@ibgib/web-gib 0.0.56 → 0.0.58

package/src/ui/component/identity/keystone-details/keystone-details.mts

@@ -22,6 +22,7 @@ import { getKeystoneSyncService } from "../../../../identity/keystone-sync-servi
 import { updateSpecialIndex } from "@ibgib/core-gib/dist/timeline/timeline-api.mjs";
 import { getTjpAddr, toDto } from "@ibgib/core-gib/dist/common/other/ibgib-helper.mjs";
 import { parseSpaceIb } from "@ibgib/core-gib/dist/witness/space/space-helper.mjs";
+import { executeSsoOAuthPopup } from "../../../../identity/sso-popup-helper.mjs";
 
 import { getComponentCtorArg } from "../../../../app-bootstrap/init-orchestration.mjs";
 import { promptForSecret } from "../../../../helpers.web.mjs";
@@ -403,7 +404,7 @@ export class KeystoneDetailsComponentInstance
 
             await this.updateFrameDetailsView();
         } catch (error) {
-            console.error(`${lc} ${extractErrorMsg(error)}`);
+            console.error(`${lc} Registered identity keystone address ${this.ibGibAddr} not found in local browser space: ${extractErrorMsg(error)} (E: a123456789abcdef0123456789c0003)`);
             throw error;
         } finally {
             if (logalot) { console.log(`${lc} complete.`); }
@@ -951,9 +952,9 @@ export class KeystoneDetailsComponentInstance
             });
 
             // Put evolved parent keystone to server via putEvolveKeystone
-            const parentTjp = getTjpAddr({ ibGib: this.ibGib! }) || getIbGibAddr({ ibGib: this.ibGib! });
+            const parentTjpAddr = getTjpAddr({ ibGib: this.ibGib! }) || getIbGibAddr({ ibGib: this.ibGib! });
             const syncRes = await getApiBridge().putEvolveKeystone({
-                domainAddr: parentTjp,
+                domainAddr: parentTjpAddr,
                 keystoneIbGib: evolvedParent,
                 relatedKeystoneIbGibs: []
             });
@@ -1039,70 +1040,17 @@ export class KeystoneDetailsComponentInstance
         this.setSSOStatus(`Linking ${providerId}...`, "info");
 
         try {
-            // 1. Fetch public SSO configs from server
-            const res = await fetch('/api/identity/sso/config');
-            if (!res.ok) {
-                throw new Error(`Failed to fetch SSO config from server: ${res.statusText}`);
-            }
-            const data = await res.json();
-            if (!data.success || !data.providers) {
-                throw new Error(`SSO configuration fetch failed: ${data.message || 'unknown error'}`);
-            }
-
-            const providerConfig = data.providers.find((p: any) => p.providerId === providerId);
-            if (!providerConfig) {
-                throw new Error(`SSO provider '${providerId}' is not configured on the server.`);
-            }
-
-            // 2. Generate a secure, high-entropy user nonce
-            const userNonce = (Math.random().toString(36).substring(2) + Math.random().toString(36).substring(2)).substring(0, 32);
-
-            // 3. Construct state payload
-            const stateObj = {
+            const resPopup = await executeSsoOAuthPopup({
                 providerId,
-                parentTjpAddr: this.ibGibAddr,
-                userNonce
-            };
-            const state = btoa(JSON.stringify(stateObj));
-
-            // 4. Construct Auth URL
-            const authUrl = `${providerConfig.authUrl}?client_id=${providerConfig.clientId}&redirect_uri=${encodeURIComponent(providerConfig.redirectUri)}&response_type=code&scope=${encodeURIComponent(providerConfig.scope)}&state=${encodeURIComponent(state)}`;
-
-            // 5. Open popup window
-            const popup = window.open(
-                authUrl,
-                'sso-oauth-popup',
-                'width=600,height=700,status=yes,toolbar=no,menubar=no,location=yes'
-            );
-            if (!popup) {
-                throw new Error("Popup blocked by browser. Please enable popups for this site.");
-            }
+                parentTjpAddr: this.ibGibAddr
+            });
 
