@owlmeans/server-auth 0.1.18-rc.50 → 0.1.18-rc.52
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +2 -2
- package/agent-meta/manifest.json +2 -2
- package/agent-meta/skills/server-auth/SKILL.md +3 -3
- package/agent-meta/skills/supervisor-auth/SKILL.md +2 -2
- package/build/manager/model.d.ts.map +1 -1
- package/build/manager/model.js +66 -43
- package/build/manager/model.js.map +1 -1
- package/build/manager/plugins/basic-rely.d.ts.map +1 -1
- package/build/manager/plugins/basic-rely.js +5 -2
- package/build/manager/plugins/basic-rely.js.map +1 -1
- package/build/manager/rely/flow.d.ts.map +1 -1
- package/build/manager/rely/flow.js +7 -5
- package/build/manager/rely/flow.js.map +1 -1
- package/build/service.d.ts.map +1 -1
- package/build/service.js +17 -5
- package/build/service.js.map +1 -1
- package/package.json +25 -24
- package/src/manager/README.md +1 -1
- package/src/manager/model.ts +74 -46
- package/src/manager/plugins/basic-rely.ts +6 -2
- package/src/manager/rely/flow.ts +8 -5
- package/src/service.ts +19 -5
package/README.md
CHANGED
|
@@ -13,7 +13,7 @@ account/profile records `@owlmeans/server-auth-identity`, and the browser side `
|
|
|
13
13
|
## Installation
|
|
14
14
|
|
|
15
15
|
```bash
|
|
16
|
-
bun add @owlmeans/server-auth@^0.1.18-rc.
|
|
16
|
+
bun add @owlmeans/server-auth@^0.1.18-rc.52
|
|
17
17
|
```
|
|
18
18
|
|
|
19
19
|
## Concepts
|
|
@@ -222,7 +222,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
|
|
|
222
222
|
your project's skill store (`.agents/skills/`):
|
|
223
223
|
|
|
224
224
|
```sh
|
|
225
|
-
npx @owlmeans/agent-skills@^0.1.18-rc.
|
|
225
|
+
npx @owlmeans/agent-skills@^0.1.18-rc.47
|
|
226
226
|
```
|
|
227
227
|
|
|
228
228
|
The embedded files are version-matched to this package release. Do not edit them
|
package/agent-meta/manifest.json
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schemaVersion": 2,
|
|
3
3
|
"package": "@owlmeans/server-auth",
|
|
4
|
-
"version": "0.1.18-rc.
|
|
5
|
-
"generatedAt": "2026-10-
|
|
4
|
+
"version": "0.1.18-rc.52",
|
|
5
|
+
"generatedAt": "2026-10-03T20:05:07.590Z",
|
|
6
6
|
"canonicalRepo": "https://github.com/owlmeans/common",
|
|
7
7
|
"entries": [
|
|
8
8
|
{
|
|
@@ -8,7 +8,7 @@ user-invocable: false
|
|
|
8
8
|
# @owlmeans/server-auth
|
|
9
9
|
|
|
10
10
|
**Layer:** Server
|
|
11
|
-
**Install:** `"@owlmeans/server-auth": "^0.1.18-rc.
|
|
11
|
+
**Install:** `"@owlmeans/server-auth": "^0.1.18-rc.52"` in `dependencies`
|
|
12
12
|
|
|
13
13
|
Two halves, deliberately split by subpath:
|
|
14
14
|
|
|
@@ -30,7 +30,6 @@ An ordinary service imports the root. Only the auth manager imports `./manager`.
|
|
|
30
30
|
| `AUTH_CACHE` | `'auth-cache'` — the single-use challenge store |
|
|
31
31
|
| `AUTH_SRV_KEY` | `'auth-service'` — the TRUSTED record whose key signs credential envelopes |
|
|
32
32
|
| `AUTHEN_TIMEFRAME` | `15 * 60 * 1000` — challenge lifetime and anti-replay window, in ms |
|
|
33
|
-
| `AUTH_SESSION_MANAGER` / `appendMemoryAuthSessionManager` | Seven-day session registry contract and the process-local default; use the Redis implementation from `@owlmeans/server-auth-session` for a shared authority |
|
|
34
33
|
| `AuthService`, `AuthServiceAppend`, `AuthSpent` | Types |
|
|
35
34
|
| `makeRelyModel`, `makeProviderRely`, `makeConsumerRely`, `RelyOptions` | The rely (wallet handshake) models |
|
|
36
35
|
|
|
@@ -108,7 +107,8 @@ registerPlugin('my-method', context => ({
|
|
|
108
107
|
context with `AUTH_SESSION_MANAGER`, the guard rejects an absent, expired, pending or revoked
|
|
109
108
|
session and re-signs fresh profile claims after a registry revision. Registry or identity-store
|
|
110
109
|
failure is `AuthUnavailable` (503), never a false 401/logout.
|
|
111
|
-
-
|
|
110
|
+
- The session registry (`AUTH_SESSION_MANAGER`) is `@owlmeans/server-auth-session`'s, not exported
|
|
111
|
+
here; `appendAuthService` installs its memory manager only as a single-process default. A
|
|
112
112
|
central or multi-replica issuer registers `appendRedisAuthSessionManager(context)` before it;
|
|
113
113
|
the manager is the authority that fences, refreshes or revokes an organization profile's sessions.
|
|
114
114
|
- The manager canonicalizes the organization entity: whatever slug (current, retired, or the frozen
|
|
@@ -52,8 +52,8 @@ Options:
|
|
|
52
52
|
front-end signs with. Pick aliases whose private keys you actually have (e.g. in `.env.dev.secrets`).
|
|
53
53
|
- `resolveUser` — `(userId, context, { register }) => Promise<SupervisorUserResolution>`. Default:
|
|
54
54
|
trust the id as-is (`{ userId }`). Wire it to `@owlmeans/server-auth-identity`'s
|
|
55
|
-
`IdentityLinkingService` (`getLinkedProfile` / `linkProfile`) to find-or-create
|
|
56
|
-
organization
|
|
55
|
+
`IdentityLinkingService` (`getLinkedProfile` / `linkProfile`) to find-or-create the person's
|
|
56
|
+
account and the deployment's own row (a new address registers a personal organization). `SupervisorUserResolution` is `{ userId }` plus optional `profileId`,
|
|
57
57
|
`entitySlug`, `role` and `scopes` — the organization value is a SLUG, the renameable public name
|
|
58
58
|
that a token carries, never the stable `entityId`. `profileId` defaults to `userId`, `scopes` to
|
|
59
59
|
the credential's own or `[ALL_SCOPES]`, and `role` to `AuthRole.User`.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/manager/model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;
|
|
1
|
+
{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/manager/model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AA6BlE,eAAO,MAAM,aAAa,YAAa,UAAU,CAAC,SAAS,CAAC,KAAG,SA6G9D,CAAA"}
|
package/build/manager/model.js
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
|
-
import { AuthenFailed, AuthenPayloadError, entitySlugOf } from '@owlmeans/auth';
|
|
1
|
+
import { AuthenFailed, AuthenPayloadError, AuthError, AuthUnavailable, entitySlugOf } from '@owlmeans/auth';
|
|
2
|
+
import { logger } from '@owlmeans/log';
|
|
2
3
|
import { ENTITY_RESOLVER } from '@owlmeans/auth-common';
|
|
3
4
|
import { getPlugin } from './plugins/utils.js';
|
|
4
5
|
import { AUTH_CACHE, AUTHEN_TIMEFRAME } from '../consts.js';
|
|
@@ -6,6 +7,10 @@ import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope';
|
|
|
6
7
|
import { createRelyFlow } from './rely/flow.js';
|
|
7
8
|
import { trusted } from './utils/trusted.js';
|
|
8
9
|
import { AuthChallengeReplayPolicy } from './plugins/replay-policy.js';
|
|
10
|
+
const log = logger('server-auth');
|
|
11
|
+
/** An account id as a log may carry it: an e-mail is reduced to its domain. */
|
|
12
|
+
const accountOf = (userId) => userId == null ? undefined : userId.includes('@') ? `*@${userId.slice(userId.lastIndexOf('@') + 1)}` : userId;
|
|
13
|
+
const compact = (value) => Object.fromEntries(Object.entries(value).filter(([, entry]) => entry != null));
|
|
9
14
|
export const makeAuthModel = (context) => {
|
|
10
15
|
const cache = (context) => context.resource(AUTH_CACHE);
|
|
11
16
|
const model = {
|
|
@@ -26,54 +31,72 @@ export const makeAuthModel = (context) => {
|
|
|
26
31
|
return { challenge };
|
|
27
32
|
},
|
|
28
33
|
authenticate: async (credential) => {
|
|
29
|
-
|
|
30
|
-
const
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
if (plugin.challengeReplayPolicy !== AuthChallengeReplayPolicy.Plugin) {
|
|
37
|
-
try {
|
|
38
|
-
await cache(context).create({ id: msg }, { ttl: (envelope.envelope.ttl ?? AUTHEN_TIMEFRAME) / 1000 });
|
|
34
|
+
// The one place every manager sign-in method (each plugin) is decided — logged once here.
