@owlmeans/iam 0.1.18-rc.14 → 0.1.18-rc.16
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +2 -2
- package/agent-meta/manifest.json +2 -2
- package/agent-meta/skills/iam/SKILL.md +157 -64
- package/build/consts.d.ts +1 -1
- package/build/consts.d.ts.map +1 -1
- package/build/errors.d.ts.map +1 -1
- package/build/errors.js.map +1 -1
- package/build/gate/param.d.ts.map +1 -1
- package/build/gate/resolve.d.ts.map +1 -1
- package/build/gate/resolve.js.map +1 -1
- package/build/gate/validate.d.ts.map +1 -1
- package/build/gate/validate.js.map +1 -1
- package/build/permission.d.ts.map +1 -1
- package/build/utils.d.ts.map +1 -1
- package/package.json +6 -6
package/README.md
CHANGED
|
@@ -13,7 +13,7 @@ Provider-agnostic IAM abstraction for the OwlMeans framework — `IamService` in
|
|
|
13
13
|
## Installation
|
|
14
14
|
|
|
15
15
|
```bash
|
|
16
|
-
bun add @owlmeans/iam
|
|
16
|
+
bun add @owlmeans/iam@^0.1.18-rc.15
|
|
17
17
|
```
|
|
18
18
|
|
|
19
19
|
## Usage
|
|
@@ -36,7 +36,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
|
|
|
36
36
|
your project's skill store (`.agents/skills/`):
|
|
37
37
|
|
|
38
38
|
```sh
|
|
39
|
-
npx @owlmeans/agent-skills
|
|
39
|
+
npx @owlmeans/agent-skills@^0.1.18-rc.12
|
|
40
40
|
```
|
|
41
41
|
|
|
42
42
|
The embedded files are version-matched to this package release. Do not edit them
|
package/agent-meta/manifest.json
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schemaVersion": 2,
|
|
3
3
|
"package": "@owlmeans/iam",
|
|
4
|
-
"version": "0.1.18-rc.
|
|
5
|
-
"generatedAt": "2026-09-
|
|
4
|
+
"version": "0.1.18-rc.16",
|
|
5
|
+
"generatedAt": "2026-09-04T22:43:25.440Z",
|
|
6
6
|
"canonicalRepo": "https://github.com/owlmeans/common",
|
|
7
7
|
"entries": [
|
|
8
8
|
{
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: iam
|
|
3
|
-
description: "
|
|
3
|
+
description: "How to use @owlmeans/iam — the provider-agnostic IamService, the permission-definition and two-form grant model, client-id uniqueness, issuer and redirect-URI rules, and hasPermission. Load when wiring IAM operations, granting or revoking permissions, selecting the IAM backend, or implementing a new IAM provider. Applies to files matching **/services/iam*.ts, **/context.ts, **/types.ts."
|
|
4
4
|
metadata:
|
|
5
5
|
applyTo: "**/services/iam*.ts, **/context.ts, **/types.ts"
|
|
6
6
|
---
|
|
@@ -8,7 +8,46 @@ metadata:
|
|
|
8
8
|
|
|
9
9
|
# Using `@owlmeans/iam`
|
|
10
10
|
|
|
11
|
-
|
|
11
|
+
**Install:** `"@owlmeans/iam": "^0.1.18-rc.16"` in `dependencies`
|
|
12
|
+
|
|
13
|
+
Provider-agnostic IAM abstraction: the `IamService` interface, the permission and grant shapes, the
|
|
14
|
+
gate-param grammar, and `hasPermission`. It contains no implementation and talks to no provider —
|
|
15
|
+
concrete backends (a Keycloak proxy, an integrated backend built on the OwlMeans OIDC provider) are
|
|
16
|
+
separate packages, and every consumer depends on this interface rather than on one of them.
|
|
17
|
+
|
|
18
|
+
## The browser half — `@owlmeans/client-iam`
|
|
19
|
+
|
|
20
|
+
`@owlmeans/client-iam` has no skill of its own because it is a wiring package: it re-exports these
|
|
21
|
+
types and `hasPermission`, and adds the two calls that turn "this application uses IAM" into two
|
|
22
|
+
lines.
|
|
23
|
+
|
|
24
|
+
| Export | Description |
|
|
25
|
+
|--------|-------------|
|
|
26
|
+
| `appendIam(context, opts?)` | Wires the OIDC guard onto a web context **and** installs the consent-before-sign-in precondition |
|
|
27
|
+
| `setupIam(entrypoints, coguards?)` | Wires the same guard onto the entrypoint list, and attaches the dispatcher screen |
|
|
28
|
+
| `requireConsentForLogin(ctx, opts?)` | That precondition on its own, for a context wired some other way |
|
|
29
|
+
| `CONSENT_LOGIN_PRECONDITION` / `CLIENT_IAM_SERVICE` | The precondition alias and the service alias |
|
|
30
|
+
| `useLogin` / `useLogout`, `LoginOutcome` / `LoginIntent`, `LoginPlugin` / `LoginService` / … | Re-exported sign-in surface, so an app has one IAM import rather than three |
|
|
31
|
+
| Everything from `@owlmeans/iam` | The types above, plus `hasPermission` |
|
|
32
|
+
|
|
33
|
+
Two rules ride on it. **`setupIam` is called exactly once per entrypoint list** — it appends the OIDC
|
|
34
|
+
dispatcher entrypoints to the list it is given rather than returning a new one, and then elevates
|
|
35
|
+
three aliases in place. **Calling it twice fails silently, it does not throw.** Elevation is
|
|
36
|
+
idempotent: it replaces the *first* element carrying the alias and only raises when the alias is
|
|
37
|
+
absent (`Entrypoint with alias … not present`, which a list missing the `DISPATCHER` declaration
|
|
38
|
+
hits). So a second `setupIam` — or a `setupOidcGuard` from `@owlmeans/web-oidc-rp` called alongside
|
|
39
|
+
it — leaves the same declarations in the list twice and re-elevates them, with no error and no
|
|
40
|
+
warning, and the dispatcher screen ends up as whatever the later call attached: a parametrised
|
|
41
|
+
dispatcher is quietly swapped for the default. An app that calls `setupIam` must therefore not also
|
|
42
|
+
call `setupOidcGuard` itself.
