@owlmeans/server-auth 0.1.18-rc.4 → 0.1.18-rc.40

package/src/manager/main.ts

@@ -1,9 +1,9 @@
 
-import { modules } from './modules.js'
+import { entrypoints } from './entrypoints.js'
 import type { AppContext, AppConfig } from './types.js'
 
 export const main = async <C extends AppConfig, T extends AppContext<C>>(ctx: T) => {
-  ctx.registerEntrypoints(modules)
+  ctx.registerEntrypoints(entrypoints)
   await ctx.configure().init()
   await ctx.getApiServer().listen()
 }

package/src/manager/model.ts

@@ -1,6 +1,8 @@
 import type { AuthModel, AppConfig, AppContext } from './types.js'
-import { AuthenFailed, AuthenPayloadError } from '@owlmeans/auth'
+import { AuthenFailed, AuthenPayloadError, entitySlugOf } from '@owlmeans/auth'
 import type { AuthCredentials } from '@owlmeans/auth'
+import type { EntityResolverService } from '@owlmeans/auth-common'
+import { ENTITY_RESOLVER } from '@owlmeans/auth-common'
 import { getPlugin } from './plugins/utils.js'
 import { AUTH_CACHE, AUTHEN_TIMEFRAME } from '../consts.js'
 import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
@@ -10,6 +12,7 @@ import { trusted } from './utils/trusted.js'
 import type { ServerConfig, ServerContext } from '@owlmeans/server-context'
 import type { Resource } from '@owlmeans/resource'
 import type { AuthSpent } from '../types.js'
+import { AuthChallengeReplayPolicy } from './plugins/replay-policy.js'
 
 type Config = ServerConfig
 type Context = ServerContext<Config>
@@ -49,22 +52,24 @@ export const makeAuthModel = (context: AppContext<AppConfig>): AuthModel => {
 
       const msg: string = envelope.message(true)
 
-      try {
-        await cache(context).create({ id: msg }, { ttl: (envelope.envelope.ttl ?? AUTHEN_TIMEFRAME) / 1000 })
-      } catch (e) {
-        const error = new AuthenFailed('challenge')
-        if (e instanceof Error) {
-          error.oiriginalStack = `${e} : ${e.stack}`
+      const plugin = await getPlugin(envelope.type(), context)
+
+      if (plugin.challengeReplayPolicy !== AuthChallengeReplayPolicy.Plugin) {
+        try {
+          await cache(context).create({ id: msg }, { ttl: (envelope.envelope.ttl ?? AUTHEN_TIMEFRAME) / 1000 })
+        } catch (e) {
+          const error = new AuthenFailed('challenge')
+          if (e instanceof Error) {
+            error.oiriginalStack = `${e} : ${e.stack}`
+          }
+          throw error
         }
-        throw error
       }
 
       if (credential.userId == null) {
         throw new AuthenPayloadError('userId')
       }
 
-      const plugin = await getPlugin(envelope.type(), context)
-
       // @TODO this token PROBABLY needs to be registered somewhere and rechecked
       // from time to time to make sure that the session is not deleted 
       // or permission hasn't changed.
@@ -75,6 +80,19 @@ export const makeAuthModel = (context: AppContext<AppConfig>): AuthModel => {
       const { token } = await plugin.authenticate(Object.assign(credential, { challenge: msg }))
       credential.challenge = token === '' ? challenge : token
 
+      // Plugins accept whatever the caller typed — a current slug, a slug the organization has
+      // since retired, or (for a token minted before slugs existed) its stable key. The token is
+      // signed once and read for as long as it lives, so the value is canonicalized here rather
+      // than at every place that later reads it back.
+      const entitySlug = entitySlugOf(credential)
+      if (entitySlug != null && context.hasService(ENTITY_RESOLVER)) {
+        const entity = await context.service<EntityResolverService>(ENTITY_RESOLVER).resolve(entitySlug)
+        if (entity == null) {
+          throw new AuthenFailed('entity')
+        }
+        credential.entitySlug = entity.slug
+      }
+
       credential.credential = trustedUser.id
 
