@owlmeans/server-auth 0.1.0

package/src/manager/model.ts

@@ -0,0 +1,93 @@
+import type { AuthModel, AppConfig, AppContext } from './types.js'
+import { AuthenFailed, AuthenPayloadError } from '@owlmeans/auth'
+import type { AuthCredentials } from '@owlmeans/auth'
+import { getPlugin } from './plugins/utils.js'
+import { AUTH_CACHE, AUTHEN_TIMEFRAME } from '../consts.js'
+import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
+import type { EnvelopeModel } from '@owlmeans/basic-envelope'
+import { createRelyFlow } from './rely/flow.js'
+import { trusted } from './utils/trusted.js'
+import type { ServerConfig, ServerContext } from '@owlmeans/server-context'
+import type { Resource } from '@owlmeans/resource'
+import type { AuthSpent } from '../types.js'
+
+type Config = ServerConfig
+type Context = ServerContext<Config>
+
+export const makeAuthModel = (context: AppContext<AppConfig>): AuthModel => {
+  const cache = (context: Context): Resource<AuthSpent> =>
+    context.resource<Resource<AuthSpent>>(AUTH_CACHE)
+
+  const model: AuthModel = {
+    init: async request => {
+      const plugin = getPlugin(request.type, context)
+      const response = await plugin.init(request)
+
+      const envelope = makeEnvelopeModel(plugin.type)
+
+      /**
+       * @TODO It looks like we don't validate sourced challenge by any means
+       * So we need to:
+       * 1. Remove it  cause we process it as a separate property anyway
+       * 2. Fix it because it looks like this separate property isn't validated
+       */
+      const challengeToken = request.source != null
+        ? `${request.source}:${response.challenge}` : response.challenge
+
+      const [, keyPair] = await trusted(context)
+      const challenge = await envelope.send(challengeToken, AUTHEN_TIMEFRAME).sign(keyPair, EnvelopeKind.Wrap)
+
+      return { challenge }
+    },
+
+    authenticate: async credential => {
+      const [trustedUser, keyPair] = await trusted(context)
+      const envelope: EnvelopeModel = makeEnvelopeModel(credential.challenge, EnvelopeKind.Wrap)
+      if (!await envelope.verify(keyPair)) {
+        throw new AuthenFailed('challenge')
+      }
+
+      const msg: string = envelope.message(true)
+
+      try {
+        await cache(context).create({ id: msg }, { ttl: (envelope.envelope.ttl ?? AUTHEN_TIMEFRAME) / 1000 })
+      } catch (e) {
+        const error = new AuthenFailed('challenge')
+        if (e instanceof Error) {
+          error.oiriginalStack = `${e} : ${e.stack}`
+        }
+        throw error
+      }
+
+      if (credential.userId == null) {
+        throw new AuthenPayloadError('userId')
+      }
+
+      const plugin = getPlugin(envelope.type(), context)
+
+      // @TODO this token PROBABLY needs to be registered somewhere and rechecked
+      // from time to time to make sure that the session is not deleted 
+      // or permission hasn't changed.
+      // Alternative solution is to have permissions cached and cleaned 
+      // when some broadcast message is sent from authentication system.
+
+      const challenge = credential.challenge
+      const { token } = await plugin.authenticate(Object.assign(credential, { challenge: msg }))
+      credential.challenge = token === '' ? challenge : token
+
+      credential.credential = trustedUser.id
+
+      return {
+        token: await makeEnvelopeModel<AuthCredentials>(credential.type)
+          .send(credential, AUTHEN_TIMEFRAME)
+          .sign(keyPair, EnvelopeKind.Token)
+      }
+    },
+
+    rely: async (conn, auth) => {
+      conn.authenticate = createRelyFlow(context, conn, auth)
+    }
+  }
+
+  return model
+}