|
|
43
|
+
|
|
44
|
+
And the consent precondition sits on `LoginService.begin` rather than on a hook, a screen or a login
|
|
45
|
+
plugin, because `begin` is the single funnel every sign-in mechanic passes through and the one place
|
|
46
|
+
the user's gesture is still live — a refusal resolves as `LoginOutcome.Gesture` and opens the consent dialog in
|
|
47
|
+
the same gesture. An application that genuinely sets no cookie passes `{ consent: { disabled: true } }`.
|
|
48
|
+
|
|
49
|
+
The server half of the same story is `@owlmeans/server-iam` — the IAM gate that asserts the grants
|
|
50
|
+
this package's screens hand out. Permission decisions are made there, never in the browser.
|
|
12
51
|
|
|
13
52
|
## Public API surface
|
|
14
53
|
|
|
@@ -18,24 +57,38 @@ Provider-agnostic IAM abstraction. Defines `IamService` interface and related ty
|
|
|
18
57
|
| `IamClient` | type | Provisioned OIDC client `{ id?, clientId, secret?, name?, realm? }` |
|
|
19
58
|
| `IamClientOptions` | type | `{ redirectUris? }` — explicit `ensureClient` hardening; omitting is a keycloak-only legacy shape (see below) |
|
|
20
59
|
| `IamCredentialsPair` | type | `{ token: string; realm: string }` |
|
|
21
|
-
| `IamPermissionArgs` | type | `{ permission?, resourceScoped?, title? }` — `permission` absent means unscoped resource name |
|
|
60
|
+
| `IamPermissionArgs` | type | `{ permission?, resourceScoped?, title?, area?, managed? }` — `permission` absent means unscoped resource name |
|
|
22
61
|
| `IamResourceSpec` | type | `{ name: string; displayName?: string }` |
|
|
23
|
-
| `IamPermissionDefinition` | type | Declared permission `{ name, resource, action?, resourceScoped?, title? }` |
|
|
24
|
-
| `
|
|
25
|
-
| `
|
|
62
|
+
| `IamPermissionDefinition` | type | Declared permission `{ name, resource, action?, resourceScoped?, title?, area?, managed? }` |
|
|
63
|
+
| `IamPermissionFilter` | type | `{ areas?, managed?, resourceScoped? }` — narrows `listPermissions`; an `areas` entry of `null` matches untagged definitions |
|
|
64
|
+
| `IamGrantArgs` | type | `{ resources?: string[], mode? }` |
|
|
65
|
+
| `IamGrant` | type | `{ profileId, clientId, permission, resources?, mode? }` |
|
|
66
|
+
| `IamGrantMode` | enum | `Blanket` / `Resources` / `All` — which FORM of a grant an operation addresses |
|
|
67
|
+
| `IamGrantBundle` | type | `{ filter?, permissions?, mode?, resources? }` — what `grantBundle` hands out |
|
|
68
|
+
| `IamRemovalPolicy` | enum | `Cascade` / `Refuse` — what to do about grants of a definition being deleted |
|
|
69
|
+
| `IamPermissionDeleteArgs`, `IamPermissionRemoval` | type | `{ policy?, managed? }` and `{ permission, clientId, found, revoked }` |
|
|
70
|
+
| `IamNormalizeArgs`, `IamNormalizationReport` | type | `{ dryRun? }` and the rename/merge plan `normalizePermissions` reports |
|
|
71
|
+
| `IAM_AREAS`, `IamArea` | const/type | `['user', 'operator', 'admin']` — presentational grouping tags, read by no gate |
|
|
72
|
+
| `PERMISSION_ACTION_SEPARATOR` | const | `'--'` — TWO hyphens, never one |
|
|
73
|
+
| `parsePermissionName` / `composePermissionName` / `isPermissionName` | fn | Read, build and validate a permission NAME |
|
|
74
|
+
| `ParsedPermissionName` | type | `{ name, resource, action?, problem? }` |
|
|
26
75
|
| `IamUser` | type | End-user of an entity `{ profileId, email?, name?, role, disabled?, grantCount? }` |
|
|
27
76
|
| `IamUserInvite` | type | `{ email, name?, role? }` — find-or-create args |
|
|
28
77
|
| `IamUserUpdate` | type | `{ name?, role?, disabled? }` |
|
|
29
78
|
| `hasPermission` | fn | `(auth, permission, { scope?, resourceId? }?)` — checks `Authorization.permissions` PermissionSet[]; an unscoped set satisfies a resourceId check |
|
|
79
|
+
| `HasPermissionOptions` | type | `{ scope?, resourceId? }` |
|
|
80
|
+
| Gate grammar | fn/type | `parseGateParam`, `parseGateSelector`, `formatGateParam`, `resolveGateResource`, `validateGateParams`, `routeParamsOf`, plus `RESOURCE_*_SEPARATOR`, `GateParamSource`, `DEFAULT_GATE_PARAM_SOURCES`, `GateParamErrorCode`, `GateResolutionFailure` and the `Gate*` types. The syntax itself is documented in the `server-iam` skill |
|
|
30
81
|
| `DEFAULT_ALIAS` | const | Default service alias `'iam-service'` |
|
|
31
82
|
| `IAM_MODE_KEYCLOAK` | const | `'keycloak'` |
|
|
32
83
|
| `IAM_MODE_INTEGRATED` | const | `'integrated'` |
|
|
33
84
|
| `IamMode` | type | `'keycloak' \| 'integrated'` |
|
|
34
85
|
| `IamError` | class | Base IAM error |
|
|
35
|
-
| `IamClientError` | class |
|
|
36
|
-
| `IamResourceError` | class |
|
|
86
|
+
| `IamClientError` | class | An OIDC client is invalid or unusable — missing `secret`, unusable `redirect_uris`, `client:entity-mismatch`, an unconfigured provider route |
|
|
87
|
+
| `IamResourceError` | class | A provider resource returned with no name |
|
|
37
88
|
| `IamGrantError` | class | Grant subject missing or entity mismatch |
|
|
38
|
-
| `
|
|
89
|
+
| `IamPermissionError` | class | A refusal about a DEFINITION: `permission:held:<name>`, `permission:managed:<name>` |
|
|
90
|
+
| `IamUserError` | class | An end-user operation was refused |
|
|
91
|
+
| `IamUnsupported` | class | Operation not supported by the active backend (e.g. `resource-scoped-grant`, `user-management`) |
|
|
39
92
|
|
|
40
93
|
## Permission model (two grant forms)
|
|
41
94
|
|
|
@@ -49,23 +102,36 @@ subjects with `grantPermission`:
|
|
|
49
102
|
Grants materialize as OwlMeans `PermissionSet[]` (`scope` = clientId; resource-scoped grants live in a
|
|
50
103
|
dedicated set per permission carrying `resources[]`, because `resources` applies to all keys of a set).
