@owlmeans/server-auth 0.1.18-rc.8 → 0.1.18

package/build/service.js

@@ -2,12 +2,72 @@ import { TRUSTED } from '@owlmeans/config';
 import { AUTH_CACHE, AUTH_SRV_KEY, AUTHEN_TIMEFRAME, DEFAULT_ALIAS } from './consts.js';
 import { assertContext, createService } from '@owlmeans/context';
 import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope';
-import { AuthenFailed, AuthorizationError, AuthroizationType } from '@owlmeans/auth';
+import { AuthenFailed, AuthenticationType, AuthorizationError, AuthroizationType, AuthUnavailable } from '@owlmeans/auth';
 import { createStaticResource } from '@owlmeans/static-resource';
 import { trust, extractAuthToken } from '@owlmeans/auth-common/utils';
+import { ENTITY_RESOLVER, TOKEN_UPDATE } from '@owlmeans/auth-common';
+import { AUTH_IDENTITY_PROFILE } from '@owlmeans/server-auth-identity';
+import { appendMemoryAuthSessionManager, AUTH_SESSION_MANAGER, AUTH_SESSION_TTL } from '@owlmeans/server-auth-session';
+import { idHelper } from '@owlmeans/basic-ids';
+import { logger } from '@owlmeans/log';
+const log = logger('server-auth');
 export const makeAuthService = (alias = DEFAULT_ALIAS) => {
+    /**
+     * A refused token exchange — the manager's token presented to open a session. Logged with the
+     * reason and the account id only; returns the error for the caller to throw.
+     */
+    const refuse = (reason, error, userId) => {
+        const accountId = userId == null ? undefined
+            : userId.includes('@') ? `*@${userId.slice(userId.lastIndexOf('@') + 1)}` : userId;
+        log.warn('Session exchange refused', { reason, ...(accountId != null ? { accountId } : {}) }, { event: 'auth.refused' });
+        return error;
+    };
     const location = `server-auth:${alias}`;
     const cache = (context) => context.resource(AUTH_CACHE);
+    const sessions = (context) => context.hasService(AUTH_SESSION_MANAGER)
+        ? context.service(AUTH_SESSION_MANAGER)
+        : null;
+    const entityIdFor = async (context, entitySlug) => {
+        if (entitySlug == null || entitySlug === '')
+            return null;
+        if (!context.hasService(ENTITY_RESOLVER))
+            return entitySlug;
+        const entity = await context.service(ENTITY_RESOLVER).resolve(entitySlug);
+        return entity?.id ?? null;
+    };
+    const refresh = async (context, auth, version) => {
+        const entityId = await entityIdFor(context, auth.entitySlug);
+        if (entityId == null || auth.profileId == null || !context.hasResource(AUTH_IDENTITY_PROFILE))
+            return null;
+        const profiles = context.resource(AUTH_IDENTITY_PROFILE);
+        let profile = null;
+        try {
+            profile = await profiles.load({ entityId, profileId: auth.profileId });
+        }
+        catch {
+            // A missing profile is a definitive authentication refusal; a failed profile store is an
+            // availability dependency and must not look like a revoked browser session.
+            throw new AuthUnavailable('identity-profile');
+        }
+        if (profile == null || (profile.expiresAt != null && new Date(profile.expiresAt).getTime() <= Date.now()))
+            return null;
+        return {
+            ...auth,
+            userId: profile.userId ?? auth.userId,
+            role: profile.role,
+            scopes: profile.scopes ?? [],
+            ...(profile.permissions != null ? { permissions: profile.permissions } : {}),
+            authorizationVersion: version,
+            createdAt: new Date()
+        };
+    };
+    const sign = async (context, auth) => {
+        const trusted = await trust(context, TRUSTED, context.cfg.alias ?? context.cfg.service);
