@owlmeans/server-auth 0.1.18-rc.55 → 0.1.18-rc.56

package/build/manager/plugins/re-captcha.d.ts

@@ -1,4 +1,13 @@
 import type { AppContext, AppConfig } from '../types.js';
 import type { AuthPlugin } from './types.js';
+/**
+ * The reCAPTCHA sign-in: proves that a person solved a challenge, and nothing about who they are.
+ *
+ * The token the manager signs for it is a GUEST credential — `GUEST_ID`, role Guest, `[AUTH_SCOPE]`,
+ * type ReCaptcha — whatever identity the caller posted: a profile, an organization, permissions,
+ * groups, an expiry and a `source` are dropped before it is signed. Its single-use key is the
+ * server-issued challenge it carries. A route accepts it only through `makeReCaptchaGuard`; the
+ * bearer exchange refuses it.
+ */
 export declare const makeReCaptchaPlugin: <C extends AppConfig, T extends AppContext<C>>(context: T) => AuthPlugin;
 //# sourceMappingURL=re-captcha.d.ts.map

package/build/manager/plugins/re-captcha.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"re-captcha.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/re-captcha.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACxD,OAAO,KAAK,EAAE,UAAU,EAAuC,MAAM,YAAY,CAAA;AAUjF,eAAO,MAAM,mBAAmB,GAAI,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,KAAG,UAiD9F,CAAA"}
+{"version":3,"file":"re-captcha.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/re-captcha.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAQ5C;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,KAAG,UAqD9F,CAAA"}

package/build/manager/plugins/re-captcha.js

@@ -1,46 +1,59 @@
-import { AuthenFailed, AuthenticationType, AuthPluginError, MOD_RECAPTCHA, AUTH_SCOPE, AuthRole } from '@owlmeans/auth';
-import { PLUGINS } from '@owlmeans/config';
-import { PluginMissconfigured } from '@owlmeans/config';
-import { EntrypointOutcome } from '@owlmeans/entrypoint';
+import { AUTH_SCOPE, AuthenticationType, AuthRole, GUEST_ID, MOD_RECAPTCHA } from '@owlmeans/auth';
+import { PLUGINS, PluginMissconfigured } from '@owlmeans/config';
 import { base64 } from '@scure/base';
 import { randomBytes } from '@noble/hashes/utils.js';
 import { authPluginHelper } from './utils.js';
+import { RECAPTCHA_VERIFIER } from './re-captcha/consts.js';
+import { RECAPTCHA_CREDENTIAL_FIELDS } from './re-captcha/consts.local.js';
+import { makeReCaptchaPolicyModel } from './re-captcha/policy.js';
+import { createReCaptchaVerifierService } from './re-captcha/verifier.js';
+/**
+ * The reCAPTCHA sign-in: proves that a person solved a challenge, and nothing about who they are.
+ *
+ * The token the manager signs for it is a GUEST credential — `GUEST_ID`, role Guest, `[AUTH_SCOPE]`,
+ * type ReCaptcha — whatever identity the caller posted: a profile, an organization, permissions,
+ * groups, an expiry and a `source` are dropped before it is signed. Its single-use key is the
+ * server-issued challenge it carries. A route accepts it only through `makeReCaptchaGuard`; the
+ * bearer exchange refuses it.
+ */
 export const makeReCaptchaPlugin = (context) => {
+    const verifier = () => context.hasService(RECAPTCHA_VERIFIER)
+        ? context.service(RECAPTCHA_VERIFIER)
+        : createReCaptchaVerifierService();
+    /** The secret and the policy of the `MOD_RECAPTCHA` record; no secret = no reCAPTCHA sign-in. */
+    const configured = async () => {
+        const record = await context.getConfigResource(PLUGINS).load(MOD_RECAPTCHA);
+        if (record == null || typeof record.value !== 'string' || record.value === '') {
+            throw new PluginMissconfigured('value');
+        }
+        return [record.value, makeReCaptchaPolicyModel(record)];
+    };
+    const resetIdentity = (credential) => {
+        const fields = credential;
+        for (const field of Object.keys(fields)) {
+            if (!RECAPTCHA_CREDENTIAL_FIELDS.includes(field)) {
+                delete fields[field];
+            }
+        }
+        credential.type = AuthenticationType.ReCaptcha;
+        credential.role = AuthRole.Guest;
+        credential.userId = GUEST_ID;
+        credential.scopes = [AUTH_SCOPE];
+    };
     const plugin = {
         type: AuthenticationType.ReCaptcha,
         init: async (request) => {
             authPluginHelper.assertType(request.type, plugin);
-            const challenge = base64.encode(randomBytes(32));
-            return { challenge };
+            return { challenge: base64.encode(randomBytes(32)) };
         },
         authenticate: async (credential) => {
-            const cfg = context.getConfigResource(PLUGINS);
-            const config = await cfg.get(MOD_RECAPTCHA);
-            if (config.value == null) {
-                throw new PluginMissconfigured('value');
-            }
-            const validateRecaptcha = context.entrypoint(MOD_RECAPTCHA);
-            const { value: result, outcome: status } = await validateRecaptcha.invoke({
-                body: {
-                    secret: config.value,
-                    response: credential.credential
-                },
-                headers: { 'content-type': 'application/x-www-form-urlencoded' }
-            });
-            if (status !== EntrypointOutcome.Ok) {
-                throw new AuthPluginError('recaptcha:api');
-            }
-            if (!result.success) {
-                throw new AuthenFailed('recaptcha:' + (result['error-codes']?.join(',') ?? 'unknown'));
-            }
-            credential.scopes = [AUTH_SCOPE];
-            credential.role = AuthRole.Guest;
-            credential.type = AuthenticationType.ReCaptcha;
-            const [previous, challenge] = credential.challenge.split(':');
-            if (challenge != null) {
-                credential.challenge = previous;
-                return { token: previous };
-            }
+            const [secret, policy] = await configured();
+            // Read before the policy is judged: a misconfigured record fails before Google is asked.
+            policy.minScore();
+            const answer = await verifier().verify({ secret, response: credential.credential });
+            policy.assert(answer);
+            resetIdentity(credential);
+            // '' keeps the manager's own server-issued challenge on the token: that is its spend key.
             return { token: '' };
         }
     };

