@iwentsourcing/core 0.1.0

package/dist/authentication/jwt/validate-jwt.js

@@ -0,0 +1,66 @@
+import { extractObject, extractPart, parseJwt } from './parse-jwt.js';
+import { object } from '../../typing/object.js';
+import { optional } from '../../typing/optional.js';
+import { string } from '../../typing/string.js';
+import { verifyJwkSignature } from '../jwk/jwk-verify.js';
+import { createLogger } from '../../logger/logger.js';
+import { nowInSeconds } from '../../utils/now-in-seconds.js';
+import { parseAttributes } from '../create-open-id-instance.js';
+import { validate } from '../../typing/validate.js';
+import { record } from '../../typing/record.js';
+import { number } from '../../typing/number.js';
+import { assert } from '../../typing/assert.js';
+import { parsePath } from './parse-path.js';
+const logger = createLogger('jwt');
+export async function validateJwt(env, access_token, subKey, attributeKeys, keyResolver, signal) {
+    const header = parseJwt(access_token, 0, object('JwtHeader', {
+        kid: optional(string()),
+        x5t: optional(string()),
+    }));
+    const headerRaw = extractPart(access_token, 0);
+    const payloadRaw = extractPart(access_token, 1);
+    const signature = extractPart(access_token, 2);
+    const publicKey = await keyResolver(header, signal);
+    if (!publicKey) {
+        logger.warn(`no key found for ${header.kid}`);
+        return null;
+    }
+    const verified = await verifyJwkSignature(env, { payload: payloadRaw, header: headerRaw, signature }, publicKey);
+    if (!verified) {
+        logger.warn(`no valid signature for ${access_token}`);
+        return null;
+    }
+    const payloadObject = extractObject(access_token, 1);
+    assert(payloadObject, object('JwtPayload', {
+        nbf: optional(number()),
+        exp: number(),
+        aud: string(),
+        iss: string(),
+    }));
+    const now = nowInSeconds();
+    if (payloadObject.nbf) {
+        if (payloadObject.nbf > now) {
+            logger.warn(`not valid yet`);
+            return null;
+        }
+    }
+    if (payloadObject.exp) {
+        if (payloadObject.exp < now) {
+            logger.warn(`not valid anymore`);
+            return null;
+        }
+    }
+    const [, attributesToken] = validate(payloadObject, object('TokenAttribute', {
+        attributes: record(string(), string()),
+    }));
+    const sub = parsePath(subKey, payloadObject, string());
+    return {
+        payload: {
+            sub: sub,
+            iss: payloadObject.iss,
+            aud: payloadObject.aud,
+        },
+        attributes: parseAttributes(attributesToken?.attributes ?? {}, attributeKeys),
+    };
+}
+//# sourceMappingURL=validate-jwt.js.map

package/dist/authentication/jwt/validate-jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-jwt.js","sourceRoot":"","sources":["../../../src/authentication/jwt/validate-jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG1D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAE7D,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;AAEnC,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAe,EACf,YAAoB,EACpB,MAAc,EACd,aAAuB,EACvB,WAG2B,EAC3B,MAAmB;IAEnB,MAAM,MAAM,GAAG,QAAQ,CACrB,YAAY,EACZ,CAAC,EACD,MAAM,CAAC,WAAW,EAAE;QAClB,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACvB,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KACxB,CAAC,CACH,CAAC;IAEF,MAAM,SAAS,GAAG,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IAE/C,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,oBAAoB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CACvC,GAAG,EACH,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EACrD,SAAS,CACV,CAAC;IAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,0BAA0B,YAAY,EAAE,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,aAAa,GAAG,aAAa,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IAErD,MAAM,CACJ,aAAa,EACb,MAAM,CAAC,YAAY,EAAE;QACnB,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACvB,GAAG,EAAE,MAAM,EAAE;QACb,GAAG,EAAE,MAAM,EAAE;QACb,GAAG,EAAE,MAAM,EAAE;KACd,CAAC,CACH,CAAC;IAEF,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,IAAI,aAAa,CAAC,GAAG,EAAE,CAAC;QACtB,IAAI,aAAa,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,aAAa,CAAC,GAAG,EAAE,CAAC;QACtB,IAAI,aAAa,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,CAAC,EAAE,eAAe,CAAC,GAAG,QAAQ,CAClC,aAAa,EACb,MAAM,CAAC,gBAAgB,EAAE;QACvB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC;KACvC,CAAC,CACH,CAAC;IAEF,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;IAEvD,OAAO;QACL,OAAO,EAAE;YACP,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,aAAa,CAAC,GAAG;YACtB,GAAG,EAAE,aAAa,CAAC,GAAG;SACvB;QACD,UAAU,EAAE,eAAe,CACzB,eAAe,EAAE,UAAU,IAAI,EAAE,EACjC,aAAa,CACd;KACF,CAAC;AACJ,CAAC"}