package/src/manager/modules.ts

@@ -0,0 +1,29 @@
+
+import { AUTHEN, AUTHEN_AUTHEN, AUTHEN_INIT, AUTHEN_RELY, MOD_RECAPTCHA } from '@owlmeans/auth'
+import { modules as list } from '@owlmeans/auth-common'
+import { modules as apiConfig } from '@owlmeans/api-config-server'
+import { elevate, guard } from '@owlmeans/server-module'
+import * as actions from './actions/index.js'
+import { module } from '@owlmeans/client-module'
+import { backend, route, RouteMethod } from '@owlmeans/route'
+import { handleIntermediate } from '@owlmeans/server-api'
+import { DEFAULT_RELY } from './consts.js'
+
+elevate(list, AUTHEN, handleIntermediate(
+  async (_, context) => await context.updateContext() as typeof context
+), { intermediate: true })
+elevate(list, AUTHEN_INIT, actions.authenticationInit)
+elevate(list, AUTHEN_AUTHEN, actions.authenticate)
+elevate(list, AUTHEN_RELY, actions.rely, guard(DEFAULT_RELY))
+
+export const modules = list
+list.push(...apiConfig)
+list.push(
+  module(
+    route(MOD_RECAPTCHA, '/api/siteverify', backend({
+      host: 'https://www.google.com',
+      base: 'recaptcha',
+      secure: true,
+    }, RouteMethod.POST))
+  )
+)

package/src/manager/plugins/basic-ed25519.ts

@@ -0,0 +1,56 @@
+import { AuthenticationType, AuthenFailed, ALL_SCOPES, AuthRole } from '@owlmeans/auth'
+import type { AuthPlugin } from './types.js'
+import { assertType } from './utils.js'
+import { randomBytes } from '@noble/hashes/utils'
+import { base64 } from '@scure/base'
+import { fromPubKey } from '@owlmeans/basic-keys'
+import type { AppConfig, AppContext } from '../types.js'
+import { TRUSTED } from '@owlmeans/config'
+import type { TrustedRecord } from '@owlmeans/auth-common'
+
+export const basicEd25519 = <C extends AppConfig, T extends AppContext<C>>(context: T): AuthPlugin => {
+  const plugin: AuthPlugin = {
+    type: AuthenticationType.BasicEd25519,
+    init: async request => {
+      assertType(request.type, plugin)
+
+      const challenge = base64.encode(randomBytes(32))
+
+      return { challenge }
+    },
+
+    authenticate: async credential => {
+      /**
+       * @TODO We need to find users in some db not just in static
+       */
+      const systemUser = await context.getConfigResource(TRUSTED)
+        .load<TrustedRecord>(credential.userId)
+
+      if (systemUser == null) {
+        throw new AuthenFailed()
+      }
+
+      if (systemUser.credential == null) {
+        throw new SyntaxError('System user missconfigured')
+      }
+
+      const key = fromPubKey(systemUser.credential)
+
+      if (!await key.verify(credential.challenge, credential.credential)) {
+        throw new AuthenFailed(`challenge:${plugin.type}`)
+      }
+
+      const token = base64.encode(randomBytes(32))
+
+      // @TODO we need to do something with scopes - it's not secure
+      credential.scopes = [ALL_SCOPES]
+      credential.role = AuthRole.Superuser
+      credential.challenge = token
+      credential.type = AuthenticationType.OneTimeToken
+
+      return { token }
+    }
+  }
+
+  return plugin
+}