+        const ttl = auth.expiresAt == null ? AUTH_SESSION_TTL : Math.max(0, new Date(auth.expiresAt).getTime() - Date.now());
+        const authorization = await makeEnvelopeModel(AuthroizationType.Ed25519BasicToken)
+            .send(auth, ttl).sign(trusted.key, EnvelopeKind.Token);
+        return `${AuthroizationType.Ed25519BasicToken.toUpperCase()} ${authorization}`;
+    };
     const service = createService(alias, {
         match: async (req) => extractAuthToken(req, AuthroizationType.Ed25519BasicToken) != null,
         handle: async (req, res) => {
@@ -21,7 +81,32 @@ export const makeAuthService = (alias = DEFAULT_ALIAS) => {
             if (!await envelope.verify(trusted.key)) {
                 return false;
             }
-            res.resolve(envelope.message());
+            let auth = envelope.message();
+            const manager = sessions(context);
+            if (manager != null) {
+                if (auth.sessionId == null)
+                    return false;
+                let decision;
+                try {
+                    decision = await manager.inspect(auth.sessionId);
+                }
+                catch {
+                    // Registry availability is a security dependency. A guard cannot authenticate through it.
+                    throw new AuthUnavailable('session-registry');
+                }
+                if (decision.state !== 'active' && decision.state !== 'refresh')
+                    return false;
+                if (decision.state === 'refresh') {
+                    const refreshed = await refresh(context, auth, decision.version);
+                    if (refreshed == null)
+                        return false;
+                    auth = refreshed;
+                    const replacement = await sign(context, auth);
+                    res.responseProvider?.header(TOKEN_UPDATE, replacement);
+                    req.headers = { ...req.headers, authorization: replacement };
+                }
+            }
+            res.resolve(auth);
             return true;
         },
         unpack: async (token) => {
@@ -32,7 +117,22 @@ export const makeAuthService = (alias = DEFAULT_ALIAS) => {
             if (!await envelope.verify(trusted.key)) {
                 throw new AuthorizationError('unpack');
             }
-            return envelope.message();
+            const auth = envelope.message();
+            const manager = sessions(context);
+            if (manager != null) {
+                if (auth.sessionId == null)
+                    throw new AuthorizationError('session');
+                let decision;
+                try {
+                    decision = await manager.inspect(auth.sessionId);
+                }
+                catch {
+                    throw new AuthUnavailable('session-registry');
+                }
+                if (decision.state !== 'active')
+                    throw new AuthorizationError('session');
+            }
+            return auth;
         },
         authenticated: async () => {
             return null;
@@ -42,21 +142,28 @@ export const makeAuthService = (alias = DEFAULT_ALIAS) => {
             const envelope = makeEnvelopeModel(token.token, EnvelopeKind.Token);
             const authService = await trust(context, TRUSTED, AUTH_SRV_KEY);
             if (!await envelope.verify(authService.key)) {
-                throw new AuthenFailed();
+                throw refuse('signature', new AuthenFailed());
             }
             const credentials = envelope.message();
             const msg = credentials.challenge;
