@owlmeans/auth-common 0.1.18-rc.2 → 0.1.18-rc.21

package/build/helper.d.ts

@@ -0,0 +1 @@
+//# sourceMappingURL=helper.d.ts.map

package/build/helper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":""}

package/build/helper.js

@@ -0,0 +1,2 @@
+"use strict";
+//# sourceMappingURL=helper.js.map

package/build/helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":""}

package/build/index.d.ts

@@ -1,6 +1,8 @@
 export type * from './types.js';
-export * from './modules.js';
+export * from './schemas.js';
+export * from './entrypoints.js';
 export * from './consts.js';
+export * from './entity.js';
 export * from './middleware.js';
 export * from './guards/index.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAE/B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,mBAAmB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAE/B,cAAc,cAAc,CAAA;AAC5B,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,mBAAmB,CAAA"}

package/build/index.js

@@ -1,5 +1,7 @@
-export * from './modules.js';
+export * from './schemas.js';
+export * from './entrypoints.js';
 export * from './consts.js';
+export * from './entity.js';
 export * from './middleware.js';
 export * from './guards/index.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,mBAAmB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,cAAc,CAAA;AAC5B,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,mBAAmB,CAAA"}

package/build/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAOnD,eAAO,MAAM,cAAc,EAAE,UAsC5B,CAAA"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAOnD,eAAO,MAAM,cAAc,EAAE,UAuC5B,CAAA"}

package/build/middleware.js

@@ -6,22 +6,23 @@ export const authMiddleware = {
     stage: MiddlewareStage.Loading,
     apply: async (context) => {
         context.entrypoints().forEach(module => {
-            if (module.route.route.type === AppType.Backend && module.call != null) {
-                const guards = module.getGuards();
-                if (guards.length > 0) {
+            if (module.route.route.type === AppType.Backend && module.invoke != null) {
+                if (module.getGuards().length > 0) {
                     if (module._auth_common_middleware_applied === true) {
                         return;
                     }
                     module._auth_common_middleware_applied = true;
-                    // const auth = context.service<GuardService>(service)
-                    const call = module.call;
-                    module.call = async (req, res) => {
+                    // Wrapping `invoke` covers `call` too: `call` reads `invoke` off the entrypoint at the
+                    // moment it runs, so both verbs carry the authentication header.
+                    const invoke = module.invoke;
+                    module.invoke = (async (req) => {
                         // @TODO Actually we may use multiple authentication headers with the same name
                         // As I learnt its not always the case
-                        const [token] = (await Promise.all(guards.map(guard => context.service(guard).authenticated(req)))).filter(token => token != null).reverse();
+                        // Asked per call, not captured: an ancestor may have gained a guard since the
+                        // middleware wrapped this entrypoint.
+                        const [token] = (await Promise.all(module.getGuards().map(guard => context.service(guard).authenticated(req)))).filter(token => token != null).reverse();
                         if (token != null) {
-                            await module.resolve();
-                            const _req = req ?? provideRequest(module.getAlias(), module.getPath());
+                            const _req = req ?? provideRequest(module.alias, module.path());
                             const headers = (_req.headers ?? {});
                             if (headers[AUTH_HEADER] == null) {
                                 headers[AUTH_HEADER] = token;
@@ -29,8 +30,8 @@ export const authMiddleware = {
                                 req = _req;
                             }
                         }
-                        return call(req, res);
-                    };
+                        return invoke(req);
+                    });
                 }
             }
         });

