@owlmeans/server-auth 0.1.0

package/build/manager/context.js

@@ -0,0 +1,26 @@
+import { makeServerContext } from '@owlmeans/server-context';
+import { appendApiServer } from '@owlmeans/server-api';
+import { appendApiClient } from '@owlmeans/api';
+import { appendSocketService, createSocketMiddleware } from '@owlmeans/server-socket';
+import { DEFAULT_RELY } from './consts.js';
+import { createRelyService } from './rely.js';
+import { AUTH_CACHE } from '../consts.js';
+import { appendStaticResource } from '@owlmeans/static-resource';
+export const makeContext = (cfg, customize = false) => {
+    const context = makeServerContext(cfg);
+    appendApiServer(context);
+    appendApiClient(context);
+    appendSocketService(context);
+    context.registerMiddleware(createSocketMiddleware());
+    // @TODO figure out rely service via config?
+    if (!customize && !context.hasService(DEFAULT_RELY)) {
+        context.registerService(createRelyService(DEFAULT_RELY));
+    }
+    appendStaticResource(context);
+    if (!customize && !context.hasResource(AUTH_CACHE)) {
+        appendStaticResource(context, AUTH_CACHE);
+    }
+    context.makeContext = (cfg => makeContext(cfg, customize));
+    return context;
+};
+//# sourceMappingURL=context.js.map

package/build/manager/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/manager/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE5D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAEhE,MAAM,CAAC,MAAM,WAAW,GAAG,CAA+C,GAAM,EAAE,YAAqB,KAAK,EAAK,EAAE;IACjH,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAM,CAAA;IAE3C,eAAe,CAAO,OAAO,CAAC,CAAA;IAC9B,eAAe,CAAO,OAAO,CAAC,CAAA;IAC9B,mBAAmB,CAAO,OAAO,CAAC,CAAA;IAElC,OAAO,CAAC,kBAAkB,CAAC,sBAAsB,EAAE,CAAC,CAAA;IAEpD,4CAA4C;IAC5C,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAA;IAC1D,CAAC;IAED,oBAAoB,CAAO,OAAO,CAAC,CAAA;IACnC,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QACnD,oBAAoB,CAAO,OAAO,EAAE,UAAU,CAAC,CAAA;IACjD,CAAC;IAED,OAAO,CAAC,WAAW,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAA+B,CAAA;IAExF,OAAO,OAAY,CAAA;AACrB,CAAC,CAAA"}

package/build/manager/exports.d.ts

@@ -0,0 +1,16 @@
+export { config } from '@owlmeans/server-context';
+export type { TrustedRecord } from '@owlmeans/auth-common';
+export { addWebService } from '@owlmeans/client-config';
+export { service, TRUSTED } from '@owlmeans/config';
+export { AppType, assertContext } from '@owlmeans/context';
+export { klusterize } from '@owlmeans/kluster';
+export { elevate } from '@owlmeans/server-module';
+export { elevate as celevate, stab } from '@owlmeans/client-module';
+export type { RefedModuleHandler } from '@owlmeans/server-module';
+export { handleIntermediate, handleBody, handleRequest, handleParams } from '@owlmeans/server-api';
+export type { AbstractRequest, AbstractResponse } from '@owlmeans/module';
+export { backend } from '@owlmeans/route';
+export { AUTHEN, AUTHEN_AUTHEN, AUTHEN_INIT } from '@owlmeans/auth';
+export { GUARD_ED25519, BED255_CASHE_RESOURCE } from '@owlmeans/auth-common';
+export { filterObject } from '@owlmeans/resource';
+//# sourceMappingURL=exports.d.ts.map

package/build/manager/exports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exports.d.ts","sourceRoot":"","sources":["../../src/manager/exports.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAA;AACjD,YAAY,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACvD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAA;AACjD,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAA;AACnE,YAAY,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAClG,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAEzC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA"}

package/build/manager/exports.js

@@ -0,0 +1,13 @@
+export { config } from '@owlmeans/server-context';
+export { addWebService } from '@owlmeans/client-config';
+export { service, TRUSTED } from '@owlmeans/config';
+export { AppType, assertContext } from '@owlmeans/context';
+export { klusterize } from '@owlmeans/kluster';
+export { elevate } from '@owlmeans/server-module';
+export { elevate as celevate, stab } from '@owlmeans/client-module';
+export { handleIntermediate, handleBody, handleRequest, handleParams } from '@owlmeans/server-api';
+export { backend } from '@owlmeans/route';
+export { AUTHEN, AUTHEN_AUTHEN, AUTHEN_INIT } from '@owlmeans/auth';
+export { GUARD_ED25519, BED255_CASHE_RESOURCE } from '@owlmeans/auth-common';
+export { filterObject } from '@owlmeans/resource';
+//# sourceMappingURL=exports.js.map

