@ibgib/web-gib 0.0.49 → 0.0.51

package/dist/identity/sso/sso-custodian-service.respec.mjs

@@ -0,0 +1,254 @@
+import { generateKeyPairSync, createSign } from 'node:crypto';
+import { respecfully, ifWeMight, iReckon, firstOfAll, lastOfAll } from '@ibgib/helper-gib/dist/respec-gib/respec-gib.mjs';
+import { SsoCustodianService } from './sso-custodian-service.mjs';
+import { POOL_ID_MANAGE } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
+import { createStandardPoolConfig } from '@ibgib/core-gib/dist/keystone/keystone-config-builder.mjs';
+const maam = `[${import.meta.url}]`, sir = maam;
+await respecfully(sir, 'SsoCustodianService', async () => {
+    let mockPrivateKey;
+    let mockPublicKeyJwk;
+    let originalFetch;
+    firstOfAll(sir, async () => {
+        // Generate mock RSA key pair
+        const { privateKey, publicKey } = generateKeyPairSync('rsa', {
+            modulusLength: 2048
+        });
+        mockPrivateKey = privateKey;
+        // Export public key as JWK
+        mockPublicKeyJwk = publicKey.export({ format: 'jwk' });
+        mockPublicKeyJwk.kid = 'mock-kid-123';
+        mockPublicKeyJwk.alg = 'RS256';
+        mockPublicKeyJwk.use = 'sig';
+        // Mock global fetch to return JWKS containing the mock public key
+        originalFetch = globalThis.fetch;
+        globalThis.fetch = async (url, options) => {
+            if (url === 'https://www.googleapis.com/oauth2/v3/certs') {
+                return {
+                    ok: true,
+                    status: 200,
+                    json: async () => ({
+                        keys: [mockPublicKeyJwk]
+                    })
+                };
+            }
+            return {
+                ok: false,
+                status: 404,
+                text: async () => 'Not Found'
+            };
+        };
+    });
+    lastOfAll(sir, async () => {
+        // Restore global fetch
+        if (originalFetch) {
+            globalThis.fetch = originalFetch;
+        }
+    });
+    await ifWeMight(sir, 'verify dynamic RSA RS256 JWT signature successfully', async () => {
+        const config = {
+            ssoServerKdfSecret: 'mock-kdf-secret',
+            sessionSecret: 'mock-session-secret',
+            providers: {
+                google: {
+                    providerId: 'google',
+                    clientId: 'google-client-id-123',
+                    clientSecret: 'google-client-secret-123',
+                    tokenUrl: 'https://oauth2.googleapis.com/token',
+                    userInfoUrl: 'https://openidconnect.googleapis.com/v1/userinfo',
+                    jwksUrl: 'https://www.googleapis.com/oauth2/v3/certs'
+                }
+            }
+        };
+        const service = new SsoCustodianService(config);
+        // 1. Build JWT Header & Payload
+        const header = { alg: 'RS256', kid: 'mock-kid-123', typ: 'JWT' };
+        const payload = {
+            sub: 'user-sub-999',
+            email: 'user@example.com',
+            name: 'John Doe',
+            aud: 'google-client-id-123',
+            iss: 'https://accounts.google.com',
+            exp: Math.floor(Date.now() / 1000) + 3600 // expires in 1 hour
+        };
+        const headerB64 = Buffer.from(JSON.stringify(header)).toString('base64url');
+        const payloadB64 = Buffer.from(JSON.stringify(payload)).toString('base64url');
+        const data = `${headerB64}.${payloadB64}`;
+        // 2. Sign JWT using private key
+        const sign = createSign('RSA-SHA256');
+        sign.update(data);
+        const signatureB64 = sign.sign(mockPrivateKey, 'base64url');
+        const mockJwtToken = `${data}.${signatureB64}`;
+        // 3. Verify signature via service
+        const decodedPayload = await service.verifyJwt(mockJwtToken, config.providers.google);
+        iReckon(sir, decodedPayload.sub).isGonnaBe('user-sub-999');
+        iReckon(sir, decodedPayload.email).isGonnaBe('user@example.com');
