@manta-eu/lib 0.1.10 → 0.2.1

package/dist/custom-app.d.ts

@@ -0,0 +1,52 @@
+export declare const customAppClientIdPrefix = "ext-";
+export declare const customAppClientIdPattern: RegExp;
+export declare const maxCustomAppClientIdLength = 64;
+export declare function customAppClientIdProblem(clientId: unknown): string | undefined;
+export declare function redirectUrlProblem(raw: string): string | undefined;
+export declare const customAppUsersIdpAlias = "manta-custom-app-users";
+export declare const customAppUsersPath = "/agents/custom-app-users";
+export declare const customAppUserTokenPath = "/agents/custom-app-users/token";
+export declare const customAppUserIdPattern: RegExp;
+export declare const customAppUserFieldKeyPattern: RegExp;
+export declare const maxCustomAppUserFields = 50;
+export declare const maxCustomAppUserFieldLength = 1024;
+export declare const maxCustomAppUserAgentFieldsLength = 4096;
+export declare const maxCustomAppUserNameLength = 200;
+export declare const maxCustomAppUserEmailLength = 320;
+export declare const maxCustomAppUserTeams = 50;
+export declare const maxCustomAppUserDatastores = 50;
+export type CustomAppUserFieldValue = string | number | boolean;
+export type CustomAppUserField = {
+    value: CustomAppUserFieldValue;
+    agent?: boolean;
+};
+export type CustomAppUserProfile = {
+    name?: string;
+    email?: string;
+    fields?: Record<string, CustomAppUserField>;
+};
+export type CustomAppUserTokenRequest = CustomAppUserProfile & {
+    client_id: string;
+    client_secret: string;
+    user_id?: string;
+    anonymous_id?: string;
+    datastores?: string[];
+    teams?: string[];
+};
+export declare function customAppUserTeamsProblem(teams: unknown): string | undefined;
+export declare function customAppUserDatastoresProblem(datastores: unknown): string | undefined;
+export type CustomAppUserTokenResponse = {
+    access_token: string;
+    token_type: "Bearer";
+    expires_in: number;
+};
+export declare function customAppUserSubject(clientId: string, userId: string): string;
+export declare function customAppUserIdOfSubject(clientId: string, subject: string | undefined): string | undefined;
+export declare function anonymousSubject(clientId: string): string;
+export declare function customAppClientIdOfUsername(username: string | undefined): string | undefined;
+export declare function customAppUsernamePrefix(clientId: string): string;
+export declare function anonymousPrincipalId(clientId: string, anonymousId: string): string;
+export declare const anonymousVisitorIdName = "An anonymous visitor id";
+export declare function customAppUserIdProblem(userId: unknown, name?: string): string | undefined;
+export declare function customAppUserProfileProblem(profile: CustomAppUserProfile): string | undefined;
+//# sourceMappingURL=custom-app.d.ts.map

package/dist/custom-app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-app.d.ts","sourceRoot":"","sources":["../src/custom-app.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,uBAAuB,SAAS,CAAC;AAE9C,eAAO,MAAM,wBAAwB,QAAqB,CAAC;AAC3D,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAS9E;AAMD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAkBlE;AAED,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AAC/D,eAAO,MAAM,kBAAkB,6BAA6B,CAAC;AAC7D,eAAO,MAAM,sBAAsB,mCAAgC,CAAC;AACpE,eAAO,MAAM,sBAAsB,QAA8B,CAAC;AAClE,eAAO,MAAM,4BAA4B,QAAmC,CAAC;AAC7E,eAAO,MAAM,sBAAsB,KAAK,CAAC;AACzC,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAEhD,eAAO,MAAM,iCAAiC,OAAO,CAAC;AACtD,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAC9C,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAC/C,eAAO,MAAM,qBAAqB,KAAK,CAAC;AACxC,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAG7C,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAChE,MAAM,MAAM,kBAAkB,GAAG;IAAE,KAAK,EAAE,uBAAuB,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAErF,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG,oBAAoB,GAAG;IAC7D,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AAEF,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAQ5E;AAED,wBAAgB,8BAA8B,CAAC,UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAOtF;AAED,MAAM,MAAM,0BAA0B,GAAG;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5G,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAK1G;AAGD,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEzD;AAKD,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAE5F;AAED,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAElF;AAED,eAAO,MAAM,sBAAsB,4BAA4B,CAAC;AAEhE,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,SAAyB,GAAG,MAAM,GAAG,SAAS,CAKzG;AAgBD,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS,CA+B7F"}