package/build/manager/exports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exports.js","sourceRoot":"","sources":["../../src/manager/exports.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAA;AAEjD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACvD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAA;AACjD,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAA;AAEnE,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAElG,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAEzC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA"}

package/build/manager/index.d.ts

@@ -0,0 +1,11 @@
+export type * from './types.js';
+export * from './modules.js';
+export * from './exports.js';
+export * from './context.js';
+export * from './main.js';
+export * from './rely.js';
+export * from './consts.js';
+export * from './rely/index.js';
+export * from './actions/index.js';
+export * from './plugins/index.js';
+//# sourceMappingURL=index.d.ts.map

package/build/manager/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/manager/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAE/B,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA;AACzB,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA"}

package/build/manager/index.js

@@ -0,0 +1,10 @@
+export * from './modules.js';
+export * from './exports.js';
+export * from './context.js';
+export * from './main.js';
+export * from './rely.js';
+export * from './consts.js';
+export * from './rely/index.js';
+export * from './actions/index.js';
+export * from './plugins/index.js';
+//# sourceMappingURL=index.js.map

package/build/manager/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/manager/index.ts"],"names":[],"mappings":"AAEA,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA;AACzB,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA"}

package/build/manager/main.d.ts

@@ -0,0 +1,3 @@
+import type { AppContext, AppConfig } from './types.js';
+export declare const main: <C extends AppConfig, T extends AppContext<C>>(ctx: T) => Promise<void>;
+//# sourceMappingURL=main.d.ts.map

package/build/manager/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/manager/main.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAEvD,eAAO,MAAM,IAAI,GAAU,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,kBAI9E,CAAA"}

package/build/manager/main.js

@@ -0,0 +1,7 @@
+import { modules } from './modules.js';
+export const main = async (ctx) => {
+    ctx.registerModules(modules);
+    await ctx.configure().init();
+    await ctx.getApiServer().listen();
+};
+//# sourceMappingURL=main.js.map

package/build/manager/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/manager/main.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAGtC,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,EAAgD,GAAM,EAAE,EAAE;IACjF,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAC5B,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,CAAA;IAC5B,MAAM,GAAG,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,CAAA;AACnC,CAAC,CAAA"}

package/build/manager/model.d.ts

@@ -0,0 +1,3 @@
+import type { AuthModel, AppConfig, AppContext } from './types.js';
+export declare const makeAuthModel: (context: AppContext<AppConfig>) => AuthModel;
+//# sourceMappingURL=model.d.ts.map

package/build/manager/model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/manager/model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAgBlE,eAAO,MAAM,aAAa,YAAa,UAAU,CAAC,SAAS,CAAC,KAAG,SA4E9D,CAAA"}

package/build/manager/model.js

@@ -0,0 +1,68 @@
+import { AuthenFailed, AuthenPayloadError } from '@owlmeans/auth';
+import { getPlugin } from './plugins/utils.js';
+import { AUTH_CACHE, AUTHEN_TIMEFRAME } from '../consts.js';
+import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope';
+import { createRelyFlow } from './rely/flow.js';
+import { trusted } from './utils/trusted.js';
+export const makeAuthModel = (context) => {
+    const cache = (context) => context.resource(AUTH_CACHE);
+    const model = {
+        init: async (request) => {
+            const plugin = getPlugin(request.type, context);
+            const response = await plugin.init(request);
+            const envelope = makeEnvelopeModel(plugin.type);
+            /**
+             * @TODO It looks like we don't validate sourced challenge by any means
+             * So we need to:
+             * 1. Remove it  cause we process it as a separate property anyway
+             * 2. Fix it because it looks like this separate property isn't validated
+             */
+            const challengeToken = request.source != null
+                ? `${request.source}:${response.challenge}` : response.challenge;
+            const [, keyPair] = await trusted(context);
+            const challenge = await envelope.send(challengeToken, AUTHEN_TIMEFRAME).sign(keyPair, EnvelopeKind.Wrap);
+            return { challenge };
+        },
+        authenticate: async (credential) => {
+            const [trustedUser, keyPair] = await trusted(context);
+            const envelope = makeEnvelopeModel(credential.challenge, EnvelopeKind.Wrap);
+            if (!await envelope.verify(keyPair)) {
+                throw new AuthenFailed('challenge');
+            }
+            const msg = envelope.message(true);
+            try {
+                await cache(context).create({ id: msg }, { ttl: (envelope.envelope.ttl ?? AUTHEN_TIMEFRAME) / 1000 });
+            }
+            catch (e) {
+                const error = new AuthenFailed('challenge');
+                if (e instanceof Error) {
+                    error.oiriginalStack = `${e} : ${e.stack}`;
+                }
+                throw error;
+            }
+            if (credential.userId == null) {
+                throw new AuthenPayloadError('userId');
+            }
+            const plugin = getPlugin(envelope.type(), context);
+            // @TODO this token PROBABLY needs to be registered somewhere and rechecked
+            // from time to time to make sure that the session is not deleted 
+            // or permission hasn't changed.
+            // Alternative solution is to have permissions cached and cleaned 
+            // when some broadcast message is sent from authentication system.
+            const challenge = credential.challenge;
+            const { token } = await plugin.authenticate(Object.assign(credential, { challenge: msg }));
+            credential.challenge = token === '' ? challenge : token;
+            credential.credential = trustedUser.id;
+            return {
+                token: await makeEnvelopeModel(credential.type)
+                    .send(credential, AUTHEN_TIMEFRAME)
+                    .sign(keyPair, EnvelopeKind.Token)
+            };
+        },
+        rely: async (conn, auth) => {
+            conn.authenticate = createRelyFlow(context, conn, auth);
+        }
+    };
+    return model;
+};
+//# sourceMappingURL=model.js.map

