@owlmeans/server-auth 0.1.18-rc.53 → 0.1.18-rc.55

package/src/manager/plugins/index.ts

@@ -1,21 +1,19 @@
 import { AuthenticationType } from '@owlmeans/auth'
-import type { AuthPlugin } from './types.js'
-import { basicEd25519 } from './basic-ed25519.js'
-import type { AppContext, AppConfig } from '../types.js'
-import { reCaptcha } from './re-captcha.js'
-import { basicRely } from './basic-rely.js'
+import type { AuthPluginFactory } from './types.js'
+import { makeBasicEd25519Plugin } from './basic-ed25519.js'
+import { makeReCaptchaPlugin } from './re-captcha.js'
+import { makeBasicRelyPlugin } from './basic-rely.js'
 
-export const plugins: Record<string, <C extends AppConfig, T extends AppContext<C>>(context: T) => AuthPlugin> = {}
+export const plugins: Record<string, AuthPluginFactory> = {}
 
-plugins[AuthenticationType.BasicEd25519] = basicEd25519 as typeof plugins[keyof typeof plugins]
-plugins[AuthenticationType.ReCaptcha] = reCaptcha as typeof plugins[keyof typeof plugins]
-plugins[AuthenticationType.RelyHandshake] = basicRely as typeof plugins[keyof typeof plugins]
+plugins[AuthenticationType.BasicEd25519] = makeBasicEd25519Plugin as AuthPluginFactory
+plugins[AuthenticationType.ReCaptcha] = makeReCaptchaPlugin as AuthPluginFactory
+plugins[AuthenticationType.RelyHandshake] = makeBasicRelyPlugin as AuthPluginFactory
 
 /** Register an external AuthPlugin factory under a custom type string. */
 export const registerPlugin = (
   type: string,
-  factory: <C extends AppConfig, T extends AppContext<C>>(context: T) => AuthPlugin
+  factory: AuthPluginFactory
 ): void => {
-  plugins[type] = factory as typeof plugins[keyof typeof plugins]
+  plugins[type] = factory
 }
-

package/src/manager/plugins/re-captcha.ts

@@ -8,14 +8,14 @@ import type { ClientEntrypoint } from '@owlmeans/client-entrypoint'
 import { EntrypointOutcome } from '@owlmeans/entrypoint'
 import { base64 } from '@scure/base'
 import { randomBytes } from '@noble/hashes/utils.js'
-import { assertType } from './utils.js'
+import { authPluginHelper } from './utils.js'
 
-export const reCaptcha = <C extends AppConfig, T extends AppContext<C>>(context: T): AuthPlugin => {
+export const makeReCaptchaPlugin = <C extends AppConfig, T extends AppContext<C>>(context: T): AuthPlugin => {
   const plugin: AuthPlugin = {
     type: AuthenticationType.ReCaptcha,
 
     init: async request => {
-      assertType(request.type, plugin)
+      authPluginHelper.assertType(request.type, plugin)
 
       const challenge = base64.encode(randomBytes(32))
 

package/src/manager/plugins/supervisor.ts

@@ -2,7 +2,7 @@ import { AuthenticationType, AuthenFailed, AuthRole, ALL_SCOPES, buildSupervisor
 import type { AuthPlugin } from './types.js'
 import { base64 } from '@scure/base'
 import { randomBytes } from '@noble/hashes/utils.js'
-import { fromPubKey } from '@owlmeans/basic-keys'
+import { keyHelper } from '@owlmeans/basic-keys'
 import { TRUSTED } from '@owlmeans/config'
 import type { TrustedRecord } from '@owlmeans/auth-common'
 import type { AppConfig, AppContext, SupervisorPluginOptions } from '../types.js'
@@ -51,7 +51,7 @@ export const makeSupervisorPlugin = (
           if (record?.credential == null) {
             continue
           }
-          if (await fromPubKey(record.credential).verify(payload, parsed.signature)) {
+          if (await keyHelper.fromPubKey(record.credential).verify(payload, parsed.signature)) {
             matched = alias
             break
           }

package/src/manager/plugins/types.ts

@@ -1,9 +1,9 @@
 import type { AllowanceResponse } from '@owlmeans/auth'
-import type { AuthModel } from '../types.js'
+import type { AppConfig, AppContext, AuthModel } from '../types.js'
 import type { AbstractRequest } from '@owlmeans/entrypoint'
 import type { RedisResource } from '@owlmeans/redis-resource'
 import type { ResourceRecord } from '@owlmeans/resource'
-import type { AuthChallengeReplayPolicy } from './replay-policy.js'
+import type { AuthChallengeReplayPolicy } from './consts.js'
 
