@o3co/auth-provider-foundation 0.16.0 → 0.17.0-rc.2

package/dist/repositories/HttpUserRepository.mjs

@@ -13,46 +13,31 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import { describeWeakSecret, MIN_SECRET_ENTROPY_BYTES, measureSecretEntropyBytes, } from "@o3co/auth-provider-core";
 import { assertSecureEndpoint, endpointForMessage } from "../endpointUrl.mjs";
-import { readFailure, requestFailure, StoreCredentialRefusedError } from "./storeErrors.mjs";
-import { hasBearerChallenge } from "./wwwAuthenticate.mjs";
-/** The Store answered 409 to a link request: the identity is already someone else's (#482). */
+import { markMfaEnrolledAtStore } from "../mfa/markEnrolled.mjs";
+import { bearerAuthorization, checkStoreResponseCap, checkStoreTimeout, DEFAULT_MAX_RESPONSE_BYTES, postToStore, } from "../storeTransport.mjs";
+export { DEFAULT_MAX_RESPONSE_BYTES };
+/** What this repository's messages lead with. */
+const OWNER = "HttpUserRepository";
+/** Whether a status is a `2xx`, the answers whose body is read. */
+const isSuccess = (status) => status >= 200 && status < 300;
+/** The Store answered 409 to a link request: the identity is already someone else's. */
 const CONFLICT = Symbol("conflict");
 /**
- * Default ceiling on an upstream response body, in bytes.
- *
- * A `User` record is a few hundred bytes; 1 MiB is generous for one carrying
- * custom claims and small enough that a hostile or broken Store cannot walk the
- * process out of memory one login at a time (#285).
- */
-export const DEFAULT_MAX_RESPONSE_BYTES = 1024 * 1024;
-/**
- * Largest delay Node's timer subsystem represents. Anything above it is
- * silently clamped to 1ms — so an operator writing a very large number meaning
- * "be patient" would otherwise get the most impatient timeout possible.
- */
-const MAX_TIMEOUT_MS = 2_147_483_647;
-/**
- * Runtime guard for the upstream user-service response. The previous
- * `(await res.json()) as User` was a compile-time cast only — a malformed
- * upstream payload (`{ status: "ok" }`, schema migration, tampered
- * response) silently produced a `User` with `undefined` required fields,
- * leaking `sub: undefined` into the authentication flow.
- *
- * The guard accepts any object with string `id` and `username`,
- * preserving the index-signature `[key: string]: unknown` extras that
- * `User` allows. Empty strings pass — bcrypt compare and downstream
- * gates prevent empty-credential authentication in practice; tightening
- * to `.min(1)` is a Phase F follow-up if needed.
- *
- * Per TS-2 (Wave 5g).
+ * Runtime guard for the Store's user response, so a malformed payload cannot
+ * become a `User` whose `id` is missing or empty: an empty `id` names nobody,
+ * and OpenID Connect Core §2 requires the `sub` it becomes to be a locally
+ * unique identifier. Accepts any object with a non-empty string `id` and
+ * `username`, keeping the extras `User`'s index signature allows.
  */
 function isUser(v) {
     if (typeof v !== "object" || v === null)
         return false;
     const o = v;
-    return typeof o.id === "string" && typeof o.username === "string";
+    return (typeof o.id === "string" &&
+        o.id.length > 0 &&
+        typeof o.username === "string" &&
+        o.username.length > 0);
 }
 const COVERAGE_FIELD = "federatedIdentityLookupCoverage";
 const COVERAGE_KEYS = new Set([
@@ -159,184 +144,19 @@ function lookupAnswer(value) {
     }
 }
 /**
- * RFC 6750 §2.1 `b64token` — the characters a bearer credential may carry.
- * Nothing in it is whitespace or a control character, so a token that
- * matches cannot break the header it rides in.
