@owlmeans/auth-common 0.1.1 → 0.1.3

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2024 OwlMeans Common — Fullstack typescript framework
+Copyright (c) 2026 OwlMeans Common — Fullstack typescript framework
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -1,318 +1,77 @@
 # @owlmeans/auth-common
 
-Common authentication components and modules for OwlMeans Common libraries. This package provides shared authentication infrastructure that bridges the core `@owlmeans/auth` package with client and server implementations, focusing on authentication modules, guards, middleware, and common types used across fullstack applications.
+Predefined authentication modules, guards, and constants shared between server and client packages.
 
 ## Overview
 
-The `@owlmeans/auth-common` package serves as a foundational layer for authentication in the OwlMeans ecosystem, providing:
-
-- **Authentication Modules**: Predefined URL units for authentication flows including login, initialization, and rely functionality
-- **Guard Services**: Authentication and authorization guard implementations for route protection
-- **Common Types**: Shared interfaces and types used across client and server authentication implementations
-- **Middleware**: Authentication middleware for request processing and token validation
-- **Utility Functions**: Helper functions for authentication workflows and token management
-
-This package follows the OwlMeans "quadra" pattern, providing common functionality that can be used by both server and client implementations.
+- Exports standard auth module definitions (login, init, rely, dispatcher) ready to register in any app
+- Provides `DEFAULT_GUARD` and `GUARD_ED25519` constants for protecting routes
+- Implements the Basic ED25519 signature guard service for cryptographic request authentication
+- Headers: `BED255_NONCE_HEADER`, `BED255_TIME_HEADER` for auth challenge/response
 
 ## Installation
 
 ```bash
-npm install @owlmeans/auth-common
+bun add @owlmeans/auth-common
 ```
 
-## Core Concepts
-
-### Authentication Modules
-
-In the OwlMeans ecosystem, modules represent URL units that define authentication routes and their behavior. The auth-common package provides standardized authentication modules for:
-
-- **Backend Authentication**: Server-side authentication endpoints
-- **Frontend Authentication**: Client-side authentication routes  
-- **Socket Authentication**: WebSocket authentication channels
-- **Dispatcher Routes**: Authentication flow management and redirection
-
-### Guards and Services
+## Usage
 
-The package defines standard service interfaces for authentication and authorization:
-
-- **AuthService**: Core authentication service with token validation and user management
-- **AuthorizationService**: Permission-based authorization service
-- **GuardService**: Route protection and access control
-
-## API Reference
-
-### Types
-
-#### `AuthRequest`
-Extended request interface with authentication token in query parameters.
-
-```typescript
-interface AuthRequest extends AbstractRequest {
-  query: AuthToken
-}
-```
-
-#### `AuthUIParams`
-Parameters for authentication UI components.
-
-```typescript
-interface AuthUIParams {
-  type?: string  // Authentication type identifier
-}
-```
-
-#### `AuthService`
-Core authentication service interface extending GuardService.
-
-```typescript
-interface AuthService extends GuardService {
-  auth?: Auth                                           // Current authentication state
-  authenticate: (token: AuthToken) => Promise<void>    // Authenticate with token (throws AuthenFailed)
-  update: (token: string | undefined) => Promise<void> // Update authentication token
-  user: () => Auth                                      // Get current authenticated user
-  store: <T extends ResourceRecord = ResourceRecord>() => Resource<T>  // Get authentication storage resource
-}
-```
-
-**Methods:**
-- **`authenticate(token: AuthToken): Promise<void>`**: Validates and sets authentication token. Throws `AuthenFailed` on invalid token.
-- **`update(token: string | undefined): Promise<void>`**: Updates the current authentication token, useful for token refresh.
-- **`user(): Auth`**: Returns the current authenticated user object.
-- **`store<T>(): Resource<T>`**: Provides access to the authentication storage resource for persistence.
-
-#### `AuthorizationService`
-Service interface for permission-based authorization.
-
-```typescript
-interface AuthorizationService extends InitializedService {
-  isAllowed: (permissions: string | string[] | PermissionSet | PermissionSet[], token?: string | AuthToken | null, thr?: boolean) => Promise<boolean>
-  update: (token?: string | AuthToken, thr?: boolean) => Promise<AuthToken | null>
-}
-```
-
-**Methods:**
-- **`isAllowed(permissions, token?, thr?): Promise<boolean>`**: Checks if given permissions are allowed for the token. Can throw on error if `thr` is true.
-- **`update(token?, thr?): Promise<AuthToken | null>`**: Updates authorization context with new token and returns validated token.
-
-#### `TrustedRecord`
-Configuration record for trusted authentication entities.
-
-```typescript
-interface TrustedRecord extends ConfigRecord, Partial<Omit<Profile, "permissions" | "attributes">> {
-  id: string  // Unique identifier for the trusted entity
-}
-```
-
-### Modules
-
-The package exports a standardized set of authentication modules through the `modules` array:
-
-#### Backend Modules
-- **`AUTHEN`**: Base authentication endpoint (`/authentication`)
-- **`AUTHEN_INIT`**: Authentication initialization (`/init`) - POST with AllowanceRequestSchema
-- **`AUTHEN_AUTHEN`**: Authentication execution (`/authenticate`) - POST with AuthCredentialsSchema  
-- **`AUTHEN_RELY`**: WebSocket authentication rely (`/rely`) - with OptionalAuthTokenSchema
-
-#### Frontend Modules
-- **`CAUTHEN`**: Base client authentication (`/authentication`)
-- **`CAUTHEN_AUTHEN`**: Client login page (`/login`)
-- **`CAUTHEN_AUTHEN_DEFAULT`**: Default client auth route (`/`)
-- **`CAUTHEN_AUTHEN_TYPED`**: Typed authentication (`/:type`)
-- **`CAUTHEN_FLOW_ENTER`**: Authentication flow entry point (`/`)
-
-#### Dispatcher Modules
-- **`DISPATCHER`**: Authentication dispatcher (`/dispatcher`) - sticky module with AuthTokenSchema
-- **`DISPATCHER_AUTHEN`**: Dispatcher authentication endpoint (`/authenticate`) - POST with AuthTokenSchema
+Register the built-in auth modules and protect a route:
 
 ```typescript
 import { modules } from '@owlmeans/auth-common'
+import { GUARD_ED25519, DEFAULT_GUARD } from '@owlmeans/auth-common'
 
-// All authentication modules are available in the modules array
-console.log(modules.length) // 11 predefined authentication modules
+// Add auth modules to your app (includes /authentication, /login, /dispatcher routes)
+await main(context, [...modules, ...appModules])
 ```
 
-### Constants
+Protect a route with the ED25519 signature guard (re-exported via `@owlmeans/server-app`):
 