|
|
35
|
+
const method = credential.type;
|
|
36
|
+
try {
|
|
37
|
+
const [trustedUser, keyPair] = await trusted(context);
|
|
38
|
+
const envelope = makeEnvelopeModel(credential.challenge, EnvelopeKind.Wrap);
|
|
39
|
+
if (!await envelope.verify(keyPair)) {
|
|
40
|
+
throw new AuthenFailed('challenge');
|
|
39
41
|
}
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
42
|
+
const msg = envelope.message(true);
|
|
43
|
+
const plugin = await getPlugin(envelope.type(), context);
|
|
44
|
+
if (plugin.challengeReplayPolicy !== AuthChallengeReplayPolicy.Plugin) {
|
|
45
|
+
try {
|
|
46
|
+
await cache(context).create({ id: msg }, { ttl: (envelope.envelope.ttl ?? AUTHEN_TIMEFRAME) / 1000 });
|
|
47
|
+
}
|
|
48
|
+
catch (e) {
|
|
49
|
+
const error = new AuthenFailed('challenge');
|
|
50
|
+
if (e instanceof Error) {
|
|
51
|
+
error.oiriginalStack = `${e} : ${e.stack}`;
|
|
52
|
+
}
|
|
53
|
+
throw error;
|
|
44
54
|
}
|
|
45
|
-
throw error;
|
|
46
55
|
}
|
|
56
|
+
if (credential.userId == null) {
|
|
57
|
+
throw new AuthenPayloadError('userId');
|
|
58
|
+
}
|
|
59
|
+
// @TODO this token PROBABLY needs to be registered somewhere and rechecked
|
|
60
|
+
// from time to time to make sure that the session is not deleted
|
|
61
|
+
// or permission hasn't changed.
|
|
62
|
+
// Alternative solution is to have permissions cached and cleaned
|
|
63
|
+
// when some broadcast message is sent from authentication system.
|
|
64
|
+
const challenge = credential.challenge;
|
|
65
|
+
const { token } = await plugin.authenticate(Object.assign(credential, { challenge: msg }));
|
|
66
|
+
credential.challenge = token === '' ? challenge : token;
|
|
67
|
+
// Plugins accept whatever the caller typed — a current slug, a slug the organization has
|
|
68
|
+
// since retired, or (for a token minted before slugs existed) its stable key. The token is
|
|
69
|
+
// signed once and read for as long as it lives, so the value is canonicalized here rather
|
|
70
|
+
// than at every place that later reads it back.
|
|
71
|
+
const entitySlug = entitySlugOf(credential);
|
|
72
|
+
if (entitySlug != null && context.hasService(ENTITY_RESOLVER)) {
|
|
73
|
+
const entity = await context.service(ENTITY_RESOLVER).resolve(entitySlug);
|
|
74
|
+
if (entity == null) {
|
|
75
|
+
throw new AuthenFailed('entity');
|
|
76
|
+
}
|
|
77
|
+
credential.entitySlug = entity.slug;
|
|
78
|
+
}
|
|
79
|
+
credential.credential = trustedUser.id;
|
|
80
|
+
const result = {
|
|
81
|
+
token: await makeEnvelopeModel(credential.type)
|
|
82
|
+
.send(credential, AUTHEN_TIMEFRAME)
|
|
83
|
+
.sign(keyPair, EnvelopeKind.Token)
|
|
84
|
+
};
|
|
85
|
+
log.info('Signed in', compact({
|
|
86
|
+
method, accountId: accountOf(credential.userId), profileId: credential.profileId,
|
|
87
|
+
entitySlug: credential.entitySlug,
|
|
88
|
+
}), { event: 'auth.signed-in' });
|
|
89
|
+
return result;
|
|
47
90
|
}
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
// Alternative solution is to have permissions cached and cleaned
|
|
55
|
-
// when some broadcast message is sent from authentication system.
|
|
56
|
-
const challenge = credential.challenge;
|
|
57
|
-
const { token } = await plugin.authenticate(Object.assign(credential, { challenge: msg }));
|
|
58
|
-
credential.challenge = token === '' ? challenge : token;
|
|
59
|
-
// Plugins accept whatever the caller typed — a current slug, a slug the organization has
|
|
60
|
-
// since retired, or (for a token minted before slugs existed) its stable key. The token is
|
|
61
|
-
// signed once and read for as long as it lives, so the value is canonicalized here rather
|
|
62
|
-
// than at every place that later reads it back.
|
|
63
|
-
const entitySlug = entitySlugOf(credential);
|
|
64
|
-
if (entitySlug != null && context.hasService(ENTITY_RESOLVER)) {
|
|
65
|
-
const entity = await context.service(ENTITY_RESOLVER).resolve(entitySlug);
|
|
66
|
-
if (entity == null) {
|
|
67
|
-
throw new AuthenFailed('entity');
|
|
91
|
+
catch (error) {
|
|
92
|
+
// An outage (`AuthUnavailable`) is not a refusal; it propagates and is logged as a failure.
|
|
93
|
+
if (error instanceof AuthError && !(error instanceof AuthUnavailable)) {
|
|
94
|
+
log.warn('Sign-in refused', compact({
|
|
95
|
+
method, accountId: accountOf(credential.userId), reason: error.message,
|
|
96
|
+
}), { event: 'auth.refused' });
|
|
68
97
|
}
|
|
69
|
-
|
|
98
|
+
throw error;
|
|
70
99
|
}
|
|
71
|
-
credential.credential = trustedUser.id;
|
|
72
|
-
return {
|
|
73
|
-
token: await makeEnvelopeModel(credential.type)
|
|
74
|
-
.send(credential, AUTHEN_TIMEFRAME)
|
|
75
|
-
.sign(keyPair, EnvelopeKind.Token)
|
|
76
|
-
};
|
|
77
100
|
},
|
|
78
101
|
rely: async (conn, auth) => {
|
|
79
102
|
conn.authenticate = createRelyFlow(context, conn, auth);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"model.js","sourceRoot":"","sources":["../../src/manager/model.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;
|
|
1
|
+
{"version":3,"file":"model.js","sourceRoot":"","sources":["../../src/manager/model.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC3G,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAGtC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC3D,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE1E,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAI5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAA;AAKtE,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,CAAA;AAEjC,+EAA+E;AAC/E,MAAM,SAAS,GAAG,CAAC,MAA0B,EAAsB,EAAE,CACnE,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAA;AAE/G,MAAM,OAAO,GAAG,CAAoC,KAAQ,EAAc,EAAE,CAC1E,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAe,CAAA;AAE9F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAA8B,EAAa,EAAE;IACzE,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAuB,EAAE,CACtD,OAAO,CAAC,QAAQ,CAAsB,UAAU,CAAC,CAAA;IAEnD,MAAM,KAAK,GAAc;QACvB,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACpB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;YACrD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAE3C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YAE/C;;;;;eAKG;YACH,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI;gBAC3C,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAA;YAElE,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;YAC1C,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;YAExG,OAAO,EAAE,SAAS,EAAE,CAAA;QACtB,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B,0FAA0F;YAC1F,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAA;YAC9B,IAAI,CAAC;gBACH,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;gBACrD,MAAM,QAAQ,GAAkB,iBAAiB,CAAC,UAAU,CAAC,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;gBAC1F,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;oBACpC,MAAM,IAAI,YAAY,CAAC,WAAW,CAAC,CAAA;gBACrC,CAAC;gBAED,MAAM,GAAG,GAAW,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAE1C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAA;gBAExD,IAAI,MAAM,CAAC,qBAAqB,KAAK,yBAAyB,CAAC,MAAM,EAAE,CAAC;oBACtE,IAAI,CAAC;wBACH,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,gBAAgB,CAAC,GAAG,IAAI,EAAE,CAAC,CAAA;oBACvG,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACX,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,WAAW,CAAC,CAAA;wBAC3C,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;4BACvB,KAAK,CAAC,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAA;wBAC5C,CAAC;wBACD,MAAM,KAAK,CAAA;oBACb,CAAC;gBACH,CAAC;gBAED,IAAI,UAAU,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;oBAC9B,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;gBACxC,CAAC;gBAED,2EAA2E;gBAC3E,kEAAkE;gBAClE,gCAAgC;gBAChC,kEAAkE;gBAClE,kEAAkE;gBAElE,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAA;gBACtC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;gBAC1F,UAAU,CAAC,SAAS,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAA;gBAEvD,yFAAyF;gBACzF,2FAA2F;gBAC3F,0FAA0F;gBAC1F,gDAAgD;gBAChD,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC,CAAA;gBAC3C,IAAI,UAAU,IAAI,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;oBAC9D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;oBAChG