- */
-const B64TOKEN = /^[A-Za-z0-9\-._~+/]+=*$/;
-const BEARER_TOKEN_FIELD = "bearerToken";
-/**
- * The credential presented to the Store, checked (#285's rule: at
- * construction, so a deployment that would send an unusable one fails at
- * boot) and turned into the `Authorization` value; `undefined` when none is
- * configured, which sends no `Authorization` header at all.
- *
- * The shape is refused here and not left to `fetch`: a header value `fetch`
- * refuses is one it QUOTES in the `TypeError` it throws, on the request path,
- * where the session routes log what is thrown. The strength is core's
- * shared-secret floor (`MIN_SECRET_ENTROPY_BYTES`, measured on the decoded
- * length as `SESSION_SECRET` is): whoever holds this token speaks to the Store
- * as auth.provider — resolves an identity to its user, links one to any user.
- * No message quotes the value.
- */
-function bearerAuthorization(value) {
-    if (value === undefined)
-        return undefined;
-    const refuse = (problem) => new Error(`HttpUserRepository: "${BEARER_TOKEN_FIELD}" ${problem}`);
-    if (typeof value !== "string")
-        throw refuse("must be a string");
-    if (value === "") {
-        throw refuse('must not be empty — HOCON substitutes an exported-but-empty variable as ""; ' +
-            "leave it unset to send no Authorization header");
-    }
-    if (!B64TOKEN.test(value)) {
-        throw refuse("must be a bare RFC 6750 token: letters, digits and - . _ ~ + /, then optional = padding — " +
-            'no whitespace, no line break, and no "Bearer " prefix (the scheme is added)');
-    }
-    const actualBytes = measureSecretEntropyBytes(value);
-    if (actualBytes < MIN_SECRET_ENTROPY_BYTES) {
-        throw new Error(`HttpUserRepository: ${describeWeakSecret(actualBytes, {
-            configKey: "repositories.user.http.bearerToken",
-            envVar: "CLIENT_USER_BEARER_TOKEN",
-        })}`);
-    }
-    return `Bearer ${value}`;
-}
-/** Whether `value` is a positive integer that fits `bound`. */
-function isPositiveIntegerWithin(value, bound) {
-    return typeof value === "number" && Number.isInteger(value) && value > 0 && value <= bound;
-}
-/**
- * Releases a response body we are not going to read.
- *
- * Without this an error or 401 leaves the body unconsumed, and undici holds the
- * socket until the response is garbage collected rather than returning it to
- * the keep-alive pool — a slow leak on the failure path, which is exactly the
- * path a struggling deployment spends its time on.
- *
- * Deliberately not awaited: cancelling is a signal to the transport, and how
- * long the peer takes to act on it is the peer's business. Awaiting would hand
- * a hostile Store a second way to stall the caller — the one the request
- * deadline exists to close — and some interceptors never settle it at all.
- */
-function discardBody(res) {
-    res.body?.cancel().catch(() => {
-        // Already consumed, already errored, or aborted — nothing to release.
-    });
-}
-/**
- * Reads at most `limit` bytes of `res` and returns them as text, throwing once
- * the limit is passed.
- *
- * `Content-Length` is checked first so an honest oversized response is refused
- * before a byte of it is read, but the streaming count is the load-bearing
- * half: a hostile Store simply omits the header (or lies), and chunked transfer
- * encoding has none to omit.
- *
- * Everything it throws is the adapter's own: the cap, the deadline's
- * rejection, or — for a stream that broke mid-read — what `unreadable` makes
- * of the transport's error, which is never passed on as it is. `endpoint` is
- * how its messages name the Store: origin and path (`endpointForMessage`).