       return {

package/src/manager/plugins/basic-ed25519.ts

@@ -23,8 +23,8 @@ export const basicEd25519 = <C extends AppConfig, T extends AppContext<C>>(conte
       /**
        * @TODO We need to find users in some db not just in static
        */
-      const systemUser = await context.getConfigResource(TRUSTED)
-        .load<TrustedRecord>(credential.userId)
+      const systemUser = await context.getConfigResource<TrustedRecord>(TRUSTED)
+        .load(credential.userId)
 
       if (systemUser == null) {
         throw new AuthenFailed()

package/src/manager/plugins/basic-rely.ts

@@ -7,17 +7,18 @@ import { trusted } from '../utils/trusted.js'
 import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
 import { AUTH_CACHE } from '../../consts.js'
 import { ResourceError } from '@owlmeans/resource'
+import type { Unsubscribe } from '@owlmeans/resource'
 import { RELY_CALL_TIMEOUT, RELY_PIN_PERFIX, RELY_TOKEN_PREFIX } from '@owlmeans/auth-common'
 
-const _subscriptions: Record<string, CallableFunction> = {}
+const _subscriptions: Record<string, Unsubscribe> = {}
 export const basicRely = (context: AppContext, type?: string): AuthPlugin => {
   const plugin: AuthPlugin = {
     type: type ?? AuthenticationType.RelyHandshake,
 
     // This method is used by consumer and by provider (wallet)
     // to initialize shared authentication process.
-    // The idea is that both subscribe to wait for a handshake value
-    // from the peer, that in fact is a subscription to a redis message tunnel.  
+    // The idea is that both watch the record holding their own pin/token and wake
+    // up when the peer writes its handshake value into it.
     init: async (request: RelyAllowanceRequest): Promise<AllowanceResponse> => {
       const [, keyPair] = await trusted(context)
       const tunnel = context.resource<AuthRedisResource>(AUTH_CACHE)
@@ -41,8 +42,8 @@ export const basicRely = (context: AppContext, type?: string): AuthPlugin => {
 
           if (request.provideRely != null) {
             await Promise.all([pin, token].filter(key => key != null).map(async key => {
-              _subscriptions[key] = await tunnel.subscribe(async value => {
-                if (value.challenge != null) {
+              _subscriptions[key] = await tunnel.watch(key, async value => {
+                if (value?.challenge != null) {
                   const rely = makeEnvelopeModel<RelyToken>(value.challenge, EnvelopeKind.Wrap)
                   if (await rely.verify(keyPair)) {
                     [pin, token].filter(key => key != null).forEach(key => {
@@ -54,7 +55,7 @@ export const basicRely = (context: AppContext, type?: string): AuthPlugin => {
                     await request.provideRely?.(rely.message(), relyMsg, true)
                   }
                 }
-              }, { /*ttl: RELY_CALL_TIMEOUT,*/ key, once: true })
+              }, { once: true })
 
               // @TODO they need to be killed on close - but actually live a little bit longer 
               // then timeout for them is ok

package/src/manager/plugins/export.ts

@@ -1,5 +1,6 @@
 
 export type * from './types.js'
+export * from './replay-policy.js'
 export * from './basic-ed25519.js'
 export * from './re-captcha.js'
 export * from './basic-rely.js'

package/src/manager/plugins/re-captcha.ts

@@ -23,13 +23,13 @@ export const reCaptcha = <C extends AppConfig, T extends AppContext<C>>(context:
     },
 
     authenticate: async credential => {
-      const cfg = context.getConfigResource(PLUGINS)
-      const config = await cfg.get<PluginConfig>(MOD_RECAPTCHA)
+      const cfg = context.getConfigResource<PluginConfig>(PLUGINS)
+      const config = await cfg.get(MOD_RECAPTCHA)
       if (config.value == null) {
         throw new PluginMissconfigured('value')
       }
       const validateRecaptcha = context.entrypoint<ClientEntrypoint<RecpatchaResponse>>(MOD_RECAPTCHA)
-      const [result, status] = await validateRecaptcha.call<RecpatchaResponse, RecaptchaRequest>({
+      const { value: result, outcome: status } = await validateRecaptcha.invoke<RecpatchaResponse, RecaptchaRequest>({
         body: {
           secret: config.value,
           response: credential.credential

