@owlmeans/auth-common 0.1.18-rc.41 → 0.1.18-rc.43

package/README.md

@@ -12,7 +12,7 @@ Predefined authentication protocols, guards, and constants shared between server
 ## Installation
 
 ```bash
-bun add @owlmeans/auth-common@^0.1.18-rc.41
+bun add @owlmeans/auth-common@^0.1.18-rc.43
 ```
 
 ## Usage
@@ -98,7 +98,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.42
+npx @owlmeans/agent-skills@^0.1.18-rc.45
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/auth-common",
-  "version": "0.1.18-rc.41",
-  "generatedAt": "2026-09-29T08:01:58.121Z",
+  "version": "0.1.18-rc.43",
+  "generatedAt": "2026-10-01T23:27:48.728Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/auth-common/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/auth-common
 
 **Layer:** Core
-**Install:** `"@owlmeans/auth-common": "^0.1.18-rc.41"` in `dependencies`
+**Install:** `"@owlmeans/auth-common": "^0.1.18-rc.43"` in `dependencies`
 
 Everything a server and a browser must agree on to talk authentication: aliases, the shared
 protocol declarations, the signature guard, and the contract for resolving the organization
@@ -83,7 +83,7 @@ import { attachEntity, entityKeyOf, requireEntityKey, requireEntity } from '@owl
 
 | Helper | What it answers |
 |--------|-----------------|
-| `attachEntity(context, request)` | Resolve the slug on `request.auth` and set `request.entity`, canonicalizing a retired slug to the current one. A no-op when no resolver is registered; throws `AuthenFailed('entity')` when the token names an organization that will not resolve |
+| `attachEntity(context, request)` | Resolve the slug on `request.auth` and set `request.entity`, canonicalizing a retired slug to the current one. Keeps an entity the guard already attached when its `slug` equals the token's exactly, and drops one that does not. Otherwise a no-op when no resolver is registered; throws `AuthenFailed('entity')` when the token names an organization that will not resolve |
 | `entityKeyOf(req)` | The value to store and query organization-scoped records by — `req.entity?.id`, falling back to the token's slug where no resolver exists |
 | `requireEntityKey(req)` | Same, throwing `AuthorizationError` when the request carries no organization |
 | `requireEntity(req)` | The full `ResolvedEntity` (`id`, `slug`, `iamKey`), throwing `AuthorizationError` when nothing resolved |
@@ -93,6 +93,12 @@ any socket that authenticates after its connection is already open. A path that
 without it leaves `request.entity` empty and its handlers silently compare a slug against stored
 ids.
 
+A guard may attach the entity itself when its authority names the organization — the OIDC guard
+does for a session of a tenanted client (`@owlmeans/oidc`), whose relying party has no registry to
+resolve from. `attachEntity` trusts that attachment only while its `slug` is the token's
+`entitySlugOf(request.auth)`; on any mismatch it removes it and resolves as if nothing had been
+attached, so a stale or foreign entity can never reach a handler.
+
 Never build a user-facing name (a hostname, a display label) from `entityKeyOf`. Those want the
 current slug, `req.entity?.slug`.
 

package/build/entity.d.ts

@@ -34,8 +34,14 @@ export declare const requireEntity: (req: AbstractRequest) => ResolvedEntity;
  * its handlers quietly fall back to comparing a slug against stored ids — which surfaces as "this
  * project does not exist" rather than as a missing resolution, and costs an afternoon to find.
  *
- * A no-op when no resolver is registered: such a deployment has no organization store, and the
- * slug is the only identifier it has.
+ * An entity the guard already attached is kept while its slug is exactly the token's: a guard
+ * whose authority names the organization itself (an OIDC session of a tenanted client) is the only
+ * source such a deployment has, because the registry that owns the organization is not its own.
+ * One whose slug differs is never trusted — it is dropped, and resolution proceeds as if it had
+ * not been there.
+ *
+ * Otherwise a no-op when no resolver is registered: such a deployment has no organization store,
+ * and the slug is the only identifier it has.
  *
  * @throws {AuthenFailed} when the token names an organization that cannot be resolved.
  */