package/build/manager/plugins/re-captcha.js.map

@@ -1 +1 @@
-{"version":3,"file":"re-captcha.js","sourceRoot":"","sources":["../../../src/manager/plugins/re-captcha.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAGvH,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAE1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAEvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAE7C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAA+C,OAAU,EAAc,EAAE;IAC1G,MAAM,MAAM,GAAe;QACzB,IAAI,EAAE,kBAAkB,CAAC,SAAS;QAElC,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACpB,gBAAgB,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAEjD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YAEhD,OAAO,EAAE,SAAS,EAAE,CAAA;QACtB,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAe,OAAO,CAAC,CAAA;YAC5D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;YAC3C,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;gBACzB,MAAM,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAA;YACzC,CAAC;YACD,MAAM,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAsC,aAAa,CAAC,CAAA;YAChG,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAsC;gBAC7G,IAAI,EAAE;oBACJ,MAAM,EAAE,MAAM,CAAC,KAAK;oBACpB,QAAQ,EAAE,UAAU,CAAC,UAAU;iBAChC;gBACD,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;aACjE,CAAC,CAAA;YACF,IAAI,MAAM,KAAK,iBAAiB,CAAC,EAAE,EAAE,CAAC;gBACpC,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAA;YAC5C,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,YAAY,CAAC,YAAY,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC,CAAA;YACxF,CAAC;YAED,UAAU,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,CAAA;YAChC,UAAU,CAAC,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAA;YAChC,UAAU,CAAC,IAAI,GAAG,kBAAkB,CAAC,SAAS,CAAA;YAE9C,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAiC,CAAA;YAC7F,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;gBACtB,UAAU,CAAC,SAAS,GAAG,QAAQ,CAAA;gBAE/B,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;YAC5B,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;QACtB,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}
+{"version":3,"file":"re-captcha.js","sourceRoot":"","sources":["../../../src/manager/plugins/re-captcha.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAElG,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAGpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAA;AAC1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AACjE,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAA;AAGzE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAA+C,OAAU,EAAc,EAAE;IAC1G,MAAM,QAAQ,GAAG,GAA6B,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC;QACrF,CAAC,CAAC,OAAO,CAAC,OAAO,CAA2B,kBAAkB,CAAC;QAC/D,CAAC,CAAC,8BAA8B,EAAE,CAAA;IAEpC,iGAAiG;IACjG,MAAM,UAAU,GAAG,KAAK,IAA6C,EAAE;QACrE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAwB,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QAClG,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;YAC9E,MAAM,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAA;QACzC,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAA;IACzD,CAAC,CAAA;IAED,MAAM,aAAa,GAAG,CAAC,UAA2B,EAAQ,EAAE;QAC1D,MAAM,MAAM,GAAG,UAAgD,CAAA;QAC/D,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,2BAA2B,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;YACtB,CAAC;QACH,CAAC;QACD,UAAU,CAAC,IAAI,GAAG,kBAAkB,CAAC,SAAS,CAAA;QAC9C,UAAU,CAAC,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAA;QAChC,UAAU,CAAC,MAAM,GAAG,QAAQ,CAAA;QAC5B,UAAU,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,CAAA;IAClC,CAAC,CAAA;IAED,MAAM,MAAM,GAAe;QACzB,IAAI,EAAE,kBAAkB,CAAC,SAAS;QAElC,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACpB,gBAAgB,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAEjD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,CAAA;QACtD,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,UAAU,EAAE,CAAA;YAC3C,yFAAyF;YACzF,MAAM,CAAC,QAAQ,EAAE,CAAA;YAEjB,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAA;YACnF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAErB,aAAa,CAAC,UAAU,CAAC,CAAA;YAEzB,0FAA0F;YAC1F,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;QACtB,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}

package/build/manager/plugins/types.d.ts

@@ -1,6 +1,5 @@
 import type { AllowanceResponse } from '@owlmeans/auth';
 import type { AppConfig, AppContext, AuthModel } from '../types.js';
-import type { AbstractRequest } from '@owlmeans/entrypoint';
 import type { RedisResource } from '@owlmeans/redis-resource';
 import type { ResourceRecord } from '@owlmeans/resource';
 import type { AuthChallengeReplayPolicy } from './consts.js';
@@ -12,18 +11,6 @@ export interface AuthPlugin extends Omit<AuthModel, "rely"> {
      */
     challengeReplayPolicy?: AuthChallengeReplayPolicy;
 }
-export interface RecpatchaResponse {
-    success: boolean;
-    challenge_ts: number;
-    hostname: string;
-    'error-codes'?: string[];
-}
-export interface RecaptchaRequest extends AbstractRequest<{
-    secret: string;
-    response: string;
-    remoteip?: string;
-}> {
-}
 export interface RelyRecord extends ResourceRecord, AllowanceResponse {
 }
 export interface AuthRedisResource extends RedisResource<RelyRecord> {

package/build/manager/plugins/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAA;AAE5D,MAAM,WAAW,UAAW,SAAQ,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC;IACzD,IAAI,EAAE,MAAM,CAAA;IACZ;;;OAGG;IACH,qBAAqB,CAAC,EAAE,yBAAyB,CAAA;CAClD;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;CACzB;AAED,MAAM,WAAW,gBAAiB,SAAQ,eAAe,CAAC;IACxD,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAC;CAAI;AAEN,MAAM,WAAW,UAAW,SAAQ,cAAc,EAAE,iBAAiB;CACpE;AAED,MAAM,WAAW,iBAAkB,SAAQ,aAAa,CAAC,UAAU,CAAC;CAAG;AAEvE,+EAA+E;AAC/E,MAAM,WAAW,iBAAiB;IAChC,CAAC,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,UAAU,CAAA;CACvE;AAED,kGAAkG;AAClG,MAAM,WAAW,gBAAgB;IAC/B,8EAA8E;IAC9E,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAA;IACtD;;;;OAIG;IACH,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,UAAU,CAAC,CAAA;CACjF"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAA;AAE5D,MAAM,WAAW,UAAW,SAAQ,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC;IACzD,IAAI,EAAE,MAAM,CAAA;IACZ;;;OAGG;IACH,qBAAqB,CAAC,EAAE,yBAAyB,CAAA;CAClD;AAED,MAAM,WAAW,UAAW,SAAQ,cAAc,EAAE,iBAAiB;CACpE;AAED,MAAM,WAAW,iBAAkB,SAAQ,aAAa,CAAC,UAAU,CAAC;CAAG;AAEvE,+EAA+E;AAC/E,MAAM,WAAW,iBAAiB;IAChC,CAAC,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,UAAU,CAAA;CACvE;AAED,kGAAkG;AAClG,MAAM,WAAW,gBAAgB;IAC/B,8EAA8E;IAC9E,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAA;IACtD;;;;OAIG;IACH,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,UAAU,CAAC,CAAA;CACjF"}

