@open-rap/runtime 0.0.0-stage → 0.1.0

package/dist/auth/authorizations.js

@@ -0,0 +1,103 @@
+/**
+ * The authorizations of the users (decision D34): the roles of the identity provider (claims of
+ * the token) give authorizations, instances of authorization objects with field values, defined
+ * in rapt/authorizations.json — the counterpart of the business roles of the ABAP environment.
+ * AUTHORITY-CHECK and the access controls (pfcg_auth) read them.
+ */
+import { authorizationClaims } from "@open-rap/model";
+const CLAIM = /^\{claim:([^}]+)\}$/;
+/** A value of an authorization field against an accepted value of a role (PFCG semantics). */
+export function valueMatches(value, accepted) {
+    if (typeof accepted !== "string") {
+        return value >= accepted.from && value <= accepted.to;
+    }
+    if (accepted === "*") {
+        return true;
+    }
+    if (accepted.endsWith("*")) {
+        return value.startsWith(accepted.slice(0, -1));
+    }
+    return value === accepted;
+}
+/** The roles of rapt/authorizations.json (`roles`: role name → authorizations) as a model. */
+export function rolesFromJson(json) {
+    const roles = json?.roles;
+    if (typeof roles !== "object" || roles === null || Array.isArray(roles)) {
+        throw new Error('the authorizations file needs "roles": role name → { "authorizations": [...] }');
+    }
+    return Object.entries(roles).map(([name, role]) => {
+        if (!Array.isArray(role?.authorizations)) {
+            throw new Error(`roles.${name}: "authorizations" must be a list`);
+        }
+        return {
+            name,
+            ...(typeof role.description === "string" ? { description: role.description } : {}),
+            authorizations: role.authorizations.map((a) => ({
+                object: String(a.object).toUpperCase(),
+                fields: Object.fromEntries(Object.entries(a.fields ?? {}).map(([field, values]) => [field.toUpperCase(), (Array.isArray(values) ? values : [values])])),
+            })),
+        };
+    });
+}
+export class Authorizations {
+    roles;
+    constructor(model) {
+        this.roles = model?.roles ?? [];
+    }
+    /** Whether roles are defined (else AUTHORITY-CHECK fails for every user: no authorization). */
+    get defined() {
+        return this.roles.length > 0;
+    }
+    /** The claims of the token that values of the roles read (`{claim:agency}`). */
+    claims() {
+        return authorizationClaims({ roles: this.roles });
+    }
+    /**
+     * The development user without DEV_ROLES (`*`) has every authorization, like SAP_ALL in a
+     * development system: every role, and AUTHORITY-CHECK passes for every object.
+     */
+    isUnrestricted(user) {
+        return user.authenticatedBy === "development" && user.roles.includes("*");
+    }
+    /** The roles of a user: those of its token; all of them for the unrestricted development user. */
+    rolesOf(user) {
+        if (this.isUnrestricted(user)) {
+            return this.roles;
+        }
+        return this.roles.filter((r) => user.roles.includes(r.name) || user.roles.some((u) => u.toLowerCase() === r.name.toLowerCase()));
+    }
+    /** The authorizations of a user for an authorization object, the claims of its token expanded. */
+    of(user, object) {
+        const name = object.toUpperCase();
+        const result = [];
+        for (const role of this.rolesOf(user)) {
+            for (const authorization of role.authorizations.filter((a) => a.object === name)) {
+                const fields = {};
+                for (const [field, values] of Object.entries(authorization.fields)) {
+                    fields[field] = values.flatMap((v) => {
+                        const claim = typeof v === "string" ? CLAIM.exec(v)?.[1] : undefined;
+                        return claim === undefined ? [v] : (user.attributes?.[claim] ?? []);
+                    });
+                }
+                result.push(fields);
+            }
+        }
+        return result;
+    }
+    /**
+     * AUTHORITY-CHECK: 0 when one authorization of the object accepts every checked field (a field
+     * given with DUMMY is not checked), 4 when none does, 12 without authorization for the object.
+     */
+    check(user, object, fields) {
+        if (this.isUnrestricted(user)) {
+            return 0;
+        }
+        const authorizations = this.of(user, object);
+        if (authorizations.length === 0) {
+            return 12;
+        }
+        const granted = authorizations.some((authorization) => fields.every((field) => field.value === undefined || (authorization[field.id.toUpperCase()] ?? []).some((accepted) => valueMatches(field.value, accepted))));
+        return granted ? 0 : 4;
+    }
+}
+//# sourceMappingURL=authorizations.js.map

