@owlmeans/server-auth 0.1.0

package/src/manager/rely.ts

@@ -0,0 +1,90 @@
+import { assertContext, createService } from '@owlmeans/context'
+import { DEFAULT_RELY } from './consts.js'
+import type { AppContext, RelyService } from './types.js'
+import { AUTH_QUERY, AuthenFailed, AuthenticationType } from '@owlmeans/auth'
+import type { Auth, AuthCredentials, AuthToken } from '@owlmeans/auth'
+import type { AbstractRequest, AbstractResponse } from '@owlmeans/module'
+import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
+import type { ServerConfig, ServerContext } from '@owlmeans/server-context'
+import { AUTH_CACHE, AUTHEN_TIMEFRAME } from '../consts.js'
+import type { AuthSpent } from '../types.js'
+import type { Resource } from '@owlmeans/resource'
+import { trusted } from './utils/trusted.js'
+
+type Config = ServerConfig
+type Context = ServerContext<Config>
+
+export const createRelyService = (alias: string = DEFAULT_RELY): RelyService => {
+  const _keyPair = async (context: Context) => {
+    const [, keyPair] = await trusted(context as AppContext)
+
+    return keyPair
+  }
+
+  const service: RelyService = createService<RelyService>(alias, {
+    match: async (req: AbstractRequest<AuthToken>) => {
+      const authorization: string | null = req.query[AUTH_QUERY] != null
+        ? `${req.query[AUTH_QUERY]}` : null
+
+      if (authorization == null) {
+        // This is optional Guard. So it can not match only on provided authorization
+        // that is not valid. In other cases it's passed and need to be handled 
+        // to provide or null authentication object.
+        return true
+      }
+
+      const token = makeEnvelopeModel<Auth>(authorization, EnvelopeKind.Token)
+      const auth = token.message()
+
+      return auth.type === AuthenticationType.OneTimeToken
+    },
+
+    handle: async <T>(req: AbstractRequest<AuthToken>, res: AbstractResponse<Auth>) => {
+      const context = assertContext<Config, Context>(service.ctx as Context)
+      const authorization = req.query[AUTH_QUERY]
+      // We authorize in cases when there is no authorization or it's valid one
+      if (authorization == null) {
+        return true as T
+      }
+
+      // @TODO it's likely something is wrong with AbstractRequest types - so it should be fixed there
+      if (typeof authorization !== 'string') {
+        return false as T
+      }
+
+      const envelope = makeEnvelopeModel<AuthCredentials>(authorization, EnvelopeKind.Token)
+
+      if (!await envelope.verify(await _keyPair(context))) {
+        return false as T
+      }
+
+      const msg = envelope.message()
+      if (msg.source !== AuthenticationType.WalletDid) {
+        return false as T
+      }
+
+      try {
+        const cache = (context: Context): Resource<AuthSpent> =>
+          context.resource<Resource<AuthSpent>>(AUTH_CACHE)
+
+        await cache(context).create(
+          { id: msg.challenge }, 
+          { ttl: (envelope.envelope.ttl ?? AUTHEN_TIMEFRAME) / 1000 }
+        )
+      } catch (e) {
+        const error = new AuthenFailed('challenge')
+        if (e instanceof Error) {
+          error.oiriginalStack = `${e} : ${e.stack}`
+        }
+        throw error
+      }
+
+      // @TODO Actually there is some mess. We know that it aint Auth but AuthCredentials
+      res.resolve(msg as unknown as Auth)
+
+      return true as T
+    }
+  }, service => async () => { service.initialized = true })
+
+  return service
+}

package/src/manager/types.ts

@@ -0,0 +1,42 @@
+import type { AllowanceRequest, AllowanceResponse, Auth, AuthCredentials, AuthToken, RelyToken } from '@owlmeans/auth'
+import type { KlusterConfig } from '@owlmeans/kluster'
+import type { GuardService } from '@owlmeans/module'
+import type { ApiServerAppend } from '@owlmeans/server-api'
+import type { ServerContext, ServerConfig } from '@owlmeans/server-context'
+import type { ServiceRoute } from '@owlmeans/server-route'
+import type { Connection } from '@owlmeans/socket'
+import type { StaticResourceAppend } from '@owlmeans/static-resource'
+
+export interface AppConfig extends ServerConfig, KlusterConfig {
+  services: Record<string, ServiceRoute>
+}
+
+export interface AuthModel {
+  init: (request: AllowanceRequest) => Promise<AllowanceResponse>
+
+  authenticate: (credential: AuthCredentials) => Promise<AuthToken>
+
+  rely: (conn: Connection, source?: Auth | null) => Promise<void>
+}
+
+export interface AppContext<C extends AppConfig = AppConfig> extends ServerContext<C>
+  , ApiServerAppend
+  , StaticResourceAppend { }
+
+export interface RelyService extends GuardService {
+}
+
+export interface RelyAllowanceRequest extends AllowanceRequest {
+  auth?: Auth
+  provideRely?: RelyLinker
+  conn?: Connection
+}
+
+export interface RelyLinker {
+  (rely: RelyToken, source: RelyToken, notify?: boolean): Promise<void>
+}
+
+export interface RelyCarrier {
+  source: RelyToken,
+  rely: RelyToken
+}

