@owlmeans/auth-common 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 OwlMeans Common — Fullstack typescript framework
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,318 @@
+# @owlmeans/auth-common
+
+Common authentication components and modules for OwlMeans Common libraries. This package provides shared authentication infrastructure that bridges the core `@owlmeans/auth` package with client and server implementations, focusing on authentication modules, guards, middleware, and common types used across fullstack applications.
+
+## Overview
+
+The `@owlmeans/auth-common` package serves as a foundational layer for authentication in the OwlMeans ecosystem, providing:
+
+- **Authentication Modules**: Predefined URL units for authentication flows including login, initialization, and rely functionality
+- **Guard Services**: Authentication and authorization guard implementations for route protection
+- **Common Types**: Shared interfaces and types used across client and server authentication implementations
+- **Middleware**: Authentication middleware for request processing and token validation
+- **Utility Functions**: Helper functions for authentication workflows and token management
+
+This package follows the OwlMeans "quadra" pattern, providing common functionality that can be used by both server and client implementations.
+
+## Installation
+
+```bash
+npm install @owlmeans/auth-common
+```
+
+## Core Concepts
+
+### Authentication Modules
+
+In the OwlMeans ecosystem, modules represent URL units that define authentication routes and their behavior. The auth-common package provides standardized authentication modules for:
+
+- **Backend Authentication**: Server-side authentication endpoints
+- **Frontend Authentication**: Client-side authentication routes  
+- **Socket Authentication**: WebSocket authentication channels
+- **Dispatcher Routes**: Authentication flow management and redirection
+
+### Guards and Services
+
+The package defines standard service interfaces for authentication and authorization:
+
+- **AuthService**: Core authentication service with token validation and user management
+- **AuthorizationService**: Permission-based authorization service
+- **GuardService**: Route protection and access control
+
+## API Reference
+
+### Types
+
+#### `AuthRequest`
+Extended request interface with authentication token in query parameters.
+
+```typescript
+interface AuthRequest extends AbstractRequest {
+  query: AuthToken
+}
+```
+
+#### `AuthUIParams`
+Parameters for authentication UI components.
+
+```typescript
+interface AuthUIParams {
+  type?: string  // Authentication type identifier
+}
+```
+
+#### `AuthService`
+Core authentication service interface extending GuardService.
+
+```typescript
+interface AuthService extends GuardService {
+  auth?: Auth                                           // Current authentication state
+  authenticate: (token: AuthToken) => Promise<void>    // Authenticate with token (throws AuthenFailed)
+  update: (token: string | undefined) => Promise<void> // Update authentication token
+  user: () => Auth                                      // Get current authenticated user
+  store: <T extends ResourceRecord = ResourceRecord>() => Resource<T>  // Get authentication storage resource
+}
+```
+
+**Methods:**
+- **`authenticate(token: AuthToken): Promise<void>`**: Validates and sets authentication token. Throws `AuthenFailed` on invalid token.
+- **`update(token: string | undefined): Promise<void>`**: Updates the current authentication token, useful for token refresh.
+- **`user(): Auth`**: Returns the current authenticated user object.
+- **`store<T>(): Resource<T>`**: Provides access to the authentication storage resource for persistence.
+
+#### `AuthorizationService`
+Service interface for permission-based authorization.