package/dist/auth/authorizations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizations.js","sourceRoot":"","sources":["../../src/auth/authorizations.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,mBAAmB,EAAqE,MAAM,iBAAiB,CAAC;AAMzH,MAAM,KAAK,GAAG,qBAAqB,CAAC;AAEpC,8FAA8F;AAC9F,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,QAA4B;IACtE,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,KAAK,IAAI,QAAQ,CAAC,IAAI,IAAI,KAAK,IAAI,QAAQ,CAAC,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,KAAK,QAAQ,CAAC;AAC5B,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,aAAa,CAAC,IAAa;IACzC,MAAM,KAAK,GAAI,IAA4B,EAAE,KAAK,CAAC;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,KAA2E,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE;QACtH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,mCAAmC,CAAC,CAAC;QACpE,CAAC;QACD,OAAO;YACL,IAAI;YACJ,GAAG,CAAC,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,cAAc,EAAG,IAAI,CAAC,cAA6E,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9G,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE;gBACtC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAyB,CAAC,CAAC,CAAC;aAChL,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,cAAc;IACR,KAAK,CAAc;IAEpC,YAAmB,KAAsC;QACvD,IAAI,CAAC,KAAK,GAAG,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC;IAClC,CAAC;IAED,+FAA+F;IAC/F,IAAW,OAAO;QAChB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,gFAAgF;IACzE,MAAM;QACX,OAAO,mBAAmB,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACpD,CAAC;IAED;;;OAGG;IACI,cAAc,CAAC,IAAU;QAC9B,OAAO,IAAI,CAAC,eAAe,KAAK,aAAa,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5E,CAAC;IAED,kGAAkG;IAC3F,OAAO,CAAC,IAAU;QACvB,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACnI,CAAC;IAED,kGAAkG;IAC3F,EAAE,CAAC,IAAU,EAAE,MAAc;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,MAAM,GAAwB,EAAE,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,KAAK,MAAM,aAAa,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,CAAC;gBACjF,MAAM,MAAM,GAAsB,EAAE,CAAC;gBACrC,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;oBACnE,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;wBACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;wBACrE,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;oBACtE,CAAC,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,IAAU,EAAE,MAAc,EAAE,MAA6C;QACpF,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE,CACpD,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,KAAe,EAAE,QAAQ,CAAC,CAAC,CAAC,CACtK,CAAC;QACF,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;CACF"}

package/dist/auth/business-users.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The users of I_BusinessUserBasic (D44): on SAP, the business users of the system; here, the
+ * users of the identity provider who used the application, recorded at their first request (and
+ * their name and e-mail updated once per process).
+ */
+import type { Database } from "../db/database.js";
+import type { User } from "./user.js";
+export declare const BUSINESS_USER_TABLE = "rapt_bususer";
+export declare class BusinessUsers {
+    private readonly db;
+    private readonly seen;
+    constructor(db: () => Database);
+    /** Records the user (fire and forget: a failure never fails the request). */
+    record(user: User): void;
+}

