@owlmeans/server-auth-identity 0.1.3

package/README.md

@@ -0,0 +1,94 @@
+# @owlmeans/server-auth-identity
+
+Mongo-backed local identity resources and provider account linking for OwlMeans server applications.
+
+## Overview
+
+- Registers three Mongo resources: local accounts, local profiles, and provider credentials.
+- Provides `IdentityLinkingService` to map external provider profile details into an OwlMeans `AuthPayload`.
+- Keeps external provider identity separate from local product identity and authorization scopes.
+- Designed to work with `@owlmeans/server-auth`, `@owlmeans/server-oidc-rp`, and product-specific module gates.
+
+## Installation
+
+```bash
+bun add @owlmeans/server-auth-identity
+```
+
+## Usage
+
+Register identity resources in a server context after Mongo and auth services are available:
+
+```typescript
+import { appendAuthIdentityResources } from '@owlmeans/server-auth-identity'
+
+appendAuthIdentityResources(context)
+```
+
+Link an external provider profile to a local account/profile:
+
+```typescript
+import { AUTH_IDENTITY_LINKING } from '@owlmeans/server-auth-identity'
+import type { IdentityLinkingService } from '@owlmeans/server-auth-identity'
+
+const linking = context.service<IdentityLinkingService>(AUTH_IDENTITY_LINKING)
+
+const auth = await linking.linkProfile(providerDetails, { username })
+```
+
+Read identity profiles without mutating records:
+
+```typescript
+import { AUTH_IDENTITY_PROFILE } from '@owlmeans/server-auth-identity'
+import type { IdentityProfileResource } from '@owlmeans/server-auth-identity'
+
+const profiles = context.resource<IdentityProfileResource>(AUTH_IDENTITY_PROFILE)
+const profile = await profiles.load(profileId, 'profileId')
+
+const { items } = await profiles.list({ entityId, profileId } as any)
+```
+
+## API
+
+### Resource Factories
+
+- `makeIdentityAccountResource(dbAlias?)` - local account record, one per user.
+- `makeIdentityProfileResource(dbAlias?)` - local profile record with `entityId`, `role`, `scopes`, and optional expiry.
+- `makeIdentityCredentialsResource(dbAlias?)` - provider credentials link record.
+- `appendAuthIdentityResources(context, dbAlias?)` - registers all resources and `IdentityLinkingService`.
+
+### Aliases
+
+- `AUTH_IDENTITY_ACCOUNT` - account resource alias.
+- `AUTH_IDENTITY_PROFILE` - profile resource alias.
+- `AUTH_IDENTITY_CREDENTIALS` - provider credentials resource alias.
+- `AUTH_IDENTITY_LINKING` - linking service alias.
+
+### Types
+
+- `IdentityAccount` - `Profile & ResourceRecord`; `credential` is the generated local entity slug.
+- `IdentityProfile` - `Profile & ResourceRecord`; includes `profileId`, `userId?`, `role`, `entityId`, `scopes`, `expiresAt?`.
+- `IdentityCredentials` - `AuthCredentials & ResourceRecord`; includes `profileId` and derived provider keys.
+- `IdentityLinkingService` - `getLinkedProfile`, `linkProfile`, `linkCredentials`, `getOwnerProfiles`, `getOwnerCredentials`.
+
+## Key Derivation
+
+- Account `credential`: generated Base58 local entity slug.
+- Profile `profileId`: `"{type}:{accountId}"`.
+- Credentials `userId`: `"{type}:{service}:{providerSub}"`.
+- Credentials `credential`: `"service:{type}:{service}"`.
+
+## Product-Viable Integration Notes
+
+- Google/OIDC login is only the provider bootstrap path; durable authorization data lives in `IdentityProfile`.
+- Backend contexts should register `appendAuthService(context)`, then `appendAuthIdentityResources(context)`, then product gate services.
+- Product gates should read `AUTH_IDENTITY_PROFILE`, verify `entityId`, reject expired or blocked profiles, and compare gate params against profile scopes.
+- `Resource.pick()` is destructive and deletes the matching record. Never use `pick()` for gate or handler reads; use `load()` or `list()`.
+
+## Related Packages
+
+- [`@owlmeans/auth`](../auth) - core `AuthPayload`, `AuthRole`, `Profile`, and auth errors.
+- [`@owlmeans/server-auth`](../server-auth) - bearer verification and default auth guard.
+- [`@owlmeans/server-oidc-rp`](../server-oidc-rp) - provider exchange and account-linking interface compatibility.
+- [`@owlmeans/oidc`](../oidc) - `ProviderProfileDetails` and provider config types.
+- [`@owlmeans/mongo-resource`](../mongo-resource) - Mongo-backed resource implementation.

package/build/consts.d.ts

@@ -0,0 +1,7 @@
+export declare const AUTH_IDENTITY_ACCOUNT = "auth-identity:account";
+export declare const AUTH_IDENTITY_PROFILE = "auth-identity:profile";
+export declare const AUTH_IDENTITY_CREDENTIALS = "auth-identity:credentials";
+export declare const AUTH_IDENTITY_LINKING = "auth-identity:linking";
+export declare const LOGIN_SERVICE_PREFIX = "service";
+export declare const EXTERNAL_KEY_DELIMITER = ":";
+//# sourceMappingURL=consts.d.ts.map

package/build/consts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,qBAAqB,0BAA0B,CAAA;AAC5D,eAAO,MAAM,qBAAqB,0BAA0B,CAAA;AAC5D,eAAO,MAAM,yBAAyB,8BAA8B,CAAA;AACpE,eAAO,MAAM,qBAAqB,0BAA0B,CAAA;AAG5D,eAAO,MAAM,oBAAoB,YAAY,CAAA;AAC7C,eAAO,MAAM,sBAAsB,MAAM,CAAA"}

