@o3co/auth-provider-foundation 0.12.1 → 0.13.0

package/README.md

@@ -40,6 +40,7 @@ class HttpUserRepository implements UserRepository {
   constructor(options: {
     authenticateUrl: string;        // POST endpoint for username/password auth
     authenticateByTokenUrl: string; // POST endpoint for token-based auth
+    linkFederatedIdentityUrl?: string; // POST endpoint that links a federated identity (#482)
     timeout: number;                // request timeout in milliseconds
     maxResponseBytes?: number;      // response body cap, default 1 MiB
   });
@@ -49,6 +50,10 @@ class HttpUserRepository implements UserRepository {
 
   // POST authenticateByTokenUrl with body: { token }
   authenticateByToken(token: string): Promise<User | null>;
+
+  // POST linkFederatedIdentityUrl with body: { userId, provider, sub, token, claims }
+  // — present only when the URL is configured (#482)
+  linkFederatedIdentity?(userId: string, identity: FederatedIdentityLink): Promise<LinkFederatedIdentityResult>;
 }
 ```
 
@@ -57,13 +62,21 @@ class HttpUserRepository implements UserRepository {
 - Throws when the upstream returns 2xx with a body that is not a JSON `User`
   (`{ id: string, username: string, … }`) — an upstream failure, not a
   "user not found".
+- `linkFederatedIdentity` (#482): a `2xx` `User` is `{ ok: true, user }`;
+  `401` / `403` is `{ ok: false, reason: "refused" }`; `409` is
+  `{ ok: false, reason: "conflict" }`; anything else throws. The method is
+  absent when `linkFederatedIdentityUrl` is not configured, which is how the
+  federation routes know to refuse `?link=1` up front. What a Store checks
+  before answering `2xx` — never on an unverified or relay address, never by
+  e-mail alone — is in the
+  [session package README](../session/README.md#account-linking-across-federations-482).
 
 ### Constructor validation
 
 Every option is validated in the **constructor**, so a misconfigured deployment
 fails at boot rather than at the first login attempt.
 
-**Both URLs must use `https://`.** They carry plaintext user credentials — a
+**Every URL must use `https://`** (the link endpoint included). They carry plaintext user credentials — a
 password on `authenticateUrl`, a token on `authenticateByTokenUrl` — so an
 `http://` URL does not merely weaken the connection, it publishes the credential
 to every hop on the path.

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.mts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AA6B/E,eAAO,MAAM,uBAAuB,GAAI,WAAW;IAClD,WAAW,EAAE,cAAc,CAAC,cAAc,CAAC,CAAC;CAC5C,KAAG,IAkBH,CAAC;AAEF,OAAO,EACN,0BAA0B,EAC1B,kBAAkB,GAClB,MAAM,uCAAuC,CAAC"}
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.mts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AA6B/E,eAAO,MAAM,uBAAuB,GAAI,WAAW;IAClD,WAAW,EAAE,cAAc,CAAC,cAAc,CAAC,CAAC;CAC5C,KAAG,IAsBH,CAAC;AAEF,OAAO,EACN,0BAA0B,EAC1B,kBAAkB,GAClB,MAAM,uCAAuC,CAAC"}

package/dist/index.mjs

@@ -52,6 +52,10 @@ export const registerBuiltinAdapters = (factories) => {
         return new HttpUserRepository({
             authenticateUrl: config.authenticateUrl,
             authenticateByTokenUrl: config.authenticateByTokenUrl,
+            // #482: optional. Present → the repository can link a federated identity.
+            ...(typeof config.linkFederatedIdentityUrl === "string"
+                ? { linkFederatedIdentityUrl: config.linkFederatedIdentityUrl }
+                : {}),
             timeout: toNumber(config.timeout, DEFAULT_TIMEOUT_MS),
             maxResponseBytes: toNumber(config.maxResponseBytes, DEFAULT_MAX_RESPONSE_BYTES),
         });

package/dist/repositories/HttpUserRepository.d.mts

@@ -1,4 +1,4 @@
-import type { User, UserRepository } from "@o3co/auth-provider-core";
+import type { FederatedIdentityLink, LinkFederatedIdentityResult, User, UserRepository } from "@o3co/auth-provider-core";
 /**
  * Default ceiling on an upstream response body, in bytes.