package/src/manager/plugins/replay-policy.ts

@@ -0,0 +1,7 @@
+/** Ownership of atomic replay protection for a verified authentication challenge. */
+export enum AuthChallengeReplayPolicy {
+  /** Default: the auth manager consumes the challenge before plugin authentication. */
+  Manager = 'manager',
+  /** The plugin owns bounded attempts and atomic success consumption. */
+  Plugin = 'plugin',
+}

package/src/manager/plugins/supervisor.ts

@@ -48,8 +48,8 @@ export const makeSupervisorPlugin = (
       let matched: string | null = null
       for (const alias of opts.supervisors) {
         try {
-          const record = await context.getConfigResource(TRUSTED)
-            .load<TrustedRecord>(alias, 'name')
+          const record = await context.getConfigResource<TrustedRecord>(TRUSTED)
+            .load({ name: alias })
           if (record?.credential == null) {
             continue
           }
@@ -71,8 +71,8 @@ export const makeSupervisorPlugin = (
 
       credential.userId = resolution.userId
       credential.profileId = resolution.profileId ?? resolution.userId
-      if (resolution.entityId != null) {
-        credential.entityId = resolution.entityId
+      if (resolution.entitySlug != null) {
+        credential.entitySlug = resolution.entitySlug
       }
       credential.scopes = resolution.scopes ?? credential.scopes ?? [ALL_SCOPES]
       credential.role = resolution.role ?? AuthRole.User

package/src/manager/plugins/types.ts

@@ -3,9 +3,15 @@ import type { AuthModel } from '../types.js'
 import type { AbstractRequest } from '@owlmeans/entrypoint'
 import type { RedisResource } from '@owlmeans/redis-resource'
 import type { ResourceRecord } from '@owlmeans/resource'
+import type { AuthChallengeReplayPolicy } from './replay-policy.js'
 
 export interface AuthPlugin extends Omit<AuthModel, "rely"> {
   type: string
+  /**
+   * Who atomically consumes a verified challenge. The manager remains the default; a plugin may
+   * opt in only when its own credential protocol needs a bounded retry budget before consumption.
+   */
+  challengeReplayPolicy?: AuthChallengeReplayPolicy
 }
 
 export interface RecpatchaResponse {

package/src/manager/rely/flow.ts

@@ -38,7 +38,7 @@ export const createRelyFlow = (context: AppContext, conn: Connection, auth?: Aut
           await closeReceiver()
         }
       }
-    }, source.nonce)
+    }, { channel: source.nonce })
     // We allow to just forward call messages back and forth
     conn._receiveCall = async msg => { console.info(source.nonce, 'Forward call', msg.method, msg.id) }
     conn._receiveResult = async msg => { console.info(source.nonce, 'Forward result', msg.id) }

package/src/manager/supervisor.ts

@@ -10,7 +10,7 @@ import { makeSupervisorPlugin } from './plugins/supervisor.js'
  * token will represent. Only `userId` is required - the rest default sensibly.
  */
 export interface SupervisorUserResolution extends Partial<Pick<AuthPayload,
-  'profileId' | 'entityId' | 'role' | 'scopes'>> {
+  'profileId' | 'entitySlug' | 'role' | 'scopes'>> {
   userId: string
 }
 
@@ -43,7 +43,7 @@ export interface SupervisorAuthOptions {
   enabled?: boolean
   /**
    * Also accept internal owlmeans `Ed25519BasicToken`s even when another guard
-   * (e.g. OIDC) is the primary guard on protected modules. Default: true.
+   * (e.g. OIDC) is the primary guard on protected entrypoints. Default: true.
    */
   acceptInternalTokens?: boolean
   /** The internal-token guard to add as a coguard. Default: DEFAULT_GUARD ('auth'). */
@@ -57,15 +57,15 @@ const isDevelopment = (context: { cfg: { debug?: { all?: boolean, supervisor?: b
 