package/build/consts.js

@@ -0,0 +1,8 @@
+export const AUTH_IDENTITY_ACCOUNT = 'auth-identity:account';
+export const AUTH_IDENTITY_PROFILE = 'auth-identity:profile';
+export const AUTH_IDENTITY_CREDENTIALS = 'auth-identity:credentials';
+export const AUTH_IDENTITY_LINKING = 'auth-identity:linking';
+// Helper prefixes for stable key derivation
+export const LOGIN_SERVICE_PREFIX = 'service';
+export const EXTERNAL_KEY_DELIMITER = ':';
+//# sourceMappingURL=consts.js.map

package/build/consts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAA;AAC5D,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAA;AAC5D,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAA2B,CAAA;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAA;AAE5D,4CAA4C;AAC5C,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAS,CAAA;AAC7C,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAA"}

package/build/helper.d.ts

@@ -0,0 +1,3 @@
+import type { BasicContext } from '@owlmeans/context';
+export declare const appendAuthIdentityResources: (context: BasicContext<any>, dbAlias?: string) => void;
+//# sourceMappingURL=helper.d.ts.map

package/build/helper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAIrD,eAAO,MAAM,2BAA2B,GACtC,SAAS,YAAY,CAAC,GAAG,CAAC,EAC1B,UAAU,MAAM,KACf,IAKF,CAAA"}

package/build/helper.js

@@ -0,0 +1,9 @@
+import { makeIdentityAccountResource, makeIdentityProfileResource, makeIdentityCredentialsResource } from './resource.js';
+import { makeIdentityLinkingService } from './service.js';
+export const appendAuthIdentityResources = (context, dbAlias) => {
+    context.registerResource(makeIdentityAccountResource(dbAlias));
+    context.registerResource(makeIdentityProfileResource(dbAlias));
+    context.registerResource(makeIdentityCredentialsResource(dbAlias));
+    context.registerService(makeIdentityLinkingService());
+};
+//# sourceMappingURL=helper.js.map

package/build/helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helper.js","sourceRoot":"","sources":["../src/helper.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,+BAA+B,EAAE,MAAM,eAAe,CAAA;AACzH,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAEzD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,OAA0B,EAC1B,OAAgB,EACV,EAAE;IACR,OAAO,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAA;IAC9D,OAAO,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAA;IAC9D,OAAO,CAAC,gBAAgB,CAAC,+BAA+B,CAAC,OAAO,CAAC,CAAC,CAAA;IAClE,OAAO,CAAC,eAAe,CAAC,0BAA0B,EAAE,CAAC,CAAA;AACvD,CAAC,CAAA"}

package/build/index.d.ts

@@ -0,0 +1,6 @@
+export * from './consts.js';
+export type * from './types.js';
+export * from './resource.js';
+export * from './service.js';
+export * from './helper.js';
+//# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,mBAAmB,YAAY,CAAA;AAC/B,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA"}

package/build/index.js

@@ -0,0 +1,5 @@
+export * from './consts.js';
+export * from './resource.js';
+export * from './service.js';
+export * from './helper.js';
+//# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAE3B,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA"}

package/build/resource.d.ts

@@ -0,0 +1,5 @@
+import type { IdentityAccountResource, IdentityProfileResource, IdentityCredentialsResource } from './types.js';
+export declare const makeIdentityAccountResource: (dbAlias?: string) => IdentityAccountResource;
+export declare const makeIdentityProfileResource: (dbAlias?: string) => IdentityProfileResource;
+export declare const makeIdentityCredentialsResource: (dbAlias?: string) => IdentityCredentialsResource;
+//# sourceMappingURL=resource.d.ts.map

package/build/resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../src/resource.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAmB,uBAAuB,EAAmB,uBAAuB,EAAuB,2BAA2B,EAAE,MAAM,YAAY,CAAA;AAGtK,eAAO,MAAM,2BAA2B,GAAI,UAAU,MAAM,KAAG,uBAQ9D,CAAA;AAED,eAAO,MAAM,2BAA2B,GAAI,UAAU,MAAM,KAAG,uBAS9D,CAAA;AAED,eAAO,MAAM,+BAA+B,GAAI,UAAU,MAAM,KAAG,2BAOlE,CAAA"}

package/build/resource.js

@@ -0,0 +1,24 @@
+import { makeMongoResource } from '@owlmeans/mongo-resource';
+import { AUTH_IDENTITY_ACCOUNT, AUTH_IDENTITY_PROFILE, AUTH_IDENTITY_CREDENTIALS } from './consts.js';
+export const makeIdentityAccountResource = (dbAlias) => {
+    const resource = makeMongoResource(AUTH_IDENTITY_ACCOUNT, dbAlias);
+    resource.index('credential', { credential: 1 }, { unique: true });
+    resource.index('entityId', { entityId: 1 });
+    resource.index('secret', { secret: 1 }, { unique: true, sparse: true });
+    return resource;
+};
+export const makeIdentityProfileResource = (dbAlias) => {
+    const resource = makeMongoResource(AUTH_IDENTITY_PROFILE, dbAlias);
+    resource.index('userId', { userId: 1 });
+    resource.index('entityId', { entityId: 1 });
+    resource.index('role', { role: 1, entityId: 1 });
+    resource.index('profile', { profileId: 1, entityId: 1 }, { unique: true });
+    return resource;
+};
+export const makeIdentityCredentialsResource = (dbAlias) => {
+    const resource = makeMongoResource(AUTH_IDENTITY_CREDENTIALS, dbAlias);
+    resource.index('provider', { type: 1, userId: 1, credential: 1 }, { unique: true });
+    resource.index('profileId', { profileId: 1 });
+    return resource;
+};
+//# sourceMappingURL=resource.js.map

