@owlmeans/server-auth 0.1.18-rc.55 → 0.1.18-rc.57

package/README.md

@@ -13,7 +13,7 @@ account/profile records `@owlmeans/server-auth-identity`, and the browser side `
 ## Installation
 
 ```bash
-bun add @owlmeans/server-auth@^0.1.18-rc.55
+bun add @owlmeans/server-auth@^0.1.18-rc.57
 ```
 
 ## Concepts
@@ -144,6 +144,29 @@ registerPlugin('my-method', context => ({
 }) as AuthPlugin)
 ```
 
+### Accept a reCAPTCHA-proven guest on one route
+
+The manager's reCAPTCHA plugin signs a GUEST token (`GUEST_ID`, role Guest, `[AUTH_SCOPE]`) whatever
+identity the caller posts. A route takes it through the reCAPTCHA guard, which spends it once:
+
+```ts
+import { CMOD_RECAPTCHA, MOD_RECAPTCHA, RECAPTCHA_GUARD } from '@owlmeans/auth'
+import { clientPlugin, plugin } from '@owlmeans/config'
+import { makeReCaptchaGuard, reCaptchaTokenOf } from '@owlmeans/server-auth'
+
+// config: the secret plus the policy (strings, '' = no check), and the browser's site key
+plugin(cfg, {
+  value: '/etc/master-secret/recaptcha-secret',
+  hostnames: 'example.org, example.com', minScore: '0.5', actions: 'inquiry',
+}, MOD_RECAPTCHA)
+clientPlugin(cfg, '/etc/app-config/recaptcha-site-key', CMOD_RECAPTCHA)
+
+// context: the guard of the route's `guards: [RECAPTCHA_GUARD]` (`Authorization: RE-CAPTCHA <token>`)
+context.registerService(makeReCaptchaGuard())
+// a pre-parse check that does not spend:
+const guest = await reCaptchaTokenOf(context).inspect(request) // null = 401
+```
+
 ## API
 
 ### Root export
@@ -159,6 +182,9 @@ registerPlugin('my-method', context => ({
 | `AUTHEN_TIMEFRAME` | const | `15 * 60 * 1000` ms — challenge lifetime and anti-replay window |
 | `makeRelyModel`, `makeProviderRely`, `makeConsumerRely` | function | Rely envelope models |
 | `AuthService`, `AuthServiceAppend`, `AuthSpent`, `RelyOptions` | type | Guard service, context mixin, cache record, rely options |
+| `makeReCaptchaGuard(alias = RECAPTCHA_GUARD)` | function | Guard of a route a reCAPTCHA guest calls once: verifies and spends `RE-CAPTCHA <token>` |
+| `makeReCaptchaTokenHelper(ctx)`, `reCaptchaTokenOf(ctx)` | function | `inspect(req)` / `verify(token)` (no spend) and `spend(guest)` |
+| `ReCaptchaGuest`, `ReCaptchaCarrier`, `ReCaptchaTokenHelper` | type | Inspection result, header carrier, token checks |
 
 ### `./manager`
 
@@ -166,7 +192,7 @@ registerPlugin('my-method', context => ({
 |---|---|---|
 | `makeContext(cfg, customize?)` | function | Server context with API server, API client, socket service, rely guard and static `AUTH_CACHE` |
 | `main(ctx)` | function | Register the manager entrypoints, init and listen |
-| `entrypoints` | const | Bindings for authen, init, authenticate, rely, api-config and reCAPTCHA siteverify |
+| `entrypoints` | const | Bindings for authen, init, authenticate, rely and api-config |
 | `authenticationInit`, `authenticate`, `rely` | function | Implementations bound to the auth protocols |
 | `plugins`, `registerPlugin(type, factory)` | const / function | The plugin registry |
 | `appendSupervisorAuth(ctx, opts?)`, `setupInternalTokenCoguard(entrypoints, guard?)` | function | PK supervisor login (development only by default) |
@@ -187,7 +213,11 @@ registerPlugin('my-method', context => ({
 | `authPluginHelper.getPlugin(type, context)`, `authPluginHelper.assertType(type, plugin)` | method | Resolution; `getPlugin` throws `AuthUnknown(type)` for an unregistered type |
 | `makeBasicEd25519Plugin`, `makeReCaptchaPlugin`, `makeBasicRelyPlugin` | function | Built-in plugin factories |
 | `makeSupervisorPlugin(context, opts)` | function | PK supervisor plugin factory |
-| `AuthPlugin`, `AuthPluginFactory`, `AuthPluginHelper`, `RecpatchaResponse`, `RecaptchaRequest`, `RelyRecord`, `AuthRedisResource` | type | Plugin shapes |
+| `createReCaptchaVerifierService(alias?, opts?)`, `appendReCaptchaVerifierService(ctx, alias?, opts?)` | function | Google siteverify over `fetch` (https only); the plugin's seam |
+| `makeReCaptchaPolicyModel(record)` | function | The `MOD_RECAPTCHA` record's policy: `hostnames()`, `minScore()`, `actions()`, `assert(answer)` |
+| `RECAPTCHA_VERIFIER`, `RECAPTCHA_SITEVERIFY_URL`, `RECAPTCHA_VERIFY_TIMEOUT` | const | `'re-captcha-verifier'`, Google's endpoint, 10 s |
+| `AuthPlugin`, `AuthPluginFactory`, `AuthPluginHelper`, `RelyRecord`, `AuthRedisResource` | type | Plugin shapes |
+| `ReCaptchaResponse`, `ReCaptchaRequest`, `ReCaptchaVerifierService`, `ReCaptchaVerifierOptions`, `ReCaptchaFetch`, `ReCaptchaPluginConfig`, `ReCaptchaPolicyModel` | type | reCAPTCHA shapes |
 
 ## Common pitfalls
 
@@ -202,6 +232,8 @@ registerPlugin('my-method', context => ({
   entity id.
 - Register `appendAuthService` before `appendAuthIdentityResources` and product gate services.
 - Import `./manager` only in the auth manager process.
+- A reCAPTCHA token is a guest token: the bearer exchange (`authenticate`) refuses it, and only
+  `makeReCaptchaGuard` accepts it — once.
 
 ## Related packages
 
@@ -222,7 +254,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.51