 /**
  * Ensure the internal `Ed25519BasicToken` guard is accepted as a coguard on every
- * already-guarded backend module, so internal owlmeans tokens keep working even
+ * already-guarded backend entrypoint, so internal owlmeans tokens keep working even
  * when another guard (e.g. OIDC) is the primary guard. The primary guard stays
  * first; the internal guard is appended as a fallback (its `match` only fires for
  * an `Ed25519BasicToken` authorization header).
  */
 export const setupInternalTokenCoguard = (
-  modules: Array<{ guards?: string[] }>, guard: string = DEFAULT_GUARD
+  entrypoints: Array<{ guards?: string[] }>, guard: string = DEFAULT_GUARD
 ): void => {
-  modules.forEach(module => {
+  entrypoints.forEach(module => {
     if (module.guards != null && module.guards.length > 0 && !module.guards.includes(guard)) {
       module.guards.push(guard)
     }
@@ -78,7 +78,7 @@ export const setupInternalTokenCoguard = (
  *
  * It registers the supervisor auth plugin (verifies a front-end signature against
  * the allowlisted trusted keys, then resolves/registers the target user) and -
- * unless disabled - makes protected modules also accept internal owlmeans tokens
+ * unless disabled - makes protected entrypoints also accept internal owlmeans tokens
  * (requirement: understand internal tokens even when OIDC is the primary guard).
  */
 export const appendSupervisorAuth = <C extends AppConfig, T extends AppContext<C>>(

package/src/model/rely/consumer.ts

@@ -1,7 +1,9 @@
 import { makeRelyModel } from './peer.js'
+import type { RelyToken } from '@owlmeans/auth'
+import type { EnvelopeModel } from '@owlmeans/basic-envelope'
 import type { RelyOptions } from './types.js'
 
-export const makeConsumerRely = (opts?: RelyOptions) => {
+export const makeConsumerRely = (opts?: RelyOptions): EnvelopeModel<RelyToken> => {
   const model = makeRelyModel(opts)
   const msg = model.message()
   delete msg.pin

package/src/model/rely/provider.ts

@@ -1,8 +1,10 @@
 
 import { makeRelyModel } from './peer.js'
+import type { RelyToken } from '@owlmeans/auth'
+import type { EnvelopeModel } from '@owlmeans/basic-envelope'
 import type { RelyOptions } from './types.js'
 
-export const makeProviderRely = (opts?: RelyOptions) => {
+export const makeProviderRely = (opts?: RelyOptions): EnvelopeModel<RelyToken> => {
   const model = makeRelyModel(opts)
 
   return model

package/src/service.ts

@@ -5,11 +5,21 @@ import type { AuthServiceAppend, AuthService, AuthSpent } from './types.js'
 import { assertContext, createService } from '@owlmeans/context'
 import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
 import type { Auth, AuthCredentials } from '@owlmeans/auth'
-import { AuthenFailed, AuthorizationError, AuthroizationType } from '@owlmeans/auth'
+import { AuthenFailed, AuthorizationError, AuthroizationType, AuthUnavailable } from '@owlmeans/auth'
 import type { AbstractRequest, AbstractResponse } from '@owlmeans/entrypoint'
 import type { Resource } from '@owlmeans/resource'
 import { createStaticResource } from '@owlmeans/static-resource'
 import { trust, extractAuthToken } from '@owlmeans/auth-common/utils'
+import { ENTITY_RESOLVER } from '@owlmeans/auth-common'
+import type { EntityResolverService } from '@owlmeans/auth-common'
+import { AUTH_IDENTITY_PROFILE } from '@owlmeans/server-auth-identity'
+import type { IdentityProfile, IdentityProfileResource } from '@owlmeans/server-auth-identity'
+import {
+  appendMemoryAuthSessionManager, AUTH_SESSION_MANAGER, AUTH_SESSION_TTL
+} from '@owlmeans/server-auth-session'
+import type { AuthSessionManager } from '@owlmeans/server-auth-session'
+import { uuid } from '@owlmeans/basic-ids'
+import { TOKEN_UPDATE } from '@owlmeans/auth-common'
 
 type Config = ServerConfig
 type Context = ServerContext<Config>
@@ -20,6 +30,50 @@ export const makeAuthService = (alias: string = DEFAULT_ALIAS): AuthService => {
   const cache = (context: Context): Resource<AuthSpent> =>
     context.resource<Resource<AuthSpent>>(AUTH_CACHE)
 