-            // @TODO This operation is not atomic in case of redis store usage and scling
+            // A reCAPTCHA token proves a solved challenge, never a person: it is spent by
+            // `makeReCaptchaGuard` on the one route that takes it and never becomes a session. Refused
+            // before the spend, so a token presented here stays usable where it belongs.
+            if (envelope.type() === AuthenticationType.ReCaptcha || credentials.type === AuthenticationType.ReCaptcha) {
+                throw refuse('guest', new AuthenFailed('guest'), credentials.userId);
+            }
             try {
                 await cache(context).create({ id: msg }, { ttl: AUTHEN_TIMEFRAME / 1000 });
             }
             catch {
-                throw new AuthenFailed();
+                throw refuse('replay', new AuthenFailed(), credentials.userId);
             }
             if (credentials.credential !== authService.user.id) {
-                throw new AuthenFailed();
+                throw refuse('issuer', new AuthenFailed(), credentials.userId);
             }
             // @TODO Move to a plugin
+            const issuedAt = Date.now();
+            const expiresAt = new Date(issuedAt + AUTH_SESSION_TTL);
             const auth = {
                 token: credentials.challenge,
                 userId: credentials.userId,
@@ -65,14 +172,27 @@ export const makeAuthService = (alias = DEFAULT_ALIAS) => {
                 type: AuthroizationType.Ed25519BasicToken,
                 source: context.cfg.service,
                 profileId: credentials.profileId,
-                entityId: credentials.entityId,
+                entitySlug: credentials.entitySlug,
                 isUser: true,
-                createdAt: new Date()
+                createdAt: new Date(issuedAt),
+                expiresAt,
+                sessionId: idHelper.uuid(),
+                authorizationVersion: 1
             };
-            const trusted = await trust(context, TRUSTED, context.cfg.alias ?? context.cfg.service);
-            const authorization = await makeEnvelopeModel(AuthroizationType.Ed25519BasicToken)
-                .send(auth, null).sign(trusted.key, EnvelopeKind.Token);
-            return { token: `${AuthroizationType.Ed25519BasicToken.toUpperCase()} ${authorization}` };
+            const manager = sessions(context);
+            if (manager != null) {
+                const entityId = await entityIdFor(context, auth.entitySlug);
+                if (entityId == null || auth.profileId == null)
+                    throw refuse('session', new AuthenFailed('session'), auth.userId);
+                const decision = await manager.register({
+                    id: auth.sessionId, kind: 'bearer', entityId, profileId: auth.profileId,
+                    issuedAt, expiresAt: expiresAt.getTime()
+                });
+                if (decision.state !== 'active')
+                    throw refuse('session', new AuthenFailed('session'), auth.userId);
+                auth.authorizationVersion = decision.version;
+            }
+            return { token: await sign(context, auth) };
         }
     });
     return service;
@@ -81,6 +201,9 @@ export const appendAuthService = (ctx, alias = DEFAULT_ALIAS) => {
     if (!ctx.hasResource(AUTH_CACHE)) {
         ctx.registerResource(createStaticResource(AUTH_CACHE));
     }
+    // Every standalone server gets an expiring process-local registry. Scaled deployments replace
+    // it with appendRedisAuthSessionManager before calling this helper.
+    appendMemoryAuthSessionManager(ctx);
     const service = makeAuthService(alias);
     const context = ctx;
     context.registerService(service);

