@hollware/server 0.3.0 → 0.4.0

package/dist/{ceremonies-D7tsWU3S.mjs → ceremonies-V_1BbmZQ.mjs}

@@ -1,4 +1,4 @@
-import { a as findInvitation, c as invitationById, d as saveChallenge, f as takeChallenge, i as createUser, l as passkeysOf, m as userHandle, o as findPasskey, p as touchPasskey, r as createSession, t as addPasskey, u as redeemInvitation } from "./store-Sq0pwUQv.mjs";
+import { a as findInvitation, c as invitationById, d as redeemInvitation, f as saveChallenge, h as userHandle, i as createUser, m as touchPasskey, o as findPasskey, p as takeChallenge, r as createSession, t as addPasskey, u as passkeysOf } from "./store-CsuER6J7.mjs";
 import { HollwareError, newId } from "@hollware/core";
 import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse } from "@simplewebauthn/server";
 import { isoBase64URL } from "@simplewebauthn/server/helpers";
@@ -17,10 +17,10 @@ function refused(message, fix) {
 }
 /** The options of `navigator.credentials.create` for the person of an invitation. */
 async function registrationOptions(ceremony, invitationSecret) {
-	const invitation = await findInvitation(ceremony.db, ceremony.site, invitationSecret, ceremony.now);
+	const invitation = await findInvitation(ceremony.db, invitationSecret, ceremony.now);
 	if (invitation === null) throw refused("This link is not valid: it was used already, or it expired.", "Ask the owner of this Hollware for a new invitation.");
 	const userId = invitation.userId ?? newId("usr");
-	const existing = invitation.userId === null ? [] : await passkeysOf(ceremony.db, ceremony.site, invitation.userId);
+	const existing = invitation.userId === null ? [] : await passkeysOf(ceremony.db, invitation.userId);
 	const rp = relyingParty(ceremony);
 	const options = await generateRegistrationOptions({
 		rpName: "Hollware",
@@ -36,7 +36,6 @@ async function registrationOptions(ceremony, invitationSecret) {
 	});
 	return {
 		challengeId: await saveChallenge(ceremony.db, {
-			site: ceremony.site,
 			challenge: options.challenge,
 			purpose: "register",
 			invitationId: invitation.id,
@@ -52,7 +51,6 @@ async function registrationOptions(ceremony, invitationSecret) {
 */
 async function verifyRegistration(ceremony, input) {
 	const challenge = await takeChallenge(ceremony.db, {
-		site: ceremony.site,
 		id: input.challengeId,
 		purpose: "register",
 		now: ceremony.now
@@ -66,18 +64,17 @@ async function verifyRegistration(ceremony, input) {
 		expectedRPID: rp.id
 	});
 	if (!verified.verified) throw refused("The passkey could not be verified.", "Try again.");
-	const invitation = await invitationById(ceremony.db, ceremony.site, challenge.invitationId);
-	if (invitation === null || !await redeemInvitation(ceremony.db, ceremony.site, invitation.id, ceremony.now)) throw refused("This link is not valid: it was used already, or it expired.", "Ask the owner of this Hollware for a new invitation.");
+	const invitation = await invitationById(ceremony.db, challenge.invitationId);
+	if (invitation === null || !await redeemInvitation(ceremony.db, invitation.id, ceremony.now)) throw refused("This link is not valid: it was used already, or it expired.", "Ask the owner of this Hollware for a new invitation.");
 	if (invitation.userId === null) await createUser(ceremony.db, {
 		id: challenge.userId,
 		name: input.name.trim() === "" ? "Unnamed" : input.name.trim(),
 		role: invitation.role,
-		site: ceremony.site,
+		site: invitation.site,
 		now: ceremony.now
 	});
 	const { credential } = verified.registrationInfo;
 	await addPasskey(ceremony.db, {
-		site: ceremony.site,
 		userId: challenge.userId,
 		credentialId: credential.id,
 		publicKey: isoBase64URL.fromBuffer(credential.publicKey),
@@ -87,7 +84,6 @@ async function verifyRegistration(ceremony, input) {
 		now: ceremony.now
 	});
 	const session = await createSession(ceremony.db, {
-		site: ceremony.site,
 		userId: challenge.userId,
 		now: ceremony.now,
 		hours: SESSION_HOURS
@@ -97,7 +93,7 @@ async function verifyRegistration(ceremony, input) {
 		session: session.secret
 	};
 }
-/** The options of `navigator.credentials.get`: any passkey of this site, chosen by the person. */
+/** The options of `navigator.credentials.get`: any passkey of this deployment, chosen by the person. */
 async function authenticationOptions(ceremony) {
 	const rp = relyingParty(ceremony);
 	const options = await generateAuthenticationOptions({
@@ -106,7 +102,6 @@ async function authenticationOptions(ceremony) {
 	});
 	return {
 		challengeId: await saveChallenge(ceremony.db, {
-			site: ceremony.site,
 			challenge: options.challenge,
 			purpose: "authenticate",
 			invitationId: null,
@@ -116,16 +111,15 @@ async function authenticationOptions(ceremony) {
 		options
 	};
 }
-/** Verifies a sign-in with a passkey of this site, and opens the person's session. */
+/** Verifies a sign-in with a passkey of this deployment, and opens the person's session. */
 async function verifyAuthentication(ceremony, input) {
 	const challenge = await takeChallenge(ceremony.db, {
-		site: ceremony.site,
 		id: input.challengeId,
 		purpose: "authenticate",
 		now: ceremony.now
 	});
 	if (challenge === null) throw refused("The sign-in expired.", "Sign in again.");
-	const passkey = await findPasskey(ceremony.db, ceremony.site, input.response.id);
+	const passkey = await findPasskey(ceremony.db, input.response.id);
 	if (passkey === null) throw refused("This passkey is not one of this Hollware.", "Use a passkey you registered here.");
 	const rp = relyingParty(ceremony);
 	const verified = await verifyAuthenticationResponse({
@@ -143,7 +137,6 @@ async function verifyAuthentication(ceremony, input) {
 	if (!verified.verified) throw refused("The passkey could not be verified.", "Try again.");
 	await touchPasskey(ceremony.db, passkey.id, verified.authenticationInfo.newCounter, ceremony.now);
 	const session = await createSession(ceremony.db, {
-		site: ceremony.site,
 		userId: passkey.userId,
 		now: ceremony.now,
 		hours: SESSION_HOURS

package/dist/index.d.mts

@@ -333,6 +333,17 @@ type Principal = {
   readonly site: string;
   /** The scopes of the grant intersected with those of the user's role, as of now. */
   readonly scopes: readonly Scope[];
+} | {
+  /**
+   * A read token (`hw_read_`): it reads the published content of its site over the read API,
+   * and the gateway turns it away from every other route.
+   */
+  readonly kind: 'read';
+  readonly userId: string;
+  readonly tokenId: string;
+  readonly site: string;
+  /** `content:read` while its user's role has it, else nothing. */
+  readonly scopes: readonly Scope[];
 } | {
   /** A Worker of the same account, over the RPC binding: it reads published content. */
   readonly kind: 'binding';