@ibgib/web-gib 0.0.56 → 0.0.57

package/src/ui/component/identity/keystone-creator/keystone-creator.mts

@@ -2,39 +2,29 @@ import thisCss from "./keystone-creator.css";
 import thisHtml from "./keystone-creator.html";
 import commonComponentStylesCss from "../../common-component-styles.css";
 
-import { delay, extractErrorMsg, hash } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
-import { HashAlgorithm } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
+import { delay, extractErrorMsg, } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
 import { IbGibAddr } from "@ibgib/ts-gib/dist/types.mjs";
 import { IbGib_V1 } from "@ibgib/ts-gib/dist/V1/types.mjs";
 import { getIbGibAddr } from "@ibgib/ts-gib/dist/helper.mjs";
+import { getGibInfo } from "@ibgib/ts-gib/dist/V1/transforms/transform-helper.mjs";
 import { KeystoneService_V1 } from "@ibgib/core-gib/dist/keystone/keystone-service-v1.mjs";
-import {
-    KeystonePoolConfig, KeystoneChallengeType, KeystoneReplenishStrategy
-} from "@ibgib/core-gib/dist/keystone/keystone-types.mjs";
 import { KeystoneProfileBuilder } from "@ibgib/core-gib/dist/keystone/policy/keystone-profile-builder.mjs";
-import { getGlobalMetaspace_waitIfNeeded, getLocalCoupledIbGibForDomainIbGib } from "../../../../helpers.mjs";
-import {
-    IbGibDynamicComponentMetaBase, IbGibFormInstanceBase,
-} from "../../ibgib-dynamic-component-bases.mjs";
+import { updateSpecialIndex, } from "@ibgib/core-gib/dist/timeline/timeline-api.mjs";
+import { toDto, getTjpAddr } from "@ibgib/core-gib/dist/common/other/ibgib-helper.mjs";
+import { validateEmail } from "@ibgib/core-gib/dist/keystone/keystone-helpers.mjs";
+import { KEYSTONE_USERNAME_REGEXP, KEYSTONE_DESCRIPTION_REGEXP, KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT } from "@ibgib/core-gib/dist/keystone/keystone-constants.mjs";
+import { deriveDelegateSecret } from "@ibgib/core-gib/dist/keystone/strategy/hash-reveal-v1/hash-reveal-v1.mjs";
+
+import { getGlobalMetaspace_waitIfNeeded, } from "../../../../helpers.mjs";
+import { IbGibDynamicComponentMetaBase, IbGibFormInstanceBase, } from "../../ibgib-dynamic-component-bases.mjs";
 import {
     ElementsBase, IbGibDynamicComponentInstance,
     IbGibDynamicComponentInstanceInitOpts,
 } from "../../component-types.mjs";
-
 import { getComponentCtorArg } from "../../../../app-bootstrap/init-orchestration.mjs";
 import { getApiBridge } from "../../../../api/ibgib-api-bridge.mjs";
-
-import {
-    createSettings, getSectionName, getSettingsScope
-} from "../../../../common/settings/settings-helpers.mjs";
-import { SettingsType } from "../../../../common/settings/settings-constants.mjs";
-import { SettingsIbGib_V1 } from "../../../../common/settings/settings-types.mjs";
-import { updateSpecialIndex, mut8Timeline } from "@ibgib/core-gib/dist/timeline/timeline-api.mjs";
-import { toDto } from "@ibgib/core-gib/dist/common/other/ibgib-helper.mjs";
-import { validateEmail } from "@ibgib/core-gib/dist/keystone/keystone-helpers.mjs";
-import { KEYSTONE_USERNAME_REGEXP, KEYSTONE_DESCRIPTION_REGEXP, KEYSTONE_VERB_SYNC, KEYSTONE_VERB_CONNECT } from "@ibgib/core-gib/dist/keystone/keystone-constants.mjs";
 import { EVENT_IBGIB_IDENTITY_REQUEST_CHANGE, EVENT_IBGIB_UI_MESSAGE } from "../../../ui-constants.mjs";
-import { deriveDelegateSecret } from "@ibgib/core-gib/dist/keystone/strategy/hash-reveal-v1/hash-reveal-v1.mjs";
+import { shadowRoot_getElementById } from "../../../../helpers.web.mjs";
 
 export const KEYSTONE_CREATOR_COMPONENT_NAME = 'ibgib-keystone-creator';
 