package/dist/custom-app.js

@@ -0,0 +1,146 @@
+import { isPresent } from "./present.js";
+export const customAppClientIdPrefix = "ext-";
+// As the plugin's own pattern: anything else names no app, and each name would get its own rate limiter.
+export const customAppClientIdPattern = /^ext-[a-z0-9-]+$/;
+export const maxCustomAppClientIdLength = 64;
+export function customAppClientIdProblem(clientId) {
+    if (typeof clientId !== "string" ||
+        clientId.length > maxCustomAppClientIdLength ||
+        !customAppClientIdPattern.test(clientId)) {
+        return `${JSON.stringify(clientId)} is not a custom app's client ID, ext-...`;
+    }
+    return undefined;
+}
+const loopbackHosts = new Set(["localhost", "127.0.0.1", "[::1]"]);
+const maxRedirectUrlLength = 2048;
+// Keycloak compares a redirect URL with what the app sends as an exact string, so it is stored as typed.
+export function redirectUrlProblem(raw) {
+    if (raw.length > maxRedirectUrlLength)
+        return `Keep it under ${maxRedirectUrlLength} characters`;
+    if (raw.includes("*"))
+        return "Wildcards are not allowed";
+    if (/[\s,]/.test(raw))
+        return "Leave out commas and spaces, one URL per field";
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return "Enter a full URL, like https://app.example.com/callback";
+    }
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && loopbackHosts.has(url.hostname))) {
+        return "Use https, or http for localhost";
+    }
+    if (isPresent(url.username) || isPresent(url.password))
+        return "Leave out the username and password";
+    if (isPresent(url.hash))
+        return "Leave out the #fragment";
+    return undefined;
+}
+export const customAppUsersIdpAlias = "manta-custom-app-users";
+export const customAppUsersPath = "/agents/custom-app-users";
+export const customAppUserTokenPath = `${customAppUsersPath}/token`;
+export const customAppUserIdPattern = /^[A-Za-z0-9_.@|-]{1,128}$/;
+export const customAppUserFieldKeyPattern = /^[A-Za-z][A-Za-z0-9_.-]{0,63}$/;
+export const maxCustomAppUserFields = 50;
+export const maxCustomAppUserFieldLength = 1024;
+// The fields marked for the agent ride in every access token, so they are held well under a request header's size.
+export const maxCustomAppUserAgentFieldsLength = 4096;
+export const maxCustomAppUserNameLength = 200;
+export const maxCustomAppUserEmailLength = 320;
+export const maxCustomAppUserTeams = 50;
+export const maxCustomAppUserDatastores = 50;
+const maxTeamPathLength = 255;
+export function customAppUserTeamsProblem(teams) {
+    if (teams === undefined)
+        return undefined;
+    if (!Array.isArray(teams) || teams.length > maxCustomAppUserTeams)
+        return `teams lists at most ${maxCustomAppUserTeams} teams`;
+    const bad = teams.find((team) => typeof team !== "string" || !team.startsWith("/") || team.length < 2 || team.length > maxTeamPathLength);
+    return bad === undefined ? undefined : `A team is its path, like /Sales/EU; ${JSON.stringify(bad)} is not one`;
+}
+export function customAppUserDatastoresProblem(datastores) {
+    if (datastores === undefined)
+        return undefined;
+    if (!Array.isArray(datastores) || !isPresent(datastores) || datastores.length > maxCustomAppUserDatastores) {
+        return `datastores lists 1 to ${maxCustomAppUserDatastores} datastores, or is left out`;
+    }
+    const bad = datastores.find((datastore) => typeof datastore !== "string" || !isPresent(datastore));
+    return bad === undefined ? undefined : `A datastore is its id; ${JSON.stringify(bad)} is not one`;
+}
+export function customAppUserSubject(clientId, userId) {