- */
-async function readBodyCapped(res, limit, endpoint, deadline, unreadable) {
-    const declared = Number(res.headers.get("content-length"));
-    if (Number.isFinite(declared) && declared > limit) {
-        discardBody(res);
-        throw new Error(`HttpUserRepository: upstream ${endpoint} response exceeds the ${limit}-byte cap ` +
-            `(Content-Length: ${declared})`);
-    }
-    if (res.body === null)
-        return "";
-    const reader = res.body.getReader();
-    const decoder = new TextDecoder();
-    let text = "";
-    let read = 0;
-    try {
-        for (;;) {
-            // Raced against the deadline rather than relying on `signal` alone:
-            // aborting a request does not reliably interrupt a `read()` already
-            // in flight, which is exactly the slow-loris shape — headers arrive
-            // promptly, then the body dribbles or stops. One absolute deadline
-            // for the whole exchange, not a fresh one per chunk.
-            const { done, value } = await Promise.race([
-                reader.read().catch((err) => {
-                    throw unreadable(err);
-                }),
-                deadline,
-            ]);
-            if (done)
-                break;
-            read += value.byteLength;
-            if (read > limit) {
-                throw new Error(`HttpUserRepository: upstream ${endpoint} response exceeds the ${limit}-byte cap`);
-            }
-            text += decoder.decode(value, { stream: true });
-        }
-    }
-    finally {
-        // Tears down the connection when we bail out early; a no-op once the
-        // stream has completed on its own. Not awaited, for the reason given on
-        // `discardBody`.
-        reader.cancel().catch(() => { });
-    }
-    return text + decoder.decode();
-}
-/**
- * Whether `err` is the abort our own deadline raised on the `fetch` itself —
- * the case where the response headers never arrive.
- *
- * A deliberately shallow check. An aborted `fetch` rejects with the
- * `AbortError` directly; the wrapping that `fetch` does apply is for network
- * failures, which are not aborts. If some runtime did wrap one, the request
- * still fails — as a `StoreTransportError` ("could not be reached") instead of
- * a `TimeoutError`, a misnamed failure rather than a missed one, and not worth
- * an untestable `cause` walk.
- * A stalled *body* is not covered here at all: that is the deadline race in
- * `readBodyCapped`, which does not depend on abort semantics.
- */
-function isAbortError(err) {
-    // Optional chaining rather than a `typeof` guard: it covers `null`,
-    // `undefined` and a thrown primitive in the same expression, with no
-    // branch that only a contrived throw could reach.
-    const name = err?.name;
-    return name === "AbortError" || name === "TimeoutError";
-}
-/**
- * `UserRepository` backed by "the Store" — the upstream user service defined
+ * `UserRepository` backed by "the Store", the upstream user service defined
  * on core's `User` doc (`@o3co/auth-provider-core`, `src/repositories/types.mts`).
+ * See README, The wire contract and Constructor validation.
  *
  * Every endpoint receives a plaintext credential or a verified identity, so
- * each is validated at **construction**: a deployment configured with an
- * `http://` Store URL fails at boot rather than leaking the first user's
- * password (#285). `http://` is accepted for loopback hosts only — see
- * `src/endpointUrl.mts` for the carve-out and its rationale.
- *
- * No request follows a redirect, so a URL that passed that check is the only
- * place its body is ever sent and the only one whose answer is taken: a `3xx`
- * from the Store is an upstream failure, thrown like any other unexpected
- * status, and its `Location` is never contacted.
- *
- * With `bearerToken` configured, every request — authentication, linking and
- * the identity lookup alike — carries `Authorization: Bearer <token>`, so the
- * Store can refuse a caller that is not this deployment; without it, no
- * request carries an `Authorization` header. The Store says it refused THIS
- * deployment by answering `401` or `403` with a `Bearer` challenge (RFC 6750
- * §3), and that answer, while a token was sent, throws a
- * {@link StoreCredentialRefusedError} on every request — never "no such user"
- * or a refused link, which is what either status without the challenge still
- * means.
