@owlmeans/server-auth 0.1.18-rc.4 → 0.1.18-rc.40

package/build/manager/supervisor.d.ts

@@ -4,7 +4,7 @@ import type { AppConfig, AppContext } from './types.js';
  * What a `SupervisorUserResolver` returns: the identity the supervisor-minted
  * token will represent. Only `userId` is required - the rest default sensibly.
  */
-export interface SupervisorUserResolution extends Partial<Pick<AuthPayload, 'profileId' | 'entityId' | 'role' | 'scopes'>> {
+export interface SupervisorUserResolution extends Partial<Pick<AuthPayload, 'profileId' | 'entitySlug' | 'role' | 'scopes'>> {
     userId: string;
 }
 /**
@@ -34,7 +34,7 @@ export interface SupervisorAuthOptions {
     enabled?: boolean;
     /**
      * Also accept internal owlmeans `Ed25519BasicToken`s even when another guard
-     * (e.g. OIDC) is the primary guard on protected modules. Default: true.
+     * (e.g. OIDC) is the primary guard on protected entrypoints. Default: true.
      */
     acceptInternalTokens?: boolean;
     /** The internal-token guard to add as a coguard. Default: DEFAULT_GUARD ('auth'). */
@@ -42,12 +42,12 @@ export interface SupervisorAuthOptions {
 }
 /**
  * Ensure the internal `Ed25519BasicToken` guard is accepted as a coguard on every
- * already-guarded backend module, so internal owlmeans tokens keep working even
+ * already-guarded backend entrypoint, so internal owlmeans tokens keep working even
  * when another guard (e.g. OIDC) is the primary guard. The primary guard stays
  * first; the internal guard is appended as a fallback (its `match` only fires for
  * an `Ed25519BasicToken` authorization header).
  */
-export declare const setupInternalTokenCoguard: (modules: Array<{
+export declare const setupInternalTokenCoguard: (entrypoints: Array<{
     guards?: string[];
 }>, guard?: string) => void;
 /**
@@ -56,7 +56,7 @@ export declare const setupInternalTokenCoguard: (modules: Array<{
  *
  * It registers the supervisor auth plugin (verifies a front-end signature against
  * the allowlisted trusted keys, then resolves/registers the target user) and -
- * unless disabled - makes protected modules also accept internal owlmeans tokens
+ * unless disabled - makes protected entrypoints also accept internal owlmeans tokens
  * (requirement: understand internal tokens even when OIDC is the primary guard).
  */
 export declare const appendSupervisorAuth: <C extends AppConfig, T extends AppContext<C>>(context: T, opts?: SupervisorAuthOptions) => T;

package/build/manager/supervisor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../../src/manager/supervisor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAEjD,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAIvD;;;GAGG;AACH,MAAM,WAAW,wBAAyB,SAAQ,OAAO,CAAC,IAAI,CAAC,WAAW,EACxE,WAAW,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC,CAAC;IAC9C,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,CAAC,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,EAC3C,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,GACtD,OAAO,CAAC,wBAAwB,CAAC,CAAA;CACrC;AAED,qDAAqD;AACrD,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,iBAAiB,EAAE,OAAO,CAAA;IAC1B,WAAW,CAAC,EAAE,sBAAsB,CAAA;CACrC;AAED,MAAM,WAAW,qBAAqB;IACpC,2FAA2F;IAC3F,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,sBAAsB,CAAA;IACpC,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,+FAA+F;IAC/F,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,qFAAqF;IACrF,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAOD;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,YAC3B,KAAK,CAAC;IAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,UAAS,MAAM,KACnD,IAMF,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,WACtE,CAAC,SAAS,qBAAqB,KACvC,CAyBF,CAAA"}
+{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../../src/manager/supervisor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAEjD,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAIvD;;;GAGG;AACH,MAAM,WAAW,wBAAyB,SAAQ,OAAO,CAAC,IAAI,CAAC,WAAW,EACxE,WAAW,GAAG,YAAY,GAAG,MAAM,GAAG,QAAQ,CAAC,CAAC;IAChD,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,CAAC,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,EAC3C,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,GACtD,OAAO,CAAC,wBAAwB,CAAC,CAAA;CACrC;AAED,qDAAqD;AACrD,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,iBAAiB,EAAE,OAAO,CAAA;IAC1B,WAAW,CAAC,EAAE,sBAAsB,CAAA;CACrC;AAED,MAAM,WAAW,qBAAqB;IACpC,2FAA2F;IAC3F,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,sBAAsB,CAAA;IACpC,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,+FAA+F;IAC/F,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,qFAAqF;IACrF,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAOD;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,gBACvB,KAAK,CAAC;IAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,UAAS,MAAM,KACvD,IAMF,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,WACtE,CAAC,SAAS,qBAAqB,KACvC,CAyBF,CAAA"}