-#### Rely Constants
 ```typescript
-const RELY_PIN_PERFIX = 'rely-pin:'        // Prefix for rely PIN tokens
-const RELY_TOKEN_PREFIX = 'rely-token:'    // Prefix for rely tokens
-const RELY_CALL_TIMEOUT = 120              // Rely call timeout in seconds
-const RELY_ACTION_TIMEOUT = 600            // Rely action timeout in seconds
-```
+import { GUARD_ED25519 } from '@owlmeans/auth-common'
+import { module, guard } from '@owlmeans/server-app'
 
-#### Service Constants
-```typescript
-const DISPATCHER_PATH = '/dispatcher'      // Default dispatcher route path
-const DEF_AUTH_SRV = 'auth'               // Default authentication service name
-const DEFAULT_GUARD = DEF_AUTH_SRV        // Default guard service name
-const TOKEN_UPDATE = 'auth-token-refresh' // Token update event name
+const adminModule = module(route('admin', '/api/admin'), guard(GUARD_ED25519))
 ```
 
-### Guards
-
-The package provides authentication guard implementations in the `/guards` subpackage:
+## API
 
-#### Basic Ed25519 Guard
-Authentication guard implementation for Ed25519 signature-based authentication.
+### `modules`
 
-```typescript
-import { basicEd25519Guard } from '@owlmeans/auth-common/guards'
-```
+Array of pre-built `CommonModule` instances covering the standard auth flow:
+- `AUTHEN` — backend `/authentication` base route
+- `AUTHEN_INIT` — POST `/authentication/init` (allowance request)
+- `AUTHEN_AUTHEN` — POST `/authentication/authenticate` (credential submission)
+- `AUTHEN_RELY` — WebSocket `/authentication/rely`
+- `CAUTHEN`, `CAUTHEN_AUTHEN` — frontend auth routes
+- `DISPATCHER` — frontend dispatcher route (sticky, handles redirect auth tokens)
 
-### Utilities
-
-Authentication utility functions are available in the `/utils` subpackage:
-
-#### Header Utilities
-Functions for managing authentication headers in HTTP requests.
-
-#### Trusted Entity Utilities  
-Functions for managing trusted authentication entities and their validation.
-
-```typescript
-import { /* utility functions */ } from '@owlmeans/auth-common/utils'
-```
-
-## Usage Examples
-
-### Using Authentication Modules
-
-```typescript
-import { modules } from '@owlmeans/auth-common'
-import { makeBasicContext } from '@owlmeans/context'
-
-const context = makeBasicContext(config)
-
-// Register all authentication modules
-modules.forEach(module => {
-  context.registerModule(module)
-})
-
-await context.configure().init()
-
-// Access specific authentication modules
-const loginModule = context.module('cauthen-authen')
-const authModule = context.module('authen')
-```
-
-### Implementing AuthService
-
-```typescript
-import type { AuthService } from '@owlmeans/auth-common'
-import { createService } from '@owlmeans/context'
-
-const authService = createService<AuthService>('auth', {
-  auth: undefined,
-  
-  async authenticate(token) {
-    // Validate token and set auth
-    const validatedAuth = await validateToken(token)
-    this.auth = validatedAuth
-  },
-  
-  async update(token) {
-    if (token) {
-      await this.authenticate({ token })
-    }
-  },
-  
-  user() {
-    if (!this.auth) {
-      throw new Error('No authenticated user')
-    }
-    return this.auth
-  },
-  
-  store() {
-    // Return authentication storage resource
-    return authStorageResource
-  }
-})
-```
-
-### Permission Checking
+### Guard Constants
 
 ```typescript
-import type { AuthorizationService } from '@owlmeans/auth-common'
-
-const authzService: AuthorizationService = context.service('authorization')
-
-// Check single permission
-const canRead = await authzService.isAllowed('read', userToken)
-
-// Check multiple permissions
-const canReadWrite = await authzService.isAllowed(['read', 'write'], userToken)
-
-// Check with permission sets
-const canAccess = await authzService.isAllowed([{
-  scope: 'documents',
-  permissions: { read: true, write: true }
-}], userToken)
+DEFAULT_GUARD   // alias for the default auth service ('auth')
+GUARD_ED25519   // guard name for Basic ED25519 signature authentication
 ```
 
-### Using Constants
+### Header Constants (for WebSocket/HTTP auth challenges)
 
 ```typescript
-import { DEF_AUTH_SRV, DISPATCHER_PATH, RELY_CALL_TIMEOUT } from '@owlmeans/auth-common'
-
-// Configure authentication service
-const authServiceName = DEF_AUTH_SRV
-
-// Set up dispatcher route
-const dispatcherRoute = DISPATCHER_PATH
-
-// Configure rely timeout
-const relyTimeout = RELY_CALL_TIMEOUT * 1000 // Convert to milliseconds
+BED255_NONCE_HEADER  // 'X-Auth-Nonce'
+BED255_TIME_HEADER   // 'X-Auth-Time'
+BED255_CASHE_RESOURCE // resource alias for nonce cache
 ```
 
-## Integration with OwlMeans Ecosystem
-
-The auth-common package integrates with other OwlMeans packages:
+## Product-Viable Integration Notes
 
-- **@owlmeans/auth**: Core authentication types and validation
-- **@owlmeans/basic-keys**: Cryptographic key management for signatures
-- **@owlmeans/context**: Dependency injection and service registration
-- **@owlmeans/module**: Module system and route definitions
-- **@owlmeans/resource**: Data persistence and resource management
-- **@owlmeans/route**: URL and routing infrastructure
-
-## Package Structure
-
-The authentication common library follows the OwlMeans package structure:
-
-- **types**: TypeScript interfaces and type definitions
-- **modules**: Predefined authentication modules for common flows
-- **consts**: Static values and configuration constants
-- **guards/**: Authentication guard implementations
-- **utils/**: Internal utility functions for authentication workflows
-- **middleware**: Authentication middleware for request processing
+- `DEFAULT_GUARD` protects manager routes after bearer authentication is installed by `@owlmeans/server-auth`.
+- Product authorization composes a custom gate inside `guard(DEFAULT_GUARD, gate(VIABLE_AUTH_GATE, [...]))` rather than using `OIDC_GATE` for Google login flows.
+- `GUARD_ED25519` remains the service-to-service guard for internal/publisher/payment/auth-service calls.
+- The browser-side alias from `@owlmeans/client-auth` must match the default guard name so shared module declarations elevate consistently.
 