- *
- * A transport's own error is never thrown: undici's parser errors quote the
- * bytes they rejected, and a peer that reflects the request puts the
- * `Authorization` header — or a password — there. A request that cannot be
- * made, or an answer that cannot be read, throws a `StoreTransportError`
- * (`src/repositories/storeErrors.mts`): a fixed message naming the endpoint
- * and what failed, at most an allowlisted transport code, no cause.
- *
- * Every message names an endpoint by its origin and path alone
- * (`endpointForMessage`, `src/endpointUrl.mts`): a Store URL may carry a
- * query string, and a query may carry a credential, while every caller logs
- * what this throws.
+ * each is validated at **construction** (`src/endpointUrl.mts`), and no
+ * request follows a redirect. With `bearerToken`, every request carries
+ * `Authorization: Bearer <token>`, and a `401` or `403` with a `Bearer`
+ * challenge throws a `StoreCredentialRefusedError`. A transport's own
+ * error is never thrown, because it may quote the request: a failure throws a
+ * `StoreTransportError` with a fixed message, at most an allowlisted transport
+ * code, and no cause. Every message names an endpoint by origin and path
+ * alone.
  */
 export class HttpUserRepository {
     /**
@@ -353,29 +173,40 @@ export class HttpUserRepository {
     findSubjectByFederatedIdentityUrl;
     coverage;
     /**
-     * #482 — see {@link UserRepository.linkFederatedIdentity}. Present only when
+     * See {@link UserRepository.linkFederatedIdentity}. Present only when
      * `linkFederatedIdentityUrl` is configured, which is how the federation routes
      * know to refuse `?link=1` up front instead of at the callback.
      */
     linkFederatedIdentity;
     /**
-     * #613 — see {@link UserRepository.supportsFederatedIdentityLookup}. Present
+     * See {@link UserRepository.supportsFederatedIdentityLookup}. Present
      * together with the lookup, only when `findSubjectByFederatedIdentityUrl` is
      * configured: absent, a deployment that requires the lookup is refused at
      * boot by the method's name, which is the message that says what to set.
      * Answers from the declaration alone — the Store is not asked at boot.
      */
     supportsFederatedIdentityLookup;
-    /** #613 — see {@link UserRepository.findSubjectByFederatedIdentity}. Present with the probe. */
+    /** See {@link UserRepository.findSubjectByFederatedIdentity}. Present with the probe. */
     findSubjectByFederatedIdentity;
-    constructor({ authenticateUrl, authenticateByTokenUrl, linkFederatedIdentityUrl, findSubjectByFederatedIdentityUrl, federatedIdentityLookupCoverage, bearerToken, timeout, maxResponseBytes = DEFAULT_MAX_RESPONSE_BYTES, }) {
+    /**
+     * See {@link UserRepository.markMfaEnrolled}. Present only when
+     * `markMfaEnrolledUrl` is configured, which is how
+     * `supportsMfaEnrollmentWitness` detects it; written as the Store's MFA
+     * endpoints are (`src/mfa/markEnrolled.mts`).
