@owlmeans/auth-common 0.1.0

package/build/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAExD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAG5C,MAAM,CAAC,MAAM,cAAc,GAAe;IACxC,IAAI,EAAE,cAAc,CAAC,OAAO;IAC5B,KAAK,EAAE,eAAe,CAAC,OAAO;IAC9B,KAAK,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;QACrB,OAAO,CAAC,OAAO,EAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;YACzC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBACvE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;gBACjC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtB,IAAI,MAAM,CAAC,+BAA+B,KAAK,IAAI,EAAE,CAAC;wBACpD,OAAM;oBACR,CAAC;oBACD,MAAM,CAAC,+BAA+B,GAAG,IAAI,CAAA;oBAC7C,sDAAsD;oBACtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;oBACxB,MAAM,CAAC,IAAI,GAAG,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;wBAC/B,+EAA+E;wBAC/E,sCAAsC;wBACtC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAC3C,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAe,KAAK,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CACjE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAA;wBAC5C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;4BAClB,MAAM,MAAM,CAAC,OAAO,EAAE,CAAA;4BACtB,MAAM,IAAI,GAA6B,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;4BACjG,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAuC,CAAA;4BAC1E,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,IAAI,EAAE,CAAC;gCACjC,OAAO,CAAC,WAAW,CAAC,GAAG,KAAK,CAAA;gCAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;gCACtB,GAAG,GAAG,IAAkB,CAAA;4BAC1B,CAAC;wBACH,CAAC;wBAED,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;oBACvB,CAAC,CAAA;gBAEH,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;CACF,CAAA"}

package/build/modules.d.ts

@@ -0,0 +1,2 @@
+export declare const modules: import("@owlmeans/module").CommonModule[];
+//# sourceMappingURL=modules.d.ts.map

package/build/modules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,OAAO,2CAuBnB,CAAA"}

package/build/modules.js

@@ -0,0 +1,32 @@
+import { AUTHEN, AUTHEN_AUTHEN, AUTHEN_INIT, AUTHEN_RELY, AllowanceRequestSchema, AuthCredentialsSchema, AuthTokenSchema, CAUTHEN, CAUTHEN_AUTHEN, CAUTHEN_AUTHEN_DEFAULT, CAUTHEN_AUTHEN_TYPED, DISPATCHER, DISPATCHER_AUTHEN, OptionalAuthTokenSchema, CAUTHEN_FLOW_ENTER } from '@owlmeans/auth';
+// import { AppType } from '@owlmeans/context'
+import { body, filter, module, query } from '@owlmeans/module';
+import { route, RouteMethod, frontend, backend, socket } from '@owlmeans/route';
+import { DISPATCHER_PATH } from './consts.js';
+export const modules = [
+    module(route(AUTHEN, '/authentication', backend())),
+    module(route(AUTHEN_INIT, '/init', backend(AUTHEN, RouteMethod.POST)), filter(body(AllowanceRequestSchema))),
+    module(route(AUTHEN_AUTHEN, '/authenticate', backend(AUTHEN, RouteMethod.POST)), filter(body(AuthCredentialsSchema))),
+    module(route(AUTHEN_RELY, '/rely', socket(AUTHEN)), filter(query(OptionalAuthTokenSchema))),
+    module(route(CAUTHEN, '/authentication', frontend())),
+    module(route(CAUTHEN_AUTHEN, '/login', frontend(CAUTHEN))),
+    module(route(CAUTHEN_AUTHEN_DEFAULT, '/', frontend(CAUTHEN_AUTHEN, true))),
+    module(route(CAUTHEN_AUTHEN_TYPED, '/:type', frontend(CAUTHEN_AUTHEN))),
+    // This is a helper route that is used by service providers to redirect to an external authentication service.
+    module(route(CAUTHEN_FLOW_ENTER, '/', frontend())),
+    // This is a helper route that is useb by service providres to process authentication provisioning via redirect.
+    // Also it can be default starting point to be redirected to an external identity provider.
+    module(route(DISPATCHER, DISPATCHER_PATH, frontend({ service: DISPATCHER })), 
+    // This module is sticky - it means it's always attach to client router.
+    // It's required here cause every web app needs dispatcher route to authorize
+    // rediected users.
+    filter(query(AuthTokenSchema), { sticky: true })),
+    // This is a helper route that representes a API endpoint of service provider that wants to authenticate 
+    // a user with OwlMeans server-auth library.
+    module(route(DISPATCHER_AUTHEN, '/authenticate', backend(null, RouteMethod.POST)), filter(body(AuthTokenSchema))),
+];
+// const skipModules = [DISPATCHER]
+// export const authBackendModules = modules.filter(
+//   module => !skipModules.includes(module.alias) && module.route.route.type === AppType.Backend
+// ).map(module => module.alias)
+//# sourceMappingURL=modules.js.map