package/build/resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.js","sourceRoot":"","sources":["../src/resource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE5D,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAA;AAErG,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,OAAgB,EAA2B,EAAE;IACvF,MAAM,QAAQ,GAAG,iBAAiB,CAChC,qBAAqB,EAAE,OAAO,CAC/B,CAAA;IACD,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACjE,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;IAC3C,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACvE,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,OAAgB,EAA2B,EAAE;IACvF,MAAM,QAAQ,GAAG,iBAAiB,CAChC,qBAAqB,EAAE,OAAO,CAC/B,CAAA;IACD,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;IACvC,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;IAC3C,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;IAChD,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1E,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,OAAgB,EAA+B,EAAE;IAC/F,MAAM,QAAQ,GAAG,iBAAiB,CAChC,yBAAyB,EAAE,OAAO,CACnC,CAAA;IACD,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACnF,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAA;IAC7C,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA"}

package/build/service.d.ts

@@ -0,0 +1,3 @@
+import type { IdentityLinkingService } from './types.js';
+export declare const makeIdentityLinkingService: () => IdentityLinkingService;
+//# sourceMappingURL=service.d.ts.map

package/build/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAA8F,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAepJ,eAAO,MAAM,0BAA0B,QAAO,sBA6K7C,CAAA"}

package/build/service.js

@@ -0,0 +1,173 @@
+import { appendContextual } from '@owlmeans/context';
+import { ALL_SCOPES, AuthRole } from '@owlmeans/auth';
+import { createIdOfLength, IdStyle } from '@owlmeans/basic-ids';
+import { AUTH_IDENTITY_ACCOUNT, AUTH_IDENTITY_PROFILE, AUTH_IDENTITY_CREDENTIALS, AUTH_IDENTITY_LINKING, LOGIN_SERVICE_PREFIX, EXTERNAL_KEY_DELIMITER } from './consts.js';
+const MAX_SLUG_RETRIES = 5;
+// Stable external login key: "{type}:{service}:{providerSub}"
+const externalKey = (details) => [details.type, details.service, details.userId].join(EXTERNAL_KEY_DELIMITER);
+// Login-service credential stored on profile and credentials: "service:{type}:{service}"
+const loginService = (details) => [LOGIN_SERVICE_PREFIX, details.type, details.service].join(EXTERNAL_KEY_DELIMITER);
+export const makeIdentityLinkingService = () => {
+    const service = appendContextual(AUTH_IDENTITY_LINKING, {
+        getLinkedProfile: async (details) => {
+            const ctx = service.ctx;
+            const credsResource = ctx.resource(AUTH_IDENTITY_CREDENTIALS);
+            const { items: creds } = await credsResource.list({
+                criteria: {
+                    type: details.type,
+                    userId: externalKey(details),
+                    credential: loginService(details),
+                }
+            });
+            const cred = creds[0] ?? null;
+            if (cred == null)
+                return null;
+            const profileResource = ctx.resource(AUTH_IDENTITY_PROFILE);
+            const profile = await profileResource.load(cred.profileId, 'profileId');
+            if (profile == null)
+                return null;
+            return {
+                type: details.type,
+                role: profile.role,
+                userId: profile.userId ?? profile.profileId,
+                profileId: profile.profileId,
+                entityId: profile.entityId,
+                scopes: profile.scopes,
+            };
+        },
+        linkProfile: async (details, meta) => {
+            const ctx = service.ctx;
+            const accountResource = ctx.resource(AUTH_IDENTITY_ACCOUNT);
+            const profileResource = ctx.resource(AUTH_IDENTITY_PROFILE);
+            const credsResource = ctx.resource(AUTH_IDENTITY_CREDENTIALS);
+            // Generate a unique local entity slug stored as the account credential.
+            let accountId = null;
+            let entityId = null;
+            for (let i = 0; i < MAX_SLUG_RETRIES; i++) {
+                const credential = createIdOfLength(16, IdStyle.Base58);
+                try {
+                    const account = await accountResource.create({
+                        credential,
+                        name: meta.username,
+                        entityId: credential,
+                    });
+                    accountId = account.id;
+                    entityId = account.credential;
+                    break;
+                }
+                catch (err) {
+                    if (err?.code === 11000 || err?.message?.includes('duplicate'))
+                        continue;
+                    throw err;
+                }
+            }
+            if (accountId == null || entityId == null) {
+                throw new Error('Failed to generate unique account credential after retries');
+            }
+            const profileId = [details.type, accountId].join(EXTERNAL_KEY_DELIMITER);
+            const svc = loginService(details);
+            let profile;
+            try {
+                profile = await profileResource.create({
+                    profileId,
+                    userId: accountId,
+                    credential: svc,
+                    role: AuthRole.User,
+                    name: meta.username,
+                    entityId,
+                    scopes: [ALL_SCOPES],
+                });
+            }
+            catch (err) {
+                if (err?.code === 11000 || err?.message?.includes('duplicate')) {
+                    profile = await profileResource.get(profileId, 'profileId');
+                }
+                else {
+                    throw err;
+                }
+            }
+            await credsResource.create({
+                challenge: '',
+                type: details.type,
+                userId: externalKey(details),
+                profileId,
+                credential: svc,
+            });
+            return {
+                type: details.type,
+                role: profile.role,
+                userId: profile.userId ?? profile.profileId,
+                profileId: profile.profileId,
+                entityId: profile.entityId,
+                scopes: profile.scopes,
+            };
+        },
+        linkCredentials: async (details) => {
+            const result = await service.getLinkedProfile(details);
+            if (result == null) {
+                throw new Error('Cannot link credentials: profile not found');
+            }
+            if (details.profileId != null) {
+                const ctx = service.ctx;
+                const credsResource = ctx.resource(AUTH_IDENTITY_CREDENTIALS);
+                await credsResource.create({
+                    challenge: '',
+                    type: details.type,
+                    userId: externalKey(details),
+                    profileId: details.profileId,
+                    credential: loginService(details),
+                });
+            }
+            return result;
+        },
+        getOwnerProfiles: async (entityId) => {
+            const ctx = service.ctx;
+            const profileResource = ctx.resource(AUTH_IDENTITY_PROFILE);
+            const { items: profiles } = await profileResource.list({ criteria: { entityId } });
+            return profiles.map(p => ({
+                id: p.profileId,
+                name: p.name,
+                credential: p.credential,
+                entityId: p.entityId,
+                scopes: p.scopes,
+                groups: p.groups,
+                permissions: p.permissions,
+                attributes: p.attributes,
+            }));
+        },
+        getOwnerCredentials: async (userId, entityId, type) => {
+            const ctx = service.ctx;
+            const profileResource = ctx.resource(AUTH_IDENTITY_PROFILE);
+            const credsResource = ctx.resource(AUTH_IDENTITY_CREDENTIALS);
+            const profileFilter = { userId };
+            if (entityId != null)
+                profileFilter.entityId = entityId;
+            const { items: profiles } = await profileResource.list(profileFilter);
+            if (profiles.length === 0)
+                return undefined;
+            const credsFilter = {
+                profileId: { $in: profiles.map(p => p.profileId) }
+            };
+            if (type != null)
+                credsFilter.type = type;
+            const { items: creds } = await credsResource.list(credsFilter);
+            if (creds.length === 0)
+                return undefined;
+            const cred = creds[0];
+            const profile = profiles.find(p => p.profileId === cred.profileId) ?? profiles[0];
+            return {
+                type: cred.type,
+                role: profile.role,
+                userId: profile.userId ?? profile.profileId,
+                profileId: profile.profileId,
+                entityId: profile.entityId,
+                scopes: profile.scopes,
+                challenge: cred.challenge,
+                credential: cred.credential,
+                publicKey: cred.publicKey,
+            };
+        },
+    });
+    return service;
+};
+//# sourceMappingURL=service.js.map