package/build/manager/model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../src/manager/model.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAEjE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC3D,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE1E,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAQ5C,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAA8B,EAAa,EAAE;IACzE,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAuB,EAAE,CACtD,OAAO,CAAC,QAAQ,CAAsB,UAAU,CAAC,CAAA;IAEnD,MAAM,KAAK,GAAc;QACvB,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACpB,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;YAC/C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAE3C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YAE/C;;;;;eAKG;YACH,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI;gBAC3C,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAA;YAElE,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;YAC1C,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;YAExG,OAAO,EAAE,SAAS,EAAE,CAAA;QACtB,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;YACrD,MAAM,QAAQ,GAAkB,iBAAiB,CAAC,UAAU,CAAC,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;YAC1F,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,YAAY,CAAC,WAAW,CAAC,CAAA;YACrC,CAAC;YAED,MAAM,GAAG,GAAW,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAE1C,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,gBAAgB,CAAC,GAAG,IAAI,EAAE,CAAC,CAAA;YACvG,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,WAAW,CAAC,CAAA;gBAC3C,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;oBACvB,KAAK,CAAC,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAA;gBAC5C,CAAC;gBACD,MAAM,KAAK,CAAA;YACb,CAAC;YAED,IAAI,UAAU,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBAC9B,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YAED,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAA;YAElD,2EAA2E;YAC3E,kEAAkE;YAClE,gCAAgC;YAChC,kEAAkE;YAClE,kEAAkE;YAElE,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAA;YACtC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;YAC1F,UAAU,CAAC,SAAS,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAA;YAEvD,UAAU,CAAC,UAAU,GAAG,WAAW,CAAC,EAAE,CAAA;YAEtC,OAAO;gBACL,KAAK,EAAE,MAAM,iBAAiB,CAAkB,UAAU,CAAC,IAAI,CAAC;qBAC7D,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC;qBAClC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC;aACrC,CAAA;QACH,CAAC;QAED,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YACzB,IAAI,CAAC,YAAY,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACzD,CAAC;KACF,CAAA;IAED,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}

package/build/manager/modules.d.ts

@@ -0,0 +1,2 @@
+export declare const modules: import("@owlmeans/module").CommonModule[];
+//# sourceMappingURL=modules.d.ts.map

package/build/manager/modules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../../src/manager/modules.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,OAAO,2CAAO,CAAA"}

package/build/manager/modules.js

@@ -0,0 +1,21 @@
+import { AUTHEN, AUTHEN_AUTHEN, AUTHEN_INIT, AUTHEN_RELY, MOD_RECAPTCHA } from '@owlmeans/auth';
+import { modules as list } from '@owlmeans/auth-common';
+import { modules as apiConfig } from '@owlmeans/api-config-server';
+import { elevate, guard } from '@owlmeans/server-module';
+import * as actions from './actions/index.js';
+import { module } from '@owlmeans/client-module';
+import { backend, route, RouteMethod } from '@owlmeans/route';
+import { handleIntermediate } from '@owlmeans/server-api';
+import { DEFAULT_RELY } from './consts.js';
+elevate(list, AUTHEN, handleIntermediate(async (_, context) => await context.updateContext()), { intermediate: true });
+elevate(list, AUTHEN_INIT, actions.authenticationInit);
+elevate(list, AUTHEN_AUTHEN, actions.authenticate);
+elevate(list, AUTHEN_RELY, actions.rely, guard(DEFAULT_RELY));
+export const modules = list;
+list.push(...apiConfig);
+list.push(module(route(MOD_RECAPTCHA, '/api/siteverify', backend({
+    host: 'https://www.google.com',
+    base: 'recaptcha',
+    secure: true,
+}, RouteMethod.POST))));
+//# sourceMappingURL=modules.js.map