  *
@@ -22,14 +22,30 @@ export declare class HttpUserRepository implements UserRepository {
     private authenticateByTokenUrl;
     private timeout;
     private maxResponseBytes;
-    constructor({ authenticateUrl, authenticateByTokenUrl, timeout, maxResponseBytes, }: {
+    private linkFederatedIdentityUrl?;
+    /**
+     * #482 — see {@link UserRepository.linkFederatedIdentity}. Present only when
+     * `linkFederatedIdentityUrl` is configured, which is how the federation routes
+     * know to refuse `?link=1` up front instead of at the callback.
+     */
+    readonly linkFederatedIdentity?: (userId: string, identity: FederatedIdentityLink) => Promise<LinkFederatedIdentityResult>;
+    constructor({ authenticateUrl, authenticateByTokenUrl, linkFederatedIdentityUrl, timeout, maxResponseBytes, }: {
         authenticateUrl: string;
         authenticateByTokenUrl: string;
+        /** #482: optional; the Store's link endpoint. Same https rule as the other two. */
+        linkFederatedIdentityUrl?: string;
         timeout: number;
         maxResponseBytes?: number;
     });
     authenticate(username: string, password: string): Promise<User | null>;
     authenticateByToken(token: string): Promise<User | null>;
+    /**
+     * POST `{ userId, provider, sub, token, claims }` to the Store's link endpoint
+     * (#482). A `2xx` `User` is the linked account; `401` / `403` is the Store's
+     * refusal (policy — an unverified or relay address, one identity per
+     * provider, …); `409` says the identity is already someone else's.
+     */
+    private linkViaHttp;
     private post;
 }
 //# sourceMappingURL=HttpUserRepository.d.mts.map

package/dist/repositories/HttpUserRepository.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"HttpUserRepository.d.mts","sourceRoot":"","sources":["../../src/repositories/HttpUserRepository.mts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAGrE;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,QAAc,CAAC;AAkItD;;;;;;;;;GASG;AACH,qBAAa,kBAAmB,YAAW,cAAc;IACxD,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,sBAAsB,CAAS;IACvC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,gBAAgB,CAAS;gBAErB,EACX,eAAe,EACf,sBAAsB,EACtB,OAAO,EACP,gBAA6C,GAC7C,EAAE;QACF,eAAe,EAAE,MAAM,CAAC;QACxB,sBAAsB,EAAE,MAAM,CAAC;QAC/B,OAAO,EAAE,MAAM,CAAC;QAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC1B;IAqBK,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAItE,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YAIhD,IAAI;CAqElB"}
+{"version":3,"file":"HttpUserRepository.d.mts","sourceRoot":"","sources":["../../src/repositories/HttpUserRepository.mts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACX,qBAAqB,EACrB,2BAA2B,EAC3B,IAAI,EACJ,cAAc,EACd,MAAM,0BAA0B,CAAC;AAMlC;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,QAAc,CAAC;AAkItD;;;;;;;;;GASG;AACH,qBAAa,kBAAmB,YAAW,cAAc;IACxD,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,sBAAsB,CAAS;IACvC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,wBAAwB,CAAC,CAAS;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAChC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,qBAAqB,KAC3B,OAAO,CAAC,2BAA2B,CAAC,CAAC;gBAE9B,EACX,eAAe,EACf,sBAAsB,EACtB,wBAAwB,EACxB,OAAO,EACP,gBAA6C,GAC7C,EAAE;QACF,eAAe,EAAE,MAAM,CAAC;QACxB,sBAAsB,EAAE,MAAM,CAAC;QAC/B,mFAAmF;QACnF,wBAAwB,CAAC,EAAE,MAAM,CAAC;QAClC,OAAO,EAAE,MAAM,CAAC;QAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC1B;IA4BK,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAKtE,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAI9D;;;;;OAKG;YACW,WAAW;YAWX,IAAI;CA4ElB"}

package/dist/repositories/HttpUserRepository.mjs

@@ -14,6 +14,8 @@
  * limitations under the License.
  */
 import { assertSecureEndpoint } from "../endpointUrl.mjs";
+/** The Store answered 409 to a link request: the identity is already someone else's (#482). */
+const CONFLICT = Symbol("conflict");
 /**
  * Default ceiling on an upstream response body, in bytes.