+  const sessions = (context: Context): AuthSessionManager | null =>
+    context.hasService(AUTH_SESSION_MANAGER)
+      ? context.service<AuthSessionManager>(AUTH_SESSION_MANAGER)
+      : null
+
+  const entityIdFor = async (context: Context, entitySlug: string | undefined): Promise<string | null> => {
+    if (entitySlug == null || entitySlug === '') return null
+    if (!context.hasService(ENTITY_RESOLVER)) return entitySlug
+    const entity = await context.service<EntityResolverService>(ENTITY_RESOLVER).resolve(entitySlug)
+    return entity?.id ?? null
+  }
+
+  const refresh = async (context: Context, auth: Auth, version: number): Promise<Auth | null> => {
+    const entityId = await entityIdFor(context, auth.entitySlug)
+    if (entityId == null || auth.profileId == null || !context.hasResource(AUTH_IDENTITY_PROFILE)) return null
+    const profiles = context.resource<IdentityProfileResource>(AUTH_IDENTITY_PROFILE)
+    let profile: IdentityProfile | null = null
+    try {
+      profile = await profiles.load({ entityId, profileId: auth.profileId })
+    } catch {
+      // A missing profile is a definitive authentication refusal; a failed profile store is an
+      // availability dependency and must not look like a revoked browser session.
+      throw new AuthUnavailable('identity-profile')
+    }
+    if (profile == null || (profile.expiresAt != null && new Date(profile.expiresAt).getTime() <= Date.now())) return null
+    return {
+      ...auth,
+      userId: profile.userId ?? auth.userId,
+      role: profile.role,
+      scopes: profile.scopes ?? [],
+      ...(profile.permissions != null ? { permissions: profile.permissions } : {}),
+      authorizationVersion: version,
+      createdAt: new Date()
+    }
+  }
+
+  const sign = async (context: Context, auth: Auth): Promise<string> => {
+    const trusted = await trust<Config, Context>(context, TRUSTED, context.cfg.alias ?? context.cfg.service)
+    const ttl = auth.expiresAt == null ? AUTH_SESSION_TTL : Math.max(0, new Date(auth.expiresAt).getTime() - Date.now())
+    const authorization = await makeEnvelopeModel<Auth>(AuthroizationType.Ed25519BasicToken)
+      .send(auth, ttl).sign(trusted.key, EnvelopeKind.Token)
+    return `${AuthroizationType.Ed25519BasicToken.toUpperCase()} ${authorization}`
+  }
+
   const service: AuthService = createService<AuthService>(alias, {
     match: async req => extractAuthToken(req, AuthroizationType.Ed25519BasicToken) != null,
 
@@ -37,7 +91,29 @@ export const makeAuthService = (alias: string = DEFAULT_ALIAS): AuthService => {
         return false as T
       }
 
-      res.resolve(envelope.message())
+      let auth = envelope.message()
+      const manager = sessions(context)
+      if (manager != null) {
+        if (auth.sessionId == null) return false as T
+        let decision
+        try {
+          decision = await manager.inspect(auth.sessionId)
+        } catch {
+          // Registry availability is a security dependency. A guard cannot authenticate through it.
+          throw new AuthUnavailable('session-registry')
+        }
+        if (decision.state !== 'active' && decision.state !== 'refresh') return false as T
+        if (decision.state === 'refresh') {
+          const refreshed = await refresh(context, auth, decision.version)
+          if (refreshed == null) return false as T
+          auth = refreshed
+          const replacement = await sign(context, auth)
+          res.responseProvider?.header(TOKEN_UPDATE, replacement)
+          req.headers = { ...req.headers, authorization: replacement }
+        }
+      }
+
+      res.resolve(auth)
 