package/dist/authentication/jwt-auth-definitions.d.ts

@@ -0,0 +1,6 @@
+import { AuthProviders } from './auth-providers.js';
+export type JwtAuthDefinitions<TAuth extends AuthProviders> = {
+    [Prop in keyof TAuth as TAuth[Prop] extends {
+        type: 'jwt';
+    } ? Prop : never]: TAuth[Prop];
+};

package/dist/authentication/jwt-auth-definitions.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=jwt-auth-definitions.js.map

package/dist/authentication/jwt-auth-definitions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-auth-definitions.js","sourceRoot":"","sources":["../../src/authentication/jwt-auth-definitions.ts"],"names":[],"mappings":""}

package/dist/authentication/jwt-store.d.ts

@@ -0,0 +1,23 @@
+import { TypeOf } from '../typing/type-of.js';
+import { Secret } from '../realm/secret.js';
+export declare const JwtStoreAlgorithm: import("../typing/union-type-description.js").UnionTypeDescription<"HS256">;
+export declare const JwtStore: import("../typing/object-type-description.js").ObjectTypeDescription<{
+    type: "jwt";
+    secret: string | {
+        type: "secret";
+        name: string;
+    };
+    algorithm: "HS256";
+    issuer: string;
+    audience: string;
+    expirationTime: string;
+}>;
+export type JwtStore = TypeOf<typeof JwtStore>;
+export interface JwtStoreOptions {
+    algorithm?: 'HS256';
+    secret: string | Secret;
+    issuer: string;
+    audience: string;
+    expirationTime?: string;
+}
+export declare function jwtStore(options: JwtStoreOptions): JwtStore;

package/dist/authentication/jwt-store.js

@@ -0,0 +1,25 @@
+import { object } from '../typing/object.js';
+import { literal } from '../typing/literal.js';
+import { union } from '../typing/union.js';
+import { string } from '../typing/string.js';
+import { Secret } from '../realm/secret.js';
+export const JwtStoreAlgorithm = union('JwtStoreAlgorithm', [literal('HS256')]);
+export const JwtStore = object('JwtStore', {
+    type: literal('jwt'),
+    algorithm: JwtStoreAlgorithm,
+    secret: union('JwtSecret', [string(), Secret]),
+    issuer: string(),
+    audience: string(),
+    expirationTime: string(),
+});
+export function jwtStore(options) {
+    return {
+        type: 'jwt',
+        algorithm: options.algorithm ?? 'HS256',
+        audience: options.audience,
+        issuer: options.issuer,
+        secret: options.secret,
+        expirationTime: options.expirationTime ?? '10min',
+    };
+}
+//# sourceMappingURL=jwt-store.js.map