+
+```typescript
+interface AuthorizationService extends InitializedService {
+  isAllowed: (permissions: string | string[] | PermissionSet | PermissionSet[], token?: string | AuthToken | null, thr?: boolean) => Promise<boolean>
+  update: (token?: string | AuthToken, thr?: boolean) => Promise<AuthToken | null>
+}
+```
+
+**Methods:**
+- **`isAllowed(permissions, token?, thr?): Promise<boolean>`**: Checks if given permissions are allowed for the token. Can throw on error if `thr` is true.
+- **`update(token?, thr?): Promise<AuthToken | null>`**: Updates authorization context with new token and returns validated token.
+
+#### `TrustedRecord`
+Configuration record for trusted authentication entities.
+
+```typescript
+interface TrustedRecord extends ConfigRecord, Partial<Omit<Profile, "permissions" | "attributes">> {
+  id: string  // Unique identifier for the trusted entity
+}
+```
+
+### Modules
+
+The package exports a standardized set of authentication modules through the `modules` array:
+
+#### Backend Modules
+- **`AUTHEN`**: Base authentication endpoint (`/authentication`)
+- **`AUTHEN_INIT`**: Authentication initialization (`/init`) - POST with AllowanceRequestSchema
+- **`AUTHEN_AUTHEN`**: Authentication execution (`/authenticate`) - POST with AuthCredentialsSchema  
+- **`AUTHEN_RELY`**: WebSocket authentication rely (`/rely`) - with OptionalAuthTokenSchema
+
+#### Frontend Modules
+- **`CAUTHEN`**: Base client authentication (`/authentication`)
+- **`CAUTHEN_AUTHEN`**: Client login page (`/login`)
+- **`CAUTHEN_AUTHEN_DEFAULT`**: Default client auth route (`/`)
+- **`CAUTHEN_AUTHEN_TYPED`**: Typed authentication (`/:type`)
+- **`CAUTHEN_FLOW_ENTER`**: Authentication flow entry point (`/`)
+
+#### Dispatcher Modules
+- **`DISPATCHER`**: Authentication dispatcher (`/dispatcher`) - sticky module with AuthTokenSchema
+- **`DISPATCHER_AUTHEN`**: Dispatcher authentication endpoint (`/authenticate`) - POST with AuthTokenSchema
+
+```typescript
+import { modules } from '@owlmeans/auth-common'
+
+// All authentication modules are available in the modules array
+console.log(modules.length) // 11 predefined authentication modules
+```
+
+### Constants
+
+#### Rely Constants
+```typescript
+const RELY_PIN_PERFIX = 'rely-pin:'        // Prefix for rely PIN tokens
+const RELY_TOKEN_PREFIX = 'rely-token:'    // Prefix for rely tokens
+const RELY_CALL_TIMEOUT = 120              // Rely call timeout in seconds
+const RELY_ACTION_TIMEOUT = 600            // Rely action timeout in seconds
+```
+
+#### Service Constants
+```typescript
+const DISPATCHER_PATH = '/dispatcher'      // Default dispatcher route path
+const DEF_AUTH_SRV = 'auth'               // Default authentication service name
+const DEFAULT_GUARD = DEF_AUTH_SRV        // Default guard service name
+const TOKEN_UPDATE = 'auth-token-refresh' // Token update event name
+```
+
+### Guards
+
+The package provides authentication guard implementations in the `/guards` subpackage:
+
+#### Basic Ed25519 Guard
+Authentication guard implementation for Ed25519 signature-based authentication.
+
+```typescript
+import { basicEd25519Guard } from '@owlmeans/auth-common/guards'
+```
+
+### Utilities
+
+Authentication utility functions are available in the `/utils` subpackage:
+
+#### Header Utilities
+Functions for managing authentication headers in HTTP requests.
+
+#### Trusted Entity Utilities  
+Functions for managing trusted authentication entities and their validation.
+
+```typescript
+import { /* utility functions */ } from '@owlmeans/auth-common/utils'
+```
+
+## Usage Examples
+
+### Using Authentication Modules
+
+```typescript
+import { modules } from '@owlmeans/auth-common'
+import { makeBasicContext } from '@owlmeans/context'
+
+const context = makeBasicContext(config)
+
+// Register all authentication modules