package/build/re-captcha/guard.d.ts

@@ -0,0 +1,12 @@
+import type { GuardService } from '@owlmeans/entrypoint';
+/**
+ * The guard of a route a reCAPTCHA-proven guest may call once (`RECAPTCHA_GUARD`):
+ * `Authorization: RE-CAPTCHA <token>`, the token the auth manager's reCAPTCHA plugin issued.
+ *
+ * Every check of `ReCaptchaTokenHelper.inspect`, then the spend — a token admits one request. The
+ * request's `auth` is a guest (`GUEST_ID`, role Guest, `[AUTH_SCOPE]`, type ReCaptcha) with an empty
+ * `token`: whatever reads an authorization downstream may log it. A refused token is no credential at
+ * all, so the request is unauthenticated (401).
+ */
+export declare const makeReCaptchaGuard: (alias?: string) => GuardService;
+//# sourceMappingURL=guard.d.ts.map

package/build/re-captcha/guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../src/re-captcha/guard.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAqC,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAI3F;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,WAAW,MAAM,KAAqB,YAkCpE,CAAA"}

package/build/re-captcha/guard.js

@@ -0,0 +1,43 @@
+import { AUTH_SCOPE, AuthenticationType, AuthRole, GUEST_ID, RECAPTCHA_GUARD } from '@owlmeans/auth';
+import { extractAuthToken } from '@owlmeans/auth-common/utils';
+import { createService } from '@owlmeans/context';
+import { reCaptchaTokenOf } from './token.js';
+/**
+ * The guard of a route a reCAPTCHA-proven guest may call once (`RECAPTCHA_GUARD`):
+ * `Authorization: RE-CAPTCHA <token>`, the token the auth manager's reCAPTCHA plugin issued.
+ *
+ * Every check of `ReCaptchaTokenHelper.inspect`, then the spend — a token admits one request. The
+ * request's `auth` is a guest (`GUEST_ID`, role Guest, `[AUTH_SCOPE]`, type ReCaptcha) with an empty
+ * `token`: whatever reads an authorization downstream may log it. A refused token is no credential at
+ * all, so the request is unauthenticated (401).
+ */
+export const makeReCaptchaGuard = (alias = RECAPTCHA_GUARD) => {
+    const service = createService(alias, {
+        match: async (req) => req != null && extractAuthToken(req, AuthenticationType.ReCaptcha) != null,
+        handle: async (req, res) => {
+            const context = service.assertCtx();
+            const tokens = reCaptchaTokenOf(context);
+            const guest = await tokens.inspect(req);
+            if (guest == null || !await tokens.spend(guest)) {
+                return false;
+            }
+            const auth = {
+                token: '',
+                type: AuthenticationType.ReCaptcha,
+                role: AuthRole.Guest,
+                userId: GUEST_ID,
+                scopes: [AUTH_SCOPE],
+                isUser: false,
+                source: context.cfg.service,
+                createdAt: new Date(),
+                expiresAt: guest.expiresAt,
+            };
+            res.resolve(auth);
+            return true;
+        },
+        /** Server-side guard: it verifies what arrives, it never produces a credential. */
+        authenticated: async () => null,
+    });
+    return service;
+};
+//# sourceMappingURL=guard.js.map

package/build/re-captcha/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../src/re-captcha/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAEpG,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAGjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAE7C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAK,GAAW,eAAe,EAAgB,EAAE;IAClF,MAAM,OAAO,GAAiB,aAAa,CAAe,KAAK,EAAE;QAC/D,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CAAC,GAAG,IAAI,IAAI,IAAI,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,CAAC,SAAS,CAAC,IAAI,IAAI;QAE9F,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YACpD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;YAExC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACvC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChD,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,IAAI,GAAS;gBACjB,KAAK,EAAE,EAAE;gBACT,IAAI,EAAE,kBAAkB,CAAC,SAAS;gBAClC,IAAI,EAAE,QAAQ,CAAC,KAAK;gBACpB,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,CAAC,UAAU,CAAC;gBACpB,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;gBAC3B,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAA;YACD,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAEjB,OAAO,IAAS,CAAA;QAClB,CAAC;QAED,mFAAmF;QACnF,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;KAChC,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/re-captcha/index.d.ts

@@ -0,0 +1,4 @@
+export type * from './types.js';
+export * from './token.js';
+export * from './guard.js';
+//# sourceMappingURL=index.d.ts.map

package/build/re-captcha/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/re-captcha/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA"}

package/build/re-captcha/index.js

@@ -0,0 +1,3 @@
+export * from './token.js';
+export * from './guard.js';
+//# sourceMappingURL=index.js.map

package/build/re-captcha/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/re-captcha/index.ts"],"names":[],"mappings":"AACA,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA"}

package/build/re-captcha/token.d.ts

@@ -0,0 +1,6 @@
+import type { Context } from '../types.local.js';
+import type { ReCaptchaTokenHelper } from './types.js';
+export declare const makeReCaptchaTokenHelper: (context: Context) => ReCaptchaTokenHelper;
+/** The reCAPTCHA token checks of a context — built once per context. */
+export declare const reCaptchaTokenOf: (target: Context) => ReCaptchaTokenHelper;
+//# sourceMappingURL=token.d.ts.map

package/build/re-captcha/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/re-captcha/token.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAU,OAAO,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,KAAK,EAAoC,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAIxF,eAAO,MAAM,wBAAwB,YAAa,OAAO,KAAG,oBAoE3D,CAAA;AAED,wEAAwE;AACxE,eAAO,MAAM,gBAAgB,2CAA+C,CAAA"}

