@owlmeans/auth-common 0.1.18-rc.2 → 0.1.18-rc.21

package/src/types.ts

@@ -42,5 +42,58 @@ export interface ProfileToEntityIdRequest {
 }
 
 export interface ProfileToEntityIdResponse {
-  entityId: string
+  entitySlug: string
+}
+
+/**
+ * An organization entity: one immutable id, one renameable slug, and the trail of slugs it used to
+ * answer to.
+ *
+ * `formerSlugs` is what makes a rename survivable rather than merely possible. Tokens minted before
+ * the rename keep arriving until they expire, and third-party systems keep quoting the old value
+ * indefinitely; resolving a former slug to the same entity is how both keep working without anyone
+ * reissuing anything.
+ */
+export interface OrgEntityRef {
+  id: string
+  slug: string
+  formerSlugs?: string[]
+  /** Frozen identifier for systems whose names cannot be rewritten. See `ResolvedEntity.iamKey`. */
+  iamKey: string
+}
+
+/**
+ * Resolves the renameable slug on a token to the stable entity it names.
+ *
+ * Registered only by implementations that actually store organizations. Basic auth deliberately
+ * does not define what an entity id is — a deployment backed by an external IAM has no such record
+ * and registers nothing, and every consumer must therefore treat an unresolved entity as ordinary
+ * rather than exceptional.
+ */
+export interface EntityResolverService extends InitializedService {
+  /**
+   * Find an entity by any name it has ever answered to: its id, its current slug, a former slug,
+   * or its frozen `iamKey`. Ids win over slugs, so a slug that collides with some other entity's
+   * id can never shadow it.
+   */
+  resolve: (value: string) => Promise<OrgEntityRef | null>
+  byId: (id: string) => Promise<OrgEntityRef | null>
+  /** Mint an unused slug. Uniqueness is settled against the store, not by entropy. */
+  mintSlug: () => Promise<string>
+  /**
+   * Point the entity at a new slug, retiring the old one into `formerSlugs`.
+   *
+   * This is the whole cost of a rename: nothing else in any store is touched, because nothing else
+   * keys on the slug.
+   */
+  rename: (id: string, slug: string) => Promise<OrgEntityRef>
+  /**
+   * Read — or, on first ask, mint and persist — a name this entity is known by in a system that
+   * cannot be renamed later (a namespace, a bucket prefix, a realm).
+   *
+   * Minting through the entity record rather than deriving the name on demand is what lets the
+   * slug move afterwards: the derivation happens once, the result is what everything addresses,
+   * and a later rename leaves the live resource alone.
+   */
+  mintName: (id: string, key: string, mint: (entity: OrgEntityRef) => string) => Promise<string>
 }

package/src/utils/trusted.ts

@@ -1,11 +1,12 @@
 
 import type { Context, Config } from './types.js'
 import type { TrustedRecord } from '../types.js'
-import type { Resource } from '@owlmeans/resource'
+import type { Criteria, Resource } from '@owlmeans/resource'
 import { fromPubKey, makeKeyPairModel } from '@owlmeans/basic-keys'
 
 export const trust = async <C extends Config, T extends Context<C>>(context: T, resource: string, userName: string, field: string = 'name') => {
-  const trustedUser = await context.resource<Resource<TrustedRecord>>(resource).load(userName, field)
+  const where: Criteria<TrustedRecord> = { [field]: userName }
+  const trustedUser = await context.resource<Resource<TrustedRecord>>(resource).load(where)
   if (trustedUser == null) {
     throw new SyntaxError(`Auth service trusted entity is not provided: ${userName}`)
   }

package/tests/context.ts

@@ -1,4 +1,4 @@
-import { AppType, Layer, makeBasicContext } from '@owlmeans/context'
+import { AppType, makeBasicContext } from '@owlmeans/context'
 import type { BasicConfig, BasicContext } from '@owlmeans/context'
 import { makeMemoryTrustedResource, makeFixtureKeyPair } from '@owlmeans/test-auth'
 import type { TrustedRecord } from '@owlmeans/auth-common'
@@ -38,7 +38,6 @@ export const makeTrustFixture = (
   const ctx = makeBasicContext<BasicConfig>({
     ready: false,
     service: 'auth-common-tests',
-    layer: Layer.Service,
     type: AppType.Backend,
   })
 

package/tests/dispatcher.spec.ts

@@ -1,38 +1,38 @@
 import { describe, expect, test } from 'bun:test'
-import { modules } from '@owlmeans/auth-common'
+import { authProtocols } from '@owlmeans/auth-common'
 import { DISPATCHER, DISPATCHER_AUTHEN } from '@owlmeans/auth'
 import { DISPATCHER_PATH } from '../src/consts.js'
 