+modules.forEach(module => {
+  context.registerModule(module)
+})
+
+await context.configure().init()
+
+// Access specific authentication modules
+const loginModule = context.module('cauthen-authen')
+const authModule = context.module('authen')
+```
+
+### Implementing AuthService
+
+```typescript
+import type { AuthService } from '@owlmeans/auth-common'
+import { createService } from '@owlmeans/context'
+
+const authService = createService<AuthService>('auth', {
+  auth: undefined,
+  
+  async authenticate(token) {
+    // Validate token and set auth
+    const validatedAuth = await validateToken(token)
+    this.auth = validatedAuth
+  },
+  
+  async update(token) {
+    if (token) {
+      await this.authenticate({ token })
+    }
+  },
+  
+  user() {
+    if (!this.auth) {
+      throw new Error('No authenticated user')
+    }
+    return this.auth
+  },
+  
+  store() {
+    // Return authentication storage resource
+    return authStorageResource
+  }
+})
+```
+
+### Permission Checking
+
+```typescript
+import type { AuthorizationService } from '@owlmeans/auth-common'
+
+const authzService: AuthorizationService = context.service('authorization')
+
+// Check single permission
+const canRead = await authzService.isAllowed('read', userToken)
+
+// Check multiple permissions
+const canReadWrite = await authzService.isAllowed(['read', 'write'], userToken)
+
+// Check with permission sets
+const canAccess = await authzService.isAllowed([{
+  scope: 'documents',
+  permissions: { read: true, write: true }
+}], userToken)
+```
+
+### Using Constants
+
+```typescript
+import { DEF_AUTH_SRV, DISPATCHER_PATH, RELY_CALL_TIMEOUT } from '@owlmeans/auth-common'
+
+// Configure authentication service
+const authServiceName = DEF_AUTH_SRV
+
+// Set up dispatcher route
+const dispatcherRoute = DISPATCHER_PATH
+
+// Configure rely timeout
+const relyTimeout = RELY_CALL_TIMEOUT * 1000 // Convert to milliseconds
+```
+
+## Integration with OwlMeans Ecosystem
+
+The auth-common package integrates with other OwlMeans packages:
+
+- **@owlmeans/auth**: Core authentication types and validation
+- **@owlmeans/basic-keys**: Cryptographic key management for signatures
+- **@owlmeans/context**: Dependency injection and service registration
+- **@owlmeans/module**: Module system and route definitions
+- **@owlmeans/resource**: Data persistence and resource management
+- **@owlmeans/route**: URL and routing infrastructure
+
+## Package Structure
+
+The authentication common library follows the OwlMeans package structure:
+
+- **types**: TypeScript interfaces and type definitions
+- **modules**: Predefined authentication modules for common flows
+- **consts**: Static values and configuration constants
+- **guards/**: Authentication guard implementations
+- **utils/**: Internal utility functions for authentication workflows
+- **middleware**: Authentication middleware for request processing
+
+## Related Packages
+
+This package serves as the foundation for:
+
+- **@owlmeans/server-auth**: Server-side authentication implementation
+- **@owlmeans/client-auth**: Client-side authentication implementation  
+- **@owlmeans/web-oidc-provider**: OpenID Connect provider implementation
+- **@owlmeans/web-oidc-rp**: OpenID Connect relying party implementation
+
+## Error Handling
+
+The package leverages the error types from `@owlmeans/auth`:
+
+- **AuthenFailed**: Thrown by `authenticate()` method on authentication failure
+- **AuthForbidden**: Thrown by authorization services on access denial
+- **AuthError**: Base authentication error for general failures
+
+Always handle authentication errors appropriately in your application:
+
+```typescript
+try {
+  await authService.authenticate(token)
+} catch (error) {
+  if (error instanceof AuthenFailed) {
+    // Handle authentication failure
+  }
+}
+```