+    return `app:${clientId}:${userId}`;
+}
+export function customAppUserIdOfSubject(clientId, subject) {
+    const prefix = customAppUserSubject(clientId, "");
+    return subject?.startsWith(prefix) === true && subject.length > prefix.length
+        ? subject.slice(prefix.length)
+        : undefined;
+}
+// Every anonymous visitor of one app shares this account; the visitor id rides in the token instead.
+export function anonymousSubject(clientId) {
+    return `anon:${clientId}`;
+}
+// Only accounts the Worker made carry app.<client id>.<hash>; an upgrade renames the account to its email.
+const generatedCustomAppUsername = /^app\.(ext-[a-z0-9-]+)\.([0-9a-f]{32}|anonymous)$/;
+export function customAppClientIdOfUsername(username) {
+    return generatedCustomAppUsername.exec(username ?? "")?.[1];
+}
+export function customAppUsernamePrefix(clientId) {
+    return `app.${clientId}.`;
+}
+export function anonymousPrincipalId(clientId, anonymousId) {
+    return `anon:${clientId}:${anonymousId}`;
+}
+export const anonymousVisitorIdName = "An anonymous visitor id";
+export function customAppUserIdProblem(userId, name = "A custom app user id") {
+    if (typeof userId !== "string" || !customAppUserIdPattern.test(userId)) {
+        return `${name} is 1 to 128 letters, digits or - _ . @ |`;
+    }
+    return undefined;
+}
+function fieldProblem(key, field) {
+    if (!customAppUserFieldKeyPattern.test(key))
+        return `Field name "${key}" must start with a letter and use letters, digits, - _ .`;
+    if (typeof field !== "object" || field === null || !("value" in field))
+        return `Field "${key}" needs a value`;
+    const { value, agent } = field;
+    if (!["string", "number", "boolean"].includes(typeof value))
+        return `Field "${key}" must be a string, number or boolean`;
+    if (typeof value === "string" && value.length > maxCustomAppUserFieldLength) {
+        return `Field "${key}" is longer than ${maxCustomAppUserFieldLength} characters`;
+    }
+    if (agent !== undefined && typeof agent !== "boolean")
+        return `Field "${key}" marks agent with true or false`;
+    return undefined;
+}
+export function customAppUserProfileProblem(profile) {
+    const { name, email, fields } = profile;
+    if (name !== undefined && (typeof name !== "string" || name.length > maxCustomAppUserNameLength)) {
+        return `A name is text of at most ${maxCustomAppUserNameLength} characters`;
+    }
+    if (email !== undefined &&
+        (typeof email !== "string" || email.length > maxCustomAppUserEmailLength || !email.includes("@"))) {
+        return "An email needs an @ and at most 320 characters";
+    }
+    if (fields === undefined)
+        return undefined;
+    if (typeof fields !== "object" || fields === null || Array.isArray(fields))
+        return "Fields are an object of named fields";
+    const entries = Object.entries(fields);
+    if (entries.length > maxCustomAppUserFields)
+        return `At most ${maxCustomAppUserFields} fields`;
+    for (const [key, field] of entries) {
+        const problem = fieldProblem(key, field);
+        if (problem !== undefined)
+            return problem;
+    }
+    const agentFieldsLength = entries.reduce((length, [key, field]) => field.agent === true
+        ? length + key.length + String(field.value).length
+        : length, 0);
+    if (agentFieldsLength > maxCustomAppUserAgentFieldsLength) {
+        return `The fields marked for the agent come to at most ${maxCustomAppUserAgentFieldsLength} characters, names included`;
+    }
+    return undefined;
+}
+//# sourceMappingURL=custom-app.js.map