,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;wBACnB,MAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAA;oBAClC,CAAC;oBACD,UAAU,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAA;gBACrC,CAAC;gBAED,UAAU,CAAC,UAAU,GAAG,WAAW,CAAC,EAAE,CAAA;gBAEtC,MAAM,MAAM,GAAG;oBACb,KAAK,EAAE,MAAM,iBAAiB,CAAkB,UAAU,CAAC,IAAI,CAAC;yBAC7D,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC;yBAClC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC;iBACrC,CAAA;gBACD,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC;oBAC5B,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS;oBAChF,UAAU,EAAE,UAAU,CAAC,UAAU;iBAClC,CAAC,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAA;gBAEhC,OAAO,MAAM,CAAA;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,4FAA4F;gBAC5F,IAAI,KAAK,YAAY,SAAS,IAAI,CAAC,CAAC,KAAK,YAAY,eAAe,CAAC,EAAE,CAAC;oBACtE,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC;wBAClC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO;qBACvE,CAAC,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAA;gBAChC,CAAC;gBACD,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC;QAED,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YACzB,IAAI,CAAC,YAAY,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACzD,CAAC;KACF,CAAA;IAED,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"basic-rely.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/basic-rely.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAqC,MAAM,aAAa,CAAA;AAChF,OAAO,KAAK,EAAE,UAAU,EAAiC,MAAM,YAAY,CAAA;
|
|
1
|
+
{"version":3,"file":"basic-rely.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/basic-rely.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAqC,MAAM,aAAa,CAAA;AAChF,OAAO,KAAK,EAAE,UAAU,EAAiC,MAAM,YAAY,CAAA;AAa3E,eAAO,MAAM,SAAS,YAAa,UAAU,SAAS,MAAM,KAAG,UA2J9D,CAAA"}
|
|
@@ -5,6 +5,8 @@ import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope';
|
|
|
5
5
|
import { AUTH_CACHE } from '../../consts.js';
|
|
6
6
|
import { ResourceError } from '@owlmeans/resource';
|
|
7
7
|
import { RELY_CALL_TIMEOUT, RELY_PIN_PERFIX, RELY_TOKEN_PREFIX } from '@owlmeans/auth-common';
|
|
8
|
+
import { logger } from '@owlmeans/log';
|
|
9
|
+
const log = logger('server-auth:rely');
|
|
8
10
|
const _subscriptions = {};
|
|
9
11
|
export const basicRely = (context, type) => {
|
|
10
12
|
const plugin = {
|
|
@@ -65,7 +67,7 @@ export const basicRely = (context, type) => {
|
|
|
65
67
|
}
|
|
66
68
|
catch (e) {
|
|
67
69
|
if (e instanceof ResourceError) {
|
|
68
|
-
|
|
70
|
+
log.warn('Rely pin/token collision; retrying', e);
|
|
69
71
|
}
|
|
70
72
|
else {
|
|
71
73
|
throw e;
|
|
@@ -109,7 +111,8 @@ export const basicRely = (context, type) => {
|
|
|
109
111
|
}
|
|
110
112
|
catch (e) {
|
|
111
113
|
if (e instanceof ResourceError) {
|
|
112
|
-
|
|
114
|
+
// The peer's pin/token is unknown; the refusal itself is logged where sign-in is decided.
|
|
115
|
+
log.debug('Rely peer lookup failed', e);
|
|
113
116
|
throw new AuthorizationError('rely');
|
|
114
117
|
}
|
|
115
118
|
else {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"basic-rely.js","sourceRoot":"","sources":["../../../src/manager/plugins/basic-rely.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAI3H,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAElD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;
|
|
1
|
+
{"version":3,"file":"basic-rely.js","sourceRoot":"","sources":["../../../src/manager/plugins/basic-rely.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAI3H,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAElD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAC7F,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAEtC,MAAM,GAAG,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAA;AAEtC,MAAM,cAAc,GAAgC,EAAE,CAAA;AACtD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAAmB,EAAE,IAAa,EAAc,EAAE;IAC1E,MAAM,MAAM,GAAe;QACzB,IAAI,EAAE,IAAI,IAAI,kBAAkB,CAAC,aAAa;QAE9C,2DAA2D;QAC3D,+CAA+C;QAC/C,8EAA8E;QAC9E,uDAAuD;QACvD,IAAI,EAAE,KAAK,EAAE,OAA6B,EAA8B,EAAE;YACxE,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;YAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAoB,UAAU,CAAC,CAAA;YAC9D,IAAI,OAAkB,CAAA;YACtB,GAAG,CAAC;gBACF,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAA;oBAE3E,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;oBACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,eAAe,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;oBAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,iBAAiB,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;oBAEnF,MAAM,QAAQ,GAAG,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAA;oBAE3E,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;wBAChB,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAA;oBAC3E,CAAC;oBACD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;wBAClB,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAA;oBAC7E,CAAC;oBAED,IAAI,OAAO,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;wBAChC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,EAAC,GAAG,EAAC,EAAE;4BACxE,cAAc,CAAC,GAAG,CAAC,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;gCAC1D,IAAI,KAAK,EAAE,SAAS,IAAI,IAAI,EAAE,CAAC;oCAC7B,MAAM,IAAI,GAAG,iBAAiB,CAAY,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;oCAC7E,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;wCAC/B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;4CACpD,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;4CACvB,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;gDAChC,OAAO,cAAc,CAAC,GAAG,CAAC,CAAA;4CAC5B,CAAC;wCACH,CAAC,CAAC,CAAA;wCACF,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;oCAC5D,CAAC;gCACH,CAAC;4BACH,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;4BAElB,iFAAiF;4BACjF,8BAA8B;4BAC9B,UAAU,CAAC,GAAG,EAAE;gCACd,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;oCAChC,IAAI,CAAC;wCACH,KAAK,cAAc,CAAC,GAAG,CAAC,EAAE,CAAA;wCAC1B,OAAO,cAAc,CAAC,GAAG,CAAC,CAAA;oCAC5B,CAAC;4CAAS,CAAC;wCACT,KAAK,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAA;oCAC5B,CAAC;gCACH,CAAC;4BACH,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC,CAAA;wBAC9B,CAAC,CAAC,CAAC,CAAA;oBACL,CAAC;oBAED,OAAO,QAAQ,CAAA;gBACjB,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAI,CAAC,YAAY,aAAa,EAAE,CAAC;wBAC/B,GAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE,CAAC,CAAC,CAAA;oBACnD,CAAC;yBAAM,CAAC;wBACN,MAAM,CAAC,CAAA;oBACT,CAAC;gBACH,CAAC;gBACD,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;YACxD,CAAC,QAAQ,IAAI,EAAC;QAChB,CAAC;QAED,iGAAiG;QACjG,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;YAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAoB,UAAU,CAAC,CAAA;YAE9D,6DAA6D;YAC7D,yCAAyC;YACzC,sCAAsC;YAEtC,IAAI,IAAe,CAAA;YACnB,IAAI,CAAC;gBACH,IAAI,IAAgB,CAAA;gBACpB,IAAI,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;oBACtD,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;oBACnE,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;wBACpB,MAAM,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAA;oBACrC,CAAC;oBACD,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;gBAChD,CAAC;qBAAM,IAAI,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;oBAC/D,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;oBACrE,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;wBACpB,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;oBACvC,CAAC;oBACD,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;gBAChD,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,kBAAkB,CAAC,YAAY,CAAC,CAAA;gBAC5C,CAAC;gBACD,MAAM,OAAO,GAAG,iBAAiB,CAAY,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;gBAC/E,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC7B,MAAM,IAAI,gBAAgB,EAAE,CAAA;gBAC9B,CAAC;gBACD,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;YAC1B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,aAAa,EAAE,CAAC;oBAC/B,0FAA0F;oBAC1F,GAAG,CAAC,KAAK,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAA;oBACvC,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAA;gBACtC,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,CAAA;gBACT,CAAC;YACH,CAAC;YAED,MAAM,WAAW,GAAG,iBAAiB,CAAY,UAAU,CAAC,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;