package/src/manager/plugins/basic-rely.ts

@@ -0,0 +1,167 @@
+import { AuthenFailed, AuthenPayloadError, AuthenticationType, AuthManagerError, AuthorizationError } from '@owlmeans/auth'
+import type { AllowanceResponse, Auth, RelyToken } from '@owlmeans/auth'
+import type { AppContext, RelyAllowanceRequest, RelyCarrier } from '../types.js'
+import type { AuthPlugin, AuthRedisResource, RelyRecord } from './types.js'
+import { makeConsumerRely, makeProviderRely } from '../../model/index.js'
+import { trusted } from '../utils/trusted.js'
+import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
+import { AUTH_CACHE } from '../../consts.js'
+import { ResourceError } from '@owlmeans/resource'
+import { RELY_CALL_TIMEOUT, RELY_PIN_PERFIX, RELY_TOKEN_PREFIX } from '@owlmeans/auth-common'
+
+const _subscriptions: Record<string, CallableFunction> = {}
+export const basicRely = (context: AppContext, type?: string): AuthPlugin => {
+  const plugin: AuthPlugin = {
+    type: type ?? AuthenticationType.RelyHandshake,
+
+    // This method is used by consumer and by provider (wallet)
+    // to initialize shared authentication process.
+    // The idea is that both subscribe to wait for a handshake value
+    // from the peer, that in fact is a subscription to a redis message tunnel.  
+    init: async (request: RelyAllowanceRequest): Promise<AllowanceResponse> => {
+      const [, keyPair] = await trusted(context)
+      const tunnel = context.resource<AuthRedisResource>(AUTH_CACHE)
+      let relyMsg: RelyToken
+      do {
+        try {
+          const rely = request.auth == null ? makeConsumerRely() : makeProviderRely()
+
+          relyMsg = rely.message()
+          const pin = relyMsg.pin != null ? `${RELY_PIN_PERFIX}${relyMsg.pin}` : null
+          const token = relyMsg.token != null ? `${RELY_TOKEN_PREFIX}${relyMsg.token}` : null
+
+          const response = { challenge: await rely.sign(keyPair, EnvelopeKind.Wrap) }
+
+          if (pin != null) {
+            await tunnel.create({ ...response, id: pin }, { ttl: RELY_CALL_TIMEOUT })
+          }
+          if (token != null) {
+            await tunnel.create({ ...response, id: token }, { ttl: RELY_CALL_TIMEOUT })
+          }
+
+          if (request.provideRely != null) {
+            await Promise.all([pin, token].filter(key => key != null).map(async key => {
+              _subscriptions[key] = await tunnel.subscribe(async value => {
+                if (value.challenge != null) {
+                  const rely = makeEnvelopeModel<RelyToken>(value.challenge, EnvelopeKind.Wrap)
+                  if (await rely.verify(keyPair)) {
+                    [pin, token].filter(key => key != null).forEach(key => {
+                      _subscriptions[key]?.()
+                      if (_subscriptions[key] != null) {
+                        delete _subscriptions[key]
+                      }
+                    })
+                    await request.provideRely?.(rely.message(), relyMsg, true)
+                  }
+                }
+              }, { /*ttl: RELY_CALL_TIMEOUT,*/ key, once: true })
+
+              // @TODO they need to be killed on close - but actually live a little bit longer 
+              // then timeout for them is ok
+              setTimeout(() => {
+                if (_subscriptions[key] != null) {
+                  try {
+                    void _subscriptions[key]()
+                    delete _subscriptions[key]
+                  } finally {
+                    void request.conn?.close()
+                  }
+                }
+              }, RELY_CALL_TIMEOUT * 1000)
+            }))
+          }
+
+          return response
+        } catch (e) {
+          if (e instanceof ResourceError) {
+            console.error('COLISION ON TRY TO CREATE RELY PIN\TOKEN...', e)
+          } else {
+            throw e
+          }
+        }
+        await new Promise(resolve => setTimeout(resolve, 500))
+      } while (true)
+    },
+
+    // This part of flow is entered by the party that is active (provides peer's code - token or pin)
+    authenticate: async credential => {
+      const [, keyPair] = await trusted(context)
+      const tunnel = context.resource<AuthRedisResource>(AUTH_CACHE)
+
+      // 1. Just get a peer connection based on provided credential
+      // 2. Provision it with provided own data
+      // 3. Delete own rely connection seeds
+
+      let rely: RelyToken
+      try {
+        let peer: RelyRecord
+        if (credential.credential.startsWith(RELY_PIN_PERFIX)) {
+          const key = credential.credential.substring(RELY_PIN_PERFIX.length)
+          if (key.length > 12) {
+            throw new AuthenPayloadError('pin')
+          }
+          peer = await tunnel.get(credential.credential)
+        } else if (credential.credential.startsWith(RELY_TOKEN_PREFIX)) {
+          const key = credential.credential.substring(RELY_TOKEN_PREFIX.length)
+          if (key.length > 16) {
+            throw new AuthenPayloadError('token')
+          }
+          peer = await tunnel.get(credential.credential)
+        } else {
+          throw new AuthenPayloadError('credential')
+        }
+        const envelop = makeEnvelopeModel<RelyToken>(peer.challenge, EnvelopeKind.Wrap)
+        if (!envelop.verify(keyPair)) {
+          throw new AuthManagerError()
+        }
+        rely = envelop.message()
+      } catch (e) {
+        if (e instanceof ResourceError) {
+          console.error(e)
+          throw new AuthorizationError('rely')
+        } else {
+          throw e
+        }
+      }
+
+      const myChallenge = makeEnvelopeModel<RelyToken>(credential.challenge, EnvelopeKind.Wrap)
+      if (!myChallenge.verify(keyPair)) {
+        throw new AuthenFailed()
+      }
+
+      await tunnel.update({ id: credential.credential, challenge: myChallenge.wrap() })
+
+      const myRely = myChallenge.message();
+
+      [
+        myRely.pin != null ? `${RELY_PIN_PERFIX}${myRely.pin}` : null,
+        myRely.token != null ? `${RELY_TOKEN_PREFIX}${myRely.token}` : null
+      ].filter(key => key != null).forEach(key => {
+        if (_subscriptions[key] != null) {
+          void _subscriptions[key]()
+          delete _subscriptions[key]
+        }
+      })
+
+      const token = makeEnvelopeModel<RelyCarrier>(AuthenticationType.RelyHandshake)
+      token.send({ source: myRely, rely })
+
+      credential.type = AuthenticationType.RelyHandshake
+
+      // @TODO think about it: we create a mixed object here that is credentials and authentication
+      // in the same time. Actually it's a bit dirty. And it means that auth service at the end of the
+      // day can produce both (authentication token and authentication token "ticket").
+      // Why we do it this way here: cause the consumer of authentication is the auth service itself
+      // and there is no need to "exchange" the token (what we do when we come via url redirect to another service
+      // with the one-time auth token potentially exposed as a result).
+      const _auth: Auth = credential as unknown as Auth
+      _auth.createdAt = new Date()
+      _auth.token = token.tokenize()
+      _auth.isUser = true
+
+      return { token: _auth.token }
+    }
+  }
+
+  return plugin
+}