package/build/entity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entity.d.ts","sourceRoot":"","sources":["../src/entity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAKrD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,QAAS,eAAe,KAAG,MAAM,GAAG,SAClB,CAAA;AAE1C;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,QAAS,eAAe,KAAG,MAOvD,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,aAAa,QAAS,eAAe,KAAG,cAMpD,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,YAAY,YACd,YAAY,CAAC,GAAG,CAAC,WAAW,eAAe,KACnD,OAAO,CAAC,cAAc,GAAG,SAAS,CAiBpC,CAAA"}
+{"version":3,"file":"entity.d.ts","sourceRoot":"","sources":["../src/entity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAKrD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,QAAS,eAAe,KAAG,MAAM,GAAG,SAClB,CAAA;AAE1C;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,QAAS,eAAe,KAAG,MAOvD,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,aAAa,QAAS,eAAe,KAAG,cAMpD,CAAA;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,YAAY,YACd,YAAY,CAAC,GAAG,CAAC,WAAW,eAAe,KACnD,OAAO,CAAC,cAAc,GAAG,SAAS,CAwBpC,CAAA"}

package/build/entity.js

@@ -45,13 +45,25 @@ export const requireEntity = (req) => {
  * its handlers quietly fall back to comparing a slug against stored ids — which surfaces as "this
  * project does not exist" rather than as a missing resolution, and costs an afternoon to find.
  *
- * A no-op when no resolver is registered: such a deployment has no organization store, and the
- * slug is the only identifier it has.
+ * An entity the guard already attached is kept while its slug is exactly the token's: a guard
+ * whose authority names the organization itself (an OIDC session of a tenanted client) is the only
+ * source such a deployment has, because the registry that owns the organization is not its own.
+ * One whose slug differs is never trusted — it is dropped, and resolution proceeds as if it had
+ * not been there.
+ *
+ * Otherwise a no-op when no resolver is registered: such a deployment has no organization store,
+ * and the slug is the only identifier it has.
  *
  * @throws {AuthenFailed} when the token names an organization that cannot be resolved.
  */
 export const attachEntity = async (context, request) => {
     const slug = entitySlugOf(request.auth);
+    if (request.entity != null) {
+        if (slug != null && request.entity.slug === slug) {
+            return request.entity;
+        }
+        request.entity = undefined;
+    }
     if (slug == null || !context.hasService(ENTITY_RESOLVER)) {
         return undefined;
     }

package/build/entity.js.map

@@ -1 +1 @@
-{"version":3,"file":"entity.js","sourceRoot":"","sources":["../src/entity.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAE/E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE7C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAoB,EAAsB,EAAE,CACtE,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AAE1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAoB,EAAU,EAAE;IAC/D,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,kBAAkB,EAAE,CAAA;IAChC,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAoB,EAAkB,EAAE;IACpE,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,kBAAkB,EAAE,CAAA;IAChC,CAAC;IAED,OAAO,GAAG,CAAC,MAAM,CAAA;AACnB,CAAC,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,OAA0B,EAAE,OAAwB,EACf,EAAE;IACvC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACvC,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACzD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1F,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAA;IAClC,CAAC;IAED,gGAAgG;IAChG,qFAAqF;IACrF,OAAO,CAAC,IAAK,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAA;IACtC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAA;IAEvB,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}
+{"version":3,"file":"entity.js","sourceRoot":"","sources":["../src/entity.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAE/E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE7C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAoB,EAAsB,EAAE,CACtE,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AAE1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAoB,EAAU,EAAE;IAC/D,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,kBAAkB,EAAE,CAAA;IAChC,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAoB,EAAkB,EAAE;IACpE,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,kBAAkB,EAAE,CAAA;IAChC,CAAC;IAED,OAAO,GAAG,CAAC,MAAM,CAAA;AACnB,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,OAA0B,EAAE,OAAwB,EACf,EAAE;IACvC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACvC,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QAC3B,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACjD,OAAO,OAAO,CAAC,MAAM,CAAA;QACvB,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,SAAS,CAAA;IAC5B,CAAC;IAED,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACzD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1F,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAA;IAClC,CAAC;IAED,gGAAgG;IAChG,qFAAqF;IACrF,OAAO,CAAC,IAAK,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAA;IACtC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAA;IAEvB,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/auth-common",
-  "version": "0.1.18-rc.41",
+  "version": "0.1.18-rc.43",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -29,19 +29,19 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.36",
-    "@owlmeans/auth-common": "^0.1.18-rc.41",
+    "@owlmeans/auth": "^0.1.18-rc.37",
+    "@owlmeans/auth-common": "^0.1.18-rc.43",
     "@owlmeans/basic-ids": "^0.1.18-rc.34",
-    "@owlmeans/basic-keys": "^0.1.18-rc.42",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.41",
+    "@owlmeans/basic-keys": "^0.1.18-rc.44",
+    "@owlmeans/client-entrypoint": "^0.1.18-rc.43",
     "@owlmeans/context": "^0.1.18-rc.32",
-    "@owlmeans/entrypoint": "^0.1.18-rc.37",
+    "@owlmeans/entrypoint": "^0.1.18-rc.38",
     "@owlmeans/resource": "^0.1.18-rc.37",
     "@owlmeans/route": "^0.1.18-rc.33"
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/test-auth": "^0.1.18-rc.40",
+    "@owlmeans/test-auth": "^0.1.18-rc.42",
     "@types/bun": "^1.4.0",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"