 export interface AuthPlugin extends Omit<AuthModel, "rely"> {
   type: string
@@ -31,3 +31,20 @@ export interface RelyRecord extends ResourceRecord, AllowanceResponse {
 }
 
 export interface AuthRedisResource extends RedisResource<RelyRecord> {}
+
+/** Builds the plugin of one authentication type over the context it serves. */
+export interface AuthPluginFactory {
+  <C extends AppConfig, T extends AppContext<C>>(context: T): AuthPlugin
+}
+
+/** Resolution of the registered plugins, and the check every plugin runs on what it is handed. */
+export interface AuthPluginHelper {
+  /** @throws {TypeMissmatchError} when a request names another plugin's type */
+  assertType: (type: string, plugin: AuthPlugin) => void
+  /**
+   * The registered plugin of a type, built over the context.
+   *
+   * @throws {AuthUnknown}
+   */
+  getPlugin: (type: string, context: AppContext<AppConfig>) => Promise<AuthPlugin>
+}

package/src/manager/plugins/utils.ts

@@ -1,21 +1,31 @@
 import { AuthUnknown, TypeMissmatchError } from '@owlmeans/auth'
-import type { AuthPlugin } from './types.js'
+import type { AuthPlugin, AuthPluginHelper } from './types.js'
 import type { AppContext, AppConfig } from '../types.js'
 
-export const assertType = (type: string, plugin: AuthPlugin) => {
-  if (type !== plugin.type) {
-    throw new TypeMissmatchError(plugin.type)
+export const createAuthPluginHelper = (): AuthPluginHelper => {
+  const assertType = (type: string, plugin: AuthPlugin): void => {
+    if (type !== plugin.type) {
+      throw new TypeMissmatchError(plugin.type)
+    }
   }
-}
 
-/**
- * @throws {AuthUnknown}
- */
-export const getPlugin = async (type: string, context: AppContext<AppConfig>): Promise<AuthPlugin> => {
-  const { plugins } = await import('./index.js')
-  const plugin = plugins[type]
-  if (plugin == null) {
-    throw new AuthUnknown(type)
+  const getPlugin = async (type: string, context: AppContext<AppConfig>): Promise<AuthPlugin> => {
+    const { plugins } = await import('./index.js')
+    const plugin = plugins[type]
+    if (plugin == null) {
+      throw new AuthUnknown(type)
+    }
+    return plugins[type](context)
   }
-  return plugins[type](context)
+
+  return { assertType, getPlugin }
 }
+
+export const authPluginHelper = createAuthPluginHelper()
+
+/** @deprecated compat:factory-refactor — use `authPluginHelper.assertType(…)` */
+export const assertType = (type: string, plugin: AuthPlugin): void => authPluginHelper.assertType(type, plugin)
+
+/** @deprecated compat:factory-refactor — use `authPluginHelper.getPlugin(…)` */
+export const getPlugin = async (type: string, context: AppContext<AppConfig>): Promise<AuthPlugin> =>
+  await authPluginHelper.getPlugin(type, context)

package/src/manager/rely/flow.ts

@@ -1,7 +1,6 @@
 import type { AllowanceRequest, Auth, AuthCredentials, RelyToken } from '@owlmeans/auth'
 import { AUTH_SCOPE, AuthenticationStage, AuthenticationType, AuthPluginError, AuthRole, RELY_3RD } from '@owlmeans/auth'
 import type { AuthenticateMethod, Connection, EventMessage, Message } from '@owlmeans/socket'
-import { isEventMessage, isMessage } from '@owlmeans/socket'
 import type { AppContext, RelyAllowanceRequest, RelyLinker, RelyCarrier } from '../types.js'
 import { makeAuthModel } from '../model.js'
 import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
@@ -10,6 +9,7 @@ import { RELY_TUNNEL } from '../consts.js'
 import type { RedisResource } from '@owlmeans/redis-resource'
 import { RELY_ACTION_TIMEOUT } from '@owlmeans/auth-common'
 import { logger } from '@owlmeans/log'
+import { socketMessageHelper } from '@owlmeans/socket'
 