YACzF,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAEjF,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC;YAErC;gBACE,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,eAAe,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI;gBAC7D,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,iBAAiB,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI;aACpE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;gBACzC,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;oBAChC,KAAK,cAAc,CAAC,GAAG,CAAC,EAAE,CAAA;oBAC1B,OAAO,cAAc,CAAC,GAAG,CAAC,CAAA;gBAC5B,CAAC;YACH,CAAC,CAAC,CAAA;YAEF,MAAM,KAAK,GAAG,iBAAiB,CAAc,kBAAkB,CAAC,aAAa,CAAC,CAAA;YAC9E,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;YAEpC,UAAU,CAAC,IAAI,GAAG,kBAAkB,CAAC,aAAa,CAAA;YAElD,6FAA6F;YAC7F,gGAAgG;YAChG,iFAAiF;YACjF,8FAA8F;YAC9F,4GAA4G;YAC5G,iEAAiE;YACjE,MAAM,KAAK,GAAS,UAA6B,CAAA;YACjD,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAA;YAC5B,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAA;YAC9B,KAAK,CAAC,MAAM,GAAG,IAAI,CAAA;YAEnB,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAA;QAC/B,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../../../src/manager/rely/flow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAoB,IAAI,EAA8B,MAAM,gBAAgB,CAAA;AAExF,OAAO,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAyB,MAAM,kBAAkB,CAAA;AAE7F,OAAO,KAAK,EAAE,UAAU,EAAiD,MAAM,aAAa,CAAA;
|
|
1
|
+
{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../../../src/manager/rely/flow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAoB,IAAI,EAA8B,MAAM,gBAAgB,CAAA;AAExF,OAAO,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAyB,MAAM,kBAAkB,CAAA;AAE7F,OAAO,KAAK,EAAE,UAAU,EAAiD,MAAM,aAAa,CAAA;AAqB5F,eAAO,MAAM,cAAc,YAAa,UAAU,QAAQ,UAAU,SAAS,IAAI,GAAG,IAAI,KAAG,kBAgH1F,CAAA"}
|
|
@@ -5,6 +5,7 @@ import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope';
|
|
|
5
5
|
import { trusted } from '../utils/trusted.js';
|
|
6
6
|
import { RELY_TUNNEL } from '../consts.js';
|
|
7
7
|
import { RELY_ACTION_TIMEOUT } from '@owlmeans/auth-common';
|
|
8
|
+
import { logger } from '@owlmeans/log';
|
|
8
9
|
// 1. There is a difference between privileged (provider)
|
|
9
10
|
// and non-privileged (consumer) request
|
|
10
11
|
// 2. Source allows to distinguish between provider and consumer
|
|
@@ -14,6 +15,7 @@ import { RELY_ACTION_TIMEOUT } from '@owlmeans/auth-common';
|
|
|
14
15
|
// 3. General idea is that: when you are connected, the auth
|
|
15
16
|
// process can be started from scratch following same stages
|
|
16
17
|
// and using the same plugins but via socket
|
|
18
|
+
const log = logger('server-auth:rely');
|
|
17
19
|
export const createRelyFlow = (context, conn, auth) => {
|
|
18
20
|
const auhtenticate = conn.authenticate;
|
|
19
21
|
const model = makeAuthModel(context);
|
|
@@ -33,9 +35,9 @@ export const createRelyFlow = (context, conn, auth) => {
|
|
|
33
35
|
}
|
|
34
36
|
}, { channel: source.nonce });
|
|
35
37
|
// We allow to just forward call messages back and forth
|
|
36
|
-
conn._receiveCall = async (msg) => {
|
|
37
|
-
conn._receiveResult = async (msg) => {
|
|
38
|
-
conn._receiveError = async (msg) => {
|
|
38
|
+
conn._receiveCall = async (msg) => { log.debug('Forward call', { nonce: source.nonce, method: msg.method, id: msg.id }); };
|
|
39
|
+
conn._receiveResult = async (msg) => { log.debug('Forward result', { nonce: source.nonce, id: msg.id }); };
|
|
40
|
+
conn._receiveError = async (msg) => { log.debug('Forward error', { nonce: source.nonce, id: msg.id }); };
|
|
39
41
|
conn.defaultCallTimeout = RELY_ACTION_TIMEOUT * 1000;
|
|
40
42
|
const closeSender = conn.listen(async (message) => {
|
|
41
43
|
if (isMessage(message, true)) {
|
|
@@ -88,7 +90,7 @@ export const createRelyFlow = (context, conn, auth) => {
|
|
|
88
90
|
return [stage, await model.init(_payload)];
|
|
89
91
|
}
|
|
90
92
|
catch (e) {
|
|
91
|
-
|
|
93
|
+
log.warn('Rely init failed; connection closed', e);
|
|
92
94
|
await conn.close();
|
|
93
95
|
}
|
|
94
96
|
break;
|
|
@@ -110,7 +112,7 @@ export const createRelyFlow = (context, conn, auth) => {
|
|
|
110
112
|
return [AuthenticationStage.Authenticated, internalAuth];
|
|
111
113
|
}
|
|
112
114
|
catch (e) {
|
|
113
|
-
|
|
115
|
+
log.warn('Rely authentication failed; connection closed', e);
|
|
114
116
|
await conn.close();
|
|
115
117
|
}
|
|
116
118
|
break;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"flow.js","sourceRoot":"","sources":["../../../src/manager/rely/flow.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEzH,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAE5D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;
|
|
1
|
+
{"version":3,"file":"flow.js","sourceRoot":"","sources":["../../../src/manager/rely/flow.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEzH,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAE5D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAEtC,yDAAyD;AACzD,4CAA4C;AAC5C,gEAAgE;AAChE,wDAAwD;AACxD,mDAAmD;AACnD,2DAA2D;AAC3D,4DAA4D;AAC5D,+DAA+D;AAC/D,+CAA+C;AAE/C,MAAM,GAAG,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAA;AAEtC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAmB,EAAE,IAAgB,EAAE,IAAkB,EAAsB,EAAE;IAC9G,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAA;IAEtC,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IACpC,IAAI,YAAY,GAAgB,IAAI,IAAI,IAAI,CAAA;IAE5C,MAAM,MAAM,GAAe,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QACxD,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAA8B,WAAW,CAAC,CAAA;QACzE,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAC,OAAO,EAAC,EAAE;YAC3D,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAC1B,CAAC;iBAAM,IAAI,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;gBACzC,IAAK,OAAiC,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;oBACzD,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;oBAClB,WAAW,EAAE,CAAA;oBACb,MAAM,aAAa,EAAE,CAAA;gBACvB,CAAC;YACH,CAAC;QACH,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;QAC7B,wDAAwD;QACxD,IAAI,CAAC,YAAY,GAAG,KAAK,EAAC,GAAG,EAAC,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAA,CAAC,CAAC,CAAA;QACvH,IAAI,CAAC,cAAc,GAAG,KAAK,EAAC,GAAG,EAAC,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAA,CAAC,CAAC,CAAA;QACvG,IAAI,CAAC,aAAa,GAAG,KAAK,EAAC,GAAG,EAAC,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAA,CAAC,CAAC,CAAA;QACrG,IAAI,CAAC,kBAAkB,GAAG,mBAAmB,GAAG,IAAI,CAAA;QACpD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAC,OAAO,EAAC,EAAE;YAC9C,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,CAAA;gBAC9B,IAAI,OAAO,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;oBAC5B,OAAO,OAAO,CAAC,OAAO,CAAA;gBACxB,CAAC;gBACD,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;YAC3C,CAAC;iBAAM,IAAI,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;gBACzC,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;oBAC9B,MAAM,OAAO,GAAG,EAAE,GAAG,OAA2B,EAAE,CAAA;oBAClD,IAAI,OAAO,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;wBAC5B,OAAO,OAAO,CAAC,OAAO,CAAA;oBACxB,CAAC;oBACD,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;oBACzC,WAAW,EAAE,CAAA;oBACb,MAAM,aAAa,EAAE,CAAA;gBACvB,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QACF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,YAAY,GAAG;gBACb,KAAK,EAAE,iBAAiB,CAAY,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;gBACnE,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,IAAI,EAAE,kBAAkB,CAAC,aAAa;gBACtC,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,MAAM,EAAE,MAAM,CAAC,KAAK;gBACpB,MAAM,EAAE,CAAC,UAAU,CAAC;aACrB,CAAA;YACD,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;QAClE,CAAC;IACH,CAAC,CAAA;IAED,IAAI,CAAC,YAAY,GAAG,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC3C,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;QAC1C,QAAQ,KAAK,EAAE,CAAC;YACd,sEAAsE;YACtE,KAAK,mBAAmB,CAAC,IAAI;gBAC3B,MAAM,QAAQ,GAAG,OAA+B,CAAA;gBAChD,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;oBACjB,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAA;gBACtB,CAAC;qBAAM,IAAI,QAAQ,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;oBACjC,OAAO,QAAQ,CAAC,IAAI,CAAA;gBACtB,CAAC;gBACD,QAAQ,CAAC,