package/dist/authentication/jwt-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-store.js","sourceRoot":"","sources":["../../src/authentication/jwt-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC,mBAAmB,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEhF,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE;IACzC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC;IACpB,SAAS,EAAE,iBAAiB;IAC5B,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,EAAE,MAAM,EAAE;IAChB,QAAQ,EAAE,MAAM,EAAE;IAClB,cAAc,EAAE,MAAM,EAAE;CACzB,CAAC,CAAC;AAWH,MAAM,UAAU,QAAQ,CAAC,OAAwB;IAC/C,OAAO;QACL,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO;QACvC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,OAAO;KAClD,CAAC;AACJ,CAAC"}

package/dist/authentication/keystore/create-key-store.d.ts

@@ -0,0 +1,8 @@
+import { KeyStore } from './key-store.js';
+import { RuntimeEnv } from '../../environment/runtime-env.js';
+import { JwtStore } from '../jwt-store.js';
+import { OpenIDProvider } from '../open-id-provider.js';
+import { TokenProvider } from '../token-provider.js';
+export declare function createKeyStore(env: RuntimeEnv, config: {
+    [key: string]: OpenIDProvider | JwtStore | TokenProvider;
+}): KeyStore;

package/dist/authentication/keystore/create-key-store.js

@@ -0,0 +1,24 @@
+import { createAuthProvider } from '../create-auth-provider.js';
+import { iterate } from '../../utils/iterate.js';
+export function createKeyStore(env, config) {
+    const issuers = {};
+    const providers = {};
+    for (const [key, provider] of Object.entries(config)) {
+        const store = createAuthProvider(env, key, provider);
+        providers[key] = store;
+        for (const issuer of iterate(provider.issuer)) {
+            if (!issuers[issuer]) {
+                issuers[issuer] = store;
+            }
+        }
+    }
+    return {
+        provider(provider) {
+            return providers[provider] ?? null;
+        },
+        issuer(issuer) {
+            return issuers[issuer] ?? null;
+        },
+    };
+}
+//# sourceMappingURL=create-key-store.js.map

package/dist/authentication/keystore/create-key-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-key-store.js","sourceRoot":"","sources":["../../../src/authentication/keystore/create-key-store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAQjD,MAAM,UAAU,cAAc,CAC5B,GAAe,EACf,MAEC;IAED,MAAM,OAAO,GAKT,EAAE,CAAC;IACP,MAAM,SAAS,GAKX,EAAE,CAAC;IAEP,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAErD,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAEvB,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrB,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,CAAC,QAAgB;YACvB,OAAO,SAAS,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;QACrC,CAAC;QACD,MAAM,CAAC,MAAc;YACnB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;QACjC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/authentication/keystore/create-key-store.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/authentication/keystore/create-key-store.test.js

@@ -0,0 +1,38 @@
+import { describe, it } from 'node:test';
+import { createKeyStore } from './create-key-store.js';
+import { createNodeEnv } from '../../node/create-node-env.js';
+import { jwtStore } from '../jwt-store.js';
+import { isDefined } from '../../utils/is-defined.js';
+import assert from 'node:assert';
+describe('create-key-store', () => {
+    const env = createNodeEnv();
+    it('should create local keystore', async (test) => {
+        const keystore = createKeyStore(env, {
+            test: jwtStore({
+                algorithm: 'HS256',
+                secret: '1234',
+                audience: 'local',
+                issuer: 'test',
+                expirationTime: '10m',
+            }),
+        });
+        const issuer = keystore.issuer('test');
+        isDefined(issuer);
+        isJwtKeyStore(issuer);
+        const tokens = await issuer.create({
+            refresh_token: 'a',
+            username: 'foo',
+            attributes: { foo: 'bar' },
+        }, test.signal);
+        const result = await issuer.verify(tokens.id_token, test.signal);
+        isDefined(result);
+        assert(result.payload.sub, 'foo');
+        assert(result.payload.iss, 'test');
+    });
+});
+function isJwtKeyStore(keystore) {
+    if (keystore.type !== 'jwt') {
+        throw new Error('not a jwt key store');
+    }
+}
+//# sourceMappingURL=create-key-store.test.js.map