package/dist/custom-app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-app.js","sourceRoot":"","sources":["../src/custom-app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAC9C,yGAAyG;AACzG,MAAM,CAAC,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AAC3D,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C,MAAM,UAAU,wBAAwB,CAAC,QAAiB;IACxD,IACE,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,CAAC,MAAM,GAAG,0BAA0B;QAC5C,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,EACxC,CAAC;QACD,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,2CAA2C,CAAC;IAChF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AACnE,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC,yGAAyG;AACzG,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,GAAG,CAAC,MAAM,GAAG,oBAAoB;QAAE,OAAO,iBAAiB,oBAAoB,aAAa,CAAC;IACjG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,2BAA2B,CAAC;IAC1D,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,gDAAgD,CAAC;IAE/E,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,yDAAyD,CAAC;IACnE,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAChG,OAAO,kCAAkC,CAAC;IAC5C,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,qCAAqC,CAAC;IACrG,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,yBAAyB,CAAC;IAC1D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AAC/D,MAAM,CAAC,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAC7D,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,kBAAkB,QAAQ,CAAC;AACpE,MAAM,CAAC,MAAM,sBAAsB,GAAG,2BAA2B,CAAC;AAClE,MAAM,CAAC,MAAM,4BAA4B,GAAG,gCAAgC,CAAC;AAC7E,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AACzC,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAChD,mHAAmH;AACnH,MAAM,CAAC,MAAM,iCAAiC,GAAG,IAAI,CAAC;AACtD,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAC9C,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAC/C,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACxC,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAC7C,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAoB9B,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,qBAAqB;QAC/D,OAAO,uBAAuB,qBAAqB,QAAQ,CAAC;IAC9D,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CACpB,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,iBAAiB,CAClH,CAAC;IACF,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,uCAAuC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC;AACjH,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,UAAmB;IAChE,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,0BAA0B,EAAE,CAAC;QAC3G,OAAO,yBAAyB,0BAA0B,6BAA6B,CAAC;IAC1F,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IACnG,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC;AACpG,CAAC;AAID,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,MAAc;IACnE,OAAO,OAAO,QAAQ,IAAI,MAAM,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,QAAgB,EAAE,OAA2B;IACpF,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAClD,OAAO,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM;QAC3E,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;QAC9B,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,QAAQ,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED,2GAA2G;AAC3G,MAAM,0BAA0B,GAAG,mDAAmD,CAAC;AAEvF,MAAM,UAAU,2BAA2B,CAAC,QAA4B;IACtE,OAAO,0BAA0B,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,OAAO,OAAO,QAAQ,GAAG,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,WAAmB;IACxE,OAAO,QAAQ,QAAQ,IAAI,WAAW,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,yBAAyB,CAAC;AAEhE,MAAM,UAAU,sBAAsB,CAAC,MAAe,EAAE,IAAI,GAAG,sBAAsB;IACnF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACvE,OAAO,GAAG,IAAI,2CAA2C,CAAC;IAC5D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,KAAc;IAC/C,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC;QACzC,OAAO,eAAe,GAAG,2DAA2D,CAAC;IACvF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC;QAAE,OAAO,UAAU,GAAG,iBAAiB,CAAC;IAC9G,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAA4C,CAAC;IACtE,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,KAAK,CAAC;QACzD,OAAO,UAAU,GAAG,uCAAuC,CAAC;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,2BAA2B,EAAE,CAAC;QAC5E,OAAO,UAAU,GAAG,oBAAoB,2BAA2B,aAAa,CAAC;IACnF,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,UAAU,GAAG,kCAAkC,CAAC;IAC9G,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,OAA6B;IACvE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACxC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,0BAA0B,CAAC,EAAE,CAAC;QACjG,OAAO,6BAA6B,0BAA0B,aAAa,CAAC;IAC9E,CAAC;IACD,IACE,KAAK,KAAK,SAAS;QACnB,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,2BAA2B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EACjG,CAAC;QACD,OAAO,gDAAgD,CAAC;IAC1D,CAAC;IACD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACxE,OAAO,sCAAsC,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,MAAM,GAAG,sBAAsB;QAAE,OAAO,WAAW,sBAAsB,SAAS,CAAC;IAC/F,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzC,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC;IAC5C,CAAC;IACD,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM,CACtC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACtB,KAA6B,CAAC,KAAK,KAAK,IAAI;QAC3C,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,MAAM,CAAE,KAA4B,CAAC,KAAK,CAAC,CAAC,MAAM;QAC1E,CAAC,CAAC,MAAM,EACZ,CAAC,CACF,CAAC;IACF,IAAI,iBAAiB,GAAG,iCAAiC,EAAE,CAAC;QAC1D,OAAO,mDAAmD,iCAAiC,6BAA6B,CAAC;IAC3H,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@manta-eu/lib",
-  "version": "0.1.10",
+  "version": "0.2.1",
   "description": "Pure TypeScript helpers shared across the Manta packages",
   "homepage": "https://developers.manta.eu",
   "keywords": [