package/src/manager/plugins/export.ts

@@ -0,0 +1,6 @@
+
+export type * from './types.js'
+export * from './basic-ed25519.js'
+export * from './re-captcha.js'
+export * from './basic-rely.js'
+export * from './utils.js'

package/src/manager/plugins/index.ts

@@ -0,0 +1,13 @@
+import { AuthenticationType } from '@owlmeans/auth'
+import type { AuthPlugin } from './types.js'
+import { basicEd25519 } from './basic-ed25519.js'
+import type { AppContext, AppConfig } from '../types.js'
+import { reCaptcha } from './re-captcha.js'
+import { basicRely } from './basic-rely.js'
+
+export const plugins: Record<string, <C extends AppConfig, T extends AppContext<C>>(context: T) => AuthPlugin> = {}
+
+plugins[AuthenticationType.BasicEd25519] = basicEd25519 as typeof plugins[keyof typeof plugins]
+plugins[AuthenticationType.ReCaptcha] = reCaptcha as typeof plugins[keyof typeof plugins]
+plugins[AuthenticationType.RelyHandshake] = basicRely as typeof plugins[keyof typeof plugins]
+

package/src/manager/plugins/re-captcha.ts

@@ -0,0 +1,62 @@
+import { AuthenFailed, AuthenticationType, AuthPluginError, MOD_RECAPTCHA, AUTH_SCOPE, AuthRole } from '@owlmeans/auth'
+import type { AppContext, AppConfig } from '../types.js'
+import type { AuthPlugin, RecaptchaRequest, RecpatchaResponse } from './types.js'
+import { PLUGINS } from '@owlmeans/config'
+import type { PluginConfig } from '@owlmeans/config'
+import { PluginMissconfigured } from '@owlmeans/config'
+import type { ClientModule } from '@owlmeans/client-module'
+import { ModuleOutcome } from '@owlmeans/module'
+import { base64 } from '@scure/base'
+import { randomBytes } from '@noble/hashes/utils'
+import { assertType } from './utils.js'
+
+export const reCaptcha = <C extends AppConfig, T extends AppContext<C>>(context: T): AuthPlugin => {
+  const plugin: AuthPlugin = {
+    type: AuthenticationType.ReCaptcha,
+
+    init: async request => {
+      assertType(request.type, plugin)
+
+      const challenge = base64.encode(randomBytes(32))
+
+      return { challenge }
+    },
+
+    authenticate: async credential => {
+      const cfg = context.getConfigResource(PLUGINS)
+      const config = await cfg.get<PluginConfig>(MOD_RECAPTCHA)
+      if (config.value == null) {
+        throw new PluginMissconfigured('value')
+      }
+      const validateRecaptcha = context.module<ClientModule<RecpatchaResponse>>(MOD_RECAPTCHA)
+      const [result, status] = await validateRecaptcha.call<RecpatchaResponse, RecaptchaRequest>({
+        body: {
+          secret: config.value,
+          response: credential.credential
+        },
+        headers: { 'content-type': 'application/x-www-form-urlencoded' }
+      })
+      if (status !== ModuleOutcome.Ok) {
+        throw new AuthPluginError('recaptcha:api')
+      }
+      if (!result.success) {
+        throw new AuthenFailed('recaptcha:' + (result['error-codes']?.join(',') ?? 'unknown'))
+      }
+
+      credential.scopes = [AUTH_SCOPE]
+      credential.role = AuthRole.Guest
+      credential.type = AuthenticationType.ReCaptcha
+
+      const [previous, challenge] = credential.challenge.split(':') as [string, string | undefined]
+      if (challenge != null) {
+        credential.challenge = previous
+
+        return { token: previous }
+      }
+
+      return { token: '' }
+    }
+  }
+
+  return plugin
+}