-// The DISPATCHER module intentionally declares service: DISPATCHER so that
-// urlCall() produces an absolute URL (pointing to the auth service).
+// The DISPATCHER entrypoint intentionally declares service: DISPATCHER so that
+// url() produces an absolute URL (pointing to the auth service).
 // The fix for the React Router 404 ("/https:/vib.owl.flat/dispatcher") lives
 // in @owlmeans/client's navigator.navigate() — when the URL is absolute it
 // does a browser redirect (globalThis.location.href) instead of React Router navigate().
 
-describe('@owlmeans/auth-common — DISPATCHER module declaration', () => {
-  const dispatcher = modules.find(m => m.route.route.alias === DISPATCHER)
+describe('@owlmeans/auth-common — DISPATCHER protocol declaration', () => {
+  const dispatcher = authProtocols.dispatcher
 
-  test('DISPATCHER module is present in the modules array', () => {
-    expect(dispatcher).toBeDefined()
+  test('DISPATCHER protocol is present in the authentication tree', () => {
+    expect(dispatcher.alias).toBe(DISPATCHER)
   })
 
   test('DISPATCHER route has an explicit service override (cross-service)', () => {
     // service: DISPATCHER is intentional — the dispatcher belongs to the auth service.
     // The navigator in @owlmeans/client handles the resulting absolute URL correctly.
-    expect(dispatcher?.route.route.service).toBe(DISPATCHER)
+    expect(dispatcher.route.route.service).toBe(DISPATCHER)
   })
 
   test('DISPATCHER route path is DISPATCHER_PATH (/dispatcher)', () => {
-    expect(dispatcher?.route.route.path).toBe(DISPATCHER_PATH)
+    expect(dispatcher.route.route.path).toBe(DISPATCHER_PATH)
   })
 
-  test('DISPATCHER module is sticky (always registered in every app router)', () => {
-    expect(dispatcher?.sticky).toBe(true)
+  test('DISPATCHER entrypoint is sticky (always registered in every app router)', () => {
+    expect(dispatcher.sticky).toBe(true)
   })
 
-  test('DISPATCHER_AUTHEN backend module is distinct', () => {
-    const dispatcherAuthen = modules.find(m => m.route.route.alias === DISPATCHER_AUTHEN)
-    expect(dispatcherAuthen).toBeDefined()
-    expect(dispatcherAuthen?.sticky).toBeFalsy()
+  test('DISPATCHER_AUTHEN backend entrypoint is distinct', () => {
+    const dispatcherAuthen = authProtocols.dispatcherAuthenticate
+    expect(dispatcherAuthen.alias).toBe(DISPATCHER_AUTHEN)
+    expect(dispatcherAuthen.sticky).toBeFalsy()
   })
 })

package/build/modules.d.ts

@@ -1,3 +0,0 @@
-export declare const modules: import("@owlmeans/entrypoint").CommonEntrypoint[];
-export declare const managerModules: import("@owlmeans/entrypoint").CommonEntrypoint[];
-//# sourceMappingURL=modules.d.ts.map

package/build/modules.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,OAAO,mDAuBnB,CAAA;AAED,eAAO,MAAM,cAAc,mDAW1B,CAAA"}