@@ -293,7 +283,12 @@ export class KeystoneCreatorComponentInstance
             });
 
             // 1. Prepare Primary/Domain Keystone Configs
-            const builder = KeystoneProfileBuilder.buildKeystone('domain')
+            const isProd = process.env.NODE_ENV === 'production';
+            const requestedProfile = (process.env.KEYSTONE_PROFILE || 'domain').toLowerCase();
+            const profileName = (isProd && requestedProfile === 'test') ? 'domain' : requestedProfile;
+            console.log(`${lc} Using keystone policy profile '${profileName}' (I: 90123456789abcdef0123456789abcde)`);
+
+            const builder = KeystoneProfileBuilder.buildKeystone(profileName as any)
                 .withUsername(username)
                 .withDescription(description);
             if (email) {
@@ -328,11 +323,11 @@ export class KeystoneCreatorComponentInstance
                 isPrimary: true
             });
 
-            const addr = getIbGibAddr({ ibGib: keystoneIbGib });
-            console.log(`${lc} local genesis complete: ${addr}`);
+            const primaryTjpAddr = getTjpAddr({ ibGib: keystoneIbGib, defaultIfNone: 'incomingAddr' })!;
+            console.log(`${lc} local genesis complete: ${primaryTjpAddr}`);
             await delay(humanEyeDelay); // for human eyes, not needed for functionality
             this.setStatus("Local genesis complete. Creating sync delegate...", "info");
-            console.log(`✓ Local genesis complete: ${addr}`);
+            console.log(`✓ Local genesis complete: ${primaryTjpAddr}`);
 
             // Automatically generate Sync Delegate Keystone
             this.showBusy({
@@ -343,12 +338,13 @@ export class KeystoneCreatorComponentInstance
             });
 
             const delegateSecret = await deriveDelegateSecret({ masterSecret });
-            const delegateBuilder = KeystoneProfileBuilder.buildKeystone('sync')
+            const delegateBuilder = KeystoneProfileBuilder.buildKeystone(profileName as any)
                 .withUsername(`${username}-sync`)
                 .withDescription(`Sync Delegate for ${username}`)
                 .withDetails({
                     client: 'space-gib-web',
-                    role: 'sync-delegate'
+                    role: 'sync-delegate',
+                    primaryTjpAddr: primaryTjpAddr,
                 });
             const delegateConfigs = await delegateBuilder.compileConfigs();
 
@@ -385,15 +381,11 @@ export class KeystoneCreatorComponentInstance
             await delay(humanEyeDelay);
 
             // 4. Post to Server
-            console.log(`Posting genesis keystone to server...`);
-            this.setStatus("Syncing genesis to server...", "info");
+            this.setStatus("Syncing genesis keystone to server...", "info");
             this.showBusy({
                 isBusy: true,
                 title: 'Syncing to Server...',
-                msg: [
-                    'Posting genesis keystone to server sync node...',
-                    '(may take awhile, depending on strength of keystone...)',
-                ].join('\n'),
+                msg: 'Quarantining staging genesis keystone on server...',
                 animationEmoji: '🔄'
             });
             const resSync = await getApiBridge().postGenesisKeystone(keystoneIbGib);
@@ -406,26 +398,116 @@ export class KeystoneCreatorComponentInstance
                 return;
             }
 
