@learncard/learn-cloud-service 2.5.34 → 2.5.36

package/src/helpers/share-content-auth/index.ts

@@ -0,0 +1,59 @@
+/**
+ * LC-2187 robust multi-credential sharing — LearnCloud service authorization.
+ *
+ * A narrow, reusable verifier foundation for the future service-only
+ * `share_content` storage routes (put/get/stat/delete of exact immutable
+ * objects plus the separate owner-recovery read intent). It is **not** wired to
+ * any route or server entrypoint and reads no environment/secrets; callers
+ * inject the trust configuration, DIDKit verification, clock and atomic replay
+ * store.
+ *
+ * No plaintext keys, credentials or source URIs are handled here: the request
+ * hash covers the opaque ciphertext envelope and the opaque owner-encrypted
+ * recovery.
+ */
+
+export * from './types';
+export {
+    SHARE_ID_BYTES,
+    extractSignedClaims,
+    parseShareContentAuthorizationClaims,
+} from './claims';
+export {
+    DEFAULT_MAX_CANONICAL_DEPTH,
+    DEFAULT_MAX_CANONICAL_REQUEST_BYTES,
+    ShareContentCanonicalizationError,
+    canonicalizeShareContentRequestBody,
+    computeShareContentRequestHash,
+    isBoundedNonce,
+    isCanonicalBase64Url,
+    isOpaqueIdentifier,
+    isPlainObject,
+    isSafeContentVersion,
+    isSafeEpochSecond,
+    isSha256Hex,
+    isShareContentOperation,
+} from './canonical';
+export {
+    DEFAULT_MAX_JTI_LENGTH,
+    DEFAULT_MAX_TOKEN_BYTES,
+    DEFAULT_MIN_JTI_LENGTH,
+    DISABLED_SHARE_CONTENT_TRUST_CONFIG,
+    HARD_MAX_CLOCK_SKEW_SECONDS,
+    HARD_MAX_TOKEN_BYTES,
+    HARD_MAX_TOKEN_TTL_SECONDS,
+    HARD_MIN_TOKEN_BYTES,
+    isShareContentTrustConfigActive,
+    resolveShareContentTrustConfig,
+} from './config';
+export { parseCompactJwt, validateShareContentJwtHeader } from './token';
+export {
+    createShareContentAuthorizationVerifier,
+    type CreateShareContentAuthorizationVerifierDependencies,
+} from './verifier';
+export {
+    createDidkitPresentationVerifier,
+    createSetIfAbsentReplayStore,
+    type LearnCardLike,
+    type SetIfAbsent,
+} from './adapters';

package/src/helpers/share-content-auth/token.ts

@@ -0,0 +1,148 @@
+import { isCanonicalBase64Url, isPlainObject } from './canonical';
+import type { ShareContentTrustConfig } from './types';
+
+/**
+ * Strict, bounded parsing of the compact JWS produced by DIDKit for a
+ * holder-signed Verifiable Presentation. Nothing here is trusted: parsing only
+ * establishes syntactic shape and the allowlisted signer before any resolver or
+ * signature verifier is invoked.