 // 1. There is a difference between privileged (provider)
 //    and non-privileged (consumer) request 
@@ -32,9 +32,9 @@ export const createRelyFlow = (context: AppContext, conn: Connection, auth?: Aut
   const linker: RelyLinker = async (rely, source, notify) => {
     const tunnel = context.resource<RedisResource<Message<any>>>(RELY_TUNNEL)
     const closeReceiver = await tunnel.subscribe(async message => {
-      if (isMessage(message, true)) {
+      if (socketMessageHelper.isMessage(message, true)) {
         await conn.send(message)
-      } else if (isEventMessage(message, true)) {
+      } else if (socketMessageHelper.isEventMessage(message, true)) {
         if ((message as EventMessage<unknown>).event === 'close') {
           await conn.close()
           closeSender()
@@ -48,13 +48,13 @@ export const createRelyFlow = (context: AppContext, conn: Connection, auth?: Aut
     conn._receiveError = async msg => { log.debug('Forward error', { nonce: source.nonce, id: msg.id }) }
     conn.defaultCallTimeout = RELY_ACTION_TIMEOUT * 1000
     const closeSender = conn.listen(async message => {
-      if (isMessage(message, true)) {
+      if (socketMessageHelper.isMessage(message, true)) {
         const forward = { ...message }
         if (forward.rawData != null) {
           delete forward.rawData
         }
         await tunnel.publish(forward, rely.nonce)
-      } else if (isEventMessage(message, true)) {
+      } else if (socketMessageHelper.isEventMessage(message, true)) {
         if (message.event === 'close') {
           const forward = { ...message as Message<unknown> }
           if (forward.rawData != null) {

package/src/manager/supervisor.ts

@@ -1,6 +1,7 @@
 import { AuthenticationType } from '@owlmeans/auth'
 import { DEFAULT_GUARD } from '@owlmeans/auth-common'
 import type { AppConfig, AppContext, SupervisorAuthOptions, SupervisorPluginOptions } from './types.js'
+import type { AuthPluginFactory } from './plugins/types.js'
 import { registerPlugin } from './plugins/index.js'
 import { makeSupervisorPlugin } from './plugins/supervisor.js'
 import { DEFAULT_SUPERVISORS } from './consts.local.js'
@@ -50,7 +51,7 @@ export const appendSupervisorAuth = <C extends AppConfig, T extends AppContext<C
 
   registerPlugin(
     AuthenticationType.Supervisor,
-    (ctx => makeSupervisorPlugin(ctx as unknown as AppContext<AppConfig>, resolved)) as Parameters<typeof registerPlugin>[1]
+    (ctx => makeSupervisorPlugin(ctx as unknown as AppContext<AppConfig>, resolved)) as AuthPluginFactory
   )
 
   if (opts?.acceptInternalTokens !== false) {

package/src/model/rely/peer.ts

@@ -7,6 +7,14 @@ import { base58 } from '@scure/base'
 import type { RelyOptions } from './types.js'
 import { RELY_CALL_TIMEOUT } from '@owlmeans/auth-common'
 
+const toNumber = (bytes: Uint8Array): string => {
+  let pinInt = 0n
+  for (let i = bytes.length - 1; i >= 0; i--) {
+    pinInt = (pinInt << 8n) | BigInt(bytes[i]);
+  }
+  return pinInt.toString()
+}
+
 export const makeRelyModel = (opts?: RelyOptions): EnvelopeModel<RelyToken> => {
   const envelope = makeEnvelopeModel<RelyToken>(RELY_3RD)
 
@@ -33,11 +41,3 @@ export const makeRelyModel = (opts?: RelyOptions): EnvelopeModel<RelyToken> => {
 
   return envelope
 }
-
-const toNumber = (bytes: Uint8Array): string => {
-  let pinInt = 0n
-  for (let i = bytes.length - 1; i >= 0; i--) {
-    pinInt = (pinInt << 8n) | BigInt(bytes[i]);
-  }
-  return pinInt.toString()
-}

package/src/service.ts

@@ -12,25 +12,25 @@ import { trust, extractAuthToken } from '@owlmeans/auth-common/utils'
 import { ENTITY_RESOLVER, type EntityResolverService, TOKEN_UPDATE } from '@owlmeans/auth-common'
 import { AUTH_IDENTITY_PROFILE, type IdentityProfile, type IdentityProfileResource } from '@owlmeans/server-auth-identity'
 import { appendMemoryAuthSessionManager, AUTH_SESSION_MANAGER, AUTH_SESSION_TTL, type AuthSessionManager } from '@owlmeans/server-auth-session'
-import { uuid } from '@owlmeans/basic-ids'
+import { idHelper } from '@owlmeans/basic-ids'
 import { logger } from '@owlmeans/log'
 import type { Config, Context } from './types.local.js'
 
 
 const log = logger('server-auth')
 