package/src/manager/utils/index.ts

@@ -0,0 +1,2 @@
+
+export * from './trusted.js'

package/src/manager/utils/trusted.ts

@@ -0,0 +1,16 @@
+import type { KeyPairModel } from '@owlmeans/basic-keys'
+import type { AppContext, AppConfig } from '../types.js'
+import { TRUSTED } from '@owlmeans/config'
+import { AUTH_SRV_KEY } from '../../consts.js'
+import type { TrustedRecord } from '@owlmeans/auth-common'
+import { trust } from '@owlmeans/auth-common/utils'
+
+export const trusted = async (context: AppContext, userName: string = AUTH_SRV_KEY): Promise<[TrustedRecord, KeyPairModel]> => {
+  const trusted = await trust<AppConfig, AppContext>(context, TRUSTED, userName)
+
+  if (trusted.user.secret == null) {
+    throw new SyntaxError(`Auth srvice trusted users should have secret keys to be used ${userName}`)
+  }
+
+  return [trusted.user, trusted.key]
+}

package/src/model/index.ts

@@ -0,0 +1,2 @@
+
+export * from './rely/index.js'

package/src/model/rely/consumer.ts

@@ -0,0 +1,11 @@
+import { makeRelyModel } from './peer.js'
+import type { RelyOptions } from './types.js'
+
+export const makeConsumerRely = (opts?: RelyOptions) => {
+  const model = makeRelyModel(opts)
+  const msg = model.message()
+  delete msg.pin
+  model.send(msg)
+
+  return model
+}

package/src/model/rely/index.ts

@@ -0,0 +1,5 @@
+
+export type * from './types.js'
+export * from './peer.js'
+export * from './provider.js'
+export * from './consumer.js'

package/src/model/rely/peer.ts

@@ -0,0 +1,43 @@
+import type { RelyToken } from '@owlmeans/auth'
+import { RELY_3RD } from '@owlmeans/auth'
+import type { EnvelopeModel } from '@owlmeans/basic-envelope'
+import { makeEnvelopeModel } from '@owlmeans/basic-envelope'
+import { createRandomPrefix, createIdOfLength, IdStyle } from '@owlmeans/basic-ids'
+import { base58 } from '@scure/base'
+import type { RelyOptions } from './types.js'
+import { RELY_CALL_TIMEOUT } from '@owlmeans/auth-common'
+
+export const makeRelyModel = (opts?: RelyOptions): EnvelopeModel<RelyToken> => {
+  const envelope = makeEnvelopeModel<RelyToken>(RELY_3RD)
+
+  const pinLength = opts?.pinLength ?? 6
+  const checkLength = opts?.checkLenght ?? 2
+  const tokenLength = opts?.tokenLength ?? 16
+  const nonceLength = opts?.nonceLength ?? 24
+  const pinQty = Math.ceil(pinLength / 2)
+  const checkQty = Math.ceil(checkLength / 2)
+  const tokenQty = tokenLength
+  const source = createRandomPrefix(pinQty + checkQty + tokenQty)
+  const bytes = base58.decode(source)
+  const pinBytes = bytes.slice(0, pinQty)
+  const checkBytes = bytes.slice(pinQty, pinQty + checkQty)
+  const tokenBytes = bytes.slice(pinQty + checkQty)
+
+  const pin = toNumber(pinBytes).substring(0, pinLength)
+  envelope.send({
+    pin,
+    check: toNumber(checkBytes).substring(0, checkLength),
+    token: base58.encode(tokenBytes).substring(0, tokenLength),
+    nonce: createIdOfLength(nonceLength, IdStyle.Base64)
+  }, opts?.liveTime ?? RELY_CALL_TIMEOUT * 1000)
+
+  return envelope
+}
+
+const toNumber = (bytes: Uint8Array): string => {
+  let pinInt = 0n
+  for (let i = bytes.length - 1; i >= 0; i--) {
+    pinInt = (pinInt << 8n) | BigInt(bytes[i]);
+  }
+  return pinInt.toString()
+}