package/build/re-captcha/token.js

@@ -0,0 +1,74 @@
+import { AuthenticationType, AuthRole, AuthUnavailable, GUEST_ID } from '@owlmeans/auth';
+import { extractAuthToken, trust } from '@owlmeans/auth-common/utils';
+import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope';
+import { TRUSTED } from '@owlmeans/config';
+import { memoHelper } from '@owlmeans/context';
+import { logger } from '@owlmeans/log';
+import { RecordExists } from '@owlmeans/resource';
+import { AUTH_CACHE, AUTH_SRV_KEY, AUTHEN_TIMEFRAME } from '../consts.js';
+const log = logger('server-auth:re-captcha');
+export const makeReCaptchaTokenHelper = (context) => {
+    const refuse = (reason) => {
+        log.debug('reCAPTCHA token refused', { reason }, { event: 'auth.refused' });
+        return null;
+    };
+    const verify = async (token) => {
+        let envelope;
+        try {
+            envelope = makeEnvelopeModel(token, EnvelopeKind.Token);
+        }
+        catch {
+            return refuse('token');
+        }
+        if (envelope.type() !== AuthenticationType.ReCaptcha) {
+            return refuse('type');
+        }
+        // A guest token lives no longer than its spend record does, so it can never be spent twice.
+        const ttl = envelope.envelope.ttl;
+        if (ttl == null || ttl > AUTHEN_TIMEFRAME) {
+            return refuse('ttl');
+        }
+        const signer = await trust(context, TRUSTED, AUTH_SRV_KEY);
+        // Signature and expiry: an envelope past `dt + ttl` does not verify.
+        if (!await envelope.verify(signer.key)) {
+            return refuse('signature');
+        }
+        const credential = envelope.message();
+        if (credential == null || typeof credential !== 'object') {
+            return refuse('token');
+        }
+        if (credential.credential !== signer.user.id) {
+            return refuse('issuer');
+        }
+        if (credential.type !== AuthenticationType.ReCaptcha || credential.role !== AuthRole.Guest
+            || credential.userId !== GUEST_ID) {
+            return refuse('guest');
+        }
+        if (typeof credential.challenge !== 'string' || credential.challenge === '') {
+            return refuse('challenge');
+        }
+        return { credential, challenge: credential.challenge, expiresAt: new Date(envelope.envelope.dt + ttl) };
+    };
+    const inspect = async (req) => {
+        const token = extractAuthToken(req, AuthenticationType.ReCaptcha);
+        return token == null || token === '' ? null : await verify(token);
+    };
+    const spend = async (guest) => {
+        try {
+            await context.resource(AUTH_CACHE)
+                .create({ id: guest.challenge }, { ttl: AUTHEN_TIMEFRAME / 1000 });
+        }
+        catch (error) {
+            if (error instanceof RecordExists || error?.type === RecordExists.typeName) {
+                log.debug('reCAPTCHA token refused', { reason: 'spent' }, { event: 'auth.refused' });
+                return false;
+            }
+            throw new AuthUnavailable('auth-cache');
+        }
+        return true;
+    };
+    return { inspect, verify, spend };
+};
+/** The reCAPTCHA token checks of a context — built once per context. */
+export const reCaptchaTokenOf = memoHelper.oncePer(makeReCaptchaTokenHelper);
+//# sourceMappingURL=token.js.map

package/build/re-captcha/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/re-captcha/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAExF,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE1E,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEjD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAKzE,MAAM,GAAG,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAA;AAE5C,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,OAAgB,EAAwB,EAAE;IACjF,MAAM,MAAM,GAAG,CAAC,MAAc,EAAQ,EAAE;QACtC,GAAG,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAA;QAC3E,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,MAAM,MAAM,GAAG,KAAK,EAAE,KAAa,EAAkC,EAAE;QACrE,IAAI,QAAwC,CAAA;QAC5C,IAAI,CAAC;YACH,QAAQ,GAAG,iBAAiB,CAAkB,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;QACxB,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,kBAAkB,CAAC,SAAS,EAAE,CAAC;YACrD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAA;QACvB,CAAC;QACD,4FAA4F;QAC5F,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAA;QACjC,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,GAAG,gBAAgB,EAAE,CAAC;YAC1C,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;QACtB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;QAC3E,qEAAqE;QACrE,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,OAAO,MAAM,CAAC,WAAW,CAAC,CAAA;QAC5B,CAAC;QAED,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,EAAmB,CAAA;QACtD,IAAI,UAAU,IAAI,IAAI,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACzD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;QACxB,CAAC;QACD,IAAI,UAAU,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YAC7C,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAA;QACzB,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,KAAK,kBAAkB,CAAC,SAAS,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC,KAAK;eACrF,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;QACxB,CAAC;QACD,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,QAAQ,IAAI,UAAU,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YAC5E,OAAO,MAAM,CAAC,WAAW,CAAC,CAAA;QAC5B,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,GAAG,GAAG,CAAC,EAAE,CAAA;IACzG,CAAC,CAAA;IAED,MAAM,OAAO,GAAG,KAAK,EAAE,GAAqB,EAAkC,EAAE;QAC9E,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAA;QAEjE,OAAO,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAA;IACnE,CAAC,CAAA;IAED,MAAM,KAAK,GAAG,KAAK,EAAE,KAAqB,EAAoB,EAAE;QAC9D,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,QAAQ,CAAsB,UAAU,CAAC;iBACpD,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,YAAY,IAAK,KAAkC,EAAE,IAAI,KAAK,YAAY,CAAC,QAAQ,EAAE,CAAC;gBACzG,GAAG,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAA;gBACpF,OAAO,KAAK,CAAA;YACd,CAAC;YACD,MAAM,IAAI,eAAe,CAAC,YAAY,CAAC,CAAA;QACzC,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;AACnC,CAAC,CAAA;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAA"}

