@owlmeans/server-auth-identity 0.1.18-rc.43 → 0.1.18-rc.45
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +2 -2
- package/agent-meta/manifest.json +2 -2
- package/agent-meta/skills/server-auth-identity/SKILL.md +1 -1
- package/build/events.d.ts.map +1 -1
- package/build/events.js +3 -1
- package/build/events.js.map +1 -1
- package/build/service.d.ts.map +1 -1
- package/build/service.js +5 -0
- package/build/service.js.map +1 -1
- package/package.json +9 -8
- package/src/events.ts +4 -1
- package/src/service.ts +6 -0
- package/tests/events.spec.ts +7 -3
package/README.md
CHANGED
|
@@ -10,7 +10,7 @@ whose grants decide access (use `@owlmeans/server-oidc-rp`'s guard and gate, or
|
|
|
10
10
|
## Installation
|
|
11
11
|
|
|
12
12
|
```bash
|
|
13
|
-
bun add @owlmeans/server-auth-identity@^0.1.18-rc.
|
|
13
|
+
bun add @owlmeans/server-auth-identity@^0.1.18-rc.45
|
|
14
14
|
```
|
|
15
15
|
|
|
16
16
|
## Concepts
|
|
@@ -308,7 +308,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
|
|
|
308
308
|
your project's skill store (`.agents/skills/`):
|
|
309
309
|
|
|
310
310
|
```sh
|
|
311
|
-
npx @owlmeans/agent-skills@^0.1.18-rc.
|
|
311
|
+
npx @owlmeans/agent-skills@^0.1.18-rc.47
|
|
312
312
|
```
|
|
313
313
|
|
|
314
314
|
The embedded files are version-matched to this package release. Do not edit them
|
package/agent-meta/manifest.json
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schemaVersion": 2,
|
|
3
3
|
"package": "@owlmeans/server-auth-identity",
|
|
4
|
-
"version": "0.1.18-rc.
|
|
5
|
-
"generatedAt": "2026-10-
|
|
4
|
+
"version": "0.1.18-rc.45",
|
|
5
|
+
"generatedAt": "2026-10-03T20:05:07.583Z",
|
|
6
6
|
"canonicalRepo": "https://github.com/owlmeans/common",
|
|
7
7
|
"entries": [
|
|
8
8
|
{
|
|
@@ -8,7 +8,7 @@ user-invocable: false
|
|
|
8
8
|
# @owlmeans/server-auth-identity
|
|
9
9
|
|
|
10
10
|
**Layer:** Server
|
|
11
|
-
**Install:** `"@owlmeans/server-auth-identity": "^0.1.18-rc.
|
|
11
|
+
**Install:** `"@owlmeans/server-auth-identity": "^0.1.18-rc.45"` in `dependencies`
|
|
12
12
|
|
|
13
13
|
The identity store a deployment owns when it does not delegate identity to an external IAM. It
|
|
14
14
|
answers *who is this person* (account + credentials), *what are they in this app and organization*
|
package/build/events.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAGrD,OAAO,KAAK,EAC8B,qBAAqB,EAC9D,MAAM,YAAY,CAAA;
|
|
1
|
+
{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAGrD,OAAO,KAAK,EAC8B,qBAAqB,EAC9D,MAAM,YAAY,CAAA;AAKnB,eAAO,MAAM,yBAAyB,WAC7B,MAAM,KACZ,qBAuCF,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,cAAc,QACpB,YAAY,CAAC,GAAG,CAAC,UAAS,MAAM,KACpC,qBAAqB,GAAG,IAC+C,CAAA"}
|
package/build/events.js
CHANGED
|
@@ -1,5 +1,7 @@
|
|
|
1
1
|
import { createLazyService } from '@owlmeans/context';
|
|
2
2
|
import { AUTH_IDENTITY_EVENTS } from './consts.js';
|
|
3
|
+
import { logger } from '@owlmeans/log';
|
|
4
|
+
const log = logger('server-auth-identity');
|
|
3
5
|
export const makeIdentityEventsService = (alias = AUTH_IDENTITY_EVENTS) => {
|
|
4
6
|
const created = [];
|
|
5
7
|
const profiles = [];
|
|
@@ -13,7 +15,7 @@ export const makeIdentityEventsService = (alias = AUTH_IDENTITY_EVENTS) => {
|
|
|
13
15
|
await callback(event, service.assertCtx());
|
|
14
16
|
}
|
|
15
17
|
catch (error) {
|
|
16
|
-
|
|
18
|
+
log.error('Identity event listener failed', { alias, listener: what, error });
|
|
17
19
|
}
|