+     */
+    markMfaEnrolled;
+    constructor({ authenticateUrl, authenticateByTokenUrl, linkFederatedIdentityUrl, findSubjectByFederatedIdentityUrl, federatedIdentityLookupCoverage, markMfaEnrolledUrl, bearerToken, timeout, maxResponseBytes = DEFAULT_MAX_RESPONSE_BYTES, }) {
         this.authenticateUrl = assertSecureEndpoint(authenticateUrl, "authenticateUrl");
         this.authenticateByTokenUrl = assertSecureEndpoint(authenticateByTokenUrl, "authenticateByTokenUrl");
-        this.#authorization = bearerAuthorization(bearerToken);
+        this.#authorization = bearerAuthorization(bearerToken, OWNER);
         if (linkFederatedIdentityUrl !== undefined) {
             this.linkFederatedIdentityUrl = assertSecureEndpoint(linkFederatedIdentityUrl, "linkFederatedIdentityUrl");
             this.linkFederatedIdentity = (userId, identity) => this.linkViaHttp(userId, identity);
         }
+        if (markMfaEnrolledUrl !== undefined) {
+            const url = assertSecureEndpoint(markMfaEnrolledUrl, "markMfaEnrolledUrl");
+            this.markMfaEnrolled = (subject, enrolled) => markMfaEnrolledAtStore(url, this.settings(), OWNER, subject, enrolled);
+        }
         this.coverage = validateCoverage(federatedIdentityLookupCoverage);
         if (findSubjectByFederatedIdentityUrl !== undefined) {
             this.findSubjectByFederatedIdentityUrl = assertSecureEndpoint(findSubjectByFederatedIdentityUrl, "findSubjectByFederatedIdentityUrl");
@@ -392,38 +223,23 @@ export class HttpUserRepository {
             throw new Error(`HttpUserRepository: "${COVERAGE_FIELD}" declares what the Store's lookup covers, and no ` +
                 '"findSubjectByFederatedIdentityUrl" names that lookup — set the URL, or remove the declaration');
         }
-        if (!isPositiveIntegerWithin(timeout, MAX_TIMEOUT_MS)) {
-            throw new Error(`HttpUserRepository: "timeout" must be a positive integer no greater than ` +
-                `${MAX_TIMEOUT_MS} milliseconds`);
-        }
-        this.timeout = timeout;
-        if (!isPositiveIntegerWithin(maxResponseBytes, Number.MAX_SAFE_INTEGER)) {
-            throw new Error('HttpUserRepository: "maxResponseBytes" must be a positive integer');
-        }
-        this.maxResponseBytes = maxResponseBytes;
-    }
-    /** What every request carries: the body's type and, when configured, the credential. */
-    headers() {
-        return this.#authorization === undefined
-            ? { "Content-Type": "application/json" }
-            : { "Content-Type": "application/json", Authorization: this.#authorization };
+        this.timeout = checkStoreTimeout(timeout, OWNER);
+        this.maxResponseBytes = checkStoreResponseCap(maxResponseBytes, OWNER);
     }
     /**
-     * Throws {@link StoreCredentialRefusedError} when a non-`2xx` answer is the
-     * Store refusing this deployment's credential: a `401` or `403` with a
-     * `Bearer` challenge, to a request that carried the token. Read before any
-     * other reading of the status — without it a token the Store does not
-     * accept is every login "no such user" and every link "refused", with
-     * nothing logged. Without a token sent, a challenge is not about one, and a
-     * Store whose stack challenges every refusal keeps the wire meaning it has
-     * always had.
+     * What every request is sent with: the credential, when configured, the
+     * deadline and the cap. A `401` or `403` with a `Bearer` challenge to a
+     * request that carried the credential throws `StoreCredentialRefusedError`
+     * before any other reading of the status (`postToStore`): otherwise a
+     * token the Store does not accept is every login "no such user" and every
+     * link "refused", with nothing logged.
      */
-    assertCredentialAccepted(res, endpoint) {
-        if (this.#authorization !== undefined &&
-            (res.status === 401 || res.status === 403) &&
-            hasBearerChallenge(res.headers.get("www-authenticate"))) {
-            throw new StoreCredentialRefusedError(endpoint, res.status);
-        }
+    settings() {
+        return {
+            authorization: this.#authorization,
+            timeout: this.timeout,
+            maxResponseBytes: this.maxResponseBytes,
+        };
     }
     async authenticate(username, password) {
         // Without `acceptConflict` the sentinel is never produced — a 409 throws.
@@ -433,8 +249,8 @@ export class HttpUserRepository {
         return this.post(this.authenticateByTokenUrl, { token });
     }
     /**
-     * POST `{ userId, provider, sub, token, claims }` to the Store's link endpoint
-     * (#482). A `2xx` `User` is the linked account; `401` / `403` is the Store's
+     * POST `{ userId, provider, sub, token, claims }` to the Store's link
+     * endpoint. A `2xx` `User` is the linked account; `401` / `403` is the Store's
      * refusal (policy — an unverified or relay address, one identity per
      * provider, …); `409` says the identity is already someone else's.