  *
@@ -152,9 +154,20 @@ export class HttpUserRepository {
     authenticateByTokenUrl;
     timeout;
     maxResponseBytes;
-    constructor({ authenticateUrl, authenticateByTokenUrl, timeout, maxResponseBytes = DEFAULT_MAX_RESPONSE_BYTES, }) {
+    linkFederatedIdentityUrl;
+    /**
+     * #482 — see {@link UserRepository.linkFederatedIdentity}. Present only when
+     * `linkFederatedIdentityUrl` is configured, which is how the federation routes
+     * know to refuse `?link=1` up front instead of at the callback.
+     */
+    linkFederatedIdentity;
+    constructor({ authenticateUrl, authenticateByTokenUrl, linkFederatedIdentityUrl, timeout, maxResponseBytes = DEFAULT_MAX_RESPONSE_BYTES, }) {
         this.authenticateUrl = assertSecureEndpoint(authenticateUrl, "authenticateUrl");
         this.authenticateByTokenUrl = assertSecureEndpoint(authenticateByTokenUrl, "authenticateByTokenUrl");
+        if (linkFederatedIdentityUrl !== undefined) {
+            this.linkFederatedIdentityUrl = assertSecureEndpoint(linkFederatedIdentityUrl, "linkFederatedIdentityUrl");
+            this.linkFederatedIdentity = (userId, identity) => this.linkViaHttp(userId, identity);
+        }
         if (!isPositiveIntegerWithin(timeout, MAX_TIMEOUT_MS)) {
             throw new Error(`HttpUserRepository: "timeout" must be a positive integer no greater than ` +
                 `${MAX_TIMEOUT_MS} milliseconds`);
@@ -166,12 +179,28 @@ export class HttpUserRepository {
         this.maxResponseBytes = maxResponseBytes;
     }
     async authenticate(username, password) {
+        // Without `acceptConflict` the sentinel is never produced — a 409 throws.
         return this.post(this.authenticateUrl, { email: username, password });
     }
     async authenticateByToken(token) {
         return this.post(this.authenticateByTokenUrl, { token });
     }
-    async post(url, body) {
+    /**
+     * POST `{ userId, provider, sub, token, claims }` to the Store's link endpoint
+     * (#482). A `2xx` `User` is the linked account; `401` / `403` is the Store's
+     * refusal (policy — an unverified or relay address, one identity per
+     * provider, …); `409` says the identity is already someone else's.
+     */
+    async linkViaHttp(userId, identity) {
+        const url = this.linkFederatedIdentityUrl;
+        const answer = await this.post(url, { userId, ...identity }, { acceptConflict: true });
+        if (answer === CONFLICT)
+            return { ok: false, reason: "conflict" };
+        if (answer === null)
+            return { ok: false, reason: "refused" };
+        return { ok: true, user: answer };
+    }
+    async post(url, body, options = {}) {
         const controller = new AbortController();
         let timedOut = false;
         // One absolute deadline for the whole exchange, expressed twice: as the
@@ -218,6 +247,9 @@ export class HttpUserRepository {
                 return parsed;
             }
             discardBody(res);
+            if (options.acceptConflict && res.status === 409) {
+                return CONFLICT;
+            }
             if (res.status === 401 || res.status === 403) {
                 return null;
             }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@o3co/auth-provider-foundation",
   "description": "Production HTTP user-authentication adapter for auth.provider",
-  "version": "0.12.1",
+  "version": "0.13.0",
   "license": "Apache-2.0",
   "engines": {
     "node": ">=22.0.0"
@@ -32,15 +32,15 @@
     }
   },
   "peerDependencies": {
-    "@o3co/auth-provider-core": "^0.12.1"
+    "@o3co/auth-provider-core": "^0.13.0"
   },
   "devDependencies": {
-    "@types/node": "^26.2.0",
+    "@types/node": "^26.5.0",
     "msw": "^2.15.0",
     "pino": "^10.3.1",
-    "vitest": "^4.1.11",
-    "@vitest/coverage-v8": "^4.1.10",
-    "@o3co/auth-provider-core": "0.12.1"
+    "vitest": "^5.0.0",
+    "@vitest/coverage-v8": "^5.0.0",
+    "@o3co/auth-provider-core": "0.13.0"
   },
   "scripts": {
     "prebuild": "rimraf dist",