package/build/manager/supervisor.js

@@ -6,13 +6,13 @@ const DEFAULT_SUPERVISORS = ['master', 'superuser'];
 const isDevelopment = (context) => context.cfg.debug?.all === true || context.cfg.debug?.supervisor === true;
 /**
  * Ensure the internal `Ed25519BasicToken` guard is accepted as a coguard on every
- * already-guarded backend module, so internal owlmeans tokens keep working even
+ * already-guarded backend entrypoint, so internal owlmeans tokens keep working even
  * when another guard (e.g. OIDC) is the primary guard. The primary guard stays
  * first; the internal guard is appended as a fallback (its `match` only fires for
  * an `Ed25519BasicToken` authorization header).
  */
-export const setupInternalTokenCoguard = (modules, guard = DEFAULT_GUARD) => {
-    modules.forEach(module => {
+export const setupInternalTokenCoguard = (entrypoints, guard = DEFAULT_GUARD) => {
+    entrypoints.forEach(module => {
         if (module.guards != null && module.guards.length > 0 && !module.guards.includes(guard)) {
             module.guards.push(guard);
         }
@@ -24,7 +24,7 @@ export const setupInternalTokenCoguard = (modules, guard = DEFAULT_GUARD) => {
  *
  * It registers the supervisor auth plugin (verifies a front-end signature against
  * the allowlisted trusted keys, then resolves/registers the target user) and -
- * unless disabled - makes protected modules also accept internal owlmeans tokens
+ * unless disabled - makes protected entrypoints also accept internal owlmeans tokens
  * (requirement: understand internal tokens even when OIDC is the primary guard).
  */
 export const appendSupervisorAuth = (context, opts) => {

package/build/manager/supervisor.js.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../../src/manager/supervisor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAEnD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAErD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AA+C9D,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;AAEnD,MAAM,aAAa,GAAG,CAAC,OAAqE,EAAW,EAAE,CACvG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;AAE3E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,OAAqC,EAAE,KAAK,GAAW,aAAa,EAC9D,EAAE;IACR,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;QACvB,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACxF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC3B,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,OAAU,EAAE,IAA4B,EACrC,EAAE;IACL,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC,CAAA;IACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,MAAM,QAAQ,GAA4B;QACxC,WAAW,EAAE,IAAI,EAAE,WAAW,IAAI,mBAAmB;QACrD,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,IAAI,IAAI;QAClD,WAAW,EAAE,IAAI,EAAE,WAAW;KAC/B,CAAA;IAED,cAAc,CACZ,kBAAkB,CAAC,UAAU,EAC7B,CAAC,GAAG,CAAC,EAAE,CAAC,oBAAoB,CAAC,GAAuC,EAAE,QAAQ,CAAC,CAAyC,CACzH,CAAA;IAED,IAAI,IAAI,EAAE,oBAAoB,KAAK,KAAK,EAAE,CAAC;QACzC,yBAAyB,CACvB,OAAO,CAAC,WAAW,EAA6C,EAChE,IAAI,EAAE,KAAK,IAAI,aAAa,CAC7B,CAAA;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
+{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../../src/manager/supervisor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAEnD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAErD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AA+C9D,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;AAEnD,MAAM,aAAa,GAAG,CAAC,OAAqE,EAAW,EAAE,CACvG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;AAE3E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,WAAyC,EAAE,KAAK,GAAW,aAAa,EAClE,EAAE;IACR,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;QAC3B,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACxF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC3B,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,OAAU,EAAE,IAA4B,EACrC,EAAE;IACL,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC,CAAA;IACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,MAAM,QAAQ,GAA4B;QACxC,WAAW,EAAE,IAAI,EAAE,WAAW,IAAI,mBAAmB;QACrD,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,IAAI,IAAI;QAClD,WAAW,EAAE,IAAI,EAAE,WAAW;KAC/B,CAAA;IAED,cAAc,CACZ,kBAAkB,CAAC,UAAU,EAC7B,CAAC,GAAG,CAAC,EAAE,CAAC,oBAAoB,CAAC,GAAuC,EAAE,QAAQ,CAAC,CAAyC,CACzH,CAAA;IAED,IAAI,IAAI,EAAE,oBAAoB,KAAK,KAAK,EAAE,CAAC;QACzC,yBAAyB,CACvB,OAAO,CAAC,WAAW,EAA6C,EAChE,IAAI,EAAE,KAAK,IAAI,aAAa,CAC7B,CAAA;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/model/rely/consumer.d.ts

@@ -1,3 +1,5 @@
+import type { RelyToken } from '@owlmeans/auth';
+import type { EnvelopeModel } from '@owlmeans/basic-envelope';
 import type { RelyOptions } from './types.js';
-export declare const makeConsumerRely: (opts?: RelyOptions) => import("@owlmeans/basic-envelope").EnvelopeModel<import("@owlmeans/auth").RelyToken>;
+export declare const makeConsumerRely: (opts?: RelyOptions) => EnvelopeModel<RelyToken>;
 //# sourceMappingURL=consumer.d.ts.map

package/build/model/rely/consumer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consumer.d.ts","sourceRoot":"","sources":["../../../src/model/rely/consumer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C,eAAO,MAAM,gBAAgB,UAAW,WAAW,yFAOlD,CAAA"}
+{"version":3,"file":"consumer.d.ts","sourceRoot":"","sources":["../../../src/model/rely/consumer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C,eAAO,MAAM,gBAAgB,UAAW,WAAW,KAAG,aAAa,CAAC,SAAS,CAO5E,CAAA"}

package/build/model/rely/consumer.js.map

@@ -1 +1 @@
-{"version":3,"file":"consumer.js","sourceRoot":"","sources":["../../../src/model/rely/consumer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAGzC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAkB,EAAE,EAAE;IACrD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAA;IAC3B,OAAO,GAAG,CAAC,GAAG,CAAA;IACd,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAEf,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}
+{"version":3,"file":"consumer.js","sourceRoot":"","sources":["../../../src/model/rely/consumer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAKzC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAkB,EAA4B,EAAE;IAC/E,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAA;IAC3B,OAAO,GAAG,CAAC,GAAG,CAAA;IACd,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAEf,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}