package/dist/auth/business-users.js

@@ -0,0 +1,36 @@
+/**
+ * The users of I_BusinessUserBasic (D44): on SAP, the business users of the system; here, the
+ * users of the identity provider who used the application, recorded at their first request (and
+ * their name and e-mail updated once per process).
+ */
+import { sql } from "kysely";
+export const BUSINESS_USER_TABLE = "rapt_bususer";
+export class BusinessUsers {
+    db;
+    seen = new Set();
+    constructor(db) {
+        this.db = db;
+    }
+    /** Records the user (fire and forget: a failure never fails the request). */
+    record(user) {
+        if (this.seen.has(user.abapName)) {
+            return;
+        }
+        this.seen.add(user.abapName);
+        const full = user.name ?? user.abapName;
+        const parts = full.trim().split(/\s+/);
+        const first = parts.length > 1 ? parts.slice(0, -1).join(" ") : "";
+        const last = parts.length > 1 ? (parts[parts.length - 1] ?? "") : full;
+        void sql `INSERT INTO rapt_bususer (userid, partner, fullname, firstname, lastname, email)
+      SELECT ${user.abapName}, lpad((coalesce(max(CASE WHEN partner ~ '^[0-9]+$' THEN partner::bigint END), 0) + 1)::text, 10, '0'),
+        ${full.slice(0, 80)}, ${first.slice(0, 40)}, ${last.slice(0, 40)}, ${(user.email ?? "").slice(0, 241)}
+      FROM rapt_bususer
+      ON CONFLICT (userid) DO UPDATE SET fullname = EXCLUDED.fullname, firstname = EXCLUDED.firstname, lastname = EXCLUDED.lastname,
+        email = CASE WHEN EXCLUDED.email = '' THEN rapt_bususer.email ELSE EXCLUDED.email END`
+            .execute(this.db())
+            .catch(() => {
+            this.seen.delete(user.abapName);
+        });
+    }
+}
+//# sourceMappingURL=business-users.js.map

package/dist/auth/business-users.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"business-users.js","sourceRoot":"","sources":["../../src/auth/business-users.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAI7B,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAElD,MAAM,OAAO,aAAa;IAGY,EAAE;IAFrB,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1C,YAAoC,EAAkB;kBAAlB,EAAE;IAAmB,CAAC;IAE1D,6EAA6E;IACtE,MAAM,CAAC,IAAU;QACtB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvE,KAAK,GAAG,CAAA;eACG,IAAI,CAAC,QAAQ;UAClB,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;;;8FAGf;aACvF,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;aAClB,KAAK,CAAC,GAAG,EAAE;YACV,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACP,CAAC;CACF"}

package/dist/auth/dev-oauth.d.ts

@@ -0,0 +1,38 @@
+/**
+ * A development OAuth 2.0 authorization server (D60), served under /oauth by `rapt dev` (and by
+ * an application started with DEV_OAUTH=on in the development mode), to call the service as a
+ * Web API with the flows of a real identity provider, without one:
+ *
+ * - client credentials: POST /oauth/token grant_type=client_credentials with the client id and
+ *   secret (form or Basic): a token of the technical user of the client;
+ * - authorization code with PKCE (S256): GET /oauth/authorize (a page to choose the user), then
+ *   POST /oauth/token grant_type=authorization_code with the code_verifier;
+ * - /oauth/.well-known/openid-configuration and /oauth/jwks for the clients that discover them.
+ *
+ * Tokens are RS256 JWTs signed with a key generated at start-up: they end with the process. In
+ * production, the tokens come from the identity provider (AUTH_MODE=oidc).
+ */
+import type { FastifyInstance } from "fastify";
+import { type JWTPayload } from "jose";
+export interface DevOAuthClient {
+    clientId: string;
+    /** Confidential clients (client credentials); a public client (PKCE) has none. */
+    clientSecret?: string;
+    /** Roles of the technical user of a confidential client (default: every role, `*`). */
+    roles?: string[];
+}
+/** The clients when none are configured (DEV_OAUTH_CLIENTS). */
+export declare const DEFAULT_DEV_CLIENTS: DevOAuthClient[];
+export declare class DevOAuthServer {
+    private readonly clients;
+    private readonly privateKey;
+    private readonly jwk;
+    private readonly codes;
+    private constructor();
+    static create(clients?: DevOAuthClient[]): Promise<DevOAuthServer>;
+    /** Verifies a token of this server; its claims. */
+    verify(token: string): Promise<JWTPayload>;
+    private issuer;
+    private token;
+    register(app: FastifyInstance): void;
+}