-            // Post evolved keystone + delegate keystone
-            this.setStatus("Syncing delegate registration to server...", "info");
-            this.showBusy({
-                isBusy: true,
-                title: 'Syncing Delegate...',
-                msg: 'Posting evolved domain identity and sync delegate to server...',
-                animationEmoji: '🔄'
-            });
-            const resEvolve = await getApiBridge().putEvolveKeystone({
-                domainAddr: addr,
-                keystoneIbGib: evolvedParentKeystoneIbGib,
-                relatedKeystoneIbGibs: [delegateKeystoneIbGib]
-            });
-            if (!resEvolve.success) {
-                const msg = `Delegate registration sync failed: ${resEvolve.message}`;
-                console.error(`${lc} ${msg}`);
-                this.setStatus(msg, "error");
+            const isPending = (resSync as any).pending || (resSync as any).statusCode === 202;
+
+            if (isPending) {
+                console.log(`${lc} Genesis keystone quarantined in pending staging area. Prompting for 6-digit verification code.`);
                 this.showBusy({ isBusy: false });
-                this.setButtonLoading(false);
-                return;
+                this.setFormDisabled(true);
+
+                if (!this.shadowRoot) { throw new Error(`(UNEXPECTED) this.shadowRoot falsy? (E: 6d316f5a2bf8e6a0286306468d35c826)`); }
+                const secVerify = shadowRoot_getElementById<HTMLDivElement>(this.shadowRoot, 'section-code-verification');
+                const inputVerifyCode =
+                    shadowRoot_getElementById<HTMLInputElement>(this.shadowRoot, 'input-verify-code');
+                const btnSubmitCode =
+                    shadowRoot_getElementById<HTMLButtonElement>(this.shadowRoot, 'btn-submit-code');
+                const btnResendCode =
+                    shadowRoot_getElementById<HTMLButtonElement>(this.shadowRoot, 'btn-resend-code');
+
+                secVerify.classList.remove('hidden');
+                secVerify.scrollIntoView({ behavior: 'smooth', block: 'nearest' });
+                this.setStatus("✉️ Verification code sent to your email. Enter 6-digit code below:", "info");
+
+                const onResendCode = async () => {
+                    btnResendCode.disabled = true;
+                    btnResendCode.textContent = "Sending...";
+                    this.setStatus("Resending verification code to your email...", "info");
+                    const resResend = await getApiBridge().postVerificationCode({ email, primaryTjpAddr: primaryTjpAddr });
+                    if (resResend.success) {
+                        this.setStatus("✉️ New verification code sent to your email!", "success");
+                    } else {
+                        this.setStatus(resResend.message || "Failed to resend verification code.", "error");
+                    }
+                    btnResendCode.disabled = false;
+                    btnResendCode.textContent = "Resend Code";
+                };
+                btnResendCode.addEventListener('click', onResendCode);
+
+                await new Promise<void>((resolve, reject) => {
+                    const onSubmitCode = async () => {
+                        const code = inputVerifyCode.value.trim();
+                        if (!code || code.length !== 6 || !/^\d{6}$/.test(code)) {
+                            this.setStatus("Please enter a valid 6-digit numeric verification code (e.g. 482901).", "error");
+                            return;
+                        }
+
+                        btnSubmitCode.disabled = true;
+                        btnSubmitCode.textContent = "Verifying...";
+                        this.showBusy({
+                            isBusy: true,
+                            title: 'Verifying & Activating...',
+                            msg: 'Great! Juust a moment...\n(Validating code, promoting server domain space, other security stuff...)',
+                            animationEmoji: '🔐'
+                        });
+
+                        const resVerify = await getApiBridge().postVerifyCode({ email, primaryTjpAddr: primaryTjpAddr, code });
+                        if (!resVerify.success) {
+                            this.showBusy({ isBusy: false });
+                            this.setStatus(resVerify.message || "Incorrect verification code.", "error");
+                            btnSubmitCode.disabled = false;
+                            btnSubmitCode.textContent = "Verify Code";
+                            return;
+                        }
+
+                        console.log(`${lc} Code verified & server domain promoted! Syncing delegate...`);
+                        this.showBusy({
+                            isBusy: true,
+                            title: 'Syncing Delegate...',
+                            msg: 'Posting evolved domain identity and sync delegate to server...',
+                            animationEmoji: '⚡'
+                        });
+
+                        btnSubmitCode.removeEventListener('click', onSubmitCode);
+                        secVerify.classList.add('hidden');
+                        this.setFormDisabled(false);
+
+                        // Now that server domain space is promoted, post evolved keystone + delegate
+                        const resEvolve = await getApiBridge().putEvolveKeystone({
+                            domainAddr: primaryTjpAddr,
+                            keystoneIbGib: evolvedParentKeystoneIbGib,
+                            relatedKeystoneIbGibs: [delegateKeystoneIbGib]
+                        });
+                        if (!resEvolve.success) {
+                            console.warn(`${lc} Delegate sync warning after code verification: ${resEvolve.message}`);
+                        }
+
+                        resolve();
+                    };
+
+                    btnSubmitCode.addEventListener('click', onSubmitCode);
+                });
+            } else {
+                // Post evolved keystone + delegate keystone immediately (no email or pre-verified)
+                this.setStatus("Syncing delegate registration to server...", "info");
+                this.showBusy({
+                    isBusy: true,
+                    title: 'Syncing Delegate...',
+                    msg: 'Posting evolved domain identity and sync delegate to server...',
+                    animationEmoji: '🔄'
+                });
+                const resEvolve = await getApiBridge().putEvolveKeystone({
+                    domainAddr: primaryTjpAddr,
+                    keystoneIbGib: evolvedParentKeystoneIbGib,
+                    relatedKeystoneIbGibs: [delegateKeystoneIbGib]
+                });
+                if (!resEvolve.success) {
+                    const msg = `Delegate registration sync failed: ${resEvolve.message}`;
+                    console.error(`${lc} ${msg}`);
+                    this.setStatus(msg, "error");
+                    this.showBusy({ isBusy: false });
+                    this.setButtonLoading(false);
+                    return;
+                }
             }
 