+ */
+
+/** Remote-key and extension headers are never valid for this purpose. */
+const FORBIDDEN_HEADER_FIELDS = ['jwk', 'jku', 'x5u', 'x5c', 'crit', 'enc', 'apu', 'apv'] as const;
+
+const MAX_KID_LENGTH = 512;
+
+export type ParsedCompactJwt = {
+    header: Record<string, unknown>;
+    payload: Record<string, unknown>;
+    signingInput: string;
+    signature: string;
+};
+
+export type ParseCompactJwtResult =
+    | { ok: true; parsed: ParsedCompactJwt }
+    | { ok: false; reason: 'TOKEN_TOO_LARGE' | 'MALFORMED_TOKEN' };
+
+export const parseCompactJwt = (token: unknown, maxBytes: number): ParseCompactJwtResult => {
+    if (typeof token !== 'string') return { ok: false, reason: 'MALFORMED_TOKEN' };
+    if (Buffer.byteLength(token, 'utf8') > maxBytes)
+        return { ok: false, reason: 'TOKEN_TOO_LARGE' };
+
+    const parts = token.split('.');
+
+    if (parts.length !== 3) return { ok: false, reason: 'MALFORMED_TOKEN' };
+
+    const [headerPart, payloadPart, signaturePart] = parts;
+
+    if (!headerPart || !payloadPart || !signaturePart) {
+        return { ok: false, reason: 'MALFORMED_TOKEN' };
+    }
+
+    if (
+        !isCanonicalBase64Url(headerPart) ||
+        !isCanonicalBase64Url(payloadPart) ||
+        !isCanonicalBase64Url(signaturePart)
+    ) {
+        return { ok: false, reason: 'MALFORMED_TOKEN' };
+    }
+
+    let header: unknown;
+    let payload: unknown;
+
+    try {
+        header = JSON.parse(Buffer.from(headerPart, 'base64url').toString('utf8'));
+        payload = JSON.parse(Buffer.from(payloadPart, 'base64url').toString('utf8'));
+    } catch {
+        return { ok: false, reason: 'MALFORMED_TOKEN' };
+    }
+
+    if (!isPlainObject(header) || !isPlainObject(payload)) {
+        return { ok: false, reason: 'MALFORMED_TOKEN' };
+    }
+
+    return {
+        ok: true,
+        parsed: {
+            header,
+            payload,
+            signingInput: `${headerPart}.${payloadPart}`,
+            signature: signaturePart,
+        },
+    };
+};
+
+export type ValidatedJwtHeader = {
+    signerDid: string;
+    /** Full `kid`, e.g. `did:web:brain.example#key-1`. */
+    verificationMethod: string;
+};
+
+export type ValidateJwtHeaderResult =
+    | { ok: true; value: ValidatedJwtHeader }
+    | {
+          ok: false;
+          reason:
+              | 'UNSUPPORTED_HEADER'
+              | 'UNSUPPORTED_ALGORITHM'
+              | 'MISSING_KID'
+              | 'UNKNOWN_SIGNER'
+              | 'UNKNOWN_VERIFICATION_METHOD';
+      };
+
+/**
+ * Validate the JOSE header and apply the exact DID + verification-method
+ * allowlist. This runs *before* the injected signature verifier, so an unknown
+ * `kid` can never trigger did:web/did:key network resolution.
+ */
+export const validateShareContentJwtHeader = (
+    header: Record<string, unknown>,
+    config: ShareContentTrustConfig
+): ValidateJwtHeaderResult => {
+    if (
+        Object.keys(header).some(field => !['alg', 'kid', 'typ'].includes(field)) ||
+        (header.typ !== undefined && header.typ !== 'JWT')
+    ) {
+        return { ok: false, reason: 'UNSUPPORTED_HEADER' };
+    }
+    for (const field of FORBIDDEN_HEADER_FIELDS) {
+        if (field in header) return { ok: false, reason: 'UNSUPPORTED_HEADER' };
+    }
+
+    const alg = header.alg;
+
+    if (typeof alg !== 'string' || !config.allowedAlgorithms.includes(alg)) {
+        return { ok: false, reason: 'UNSUPPORTED_ALGORITHM' };
+    }
+
+    const kid = header.kid;
+
+    if (typeof kid !== 'string' || kid.length === 0 || kid.length > MAX_KID_LENGTH) {
+        return { ok: false, reason: 'MISSING_KID' };
+    }
+
+    // Reject URLs / relative key references outright. Only a DID URL fragment is valid.
+    if (/^[a-z][a-z0-9+.-]*:/i.test(kid) && !kid.startsWith('did:')) {
+        return { ok: false, reason: 'UNSUPPORTED_HEADER' };
+    }
+
+    const hashIndex = kid.indexOf('#');
+
+    if (hashIndex <= 0 || hashIndex === kid.length - 1) {
+        return { ok: false, reason: 'MISSING_KID' };
+    }
+
+    const signerDid = kid.slice(0, hashIndex);
+
+    if (!signerDid.startsWith('did:')) return { ok: false, reason: 'MISSING_KID' };
+
+    if (!config.allowedServiceDids.includes(signerDid)) {
+        return { ok: false, reason: 'UNKNOWN_SIGNER' };
+    }
+
+    if (!config.allowedVerificationMethods.includes(kid)) {
+        return { ok: false, reason: 'UNKNOWN_VERIFICATION_METHOD' };
+    }
+
+    return { ok: true, value: { signerDid, verificationMethod: kid } };
+};

package/src/helpers/share-content-auth/types.ts

@@ -0,0 +1,195 @@
+/**
+ * LC-2187 — Brain → LearnCloud share-content service authorization types.