package/build/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAE5D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAG5C,MAAM,CAAC,MAAM,cAAc,GAAe;IACxC,IAAI,EAAE,cAAc,CAAC,OAAO;IAC5B,KAAK,EAAE,eAAe,CAAC,OAAO;IAC9B,KAAK,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;QACrB,OAAO,CAAC,WAAW,EAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;YAC7C,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBACvE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;gBACjC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtB,IAAI,MAAM,CAAC,+BAA+B,KAAK,IAAI,EAAE,CAAC;wBACpD,OAAM;oBACR,CAAC;oBACD,MAAM,CAAC,+BAA+B,GAAG,IAAI,CAAA;oBAC7C,sDAAsD;oBACtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;oBACxB,MAAM,CAAC,IAAI,GAAG,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;wBAC/B,+EAA+E;wBAC/E,sCAAsC;wBACtC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAC3C,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAe,KAAK,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CACjE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAA;wBAC5C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;4BAClB,MAAM,MAAM,CAAC,OAAO,EAAE,CAAA;4BACtB,MAAM,IAAI,GAA6B,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;4BACjG,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAuC,CAAA;4BAC1E,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,IAAI,EAAE,CAAC;gCACjC,OAAO,CAAC,WAAW,CAAC,GAAG,KAAK,CAAA;gCAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;gCACtB,GAAG,GAAG,IAAkB,CAAA;4BAC1B,CAAC;wBACH,CAAC;wBAED,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;oBACvB,CAAC,CAAA;gBAEH,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;CACF,CAAA"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAE5D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAG5C,MAAM,CAAC,MAAM,cAAc,GAAe;IACxC,IAAI,EAAE,cAAc,CAAC,OAAO;IAC5B,KAAK,EAAE,eAAe,CAAC,OAAO;IAC9B,KAAK,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;QACrB,OAAO,CAAC,WAAW,EAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;YAC7C,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBACzE,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAClC,IAAI,MAAM,CAAC,+BAA+B,KAAK,IAAI,EAAE,CAAC;wBACpD,OAAM;oBACR,CAAC;oBACD,MAAM,CAAC,+BAA+B,GAAG,IAAI,CAAA;oBAC7C,uFAAuF;oBACvF,iEAAiE;oBACjE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;oBAC5B,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,EAAC,GAAG,EAAC,EAAE;wBAC3B,+EAA+E;wBAC/E,sCAAsC;wBACtC,8EAA8E;wBAC9E,sCAAsC;wBACtC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,GAAG,CACvD,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAe,KAAK,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CACjE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAA;wBAC5C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;4BAClB,MAAM,IAAI,GAA6B,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;4BACzF,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAuC,CAAA;4BAC1E,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,IAAI,EAAE,CAAC;gCACjC,OAAO,CAAC,WAAW,CAAC,GAAG,KAAK,CAAA;gCAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;gCACtB,GAAG,GAAG,IAAkB,CAAA;4BAC1B,CAAC;wBACH,CAAC;wBAED,OAAO,MAAM,CAAC,GAAG,CAAC,CAAA;oBACpB,CAAC,CAAyB,CAAA;gBAE5B,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;CACF,CAAA"}

package/build/schemas.d.ts

@@ -0,0 +1,16 @@
+import type { JSONSchemaType } from 'ajv';
+/**
+ * What the surrogate login window is told about why it was opened.
+ *
+ * Every field is optional: the window must render something sensible when opened by hand, or by an
+ * older build that knew none of these parameters. `next` carries the address to run once the
+ * window is one level up, so the flow parameters the opener's URL held are forwarded rather than
+ * silently dropped.
+ */
+export interface SurrogateQuery {
+    intent?: string;
+    next?: string;
+    method?: string;
+}
+export declare const SurrogateQuerySchema: JSONSchemaType<SurrogateQuery>;
+//# sourceMappingURL=schemas.d.ts.map

package/build/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,KAAK,CAAA;AAEzC;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,eAAO,MAAM,oBAAoB,EAAE,cAAc,CAAC,cAAc,CAQ/D,CAAA"}

package/build/schemas.js

@@ -0,0 +1,10 @@
+export const SurrogateQuerySchema = {
+    type: 'object',
+    properties: {
+        intent: { type: 'string', maxLength: 32, nullable: true },
+        next: { type: 'string', maxLength: 2048, nullable: true },
+        method: { type: 'string', maxLength: 128, nullable: true },
+    },
+    additionalProperties: true,
+};
+//# sourceMappingURL=schemas.js.map