package/dist/auth/dev-oauth.js

@@ -0,0 +1,156 @@
+/**
+ * A development OAuth 2.0 authorization server (D60), served under /oauth by `rapt dev` (and by
+ * an application started with DEV_OAUTH=on in the development mode), to call the service as a
+ * Web API with the flows of a real identity provider, without one:
+ *
+ * - client credentials: POST /oauth/token grant_type=client_credentials with the client id and
+ *   secret (form or Basic): a token of the technical user of the client;
+ * - authorization code with PKCE (S256): GET /oauth/authorize (a page to choose the user), then
+ *   POST /oauth/token grant_type=authorization_code with the code_verifier;
+ * - /oauth/.well-known/openid-configuration and /oauth/jwks for the clients that discover them.
+ *
+ * Tokens are RS256 JWTs signed with a key generated at start-up: they end with the process. In
+ * production, the tokens come from the identity provider (AUTH_MODE=oidc).
+ */
+import { createHash, randomBytes } from "node:crypto";
+import { createLocalJWKSet, exportJWK, generateKeyPair, jwtVerify, SignJWT } from "jose";
+/** The clients when none are configured (DEV_OAUTH_CLIENTS). */
+export const DEFAULT_DEV_CLIENTS = [
+    { clientId: "rapt-client", clientSecret: "rapt-secret", roles: ["*"] },
+    { clientId: "rapt-pkce" },
+];
+const TOKEN_LIFETIME = 3600;
+const escapeHtml = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+export class DevOAuthServer {
+    clients;
+    privateKey;
+    jwk;
+    codes = new Map();
+    constructor(clients, privateKey, jwk) {
+        this.clients = clients;
+        this.privateKey = privateKey;
+        this.jwk = jwk;
+    }
+    static async create(clients = DEFAULT_DEV_CLIENTS) {
+        const { privateKey, publicKey } = await generateKeyPair("RS256", { extractable: true });
+        const jwk = { ...(await exportJWK(publicKey)), kid: "rapt-dev", alg: "RS256", use: "sig" };
+        return new DevOAuthServer(clients, privateKey, jwk);
+    }
+    /** Verifies a token of this server; its claims. */
+    async verify(token) {
+        const { payload } = await jwtVerify(token, createLocalJWKSet({ keys: [this.jwk] }));
+        return payload;
+    }
+    issuer(request) {
+        const proto = String(request.headers["x-forwarded-proto"] ?? request.protocol ?? "http").split(",")[0];
+        return `${proto}://${request.headers.host ?? "localhost"}/oauth`;
+    }
+    async token(issuer, claims) {
+        return new SignJWT(claims)
+            .setProtectedHeader({ alg: "RS256", kid: "rapt-dev" })
+            .setIssuer(issuer)
+            .setIssuedAt()
+            .setExpirationTime(`${TOKEN_LIFETIME}s`)
+            .sign(this.privateKey);
+    }
+    register(app) {
+        const form = (body) => new URLSearchParams(typeof body === "string" ? body : Buffer.isBuffer(body) ? body.toString("utf8") : "");
+        const error = (code, description) => JSON.stringify({ error: code, error_description: description });
+        app.get("/oauth/.well-known/openid-configuration", async (request, reply) => {
+            const issuer = this.issuer(request);
+            return reply.header("Content-Type", "application/json").send(JSON.stringify({
+                issuer,
+                authorization_endpoint: `${issuer}/authorize`,
+                token_endpoint: `${issuer}/token`,
+                jwks_uri: `${issuer}/jwks`,
+                response_types_supported: ["code"],
+                grant_types_supported: ["authorization_code", "client_credentials"],
+                code_challenge_methods_supported: ["S256"],
+                token_endpoint_auth_methods_supported: ["client_secret_post", "client_secret_basic", "none"],
+                id_token_signing_alg_values_supported: ["RS256"],
+            }));
+        });
+        app.get("/oauth/jwks", async (_request, reply) => reply.header("Content-Type", "application/json").send(JSON.stringify({ keys: [this.jwk] })));
+        // authorization code with PKCE: a page to choose the user of the development token
+        app.get("/oauth/authorize", async (request, reply) => {
+            const query = request.query;
+            const client = this.clients.find((c) => c.clientId === query["client_id"]);
+            if (query["response_type"] !== "code" || client === undefined || query["redirect_uri"] === undefined) {
+                return reply.code(400).header("Content-Type", "text/plain").send("response_type=code, a known client_id and a redirect_uri are required");
+            }
+            if (query["code_challenge"] === undefined || (query["code_challenge_method"] ?? "plain") !== "S256") {
+                return reply.code(400).header("Content-Type", "text/plain").send("PKCE is required: code_challenge with code_challenge_method=S256");
+            }
+            const hidden = ["client_id", "redirect_uri", "state", "code_challenge"].map((k) => `<input type="hidden" name="${k}" value="${escapeHtml(query[k] ?? "")}">`).join("");
+            return reply.header("Content-Type", "text/html; charset=utf-8").send(`<!doctype html><html><head><meta charset="utf-8"><title>rapt dev sign-in</title>
+<style>body{font-family:system-ui,sans-serif;max-width:26rem;margin:4rem auto;padding:0 1rem}label{display:block;margin:.8rem 0 .2rem}input{width:100%;padding:.4rem;box-sizing:border-box}button{margin-top:1.2rem;padding:.5rem 1rem}</style></head>