package/build/model/rely/provider.d.ts

@@ -1,3 +1,5 @@
+import type { RelyToken } from '@owlmeans/auth';
+import type { EnvelopeModel } from '@owlmeans/basic-envelope';
 import type { RelyOptions } from './types.js';
-export declare const makeProviderRely: (opts?: RelyOptions) => import("@owlmeans/basic-envelope").EnvelopeModel<import("@owlmeans/auth").RelyToken>;
+export declare const makeProviderRely: (opts?: RelyOptions) => EnvelopeModel<RelyToken>;
 //# sourceMappingURL=provider.d.ts.map

package/build/model/rely/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../src/model/rely/provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C,eAAO,MAAM,gBAAgB,UAAW,WAAW,yFAIlD,CAAA"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../src/model/rely/provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C,eAAO,MAAM,gBAAgB,UAAW,WAAW,KAAG,aAAa,CAAC,SAAS,CAI5E,CAAA"}

package/build/model/rely/provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../../src/model/rely/provider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAGzC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAkB,EAAE,EAAE;IACrD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAEjC,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../../src/model/rely/provider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAKzC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAkB,EAA4B,EAAE;IAC/E,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAEjC,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}

package/build/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAG3E,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAa,MAAM,YAAY,CAAA;AAU3E,KAAK,MAAM,GAAG,YAAY,CAAA;AAG1B,eAAO,MAAM,eAAe,WAAW,MAAM,KAAmB,WA4F/D,CAAA;AAED,eAAO,MAAM,iBAAiB,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,aAAa,CAAC,CAAC,CAAC,OACvE,CAAC,UAAS,MAAM,KACpB,CAAC,GAAG,iBAaN,CAAA"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAG3E,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAa,MAAM,YAAY,CAAA;AAoB3E,KAAK,MAAM,GAAG,YAAY,CAAA;AAG1B,eAAO,MAAM,eAAe,WAAW,MAAM,KAAmB,WAqL/D,CAAA;AAED,eAAO,MAAM,iBAAiB,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,aAAa,CAAC,CAAC,CAAC,OACvE,CAAC,UAAS,MAAM,KACpB,CAAC,GAAG,iBAiBN,CAAA"}