package/src/entity.ts

@@ -55,8 +55,14 @@ export const requireEntity = (req: AbstractRequest): ResolvedEntity => {
  * its handlers quietly fall back to comparing a slug against stored ids — which surfaces as "this
  * project does not exist" rather than as a missing resolution, and costs an afternoon to find.
  *
- * A no-op when no resolver is registered: such a deployment has no organization store, and the
- * slug is the only identifier it has.
+ * An entity the guard already attached is kept while its slug is exactly the token's: a guard
+ * whose authority names the organization itself (an OIDC session of a tenanted client) is the only
+ * source such a deployment has, because the registry that owns the organization is not its own.
+ * One whose slug differs is never trusted — it is dropped, and resolution proceeds as if it had
+ * not been there.
+ *
+ * Otherwise a no-op when no resolver is registered: such a deployment has no organization store,
+ * and the slug is the only identifier it has.
  *
  * @throws {AuthenFailed} when the token names an organization that cannot be resolved.
  */
@@ -64,6 +70,13 @@ export const attachEntity = async (
   context: BasicContext<any>, request: AbstractRequest
 ): Promise<ResolvedEntity | undefined> => {
   const slug = entitySlugOf(request.auth)
+  if (request.entity != null) {
+    if (slug != null && request.entity.slug === slug) {
+      return request.entity
+    }
+    request.entity = undefined
+  }
+
   if (slug == null || !context.hasService(ENTITY_RESOLVER)) {
     return undefined
   }