package/build/consts.d.ts

@@ -0,0 +1,9 @@
+export declare const RELY_PIN_PERFIX = "rely-pin:";
+export declare const RELY_TOKEN_PREFIX = "rely-token:";
+export declare const RELY_CALL_TIMEOUT = 120;
+export declare const RELY_ACTION_TIMEOUT = 600;
+export declare const DISPATCHER_PATH = "/dispatcher";
+export declare const DEF_AUTH_SRV = "auth";
+export declare const DEFAULT_GUARD = "auth";
+export declare const TOKEN_UPDATE = "auth-token-refresh";
+//# sourceMappingURL=consts.d.ts.map

package/build/consts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,cAAc,CAAA;AAE1C,eAAO,MAAM,iBAAiB,gBAAgB,CAAA;AAE9C,eAAO,MAAM,iBAAiB,MAAM,CAAA;AAEpC,eAAO,MAAM,mBAAmB,MAAM,CAAA;AAEtC,eAAO,MAAM,eAAe,gBAAgB,CAAA;AAE5C,eAAO,MAAM,YAAY,SAAS,CAAA;AAElC,eAAO,MAAM,aAAa,SAAe,CAAA;AAEzC,eAAO,MAAM,YAAY,uBAAuB,CAAA"}

package/build/consts.js

@@ -0,0 +1,9 @@
+export const RELY_PIN_PERFIX = 'rely-pin:';
+export const RELY_TOKEN_PREFIX = 'rely-token:';
+export const RELY_CALL_TIMEOUT = 120;
+export const RELY_ACTION_TIMEOUT = 600;
+export const DISPATCHER_PATH = '/dispatcher';
+export const DEF_AUTH_SRV = 'auth';
+export const DEFAULT_GUARD = DEF_AUTH_SRV;
+export const TOKEN_UPDATE = 'auth-token-refresh';
+//# sourceMappingURL=consts.js.map

package/build/consts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAA;AAE1C,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAA;AAE9C,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAA;AAEpC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAA;AAEtC,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAA;AAE5C,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAA;AAElC,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAA;AAEzC,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAA"}

package/build/guards/basic-ed25519/consts.d.ts

@@ -0,0 +1,6 @@
+export declare const GUARD_ED25519 = "guard:ed25519-basic-signature";
+export declare const BED255_TIME_HEADER = "X-Auth-Time";
+export declare const BED255_NONCE_HEADER = "X-Auth-Nonce";
+export declare const BED255_SIG_TTL: number;
+export declare const BED255_CASHE_RESOURCE = "basic-ed25519-nonce-cache";
+//# sourceMappingURL=consts.d.ts.map

package/build/guards/basic-ed25519/consts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/consts.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,aAAa,kCAAqD,CAAA;AAE/E,eAAO,MAAM,kBAAkB,gBAAgB,CAAA;AAC/C,eAAO,MAAM,mBAAmB,iBAAiB,CAAA;AAEjD,eAAO,MAAM,cAAc,QAAY,CAAA;AAEvC,eAAO,MAAM,qBAAqB,8BAA8B,CAAA"}

package/build/guards/basic-ed25519/consts.js

@@ -0,0 +1,7 @@
+import { AuthroizationType } from '@owlmeans/auth';
+export const GUARD_ED25519 = `guard:${AuthroizationType.Ed25519BasicSignature}`;
+export const BED255_TIME_HEADER = 'X-Auth-Time';
+export const BED255_NONCE_HEADER = 'X-Auth-Nonce';
+export const BED255_SIG_TTL = 60 * 1000;
+export const BED255_CASHE_RESOURCE = 'basic-ed25519-nonce-cache';
+//# sourceMappingURL=consts.js.map

package/build/guards/basic-ed25519/consts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/consts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,iBAAiB,CAAC,qBAAqB,EAAE,CAAA;AAE/E,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAA;AAC/C,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAA;AAEjD,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAA;AAEvC,MAAM,CAAC,MAAM,qBAAqB,GAAG,2BAA2B,CAAA"}

package/build/guards/basic-ed25519/index.d.ts

@@ -0,0 +1,4 @@
+export type * from './types.js';
+export * from './consts.js';
+export * from './service.js';
+//# sourceMappingURL=index.d.ts.map

package/build/guards/basic-ed25519/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/index.ts"],"names":[],"mappings":"AACA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA"}

package/build/guards/basic-ed25519/index.js

@@ -0,0 +1,3 @@
+export * from './consts.js';
+export * from './service.js';
+//# sourceMappingURL=index.js.map

package/build/guards/basic-ed25519/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/index.ts"],"names":[],"mappings":"AAEA,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA"}

