@ibgib/node-gib 0.0.19 → 0.0.21

package/src/serve-gib/handlers/api/keystone/sso-link.handler.mts

@@ -1,26 +1,20 @@
 import { extractErrorMsg } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
-import { loadSsoServerConfig } from '../../../../identity/sso/sso-config-helper.mjs';
-import { SsoCustodianService } from '../../../../identity/sso/sso-custodian-service.mjs';
+import { getIbAndGib, getIbGibAddr } from '@ibgib/ts-gib/dist/helper.mjs';
+import { getGibInfo } from '@ibgib/ts-gib/dist/V1/transforms/transform-helper.mjs';
+import { getSsoCustodianService } from '../../../../identity/sso/sso-custodian-service.mjs';
 import { SsoProviderId } from '../../../../identity/sso/sso-types.mjs';
 import { isSsoProviderLinked } from '@ibgib/web-gib/dist/identity/sso/sso-helpers.mjs';
 import { KeystoneService_V1 } from '@ibgib/core-gib/dist/keystone/keystone-service-v1.mjs';
 import { getIdentityIndexService } from '../../../identity-index/identity-index-service.mjs';
+import { loadSsoServerConfig } from '../../../../identity/sso/sso-config-helper.mjs';
+import { generateCustodianRequirements } from '../../../../identity/sso/custodian-auth-helpers.mjs';
 
 import { GLOBAL_LOG_A_LOT } from '../../../constants.mjs';
 import { ServeGibHandlerWithMetaspaceBase } from '../../handler-base.mjs';
 import { API_PATH_REGEXES } from '../../../path-constants.mjs';
 import { ParamsWithDomain, RequestContext, ResponseResult, ServeGibHttpMethod } from '../../../types.mjs';
 
-const logalot = GLOBAL_LOG_A_LOT;
-
-let custodian: SsoCustodianService | undefined;
-function getCustodian(): SsoCustodianService {
-    if (!custodian) {
-        const config = loadSsoServerConfig();
-        custodian = new SsoCustodianService(config);
-    }
-    return custodian;
-}
+const logalot = GLOBAL_LOG_A_LOT || true;
 
 interface LinkParams extends ParamsWithDomain {
     parentTjpAddr: string;
@@ -46,18 +40,33 @@ export class SsoLinkHandler extends ServeGibHandlerWithMetaspaceBase<LinkParams,
     protected override regex = API_PATH_REGEXES.IDENTITY_SSO_LINK;
 
     protected override async parseParamsImpl(reqCtx: RequestContext<LinkParams, any>): Promise<LinkParams | undefined> {
-        let parsed: any;
+        const lc = `${this.lc}[${this.parseParamsImpl.name}]`;
         try {
-            parsed = JSON.parse(reqCtx.body);
-        } catch {
-            return undefined;
+            if (logalot) { console.log(`${lc} starting... (I: a38f2cee647c127b48ec6ad1e8d1e826)`); }
+
+            let parsed: any;
+            try {
+                parsed = JSON.parse(reqCtx.body);
+            } catch {
+                return undefined;
+            }
+            let parentTjpAddr = parsed?.parentTjpAddr;
+            if (!parentTjpAddr) { return undefined; }
+            const { ib } = getIbAndGib({ ibGibAddr: parentTjpAddr });
+            const { tjpGib } = getGibInfo({ ibGibAddr: parentTjpAddr });
+            if (tjpGib && ib) {
+                parentTjpAddr = `${ib}^${tjpGib}`;
+            }
+            return {
+                parentTjpAddr,
+                domainInfo: this.getDomainInfo({ domainAddr: parentTjpAddr })
+            };
+        } catch (error) {
+            console.error(`${lc} ${extractErrorMsg(error)}`);
+            throw error;
+        } finally {
+            if (logalot) { console.log(`${lc} complete.`); }
         }
-        const parentTjpAddr = parsed?.parentTjpAddr;
-        if (!parentTjpAddr) { return undefined; }
-        return {
-            parentTjpAddr,
-            domainInfo: this.getDomainInfo({ domainAddr: parentTjpAddr })
-        };
     }
 
     protected override async validateQueryParams({ queryParams }: { queryParams: any }): Promise<string[]> {
@@ -83,11 +92,19 @@ export class SsoLinkHandler extends ServeGibHandlerWithMetaspaceBase<LinkParams,
                 return this.error(400, 'Request body must be valid JSON (E: e1b2c3d4e5f67890a1b2c3d4e5f67890)');
             }
 