 ## Related Packages
 
-This package serves as the foundation for:
-
-- **@owlmeans/server-auth**: Server-side authentication implementation
-- **@owlmeans/client-auth**: Client-side authentication implementation  
-- **@owlmeans/web-oidc-provider**: OpenID Connect provider implementation
-- **@owlmeans/web-oidc-rp**: OpenID Connect relying party implementation
-
-## Error Handling
-
-The package leverages the error types from `@owlmeans/auth`:
-
-- **AuthenFailed**: Thrown by `authenticate()` method on authentication failure
-- **AuthForbidden**: Thrown by authorization services on access denial
-- **AuthError**: Base authentication error for general failures
-
-Always handle authentication errors appropriately in your application:
-
-```typescript
-try {
-  await authService.authenticate(token)
-} catch (error) {
-  if (error instanceof AuthenFailed) {
-    // Handle authentication failure
-  }
-}
-```
+- [`@owlmeans/auth`](../auth) — auth type definitions and schemas
+- [`@owlmeans/server-auth`](../server-auth) — server guard implementation
+- [`@owlmeans/client-auth`](../client-auth) — client auth service

package/build/consts.d.ts

@@ -6,4 +6,24 @@ export declare const DISPATCHER_PATH = "/dispatcher";
 export declare const DEF_AUTH_SRV = "auth";
 export declare const DEFAULT_GUARD = "auth";
 export declare const TOKEN_UPDATE = "auth-token-refresh";
+export declare const WEB_API = "web-auth-api";
+export declare const authApi: {
+    profile: {
+        base: string;
+        toEntityId: string;
+    };
+    entity: {
+        base: string;
+        get: string;
+        profile: {
+            base: string;
+            list: string;
+            link: string;
+        };
+    };
+    auth: {
+        base: string;
+        delegate: string;
+    };
+};
 //# sourceMappingURL=consts.d.ts.map

package/build/consts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,cAAc,CAAA;AAE1C,eAAO,MAAM,iBAAiB,gBAAgB,CAAA;AAE9C,eAAO,MAAM,iBAAiB,MAAM,CAAA;AAEpC,eAAO,MAAM,mBAAmB,MAAM,CAAA;AAEtC,eAAO,MAAM,eAAe,gBAAgB,CAAA;AAE5C,eAAO,MAAM,YAAY,SAAS,CAAA;AAElC,eAAO,MAAM,aAAa,SAAe,CAAA;AAEzC,eAAO,MAAM,YAAY,uBAAuB,CAAA"}
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,cAAc,CAAA;AAE1C,eAAO,MAAM,iBAAiB,gBAAgB,CAAA;AAE9C,eAAO,MAAM,iBAAiB,MAAM,CAAA;AAEpC,eAAO,MAAM,mBAAmB,MAAM,CAAA;AAEtC,eAAO,MAAM,eAAe,gBAAgB,CAAA;AAE5C,eAAO,MAAM,YAAY,SAAS,CAAA;AAElC,eAAO,MAAM,aAAa,SAAe,CAAA;AAEzC,eAAO,MAAM,YAAY,uBAAuB,CAAA;AAEhD,eAAO,MAAM,OAAO,iBAAiB,CAAA;AAErC,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;CAkBnB,CAAA"}

package/build/consts.js

@@ -6,4 +6,24 @@ export const DISPATCHER_PATH = '/dispatcher';
 export const DEF_AUTH_SRV = 'auth';
 export const DEFAULT_GUARD = DEF_AUTH_SRV;
 export const TOKEN_UPDATE = 'auth-token-refresh';
+export const WEB_API = 'web-auth-api';
+export const authApi = {
+    profile: {
+        base: 'api:profile',
+        toEntityId: 'api:profile:to-entity-id',
+    },
+    entity: {
+        base: 'api:entity',
+        get: 'api:entity:get',
+        profile: {
+            base: 'api:entity:profile',
+            list: 'api:entity:profile:list',
+            link: 'api:entity:profile:link',
+        }
+    },
+    auth: {
+        base: 'api:auth',
+        delegate: 'api:auth:delegate',
+    },
+};
 //# sourceMappingURL=consts.js.map

package/build/consts.js.map

@@ -1 +1 @@
-{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAA;AAE1C,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAA;AAE9C,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAA;AAEpC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAA;AAEtC,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAA;AAE5C,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAA;AAElC,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAA;AAEzC,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAA"}
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAA;AAE1C,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAA;AAE9C,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAA;AAEpC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAA;AAEtC,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAA;AAE5C,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAA;AAElC,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAA;AAEzC,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAA;AAEhD,MAAM,CAAC,MAAM,OAAO,GAAG,cAAc,CAAA;AAErC,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,OAAO,EAAE;QACP,IAAI,EAAE,aAAa;QACnB,UAAU,EAAE,0BAA0B;KACvC;IACD,MAAM,EAAE;QACN,IAAI,EAAE,YAAY;QAClB,GAAG,EAAE,gBAAgB;QACrB,OAAO,EAAE;YACP,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,yBAAyB;YAC/B,IAAI,EAAE,yBAAyB;SAChC;KACF;IACD,IAAI,EAAE;QACJ,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,mBAAmB;KAC9B;CACF,CAAA"}

package/build/guards/basic-ed25519/types.d.ts

@@ -1,4 +1,4 @@
-import type { GuardService } from '@owlmeans/module';
+import type { GuardService } from '@owlmeans/entrypoint';
 export interface BasicEd25519Guard extends GuardService {
 }
 export interface BasicEd25519GuardOptions {

package/build/guards/basic-ed25519/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAEpD,MAAM,WAAW,iBAAkB,SAAQ,YAAY;CACtD;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/guards/basic-ed25519/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExD,MAAM,WAAW,iBAAkB,SAAQ,YAAY;CACtD;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf"}

package/build/middleware.js

@@ -1,11 +1,11 @@
 import { MiddlewareType, MiddlewareStage, AppType } from '@owlmeans/context';
-import { provideRequest } from '@owlmeans/client-module';
+import { provideRequest } from '@owlmeans/client-entrypoint';
 import { AUTH_HEADER } from '@owlmeans/auth';
 export const authMiddleware = {
     type: MiddlewareType.Context,
     stage: MiddlewareStage.Loading,
     apply: async (context) => {
-        context.modules().forEach(module => {
+        context.entrypoints().forEach(module => {
             if (module.route.route.type === AppType.Backend && module.call != null) {
                 const guards = module.getGuards();
                 if (guards.length > 0) {