+npx @owlmeans/agent-skills@^0.1.18-rc.53
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-auth",
-  "version": "0.1.18-rc.55",
-  "generatedAt": "2026-10-06T11:45:57.660Z",
+  "version": "0.1.18-rc.57",
+  "generatedAt": "2026-10-09T11:30:42.742Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-auth/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: server-auth
-description: How to use @owlmeans/server-auth — the server side of OwlMeans authentication. Two halves in one package - appendAuthService/makeAuthService, which verify Ed25519 bearer tokens on an ordinary API server, and the ./manager subpath, which IS the auth manager service (challenge, plugin registry, credential envelope, rely). Auto-invoked when importing the server auth guard, registering an auth plugin, or building the auth manager.
+description: How to use @owlmeans/server-auth — the server side of OwlMeans authentication. Two halves in one package - appendAuthService/makeAuthService, which verify Ed25519 bearer tokens on an ordinary API server, and the ./manager subpath, which IS the auth manager service (challenge, plugin registry, credential envelope, rely). Also the reCAPTCHA guest path - the plugin's verifier and policy record, and makeReCaptchaGuard, which spends a guest token once. Auto-invoked when importing the server auth guard or the reCAPTCHA guard, registering an auth plugin, or building the auth manager.
 user-invocable: false
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/server-auth
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-auth": "^0.1.18-rc.55"` in `dependencies`
+**Install:** `"@owlmeans/server-auth": "^0.1.18-rc.57"` in `dependencies`
 
 Two halves, deliberately split by subpath:
 
@@ -32,6 +32,9 @@ An ordinary service imports the root. Only the auth manager imports `./manager`.
 | `AUTHEN_TIMEFRAME` | `15 * 60 * 1000` — challenge lifetime and anti-replay window, in ms |
 | `AuthService`, `AuthServiceAppend`, `AuthSpent` | Types |
 | `makeRelyModel`, `makeProviderRely`, `makeConsumerRely`, `RelyOptions` | The rely (wallet handshake) models |
+| `makeReCaptchaGuard(alias = RECAPTCHA_GUARD)` | The guard of a route a reCAPTCHA guest calls once — see "reCAPTCHA guests" |
+| `makeReCaptchaTokenHelper(ctx)`, `reCaptchaTokenOf(ctx)` | `inspect(req)` / `verify(token)` → `ReCaptchaGuest \| null` without spending; `spend(guest)` → `false` when spent before |
+| `ReCaptchaGuest`, `ReCaptchaCarrier`, `ReCaptchaTokenHelper` | Types: `{ credential, challenge, expiresAt }`, `{ headers? }`, the helper |
 
 ## Key Exports — `./manager`
 
@@ -39,7 +42,7 @@ An ordinary service imports the root. Only the auth manager imports `./manager`.
 |--------|-------------|
 | `makeContext(cfg, customize?)` | A server context preconfigured with the API server, API client, socket service and static `AUTH_CACHE` |
 | `main(ctx)` | Register the manager entrypoints, configure, init and listen |
-| `entrypoints` | `AUTHEN`, `AUTHEN_INIT`, `AUTHEN_AUTHEN`, `AUTHEN_RELY`, the api-config entrypoints and the reCAPTCHA siteverify entrypoint |
+| `entrypoints` | `AUTHEN`, `AUTHEN_INIT`, `AUTHEN_AUTHEN`, `AUTHEN_RELY` and the api-config entrypoints |
 | `authenticationInit`, `authenticate`, `rely` | Implementations bound to auth protocols: `init(request)` → challenge, `authenticate(credential)` → signed credential envelope, and the rely socket |
 | `plugins`, `registerPlugin(type, factory)` | The plugin registry (also on `./manager/plugins`) |
 | `appendSupervisorAuth(ctx, opts?)`, `setupInternalTokenCoguard(entrypoints, guard?)` | PK supervisor login — see the `supervisor-auth` skill |
@@ -61,7 +64,11 @@ one import.
 | `authPluginHelper.getPlugin(type, context)`, `authPluginHelper.assertType(type, plugin)` | Resolution; `getPlugin` throws `AuthUnknown(type)` for an unregistered type |
 | `makeBasicEd25519Plugin`, `makeReCaptchaPlugin`, `makeBasicRelyPlugin` | The plugin factories registered out of the box, for `AuthenticationType.BasicEd25519`, `ReCaptcha` and `RelyHandshake` |
 | `makeSupervisorPlugin(context, opts)` | The PK supervisor plugin factory |
-| `RecpatchaResponse`, `RecaptchaRequest`, `RelyRecord`, `AuthRedisResource` | Types |
+| `createReCaptchaVerifierService(alias = RECAPTCHA_VERIFIER, opts?)`, `appendReCaptchaVerifierService(ctx, alias?, opts?)` | Google siteverify: one `fetch` form POST (`opts.url` must be https, `opts.fetch` injectable, `opts.timeout` default 10 s) |
+| `makeReCaptchaPolicyModel(record)` | The `MOD_RECAPTCHA` record's policy: `hostnames()`, `minScore()`, `actions()`, `assert(answer)` |
+| `RECAPTCHA_VERIFIER`, `RECAPTCHA_SITEVERIFY_URL`, `RECAPTCHA_VERIFY_TIMEOUT` | `'re-captcha-verifier'`, `https://www.google.com/recaptcha/api/siteverify`, `10_000` |
+| `ReCaptchaResponse`, `ReCaptchaRequest`, `ReCaptchaVerifierService`, `ReCaptchaVerifierOptions`, `ReCaptchaFetch`, `ReCaptchaPluginConfig`, `ReCaptchaPolicyModel` | reCAPTCHA types |
+| `RelyRecord`, `AuthRedisResource` | Types |
 
 ## Usage
 
@@ -92,6 +99,57 @@ registerPlugin('my-method', context => ({
 }) as AuthPlugin)
 ```
 