|
|
51
104
|
|
|
105
|
+
A **name** is `<resource>--<action>`, with two hyphens. One hyphen is not a separator: `enquiry-view`
|
|
106
|
+
is a resource named `enquiry-view` with no action, and it must keep parsing that way, because a name
|
|
107
|
+
already granted somewhere cannot be reinterpreted without orphaning the grant. Build and read names
|
|
108
|
+
through `composePermissionName` / `parsePermissionName` rather than splitting strings.
|
|
109
|
+
|
|
110
|
+
`resourceScoped: true` says a permission *may* be bound to resource ids, not that it must be. The
|
|
111
|
+
same name is grantable in both forms and they are stored separately, which is what `IamGrantMode`
|
|
112
|
+
addresses: `Blanket` is the set carrying no `resources` (and `hasPermission` reads it as covering
|
|
113
|
+
every id), `Resources` is an explicit id list, and `All` is revoke-only. The defaults are asymmetric
|
|
114
|
+
on purpose — `grantPermission` defaults to `Blanket`, `revokePermission` to `All`, because a bare
|
|
115
|
+
revoke has always meant "remove it everywhere". Pass `mode` explicitly rather than relying on either.
|
|
116
|
+
|
|
117
|
+
`area` is a presentational grouping tag (`IAM_AREAS`, or any string a deployment defines) and decides
|
|
118
|
+
nothing at request time. `managed: true` marks a definition the platform owns: an operator cannot
|
|
119
|
+
revoke it from an undifferentiated list, and a repair that deletes "definitions no declaration names"
|
|
120
|
+
must not reach one.
|
|
121
|
+
|
|
52
122
|
## `IamService` interface
|
|
53
123
|
|
|
54
124
|
```ts
|
|
55
125
|
interface IamService extends InitializedService {
|
|
56
|
-
//
|
|
126
|
+
// The tenant's admin OIDC provider config, and a raw admin { token, realm } pair.
|
|
57
127
|
getEntityAdminConfig: (entityId: string) => Promise<OidcProviderConfig>
|
|
58
|
-
|
|
59
|
-
// Get an admin { token, realm } pair for raw low-level calls (avoid unless necessary)
|
|
60
128
|
getCredentialsPair: (entityId: string) => Promise<IamCredentialsPair>
|
|
61
129
|
|
|
62
|
-
// The tenant's public
|
|
63
|
-
// Config-only (no remote call); throws IamClientError when the provider route is unconfigured.
|
|
130
|
+
// The tenant's public issuer URL — see "Issuer & redirect URIs".
|
|
64
131
|
getIssuerUrl: (entityId: string) => Promise<string>
|
|
65
132
|
|
|
66
|
-
// Provision an OIDC client for a tenant
|
|
67
|
-
//
|
|
68
|
-
// MUST refuse an existing record owned by another entity — see "A client id is a global name".
|
|
133
|
+
// Provision an OIDC client for a tenant — see "Issuer & redirect URIs" and
|
|
134
|
+
// "A client id is a global name" for the two rules it has to obey.
|
|
69
135
|
ensureClient: (entityId: string, clientId: string, options?: IamClientOptions) => Promise<IamClient>
|
|
70
136
|
|
|
71
137
|
// Reserve a free client id without provisioning it; false when anyone else holds it.
|
|
@@ -74,32 +140,42 @@ interface IamService extends InitializedService {
|
|
|
74
140
|
// Release a client id and everything keyed by it (called when a project/slot is deleted).
|
|
75
141
|
deleteClient: (entityId: string, clientId: string) => Promise<void>
|
|
76
142
|
|
|
77
|
-
//
|
|
143
|
+
// Declare a permission. Returns the canonical name. MERGES into an existing definition —
|
|
144
|
+
// resource/action re-derived, omitted flags kept — and NEVER rewrites the name. Refuses a
|
|
145
|
+
// `resource` carrying an `@` selector.
|
|
78
146
|
ensurePermission: (entityId: string, clientId: string, resource?: string, args?: IamPermissionArgs) => Promise<string>
|
|
79
147
|
|
|
80
|
-
//
|
|
148
|
+
// Remove definitions BY NAME, and by default their grants. Idempotent ({ found: false } when
|
|
149
|
+
// absent). Grants go first: a crash between the stores must leave a definition with no grants,
|
|
150
|
+
// never grants with no definition. A `managed` definition needs args.managed === true.
|
|
151
|
+
deletePermission: (entityId: string, clientId: string, permission: string | string[], args?: IamPermissionDeleteArgs) => Promise<IamPermissionRemoval[]>
|
|
152
|
+
|
|
153
|
+
// Repair definitions whose stored name leaked a gate selector, moving grants in the same write.
|
|
154
|
+
// A rename and a merge — never a delete, never an invention.
