@owlmeans/server-auth 0.1.0

package/build/service.js

@@ -0,0 +1,90 @@
+import { TRUSTED } from '@owlmeans/config';
+import { AUTH_CACHE, AUTH_SRV_KEY, AUTHEN_TIMEFRAME, DEFAULT_ALIAS } from './consts.js';
+import { assertContext, createService } from '@owlmeans/context';
+import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope';
+import { AuthenFailed, AuthorizationError, AuthroizationType } from '@owlmeans/auth';
+import { createStaticResource } from '@owlmeans/static-resource';
+import { trust, extractAuthToken } from '@owlmeans/auth-common/utils';
+export const makeAuthService = (alias = DEFAULT_ALIAS) => {
+    const location = `server-auth:${alias}`;
+    const cache = (context) => context.resource(AUTH_CACHE);
+    const service = createService(alias, {
+        match: async (req) => extractAuthToken(req, AuthroizationType.Ed25519BasicToken) != null,
+        handle: async (req, res) => {
+            const context = assertContext(service.ctx);
+            const authorization = extractAuthToken(req, AuthroizationType.Ed25519BasicToken);
+            if (authorization == null) {
+                return false;
+            }
+            const envelope = makeEnvelopeModel(authorization, EnvelopeKind.Token);
+            const trusted = await trust(context, TRUSTED, context.cfg.alias ?? context.cfg.service);
+            if (!await envelope.verify(trusted.key)) {
+                return false;
+            }
+            res.resolve(envelope.message());
+            return true;
+        },
+        unpack: async (token) => {
+            const context = service.assertCtx();
+            const [, authorization] = token.split(' ');
+            const envelope = makeEnvelopeModel(authorization, EnvelopeKind.Token);
+            const trusted = await trust(context, TRUSTED, context.cfg.alias ?? context.cfg.service);
+            if (!await envelope.verify(trusted.key)) {
+                throw new AuthorizationError('unpack');
+            }
+            return envelope.message();
+        },
+        authenticated: async () => {
+            return null;
+        },
+        authenticate: async (token) => {
+            const context = assertContext(service.ctx, location);
+            const envelope = makeEnvelopeModel(token.token, EnvelopeKind.Token);
+            const authService = await trust(context, TRUSTED, AUTH_SRV_KEY);
+            if (!await envelope.verify(authService.key)) {
+                throw new AuthenFailed();
+            }
+            const credentials = envelope.message();
+            const msg = credentials.challenge;
+            // @TODO This operation is not atomic in case of redis store usage and scling
+            try {
+                await cache(context).create({ id: msg }, { ttl: AUTHEN_TIMEFRAME / 1000 });
+            }
+            catch {
+                throw new AuthenFailed();
+            }
+            if (credentials.credential !== authService.user.id) {
+                throw new AuthenFailed();
+            }
+            // @TODO Move to a plugin
+            const auth = {
+                token: credentials.challenge,
+                userId: credentials.userId,
+                scopes: credentials.scopes,
+                role: credentials.role,
+                type: AuthroizationType.Ed25519BasicToken,
+                source: context.cfg.service,
+                profileId: credentials.profileId,
+                entityId: credentials.entityId,
+                isUser: true,
+                createdAt: new Date()
+            };
+            const trusted = await trust(context, TRUSTED, context.cfg.alias ?? context.cfg.service);
+            const authorization = await makeEnvelopeModel(AuthroizationType.Ed25519BasicToken)
+                .send(auth, null).sign(trusted.key, EnvelopeKind.Token);
+            return { token: `${AuthroizationType.Ed25519BasicToken.toUpperCase()} ${authorization}` };
+        }
+    });
+    return service;
+};
+export const appendAuthService = (ctx, alias = DEFAULT_ALIAS) => {
+    if (!ctx.hasResource(AUTH_CACHE)) {
+        ctx.registerResource(createStaticResource(AUTH_CACHE));
+    }
+    const service = makeAuthService(alias);
+    const context = ctx;
+    context.registerService(service);
+    context.auth = () => ctx.service(service.alias);
+    return context;
+};
+//# sourceMappingURL=service.js.map