package/build/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAGpD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAErD,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAE/D,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAI1K,MAAM,gBAAgB,GAAG,CAAC,CAAA;AAE1B,8DAA8D;AAC9D,MAAM,WAAW,GAAG,CAAC,OAA+B,EAAU,EAAE,CAC9D,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;AAE9E,yFAAyF;AACzF,MAAM,YAAY,GAAG,CAAC,OAA+B,EAAU,EAAE,CAC/D,CAAC,oBAAoB,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;AAEpF,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAA2B,EAAE;IACrE,MAAM,OAAO,GAA2B,gBAAgB,CAAyB,qBAAqB,EAAE;QACtG,gBAAgB,EAAE,KAAK,EAAE,OAA+B,EAA+B,EAAE;YACvF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;YAClC,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAA8B,yBAAyB,CAAC,CAAA;YAE1F,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC;gBAChD,QAAQ,EAAE;oBACR,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC;oBAC5B,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC;iBAClC;aACF,CAAC,CAAA;YACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;YAC7B,IAAI,IAAI,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAA;YAE7B,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;YACpF,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;YACvE,IAAI,OAAO,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAA;YAEhC,OAAO;gBACL,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS;gBAC3C,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAA;QACH,CAAC;QAED,WAAW,EAAE,KAAK,EAAE,OAA+B,EAAE,IAAiB,EAAwB,EAAE;YAC9F,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;YAClC,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;YACpF,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;YACpF,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAA8B,yBAAyB,CAAC,CAAA;YAE1F,wEAAwE;YACxE,IAAI,SAAS,GAAkB,IAAI,CAAA;YACnC,IAAI,QAAQ,GAAkB,IAAI,CAAA;YAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,gBAAgB,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC1C,MAAM,UAAU,GAAG,gBAAgB,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;gBACvD,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC;wBAC3C,UAAU;wBACV,IAAI,EAAE,IAAI,CAAC,QAAQ;wBACnB,QAAQ,EAAE,UAAU;qBACrB,CAAC,CAAA;oBACF,SAAS,GAAG,OAAO,CAAC,EAAE,CAAA;oBACtB,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAA;oBAC7B,MAAK;gBACP,CAAC;gBAAC,OAAO,GAAQ,EAAE,CAAC;oBAClB,IAAI,GAAG,EAAE,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC;wBAAE,SAAQ;oBACxE,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YAED,IAAI,SAAS,IAAI,IAAI,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;YAC/E,CAAC;YAED,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;YACxE,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;YAEjC,IAAI,OAAO,CAAA;YACX,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC;oBACrC,SAAS;oBACT,MAAM,EAAE,SAAS;oBACjB,UAAU,EAAE,GAAG;oBACf,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,IAAI,EAAE,IAAI,CAAC,QAAQ;oBACnB,QAAQ;oBACR,MAAM,EAAE,CAAC,UAAU,CAAC;iBACrB,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,IAAI,GAAG,EAAE,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC/D,OAAO,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;gBAC7D,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YAED,MAAM,aAAa,CAAC,MAAM,CAAC;gBACzB,SAAS,EAAE,EAAE;gBACb,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC;gBAC5B,SAAS;gBACT,UAAU,EAAE,GAAG;aAChB,CAAC,CAAA;YAEF,OAAO;gBACL,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS;gBAC3C,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAA;QACH,CAAC;QAED,eAAe,EAAE,KAAK,EAAE,OAA+B,EAAwB,EAAE;YAC/E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAA;YACtD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;YAC/D,CAAC;YAED,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;gBAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;gBAClC,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAA8B,yBAAyB,CAAC,CAAA;gBAC1F,MAAM,aAAa,CAAC,MAAM,CAAC;oBACzB,SAAS,EAAE,EAAE;oBACb,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC;oBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC;iBAClC,CAAC,CAAA;YACJ,CAAC;YAED,OAAO,MAAM,CAAA;QACf,CAAC;QAED,gBAAgB,EAAE,KAAK,EAAE,QAAgB,EAAsB,EAAE;YAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;YAClC,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;YACpF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;YAElF,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxB,EAAE,EAAE,CAAC,CAAC,SAAS;gBACf,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,UAAU,EAAE,CAAC,CAAC,UAAU;aACzB,CAAC,CAAC,CAAA;QACL,CAAC;QAED,mBAAmB,EAAE,KAAK,EAAE,MAAc,EAAE,QAAiB,EAAE,IAAa,EAAwC,EAAE;YACpH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAc,CAAA;YAClC,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;YACpF,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAA8B,yBAAyB,CAAC,CAAA;YAE1F,MAAM,aAAa,GAA4B,EAAE,MAAM,EAAE,CAAA;YACzD,IAAI,QAAQ,IAAI,IAAI;gBAAE,aAAa,CAAC,QAAQ,GAAG,QAAQ,CAAA;YACvD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,aAAoB,CAAC,CAAA;YAC5E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAA;YAE3C,MAAM,WAAW,GAA4B;gBAC3C,SAAS,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;aACnD,CAAA;YACD,IAAI,IAAI,IAAI,IAAI;gBAAE,WAAW,CAAC,IAAI,GAAG,IAAI,CAAA;YACzC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,WAAkB,CAAC,CAAA;YACrE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAA;YAExC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;YACrB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAA;YAEjF,OAAO;gBACL,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS;gBAC3C,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAA;QACH,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/types.d.ts