+        iReckon(sir, decodedPayload.name).isGonnaBe('John Doe');
+    });
+    await ifWeMight(sir, 'fail validation if JWT has invalid signature', async () => {
+        const config = {
+            ssoServerKdfSecret: 'mock-kdf-secret',
+            sessionSecret: 'mock-session-secret',
+            providers: {
+                google: {
+                    providerId: 'google',
+                    clientId: 'google-client-id-123',
+                    clientSecret: 'google-client-secret-123',
+                    tokenUrl: 'https://oauth2.googleapis.com/token',
+                    userInfoUrl: 'https://openidconnect.googleapis.com/v1/userinfo',
+                    jwksUrl: 'https://www.googleapis.com/oauth2/v3/certs'
+                }
+            }
+        };
+        const service = new SsoCustodianService(config);
+        const header = { alg: 'RS256', kid: 'mock-kid-123', typ: 'JWT' };
+        const payload = {
+            sub: 'user-sub-999',
+            aud: 'google-client-id-123',
+            exp: Math.floor(Date.now() / 1000) + 3600
+        };
+        const headerB64 = Buffer.from(JSON.stringify(header)).toString('base64url');
+        const payloadB64 = Buffer.from(JSON.stringify(payload)).toString('base64url');
+        const data = `${headerB64}.${payloadB64}`;
+        // Create signature using a different/unregistered RSA key
+        const { privateKey: badPrivateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
+        const sign = createSign('RSA-SHA256');
+        sign.update(data);
+        const badSignatureB64 = sign.sign(badPrivateKey, 'base64url');
+        const badJwtToken = `${data}.${badSignatureB64}`;
+        let verifyError;
+        try {
+            await service.verifyJwt(badJwtToken, config.providers.google);
+        }
+        catch (error) {
+            verifyError = error;
+        }
+        iReckon(sir, verifyError).not.isGonnaBeUndefined();
+        iReckon(sir, verifyError.message).includes('Cryptographic signature verification failed');
+    });
+    await ifWeMight(sir, 'derive server-delegate secret deterministically', async () => {
+        const config = {
+            ssoServerKdfSecret: 'high-entropy-server-kdf-secret',
+            sessionSecret: 'session-secret-123',
+            providers: {}
+        };
+        const service = new SsoCustodianService(config);
+        const key = 'google:123456789';
+        const nonce1 = 'nonce-abc-123';
+        const nonce2 = 'nonce-def-456';
+        const secret1_a = await service.deriveServerDelegateSecret(key, nonce1);
+        const secret1_b = await service.deriveServerDelegateSecret(key, nonce1);
+        const secret2 = await service.deriveServerDelegateSecret(key, nonce2);
+        // Identical inputs must yield identical outputs
+        iReckon(sir, secret1_a).isGonnaBe(secret1_b);
+        // Different nonces must yield different outputs
+        iReckon(sir, secret1_a).not.isGonnaBe(secret2);
+        // Derived secrets must be string type with high entropy
+        iReckon(sir, typeof secret1_a).isGonnaBe('string');
+        iReckon(sir, secret1_a.length).isGonnaBe(128); // sha512 output in hex/base64 wrap
+    });
+    await ifWeMight(sir, 'create custodian challenge pool successfully', async () => {
+        const config = {
+            ssoServerKdfSecret: 'high-entropy-server-kdf-secret',
+            sessionSecret: 'session-secret-123',
+            providers: {}
+        };
+        const service = new SsoCustodianService(config);
+        const key = 'google:123456789';
+        const nonce = 'nonce-abc-123';
+        // 1. Create a mock target keystone containing a 'manage' pool
+        const userManageConfig = createStandardPoolConfig({
+            id: POOL_ID_MANAGE,
+            salt: 'user-manage-salt'
+        });
+        userManageConfig.behavior.size = 12; // custom size for verification
+        const mockTargetKeystone = {