package/build/service.js

@@ -2,12 +2,61 @@ import { TRUSTED } from '@owlmeans/config';
 import { AUTH_CACHE, AUTH_SRV_KEY, AUTHEN_TIMEFRAME, DEFAULT_ALIAS } from './consts.js';
 import { assertContext, createService } from '@owlmeans/context';
 import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope';
-import { AuthenFailed, AuthorizationError, AuthroizationType } from '@owlmeans/auth';
+import { AuthenFailed, AuthorizationError, AuthroizationType, AuthUnavailable } from '@owlmeans/auth';
 import { createStaticResource } from '@owlmeans/static-resource';
 import { trust, extractAuthToken } from '@owlmeans/auth-common/utils';
+import { ENTITY_RESOLVER } from '@owlmeans/auth-common';
+import { AUTH_IDENTITY_PROFILE } from '@owlmeans/server-auth-identity';
+import { appendMemoryAuthSessionManager, AUTH_SESSION_MANAGER, AUTH_SESSION_TTL } from '@owlmeans/server-auth-session';
+import { uuid } from '@owlmeans/basic-ids';
+import { TOKEN_UPDATE } from '@owlmeans/auth-common';
 export const makeAuthService = (alias = DEFAULT_ALIAS) => {
     const location = `server-auth:${alias}`;
     const cache = (context) => context.resource(AUTH_CACHE);
+    const sessions = (context) => context.hasService(AUTH_SESSION_MANAGER)
+        ? context.service(AUTH_SESSION_MANAGER)
+        : null;
+    const entityIdFor = async (context, entitySlug) => {
+        if (entitySlug == null || entitySlug === '')
+            return null;
+        if (!context.hasService(ENTITY_RESOLVER))
+            return entitySlug;
+        const entity = await context.service(ENTITY_RESOLVER).resolve(entitySlug);
+        return entity?.id ?? null;
+    };
+    const refresh = async (context, auth, version) => {
+        const entityId = await entityIdFor(context, auth.entitySlug);
+        if (entityId == null || auth.profileId == null || !context.hasResource(AUTH_IDENTITY_PROFILE))
+            return null;
+        const profiles = context.resource(AUTH_IDENTITY_PROFILE);
+        let profile = null;
+        try {
+            profile = await profiles.load({ entityId, profileId: auth.profileId });
+        }
+        catch {
+            // A missing profile is a definitive authentication refusal; a failed profile store is an
+            // availability dependency and must not look like a revoked browser session.
+            throw new AuthUnavailable('identity-profile');
+        }
+        if (profile == null || (profile.expiresAt != null && new Date(profile.expiresAt).getTime() <= Date.now()))
+            return null;
+        return {
+            ...auth,
+            userId: profile.userId ?? auth.userId,
+            role: profile.role,
+            scopes: profile.scopes ?? [],
+            ...(profile.permissions != null ? { permissions: profile.permissions } : {}),
+            authorizationVersion: version,
+            createdAt: new Date()
+        };
+    };
+    const sign = async (context, auth) => {
+        const trusted = await trust(context, TRUSTED, context.cfg.alias ?? context.cfg.service);
+        const ttl = auth.expiresAt == null ? AUTH_SESSION_TTL : Math.max(0, new Date(auth.expiresAt).getTime() - Date.now());
+        const authorization = await makeEnvelopeModel(AuthroizationType.Ed25519BasicToken)
+            .send(auth, ttl).sign(trusted.key, EnvelopeKind.Token);
+        return `${AuthroizationType.Ed25519BasicToken.toUpperCase()} ${authorization}`;
+    };
     const service = createService(alias, {
         match: async (req) => extractAuthToken(req, AuthroizationType.Ed25519BasicToken) != null,
         handle: async (req, res) => {
@@ -21,7 +70,32 @@ export const makeAuthService = (alias = DEFAULT_ALIAS) => {
             if (!await envelope.verify(trusted.key)) {
                 return false;
             }
-            res.resolve(envelope.message());
+            let auth = envelope.message();
+            const manager = sessions(context);
+            if (manager != null) {
+                if (auth.sessionId == null)
+                    return false;
+                let decision;
+                try {
+                    decision = await manager.inspect(auth.sessionId);
+                }
+                catch {
+                    // Registry availability is a security dependency. A guard cannot authenticate through it.
+                    throw new AuthUnavailable('session-registry');
+                }
+                if (decision.state !== 'active' && decision.state !== 'refresh')
+                    return false;
+                if (decision.state === 'refresh') {
+                    const refreshed = await refresh(context, auth, decision.version);
+                    if (refreshed == null)
+                        return false;
+                    auth = refreshed;
+                    const replacement = await sign(context, auth);
+                    res.responseProvider?.header(TOKEN_UPDATE, replacement);
+                    req.headers = { ...req.headers, authorization: replacement };
+                }
+            }
+            res.resolve(auth);
             return true;
         },
         unpack: async (token) => {
@@ -32,7 +106,22 @@ export const makeAuthService = (alias = DEFAULT_ALIAS) => {
             if (!await envelope.verify(trusted.key)) {
                 throw new AuthorizationError('unpack');
             }
-            return envelope.message();
+            const auth = envelope.message();
+            const manager = sessions(context);
+            if (manager != null) {
+                if (auth.sessionId == null)
+                    throw new AuthorizationError('session');
+                let decision;
+                try {
+                    decision = await manager.inspect(auth.sessionId);
+                }
+                catch {
+                    throw new AuthUnavailable('session-registry');
+                }
+                if (decision.state !== 'active')
+                    throw new AuthorizationError('session');
+            }
+            return auth;
         },
         authenticated: async () => {
             return null;
@@ -57,6 +146,8 @@ export const makeAuthService = (alias = DEFAULT_ALIAS) => {
                 throw new AuthenFailed();
             }
             // @TODO Move to a plugin
+            const issuedAt = Date.now();
+            const expiresAt = new Date(issuedAt + AUTH_SESSION_TTL);
             const auth = {
                 token: credentials.challenge,
                 userId: credentials.userId,
@@ -65,14 +156,27 @@ export const makeAuthService = (alias = DEFAULT_ALIAS) => {
                 type: AuthroizationType.Ed25519BasicToken,
                 source: context.cfg.service,
                 profileId: credentials.profileId,
-                entityId: credentials.entityId,
+                entitySlug: credentials.entitySlug,
                 isUser: true,
-                createdAt: new Date()
+                createdAt: new Date(issuedAt),
+                expiresAt,
+                sessionId: uuid(),
+                authorizationVersion: 1
             };
-            const trusted = await trust(context, TRUSTED, context.cfg.alias ?? context.cfg.service);
-            const authorization = await makeEnvelopeModel(AuthroizationType.Ed25519BasicToken)
-                .send(auth, null).sign(trusted.key, EnvelopeKind.Token);
-            return { token: `${AuthroizationType.Ed25519BasicToken.toUpperCase()} ${authorization}` };
+            const manager = sessions(context);
+            if (manager != null) {
+                const entityId = await entityIdFor(context, auth.entitySlug);
+                if (entityId == null || auth.profileId == null)
+                    throw new AuthenFailed('session');
+                const decision = await manager.register({
+                    id: auth.sessionId, kind: 'bearer', entityId, profileId: auth.profileId,
+                    issuedAt, expiresAt: expiresAt.getTime()
+                });
+                if (decision.state !== 'active')
+                    throw new AuthenFailed('session');
+                auth.authorizationVersion = decision.version;
+            }
+            return { token: await sign(context, auth) };
         }
     });
     return service;
@@ -81,6 +185,9 @@ export const appendAuthService = (ctx, alias = DEFAULT_ALIAS) => {
     if (!ctx.hasResource(AUTH_CACHE)) {
         ctx.registerResource(createStaticResource(AUTH_CACHE));
     }
+    // Every standalone server gets an expiring process-local registry. Scaled deployments replace
+    // it with appendRedisAuthSessionManager before calling this helper.
+    appendMemoryAuthSessionManager(ctx);
     const service = makeAuthService(alias);
     const context = ctx;
     context.registerService(service);

