@o3co/auth-provider-templates 0.0.0 → 0.18.0-rc.1

package/subject-revocation-store/src/module.js

@@ -0,0 +1,26 @@
+import { defineModule } from "@o3co/auth-provider-foundation/kernel";
+import { recordsIn } from "@o3co/auth-provider-foundation/records";
+import { spaces, store } from "@o3co/auth-provider-foundation/store";
+import { boundaryStore, } from "@o3co/auth-provider-identity/subject-revocation";
+/** Each need subject-revocation states, as the guarantee a space declares for it. */
+const guaranteeFor = {
+    neverEvicted: "no-eviction",
+    survivesCrash: "durable",
+    survivesFailover: "replicated",
+};
+const boundaries = {
+    name: "subject-revocation-store.boundaries",
+    guarantees: Object.values(guaranteeFor),
+};
+export default defineModule({ name: "subject-revocation-store" }, (m) => [
+    m.contribute(spaces).by(() => boundaries),
+    m.provide(boundaryStore).by(async (c) => {
+        const place = { store: await c.get(store), space: boundaries, log: c.log, random: c.random };
+        const records = recordsIn(place);
+        return {
+            save: (subject, record) => records.create(subject, record, "endless"),
+            read: records.read,
+            update: (subject, change) => records.change(subject, (record) => ({ value: change(record) })),
+        };
+    }),
+]);

package/tokens-store/README.md

@@ -0,0 +1,3 @@
+# tokens-store
+
+Wires `tokens`' store interface, revoked tokens, to `records`' records. Its one space declares a guarantee for each need `tokens` states. A need with nothing mapped to it fails the type check, and `tokens`' store contract, run on a store that loses what a missing guarantee allows, checks what each guarantee means. The wiring only maps, with no branches or loops. Depends on `kernel`, `tokens`, `records` and `store`.

package/tokens-store/src/module.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("@o3co/auth-provider-foundation/kernel").Module;
+export default _default;

package/tokens-store/src/module.js

@@ -0,0 +1,22 @@
+import { defineModule } from "@o3co/auth-provider-foundation/kernel";
+import { recordsIn } from "@o3co/auth-provider-foundation/records";
+import { spaces, store } from "@o3co/auth-provider-foundation/store";
+import { revokedTokens } from "@o3co/auth-provider-oauth/tokens";
+/** Each need tokens states, as the guarantee a space declares for it. */
+const guaranteeFor = {
+    neverEvicted: "no-eviction",
+    survivesCrash: "durable",
+    survivesFailover: "replicated",
+};
+const revoked = { name: "tokens-store.revoked", guarantees: Object.values(guaranteeFor) };
+export default defineModule({ name: "tokens-store" }, (m) => [
+    m.contribute(spaces).by(() => revoked),
+    m.provide(revokedTokens).by(async (c) => {
+        const place = { store: await c.get(store), space: revoked, log: c.log, random: c.random };
+        const records = recordsIn(place);
+        return {
+            save: (id, lifetimeMs) => records.create(id, true, lifetimeMs),
+            holds: async (id) => (await records.read(id)) !== undefined,
+        };
+    }),
+]);

package/users-store/README.md

@@ -0,0 +1,3 @@
+# users-store
+
+Wires `users`' store interfaces, links and verified contacts, to `records`' records, kept without end. Each interface has a space of its own, which declares a guarantee for each need `users` states for it. A need with nothing mapped to it fails the type check, and `users`' store contracts, run on a store that loses what a missing guarantee allows, check what each guarantee means. The wiring only maps, with no branches or loops. Depends on `kernel`, `users`, `records` and `store`.

package/users-store/src/module.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("@o3co/auth-provider-foundation/kernel").Module;
+export default _default;