-            // 6. Listen for callback from pop-up
-            let checkClosedInterval: any;
-            const messageListener = async (event: MessageEvent) => {
-                if (event.origin !== window.location.origin) return;
-                const callbackData = event.data;
-                if (callbackData && callbackData.type === 'sso-oauth-callback') {
-                    window.removeEventListener('message', messageListener);
-                    clearInterval(checkClosedInterval);
-                    await this.handleSSOLinkCallback(callbackData.code, stateObj, providerConfig.redirectUri);
-                }
-            };
-            window.addEventListener('message', messageListener);
-
-            // 7. Poll for manual closure of the popup window
-            checkClosedInterval = setInterval(() => {
-                if (popup.closed) {
-                    clearInterval(checkClosedInterval);
-                    window.removeEventListener('message', messageListener);
-                    const statusEl = this.elements!.ssoStatusMsgEl;
-                    if (statusEl.textContent && statusEl.textContent.startsWith('Linking')) {
-                        this.setSSOStatus('Linking cancelled (window closed).', 'error');
-                    }
-                }
-            }, 500);
+            if (!resPopup.success || !resPopup.code) {
+                this.setSSOStatus(resPopup.message || `Linking cancelled.`, "error");
+                return;
+            }
 
+            await this.handleSSOLinkCallback(resPopup.code, resPopup.stateObj, resPopup.redirectUri!);
         } catch (error) {
             console.error(`${lc} SSO link initiation failed: ${extractErrorMsg(error)}`);
             this.setSSOStatus(`Link failed: ${extractErrorMsg(error)}`, "error");
@@ -1389,20 +1337,21 @@ export class KeystoneDetailsComponentInstance
             this.setChangePassphraseStatus("Evolving primary identity keystone...", "info");
 
             const metaspace = await getGlobalMetaspace_waitIfNeeded();
-            if (!metaspace) throw new Error("Metaspace not found");
+            if (!metaspace) { throw new Error(`(UNEXPECTED) metaspace falsy? (E: 95e3c8374b0f088f339f5c5a8700f826)`); }
             const space = await metaspace.getLocalUserSpace({ lock: false });
-            if (!space) { throw new Error("Local space not found"); }
+            if (!space) { throw new Error(`(UNEXPECTED) couldn't get default local space? (E: 2fc1281c28351fd378a1d7f88eaa0526)`); }
 
             // 2. Rotate parent identity
-            debugger; // walk through this...looking for delegate failure
-            const { newKeystone: evolvedParent, newDelegates: evolvedDelegates } = await keystoneService.changePassword({
-                keystoneIbGib: this.ibGib!,
-                newMasterSecret: newPassphrase,
-                signingSecret: currentPassphrase,
-                signingPoolId: 'manage',
-                metaspace,
-                space
-            });
+            debugger; // walk through this...looking for delegate failure // hmm...I thought we got change password going?
+            const { newKeystone: evolvedParent, newDelegates: evolvedDelegates } =
+                await keystoneService.changePassword({
+                    keystoneIbGib: this.ibGib!,
+                    newMasterSecret: newPassphrase,
+                    signingSecret: currentPassphrase,
+                    signingPoolId: 'manage',
+                    metaspace,
+                    space
+                });
             debugger; // look at evolvedDelegates
 
             this.setChangePassphraseStatus("Resolving and rotating delegate keystones...", "info");
@@ -1458,10 +1407,10 @@ export class KeystoneDetailsComponentInstance
 
             // 4. Sync evolved parent and all evolved delegate keystones atomically
             this.setChangePassphraseStatus("Syncing evolved keystones to server...", "info");
-            const parentTjp = getIbGibAddr({ ibGib: this.ibGib! }); // is this.ibGib the tjp always? or is it the latest in the keystone line? Does it matter?
+            const parentTjpAddr = getIbGibAddr({ ibGib: this.ibGib! }); // is this.ibGib the tjp always? or is it the latest in the keystone line? Does it matter?
 
             const syncRes = await getApiBridge().putEvolveKeystone({
-                domainAddr: parentTjp,
+                domainAddr: parentTjpAddr,
                 keystoneIbGib: evolvedParent,
                 relatedKeystoneIbGibs: evolvedDelegates,
             });

package/dist/identity/sso/sso-config-helper.d.mts

@@ -1,7 +0,0 @@
-import { SsoServerConfig } from './sso-types.mjs';
-/**
- * Loads the SSO configuration from environment variables.
- * Parses active OAuth2 providers dynamically based on their environment keys.
- */
-export declare function loadSsoServerConfig(): SsoServerConfig;
-//# sourceMappingURL=sso-config-helper.d.mts.map