+            ib: 'keystone^some-tjp-addr',
+            gib: 'some-gib-value',
+            data: {
+                challengePools: [
+                    {
+                        id: 'manage',
+                        config: userManageConfig,
+                        challenges: { 'chal1': 'val1' }
+                    }
+                ],
+                n: 0
+            }
+        };
+        // 2. Mock metaspace and space calls
+        const mockSpace = {};
+        const mockMetaspace = {
+            getLatestAddr: async () => 'latest-keystone-addr',
+            get: async () => ({
+                success: true,
+                ibGibs: [mockTargetKeystone]
+            })
+        };
+        const custodianPool = await service.createCustodianChallengePool({
+            providerId: 'google',
+            providerKey: key,
+            userNonce: nonce,
+            keystoneAddr: 'some-tjp-addr',
+            metaspace: mockMetaspace,
+            space: mockSpace
+        });
+        iReckon(sir, custodianPool).not.isGonnaBeUndefined();
+        iReckon(sir, custodianPool.id).willEqual('custodian-manage-google');
+        iReckon(sir, custodianPool.isForeign).isGonnaBeTrue();
+        iReckon(sir, custodianPool.metadata?.providerKey).willEqual(key);
+        // Replicated behavior size from parent manage pool config
+        iReckon(sir, custodianPool.config.behavior.size).willEqual(userManageConfig.behavior.size);
+        // Structural validation of challenges
+        const challengesCount = Object.keys(custodianPool.challenges).length;
+        iReckon(sir, challengesCount).willEqual(custodianPool.config.behavior.size);
+    });
+    await ifWeMight(sir, 'revoke tokens successfully, making the correct http fetch calls', async () => {
+        const config = {
+            ssoServerKdfSecret: 'high-entropy-server-kdf-secret',
+            sessionSecret: 'session-secret-123',
+            providers: {
+                google: {
+                    providerId: 'google',
+                    clientId: 'google-client-id-abc',
+                    clientSecret: 'google-client-secret-abc',
+                    tokenUrl: 'https://oauth2.googleapis.com/token',
+                    userInfoUrl: 'https://openidconnect.googleapis.com/v1/userinfo'
+                },
+                github: {
+                    providerId: 'github',
+                    clientId: 'github-client-id-xyz',
+                    clientSecret: 'github-client-secret-xyz',
+                    tokenUrl: 'https://github.com/login/oauth/access_token',
+                    userInfoUrl: 'https://api.github.com/user'
+                }
+            }
+        };
+        const service = new SsoCustodianService(config);
+        const originalFetch = globalThis.fetch;
+        let fetchCalls = [];
+        globalThis.fetch = (async (url, options) => {
+            fetchCalls.push({ url, options });
+            return {
+                ok: true,
+                status: 200,
+                text: async () => 'ok'
+            };
+        });
+        try {
+            // Revoke Google token
+            await service.revokeToken('google', 'google-test-token-123');
+            iReckon(sir, fetchCalls.length).willEqual(1);
+            iReckon(sir, fetchCalls[0].url).includes('google-test-token-123');
+            // Revoke GitHub token
+            await service.revokeToken('github', 'github-test-token-456');
+            iReckon(sir, fetchCalls.length).willEqual(2);
+            iReckon(sir, fetchCalls[1].url).includes('/applications/github-client-id-xyz/grant');
+            iReckon(sir, fetchCalls[1].options.method).willEqual('DELETE');
+            iReckon(sir, fetchCalls[1].options.headers['Authorization']).includes('Basic');
+        }
+        finally {
+            globalThis.fetch = originalFetch;
+        }
+    });
+});
+//# sourceMappingURL=sso-custodian-service.respec.mjs.map