package/build/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAExD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAG5C,MAAM,CAAC,MAAM,cAAc,GAAe;IACxC,IAAI,EAAE,cAAc,CAAC,OAAO;IAC5B,KAAK,EAAE,eAAe,CAAC,OAAO;IAC9B,KAAK,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;QACrB,OAAO,CAAC,OAAO,EAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;YACzC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBACvE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;gBACjC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtB,IAAI,MAAM,CAAC,+BAA+B,KAAK,IAAI,EAAE,CAAC;wBACpD,OAAM;oBACR,CAAC;oBACD,MAAM,CAAC,+BAA+B,GAAG,IAAI,CAAA;oBAC7C,sDAAsD;oBACtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;oBACxB,MAAM,CAAC,IAAI,GAAG,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;wBAC/B,+EAA+E;wBAC/E,sCAAsC;wBACtC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAC3C,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAe,KAAK,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CACjE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAA;wBAC5C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;4BAClB,MAAM,MAAM,CAAC,OAAO,EAAE,CAAA;4BACtB,MAAM,IAAI,GAA6B,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;4BACjG,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAuC,CAAA;4BAC1E,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,IAAI,EAAE,CAAC;gCACjC,OAAO,CAAC,WAAW,CAAC,GAAG,KAAK,CAAA;gCAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;gCACtB,GAAG,GAAG,IAAkB,CAAA;4BAC1B,CAAC;wBACH,CAAC;wBAED,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;oBACvB,CAAC,CAAA;gBAEH,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;CACF,CAAA"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAE5D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAG5C,MAAM,CAAC,MAAM,cAAc,GAAe;IACxC,IAAI,EAAE,cAAc,CAAC,OAAO;IAC5B,KAAK,EAAE,eAAe,CAAC,OAAO;IAC9B,KAAK,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;QACrB,OAAO,CAAC,WAAW,EAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;YAC7C,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBACvE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;gBACjC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtB,IAAI,MAAM,CAAC,+BAA+B,KAAK,IAAI,EAAE,CAAC;wBACpD,OAAM;oBACR,CAAC;oBACD,MAAM,CAAC,+BAA+B,GAAG,IAAI,CAAA;oBAC7C,sDAAsD;oBACtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;oBACxB,MAAM,CAAC,IAAI,GAAG,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;wBAC/B,+EAA+E;wBAC/E,sCAAsC;wBACtC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAC3C,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAe,KAAK,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CACjE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAA;wBAC5C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;4BAClB,MAAM,MAAM,CAAC,OAAO,EAAE,CAAA;4BACtB,MAAM,IAAI,GAA6B,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;4BACjG,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAuC,CAAA;4BAC1E,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,IAAI,EAAE,CAAC;gCACjC,OAAO,CAAC,WAAW,CAAC,GAAG,KAAK,CAAA;gCAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;gCACtB,GAAG,GAAG,IAAkB,CAAA;4BAC1B,CAAC;wBACH,CAAC;wBAED,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;oBACvB,CAAC,CAAA;gBAEH,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;CACF,CAAA"}

package/build/modules.d.ts

@@ -1,2 +1,3 @@
-export declare const modules: import("@owlmeans/module").CommonModule[];
+export declare const modules: import("@owlmeans/entrypoint").CommonEntrypoint[];
+export declare const managerModules: import("@owlmeans/entrypoint").CommonEntrypoint[];
 //# sourceMappingURL=modules.d.ts.map

package/build/modules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,OAAO,2CAuBnB,CAAA"}
+{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,OAAO,mDAuBnB,CAAA;AAED,eAAO,MAAM,cAAc,mDAW1B,CAAA"}

package/build/modules.js

@@ -1,29 +1,35 @@
 import { AUTHEN, AUTHEN_AUTHEN, AUTHEN_INIT, AUTHEN_RELY, AllowanceRequestSchema, AuthCredentialsSchema, AuthTokenSchema, CAUTHEN, CAUTHEN_AUTHEN, CAUTHEN_AUTHEN_DEFAULT, CAUTHEN_AUTHEN_TYPED, DISPATCHER, DISPATCHER_AUTHEN, OptionalAuthTokenSchema, CAUTHEN_FLOW_ENTER } from '@owlmeans/auth';
 // import { AppType } from '@owlmeans/context'
-import { body, filter, module, query } from '@owlmeans/module';
+import { body, filter, entrypoint, query } from '@owlmeans/entrypoint';
 import { route, RouteMethod, frontend, backend, socket } from '@owlmeans/route';
-import { DISPATCHER_PATH } from './consts.js';
+import { DISPATCHER_PATH, WEB_API, authApi } from './consts.js';
 export const modules = [
-    module(route(AUTHEN, '/authentication', backend())),
-    module(route(AUTHEN_INIT, '/init', backend(AUTHEN, RouteMethod.POST)), filter(body(AllowanceRequestSchema))),
-    module(route(AUTHEN_AUTHEN, '/authenticate', backend(AUTHEN, RouteMethod.POST)), filter(body(AuthCredentialsSchema))),
-    module(route(AUTHEN_RELY, '/rely', socket(AUTHEN)), filter(query(OptionalAuthTokenSchema))),
-    module(route(CAUTHEN, '/authentication', frontend())),
-    module(route(CAUTHEN_AUTHEN, '/login', frontend(CAUTHEN))),
-    module(route(CAUTHEN_AUTHEN_DEFAULT, '/', frontend(CAUTHEN_AUTHEN, true))),
-    module(route(CAUTHEN_AUTHEN_TYPED, '/:type', frontend(CAUTHEN_AUTHEN))),
+    entrypoint(route(AUTHEN, '/authentication', backend())),
+    entrypoint(route(AUTHEN_INIT, '/init', backend(AUTHEN, RouteMethod.POST)), filter(body(AllowanceRequestSchema))),
+    entrypoint(route(AUTHEN_AUTHEN, '/authenticate', backend(AUTHEN, RouteMethod.POST)), filter(body(AuthCredentialsSchema))),
+    entrypoint(route(AUTHEN_RELY, '/rely', socket(AUTHEN)), filter(query(OptionalAuthTokenSchema))),
+    entrypoint(route(CAUTHEN, '/authentication', frontend())),
+    entrypoint(route(CAUTHEN_AUTHEN, '/login', frontend(CAUTHEN))),
+    entrypoint(route(CAUTHEN_AUTHEN_DEFAULT, '/', frontend(CAUTHEN_AUTHEN, true))),
+    entrypoint(route(CAUTHEN_AUTHEN_TYPED, '/:type', frontend(CAUTHEN_AUTHEN))),
     // This is a helper route that is used by service providers to redirect to an external authentication service.
-    module(route(CAUTHEN_FLOW_ENTER, '/', frontend())),
+    entrypoint(route(CAUTHEN_FLOW_ENTER, '/', frontend())),
     // This is a helper route that is useb by service providres to process authentication provisioning via redirect.
     // Also it can be default starting point to be redirected to an external identity provider.
-    module(route(DISPATCHER, DISPATCHER_PATH, frontend({ service: DISPATCHER })), 
+    entrypoint(route(DISPATCHER, DISPATCHER_PATH, frontend({ service: DISPATCHER })), 
     // This module is sticky - it means it's always attach to client router.
     // It's required here cause every web app needs dispatcher route to authorize
     // rediected users.
     filter(query(AuthTokenSchema), { sticky: true })),
-    // This is a helper route that representes a API endpoint of service provider that wants to authenticate 
+    // This is a helper route that representes a API endpoint of service provider that wants to authenticate
     // a user with OwlMeans server-auth library.
-    module(route(DISPATCHER_AUTHEN, '/authenticate', backend(null, RouteMethod.POST)), filter(body(AuthTokenSchema))),
+    entrypoint(route(DISPATCHER_AUTHEN, '/authenticate', backend(null, RouteMethod.POST)), filter(body(AuthTokenSchema))),
+];
+export const managerModules = [
+    entrypoint(route(authApi.profile.base, '/profile', backend({ service: WEB_API }))),
+    entrypoint(route(authApi.profile.toEntityId, '/to-entity-id', backend(authApi.profile.base, RouteMethod.POST))),
+    entrypoint(route(authApi.auth.base, '/auth', backend({ service: WEB_API }))),
+    entrypoint(route(authApi.auth.delegate, '/delegate', backend(authApi.auth.base, RouteMethod.POST))),
 ];
 // const skipModules = [DISPATCHER]
 // export const authBackendModules = modules.filter(