package/build/modules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"modules.js","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AACA,OAAO,EACL,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,sBAAsB,EAAE,qBAAqB,EAC9F,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,UAAU,EAClG,iBAAiB,EAAE,uBAAuB,EAAE,kBAAkB,EAC/D,MAAM,gBAAgB,CAAA;AACvB,8CAA8C;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAC9D,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE7C,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC5G,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACrH,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC3F,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrD,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,GAAG,EAAE,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1E,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;IACvE,8GAA8G;IAC9G,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClD,gHAAgH;IAChH,2FAA2F;IAC3F,MAAM,CACJ,KAAK,CAAC,UAAU,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IACrE,wEAAwE;IACxE,6EAA6E;IAC7E,mBAAmB;IACnB,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CACjD;IACD,yGAAyG;IACzG,4CAA4C;IAC5C,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,eAAe,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;CAClH,CAAA;AAED,mCAAmC;AACnC,oDAAoD;AACpD,iGAAiG;AACjG,gCAAgC"}

package/build/types.d.ts

@@ -0,0 +1,28 @@
+import type { Auth, AuthToken, PermissionSet, Profile } from '@owlmeans/auth';
+import type { ConfigRecord, InitializedService } from '@owlmeans/context';
+import type { AbstractRequest, GuardService } from '@owlmeans/module';
+import type { Resource, ResourceRecord } from '@owlmeans/resource';
+export interface AuthRequest extends AbstractRequest {
+    query: AuthToken;
+}
+export interface AuthUIParams {
+    type?: string;
+}
+export interface AuthService extends GuardService {
+    auth?: Auth;
+    /**
+     * @throws {AuthenFailed}
+     */
+    authenticate: (token: AuthToken) => Promise<void>;
+    update: (token: string | undefined) => Promise<void>;
+    user: () => Auth;
+    store: <T extends ResourceRecord = ResourceRecord>() => Resource<T>;
+}
+export interface AuthorizationService extends InitializedService {
+    isAllowed: (permissions: string | string[] | PermissionSet | PermissionSet[], token?: string | AuthToken | null, thr?: boolean) => Promise<boolean>;
+    update: (token?: string | AuthToken, thr?: boolean) => Promise<AuthToken | null>;
+}
+export interface TrustedRecord extends ConfigRecord, Partial<Omit<Profile, "permissions" | "attributes">> {
+    id: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAC7E,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAElE,MAAM,WAAW,WAAY,SAAQ,eAAe;IAClD,KAAK,EAAE,SAAS,CAAA;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,WAAY,SAAQ,YAAY;IAC/C,IAAI,CAAC,EAAE,IAAI,CAAA;IACX;;OAEG;IACH,YAAY,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACjD,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACpD,IAAI,EAAE,MAAM,IAAI,CAAA;IAEhB,KAAK,EAAE,CAAC,CAAC,SAAS,cAAc,GAAG,cAAc,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAA;CACpE;AAED,MAAM,WAAW,oBAAqB,SAAQ,kBAAkB;IAC9D,SAAS,EAAE,CACT,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,aAAa,GAAG,aAAa,EAAE,EAChE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACjC,GAAG,CAAC,EAAE,OAAO,KACV,OAAO,CAAC,OAAO,CAAC,CAAA;IAErB,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAA;CACjF;AAED,MAAM,WAAW,aAAc,SAAQ,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,GAAG,YAAY,CAAC,CAAC;IACvG,EAAE,EAAE,MAAM,CAAA;CACX"}

package/build/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/build/utils/header.d.ts