      */
@@ -455,7 +271,7 @@ export class HttpUserRepository {
     }
     /**
      * POST `{ provider, issuer, clientId, sub, claims }` to the Store's lookup
-     * (#613) and read one of the port's three answers. Answered locally, with
+     * and read one of the port's three answers. Answered locally, with
      * no request, where the declaration already decides: a registration nobody
      * declared is `registration_not_covered`, and a declared one arriving
      * without a claim its strategy needs is `identity_not_resolvable`. Every
@@ -482,191 +298,79 @@ export class HttpUserRepository {
     }
     /**
      * The lookup's transport: the same deadline, cap and abort as {@link post},
-     * and like it never follows a redirect — the body carries a verified
-     * identity, and a `Location` is not a configured endpoint. None of
-     * {@link post}'s readings, though. A `401`/`403` is not "nobody", a `409` is
-     * not a conflict, a `404` is not an absence: only a `2xx` carrying one of the
-     * three answers is an answer, and everything else throws — as an outage,
-     * which is what a lookup that could not be made is — a `401` or `403` with a
-     * `Bearer` challenge, to a request that carried the token, as the refused
-     * credential it is. What is thrown names the endpoint by origin and path — and, for an answer
-     * with a status, the status; for a transport failure, at most its code — and
-     * never the body, the identity, a status text or an underlying cause.
+     * and like it never follows a redirect (the body carries a verified identity,
+     * and a `Location` is not a configured endpoint). None of {@link post}'s
+     * readings: only a `2xx` carrying one of the three answers is an answer.
+     * Everything else throws as an outage, except a `401` or `403` with a
+     * `Bearer` challenge to a request that carried the token, which throws as the
+     * refused credential it is. What is thrown names the endpoint by origin and
+     * path, plus the status for an answer or at most the code for a transport
+     * failure, and never the body, the identity, a status text or a cause.
      */
     async postLookup(url, body) {
         // What every message names: origin and path, never the query.
         const endpoint = endpointForMessage(url);
-        const controller = new AbortController();
-        let timedOut = false;
-        const timeoutError = () => {
-            const error = new Error(`HttpUserRepository: request to ${endpoint} timed out after ${this.timeout}ms`);
-            error.name = "TimeoutError";
-            return error;
-        };
-        let fireDeadline = () => { };
-        const deadline = new Promise((_resolve, reject) => {
-            fireDeadline = () => reject(timeoutError());
-        });
-        deadline.catch(() => { });
-        const timer = setTimeout(() => {
-            timedOut = true;
-            controller.abort();
-            fireDeadline();
-        }, this.timeout);
+        const { response, text } = await postToStore(url, body, this.settings(), {
+            owner: OWNER,
+            unreachable: `HttpUserRepository: identity lookup at ${endpoint} could not be reached`,
+            closed: `HttpUserRepository: identity lookup at ${endpoint}: the connection closed before a complete response arrived`,
+            malformed: `HttpUserRepository: identity lookup at ${endpoint} answered with a malformed HTTP response`,
+            unreadable: `HttpUserRepository: identity lookup at ${endpoint} could not be read`,
+        }, isSuccess);
+        if (text === undefined) {
+            throw new Error(`HttpUserRepository: identity lookup at ${endpoint} answered HTTP ${response.status}`);
+        }
+        let parsed;
         try {
-            let res;
-            try {
-                res = await fetch(url, {
-                    method: "POST",
-                    headers: this.headers(),
-                    body: JSON.stringify(body),
-                    signal: controller.signal,
-                    redirect: "manual",
-                });
-            }
-            catch (err) {
-                if (timedOut && isAbortError(err))
-                    throw timeoutError();
-                // A fixed message, without the cause: what a transport reports may
-                // quote what it was sending.