package/dist/identity/sso/sso-config-helper.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sso-config-helper.d.mts","sourceRoot":"","sources":["../../../src/identity/sso/sso-config-helper.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAA0C,MAAM,iBAAiB,CAAC;AAE1F;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,eAAe,CA6CrD"}

package/dist/identity/sso/sso-config-helper.mjs

@@ -1,42 +0,0 @@
-/**
- * Loads the SSO configuration from environment variables.
- * Parses active OAuth2 providers dynamically based on their environment keys.
- */
-export function loadSsoServerConfig() {
-    const ssoServerKdfSecret = process.env.SSO_SERVER_KDF_SECRET;
-    const sessionSecret = process.env.SESSION_SECRET;
-    if (!ssoServerKdfSecret) {
-        throw new Error(`SSO_SERVER_KDF_SECRET is missing from environment. (E: 840899ab4fdfd23e89cfae1889cfae12)`);
-    }
-    if (!sessionSecret) {
-        throw new Error(`SESSION_SECRET is missing from environment. (E: bfa899ab4fdfd23e89cfae23)`);
-    }
-    const providers = {};
-    // Load Google Provider if configured
-    if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {
-        providers.google = {
-            providerId: 'google',
-            clientId: process.env.GOOGLE_CLIENT_ID,
-            clientSecret: process.env.GOOGLE_CLIENT_SECRET,
-            tokenUrl: 'https://oauth2.googleapis.com/token',
-            userInfoUrl: 'https://openidconnect.googleapis.com/v1/userinfo',
-            jwksUrl: 'https://www.googleapis.com/oauth2/v3/certs'
-        };
-    }
-    // Load GitHub Provider if configured
-    if (process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET) {
-        providers.github = {
-            providerId: 'github',
-            clientId: process.env.GITHUB_CLIENT_ID,
-            clientSecret: process.env.GITHUB_CLIENT_SECRET,
-            tokenUrl: 'https://github.com/login/oauth/access_token',
-            userInfoUrl: 'https://api.github.com/user'
-        };
-    }
-    return {
-        ssoServerKdfSecret,
-        sessionSecret,
-        providers
-    };
-}
-//# sourceMappingURL=sso-config-helper.mjs.map

package/dist/identity/sso/sso-config-helper.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"sso-config-helper.mjs","sourceRoot":"","sources":["../../../src/identity/sso/sso-config-helper.mts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IAC/B,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAC7D,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAEjD,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACX,0FAA0F,CAC7F,CAAC;IACN,CAAC;IACD,IAAI,CAAC,aAAa,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACX,2EAA2E,CAC9E,CAAC;IACN,CAAC;IAED,MAAM,SAAS,GAA4D,EAAE,CAAC;IAE9E,qCAAqC;IACrC,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACnE,SAAS,CAAC,MAAM,GAAG;YACf,UAAU,EAAE,QAAQ;YACpB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;YAC9C,QAAQ,EAAE,qCAAqC;YAC/C,WAAW,EAAE,kDAAkD;YAC/D,OAAO,EAAE,4CAA4C;SACxD,CAAC;IACN,CAAC;IAED,qCAAqC;IACrC,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACnE,SAAS,CAAC,MAAM,GAAG;YACf,UAAU,EAAE,QAAQ;YACpB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;YAC9C,QAAQ,EAAE,6CAA6C;YACvD,WAAW,EAAE,6BAA6B;SAC7C,CAAC;IACN,CAAC;IAED,OAAO;QACH,kBAAkB;QAClB,aAAa;QACb,SAAS;KACZ,CAAC;AACN,CAAC"}