package/dist/identity/sso/sso-custodian-service.respec.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-custodian-service.respec.mjs","sourceRoot":"","sources":["../../../src/identity/sso/sso-custodian-service.respec.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EACH,WAAW,EACX,SAAS,EACT,OAAO,EACP,UAAU,EACV,SAAS,EACZ,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EAA4B,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAChH,OAAO,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AAErG,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC;AAEhD,MAAM,WAAW,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,IAAI,EAAE;IACrD,IAAI,cAAmB,CAAC;IACxB,IAAI,gBAAqB,CAAC;IAC1B,IAAI,aAAkB,CAAC;IAEvB,UAAU,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;QACvB,6BAA6B;QAC7B,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE;YACzD,aAAa,EAAE,IAAI;SACtB,CAAC,CAAC;QACH,cAAc,GAAG,UAAU,CAAC;QAE5B,2BAA2B;QAC3B,gBAAgB,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,gBAAgB,CAAC,GAAG,GAAG,cAAc,CAAC;QACtC,gBAAgB,CAAC,GAAG,GAAG,OAAO,CAAC;QAC/B,gBAAgB,CAAC,GAAG,GAAG,KAAK,CAAC;QAE7B,kEAAkE;QAClE,aAAa,GAAI,UAAkB,CAAC,KAAK,CAAC;QACzC,UAAkB,CAAC,KAAK,GAAG,KAAK,EAAE,GAAW,EAAE,OAAa,EAAE,EAAE;YAC7D,IAAI,GAAG,KAAK,4CAA4C,EAAE,CAAC;gBACvD,OAAO;oBACH,EAAE,EAAE,IAAI;oBACR,MAAM,EAAE,GAAG;oBACX,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;wBACf,IAAI,EAAE,CAAC,gBAAgB,CAAC;qBAC3B,CAAC;iBACE,CAAC;YACb,CAAC;YACD,OAAO;gBACH,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,WAAW;aACzB,CAAC;QACb,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;QACtB,uBAAuB;QACvB,IAAI,aAAa,EAAE,CAAC;YACf,UAAkB,CAAC,KAAK,GAAG,aAAa,CAAC;QAC9C,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,CAAC,GAAG,EAAE,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,MAAM,GAAoB;YAC5B,kBAAkB,EAAE,iBAAiB;YACrC,aAAa,EAAE,qBAAqB;YACpC,SAAS,EAAE;gBACP,MAAM,EAAE;oBACJ,UAAU,EAAE,QAAQ;oBACpB,QAAQ,EAAE,sBAAsB;oBAChC,YAAY,EAAE,0BAA0B;oBACxC,QAAQ,EAAE,qCAAqC;oBAC/C,WAAW,EAAE,kDAAkD;oBAC/D,OAAO,EAAE,4CAA4C;iBACxD;aACJ;SACJ,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAEhD,gCAAgC;QAChC,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACjE,MAAM,OAAO,GAAG;YACZ,GAAG,EAAE,cAAc;YACnB,KAAK,EAAE,kBAAkB;YACzB,IAAI,EAAE,UAAU;YAChB,GAAG,EAAE,sBAAsB;YAC3B,GAAG,EAAE,6BAA6B;YAClC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,oBAAoB;SACjE,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC9E,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QAE1C,gCAAgC;QAChC,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAE5D,MAAM,YAAY,GAAG,GAAG,IAAI,IAAI,YAAY,EAAE,CAAC;QAE/C,kCAAkC;QAClC,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,MAAO,CAAC,CAAC;QAEvF,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACjE,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,CAAC,GAAG,EAAE,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,MAAM,GAAoB;YAC5B,kBAAkB,EAAE,iBAAiB;YACrC,aAAa,EAAE,qBAAqB;YACpC,SAAS,EAAE;gBACP,MAAM,EAAE;oBACJ,UAAU,EAAE,QAAQ;oBACpB,QAAQ,EAAE,sBAAsB;oBAChC,YAAY,EAAE,0BAA0B;oBACxC,QAAQ,EAAE,qCAAqC;oBAC/C,WAAW,EAAE,kDAAkD;oBAC/D,OAAO,EAAE,4CAA4C;iBACxD;aACJ;SACJ,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAEhD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACjE,MAAM,OAAO,GAAG;YACZ,GAAG,EAAE,cAAc;YACnB,GAAG,EAAE,sBAAsB;YAC3B,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI;SAC5C,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC9E,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QAE1C,0DAA0D;QAC1D,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClB,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QAE9D,MAAM,WAAW,GAAG,GAAG,IAAI,IAAI,eAAe,EAAE,CAAC;QAEjD,IAAI,WAAgB,CAAC;QACrB,IAAI,CAAC;YACD,MAAM,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,MAAO,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,WAAW,GAAG