package/build/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEvF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE1E,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAGpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAKrE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,QAAgB,aAAa,EAAe,EAAE;IAC5E,MAAM,QAAQ,GAAG,eAAe,KAAK,EAAE,CAAA;IAEvC,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAuB,EAAE,CACtD,OAAO,CAAC,QAAQ,CAAsB,UAAU,CAAC,CAAA;IAEnD,MAAM,OAAO,GAAgB,aAAa,CAAc,KAAK,EAAE;QAC7D,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,IAAI;QAEtF,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAY,CAAA;YACrD,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAA;YAChF,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAE3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxG,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;YAE/B,OAAO,IAAS,CAAA;QAClB,CAAC;QAED,MAAM,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YACpB,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YACpD,MAAM,CAAC,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAE3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxG,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YAED,OAAO,QAAQ,CAAC,OAAO,EAAE,CAAA;QAC3B,CAAC;QAED,aAAa,EAAE,KAAK,IAAI,EAAE;YACxB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YAC1B,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,EAAE,QAAQ,CAAC,CAAA;YAChF,MAAM,QAAQ,GAAG,iBAAiB,CAAkB,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAEpF,MAAM,WAAW,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;YAChF,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YACtC,MAAM,GAAG,GAAG,WAAW,CAAC,SAAS,CAAA;YAEjC,6EAA6E;YAE7E,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;YAC5E,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,IAAI,WAAW,CAAC,UAAU,KAAK,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACnD,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,yBAAyB;YACzB,MAAM,IAAI,GAAS;gBACjB,KAAK,EAAE,WAAW,CAAC,SAAS;gBAC5B,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,IAAI,EAAE,iBAAiB,CAAC,iBAAiB;gBACzC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;gBAC3B,SAAS,EAAE,WAAW,CAAC,SAAS;gBAChC,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAA;YAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxG,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAO,iBAAiB,CAAC,iBAAiB,CAAC;iBACrF,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAEzD,OAAO,EAAE,KAAK,EAAE,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,EAAE,IAAI,aAAa,EAAE,EAAE,CAAA;QAC3F,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,GAAM,EAAE,QAAgB,aAAa,EACd,EAAE;IAEzB,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAA;IACxD,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,GAA4B,CAAA;IAE5C,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAChC,OAAO,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAE/C,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEvF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAmC,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAG1J,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,EAAE,eAAe,EAA8B,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACjG,OAAO,EAAE,qBAAqB,EAAsD,MAAM,gCAAgC,CAAA;AAC1H,OAAO,EAAE,8BAA8B,EAAE,oBAAoB,EAAE,gBAAgB,EAA2B,MAAM,+BAA+B,CAAA;AAC/I,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAItC,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,CAAA;AAEjC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAK,GAAW,aAAa,EAAe,EAAE;IAC5E;;;OAGG;IACH,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,KAAmB,EAAE,MAAe,EAAgB,EAAE;QACpF,MAAM,SAAS,GAAG,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS;YAC1C,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAA;QACpF,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAA;QACxH,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IAED,MAAM,QAAQ,GAAG,eAAe,KAAK,EAAE,CAAA;IAEvC,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAuB,EAAE,CACtD,OAAO,CAAC,QAAQ,CAAsB,UAAU,CAAC,CAAA;IAEnD,MAAM,QAAQ,GAAG,CAAC,OAAgB,EAA6B,EAAE,CAC/D,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC;QACtC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAqB,oBAAoB,CAAC;QAC3D,CAAC,CAAC,IAAI,CAAA;IAEV,MAAM,WAAW,GAAG,KAAK,EAAE,OAAgB,EAAE,UAA8B,EAA0B,EAAE;QACrG,IAAI,UAAU,IAAI,IAAI,IAAI,UAAU,KAAK,EAAE;YAAE,OAAO,IAAI,CAAA;QACxD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,OAAO,UAAU,CAAA;QAC3D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QAChG,OAAO,MAAM,EAAE,EAAE,IAAI,IAAI,CAAA;IAC3B,CAAC,CAAA;IAED,MAAM,OAAO,GAAG,KAAK,EAAE,OAAgB,EAAE,IAAU,EAAE,OAAe,EAAwB,EAAE;QAC5F,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;QAC5D,IAAI,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,qBAAqB,CAAC;YAAE,OAAO,IAAI,CAAA;QAC1G,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAA0B,qBAAqB,CAAC,CAAA;QACjF,IAAI,OAAO,GAA2B,IAAI,CAAA;QAC1C,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,yFAAyF;YACzF,4EAA4E;YAC5E,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAA;QAC/C,CAAC;QACD,IAAI,OAAO,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAAE,OAAO,IAAI,CAAA;QACtH,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM;YACrC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;YAC5B,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,oBAAoB,EAAE,OAAO;YAC7B,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAA;IACH,CAAC,CAAA;IAED,MAAM,IAAI,GAAG,KAAK,EAAE,OAAgB,EAAE,IAAU,EAAmB,EAAE;QACnE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACxG,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QACpH,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAO,iBAAiB,CAAC,iBAAiB,CAAC;aACrF,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;QACxD,OAAO,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,EAAE,IAAI,aAAa,EAAE,CAAA;IAChF,CAAC,CAAA;IAED,MAAM,OAAO,GAAgB,aAAa,CAAc,KAAK,EAAE;QAC7D,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,IAAI;QAEtF,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAY,CAAA;YACrD,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAA;YAChF,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAE3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxG,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,IAAI,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YAC7B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;YACjC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI;oBAAE,OAAO,KAAU,CAAA;gBAC7C,IAAI,QAAQ,CAAA;gBACZ,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBAClD,CAAC;gBAAC,MAAM,CAAC;oBACP,0FAA0F;oBAC1F,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAA;gBAC/C,CAAC;gBACD,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS;oBAAE,OAAO,KAAU,CAAA;gBAClF,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBACjC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;oBAChE,IAAI,SAAS,IAAI,IAAI;wBAAE,OAAO,KAAU,CAAA;oBACxC,IAAI,GAAG,SAAS,CAAA;oBAChB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;oBAC7C,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;oBACvD,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,CAAA;gBAC9D,CAAC;YACH,CAAC;YAED,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAEjB,OAAO,IAAS,CAAA;QAClB,CAAC;QAED,MAAM,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YACpB,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YACpD,MAAM,CAAC,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAE3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACxG,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;YACjC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI;oBAAE,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;gBACnE,IAAI,QAAQ,CAAA;gBACZ,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBAClD,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAA;gBAC/C,CAAC;gBACD,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ;oBAAE,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;YAC1E,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,aAAa,EAAE,KAAK,IAAI,EAAE;YACxB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YAC1B,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,EAAE,QAAQ,CAAC,CAAA;YAChF,MAAM,QAAQ,GAAG,iBAAiB,CAAkB,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAEpF,MAAM,WAAW,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;YAChF,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5C,MAAM,MAAM,CAAC,WAAW,EAAE,IAAI,YAAY,EAAE,CAAC,CAAA;YAC/C,CAAC;YAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YACtC,MAAM,GAAG,GAAG,WAAW,CAAC,SAAS,CAAA;YAEjC,8EAA8E;YAC9E,2FAA2F;YAC3F,6EAA6E;YAC7E,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,kBAAkB,CAAC,SAAS,IAAI,WAAW,CAAC,IAAI,KAAK,kBAAkB,CAAC,SAAS,EAAE,CAAC;gBAC1G,MAAM,MAAM,CAAC,OAAO,EAAE,IAAI,YAAY,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;YACtE,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;YAC5E,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,YAAY,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;YAChE,CAAC;YAED,IAAI,WAAW,CAAC,UAAU,KAAK,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACnD,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,YAAY,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;YAChE,CAAC;YAED,yBAAyB;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,QAAQ,GAAG,gBAAgB,CAAC,CAAA;YACvD,MAAM,IAAI,GAAS;gBACjB,KAAK,EAAE,WAAW,CAAC,SAAS;gBAC5B,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,IAAI,EAAE,iBAAiB,CAAC,iBAAiB;gBACzC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;gBAC3B,SAAS,EAAE,WAAW,CAAC,SAAS;gBAChC,UAAU,EAAE,WAAW,CAAC,UAAU;gBAClC,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC;gBAC7B,SAAS;gBACT,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;gBAC1B,oBAAoB,EAAE,CAAC;aACxB,CAAA;YACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;YACjC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;gBAC5D,IAAI,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI;oBAAE,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;gBACjH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;oBACtC,EAAE,EAAE,IAAI,CAAC,SAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS;oBACxE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE;iBACzC,CAAC,CAAA;gBACF,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ;oBAAE,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;gBAClG,IAAI,CAAC,oBAAoB,GAAG,QAAQ,CAAC,OAAO,CAAA;YAC9C,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAA;QAC7C,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,GAAM,EAAE,KAAK,GAAW,aAAa,EACd,EAAE;IAEzB,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAA;IACxD,CAAC;IAED,8FAA8F;IAC9F,oEAAoE;IACpE,8BAA8B,CAAC,GAAG,CAAC,CAAA;IAEnC,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,GAA4B,CAAA;IAE5C,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAChC,OAAO,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAE/C,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/types.local.d.ts