+## reCAPTCHA guests
+
+A reCAPTCHA sign-in proves that a person solved a challenge — nothing about who they are.
+
+**Config.** One Backend plugin record `MOD_RECAPTCHA` holds the secret in `value` and the policy in
+extra string fields (`''` or absent = no check; each may be a file path the file config reader
+resolves); the browser's site key is a separate Frontend record `CMOD_RECAPTCHA`. Only Frontend
+records are advertised, so the secret and the policy never reach a browser.
+
+```ts
+plugin(cfg, { value: '/etc/master-secret/recaptcha-secret',
+  hostnames: 'example.org, example.com', minScore: '0.5', actions: 'inquiry' }, MOD_RECAPTCHA)
+clientPlugin(cfg, '/etc/app-config/recaptcha-site-key', CMOD_RECAPTCHA)
+```
+
+| Field | Check (refusal) |
+|---|---|
+| `value` | the siteverify secret; missing or `''` → `PluginMissconfigured('value')` before Google is asked |
+| — | Google's `success` (`AuthenFailed('recaptcha:<error-codes>')`, `recaptcha:unknown` without codes) |
+| `hostnames` | comma/space list; the answer's `hostname` equals an entry or is its subdomain (`recaptcha:hostname`) |
+| `minScore` | 0…1; a score-based answer with `score < minScore` (`recaptcha:score`); a checkbox answer has no score and passes; a non-number → `PluginMissconfigured('minScore')` |
+| `actions` | comma/space list; the answer's `action` must be one of them — an answer without one fails (`recaptcha:action`) |
+
+**Plugin.** `makeReCaptchaPlugin` asks the verifier registered under `RECAPTCHA_VERIFIER` (a test
+or proxy registers its own; without one the default siteverify `fetch` runs — Google is always
+https, `cfg.security.unsecure` does not apply). Google unreachable or answering garbage is
+`AuthUnavailable` (503), never a refusal. After a passing answer the credential keeps ONLY `type`,
+`role`, `userId`, `scopes`, `challenge`, `credential`, set to a guest: `GUEST_ID`, `AuthRole.Guest`,
+`[AUTH_SCOPE]`, type ReCaptcha. A posted `profileId`, `entitySlug`/`entityId`, `permissions`,
+`groups`, `expiresAt`, `source` or `publicKey` is dropped; `source` never changes the spend key.
+
+**Token.** The manager signs it as usual: an `AUTHEN_TIMEFRAME` envelope of type `re-captcha` whose
+`challenge` is the server-issued wrapped challenge (the spend key) and whose `credential` is the
+`AUTH_SRV_KEY` record's id. The browser sends it as `Authorization: RE-CAPTCHA <token>`.
+
+**Guard.** A route takes it with `guards: [RECAPTCHA_GUARD]` and `makeReCaptchaGuard()` registered
+in a context holding the `AUTH_SRV_KEY` trusted record (public key is enough) and a shared
+`AUTH_CACHE`. `reCaptchaTokenOf(ctx).inspect(req)` checks, without spending: envelope type, a TTL
+of at most `AUTHEN_TIMEFRAME`, signature and expiry, the auth record's stamp, type ReCaptcha, role
+Guest, `GUEST_ID`, a non-empty challenge. The guard then spends it — an atomic create-once of the
+challenge in `AUTH_CACHE` (Redis `SET NX`), the same key a bearer exchange and the integrated IAM's
+finalizer claim, so a token is spent once across the platform. A replay, or any failed check, is
+401. `req.auth` becomes a guest with `token: ''` and `expiresAt` = the token's expiry. Use
+`inspect` for a pre-parse check (before a large body is read); the route still needs the guard.
+
+**Never a session.** `AuthService.authenticate` (the dispatcher's bearer exchange) refuses a
+credential whose envelope or `type` is ReCaptcha (`AuthenFailed('guest')`) before spending it. A
+service that judges manager tokens itself (a finalizer) must check the method it expects — the
+token's type and its challenge's envelope type — not just the signature, since one key signs every
+method's token.
+
 ## Rules
 