package/src/custom-app.ts

@@ -0,0 +1,182 @@
+import { isPresent } from "./present";
+
+export const customAppClientIdPrefix = "ext-";
+// As the plugin's own pattern: anything else names no app, and each name would get its own rate limiter.
+export const customAppClientIdPattern = /^ext-[a-z0-9-]+$/;
+export const maxCustomAppClientIdLength = 64;
+
+export function customAppClientIdProblem(clientId: unknown): string | undefined {
+  if (
+    typeof clientId !== "string" ||
+    clientId.length > maxCustomAppClientIdLength ||
+    !customAppClientIdPattern.test(clientId)
+  ) {
+    return `${JSON.stringify(clientId)} is not a custom app's client ID, ext-...`;
+  }
+  return undefined;
+}
+
+const loopbackHosts = new Set(["localhost", "127.0.0.1", "[::1]"]);
+const maxRedirectUrlLength = 2048;
+
+// Keycloak compares a redirect URL with what the app sends as an exact string, so it is stored as typed.
+export function redirectUrlProblem(raw: string): string | undefined {
+  if (raw.length > maxRedirectUrlLength) return `Keep it under ${maxRedirectUrlLength} characters`;
+  if (raw.includes("*")) return "Wildcards are not allowed";
+  if (/[\s,]/.test(raw)) return "Leave out commas and spaces, one URL per field";
+
+  let url: URL;
+  try {
+    url = new URL(raw);
+  } catch {
+    return "Enter a full URL, like https://app.example.com/callback";
+  }
+
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopbackHosts.has(url.hostname))) {
+    return "Use https, or http for localhost";
+  }
+  if (isPresent(url.username) || isPresent(url.password)) return "Leave out the username and password";
+  if (isPresent(url.hash)) return "Leave out the #fragment";
+  return undefined;
+}
+
+export const customAppUsersIdpAlias = "manta-custom-app-users";
+export const customAppUsersPath = "/agents/custom-app-users";
+export const customAppUserTokenPath = `${customAppUsersPath}/token`;
+export const customAppUserIdPattern = /^[A-Za-z0-9_.@|-]{1,128}$/;
+export const customAppUserFieldKeyPattern = /^[A-Za-z][A-Za-z0-9_.-]{0,63}$/;
+export const maxCustomAppUserFields = 50;
+export const maxCustomAppUserFieldLength = 1024;
+// The fields marked for the agent ride in every access token, so they are held well under a request header's size.
+export const maxCustomAppUserAgentFieldsLength = 4096;
+export const maxCustomAppUserNameLength = 200;
+export const maxCustomAppUserEmailLength = 320;
+export const maxCustomAppUserTeams = 50;
+export const maxCustomAppUserDatastores = 50;
+const maxTeamPathLength = 255;
+
+export type CustomAppUserFieldValue = string | number | boolean;
+export type CustomAppUserField = { value: CustomAppUserFieldValue; agent?: boolean };
+
+export type CustomAppUserProfile = {
+  name?: string;
+  email?: string;
+  fields?: Record<string, CustomAppUserField>;
+};
+
+export type CustomAppUserTokenRequest = CustomAppUserProfile & {
+  client_id: string;
+  client_secret: string;
+  user_id?: string;
+  anonymous_id?: string;
+  datastores?: string[];
+  teams?: string[];
+};
+
+export function customAppUserTeamsProblem(teams: unknown): string | undefined {
+  if (teams === undefined) return undefined;
+  if (!Array.isArray(teams) || teams.length > maxCustomAppUserTeams)
+    return `teams lists at most ${maxCustomAppUserTeams} teams`;
+  const bad = teams.find(
+    (team) => typeof team !== "string" || !team.startsWith("/") || team.length < 2 || team.length > maxTeamPathLength,
+  );
+  return bad === undefined ? undefined : `A team is its path, like /Sales/EU; ${JSON.stringify(bad)} is not one`;
+}
+
+export function customAppUserDatastoresProblem(datastores: unknown): string | undefined {
+  if (datastores === undefined) return undefined;
+  if (!Array.isArray(datastores) || !isPresent(datastores) || datastores.length > maxCustomAppUserDatastores) {
+    return `datastores lists 1 to ${maxCustomAppUserDatastores} datastores, or is left out`;
+  }
+  const bad = datastores.find((datastore) => typeof datastore !== "string" || !isPresent(datastore));