package/build/modules.js

@@ -1,38 +0,0 @@
-import { AUTHEN, AUTHEN_AUTHEN, AUTHEN_INIT, AUTHEN_RELY, AllowanceRequestSchema, AuthCredentialsSchema, AuthTokenSchema, CAUTHEN, CAUTHEN_AUTHEN, CAUTHEN_AUTHEN_DEFAULT, CAUTHEN_AUTHEN_TYPED, DISPATCHER, DISPATCHER_AUTHEN, OptionalAuthTokenSchema, CAUTHEN_FLOW_ENTER } from '@owlmeans/auth';
-// import { AppType } from '@owlmeans/context'
-import { body, filter, entrypoint, query } from '@owlmeans/entrypoint';
-import { route, RouteMethod, frontend, backend, socket } from '@owlmeans/route';
-import { DISPATCHER_PATH, WEB_API, authApi } from './consts.js';
-export const modules = [
-    entrypoint(route(AUTHEN, '/authentication', backend())),
-    entrypoint(route(AUTHEN_INIT, '/init', backend(AUTHEN, RouteMethod.POST)), filter(body(AllowanceRequestSchema))),
-    entrypoint(route(AUTHEN_AUTHEN, '/authenticate', backend(AUTHEN, RouteMethod.POST)), filter(body(AuthCredentialsSchema))),
-    entrypoint(route(AUTHEN_RELY, '/rely', socket(AUTHEN)), filter(query(OptionalAuthTokenSchema))),
-    entrypoint(route(CAUTHEN, '/authentication', frontend())),
-    entrypoint(route(CAUTHEN_AUTHEN, '/login', frontend(CAUTHEN))),
-    entrypoint(route(CAUTHEN_AUTHEN_DEFAULT, '/', frontend(CAUTHEN_AUTHEN, true))),
-    entrypoint(route(CAUTHEN_AUTHEN_TYPED, '/:type', frontend(CAUTHEN_AUTHEN))),
-    // This is a helper route that is used by service providers to redirect to an external authentication service.
-    entrypoint(route(CAUTHEN_FLOW_ENTER, '/', frontend())),
-    // This is a helper route that is useb by service providres to process authentication provisioning via redirect.
-    // Also it can be default starting point to be redirected to an external identity provider.
-    entrypoint(route(DISPATCHER, DISPATCHER_PATH, frontend({ service: DISPATCHER })), 
-    // This module is sticky - it means it's always attach to client router.
-    // It's required here cause every web app needs dispatcher route to authorize
-    // rediected users.
-    filter(query(AuthTokenSchema), { sticky: true })),
-    // This is a helper route that representes a API endpoint of service provider that wants to authenticate
-    // a user with OwlMeans server-auth library.
-    entrypoint(route(DISPATCHER_AUTHEN, '/authenticate', backend(null, RouteMethod.POST)), filter(body(AuthTokenSchema))),
-];
-export const managerModules = [
-    entrypoint(route(authApi.profile.base, '/profile', backend({ service: WEB_API }))),
-    entrypoint(route(authApi.profile.toEntityId, '/to-entity-id', backend(authApi.profile.base, RouteMethod.POST))),
-    entrypoint(route(authApi.auth.base, '/auth', backend({ service: WEB_API }))),
-    entrypoint(route(authApi.auth.delegate, '/delegate', backend(authApi.auth.base, RouteMethod.POST))),
-];
-// const skipModules = [DISPATCHER]
-// export const authBackendModules = modules.filter(
-//   module => !skipModules.includes(module.alias) && module.route.route.type === AppType.Backend
-// ).map(module => module.alias)
-//# sourceMappingURL=modules.js.map

package/build/modules.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"modules.js","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AACA,OAAO,EACL,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,sBAAsB,EAAE,qBAAqB,EAC9F,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,UAAU,EAClG,iBAAiB,EAAE,uBAAuB,EAAE,kBAAkB,EAC/D,MAAM,gBAAgB,CAAA;AACvB,8CAA8C;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AACtE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC/E,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAE/D,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAChH,UAAU,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACzH,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC/F,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzD,UAAU,CAAC,KAAK,CAAC,cAAc,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,UAAU,CAAC,KAAK,CAAC,sBAAsB,EAAE,GAAG,EAAE,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9E,UAAU,CAAC,KAAK,CAAC,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;IAC3E,8GAA8G;IAC9G,UAAU,CAAC,KAAK,CAAC,kBAAkB,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtD,gHAAgH;IAChH,2FAA2F;IAC3F,UAAU,CACR,KAAK,CAAC,UAAU,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IACrE,wEAAwE;IACxE,6EAA6E;IAC7E,mBAAmB;IACnB,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CACjD;IACD,wGAAwG;IACxG,4CAA4C;IAC5C,UAAU,CAAC,KAAK,CAAC,iBAAiB,EAAE,eAAe,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;CACtH,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAClF,UAAU,CAAC,KAAK,CACd,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,eAAe,EAC3C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAChD,CAAC;IACF,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC5E,UAAU,CAAC,KAAK,CACd,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAClC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAC7C,CAAC;CACH,CAAA;AAED,mCAAmC;AACnC,oDAAoD;AACpD,iGAAiG;AACjG,gCAAgC"}