+ *
+ * This module is a reusable authorization *verifier foundation*. It is not
+ * registered on any router and it does not read the environment. Callers inject
+ * the trust configuration, the presentation verifier, the clock and the atomic
+ * replay store, so the unit tests exercise the real module without Redis,
+ * MongoDB, did:web resolution or unfinished storage/schema work.
+ */
+
+/** Signed purpose claim. V1 is the only accepted value. */
+export const SHARE_CONTENT_AUTH_PURPOSE = 'lc-share-content/v1' as const;
+
+/**
+ * Least-privilege operation allowlist. There is deliberately no `list`,
+ * `deleteOwner` or other wildcard/collection-wide privilege: every token is
+ * bound to exactly one immutable object. `readRecovery` is the separate
+ * owner-encrypted recovery read intent.
+ */
+export const SHARE_CONTENT_OPERATIONS = ['put', 'get', 'stat', 'delete', 'readRecovery'] as const;
+
+export type ShareContentOperation = (typeof SHARE_CONTENT_OPERATIONS)[number];
+
+/** Every key that may appear in the signed claims object. Unknown keys are rejected. */
+export const SHARE_CONTENT_CLAIM_FIELDS = [
+    'iss',
+    'aud',
+    'purpose',
+    'namespace',
+    'op',
+    'shareId',
+    'contentVersion',
+    'ownerProfileId',
+    'objectId',
+    'operationId',
+    'requestHash',
+    'iat',
+    'exp',
+    'jti',
+] as const;
+
+export type ShareContentClaimField = (typeof SHARE_CONTENT_CLAIM_FIELDS)[number];
+
+/** Claims signed by Brain and re-validated by LearnCloud. */
+export type ShareContentAuthorizationClaims = {
+    /** Issuer = holder = the allowlisted Brain service DID. */
+    iss: string;
+    /** LearnCloud service DID. */
+    aud: string;
+    purpose: typeof SHARE_CONTENT_AUTH_PURPOSE;
+    /** Service/network namespace (tenant or deployment scope). */
+    namespace: string;
+    op: ShareContentOperation;
+    /** 16-byte canonical base64url share id (22 chars). */
+    shareId: string;
+    contentVersion: number;
+    /** Opaque profile id. Existing ids are opaque strings, not necessarily UUIDs. */
+    ownerProfileId: string;
+    /** Immutable object identity for this exact content version. */
+    objectId: string;
+    /** Operation/idempotency identity. */
+    operationId: string;
+    /** Lowercase hex SHA-256 of the canonical full request body, incl. opaque recovery. */
+    requestHash: string;
+    iat: number;
+    exp: number;
+    /** CSPRNG nonce; single-use. */
+    jti: string;
+};
+
+/**
+ * The exact request context the token must be bound to. Callers build this from
+ * the validated route input; `requestHash` is produced with
+ * `computeShareContentRequestHash`.
+ */
+export type ShareContentAuthorizationRequest = {
+    namespace: string;
+    op: ShareContentOperation;
+    shareId: string;
+    contentVersion: number;
+    ownerProfileId: string;
+    objectId: string;
+    operationId: string;
+    requestHash: string;
+};
+
+/** Minimal authenticated context returned on success. Never contains the raw token. */
+export type ShareContentAuthorizationContext = {
+    signerDid: string;
+    /** Full `kid` verification method that signed the presentation. */
+    verificationMethod: string;
+    claims: ShareContentAuthorizationClaims;
+};
+
+/** Result shape of the existing DIDKit `verifyPresentation(..., { proofFormat: 'jwt' })`. */
+export type PresentationVerificationResult = {
+    checks: string[];
+    warnings: string[];
+    errors: string[];
+};
+
+/** Injected DIDKit adapter. The module never resolves keys itself. */
+export type PresentationVerifier = (token: string) => Promise<PresentationVerificationResult>;
+
+/**
+ * Injected atomic replay store. `consumeOnce` must be a single atomic
+ * SET-if-absent (e.g. Redis `SET key value NX EX ttl`) and must throw when the
+ * backing store is unavailable so the verifier can fail closed.