             // 5. Register with the keystones special index
@@ -468,11 +550,28 @@ export class KeystoneCreatorComponentInstance
             }
 
             // 7. Success
+            const successMsg = "Identity successfully created and activated! Just a sec...";
+            this.showBusy({
+                isBusy: true,
+                title: 'Success!',
+                msg: successMsg,
+                animationEmoji: '✅'
+            });
+            await delay(humanEyeDelay); // for human eyes, not needed for functionality, because we'll redirect
+            await delay(humanEyeDelay); // for human eyes, not needed for functionality, because we'll redirect
+            await delay(humanEyeDelay); // for human eyes, not needed for functionality, because we'll redirect
+            await delay(humanEyeDelay); // for human eyes, not needed for functionality, because we'll redirect
             this.elements!.keystoneAddrEl.textContent = evolvedParentAddr;
             this.elements!.statusArea.classList.remove('hidden');
-            this.setStatus("Keystone successfully created and synced!", "success");
-            await delay(humanEyeDelay); // for human eyes, not needed for functionality
-            console.log(`✓ Keystone successfully created and synced!`);
+            this.setStatus(successMsg, "success");
+            console.log(`${lc} ✓ ${successMsg} (I: 3396d8261978d7027895b71e27e9ab26)`);
+
+            // Dispatch UI message to close keystone-creator and show identity-manager
+            window.dispatchEvent(new CustomEvent(EVENT_IBGIB_UI_MESSAGE, {
+                detail: { action: 'show-identity-manager', addr: evolvedParentAddr },
+                bubbles: true,
+                composed: true
+            }));
 
         } catch (error) {
             const emsg = extractErrorMsg(error);
@@ -487,6 +586,32 @@ export class KeystoneCreatorComponentInstance
         }
     }
 
+    private setFormDisabled(disabled: boolean): void {
+        const root = this.shadowRoot!;
+        const inputIds = [
+            'input-username',
+            'input-description',
+            'input-email',
+            'input-secret',
+            'checkbox-make-active',
+            'btn-generate',
+            'btn-switch-sign-in',
+        ];
+        for (const id of inputIds) {
+            const el = root.getElementById(id) as HTMLInputElement | HTMLButtonElement | null;
+            if (el) {
+                el.disabled = disabled;
+                if (disabled) {
+                    el.style.opacity = '0.5';
+                    el.style.pointerEvents = 'none';
+                } else {
+                    el.style.opacity = '1';
+                    el.style.pointerEvents = 'auto';
+                }
+            }
+        }
+    }
+
     protected override async renderUI(): Promise<void> {
         // No complex rendering needed for this simple creator component yet
     }

package/src/ui/component/identity/keystone-details/keystone-details.mts

@@ -951,9 +951,9 @@ export class KeystoneDetailsComponentInstance
             });
 