package/build/re-captcha/types.d.ts

@@ -0,0 +1,44 @@
+import type { AuthCredentials } from '@owlmeans/auth';
+import type { AbstractRequest } from '@owlmeans/entrypoint';
+/** A reCAPTCHA guest token that passed every check but the spend. */
+export interface ReCaptchaGuest {
+    /**
+     * The credential the auth manager signed: `GUEST_ID`, role Guest, type ReCaptcha, stamped with
+     * the auth service record's id. It names nobody.
+     */
+    credential: AuthCredentials;
+    /** The server-issued challenge the token carries — the key it is spent under in `AUTH_CACHE`. */
+    challenge: string;
+    /** When the token stops being accepted. */
+    expiresAt: Date;
+}
+/** Anything that carries request headers: an entrypoint request, or a raw Fastify request. */
+export interface ReCaptchaCarrier extends Partial<Pick<AbstractRequest, 'headers'>> {
+}
+/**
+ * The checks of a reCAPTCHA guest token (`Authorization: RE-CAPTCHA <token>`), bound to the context
+ * whose `TRUSTED` record `AUTH_SRV_KEY` signed it and whose `AUTH_CACHE` spends it.
+ */
+export interface ReCaptchaTokenHelper {
+    /**
+     * The guest a request carries, checked WITHOUT spending: envelope type, signature by the auth
+     * service key, TTL (at most `AUTHEN_TIMEFRAME`), the auth record's stamp, type ReCaptcha, role
+     * Guest, `GUEST_ID`, a server-issued challenge. Made for a pre-parse check (before a body is read);
+     * the route itself still needs the guard, which spends.
+     *
+     * @returns `null` for a request without such a header or with a token that fails a check.
+     * @throws {SyntaxError} when the context has no `AUTH_SRV_KEY` trusted record (a configuration fault).
+     */
+    inspect: (req: ReCaptchaCarrier) => Promise<ReCaptchaGuest | null>;
+    /** {@link inspect} for a bare token (the value after `RE-CAPTCHA `). */
+    verify: (token: string) => Promise<ReCaptchaGuest | null>;
+    /**
+     * Spend the token: an atomic create-once of its challenge in `AUTH_CACHE` (Redis `SET NX` in a
+     * backend context), under the same key a bearer exchange and the IAM finalizer claim.
+     *
+     * @returns `false` when the token was spent before.
+     * @throws {AuthUnavailable} when the cache cannot answer.
+     */
+    spend: (guest: ReCaptchaGuest) => Promise<boolean>;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/re-captcha/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/re-captcha/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAE3D,qEAAqE;AACrE,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,UAAU,EAAE,eAAe,CAAA;IAC3B,iGAAiG;IACjG,SAAS,EAAE,MAAM,CAAA;IACjB,2CAA2C;IAC3C,SAAS,EAAE,IAAI,CAAA;CAChB;AAED,8FAA8F;AAC9F,MAAM,WAAW,gBAAiB,SAAQ,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;CAAG;AAEtF;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;OAQG;IACH,OAAO,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAA;IAClE,wEAAwE;IACxE,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAA;IACzD;;;;;;OAMG;IACH,KAAK,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CACnD"}

package/build/re-captcha/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/re-captcha/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/re-captcha/types.ts"],"names":[],"mappings":""}

package/build/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAG7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAa,MAAM,YAAY,CAAA;AAa3E,OAAO,KAAK,EAAE,MAAM,EAAW,MAAM,kBAAkB,CAAA;AAKvD,eAAO,MAAM,eAAe,WAAW,MAAM,KAAmB,WAgM/D,CAAA;AAED,eAAO,MAAM,iBAAiB,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,aAAa,CAAC,CAAC,CAAC,OACvE,CAAC,UAAS,MAAM,KACpB,CAAC,GAAG,iBAiBN,CAAA"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAG7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAa,MAAM,YAAY,CAAA;AAa3E,OAAO,KAAK,EAAE,MAAM,EAAW,MAAM,kBAAkB,CAAA;AAKvD,eAAO,MAAM,eAAe,WAAW,MAAM,KAAmB,WAqM/D,CAAA;AAED,eAAO,MAAM,iBAAiB,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,aAAa,CAAC,CAAC,CAAC,OACvE,CAAC,UAAS,MAAM,KACpB,CAAC,GAAG,iBAiBN,CAAA"}

package/build/service.js

@@ -2,7 +2,7 @@ import { TRUSTED } from '@owlmeans/config';
 import { AUTH_CACHE, AUTH_SRV_KEY, AUTHEN_TIMEFRAME, DEFAULT_ALIAS } from './consts.js';
 import { assertContext, createService } from '@owlmeans/context';
 import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope';
-import { AuthenFailed, AuthorizationError, AuthroizationType, AuthUnavailable } from '@owlmeans/auth';
+import { AuthenFailed, AuthenticationType, AuthorizationError, AuthroizationType, AuthUnavailable } from '@owlmeans/auth';
 import { createStaticResource } from '@owlmeans/static-resource';
 import { trust, extractAuthToken } from '@owlmeans/auth-common/utils';
 import { ENTITY_RESOLVER, TOKEN_UPDATE } from '@owlmeans/auth-common';
@@ -146,7 +146,12 @@ export const makeAuthService = (alias = DEFAULT_ALIAS) => {
             }
             const credentials = envelope.message();
             const msg = credentials.challenge;
-            // @TODO This operation is not atomic in case of redis store usage and scling
+            // A reCAPTCHA token proves a solved challenge, never a person: it is spent by
+            // `makeReCaptchaGuard` on the one route that takes it and never becomes a session. Refused
+            // before the spend, so a token presented here stays usable where it belongs.
+            if (envelope.type() === AuthenticationType.ReCaptcha || credentials.type === AuthenticationType.ReCaptcha) {
+                throw refuse('guest', new AuthenFailed('guest'), credentials.userId);
+            }
             try {
                 await cache(context).create({ id: msg }, { ttl: AUTHEN_TIMEFRAME / 1000 });
             }