package/build/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAgBA,MAAM,CAAC,MAAM,oBAAoB,GAAmC;IAClE,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;QACzD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QACzD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC3D;IACD,oBAAoB,EAAE,IAAI;CAC3B,CAAA"}

package/build/types.d.ts

@@ -29,6 +29,57 @@ export interface ProfileToEntityIdRequest {
     profileId: string;
 }
 export interface ProfileToEntityIdResponse {
-    entityId: string;
+    entitySlug: string;
+}
+/**
+ * An organization entity: one immutable id, one renameable slug, and the trail of slugs it used to
+ * answer to.
+ *
+ * `formerSlugs` is what makes a rename survivable rather than merely possible. Tokens minted before
+ * the rename keep arriving until they expire, and third-party systems keep quoting the old value
+ * indefinitely; resolving a former slug to the same entity is how both keep working without anyone
+ * reissuing anything.
+ */
+export interface OrgEntityRef {
+    id: string;
+    slug: string;
+    formerSlugs?: string[];
+    /** Frozen identifier for systems whose names cannot be rewritten. See `ResolvedEntity.iamKey`. */
+    iamKey: string;
+}
+/**
+ * Resolves the renameable slug on a token to the stable entity it names.
+ *
+ * Registered only by implementations that actually store organizations. Basic auth deliberately
+ * does not define what an entity id is — a deployment backed by an external IAM has no such record
+ * and registers nothing, and every consumer must therefore treat an unresolved entity as ordinary
+ * rather than exceptional.
+ */
+export interface EntityResolverService extends InitializedService {
+    /**
+     * Find an entity by any name it has ever answered to: its id, its current slug, a former slug,
+     * or its frozen `iamKey`. Ids win over slugs, so a slug that collides with some other entity's
+     * id can never shadow it.
+     */
+    resolve: (value: string) => Promise<OrgEntityRef | null>;
+    byId: (id: string) => Promise<OrgEntityRef | null>;
+    /** Mint an unused slug. Uniqueness is settled against the store, not by entropy. */
+    mintSlug: () => Promise<string>;
+    /**
+     * Point the entity at a new slug, retiring the old one into `formerSlugs`.
+     *
+     * This is the whole cost of a rename: nothing else in any store is touched, because nothing else
+     * keys on the slug.
+     */
+    rename: (id: string, slug: string) => Promise<OrgEntityRef>;
+    /**
+     * Read — or, on first ask, mint and persist — a name this entity is known by in a system that
+     * cannot be renamed later (a namespace, a bucket prefix, a realm).
+     *
+     * Minting through the entity record rather than deriving the name on demand is what lets the
+     * slug move afterwards: the derivation happens once, the result is what everything addresses,
+     * and a later rename leaves the live resource alone.
+     */
+    mintName: (id: string, key: string, mint: (entity: OrgEntityRef) => string) => Promise<string>;
 }
 //# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAC7E,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAElE,MAAM,WAAW,WAAY,SAAQ,eAAe;IAClD,KAAK,EAAE,SAAS,CAAA;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,WAAY,SAAQ,YAAY;IAC/C,IAAI,CAAC,EAAE,IAAI,CAAA;IACX;;OAEG;IACH,YAAY,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACjD,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACpD,IAAI,EAAE,MAAM,IAAI,CAAA;IAEhB,KAAK,EAAE,CAAC,CAAC,SAAS,cAAc,GAAG,cAAc,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAA;CACpE;AAED,MAAM,WAAW,oBAAqB,SAAQ,kBAAkB;IAC9D,SAAS,EAAE,CACT,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,aAAa,GAAG,aAAa,EAAE,EAChE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACjC,GAAG,CAAC,EAAE,OAAO,KACV,OAAO,CAAC,OAAO,CAAC,CAAA;IAErB,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAA;CACjF;AAED,MAAM,WAAW,aAAc,SAAQ,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,GAAG,YAAY,CAAC,CAAC;IACvG,EAAE,EAAE,MAAM,CAAA;CACX;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAA;CACjB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAC7E,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAElE,MAAM,WAAW,WAAY,SAAQ,eAAe;IAClD,KAAK,EAAE,SAAS,CAAA;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,WAAY,SAAQ,YAAY;IAC/C,IAAI,CAAC,EAAE,IAAI,CAAA;IACX;;OAEG;IACH,YAAY,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACjD,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACpD,IAAI,EAAE,MAAM,IAAI,CAAA;IAEhB,KAAK,EAAE,CAAC,CAAC,SAAS,cAAc,GAAG,cAAc,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAA;CACpE;AAED,MAAM,WAAW,oBAAqB,SAAQ,kBAAkB;IAC9D,SAAS,EAAE,CACT,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,aAAa,GAAG,aAAa,EAAE,EAChE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACjC,GAAG,CAAC,EAAE,OAAO,KACV,OAAO,CAAC,OAAO,CAAC,CAAA;IAErB,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAA;CACjF;AAED,MAAM,WAAW,aAAc,SAAQ,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,GAAG,YAAY,CAAC,CAAC;IACvG,EAAE,EAAE,MAAM,CAAA;CACX;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,kGAAkG;IAClG,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAsB,SAAQ,kBAAkB;IAC/D;;;;OAIG;IACH,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IACxD,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IAClD,oFAAoF;IACpF,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAC/B;;;;;OAKG;IACH,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC3D;;;;;;;OAOG;IACH,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAC/F"}