|
18
20
|
}
|
|
19
21
|
};
|
package/build/events.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"events.js","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;
|
|
1
|
+
{"version":3,"file":"events.js","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAIlD,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAEtC,MAAM,GAAG,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAA;AAE1C,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,KAAK,GAAW,oBAAoB,EACb,EAAE;IACzB,MAAM,OAAO,GAA4B,EAAE,CAAA;IAC3C,MAAM,QAAQ,GAA6B,EAAE,CAAA;IAE7C;;;OAGG;IACH,MAAM,OAAO,GAAG,KAAK,EACnB,SAAmE,EAAE,KAAQ,EAAE,IAAY,EAC5E,EAAE;QACjB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAA2C,CAAC,CAAA;YACrF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,GAAG,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAC/E,CAAC;QACH,CAAC;IACH,CAAC,CAAA;IAED,MAAM,OAAO,GAA0B,iBAAiB,CAAwB,KAAK,EAAE;QACrF,eAAe,EAAE,QAAQ,CAAC,EAAE;YAC1B,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACxB,CAAC;QAED,sBAAsB,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YACpC,MAAM,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,kBAAkB,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAA;QACpE,CAAC;QAED,gBAAgB,EAAE,QAAQ,CAAC,EAAE;YAC3B,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACzB,CAAC;QAED,uBAAuB,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YACrC,MAAM,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,mBAAmB,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAA;QACvF,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,GAAsB,EAAE,KAAK,GAAW,oBAAoB,EAC9B,EAAE,CAChC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAwB,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA"}
|
package/build/service.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACkF,sBAAsB,EAClH,wBAAwB,EACzB,MAAM,YAAY,CAAA;
|
|
1
|
+
{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACkF,sBAAsB,EAClH,wBAAwB,EACzB,MAAM,YAAY,CAAA;AAenB;;;GAGG;AACH,eAAO,MAAM,0BAA0B,UAAU,wBAAwB,KAAQ,sBAwJhF,CAAA"}
|
package/build/service.js
CHANGED
|
@@ -4,6 +4,8 @@ import { ENTITY_RESOLVER } from '@owlmeans/auth-common';
|
|
|
4
4
|
import { AUTH_IDENTITY_ACCOUNT, AUTH_IDENTITY_PROFILE, AUTH_IDENTITY_CREDENTIALS, AUTH_IDENTITY_LINKING, DEFAULT_APP_SERVICE, } from './consts.js';
|
|
5
5
|
import { identityEvents } from './events.js';
|
|
6
6
|
import { credentialKeyOf, credentialOf, ensureAccount, ensureProfile, profileIdOf } from './identity.js';
|
|
7
|
+
import { logger } from '@owlmeans/log';
|
|
8
|
+
const log = logger('server-auth-identity');
|
|
7
9
|
/**
|
|
8
10
|
* The deployment's own sign-in over the identity store: every payload names the row of THIS
|
|
9
11
|
* deployment's app (`opts.service`) in the account's main organization.
|
|
@@ -84,6 +86,9 @@ export const makeIdentityLinkingService = (opts = {}) => {
|
|
|
84
86
|
}
|
|
85
87
|
const linked = (await credentialOf(ctx, details))?.account;
|
|
86
88
|
if (linked != null && linked.id !== account.id) {
|
|
89
|
+
log.warn('Credential link refused: the method signs into another account', {
|
|
90
|
+
method: details.type, service: details.service, accountId: account.id, reason: 'linked-elsewhere',
|
|
91
|
+
}, { event: 'auth.refused' });
|
|
87
92
|
throw new Error('Cannot link credentials: the method signs into another account');
|
|
88
93
|
}
|
|
89
94
|
// By the account's own address, so the method is attached to exactly this account.