package/build/guards/basic-ed25519/service.d.ts

@@ -0,0 +1,8 @@
+import type { BasicEd25519Guard, BasicEd25519GuardOptions } from './types.js';
+/**
+ * Proper configuration:
+ * - One needs to specify opts.cache as a redis resource that stores nonces for a while to
+ * avoid requests duplication.
+ */
+export declare const makeBasicEd25519Guard: (resource: string, opts?: BasicEd25519GuardOptions) => BasicEd25519Guard;
+//# sourceMappingURL=service.d.ts.map

package/build/guards/basic-ed25519/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/service.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAU7E;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,aAAc,MAAM,SAAS,wBAAwB,KAAG,iBAqHzF,CAAA"}

package/build/guards/basic-ed25519/service.js

@@ -0,0 +1,110 @@
+import { createService } from '@owlmeans/context';
+import { assertContext } from '@owlmeans/context';
+import { BED255_NONCE_HEADER, BED255_TIME_HEADER, BED255_CASHE_RESOURCE, GUARD_ED25519, BED255_SIG_TTL } from './consts.js';
+import { trust } from '../../utils/trusted.js';
+import { AuthenPayloadError, AuthroizationType, AuthRole } from '@owlmeans/auth';
+import { createIdOfLength } from '@owlmeans/basic-ids';
+import { extractAuthToken } from '@owlmeans/auth-common/utils';
+const timeKey = BED255_TIME_HEADER.toLocaleLowerCase();
+const nonceKey = BED255_NONCE_HEADER.toLocaleLowerCase();
+/**
+ * Proper configuration:
+ * - One needs to specify opts.cache as a redis resource that stores nonces for a while to
+ * avoid requests duplication.
+ */
+export const makeBasicEd25519Guard = (resource, opts) => {
+    const cache = (context) => context.hasResource(opts?.cache ?? BED255_CASHE_RESOURCE)
+        ? context.resource(opts?.cache ?? BED255_CASHE_RESOURCE)
+        : null;
+    const guard = createService(GUARD_ED25519, {
+        authenticated: async (req) => {
+            const context = assertContext(guard.ctx);
+            const truested = await trust(context, resource, context.cfg.alias ?? context.cfg.service);
+            // req?.body != null 
+            if (req != null && truested.user.secret != null) {
+                if (req.headers == null) {
+                    req.headers = {};
+                }
+                req.headers[timeKey] = new Date().toISOString();
+                req.headers[nonceKey] = createIdOfLength(16);
+                const payload = {
+                    body: req.body ?? {},
+                    headers: { [timeKey]: req.headers[timeKey], [nonceKey]: req.headers[nonceKey] }
+                };
+                const token = [
+                    AuthroizationType.Ed25519BasicSignature.toUpperCase(),
+                    ['Credential', truested.user.id],
+                    ['Signature', await truested.key.sign(payload)]
+                ];
+                return token.map(item => Array.isArray(item) ? item.join('=') : item).join(' ');
+            }
+            return null;
+        },
+        match: async (req) => extractAuthToken(req, AuthroizationType.Ed25519BasicSignature) != null,
+        handle: async (req, res) => {
+            const context = assertContext(guard.ctx);
+            const authorization = extractAuthToken(req, AuthroizationType.Ed25519BasicSignature);
+            if (authorization == null) {
+                return false;
+            }
+            const signature = authorization.split(' ', 3).reduce((result, pair) => {
+                if (!pair.includes('=')) {
+                    return result;
+                }
+                const [key, value] = pair.split('=', 2);
+                return { ...result, [key.toLowerCase()]: value };
+            }, {});
+            const trusted = await trust(context, resource, signature.credential, "id");
+            if (trusted.user.credential == null) {
+                return false;
+            }
+            const payload = {
+                body: req.body ?? {},
+                headers: { [timeKey]: req.headers[timeKey], [nonceKey]: req.headers[nonceKey] }
+            };
+            if (!await trusted.key.verify(payload, signature.signature)) {
+                return false;
+            }
+            if (typeof req.headers[timeKey] !== 'string') {
+                throw new AuthenPayloadError('timestamp');
+            }
+            const createdAt = new Date(req.headers[timeKey]);
+            if (createdAt.getTime() + BED255_SIG_TTL < Date.now()) {
+                throw new AuthenPayloadError('expired');
+            }
+            const nonce = req.headers[nonceKey];
+            if (typeof nonce !== 'string') {
+                throw new AuthenPayloadError('nonce');
+            }
+            try {
+                const tried = cache(context);
+                if (tried != null) {
+                    await tried.create({ id: nonce }, { ttl: BED255_SIG_TTL / 1000 });
+                }
+            }
+            catch {
+                throw new AuthenPayloadError('nonce');
+            }
+            res.resolve({
+                token: authorization,
+                userId: trusted.user.id,
+                profileId: trusted.user.id,
+                entityId: trusted.user.entityId,
+                scopes: trusted.user.name != null ? [trusted.user.name] : [],
+                type: AuthroizationType.Ed25519BasicSignature,
+                source: context.cfg.service,
+                /**
+                 * @TODO actually it's not always the case (that the the role is the service)
+                 */
+                role: AuthRole.Service,
+                isUser: false,
+                createdAt: new Date()
+            });
+            return true;
+        }
+    }, guard => async () => {
+        guard.initialized = true;
+    });
+    return guard;
+};
+//# sourceMappingURL=service.js.map