package/tests/entity.spec.ts

@@ -0,0 +1,112 @@
+import { describe, expect, test } from 'bun:test'
+import { AppType, createService, makeBasicContext } from '@owlmeans/context'
+import type { BasicConfig, BasicContext } from '@owlmeans/context'
+import { AuthenFailed, AuthRole } from '@owlmeans/auth'
+import type { Auth } from '@owlmeans/auth'
+import type { AbstractRequest, ResolvedEntity } from '@owlmeans/entrypoint'
+import { attachEntity } from '../src/entity.js'
+import { ENTITY_RESOLVER } from '../src/consts.js'
+import type { EntityResolverService, OrgEntityRef } from '../src/types.js'
+
+const ACME: OrgEntityRef = { id: '0123456789abcdef01234567', slug: 'acme', formerSlugs: ['acme-old'], iamKey: 'acme-key' }
+
+/** A context with an in-memory registry of one organization, or none at all. */
+const contextWith = async (registry?: OrgEntityRef[]) => {
+  const ctx = makeBasicContext<BasicConfig>({ ready: false, service: 'entity-tests', type: AppType.Backend })
+  const calls: string[] = []
+  if (registry != null) {
+    ctx.registerService(createService<EntityResolverService>(ENTITY_RESOLVER, {
+      resolve: async value => {
+        calls.push(value)
+        return registry.find(entity => entity.id === value || entity.slug === value
+          || entity.formerSlugs?.includes(value) || entity.iamKey === value) ?? null
+      },
+      byId: async id => registry.find(entity => entity.id === id) ?? null,
+      mintSlug: async () => 'minted',
+      rename: async () => { throw new Error('not used') },
+      mintName: async () => { throw new Error('not used') },
+    }))
+  }
+  ctx.configure()
+  await ctx.init()
+
+  return { ctx: ctx as BasicContext<BasicConfig>, calls }
+}
+
+const requestFor = (entitySlug?: string, entity?: ResolvedEntity): AbstractRequest => ({
+  alias: 'any', path: '/', params: {}, query: {}, headers: {},
+  auth: { token: 't', type: 'oidc', userId: 'u', role: AuthRole.User, scopes: [], isUser: true,
+    createdAt: new Date(), ...(entitySlug != null ? { entitySlug } : {}) } as Auth,
+  ...(entity != null ? { entity } : {}),
+})
+
+const attached: ResolvedEntity = { id: 'iam-key-tenant', slug: 'tenant', iamKey: 'iam-key-tenant' }
+
+describe('attachEntity — an entity the guard attached', () => {
+  test('is kept when its slug is the token one, with no resolver registered', async () => {
+    const { ctx } = await contextWith()
+    const request = requestFor('tenant', attached)
+
+    expect(await attachEntity(ctx, request)).toEqual(attached)
+    expect(request.entity).toEqual(attached)
+  })
+
+  test('is kept without asking a registered resolver', async () => {
+    const { ctx, calls } = await contextWith([ACME])
+    const request = requestFor('tenant', attached)
+
+    expect(await attachEntity(ctx, request)).toEqual(attached)
+    expect(calls).toEqual([])
+  })
+
+  test('with another slug falls through to the resolver', async () => {
+    const { ctx, calls } = await contextWith([ACME])
+    const request = requestFor('acme', attached)
+
+    expect(await attachEntity(ctx, request)).toEqual(ACME)
+    expect(request.entity).toEqual(ACME)
+    expect(calls).toEqual(['acme'])
+  })
+
+  test('with another slug and no resolver is dropped, never trusted', async () => {
+    const { ctx } = await contextWith()
+    const request = requestFor('acme', attached)
+
+    expect(await attachEntity(ctx, request)).toBeUndefined()
+    expect(request.entity).toBeUndefined()
+  })
+
+  test('on a token naming no organization is dropped', async () => {
+    const { ctx } = await contextWith()
+    const request = requestFor(undefined, attached)
+
+    expect(await attachEntity(ctx, request)).toBeUndefined()
+    expect(request.entity).toBeUndefined()
+  })
+})
+
+describe('attachEntity — the resolver path', () => {
+  test('resolves and canonicalizes a retired slug', async () => {
+    const { ctx } = await contextWith([ACME])
+    const request = requestFor('acme-old')
+
+    expect(await attachEntity(ctx, request)).toEqual(ACME)
+    expect(request.entity).toEqual(ACME)
+    expect(request.auth?.entitySlug).toBe('acme')
+  })
+
+  test('refuses a token naming an organization the registry does not know', async () => {
+    const { ctx } = await contextWith([ACME])
+
+    await expect(attachEntity(ctx, requestFor('nobody'))).rejects.toBeInstanceOf(AuthenFailed)
+  })
+
+  test('is a no-op with no resolver and nothing attached', async () => {
+    const { ctx } = await contextWith()
+    const request = requestFor('acme')
+
+    expect(await attachEntity(ctx, request)).toBeUndefined()
+    expect(request.entity).toBeUndefined()
+    expect(request.auth?.entitySlug).toBe('acme')
+  })
+})