 - The guard verifies a bearer token and populates `req.auth`. It decides nothing about ownership or
@@ -117,6 +175,8 @@ registerPlugin('my-method', context => ({
   `AuthenFailed('entity')`. Where no resolver is registered the value is passed through untouched.
 - Pair this package with `@owlmeans/server-auth-identity` when an external provider (Google, OIDC,
   email OTP) must map onto local account/profile/credential records.
+- A reCAPTCHA token is a guest token: only `makeReCaptchaGuard` accepts it, once; the bearer
+  exchange refuses it (see "reCAPTCHA guests").
 
 ## Depends On
 

package/build/index.d.ts

@@ -3,4 +3,5 @@ export * from './model/index.js';
 export * from './consts.js';
 export * from './entrypoints.js';
 export * from './service.js';
+export * from './re-captcha/index.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA;AAC3B,cAAc,kBAAkB,CAAA;AAChC,cAAc,cAAc,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA;AAC3B,cAAc,kBAAkB,CAAA;AAChC,cAAc,cAAc,CAAA;AAC5B,cAAc,uBAAuB,CAAA"}

package/build/index.js

@@ -2,4 +2,5 @@ export * from './model/index.js';
 export * from './consts.js';
 export * from './entrypoints.js';
 export * from './service.js';
+export * from './re-captcha/index.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA;AAC3B,cAAc,kBAAkB,CAAA;AAChC,cAAc,cAAc,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA;AAC3B,cAAc,kBAAkB,CAAA;AAChC,cAAc,cAAc,CAAA;AAC5B,cAAc,uBAAuB,CAAA"}

package/build/manager/entrypoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../../src/manager/entrypoints.ts"],"names":[],"mappings":"AAiBA,8DAA8D;AAC9D,eAAO,MAAM,WAAW;;;;;;iBAOvB,CAAA"}
+{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../../src/manager/entrypoints.ts"],"names":[],"mappings":"AASA,8DAA8D;AAC9D,eAAO,MAAM,WAAW;;;;;;iBAMvB,CAAA"}

package/build/manager/entrypoints.js

@@ -1,17 +1,10 @@
-import { MOD_RECAPTCHA } from '@owlmeans/auth';
 import { authProtocols } from '@owlmeans/auth-common';
 import { entrypoints as apiConfigBindings } from '@owlmeans/api-config-server';
 import { bind } from '@owlmeans/server-entrypoint';
-import { decorateEntrypoint, openProtocol } from '@owlmeans/entrypoint';
+import { decorateEntrypoint } from '@owlmeans/entrypoint';
 import * as actions from './actions/index.js';
-import { backend, route, RouteMethod } from '@owlmeans/route';
 import { DEFAULT_RELY } from './consts.js';
 const relyProtocol = decorateEntrypoint(authProtocols.rely, { guards: DEFAULT_RELY });
-const reCaptchaProtocol = openProtocol(route(MOD_RECAPTCHA, '/api/siteverify', backend({
-    host: 'https://www.google.com',
-    base: 'recaptcha',
-    secure: true,
-}, RouteMethod.POST)));
 /** Server entrypoints for the full authentication manager. */
 export const entrypoints = [
     bind(authProtocols.authen, undefined, { intermediate: true }),
@@ -19,6 +12,5 @@ export const entrypoints = [
     bind(authProtocols.authenticate, actions.authenticate(authProtocols.authenticate)),
     bind(relyProtocol, actions.rely(relyProtocol)),
     ...apiConfigBindings,
-    bind(reCaptchaProtocol),
 ];
 //# sourceMappingURL=entrypoints.js.map

package/build/manager/entrypoints.js.map

@@ -1 +1 @@
-{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../../src/manager/entrypoints.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,WAAW,IAAI,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC9E,OAAO,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAA;AAClD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACvE,OAAO,KAAK,OAAO,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1C,MAAM,YAAY,GAAG,kBAAkB,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAA;AACrF,MAAM,iBAAiB,GAAG,YAAY,CAAC,KAAK,CAAC,aAAa,EAAE,iBAAiB,EAAE,OAAO,CAAC;IACrF,IAAI,EAAE,wBAAwB;IAC9B,IAAI,EAAE,WAAW;IACjB,MAAM,EAAE,IAAI;CACb,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AAEtB,8DAA8D;AAC9D,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC7D,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,kBAAkB,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;IAClF,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC9C,GAAG,iBAAiB;IACpB,IAAI,CAAC,iBAAiB,CAAC;CACxB,CAAA"}
+{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../../src/manager/entrypoints.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,WAAW,IAAI,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC9E,OAAO,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAA;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,KAAK,OAAO,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1C,MAAM,YAAY,GAAG,kBAAkB,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAA;AAErF,8DAA8D;AAC9D,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC7D,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,kBAAkB,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;IAClF,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC9C,GAAG,iBAAiB;CACrB,CAAA"}