WAAW,GAAG,MAAM,CAAA;gBAC7B,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAA;gBAEpB,IAAI,CAAC;oBACH,OAAO,CAAC,KAAK,EAAE,MAAM,KAAK,CAAC,IAAI,CAAC,QAA4B,CAAQ,CAAC,CAAA;gBACvE,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,GAAG,CAAC,IAAI,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAA;oBAClD,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;gBACpB,CAAC;gBACD,MAAK;YACP,kFAAkF;YAClF,KAAK,mBAAmB,CAAC,YAAY;gBACnC,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,OAA0B,CAAA;oBACvC,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;oBACpD,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;oBACjF,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;wBACpC,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAA;oBAC5C,CAAC;oBACD,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,kBAAkB,CAAC,aAAa,EAAE,CAAC;wBACzD,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAA;oBAC5C,CAAC;oBACD,YAAY,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;oBAEjC,MAAM,KAAK,GAAG,iBAAiB,CAAc,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAA;oBAE9F,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;oBAEtC,OAAO,CAAC,mBAAmB,CAAC,aAAa,EAAE,YAAmB,CAAC,CAAA;gBACjE,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,GAAG,CAAC,IAAI,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAA;oBAC5D,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;gBACpB,CAAC;gBACD,MAAK;YACP,qDAAqD;YACrD,KAAK,mBAAmB,CAAC,aAAa;gBACpC,OAAO,CAAC,KAAK,EAAE,YAAmB,CAAC,CAAA;YACrC;gBACE,OAAO,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QACvC,CAAC;QACD,OAAO,CAAC,KAAK,EAAE,IAAW,CAAC,CAAA;IAC7B,CAAC,CAAA;IAED,OAAO,IAAI,CAAC,YAAY,CAAA;AAC1B,CAAC,CAAA"}
|
package/build/service.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAG3E,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAa,MAAM,YAAY,CAAA;
|
|
1
|
+
{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAG3E,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAa,MAAM,YAAY,CAAA;AAqB3E,KAAK,MAAM,GAAG,YAAY,CAAA;AAgB1B,eAAO,MAAM,eAAe,WAAW,MAAM,KAAmB,WAqL/D,CAAA;AAED,eAAO,MAAM,iBAAiB,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,aAAa,CAAC,CAAC,CAAC,OACvE,CAAC,UAAS,MAAM,KACpB,CAAC,GAAG,iBAiBN,CAAA"}
|
package/build/service.js
CHANGED
|
@@ -10,6 +10,18 @@ import { AUTH_IDENTITY_PROFILE } from '@owlmeans/server-auth-identity';
|
|
|
10
10
|
import { appendMemoryAuthSessionManager, AUTH_SESSION_MANAGER, AUTH_SESSION_TTL } from '@owlmeans/server-auth-session';
|
|
11
11
|
import { uuid } from '@owlmeans/basic-ids';
|
|
12
12
|
import { TOKEN_UPDATE } from '@owlmeans/auth-common';
|
|
13
|
+
import { logger } from '@owlmeans/log';
|
|
14
|
+
const log = logger('server-auth');
|
|
15
|
+
/**
|
|
16
|
+
* A refused token exchange — the manager's token presented to open a session. Logged with the
|
|
17
|
+
* reason and the account id only; returns the error for the caller to throw.
|
|
18
|
+
*/
|
|
19
|
+
const refuse = (reason, error, userId) => {
|
|
20
|
+
const accountId = userId == null ? undefined
|
|
21
|
+
: userId.includes('@') ? `*@${userId.slice(userId.lastIndexOf('@') + 1)}` : userId;
|
|
22
|
+
log.warn('Session exchange refused', { reason, ...(accountId != null ? { accountId } : {}) }, { event: 'auth.refused' });
|
|
23
|
+
return error;
|
|
24
|
+
};
|
|
13
25
|
export const makeAuthService = (alias = DEFAULT_ALIAS) => {
|
|
14
26
|
const location = `server-auth:${alias}`;
|
|
15
27
|
const cache = (context) => context.resource(AUTH_CACHE);
|
|
@@ -131,7 +143,7 @@ export const makeAuthService = (alias = DEFAULT_ALIAS) => {
|
|
|
131
143
|
const envelope = makeEnvelopeModel(token.token, EnvelopeKind.Token);
|
|
132
144
|
const authService = await trust(context, TRUSTED, AUTH_SRV_KEY);
|
|
133
145
|
if (!await envelope.verify(authService.key)) {
|
|
134
|
-
throw new AuthenFailed();
|
|
146
|
+
throw refuse('signature', new AuthenFailed());
|
|
135
147
|
}
|
|
136
148
|
const credentials = envelope.message();
|
|
137
149
|
const msg = credentials.challenge;
|
|
@@ -140,10 +152,10 @@ export const makeAuthService = (alias = DEFAULT_ALIAS) => {
|
|
|
140
152
|
await cache(context).create({ id: msg }, { ttl: AUTHEN_TIMEFRAME / 1000 });
|
|
141
153
|
}
|
|
142
154
|
catch {
|
|
143
|
-
throw new AuthenFailed();
|
|
155
|
+
throw refuse('replay', new AuthenFailed(), credentials.userId);
|
|
144
156
|
}
|
|
145
157
|
if (credentials.credential !== authService.user.id) {
|
|
146
|
-
throw new AuthenFailed();
|
|
158
|
+
throw refuse('issuer', new AuthenFailed(), credentials.userId);
|
|
147
159
|
}
|
|
148
160
|
// @TODO Move to a plugin
|
|
149
161
|
const issuedAt = Date.now();
|
|
@@ -167,13 +179,13 @@ export const makeAuthService = (alias = DEFAULT_ALIAS) => {
|
|
|
167
179
|
if (manager != null) {
|
|
168
180
|
const entityId = await entityIdFor(context, auth.entitySlug);
|
|
169
181
|
if (entityId == null || auth.profileId == null)
|
|
170
|
-
throw new AuthenFailed('session');
|
|
182
|
+
throw refuse('session', new AuthenFailed('session'), auth.userId);
|
|
171
183
|
const decision = await manager.register({
|
|
172
184
|
id: auth.sessionId, kind: 'bearer', entityId, profileId: auth.profileId,
|
|
173
185
|
issuedAt, expiresAt: expiresAt.getTime()
|
|
174
186
|
});
|
|
175
187
|
if (decision.state !== 'active')
|
|
176
|
-
throw new AuthenFailed('session');
|
|
188
|
+
throw refuse('session', new AuthenFailed('session'), auth.userId);
|
|
177
189
|
auth.authorizationVersion = decision.version;
|
|
178
190
|
}
|
|
179
191
|
return { token: await sign(context, auth) };
|
package/build/service.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEvF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE1E,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAGrG,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAEtE,OAAO,EACL,8BAA8B,EAAE,oBAAoB,EAAE,gBAAgB,EACvE,MAAM,+BAA+B,CAAA;AAEtC,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;
|
|
1
|
+
{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEvF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE1E,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAGrG,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAEtE,OAAO,EACL,8BAA8B,EAAE,oBAAoB,EAAE,gBAAgB,EACvE,MAAM,+BAA+B,CAAA;AAEtC,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAKtC,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,CAAA;AAEjC;;;GAGG;AACH,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,KAAmB,EAAE,MAAe,EAAgB,EAAE;IACpF,MAAM,SAAS,GAAG,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS;QAC1C,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAA;IACpF,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAA;IACxH,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAK,GAAW,aAAa,EAAe,EAAE;IAC5E,MAAM,QAAQ,GAAG,eAAe,KAAK,EAAE,CAAA;IAEvC,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAuB,EAAE,CACtD,OAAO,CAAC,QAAQ,CAAsB,UAAU,CAAC,CAAA;IAEnD,MAAM,QAAQ,GAAG,CAAC,OAAgB,EAA6B,EAAE,CAC/D,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC;QACtC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAqB,oBAAoB,CAAC;QAC3D,CAAC,CAAC,IAAI,CAAA;IAEV,MAAM,WAAW,GAAG,KAAK,EAAE,OAAgB,EAAE,UAA8B,EAA0B,EAAE;QACrG,IAAI,UAAU,IAAI,IAAI,IAAI,UAAU,KAAK,EAAE;YAAE,OAAO,IAAI,CAAA;QACxD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,OAAO,UAAU,CAAA;QAC3D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QAChG,OAAO,MAAM,EAAE,EAAE,IAAI,IAAI,CAAA;IAC3B,CAAC,CAAA;IAED,MAAM,OAAO,GAAG,KAAK,EAAE,OAAgB,EAAE,IAAU,EAAE,OAAe,EAAwB,EAAE;QAC5F,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;QAC5D,IAAI,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,qBAAqB,CAAC;YAAE,OAAO,IAAI,CAAA;QAC1G,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;QACjF,IAAI,OAAO,GAA2B,IAAI,CAAA;QAC1C,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,yFAAyF;YACzF,4EAA4E;YAC5E,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAA;QAC/C,CAAC;QACD,IAAI,OAAO,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAAE,OAAO,IAAI,CAAA;QACtH,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM;YACrC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;YAC5B,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,oBAAoB,EAAE,OAAO;YAC7B,