@@ -0,0 +1,66 @@
+import type { ResourceRecord } from '@owlmeans/resource';
+import type { MongoResource } from '@owlmeans/mongo-resource';
+import type { InitializedService } from '@owlmeans/context';
+import type { ServerConfig, ServerContext } from '@owlmeans/server-context';
+import type { AuthCredentials, AuthPayload, AuthRole, Profile } from '@owlmeans/auth';
+import type { ProviderProfileDetails } from '@owlmeans/oidc';
+/**
+ * Local account record — one per user.
+ * id is the Mongo resource id; credential is the stable unique local entity slug.
+ */
+export interface IdentityAccount extends Profile, ResourceRecord {
+    id: string;
+    credential: string;
+}
+/**
+ * Local profile record — ties a user to an entity with a role.
+ * Mirrors IAMProfile from @owlmeans/auth backend.
+ */
+export interface IdentityProfile extends Profile, ResourceRecord {
+    id: string;
+    profileId: string;
+    userId?: string;
+    role: AuthRole;
+    expiresAt?: Date;
+}
+/**
+ * Provider credentials record — one per provider link per profile.
+ * Maps an external provider subject to a local profile using auth-native fields.
+ * credential stores the login-service key: "service:{type}:{service}"
+ * userId stores the derived external login key: "{type}:{service}:{providerSub}"
+ */
+export interface IdentityCredentials extends AuthCredentials, ResourceRecord {
+    profileId: string;
+}
+export type IdentityAccountResource = MongoResource<IdentityAccount>;
+export type IdentityProfileResource = MongoResource<IdentityProfile>;
+export type IdentityCredentialsResource = MongoResource<IdentityCredentials>;
+/**
+ * Compatible with AccountLinkingService from @owlmeans/server-oidc-rp
+ * but defined independently to avoid circular dependency.
+ */
+export interface IdentityLinkingService extends InitializedService {
+    getLinkedProfile: (details: ProviderProfileDetails) => Promise<AuthPayload | null>;
+    linkProfile: (details: ProviderProfileDetails, meta: AccountMeta) => Promise<AuthPayload>;
+    linkCredentials: (details: ProviderProfileDetails) => Promise<AuthPayload>;
+    getOwnerProfiles: (entityId: string) => Promise<Profile[]>;
+    getOwnerCredentials: (userId: string, entityId?: string, type?: string) => Promise<AuthCredentials | undefined>;
+}
+export interface AccountMeta {
+    username: string;
+    force?: boolean;
+}
+export interface IdentityConfig extends ServerConfig {
+}
+export interface IdentityContext<C extends IdentityConfig = IdentityConfig> extends ServerContext<C> {
+}
+export interface GoogleUserInfo {
+    sub: string;
+    email: string;
+    email_verified?: boolean;
+    name?: string;
+    given_name?: string;
+    family_name?: string;
+    picture?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AACrF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AAE5D;;;GAGG;AACH,MAAM,WAAW,eAAgB,SAAQ,OAAO,EAAE,cAAc;IAC9D,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAgB,SAAQ,OAAO,EAAE,cAAc;IAC9D,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,QAAQ,CAAA;IACd,SAAS,CAAC,EAAE,IAAI,CAAA;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAoB,SAAQ,eAAe,EAAE,cAAc;IAC1E,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,uBAAuB,GAAG,aAAa,CAAC,eAAe,CAAC,CAAA;AACpE,MAAM,MAAM,uBAAuB,GAAG,aAAa,CAAC,eAAe,CAAC,CAAA;AACpE,MAAM,MAAM,2BAA2B,GAAG,aAAa,CAAC,mBAAmB,CAAC,CAAA;AAE5E;;;GAGG;AACH,MAAM,WAAW,sBAAuB,SAAQ,kBAAkB;IAChE,gBAAgB,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;IAClF,WAAW,EAAE,CAAC,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,CAAA;IACzF,eAAe,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAA;IAC1E,gBAAgB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;IAC1D,mBAAmB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAA;CAChH;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,cAAe,SAAQ,YAAY;CACnD;AAED,MAAM,WAAW,eAAe,CAAC,CAAC,SAAS,cAAc,GAAG,cAAc,CAAE,SAAQ,aAAa,CAAC,CAAC,CAAC;CACnG;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB"}