,KAAK,CAAC;QACxB,CAAC;QAED,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,6CAA6C,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,CAAC,GAAG,EAAE,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,MAAM,GAAoB;YAC5B,kBAAkB,EAAE,gCAAgC;YACpD,aAAa,EAAE,oBAAoB;YACnC,SAAS,EAAE,EAAE;SAChB,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAEhD,MAAM,GAAG,GAAG,kBAAkB,CAAC;QAC/B,MAAM,MAAM,GAAG,eAAe,CAAC;QAC/B,MAAM,MAAM,GAAG,eAAe,CAAC;QAE/B,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAEtE,gDAAgD;QAChD,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC7C,gDAAgD;QAChD,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC/C,wDAAwD;QACxD,OAAO,CAAC,GAAG,EAAE,OAAO,SAAS,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,mCAAmC;IACtF,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,CAAC,GAAG,EAAE,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,MAAM,GAAoB;YAC5B,kBAAkB,EAAE,gCAAgC;YACpD,aAAa,EAAE,oBAAoB;YACnC,SAAS,EAAE,EAAE;SAChB,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAEhD,MAAM,GAAG,GAAG,kBAAkB,CAAC;QAC/B,MAAM,KAAK,GAAG,eAAe,CAAC;QAE9B,8DAA8D;QAC9D,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;YAC9C,EAAE,EAAE,cAAc;YAClB,IAAI,EAAE,kBAAkB;SAC3B,CAAC,CAAC;QACH,gBAAgB,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,+BAA+B;QACpE,MAAM,kBAAkB,GAAG;YACvB,EAAE,EAAE,wBAAwB;YAC5B,GAAG,EAAE,gBAAgB;YACrB,IAAI,EAAE;gBACF,cAAc,EAAE;oBACZ;wBACI,EAAE,EAAE,QAAQ;wBACZ,MAAM,EAAE,gBAAgB;wBACxB,UAAU,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;qBAClC;iBACJ;gBACD,CAAC,EAAE,CAAC;aACP;SACJ,CAAC;QAEF,oCAAoC;QACpC,MAAM,SAAS,GAAG,EAAE,CAAC;QACrB,MAAM,aAAa,GAAG;YAClB,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,sBAAsB;YACjD,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBACd,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,CAAC,kBAAkB,CAAC;aAC/B,CAAC;SACL,CAAC;QAEF,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,4BAA4B,CAAC;YAC7D,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE,KAAK;YAChB,YAAY,EAAE,eAAe;YAC7B,SAAS,EAAE,aAAoB;YAC/B,KAAK,EAAE,SAAgB;SAC1B,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QACrD,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC;QACtD,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAEjE,0DAA0D;QAC1D,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAE3F,sCAAsC;QACtC,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;QACrE,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,CAAC,GAAG,EAAE,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,MAAM,GAAoB;YAC5B,kBAAkB,EAAE,gCAAgC;YACpD,aAAa,EAAE,oBAAoB;YACnC,SAAS,EAAE;gBACP,MAAM,EAAE;oBACJ,UAAU,EAAE,QAAQ;oBACpB,QAAQ,EAAE,sBAAsB;oBAChC,YAAY,EAAE,0BAA0B;oBACxC,QAAQ,EAAE,qCAAqC;oBAC/C,WAAW,EAAE,kDAAkD;iBAClE;gBACD,MAAM,EAAE;oBACJ,UAAU,EAAE,QAAQ;oBACpB,QAAQ,EAAE,sBAAsB;oBAChC,YAAY,EAAE,0BAA0B;oBACxC,QAAQ,EAAE,6CAA6C;oBACvD,WAAW,EAAE,6BAA6B;iBAC7C;aACJ;SACJ,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAEhD,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC;QACvC,IAAI,UAAU,GAAoC,EAAE,CAAC;QACrD,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,GAAQ,EAAE,OAAY,EAAE,EAAE;YACjD,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;YAClC,OAAO;gBACH,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;aAClB,CAAC;QACb,CAAC,CAAQ,CAAC;QAEV,IAAI,CAAC;YACD,sBAAsB;YACtB,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;YAC7D,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC;YAElE,sBAAsB;YACtB,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;YAC7D,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,0CAA0C,CAAC,CAAC;YACrF,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC/D,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnF,CAAC;gBAAS,CAAC;YACP,UAAU,CAAC,KAAK,GAAG,aAAa,CAAC;QACrC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/identity/sso/sso-helpers.d.mts