package/build/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEvF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE1E,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAGpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAKrE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,QAAgB,aAAa,EAAe,EAAE;IAC5E,MAAM,QAAQ,GAAG,eAAe,KAAK,EAAE,CAAA;IAEvC,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAuB,EAAE,CACtD,OAAO,CAAC,QAAQ,CAAsB,UAAU,CAAC,CAAA;IAEnD,MAAM,OAAO,GAAgB,aAAa,CAAc,KAAK,EAAE;QAC7D,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,IAAI;QAEtF,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAY,CAAA;YACrD,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAA;YAChF,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAE3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxG,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;YAE/B,OAAO,IAAS,CAAA;QAClB,CAAC;QAED,MAAM,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YACpB,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YACpD,MAAM,CAAC,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAE3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxG,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YAED,OAAO,QAAQ,CAAC,OAAO,EAAE,CAAA;QAC3B,CAAC;QAED,aAAa,EAAE,KAAK,IAAI,EAAE;YACxB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YAC1B,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,EAAE,QAAQ,CAAC,CAAA;YAChF,MAAM,QAAQ,GAAG,iBAAiB,CAAkB,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAEpF,MAAM,WAAW,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;YAChF,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YACtC,MAAM,GAAG,GAAG,WAAW,CAAC,SAAS,CAAA;YAEjC,6EAA6E;YAE7E,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;YAC5E,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,IAAI,WAAW,CAAC,UAAU,KAAK,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACnD,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,yBAAyB;YACzB,MAAM,IAAI,GAAS;gBACjB,KAAK,EAAE,WAAW,CAAC,SAAS;gBAC5B,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,IAAI,EAAE,iBAAiB,CAAC,iBAAiB;gBACzC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;gBAC3B,SAAS,EAAE,WAAW,CAAC,SAAS;gBAChC,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAA;YAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxG,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAO,iBAAiB,CAAC,iBAAiB,CAAC;iBACrF,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAEzD,OAAO,EAAE,KAAK,EAAE,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,EAAE,IAAI,aAAa,EAAE,EAAE,CAAA;QAC3F,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,GAAM,EAAE,QAAgB,aAAa,EACd,EAAE;IAEzB,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAA;IACxD,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,GAA4B,CAAA;IAE5C,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAChC,OAAO,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAE/C,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/types.d.ts

@@ -0,0 +1,13 @@
+import type { Auth, AuthToken } from '@owlmeans/auth';
+import type { GuardService } from '@owlmeans/module';
+import type { ResourceRecord } from '@owlmeans/resource';
+export interface AuthService extends GuardService {
+    authenticate: (token: AuthToken) => Promise<AuthToken>;
+    unpack: (token: string) => Promise<Auth>;
+}
+export interface AuthServiceAppend {
+    auth: () => AuthService;
+}
+export interface AuthSpent extends ResourceRecord {
+}
+//# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAExD,MAAM,WAAW,WAAY,SAAQ,YAAY;IAC/C,YAAY,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC,CAAA;IACtD,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACzC;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,WAAW,CAAA;CACxB;AAED,MAAM,WAAW,SAAU,SAAQ,cAAc;CAChD"}