@@ -0,0 +1,3 @@
+import type { AbstractRequest } from '@owlmeans/module';
+export declare const extractAuthToken: (req: Partial<AbstractRequest>, type?: string | null, onlyValue?: boolean) => string | null;
+//# sourceMappingURL=header.d.ts.map

package/build/utils/header.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"header.d.ts","sourceRoot":"","sources":["../../src/utils/header.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAEvD,eAAO,MAAM,gBAAgB,QACtB,OAAO,CAAC,eAAe,CAAC,SACvB,MAAM,GAAG,IAAI,cACR,OAAO,KACjB,MAAM,GAAG,IAgBX,CAAA"}

package/build/utils/header.js

@@ -0,0 +1,16 @@
+import { AUTH_HEADER, AuthroizationType } from '@owlmeans/auth';
+export const extractAuthToken = (req, type = AuthroizationType.Ed25519BasicToken, onlyValue = true) => {
+    let authorization = req.headers?.[AUTH_HEADER];
+    authorization = Array.isArray(authorization) ? authorization[0] : authorization;
+    if (authorization == null) {
+        return null;
+    }
+    const [prefix, ...rest] = authorization.split(' ');
+    if (type == null) {
+        return onlyValue ? rest.join(' ') : authorization;
+    }
+    return prefix === type.toUpperCase() ?
+        onlyValue ? rest.join(' ') : authorization
+        : null;
+};
+//# sourceMappingURL=header.js.map

package/build/utils/header.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"header.js","sourceRoot":"","sources":["../../src/utils/header.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAG/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,GAA6B,EAC7B,OAAsB,iBAAiB,CAAC,iBAAiB,EACzD,YAAqB,IAAI,EACV,EAAE;IACjB,IAAI,aAAa,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAA;IAC9C,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAA;IAE/E,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAClD,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACjB,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAA;IACnD,CAAC;IAED,OAAO,MAAM,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACpC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa;QAC1C,CAAC,CAAC,IAAI,CAAA;AACV,CAAC,CAAA"}

package/build/utils/index.d.ts

@@ -0,0 +1,4 @@
+export type * from './types.js';
+export * from './trusted.js';
+export * from './header.js';
+//# sourceMappingURL=index.d.ts.map

package/build/utils/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AACA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA"}

package/build/utils/index.js

@@ -0,0 +1,3 @@
+export * from './trusted.js';
+export * from './header.js';
+//# sourceMappingURL=index.js.map

package/build/utils/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAEA,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA"}

package/build/utils/trusted.d.ts

@@ -0,0 +1,7 @@
+import type { Context, Config } from './types.js';
+import type { TrustedRecord } from '../types.js';
+export declare const trust: <C extends Config, T extends Context<C>>(context: T, resource: string, userName: string, field?: string) => Promise<{
+    user: TrustedRecord;
+    key: import("@owlmeans/basic-keys").KeyPairModel;
+}>;
+//# sourceMappingURL=trusted.d.ts.map

package/build/utils/trusted.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted.d.ts","sourceRoot":"","sources":["../../src/utils/trusted.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAIhD,eAAO,MAAM,KAAK,GAAU,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,MAAM,YAAY,MAAM,UAAS,MAAM;;;EAUhI,CAAA"}