-            const { code, providerId, parentTjpAddr, userNonce, redirectUri } = parsed;
+            let { code, providerId, parentTjpAddr, userNonce, redirectUri } = parsed;
             if (!code || !providerId || !parentTjpAddr || !userNonce || !redirectUri) {
                 return this.error(400, 'Body missing required parameters (code, providerId, parentTjpAddr, userNonce, redirectUri) (E: f2c3d4e5f6789012a3b4c5d6e7f89012)');
             }
 
+            if (logalot) { console.log(`${lc} LinkBody parsed (I: 7525b8bd29c8504e989e918825d4e826)`); }
+
+            const { ib } = getIbAndGib({ ibGibAddr: parentTjpAddr });
+            const { tjpGib } = getGibInfo({ ibGibAddr: parentTjpAddr });
+            if (tjpGib && ib) {
+                parentTjpAddr = `${ib}^${tjpGib}`;
+            }
+
             const space = await reqCtx.metaspace.getLocalUserSpace({ lock: false });
             if (!space) {
                 return this.error(500, 'No local user space found in domain metaspace (E: 03d4e5f678901234b5c6d7e8f9012345)');
@@ -104,12 +121,22 @@ export class SsoLinkHandler extends ServeGibHandlerWithMetaspaceBase<LinkParams,
                 return this.error(400, `Keystone not found for address: ${parentTjpAddr} (E: 14e5f67890123456c7d8e9f012345678)`);
             }
 
-            if (isSsoProviderLinked({ keystone: targetKeystone, providerId })) {
+            if (logalot) {
+                console.log(`${lc} targetKeystone gotten. addr: ${getIbGibAddr({ ibGib: targetKeystone })}, pools: ${JSON.stringify(targetKeystone.data?.challengePools?.map(p => p.id))}, frameDetails: ${JSON.stringify(targetKeystone.data?.frameDetails)} (I: 3d2068e16cb4da0428d601a7a74e3826)`);
+            }
+
+            const isLinked = isSsoProviderLinked({ keystone: targetKeystone, providerId });
+            if (logalot) {
+                console.log(`${lc} isSsoProviderLinked for ${providerId}: ${isLinked}`);
+            }
+
+            if (isLinked) {
                 return this.error(400, `SSO provider "${providerId}" is already linked to this keystone. (E: 25f6789012345678d9e0f12345678901)`);
             }
 
             // 1. Authenticate with provider and retrieve user info
-            const service = getCustodian();
+            const service = getSsoCustodianService();
+            if (logalot) { console.log(`${lc} getSsoCustodianService returned (I: f7e0b290ed2a2dcde807ff2853016226)`); }
             const userInfo = await service.getOAuthUserInfo(providerId, code, redirectUri);
 
             if (userInfo.email) {
@@ -136,9 +163,17 @@ export class SsoLinkHandler extends ServeGibHandlerWithMetaspaceBase<LinkParams,
 
             console.log(`${lc} created custodian pool for: ${userInfo.providerKey} (I: 4718901234567890f1a2b34567890123)`);
 
+            const ssoConfig = loadSsoServerConfig();
+            const serverSecret = ssoConfig.ssoServerKdfSecret;
+            const custodianReqs = await generateCustodianRequirements({
+                primaryTjpAddr: parentTjpAddr,
+                serverSecret
+            });
+
             return this.ok({
                 success: true,
-                custodianPool
+                custodianPool,
+                custodianReqs
             }, 200);
 