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAA;IACH,CAAC,CAAA;IAED,MAAM,IAAI,GAAG,KAAK,EAAE,OAAgB,EAAE,IAAU,EAAmB,EAAE;QACnE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACxG,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QACpH,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAO,iBAAiB,CAAC,iBAAiB,CAAC;aACrF,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;QACxD,OAAO,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,EAAE,IAAI,aAAa,EAAE,CAAA;IAChF,CAAC,CAAA;IAED,MAAM,OAAO,GAAgB,aAAa,CAAc,KAAK,EAAE;QAC7D,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,IAAI;QAEtF,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAY,CAAA;YACrD,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAA;YAChF,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAE3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxG,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,IAAI,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YAC7B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;YACjC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI;oBAAE,OAAO,KAAU,CAAA;gBAC7C,IAAI,QAAQ,CAAA;gBACZ,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBAClD,CAAC;gBAAC,MAAM,CAAC;oBACP,0FAA0F;oBAC1F,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAA;gBAC/C,CAAC;gBACD,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS;oBAAE,OAAO,KAAU,CAAA;gBAClF,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBACjC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;oBAChE,IAAI,SAAS,IAAI,IAAI;wBAAE,OAAO,KAAU,CAAA;oBACxC,IAAI,GAAG,SAAS,CAAA;oBAChB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;oBAC7C,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;oBACvD,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,CAAA;gBAC9D,CAAC;YACH,CAAC;YAED,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAEjB,OAAO,IAAS,CAAA;QAClB,CAAC;QAED,MAAM,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YACpB,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YACpD,MAAM,CAAC,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAE3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxG,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;YACjC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI;oBAAE,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;gBACnE,IAAI,QAAQ,CAAA;gBACZ,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBAClD,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAA;gBAC/C,CAAC;gBACD,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ;oBAAE,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;YAC1E,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,aAAa,EAAE,KAAK,IAAI,EAAE;YACxB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YAC1B,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,EAAE,QAAQ,CAAC,CAAA;YAChF,MAAM,QAAQ,GAAG,iBAAiB,CAAkB,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAEpF,MAAM,WAAW,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;YAChF,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5C,MAAM,MAAM,CAAC,WAAW,EAAE,IAAI,YAAY,EAAE,CAAC,CAAA;YAC/C,CAAC;YAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YACtC,MAAM,GAAG,GAAG,WAAW,CAAC,SAAS,CAAA;YAEjC,6EAA6E;YAE7E,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;YAC5E,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,YAAY,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;YAChE,CAAC;YAED,IAAI,WAAW,CAAC,UAAU,KAAK,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACnD,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,YAAY,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;YAChE,CAAC;YAED,yBAAyB;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,QAAQ,GAAG,gBAAgB,CAAC,CAAA;YACvD,MAAM,IAAI,GAAS;gBACjB,KAAK,EAAE,WAAW,CAAC,SAAS;gBAC5B,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,IAAI,EAAE,iBAAiB,CAAC,iBAAiB;gBACzC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;gBAC3B,SAAS,EAAE,WAAW,CAAC,SAAS;gBAChC,UAAU,EAAE,WAAW,CAAC,UAAU;gBAClC,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC;gBAC7B,SAAS;gBACT,SAAS,EAAE,IAAI,EAAE;gBACjB,oBAAoB,EAAE,CAAC;aACxB,CAAA;YACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;YACjC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;gBAC5D,IAAI,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI;oBAAE,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;gBACjH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;oBACtC,EAAE,EAAE,IAAI,CAAC,SAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS;oBACxE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE;iBACzC,CAAC,CAAA;gBACF,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ;oBAAE,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;gBAClG,IAAI,CAAC,oBAAoB,GAAG,QAAQ,CAAC,OAAO,CAAA;YAC9C,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAA;QAC7C,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,GAAM,EAAE,KAAK,GAAW,aAAa,EACd,EAAE;IAEzB,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAA;IACxD,CAAC;IAED,8FAA8F;IAC9F,oEAAoE;IACpE,8BAA8B,CAAC,GAAG,CAAC,CAAA;IAEnC,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,GAA4B,CAAA;IAE5C,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAChC,OAAO,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAE/C,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@owlmeans/server-auth",
|
|
3
|
-
"version": "0.1.18-rc.
|
|
3
|
+
"version": "0.1.18-rc.52",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"scripts": {
|
|
@@ -37,31 +37,32 @@
|
|
|
37
37
|
},
|
|
38
38
|
"dependencies": {
|
|
39
39
|
"@noble/hashes": "^1.5.0",
|
|
40
|
-
"@owlmeans/api": "^0.1.18-rc.
|
|
41
|
-
"@owlmeans/api-config-server": "^0.1.18-rc.
|
|
42
|
-
"@owlmeans/auth": "^0.1.18-rc.
|
|
43
|
-
"@owlmeans/auth-common": "^0.1.18-rc.
|
|
44
|
-
"@owlmeans/basic-envelope": "^0.1.18-rc.
|
|
45
|
-
"@owlmeans/basic-ids": "^0.1.18-rc.
|
|
46
|
-
"@owlmeans/basic-keys": "^0.1.18-rc.
|
|
47
|
-
"@owlmeans/client-config": "^0.1.18-rc.
|
|
48
|
-
"@owlmeans/client-entrypoint": "^0.1.18-rc.
|
|
49
|
-
"@owlmeans/config": "^0.1.18-rc.
|
|
40
|
+
"@owlmeans/api": "^0.1.18-rc.45",
|
|
41
|
+
"@owlmeans/api-config-server": "^0.1.18-rc.49",
|
|
42
|
+
"@owlmeans/auth": "^0.1.18-rc.38",
|
|
43
|
+
"@owlmeans/auth-common": "^0.1.18-rc.45",
|
|
44
|
+
"@owlmeans/basic-envelope": "^0.1.18-rc.44",
|
|
45
|
+
"@owlmeans/basic-ids": "^0.1.18-rc.35",
|
|
46
|
+
"@owlmeans/basic-keys": "^0.1.18-rc.46",
|
|
47
|
+
"@owlmeans/client-config": "^0.1.18-rc.42",
|
|
48
|
+
"@owlmeans/client-entrypoint": "^0.1.18-rc.45",
|
|
49
|
+
"@owlmeans/config": "^0.1.18-rc.42",
|
|
50
50
|
"@owlmeans/context": "^0.1.18-rc.32",
|
|
51
|
-
"@owlmeans/kluster": "^0.1.18-rc.
|
|
52
|
-
"@owlmeans/
|
|
53
|
-
"@owlmeans/
|
|
54
|
-
"@owlmeans/resource": "^0.1.18-rc.
|
|
51
|
+
"@owlmeans/kluster": "^0.1.18-rc.41",
|
|
52
|
+
"@owlmeans/log": "^0.1.18-rc.0",
|
|
53
|
+
"@owlmeans/entrypoint": "^0.1.18-rc.39",
|
|
54
|
+
"@owlmeans/redis-resource": "^0.1.18-rc.42",
|
|
55
|
+
"@owlmeans/resource": "^0.1.18-rc.38",
|
|
55
56
|
"@owlmeans/route": "^0.1.18-rc.33",
|
|
56
|
-
"@owlmeans/server-api": "^0.1.18-rc.
|
|
57
|
-
"@owlmeans/server-auth-identity": "^0.1.18-rc.
|
|
58
|
-
"@owlmeans/server-auth-session": "^0.1.18-rc.
|
|
59
|
-
"@owlmeans/server-context": "^0.1.18-rc.
|
|
60
|
-
"@owlmeans/server-entrypoint": "^0.1.18-rc.
|
|
57
|
+
"@owlmeans/server-api": "^0.1.18-rc.49",
|
|
58
|
+
"@owlmeans/server-auth-identity": "^0.1.18-rc.45",
|
|
59
|
+
"@owlmeans/server-auth-session": "^0.1.18-rc.14",
|
|
60
|
+
"@owlmeans/server-context": "^0.1.18-rc.41",
|
|
61
|
+
"@owlmeans/server-entrypoint": "^0.1.18-rc.38",
|
|
61
62
|
"@owlmeans/server-route": "^0.1.18-rc.32",
|
|
62
|
-
"@owlmeans/server-socket": "^0.1.18-rc.
|
|
63
|
-
"@owlmeans/socket": "^0.1.18-rc.
|
|
64
|
-
"@owlmeans/static-resource": "^0.1.18-rc.
|
|
63
|
+
"@owlmeans/server-socket": "^0.1.18-rc.52",
|
|
64
|
+
"@owlmeans/socket": "^0.1.18-rc.38",
|
|
65
|
+
"@owlmeans/static-resource": "^0.1.18-rc.37",
|
|
65
66
|
"@scure/base": "^2.3.0"
|
|
66
67
|
},
|
|
67
68
|
"peerDependencies": {
|
|
@@ -69,7 +70,7 @@
|
|
|
69
70
|
},
|
|
70
71
|
"devDependencies": {
|
|
71
72
|
"@owlmeans/dep-config": "workspace:*",
|
|
72
|
-
"@owlmeans/test-auth": "^0.1.18-rc.