package/build/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@owlmeans/server-auth-identity",
+  "version": "0.1.3",
+  "license": "MIT",
+  "type": "module",
+  "scripts": {
+    "build": "tsc -b",
+    "dev": "sleep 24 && nodemon -e ts,tsx,json --watch src --exec \"tsc -p ./tsconfig.json\"",
+    "watch": "tsc -b -w --preserveWatchOutput --pretty",
+    "test": "bun test ./tests"
+  },
+  "main": "build/index.js",
+  "module": "build/index.js",
+  "types": "build/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./build/index.js",
+      "require": "./build/index.js",
+      "default": "./build/index.js",
+      "module": "./build/index.js",
+      "types": "./build/index.d.ts"
+    }
+  },
+  "dependencies": {
+    "@owlmeans/auth": "^0.1.3",
+    "@owlmeans/basic-ids": "^0.1.3",
+    "@owlmeans/context": "^0.1.3",
+    "@owlmeans/mongo-resource": "^0.1.3",
+    "@owlmeans/oidc": "^0.1.3",
+    "@owlmeans/resource": "^0.1.3",
+    "@owlmeans/server-context": "^0.1.3"
+  },
+  "peerDependencies": {
+    "mongodb": "*"
+  },
+  "devDependencies": {
+    "@owlmeans/dep-config": "workspace:*",
+    "@types/bun": "^1.3.0",
+    "nodemon": "^3.1.11",
+    "typescript": "^6.0.2"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/consts.ts

@@ -0,0 +1,9 @@
+
+export const AUTH_IDENTITY_ACCOUNT = 'auth-identity:account'
+export const AUTH_IDENTITY_PROFILE = 'auth-identity:profile'
+export const AUTH_IDENTITY_CREDENTIALS = 'auth-identity:credentials'
+export const AUTH_IDENTITY_LINKING = 'auth-identity:linking'
+
+// Helper prefixes for stable key derivation
+export const LOGIN_SERVICE_PREFIX = 'service'
+export const EXTERNAL_KEY_DELIMITER = ':'

package/src/helper.ts

@@ -0,0 +1,13 @@
+import type { BasicContext } from '@owlmeans/context'
+import { makeIdentityAccountResource, makeIdentityProfileResource, makeIdentityCredentialsResource } from './resource.js'
+import { makeIdentityLinkingService } from './service.js'
+
+export const appendAuthIdentityResources = (
+  context: BasicContext<any>,
+  dbAlias?: string
+): void => {
+  context.registerResource(makeIdentityAccountResource(dbAlias))
+  context.registerResource(makeIdentityProfileResource(dbAlias))
+  context.registerResource(makeIdentityCredentialsResource(dbAlias))
+  context.registerService(makeIdentityLinkingService())
+}

package/src/index.ts

@@ -0,0 +1,5 @@
+export * from './consts.js'
+export type * from './types.js'
+export * from './resource.js'
+export * from './service.js'
+export * from './helper.js'

package/src/resource.ts

@@ -0,0 +1,33 @@
+import { makeMongoResource } from '@owlmeans/mongo-resource'
+import type { IdentityAccount, IdentityAccountResource, IdentityProfile, IdentityProfileResource, IdentityCredentials, IdentityCredentialsResource } from './types.js'
+import { AUTH_IDENTITY_ACCOUNT, AUTH_IDENTITY_PROFILE, AUTH_IDENTITY_CREDENTIALS } from './consts.js'
+
+export const makeIdentityAccountResource = (dbAlias?: string): IdentityAccountResource => {
+  const resource = makeMongoResource<IdentityAccount, IdentityAccountResource>(
+    AUTH_IDENTITY_ACCOUNT, dbAlias
+  )
+  resource.index('credential', { credential: 1 }, { unique: true })
+  resource.index('entityId', { entityId: 1 })
+  resource.index('secret', { secret: 1 }, { unique: true, sparse: true })
+  return resource
+}
+
+export const makeIdentityProfileResource = (dbAlias?: string): IdentityProfileResource => {
+  const resource = makeMongoResource<IdentityProfile, IdentityProfileResource>(
+    AUTH_IDENTITY_PROFILE, dbAlias
+  )
+  resource.index('userId', { userId: 1 })
+  resource.index('entityId', { entityId: 1 })
+  resource.index('role', { role: 1, entityId: 1 })
+  resource.index('profile', { profileId: 1, entityId: 1 }, { unique: true })
+  return resource
+}
+
+export const makeIdentityCredentialsResource = (dbAlias?: string): IdentityCredentialsResource => {
+  const resource = makeMongoResource<IdentityCredentials, IdentityCredentialsResource>(
+    AUTH_IDENTITY_CREDENTIALS, dbAlias
+  )
+  resource.index('provider', { type: 1, userId: 1, credential: 1 }, { unique: true })
+  resource.index('profileId', { profileId: 1 })
+  return resource
+}