       return true as T
     },
@@ -51,8 +127,19 @@ export const makeAuthService = (alias: string = DEFAULT_ALIAS): AuthService => {
       if (!await envelope.verify(trusted.key)) {
         throw new AuthorizationError('unpack')
       }
-
-      return envelope.message()
+      const auth = envelope.message()
+      const manager = sessions(context)
+      if (manager != null) {
+        if (auth.sessionId == null) throw new AuthorizationError('session')
+        let decision
+        try {
+          decision = await manager.inspect(auth.sessionId)
+        } catch {
+          throw new AuthUnavailable('session-registry')
+        }
+        if (decision.state !== 'active') throw new AuthorizationError('session')
+      }
+      return auth
     },
 
     authenticated: async () => {
@@ -84,6 +171,8 @@ export const makeAuthService = (alias: string = DEFAULT_ALIAS): AuthService => {
       }
 
       // @TODO Move to a plugin
+      const issuedAt = Date.now()
+      const expiresAt = new Date(issuedAt + AUTH_SESSION_TTL)
       const auth: Auth = {
         token: credentials.challenge,
         userId: credentials.userId,
@@ -92,16 +181,26 @@ export const makeAuthService = (alias: string = DEFAULT_ALIAS): AuthService => {
         type: AuthroizationType.Ed25519BasicToken,
         source: context.cfg.service,
         profileId: credentials.profileId,
-        entityId: credentials.entityId,
+        entitySlug: credentials.entitySlug,
         isUser: true,
-        createdAt: new Date()
+        createdAt: new Date(issuedAt),
+        expiresAt,
+        sessionId: uuid(),
+        authorizationVersion: 1
+      }
+      const manager = sessions(context)
+      if (manager != null) {
+        const entityId = await entityIdFor(context, auth.entitySlug)
+        if (entityId == null || auth.profileId == null) throw new AuthenFailed('session')
+        const decision = await manager.register({
+          id: auth.sessionId!, kind: 'bearer', entityId, profileId: auth.profileId,
+          issuedAt, expiresAt: expiresAt.getTime()
+        })
+        if (decision.state !== 'active') throw new AuthenFailed('session')
+        auth.authorizationVersion = decision.version
       }
 
-      const trusted = await trust<Config, Context>(context, TRUSTED, context.cfg.alias ?? context.cfg.service)
-      const authorization = await makeEnvelopeModel<Auth>(AuthroizationType.Ed25519BasicToken)
-        .send(auth, null).sign(trusted.key, EnvelopeKind.Token)
-
-      return { token: `${AuthroizationType.Ed25519BasicToken.toUpperCase()} ${authorization}` }
+      return { token: await sign(context, auth) }
     }
   })
 
@@ -116,6 +215,10 @@ export const appendAuthService = <C extends Config, T extends ServerContext<C>>(
     ctx.registerResource(createStaticResource(AUTH_CACHE))
   }
 
+  // Every standalone server gets an expiring process-local registry. Scaled deployments replace
+  // it with appendRedisAuthSessionManager before calling this helper.
+  appendMemoryAuthSessionManager(ctx)
+
   const service = makeAuthService(alias)
   const context = ctx as T & AuthServiceAppend
 

package/tests/context.ts

@@ -1,4 +1,4 @@
-import { AppType, Layer, makeBasicContext } from '@owlmeans/context'
+import { AppType, makeBasicContext } from '@owlmeans/context'
 import type { BasicConfig, BasicContext } from '@owlmeans/context'
 import { createStaticResource } from '@owlmeans/static-resource'
 import { makeMemoryTrustedResource, makeFixtureKeyPair } from '@owlmeans/test-auth'
@@ -25,6 +25,8 @@ export const makeTestContext = () => {
     id: authServiceKP.exportAddress(),
     name: AUTH_SRV_KEY,
     credential: authServiceKP.exportPublic(),
+    // Local, deterministic test-only key: the manager signs its synthetic exchange envelope.
+    secret: authServiceKP.export(),
     scopes: ['*'],
   }
 