package/build/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,76 @@
+{
+  "name": "@owlmeans/server-auth",
+  "version": "0.1.0",
+  "type": "module",
+  "scripts": {
+    "build": "tsc -b",
+    "dev": "sleep 276 && nodemon -e ts,tsx,json --watch src --exec \"tsc -p ./tsconfig.json\"",
+    "watch": "tsc -b -w --preserveWatchOutput --pretty"
+  },
+  "main": "build/index.js",
+  "module": "build/index.js",
+  "types": "build/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./build/index.js",
+      "require": "./build/index.js",
+      "default": "./build/index.js",
+      "module": "./build/index.js",
+      "types": "./build/index.d.ts"
+    },
+    "./manager": {
+      "import": "./build/manager/index.js",
+      "require": "./build/manager/index.js",
+      "default": "./build/manager/index.js",
+      "module": "./build/manager/index.js",
+      "types": "./build/manager/index.d.ts"
+    },
+    "./manager/plugins": {
+      "import": "./build/manager/plugins/export.js",
+      "require": "./build/manager/plugins/export.js",
+      "default": "./build/manager/plugins/export.js",
+      "module": "./build/manager/plugins/export.js",
+      "types": "./build/manager/plugins/export.d.ts"
+    }
+  },
+  "dependencies": {
+    "@noble/hashes": "^1.5.0",
+    "@owlmeans/api": "^0.1.0",
+    "@owlmeans/api-config-server": "^0.1.0",
+    "@owlmeans/auth": "^0.1.0",
+    "@owlmeans/auth-common": "^0.1.0",
+    "@owlmeans/basic-envelope": "^0.1.0",
+    "@owlmeans/basic-ids": "^0.1.0",
+    "@owlmeans/basic-keys": "^0.1.0",
+    "@owlmeans/client-config": "^0.1.0",
+    "@owlmeans/client-module": "^0.1.0",
+    "@owlmeans/config": "^0.1.0",
+    "@owlmeans/context": "^0.1.0",
+    "@owlmeans/kluster": "^0.1.0",
+    "@owlmeans/module": "^0.1.0",
+    "@owlmeans/redis-resource": "^0.1.0",
+    "@owlmeans/resource": "^0.1.0",
+    "@owlmeans/route": "^0.1.0",
+    "@owlmeans/server-api": "^0.1.0",
+    "@owlmeans/server-context": "^0.1.0",
+    "@owlmeans/server-module": "^0.1.0",
+    "@owlmeans/server-route": "^0.1.0",
+    "@owlmeans/server-socket": "^0.1.0",
+    "@owlmeans/socket": "^0.1.0",
+    "@owlmeans/static-resource": "^0.1.0",
+    "@scure/base": "^1.1.9"
+  },
+  "peerDependencies": {
+    "ajv": "*"
+  },
+  "devDependencies": {
+    "@types/node": "^22.7.8",
+    "nodemon": "^3.1.7",
+    "npm-check": "^6.0.1",
+    "typescript": "^5.6.3"
+  },
+  "private": false,
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/actions/index.ts

@@ -0,0 +1,2 @@
+
+export * from './service.js'

package/src/actions/service.ts

@@ -0,0 +1,16 @@
+import type { RefedModuleHandler } from '@owlmeans/server-module'
+import type { AuthToken } from '@owlmeans/auth'
+import { handleBody } from '@owlmeans/server-api'
+import { AuthServiceAppend } from '../types.js'
+import type { ServerConfig, ServerContext } from '@owlmeans/server-context'
+import { assertContext } from '@owlmeans/context'
+
+type Config = ServerConfig
+type Context = ServerContext<Config> & AuthServiceAppend
+
+export const authenticate: RefedModuleHandler<AuthToken> = handleBody(
+  async (payload: AuthToken, ctx) => {
+    const context = assertContext(ctx, 'authenticate') as Context
+    return await context.auth().authenticate(payload)
+  }
+)

package/src/consts.ts

@@ -0,0 +1,8 @@
+
+export const AUTHEN_TIMEFRAME = 10 * 60 * 1000
+
+export const AUTH_SRV_KEY = 'auth-service'
+
+export const DEFAULT_ALIAS = 'auth'
+
+export const AUTH_CACHE = 'auth-cache'

package/src/index.ts

@@ -0,0 +1,6 @@
+
+export type * from './types.js'
+export * from './model/index.js'
+export * from './consts.js'
+export * from './modules.js'
+export * from './service.js'