package/dist/authentication/keystore/create-key-store.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-key-store.test.js","sourceRoot":"","sources":["../../../src/authentication/keystore/create-key-store.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,MAAM,MAAM,aAAa,CAAC;AAKjC,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,EAAE,CAAC,8BAA8B,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAChD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE;YACnC,IAAI,EAAE,QAAQ,CAAC;gBACb,SAAS,EAAE,OAAO;gBAClB,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,MAAM;gBACd,cAAc,EAAE,KAAK;aACtB,CAAC;SACH,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAEvC,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,aAAa,CAAC,MAAM,CAAC,CAAC;QAEtB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAChC;YACE,aAAa,EAAE,GAAG;YAClB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE;SAC3B,EACD,IAAI,CAAC,MAAM,CACZ,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACjE,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,SAAS,aAAa,CACpB,QAA2E;IAE3E,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;AACH,CAAC"}

package/dist/authentication/keystore/create-keystore-manager.d.ts

@@ -0,0 +1,6 @@
+import { KeyStore } from './key-store.js';
+import { RuntimeEnv } from '../../environment/runtime-env.js';
+import { Registry } from '../../registry/registry.js';
+export declare function createKeystoreManager(env: RuntimeEnv, registry: Registry): {
+    get(tenant: string, realm: string, signal: AbortSignal): Promise<KeyStore>;
+};

package/dist/authentication/keystore/create-keystore-manager.js

@@ -0,0 +1,22 @@
+import { createKeyStore } from './create-key-store.js';
+import { createLazy } from '../../lazy/create-lazy.js';
+import { CustomError } from '../../error/custom-error.js';
+export function createKeystoreManager(env, registry) {
+    const map = {};
+    return {
+        async get(tenant, realm, signal) {
+            const key = `${tenant}:${realm}`;
+            if (!map[key]) {
+                map[key] = createLazy(async () => {
+                    const auth = await registry.getAuth(tenant, realm, signal);
+                    if (!auth) {
+                        throw new CustomError('no auth providers', { realm, tenant });
+                    }
+                    return createKeyStore(env, auth);
+                });
+            }
+            return map[key].resolve();
+        },
+    };
+}
+//# sourceMappingURL=create-keystore-manager.js.map

package/dist/authentication/keystore/create-keystore-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-keystore-manager.js","sourceRoot":"","sources":["../../../src/authentication/keystore/create-keystore-manager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAKvD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAE1D,MAAM,UAAU,qBAAqB,CAAC,GAAe,EAAE,QAAkB;IACvE,MAAM,GAAG,GAAmC,EAAE,CAAC;IAC/C,OAAO;QACL,KAAK,CAAC,GAAG,CACP,MAAc,EACd,KAAa,EACb,MAAmB;YAEnB,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACd,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,CAAW,KAAK,IAAI,EAAE;oBACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;oBAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;wBACV,MAAM,IAAI,WAAW,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;oBAChE,CAAC;oBACD,OAAO,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACnC,CAAC,CAAC,CAAC;YACL,CAAC;YAED,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;QAC5B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/authentication/keystore/jwt-key-store-instance.d.ts

@@ -0,0 +1,11 @@
+import { JwtStore } from '../jwt-store.js';
+import { TokenRequest } from '../token-request.js';
+import { TokenResponse } from '../../management/authentication/token-response.js';
+import { TokenValidation } from './token-validation.js';
+export interface JwtKeyStoreInstance {
+    type: 'jwt';
+    config: JwtStore;
+    create(result: TokenRequest, signal: AbortSignal): Promise<TokenResponse>;
+    validate(access_token: string, signal: AbortSignal): Promise<TokenValidation | null>;
+    verify(access_token: string, signal: AbortSignal): Promise<TokenValidation | null>;
+}

package/dist/authentication/keystore/jwt-key-store-instance.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=jwt-key-store-instance.js.map

package/dist/authentication/keystore/jwt-key-store-instance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-key-store-instance.js","sourceRoot":"","sources":["../../../src/authentication/keystore/jwt-key-store-instance.ts"],"names":[],"mappings":""}