@@ -0,0 +1,4 @@
+import type { ServerContext, ServerConfig } from '@owlmeans/server-context';
+export type Config = ServerConfig;
+export type Context = ServerContext<Config>;
+//# sourceMappingURL=types.local.d.ts.map

package/build/types.local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.local.d.ts","sourceRoot":"","sources":["../src/types.local.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAE3E,MAAM,MAAM,MAAM,GAAG,YAAY,CAAA;AAEjC,MAAM,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA"}

package/build/types.local.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.local.js.map

package/build/types.local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.local.js","sourceRoot":"","sources":["../src/types.local.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-auth",
-  "version": "0.1.18-rc.8",
+  "version": "0.1.18",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -36,40 +36,43 @@
     }
   },
   "dependencies": {
-    "@noble/hashes": "^1.5.0",
-    "@owlmeans/api": "^0.1.18-rc.6",
-    "@owlmeans/api-config-server": "^0.1.18-rc.8",
-    "@owlmeans/auth": "^0.1.18-rc.6",
-    "@owlmeans/auth-common": "^0.1.18-rc.6",
-    "@owlmeans/basic-envelope": "^0.1.18-rc.6",
-    "@owlmeans/basic-ids": "^0.1.18-rc.6",
-    "@owlmeans/basic-keys": "^0.1.18-rc.6",
-    "@owlmeans/client-config": "^0.1.18-rc.6",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.6",
-    "@owlmeans/config": "^0.1.18-rc.6",
-    "@owlmeans/context": "^0.1.18-rc.6",
-    "@owlmeans/kluster": "^0.1.18-rc.6",
-    "@owlmeans/entrypoint": "^0.1.18-rc.6",
-    "@owlmeans/redis-resource": "^0.1.18-rc.6",
-    "@owlmeans/resource": "^0.1.18-rc.6",
-    "@owlmeans/route": "^0.1.18-rc.6",
-    "@owlmeans/server-api": "^0.1.18-rc.8",
-    "@owlmeans/server-context": "^0.1.18-rc.6",
-    "@owlmeans/server-entrypoint": "^0.1.18-rc.6",
-    "@owlmeans/server-route": "^0.1.18-rc.6",
-    "@owlmeans/server-socket": "^0.1.18-rc.8",
-    "@owlmeans/socket": "^0.1.18-rc.6",
-    "@owlmeans/static-resource": "^0.1.18-rc.6",
-    "@scure/base": "^2.3.0"
+    "@noble/hashes": "^2.4.0",
+    "@owlmeans/api": "^0.1.18",
+    "@owlmeans/api-config-server": "^0.1.18",
+    "@owlmeans/auth": "^0.1.18",
+    "@owlmeans/auth-common": "^0.1.18",
+    "@owlmeans/basic-envelope": "^0.1.18",
+    "@owlmeans/basic-ids": "^0.1.18",
+    "@owlmeans/basic-keys": "^0.1.18",
+    "@owlmeans/client-config": "^0.1.18",
+    "@owlmeans/client-entrypoint": "^0.1.18",
+    "@owlmeans/config": "^0.1.18",
+    "@owlmeans/context": "^0.1.18",
+    "@owlmeans/kluster": "^0.1.18",
+    "@owlmeans/log": "^0.1.18",
+    "@owlmeans/entrypoint": "^0.1.18",
+    "@owlmeans/redis-resource": "^0.1.18",
+    "@owlmeans/resource": "^0.1.18",
+    "@owlmeans/route": "^0.1.18",
+    "@owlmeans/server-api": "^0.1.18",
+    "@owlmeans/server-auth-identity": "^0.1.18",
+    "@owlmeans/server-auth-session": "^0.1.18",
+    "@owlmeans/server-context": "^0.1.18",
+    "@owlmeans/server-entrypoint": "^0.1.18",
+    "@owlmeans/server-route": "^0.1.18",
+    "@owlmeans/server-socket": "^0.1.18",
+    "@owlmeans/socket": "^0.1.18",
+    "@owlmeans/static-resource": "^0.1.18",
+    "@scure/base": "^2.4.0"
   },
   "peerDependencies": {
     "ajv": "*"
   },
   "devDependencies": {
-    "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/test-auth": "^0.1.18-rc.6",
-    "@types/bun": "^1.3.14",
-    "@types/node": "^26.1.0",
+    "@owlmeans/dep-config": "^0.1.18",
+    "@owlmeans/test-auth": "^0.1.18",
+    "@types/bun": "^1.4.2",
+    "@types/node": "^26.6.4",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"
   },

package/src/actions/service.ts

@@ -1,16 +1,14 @@
-import type { RefedEntrypointHandler } from '@owlmeans/server-entrypoint'
+import { handlers } from '@owlmeans/server-api'
+import type { EntrypointProtocol } from '@owlmeans/entrypoint'
 import type { AuthToken } from '@owlmeans/auth'
-import { handleBody } from '@owlmeans/server-api'
-import { AuthServiceAppend } from '../types.js'
-import type { ServerConfig, ServerContext } from '@owlmeans/server-context'
 import { assertContext } from '@owlmeans/context'
+import type { Context } from './types.local.js'
 