package/build/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEvF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE1E,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAGpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAKrE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAK,GAAW,aAAa,EAAe,EAAE;IAC5E,MAAM,QAAQ,GAAG,eAAe,KAAK,EAAE,CAAA;IAEvC,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAuB,EAAE,CACtD,OAAO,CAAC,QAAQ,CAAsB,UAAU,CAAC,CAAA;IAEnD,MAAM,OAAO,GAAgB,aAAa,CAAc,KAAK,EAAE;QAC7D,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,IAAI;QAEtF,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAY,CAAA;YACrD,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAA;YAChF,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAE3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxG,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;YAE/B,OAAO,IAAS,CAAA;QAClB,CAAC;QAED,MAAM,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YACpB,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YACpD,MAAM,CAAC,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAE3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxG,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YAED,OAAO,QAAQ,CAAC,OAAO,EAAE,CAAA;QAC3B,CAAC;QAED,aAAa,EAAE,KAAK,IAAI,EAAE;YACxB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YAC1B,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,EAAE,QAAQ,CAAC,CAAA;YAChF,MAAM,QAAQ,GAAG,iBAAiB,CAAkB,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAEpF,MAAM,WAAW,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;YAChF,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YACtC,MAAM,GAAG,GAAG,WAAW,CAAC,SAAS,CAAA;YAEjC,6EAA6E;YAE7E,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;YAC5E,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,IAAI,WAAW,CAAC,UAAU,KAAK,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACnD,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,yBAAyB;YACzB,MAAM,IAAI,GAAS;gBACjB,KAAK,EAAE,WAAW,CAAC,SAAS;gBAC5B,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,IAAI,EAAE,iBAAiB,CAAC,iBAAiB;gBACzC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;gBAC3B,SAAS,EAAE,WAAW,CAAC,SAAS;gBAChC,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAA;YAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxG,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAO,iBAAiB,CAAC,iBAAiB,CAAC;iBACrF,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAEzD,OAAO,EAAE,KAAK,EAAE,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,EAAE,IAAI,aAAa,EAAE,EAAE,CAAA;QAC3F,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,GAAM,EAAE,KAAK,GAAW,aAAa,EACd,EAAE;IAEzB,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAA;IACxD,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,GAA4B,CAAA;IAE5C,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAChC,OAAO,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAE/C,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEvF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE1E,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAGrG,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAEtE,OAAO,EACL,8BAA8B,EAAE,oBAAoB,EAAE,gBAAgB,EACvE,MAAM,+BAA+B,CAAA;AAEtC,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAKpD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAK,GAAW,aAAa,EAAe,EAAE;IAC5E,MAAM,QAAQ,GAAG,eAAe,KAAK,EAAE,CAAA;IAEvC,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAuB,EAAE,CACtD,OAAO,CAAC,QAAQ,CAAsB,UAAU,CAAC,CAAA;IAEnD,MAAM,QAAQ,GAAG,CAAC,OAAgB,EAA6B,EAAE,CAC/D,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC;QACtC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAqB,oBAAoB,CAAC;QAC3D,CAAC,CAAC,IAAI,CAAA;IAEV,MAAM,WAAW,GAAG,KAAK,EAAE,OAAgB,EAAE,UAA8B,EAA0B,EAAE;QACrG,IAAI,UAAU,IAAI,IAAI,IAAI,UAAU,KAAK,EAAE;YAAE,OAAO,IAAI,CAAA;QACxD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,OAAO,UAAU,CAAA;QAC3D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QAChG,OAAO,MAAM,EAAE,EAAE,IAAI,IAAI,CAAA;IAC3B,CAAC,CAAA;IAED,MAAM,OAAO,GAAG,KAAK,EAAE,OAAgB,EAAE,IAAU,EAAE,OAAe,EAAwB,EAAE;QAC5F,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;QAC5D,IAAI,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,qBAAqB,CAAC;YAAE,OAAO,IAAI,CAAA;QAC1G,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;QACjF,IAAI,OAAO,GAA2B,IAAI,CAAA;QAC1C,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,yFAAyF;YACzF,4EAA4E;YAC5E,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAA;QAC/C,CAAC;QACD,IAAI,OAAO,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAAE,OAAO,IAAI,CAAA;QACtH,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM;YACrC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;YAC5B,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,oBAAoB,EAAE,OAAO;YAC7B,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAA;IACH,CAAC,CAAA;IAED,MAAM,IAAI,GAAG,KAAK,EAAE,OAAgB,EAAE,IAAU,EAAmB,EAAE;QACnE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACxG,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QACpH,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAO,iBAAiB,CAAC,iBAAiB,CAAC;aACrF,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;QACxD,OAAO,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,EAAE,IAAI,aAAa,EAAE,CAAA;IAChF,CAAC,CAAA;IAED,MAAM,OAAO,GAAgB,aAAa,CAAc,KAAK,EAAE;QAC7D,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,IAAI;QAEtF,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAY,CAAA;YACrD,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAA;YAChF,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAE3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxG,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,IAAI,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YAC7B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;YACjC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI;oBAAE,OAAO,KAAU,CAAA;gBAC7C,IAAI,QAAQ,CAAA;gBACZ,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBAClD,CAAC;gBAAC,MAAM,CAAC;oBACP,0FAA0F;oBAC1F,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAA;gBAC/C,CAAC;gBACD,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS;oBAAE,OAAO,KAAU,CAAA;gBAClF,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBACjC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