@ibgib/web-gib 0.0.49 → 0.0.50

package/src/identity/sso/sso-custodian-service.respec.mts

@@ -0,0 +1,206 @@
+import { generateKeyPairSync, createSign } from 'node:crypto';
+import { 
+    respecfully, 
+    ifWeMight, 
+    iReckon, 
+    firstOfAll, 
+    lastOfAll 
+} from '@ibgib/helper-gib/dist/respec-gib/respec-gib.mjs';
+import { SsoCustodianService } from './sso-custodian-service.mjs';
+import { SsoServerConfig } from './sso-types.mjs';
+import { POOL_ID_CUSTODIAN_MANAGE } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
+
+const maam = `[${import.meta.url}]`, sir = maam;
+
+await respecfully(sir, 'SsoCustodianService', async () => {
+    let mockPrivateKey: any;
+    let mockPublicKeyJwk: any;
+    let originalFetch: any;
+
+    firstOfAll(sir, async () => {
+        // Generate mock RSA key pair
+        const { privateKey, publicKey } = generateKeyPairSync('rsa', {
+            modulusLength: 2048
+        });
+        mockPrivateKey = privateKey;
+        
+        // Export public key as JWK
+        mockPublicKeyJwk = publicKey.export({ format: 'jwk' });
+        mockPublicKeyJwk.kid = 'mock-kid-123';
+        mockPublicKeyJwk.alg = 'RS256';
+        mockPublicKeyJwk.use = 'sig';
+
+        // Mock global fetch to return JWKS containing the mock public key
+        originalFetch = (globalThis as any).fetch;
+        (globalThis as any).fetch = async (url: string, options?: any) => {
+            if (url === 'https://www.googleapis.com/oauth2/v3/certs') {
+                return {
+                    ok: true,
+                    status: 200,
+                    json: async () => ({
+                        keys: [mockPublicKeyJwk]
+                    })
+                } as any;
+            }
+            return {
+                ok: false,
+                status: 404,
+                text: async () => 'Not Found'
+            } as any;
+        };
+    });
+
+    lastOfAll(sir, async () => {
+        // Restore global fetch
+        if (originalFetch) {
+            (globalThis as any).fetch = originalFetch;
+        }
+    });
+
+    await ifWeMight(sir, 'verify dynamic RSA RS256 JWT signature successfully', async () => {
+        const config: SsoServerConfig = {
+            ssoServerKdfSecret: 'mock-kdf-secret',
+            sessionSecret: 'mock-session-secret',
+            providers: {
+                google: {
+                    providerId: 'google',
+                    clientId: 'google-client-id-123',
+                    clientSecret: 'google-client-secret-123',
+                    tokenUrl: 'https://oauth2.googleapis.com/token',
+                    userInfoUrl: 'https://openidconnect.googleapis.com/v1/userinfo',
+                    jwksUrl: 'https://www.googleapis.com/oauth2/v3/certs'
+                }
+            }
+        };
+
+        const service = new SsoCustodianService(config);
+
+        // 1. Build JWT Header & Payload
+        const header = { alg: 'RS256', kid: 'mock-kid-123', typ: 'JWT' };
+        const payload = {
+            sub: 'user-sub-999',
+            email: 'user@example.com',
+            name: 'John Doe',
+            aud: 'google-client-id-123',
+            iss: 'https://accounts.google.com',
+            exp: Math.floor(Date.now() / 1000) + 3600 // expires in 1 hour
+        };
+
+        const headerB64 = Buffer.from(JSON.stringify(header)).toString('base64url');
+        const payloadB64 = Buffer.from(JSON.stringify(payload)).toString('base64url');
+        const data = `${headerB64}.${payloadB64}`;
+
+        // 2. Sign JWT using private key
+        const sign = createSign('RSA-SHA256');
+        sign.update(data);
+        const signatureB64 = sign.sign(mockPrivateKey, 'base64url');
+
+        const mockJwtToken = `${data}.${signatureB64}`;
+
+        // 3. Verify signature via service
+        const decodedPayload = await service.verifyJwt(mockJwtToken, config.providers.google!);
+
+        iReckon(sir, decodedPayload.sub).isGonnaBe('user-sub-999');
+        iReckon(sir, decodedPayload.email).isGonnaBe('user@example.com');
+        iReckon(sir, decodedPayload.name).isGonnaBe('John Doe');
+    });
+
+    await ifWeMight(sir, 'fail validation if JWT has invalid signature', async () => {