|
|
155
|
+
normalizePermissions: (entityId: string, clientId: string, args?: IamNormalizeArgs) => Promise<IamNormalizationReport>
|
|
156
|
+
|
|
157
|
+
// Provision a resource and assign it to the tenant's owner role
|
|
81
158
|
ensureResourceOwnership: (entityId: string, clientId: string, resource: IamResourceSpec) => Promise<void>
|
|
82
159
|
|
|
83
160
|
// --- Authorization (permission definitions & grants) ---
|
|
84
161
|
|
|
85
|
-
|
|
86
|
-
listPermissions: (entityId: string, clientId: string) => Promise<IamPermissionDefinition[]>
|
|
162
|
+
listPermissions: (entityId: string, clientId: string, filter?: IamPermissionFilter) => Promise<IamPermissionDefinition[]>
|
|
87
163
|
|
|
88
|
-
//
|
|
164
|
+
// args.resources selects the resource-scoped form; see "Permission model (two grant forms)"
|
|
89
165
|
grantPermission: (entityId: string, clientId: string, profileId: string, permission: string, args?: IamGrantArgs) => Promise<IamGrant>
|
|
90
|
-
|
|
91
|
-
// Revoke; with args.resources only those ids are removed, else the whole grant
|
|
92
166
|
revokePermission: (entityId: string, clientId: string, profileId: string, permission: string, args?: IamGrantArgs) => Promise<void>
|
|
93
167
|
|
|
94
|
-
//
|
|
168
|
+
// Grant everything a bundle selects to each subject, idempotently, in ONE read and write per
|
|
169
|
+
// subject. Returns what each subject now holds, not what changed. Use it instead of looping over
|
|
170
|
+
// grantPermission, which costs N·M writes and N·M lost-update windows on the same records.
|
|
171
|
+
grantBundle: (entityId: string, clientId: string, profileIds: string[], bundle: IamGrantBundle) => Promise<IamGrant[]>
|
|
172
|
+
|
|
95
173
|
listGrants: (entityId: string, clientId: string, profileId?: string) => Promise<IamGrant[]>
|
|
96
174
|
|
|
97
|
-
// --- End-user management
|
|
175
|
+
// --- End-user management — see "End-users are customer-wide" ---
|
|
98
176
|
|
|
99
|
-
// Every end-user of the entity. clientId scopes the reported grantCount — it does NOT filter.
|
|
100
177
|
listUsers: (entityId: string, clientId?: string) => Promise<IamUser[]>
|
|
101
178
|
getUser: (entityId: string, profileId: string) => Promise<IamUser | null>
|
|
102
|
-
// Find-or-create by email — the one way an end-user record comes into existence.
|
|
103
179
|
inviteUser: (entityId: string, invite: IamUserInvite) => Promise<IamUser>
|
|
104
180
|
updateUser: (entityId: string, profileId: string, update: IamUserUpdate) => Promise<IamUser>
|
|
105
181
|
removeUser: (entityId: string, profileId: string) => Promise<void>
|
|
@@ -115,9 +191,9 @@ has authenticated against a project but holds no grant there is still that proje
|
|
|
115
191
|
screen that hands out grants is exactly where they have to be visible.
|
|
116
192
|
|
|
117
193
|
`inviteUser` is idempotent by email, which is what lets an invitation and a first sign-in converge on
|
|
118
|
-
one record instead of accumulating twins.
|
|
119
|
-
|
|
120
|
-
all five methods
|
|
194
|
+
one record instead of accumulating twins. A backend with no user store of its own — one where the
|
|
195
|
+
customer manages users in the provider's own console — throws `IamUnsupported('user-management')`
|
|
196
|
+
from all five methods.
|
|
121
197
|
|
|
122
198
|
## A client id is a global name
|
|
123
199
|
|
|
@@ -138,15 +214,8 @@ cannot namespace it on a consumer's behalf. Uniqueness has to be *in the id*.
|
|
|
138
214
|
|
|
139
215
|
## `IamClient.realm` field
|
|
140
216
|
|
|
141
|
-
`realm` is set by the provider to the entity
|
|
142
|
-
|
|
143
|
-
```ts
|
|
144
|
-
// ✓ correct
|
|
145
|
-
await meta.update('oidcRealm', client.realm ?? fallbackEntityId)
|
|
146
|
-
|
|
147
|
-
// ✗ never do this — internal Keycloak implementation detail
|
|
148
|
-
await meta.update('oidcRealm', (client as any)._realm)
|
|
149
|
-
```
|
|
217
|
+
`realm` is set by the provider to the entity id, so read `client.realm ?? fallbackEntityId` and never
|
|
218
|
+
reach into an adapter's own internals (`(client as any)._realm`) for the same value.
|
|
150
219
|
|
|
151
220
|
## Issuer & redirect URIs
|
|
152
221
|
|
|
@@ -167,39 +236,63 @@ config is self-sufficient too.
|
|
|
167
236
|
|
|
168
237
|
**Always pass `redirectUris`.** Omitting them is a keycloak-only legacy default (`['*']`, which
|
|
169
238
|
Keycloak expands per-origin). The integrated provider does exact `redirect_uri` matching and
|
|
170
|
-
`oidc-provider` refuses to load a client whose `redirect_uris` are not absolute URIs — so
|
|
171
|
-
`
|
|
239
|
+
`oidc-provider` refuses to load a client whose `redirect_uris` are not absolute URIs — so an
|
|
240
|
+
integrated backend's `ensureClient` throws `IamClientError('redirect-uris')` on creation rather than
|
|
172
241
|
registering a client that can never complete a callback. An omitted list never widens an existing
|
|
173
242
|
hardened client.