package/src/service.ts

@@ -0,0 +1,195 @@
+import { appendContextual } from '@owlmeans/context'
+import type { ServerConfig, ServerContext } from '@owlmeans/server-context'
+import type { AuthCredentials, AuthPayload, Profile } from '@owlmeans/auth'
+import { ALL_SCOPES, AuthRole } from '@owlmeans/auth'
+import type { ProviderProfileDetails } from '@owlmeans/oidc'
+import { createIdOfLength, IdStyle } from '@owlmeans/basic-ids'
+import type { AccountMeta, IdentityAccountResource, IdentityProfileResource, IdentityCredentialsResource, IdentityLinkingService } from './types.js'
+import { AUTH_IDENTITY_ACCOUNT, AUTH_IDENTITY_PROFILE, AUTH_IDENTITY_CREDENTIALS, AUTH_IDENTITY_LINKING, LOGIN_SERVICE_PREFIX, EXTERNAL_KEY_DELIMITER } from './consts.js'
+
+type Context = ServerContext<ServerConfig>
+
+const MAX_SLUG_RETRIES = 5
+
+// Stable external login key: "{type}:{service}:{providerSub}"
+const externalKey = (details: ProviderProfileDetails): string =>
+  [details.type, details.service, details.userId].join(EXTERNAL_KEY_DELIMITER)
+
+// Login-service credential stored on profile and credentials: "service:{type}:{service}"
+const loginService = (details: ProviderProfileDetails): string =>
+  [LOGIN_SERVICE_PREFIX, details.type, details.service].join(EXTERNAL_KEY_DELIMITER)
+
+export const makeIdentityLinkingService = (): IdentityLinkingService => {
+  const service: IdentityLinkingService = appendContextual<IdentityLinkingService>(AUTH_IDENTITY_LINKING, {
+    getLinkedProfile: async (details: ProviderProfileDetails): Promise<AuthPayload | null> => {
+      const ctx = service.ctx as Context
+      const credsResource = ctx.resource<IdentityCredentialsResource>(AUTH_IDENTITY_CREDENTIALS)
+
+      const { items: creds } = await credsResource.list({
+        criteria: {
+          type: details.type,
+          userId: externalKey(details),
+          credential: loginService(details),
+        }
+      })
+      const cred = creds[0] ?? null
+      if (cred == null) return null
+
+      const profileResource = ctx.resource<IdentityProfileResource>(AUTH_IDENTITY_PROFILE)
+      const profile = await profileResource.load(cred.profileId, 'profileId')
+      if (profile == null) return null
+
+      return {
+        type: details.type,
+        role: profile.role,
+        userId: profile.userId ?? profile.profileId,
+        profileId: profile.profileId,
+        entityId: profile.entityId,
+        scopes: profile.scopes,
+      }
+    },
+
+    linkProfile: async (details: ProviderProfileDetails, meta: AccountMeta): Promise<AuthPayload> => {
+      const ctx = service.ctx as Context
+      const accountResource = ctx.resource<IdentityAccountResource>(AUTH_IDENTITY_ACCOUNT)
+      const profileResource = ctx.resource<IdentityProfileResource>(AUTH_IDENTITY_PROFILE)
+      const credsResource = ctx.resource<IdentityCredentialsResource>(AUTH_IDENTITY_CREDENTIALS)
+
+      // Generate a unique local entity slug stored as the account credential.
+      let accountId: string | null = null
+      let entityId: string | null = null
+      for (let i = 0; i < MAX_SLUG_RETRIES; i++) {
+        const credential = createIdOfLength(16, IdStyle.Base58)
+        try {
+          const account = await accountResource.create({
+            credential,
+            name: meta.username,
+            entityId: credential,
+          })
+          accountId = account.id
+          entityId = account.credential
+          break
+        } catch (err: any) {
+          if (err?.code === 11000 || err?.message?.includes('duplicate')) continue
+          throw err
+        }
+      }
+
+      if (accountId == null || entityId == null) {
+        throw new Error('Failed to generate unique account credential after retries')
+      }
+
+      const profileId = [details.type, accountId].join(EXTERNAL_KEY_DELIMITER)
+      const svc = loginService(details)
+
+      let profile
+      try {
+        profile = await profileResource.create({
+          profileId,
+          userId: accountId,
+          credential: svc,
+          role: AuthRole.User,
+          name: meta.username,
+          entityId,
+          scopes: [ALL_SCOPES],
+        })
+      } catch (err: any) {
+        if (err?.code === 11000 || err?.message?.includes('duplicate')) {
+          profile = await profileResource.get(profileId, 'profileId')
+        } else {
+          throw err
+        }
+      }
+
+      await credsResource.create({
+        challenge: '',
+        type: details.type,
+        userId: externalKey(details),
+        profileId,
+        credential: svc,
+      })
+
+      return {
+        type: details.type,
+        role: profile.role,
+        userId: profile.userId ?? profile.profileId,
+        profileId: profile.profileId,
+        entityId: profile.entityId,
+        scopes: profile.scopes,
+      }
+    },
+
+    linkCredentials: async (details: ProviderProfileDetails): Promise<AuthPayload> => {
+      const result = await service.getLinkedProfile(details)
+      if (result == null) {
+        throw new Error('Cannot link credentials: profile not found')
+      }
+
+      if (details.profileId != null) {
+        const ctx = service.ctx as Context
+        const credsResource = ctx.resource<IdentityCredentialsResource>(AUTH_IDENTITY_CREDENTIALS)
+        await credsResource.create({
+          challenge: '',
+          type: details.type,
+          userId: externalKey(details),
+          profileId: details.profileId,
+          credential: loginService(details),
+        })
+      }
+
+      return result
+    },
+
+    getOwnerProfiles: async (entityId: string): Promise<Profile[]> => {
+      const ctx = service.ctx as Context
+      const profileResource = ctx.resource<IdentityProfileResource>(AUTH_IDENTITY_PROFILE)
+      const { items: profiles } = await profileResource.list({ criteria: { entityId } })
+
+      return profiles.map(p => ({
+        id: p.profileId,
+        name: p.name,
+        credential: p.credential,
+        entityId: p.entityId,
+        scopes: p.scopes,
+        groups: p.groups,
+        permissions: p.permissions,
+        attributes: p.attributes,
+      }))
+    },
+
+    getOwnerCredentials: async (userId: string, entityId?: string, type?: string): Promise<AuthCredentials | undefined> => {
+      const ctx = service.ctx as Context
+      const profileResource = ctx.resource<IdentityProfileResource>(AUTH_IDENTITY_PROFILE)
+      const credsResource = ctx.resource<IdentityCredentialsResource>(AUTH_IDENTITY_CREDENTIALS)
+
+      const profileFilter: Record<string, unknown> = { userId }
+      if (entityId != null) profileFilter.entityId = entityId
+      const { items: profiles } = await profileResource.list(profileFilter as any)
+      if (profiles.length === 0) return undefined
+
+      const credsFilter: Record<string, unknown> = {
+        profileId: { $in: profiles.map(p => p.profileId) }
+      }
+      if (type != null) credsFilter.type = type
+      const { items: creds } = await credsResource.list(credsFilter as any)
+      if (creds.length === 0) return undefined
+
+      const cred = creds[0]
+      const profile = profiles.find(p => p.profileId === cred.profileId) ?? profiles[0]
+
+      return {
+        type: cred.type,
+        role: profile.role,
+        userId: profile.userId ?? profile.profileId,
+        profileId: profile.profileId,
+        entityId: profile.entityId,
+        scopes: profile.scopes,
+        challenge: cred.challenge,
+        credential: cred.credential,
+        publicKey: cred.publicKey,
+      }
+    },
+  })
+
+  return service
+}