|
|
73
|
+
"@owlmeans/test-auth": "^0.1.18-rc.44",
|
|
73
74
|
"@types/bun": "^1.4.0",
|
|
74
75
|
"@types/node": "^26.1.0",
|
|
75
76
|
"nodemon": "^3.1.14",
|
package/src/manager/README.md
CHANGED
|
@@ -38,7 +38,7 @@ The manager is built on the OwlMeans entrypoint system, providing:
|
|
|
38
38
|
This manager app is part of the `@owlmeans/server-auth` package:
|
|
39
39
|
|
|
40
40
|
```bash
|
|
41
|
-
npm install @owlmeans/server-auth@^0.1.18-rc.
|
|
41
|
+
npm install @owlmeans/server-auth@^0.1.18-rc.52
|
|
42
42
|
```
|
|
43
43
|
|
|
44
44
|
## API Reference
|
package/src/manager/model.ts
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import type { AuthModel, AppConfig, AppContext } from './types.js'
|
|
2
|
-
import { AuthenFailed, AuthenPayloadError, entitySlugOf } from '@owlmeans/auth'
|
|
2
|
+
import { AuthenFailed, AuthenPayloadError, AuthError, AuthUnavailable, entitySlugOf } from '@owlmeans/auth'
|
|
3
|
+
import { logger } from '@owlmeans/log'
|
|
3
4
|
import type { AuthCredentials } from '@owlmeans/auth'
|
|
4
5
|
import type { EntityResolverService } from '@owlmeans/auth-common'
|
|
5
6
|
import { ENTITY_RESOLVER } from '@owlmeans/auth-common'
|
|
@@ -17,6 +18,15 @@ import { AuthChallengeReplayPolicy } from './plugins/replay-policy.js'
|
|
|
17
18
|
type Config = ServerConfig
|
|
18
19
|
type Context = ServerContext<Config>
|
|
19
20
|
|
|
21
|
+
const log = logger('server-auth')
|
|
22
|
+
|
|
23
|
+
/** An account id as a log may carry it: an e-mail is reduced to its domain. */
|
|
24
|
+
const accountOf = (userId: string | undefined): string | undefined =>
|
|
25
|
+
userId == null ? undefined : userId.includes('@') ? `*@${userId.slice(userId.lastIndexOf('@') + 1)}` : userId
|
|
26
|
+
|
|
27
|
+
const compact = <T extends Record<string, unknown>>(value: T): Partial<T> =>
|
|
28
|
+
Object.fromEntries(Object.entries(value).filter(([, entry]) => entry != null)) as Partial<T>
|
|
29
|
+
|
|
20
30
|
export const makeAuthModel = (context: AppContext<AppConfig>): AuthModel => {
|
|
21
31
|
const cache = (context: Context): Resource<AuthSpent> =>
|
|
22
32
|
context.resource<Resource<AuthSpent>>(AUTH_CACHE)
|
|
@@ -44,61 +54,79 @@ export const makeAuthModel = (context: AppContext<AppConfig>): AuthModel => {
|
|
|
44
54
|
},
|
|
45
55
|
|
|
46
56
|
authenticate: async credential => {
|
|
47
|
-
|
|
48
|
-
const
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
57
|
+
// The one place every manager sign-in method (each plugin) is decided — logged once here.
|
|
58
|
+
const method = credential.type
|
|
59
|
+
try {
|
|
60
|
+
const [trustedUser, keyPair] = await trusted(context)
|
|
61
|
+
const envelope: EnvelopeModel = makeEnvelopeModel(credential.challenge, EnvelopeKind.Wrap)
|
|
62
|
+
if (!await envelope.verify(keyPair)) {
|
|
63
|
+
throw new AuthenFailed('challenge')
|
|
64
|
+
}
|
|
52
65
|
|
|
53
|
-
|
|
66
|
+
const msg: string = envelope.message(true)
|
|
54
67
|
|
|
55
|
-
|
|
68
|
+
const plugin = await getPlugin(envelope.type(), context)
|
|
56
69
|
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
70
|
+
if (plugin.challengeReplayPolicy !== AuthChallengeReplayPolicy.Plugin) {
|
|
71
|
+
try {
|
|
72
|
+
await cache(context).create({ id: msg }, { ttl: (envelope.envelope.ttl ?? AUTHEN_TIMEFRAME) / 1000 })
|
|
73
|
+
} catch (e) {
|
|
74
|
+
const error = new AuthenFailed('challenge')
|
|
75
|
+
if (e instanceof Error) {
|
|
76
|
+
error.oiriginalStack = `${e} : ${e.stack}`
|
|
77
|
+
}
|
|
78
|
+
throw error
|
|
64
79
|
}
|
|
65
|
-
throw error
|
|
66
80
|
}
|
|
67
|
-
}
|
|
68
81
|
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
82
|
+
if (credential.userId == null) {
|
|
83
|
+
throw new AuthenPayloadError('userId')
|
|
84
|
+
}
|
|
72
85
|
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
86
|
+
// @TODO this token PROBABLY needs to be registered somewhere and rechecked
|
|
87
|
+
// from time to time to make sure that the session is not deleted
|
|
88
|
+
// or permission hasn't changed.
|
|
89
|
+
// Alternative solution is to have permissions cached and cleaned
|
|
90
|
+
// when some broadcast message is sent from authentication system.
|
|
91
|
+
|
|
92
|
+
const challenge = credential.challenge
|
|
93
|
+
const { token } = await plugin.authenticate(Object.assign(credential, { challenge: msg }))
|
|
94
|
+
credential.challenge = token === '' ? challenge : token
|
|
95
|
+
|
|
96
|
+
// Plugins accept whatever the caller typed — a current slug, a slug the organization has
|
|
97
|
+
// since retired, or (for a token minted before slugs existed) its stable key. The token is
|
|
98
|
+
// signed once and read for as long as it lives, so the value is canonicalized here rather
|
|
99
|
+
// than at every place that later reads it back.
|
|
100
|
+
const entitySlug = entitySlugOf(credential)
|
|
101
|
+
if (entitySlug != null && context.hasService(ENTITY_RESOLVER)) {
|
|
102
|
+
const entity = await context.service<EntityResolverService>(ENTITY_RESOLVER).resolve(entitySlug)
|
|
103
|
+
if (entity == null) {
|
|
104
|
+
throw new AuthenFailed('entity')
|
|
105
|
+
}
|
|
106
|
+
credential.entitySlug = entity.slug
|
|
92
107
|
}
|
|
93
|
-
credential.entitySlug = entity.slug
|
|
94
|
-
}
|
|
95
108
|
|
|
96
|
-
|
|
109
|
+
credential.credential = trustedUser.id
|
|
97
110
|
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
111
|
+
const result = {
|
|
112
|
+
token: await makeEnvelopeModel<AuthCredentials>(credential.type)
|
|
113
|
+
.send(credential, AUTHEN_TIMEFRAME)
|
|
114
|
+
.sign(keyPair, EnvelopeKind.Token)
|
|
115
|
+
}
|
|
116
|
+
log.info('Signed in', compact({
|
|
117
|
+
method, accountId: accountOf(credential.userId), profileId: credential.profileId,
|
|
118
|
+
entitySlug: credential.entitySlug,
|
|
119
|
+
}), { event: 'auth.signed-in' })
|
|
120
|
+
|
|
121
|
+
return result
|
|
122
|
+
} catch (error) {
|
|
123
|
+
// An outage (`AuthUnavailable`) is not a refusal; it propagates and is logged as a failure.
|
|
124
|
+
if (error instanceof AuthError && !(error instanceof AuthUnavailable)) {
|
|
125
|
+
log.warn('Sign-in refused', compact({
|
|
126
|
+
method, accountId: accountOf(credential.userId), reason: error.message,
|
|
127
|
+
}), { event: 'auth.refused' })
|
|
128
|
+
}
|
|
129
|
+
throw error
|
|
102
130
|
}
|
|
103
131
|
},
|
|
104
132
|
|
|
@@ -9,6 +9,9 @@ import { AUTH_CACHE } from '../../consts.js'
|
|
|
9
9
|
import { ResourceError } from '@owlmeans/resource'
|
|
10
10
|
import type { Unsubscribe } from '@owlmeans/resource'
|
|
11
11
|
import { RELY_CALL_TIMEOUT, RELY_PIN_PERFIX, RELY_TOKEN_PREFIX } from '@owlmeans/auth-common'
|
|
12
|
+
import { logger } from '@owlmeans/log'
|
|
13
|
+
|
|
14
|
+
const log = logger('server-auth:rely')
|
|
12
15
|
|
|
13
16
|
const _subscriptions: Record<string, Unsubscribe> = {}
|
|
14
17
|
export const basicRely = (context: AppContext, type?: string): AuthPlugin => {
|
|
@@ -75,7 +78,7 @@ export const basicRely = (context: AppContext, type?: string): AuthPlugin => {
|
|
|
75
78
|
return response
|
|
76
79
|
} catch (e) {
|
|
77
80
|
if (e instanceof ResourceError) {
|
|
78
|
-
|
|
81
|
+
log.warn('Rely pin/token collision; retrying', e)
|
|
79
82
|
} else {
|
|
80
83
|
throw e
|
|
81
84
|
}
|
|
@@ -118,7 +121,8 @@ export const basicRely = (context: AppContext, type?: string): AuthPlugin => {
|
|
|
118
121
|
rely = envelop.message()
|
|
119
122
|
} catch (e) {
|
|
120
123
|
if (e instanceof ResourceError) {
|
|
121
|
-
|
|
124
|
+
// The peer's pin/token is unknown; the refusal itself is logged where sign-in is decided.