package/build/modules.js.map

@@ -1 +1 @@
-{"version":3,"file":"modules.js","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AACA,OAAO,EACL,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,sBAAsB,EAAE,qBAAqB,EAC9F,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,UAAU,EAClG,iBAAiB,EAAE,uBAAuB,EAAE,kBAAkB,EAC/D,MAAM,gBAAgB,CAAA;AACvB,8CAA8C;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAC9D,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE7C,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC5G,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACrH,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC3F,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrD,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,GAAG,EAAE,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1E,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;IACvE,8GAA8G;IAC9G,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClD,gHAAgH;IAChH,2FAA2F;IAC3F,MAAM,CACJ,KAAK,CAAC,UAAU,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IACrE,wEAAwE;IACxE,6EAA6E;IAC7E,mBAAmB;IACnB,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CACjD;IACD,yGAAyG;IACzG,4CAA4C;IAC5C,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,eAAe,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;CAClH,CAAA;AAED,mCAAmC;AACnC,oDAAoD;AACpD,iGAAiG;AACjG,gCAAgC"}
+{"version":3,"file":"modules.js","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AACA,OAAO,EACL,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,sBAAsB,EAAE,qBAAqB,EAC9F,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,UAAU,EAClG,iBAAiB,EAAE,uBAAuB,EAAE,kBAAkB,EAC/D,MAAM,gBAAgB,CAAA;AACvB,8CAA8C;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AACtE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC/E,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAE/D,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAChH,UAAU,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACzH,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC/F,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzD,UAAU,CAAC,KAAK,CAAC,cAAc,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,UAAU,CAAC,KAAK,CAAC,sBAAsB,EAAE,GAAG,EAAE,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9E,UAAU,CAAC,KAAK,CAAC,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;IAC3E,8GAA8G;IAC9G,UAAU,CAAC,KAAK,CAAC,kBAAkB,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtD,gHAAgH;IAChH,2FAA2F;IAC3F,UAAU,CACR,KAAK,CAAC,UAAU,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IACrE,wEAAwE;IACxE,6EAA6E;IAC7E,mBAAmB;IACnB,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CACjD;IACD,wGAAwG;IACxG,4CAA4C;IAC5C,UAAU,CAAC,KAAK,CAAC,iBAAiB,EAAE,eAAe,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;CACtH,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAClF,UAAU,CAAC,KAAK,CACd,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,eAAe,EAC3C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAChD,CAAC;IACF,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC5E,UAAU,CAAC,KAAK,CACd,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAClC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAC7C,CAAC;CACH,CAAA;AAED,mCAAmC;AACnC,oDAAoD;AACpD,iGAAiG;AACjG,gCAAgC"}

package/build/types.d.ts

@@ -1,6 +1,6 @@
 import type { Auth, AuthToken, PermissionSet, Profile } from '@owlmeans/auth';
 import type { ConfigRecord, InitializedService } from '@owlmeans/context';
-import type { AbstractRequest, GuardService } from '@owlmeans/module';
+import type { AbstractRequest, GuardService } from '@owlmeans/entrypoint';
 import type { Resource, ResourceRecord } from '@owlmeans/resource';
 export interface AuthRequest extends AbstractRequest {
     query: AuthToken;
@@ -25,4 +25,10 @@ export interface AuthorizationService extends InitializedService {
 export interface TrustedRecord extends ConfigRecord, Partial<Omit<Profile, "permissions" | "attributes">> {
     id: string;
 }
+export interface ProfileToEntityIdRequest {
+    profileId: string;
+}
+export interface ProfileToEntityIdResponse {
+    entityId: string;
+}
 //# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAC7E,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAElE,MAAM,WAAW,WAAY,SAAQ,eAAe;IAClD,KAAK,EAAE,SAAS,CAAA;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,WAAY,SAAQ,YAAY;IAC/C,IAAI,CAAC,EAAE,IAAI,CAAA;IACX;;OAEG;IACH,YAAY,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACjD,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACpD,IAAI,EAAE,MAAM,IAAI,CAAA;IAEhB,KAAK,EAAE,CAAC,CAAC,SAAS,cAAc,GAAG,cAAc,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAA;CACpE;AAED,MAAM,WAAW,oBAAqB,SAAQ,kBAAkB;IAC9D,SAAS,EAAE,CACT,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,aAAa,GAAG,aAAa,EAAE,EAChE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACjC,GAAG,CAAC,EAAE,OAAO,KACV,OAAO,CAAC,OAAO,CAAC,CAAA;IAErB,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAA;CACjF;AAED,MAAM,WAAW,aAAc,SAAQ,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,GAAG,YAAY,CAAC,CAAC;IACvG,EAAE,EAAE,MAAM,CAAA;CACX"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAC7E,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAElE,MAAM,WAAW,WAAY,SAAQ,eAAe;IAClD,KAAK,EAAE,SAAS,CAAA;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,WAAY,SAAQ,YAAY;IAC/C,IAAI,CAAC,EAAE,IAAI,CAAA;IACX;;OAEG;IACH,YAAY,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACjD,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACpD,IAAI,EAAE,MAAM,IAAI,CAAA;IAEhB,KAAK,EAAE,CAAC,CAAC,SAAS,cAAc,GAAG,cAAc,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAA;CACpE;AAED,MAAM,WAAW,oBAAqB,SAAQ,kBAAkB;IAC9D,SAAS,EAAE,CACT,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,aAAa,GAAG,aAAa,EAAE,EAChE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACjC,GAAG,CAAC,EAAE,OAAO,KACV,OAAO,CAAC,OAAO,CAAC,CAAA;IAErB,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAA;CACjF;AAED,MAAM,WAAW,aAAc,SAAQ,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,GAAG,YAAY,CAAC,CAAC;IACvG,EAAE,EAAE,MAAM,CAAA;CACX;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAA;CACjB"}