;oBAChE,IAAI,SAAS,IAAI,IAAI;wBAAE,OAAO,KAAU,CAAA;oBACxC,IAAI,GAAG,SAAS,CAAA;oBAChB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;oBAC7C,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;oBACvD,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,CAAA;gBAC9D,CAAC;YACH,CAAC;YAED,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAEjB,OAAO,IAAS,CAAA;QAClB,CAAC;QAED,MAAM,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YACpB,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YACpD,MAAM,CAAC,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAE3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxG,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;YACjC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI;oBAAE,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;gBACnE,IAAI,QAAQ,CAAA;gBACZ,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBAClD,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAA;gBAC/C,CAAC;gBACD,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ;oBAAE,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;YAC1E,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,aAAa,EAAE,KAAK,IAAI,EAAE;YACxB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YAC1B,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,EAAE,QAAQ,CAAC,CAAA;YAChF,MAAM,QAAQ,GAAG,iBAAiB,CAAkB,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAEpF,MAAM,WAAW,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;YAChF,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YACtC,MAAM,GAAG,GAAG,WAAW,CAAC,SAAS,CAAA;YAEjC,6EAA6E;YAE7E,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;YAC5E,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,IAAI,WAAW,CAAC,UAAU,KAAK,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACnD,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,yBAAyB;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,QAAQ,GAAG,gBAAgB,CAAC,CAAA;YACvD,MAAM,IAAI,GAAS;gBACjB,KAAK,EAAE,WAAW,CAAC,SAAS;gBAC5B,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,IAAI,EAAE,iBAAiB,CAAC,iBAAiB;gBACzC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;gBAC3B,SAAS,EAAE,WAAW,CAAC,SAAS;gBAChC,UAAU,EAAE,WAAW,CAAC,UAAU;gBAClC,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC;gBAC7B,SAAS;gBACT,SAAS,EAAE,IAAI,EAAE;gBACjB,oBAAoB,EAAE,CAAC;aACxB,CAAA;YACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;YACjC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;gBAC5D,IAAI,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI;oBAAE,MAAM,IAAI,YAAY,CAAC,SAAS,CAAC,CAAA;gBACjF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;oBACtC,EAAE,EAAE,IAAI,CAAC,SAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS;oBACxE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE;iBACzC,CAAC,CAAA;gBACF,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ;oBAAE,MAAM,IAAI,YAAY,CAAC,SAAS,CAAC,CAAA;gBAClE,IAAI,CAAC,oBAAoB,GAAG,QAAQ,CAAC,OAAO,CAAA;YAC9C,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAA;QAC7C,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,GAAM,EAAE,KAAK,GAAW,aAAa,EACd,EAAE;IAEzB,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAA;IACxD,CAAC;IAED,8FAA8F;IAC9F,oEAAoE;IACpE,8BAA8B,CAAC,GAAG,CAAC,CAAA;IAEnC,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,GAA4B,CAAA;IAE5C,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAChC,OAAO,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAE/C,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-auth",
-  "version": "0.1.18-rc.4",
+  "version": "0.1.18-rc.40",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -37,29 +37,31 @@
   },
   "dependencies": {
     "@noble/hashes": "^1.5.0",
-    "@owlmeans/api": "^0.1.18-rc.4",
-    "@owlmeans/api-config-server": "^0.1.18-rc.4",
-    "@owlmeans/auth": "^0.1.18-rc.4",
-    "@owlmeans/auth-common": "^0.1.18-rc.4",
-    "@owlmeans/basic-envelope": "^0.1.18-rc.4",
-    "@owlmeans/basic-ids": "^0.1.18-rc.4",
-    "@owlmeans/basic-keys": "^0.1.18-rc.4",
-    "@owlmeans/client-config": "^0.1.18-rc.4",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.4",
-    "@owlmeans/config": "^0.1.18-rc.4",
-    "@owlmeans/context": "^0.1.18-rc.4",
-    "@owlmeans/kluster": "^0.1.18-rc.4",
-    "@owlmeans/entrypoint": "^0.1.18-rc.4",
-    "@owlmeans/redis-resource": "^0.1.18-rc.4",
-    "@owlmeans/resource": "^0.1.18-rc.4",
-    "@owlmeans/route": "^0.1.18-rc.4",
-    "@owlmeans/server-api": "^0.1.18-rc.4",
-    "@owlmeans/server-context": "^0.1.18-rc.4",
-    "@owlmeans/server-entrypoint": "^0.1.18-rc.4",
-    "@owlmeans/server-route": "^0.1.18-rc.4",
-    "@owlmeans/server-socket": "^0.1.18-rc.4",
-    "@owlmeans/socket": "^0.1.18-rc.4",
-    "@owlmeans/static-resource": "^0.1.18-rc.4",
+    "@owlmeans/api": "^0.1.18-rc.33",
+    "@owlmeans/api-config-server": "^0.1.18-rc.37",
+    "@owlmeans/auth": "^0.1.18-rc.31",
+    "@owlmeans/auth-common": "^0.1.18-rc.33",
+    "@owlmeans/basic-envelope": "^0.1.18-rc.32",
+    "@owlmeans/basic-ids": "^0.1.18-rc.30",
+    "@owlmeans/basic-keys": "^0.1.18-rc.34",
+    "@owlmeans/client-config": "^0.1.18-rc.33",
+    "@owlmeans/client-entrypoint": "^0.1.18-rc.33",
+    "@owlmeans/config": "^0.1.18-rc.33",
+    "@owlmeans/context": "^0.1.18-rc.29",
+    "@owlmeans/kluster": "^0.1.18-rc.32",
+    "@owlmeans/entrypoint": "^0.1.18-rc.32",
+    "@owlmeans/redis-resource": "^0.1.18-rc.32",
+    "@owlmeans/resource": "^0.1.18-rc.31",
+    "@owlmeans/route": "^0.1.18-rc.30",
+    "@owlmeans/server-api": "^0.1.18-rc.37",
+    "@owlmeans/server-auth-identity": "^0.1.18-rc.33",
+    "@owlmeans/server-auth-session": "^0.1.18-rc.4",
+    "@owlmeans/server-context": "^0.1.18-rc.32",
+    "@owlmeans/server-entrypoint": "^0.1.18-rc.31",
+    "@owlmeans/server-route": "^0.1.18-rc.29",
+    "@owlmeans/server-socket": "^0.1.18-rc.40",
+    "@owlmeans/socket": "^0.1.18-rc.29",
+    "@owlmeans/static-resource": "^0.1.18-rc.30",
     "@scure/base": "^2.3.0"
   },
   "peerDependencies": {
@@ -67,8 +69,8 @@
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/test-auth": "^0.1.18-rc.4",
-    "@types/bun": "^1.3.14",
+    "@owlmeans/test-auth": "^0.1.18-rc.32",
+    "@types/bun": "^1.4.0",
     "@types/node": "^26.1.0",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"