package/src/manager/plugins/types.ts

@@ -0,0 +1,27 @@
+import type { AllowanceResponse } from '@owlmeans/auth'
+import type { AuthModel } from '../types.js'
+import type { AbstractRequest } from '@owlmeans/module'
+import type { RedisResource } from '@owlmeans/redis-resource'
+import type { ResourceRecord } from '@owlmeans/resource'
+
+export interface AuthPlugin extends Omit<AuthModel, "rely"> {
+  type: string
+}
+
+export interface RecpatchaResponse {
+  success: boolean
+  challenge_ts: number
+  hostname: string
+  'error-codes'?: string[]
+}
+
+export interface RecaptchaRequest extends AbstractRequest<{
+  secret: string
+  response: string
+  remoteip?: string
+}> { }
+
+export interface RelyRecord extends ResourceRecord, AllowanceResponse {
+}
+
+export interface AuthRedisResource extends RedisResource<RelyRecord> {}

package/src/manager/plugins/utils.ts

@@ -0,0 +1,21 @@
+import { AuthUnknown, TypeMissmatchError } from '@owlmeans/auth'
+import type { AuthPlugin } from './types.js'
+import { plugins } from './index.js'
+import type { AppContext, AppConfig } from '../types.js'
+
+export const assertType = (type: string, plugin: AuthPlugin) => {
+  if (type !== plugin.type) {
+    throw new TypeMissmatchError(plugin.type)
+  }
+}
+
+/**
+ * @throws {AuthUnknown}
+ */
+export const getPlugin = (type: string, context: AppContext<AppConfig>): AuthPlugin => {
+  const plugin = plugins[type]
+  if (plugin == null) {
+    throw new AuthUnknown(type)
+  }
+  return plugins[type](context)
+}