+  return bad === undefined ? undefined : `A datastore is its id; ${JSON.stringify(bad)} is not one`;
+}
+
+export type CustomAppUserTokenResponse = { access_token: string; token_type: "Bearer"; expires_in: number };
+
+export function customAppUserSubject(clientId: string, userId: string): string {
+  return `app:${clientId}:${userId}`;
+}
+
+export function customAppUserIdOfSubject(clientId: string, subject: string | undefined): string | undefined {
+  const prefix = customAppUserSubject(clientId, "");
+  return subject?.startsWith(prefix) === true && subject.length > prefix.length
+    ? subject.slice(prefix.length)
+    : undefined;
+}
+
+// Every anonymous visitor of one app shares this account; the visitor id rides in the token instead.
+export function anonymousSubject(clientId: string): string {
+  return `anon:${clientId}`;
+}
+
+// Only accounts the Worker made carry app.<client id>.<hash>; an upgrade renames the account to its email.
+const generatedCustomAppUsername = /^app\.(ext-[a-z0-9-]+)\.([0-9a-f]{32}|anonymous)$/;
+
+export function customAppClientIdOfUsername(username: string | undefined): string | undefined {
+  return generatedCustomAppUsername.exec(username ?? "")?.[1];
+}
+
+export function customAppUsernamePrefix(clientId: string): string {
+  return `app.${clientId}.`;
+}
+
+export function anonymousPrincipalId(clientId: string, anonymousId: string): string {
+  return `anon:${clientId}:${anonymousId}`;
+}
+
+export const anonymousVisitorIdName = "An anonymous visitor id";
+
+export function customAppUserIdProblem(userId: unknown, name = "A custom app user id"): string | undefined {
+  if (typeof userId !== "string" || !customAppUserIdPattern.test(userId)) {
+    return `${name} is 1 to 128 letters, digits or - _ . @ |`;
+  }
+  return undefined;
+}
+
+function fieldProblem(key: string, field: unknown): string | undefined {
+  if (!customAppUserFieldKeyPattern.test(key))
+    return `Field name "${key}" must start with a letter and use letters, digits, - _ .`;
+  if (typeof field !== "object" || field === null || !("value" in field)) return `Field "${key}" needs a value`;
+  const { value, agent } = field as { value: unknown; agent?: unknown };
+  if (!["string", "number", "boolean"].includes(typeof value))
+    return `Field "${key}" must be a string, number or boolean`;
+  if (typeof value === "string" && value.length > maxCustomAppUserFieldLength) {
+    return `Field "${key}" is longer than ${maxCustomAppUserFieldLength} characters`;
+  }
+  if (agent !== undefined && typeof agent !== "boolean") return `Field "${key}" marks agent with true or false`;
+  return undefined;
+}
+
+export function customAppUserProfileProblem(profile: CustomAppUserProfile): string | undefined {
+  const { name, email, fields } = profile;
+  if (name !== undefined && (typeof name !== "string" || name.length > maxCustomAppUserNameLength)) {
+    return `A name is text of at most ${maxCustomAppUserNameLength} characters`;
+  }
+  if (
+    email !== undefined &&
+    (typeof email !== "string" || email.length > maxCustomAppUserEmailLength || !email.includes("@"))
+  ) {
+    return "An email needs an @ and at most 320 characters";
+  }
+  if (fields === undefined) return undefined;
+  if (typeof fields !== "object" || fields === null || Array.isArray(fields))
+    return "Fields are an object of named fields";
+  const entries = Object.entries(fields);
+  if (entries.length > maxCustomAppUserFields) return `At most ${maxCustomAppUserFields} fields`;
+  for (const [key, field] of entries) {
+    const problem = fieldProblem(key, field);
+    if (problem !== undefined) return problem;
+  }
+  const agentFieldsLength = entries.reduce(
+    (length, [key, field]) =>
+      (field as { agent?: boolean }).agent === true
+        ? length + key.length + String((field as { value: unknown }).value).length
+        : length,
+    0,
+  );
+  if (agentFieldsLength > maxCustomAppUserAgentFieldsLength) {
+    return `The fields marked for the agent come to at most ${maxCustomAppUserAgentFieldsLength} characters, names included`;
+  }
+  return undefined;
+}