|
|
174
243
|
|
|
175
|
-
## Selecting the IAM
|
|
244
|
+
## Selecting the IAM backend
|
|
176
245
|
|
|
177
|
-
The
|
|
246
|
+
The choice is made **once, in a service factory**, and nowhere else. Feature code depends on
|
|
247
|
+
`IamService` and never learns which implementation answers it. `IAM_MODE_INTEGRATED` /
|
|
248
|
+
`IAM_MODE_KEYCLOAK` and `OidcIamConfig.iamMode` (`@owlmeans/oidc`) exist so a deployment can carry
|
|
249
|
+
that choice as ordinary configuration rather than as a branch scattered through handlers. No OwlMeans
|
|
250
|
+
package reads `iamMode`; it is declared for the consumer's own factory to switch on, which is the
|
|
251
|
+
only thing that may branch.
|
|
178
252
|
|
|
179
253
|
```ts
|
|
180
|
-
|
|
181
|
-
|
|
182
|
-
|
|
183
|
-
|
|
184
|
-
|
|
185
|
-
|
|
186
|
-
|
|
187
|
-
|
|
254
|
+
import { DEFAULT_ALIAS, IAM_MODE_INTEGRATED, IAM_MODE_KEYCLOAK } from '@owlmeans/iam'
|
|
255
|
+
import type { IamMode, IamService } from '@owlmeans/iam'
|
|
256
|
+
|
|
257
|
+
// makeKeycloakAdapter / makeIntegratedAdapter are PLACEHOLDER names standing in for whichever
|
|
258
|
+
// adapter packages the deployment installs — this factory is the one place either is named, and
|
|
259
|
+
// every consumer resolves IamService by alias instead. An adapter exposes a
|
|
260
|
+
// `(alias?: string, options?: object) => IamService` factory whose alias defaults to DEFAULT_ALIAS.
|
|
261
|
+
export const makeIamService = (mode: IamMode = IAM_MODE_INTEGRATED): IamService =>
|
|
262
|
+
mode === IAM_MODE_KEYCLOAK
|
|
263
|
+
? makeKeycloakAdapter(DEFAULT_ALIAS, /* adapter options */)
|
|
264
|
+
: makeIntegratedAdapter(DEFAULT_ALIAS, /* adapter options */)
|
|
265
|
+
|
|
266
|
+
// cfg.oidc typed as OidcSharedConfig & OidcIamConfig is what carries the mode
|
|
267
|
+
context.registerService(makeIamService(cfg.oidc?.iamMode))
|
|
188
268
|
```
|
|
189
269
|
|
|
190
|
-
|
|
191
|
-
|
|
192
|
-
|
|
270
|
+
An adapter that reassembles the issuer from a registered service alias plus a base path must be given
|
|
271
|
+
the **consumer's own** alias and path. Whatever an adapter defaults to is a placeholder, and a
|
|
272
|
+
mismatch makes every service lookup behind `getIssuerUrl` miss.
|
|
193
273
|
|
|
194
|
-
|
|
274
|
+
An integrated backend — one built on `@owlmeans/server-oidc-provider`, so the deployment hosts its
|
|
275
|
+
own provider — is the default choice; a Keycloak-backed adapter exists for deployments that already
|
|
276
|
+
run one.
|
|
195
277
|
|
|
196
|
-
|
|
197
|
-
|
|
198
|
-
- `IamClientError` means the provisioned client was invalid (missing secret, null token). The proxy already throws it; callers only need to handle it, not re-throw wrapped errors.
|
|
199
|
-
- The `realm` field on `IamClient` is guaranteed to be set by all concrete implementations.
|
|
278
|
+
When a context hosts **more than one** `IamService` instance, every instance must be constructed with
|
|
279
|
+
the same options — otherwise they disagree about the issuer, and only one of them can be right.
|
|
200
280
|
|
|
201
|
-
##
|
|
281
|
+
## Rules
|
|
202
282
|
|
|
203
|
-
-
|
|
204
|
-
-
|
|
205
|
-
-
|
|
283
|
+
- Always depend on `IamService`, never on a backend's own admin client.
|
|
284
|
+
- Do not expose `getCredentialsPair` to request handlers — it returns a raw admin token.
|
|
285
|
+
- `IamClientError` means the provisioned client was invalid (missing secret, null token). The adapter
|
|
286
|
+
already throws it; callers handle it rather than re-throwing a wrapped error.
|
|
287
|
+
- `IamClient.realm` is set by every concrete implementation.
|
|
288
|
+
- An operation a backend cannot support throws `IamUnsupported('<what>')`. Callers turn that into a
|
|
289
|
+
fallback — an "external console" link, a disabled control — rather than an error screen.
|
|
290
|
+
|
|
291
|
+
## Related
|
|
292
|
+
|
|
293
|
+
- `@owlmeans/server-iam` — the IAM gate that asserts both grant forms, and the gate-param grammar;
|
|
294
|
+
see the `server-iam` skill
|
|
295
|
+
- `@owlmeans/oidc` — provider descriptors and the `iamMode` config seam; see the `oidc` skill
|
|
296
|
+
- The concrete adapters (a Keycloak proxy, and the integrated backend built on
|
|
297
|
+
`@owlmeans/server-oidc-provider` plus `@owlmeans/server-auth-identity`) ship separately and are
|
|
298
|
+
reached only through `IamService`.
|
package/build/consts.d.ts
CHANGED
|
@@ -89,7 +89,7 @@ export declare enum IamRemovalPolicy {
|
|
|
89
89
|
* deliberately absent: a public surface declares no permissions, and adding an area later would
|
|
90
90
|
* re-classify names already tagged.