package/build/utils/trusted.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trusted.d.ts","sourceRoot":"","sources":["../../src/utils/trusted.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAIhD,eAAO,MAAM,KAAK,GAAU,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,MAAM,YAAY,MAAM,UAAS,MAAM;;;EAUhI,CAAA"}
+{"version":3,"file":"trusted.d.ts","sourceRoot":"","sources":["../../src/utils/trusted.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAIhD,eAAO,MAAM,KAAK,GAAU,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,MAAM,YAAY,MAAM,UAAS,MAAM;;;EAWhI,CAAA"}

package/build/utils/trusted.js

@@ -1,6 +1,7 @@
 import { fromPubKey, makeKeyPairModel } from '@owlmeans/basic-keys';
 export const trust = async (context, resource, userName, field = 'name') => {
-    const trustedUser = await context.resource(resource).load(userName, field);
+    const where = { [field]: userName };
+    const trustedUser = await context.resource(resource).load(where);
     if (trustedUser == null) {
         throw new SyntaxError(`Auth service trusted entity is not provided: ${userName}`);
     }

package/build/utils/trusted.js.map

@@ -1 +1 @@
-{"version":3,"file":"trusted.js","sourceRoot":"","sources":["../../src/utils/trusted.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAEnE,MAAM,CAAC,MAAM,KAAK,GAAG,KAAK,EAA0C,OAAU,EAAE,QAAgB,EAAE,QAAgB,EAAE,KAAK,GAAW,MAAM,EAAE,EAAE;IAC5I,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,QAAQ,CAA0B,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IACnG,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,WAAW,CAAC,gDAAgD,QAAQ,EAAE,CAAC,CAAA;IACnF,CAAC;IAED,4EAA4E;IAC5E,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,UAAW,CAAC,CAAA;IAEvH,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;AAC5C,CAAC,CAAA"}
+{"version":3,"file":"trusted.js","sourceRoot":"","sources":["../../src/utils/trusted.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAEnE,MAAM,CAAC,MAAM,KAAK,GAAG,KAAK,EAA0C,OAAU,EAAE,QAAgB,EAAE,QAAgB,EAAE,KAAK,GAAW,MAAM,EAAE,EAAE;IAC5I,MAAM,KAAK,GAA4B,EAAE,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAA;IAC5D,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,QAAQ,CAA0B,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACzF,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,WAAW,CAAC,gDAAgD,QAAQ,EAAE,CAAC,CAAA;IACnF,CAAC;IAED,4EAA4E;IAC5E,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,UAAW,CAAC,CAAA;IAEvH,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;AAC5C,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/auth-common",
-  "version": "0.1.18-rc.2",
+  "version": "0.1.18-rc.21",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -29,20 +29,20 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.2",
-    "@owlmeans/auth-common": "^0.1.18-rc.2",
-    "@owlmeans/basic-ids": "^0.1.18-rc.2",