@@ -0,0 +1,10 @@
+import { KeystoneIbGib_V1 } from '@ibgib/core-gib/dist/keystone/keystone-types.mjs';
+/**
+ * Checks if a keystone contains a custodian challenge pool for the given provider.
+ * Client-safe & server-safe with zero dependencies.
+ */
+export declare function isSsoProviderLinked({ keystone, providerId }: {
+    keystone: KeystoneIbGib_V1 | null | undefined;
+    providerId: string;
+}): boolean;
+//# sourceMappingURL=sso-helpers.d.mts.map

package/dist/identity/sso/sso-helpers.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-helpers.d.mts","sourceRoot":"","sources":["../../../src/identity/sso/sso-helpers.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,kDAAkD,CAAC;AAEpF;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,EAChC,QAAQ,EACR,UAAU,EACb,EAAE;IACC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAIV"}

package/dist/identity/sso/sso-helpers.mjs

@@ -0,0 +1,11 @@
+/**
+ * Checks if a keystone contains a custodian challenge pool for the given provider.
+ * Client-safe & server-safe with zero dependencies.
+ */
+export function isSsoProviderLinked({ keystone, providerId }) {
+    if (!keystone?.data?.challengePools)
+        return false;
+    const targetPoolId = `custodian-manage-${providerId}`;
+    return keystone.data.challengePools.some(p => p.id === targetPoolId);
+}
+//# sourceMappingURL=sso-helpers.mjs.map

package/dist/identity/sso/sso-helpers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-helpers.mjs","sourceRoot":"","sources":["../../../src/identity/sso/sso-helpers.mts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAChC,QAAQ,EACR,UAAU,EAIb;IACG,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,cAAc;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,YAAY,GAAG,oBAAoB,UAAU,EAAE,CAAC;IACtD,OAAO,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;AACzE,CAAC"}

package/dist/identity/sso/sso-types.d.mts

@@ -0,0 +1,40 @@
+/**
+ * @module identity/sso/sso-types
+ *
+ * Core types and interfaces for extensible SSO (OAuth2) authentication.
+ */
+export type SsoProviderId = 'google' | 'github';
+export interface SsoProviderClientConfig {
+    providerId: SsoProviderId;
+    clientId: string;
+    authUrl: string;
+    redirectUri: string;
+    scope: string;
+}
+export interface SsoProviderServerConfig {
+    providerId: SsoProviderId;
+    clientId: string;
+    clientSecret: string;
+    tokenUrl: string;
+    userInfoUrl: string;
+    jwksUrl?: string;
+}
+export interface SsoServerConfig {
+    /** Server's private KDF secret used to derive server-delegate keystones. */
+    ssoServerKdfSecret: string;
+    /** Server's private session encryption secret. */
+    sessionSecret: string;
+    /** Map of active OAuth2 providers. */
+    providers: Partial<Record<SsoProviderId, SsoProviderServerConfig>>;
+}
+export interface OAuthUserInfo {
+    /** Unique identity key combining provider and sub ID (e.g., `google:107632...`). */
+    providerKey: string;
+    providerId: SsoProviderId;
+    /** Unique user ID within the provider. */
+    sub: string;
+    email?: string;
+    name?: string;
+    picture?: string;
+}
+//# sourceMappingURL=sso-types.d.mts.map

package/dist/identity/sso/sso-types.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-types.d.mts","sourceRoot":"","sources":["../../../src/identity/sso/sso-types.mts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhD,MAAM,WAAW,uBAAuB;IACpC,UAAU,EAAE,aAAa,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACpC,UAAU,EAAE,aAAa,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC5B,4EAA4E;IAC5E,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kDAAkD;IAClD,aAAa,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,aAAa;IAC1B,oFAAoF;IACpF,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,aAAa,CAAC;IAC1B,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB"}

package/dist/identity/sso/sso-types.mjs

@@ -0,0 +1,7 @@
+/**
+ * @module identity/sso/sso-types
+ *
+ * Core types and interfaces for extensible SSO (OAuth2) authentication.
+ */
+export {};
+//# sourceMappingURL=sso-types.mjs.map