         } catch (error) {

package/src/serve-gib/handlers/api/keystone/sso-login.handler.mts

@@ -19,22 +19,13 @@ import { API_PATH_REGEXES } from '../../../path-constants.mjs';
 import { RequestContext, ResponseResult, ServeGibHttpMethod } from '../../../types.mjs';
 import { bootstrapDomainMetaspace } from '../../../bootstrap-helper.mjs';
 import { loadSsoServerConfig } from '../../../../identity/sso/sso-config-helper.mjs';
-import { SsoCustodianService } from '../../../../identity/sso/sso-custodian-service.mjs';
+import { getSsoCustodianService } from '../../../../identity/sso/sso-custodian-service.mjs';
 import { SsoProviderId } from '../../../../identity/sso/sso-types.mjs';
 import { getIdentityIndexService } from '../../../identity-index/identity-index-service.mjs';
 import { generateCustodianRequirements } from '../../../../identity/sso/custodian-auth-helpers.mjs';
 
 const logalot = GLOBAL_LOG_A_LOT;
 
-let custodian: SsoCustodianService | undefined;
-function getCustodian(): SsoCustodianService {
-    if (!custodian) {
-        const config = loadSsoServerConfig();
-        custodian = new SsoCustodianService(config);
-    }
-    return custodian;
-}
-
 export interface SsoLoginBody {
     code: string;
     providerId: SsoProviderId;
@@ -95,7 +86,7 @@ export class SsoLoginHandler extends ServeGibHandlerBase<undefined, undefined> {
             }
 
             // 1. Authenticate code with provider and retrieve normalized user info
-            const service = getCustodian();
+            const service = getSsoCustodianService();
             const userInfo = await service.getOAuthUserInfo(providerId, code, redirectUri);
 
             if (!userInfo || !userInfo.email) {
@@ -149,6 +140,7 @@ export class SsoLoginHandler extends ServeGibHandlerBase<undefined, undefined> {
                         client: 'space-gib-server',
                         role: 'custodian-primary',
                         custodianProvider: providerId,
+                        custodyMode: 'full',
                         [`rawSSOName-${providerId}`]: rawSSOName,
                     });
 

package/src/serve-gib/identity-index/identity-index-service.mts

@@ -83,29 +83,39 @@ export class IdentityIndexService {
         tjpAddr?: IbGibAddr;
         primaryTjpAddr?: IbGibAddr;
     }): Promise<RegisterEmailIndexResult> {
-        const targetAddr = tjpAddr || primaryTjpAddr;
-        if (!targetAddr) { throw new Error('Either tjpAddr or primaryTjpAddr must be provided. (E: 62f15851b9a8c8d718279ab84e426826)'); }
-        const emailHash = await getIdentityEmailHash({ email, salt: this.salt });
-        const { folderPath, filePath } = getShardedIndexPath({
-            baseDir: this.baseDir,
-            emailHash
-        });
+        const lc = `${this.lc}[${this.registerEmailIndex.name}]`;
+        try {
+            if (logalot) { console.log(`${lc} starting... (I: 5d1728a955657616a8cf6ce8b5afa226)`); }
 
-        await fs.mkdir(folderPath, { recursive: true });
+            const targetAddr = tjpAddr || primaryTjpAddr;
+            if (!targetAddr) { throw new Error('Either tjpAddr or primaryTjpAddr must be provided. (E: 62f15851b9a8c8d718279ab84e426826)'); }
+            const emailHash = await getIdentityEmailHash({ email, salt: this.salt });
+            const { folderPath, filePath } = getShardedIndexPath({
+                baseDir: this.baseDir,
+                emailHash
+            });
 
-        const record: IdentityIndexRecord = {
-            tjpAddr: targetAddr,
-            createdAt: Date.now(),
-        };
+            await fs.mkdir(folderPath, { recursive: true });
 