package/src/manager/rely/flow.ts

@@ -0,0 +1,135 @@
+import type { AllowanceRequest, Auth, AuthCredentials, RelyToken } from '@owlmeans/auth'
+import { AUTH_SCOPE, AuthenticationStage, AuthenticationType, AuthPluginError, AuthRole, RELY_3RD } from '@owlmeans/auth'
+import type { AuthenticateMethod, Connection, EventMessage, Message } from '@owlmeans/socket'
+import { isEventMessage, isMessage } from '@owlmeans/socket'
+import type { AppContext, RelyAllowanceRequest, RelyLinker, RelyCarrier } from '../types.js'
+import { makeAuthModel } from '../model.js'
+import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
+import { trusted } from '../utils/trusted.js'
+import { RELY_TUNNEL } from '../consts.js'
+import type { RedisResource } from '@owlmeans/redis-resource'
+import { RELY_ACTION_TIMEOUT } from '@owlmeans/auth-common'
+
+// 1. There is a difference between privileged (provider)
+//    and non-privileged (consumer) request 
+// 2. Source allows to distinguish between provider and consumer
+//    but probably it needs to be universalized some way
+//    cause potentially wallet can also be consumer
+//    (right now consumer will request authentication type)
+// 3. General idea is that: when you are connected, the auth
+//    process can be started from scratch following same stages
+//    and using the same plugins but via socket
+
+export const createRelyFlow = (context: AppContext, conn: Connection, auth?: Auth | null): AuthenticateMethod => {
+  const auhtenticate = conn.authenticate
+
+  const model = makeAuthModel(context)
+  let internalAuth: Auth | null = auth ?? null
+
+  const linker: RelyLinker = async (rely, source, notify) => {
+    const tunnel = context.resource<RedisResource<Message<any>>>(RELY_TUNNEL)
+    const closeReceiver = await tunnel.subscribe(async message => {
+      if (isMessage(message, true)) {
+        await conn.send(message)
+      } else if (isEventMessage(message, true)) {
+        if ((message as EventMessage<unknown>).event === 'close') {
+          await conn.close()
+          closeSender()
+          await closeReceiver()
+        }
+      }
+    }, source.nonce)
+    // We allow to just forward call messages back and forth
+    conn._receiveCall = async msg => { console.info(source.nonce, 'Forward call', msg.method, msg.id) }
+    conn._receiveResult = async msg => { console.info(source.nonce, 'Forward result', msg.id) }
+    conn._receiveError = async msg => { console.info(source.nonce, 'Forward error', msg.id) }
+    conn.defaultCallTimeout = RELY_ACTION_TIMEOUT * 1000
+    const closeSender = conn.listen(async message => {
+      if (isMessage(message, true)) {
+        const forward = { ...message }
+        if (forward.rawData != null) {
+          delete forward.rawData
+        }
+        await tunnel.publish(forward, rely.nonce)
+      } else if (isEventMessage(message, true)) {
+        if (message.event === 'close') {
+          const forward = { ...message as Message<unknown> }
+          if (forward.rawData != null) {
+            delete forward.rawData
+          }
+          await tunnel.publish(forward, rely.nonce)
+          closeSender()
+          await closeReceiver()
+        }
+      }
+    })
+    if (notify === true) {
+      internalAuth = {
+        token: makeEnvelopeModel<RelyToken>(RELY_3RD).send(rely).tokenize(),
+        isUser: true,
+        createdAt: new Date(),
+        type: AuthenticationType.RelyHandshake,
+        role: AuthRole.User,
+        userId: source.nonce,
+        scopes: [AUTH_SCOPE]
+      }
+      await conn.auth(AuthenticationStage.Authenticated, internalAuth)
+    }
+  }
+
+  conn.authenticate = async (stage, payload) => {
+    const [, keyPair] = await trusted(context)
+    switch (stage) {
+      // This part of flow is entered by both consumer and provider (wallet)
+      case AuthenticationStage.Init:
+        const _payload = payload as RelyAllowanceRequest
+        if (auth != null) {
+          _payload.auth = auth
+        } else if (_payload.auth != null) {
+          delete _payload.auth
+        }
+        _payload.provideRely = linker
+        _payload.conn = conn
+
+        try {
+          return [stage, await model.init(_payload as AllowanceRequest) as any]
+        } catch (e) {
+          console.error(e)
+          await conn.close()
+        }
+        break
+      // This part of flow is entered by that actor who enters peer's key (token or pin)
+      case AuthenticationStage.Authenticate:
+        try {
+          const cred = payload as AuthCredentials
+          const authenticated = await model.authenticate(cred)
+          const envelope = makeEnvelopeModel<Auth>(authenticated.token, EnvelopeKind.Token)
+          if (!await envelope.verify(keyPair)) {
+            throw new AuthPluginError('internal-rely')
+          }
+          if (envelope.type() !== AuthenticationType.RelyHandshake) {
+            throw new AuthPluginError('internal-rely')
+          }
+          internalAuth = envelope.message()
+
+          const token = makeEnvelopeModel<RelyCarrier>(internalAuth.token, EnvelopeKind.Token).message()
+
+          await linker(token.rely, token.source)
+
+          return [AuthenticationStage.Authenticated, internalAuth as any]
+        } catch (e) {
+          console.error(e)
+          await conn.close()
+        }
+        break
+      // Support intermediate stage for visual confirmation
+      case AuthenticationStage.Authenticated:
+        return [stage, internalAuth as any]
+      default:
+        return auhtenticate(stage, payload)
+    }
+    return [stage, null as any]
+  }
+
+  return conn.authenticate
+}

package/src/manager/rely/index.ts

@@ -0,0 +1,2 @@
+
+export * from './flow.js'