-    "@owlmeans/basic-keys": "^0.1.18-rc.2",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.2",
-    "@owlmeans/context": "^0.1.18-rc.2",
-    "@owlmeans/entrypoint": "^0.1.18-rc.2",
-    "@owlmeans/resource": "^0.1.18-rc.2",
-    "@owlmeans/route": "^0.1.18-rc.2"
+    "@owlmeans/auth": "^0.1.18-rc.17",
+    "@owlmeans/auth-common": "^0.1.18-rc.21",
+    "@owlmeans/basic-ids": "^0.1.18-rc.17",
+    "@owlmeans/basic-keys": "^0.1.18-rc.20",
+    "@owlmeans/client-entrypoint": "^0.1.18-rc.21",
+    "@owlmeans/context": "^0.1.18-rc.16",
+    "@owlmeans/entrypoint": "^0.1.18-rc.19",
+    "@owlmeans/resource": "^0.1.18-rc.17",
+    "@owlmeans/route": "^0.1.18-rc.17"
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/test-auth": "^0.1.18-rc.2",
-    "@types/bun": "^1.3.14",
+    "@owlmeans/test-auth": "^0.1.18-rc.21",
+    "@types/bun": "^1.4.0",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"
   },

package/src/consts.ts

@@ -8,6 +8,15 @@ export const RELY_ACTION_TIMEOUT = 600
 
 export const DISPATCHER_PATH = '/dispatcher'
 
+/**
+ * Where the surrogate login window runs.
+ *
+ * Reserved exactly like {@link DISPATCHER_PATH}: an application must not declare a route of its
+ * own here, and a code generator must not produce one. It is user-visible — it is what the popup's
+ * address bar shows.
+ */
+export const SURROGATE_PATH = '/surrogate'
+
 export const DEF_AUTH_SRV = 'auth'
 
 export const DEFAULT_GUARD = DEF_AUTH_SRV
@@ -16,6 +25,19 @@ export const TOKEN_UPDATE = 'auth-token-refresh'
 
 export const WEB_API = 'web-auth-api'
 
+/** Service alias of the organization-entity resolver, when an implementation registers one. */
+export const ENTITY_RESOLVER = 'entity-resolver'
+
+/**
+ * What an organization slug may look like: a DNS label, lowercase.
+ *
+ * The constraint is not cosmetic. The same slug is used to compose hostnames, Kubernetes object
+ * names and OIDC client ids, so anything that would need sanitising before it could address one of
+ * those is rejected at the point it is chosen instead — a slug that survives this pattern passes
+ * through every downstream name unchanged.
+ */
+export const ENTITY_SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9-]{1,61}[a-z0-9])?$/
+
 export const authApi = {
   profile: {
     base: 'api:profile',
@@ -36,3 +58,13 @@ export const authApi = {
   },
 }
 
+
+/**
+ * The request header an authenticated call carries, re-exported for the packages that only depend
+ * on this half of the vocabulary.
+ *
+ * One spelling, one home: it is declared by `@owlmeans/auth` and named here so a client-side
+ * package does not have to take a dependency on the whole auth package to recognise its own
+ * bearer on a request it is about to send.
+ */
+export { AUTH_HEADER } from '@owlmeans/auth'