package/dist/authentication/keystore/key-store.d.ts

@@ -0,0 +1,7 @@
+import { OpenIdKeyStoreInstance } from './open-id-key-store-instance.js';
+import { JwtKeyStoreInstance } from './jwt-key-store-instance.js';
+import { TokenStoreInstance } from './token-store-instance.js';
+export interface KeyStore {
+    issuer(issuer: string): OpenIdKeyStoreInstance | JwtKeyStoreInstance | TokenStoreInstance | null;
+    provider(provider: string): OpenIdKeyStoreInstance | JwtKeyStoreInstance | TokenStoreInstance | null;
+}

package/dist/authentication/keystore/key-store.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=key-store.js.map

package/dist/authentication/keystore/key-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-store.js","sourceRoot":"","sources":["../../../src/authentication/keystore/key-store.ts"],"names":[],"mappings":""}

package/dist/authentication/keystore/keystore-manager.d.ts

@@ -0,0 +1,4 @@
+import { KeyStore } from './key-store.js';
+export interface KeystoreManager {
+    get(tenant: string, realm: string, signal: AbortSignal): Promise<KeyStore>;
+}

package/dist/authentication/keystore/keystore-manager.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=keystore-manager.js.map

package/dist/authentication/keystore/keystore-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keystore-manager.js","sourceRoot":"","sources":["../../../src/authentication/keystore/keystore-manager.ts"],"names":[],"mappings":""}

package/dist/authentication/keystore/open-id-key-store-instance.d.ts

@@ -0,0 +1,13 @@
+import { OpenIDProvider } from '../open-id-provider.js';
+import { TokenParseResult } from '../token-parse-result.js';
+import { TokenRequest } from '../token-request.js';
+import { TokenResponse } from '../../management/authentication/token-response.js';
+import { TokenValidation } from './token-validation.js';
+export interface OpenIdKeyStoreInstance {
+    config: OpenIDProvider;
+    type: 'openid';
+    create(result: TokenRequest, signal: AbortSignal): Promise<TokenResponse>;
+    validate(access_token: string, signal: AbortSignal): Promise<TokenValidation | null>;
+    verify(access_token: string, signal: AbortSignal): Promise<TokenValidation | null>;
+    parseTokenResult(response: unknown): Promise<TokenParseResult | null>;
+}

package/dist/authentication/keystore/open-id-key-store-instance.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=open-id-key-store-instance.js.map

package/dist/authentication/keystore/open-id-key-store-instance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-id-key-store-instance.js","sourceRoot":"","sources":["../../../src/authentication/keystore/open-id-key-store-instance.ts"],"names":[],"mappings":""}

package/dist/authentication/keystore/token-store-instance.d.ts

@@ -0,0 +1,13 @@
+import { TokenProvider } from '../token-provider.js';
+import { TokenRequest } from '../token-request.js';
+import { TokenParseResult } from '../token-parse-result.js';
+import { TokenResponse } from '../../management/authentication/token-response.js';
+import { TokenValidation } from './token-validation.js';
+export interface TokenStoreInstance {
+    type: 'token';
+    config: TokenProvider;
+    create(result: TokenRequest, signal: AbortSignal): Promise<TokenResponse>;
+    validate(access_token: string, signal: AbortSignal): Promise<TokenValidation | null>;
+    verify(access_token: string, signal: AbortSignal): Promise<TokenValidation | null>;
+    parseTokenResult(response: unknown, signal: AbortSignal): Promise<TokenParseResult | null>;
+}

package/dist/authentication/keystore/token-store-instance.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=token-store-instance.js.map

package/dist/authentication/keystore/token-store-instance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store-instance.js","sourceRoot":"","sources":["../../../src/authentication/keystore/token-store-instance.ts"],"names":[],"mappings":""}