package/dist/identity/sso/sso-types.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-types.mjs","sourceRoot":"","sources":["../../../src/identity/sso/sso-types.mts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ibgib/web-gib",
-  "version": "0.0.49",
+  "version": "0.0.51",
   "description": "Framework for creating agentic ibGib web apps. Contains plumbing for ibgib components, agentic framework (currently only Gemini implemented), web-based IndexedDB storage substrate, and more.",
   "funding": {
     "type": "individual",
@@ -14,6 +14,7 @@
     "//_orchestration": "~~ ORCHESTRATION (handled by @ibgib/build-gib) ~~",
     "//_publish": "~~ PUBLISH ~~",
     "pack": "npm pack --pack-destination=\"./published\"",
+    "test:node:nobuild": "node dist/respec-gib.node.mjs --inspect",
     "prepare:publish": "npm version patch && node ../../build/dist/concrete-build/build-web-gib.mjs --prod && npm run pack",
     "man:prepare:publish": "use this to patch > build > pack for publishing to npm repo"
   },
@@ -28,10 +29,10 @@
   "license": "ISC",
   "dependencies": {
     "@google/genai": "^1.33.0",
-    "@ibgib/core-gib": "^0.1.63",
+    "@ibgib/core-gib": "^0.1.65",
     "@ibgib/encrypt-gib": "^0.2.37",
     "@ibgib/helper-gib": "^0.0.36",
-    "@ibgib/ts-gib": "^0.5.32"
+    "@ibgib/ts-gib": "^0.5.33"
   },
   "engines": {
     "node": ">=19.0.0"

package/src/AUTO-GENERATED-version.mts

@@ -11,4 +11,4 @@
 /**
  * this is the version of this package, auto-updated in the build process
  */
-export const AUTO_GENERATED_VERSION = '0.0.49';
+export const AUTO_GENERATED_VERSION = '0.0.51';

package/src/common/settings/settings-constants.mts

@@ -14,6 +14,7 @@ export const SETTINGS_TYPE_PROJECTSDROPDOWN = 'projects-dropdown';
 export const SETTINGS_TYPE_PROJECT = 'project';
 export const SETTINGS_TYPE_MINIGAME = 'minigame';
 export const SETTINGS_TYPE_CHRONOLOGYS = 'chronologys';
+export const SETTINGS_TYPE_IDENTITY_MANAGER = 'identity-manager';
 /**
  * Discriminator for Settings info
  */
@@ -26,6 +27,7 @@ export type SettingsType =
     | typeof SETTINGS_TYPE_PROJECT
     | typeof SETTINGS_TYPE_MINIGAME
     | typeof SETTINGS_TYPE_CHRONOLOGYS
+    | typeof SETTINGS_TYPE_IDENTITY_MANAGER
     ;
 export const SettingsType = {
     general: SETTINGS_TYPE_GENERAL satisfies SettingsType,
@@ -36,6 +38,7 @@ export const SettingsType = {
     project: SETTINGS_TYPE_PROJECT satisfies SettingsType,
     minigame: SETTINGS_TYPE_MINIGAME satisfies SettingsType,
     chronologys: SETTINGS_TYPE_CHRONOLOGYS satisfies SettingsType,
+    identityManager: SETTINGS_TYPE_IDENTITY_MANAGER satisfies SettingsType,
 } satisfies { readonly [key: string]: SettingsType; };
 export const SETTINGS_TYPE_VALID_VALUES: SettingsType[] = Object.values(SettingsType);
 export function isSettingsType(value: any): value is SettingsType {
@@ -69,6 +72,12 @@ export const DEFAULT_SETTINGS_CHRONOLOGYS: Settings_Chronologys = {
     activeChildTjpAddr: undefined,
 }
 
+export const DEFAULT_SETTINGS_IDENTITY_MANAGER = {
+    type: SettingsType.identityManager,
+    openChildTjpAddrs: [],
+    activeChildTjpAddr: undefined,
+}
+
 export const DEFAULT_SETTINGS_DATA_V1: SettingsData_V1 = {
     sections: {},
     children: {},

package/src/common/settings/settings-helpers.mts

@@ -14,7 +14,8 @@ import {
     SETTINGS_ATOM,
     DEFAULT_SETTINGS_PROJECT,
     DEFAULT_SETTINGS_MINIGAME,
-    DEFAULT_SETTINGS_CHRONOLOGYS
+    DEFAULT_SETTINGS_CHRONOLOGYS,
+    DEFAULT_SETTINGS_IDENTITY_MANAGER
 } from "./settings-constants.mjs";
 import { IbGib_V1 } from "@ibgib/ts-gib/dist/V1/types.mjs";
 import { getIbAndGib } from "@ibgib/ts-gib/dist/helper.mjs";
@@ -110,6 +111,8 @@ export async function getDefaultSettings<TSettings extends IbGibSettings>({
                 return clone(DEFAULT_SETTINGS_MINIGAME) as TSettings;
             case SettingsType.chronologys:
                 return clone(DEFAULT_SETTINGS_CHRONOLOGYS) as TSettings;
+            case SettingsType.identityManager:
+                return clone(DEFAULT_SETTINGS_IDENTITY_MANAGER) as any as TSettings;
             default:
                 throw new Error(`(UNEXPECTED) unknown settingsType (${settingsType})? right now, we're whitelisting only. SettingsTypes: ${SETTINGS_TYPE_VALID_VALUES} (E: 801a7ade4c0849b308d5c8f8f0318d25)`);
         }