package/build/manager/modules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"modules.js","sourceRoot":"","sources":["../../src/manager/modules.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC/F,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,6BAA6B,CAAA;AAClE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAA;AACxD,OAAO,KAAK,OAAO,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAA;AAChD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1C,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,kBAAkB,CACtC,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,OAAO,CAAC,aAAa,EAAoB,CACtE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAA;AAC1B,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAA;AACtD,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;AAClD,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAA;AAE7D,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAA;AAC3B,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAA;AACvB,IAAI,CAAC,IAAI,CACP,MAAM,CACJ,KAAK,CAAC,aAAa,EAAE,iBAAiB,EAAE,OAAO,CAAC;IAC9C,IAAI,EAAE,wBAAwB;IAC9B,IAAI,EAAE,WAAW;IACjB,MAAM,EAAE,IAAI;CACb,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CACtB,CACF,CAAA"}

package/build/manager/plugins/basic-ed25519.d.ts

@@ -0,0 +1,4 @@
+import type { AuthPlugin } from './types.js';
+import type { AppConfig, AppContext } from '../types.js';
+export declare const basicEd25519: <C extends AppConfig, T extends AppContext<C>>(context: T) => AuthPlugin;
+//# sourceMappingURL=basic-ed25519.d.ts.map

package/build/manager/plugins/basic-ed25519.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"basic-ed25519.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/basic-ed25519.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAK5C,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAIxD,eAAO,MAAM,YAAY,GAAI,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,KAAG,UA6CvF,CAAA"}

package/build/manager/plugins/basic-ed25519.js

@@ -0,0 +1,42 @@
+import { AuthenticationType, AuthenFailed, ALL_SCOPES, AuthRole } from '@owlmeans/auth';
+import { assertType } from './utils.js';
+import { randomBytes } from '@noble/hashes/utils';
+import { base64 } from '@scure/base';
+import { fromPubKey } from '@owlmeans/basic-keys';
+import { TRUSTED } from '@owlmeans/config';
+export const basicEd25519 = (context) => {
+    const plugin = {
+        type: AuthenticationType.BasicEd25519,
+        init: async (request) => {
+            assertType(request.type, plugin);
+            const challenge = base64.encode(randomBytes(32));
+            return { challenge };
+        },
+        authenticate: async (credential) => {
+            /**
+             * @TODO We need to find users in some db not just in static
+             */
+            const systemUser = await context.getConfigResource(TRUSTED)
+                .load(credential.userId);
+            if (systemUser == null) {
+                throw new AuthenFailed();
+            }
+            if (systemUser.credential == null) {
+                throw new SyntaxError('System user missconfigured');
+            }
+            const key = fromPubKey(systemUser.credential);
+            if (!await key.verify(credential.challenge, credential.credential)) {
+                throw new AuthenFailed(`challenge:${plugin.type}`);
+            }
+            const token = base64.encode(randomBytes(32));
+            // @TODO we need to do something with scopes - it's not secure
+            credential.scopes = [ALL_SCOPES];
+            credential.role = AuthRole.Superuser;
+            credential.challenge = token;
+            credential.type = AuthenticationType.OneTimeToken;
+            return { token };
+        }
+    };
+    return plugin;
+};
+//# sourceMappingURL=basic-ed25519.js.map

package/build/manager/plugins/basic-ed25519.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"basic-ed25519.js","sourceRoot":"","sources":["../../../src/manager/plugins/basic-ed25519.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEvF,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEjD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAG1C,MAAM,CAAC,MAAM,YAAY,GAAG,CAA+C,OAAU,EAAc,EAAE;IACnG,MAAM,MAAM,GAAe;QACzB,IAAI,EAAE,kBAAkB,CAAC,YAAY;QACrC,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACpB,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAEhC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YAEhD,OAAO,EAAE,SAAS,EAAE,CAAA;QACtB,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B;;eAEG;YACH,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC;iBACxD,IAAI,CAAgB,UAAU,CAAC,MAAM,CAAC,CAAA;YAEzC,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,IAAI,UAAU,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;gBAClC,MAAM,IAAI,WAAW,CAAC,4BAA4B,CAAC,CAAA;YACrD,CAAC;YAED,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;YAE7C,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnE,MAAM,IAAI,YAAY,CAAC,aAAa,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;YACpD,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YAE5C,8DAA8D;YAC9D,UAAU,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,CAAA;YAChC,UAAU,CAAC,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAA;YACpC,UAAU,CAAC,SAAS,GAAG,KAAK,CAAA;YAC5B,UAAU,CAAC,IAAI,GAAG,kBAAkB,CAAC,YAAY,CAAA;YAEjD,OAAO,EAAE,KAAK,EAAE,CAAA;QAClB,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}

package/build/manager/plugins/basic-rely.d.ts

@@ -0,0 +1,4 @@
+import type { AppContext } from '../types.js';
+import type { AuthPlugin } from './types.js';
+export declare const basicRely: (context: AppContext, type?: string) => AuthPlugin;
+//# sourceMappingURL=basic-rely.d.ts.map

package/build/manager/plugins/basic-rely.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"basic-rely.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/basic-rely.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAqC,MAAM,aAAa,CAAA;AAChF,OAAO,KAAK,EAAE,UAAU,EAAiC,MAAM,YAAY,CAAA;AAS3E,eAAO,MAAM,SAAS,YAAa,UAAU,SAAS,MAAM,KAAG,UA0J9D,CAAA"}