|
|
91
91
|
*/
|
|
92
|
-
export declare const IAM_AREAS: readonly [
|
|
92
|
+
export declare const IAM_AREAS: readonly ['user', 'operator', 'admin'];
|
|
93
93
|
export type IamArea = typeof IAM_AREAS[number];
|
|
94
94
|
/** Separates the resource from the action in a permission name. TWO hyphens, never one. */
|
|
95
95
|
export declare const PERMISSION_ACTION_SEPARATOR = "--";
|
package/build/consts.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,gBAAgB,CAAA;AAE1C,eAAO,MAAM,iBAAiB,aAAa,CAAA;AAC3C,eAAO,MAAM,mBAAmB,eAAe,CAAA;AAE/C,MAAM,MAAM,OAAO,GAAG,OAAO,iBAAiB,GAAG,OAAO,mBAAmB,CAAA;AAE3E;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAA;AAE3C;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,MAAM,CAAA;AAE5C,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,MAAM,CAAA;AAE1C,8DAA8D;AAC9D,oBAAY,eAAe;IACzB,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,IAAI,SAAS;CACd;AAED;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,EAAE,eAAe,EAEvD,CAAA;AAED,+FAA+F;AAC/F,oBAAY,kBAAkB;IAC5B,aAAa,8BAA8B;IAC3C,aAAa,8BAA8B;IAC3C,YAAY,6BAA6B;IACzC,oGAAoG;IACpG,cAAc,+BAA+B;IAC7C,oEAAoE;IACpE,iBAAiB,mCAAmC;CACrD;AAED,8CAA8C;AAC9C,oBAAY,qBAAqB;IAC/B,4CAA4C;IAC5C,WAAW,iBAAiB;IAC5B,iDAAiD;IACjD,aAAa,mBAAmB;IAChC,wFAAwF;IACxF,SAAS,eAAe;IACxB,yCAAyC;IACzC,SAAS,cAAc;CACxB;AAED;;;;;;;GAOG;AACH,oBAAY,YAAY;IACtB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,mDAAmD;IACnD,GAAG,QAAQ;CACZ;AAED,+EAA+E;AAC/E,oBAAY,gBAAgB;IAC1B,uFAAuF;IACvF,OAAO,YAAY;IACnB,gFAAgF;IAChF,MAAM,WAAW;CAClB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,
|
|
1
|
+
{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,gBAAgB,CAAA;AAE1C,eAAO,MAAM,iBAAiB,aAAa,CAAA;AAC3C,eAAO,MAAM,mBAAmB,eAAe,CAAA;AAE/C,MAAM,MAAM,OAAO,GAAG,OAAO,iBAAiB,GAAG,OAAO,mBAAmB,CAAA;AAE3E;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAA;AAE3C;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,MAAM,CAAA;AAE5C,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,MAAM,CAAA;AAE1C,8DAA8D;AAC9D,oBAAY,eAAe;IACzB,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,IAAI,SAAS;CACd;AAED;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,EAAE,eAAe,EAEvD,CAAA;AAED,+FAA+F;AAC/F,oBAAY,kBAAkB;IAC5B,aAAa,8BAA8B;IAC3C,aAAa,8BAA8B;IAC3C,YAAY,6BAA6B;IACzC,oGAAoG;IACpG,cAAc,+BAA+B;IAC7C,oEAAoE;IACpE,iBAAiB,mCAAmC;CACrD;AAED,8CAA8C;AAC9C,oBAAY,qBAAqB;IAC/B,4CAA4C;IAC5C,WAAW,iBAAiB;IAC5B,iDAAiD;IACjD,aAAa,mBAAmB;IAChC,wFAAwF;IACxF,SAAS,eAAe;IACxB,yCAAyC;IACzC,SAAS,cAAc;CACxB;AAED;;;;;;;GAOG;AACH,oBAAY,YAAY;IACtB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,mDAAmD;IACnD,GAAG,QAAQ;CACZ;AAED,+EAA+E;AAC/E,oBAAY,gBAAgB;IAC1B,uFAAuF;IACvF,OAAO,YAAY;IACnB,gFAAgF;IAChF,MAAM,WAAW;CAClB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,YAAI,MAAM,EAAE,UAAU,EAAE,OAAO,CAAU,CAAA;AAE/D,MAAM,MAAM,OAAO,GAAG,OAAO,SAAS,CAAC,MAAM,CAAC,CAAA;AAE9C,2FAA2F;AAC3F,eAAO,MAAM,2BAA2B,OAAO,CAAA"}
|
package/build/errors.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,qBAAa,QAAS,SAAQ,cAAc;IAC1C,OAAuB,QAAQ,SAAkC;
|
|
1
|
+
{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,qBAAa,QAAS,SAAQ,cAAc;IAC1C,OAAuB,QAAQ,SAAkC;IAEjE,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,cAAe,SAAQ,QAAQ;IAC1C,OAAuB,QAAQ,SAAwC;IAEvE,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,gBAAiB,SAAQ,QAAQ;IAC5C,OAAuB,QAAQ,SAA0C;IAEzE,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,aAAc,SAAQ,QAAQ;IACzC,OAAuB,QAAQ,SAAuC;IAEtE,YAAY,OAAO,SAAU,EAG5B;CACF;AAED;;;;;;;;GAQG;AACH,qBAAa,kBAAmB,SAAQ,QAAQ;IAC9C,OAAuB,QAAQ,SAA4C;IAE3E,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,cAAe,SAAQ,QAAQ;IAC1C,OAAuB,QAAQ,SAA6C;IAE5E,YAAY,OAAO,SAAU,EAG5B;CACF;AAED,qBAAa,YAAa,SAAQ,QAAQ;IACxC,OAAuB,QAAQ,SAAsC;IAErE,YAAY,OAAO,SAAU,EAG5B;CACF"}
|
package/build/errors.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,MAAM,OAAO,QAAS,SAAQ,cAAc;IACnC,MAAM,CAAU,QAAQ,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,CAAA;IAEjE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,OAAO,EAAE,CAAC,CAAA;QAC1C,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAA;IAC/B,CAAC
|
|
1
|
+
{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,MAAM,OAAO,QAAS,SAAQ,cAAc;IACnC,MAAM,CAAU,QAAQ,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,CAAA;IAEjE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,OAAO,EAAE,CAAC,CAAA;QAC1C,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAA;IAC/B,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,QAAQ;IACnC,MAAM,CAAU,QAAQ,GAAG,YAAY,cAAc,CAAC,QAAQ,EAAE,CAAA;IAEvE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,CAAA;QAC1B,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAA;IACrC,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,QAAQ;IACrC,MAAM,CAAU,QAAQ,GAAG,cAAc,cAAc,CAAC,QAAQ,EAAE,CAAA;IAEzE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,YAAY,OAAO,EAAE,CAAC,CAAA;QAC5B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAA;IACvC,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,QAAQ;IAClC,MAAM,CAAU,QAAQ,GAAG,WAAW,cAAc,CAAC,QAAQ,EAAE,CAAA;IAEtE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,SAAS,OAAO,EAAE,CAAC,CAAA;QACzB,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAA;IACpC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAmB,SAAQ,QAAQ;IACvC,MAAM,CAAU,QAAQ,GAAG,gBAAgB,cAAc,CAAC,QAAQ,EAAE,CAAA;IAE3E,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,cAAc,OAAO,EAAE,CAAC,CAAA;QAC9B,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAA;IACzC,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,QAAQ;IACnC,MAAM,CAAU,QAAQ,GAAG,iBAAiB,cAAc,CAAC,QAAQ,EAAE,CAAA;IAE5E,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,eAAe,OAAO,EAAE,CAAC,CAAA;QAC/B,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAA;IACrC,CAAC;CACF;AAED,MAAM,OAAO,YAAa,SAAQ,QAAQ;IACjC,MAAM,CAAU,QAAQ,GAAG,UAAU,cAAc,CAAC,QAAQ,EAAE,CAAA;IAErE,YAAY,OAAO,GAAG,OAAO;QAC3B,KAAK,CAAC,QAAQ,OAAO,EAAE,CAAC,CAAA;QACxB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAA;IACnC,CAAC;CACF;AAED,cAAc,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAA;AAC3C,cAAc,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;AACjD,cAAc,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;AACnD,cAAc,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAA;AAChD,cAAc,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;AACrD,cAAc,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;AACjD,cAAc,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"param.d.ts","sourceRoot":"","sources":["../../src/gate/param.