package/src/model/rely/provider.ts

@@ -0,0 +1,9 @@
+
+import { makeRelyModel } from './peer.js'
+import type { RelyOptions } from './types.js'
+
+export const makeProviderRely = (opts?: RelyOptions) => {
+  const model = makeRelyModel(opts)
+
+  return model
+}

package/src/model/rely/types.ts

@@ -0,0 +1,8 @@
+
+export interface RelyOptions {
+  pinLength?: number
+  checkLenght?: number  
+  tokenLength?: number
+  nonceLength?: number
+  liveTime?: number
+}

package/src/modules.ts

@@ -0,0 +1,17 @@
+
+import { elevate } from '@owlmeans/server-module'
+import { modules as list } from '@owlmeans/auth-common'
+import { DISPATCHER, DISPATCHER_AUTHEN } from '@owlmeans/auth'
+import type { ServerModule } from '@owlmeans/server-module'
+import { authenticate } from './actions/service.js'
+import { stab, elevate as celevate } from '@owlmeans/client-module'
+
+elevate(list, DISPATCHER_AUTHEN, authenticate)
+celevate(list, DISPATCHER, stab)
+
+export const modules: ServerModule<unknown>[] = [
+  ...list.filter(
+    (module): module is ServerModule<unknown> =>
+      [DISPATCHER, DISPATCHER_AUTHEN].includes(module.getAlias())
+  )
+]

package/src/service.ts

@@ -0,0 +1,126 @@
+import type { ServerContext, ServerConfig } from '@owlmeans/server-context'
+import { TRUSTED } from '@owlmeans/config'
+import { AUTH_CACHE, AUTH_SRV_KEY, AUTHEN_TIMEFRAME, DEFAULT_ALIAS } from './consts.js'
+import type { AuthServiceAppend, AuthService, AuthSpent } from './types.js'
+import { assertContext, createService } from '@owlmeans/context'
+import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
+import type { Auth, AuthCredentials } from '@owlmeans/auth'
+import { AuthenFailed, AuthorizationError, AuthroizationType } from '@owlmeans/auth'
+import type { AbstractRequest, AbstractResponse } from '../../module/build/types.js'
+import type { Resource } from '@owlmeans/resource'
+import { createStaticResource } from '@owlmeans/static-resource'
+import { trust, extractAuthToken } from '@owlmeans/auth-common/utils'
+
+type Config = ServerConfig
+type Context = ServerContext<Config>
+
+export const makeAuthService = (alias: string = DEFAULT_ALIAS): AuthService => {
+  const location = `server-auth:${alias}`
+
+  const cache = (context: Context): Resource<AuthSpent> =>
+    context.resource<Resource<AuthSpent>>(AUTH_CACHE)
+
+  const service: AuthService = createService<AuthService>(alias, {
+    match: async req => extractAuthToken(req, AuthroizationType.Ed25519BasicToken) != null,
+
+    handle: async <T>(req: AbstractRequest, res: AbstractResponse<Auth>) => {
+      const context = assertContext(service.ctx) as Context
+      const authorization = extractAuthToken(req, AuthroizationType.Ed25519BasicToken)
+      if (authorization == null) {
+        return false as T
+      }
+
+      const envelope = makeEnvelopeModel<Auth>(authorization, EnvelopeKind.Token)
+
+      const trusted = await trust<Config, Context>(context, TRUSTED, context.cfg.alias ?? context.cfg.service)
+      if (!await envelope.verify(trusted.key)) {
+        return false as T
+      }
+
+      res.resolve(envelope.message())
+
+      return true as T
+    },
+
+    unpack: async token => {
+      const context = service.assertCtx<Config, Context>()
+      const [, authorization] = token.split(' ')
+      const envelope = makeEnvelopeModel<Auth>(authorization, EnvelopeKind.Token)
+
+      const trusted = await trust<Config, Context>(context, TRUSTED, context.cfg.alias ?? context.cfg.service)
+      if (!await envelope.verify(trusted.key)) {
+        throw new AuthorizationError('unpack')
+      }
+
+      return envelope.message()
+    },
+
+    authenticated: async () => {
+      return null
+    },
+
+    authenticate: async token => {
+      const context = assertContext<Config, Context>(service.ctx as Context, location)
+      const envelope = makeEnvelopeModel<AuthCredentials>(token.token, EnvelopeKind.Token)
+
+      const authService = await trust<Config, Context>(context, TRUSTED, AUTH_SRV_KEY)
+      if (!await envelope.verify(authService.key)) {
+        throw new AuthenFailed()
+      }
+
+      const credentials = envelope.message()
+      const msg = credentials.challenge
+
+      // @TODO This operation is not atomic in case of redis store usage and scling
+
+      try {
+        await cache(context).create({ id: msg }, { ttl: AUTHEN_TIMEFRAME / 1000 })
+      } catch {
+        throw new AuthenFailed()
+      }
+
+      if (credentials.credential !== authService.user.id) {
+        throw new AuthenFailed()
+      }
+
+      // @TODO Move to a plugin
+      const auth: Auth = {
+        token: credentials.challenge,
+        userId: credentials.userId,
+        scopes: credentials.scopes,
+        role: credentials.role,
+        type: AuthroizationType.Ed25519BasicToken,
+        source: context.cfg.service,
+        profileId: credentials.profileId,
+        entityId: credentials.entityId,
+        isUser: true,
+        createdAt: new Date()
+      }
+
+      const trusted = await trust<Config, Context>(context, TRUSTED, context.cfg.alias ?? context.cfg.service)
+      const authorization = await makeEnvelopeModel<Auth>(AuthroizationType.Ed25519BasicToken)
+        .send(auth, null).sign(trusted.key, EnvelopeKind.Token)
+
+      return { token: `${AuthroizationType.Ed25519BasicToken.toUpperCase()} ${authorization}` }
+    }
+  })
+
+  return service
+}
+
+export const appendAuthService = <C extends Config, T extends ServerContext<C>>(
+  ctx: T, alias: string = DEFAULT_ALIAS
+): T & AuthServiceAppend => {
+
+  if (!ctx.hasResource(AUTH_CACHE)) {
+    ctx.registerResource(createStaticResource(AUTH_CACHE))
+  }
+
+  const service = makeAuthService(alias)
+  const context = ctx as T & AuthServiceAppend
+
+  context.registerService(service)
+  context.auth = () => ctx.service(service.alias)
+
+  return context
+}