package/build/manager/plugins/basic-rely.js

@@ -0,0 +1,152 @@
+import { AuthenFailed, AuthenPayloadError, AuthenticationType, AuthManagerError, AuthorizationError } from '@owlmeans/auth';
+import { makeConsumerRely, makeProviderRely } from '../../model/index.js';
+import { trusted } from '../utils/trusted.js';
+import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope';
+import { AUTH_CACHE } from '../../consts.js';
+import { ResourceError } from '@owlmeans/resource';
+import { RELY_CALL_TIMEOUT, RELY_PIN_PERFIX, RELY_TOKEN_PREFIX } from '@owlmeans/auth-common';
+const _subscriptions = {};
+export const basicRely = (context, type) => {
+    const plugin = {
+        type: type ?? AuthenticationType.RelyHandshake,
+        // This method is used by consumer and by provider (wallet)
+        // to initialize shared authentication process.
+        // The idea is that both subscribe to wait for a handshake value
+        // from the peer, that in fact is a subscription to a redis message tunnel.  
+        init: async (request) => {
+            const [, keyPair] = await trusted(context);
+            const tunnel = context.resource(AUTH_CACHE);
+            let relyMsg;
+            do {
+                try {
+                    const rely = request.auth == null ? makeConsumerRely() : makeProviderRely();
+                    relyMsg = rely.message();
+                    const pin = relyMsg.pin != null ? `${RELY_PIN_PERFIX}${relyMsg.pin}` : null;
+                    const token = relyMsg.token != null ? `${RELY_TOKEN_PREFIX}${relyMsg.token}` : null;
+                    const response = { challenge: await rely.sign(keyPair, EnvelopeKind.Wrap) };
+                    if (pin != null) {
+                        await tunnel.create({ ...response, id: pin }, { ttl: RELY_CALL_TIMEOUT });
+                    }
+                    if (token != null) {
+                        await tunnel.create({ ...response, id: token }, { ttl: RELY_CALL_TIMEOUT });
+                    }
+                    if (request.provideRely != null) {
+                        await Promise.all([pin, token].filter(key => key != null).map(async (key) => {
+                            _subscriptions[key] = await tunnel.subscribe(async (value) => {
+                                if (value.challenge != null) {
+                                    const rely = makeEnvelopeModel(value.challenge, EnvelopeKind.Wrap);
+                                    if (await rely.verify(keyPair)) {
+                                        [pin, token].filter(key => key != null).forEach(key => {
+                                            _subscriptions[key]?.();
+                                            if (_subscriptions[key] != null) {
+                                                delete _subscriptions[key];
+                                            }
+                                        });
+                                        await request.provideRely?.(rely.message(), relyMsg, true);
+                                    }
+                                }
+                            }, { /*ttl: RELY_CALL_TIMEOUT,*/ key, once: true });
+                            // @TODO they need to be killed on close - but actually live a little bit longer 
+                            // then timeout for them is ok
+                            setTimeout(() => {
+                                if (_subscriptions[key] != null) {
+                                    try {
+                                        void _subscriptions[key]();
+                                        delete _subscriptions[key];
+                                    }
+                                    finally {
+                                        void request.conn?.close();
+                                    }
+                                }
+                            }, RELY_CALL_TIMEOUT * 1000);
+                        }));
+                    }
+                    return response;
+                }
+                catch (e) {
+                    if (e instanceof ResourceError) {
+                        console.error('COLISION ON TRY TO CREATE RELY PIN\TOKEN...', e);
+                    }
+                    else {
+                        throw e;
+                    }
+                }
+                await new Promise(resolve => setTimeout(resolve, 500));
+            } while (true);
+        },
+        // This part of flow is entered by the party that is active (provides peer's code - token or pin)
+        authenticate: async (credential) => {
+            const [, keyPair] = await trusted(context);
+            const tunnel = context.resource(AUTH_CACHE);
+            // 1. Just get a peer connection based on provided credential
+            // 2. Provision it with provided own data
+            // 3. Delete own rely connection seeds
+            let rely;
+            try {
+                let peer;
+                if (credential.credential.startsWith(RELY_PIN_PERFIX)) {
+                    const key = credential.credential.substring(RELY_PIN_PERFIX.length);
+                    if (key.length > 12) {
+                        throw new AuthenPayloadError('pin');
+                    }
+                    peer = await tunnel.get(credential.credential);
+                }
+                else if (credential.credential.startsWith(RELY_TOKEN_PREFIX)) {
+                    const key = credential.credential.substring(RELY_TOKEN_PREFIX.length);
+                    if (key.length > 16) {
+                        throw new AuthenPayloadError('token');
+                    }
+                    peer = await tunnel.get(credential.credential);
+                }
+                else {
+                    throw new AuthenPayloadError('credential');
+                }
+                const envelop = makeEnvelopeModel(peer.challenge, EnvelopeKind.Wrap);
+                if (!envelop.verify(keyPair)) {
+                    throw new AuthManagerError();
+                }
+                rely = envelop.message();
+            }
+            catch (e) {
+                if (e instanceof ResourceError) {
+                    console.error(e);
+                    throw new AuthorizationError('rely');
+                }
+                else {
+                    throw e;
+                }
+            }
+            const myChallenge = makeEnvelopeModel(credential.challenge, EnvelopeKind.Wrap);
+            if (!myChallenge.verify(keyPair)) {
+                throw new AuthenFailed();
+            }
+            await tunnel.update({ id: credential.credential, challenge: myChallenge.wrap() });
+            const myRely = myChallenge.message();
+            [
+                myRely.pin != null ? `${RELY_PIN_PERFIX}${myRely.pin}` : null,
+                myRely.token != null ? `${RELY_TOKEN_PREFIX}${myRely.token}` : null
+            ].filter(key => key != null).forEach(key => {
+                if (_subscriptions[key] != null) {
+                    void _subscriptions[key]();
+                    delete _subscriptions[key];
+                }
+            });
+            const token = makeEnvelopeModel(AuthenticationType.RelyHandshake);
+            token.send({ source: myRely, rely });
+            credential.type = AuthenticationType.RelyHandshake;
+            // @TODO think about it: we create a mixed object here that is credentials and authentication
+            // in the same time. Actually it's a bit dirty. And it means that auth service at the end of the
+            // day can produce both (authentication token and authentication token "ticket").
+            // Why we do it this way here: cause the consumer of authentication is the auth service itself
+            // and there is no need to "exchange" the token (what we do when we come via url redirect to another service
+            // with the one-time auth token potentially exposed as a result).
+            const _auth = credential;
+            _auth.createdAt = new Date();
+            _auth.token = token.tokenize();
+            _auth.isUser = true;
+            return { token: _auth.token };
+        }
+    };
+    return plugin;
+};
+//# sourceMappingURL=basic-rely.js.map