-                throw requestFailure(err, {
-                    unreachable: `HttpUserRepository: identity lookup at ${endpoint} could not be reached`,
-                    closed: `HttpUserRepository: identity lookup at ${endpoint}: the connection closed before a complete response arrived`,
-                    malformed: `HttpUserRepository: identity lookup at ${endpoint} answered with a malformed HTTP response`,
-                });
-            }
-            if (!res.ok) {
-                discardBody(res);
-                this.assertCredentialAccepted(res, endpoint);
-                throw new Error(`HttpUserRepository: identity lookup at ${endpoint} answered HTTP ${res.status}`);
-            }
-            let raw;
-            try {
-                raw = await readBodyCapped(res, this.maxResponseBytes, endpoint, deadline, (err) => readFailure(err, `HttpUserRepository: identity lookup at ${endpoint} could not be read`));
-            }
-            catch (err) {
-                if (timedOut)
-                    throw timeoutError();
-                throw err;
-            }
-            let parsed;
-            try {
-                parsed = JSON.parse(raw);
-            }
-            catch {
-                throw new Error(`HttpUserRepository: upstream ${endpoint} returned a non-JSON body`);
-            }
-            const answer = lookupAnswer(parsed);
-            if (answer === undefined) {
-                throw new Error(`HttpUserRepository: identity lookup at ${endpoint} answered a body that is not one of the ` +
-                    "port's answers (linked / unlinked / indeterminate)");
-            }
-            return answer;
+            parsed = JSON.parse(text);
+        }
+        catch {
+            throw new Error(`HttpUserRepository: upstream ${endpoint} returned a non-JSON body`);
         }
-        finally {
-            clearTimeout(timer);
+        const answer = lookupAnswer(parsed);
+        if (answer === undefined) {
+            throw new Error(`HttpUserRepository: identity lookup at ${endpoint} answered a body that is not one of the ` +
+                "port's answers (linked / unlinked / indeterminate)");
         }
+        return answer;
     }
     async post(url, body, options = {}) {
         // What every message names: origin and path, never the query.
         const endpoint = endpointForMessage(url);
-        const controller = new AbortController();
-        let timedOut = false;
-        // One absolute deadline for the whole exchange, expressed twice: as the
-        // abort signal `fetch` understands, and as a promise the body read can be
-        // raced against. `.catch` is attached up front so an exchange that
-        // finishes first — the overwhelmingly common case, where the timer is
-        // cleared and this never rejects — cannot leave an unhandled rejection.
-        // Named as the lookup's is: a reporter that classifies by `name` —
-        // federation-grants' reads `TimeoutError` as `timeout` — sees one kind
-        // of timeout whichever request it came from.
-        const timeoutError = () => {
-            const error = new Error(`HttpUserRepository: request to ${endpoint} timed out after ${this.timeout}ms`);
-            error.name = "TimeoutError";
-            return error;
-        };
-        let fireDeadline = () => { };
-        const deadline = new Promise((_resolve, reject) => {
-            fireDeadline = () => reject(timeoutError());
-        });
-        deadline.catch(() => { });
-        const timer = setTimeout(() => {
-            timedOut = true;
-            controller.abort();
-            fireDeadline();
-        }, this.timeout);
-        try {
-            let res;
+        // Never follows a redirect (`postToStore`): a 307 or 308 would re-send
+        // the body — a password, a token, a link request — to a `Location` the
+        // https rule never checked, and a 3xx is not a 2xx, 401, 403 or 409, so
+        // it throws below as an unexpected status.