package/src/actions/service.ts

@@ -1,16 +1,17 @@
-import type { RefedEntrypointHandler } from '@owlmeans/server-entrypoint'
+import { handlers } from '@owlmeans/server-api'
+import type { EntrypointProtocol } from '@owlmeans/entrypoint'
 import type { AuthToken } from '@owlmeans/auth'
-import { handleBody } from '@owlmeans/server-api'
 import { AuthServiceAppend } from '../types.js'
 import type { ServerConfig, ServerContext } from '@owlmeans/server-context'
 import { assertContext } from '@owlmeans/context'
 
 type Config = ServerConfig
 type Context = ServerContext<Config> & AuthServiceAppend
+const api = handlers<Context>()
 
-export const authenticate: RefedEntrypointHandler<AuthToken> = handleBody(
-  async (payload: AuthToken, ctx) => {
-    const context = assertContext(ctx, 'authenticate') as Context
-    return await context.auth().authenticate(payload)
-  }
-)
+export const authenticate = (protocol: EntrypointProtocol<{ body: AuthToken }, AuthToken>) =>
+  api.request(protocol, async (request, context) => {
+    const ctx = assertContext(context, 'authenticate') as Context
+
+    return await ctx.auth().authenticate(request.body)
+  })

package/src/entrypoints.ts

@@ -0,0 +1,12 @@
+
+import { bind } from '@owlmeans/server-entrypoint'
+import type { ServerProtocolEntrypoint } from '@owlmeans/server-entrypoint'
+import { authProtocols } from '@owlmeans/auth-common'
+import type { EntrypointProtocolDeclaration } from '@owlmeans/entrypoint'
+import { authenticate } from './actions/service.js'
+
+/** Server entrypoints required by the generic authentication service. */
+export const entrypoints: ServerProtocolEntrypoint<EntrypointProtocolDeclaration>[] = [
+  bind(authProtocols.dispatcher),
+  bind(authProtocols.dispatcherAuthenticate, authenticate(authProtocols.dispatcherAuthenticate)),
+]

package/src/index.ts

@@ -2,5 +2,5 @@
 export type * from './types.js'
 export * from './model/index.js'
 export * from './consts.js'
-export * from './modules.js'
+export * from './entrypoints.js'
 export * from './service.js'

package/src/manager/README.md

@@ -27,18 +27,18 @@ A specialized guard service that enables authentication token relay between micr
 - **Wallet DID Authentication**: Decentralized identity authentication support
 - **Challenge Validation**: Anti-replay protection using challenge-response mechanisms
 
-### Module-Based Architecture
-The manager is built on the OwlMeans module system, providing:
+### Entrypoint-Based Architecture
+The manager is built on the OwlMeans entrypoint system, providing:
 - **Route Management**: Standardized API endpoints for authentication operations
-- **Handler Registration**: Modular request handlers for different authentication flows
-- **Guard Integration**: Automatic security enforcement at the module level
+- **Handler Registration**: Protocol-backed request handlers for different authentication flows
+- **Guard Integration**: Automatic security enforcement at the entrypoint level
 
 ## Installation
 
 This manager app is part of the `@owlmeans/server-auth` package:
 
 ```bash
-npm install @owlmeans/server-auth
+npm install @owlmeans/server-auth@^0.1.18-rc.39
 ```
 
 ## API Reference
@@ -317,20 +317,16 @@ await authModel.rely(connection, authToken.auth)
 
 ### API Integration
 
-```typescript
-import { modules } from '@owlmeans/server-auth/manager'
-
-// The manager automatically registers these API endpoints:
+`main(context)` registers the manager's immutable `entrypoints` and starts the API server. For a
+custom bootstrap, register the exported collection yourself; the manager's protocols are then
+addressed through the same `context.entrypoint(protocol)` lookup as application endpoints.
 