package/build/utils/trusted.js

@@ -0,0 +1,11 @@
+import { fromPubKey, makeKeyPairModel } from '@owlmeans/basic-keys';
+export const trust = async (context, resource, userName, field = 'name') => {
+    const trustedUser = await context.resource(resource).load(userName, field);
+    if (trustedUser == null) {
+        throw new SyntaxError(`Auth service trusted entity is not provided: ${userName}`);
+    }
+    // @TODO credential can really be undefined - we need to process it properly
+    const keyPair = trustedUser.secret != null ? makeKeyPairModel(trustedUser.secret) : fromPubKey(trustedUser.credential);
+    return { user: trustedUser, key: keyPair };
+};
+//# sourceMappingURL=trusted.js.map

package/build/utils/trusted.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted.js","sourceRoot":"","sources":["../../src/utils/trusted.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAEnE,MAAM,CAAC,MAAM,KAAK,GAAG,KAAK,EAA0C,OAAU,EAAE,QAAgB,EAAE,QAAgB,EAAE,QAAgB,MAAM,EAAE,EAAE;IAC5I,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,QAAQ,CAA0B,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IACnG,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,WAAW,CAAC,gDAAgD,QAAQ,EAAE,CAAC,CAAA;IACnF,CAAC;IAED,4EAA4E;IAC5E,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,UAAW,CAAC,CAAA;IAEvH,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;AAC5C,CAAC,CAAA"}

package/build/utils/types.d.ts

@@ -0,0 +1,6 @@
+import type { BasicContext, BasicConfig } from '@owlmeans/context';
+export interface Config extends BasicConfig {
+}
+export interface Context<C extends Config = Config> extends BasicContext<C> {
+}
+//# sourceMappingURL=types.d.ts.map

package/build/utils/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/utils/types.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAElE,MAAM,WAAW,MAAO,SAAQ,WAAW;CAAG;AAE9C,MAAM,WAAW,OAAO,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,CAAE,SAAQ,YAAY,CAAC,CAAC,CAAC;CAAG"}

package/build/utils/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/utils/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/utils/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@owlmeans/auth-common",
+  "version": "0.1.0",
+  "type": "module",
+  "scripts": {
+    "build": "tsc -b",
+    "dev": "sleep 30 && nodemon -e ts,tsx,json --watch src --exec \"tsc -p ./tsconfig.json\"",
+    "watch": "tsc -b -w --preserveWatchOutput --pretty"
+  },
+  "main": "build/index.js",
+  "module": "build/index.js",
+  "types": "build/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./build/index.js",
+      "require": "./build/index.js",
+      "default": "./build/index.js",
+      "module": "./build/index.js",
+      "types": "./build/index.d.ts"
+    },
+    "./utils": {
+      "import": "./build/utils/index.js",
+      "require": "./build/utils/index.js",
+      "default": "./build/utils/index.js",
+      "module": "./build/utils/index.js",
+      "types": "./build/utils/index.d.ts"
+    }
+  },
+  "dependencies": {
+    "@owlmeans/auth": "^0.1.0",
+    "@owlmeans/auth-common": "^0.1.0",
+    "@owlmeans/basic-ids": "^0.1.0",
+    "@owlmeans/basic-keys": "^0.1.0",
+    "@owlmeans/client-module": "^0.1.0",
+    "@owlmeans/context": "^0.1.0",
+    "@owlmeans/module": "^0.1.0",
+    "@owlmeans/resource": "^0.1.0",
+    "@owlmeans/route": "^0.1.0"
+  },
+  "devDependencies": {
+    "nodemon": "^3.1.7",
+    "npm-check": "^6.0.1",
+    "typescript": "^5.6.3"
+  },
+  "private": false,
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/consts.ts