package/src/entity.ts

@@ -0,0 +1,82 @@
+import type { AbstractRequest, ResolvedEntity } from '@owlmeans/entrypoint'
+import type { BasicContext } from '@owlmeans/context'
+import { AuthenFailed, AuthorizationError, entitySlugOf } from '@owlmeans/auth'
+import type { EntityResolverService } from './types.js'
+import { ENTITY_RESOLVER } from './consts.js'
+
+/**
+ * The value a handler should store and query organization-scoped records by.
+ *
+ * Prefers the entity's stable id, which is the whole point of resolving one: records keyed by it
+ * survive a rename untouched. Falls back to the slug on the token for deployments that register no
+ * resolver — there the slug IS the only identifier the system has, and refusing to serve them
+ * would break every installation backed by an external IAM.
+ *
+ * Never use this to compose a user-facing name (a hostname, a display label). Those want the
+ * current slug, `req.entity?.slug`, precisely because it can change.
+ */
+export const entityKeyOf = (req: AbstractRequest): string | undefined =>
+  req.entity?.id ?? entitySlugOf(req.auth)
+
+/**
+ * `entityKeyOf` for handlers that cannot proceed without an organization.
+ *
+ * @throws {AuthorizationError} when the request carries no organization at all.
+ */
+export const requireEntityKey = (req: AbstractRequest): string => {
+  const key = entityKeyOf(req)
+  if (key == null || key === '') {
+    throw new AuthorizationError()
+  }
+
+  return key
+}
+
+/**
+ * The full resolved entity, for handlers that need the slug or the frozen key as well as the id.
+ *
+ * @throws {AuthorizationError} when no resolver is registered or the entity did not resolve.
+ */
+export const requireEntity = (req: AbstractRequest): ResolvedEntity => {
+  if (req.entity == null) {
+    throw new AuthorizationError()
+  }
+
+  return req.entity
+}
+
+/**
+ * Resolve the organization a just-authenticated request acts for, and attach it.
+ *
+ * Called wherever authentication is ESTABLISHED — the HTTP boundary, and any socket that
+ * authenticates on its own once the connection is already open. Both need it for the same reason:
+ * the token names the organization by a slug that can move, while everything downstream keys on
+ * the record. A path that authenticates without calling this leaves `request.entity` empty, and
+ * its handlers quietly fall back to comparing a slug against stored ids — which surfaces as "this
+ * project does not exist" rather than as a missing resolution, and costs an afternoon to find.
+ *
+ * A no-op when no resolver is registered: such a deployment has no organization store, and the
+ * slug is the only identifier it has.
+ *
+ * @throws {AuthenFailed} when the token names an organization that cannot be resolved.
+ */
+export const attachEntity = async (
+  context: BasicContext<any>, request: AbstractRequest
+): Promise<ResolvedEntity | undefined> => {
+  const slug = entitySlugOf(request.auth)
+  if (slug == null || !context.hasService(ENTITY_RESOLVER)) {
+    return undefined
+  }
+
+  const entity = await context.service<EntityResolverService>(ENTITY_RESOLVER).resolve(slug)
+  if (entity == null) {
+    throw new AuthenFailed('entity')
+  }
+
+  // Canonicalize: a request that arrived under a retired slug continues under the current one, so
+  // nothing echoing the value back can re-publish a name the organization has dropped.
+  request.auth!.entitySlug = entity.slug
+  request.entity = entity
+
+  return entity
+}