package/build/utils/header.d.ts

@@ -1,3 +1,3 @@
-import type { AbstractRequest } from '@owlmeans/module';
+import type { AbstractRequest } from '@owlmeans/entrypoint';
 export declare const extractAuthToken: (req: Partial<AbstractRequest>, type?: string | null, onlyValue?: boolean) => string | null;
 //# sourceMappingURL=header.d.ts.map

package/build/utils/header.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"header.d.ts","sourceRoot":"","sources":["../../src/utils/header.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAEvD,eAAO,MAAM,gBAAgB,GAC3B,KAAK,OAAO,CAAC,eAAe,CAAC,EAC7B,OAAM,MAAM,GAAG,IAA0C,EACzD,YAAW,OAAc,KACxB,MAAM,GAAG,IAgBX,CAAA"}
+{"version":3,"file":"header.d.ts","sourceRoot":"","sources":["../../src/utils/header.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAE3D,eAAO,MAAM,gBAAgB,GAC3B,KAAK,OAAO,CAAC,eAAe,CAAC,EAC7B,OAAM,MAAM,GAAG,IAA0C,EACzD,YAAW,OAAc,KACxB,MAAM,GAAG,IAgBX,CAAA"}

package/package.json

@@ -1,11 +1,13 @@
 {
   "name": "@owlmeans/auth-common",
-  "version": "0.1.1",
+  "version": "0.1.3",
+  "license": "MIT",
   "type": "module",
   "scripts": {
     "build": "tsc -b",
     "dev": "sleep 30 && nodemon -e ts,tsx,json --watch src --exec \"tsc -p ./tsconfig.json\"",
-    "watch": "tsc -b -w --preserveWatchOutput --pretty"
+    "watch": "tsc -b -w --preserveWatchOutput --pretty",
+    "test": "bun test ./tests"
   },
   "main": "build/index.js",
   "module": "build/index.js",
@@ -27,20 +29,23 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.1",
-    "@owlmeans/auth-common": "^0.1.1",
-    "@owlmeans/basic-ids": "^0.1.1",
-    "@owlmeans/basic-keys": "^0.1.1",
-    "@owlmeans/client-module": "^0.1.1",
-    "@owlmeans/context": "^0.1.1",
-    "@owlmeans/module": "^0.1.1",
-    "@owlmeans/resource": "^0.1.1",
-    "@owlmeans/route": "^0.1.1"
+    "@owlmeans/auth": "^0.1.3",
+    "@owlmeans/auth-common": "^0.1.3",
+    "@owlmeans/basic-ids": "^0.1.3",
+    "@owlmeans/basic-keys": "^0.1.3",
+    "@owlmeans/client-entrypoint": "^0.1.3",
+    "@owlmeans/context": "^0.1.3",
+    "@owlmeans/entrypoint": "^0.1.3",
+    "@owlmeans/resource": "^0.1.3",
+    "@owlmeans/route": "^0.1.3"
   },
   "devDependencies": {
+    "@owlmeans/dep-config": "workspace:*",
+    "@owlmeans/test-auth": "^0.1.2",
+    "@types/bun": "^1.3.0",
     "nodemon": "^3.1.11",
     "npm-check": "^6.0.1",
-    "typescript": "^5.8.3"
+    "typescript": "^6.0.2"
   },
   "publishConfig": {
     "access": "public"

package/src/consts.ts

@@ -14,3 +14,25 @@ export const DEFAULT_GUARD = DEF_AUTH_SRV
 
 export const TOKEN_UPDATE = 'auth-token-refresh'
 
+export const WEB_API = 'web-auth-api'
+
+export const authApi = {
+  profile: {
+    base: 'api:profile',
+    toEntityId: 'api:profile:to-entity-id',
+  },
+  entity: {
+    base: 'api:entity',
+    get: 'api:entity:get',
+    profile: {
+      base: 'api:entity:profile',
+      list: 'api:entity:profile:list',
+      link: 'api:entity:profile:link',
+    }
+  },
+  auth: {
+    base: 'api:auth',
+    delegate: 'api:auth:delegate',
+  },
+}
+

package/src/guards/basic-ed25519/service.ts

@@ -1,5 +1,5 @@
 import { createService } from '@owlmeans/context'
-import type { AbstractRequest, AbstractResponse } from '@owlmeans/module'
+import type { AbstractRequest, AbstractResponse } from '@owlmeans/entrypoint'
 import { assertContext } from '@owlmeans/context'
 import {
   BED255_NONCE_HEADER, BED255_TIME_HEADER, BED255_CASHE_RESOURCE, GUARD_ED25519,

package/src/guards/basic-ed25519/types.ts

@@ -1,4 +1,4 @@
-import type { GuardService } from '@owlmeans/module'
+import type { GuardService } from '@owlmeans/entrypoint'
 
 export interface BasicEd25519Guard extends GuardService {
 }

package/src/middleware.ts

@@ -1,15 +1,15 @@
 import type { Middleware } from '@owlmeans/context'
 import { MiddlewareType, MiddlewareStage, AppType } from '@owlmeans/context'
-import { provideRequest } from '@owlmeans/client-module'
-import type { ClientModule } from '@owlmeans/client-module'
+import { provideRequest } from '@owlmeans/client-entrypoint'
+import type { ClientEntrypoint } from '@owlmeans/client-entrypoint'
 import { AUTH_HEADER } from '@owlmeans/auth'
-import type { AbstractRequest, GuardService } from '@owlmeans/module'
+import type { AbstractRequest, GuardService } from '@owlmeans/entrypoint'
 
 export const authMiddleware: Middleware = {
   type: MiddlewareType.Context,
   stage: MiddlewareStage.Loading,
   apply: async context => {
-    context.modules<Perked>().forEach(module => {
+    context.entrypoints<Perked>().forEach(module => {
       if (module.route.route.type === AppType.Backend && module.call != null) {
         const guards = module.getGuards()
         if (guards.length > 0) {
@@ -38,13 +38,13 @@ export const authMiddleware: Middleware = {
 
             return call(req, res)
           }
-          
+
         }
       }
     })
   }
 }
 