             // Put evolved parent keystone to server via putEvolveKeystone
-            const parentTjp = getTjpAddr({ ibGib: this.ibGib! }) || getIbGibAddr({ ibGib: this.ibGib! });
+            const parentTjpAddr = getTjpAddr({ ibGib: this.ibGib! }) || getIbGibAddr({ ibGib: this.ibGib! });
             const syncRes = await getApiBridge().putEvolveKeystone({
-                domainAddr: parentTjp,
+                domainAddr: parentTjpAddr,
                 keystoneIbGib: evolvedParent,
                 relatedKeystoneIbGibs: []
             });
@@ -1389,20 +1389,21 @@ export class KeystoneDetailsComponentInstance
             this.setChangePassphraseStatus("Evolving primary identity keystone...", "info");
 
             const metaspace = await getGlobalMetaspace_waitIfNeeded();
-            if (!metaspace) throw new Error("Metaspace not found");
+            if (!metaspace) { throw new Error(`(UNEXPECTED) metaspace falsy? (E: 95e3c8374b0f088f339f5c5a8700f826)`); }
             const space = await metaspace.getLocalUserSpace({ lock: false });
-            if (!space) { throw new Error("Local space not found"); }
+            if (!space) { throw new Error(`(UNEXPECTED) couldn't get default local space? (E: 2fc1281c28351fd378a1d7f88eaa0526)`); }
 
             // 2. Rotate parent identity
-            debugger; // walk through this...looking for delegate failure
-            const { newKeystone: evolvedParent, newDelegates: evolvedDelegates } = await keystoneService.changePassword({
-                keystoneIbGib: this.ibGib!,
-                newMasterSecret: newPassphrase,
-                signingSecret: currentPassphrase,
-                signingPoolId: 'manage',
-                metaspace,
-                space
-            });
+            debugger; // walk through this...looking for delegate failure // hmm...I thought we got change password going?
+            const { newKeystone: evolvedParent, newDelegates: evolvedDelegates } =
+                await keystoneService.changePassword({
+                    keystoneIbGib: this.ibGib!,
+                    newMasterSecret: newPassphrase,
+                    signingSecret: currentPassphrase,
+                    signingPoolId: 'manage',
+                    metaspace,
+                    space
+                });
             debugger; // look at evolvedDelegates
 
             this.setChangePassphraseStatus("Resolving and rotating delegate keystones...", "info");
@@ -1458,10 +1459,10 @@ export class KeystoneDetailsComponentInstance
 
             // 4. Sync evolved parent and all evolved delegate keystones atomically
             this.setChangePassphraseStatus("Syncing evolved keystones to server...", "info");
-            const parentTjp = getIbGibAddr({ ibGib: this.ibGib! }); // is this.ibGib the tjp always? or is it the latest in the keystone line? Does it matter?
+            const parentTjpAddr = getIbGibAddr({ ibGib: this.ibGib! }); // is this.ibGib the tjp always? or is it the latest in the keystone line? Does it matter?
 
             const syncRes = await getApiBridge().putEvolveKeystone({
-                domainAddr: parentTjp,
+                domainAddr: parentTjpAddr,
                 keystoneIbGib: evolvedParent,
                 relatedKeystoneIbGibs: evolvedDelegates,
             });

package/dist/identity/sso/sso-config-helper.d.mts

@@ -1,7 +0,0 @@
-import { SsoServerConfig } from './sso-types.mjs';
-/**
- * Loads the SSO configuration from environment variables.
- * Parses active OAuth2 providers dynamically based on their environment keys.
- */
-export declare function loadSsoServerConfig(): SsoServerConfig;
-//# sourceMappingURL=sso-config-helper.d.mts.map

package/dist/identity/sso/sso-config-helper.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sso-config-helper.d.mts","sourceRoot":"","sources":["../../../src/identity/sso/sso-config-helper.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAA0C,MAAM,iBAAiB,CAAC;AAE1F;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,eAAe,CA6CrD"}