package/src/modules.ts

@@ -1,53 +0,0 @@
-
-import {
-  AUTHEN, AUTHEN_AUTHEN, AUTHEN_INIT, AUTHEN_RELY, AllowanceRequestSchema, AuthCredentialsSchema,
-  AuthTokenSchema, CAUTHEN, CAUTHEN_AUTHEN, CAUTHEN_AUTHEN_DEFAULT, CAUTHEN_AUTHEN_TYPED, DISPATCHER,
-  DISPATCHER_AUTHEN, OptionalAuthTokenSchema, CAUTHEN_FLOW_ENTER
-} from '@owlmeans/auth'
-// import { AppType } from '@owlmeans/context'
-import { body, filter, entrypoint, query } from '@owlmeans/entrypoint'
-import { route, RouteMethod, frontend, backend, socket } from '@owlmeans/route'
-import { DISPATCHER_PATH, WEB_API, authApi } from './consts.js'
-
-export const modules = [
-  entrypoint(route(AUTHEN, '/authentication', backend())),
-  entrypoint(route(AUTHEN_INIT, '/init', backend(AUTHEN, RouteMethod.POST)), filter(body(AllowanceRequestSchema))),
-  entrypoint(route(AUTHEN_AUTHEN, '/authenticate', backend(AUTHEN, RouteMethod.POST)), filter(body(AuthCredentialsSchema))),
-  entrypoint(route(AUTHEN_RELY, '/rely', socket(AUTHEN)), filter(query(OptionalAuthTokenSchema))),
-  entrypoint(route(CAUTHEN, '/authentication', frontend())),
-  entrypoint(route(CAUTHEN_AUTHEN, '/login', frontend(CAUTHEN))),
-  entrypoint(route(CAUTHEN_AUTHEN_DEFAULT, '/', frontend(CAUTHEN_AUTHEN, true))),
-  entrypoint(route(CAUTHEN_AUTHEN_TYPED, '/:type', frontend(CAUTHEN_AUTHEN))),
-  // This is a helper route that is used by service providers to redirect to an external authentication service.
-  entrypoint(route(CAUTHEN_FLOW_ENTER, '/', frontend())),
-  // This is a helper route that is useb by service providres to process authentication provisioning via redirect.
-  // Also it can be default starting point to be redirected to an external identity provider.
-  entrypoint(
-    route(DISPATCHER, DISPATCHER_PATH, frontend({ service: DISPATCHER })),
-    // This module is sticky - it means it's always attach to client router.
-    // It's required here cause every web app needs dispatcher route to authorize
-    // rediected users.
-    filter(query(AuthTokenSchema), { sticky: true })
-  ),
-  // This is a helper route that representes a API endpoint of service provider that wants to authenticate
-  // a user with OwlMeans server-auth library.
-  entrypoint(route(DISPATCHER_AUTHEN, '/authenticate', backend(null, RouteMethod.POST)), filter(body(AuthTokenSchema))),
-]
-
-export const managerModules = [
-  entrypoint(route(authApi.profile.base, '/profile', backend({ service: WEB_API }))),
-  entrypoint(route(
-    authApi.profile.toEntityId, '/to-entity-id',
-    backend(authApi.profile.base, RouteMethod.POST)
-  )),
-  entrypoint(route(authApi.auth.base, '/auth', backend({ service: WEB_API }))),
-  entrypoint(route(
-    authApi.auth.delegate, '/delegate',
-    backend(authApi.auth.base, RouteMethod.POST)
-  )),
-]
-
-// const skipModules = [DISPATCHER]
-// export const authBackendModules = modules.filter(
-//   module => !skipModules.includes(module.alias) && module.route.route.type === AppType.Backend
-// ).map(module => module.alias)