|
package/build/service.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAGpD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAS3C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EACL,qBAAqB,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,mBAAmB,GACpH,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;
|
|
1
|
+
{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAGpD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAS3C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EACL,qBAAqB,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,mBAAmB,GACpH,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AACxG,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAItC,MAAM,GAAG,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAA;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,IAAI,GAA6B,EAAE,EAA0B,EAAE;IACxG,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,mBAAmB,CAAA;IAE/C;;;;;;OAMG;IACH,MAAM,MAAM,GAAG,KAAK,EAAE,QAAgB,EAA+B,EAAE;QACrE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;QAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAEvF,OAAO,MAAM,EAAE,IAAI,CAAA;IACrB,CAAC,CAAA;IAED,MAAM,SAAS,GAAG,KAAK,EAAE,IAAY,EAAE,OAAwB,EAAwB,EAAE,CAAC,CAAC;QACzF,IAAI;QACJ,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAA;IAEF,MAAM,OAAO,GAA2B,gBAAgB,CAAyB,qBAAqB,EAAE;QACtG,gBAAgB,EAAE,KAAK,EAAE,OAA+B,EAA+B,EAAE;YACvF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;YAClC,MAAM,OAAO,GAAG,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO,CAAA;YAC3D,IAAI,OAAO,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAA;YAEhC,4FAA4F;YAC5F,mFAAmF;YACnF,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAC,IAAI,CAAC;gBACtF,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ;aACpE,CAAC,CAAA;YAEF,OAAO,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACxE,CAAC;QAED,WAAW,EAAE,KAAK,EAAE,OAA+B,EAAE,IAAiB,EAAwB,EAAE;YAC9F,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;YAClC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE;gBACvD,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtF,EAAE,OAAO,CAAC,CAAA;YACX,4FAA4F;YAC5F,mCAAmC;YACnC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE;gBACvC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC;aACrF,CAAC,CAAA;YAEF,0FAA0F;YAC1F,iEAAiE;YACjE,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,cAAc,CAAC,GAAG,CAAC,EAAE,sBAAsB,CAAC;oBAChD,QAAQ,EAAE,UAAU,CAAC,EAAG;oBACxB,UAAU,EAAE,UAAU,CAAC,IAAI;oBAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,SAAS,EAAE,OAAO,CAAC,EAAE;oBACrB,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,QAAQ,EAAE,OAAO,CAAC,KAAK;oBACvB,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,cAAc,EAAE,GAAG;oBACnB,SAAS,EAAE,UAAU,CAAC,SAAS;iBAChC,CAAC,CAAA;YACJ,CAAC;YAED,OAAO,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAC/C,CAAC;QAED,eAAe,EAAE,KAAK,EAAE,OAA+B,EAAwB,EAAE;YAC/E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;YAClC,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;gBAC9B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC;qBAC3E,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;gBACzC,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI;oBACzB,CAAC,CAAC,MAAM,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;oBACrF,CAAC,CAAC,IAAI,CAAA;gBACR,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;oBACpB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;gBAC/D,CAAC;gBACD,MAAM,MAAM,GAAG,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO,CAAA;gBAC1D,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;oBAC/C,GAAG,CAAC,IAAI,CAAC,gEAAgE,EAAE;wBACzE,