@@ -39,7 +41,6 @@ export const makeTestContext = () => {
   const cfg: BasicConfig = {
     ready: false,
     service: SERVICE_NAME,
-    layer: Layer.Service,
     type: AppType.Backend,
     services: {},
   }

package/tests/replay-policy.spec.ts

@@ -0,0 +1,36 @@
+import { describe, expect, test } from 'bun:test'
+import { AuthenFailed, AuthRole } from '@owlmeans/auth'
+import { makeAuthModel } from '../src/manager/model.js'
+import { AuthChallengeReplayPolicy } from '../src/manager/plugins/replay-policy.js'
+import { registerPlugin } from '../src/manager/plugins/index.js'
+import { makeTestContext } from './context.js'
+
+describe('@owlmeans/server-auth — plugin-owned challenge replay', () => {
+  test('lets a bounded-retry plugin receive a second credential attempt', async () => {
+    const type = `replay-policy-${Date.now()}`
+    let attempts = 0
+    registerPlugin(type, () => ({
+      type,
+      challengeReplayPolicy: AuthChallengeReplayPolicy.Plugin,
+      init: async () => ({ challenge: 'opaque-issuance' }),
+      authenticate: async () => {
+        attempts += 1
+        if (attempts === 1) throw new AuthenFailed('first-guess')
+        return { token: '' }
+      },
+    }))
+
+    const { context } = makeTestContext()
+    await context.configure().init()
+    const model = makeAuthModel(context as never)
+    const { challenge } = await model.init({ type, userId: 'retry@example.com' })
+    const credential = () => ({
+      type, challenge, credential: 'guess', userId: 'retry@example.com',
+      role: AuthRole.User, scopes: ['*'],
+    })
+
+    await expect(model.authenticate(credential())).rejects.toBeInstanceOf(AuthenFailed)
+    await expect(model.authenticate(credential())).resolves.toHaveProperty('token')
+    expect(attempts).toBe(2)
+  })
+})

package/tests/supervisor.spec.ts

@@ -3,6 +3,8 @@ import { makeFixtureKeyPair } from '@owlmeans/test-auth'
 import { AuthenticationType, AuthRole, buildSupervisorPayload } from '@owlmeans/auth'
 import type { AuthCredentials } from '@owlmeans/auth'
 import type { TrustedRecord } from '@owlmeans/auth-common'
+import type { Criteria } from '@owlmeans/resource'
+import { firstMatch } from '@owlmeans/resource'
 import { makeSupervisorPlugin } from '../src/manager/plugins/supervisor.js'
 import type { AppConfig, AppContext } from '../src/manager/types.js'
 
@@ -10,8 +12,8 @@ const SUPERVISOR = 'master'
 
 const makeStubContext = (records: TrustedRecord[]): AppContext<AppConfig> => ({
   getConfigResource: () => ({
-    load: async (id: string, field?: string) =>
-      records.find(r => (field === 'name' ? r.name === id : r.id === id)) ?? null
+    load: async (idOrWhere: string | Criteria<TrustedRecord>) =>
+      firstMatch(records, typeof idOrWhere === 'string' ? { id: idOrWhere } : idOrWhere)
   })
 } as unknown as AppContext<AppConfig>)
 
@@ -61,7 +63,7 @@ describe('@owlmeans/server-auth — supervisor plugin', () => {
     const plugin = makeSupervisorPlugin(context, {
       supervisors: [SUPERVISOR],
       allowRegistration: true,
-      resolveUser: async (userId) => ({ userId: 'internal-id', profileId: 'profile-1', entityId: 'entity-1', scopes: ['project'] })
+      resolveUser: async (userId) => ({ userId: 'internal-id', profileId: 'profile-1', entitySlug: 'entity-1', scopes: ['project'] })
     })
 
     const challenge = 'challenge-' + Date.now()
@@ -72,7 +74,7 @@ describe('@owlmeans/server-auth — supervisor plugin', () => {
 
     expect(credential.userId).toBe('internal-id')
     expect(credential.profileId).toBe('profile-1')
-    expect(credential.entityId).toBe('entity-1')
+    expect(credential.entitySlug).toBe('entity-1')
     expect(credential.scopes).toEqual(['project'])
   })
 