package/build/manager/plugins/export.d.ts

@@ -1,5 +1,9 @@
 export type * from './types.js';
+export type * from './re-captcha/types.js';
 export * from './consts.js';
+export * from './re-captcha/consts.js';
+export * from './re-captcha/policy.js';
+export * from './re-captcha/verifier.js';
 export * from './basic-ed25519.js';
 export * from './re-captcha.js';
 export * from './basic-rely.js';

package/build/manager/plugins/export.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"export.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/export.ts"],"names":[],"mappings":"AACA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,YAAY,CAAA;AAC1B,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"export.d.ts","sourceRoot":"","sources":["../../../src/manager/plugins/export.ts"],"names":[],"mappings":"AACA,mBAAmB,YAAY,CAAA;AAC/B,mBAAmB,uBAAuB,CAAA;AAC1C,cAAc,aAAa,CAAA;AAC3B,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,0BAA0B,CAAA;AACxC,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,YAAY,CAAA;AAC1B,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA"}

package/build/manager/plugins/export.js

@@ -1,4 +1,7 @@
 export * from './consts.js';
+export * from './re-captcha/consts.js';
+export * from './re-captcha/policy.js';
+export * from './re-captcha/verifier.js';
 export * from './basic-ed25519.js';
 export * from './re-captcha.js';
 export * from './basic-rely.js';

package/build/manager/plugins/export.js.map

@@ -1 +1 @@
-{"version":3,"file":"export.js","sourceRoot":"","sources":["../../../src/manager/plugins/export.ts"],"names":[],"mappings":"AAEA,cAAc,aAAa,CAAA;AAC3B,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,YAAY,CAAA;AAC1B,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"export.js","sourceRoot":"","sources":["../../../src/manager/plugins/export.ts"],"names":[],"mappings":"AAGA,cAAc,aAAa,CAAA;AAC3B,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,0BAA0B,CAAA;AACxC,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,YAAY,CAAA;AAC1B,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA"}

package/build/manager/plugins/re-captcha/consts.d.ts

@@ -0,0 +1,7 @@
+/** The service alias the reCAPTCHA plugin resolves its verifier by. */
+export declare const RECAPTCHA_VERIFIER = "re-captcha-verifier";
+/** Google's siteverify endpoint — always https. */
+export declare const RECAPTCHA_SITEVERIFY_URL = "https://www.google.com/recaptcha/api/siteverify";
+/** How long the default verifier waits for Google, in ms. */
+export declare const RECAPTCHA_VERIFY_TIMEOUT = 10000;
+//# sourceMappingURL=consts.d.ts.map

package/build/manager/plugins/re-captcha/consts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../../../../src/manager/plugins/re-captcha/consts.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,eAAO,MAAM,kBAAkB,wBAAwB,CAAA;AAEvD,mDAAmD;AACnD,eAAO,MAAM,wBAAwB,oDAAoD,CAAA;AAEzF,6DAA6D;AAC7D,eAAO,MAAM,wBAAwB,QAAS,CAAA"}

package/build/manager/plugins/re-captcha/consts.js

@@ -0,0 +1,7 @@
+/** The service alias the reCAPTCHA plugin resolves its verifier by. */
+export const RECAPTCHA_VERIFIER = 're-captcha-verifier';
+/** Google's siteverify endpoint — always https. */
+export const RECAPTCHA_SITEVERIFY_URL = 'https://www.google.com/recaptcha/api/siteverify';
+/** How long the default verifier waits for Google, in ms. */
+export const RECAPTCHA_VERIFY_TIMEOUT = 10_000;
+//# sourceMappingURL=consts.js.map

package/build/manager/plugins/re-captcha/consts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../../../../src/manager/plugins/re-captcha/consts.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,MAAM,CAAC,MAAM,kBAAkB,GAAG,qBAAqB,CAAA;AAEvD,mDAAmD;AACnD,MAAM,CAAC,MAAM,wBAAwB,GAAG,iDAAiD,CAAA;AAEzF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAA"}

package/build/manager/plugins/re-captcha/consts.local.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The only credential fields a reCAPTCHA guest token keeps. Everything else the caller posted —
+ * a profile, an organization (`entitySlug` or `entityId`), permissions, groups, an expiry, a
+ * `source` — is dropped: the token proves a solved challenge, never an identity.
+ */
+export declare const RECAPTCHA_CREDENTIAL_FIELDS: readonly string[];
+//# sourceMappingURL=consts.local.d.ts.map

package/build/manager/plugins/re-captcha/consts.local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.d.ts","sourceRoot":"","sources":["../../../../src/manager/plugins/re-captcha/consts.local.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAEvD,CAAA"}

package/build/manager/plugins/re-captcha/consts.local.js

@@ -0,0 +1,9 @@
+/**
+ * The only credential fields a reCAPTCHA guest token keeps. Everything else the caller posted —
+ * a profile, an organization (`entitySlug` or `entityId`), permissions, groups, an expiry, a
+ * `source` — is dropped: the token proves a solved challenge, never an identity.
+ */
+export const RECAPTCHA_CREDENTIAL_FIELDS = Object.freeze([
+    'type', 'role', 'userId', 'scopes', 'challenge', 'credential',
+]);
+//# sourceMappingURL=consts.local.js.map

package/build/manager/plugins/re-captcha/consts.local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.js","sourceRoot":"","sources":["../../../../src/manager/plugins/re-captcha/consts.local.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC1E,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY;CAC9D,CAAC,CAAA"}