+<body><h1>rapt dev sign-in</h1><p>Development authorization server: the token is issued for the user you enter. Client <b>${escapeHtml(client.clientId)}</b>.</p>
+<form method="post" action="/oauth/authorize">${hidden}<label for="user">User</label><input id="user" name="user" value="DEVELOPER" required><label for="roles">Roles (comma separated, * for all)</label><input id="roles" name="roles" value="*"><button id="signin" type="submit">Sign in</button></form></body></html>`);
+        });
+        app.post("/oauth/authorize", async (request, reply) => {
+            const params = form(request.body);
+            const client = this.clients.find((c) => c.clientId === params.get("client_id"));
+            const redirectUri = params.get("redirect_uri");
+            const challenge = params.get("code_challenge");
+            if (client === undefined || redirectUri === null || challenge === null) {
+                return reply.code(400).header("Content-Type", "text/plain").send("invalid authorization request");
+            }
+            const code = randomBytes(24).toString("base64url");
+            const user = (params.get("user") ?? "DEVELOPER").trim() || "DEVELOPER";
+            const roles = (params.get("roles") ?? "*").split(",").map((r) => r.trim()).filter((r) => r !== "");
+            this.codes.set(code, { clientId: client.clientId, redirectUri, challenge, user, roles, expires: Date.now() + 120_000 });
+            const target = new URL(redirectUri);
+            target.searchParams.set("code", code);
+            const state = params.get("state");
+            if (state !== null && state !== "")
+                target.searchParams.set("state", state);
+            return reply.redirect(target.toString());
+        });
+        app.post("/oauth/token", async (request, reply) => {
+            const params = form(request.body);
+            const json = (status, body) => reply.code(status).header("Content-Type", "application/json").header("Cache-Control", "no-store").send(body);
+            // client authentication: client_secret_basic or client_secret_post
+            let clientId = params.get("client_id");
+            let clientSecret = params.get("client_secret");
+            const basic = /^Basic\s+(.+)$/i.exec(request.headers.authorization ?? "");
+            if (basic !== null) {
+                const [id = "", secret = ""] = Buffer.from(basic[1], "base64").toString("utf8").split(":");
+                clientId = decodeURIComponent(id);
+                clientSecret = decodeURIComponent(secret);
+            }
+            const client = this.clients.find((c) => c.clientId === clientId);
+            if (client === undefined) {
+                return json(401, error("invalid_client", "unknown client"));
+            }
+            const issuer = this.issuer(request);
+            const grant = params.get("grant_type");
+            if (grant === "client_credentials") {
+                if (client.clientSecret === undefined || client.clientSecret !== clientSecret) {
+                    return json(401, error("invalid_client", "client credentials need the secret of a confidential client"));
+                }
+                const accessToken = await this.token(issuer, { sub: client.clientId, client_id: client.clientId, azp: client.clientId, roles: client.roles ?? ["*"], scope: params.get("scope") ?? "" });
+                return json(200, JSON.stringify({ access_token: accessToken, token_type: "Bearer", expires_in: TOKEN_LIFETIME }));
+            }
+            if (grant === "authorization_code") {
+                const code = this.codes.get(params.get("code") ?? "");
+                this.codes.delete(params.get("code") ?? "");
+                if (code === undefined || code.expires < Date.now() || code.clientId !== client.clientId || code.redirectUri !== params.get("redirect_uri")) {
+                    return json(400, error("invalid_grant", "unknown, expired or mismatched authorization code"));
+                }
+                if (client.clientSecret !== undefined && clientSecret !== null && clientSecret !== client.clientSecret) {
+                    return json(401, error("invalid_client", "wrong client secret"));
+                }
+                const verifier = params.get("code_verifier") ?? "";
+                if (createHash("sha256").update(verifier).digest("base64url") !== code.challenge) {
+                    return json(400, error("invalid_grant", "the code_verifier does not match the code_challenge (PKCE)"));
+                }
+                const claims = { sub: code.user, preferred_username: code.user, azp: client.clientId, roles: code.roles };
+                const accessToken = await this.token(issuer, claims);
+                const idToken = await this.token(issuer, { ...claims, aud: client.clientId });
+                return json(200, JSON.stringify({ access_token: accessToken, id_token: idToken, token_type: "Bearer", expires_in: TOKEN_LIFETIME }));
+            }
+            return json(400, error("unsupported_grant_type", "client_credentials or authorization_code"));
+        });
+    }
+}
+//# sourceMappingURL=dev-oauth.js.map