package/src/types.ts

@@ -0,0 +1,75 @@
+import type { ResourceRecord } from '@owlmeans/resource'
+import type { MongoResource } from '@owlmeans/mongo-resource'
+import type { InitializedService } from '@owlmeans/context'
+import type { ServerConfig, ServerContext } from '@owlmeans/server-context'
+import type { AuthCredentials, AuthPayload, AuthRole, Profile } from '@owlmeans/auth'
+import type { ProviderProfileDetails } from '@owlmeans/oidc'
+
+/**
+ * Local account record — one per user.
+ * id is the Mongo resource id; credential is the stable unique local entity slug.
+ */
+export interface IdentityAccount extends Profile, ResourceRecord {
+  id: string
+  credential: string
+}
+
+/**
+ * Local profile record — ties a user to an entity with a role.
+ * Mirrors IAMProfile from @owlmeans/auth backend.
+ */
+export interface IdentityProfile extends Profile, ResourceRecord {
+  id: string
+  profileId: string
+  userId?: string
+  role: AuthRole
+  expiresAt?: Date
+}
+
+/**
+ * Provider credentials record — one per provider link per profile.
+ * Maps an external provider subject to a local profile using auth-native fields.
+ * credential stores the login-service key: "service:{type}:{service}"
+ * userId stores the derived external login key: "{type}:{service}:{providerSub}"
+ */
+export interface IdentityCredentials extends AuthCredentials, ResourceRecord {
+  profileId: string
+}
+
+export type IdentityAccountResource = MongoResource<IdentityAccount>
+export type IdentityProfileResource = MongoResource<IdentityProfile>
+export type IdentityCredentialsResource = MongoResource<IdentityCredentials>
+
+/**
+ * Compatible with AccountLinkingService from @owlmeans/server-oidc-rp
+ * but defined independently to avoid circular dependency.
+ */
+export interface IdentityLinkingService extends InitializedService {
+  getLinkedProfile: (details: ProviderProfileDetails) => Promise<AuthPayload | null>
+  linkProfile: (details: ProviderProfileDetails, meta: AccountMeta) => Promise<AuthPayload>
+  linkCredentials: (details: ProviderProfileDetails) => Promise<AuthPayload>
+  getOwnerProfiles: (entityId: string) => Promise<Profile[]>
+  getOwnerCredentials: (userId: string, entityId?: string, type?: string) => Promise<AuthCredentials | undefined>
+}
+
+export interface AccountMeta {
+  username: string
+  force?: boolean
+}
+
+export interface IdentityConfig extends ServerConfig {
+}
+
+export interface IdentityContext<C extends IdentityConfig = IdentityConfig> extends ServerContext<C> {
+}
+
+export interface GoogleUserInfo {
+  sub: string
+  email: string
+  email_verified?: boolean
+  name?: string
+  given_name?: string
+  family_name?: string
+  picture?: string
+}
+

package/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "extends": ["@owlmeans/dep-config/tsconfig.base.json", "@owlmeans/dep-config/tsconfig.server.json"],
+  "compilerOptions": {
+    "rootDir": "./src",
+    "outDir": "./build/"
+  },
+  "include": ["src"]
+}