-interface Perked extends ClientModule<unknown> {
+interface Perked extends ClientEntrypoint<unknown> {
   _auth_common_middleware_applied?: boolean
 }

package/src/modules.ts

@@ -5,33 +5,46 @@ import {
   DISPATCHER_AUTHEN, OptionalAuthTokenSchema, CAUTHEN_FLOW_ENTER
 } from '@owlmeans/auth'
 // import { AppType } from '@owlmeans/context'
-import { body, filter, module, query } from '@owlmeans/module'
+import { body, filter, entrypoint, query } from '@owlmeans/entrypoint'
 import { route, RouteMethod, frontend, backend, socket } from '@owlmeans/route'
-import { DISPATCHER_PATH } from './consts.js'
+import { DISPATCHER_PATH, WEB_API, authApi } from './consts.js'
 
 export const modules = [
-  module(route(AUTHEN, '/authentication', backend())),
-  module(route(AUTHEN_INIT, '/init', backend(AUTHEN, RouteMethod.POST)), filter(body(AllowanceRequestSchema))),
-  module(route(AUTHEN_AUTHEN, '/authenticate', backend(AUTHEN, RouteMethod.POST)), filter(body(AuthCredentialsSchema))),
-  module(route(AUTHEN_RELY, '/rely', socket(AUTHEN)), filter(query(OptionalAuthTokenSchema))),
-  module(route(CAUTHEN, '/authentication', frontend())),
-  module(route(CAUTHEN_AUTHEN, '/login', frontend(CAUTHEN))),
-  module(route(CAUTHEN_AUTHEN_DEFAULT, '/', frontend(CAUTHEN_AUTHEN, true))),
-  module(route(CAUTHEN_AUTHEN_TYPED, '/:type', frontend(CAUTHEN_AUTHEN))),
+  entrypoint(route(AUTHEN, '/authentication', backend())),
+  entrypoint(route(AUTHEN_INIT, '/init', backend(AUTHEN, RouteMethod.POST)), filter(body(AllowanceRequestSchema))),
+  entrypoint(route(AUTHEN_AUTHEN, '/authenticate', backend(AUTHEN, RouteMethod.POST)), filter(body(AuthCredentialsSchema))),
+  entrypoint(route(AUTHEN_RELY, '/rely', socket(AUTHEN)), filter(query(OptionalAuthTokenSchema))),
+  entrypoint(route(CAUTHEN, '/authentication', frontend())),
+  entrypoint(route(CAUTHEN_AUTHEN, '/login', frontend(CAUTHEN))),
+  entrypoint(route(CAUTHEN_AUTHEN_DEFAULT, '/', frontend(CAUTHEN_AUTHEN, true))),
+  entrypoint(route(CAUTHEN_AUTHEN_TYPED, '/:type', frontend(CAUTHEN_AUTHEN))),
   // This is a helper route that is used by service providers to redirect to an external authentication service.
-  module(route(CAUTHEN_FLOW_ENTER, '/', frontend())),
+  entrypoint(route(CAUTHEN_FLOW_ENTER, '/', frontend())),
   // This is a helper route that is useb by service providres to process authentication provisioning via redirect.
   // Also it can be default starting point to be redirected to an external identity provider.
-  module(
+  entrypoint(
     route(DISPATCHER, DISPATCHER_PATH, frontend({ service: DISPATCHER })),
     // This module is sticky - it means it's always attach to client router.
     // It's required here cause every web app needs dispatcher route to authorize
     // rediected users.
     filter(query(AuthTokenSchema), { sticky: true })
   ),
-  // This is a helper route that representes a API endpoint of service provider that wants to authenticate 
+  // This is a helper route that representes a API endpoint of service provider that wants to authenticate
   // a user with OwlMeans server-auth library.
-  module(route(DISPATCHER_AUTHEN, '/authenticate', backend(null, RouteMethod.POST)), filter(body(AuthTokenSchema))),
+  entrypoint(route(DISPATCHER_AUTHEN, '/authenticate', backend(null, RouteMethod.POST)), filter(body(AuthTokenSchema))),
+]
+
+export const managerModules = [
+  entrypoint(route(authApi.profile.base, '/profile', backend({ service: WEB_API }))),
+  entrypoint(route(
+    authApi.profile.toEntityId, '/to-entity-id',
+    backend(authApi.profile.base, RouteMethod.POST)
+  )),
+  entrypoint(route(authApi.auth.base, '/auth', backend({ service: WEB_API }))),
+  entrypoint(route(
+    authApi.auth.delegate, '/delegate',
+    backend(authApi.auth.base, RouteMethod.POST)
+  )),
 ]
 
 // const skipModules = [DISPATCHER]

package/src/types.ts

@@ -1,6 +1,6 @@
 import type { Auth, AuthToken, PermissionSet, Profile } from '@owlmeans/auth'
 import type { ConfigRecord, InitializedService } from '@owlmeans/context'
-import type { AbstractRequest, GuardService } from '@owlmeans/module'
+import type { AbstractRequest, GuardService } from '@owlmeans/entrypoint'
 import type { Resource, ResourceRecord } from '@owlmeans/resource'
 
 export interface AuthRequest extends AbstractRequest {
@@ -36,3 +36,11 @@ export interface AuthorizationService extends InitializedService {
 export interface TrustedRecord extends ConfigRecord, Partial<Omit<Profile, "permissions" | "attributes">> {
   id: string
 }
+
+export interface ProfileToEntityIdRequest {
+  profileId: string
+}
+
+export interface ProfileToEntityIdResponse {
+  entityId: string
+}

package/src/utils/header.ts

@@ -1,5 +1,5 @@
 import { AUTH_HEADER, AuthroizationType } from '@owlmeans/auth'
-import type { AbstractRequest } from '@owlmeans/module'
+import type { AbstractRequest } from '@owlmeans/entrypoint'
 
 export const extractAuthToken = (
   req: Partial<AbstractRequest>, 

package/tests/context.ts

@@ -0,0 +1,48 @@
+import { AppType, Layer, makeBasicContext } from '@owlmeans/context'
+import type { BasicConfig, BasicContext } from '@owlmeans/context'
+import { makeMemoryTrustedResource, makeFixtureKeyPair } from '@owlmeans/test-auth'
+import type { TrustedRecord } from '@owlmeans/auth-common'
+import type { KeyPairModel } from '@owlmeans/basic-keys'
+
+export const TRUSTED_ALIAS = 'TRUSTED'
+
+export interface TrustFixture {
+  ctx: BasicContext<BasicConfig>
+  authKey: KeyPairModel
+  authRecord: TrustedRecord
+}
+
+/**
+ * Build a real `BasicContext` with an in-memory TRUSTED resource pre-populated
+ * with a single trusted user — mirroring the way viable apps populate
+ * `cfg.trusted` (see /home/igor/projects/owlmeans/viable/sources/backend/src/config.ts:62-109).
+ *
+ * Returns the context, the fixture keypair we used to build the record, and
+ * the record itself so specs can re-use them when asserting `trust()`'s return.
+ */
+export const makeTrustFixture = (
+  options: { withSecret?: boolean, name?: string, seed?: string } = {}
+): TrustFixture => {
+  const seed = options.seed ?? 'auth-common-tests'
+  const name = options.name ?? 'auth-service'
+  const authKey = makeFixtureKeyPair(seed)
+
+  const authRecord: TrustedRecord = {
+    id: authKey.exportAddress(),
+    name,
+    credential: authKey.exportPublic(),
+    ...(options.withSecret === true ? { secret: authKey.export() } : {}),
+    scopes: ['*'],
+  }
+
+  const ctx = makeBasicContext<BasicConfig>({
+    ready: false,
+    service: 'auth-common-tests',
+    layer: Layer.Service,
+    type: AppType.Backend,
+  })
+
+  ctx.registerResource(makeMemoryTrustedResource([authRecord], TRUSTED_ALIAS))
+
+  return { ctx, authKey, authRecord }
+}