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,kBAAkB;qBAClG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAA;oBAC7B,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;gBACnF,CAAC;gBACD,mFAAmF;gBACnF,MAAM,aAAa,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAA;YAC7D,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAA;YACtD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;YAC/D,CAAC;YAED,OAAO,MAAM,CAAA;QACf,CAAC;QAED,iBAAiB,EAAE,KAAK,EAAE,OAA+B,EAAiB,EAAE;YAC1E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;YAClC,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAA8B,yBAAyB,CAAC,CAAA;YAC1F,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;YAC/D,IAAI,IAAI,EAAE,EAAE,IAAI,IAAI;gBAAE,OAAM;YAC5B,MAAM,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACrC,CAAC;QAED,gBAAgB,EAAE,KAAK,EAAE,QAAgB,EAAsB,EAAE;YAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;YAClC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC;iBAC3F,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;YAChD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAA;YAEzC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxB,EAAE,EAAE,CAAC,CAAC,SAAS;gBACf,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,UAAU;gBACV,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,UAAU,EAAE,CAAC,CAAC,UAAU;aACzB,CAAC,CAAC,CAAA;QACL,CAAC;QAED,mBAAmB,EAAE,KAAK,EAAE,MAAc,EAAE,QAAiB,EAAE,IAAa,EAAwC,EAAE;YACpH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;YAClC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAC/F,IAAI,OAAO,IAAI,IAAI;gBAAE,OAAO,SAAS,CAAA;YAErC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAC,IAAI,CAAC;gBACtF,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,IAAI,OAAO,CAAC,QAAQ;aAChF,CAAC,CAAA;YACF,IAAI,OAAO,IAAI,IAAI;gBAAE,OAAO,SAAS,CAAA;YAErC,MAAM,WAAW,GAAkC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAA;YAC5E,IAAI,IAAI,IAAI,IAAI;gBAAE,WAAW,CAAC,IAAI,GAAG,IAAI,CAAA;YACzC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,CAA8B,yBAAyB,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YACzG,IAAI,IAAI,IAAI,IAAI;gBAAE,OAAO,SAAS,CAAA;YAElC,OAAO;gBACL,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;gBACtC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAA;QACH,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@owlmeans/server-auth-identity",
|
|
3
|
-
"version": "0.1.18-rc.
|
|
3
|
+
"version": "0.1.18-rc.45",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"scripts": {
|
|
@@ -22,14 +22,15 @@
|
|
|
22
22
|
}
|
|
23
23
|
},
|
|
24
24
|
"dependencies": {
|
|
25
|
-
"@owlmeans/auth": "^0.1.18-rc.
|
|
26
|
-
"@owlmeans/auth-common": "^0.1.18-rc.
|
|
27
|
-
"@owlmeans/basic-ids": "^0.1.18-rc.
|
|
25
|
+
"@owlmeans/auth": "^0.1.18-rc.38",
|
|
26
|
+
"@owlmeans/auth-common": "^0.1.18-rc.45",
|
|
27
|
+
"@owlmeans/basic-ids": "^0.1.18-rc.35",
|
|
28
28
|
"@owlmeans/context": "^0.1.18-rc.32",
|
|
29
|
-
"@owlmeans/
|
|
30
|
-
"@owlmeans/
|
|
31
|
-
"@owlmeans/
|
|
32
|
-
"@owlmeans/
|
|
29
|
+
"@owlmeans/log": "^0.1.18-rc.0",
|
|
30
|
+
"@owlmeans/mongo-resource": "^0.1.18-rc.41",
|
|
31
|
+
"@owlmeans/oidc": "^0.1.18-rc.53",
|
|
32
|
+
"@owlmeans/resource": "^0.1.18-rc.38",
|
|
33
|
+
"@owlmeans/server-context": "^0.1.18-rc.41",
|
|
33
34
|
"@scure/base": "^2.3.0"
|
|
34
35
|
},
|
|
35
36
|
"peerDependencies": {
|
package/src/events.ts
CHANGED
|
@@ -4,6 +4,9 @@ import { AUTH_IDENTITY_EVENTS } from './consts.js'
|
|
|
4
4
|
import type {
|
|
5
5
|
EntityCreatedCallback, IdentityContext, IdentityEventsService, ProfileCreatedCallback,
|
|
6
6
|
} from './types.js'
|
|
7