package/build/manager/plugins/basic-rely.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"basic-rely.js","sourceRoot":"","sources":["../../../src/manager/plugins/basic-rely.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAI3H,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAE7F,MAAM,cAAc,GAAqC,EAAE,CAAA;AAC3D,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAAmB,EAAE,IAAa,EAAc,EAAE;IAC1E,MAAM,MAAM,GAAe;QACzB,IAAI,EAAE,IAAI,IAAI,kBAAkB,CAAC,aAAa;QAE9C,2DAA2D;QAC3D,+CAA+C;QAC/C,gEAAgE;QAChE,6EAA6E;QAC7E,IAAI,EAAE,KAAK,EAAE,OAA6B,EAA8B,EAAE;YACxE,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;YAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAoB,UAAU,CAAC,CAAA;YAC9D,IAAI,OAAkB,CAAA;YACtB,GAAG,CAAC;gBACF,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAA;oBAE3E,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;oBACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,eAAe,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;oBAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,iBAAiB,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;oBAEnF,MAAM,QAAQ,GAAG,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAA;oBAE3E,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;wBAChB,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAA;oBAC3E,CAAC;oBACD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;wBAClB,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAA;oBAC7E,CAAC;oBAED,IAAI,OAAO,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;wBAChC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,EAAC,GAAG,EAAC,EAAE;4BACxE,cAAc,CAAC,GAAG,CAAC,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAC,KAAK,EAAC,EAAE;gCACzD,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;oCAC5B,MAAM,IAAI,GAAG,iBAAiB,CAAY,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;oCAC7E,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;wCAC/B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;4CACpD,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;4CACvB,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;gDAChC,OAAO,cAAc,CAAC,GAAG,CAAC,CAAA;4CAC5B,CAAC;wCACH,CAAC,CAAC,CAAA;wCACF,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;oCAC5D,CAAC;gCACH,CAAC;4BACH,CAAC,EAAE,EAAE,2BAA2B,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;4BAEnD,iFAAiF;4BACjF,8BAA8B;4BAC9B,UAAU,CAAC,GAAG,EAAE;gCACd,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;oCAChC,IAAI,CAAC;wCACH,KAAK,cAAc,CAAC,GAAG,CAAC,EAAE,CAAA;wCAC1B,OAAO,cAAc,CAAC,GAAG,CAAC,CAAA;oCAC5B,CAAC;4CAAS,CAAC;wCACT,KAAK,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAA;oCAC5B,CAAC;gCACH,CAAC;4BACH,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC,CAAA;wBAC9B,CAAC,CAAC,CAAC,CAAA;oBACL,CAAC;oBAED,OAAO,QAAQ,CAAA;gBACjB,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAI,CAAC,YAAY,aAAa,EAAE,CAAC;wBAC/B,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAA;oBACjE,CAAC;yBAAM,CAAC;wBACN,MAAM,CAAC,CAAA;oBACT,CAAC;gBACH,CAAC;gBACD,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;YACxD,CAAC,QAAQ,IAAI,EAAC;QAChB,CAAC;QAED,iGAAiG;QACjG,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;YAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAoB,UAAU,CAAC,CAAA;YAE9D,6DAA6D;YAC7D,yCAAyC;YACzC,sCAAsC;YAEtC,IAAI,IAAe,CAAA;YACnB,IAAI,CAAC;gBACH,IAAI,IAAgB,CAAA;gBACpB,IAAI,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;oBACtD,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;oBACnE,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;wBACpB,MAAM,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAA;oBACrC,CAAC;oBACD,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;gBAChD,CAAC;qBAAM,IAAI,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;oBAC/D,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;oBACrE,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;wBACpB,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;oBACvC,CAAC;oBACD,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;gBAChD,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,kBAAkB,CAAC,YAAY,CAAC,CAAA;gBAC5C,CAAC;gBACD,MAAM,OAAO,GAAG,iBAAiB,CAAY,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;gBAC/E,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC7B,MAAM,IAAI,gBAAgB,EAAE,CAAA;gBAC9B,CAAC;gBACD,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;YAC1B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,aAAa,EAAE,CAAC;oBAC/B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;oBAChB,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAA;gBACtC,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,CAAA;gBACT,CAAC;YACH,CAAC;YAED,MAAM,WAAW,GAAG,iBAAiB,CAAY,UAAU,CAAC,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;YACzF,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAEjF,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC;YAErC;gBACE,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,eAAe,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI;gBAC7D,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,iBAAiB,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI;aACpE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;gBACzC,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;oBAChC,KAAK,cAAc,CAAC,GAAG,CAAC,EAAE,CAAA;oBAC1B,OAAO,cAAc,CAAC,GAAG,CAAC,CAAA;gBAC5B,CAAC;YACH,CAAC,CAAC,CAAA;YAEF,MAAM,KAAK,GAAG,iBAAiB,CAAc,kBAAkB,CAAC,aAAa,CAAC,CAAA;YAC9E,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;YAEpC,UAAU,CAAC,IAAI,GAAG,kBAAkB,CAAC,aAAa,CAAA;YAElD,6FAA6F;YAC7F,gGAAgG;YAChG,iFAAiF;YACjF,8FAA8F;YAC9F,4GAA4G;YAC5G,iEAAiE;YACjE,MAAM,KAAK,GAAS,UAA6B,CAAA;YACjD,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAA;YAC5B,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAA;YAC9B,KAAK,CAAC,MAAM,GAAG,IAAI,CAAA;YAEnB,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAA;QAC/B,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}