package/dist/external-app.d.ts

@@ -1,3 +0,0 @@
-export declare const externalAppClientIdPrefix = "ext-";
-export declare function redirectUrlProblem(raw: string): string | undefined;
-//# sourceMappingURL=external-app.d.ts.map

package/dist/external-app.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"external-app.d.ts","sourceRoot":"","sources":["../src/external-app.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,yBAAyB,SAAS,CAAC;AAMhD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAkBlE"}

package/dist/external-app.js

@@ -1,29 +0,0 @@
-import { isPresent } from "./present.js";
-export const externalAppClientIdPrefix = "ext-";
-const loopbackHosts = new Set(["localhost", "127.0.0.1", "[::1]"]);
-const maxRedirectUrlLength = 2048;
-// Keycloak compares a redirect URL with what the app sends as an exact string, so it is stored as typed.
-export function redirectUrlProblem(raw) {
-    if (raw.length > maxRedirectUrlLength)
-        return `Keep it under ${maxRedirectUrlLength} characters`;
-    if (raw.includes("*"))
-        return "Wildcards are not allowed";
-    if (/[\s,]/.test(raw))
-        return "Leave out commas and spaces, one URL per field";
-    let url;
-    try {
-        url = new URL(raw);
-    }
-    catch {
-        return "Enter a full URL, like https://app.example.com/callback";
-    }
-    if (url.protocol !== "https:" && !(url.protocol === "http:" && loopbackHosts.has(url.hostname))) {
-        return "Use https, or http for localhost";
-    }
-    if (isPresent(url.username) || isPresent(url.password))
-        return "Leave out the username and password";
-    if (isPresent(url.hash))
-        return "Leave out the #fragment";
-    return undefined;
-}
-//# sourceMappingURL=external-app.js.map

package/dist/external-app.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"external-app.js","sourceRoot":"","sources":["../src/external-app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEhD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AACnE,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC,yGAAyG;AACzG,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,GAAG,CAAC,MAAM,GAAG,oBAAoB;QAAE,OAAO,iBAAiB,oBAAoB,aAAa,CAAC;IACjG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,2BAA2B,CAAC;IAC1D,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,gDAAgD,CAAC;IAE/E,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,yDAAyD,CAAC;IACnE,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAChG,OAAO,kCAAkC,CAAC;IAC5C,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,qCAAqC,CAAC;IACrG,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,yBAAyB,CAAC;IAC1D,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/src/external-app.ts

@@ -1,27 +0,0 @@
-import { isPresent } from "./present";
-
-export const externalAppClientIdPrefix = "ext-";
-
-const loopbackHosts = new Set(["localhost", "127.0.0.1", "[::1]"]);
-const maxRedirectUrlLength = 2048;
-
-// Keycloak compares a redirect URL with what the app sends as an exact string, so it is stored as typed.
-export function redirectUrlProblem(raw: string): string | undefined {
-  if (raw.length > maxRedirectUrlLength) return `Keep it under ${maxRedirectUrlLength} characters`;
-  if (raw.includes("*")) return "Wildcards are not allowed";
-  if (/[\s,]/.test(raw)) return "Leave out commas and spaces, one URL per field";
-
-  let url: URL;
-  try {
-    url = new URL(raw);
-  } catch {
-    return "Enter a full URL, like https://app.example.com/callback";
-  }
-
-  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopbackHosts.has(url.hostname))) {
-    return "Use https, or http for localhost";
-  }
-  if (isPresent(url.username) || isPresent(url.password)) return "Leave out the username and password";
-  if (isPresent(url.hash)) return "Leave out the #fragment";
-  return undefined;
-}