+ */
+export type ReplayStore = {
+    consumeOnce: (key: string, ttlSeconds: number) => Promise<boolean>;
+};
+
+/**
+ * Explicit trust configuration. An empty/disabled configuration denies all
+ * access (fail closed). There is deliberately no offline bypass flag.
+ *
+ * Key rotation assumptions (document-backed, not yet integration-tested):
+ * - A `did:web` identifier is stable across signing-seed rotation; the
+ *   verification method fragment in the JWT `kid` is what changes.
+ * - Operators must add the new verification method to
+ *   `allowedVerificationMethods` *before* the new key signs, and keep the old
+ *   entry for at least `maxTokenTtlSeconds + 2 * clockSkewSeconds` after the
+ *   last token signed by the old key.
+ * - did:web DID-document/resolver cache propagation must be validated in the
+ *   integration batch; this module never resolves a DID itself.
+ */
+export type ShareContentTrustConfig = {
+    enabled: boolean;
+    /** LearnCloud's own service DID. Must be non-empty when enabled. */
+    audience: string;
+    /** Exact allowed Brain service DIDs. A user DID must never be listed. */
+    allowedServiceDids: readonly string[];
+    /**
+     * Exact allowed verification methods (full `kid` values). Required: a DID
+     * alone does not authorize a key. Empty disables access.
+     */
+    allowedVerificationMethods: readonly string[];
+    /** Accepted JWS algorithms. Defaults to `EdDSA` only. */
+    allowedAlgorithms: readonly string[];
+    /** Bounded clock skew, seconds. */
+    clockSkewSeconds: number;
+    /** Maximum signed lifetime (`exp - iat`), seconds. Never above 60. */
+    maxTokenTtlSeconds: number;
+    /** Maximum raw token size in bytes. */
+    maxTokenBytes: number;
+    minJtiLength: number;
+    maxJtiLength: number;
+};
+
+/**
+ * Rejection reasons are stable, non-secret codes. Routes must map every one of
+ * them to a single generic external rejection; they must never be logged
+ * alongside token or claim payloads.
+ */
+export type ShareContentAuthorizationRejectionReason =
+    | 'DISABLED'
+    | 'INVALID_REQUEST'
+    | 'TOKEN_TOO_LARGE'
+    | 'MALFORMED_TOKEN'
+    | 'UNSUPPORTED_HEADER'
+    | 'UNSUPPORTED_ALGORITHM'
+    | 'MISSING_KID'
+    | 'UNKNOWN_SIGNER'
+    | 'UNKNOWN_VERIFICATION_METHOD'
+    | 'SIGNATURE_INVALID'
+    | 'SIGNER_MISMATCH'
+    | 'MALFORMED_CLAIMS'
+    | 'UNKNOWN_CLAIM_FIELD'
+    | 'INVALID_CLAIMS'
+    | 'INVALID_SHARE_ID'
+    | 'INVALID_IDENTIFIER'
+    | 'INVALID_JTI'
+    | 'AUDIENCE_MISMATCH'
+    | 'PURPOSE_MISMATCH'
+    | 'OPERATION_NOT_ALLOWED'
+    | 'INVALID_TTL'
+    | 'TOKEN_EXPIRED'
+    | 'TOKEN_NOT_YET_VALID'
+    | 'REQUEST_BINDING_MISMATCH'
+    | 'REQUEST_HASH_MISMATCH'
+    | 'REPLAY_DETECTED'
+    | 'REPLAY_STORE_UNAVAILABLE';
+
+export type ShareContentAuthorizationResult =
+    | { ok: true; context: ShareContentAuthorizationContext }
+    | { ok: false; reason: ShareContentAuthorizationRejectionReason };
+
+export type ShareContentAuthorizationVerifier = {
+    config: ShareContentTrustConfig;
+    authorize: (
+        request: ShareContentAuthorizationRequest,
+        token: string
+    ) => Promise<ShareContentAuthorizationResult>;
+};

package/src/helpers/share-content-auth/verifier.ts

@@ -0,0 +1,220 @@
+import { createHash } from 'node:crypto';
+
+import {
+    isCanonicalBase64Url,
+    isOpaqueIdentifier,
+    isPlainObject,
+    isSafeContentVersion,
+    isSha256Hex,
+    isShareContentOperation,
+} from './canonical';
+import {
+    SHARE_ID_BYTES,
+    extractSignedClaims,
+    parseShareContentAuthorizationClaims,
+} from './claims';
+import { isShareContentTrustConfigActive } from './config';
+import { parseCompactJwt, validateShareContentJwtHeader } from './token';
+import {
+    SHARE_CONTENT_AUTH_PURPOSE,
+    type PresentationVerificationResult,
+    type PresentationVerifier,
+    type ReplayStore,
+    type ShareContentAuthorizationContext,
+    type ShareContentAuthorizationRequest,
+    type ShareContentAuthorizationResult,
+    type ShareContentAuthorizationVerifier,