package/dist/identity/sso/sso-custodian-service.d.mts

@@ -1,139 +0,0 @@
-import { KeystoneChallengePool } from '@ibgib/core-gib/dist/keystone/keystone-types.mjs';
-import { MetaspaceService } from '@ibgib/core-gib/dist/witness/space/metaspace/metaspace-types.mjs';
-import { IbGibSpaceAny } from '@ibgib/core-gib/dist/witness/space/space-base-v1.mjs';
-import { SsoServerConfig, SsoProviderId, OAuthUserInfo, SsoProviderServerConfig, SsoProviderClientConfig } from './sso-types.mjs';
-/**
- * Server-side service for token exchange, JWT validation, and user profile normalization.
- */
-export declare class SsoCustodianService {
-    private config;
-    private lc;
-    private jwksCache;
-    private jwksTtlMs;
-    /**
-     * @param config The server's global SSO configuration.
-     *   - Visibility: Private (Contains high-entropy secrets like `ssoServerKdfSecret` and `sessionSecret`).
-     *   - Generator: Server (Bootstrapped from node environment variables on server initialization).
-     */
-    constructor(config: SsoServerConfig);
-    /**
-     * Exchanges an authorization code for an OAuth2 token and retrieves normalized user info.
-     *
-     * @param providerId The string identifier of the OAuth provider (e.g. 'google' or 'github').
-     *   - Visibility: Public (Non-sensitive metadata string).
-     *   - Generator: Client (Sent from browser UI selection).
-     *
-     * @param code The temporary authorization code returned by the OAuth provider.
-     *   - Visibility: Private (Confidential short-lived bearer credential. Must be kept private).
-     *   - Generator: Provider (Created by provider's OAuth page and sent to client redirect URI).
-     *
-     * @param redirectUri The redirect URI registered in the provider portal.
-     *   - Visibility: Public (Configuration URL).
-     *   - Generator: Client/Server (Derived from environmental configuration and sent by client).
-     */
-    getOAuthUserInfo(providerId: SsoProviderId, code: string, redirectUri: string): Promise<OAuthUserInfo>;
-    /**
-     * Directly validates a Google ID Token (JWT) locally and returns normalized user info.
-     * Useful for client-side authentication handshakes.
-     *
-     * @param idToken The raw base64-encoded signed JSON Web Token (JWT) ID token returned by Google.
-     *   - Visibility: Private (Sensitive bearer credential containing signature and claims. Must be kept private).
-     *   - Generator: Provider (Generated and signed cryptographically by Google authentication servers).
-     */
-    verifyAndNormalizeGoogleToken(idToken: string): Promise<OAuthUserInfo>;
-    /**
-     * Internal: Exchange authorization code for access token / ID token.
-     *
-     * @param providerConfig Server configuration settings for the specific provider.
-     *   - Visibility: Private (Contains provider client secrets. Must stay server-side).
-     *   - Generator: Server (Configured from node environment variables).
-     *
-     * @param code The temporary authorization code to exchange.
-     *   - Visibility: Private (Short-lived credential. Must be kept private).
-     *   - Generator: Provider (Via OAuth flow).
-     *
-     * @param redirectUri The redirect URI registered for the exchange.
-     *   - Visibility: Public (Configuration URL).
-     *   - Generator: Client/Server (From app configuration).
-     */
-    private exchangeCodeForTokens;
-    /**
-     * Internal: Fetch GitHub user profile and normalize.
-     *
-     * @param providerConfig Server configuration settings for GitHub.
-     *   - Visibility: Private (Contains GitHub client secret).
-     *   - Generator: Server (From environment config).
-     *
-     * @param accessToken The active OAuth2 access token to authorize the API call.
-     *   - Visibility: Private (Bearer token. Must be kept private).
-     *   - Generator: Provider (GitHub token endpoint).
-     */
-    private fetchAndNormalizeGithubUser;
-    /**
-     * Internal: Decodes and cryptographically verifies a JWT signature using JWKS public keys.
-     *
-     * @param token The raw base64-encoded JWT token to verify.
-     *   - Visibility: Private (Sensitive token. Must be kept private).
-     *   - Generator: Provider (Google / OIDC server).
-     *
-     * @param providerConfig The target provider server settings containing `jwksUrl`.
-     *   - Visibility: Private (Contains secrets).
-     *   - Generator: Server (From environment config).
-     */
-    verifyJwt(token: string, providerConfig: SsoProviderServerConfig): Promise<any>;
-    /**
-     * Internal: Retrieves JWKS keys from cache or fetches them from the provider's jwksUrl.
-     *
-     * @param providerConfig The provider config containing the target `jwksUrl`.
-     *   - Visibility: Private (Contains client secrets).
-     *   - Generator: Server (From environment config).
-     */
-    private getJwksKeys;
-    /**
-     * Derives a server-delegate master secret deterministically using the server's private KDF secret,
-     * the providerKey, and the user's public nonce.
-     *
-     * @param providerKey The unique key identifying the provider and user sub ID (e.g. `google:123...`).
-     *   - Visibility: Public (Identifier saved on parent's delegate claim, safe for log/ledger storage).
-     *   - Generator: Provider/Server (Derived by mapping provider user sub ID after authentication).
-     *
-     * @param userNonce The public, high-entropy nonce generated by the client to salt the KDF derivation.
-     *   - Visibility: Public (Salt value stored on parent's delegate claim, safe for ledger storage).
-     *   - Generator: Client (Generated offline on user's device).
-     */
-    deriveServerDelegateSecret(providerKey: string, userNonce: string): Promise<string>;
-    /**
-     * Creates a public custodian challenge pool (custodian-manage) derived deterministically
-     * from the server's private KDF secret, providerKey, and userNonce.
-     *
-     * @param providerKey The unique key identifying the provider and user sub ID (e.g. `google:123...`).
-     *   - Visibility: Public (Mapped identifier, safe for ledger).
-     *   - Generator: Provider/Server (Derived after successful token exchange).
-     *
-     * @param userNonce The public, high-entropy nonce.
-     *   - Visibility: Public (Derivation salt, safe for ledger).
-     *   - Generator: Client (Generated on user's device).
-     */
-    createCustodianChallengePool({ providerId, providerKey, userNonce, keystoneAddr, metaspace, space, }: {
-        providerId: string;
-        providerKey: string;
-        userNonce: string;
-        keystoneAddr: string;
-        metaspace: MetaspaceService;
-        space: IbGibSpaceAny;
-    }): Promise<KeystoneChallengePool>;
-    /**
-     * Maps private server configuration to safe public client configurations.
-     *
-     * @param hostUrl The root URL host address of the server (e.g. `https://space-gib.localhost` or `https://ibgib.space`).
-     *   - Visibility: Public (Non-sensitive hostname configuration).
-     *   - Generator: Server (Extracted from the HTTP request context headers/protocol).
-     */
-    getSsoClientConfigs(hostUrl: string): SsoProviderClientConfig[];
-    /**
-     * Revokes an active OAuth access or refresh token with the provider.
-     * Keeps token revocation logic DRY and centralized.
-     */
-    revokeToken(providerId: SsoProviderId, token: string): Promise<void>;
-}
-//# sourceMappingURL=sso-custodian-service.d.mts.map