package/dist/auth/dev-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-oauth.js","sourceRoot":"","sources":["../../src/auth/dev-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,OAAO,EAA6B,MAAM,MAAM,CAAC;AAUpH,gEAAgE;AAChE,MAAM,CAAC,MAAM,mBAAmB,GAAqB;IACnD,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE;IACtE,EAAE,QAAQ,EAAE,WAAW,EAAE;CAC1B,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,CAAC;AAW5B,MAAM,UAAU,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAEvI,MAAM,OAAO,cAAc;IAIN,OAAO;IACP,UAAU;IACV,GAAG;IALL,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAExD,YACmB,OAAyB,EACzB,UAA0C,EAC1C,GAAQ;uBAFR,OAAO;0BACP,UAAU;mBACV,GAAG;IACnB,CAAC;IAEG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,GAAqB,mBAAmB;QACxE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,MAAM,GAAG,GAAG,EAAE,GAAG,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QAC3F,OAAO,IAAI,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC;IAED,mDAAmD;IAC5C,KAAK,CAAC,MAAM,CAAC,KAAa;QAC/B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACpF,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,MAAM,CAAC,OAAuB;QACpC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACvG,OAAO,GAAG,KAAK,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,QAAQ,CAAC;IACnE,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,MAAc,EAAE,MAA+B;QACjE,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;aACvB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;aACrD,SAAS,CAAC,MAAM,CAAC;aACjB,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,cAAc,GAAG,CAAC;aACvC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3B,CAAC;IAEM,QAAQ,CAAC,GAAoB;QAClC,MAAM,IAAI,GAAG,CAAC,IAAa,EAAmB,EAAE,CAAC,IAAI,eAAe,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3J,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,WAAmB,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC;QAE7H,GAAG,CAAC,GAAG,CAAC,yCAAyC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACpC,OAAO,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC,IAAI,CAC1D,IAAI,CAAC,SAAS,CAAC;gBACb,MAAM;gBACN,sBAAsB,EAAE,GAAG,MAAM,YAAY;gBAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;gBACjC,QAAQ,EAAE,GAAG,MAAM,OAAO;gBAC1B,wBAAwB,EAAE,CAAC,MAAM,CAAC;gBAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,oBAAoB,CAAC;gBACnE,gCAAgC,EAAE,CAAC,MAAM,CAAC;gBAC1C,qCAAqC,EAAE,CAAC,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,CAAC;gBAC5F,qCAAqC,EAAE,CAAC,OAAO,CAAC;aACjD,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAE/I,mFAAmF;QACnF,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2C,CAAC;YAClE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YAC3E,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,cAAc,CAAC,KAAK,SAAS,EAAE,CAAC;gBACrG,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;YAC5I,CAAC;YACD,IAAI,KAAK,CAAC,gBAAgB,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,IAAI,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC;gBACpG,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;YACvI,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,8BAA8B,CAAC,YAAY,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACvK,OAAO,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC,IAAI,CAAC;;4HAEiD,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC;gDACvG,MAAM,qQAAqQ,CAAC,CAAC;QACzT,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACpD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;YAChF,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC/C,IAAI,MAAM,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YACpG,CAAC;YACD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,CAAC,IAAI,EAAE,IAAI,WAAW,CAAC;YACvE,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACnG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;YACxH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;YACpC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;gBAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC5E,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAChD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,IAAY,EAAW,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrK,mEAAmE;YACnE,IAAI,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACvC,IAAI,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;YAC1E,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,MAAM,CAAC,EAAE,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACrG,QAAQ,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;gBAClC,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAC5C,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;YACjE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACvC,IAAI,KAAK,KAAK,oBAAoB,EAAE,CAAC;gBACnC,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;oBAC9E,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,gBAAgB,EAAE,6DAA6D,CAAC,CAAC,CAAC;gBAC3G,CAAC;gBACD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACzL,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;YACpH,CAAC;YACD,IAAI,KAAK,KAAK,oBAAoB,EAAE,CAAC;gBACnC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;gBACtD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC5C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;oBAC5I,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,eAAe,EAAE,mDAAmD,CAAC,CAAC,CAAC;gBAChG,CAAC;gBACD,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;oBACvG,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAC,CAAC;gBACnE,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;gBACnD,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;oBACjF,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,eAAe,EAAE,4DAA4D,CAAC,CAAC,CAAC;gBACzG,CAAC;gBACD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,kBAAkB,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC1G,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACrD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC9E,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;YACvI,CAAC;YACD,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,wBAAwB,EAAE,0CAA0C,CAAC,CAAC,CAAC;QAChG,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/auth/environment.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The authentication of a generated application or launchpad, from its environment: the
+ * development user (`AUTH_MODE=none`) or OIDC (bearer tokens, and browser sessions when
+ * `OIDC_CLIENT_ID` is set). See server.ts for the variables.
+ */
+import type { AuthOptions } from "./auth.js";
+export declare function authFromEnvironment(env: Record<string, string | undefined>, publicUrl: string, attributeClaims: string[]): AuthOptions;