+        const { response, text } = await postToStore(url, body, this.settings(), {
+            owner: OWNER,
+            unreachable: `HttpUserRepository: request to ${endpoint} could not be reached`,
+            closed: `HttpUserRepository: the connection to ${endpoint} closed before a complete response arrived`,
+            malformed: `HttpUserRepository: the Store at ${endpoint} answered with a malformed HTTP response`,
+            unreadable: `HttpUserRepository: response from ${endpoint} could not be read`,
+        }, isSuccess);
+        if (text !== undefined) {
+            let parsed;
             try {
-                res = await fetch(url, {
-                    method: "POST",
-                    headers: this.headers(),
-                    body: JSON.stringify(body),
-                    signal: controller.signal,
-                    // Never followed: a 307 or 308 would re-send the body — a
-                    // password, a token, a link request — to a `Location` the https
-                    // rule never checked, and after any redirect the answer from
-                    // there would be taken as the user. Node's fetch hands the 3xx
-                    // back as it is (a browser-spec runtime would hand back an opaque
-                    // redirect, status 0); either way it is not a 2xx, 401, 403 or
-                    // 409, so it throws below as an unexpected status.
-                    redirect: "manual",
-                });
-            }
-            catch (err) {
-                if (timedOut && isAbortError(err))
-                    throw timeoutError();
-                // Never the transport's own error: it may quote what it was
-                // sending — the credential, the password — or what came back.
-                throw requestFailure(err, {
-                    unreachable: `HttpUserRepository: request to ${endpoint} could not be reached`,
-                    closed: `HttpUserRepository: the connection to ${endpoint} closed before a complete response arrived`,
-                    malformed: `HttpUserRepository: the Store at ${endpoint} answered with a malformed HTTP response`,
-                });
+                parsed = JSON.parse(text);
             }
-            if (res.ok) {
-                let raw;
-                try {
-                    raw = await readBodyCapped(res, this.maxResponseBytes, endpoint, deadline, (err) => readFailure(err, `HttpUserRepository: response from ${endpoint} could not be read`));
-                }
-                catch (err) {
-                    // Whatever the deadline interrupted is a timeout; everything
-                    // else readBodyCapped throws is already the adapter's own.
-                    if (timedOut)
-                        throw timeoutError();
-                    throw err;
-                }
-                let parsed;
-                try {
-                    parsed = JSON.parse(raw);
-                }
-                catch {
-                    // Same class of failure as the shape check below: the Store is
-                    // broken, not the credential. Reported as ours rather than as a
-                    // bare SyntaxError with no indication of where it came from.
-                    throw new Error(`HttpUserRepository: upstream ${endpoint} returned a non-JSON body`);
-                }
-                if (!isUser(parsed)) {
-                    // Upstream returned 2xx with an unexpected shape — this is an
-                    // "upstream is broken" case, not a "user not found" case, so
-                    // throw rather than return null. The thrown error propagates
-                    // as a 500 to the client (correct: upstream-service failure).
-                    throw new Error(`HttpUserRepository: upstream ${endpoint} returned an invalid User shape`);
-                }
-                return parsed;
-            }
-            discardBody(res);
-            this.assertCredentialAccepted(res, endpoint);
-            if (options.acceptConflict && res.status === 409) {
-                return CONFLICT;
+            catch {
+                // Same class of failure as the shape check below: the Store is
+                // broken, not the credential.
+                throw new Error(`HttpUserRepository: upstream ${endpoint} returned a non-JSON body`);
             }
-            if (res.status === 401 || res.status === 403) {
-                return null;
+            if (!isUser(parsed)) {
+                // A 2xx with an unexpected shape is an upstream failure, not "no
+                // such user": thrown rather than answered null.
+                throw new Error(`HttpUserRepository: upstream ${endpoint} returned an invalid User shape`);
             }
-            throw new Error(`Unexpected HTTP status ${res.status} from ${endpoint}`);
+            return parsed;
+        }
+        if (options.acceptConflict && response.status === 409) {
+            return CONFLICT;
         }
-        finally {
-            clearTimeout(timer);
+        if (response.status === 401 || response.status === 403) {
+            return null;
         }
+        throw new Error(`Unexpected HTTP status ${response.status} from ${endpoint}`);
     }
 }