-// POST /api/auth/init - Authentication initialization
-// POST /api/auth/authenticate - User authentication  
-// WebSocket /api/auth/rely - Authentication relay
+```typescript
+import { entrypoints, makeContext } from '@owlmeans/server-auth/manager'
 
-// Access modules for custom routing
-modules.forEach(module => {
-  console.log(`Route: ${module.getPath()}`)
-  console.log(`Method: ${module.route.method}`)
-})
+const context = makeContext(config)
+context.registerEntrypoints(entrypoints)
+await context.configure().init()
 ```
 
 ## API Endpoints
@@ -504,4 +500,4 @@ This manager app depends on:
 - [`@owlmeans/server-auth`](../../../README.md) - Parent server authentication package
 - [`@owlmeans/auth`](../../../auth/README.md) - Core authentication library
 - [`@owlmeans/client-auth`](../../../client-auth/README.md) - Client-side authentication
-- [`@owlmeans/context`](../../../context/README.md) - Context management system
+- [`@owlmeans/context`](../../../context/README.md) - Context management system

package/src/manager/actions/manager.ts

@@ -1,23 +1,25 @@
-import type { AllowanceRequest, AuthCredentials } from '@owlmeans/auth'
-import { handleBody } from '@owlmeans/server-api'
+import type { AllowanceRequest, AllowanceResponse, AuthCredentials, AuthToken } from '@owlmeans/auth'
+import type { EntrypointProtocol } from '@owlmeans/entrypoint'
+import { handlers } from '@owlmeans/server-api'
 import { makeAuthModel } from '../model.js'
-import type { RefedEntrypointHandler } from '@owlmeans/server-entrypoint'
 import type { AppContext, AppConfig } from '../types.js'
-import { handleConnection } from '@owlmeans/server-socket'
+import { connection } from '@owlmeans/server-socket'
 
-export const authenticationInit: RefedEntrypointHandler<AllowanceRequest> = handleBody(
-  async (payload: AllowanceRequest, ctx) =>
-    await makeAuthModel(ctx as AppContext<AppConfig>).init(payload)
+const api = handlers<AppContext<AppConfig>>()
+
+export const authenticationInit = (protocol: EntrypointProtocol<{ body: AllowanceRequest }, AllowanceResponse>) =>
+  api.body(protocol, async (body, context) =>
+  await makeAuthModel(context).init(body)
 )
 
-export const authenticate: RefedEntrypointHandler<AuthCredentials> = handleBody(
-  async (payload: AuthCredentials, ctx) =>
-    await makeAuthModel(ctx as AppContext<AppConfig>).authenticate(payload)
+export const authenticate = (protocol: EntrypointProtocol<{ body: AuthCredentials }, AuthToken>) =>
+  api.body(protocol, async (body, context) =>
+  await makeAuthModel(context).authenticate(body)
 )
 
-export const rely: RefedEntrypointHandler<void> = handleConnection(
+export const rely = (protocol: EntrypointProtocol<{ query: Partial<AuthToken> }, undefined>) => connection(protocol,
   // @TODO Request will contain information is there requrest 
   // privileged or not (privileged request implies auth provider)
-  async (conn, ctx, req) =>
-    await makeAuthModel(ctx as AppContext<AppConfig>).rely(conn, req.auth)
+  async (conn, context, request) =>
+    await makeAuthModel(context as AppContext<AppConfig>).rely(conn, request.auth)
 )

package/src/manager/context.ts

@@ -27,7 +27,5 @@ export const makeContext = <C extends AppConfig, T extends AppContext<C>>(cfg: C
     appendStaticResource<C, T>(context, AUTH_CACHE)
   }
 
-  context.makeContext = (cfg => makeContext(cfg, customize)) as typeof context.makeContext
-
   return context as T
 }

package/src/manager/entrypoints.ts

@@ -0,0 +1,26 @@
+
+import { MOD_RECAPTCHA } from '@owlmeans/auth'
+import { authProtocols } from '@owlmeans/auth-common'
+import { entrypoints as apiConfigBindings } from '@owlmeans/api-config-server'
+import { bind } from '@owlmeans/server-entrypoint'
+import { decorateEntrypoint, openProtocol } from '@owlmeans/entrypoint'
+import * as actions from './actions/index.js'
+import { backend, route, RouteMethod } from '@owlmeans/route'
+import { DEFAULT_RELY } from './consts.js'
+
+const relyProtocol = decorateEntrypoint(authProtocols.rely, { guards: DEFAULT_RELY })
+const reCaptchaProtocol = openProtocol(route(MOD_RECAPTCHA, '/api/siteverify', backend({
+  host: 'https://www.google.com',
+  base: 'recaptcha',
+  secure: true,
+}, RouteMethod.POST)))
+
+/** Server entrypoints for the full authentication manager. */
+export const entrypoints = [
+  bind(authProtocols.authen, undefined, { intermediate: true }),
+  bind(authProtocols.init, actions.authenticationInit(authProtocols.init)),
+  bind(authProtocols.authenticate, actions.authenticate(authProtocols.authenticate)),
+  bind(relyProtocol, actions.rely(relyProtocol)),
+  ...apiConfigBindings,
+  bind(reCaptchaProtocol),
+]

package/src/manager/exports.ts

@@ -5,8 +5,7 @@ export { addWebService } from '@owlmeans/client-config'
 export { service, TRUSTED } from '@owlmeans/config'
 export { AppType, assertContext } from '@owlmeans/context'
 export { klusterize } from '@owlmeans/kluster'
-export { elevate } from '@owlmeans/server-entrypoint'
-export { elevate as celevate, stab } from '@owlmeans/client-entrypoint'
+export { stab } from '@owlmeans/client-entrypoint'
 export type { RefedEntrypointHandler } from '@owlmeans/server-entrypoint'
 export { handleIntermediate, handleBody, handleRequest, handleParams } from '@owlmeans/server-api'
 export type { AbstractRequest, AbstractResponse } from '@owlmeans/entrypoint'

package/src/manager/index.ts

@@ -1,6 +1,6 @@
 export type * from './types.js'
 
-export * from './modules.js'
+export * from './entrypoints.js'
 export * from './exports.js'
 export * from './context.js'
 export * from './main.js'