package/src/entrypoints.ts

@@ -0,0 +1,73 @@
+
+import {
+  AUTHEN, AUTHEN_AUTHEN, AUTHEN_INIT, AUTHEN_RELY, AllowanceRequestSchema, AuthCredentialsSchema,
+  AuthTokenSchema, CAUTHEN, CAUTHEN_AUTHEN, CAUTHEN_AUTHEN_DEFAULT, CAUTHEN_AUTHEN_TYPED, DISPATCHER,
+  DISPATCHER_AUTHEN, DISPATCHER_SURROGATE, OptionalAuthTokenSchema, CAUTHEN_FLOW_ENTER
+} from '@owlmeans/auth'
+import type { AllowanceRequest, AllowanceResponse, AuthCredentials, AuthToken } from '@owlmeans/auth'
+// import { AppType } from '@owlmeans/context'
+import { contract, openProtocol, protocol, typed } from '@owlmeans/entrypoint'
+import { route, RouteMethod, frontend, backend, socket } from '@owlmeans/route'
+import { DISPATCHER_PATH, SURROGATE_PATH, WEB_API, authApi } from './consts.js'
+import { SurrogateQuerySchema } from './schemas.js'
+import type { SurrogateQuery } from './schemas.js'
+
+/** Shared authentication protocols, bound independently by server and browser packages. */
+export const authProtocols = {
+  authen: openProtocol(route(AUTHEN, '/authentication', backend())),
+  init: protocol(route(AUTHEN_INIT, '/init', backend(AUTHEN, RouteMethod.POST)),
+    contract.request({ body: typed<AllowanceRequest>(AllowanceRequestSchema) }, typed<AllowanceResponse>())),
+  authenticate: protocol(route(AUTHEN_AUTHEN, '/authenticate', backend(AUTHEN, RouteMethod.POST)),
+    contract.request({ body: typed<AuthCredentials>(AuthCredentialsSchema) }, typed<AuthToken>())),
+  rely: protocol(route(AUTHEN_RELY, '/rely', socket(AUTHEN)),
+    contract.request({ query: typed<Partial<AuthToken>>(OptionalAuthTokenSchema) }, typed<undefined>())),
+  client: openProtocol(route(CAUTHEN, '/authentication', frontend())),
+  login: openProtocol(route(CAUTHEN_AUTHEN, '/login', frontend(CAUTHEN))),
+  loginDefault: openProtocol(route(CAUTHEN_AUTHEN_DEFAULT, '/', frontend(CAUTHEN_AUTHEN, true))),
+  loginTyped: openProtocol(route(CAUTHEN_AUTHEN_TYPED, '/:type', frontend(CAUTHEN_AUTHEN))),
+  flowEnter: openProtocol(route(CAUTHEN_FLOW_ENTER, '/', frontend())),
+  dispatcher: protocol(
+    route(DISPATCHER, DISPATCHER_PATH, frontend({ service: DISPATCHER })),
+    contract.request({ query: typed<AuthToken>(AuthTokenSchema) }, typed()),
+    { sticky: true },
+  ),
+  // The login window an embedded application opens one level up.
+  //
+  // Top level and with no parent, so it renders outside every application layout — a popup must
+  // never show the application, with its navigation, inside itself. Sticky for the same reason the
+  // dispatcher is: it must attach to the client router regardless of service selection. It carries
+  // no `service`, unlike the dispatcher, because nothing server-side ever addresses it — the
+  // provider's callback goes to the dispatcher. And no guard: it is where a signed-out user lands.
+  surrogate: protocol(
+    route(DISPATCHER_SURROGATE, SURROGATE_PATH, frontend()),
+    contract.request({ query: typed<SurrogateQuery>(SurrogateQuerySchema) }, typed()),
+    { sticky: true },
+  ),
+  // This is a helper route that representes a API endpoint of service provider that wants to authenticate
+  // a user with OwlMeans server-auth library.
+  dispatcherAuthenticate: protocol(route(DISPATCHER_AUTHEN, '/authenticate', backend(null, RouteMethod.POST)),
+    contract.request({ body: typed<AuthToken>(AuthTokenSchema) }, typed<AuthToken>())),
+}
+
+/** Shared manager authentication protocols. */
+export const managerProtocols = {
+  profile: {
+    base: openProtocol(route(authApi.profile.base, '/profile', backend({ service: WEB_API }))),
+    toEntityId: openProtocol(route(
+    authApi.profile.toEntityId, '/to-entity-id',
+    backend(authApi.profile.base, RouteMethod.POST)
+    )),
+  },
+  auth: {
+    base: openProtocol(route(authApi.auth.base, '/auth', backend({ service: WEB_API }))),
+    delegate: openProtocol(route(
+    authApi.auth.delegate, '/delegate',
+    backend(authApi.auth.base, RouteMethod.POST)
+    )),
+  },
+}
+
+// const skipEntrypoints = [DISPATCHER]
+// export const authBackendEntrypoints = entrypoints.filter(
+//   module => !skipEntrypoints.includes(module.alias) && module.route.route.type === AppType.Backend
+// ).map(module => module.alias)