package/dist/auth/environment.js

@@ -0,0 +1,57 @@
+/**
+ * The authentication of a generated application or launchpad, from its environment: the
+ * development user (`AUTH_MODE=none`) or OIDC (bearer tokens, and browser sessions when
+ * `OIDC_CLIENT_ID` is set). See server.ts for the variables.
+ */
+export function authFromEnvironment(env, publicUrl, attributeClaims) {
+    if ((env["AUTH_MODE"] ?? "none") === "none") {
+        const auth = { mode: "none" };
+        if (env["DEV_USER"] !== undefined) {
+            auth.user = env["DEV_USER"];
+        }
+        // the roles of the development user (default: all), its claims as JSON ({"agency":["070001"]})
+        if (env["DEV_ROLES"] !== undefined) {
+            auth.roles = env["DEV_ROLES"].split(",").map((r) => r.trim()).filter((r) => r !== "");
+        }
+        if (env["DEV_ATTRIBUTES"] !== undefined && env["DEV_ATTRIBUTES"] !== "") {
+            const attributes = JSON.parse(env["DEV_ATTRIBUTES"]);
+            auth.attributes = Object.fromEntries(Object.entries(attributes).map(([k, v]) => [k, (Array.isArray(v) ? v : [v]).map(String)]));
+        }
+        return auth;
+    }
+    const issuer = env["OIDC_ISSUER"];
+    if (issuer === undefined) {
+        throw new Error("AUTH_MODE=oidc needs OIDC_ISSUER");
+    }
+    const auth = { mode: "oidc", issuer };
+    if (attributeClaims.length > 0) {
+        auth.attributeClaims = attributeClaims;
+    }
+    const optional = [
+        ["discoveryUrl", "OIDC_DISCOVERY_URL"],
+        ["audience", "OIDC_AUDIENCE"],
+        ["requiredRole", "OIDC_REQUIRED_ROLE"],
+        ["rolesClaim", "OIDC_ROLES_CLAIM"],
+        ["userClaim", "OIDC_USER_CLAIM"],
+    ];
+    for (const [key, name] of optional) {
+        const value = env[name];
+        if (value !== undefined && value !== "") {
+            auth[key] = value;
+        }
+    }
+    const clientId = env["OIDC_CLIENT_ID"];
+    if (clientId !== undefined && clientId !== "") {
+        const secret = env["SESSION_SECRET"];
+        if (secret === undefined || secret.length < 32) {
+            throw new Error("browser sessions (OIDC_CLIENT_ID) need SESSION_SECRET, 32 characters or more");
+        }
+        auth.session = { clientId, baseUrl: publicUrl, secret };
+        const clientSecret = env["OIDC_CLIENT_SECRET"];
+        if (clientSecret !== undefined && clientSecret !== "") {
+            auth.session.clientSecret = clientSecret;
+        }
+    }
+    return auth;
+}
+//# sourceMappingURL=environment.js.map