package/build/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEvF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAmC,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAGtI,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,EAAE,eAAe,EAA8B,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACjG,OAAO,EAAE,qBAAqB,EAAsD,MAAM,gCAAgC,CAAA;AAC1H,OAAO,EAAE,8BAA8B,EAAE,oBAAoB,EAAE,gBAAgB,EAA2B,MAAM,+BAA+B,CAAA;AAC/I,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAItC,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,CAAA;AAEjC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAK,GAAW,aAAa,EAAe,EAAE;IAC5E;;;OAGG;IACH,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,KAAmB,EAAE,MAAe,EAAgB,EAAE;QACpF,MAAM,SAAS,GAAG,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS;YAC1C,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAA;QACpF,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAA;QACxH,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IAED,MAAM,QAAQ,GAAG,eAAe,KAAK,EAAE,CAAA;IAEvC,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAuB,EAAE,CACtD,OAAO,CAAC,QAAQ,CAAsB,UAAU,CAAC,CAAA;IAEnD,MAAM,QAAQ,GAAG,CAAC,OAAgB,EAA6B,EAAE,CAC/D,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC;QACtC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAqB,oBAAoB,CAAC;QAC3D,CAAC,CAAC,IAAI,CAAA;IAEV,MAAM,WAAW,GAAG,KAAK,EAAE,OAAgB,EAAE,UAA8B,EAA0B,EAAE;QACrG,IAAI,UAAU,IAAI,IAAI,IAAI,UAAU,KAAK,EAAE;YAAE,OAAO,IAAI,CAAA;QACxD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,OAAO,UAAU,CAAA;QAC3D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QAChG,OAAO,MAAM,EAAE,EAAE,IAAI,IAAI,CAAA;IAC3B,CAAC,CAAA;IAED,MAAM,OAAO,GAAG,KAAK,EAAE,OAAgB,EAAE,IAAU,EAAE,OAAe,EAAwB,EAAE;QAC5F,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;QAC5D,IAAI,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,qBAAqB,CAAC;YAAE,OAAO,IAAI,CAAA;QAC1G,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;QACjF,IAAI,OAAO,GAA2B,IAAI,CAAA;QAC1C,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,yFAAyF;YACzF,4EAA4E;YAC5E,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAA;QAC/C,CAAC;QACD,IAAI,OAAO,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAAE,OAAO,IAAI,CAAA;QACtH,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM;YACrC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;YAC5B,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,oBAAoB,EAAE,OAAO;YAC7B,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAA;IACH,CAAC,CAAA;IAED,MAAM,IAAI,GAAG,KAAK,EAAE,OAAgB,EAAE,IAAU,EAAmB,EAAE;QACnE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACxG,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QACpH,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAO,iBAAiB,CAAC,iBAAiB,CAAC;aACrF,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;QACxD,OAAO,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,EAAE,IAAI,aAAa,EAAE,CAAA;IAChF,CAAC,CAAA;IAED,MAAM,OAAO,GAAgB,aAAa,CAAc,KAAK,EAAE;QAC7D,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,IAAI;QAEtF,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAY,CAAA;YACrD,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAA;YAChF,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAE3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxG,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,IAAI,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YAC7B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;YACjC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI;oBAAE,OAAO,KAAU,CAAA;gBAC7C,IAAI,QAAQ,CAAA;gBACZ,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBAClD,CAAC;gBAAC,MAAM,CAAC;oBACP,0FAA0F;oBAC1F,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAA;gBAC/C,CAAC;gBACD,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS;oBAAE,OAAO,KAAU,CAAA;gBAClF,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBACjC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;oBAChE,IAAI,SAAS,IAAI,IAAI;wBAAE,OAAO,KAAU,CAAA;oBACxC,IAAI,GAAG,SAAS,CAAA;oBAChB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;oBAC7C,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;oBACvD,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,CAAA;gBAC9D,CAAC;YACH,CAAC;YAED,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAEjB,OAAO,IAAS,CAAA;QAClB,CAAC;QAED,MAAM,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YACpB,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YACpD,MAAM,CAAC,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAE3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxG,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;YACjC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI;oBAAE,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;gBACnE,IAAI,QAAQ,CAAA;gBACZ,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBAClD,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAA;gBAC/C,CAAC;gBACD,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ;oBAAE,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;YAC1E,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,aAAa,EAAE,KAAK,IAAI,EAAE;YACxB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YAC1B,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,EAAE,QAAQ,CAAC,CAAA;YAChF,MAAM,QAAQ,GAAG,iBAAiB,CAAkB,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAEpF,MAAM,WAAW,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;YAChF,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5C,MAAM,MAAM,CAAC,WAAW,EAAE,IAAI,YAAY,EAAE,CAAC,CAAA;YAC/C,CAAC;YAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YACtC,MAAM,GAAG,GAAG,WAAW,CAAC,SAAS,CAAA;YAEjC,6EAA6E;YAE7E,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;YAC5E,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,YAAY,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;YAChE,CAAC;YAED,IAAI,WAAW,CAAC,UAAU,KAAK,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACnD,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,YAAY,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;YAChE,CAAC;YAED,yBAAyB;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,QAAQ,GAAG,gBAAgB,CAAC,CAAA;YACvD,MAAM,IAAI,GAAS;gBACjB,KAAK,EAAE,WAAW,CAAC,SAAS;gBAC5B,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,IAAI,EAAE,iBAAiB,CAAC,iBAAiB;gBACzC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;gBAC3B,SAAS,EAAE,WAAW,CAAC,SAAS;gBAChC,UAAU,EAAE,WAAW,CAAC,UAAU;gBAClC,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC;gBAC7B,SAAS;gBACT,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;gBAC1B,oBAAoB,EAAE,CAAC;aACxB,CAAA;YACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;YACjC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;gBAC5D,IAAI,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI;oBAAE,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;gBACjH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;oBACtC,EAAE,EAAE,IAAI,CAAC,SAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS;oBACxE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE;iBACzC,CAAC,CAAA;gBACF,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ;oBAAE,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;gBAClG,IAAI,CAAC,oBAAoB,GAAG,QAAQ,CAAC,OAAO,CAAA;YAC9C,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAA;QAC7C,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,GAAM,EAAE,KAAK,GAAW,aAAa,EACd,EAAE;IAEzB,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAA;IACxD,CAAC;IAED,8FAA8F;IAC9F,oEAAoE;IACpE,8BAA8B,CAAC,GAAG,CAAC,CAAA;IAEnC,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,GAA4B,CAAA;IAE5C,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAChC,OAAO,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAE/C,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEvF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAmC,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAG1J,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,EAAE,eAAe,EAA8B,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACjG,OAAO,EAAE,qBAAqB,EAAsD,MAAM,gCAAgC,CAAA;AAC1H,OAAO,EAAE,8BAA8B,EAAE,oBAAoB,EAAE,gBAAgB,EAA2B,MAAM,+BAA+B,CAAA;AAC/I,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAItC,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,CAAA;AAEjC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAK,GAAW,aAAa,EAAe,EAAE;IAC5E;;;OAGG;IACH,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,KAAmB,EAAE,MAAe,EAAgB,EAAE;QACpF,MAAM,SAAS,GAAG,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS;YAC1C,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAA;QACpF,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAA;QACxH,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IAED,MAAM,QAAQ,GAAG,eAAe,KAAK,EAAE,CAAA;IAEvC,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAuB,EAAE,CACtD,OAAO,CAAC,QAAQ,CAAsB,UAAU,CAAC,CAAA;IAEnD,MAAM,QAAQ,GAAG,CAAC,OAAgB,EAA6B,EAAE,CAC/D,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC;QACtC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAqB,oBAAoB,CAAC;QAC3D,CAAC,CAAC,IAAI,CAAA;IAEV,MAAM,WAAW,GAAG,KAAK,EAAE,OAAgB,EAAE,UAA8B,EAA0B,EAAE;QACrG,IAAI,UAAU,IAAI,IAAI,IAAI,UAAU,KAAK,EAAE;YAAE,OAAO,IAAI,CAAA;QACxD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,OAAO,UAAU,CAAA;QAC3D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QAChG,OAAO,MAAM,EAAE,EAAE,IAAI,IAAI,CAAA;IAC3B,CAAC,CAAA;IAED,MAAM,OAAO,GAAG,KAAK,EAAE,OAAgB,EAAE,IAAU,EAAE,OAAe,EAAwB,EAAE;QAC5F,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;QAC5D,IAAI,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,qBAAqB,CAAC;YAAE,OAAO,IAAI,CAAA;QAC1G,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;QACjF,IAAI,OAAO,GAA2B,IAAI,CAAA;QAC1C,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,yFAAyF;YACzF,4EAA4E;YAC5E,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAA;QAC/C,CAAC;QACD,IAAI,OAAO,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAAE,OAAO,IAAI,CAAA;QACtH,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM;YACrC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;YAC5B,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,oBAAoB,EAAE,OAAO;YAC7B,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAA;IACH,CAAC,CAAA;IAED,MAAM,IAAI,GAAG,KAAK,EAAE,OAAgB,EAAE,IAAU,EAAmB,EAAE;QACnE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACxG,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QACpH,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAO,iBAAiB,CAAC,iBAAiB,CAAC;aACrF,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;QACxD,OAAO,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,EAAE,IAAI,aAAa,EAAE,CAAA;IAChF,CAAC,CAAA;IAED,MAAM,OAAO,GAAgB,aAAa,CAAc,KAAK,EAAE;QAC7D,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,IAAI;QAEtF,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAY,CAAA;YACrD,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAA;YAChF,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAE3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxG,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,IAAI,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YAC7B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;YACjC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI;oBAAE,OAAO,KAAU,CAAA;gBAC7C,IAAI,QAAQ,CAAA;gBACZ,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBAClD,CAAC;gBAAC,MAAM,CAAC;oBACP,0FAA0F;oBAC1F,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAA;gBAC/C,CAAC;gBACD,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS;oBAAE,OAAO,KAAU,CAAA;gBAClF,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBACjC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;oBAChE,IAAI,SAAS,IAAI,IAAI;wBAAE,OAAO,KAAU,CAAA;oBACxC,IAAI,GAAG,SAAS,CAAA;oBAChB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;oBAC7C,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;oBACvD,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,CAAA;gBAC9D,CAAC;YACH,CAAC;YAED,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAEjB,OAAO,IAAS,CAAA;QAClB,CAAC;QAED,MAAM,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YACpB,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YACpD,MAAM,CAAC,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAE3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxG,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;YACjC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI;oBAAE,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;gBACnE,IAAI,QAAQ,CAAA;gBACZ,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBAClD,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAA;gBAC/C,CAAC;gBACD,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ;oBAAE,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;YAC1E,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,aAAa,EAAE,KAAK,IAAI,EAAE;YACxB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YAC1B,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,EAAE,QAAQ,CAAC,CAAA;YAChF,MAAM,QAAQ,GAAG,iBAAiB,CAAkB,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAEpF,MAAM,WAAW,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;YAChF,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5C,MAAM,MAAM,CAAC,WAAW,EAAE,IAAI,YAAY,EAAE,CAAC,CAAA;YAC/C,CAAC;YAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YACtC,MAAM,GAAG,GAAG,WAAW,CAAC,SAAS,CAAA;YAEjC,8EAA8E;YAC9E,2FAA2F;YAC3F,6EAA6E;YAC7E,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,kBAAkB,CAAC,SAAS,IAAI,WAAW,CAAC,IAAI,KAAK,kBAAkB,CAAC,SAAS,EAAE,CAAC;gBAC1G,MAAM,MAAM,CAAC,OAAO,EAAE,IAAI,YAAY,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;YACtE,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;YAC5E,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,YAAY,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;YAChE,CAAC;YAED,IAAI,WAAW,CAAC,UAAU,KAAK,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACnD,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,YAAY,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;YAChE,CAAC;YAED,yBAAyB;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,QAAQ,GAAG,gBAAgB,CAAC,CAAA;YACvD,MAAM,IAAI,GAAS;gBACjB,KAAK,EAAE,WAAW,CAAC,SAAS;gBAC5B,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,IAAI,EAAE,iBAAiB,CAAC,iBAAiB;gBACzC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;gBAC3B,SAAS,EAAE,WAAW,CAAC,SAAS;gBAChC,UAAU,EAAE,WAAW,CAAC,UAAU;gBAClC,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC;gBAC7B,SAAS;gBACT,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;gBAC1B,oBAAoB,EAAE,CAAC;aACxB,CAAA;YACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;YACjC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;gBAC5D,IAAI,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI;oBAAE,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;gBACjH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;oBACtC,EAAE,EAAE,IAAI,CAAC,SAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS;oBACxE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE;iBACzC,CAAC,CAAA;gBACF,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ;oBAAE,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;gBAClG,IAAI,CAAC,oBAAoB,GAAG,QAAQ,CAAC,OAAO,CAAA;YAC9C,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAA;QAC7C,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,GAAM,EAAE,KAAK,GAAW,aAAa,EACd,EAAE;IAEzB,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAA;IACxD,CAAC;IAED,8FAA8F;IAC9F,oEAAoE;IACpE,8BAA8B,CAAC,GAAG,CAAC,CAAA;IAEnC,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,GAA4B,CAAA;IAE5C,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAChC,OAAO,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAE/C,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-auth",
-  "version": "0.1.18-rc.55",
+  "version": "0.1.18-rc.56",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -37,31 +37,31 @@
   },
   "dependencies": {
     "@noble/hashes": "^2.4.0",
-    "@owlmeans/api": "^0.1.18-rc.48",
-    "@owlmeans/api-config-server": "^0.1.18-rc.52",
-    "@owlmeans/auth": "^0.1.18-rc.40",
-    "@owlmeans/auth-common": "^0.1.18-rc.48",
-    "@owlmeans/basic-envelope": "^0.1.18-rc.47",
-    "@owlmeans/basic-ids": "^0.1.18-rc.38",
-    "@owlmeans/basic-keys": "^0.1.18-rc.49",
-    "@owlmeans/client-config": "^0.1.18-rc.44",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.48",
+    "@owlmeans/api": "^0.1.18-rc.49",
+    "@owlmeans/api-config-server": "^0.1.18-rc.53",
+    "@owlmeans/auth": "^0.1.18-rc.41",
+    "@owlmeans/auth-common": "^0.1.18-rc.49",
+    "@owlmeans/basic-envelope": "^0.1.18-rc.48",
+    "@owlmeans/basic-ids": "^0.1.18-rc.39",
+    "@owlmeans/basic-keys": "^0.1.18-rc.50",
+    "@owlmeans/client-config": "^0.1.18-rc.45",
+    "@owlmeans/client-entrypoint": "^0.1.18-rc.49",
     "@owlmeans/config": "^0.1.18-rc.44",
     "@owlmeans/context": "^0.1.18-rc.34",
-    "@owlmeans/kluster": "^0.1.18-rc.43",
-    "@owlmeans/log": "^0.1.18-rc.2",
+    "@owlmeans/kluster": "^0.1.18-rc.44",
+    "@owlmeans/log": "^0.1.18-rc.3",
     "@owlmeans/entrypoint": "^0.1.18-rc.41",
-    "@owlmeans/redis-resource": "^0.1.18-rc.45",
+    "@owlmeans/redis-resource": "^0.1.18-rc.46",
     "@owlmeans/resource": "^0.1.18-rc.40",
     "@owlmeans/route": "^0.1.18-rc.35",
-    "@owlmeans/server-api": "^0.1.18-rc.52",
-    "@owlmeans/server-auth-identity": "^0.1.18-rc.48",
-    "@owlmeans/server-auth-session": "^0.1.18-rc.17",
-    "@owlmeans/server-context": "^0.1.18-rc.43",
+    "@owlmeans/server-api": "^0.1.18-rc.53",
+    "@owlmeans/server-auth-identity": "^0.1.18-rc.49",
+    "@owlmeans/server-auth-session": "^0.1.18-rc.18",
+    "@owlmeans/server-context": "^0.1.18-rc.44",
     "@owlmeans/server-entrypoint": "^0.1.18-rc.40",
     "@owlmeans/server-route": "^0.1.18-rc.34",
-    "@owlmeans/server-socket": "^0.1.18-rc.55",
-    "@owlmeans/socket": "^0.1.18-rc.41",
+    "@owlmeans/server-socket": "^0.1.18-rc.56",
+    "@owlmeans/socket": "^0.1.18-rc.42",
     "@owlmeans/static-resource": "^0.1.18-rc.39",
     "@scure/base": "^2.4.0"
   },
@@ -70,7 +70,7 @@
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/test-auth": "^0.1.18-rc.47",
+    "@owlmeans/test-auth": "^0.1.18-rc.48",
     "@types/bun": "^1.4.2",
     "@types/node": "^26.6.4",
     "nodemon": "^3.1.14",