@@ -0,0 +1,16 @@
+export const RELY_PIN_PERFIX = 'rely-pin:'
+
+export const RELY_TOKEN_PREFIX = 'rely-token:'
+
+export const RELY_CALL_TIMEOUT = 120
+
+export const RELY_ACTION_TIMEOUT = 600
+
+export const DISPATCHER_PATH = '/dispatcher'
+
+export const DEF_AUTH_SRV = 'auth'
+
+export const DEFAULT_GUARD = DEF_AUTH_SRV
+
+export const TOKEN_UPDATE = 'auth-token-refresh'
+

package/src/guards/basic-ed25519/consts.ts

@@ -0,0 +1,10 @@
+import { AuthroizationType } from '@owlmeans/auth'
+
+export const GUARD_ED25519 = `guard:${AuthroizationType.Ed25519BasicSignature}`
+
+export const BED255_TIME_HEADER = 'X-Auth-Time'
+export const BED255_NONCE_HEADER = 'X-Auth-Nonce'
+
+export const BED255_SIG_TTL = 60 * 1000
+
+export const BED255_CASHE_RESOURCE = 'basic-ed25519-nonce-cache'

package/src/guards/basic-ed25519/index.ts

@@ -0,0 +1,4 @@
+
+export type * from './types.js'
+export * from './consts.js'
+export * from './service.js'

package/src/guards/basic-ed25519/service.ts

@@ -0,0 +1,142 @@
+import { createService } from '@owlmeans/context'
+import type { AbstractRequest, AbstractResponse } from '@owlmeans/module'
+import { assertContext } from '@owlmeans/context'
+import {
+  BED255_NONCE_HEADER, BED255_TIME_HEADER, BED255_CASHE_RESOURCE, GUARD_ED25519,
+  BED255_SIG_TTL
+} from './consts.js'
+import { trust } from '../../utils/trusted.js'
+import type { Config, Context } from '../../utils/types.js'
+import type { BasicEd25519Guard, BasicEd25519GuardOptions } from './types.js'
+import { AuthenPayloadError, AuthroizationType, AuthRole } from '@owlmeans/auth'
+import type { Auth } from '@owlmeans/auth'
+import { createIdOfLength } from '@owlmeans/basic-ids'
+import type { Resource, ResourceRecord } from '@owlmeans/resource'
+import { extractAuthToken } from '@owlmeans/auth-common/utils'
+
+const timeKey = BED255_TIME_HEADER.toLocaleLowerCase()
+const nonceKey = BED255_NONCE_HEADER.toLocaleLowerCase()
+
+/**
+ * Proper configuration:
+ * - One needs to specify opts.cache as a redis resource that stores nonces for a while to
+ * avoid requests duplication.
+ */
+export const makeBasicEd25519Guard = (resource: string, opts?: BasicEd25519GuardOptions): BasicEd25519Guard => {
+
+  const cache = (context: Context) => context.hasResource(opts?.cache ?? BED255_CASHE_RESOURCE)
+    ? context.resource<Resource<ResourceRecord>>(opts?.cache ?? BED255_CASHE_RESOURCE)
+    : null
+
+  const guard: BasicEd25519Guard = createService<BasicEd25519Guard>(GUARD_ED25519, {
+    authenticated: async req => {
+      const context = assertContext<Config, Context>(guard.ctx)
+      const truested = await trust(context, resource, context.cfg.alias ?? context.cfg.service)
+
+      // req?.body != null 
+      if (req != null && truested.user.secret != null) {
+        if (req.headers == null) {
+          req.headers = {}
+        }
+        req.headers[timeKey] = new Date().toISOString()
+        req.headers[nonceKey] = createIdOfLength(16)
+
+        const payload = {