package/build/manager/modules.d.ts

@@ -1,2 +0,0 @@
-export declare const modules: import("@owlmeans/entrypoint").CommonEntrypoint[];
-//# sourceMappingURL=modules.d.ts.map

package/build/manager/modules.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../../src/manager/modules.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,OAAO,mDAAO,CAAA"}

package/build/manager/modules.js

@@ -1,21 +0,0 @@
-import { AUTHEN, AUTHEN_AUTHEN, AUTHEN_INIT, AUTHEN_RELY, MOD_RECAPTCHA } from '@owlmeans/auth';
-import { modules as list } from '@owlmeans/auth-common';
-import { modules as apiConfig } from '@owlmeans/api-config-server';
-import { elevate, guard } from '@owlmeans/server-entrypoint';
-import * as actions from './actions/index.js';
-import { entrypoint } from '@owlmeans/client-entrypoint';
-import { backend, route, RouteMethod } from '@owlmeans/route';
-import { handleIntermediate } from '@owlmeans/server-api';
-import { DEFAULT_RELY } from './consts.js';
-elevate(list, AUTHEN, handleIntermediate(async (_, context) => await context.updateContext()), { intermediate: true });
-elevate(list, AUTHEN_INIT, actions.authenticationInit);
-elevate(list, AUTHEN_AUTHEN, actions.authenticate);
-elevate(list, AUTHEN_RELY, actions.rely, guard(DEFAULT_RELY));
-export const modules = list;
-list.push(...apiConfig);
-list.push(entrypoint(route(MOD_RECAPTCHA, '/api/siteverify', backend({
-    host: 'https://www.google.com',
-    base: 'recaptcha',
-    secure: true,
-}, RouteMethod.POST))));
-//# sourceMappingURL=modules.js.map

package/build/manager/modules.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"modules.js","sourceRoot":"","sources":["../../src/manager/modules.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC/F,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,6BAA6B,CAAA;AAClE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AAC5D,OAAO,KAAK,OAAO,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAA;AACxD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1C,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,kBAAkB,CACtC,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,OAAO,CAAC,aAAa,EAAoB,CACtE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAA;AAC1B,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAA;AACtD,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;AAClD,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAA;AAE7D,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAA;AAC3B,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAA;AACvB,IAAI,CAAC,IAAI,CACP,UAAU,CACR,KAAK,CAAC,aAAa,EAAE,iBAAiB,EAAE,OAAO,CAAC;IAC9C,IAAI,EAAE,wBAAwB;IAC9B,IAAI,EAAE,WAAW;IACjB,MAAM,EAAE,IAAI;CACb,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CACtB,CACF,CAAA"}

package/build/modules.d.ts

@@ -1,3 +0,0 @@
-import type { ServerEntrypoint } from '@owlmeans/server-entrypoint';
-export declare const modules: ServerEntrypoint<unknown>[];
-//# sourceMappingURL=modules.d.ts.map

package/build/modules.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAOnE,eAAO,MAAM,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAK9C,CAAA"}

package/build/modules.js

@@ -1,11 +0,0 @@
-import { elevate } from '@owlmeans/server-entrypoint';
-import { modules as list } from '@owlmeans/auth-common';
-import { DISPATCHER, DISPATCHER_AUTHEN } from '@owlmeans/auth';
-import { authenticate } from './actions/service.js';
-import { stab, elevate as celevate } from '@owlmeans/client-entrypoint';
-elevate(list, DISPATCHER_AUTHEN, authenticate);
-celevate(list, DISPATCHER, stab);
-export const modules = [
-    ...list.filter((module) => [DISPATCHER, DISPATCHER_AUTHEN].includes(module.getAlias()))
-];
-//# sourceMappingURL=modules.js.map

package/build/modules.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"modules.js","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AACrD,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAE9D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAEvE,OAAO,CAAC,IAAI,EAAE,iBAAiB,EAAE,YAAY,CAAC,CAAA;AAC9C,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;AAEhC,MAAM,CAAC,MAAM,OAAO,GAAgC;IAClD,GAAG,IAAI,CAAC,MAAM,CACZ,CAAC,MAAM,EAAuC,EAAE,CAC9C,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAC9D;CACF,CAAA"}