package/src/guards/basic-ed25519/service.ts

@@ -120,7 +120,7 @@ export const makeBasicEd25519Guard = (resource: string, opts?: BasicEd25519Guard
         token: authorization,
         userId: trusted.user.id,
         profileId: trusted.user.id,
-        entityId: trusted.user.entityId,
+        entitySlug: trusted.user.entitySlug,
         scopes: trusted.user.name != null ? [trusted.user.name] : [],
         type: AuthroizationType.Ed25519BasicSignature,
         source: context.cfg.service,

package/src/index.ts

@@ -1,6 +1,8 @@
 export type * from './types.js'
 
-export * from './modules.js'
+export * from './schemas.js'
+export * from './entrypoints.js'
 export * from './consts.js'
+export * from './entity.js'
 export * from './middleware.js'
 export * from './guards/index.js'

package/src/middleware.ts

@@ -10,24 +10,25 @@ export const authMiddleware: Middleware = {
   stage: MiddlewareStage.Loading,
   apply: async context => {
     context.entrypoints<Perked>().forEach(module => {
-      if (module.route.route.type === AppType.Backend && module.call != null) {
-        const guards = module.getGuards()
-        if (guards.length > 0) {
+      if (module.route.route.type === AppType.Backend && module.invoke != null) {
+        if (module.getGuards().length > 0) {
           if (module._auth_common_middleware_applied === true) {
             return
           }
           module._auth_common_middleware_applied = true
-          // const auth = context.service<GuardService>(service)
-          const call = module.call
-          module.call = async (req, res) => {
+          // Wrapping `invoke` covers `call` too: `call` reads `invoke` off the entrypoint at the
+          // moment it runs, so both verbs carry the authentication header.
+          const invoke = module.invoke
+          module.invoke = (async req => {
             // @TODO Actually we may use multiple authentication headers with the same name
             // As I learnt its not always the case
-            const [token] = (await Promise.all(guards.map(
+            // Asked per call, not captured: an ancestor may have gained a guard since the
+            // middleware wrapped this entrypoint.
+            const [token] = (await Promise.all(module.getGuards().map(
               guard => context.service<GuardService>(guard).authenticated(req)
             ))).filter(token => token != null).reverse()
             if (token != null) {
-              await module.resolve()
-              const _req: Partial<AbstractRequest> = req ?? provideRequest(module.getAlias(), module.getPath())
+              const _req: Partial<AbstractRequest> = req ?? provideRequest(module.alias, module.path())
               const headers = (_req.headers ?? {}) as Record<string, string | undefined>
               if (headers[AUTH_HEADER] == null) {
                 headers[AUTH_HEADER] = token
@@ -36,8 +37,8 @@ export const authMiddleware: Middleware = {
               }
             }
 
-            return call(req, res)
-          }
+            return invoke(req)
+          }) as typeof module.invoke
 
         }
       }

package/src/schemas.ts

@@ -0,0 +1,25 @@
+import type { JSONSchemaType } from 'ajv'
+
+/**
+ * What the surrogate login window is told about why it was opened.
+ *
+ * Every field is optional: the window must render something sensible when opened by hand, or by an
+ * older build that knew none of these parameters. `next` carries the address to run once the
+ * window is one level up, so the flow parameters the opener's URL held are forwarded rather than
+ * silently dropped.
+ */
+export interface SurrogateQuery {
+  intent?: string
+  next?: string
+  method?: string
+}
+
+export const SurrogateQuerySchema: JSONSchemaType<SurrogateQuery> = {
+  type: 'object',
+  properties: {
+    intent: { type: 'string', maxLength: 32, nullable: true },
+    next: { type: 'string', maxLength: 2048, nullable: true },
+    method: { type: 'string', maxLength: 128, nullable: true },
+  },
+  additionalProperties: true,
+}