package/src/common/settings/settings-types.mts

@@ -15,7 +15,7 @@ import { IbGibAddr } from "@ibgib/ts-gib/dist/types.mjs";
 
 import {
     SETTINGS_ATOM, SETTINGS_TYPE_CHRONOLOGYS, SETTINGS_TYPE_MINIGAME, SETTINGS_TYPE_PROJECT,
-    SETTINGS_TYPE_TEXTEDITOR, SettingsType,
+    SETTINGS_TYPE_TEXTEDITOR, SETTINGS_TYPE_IDENTITY_MANAGER, SettingsType,
 } from "./settings-constants.mjs";
 import { LensMode } from "../project/project-types.mjs";
 
@@ -80,6 +80,10 @@ export interface Settings_Chronologys extends SettingsBase, SettingsWithTabs {
     // activeChildTjpAddr: IbGibAddr | undefined;
 }
 
+export interface Settings_IdentityManager extends SettingsBase, SettingsWithTabs {
+    type: typeof SETTINGS_TYPE_IDENTITY_MANAGER;
+}
+
 /**
  * union type of known Settings interfaces for various use cases.
  *
@@ -95,7 +99,8 @@ export type IbGibSettings =
     | Settings_TextEditor
     | Settings_Project
     | Settings_Minigame
-    | Settings_Chronologys;
+    | Settings_Chronologys
+    | Settings_IdentityManager;
 
 export interface SettingsData_V1 extends IbGibData_V1 {
     /**

package/src/identity/sso/sso-config-helper.mts

@@ -0,0 +1,52 @@
+import { SsoServerConfig, SsoProviderServerConfig, SsoProviderId } from './sso-types.mjs';
+
+/**
+ * Loads the SSO configuration from environment variables.
+ * Parses active OAuth2 providers dynamically based on their environment keys.
+ */
+export function loadSsoServerConfig(): SsoServerConfig {
+    const ssoServerKdfSecret = process.env.SSO_SERVER_KDF_SECRET;
+    const sessionSecret = process.env.SESSION_SECRET;
+
+    if (!ssoServerKdfSecret) {
+        throw new Error(
+            `SSO_SERVER_KDF_SECRET is missing from environment. (E: 840899ab4fdfd23e89cfae1889cfae12)`
+        );
+    }
+    if (!sessionSecret) {
+        throw new Error(
+            `SESSION_SECRET is missing from environment. (E: bfa899ab4fdfd23e89cfae23)`
+        );
+    }
+
+    const providers: Partial<Record<SsoProviderId, SsoProviderServerConfig>> = {};
+
+    // Load Google Provider if configured
+    if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {
+        providers.google = {
+            providerId: 'google',
+            clientId: process.env.GOOGLE_CLIENT_ID,
+            clientSecret: process.env.GOOGLE_CLIENT_SECRET,
+            tokenUrl: 'https://oauth2.googleapis.com/token',
+            userInfoUrl: 'https://openidconnect.googleapis.com/v1/userinfo',
+            jwksUrl: 'https://www.googleapis.com/oauth2/v3/certs'
+        };
+    }
+
+    // Load GitHub Provider if configured
+    if (process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET) {
+        providers.github = {
+            providerId: 'github',
+            clientId: process.env.GITHUB_CLIENT_ID,
+            clientSecret: process.env.GITHUB_CLIENT_SECRET,
+            tokenUrl: 'https://github.com/login/oauth/access_token',
+            userInfoUrl: 'https://api.github.com/user'
+        };
+    }
+
+    return {
+        ssoServerKdfSecret,
+        sessionSecret,
+        providers
+    };
+}