package/dist/auth/environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.js","sourceRoot":"","sources":["../../src/auth/environment.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,UAAU,mBAAmB,CAAC,GAAuC,EAAE,SAAiB,EAAE,eAAyB;IACvH,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC3C,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9B,CAAC;QACD,+FAA+F;QAC/F,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;YACnC,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,GAAG,CAAC,gBAAgB,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,gBAAgB,CAAC,KAAK,EAAE,EAAE,CAAC;YACxE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAA4B,CAAC;YAChF,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAClI,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,IAAI,GAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACnD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;IACD,MAAM,QAAQ,GAAuC;QACnD,CAAC,cAAc,EAAE,oBAAoB,CAAC;QACtC,CAAC,UAAU,EAAE,eAAe,CAAC;QAC7B,CAAC,cAAc,EAAE,oBAAoB,CAAC;QACtC,CAAC,YAAY,EAAE,kBAAkB,CAAC;QAClC,CAAC,WAAW,EAAE,iBAAiB,CAAC;KACjC,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACvC,IAA0C,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACvC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QACxD,MAAM,YAAY,GAAG,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAC/C,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,CAAC,YAAY,GAAG,YAAY,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/auth/session.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Browser sessions over OIDC (PLAN.md §6.8): authorization code flow with PKCE, the user kept in
+ * a signed, HttpOnly cookie (no server-side store). API clients keep using bearer tokens.
+ *
+ * Routes: GET /auth/login?returnTo=…, GET /auth/callback, GET /auth/logout, GET /auth/me.
+ * The discovery document may be fetched from an internal URL (`discoveryUrl`) while the tokens
+ * name the public issuer: the usual setup of Keycloak in docker-compose.
+ */
+import type { FastifyInstance, FastifyRequest } from "fastify";
+import { type Authenticator, type OidcAuthOptions } from "./auth.js";
+import type { User } from "./user.js";
+export declare const SESSION_COOKIE = "rapt_session";
+/**
+ * The value of a session cookie for a user, signed with the secret of the sessions: what the
+ * login callback sets. For the tests, and the tools that open a session for a known user.
+ */
+export declare function signSession(user: User, secret: string, maxAge?: number): string;
+export declare function parseCookies(header: string | undefined): Record<string, string>;
+export declare class OidcSessions {
+    private readonly authenticator;
+    private readonly options;
+    private readonly signer;
+    private metadataPromise;
+    private jwks;
+    private readonly secure;
+    private readonly maxAge;
+    constructor(authenticator: Authenticator, options: OidcAuthOptions & {
+        session: NonNullable<OidcAuthOptions["session"]>;
+    });
+    private metadata;
+    private cookie;
+    private redirectUri;
+    /**
+     * The user of a session cookie; undefined without a valid session. The session may have been
+     * opened by another application sharing the secret (a launchpad, D37): the role required by
+     * this one is checked at each request (AuthenticationError 403 without it).
+     */
+    user(request: FastifyRequest): User | undefined;
+    /** `/auth/login?returnTo=…` for the current page. */
+    loginUrl(returnTo: string): string;
+    register(app: FastifyInstance): void;
+    private login;
+    private callback;
+    private logout;
+}