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,EAChB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAI1F;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,
|
|
1
|
+
{"version":3,"file":"param.d.ts","sourceRoot":"","sources":["../../src/gate/param.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,EAChB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAI1F;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,aAAc,MAAM,KAAG,oBAAoB,GAAG,gBA6C3E,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,UAAW,MAAM,KAAG,eAoB9C,CAAA;AAED,2FAA2F;AAC3F,eAAO,MAAM,eAAe,eACd,MAAM,aACP,MAAM,GAAG;IAAE,MAAM,CAAC,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,KAC/D,MAmBF,CAAA"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/gate/resolve.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AA4EhG;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,
|
|
1
|
+
{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/gate/resolve.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AA4EhG;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,QACzB,eAAe,YAAY,oBAAoB,KACnD,sBA2BF,CAAA"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/gate/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAGrE,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAA;AAE5C;;;;;GAKG;AACH,MAAM,MAAM,GAAG,CAAC,KAAc,EAAiB,EAAE;IAC/C,QAAQ,OAAO,KAAK,EAAE,CAAC;QACrB,KAAK,QAAQ;YACX,OAAO,KAAK,CAAA;QACd,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,GAAG,KAAK,EAAE,CAAA;QACnB;YACE,OAAO,IAAI,CAAA;IACf,CAAC;AACH,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,CAAC,GAAoB,EAAE,MAAuB,EAAW,EAAE;IAC1E,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,eAAe,CAAC,MAAM,
|
|
1
|
+
{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/gate/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAGrE,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAA;AAE5C;;;;;GAKG;AACH,MAAM,MAAM,GAAG,CAAC,KAAc,EAAiB,EAAE;IAC/C,QAAQ,OAAO,KAAK,EAAE,CAAC;QACrB,KAAK,QAAQ;YACX,OAAO,KAAK,CAAA;QACd,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,GAAG,KAAK,EAAE,CAAA;QACnB;YACE,OAAO,IAAI,CAAA;IACf,CAAC;AACH,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,CAAC,GAAoB,EAAE,MAAuB,EAAW,EAAE;IAC1E,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,eAAe,CAAC,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,CAAA;QAC9C,KAAK,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,CAAC,KAAK,CAAA;QAC5C,KAAK,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,CAAA;QAC1C,KAAK,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,CAAC,OAAO,CAAA;QAChD,KAAK,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,CAAA;IAC5C,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,IAAI,GAAG,CACX,SAAkB,EAAE,IAAc,EAAE,MAAuB,EACN,EAAE;IACvD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,qBAAqB,CAAC,aAAa,EAAE,CAAA;IACxD,CAAC;IAED,IAAI,MAAM,GAAY,SAAS,CAAA;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,qBAAqB,CAAC,WAAW,EAAE,CAAA;QACtD,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,KAAK,eAAe,CAAC,OAAO,IAAI,KAAK,KAAK,CAAC;YAC/D,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;YAC1B,CAAC,CAAC,UAAU,CAAA;QAEd,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;IAC1B,CAAC;IAED,IAAI,MAAM,KAAK,eAAe,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,MAAM,EAAE,qBAAqB,CAAC,SAAS,EAAE,CAAA;QACpD,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;IACpB,CAAC;IAED,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,qBAAqB,CAAC,WAAW,EAAE,CAAA;IACtD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;AAC1B,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,GAAoB,EAAE,QAA8B,EAC5B,EAAE;IAC1B,IAAI,MAAM,GAA0B,qBAAqB,CAAC,aAAa,CAAA;IAEvE,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAEjE,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,2FAA2F;YAC3F,2DAA2D;YAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,qBAAqB,CAAC,SAAS,EAAE,CAAC;gBACtD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;YAChD,CAAC;YACD,IAAI,MAAM,KAAK,qBAAqB,CAAC,aAAa,EAAE,CAAC;gBACnD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;YACxB,CAAC;YACD,SAAQ;QACV,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAClC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,OAAO,EAAE,MAAM,EAAE,qBAAqB,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QAClE,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IACpC,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,CAAA;AACnB,CAAC,CAAA"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/gate/validate.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAwB,MAAM,aAAa,CAAA;AAGvF,gDAAgD;AAChD,eAAO,MAAM,aAAa,
|
|
1
|
+