package/build/guards/basic-ed25519/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EACL,mBAAmB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,aAAa,EAC7E,cAAc,EACf,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAA;AAG9C,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEhF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAE9D,MAAM,OAAO,GAAG,kBAAkB,CAAC,iBAAiB,EAAE,CAAA;AACtD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,iBAAiB,EAAE,CAAA;AAExD;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAgB,EAAE,IAA+B,EAAqB,EAAE;IAE5G,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,IAAI,qBAAqB,CAAC;QAC3F,CAAC,CAAC,OAAO,CAAC,QAAQ,CAA2B,IAAI,EAAE,KAAK,IAAI,qBAAqB,CAAC;QAClF,CAAC,CAAC,IAAI,CAAA;IAER,MAAM,KAAK,GAAsB,aAAa,CAAoB,aAAa,EAAE;QAC/E,aAAa,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACzB,MAAM,OAAO,GAAG,aAAa,CAAkB,KAAK,CAAC,GAAG,CAAC,CAAA;YACzD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAEzF,qBAAqB;YACrB,IAAI,GAAG,IAAI,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBAChD,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;oBACxB,GAAG,CAAC,OAAO,GAAG,EAAE,CAAA;gBAClB,CAAC;gBACD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;gBAC/C,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;gBAE5C,MAAM,OAAO,GAAG;oBACd,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;oBACpB,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;iBAChF,CAAA;gBAED,MAAM,KAAK,GAAG;oBACZ,iBAAiB,CAAC,qBAAqB,CAAC,WAAW,EAAE;oBACnD,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChC,CAAC,WAAW,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;iBAClD,CAAA;gBAED,OAAO,KAAK,CAAC,GAAG,CACd,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CACpD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACb,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;QAED,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CACjB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,IAAI,IAAI;QAExE,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,aAAa,CAAkB,KAAK,CAAC,GAAG,CAAC,CAAA;YACzD,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAA;YACpF,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;gBACpE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,OAAO,MAAM,CAAA;gBACf,CAAC;gBACD,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;gBACvC,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,CAAA;YAClD,CAAC,EAAE,EAA+C,CAAC,CAAA;YAEnD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;YAC1E,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;gBACpC,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,OAAO,GAAG;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;gBACpB,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;aAChF,CAAA;YAED,IAAI,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5D,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC7C,MAAM,IAAI,kBAAkB,CAAC,WAAW,CAAC,CAAA;YAC3C,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;YAEhD,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACtD,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;YACzC,CAAC;YAED,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACvC,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAA;gBAC5B,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;oBAClB,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI,EAAE,CAAC,CAAA;gBACnE,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACvC,CAAC;YAED,GAAG,CAAC,OAAO,CAAC;gBACV,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBACvB,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBAC1B,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;gBAC/B,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC5D,IAAI,EAAE,iBAAiB,CAAC,qBAAqB;gBAC7C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;gBAC3B;;mBAEG;gBACH,IAAI,EAAE,QAAQ,CAAC,OAAO;gBACtB,MAAM,EAAE,KAAK;gBACb,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAC,CAAA;YAEF,OAAO,IAAS,CAAA;QAClB,CAAC;KACF,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;QACrB,KAAK,CAAC,WAAW,GAAG,IAAI,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}