package/build/manager/plugins/re-captcha/policy.d.ts

@@ -0,0 +1,3 @@
+import type { ReCaptchaPluginConfig, ReCaptchaPolicyModel } from './types.js';
+export declare const makeReCaptchaPolicyModel: (record: ReCaptchaPluginConfig) => ReCaptchaPolicyModel;
+//# sourceMappingURL=policy.d.ts.map

package/build/manager/plugins/re-captcha/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../../src/manager/plugins/re-captcha/policy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,oBAAoB,EAAqB,MAAM,YAAY,CAAA;AAShG,eAAO,MAAM,wBAAwB,WAAY,qBAAqB,KAAG,oBA4CxE,CAAA"}

package/build/manager/plugins/re-captcha/policy.js

@@ -0,0 +1,44 @@
+import { AuthenFailed } from '@owlmeans/auth';
+import { PluginMissconfigured } from '@owlmeans/config';
+/** A comma- or space-separated config string as its entries; `''` and absent are no entries. */
+const listOf = (value) => typeof value === 'string' ? value.split(/[\s,]+/).map(entry => entry.trim()).filter(entry => entry !== '') : [];
+/** A host as it is compared: lowercased, without a trailing dot or a leading `*.`/`.`. */
+const hostOf = (value) => value.trim().toLowerCase().replace(/\.$/, '').replace(/^\*?\./, '');
+export const makeReCaptchaPolicyModel = (record) => {
+    const hostnames = () => listOf(record.hostnames).map(hostOf).filter(host => host !== '');
+    const minScore = () => {
+        const value = record.minScore;
+        if (value == null || (typeof value === 'string' && value.trim() === '')) {
+            return null;
+        }
+        const score = typeof value === 'number' ? value : Number(value);
+        if (!Number.isFinite(score) || score < 0 || score > 1) {
+            throw new PluginMissconfigured('minScore');
+        }
+        return score;
+    };
+    const actions = () => listOf(record.actions);
+    const assert = (response) => {
+        if (response.success !== true) {
+            const codes = Array.isArray(response['error-codes']) ? response['error-codes'] : [];
+            throw new AuthenFailed('recaptcha:' + (codes.length > 0 ? codes.join(',') : 'unknown'));
+        }
+        const allowed = hostnames();
+        if (allowed.length > 0) {
+            const host = typeof response.hostname === 'string' ? hostOf(response.hostname) : '';
+            if (host === '' || !allowed.some(entry => host === entry || host.endsWith(`.${entry}`))) {
+                throw new AuthenFailed('recaptcha:hostname');
+            }
+        }
+        const floor = minScore();
+        if (floor != null && typeof response.score === 'number' && response.score < floor) {
+            throw new AuthenFailed('recaptcha:score');
+        }
+        const named = actions();
+        if (named.length > 0 && (typeof response.action !== 'string' || !named.includes(response.action))) {
+            throw new AuthenFailed('recaptcha:action');
+        }
+    };
+    return { record, hostnames, minScore, actions, assert };
+};
+//# sourceMappingURL=policy.js.map

package/build/manager/plugins/re-captcha/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../../src/manager/plugins/re-captcha/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAGvD,gGAAgG;AAChG,MAAM,MAAM,GAAG,CAAC,KAAc,EAAY,EAAE,CAC1C,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAEjH,0FAA0F;AAC1F,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;AAE7G,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,MAA6B,EAAwB,EAAE;IAC9F,MAAM,SAAS,GAAG,GAAa,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAA;IAElG,MAAM,QAAQ,GAAG,GAAkB,EAAE;QACnC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAA;QAC7B,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACxE,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC/D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,oBAAoB,CAAC,UAAU,CAAC,CAAA;QAC5C,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IAED,MAAM,OAAO,GAAG,GAAa,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAEtD,MAAM,MAAM,GAAG,CAAC,QAA2B,EAAQ,EAAE;QACnD,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YACnF,MAAM,IAAI,YAAY,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;QACzF,CAAC;QAED,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;QAC3B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YACnF,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;gBACxF,MAAM,IAAI,YAAY,CAAC,oBAAoB,CAAC,CAAA;YAC9C,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAA;QACxB,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,GAAG,KAAK,EAAE,CAAC;YAClF,MAAM,IAAI,YAAY,CAAC,iBAAiB,CAAC,CAAA;QAC3C,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,EAAE,CAAA;QACvB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAClG,MAAM,IAAI,YAAY,CAAC,kBAAkB,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC,CAAA;IAED,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;AACzD,CAAC,CAAA"}