+    type ShareContentTrustConfig,
+} from './types';
+
+export type CreateShareContentAuthorizationVerifierDependencies = {
+    config: ShareContentTrustConfig;
+    /** Injected DIDKit presentation verification. Never called before allowlist filtering. */
+    verifyPresentation: PresentationVerifier;
+    /** Injected atomic single-use replay store. */
+    replayStore: ReplayStore;
+    /** Injected epoch-seconds clock. Defaults to `Date.now()`. */
+    now?: () => number;
+};
+
+const isValidAuthorizationRequest = (
+    request: unknown
+): request is ShareContentAuthorizationRequest => {
+    if (!isPlainObject(request)) return false;
+
+    const {
+        namespace,
+        op,
+        shareId,
+        contentVersion,
+        ownerProfileId,
+        objectId,
+        operationId,
+        requestHash,
+    } = request;
+
+    return (
+        isOpaqueIdentifier(namespace) &&
+        isShareContentOperation(op) &&
+        isCanonicalBase64Url(shareId, SHARE_ID_BYTES) &&
+        isSafeContentVersion(contentVersion) &&
+        isOpaqueIdentifier(ownerProfileId) &&
+        isOpaqueIdentifier(objectId) &&
+        isOpaqueIdentifier(operationId) &&
+        isSha256Hex(requestHash)
+    );
+};
+
+const isSignatureValid = (verification: PresentationVerificationResult | undefined): boolean =>
+    Boolean(
+        verification &&
+        Array.isArray(verification.errors) &&
+        Array.isArray(verification.checks) &&
+        verification.errors.length === 0 &&
+        verification.checks.includes('JWS')
+    );
+
+/**
+ * Build an authorization verifier over a fixed trust configuration.
+ *
+ * The returned `authorize(request, token)` is the only public entry point. It:
+ *   1. denies everything when the configuration is empty/disabled;
+ *   2. validates the expected request context;
+ *   3. strictly parses the bounded JWT and applies the exact DID + key-method
+ *      allowlist *before* calling the signature verifier;
+ *   4. cryptographically verifies, then re-binds kid → signer DID → `iss` →
+ *      `vp.holder` → signed `claims.iss`;
+ *   5. validates purpose/audience/operation/time/nonce and exact request
+ *      binding (including the canonical body hash);
+ *   6. atomically consumes the nonce for the full remaining acceptance window,
+ *      failing closed if the replay store errors.
+ *
+ * A fresh signed token (new `jti`) may retry the same idempotent operation;
+ * request idempotency is a separate concern owned by the storage layer.
+ */
+export const createShareContentAuthorizationVerifier = (
+    dependencies: CreateShareContentAuthorizationVerifierDependencies
+): ShareContentAuthorizationVerifier => {
+    const { config, verifyPresentation, replayStore } = dependencies;
+    const now = dependencies.now ?? (() => Math.floor(Date.now() / 1000));
+
+    const authorize = async (
+        request: ShareContentAuthorizationRequest,
+        token: string
+    ): Promise<ShareContentAuthorizationResult> => {
+        if (!isShareContentTrustConfigActive(config)) return { ok: false, reason: 'DISABLED' };
+        if (!isValidAuthorizationRequest(request)) return { ok: false, reason: 'INVALID_REQUEST' };
+
+        const parseResult = parseCompactJwt(token, config.maxTokenBytes);
+        if (!parseResult.ok) return parseResult;
+
+        const headerResult = validateShareContentJwtHeader(parseResult.parsed.header, config);
+        if (!headerResult.ok) return headerResult;
+
+        const { signerDid, verificationMethod } = headerResult.value;
+
+        let verification: PresentationVerificationResult;
+
+        try {
+            verification = await verifyPresentation(token);
+        } catch {
+            return { ok: false, reason: 'SIGNATURE_INVALID' };
+        }
+
+        if (!isSignatureValid(verification)) return { ok: false, reason: 'SIGNATURE_INVALID' };
+
+        const { payload } = parseResult.parsed;
+
+        // Recheck every identity claim against the key that actually signed,
+        // after cryptographic verification. Parsing alone never authenticates.