package/dist/identity/sso/sso-config-helper.mjs

@@ -1,42 +0,0 @@
-/**
- * Loads the SSO configuration from environment variables.
- * Parses active OAuth2 providers dynamically based on their environment keys.
- */
-export function loadSsoServerConfig() {
-    const ssoServerKdfSecret = process.env.SSO_SERVER_KDF_SECRET;
-    const sessionSecret = process.env.SESSION_SECRET;
-    if (!ssoServerKdfSecret) {
-        throw new Error(`SSO_SERVER_KDF_SECRET is missing from environment. (E: 840899ab4fdfd23e89cfae1889cfae12)`);
-    }
-    if (!sessionSecret) {
-        throw new Error(`SESSION_SECRET is missing from environment. (E: bfa899ab4fdfd23e89cfae23)`);
-    }
-    const providers = {};
-    // Load Google Provider if configured
-    if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {
-        providers.google = {
-            providerId: 'google',
-            clientId: process.env.GOOGLE_CLIENT_ID,
-            clientSecret: process.env.GOOGLE_CLIENT_SECRET,
-            tokenUrl: 'https://oauth2.googleapis.com/token',
-            userInfoUrl: 'https://openidconnect.googleapis.com/v1/userinfo',
-            jwksUrl: 'https://www.googleapis.com/oauth2/v3/certs'
-        };
-    }
-    // Load GitHub Provider if configured
-    if (process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET) {
-        providers.github = {
-            providerId: 'github',
-            clientId: process.env.GITHUB_CLIENT_ID,
-            clientSecret: process.env.GITHUB_CLIENT_SECRET,
-            tokenUrl: 'https://github.com/login/oauth/access_token',
-            userInfoUrl: 'https://api.github.com/user'
-        };
-    }
-    return {
-        ssoServerKdfSecret,
-        sessionSecret,
-        providers
-    };
-}
-//# sourceMappingURL=sso-config-helper.mjs.map

package/dist/identity/sso/sso-config-helper.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"sso-config-helper.mjs","sourceRoot":"","sources":["../../../src/identity/sso/sso-config-helper.mts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IAC/B,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAC7D,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAEjD,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACX,0FAA0F,CAC7F,CAAC;IACN,CAAC;IACD,IAAI,CAAC,aAAa,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACX,2EAA2E,CAC9E,CAAC;IACN,CAAC;IAED,MAAM,SAAS,GAA4D,EAAE,CAAC;IAE9E,qCAAqC;IACrC,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACnE,SAAS,CAAC,MAAM,GAAG;YACf,UAAU,EAAE,QAAQ;YACpB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;YAC9C,QAAQ,EAAE,qCAAqC;YAC/C,WAAW,EAAE,kDAAkD;YAC/D,OAAO,EAAE,4CAA4C;SACxD,CAAC;IACN,CAAC;IAED,qCAAqC;IACrC,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACnE,SAAS,CAAC,MAAM,GAAG;YACf,UAAU,EAAE,QAAQ;YACpB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;YAC9C,QAAQ,EAAE,6CAA6C;YACvD,WAAW,EAAE,6BAA6B;SAC7C,CAAC;IACN,CAAC;IAED,OAAO;QACH,kBAAkB;QAClB,aAAa;QACb,SAAS;KACZ,CAAC;AACN,CAAC"}