+        const config: SsoServerConfig = {
+            ssoServerKdfSecret: 'mock-kdf-secret',
+            sessionSecret: 'mock-session-secret',
+            providers: {
+                google: {
+                    providerId: 'google',
+                    clientId: 'google-client-id-123',
+                    clientSecret: 'google-client-secret-123',
+                    tokenUrl: 'https://oauth2.googleapis.com/token',
+                    userInfoUrl: 'https://openidconnect.googleapis.com/v1/userinfo',
+                    jwksUrl: 'https://www.googleapis.com/oauth2/v3/certs'
+                }
+            }
+        };
+
+        const service = new SsoCustodianService(config);
+
+        const header = { alg: 'RS256', kid: 'mock-kid-123', typ: 'JWT' };
+        const payload = {
+            sub: 'user-sub-999',
+            aud: 'google-client-id-123',
+            exp: Math.floor(Date.now() / 1000) + 3600
+        };
+
+        const headerB64 = Buffer.from(JSON.stringify(header)).toString('base64url');
+        const payloadB64 = Buffer.from(JSON.stringify(payload)).toString('base64url');
+        const data = `${headerB64}.${payloadB64}`;
+
+        // Create signature using a different/unregistered RSA key
+        const { privateKey: badPrivateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
+        const sign = createSign('RSA-SHA256');
+        sign.update(data);
+        const badSignatureB64 = sign.sign(badPrivateKey, 'base64url');
+
+        const badJwtToken = `${data}.${badSignatureB64}`;
+
+        let verifyError: any;
+        try {
+            await service.verifyJwt(badJwtToken, config.providers.google!);
+        } catch (error: any) {
+            verifyError = error;
+        }
+
+        iReckon(sir, verifyError).not.isGonnaBeUndefined();
+        iReckon(sir, verifyError.message).includes('Cryptographic signature verification failed');
+    });
+
+    await ifWeMight(sir, 'derive server-delegate secret deterministically', async () => {
+        const config: SsoServerConfig = {
+            ssoServerKdfSecret: 'high-entropy-server-kdf-secret',
+            sessionSecret: 'session-secret-123',
+            providers: {}
+        };
+        const service = new SsoCustodianService(config);
+
+        const key = 'google:123456789';
+        const nonce1 = 'nonce-abc-123';
+        const nonce2 = 'nonce-def-456';
+
+        const secret1_a = await service.deriveServerDelegateSecret(key, nonce1);
+        const secret1_b = await service.deriveServerDelegateSecret(key, nonce1);
+        const secret2 = await service.deriveServerDelegateSecret(key, nonce2);
+
+        // Identical inputs must yield identical outputs
+        iReckon(sir, secret1_a).isGonnaBe(secret1_b);
+        // Different nonces must yield different outputs
+        iReckon(sir, secret1_a).not.isGonnaBe(secret2);
+        // Derived secrets must be string type with high entropy
+        iReckon(sir, typeof secret1_a).isGonnaBe('string');
+        iReckon(sir, secret1_a.length).isGonnaBe(128); // sha512 output in hex/base64 wrap
+    });
+
+    await ifWeMight(sir, 'create custodian challenge pool successfully', async () => {
+        const config: SsoServerConfig = {
+            ssoServerKdfSecret: 'high-entropy-server-kdf-secret',
+            sessionSecret: 'session-secret-123',
+            providers: {}
+        };
+        const service = new SsoCustodianService(config);
+
+        const key = 'google:123456789';
+        const nonce = 'nonce-abc-123';
+
+        const custodianPool = await service.createCustodianChallengePool(
+            key,
+            nonce
+        );
+
+        iReckon(sir, custodianPool).not.isGonnaBeUndefined();
+        iReckon(sir, custodianPool.id).willEqual(POOL_ID_CUSTODIAN_MANAGE);
+        iReckon(sir, custodianPool.isForeign).isGonnaBeTrue();
+        iReckon(sir, custodianPool.metadata?.providerKey).willEqual(key);
+        
+        // Structural validation of challenges
+        const challengesCount = Object.keys(custodianPool.challenges).length;
+        iReckon(sir, challengesCount).willEqual(custodianPool.config.behavior.size);
+    });
+});