package/build/manager/plugins/export.d.ts

@@ -0,0 +1,6 @@
+export type * from './types.js';
+export * from './basic-ed25519.js';
+export * from './re-captcha.js';
+export * from './basic-rely.js';
+export * from './utils.js';
+//# sourceMappingURL=export.d.ts.map

package/build/manager/plugins/export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/export.ts"],"names":[],"mappings":"AACA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,YAAY,CAAA"}

package/build/manager/plugins/export.js

@@ -0,0 +1,5 @@
+export * from './basic-ed25519.js';
+export * from './re-captcha.js';
+export * from './basic-rely.js';
+export * from './utils.js';
+//# sourceMappingURL=export.js.map

package/build/manager/plugins/export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.js","sourceRoot":"","sources":["../../../src/manager/plugins/export.ts"],"names":[],"mappings":"AAEA,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,YAAY,CAAA"}

package/build/manager/plugins/index.d.ts

@@ -0,0 +1,4 @@
+import type { AuthPlugin } from './types.js';
+import type { AppContext, AppConfig } from '../types.js';
+export declare const plugins: Record<string, <C extends AppConfig, T extends AppContext<C>>(context: T) => AuthPlugin>;
+//# sourceMappingURL=index.d.ts.map

package/build/manager/plugins/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAIxD,eAAO,MAAM,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,UAAU,CAAM,CAAA"}

package/build/manager/plugins/index.js

@@ -0,0 +1,9 @@
+import { AuthenticationType } from '@owlmeans/auth';
+import { basicEd25519 } from './basic-ed25519.js';
+import { reCaptcha } from './re-captcha.js';
+import { basicRely } from './basic-rely.js';
+export const plugins = {};
+plugins[AuthenticationType.BasicEd25519] = basicEd25519;
+plugins[AuthenticationType.ReCaptcha] = reCaptcha;
+plugins[AuthenticationType.RelyHandshake] = basicRely;
+//# sourceMappingURL=index.js.map