package/src/types.ts

@@ -0,0 +1,15 @@
+import type { Auth, AuthToken } from '@owlmeans/auth'
+import type { GuardService } from '@owlmeans/module'
+import type { ResourceRecord } from '@owlmeans/resource'
+
+export interface AuthService extends GuardService {
+  authenticate: (token: AuthToken) => Promise<AuthToken>
+  unpack: (token: string) => Promise<Auth>
+}
+
+export interface AuthServiceAppend {
+  auth: () => AuthService
+}
+
+export interface AuthSpent extends ResourceRecord {
+}

package/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "extends": [
+    "../tsconfig.default.json",
+  ],
+  "compilerOptions": {
+    "rootDir": "./src/", /* Specify the root folder within your source files. */
+    "outDir": "./build/", /* Specify an output folder for all emitted files. */
+    "moduleResolution": "Bundler"
+  },
+  "exclude": [
+    "./dist/**/*",
+    "./build/**/*",
+    "./*.ts"
+  ]
+}

package/tsconfig.tsbuildinfo

@@ -0,0 +1 @@
+{"root":["./src/consts.ts","./src/index.ts","./src/modules.ts","./src/service.ts","./src/types.ts","./src/actions/index.ts","./src/actions/service.ts","./src/manager/consts.ts","./src/manager/context.ts","./src/manager/exports.ts","./src/manager/index.ts","./src/manager/main.ts","./src/manager/model.ts","./src/manager/modules.ts","./src/manager/rely.ts","./src/manager/types.ts","./src/manager/actions/index.ts","./src/manager/actions/manager.ts","./src/manager/plugins/basic-ed25519.ts","./src/manager/plugins/basic-rely.ts","./src/manager/plugins/export.ts","./src/manager/plugins/index.ts","./src/manager/plugins/re-captcha.ts","./src/manager/plugins/types.ts","./src/manager/plugins/utils.ts","./src/manager/rely/flow.ts","./src/manager/rely/index.ts","./src/manager/utils/index.ts","./src/manager/utils/trusted.ts","./src/model/index.ts","./src/model/rely/consumer.ts","./src/model/rely/index.ts","./src/model/rely/peer.ts","./src/model/rely/provider.ts","./src/model/rely/types.ts"],"version":"5.6.3"}