|
|
125
|
+
log.debug('Rely peer lookup failed', e)
|
|
122
126
|
throw new AuthorizationError('rely')
|
|
123
127
|
} else {
|
|
124
128
|
throw e
|
package/src/manager/rely/flow.ts
CHANGED
|
@@ -9,6 +9,7 @@ import { trusted } from '../utils/trusted.js'
|
|
|
9
9
|
import { RELY_TUNNEL } from '../consts.js'
|
|
10
10
|
import type { RedisResource } from '@owlmeans/redis-resource'
|
|
11
11
|
import { RELY_ACTION_TIMEOUT } from '@owlmeans/auth-common'
|
|
12
|
+
import { logger } from '@owlmeans/log'
|
|
12
13
|
|
|
13
14
|
// 1. There is a difference between privileged (provider)
|
|
14
15
|
// and non-privileged (consumer) request
|
|
@@ -20,6 +21,8 @@ import { RELY_ACTION_TIMEOUT } from '@owlmeans/auth-common'
|
|
|
20
21
|
// process can be started from scratch following same stages
|
|
21
22
|
// and using the same plugins but via socket
|
|
22
23
|
|
|
24
|
+
const log = logger('server-auth:rely')
|
|
25
|
+
|
|
23
26
|
export const createRelyFlow = (context: AppContext, conn: Connection, auth?: Auth | null): AuthenticateMethod => {
|
|
24
27
|
const auhtenticate = conn.authenticate
|
|
25
28
|
|
|
@@ -40,9 +43,9 @@ export const createRelyFlow = (context: AppContext, conn: Connection, auth?: Aut
|
|
|
40
43
|
}
|
|
41
44
|
}, { channel: source.nonce })
|
|
42
45
|
// We allow to just forward call messages back and forth
|
|
43
|
-
conn._receiveCall = async msg => {
|
|
44
|
-
conn._receiveResult = async msg => {
|
|
45
|
-
conn._receiveError = async msg => {
|
|
46
|
+
conn._receiveCall = async msg => { log.debug('Forward call', { nonce: source.nonce, method: msg.method, id: msg.id }) }
|
|
47
|
+
conn._receiveResult = async msg => { log.debug('Forward result', { nonce: source.nonce, id: msg.id }) }
|
|
48
|
+
conn._receiveError = async msg => { log.debug('Forward error', { nonce: source.nonce, id: msg.id }) }
|
|
46
49
|
conn.defaultCallTimeout = RELY_ACTION_TIMEOUT * 1000
|
|
47
50
|
const closeSender = conn.listen(async message => {
|
|
48
51
|
if (isMessage(message, true)) {
|
|
@@ -94,7 +97,7 @@ export const createRelyFlow = (context: AppContext, conn: Connection, auth?: Aut
|
|
|
94
97
|
try {
|
|
95
98
|
return [stage, await model.init(_payload as AllowanceRequest) as any]
|
|
96
99
|
} catch (e) {
|
|
97
|
-
|
|
100
|
+
log.warn('Rely init failed; connection closed', e)
|
|
98
101
|
await conn.close()
|
|
99
102
|
}
|
|
100
103
|
break
|
|
@@ -118,7 +121,7 @@ export const createRelyFlow = (context: AppContext, conn: Connection, auth?: Aut
|
|
|
118
121
|
|
|
119
122
|
return [AuthenticationStage.Authenticated, internalAuth as any]
|
|
120
123
|
} catch (e) {
|
|
121
|
-
|
|
124
|
+
log.warn('Rely authentication failed; connection closed', e)
|
|
122
125
|
await conn.close()
|
|
123
126
|
}
|
|
124
127
|
break
|
package/src/service.ts
CHANGED
|
@@ -20,10 +20,24 @@ import {
|
|
|
20
20
|
import type { AuthSessionManager } from '@owlmeans/server-auth-session'
|
|
21
21
|
import { uuid } from '@owlmeans/basic-ids'
|
|
22
22
|
import { TOKEN_UPDATE } from '@owlmeans/auth-common'
|
|
23
|
+
import { logger } from '@owlmeans/log'
|
|
23
24
|
|
|
24
25
|
type Config = ServerConfig
|
|
25
26
|
type Context = ServerContext<Config>
|
|
26
27
|
|
|
28
|
+
const log = logger('server-auth')
|
|
29
|
+
|
|
30
|
+
/**
|
|
31
|
+
* A refused token exchange — the manager's token presented to open a session. Logged with the
|
|
32
|
+
* reason and the account id only; returns the error for the caller to throw.
|
|
33
|
+
*/
|
|
34
|
+
const refuse = (reason: string, error: AuthenFailed, userId?: string): AuthenFailed => {
|
|
35
|
+
const accountId = userId == null ? undefined
|
|
36
|
+
: userId.includes('@') ? `*@${userId.slice(userId.lastIndexOf('@') + 1)}` : userId
|
|
37
|
+
log.warn('Session exchange refused', { reason, ...(accountId != null ? { accountId } : {}) }, { event: 'auth.refused' })
|
|
38
|
+
return error
|
|
39
|
+
}
|
|
40
|
+
|
|
27
41
|
export const makeAuthService = (alias: string = DEFAULT_ALIAS): AuthService => {
|
|
28
42
|
const location = `server-auth:${alias}`
|
|
29
43
|
|
|
@@ -152,7 +166,7 @@ export const makeAuthService = (alias: string = DEFAULT_ALIAS): AuthService => {
|
|
|
152
166
|
|
|
153
167
|
const authService = await trust<Config, Context>(context, TRUSTED, AUTH_SRV_KEY)
|
|
154
168
|
if (!await envelope.verify(authService.key)) {
|
|
155
|
-
throw new AuthenFailed()
|
|
169
|
+
throw refuse('signature', new AuthenFailed())
|
|
156
170
|
}
|
|
157
171
|
|
|
158
172
|
const credentials = envelope.message()
|
|
@@ -163,11 +177,11 @@ export const makeAuthService = (alias: string = DEFAULT_ALIAS): AuthService => {
|
|
|
163
177
|
try {
|
|
164
178
|
await cache(context).create({ id: msg }, { ttl: AUTHEN_TIMEFRAME / 1000 })
|
|
165
179
|
} catch {
|
|
166
|
-
throw new AuthenFailed()
|
|
180
|
+
throw refuse('replay', new AuthenFailed(), credentials.userId)
|
|
167
181
|
}
|
|
168
182
|
|
|
169
183
|
if (credentials.credential !== authService.user.id) {
|
|
170
|
-
throw new AuthenFailed()
|
|
184
|
+
throw refuse('issuer', new AuthenFailed(), credentials.userId)
|
|
171
185
|
}
|
|
172
186
|
|
|
173
187
|
// @TODO Move to a plugin
|
|
@@ -191,12 +205,12 @@ export const makeAuthService = (alias: string = DEFAULT_ALIAS): AuthService => {
|
|
|
191
205
|
const manager = sessions(context)
|
|
192
206
|
if (manager != null) {
|
|
193
207
|
const entityId = await entityIdFor(context, auth.entitySlug)
|
|
194
|
-
if (entityId == null || auth.profileId == null) throw new AuthenFailed('session')
|
|
208
|
+
if (entityId == null || auth.profileId == null) throw refuse('session', new AuthenFailed('session'), auth.userId)
|
|
195
209
|
const decision = await manager.register({
|
|
196
210
|
id: auth.sessionId!, kind: 'bearer', entityId, profileId: auth.profileId,
|
|
197
211
|
issuedAt, expiresAt: expiresAt.getTime()
|
|
198
212
|
})
|
|
199
|
-
if (decision.state !== 'active') throw new AuthenFailed('session')
|
|
213
|
+
if (decision.state !== 'active') throw refuse('session', new AuthenFailed('session'), auth.userId)
|
|
200
214
|
auth.authorizationVersion = decision.version
|
|
201
215
|
}
|
|
202
216
|
|