package/dist/authentication/keystore/token-validation.d.ts

@@ -0,0 +1,8 @@
+export interface TokenValidation {
+    payload: {
+        aud: string;
+        iss: string;
+        sub: string;
+    };
+    attributes: Record<string, string>;
+}

package/dist/authentication/keystore/token-validation.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=token-validation.js.map

package/dist/authentication/keystore/token-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-validation.js","sourceRoot":"","sources":["../../../src/authentication/keystore/token-validation.ts"],"names":[],"mappings":""}

package/dist/authentication/oauth/auth-device-code-response.d.ts

@@ -0,0 +1,5 @@
+export declare const AuthDeviceCodeResponse: import("../../typing/object-type-description.js").ObjectTypeDescription<{
+    type: "code";
+    url: string;
+    userCode: string;
+}>;

package/dist/authentication/oauth/auth-device-code-response.js

@@ -0,0 +1,9 @@
+import { string } from '../../typing/string.js';
+import { object } from '../../typing/object.js';
+import { literal } from '../../typing/literal.js';
+export const AuthDeviceCodeResponse = object('AuthDeviceCodeResponse', {
+    type: literal('code'),
+    url: string(),
+    userCode: string(),
+});
+//# sourceMappingURL=auth-device-code-response.js.map

package/dist/authentication/oauth/auth-device-code-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-device-code-response.js","sourceRoot":"","sources":["../../../src/authentication/oauth/auth-device-code-response.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAElD,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,wBAAwB,EAAE;IACrE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,EAAE;IACb,QAAQ,EAAE,MAAM,EAAE;CACnB,CAAC,CAAC"}

package/dist/authentication/oauth/auth-device-expired-response.d.ts

@@ -0,0 +1,3 @@
+export declare const AuthDeviceExpiredResponse: import("../../typing/object-type-description.js").ObjectTypeDescription<{
+    type: "expired";
+}>;

package/dist/authentication/oauth/auth-device-expired-response.js

@@ -0,0 +1,6 @@
+import { literal } from '../../typing/literal.js';
+import { object } from '../../typing/object.js';
+export const AuthDeviceExpiredResponse = object('AuthDeviceExpiredResponse', {
+    type: literal('expired'),
+});
+//# sourceMappingURL=auth-device-expired-response.js.map

package/dist/authentication/oauth/auth-device-expired-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-device-expired-response.js","sourceRoot":"","sources":["../../../src/authentication/oauth/auth-device-expired-response.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAEhD,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,2BAA2B,EAAE;IAC3E,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC;CACzB,CAAC,CAAC"}

package/dist/authentication/oauth/auth-device-response.d.ts

@@ -0,0 +1,18 @@
+import { TypeOf } from '../../typing/type-of.js';
+export declare const AuthDeviceResponse: import("../../typing/union-type-description.js").UnionTypeDescription<{
+    type: "code";
+    url: string;
+    userCode: string;
+} | {
+    type: "expired";
+} | {
+    type: "token";
+    token: {
+        scope: string;
+        id_token: string;
+        refresh_token: string;
+        expires_in: number;
+        username: string;
+    };
+}>;
+export type AuthDeviceResponse = TypeOf<typeof AuthDeviceResponse>;

package/dist/authentication/oauth/auth-device-response.js

@@ -0,0 +1,10 @@
+import { AuthDeviceCodeResponse } from './auth-device-code-response.js';
+import { AuthDeviceTokenResponse } from './auth-device-token-response.js';
+import { AuthDeviceExpiredResponse } from './auth-device-expired-response.js';
+import { union } from '../../typing/union.js';
+export const AuthDeviceResponse = union('AuthDeviceResponse', [
+    AuthDeviceCodeResponse,
+    AuthDeviceTokenResponse,
+    AuthDeviceExpiredResponse,
+]);
+//# sourceMappingURL=auth-device-response.js.map