+          body: req.body ?? {},
+          headers: { [timeKey]: req.headers[timeKey], [nonceKey]: req.headers[nonceKey] }
+        }
+
+        const token = [
+          AuthroizationType.Ed25519BasicSignature.toUpperCase()
+          , ['Credential', truested.user.id]
+          , ['Signature', await truested.key.sign(payload)]
+        ]
+
+        return token.map(
+          item => Array.isArray(item) ? item.join('=') : item
+        ).join(' ')
+      }
+
+      return null
+    },
+
+    match: async req =>
+      extractAuthToken(req, AuthroizationType.Ed25519BasicSignature) != null,
+
+    handle: async <T>(req: AbstractRequest, res: AbstractResponse<Auth>) => {
+      const context = assertContext<Config, Context>(guard.ctx)
+      const authorization = extractAuthToken(req, AuthroizationType.Ed25519BasicSignature)
+      if (authorization == null) {
+        return false as T
+      }
+
+      const signature = authorization.split(' ', 3).reduce((result, pair) => {
+        if (!pair.includes('=')) {
+          return result
+        }
+        const [key, value] = pair.split('=', 2)
+        return { ...result, [key.toLowerCase()]: value }
+      }, {} as { credential: string, signature: string })
+
+      const trusted = await trust(context, resource, signature.credential, "id")
+      if (trusted.user.credential == null) {
+        return false as T
+      }
+
+      const payload = {
+        body: req.body ?? {},
+        headers: { [timeKey]: req.headers[timeKey], [nonceKey]: req.headers[nonceKey] }
+      }
+
+      if (!await trusted.key.verify(payload, signature.signature)) {
+        return false as T
+      }
+
+      if (typeof req.headers[timeKey] !== 'string') {
+        throw new AuthenPayloadError('timestamp')
+      }
+
+      const createdAt = new Date(req.headers[timeKey])
+
+      if (createdAt.getTime() + BED255_SIG_TTL < Date.now()) {
+        throw new AuthenPayloadError('expired')
+      }
+
+      const nonce = req.headers[nonceKey]
+      if (typeof nonce !== 'string') {
+        throw new AuthenPayloadError('nonce')
+      }
+
+      try {
+        const tried = cache(context)
+        if (tried != null) {
+          await tried.create({ id: nonce }, { ttl: BED255_SIG_TTL / 1000 })
+        }
+      } catch {
+        throw new AuthenPayloadError('nonce')
+      }
+
+      res.resolve({
+        token: authorization,
+        userId: trusted.user.id,
+        profileId: trusted.user.id,
+        entityId: trusted.user.entityId,
+        scopes: trusted.user.name != null ? [trusted.user.name] : [],
+        type: AuthroizationType.Ed25519BasicSignature,
+        source: context.cfg.service,
+        /**
+         * @TODO actually it's not always the case (that the the role is the service)
+         */
+        role: AuthRole.Service,
+        isUser: false,
+        createdAt: new Date()
+      })
+
+      return true as T
+    }
+  }, guard => async () => {
+    guard.initialized = true
+  })
+
+  return guard
+}