package/dist/identity/sso/sso-custodian-service.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sso-custodian-service.d.mts","sourceRoot":"","sources":["../../../src/identity/sso/sso-custodian-service.mts"],"names":[],"mappings":"AAKA,OAAO,EAAoB,qBAAqB,EAAsB,MAAM,kDAAkD,CAAC;AAK/H,OAAO,EAAE,gBAAgB,EAAE,MAAM,kEAAkE,CAAC;AACpG,OAAO,EAAE,aAAa,EAAE,MAAM,sDAAsD,CAAC;AACrF,OAAO,EACH,eAAe,EACf,aAAa,EACb,aAAa,EACb,uBAAuB,EACvB,uBAAuB,EAC1B,MAAM,iBAAiB,CAAC;AAgBzB;;GAEG;AACH,qBAAa,mBAAmB;IAYhB,OAAO,CAAC,MAAM;IAX1B,OAAO,CAAC,EAAE,CAAmC;IAG7C,OAAO,CAAC,SAAS,CAAwE;IACzF,OAAO,CAAC,SAAS,CAAuB;IAExC;;;;OAIG;IACH,YAAoB,MAAM,EAAE,eAAe,EAAI;IAE/C;;;;;;;;;;;;;;OAcG;IACG,gBAAgB,CAAC,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA4B3G;IAED;;;;;;;OAOG;IACG,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA+B3E;IAED;;;;;;;;;;;;;;OAcG;YACW,qBAAqB;IAoCnC;;;;;;;;;;OAUG;YACW,2BAA2B;IAkCzC;;;;;;;;;;OAUG;IACU,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC,CAqD3F;IAED;;;;;;OAMG;YACW,WAAW;IA8BzB;;;;;;;;;;;OAWG;IACG,0BAA0B,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAWxF;IAED;;;;;;;;;;;OAWG;IACG,4BAA4B,CAAC,EAC/B,UAAU,EACV,WAAW,EACX,SAAS,EACT,YAAY,EACZ,SAAS,EACT,KAAK,GACR,EAAE;QACC,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,gBAAgB,CAAC;QAC5B,KAAK,EAAE,aAAa,CAAC;KACxB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAuEjC;IAED;;;;;;OAMG;IACH,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,uBAAuB,EAAE,CAwB9D;IAED;;;OAGG;IACG,WAAW,CAAC,UAAU,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwCzE;CACJ"}