package/dist/authentication/oauth/auth-device-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-device-response.js","sourceRoot":"","sources":["../../../src/authentication/oauth/auth-device-response.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAG9C,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAC,oBAAoB,EAAE;IAC5D,sBAAsB;IACtB,uBAAuB;IACvB,yBAAyB;CAC1B,CAAC,CAAC"}

package/dist/authentication/oauth/auth-device-token-response.d.ts

@@ -0,0 +1,10 @@
+export declare const AuthDeviceTokenResponse: import("../../typing/object-type-description.js").ObjectTypeDescription<{
+    type: "token";
+    token: {
+        scope: string;
+        id_token: string;
+        refresh_token: string;
+        expires_in: number;
+        username: string;
+    };
+}>;

package/dist/authentication/oauth/auth-device-token-response.js

@@ -0,0 +1,8 @@
+import { TokenResponse } from '../../management/authentication/token-response.js';
+import { literal } from '../../typing/literal.js';
+import { object } from '../../typing/object.js';
+export const AuthDeviceTokenResponse = object('AuthDeviceTokenResponse', {
+    type: literal('token'),
+    token: TokenResponse,
+});
+//# sourceMappingURL=auth-device-token-response.js.map

package/dist/authentication/oauth/auth-device-token-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-device-token-response.js","sourceRoot":"","sources":["../../../src/authentication/oauth/auth-device-token-response.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mDAAmD,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAEhD,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,yBAAyB,EAAE;IACvE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC;IACtB,KAAK,EAAE,aAAa;CACrB,CAAC,CAAC"}

package/dist/authentication/oauth/auth-token-response.d.ts

@@ -0,0 +1,6 @@
+export declare const AuthTokenResponse: import("../../typing/object-type-description.js").ObjectTypeDescription<{
+    scope: string;
+    id_token: string;
+    refresh_token: string | undefined;
+    expires_in: number;
+}>;

package/dist/authentication/oauth/auth-token-response.js

@@ -0,0 +1,11 @@
+import { string } from '../../typing/string.js';
+import { object } from '../../typing/object.js';
+import { number } from '../../typing/number.js';
+import { optional } from '../../typing/optional.js';
+export const AuthTokenResponse = object('OAuthTokenResponse', {
+    id_token: string(),
+    refresh_token: optional(string()),
+    scope: string(),
+    expires_in: number(),
+});
+//# sourceMappingURL=auth-token-response.js.map

package/dist/authentication/oauth/auth-token-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-token-response.js","sourceRoot":"","sources":["../../../src/authentication/oauth/auth-token-response.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAEpD,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,oBAAoB,EAAE;IAC5D,QAAQ,EAAE,MAAM,EAAE;IAClB,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACjC,KAAK,EAAE,MAAM,EAAE;IACf,UAAU,EAAE,MAAM,EAAE;CACrB,CAAC,CAAC"}

package/dist/authentication/open-id-auth-definitions.d.ts

@@ -0,0 +1,6 @@
+import { AuthProviders } from './auth-providers.js';
+export type OpenIdAuthDefinitions<TAuth extends AuthProviders> = {
+    [Prop in keyof TAuth as TAuth[Prop] extends {
+        type: 'openid';
+    } ? Prop : never]: TAuth[Prop];
+};

package/dist/authentication/open-id-auth-definitions.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=open-id-auth-definitions.js.map

package/dist/authentication/open-id-auth-definitions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-id-auth-definitions.js","sourceRoot":"","sources":["../../src/authentication/open-id-auth-definitions.ts"],"names":[],"mappings":""}