package/build/manager/plugins/re-captcha/types.d.ts

@@ -0,0 +1,79 @@
+import type { PluginConfig } from '@owlmeans/config';
+import type { InitializedService } from '@owlmeans/context';
+/** Google's siteverify answer, for a checkbox (v2) or a score-based (v3) token. */
+export interface ReCaptchaResponse {
+    success: boolean;
+    /** When the challenge was solved, as an ISO date-time string. */
+    challenge_ts: string;
+    /** The host of the page the token was solved on. */
+    hostname: string;
+    /** Score-based keys only: 0.0 (a bot) … 1.0 (a person). */
+    score?: number;
+    /** Score-based keys only: the action the page named when it asked for the token. */
+    action?: string;
+    'error-codes'?: string[];
+}
+/** The siteverify form: the key's secret, the token the browser got, optionally the browser's IP. */
+export interface ReCaptchaRequest {
+    secret: string;
+    response: string;
+    remoteip?: string;
+}
+/**
+ * Asks Google whether a reCAPTCHA token is good. The plugin resolves it by `RECAPTCHA_VERIFIER`, so a
+ * test (or a proxy) registers its own under that alias; without one, the default siteverify call runs.
+ */
+export interface ReCaptchaVerifierService extends InitializedService {
+    /**
+     * Google's answer for one token. A refusal is an answer (`success: false`), not an error.
+     *
+     * @throws {AuthUnavailable} when Google cannot be asked or answers something unreadable.
+     */
+    verify: (request: ReCaptchaRequest) => Promise<ReCaptchaResponse>;
+}
+/** The one call the default verifier makes — `fetch`, or a stand-in a test injects. */
+export interface ReCaptchaFetch {
+    (url: string, init: RequestInit): Promise<Response>;
+}
+export interface ReCaptchaVerifierOptions {
+    /** The siteverify address; must be https. Default `RECAPTCHA_SITEVERIFY_URL`. */
+    url?: string;
+    /** Default: the global `fetch`. */
+    fetch?: ReCaptchaFetch;
+    /** Milliseconds before the call is abandoned. Default `RECAPTCHA_VERIFY_TIMEOUT`. */
+    timeout?: number;
+}
+/**
+ * The `MOD_RECAPTCHA` plugin record of the server config: the secret in `value` plus the policy.
+ * Every policy field is a string as a mounted config file delivers it; `''` or absent = no check.
+ */
+export interface ReCaptchaPluginConfig extends PluginConfig {
+    /** Hosts a token may be solved on, comma- or space-separated; a subdomain of an entry passes. */
+    hostnames?: string;
+    /** The lowest score a score-based token may carry (0…1); a checkbox token has none and passes. */
+    minScore?: string | number;
+    /** The actions a token may be issued for, comma- or space-separated; a token naming none fails. */
+    actions?: string;
+}
+/** The policy one `MOD_RECAPTCHA` record states, applied to Google's answer. */
+export interface ReCaptchaPolicyModel {
+    readonly record: ReCaptchaPluginConfig;
+    /** The allowed hosts, lowercased; empty = any host. */
+    hostnames: () => string[];
+    /**
+     * The lowest accepted score, or `null` for no score check.
+     *
+     * @throws {PluginMissconfigured} when the record's value is not a number between 0 and 1.
+     */
+    minScore: () => number | null;
+    /** The allowed actions; empty = any action. */
+    actions: () => string[];
+    /**
+     * Accept Google's answer or refuse it, in this order: success, hostname, score, action.
+     *
+     * @throws {AuthenFailed} `recaptcha:<error-codes>`, `recaptcha:hostname`, `recaptcha:score`,
+     *   `recaptcha:action`.
+     */
+    assert: (response: ReCaptchaResponse) => void;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/manager/plugins/re-captcha/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/manager/plugins/re-captcha/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAE3D,mFAAmF;AACnF,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,iEAAiE;IACjE,YAAY,EAAE,MAAM,CAAA;IACpB,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAA;IAChB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;CACzB;AAED,qGAAqG;AACrG,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAyB,SAAQ,kBAAkB;IAClE;;;;OAIG;IACH,MAAM,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;CAClE;AAED,uFAAuF;AACvF,MAAM,WAAW,cAAc;IAC7B,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CACpD;AAED,MAAM,WAAW,wBAAwB;IACvC,iFAAiF;IACjF,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,mCAAmC;IACnC,KAAK,CAAC,EAAE,cAAc,CAAA;IACtB,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAsB,SAAQ,YAAY;IACzD,iGAAiG;IACjG,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,kGAAkG;IAClG,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IAC1B,mGAAmG;IACnG,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,gFAAgF;AAChF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;IACtC,uDAAuD;IACvD,SAAS,EAAE,MAAM,MAAM,EAAE,CAAA;IACzB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,MAAM,GAAG,IAAI,CAAA;IAC7B,+CAA+C;IAC/C,OAAO,EAAE,MAAM,MAAM,EAAE,CAAA;IACvB;;;;;OAKG;IACH,MAAM,EAAE,CAAC,QAAQ,EAAE,iBAAiB,KAAK,IAAI,CAAA;CAC9C"}

package/build/manager/plugins/re-captcha/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/manager/plugins/re-captcha/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/manager/plugins/re-captcha/types.ts"],"names":[],"mappings":""}

package/build/manager/plugins/re-captcha/verifier.d.ts

@@ -0,0 +1,12 @@
+import type { BasicConfig, BasicContext } from '@owlmeans/context';
+import type { ReCaptchaVerifierOptions, ReCaptchaVerifierService } from './types.js';
+/**
+ * The default verifier: one form POST to Google's siteverify. It holds no state and never touches
+ * its context, so the plugin may also run it unregistered.
+ *
+ * @throws {SyntaxError} for a siteverify address that is not https.
+ */
+export declare const createReCaptchaVerifierService: (alias?: string, options?: ReCaptchaVerifierOptions) => ReCaptchaVerifierService;
+/** Register a verifier (the default siteverify call unless `options` say otherwise). */
+export declare const appendReCaptchaVerifierService: <C extends BasicConfig, T extends BasicContext<C>>(context: T, alias?: string, options?: ReCaptchaVerifierOptions) => T;
+//# sourceMappingURL=verifier.d.ts.map