package/src/guards/basic-ed25519/types.ts

@@ -0,0 +1,9 @@
+import type { GuardService } from '@owlmeans/module'
+
+export interface BasicEd25519Guard extends GuardService {
+}
+
+export interface BasicEd25519GuardOptions {
+  cache?: string
+}
+

package/src/guards/index.ts

@@ -0,0 +1,2 @@
+
+export * from './basic-ed25519/index.js'

package/src/index.ts

@@ -0,0 +1,6 @@
+export type * from './types.js'
+
+export * from './modules.js'
+export * from './consts.js'
+export * from './middleware.js'
+export * from './guards/index.js'

package/src/middleware.ts

@@ -0,0 +1,50 @@
+import type { Middleware } from '@owlmeans/context'
+import { MiddlewareType, MiddlewareStage, AppType } from '@owlmeans/context'
+import { provideRequest } from '@owlmeans/client-module'
+import type { ClientModule } from '@owlmeans/client-module'
+import { AUTH_HEADER } from '@owlmeans/auth'
+import type { AbstractRequest, GuardService } from '@owlmeans/module'
+
+export const authMiddleware: Middleware = {
+  type: MiddlewareType.Context,
+  stage: MiddlewareStage.Loading,
+  apply: async context => {
+    context.modules<Perked>().forEach(module => {
+      if (module.route.route.type === AppType.Backend && module.call != null) {
+        const guards = module.getGuards()
+        if (guards.length > 0) {
+          if (module._auth_common_middleware_applied === true) {
+            return
+          }
+          module._auth_common_middleware_applied = true
+          // const auth = context.service<GuardService>(service)
+          const call = module.call
+          module.call = async (req, res) => {
+            // @TODO Actually we may use multiple authentication headers with the same name
+            // As I learnt its not always the case
+            const [token] = (await Promise.all(guards.map(
+              guard => context.service<GuardService>(guard).authenticated(req)
+            ))).filter(token => token != null).reverse()
+            if (token != null) {
+              await module.resolve()
+              const _req: Partial<AbstractRequest> = req ?? provideRequest(module.getAlias(), module.getPath())
+              const headers = (_req.headers ?? {}) as Record<string, string | undefined>
+              if (headers[AUTH_HEADER] == null) {
+                headers[AUTH_HEADER] = token
+                _req.headers = headers
+                req = _req as typeof req
+              }
+            }
+
+            return call(req, res)
+          }
+          
+        }
+      }
+    })
+  }
+}
+
+interface Perked extends ClientModule<unknown> {
+  _auth_common_middleware_applied?: boolean
+}

package/src/modules.ts

@@ -0,0 +1,40 @@
+
+import {
+  AUTHEN, AUTHEN_AUTHEN, AUTHEN_INIT, AUTHEN_RELY, AllowanceRequestSchema, AuthCredentialsSchema,
+  AuthTokenSchema, CAUTHEN, CAUTHEN_AUTHEN, CAUTHEN_AUTHEN_DEFAULT, CAUTHEN_AUTHEN_TYPED, DISPATCHER,
+  DISPATCHER_AUTHEN, OptionalAuthTokenSchema, CAUTHEN_FLOW_ENTER
+} from '@owlmeans/auth'
+// import { AppType } from '@owlmeans/context'
+import { body, filter, module, query } from '@owlmeans/module'
+import { route, RouteMethod, frontend, backend, socket } from '@owlmeans/route'
+import { DISPATCHER_PATH } from './consts.js'
+
+export const modules = [
+  module(route(AUTHEN, '/authentication', backend())),
+  module(route(AUTHEN_INIT, '/init', backend(AUTHEN, RouteMethod.POST)), filter(body(AllowanceRequestSchema))),
+  module(route(AUTHEN_AUTHEN, '/authenticate', backend(AUTHEN, RouteMethod.POST)), filter(body(AuthCredentialsSchema))),
+  module(route(AUTHEN_RELY, '/rely', socket(AUTHEN)), filter(query(OptionalAuthTokenSchema))),
+  module(route(CAUTHEN, '/authentication', frontend())),
+  module(route(CAUTHEN_AUTHEN, '/login', frontend(CAUTHEN))),
+  module(route(CAUTHEN_AUTHEN_DEFAULT, '/', frontend(CAUTHEN_AUTHEN, true))),
+  module(route(CAUTHEN_AUTHEN_TYPED, '/:type', frontend(CAUTHEN_AUTHEN))),
+  // This is a helper route that is used by service providers to redirect to an external authentication service.
+  module(route(CAUTHEN_FLOW_ENTER, '/', frontend())),
+  // This is a helper route that is useb by service providres to process authentication provisioning via redirect.
+  // Also it can be default starting point to be redirected to an external identity provider.
+  module(
+    route(DISPATCHER, DISPATCHER_PATH, frontend({ service: DISPATCHER })),
+    // This module is sticky - it means it's always attach to client router.
+    // It's required here cause every web app needs dispatcher route to authorize
+    // rediected users.
+    filter(query(AuthTokenSchema), { sticky: true })
+  ),
+  // This is a helper route that representes a API endpoint of service provider that wants to authenticate 
+  // a user with OwlMeans server-auth library.
+  module(route(DISPATCHER_AUTHEN, '/authenticate', backend(null, RouteMethod.POST)), filter(body(AuthTokenSchema))),
+]
+
+// const skipModules = [DISPATCHER]
+// export const authBackendModules = modules.filter(
+//   module => !skipModules.includes(module.alias) && module.route.route.type === AppType.Backend
+// ).map(module => module.alias)