package/dist/authentication/open-id-provider.d.ts

@@ -0,0 +1,47 @@
+import { TypeOf } from '../typing/type-of.js';
+export declare const OpenIDProvider: import("../typing/object-type-description.js").ObjectTypeDescription<{
+    type: "openid";
+    jwt: {
+        type: "jwt";
+        secret: string | {
+            type: "secret";
+            name: string;
+        };
+        algorithm: "HS256";
+        issuer: string;
+        audience: string;
+        expirationTime: string;
+    };
+    issuer: string | string[];
+    audience: string | string[] | undefined;
+    clientId: string | undefined;
+    clientSecret: string | {
+        type: "secret";
+        name: string;
+    } | undefined;
+    jwks: {
+        url: string;
+        subKey: string;
+    };
+    token: {
+        url: string;
+        formData: {
+            [key: string]: string;
+        };
+        tokenAttributes: string[] | undefined;
+    } | undefined;
+    authorize: {
+        url: string;
+        queryParams: {
+            [key: string]: string;
+        };
+    } | undefined;
+    deviceCode: {
+        clientSecret: boolean;
+        verificationUriName: string;
+        codeUrl: string;
+        grantType: string;
+        scope: string | undefined;
+    } | undefined;
+}>;
+export type OpenIDProvider = TypeOf<typeof OpenIDProvider>;

package/dist/authentication/open-id-provider.js

@@ -0,0 +1,39 @@
+import { object } from '../typing/object.js';
+import { string } from '../typing/string.js';
+import { record } from '../typing/record.js';
+import { optional } from '../typing/optional.js';
+import { union } from '../typing/union.js';
+import { array } from '../typing/array.js';
+import { literal } from '../typing/literal.js';
+import { Secret } from '../realm/secret.js';
+import { boolean } from '../typing/boolean.js';
+import { JwtStore } from './jwt-store.js';
+export const OpenIDProvider = object('OpenIDProvider', {
+    type: literal('openid'),
+    clientId: optional(string()),
+    clientSecret: optional(union('OpenIDClientSecret', [string(), Secret])),
+    jwks: object('OpenIDProviderJwks', {
+        url: string(),
+        subKey: string(),
+    }),
+    token: optional(object('OpenIDProviderToken', {
+        url: string(),
+        formData: record(string(), string()),
+        tokenAttributes: optional(array(string())),
+    })),
+    authorize: optional(object('OpenIDProviderAuthorize', {
+        url: string(),
+        queryParams: record(string(), string()),
+    })),
+    deviceCode: optional(object('OpenIDDeviceCode', {
+        verificationUriName: string(),
+        codeUrl: string(),
+        grantType: string(),
+        clientSecret: boolean(),
+        scope: optional(string()),
+    })),
+    issuer: union('OpenIDIssuer', [string(), array(string())]),
+    audience: optional(union('OpenIDAudience', [string(), array(string())])),
+    jwt: JwtStore,
+});
+//# sourceMappingURL=open-id-provider.js.map

package/dist/authentication/open-id-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-id-provider.js","sourceRoot":"","sources":["../../src/authentication/open-id-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,gBAAgB,EAAE;IACrD,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC;IACvB,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC5B,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACvE,IAAI,EAAE,MAAM,CAAC,oBAAoB,EAAE;QACjC,GAAG,EAAE,MAAM,EAAE;QACb,MAAM,EAAE,MAAM,EAAE;KACjB,CAAC;IACF,KAAK,EAAE,QAAQ,CACb,MAAM,CAAC,qBAAqB,EAAE;QAC5B,GAAG,EAAE,MAAM,EAAE;QACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC;QACpC,eAAe,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;KAC3C,CAAC,CACH;IACD,SAAS,EAAE,QAAQ,CACjB,MAAM,CAAC,yBAAyB,EAAE;QAChC,GAAG,EAAE,MAAM,EAAE;QACb,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC;KACxC,CAAC,CACH;IACD,UAAU,EAAE,QAAQ,CAClB,MAAM,CAAC,kBAAkB,EAAE;QACzB,mBAAmB,EAAE,MAAM,EAAE;QAC7B,OAAO,EAAE,MAAM,EAAE;QACjB,SAAS,EAAE,MAAM,EAAE;QACnB,YAAY,EAAE,OAAO,EAAE;QACvB,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KAC1B,CAAC,CACH;IACD,MAAM,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1D,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,GAAG,EAAE,QAAQ;CACd,CAAC,CAAC"}