|
+
import { logger } from '@owlmeans/log'
|
|
8
|
+
|
|
9
|
+
const log = logger('server-auth-identity')
|
|
7
10
|
|
|
8
11
|
export const makeIdentityEventsService = (
|
|
9
12
|
alias: string = AUTH_IDENTITY_EVENTS
|
|
@@ -22,7 +25,7 @@ export const makeIdentityEventsService = (
|
|
|
22
25
|
try {
|
|
23
26
|
await callback(event, service.assertCtx<IdentityContext['cfg'], IdentityContext>())
|
|
24
27
|
} catch (error) {
|
|
25
|
-
|
|
28
|
+
log.error('Identity event listener failed', { alias, listener: what, error })
|
|
26
29
|
}
|
|
27
30
|
}
|
|
28
31
|
}
|
package/src/service.ts
CHANGED
|
@@ -16,9 +16,12 @@ import {
|
|
|
16
16
|
} from './consts.js'
|
|
17
17
|
import { identityEvents } from './events.js'
|
|
18
18
|
import { credentialKeyOf, credentialOf, ensureAccount, ensureProfile, profileIdOf } from './identity.js'
|
|
19
|
+
import { logger } from '@owlmeans/log'
|
|
19
20
|
|
|
20
21
|
type Context = ServerContext<ServerConfig>
|
|
21
22
|
|
|
23
|
+
const log = logger('server-auth-identity')
|
|
24
|
+
|
|
22
25
|
/**
|
|
23
26
|
* The deployment's own sign-in over the identity store: every payload names the row of THIS
|
|
24
27
|
* deployment's app (`opts.service`) in the account's main organization.
|
|
@@ -108,6 +111,9 @@ export const makeIdentityLinkingService = (opts: IdentityResourcesOptions = {}):
|
|
|
108
111
|
}
|
|
109
112
|
const linked = (await credentialOf(ctx, details))?.account
|
|
110
113
|
if (linked != null && linked.id !== account.id) {
|
|
114
|
+
log.warn('Credential link refused: the method signs into another account', {
|
|
115
|
+
method: details.type, service: details.service, accountId: account.id, reason: 'linked-elsewhere',
|
|
116
|
+
}, { event: 'auth.refused' })
|
|
111
117
|
throw new Error('Cannot link credentials: the method signs into another account')
|
|
112
118
|
}
|
|
113
119
|
// By the account's own address, so the method is attached to exactly this account.
|
package/tests/events.spec.ts
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import { describe, expect, test } from 'bun:test'
|
|
2
|
+
import { addLogPlugin, memoryPlugin, removeLogPlugin } from '@owlmeans/log'
|
|
2
3
|
import { AuthenticationType } from '@owlmeans/auth'
|
|
3
4
|
import { makeServerContext, config as serverConfig } from '@owlmeans/server-context'
|
|
4
5
|
import type { ServerConfig } from '@owlmeans/server-context'
|
|
@@ -63,16 +64,19 @@ describe('identity events', () => {
|
|
|
63
64
|
events.onEntityCreated(async event => { reached.push(event.entityId) })
|
|
64
65
|
events.onProfileCreated(async () => { throw new Error('plans are down') })
|
|
65
66
|
events.onProfileCreated(async event => { reached.push(event.profileId) })
|
|
66
|
-
const
|
|
67
|
-
|
|
67
|
+
const memory = memoryPlugin('identity-events')
|
|
68
|
+
addLogPlugin(memory)
|
|
68
69
|
|
|
69
70
|
try {
|
|
70
71
|
const payload = await linking.linkProfile(details('google-oauth', 'google-sub'), { username: 'person@example.org' })
|
|
71
72
|
|
|
72
73
|
expect(payload.profileId).toStartWith('app:')
|
|
73
74
|
expect(reached).toHaveLength(2)
|
|
75
|
+
// Each failed listener is logged, with its error, rather than failing the sign-in.
|
|
76
|
+
const failed = memory.records.filter(record => record.level === 'error' && record.scope === 'server-auth-identity')
|
|
77
|
+
expect(failed.map(record => record.error?.message).sort()).toEqual(['plans are down', 'provisioning is down'])
|
|
74
78
|
} finally {
|
|
75
|
-
|
|
79
|
+
removeLogPlugin('identity-events')
|
|
76
80
|
}
|
|
77
81
|
})
|
|
78
82
|
|