-/**
- * A refused token exchange — the manager's token presented to open a session. Logged with the
- * reason and the account id only; returns the error for the caller to throw.
- */
-const refuse = (reason: string, error: AuthenFailed, userId?: string): AuthenFailed => {
-  const accountId = userId == null ? undefined
-    : userId.includes('@') ? `*@${userId.slice(userId.lastIndexOf('@') + 1)}` : userId
-  log.warn('Session exchange refused', { reason, ...(accountId != null ? { accountId } : {}) }, { event: 'auth.refused' })
-  return error
-}
-
 export const makeAuthService = (alias: string = DEFAULT_ALIAS): AuthService => {
+  /**
+   * A refused token exchange — the manager's token presented to open a session. Logged with the
+   * reason and the account id only; returns the error for the caller to throw.
+   */
+  const refuse = (reason: string, error: AuthenFailed, userId?: string): AuthenFailed => {
+    const accountId = userId == null ? undefined
+      : userId.includes('@') ? `*@${userId.slice(userId.lastIndexOf('@') + 1)}` : userId
+    log.warn('Session exchange refused', { reason, ...(accountId != null ? { accountId } : {}) }, { event: 'auth.refused' })
+    return error
+  }
+
   const location = `server-auth:${alias}`
 
   const cache = (context: Context): Resource<AuthSpent> =>
@@ -191,7 +191,7 @@ export const makeAuthService = (alias: string = DEFAULT_ALIAS): AuthService => {
         isUser: true,
         createdAt: new Date(issuedAt),
         expiresAt,
-        sessionId: uuid(),
+        sessionId: idHelper.uuid(),
         authorizationVersion: 1
       }
       const manager = sessions(context)

package/tests/replay-policy.spec.ts

@@ -1,7 +1,7 @@
 import { describe, expect, test } from 'bun:test'
 import { AuthenFailed, AuthRole } from '@owlmeans/auth'
 import { makeAuthModel } from '../src/manager/model.js'
-import { AuthChallengeReplayPolicy } from '../src/manager/plugins/replay-policy.js'
+import { AuthChallengeReplayPolicy } from '../src/manager/plugins/consts.js'
 import { registerPlugin } from '../src/manager/plugins/index.js'
 import { makeTestContext } from './context.js'
 

package/tests/supervisor.spec.ts

@@ -4,16 +4,16 @@ import { AuthenticationType, AuthRole, buildSupervisorPayload } from '@owlmeans/
 import type { AuthCredentials } from '@owlmeans/auth'
 import type { TrustedRecord } from '@owlmeans/auth-common'
 import type { Criteria } from '@owlmeans/resource'
-import { firstMatch } from '@owlmeans/resource'
 import { makeSupervisorPlugin } from '../src/manager/plugins/supervisor.js'
 import type { AppConfig, AppContext } from '../src/manager/types.js'
+import { recordQueryHelper } from '@owlmeans/resource'
 
 const SUPERVISOR = 'master'
 
 const makeStubContext = (records: TrustedRecord[]): AppContext<AppConfig> => ({
   getConfigResource: () => ({
     load: async (idOrWhere: string | Criteria<TrustedRecord>) =>
-      firstMatch(records, typeof idOrWhere === 'string' ? { id: idOrWhere } : idOrWhere)
+      recordQueryHelper.firstMatch(records, typeof idOrWhere === 'string' ? { id: idOrWhere } : idOrWhere)
   })
 } as unknown as AppContext<AppConfig>)
 

package/src/manager/actions/manager.ts

@@ -1,25 +0,0 @@
-import type { AllowanceRequest, AllowanceResponse, AuthCredentials, AuthToken } from '@owlmeans/auth'
-import type { EntrypointProtocol } from '@owlmeans/entrypoint'
-import { handlers } from '@owlmeans/server-api'
-import { makeAuthModel } from '../model.js'
-import type { AppContext, AppConfig } from '../types.js'
-import { connection } from '@owlmeans/server-socket'
-
-const api = handlers<AppContext<AppConfig>>()
-
-export const authenticationInit = (protocol: EntrypointProtocol<{ body: AllowanceRequest }, AllowanceResponse>) =>
-  api.body(protocol, async (body, context) =>
-  await makeAuthModel(context).init(body)
-)
-
-export const authenticate = (protocol: EntrypointProtocol<{ body: AuthCredentials }, AuthToken>) =>
-  api.body(protocol, async (body, context) =>
-  await makeAuthModel(context).authenticate(body)
-)
-
-export const rely = (protocol: EntrypointProtocol<{ query: Partial<AuthToken> }, undefined>) => connection(protocol,
-  // @TODO Request will contain information is there requrest 
-  // privileged or not (privileged request implies auth provider)
-  async (conn, context, request) =>
-    await makeAuthModel(context as AppContext<AppConfig>).rely(conn, request.auth)
-)