package/dist/identity/sso/sso-custodian-service.d.mts

@@ -1,139 +0,0 @@
-import { KeystoneChallengePool } from '@ibgib/core-gib/dist/keystone/keystone-types.mjs';
-import { MetaspaceService } from '@ibgib/core-gib/dist/witness/space/metaspace/metaspace-types.mjs';
-import { IbGibSpaceAny } from '@ibgib/core-gib/dist/witness/space/space-base-v1.mjs';
-import { SsoServerConfig, SsoProviderId, OAuthUserInfo, SsoProviderServerConfig, SsoProviderClientConfig } from './sso-types.mjs';
-/**
- * Server-side service for token exchange, JWT validation, and user profile normalization.
- */
-export declare class SsoCustodianService {
-    private config;
-    private lc;
-    private jwksCache;
-    private jwksTtlMs;
-    /**
-     * @param config The server's global SSO configuration.
-     *   - Visibility: Private (Contains high-entropy secrets like `ssoServerKdfSecret` and `sessionSecret`).
-     *   - Generator: Server (Bootstrapped from node environment variables on server initialization).
-     */
-    constructor(config: SsoServerConfig);
-    /**
-     * Exchanges an authorization code for an OAuth2 token and retrieves normalized user info.
-     *
-     * @param providerId The string identifier of the OAuth provider (e.g. 'google' or 'github').
-     *   - Visibility: Public (Non-sensitive metadata string).
-     *   - Generator: Client (Sent from browser UI selection).
-     *
-     * @param code The temporary authorization code returned by the OAuth provider.
-     *   - Visibility: Private (Confidential short-lived bearer credential. Must be kept private).
-     *   - Generator: Provider (Created by provider's OAuth page and sent to client redirect URI).
-     *
-     * @param redirectUri The redirect URI registered in the provider portal.
-     *   - Visibility: Public (Configuration URL).
-     *   - Generator: Client/Server (Derived from environmental configuration and sent by client).
-     */
-    getOAuthUserInfo(providerId: SsoProviderId, code: string, redirectUri: string): Promise<OAuthUserInfo>;
-    /**
-     * Directly validates a Google ID Token (JWT) locally and returns normalized user info.
-     * Useful for client-side authentication handshakes.
-     *
-     * @param idToken The raw base64-encoded signed JSON Web Token (JWT) ID token returned by Google.
-     *   - Visibility: Private (Sensitive bearer credential containing signature and claims. Must be kept private).
-     *   - Generator: Provider (Generated and signed cryptographically by Google authentication servers).
-     */
-    verifyAndNormalizeGoogleToken(idToken: string): Promise<OAuthUserInfo>;
-    /**
-     * Internal: Exchange authorization code for access token / ID token.
-     *
-     * @param providerConfig Server configuration settings for the specific provider.
-     *   - Visibility: Private (Contains provider client secrets. Must stay server-side).
-     *   - Generator: Server (Configured from node environment variables).
-     *
-     * @param code The temporary authorization code to exchange.
-     *   - Visibility: Private (Short-lived credential. Must be kept private).
-     *   - Generator: Provider (Via OAuth flow).
-     *
-     * @param redirectUri The redirect URI registered for the exchange.
-     *   - Visibility: Public (Configuration URL).
-     *   - Generator: Client/Server (From app configuration).
-     */
-    private exchangeCodeForTokens;
-    /**
-     * Internal: Fetch GitHub user profile and normalize.
-     *
-     * @param providerConfig Server configuration settings for GitHub.
-     *   - Visibility: Private (Contains GitHub client secret).
-     *   - Generator: Server (From environment config).
-     *
-     * @param accessToken The active OAuth2 access token to authorize the API call.
-     *   - Visibility: Private (Bearer token. Must be kept private).
-     *   - Generator: Provider (GitHub token endpoint).
-     */
-    private fetchAndNormalizeGithubUser;
-    /**
-     * Internal: Decodes and cryptographically verifies a JWT signature using JWKS public keys.
-     *
-     * @param token The raw base64-encoded JWT token to verify.
-     *   - Visibility: Private (Sensitive token. Must be kept private).
-     *   - Generator: Provider (Google / OIDC server).
-     *
-     * @param providerConfig The target provider server settings containing `jwksUrl`.
-     *   - Visibility: Private (Contains secrets).
-     *   - Generator: Server (From environment config).
-     */
-    verifyJwt(token: string, providerConfig: SsoProviderServerConfig): Promise<any>;
-    /**
-     * Internal: Retrieves JWKS keys from cache or fetches them from the provider's jwksUrl.
-     *
-     * @param providerConfig The provider config containing the target `jwksUrl`.
-     *   - Visibility: Private (Contains client secrets).
-     *   - Generator: Server (From environment config).
-     */
-    private getJwksKeys;
-    /**
-     * Derives a server-delegate master secret deterministically using the server's private KDF secret,
-     * the providerKey, and the user's public nonce.
-     *
-     * @param providerKey The unique key identifying the provider and user sub ID (e.g. `google:123...`).
-     *   - Visibility: Public (Identifier saved on parent's delegate claim, safe for log/ledger storage).
-     *   - Generator: Provider/Server (Derived by mapping provider user sub ID after authentication).
-     *
-     * @param userNonce The public, high-entropy nonce generated by the client to salt the KDF derivation.
-     *   - Visibility: Public (Salt value stored on parent's delegate claim, safe for ledger storage).
-     *   - Generator: Client (Generated offline on user's device).
-     */
-    deriveServerDelegateSecret(providerKey: string, userNonce: string): Promise<string>;
-    /**
-     * Creates a public custodian challenge pool (custodian-manage) derived deterministically
-     * from the server's private KDF secret, providerKey, and userNonce.
-     *
-     * @param providerKey The unique key identifying the provider and user sub ID (e.g. `google:123...`).
-     *   - Visibility: Public (Mapped identifier, safe for ledger).
-     *   - Generator: Provider/Server (Derived after successful token exchange).
-     *
-     * @param userNonce The public, high-entropy nonce.
-     *   - Visibility: Public (Derivation salt, safe for ledger).
-     *   - Generator: Client (Generated on user's device).
-     */
-    createCustodianChallengePool({ providerId, providerKey, userNonce, keystoneAddr, metaspace, space, }: {
-        providerId: string;
-        providerKey: string;
-        userNonce: string;
-        keystoneAddr: string;
-        metaspace: MetaspaceService;
-        space: IbGibSpaceAny;
-    }): Promise<KeystoneChallengePool>;
-    /**
-     * Maps private server configuration to safe public client configurations.
-     *
-     * @param hostUrl The root URL host address of the server (e.g. `https://space-gib.localhost` or `https://ibgib.space`).
-     *   - Visibility: Public (Non-sensitive hostname configuration).
-     *   - Generator: Server (Extracted from the HTTP request context headers/protocol).
-     */
-    getSsoClientConfigs(hostUrl: string): SsoProviderClientConfig[];
-    /**
-     * Revokes an active OAuth access or refresh token with the provider.
-     * Keeps token revocation logic DRY and centralized.
-     */
-    revokeToken(providerId: SsoProviderId, token: string): Promise<void>;
-}
-//# sourceMappingURL=sso-custodian-service.d.mts.map