package/users-store/src/module.js

@@ -0,0 +1,44 @@
+import { defineModule } from "@o3co/auth-provider-foundation/kernel";
+import { recordsIn } from "@o3co/auth-provider-foundation/records";
+import { spaces, store } from "@o3co/auth-provider-foundation/store";
+import { contactStore, linkStore, } from "@o3co/auth-provider-identity/users";
+/** Each need users states for its links, as the guarantee a space declares for it. */
+const guaranteeFor = {
+    neverEvicted: "no-eviction",
+    survivesCrash: "durable",
+    survivesFailover: "replicated",
+    confirmedReads: "confirmed-reads",
+};
+/** Each need users states for its contacts, mapped as for links. */
+const contactGuaranteeFor = {
+    neverEvicted: guaranteeFor.neverEvicted,
+    survivesCrash: guaranteeFor.survivesCrash,
+    survivesFailover: guaranteeFor.survivesFailover,
+};
+const links = { name: "users-store.links", guarantees: Object.values(guaranteeFor) };
+const contacts = {
+    name: "users-store.contacts",
+    guarantees: Object.values(contactGuaranteeFor),
+};
+export default defineModule({ name: "users-store" }, (m) => [
+    m.contribute(spaces).by(() => links),
+    m.contribute(spaces).by(() => contacts),
+    m.provide(linkStore).by(async (c) => {
+        const place = { store: await c.get(store), space: links, log: c.log, random: c.random };
+        const records = recordsIn(place);
+        return {
+            save: (key, record) => records.create(key, record, "endless"),
+            read: records.read,
+            update: records.change,
+        };
+    }),
+    m.provide(contactStore).by(async (c) => {
+        const place = { store: await c.get(store), space: contacts, log: c.log, random: c.random };
+        const records = recordsIn(place);
+        return {
+            save: (key, record) => records.create(key, record, "endless"),
+            read: records.read,
+            update: records.change,
+        };
+    }),
+]);

package/webauthn-store/README.md

@@ -0,0 +1,3 @@
+# webauthn-store
+
+Wires `webauthn`'s store interfaces to `records`. Passkeys are records kept without end in two spaces, one for credentials and one for subjects, each declaring a guarantee for each need `webauthn` states for them. Challenges are records under a secret, so a challenge never reaches the store, in a space declaring the other needs. A need with nothing mapped to it fails the type check, and `webauthn`'s store contracts, run on a store that loses what a missing guarantee allows, check what each guarantee means. The wiring only maps, with no branches or loops. Depends on `kernel`, `webauthn`, `records` and `store`.

package/webauthn-store/src/module.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("@o3co/auth-provider-foundation/kernel").Module;
+export default _default;

package/webauthn-store/src/module.js

@@ -0,0 +1,50 @@
+import { defineModule } from "@o3co/auth-provider-foundation/kernel";
+import { recordsIn, secretRecordsIn } from "@o3co/auth-provider-foundation/records";
+import { spaces, store } from "@o3co/auth-provider-foundation/store";
+import { challengeStore, passkeyStore, } from "@o3co/auth-provider-passkey/webauthn";
+/** Each need webauthn states for its passkeys, as the guarantee a space declares for it. */
+const guaranteeFor = {
+    neverEvicted: "no-eviction",
+    survivesCrash: "durable",
+    survivesFailover: "replicated",
+    confirmedReads: "confirmed-reads",
+};
+/** Each need webauthn states for its challenges, as what meets it: a guarantee, or records under a secret. */
+const { namesFromSecret: challengeRecordsFor, ...challengeGuaranteeFor } = {
+    survivesCrash: "durable",
+    survivesFailover: "replicated",
+    namesFromSecret: secretRecordsIn,
+};
+const passkeySpace = (name) => ({ name, guarantees: Object.values(guaranteeFor) });
+const credentials = passkeySpace("webauthn-store.credentials");
+const subjects = passkeySpace("webauthn-store.subjects");
+const challenges = {
+    name: "webauthn-store.challenges",
+    guarantees: Object.values(challengeGuaranteeFor),
+};
+export default defineModule({ name: "webauthn-store" }, (m) => [
+    m.contribute(spaces).by(() => credentials),
+    m.contribute(spaces).by(() => subjects),
+    m.contribute(spaces).by(() => challenges),
+    m.provide(passkeyStore).by(async (c) => {
+        const place = { store: await c.get(store), log: c.log, random: c.random };
+        /** One space's records, kept without end. */
+        const passkeyRecordsIn = (space) => {
+            const records = recordsIn({ ...place, space });
+            return {
+                save: (key, record) => records.create(key, record, "endless"),
+                read: records.read,
+                update: records.change,
+            };
+        };
+        return { credentials: passkeyRecordsIn(credentials), subjects: passkeyRecordsIn(subjects) };
+    }),
+    m.provide(challengeStore).by(async (c) => {
+        const place = { store: await c.get(store), space: challenges, log: c.log, random: c.random };
+        const records = challengeRecordsFor(place);
+        return {
+            open: records.create,
+            take: (challenge, mark) => records.change(challenge, () => ({ value: mark })),
+        };
+    }),
+]);