package/tests/dispatcher.spec.ts

@@ -0,0 +1,38 @@
+import { describe, expect, test } from 'bun:test'
+import { modules } from '@owlmeans/auth-common'
+import { DISPATCHER, DISPATCHER_AUTHEN } from '@owlmeans/auth'
+import { DISPATCHER_PATH } from '../src/consts.js'
+
+// The DISPATCHER module intentionally declares service: DISPATCHER so that
+// urlCall() produces an absolute URL (pointing to the auth service).
+// The fix for the React Router 404 ("/https:/vib.owl.flat/dispatcher") lives
+// in @owlmeans/client's navigator.navigate() — when the URL is absolute it
+// does a browser redirect (globalThis.location.href) instead of React Router navigate().
+
+describe('@owlmeans/auth-common — DISPATCHER module declaration', () => {
+  const dispatcher = modules.find(m => m.route.route.alias === DISPATCHER)
+
+  test('DISPATCHER module is present in the modules array', () => {
+    expect(dispatcher).toBeDefined()
+  })
+
+  test('DISPATCHER route has an explicit service override (cross-service)', () => {
+    // service: DISPATCHER is intentional — the dispatcher belongs to the auth service.
+    // The navigator in @owlmeans/client handles the resulting absolute URL correctly.
+    expect(dispatcher?.route.route.service).toBe(DISPATCHER)
+  })
+
+  test('DISPATCHER route path is DISPATCHER_PATH (/dispatcher)', () => {
+    expect(dispatcher?.route.route.path).toBe(DISPATCHER_PATH)
+  })
+
+  test('DISPATCHER module is sticky (always registered in every app router)', () => {
+    expect(dispatcher?.sticky).toBe(true)
+  })
+
+  test('DISPATCHER_AUTHEN backend module is distinct', () => {
+    const dispatcherAuthen = modules.find(m => m.route.route.alias === DISPATCHER_AUTHEN)
+    expect(dispatcherAuthen).toBeDefined()
+    expect(dispatcherAuthen?.sticky).toBeFalsy()
+  })
+})

package/tests/header.spec.ts

@@ -0,0 +1,32 @@
+import { describe, expect, test } from 'bun:test'
+import { extractAuthToken } from '@owlmeans/auth-common/utils'
+import { AUTH_HEADER, AuthroizationType } from '@owlmeans/auth'
+import type { AbstractRequest } from '@owlmeans/entrypoint'
+
+const reqWith = (header: string | undefined): Partial<AbstractRequest> => ({
+  headers: header == null ? {} : { [AUTH_HEADER]: header },
+})
+
+describe('@owlmeans/auth-common — extractAuthToken', () => {
+  // The basic-ed25519 guard at packages/auth-common/src/guards/basic-ed25519/service.ts:64
+  // calls extractAuthToken(req, AuthroizationType.Ed25519BasicSignature) inside `match`.
+  // viable/sources/publisher/src/helpers/ws-auth.ts also reads AUTH_HEADER directly.
+  test('returns the value when the header prefix matches the expected type', () => {
+    const req = reqWith(`${AuthroizationType.Ed25519BasicToken.toUpperCase()} abc.def`)
+    expect(extractAuthToken(req, AuthroizationType.Ed25519BasicToken)).toBe('abc.def')
+  })
+
+  test('returns null when the header prefix does not match', () => {
+    const req = reqWith(`${AuthroizationType.Ed25519BasicSignature.toUpperCase()} abc.def`)
+    expect(extractAuthToken(req, AuthroizationType.Ed25519BasicToken)).toBeNull()
+  })
+
+  test('returns null when the Authorization header is absent', () => {
+    expect(extractAuthToken(reqWith(undefined), AuthroizationType.Ed25519BasicToken)).toBeNull()
+  })
+
+  test('with type=null returns the raw value irrespective of prefix', () => {
+    const req = reqWith('CUSTOM-PREFIX raw-value')
+    expect(extractAuthToken(req, null)).toBe('raw-value')
+  })
+})

package/tests/trusted.spec.ts

@@ -0,0 +1,40 @@
+import { describe, expect, test } from 'bun:test'
+import { trust } from '@owlmeans/auth-common/utils'
+import { TRUSTED_ALIAS, makeTrustFixture } from './context.js'
+
+describe('@owlmeans/auth-common — trust() flow', () => {
+  // Mirrors viable/sources/backend/src/config.ts which pushes trusted records
+  // for master-key/auth-service/payment-service/agent — each with a `name`
+  // field that downstream `trust(context, resource, userName)` calls look up.
+  test('loads a record by name and returns a verifying key model', async () => {
+    const { ctx, authKey, authRecord } = makeTrustFixture()
+
+    const { user, key } = await trust(ctx, TRUSTED_ALIAS, authRecord.name as string)
+
+    expect(user.id).toBe(authRecord.id as string)
+    const sig = await authKey.sign({ a: 1 })
+    expect(await key.verify({ a: 1 }, sig)).toBe(true)
+  })
+
+  test('returns a signing key model when the trusted record has a `secret`', async () => {
+    const { ctx, authRecord } = makeTrustFixture({ withSecret: true })
+
+    const { key } = await trust(ctx, TRUSTED_ALIAS, authRecord.name as string)
+
+    // With secret in the record the model can sign as well as verify —
+    // this is the path used by the auth service itself when issuing tokens.
+    const sig = await key.sign({ a: 1 })
+    expect(await key.verify({ a: 1 }, sig)).toBe(true)
+  })
+
+  test('throws SyntaxError when the trusted user is missing', async () => {
+    const { ctx } = makeTrustFixture()
+
+    let caught: unknown = null
+    try {
+      await trust(ctx, TRUSTED_ALIAS, 'unknown-user')
+    } catch (e) { caught = e }
+
+    expect(caught).toBeInstanceOf(SyntaxError)
+  })
+})

package/tsconfig.json

@@ -1,15 +1,10 @@
 {
   "extends": [
-    "../tsconfig.default.json",
+    "@owlmeans/dep-config/tsconfig.base.json"
   ],
   "compilerOptions": {
-    "rootDir": "./src/", /* Specify the root folder within your source files. */
-    "outDir": "./build/", /* Specify an output folder for all emitted files. */
-    "moduleResolution": "Bundler"
+    "rootDir": "./src/",
+    "outDir": "./build/"
   },
-  "exclude": [
-    "./dist/**/*",
-    "./build/**/*",
-    "./*.ts"
-  ]
-}
+  "exclude": ["./dist/**/*", "./build/**/*", "./tests/**/*", "./*.ts"]
+}