package/src/types.ts

@@ -0,0 +1,38 @@
+import type { Auth, AuthToken, PermissionSet, Profile } from '@owlmeans/auth'
+import type { ConfigRecord, InitializedService } from '@owlmeans/context'
+import type { AbstractRequest, GuardService } from '@owlmeans/module'
+import type { Resource, ResourceRecord } from '@owlmeans/resource'
+
+export interface AuthRequest extends AbstractRequest {
+  query: AuthToken
+}
+
+export interface AuthUIParams {
+  type?: string
+}
+
+export interface AuthService extends GuardService {
+  auth?: Auth
+  /**
+   * @throws {AuthenFailed}
+   */
+  authenticate: (token: AuthToken) => Promise<void>
+  update: (token: string | undefined) => Promise<void>
+  user: () => Auth
+  
+  store: <T extends ResourceRecord = ResourceRecord>() => Resource<T>
+}
+
+export interface AuthorizationService extends InitializedService {
+  isAllowed: (
+    permissions: string | string[] | PermissionSet | PermissionSet[], 
+    token?: string | AuthToken | null, 
+    thr?: boolean
+  ) => Promise<boolean>
+
+  update: (token?: string | AuthToken, thr?: boolean) => Promise<AuthToken | null>
+}
+
+export interface TrustedRecord extends ConfigRecord, Partial<Omit<Profile, "permissions" | "attributes">> {
+  id: string
+}

package/src/utils/header.ts

@@ -0,0 +1,24 @@
+import { AUTH_HEADER, AuthroizationType } from '@owlmeans/auth'
+import type { AbstractRequest } from '@owlmeans/module'
+
+export const extractAuthToken = (
+  req: Partial<AbstractRequest>, 
+  type: string | null = AuthroizationType.Ed25519BasicToken, 
+  onlyValue: boolean = true
+): string | null => {
+  let authorization = req.headers?.[AUTH_HEADER]
+  authorization = Array.isArray(authorization) ? authorization[0] : authorization
+
+  if (authorization == null) {
+    return null
+  }
+
+  const [prefix, ...rest] = authorization.split(' ')
+  if (type == null) {
+    return onlyValue ? rest.join(' ') : authorization
+  }
+
+  return prefix === type.toUpperCase() ?
+    onlyValue ? rest.join(' ') : authorization
+    : null
+}

package/src/utils/index.ts

@@ -0,0 +1,4 @@
+
+export type * from './types.js'
+export * from './trusted.js'
+export * from './header.js'

package/src/utils/trusted.ts

@@ -0,0 +1,17 @@
+
+import type { Context, Config } from './types.js'
+import type { TrustedRecord } from '../types.js'
+import type { Resource } from '@owlmeans/resource'
+import { fromPubKey, makeKeyPairModel } from '@owlmeans/basic-keys'
+
+export const trust = async <C extends Config, T extends Context<C>>(context: T, resource: string, userName: string, field: string = 'name') => {
+  const trustedUser = await context.resource<Resource<TrustedRecord>>(resource).load(userName, field)
+  if (trustedUser == null) {
+    throw new SyntaxError(`Auth service trusted entity is not provided: ${userName}`)
+  }
+
+  // @TODO credential can really be undefined - we need to process it properly
+  const keyPair = trustedUser.secret != null ? makeKeyPairModel(trustedUser.secret) : fromPubKey(trustedUser.credential!)
+
+  return { user: trustedUser, key: keyPair }
+}

package/src/utils/types.ts

@@ -0,0 +1,6 @@
+
+import type { BasicContext, BasicConfig } from '@owlmeans/context'
+
+export interface Config extends BasicConfig {}
+
+export interface Context<C extends Config = Config> extends BasicContext<C> {}