-        try {
-            await fs.writeFile(filePath, JSON.stringify(record, null, 2), { flag: 'wx' });
-            return { emailHash, filePath, record };
-        } catch (error: any) {
-            if (error.code === 'EEXIST') {
-                throw new Error(`Email is already registered (E: duplicate_identity_409)`);
+            const record: IdentityIndexRecord = {
+                tjpAddr: targetAddr,
+                createdAt: Date.now(),
+            };
+
+            try {
+                await fs.writeFile(filePath, JSON.stringify(record, null, 2), { flag: 'wx' });
+                return { emailHash, filePath, record };
+            } catch (error: any) {
+                if (error.code === 'EEXIST') {
+                    throw new Error(`Email is already registered (E: duplicate_identity_409)`);
+                }
+                throw error;
             }
+        } catch (error) {
+            console.error(`${lc} ${extractErrorMsg(error)}`);
             throw error;
+        } finally {
+            if (logalot) { console.log(`${lc} complete.`); }
         }
     }
 
@@ -218,9 +228,19 @@ let _identityIndexService: IdentityIndexService | undefined;
 /**
  * Singleton factory getter for the IdentityIndexService.
  */
-export function getIdentityIndexService(): IdentityIndexService {
+export function getIdentityIndexService(opts?: IdentityIndexServiceOptions): IdentityIndexService {
+    if (opts) {
+        return new IdentityIndexService(opts);
+    }
     if (!_identityIndexService) {
         _identityIndexService = new IdentityIndexService();
     }
     return _identityIndexService;
 }
+
+/**
+ * Resets the cached singleton instance (useful during testing across different data directories).
+ */
+export function resetIdentityIndexService(): void {
+    _identityIndexService = undefined;
+}

package/src/serve-gib/index.mts

@@ -36,6 +36,7 @@ export * from './handlers/api/keystone/sso-link.handler.mjs';
 export * from './handlers/api/keystone/sso-login.handler.mjs';
 export * from './handlers/api/identity/keystone-custodian-genesis.handler.mjs';
 export * from './handlers/api/identity/keystone-custodian-register-delegate.handler.mjs';
+export * from './handlers/api/identity/keystone-custodian-add-master-password.handler.mjs';
 export * from './handlers/api/email/email-inbound.handler.mjs';
 export * from './handlers/api/email/email-outbound.handler.mjs';
 export * from './handlers/api/email/email-verification-code.handler.mjs';
@@ -60,6 +61,7 @@ import { SsoLoginHandler } from './handlers/api/keystone/sso-login.handler.mjs';
 import { SsoConfigHandler } from './handlers/api/keystone/sso-config.handler.mjs';
 import { KeystoneCustodianGenesisHandler } from './handlers/api/identity/keystone-custodian-genesis.handler.mjs';
 import { KeystoneCustodianRegisterDelegateHandler } from './handlers/api/identity/keystone-custodian-register-delegate.handler.mjs';
+import { KeystoneCustodianAddMasterPasswordHandler } from './handlers/api/identity/keystone-custodian-add-master-password.handler.mjs';
 import { EmailInboundHandler } from './handlers/api/email/email-inbound.handler.mjs';
 import { EmailOutboundHandler } from './handlers/api/email/email-outbound.handler.mjs';
 import { EmailVerificationCodeHandler } from './handlers/api/email/email-verification-code.handler.mjs';
@@ -89,6 +91,7 @@ export function getStandardServeGibHandlers(opts: StandardHandlersOptions = {}):
         new SsoConfigHandler(),
         new KeystoneCustodianGenesisHandler(),
         new KeystoneCustodianRegisterDelegateHandler(),
+        new KeystoneCustodianAddMasterPasswordHandler(),
         new EmailInboundHandler(),
         new EmailOutboundHandler(),
         new EmailVerificationCodeHandler(),

package/src/serve-gib/path-constants.mts

@@ -134,6 +134,11 @@ export const API_PATH_REGEXES = {
      * /api/identity/custodian/register-delegate
      */
     KEYSTONE_CUSTODIAN_REGISTER_DELEGATE: /^\/api\/identity\/custodian\/register-delegate\/?$/i,
+
+    /**
+     * /api/identity/custodian/add-master-password
+     */
+    KEYSTONE_CUSTODIAN_ADD_MASTER_PASSWORD: /^\/api\/identity\/custodian\/add-master-password\/?$/i,
 };
 
 export const VALID_STATIC_PATH_REGEX = /^\/[a-zA-Z0-9\-_\.\/]*$/;