package/dist/identity/sso/sso-custodian-service.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sso-custodian-service.d.mts","sourceRoot":"","sources":["../../../src/identity/sso/sso-custodian-service.mts"],"names":[],"mappings":"AAKA,OAAO,EAAoB,qBAAqB,EAAsB,MAAM,kDAAkD,CAAC;AAK/H,OAAO,EAAE,gBAAgB,EAAE,MAAM,kEAAkE,CAAC;AACpG,OAAO,EAAE,aAAa,EAAE,MAAM,sDAAsD,CAAC;AACrF,OAAO,EACH,eAAe,EACf,aAAa,EACb,aAAa,EACb,uBAAuB,EACvB,uBAAuB,EAC1B,MAAM,iBAAiB,CAAC;AAgBzB;;GAEG;AACH,qBAAa,mBAAmB;IAYhB,OAAO,CAAC,MAAM;IAX1B,OAAO,CAAC,EAAE,CAAmC;IAG7C,OAAO,CAAC,SAAS,CAAwE;IACzF,OAAO,CAAC,SAAS,CAAuB;IAExC;;;;OAIG;IACH,YAAoB,MAAM,EAAE,eAAe,EAAI;IAE/C;;;;;;;;;;;;;;OAcG;IACG,gBAAgB,CAAC,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA4B3G;IAED;;;;;;;OAOG;IACG,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA+B3E;IAED;;;;;;;;;;;;;;OAcG;YACW,qBAAqB;IAoCnC;;;;;;;;;;OAUG;YACW,2BAA2B;IAkCzC;;;;;;;;;;OAUG;IACU,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC,CAqD3F;IAED;;;;;;OAMG;YACW,WAAW;IA8BzB;;;;;;;;;;;OAWG;IACG,0BAA0B,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAWxF;IAED;;;;;;;;;;;OAWG;IACG,4BAA4B,CAAC,EAC/B,UAAU,EACV,WAAW,EACX,SAAS,EACT,YAAY,EACZ,SAAS,EACT,KAAK,GACR,EAAE;QACC,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,gBAAgB,CAAC;QAC5B,KAAK,EAAE,aAAa,CAAC;KACxB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAuEjC;IAED;;;;;;OAMG;IACH,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,uBAAuB,EAAE,CAwB9D;IAED;;;OAGG;IACG,WAAW,CAAC,UAAU,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwCzE;CACJ"}