package/build/manager/plugins/re-captcha/verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../../../src/manager/plugins/re-captcha/verifier.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAGlE,OAAO,KAAK,EAAqB,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAIvG;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,WAClC,MAAM,YAAgC,wBAAwB,KACpE,wBA+CF,CAAA;AAED,wFAAwF;AACxF,eAAO,MAAM,8BAA8B,GAAI,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,WACpF,CAAC,UAAS,MAAM,YAAiC,wBAAwB,KACjF,CAIF,CAAA"}

package/build/manager/plugins/re-captcha/verifier.js

@@ -0,0 +1,62 @@
+import { AuthUnavailable } from '@owlmeans/auth';
+import { createService } from '@owlmeans/context';
+import { logger } from '@owlmeans/log';
+import { RECAPTCHA_SITEVERIFY_URL, RECAPTCHA_VERIFIER, RECAPTCHA_VERIFY_TIMEOUT } from './consts.js';
+const log = logger('server-auth:re-captcha');
+/**
+ * The default verifier: one form POST to Google's siteverify. It holds no state and never touches
+ * its context, so the plugin may also run it unregistered.
+ *
+ * @throws {SyntaxError} for a siteverify address that is not https.
+ */
+export const createReCaptchaVerifierService = (alias = RECAPTCHA_VERIFIER, options = {}) => {
+    const url = options.url ?? RECAPTCHA_SITEVERIFY_URL;
+    if (!url.startsWith('https://')) {
+        throw new SyntaxError(`reCAPTCHA siteverify must be https: ${url}`);
+    }
+    const timeout = options.timeout ?? RECAPTCHA_VERIFY_TIMEOUT;
+    /** The answer, when it has the shape of one. */
+    const readAnswer = async (response) => {
+        try {
+            const answer = await response.json();
+            return answer != null && typeof answer === 'object' && typeof answer.success === 'boolean' ? answer : null;
+        }
+        catch {
+            return null;
+        }
+    };
+    return createService(alias, {
+        verify: async (request) => {
+            const body = new URLSearchParams({ secret: request.secret, response: request.response });
+            if (request.remoteip != null && request.remoteip !== '') {
+                body.set('remoteip', request.remoteip);
+            }
+            const send = options.fetch ?? fetch;
+            let response;
+            try {
+                response = await send(url, {
+                    method: 'POST',
+                    headers: { 'content-type': 'application/x-www-form-urlencoded' },
+                    body,
+                    signal: AbortSignal.timeout(timeout),
+                });
+            }
+            catch (error) {
+                log.warn('reCAPTCHA siteverify unreachable', { error }, { event: 'auth.recaptcha.unavailable' });
+                throw new AuthUnavailable('recaptcha');
+            }
+            const answer = response.ok ? await readAnswer(response) : null;
+            if (answer == null) {
+                log.warn('reCAPTCHA siteverify answered unusably', { status: response.status }, { event: 'auth.recaptcha.unavailable' });
+                throw new AuthUnavailable('recaptcha');
+            }
+            return answer;
+        },
+    });
+};
+/** Register a verifier (the default siteverify call unless `options` say otherwise). */
+export const appendReCaptchaVerifierService = (context, alias = RECAPTCHA_VERIFIER, options) => {
+    context.registerService(createReCaptchaVerifierService(alias, options));
+    return context;
+};
+//# sourceMappingURL=verifier.js.map

package/build/manager/plugins/re-captcha/verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../../../src/manager/plugins/re-captcha/verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AACtC,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAGpG,MAAM,GAAG,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAA;AAE5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,KAAK,GAAW,kBAAkB,EAAE,OAAO,GAA6B,EAAE,EAChD,EAAE;IAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,wBAAwB,CAAA;IACnD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,WAAW,CAAC,uCAAuC,GAAG,EAAE,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,wBAAwB,CAAA;IAE3D,gDAAgD;IAChD,MAAM,UAAU,GAAG,KAAK,EAAE,QAAkB,EAAqC,EAAE;QACjF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA8B,CAAA;YAChE,OAAO,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;QAC5G,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC,CAAA;IAED,OAAO,aAAa,CAA2B,KAAK,EAAE;QACpD,MAAM,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACtB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;YACxF,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,IAAI,OAAO,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;gBACxD,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YAED,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAA;YACnC,IAAI,QAAkB,CAAA;YACtB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE;oBACzB,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;oBAChE,IAAI;oBACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;iBACrC,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,GAAG,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAA;gBAChG,MAAM,IAAI,eAAe,CAAC,WAAW,CAAC,CAAA;YACxC,CAAC;YAED,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YAC9D,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,GAAG,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAA;gBACxH,MAAM,IAAI,eAAe,CAAC,WAAW,CAAC,CAAA;YACxC,CAAC;YAED,OAAO,MAAM,CAAA;QACf,CAAC;KACF,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,wFAAwF;AACxF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,OAAU,EAAE,KAAK,GAAW,kBAAkB,EAAE,OAAkC,EAC/E,EAAE;IACL,OAAO,CAAC,eAAe,CAAC,8BAA8B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAA;IAEvE,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}