package/src/identity/sso/sso-types.mts

@@ -0,0 +1,44 @@
+/**
+ * @module identity/sso/sso-types
+ *
+ * Core types and interfaces for extensible SSO (OAuth2) authentication.
+ */
+
+export type SsoProviderId = 'google' | 'github';
+
+export interface SsoProviderClientConfig {
+    providerId: SsoProviderId;
+    clientId: string;
+    authUrl: string;
+    redirectUri: string;
+    scope: string;
+}
+
+export interface SsoProviderServerConfig {
+    providerId: SsoProviderId;
+    clientId: string;
+    clientSecret: string;
+    tokenUrl: string;
+    userInfoUrl: string;
+    jwksUrl?: string;
+}
+
+export interface SsoServerConfig {
+    /** Server's private KDF secret used to derive server-delegate keystones. */
+    ssoServerKdfSecret: string;
+    /** Server's private session encryption secret. */
+    sessionSecret: string;
+    /** Map of active OAuth2 providers. */
+    providers: Partial<Record<SsoProviderId, SsoProviderServerConfig>>;
+}
+
+export interface OAuthUserInfo {
+    /** Unique identity key combining provider and sub ID (e.g., `google:107632...`). */
+    providerKey: string;
+    providerId: SsoProviderId;
+    /** Unique user ID within the provider. */
+    sub: string;
+    email?: string;
+    name?: string;
+    picture?: string;
+}

package/src/ui/component/README.md

@@ -192,10 +192,62 @@ export class MyFormInstance extends IbGibFormInstanceBase {
             // ... perform business logic / space evolution ...
             this.setStatus("Form successfully submitted!", "success");
         } catch (err) {
-            this.setStatus(`Error occurred: ${err.message}`, "error");
+            // ...
         } finally {
             this.setLoading(false, '#btn-submit');
         }
     }
 }
 ```
+
+---
+
+## 🗂️ Parent / Child Tab Components
+
+For complex views that act as shells containing other interactive component tabs (e.g. `ibgib-projects` or `ibgib-identity-manager`), the framework provides specialized parent classes:
+
+*   **`IbGibDynamicComponentInstanceBase_Parent<TIbGib, TElements, TChildInfo>`**:
+    Base class coordinating child injection, child components mapping, and activation of a specific backing child `ibgib` address.
+*   **`IbGibDynamicComponentInstanceBase_ParentOfTabs<TSettings, TIbGib, TElements, TChildInfo>`**:
+    Extends the Parent base class to integrate tab state persistence using `SettingsWithTabs` (e.g. saving which child tabs are open and which one is active).
+
+### Core Tab Integration Steps
+
+1.  **Define Tab Info**: Define a tab interface that extends `ChildInfoBase<TComponent>`:
+    ```typescript
+    interface MyTabInfo extends ChildInfoBase<IbGibDynamicComponentInstance<any, any>> {
+        // Add custom metadata if needed (e.g. component cache, lens modes)
+    }
+    ```
+2.  **Parent Class Configuration**: Extend `IbGibDynamicComponentInstanceBase_ParentOfTabs` and define `settingsType` and `getLoadedChildInfo()`:
+    ```typescript
+    export class MyParentComponent extends IbGibDynamicComponentInstanceBase_ParentOfTabs<
+        Settings_MyParent, IbGib_V1, MyElements, MyTabInfo
+    > {
+        protected get settingsType() { return SettingsType.myParent; }
+
+        protected async getLoadedChildInfo({ addr, ibGib }) {
+            // Check if tab info exists in this.childInfos, else instantiate
+            // the child component using componentSvc.getComponentInstance
+        }
+
+        protected async addChild({ addr, ibGib }) {
+            // Create tab button element, attach listener, append to DOM, and return it
+        }
+
+        protected async removeTabBtn({ tabInfo }) {
+            // Remove tab button element from DOM
+        }
+    }
+    ```
+3.  **Dynamic Delegate Tab Navigation**: 
+    To allow deep links or delegate views (e.g. clicking a delegate key to open its details in a temporary sub-tab), have the child component dispatch a bubbling Custom Event:
+    ```typescript
+    this.dispatchEvent(new CustomEvent('ibgib-view-details-request', {
+        detail: { addr: delegateAddr },
+        bubbles: true,
+        composed: true
+    }));
+    ```
+    The parent component listens to this event in `created()` and triggers `activateIbGib({ addr })` to dynamically open and activate the sub-tab.
+