{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/gate/validate.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAwB,MAAM,aAAa,CAAA;AAGvF,gDAAgD;AAChD,eAAO,MAAM,aAAa,SAAU,MAAM,KAAG,MAAM,EAGH,CAAA;AA0FhD;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,WAAY,MAAM,EAAE,UAAU,cAAc,KAAG,cAAc,EAsB3F,CAAA"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/gate/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAElE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE3C,gDAAgD;AAChD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAY,EAAE,CACtD,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;KAC3B,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;KAC5C,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;AAOhD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,GAAG,CAAC,MAA0B,EAAE,GAAW,EAAW,EAAE;IACvE,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE,GAAG,MAAoB,CAAA;IACjE,IAAI,oBAAoB,KAAK,KAAK,EAAE,CAAC;QACnC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,UAAU,CAAC,CAAA;AACnD,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,KAAqB,EAAE,MAAuB,EAAsB,EAAE;IACvF,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,eAAe,CAAC,KAAK,
|
|
1
|
+
{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/gate/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAElE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE3C,gDAAgD;AAChD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAY,EAAE,CACtD,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;KAC3B,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;KAC5C,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;AAOhD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,GAAG,CAAC,MAA0B,EAAE,GAAW,EAAW,EAAE;IACvE,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE,GAAG,MAAoB,CAAA;IACjE,IAAI,oBAAoB,KAAK,KAAK,EAAE,CAAC;QACnC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,UAAU,CAAC,CAAA;AACnD,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,KAAqB,EAAE,MAAuB,EAAsB,EAAE;IACvF,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,eAAe,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE,KAAK,CAAA;QACtD,KAAK,eAAe,CAAC,IAAI,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,CAAA;QACpD,KAAK,eAAe,CAAC,OAAO,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE,OAAO,CAAA;QAC1D,KAAK,eAAe,CAAC,MAAM,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE,MAAM,CAAA;QACxD,KAAK,eAAe,CAAC,IAAI,EAAE,OAAO,SAAS,CAAA;IAC7C,CAAC;AACH,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CACpB,KAAqB,EAAE,QAA8B,EACf,EAAE;IACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC5B,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAChB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,+FAA+F;IAC/F,6FAA6F;IAC7F,sEAAsE;IACtE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW;WAChC,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAE3E,IAAI,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QAC5B,IAAI,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;YACpF,OAAO;gBACL,IAAI,EAAE,kBAAkB,CAAC,iBAAiB;gBAC1C,MAAM,EAAE,IAAI,GAAG,8BAA8B,KAAK,CAAC,SAAS,IAAI,GAAG,GAAG;sBAClE,6DAA6D;aAClE,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM,EAAE,CAAC;QAC/C,IAAI,WAAW,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;YAChG,OAAO;gBACL,IAAI,EAAE,kBAAkB,CAAC,iBAAiB;gBAC1C,MAAM,EAAE,IAAI,GAAG,8BAA8B,KAAK,CAAC,SAAS,IAAI,GAAG,GAAG;aACvE,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,WAAW,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO;YACL,IAAI,EAAE,kBAAkB,CAAC,cAAc;YACvC,MAAM,EAAE,OAAO,QAAQ,CAAC,MAAM,wBAAwB,GAAG,sCAAsC;kBAC3F,6DAA6D;SAClE,CAAA;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAgB,EAAE,KAAsB,EAAoB,EAAE;IAC/F,MAAM,MAAM,GAAqB,EAAE,CAAA;IAEnC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;QAEpC,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;YAC5E,SAAQ;QACV,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAC7C,SAAQ;QACV,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;QACnD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;QAClC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEtD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,
|
|
1
|
+
{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEtD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,SAAU,MAAM,KAAG,oBAsBlD,CAAA;AAED,uEAAuE;AACvE,eAAO,MAAM,qBAAqB,UACzB;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,KAC3C,MAEiE,CAAA;AAEpE,mGAAmG;AACnG,eAAO,MAAM,gBAAgB,UAAW,MAAM,KAAG,OACU,CAAA"}
|
package/build/utils.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAEnD,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,4FAA4F;IAC5F,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;GAGG;AACH,eAAO,MAAM,aAAa,
|
|
1
|
+
{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAEnD,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,4FAA4F;IAC5F,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;GAGG;AACH,eAAO,MAAM,aAAa,SAClB,aAAa,cACP,MAAM,SACX,oBAAoB,KAC1B,OAIO,CAAA"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@owlmeans/iam",
|
|
3
|
-
"version": "0.1.18-rc.
|
|
3
|
+
"version": "0.1.18-rc.16",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"scripts": {
|
|
@@ -22,11 +22,11 @@
|
|
|
22
22
|
}
|
|
23
23
|
},
|
|
24
24
|
"dependencies": {
|
|
25
|
-
"@owlmeans/auth": "^0.1.18-rc.
|
|
26
|
-
"@owlmeans/context": "^0.1.18-rc.
|
|
27
|
-
"@owlmeans/error": "^0.1.18-rc.
|
|
28
|
-
"@owlmeans/oidc": "^0.1.18-rc.
|
|
29
|
-
"@owlmeans/route": "^0.1.18-rc.
|
|
25
|
+
"@owlmeans/auth": "^0.1.18-rc.9",
|
|
26
|
+
"@owlmeans/context": "^0.1.18-rc.8",
|
|
27
|
+
"@owlmeans/error": "^0.1.18-rc.8",
|
|
28
|
+
"@owlmeans/oidc": "^0.1.18-rc.13",
|
|
29
|
+
"@owlmeans/route": "^0.1.18-rc.9"
|
|
30
30
|
},
|
|
31
31
|
"devDependencies": {
|
|
32
32
|
"@owlmeans/dep-config": "workspace:*",
|