+        if (payload.iss !== signerDid) return { ok: false, reason: 'SIGNER_MISMATCH' };
+
+        const vp = payload.vp;
+        if (!isPlainObject(vp) || vp.holder !== signerDid) {
+            return { ok: false, reason: 'SIGNER_MISMATCH' };
+        }
+
+        const claimsResult = extractSignedClaims(payload);
+        if (!claimsResult.ok) return claimsResult;
+
+        const parsedClaims = parseShareContentAuthorizationClaims(claimsResult.raw, config);
+        if (!parsedClaims.ok) return parsedClaims;
+
+        const claims = parsedClaims.claims;
+
+        if (claims.iss !== signerDid) return { ok: false, reason: 'SIGNER_MISMATCH' };
+        if (claims.aud !== config.audience) return { ok: false, reason: 'AUDIENCE_MISMATCH' };
+        if (claims.purpose !== SHARE_CONTENT_AUTH_PURPOSE) {
+            return { ok: false, reason: 'PURPOSE_MISMATCH' };
+        }
+
+        const currentTime = now();
+        if (!Number.isSafeInteger(currentTime)) return { ok: false, reason: 'INVALID_TTL' };
+
+        const signedTtl = claims.exp - claims.iat;
+        if (signedTtl <= 0 || signedTtl > config.maxTokenTtlSeconds) {
+            return { ok: false, reason: 'INVALID_TTL' };
+        }
+
+        const { clockSkewSeconds } = config;
+
+        if (currentTime > claims.exp + clockSkewSeconds)
+            return { ok: false, reason: 'TOKEN_EXPIRED' };
+        if (claims.iat > currentTime + clockSkewSeconds) {
+            return { ok: false, reason: 'TOKEN_NOT_YET_VALID' };
+        }
+
+        // Exact expected context must match the signed claims before any replay
+        // consumption, so a mismatched request can never burn a valid nonce.
+        if (
+            claims.namespace !== request.namespace ||
+            claims.op !== request.op ||
+            claims.shareId !== request.shareId ||
+            claims.contentVersion !== request.contentVersion ||
+            claims.ownerProfileId !== request.ownerProfileId ||
+            claims.objectId !== request.objectId ||
+            claims.operationId !== request.operationId
+        ) {
+            return { ok: false, reason: 'REQUEST_BINDING_MISMATCH' };
+        }
+
+        if (claims.requestHash !== request.requestHash) {
+            return { ok: false, reason: 'REQUEST_HASH_MISMATCH' };
+        }
+
+        // Replay protection covers the whole acceptance window (expiry + skew).
+        // `iat` may itself be up to `skew` in the future, so the maximum
+        // derivable lifetime is maxTtl + 2 * skew.
+        const replayTtlSeconds = claims.exp + clockSkewSeconds - currentTime;
+        const maxReplayTtlSeconds = config.maxTokenTtlSeconds + 2 * clockSkewSeconds;
+
+        if (replayTtlSeconds <= 0 || replayTtlSeconds > maxReplayTtlSeconds) {
+            return { ok: false, reason: 'INVALID_TTL' };
+        }
+
+        const replayKey = `share-content-auth:jti:${createHash('sha256')
+            .update(`${signerDid}\u0000${claims.jti}`, 'utf8')
+            .digest('hex')}`;
+
+        let consumed: boolean;
+
+        try {
+            consumed = await replayStore.consumeOnce(replayKey, replayTtlSeconds);
+        } catch {
+            // Fail closed: an unavailable replay store must never widen access.
+            return { ok: false, reason: 'REPLAY_STORE_UNAVAILABLE' };
+        }
+
+        if (!consumed) return { ok: false, reason: 'REPLAY_DETECTED' };
+
+        const context: ShareContentAuthorizationContext = {
+            signerDid,
+            verificationMethod,
+            claims,
+        };
+
+        return { ok: true, context };
+    };
+
+    return { config, authorize };
+};