package/build/manager/plugins/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/manager/plugins/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAEnD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEjD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE3C,MAAM,CAAC,MAAM,OAAO,GAA6F,EAAE,CAAA;AAEnH,OAAO,CAAC,kBAAkB,CAAC,YAAY,CAAC,GAAG,YAAoD,CAAA;AAC/F,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,GAAG,SAAiD,CAAA;AACzF,OAAO,CAAC,kBAAkB,CAAC,aAAa,CAAC,GAAG,SAAiD,CAAA"}

package/build/manager/plugins/re-captcha.d.ts

@@ -0,0 +1,4 @@
+import type { AppContext, AppConfig } from '../types.js';
+import type { AuthPlugin } from './types.js';
+export declare const reCaptcha: <C extends AppConfig, T extends AppContext<C>>(context: T) => AuthPlugin;
+//# sourceMappingURL=re-captcha.d.ts.map

package/build/manager/plugins/re-captcha.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"re-captcha.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/re-captcha.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACxD,OAAO,KAAK,EAAE,UAAU,EAAuC,MAAM,YAAY,CAAA;AAUjF,eAAO,MAAM,SAAS,GAAI,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,KAAG,UAiDpF,CAAA"}

package/build/manager/plugins/re-captcha.js

@@ -0,0 +1,49 @@
+import { AuthenFailed, AuthenticationType, AuthPluginError, MOD_RECAPTCHA, AUTH_SCOPE, AuthRole } from '@owlmeans/auth';
+import { PLUGINS } from '@owlmeans/config';
+import { PluginMissconfigured } from '@owlmeans/config';
+import { ModuleOutcome } from '@owlmeans/module';
+import { base64 } from '@scure/base';
+import { randomBytes } from '@noble/hashes/utils';
+import { assertType } from './utils.js';
+export const reCaptcha = (context) => {
+    const plugin = {
+        type: AuthenticationType.ReCaptcha,
+        init: async (request) => {
+            assertType(request.type, plugin);
+            const challenge = base64.encode(randomBytes(32));
+            return { challenge };
+        },
+        authenticate: async (credential) => {
+            const cfg = context.getConfigResource(PLUGINS);
+            const config = await cfg.get(MOD_RECAPTCHA);
+            if (config.value == null) {
+                throw new PluginMissconfigured('value');
+            }
+            const validateRecaptcha = context.module(MOD_RECAPTCHA);
+            const [result, status] = await validateRecaptcha.call({
+                body: {
+                    secret: config.value,
+                    response: credential.credential
+                },
+                headers: { 'content-type': 'application/x-www-form-urlencoded' }
+            });
+            if (status !== ModuleOutcome.Ok) {
+                throw new AuthPluginError('recaptcha:api');
+            }
+            if (!result.success) {
+                throw new AuthenFailed('recaptcha:' + (result['error-codes']?.join(',') ?? 'unknown'));
+            }
+            credential.scopes = [AUTH_SCOPE];
+            credential.role = AuthRole.Guest;
+            credential.type = AuthenticationType.ReCaptcha;
+            const [previous, challenge] = credential.challenge.split(':');
+            if (challenge != null) {
+                credential.challenge = previous;
+                return { token: previous };
+            }
+            return { token: '' };
+        }
+    };
+    return plugin;
+};
+//# sourceMappingURL=re-captcha.js.map

package/build/manager/plugins/re-captcha.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"re-captcha.js","sourceRoot":"","sources":["../../../src/manager/plugins/re-captcha.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAGvH,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAE1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAEvD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAEvC,MAAM,CAAC,MAAM,SAAS,GAAG,CAA+C,OAAU,EAAc,EAAE;IAChG,MAAM,MAAM,GAAe;QACzB,IAAI,EAAE,kBAAkB,CAAC,SAAS;QAElC,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACpB,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAEhC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YAEhD,OAAO,EAAE,SAAS,EAAE,CAAA;QACtB,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAA;YAC9C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,CAAe,aAAa,CAAC,CAAA;YACzD,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;gBACzB,MAAM,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAA;YACzC,CAAC;YACD,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAkC,aAAa,CAAC,CAAA;YACxF,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAsC;gBACzF,IAAI,EAAE;oBACJ,MAAM,EAAE,MAAM,CAAC,KAAK;oBACpB,QAAQ,EAAE,UAAU,CAAC,UAAU;iBAChC;gBACD,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;aACjE,CAAC,CAAA;YACF,IAAI,MAAM,KAAK,aAAa,CAAC,EAAE,EAAE,CAAC;gBAChC,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAA;YAC5C,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,YAAY,CAAC,YAAY,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC,CAAA;YACxF,CAAC;YAED,UAAU,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,CAAA;YAChC,UAAU,CAAC,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAA;YAChC,UAAU,CAAC,IAAI,GAAG,kBAAkB,CAAC,SAAS,CAAA;YAE9C,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAiC,CAAA;YAC7F,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;gBACtB,UAAU,CAAC,SAAS,GAAG,QAAQ,CAAA;gBAE/B,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;YAC5B,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;QACtB,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}