package/src/index.ts

@@ -1,6 +1,6 @@
-
 export type * from './types.js'
 export * from './model/index.js'
 export * from './consts.js'
 export * from './entrypoints.js'
 export * from './service.js'
+export * from './re-captcha/index.js'

package/src/manager/README.md

@@ -38,7 +38,7 @@ The manager is built on the OwlMeans entrypoint system, providing:
 This manager app is part of the `@owlmeans/server-auth` package:
 
 ```bash
-npm install @owlmeans/server-auth@^0.1.18-rc.55
+npm install @owlmeans/server-auth@^0.1.18-rc.56
 ```
 
 ## API Reference

package/src/manager/entrypoints.ts

@@ -1,19 +1,11 @@
-
-import { MOD_RECAPTCHA } from '@owlmeans/auth'
 import { authProtocols } from '@owlmeans/auth-common'
 import { entrypoints as apiConfigBindings } from '@owlmeans/api-config-server'
 import { bind } from '@owlmeans/server-entrypoint'
-import { decorateEntrypoint, openProtocol } from '@owlmeans/entrypoint'
+import { decorateEntrypoint } from '@owlmeans/entrypoint'
 import * as actions from './actions/index.js'
-import { backend, route, RouteMethod } from '@owlmeans/route'
 import { DEFAULT_RELY } from './consts.js'
 
 const relyProtocol = decorateEntrypoint(authProtocols.rely, { guards: DEFAULT_RELY })
-const reCaptchaProtocol = openProtocol(route(MOD_RECAPTCHA, '/api/siteverify', backend({
-  host: 'https://www.google.com',
-  base: 'recaptcha',
-  secure: true,
-}, RouteMethod.POST)))
 
 /** Server entrypoints for the full authentication manager. */
 export const entrypoints = [
@@ -22,5 +14,4 @@ export const entrypoints = [
   bind(authProtocols.authenticate, actions.authenticate(authProtocols.authenticate)),
   bind(relyProtocol, actions.rely(relyProtocol)),
   ...apiConfigBindings,
-  bind(reCaptchaProtocol),
 ]

package/src/manager/plugins/export.ts

@@ -1,6 +1,10 @@
 
 export type * from './types.js'
+export type * from './re-captcha/types.js'
 export * from './consts.js'
+export * from './re-captcha/consts.js'
+export * from './re-captcha/policy.js'
+export * from './re-captcha/verifier.js'
 export * from './basic-ed25519.js'
 export * from './re-captcha.js'
 export * from './basic-rely.js'

package/src/manager/plugins/re-captcha/consts.local.ts

@@ -0,0 +1,8 @@
+/**
+ * The only credential fields a reCAPTCHA guest token keeps. Everything else the caller posted —
+ * a profile, an organization (`entitySlug` or `entityId`), permissions, groups, an expiry, a
+ * `source` — is dropped: the token proves a solved challenge, never an identity.
+ */
+export const RECAPTCHA_CREDENTIAL_FIELDS: readonly string[] = Object.freeze([
+  'type', 'role', 'userId', 'scopes', 'challenge', 'credential',
+])