package/build/guards/basic-ed25519/types.d.ts

@@ -0,0 +1,7 @@
+import type { GuardService } from '@owlmeans/module';
+export interface BasicEd25519Guard extends GuardService {
+}
+export interface BasicEd25519GuardOptions {
+    cache?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/guards/basic-ed25519/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAEpD,MAAM,WAAW,iBAAkB,SAAQ,YAAY;CACtD;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf"}

package/build/guards/basic-ed25519/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/guards/basic-ed25519/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/types.ts"],"names":[],"mappings":""}

package/build/guards/index.d.ts

@@ -0,0 +1,2 @@
+export * from './basic-ed25519/index.js';
+//# sourceMappingURL=index.d.ts.map

package/build/guards/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/guards/index.ts"],"names":[],"mappings":"AACA,cAAc,0BAA0B,CAAA"}

package/build/guards/index.js

@@ -0,0 +1,2 @@
+export * from './basic-ed25519/index.js';
+//# sourceMappingURL=index.js.map

package/build/guards/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/guards/index.ts"],"names":[],"mappings":"AACA,cAAc,0BAA0B,CAAA"}

package/build/index.d.ts

@@ -0,0 +1,6 @@
+export type * from './types.js';
+export * from './modules.js';
+export * from './consts.js';
+export * from './middleware.js';
+export * from './guards/index.js';
+//# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAE/B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,mBAAmB,CAAA"}

package/build/index.js

@@ -0,0 +1,5 @@
+export * from './modules.js';
+export * from './consts.js';
+export * from './middleware.js';
+export * from './guards/index.js';
+//# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,mBAAmB,CAAA"}

package/build/middleware.d.ts

@@ -0,0 +1,3 @@
+import type { Middleware } from '@owlmeans/context';
+export declare const authMiddleware: Middleware;
+//# sourceMappingURL=middleware.d.ts.map

package/build/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAOnD,eAAO,MAAM,cAAc,EAAE,UAsC5B,CAAA"}

package/build/middleware.js

@@ -0,0 +1,39 @@
+import { MiddlewareType, MiddlewareStage, AppType } from '@owlmeans/context';
+import { provideRequest } from '@owlmeans/client-module';
+import { AUTH_HEADER } from '@owlmeans/auth';
+export const authMiddleware = {
+    type: MiddlewareType.Context,
+    stage: MiddlewareStage.Loading,
+    apply: async (context) => {
+        context.modules().forEach(module => {
+            if (module.route.route.type === AppType.Backend && module.call != null) {
+                const guards = module.getGuards();
+                if (guards.length > 0) {
+                    if (module._auth_common_middleware_applied === true) {
+                        return;
+                    }
+                    module._auth_common_middleware_applied = true;
+                    // const auth = context.service<GuardService>(service)
+                    const call = module.call;
+                    module.call = async (req, res) => {
+                        // @TODO Actually we may use multiple authentication headers with the same name
+                        // As I learnt its not always the case
+                        const [token] = (await Promise.all(guards.map(guard => context.service(guard).authenticated(req)))).filter(token => token != null).reverse();
+                        if (token != null) {
+                            await module.resolve();
+                            const _req = req ?? provideRequest(module.getAlias(), module.getPath());
+                            const headers = (_req.headers ?? {});
+                            if (headers[AUTH_HEADER] == null) {
+                                headers[AUTH_HEADER] = token;
+                                _req.headers = headers;
+                                req = _req;
+                            }
+                        }
+                        return call(req, res);
+                    };
+                }
+            }
+        });
+    }
+};
+//# sourceMappingURL=middleware.js.map