-type Config = ServerConfig
-type Context = ServerContext<Config> & AuthServiceAppend
+const api = handlers<Context>()
 
-export const authenticate: RefedEntrypointHandler<AuthToken> = handleBody(
-  async (payload: AuthToken, ctx) => {
-    const context = assertContext(ctx, 'authenticate') as Context
-    return await context.auth().authenticate(payload)
-  }
-)
+export const authenticate = (protocol: EntrypointProtocol<{ body: AuthToken }, AuthToken>) =>
+  api.request(protocol, async (request, context) => {
+    const ctx = assertContext(context, 'authenticate') as Context
+
+    return await ctx.auth().authenticate(request.body)
+  })

package/src/actions/types.local.ts

@@ -0,0 +1,6 @@
+import type { ServerConfig, ServerContext } from '@owlmeans/server-context'
+import { AuthServiceAppend } from '../types.js'
+
+export type Config = ServerConfig
+
+export interface Context extends ServerContext<Config>, AuthServiceAppend {}

package/src/entrypoints.ts

@@ -0,0 +1,12 @@
+
+import { bind } from '@owlmeans/server-entrypoint'
+import type { ServerProtocolEntrypoint } from '@owlmeans/server-entrypoint'
+import { authProtocols } from '@owlmeans/auth-common'
+import type { EntrypointProtocolDeclaration } from '@owlmeans/entrypoint'
+import { authenticate } from './actions/service.js'
+
+/** Server entrypoints required by the generic authentication service. */
+export const entrypoints: ServerProtocolEntrypoint<EntrypointProtocolDeclaration>[] = [
+  bind(authProtocols.dispatcher),
+  bind(authProtocols.dispatcherAuthenticate, authenticate(authProtocols.dispatcherAuthenticate)),
+]

package/src/index.ts

@@ -1,6 +1,6 @@
-
 export type * from './types.js'
 export * from './model/index.js'
 export * from './consts.js'
-export * from './modules.js'
+export * from './entrypoints.js'
 export * from './service.js'
+export * from './re-captcha/index.js'

package/src/manager/README.md

@@ -27,18 +27,18 @@ A specialized guard service that enables authentication token relay between micr
 - **Wallet DID Authentication**: Decentralized identity authentication support
 - **Challenge Validation**: Anti-replay protection using challenge-response mechanisms
 
-### Module-Based Architecture
-The manager is built on the OwlMeans module system, providing:
+### Entrypoint-Based Architecture
+The manager is built on the OwlMeans entrypoint system, providing:
 - **Route Management**: Standardized API endpoints for authentication operations
-- **Handler Registration**: Modular request handlers for different authentication flows
-- **Guard Integration**: Automatic security enforcement at the module level
+- **Handler Registration**: Protocol-backed request handlers for different authentication flows
+- **Guard Integration**: Automatic security enforcement at the entrypoint level
 
 ## Installation
 
 This manager app is part of the `@owlmeans/server-auth` package:
 
 ```bash
-npm install @owlmeans/server-auth
+npm install @owlmeans/server-auth@^0.1.18
 ```
 
 ## API Reference
@@ -317,20 +317,16 @@ await authModel.rely(connection, authToken.auth)
 
 ### API Integration
 
-```typescript
-import { modules } from '@owlmeans/server-auth/manager'
-
-// The manager automatically registers these API endpoints:
+`main(context)` registers the manager's immutable `entrypoints` and starts the API server. For a
+custom bootstrap, register the exported collection yourself; the manager's protocols are then
+addressed through the same `context.entrypoint(protocol)` lookup as application endpoints.
 
-// POST /api/auth/init - Authentication initialization
-// POST /api/auth/authenticate - User authentication  
-// WebSocket /api/auth/rely - Authentication relay
+```typescript
+import { entrypoints, makeContext } from '@owlmeans/server-auth/manager'
 
-// Access modules for custom routing
-modules.forEach(module => {
-  console.log(`Route: ${module.getPath()}`)
-  console.log(`Method: ${module.route.method}`)
-})
+const context = makeContext(config)
+context.registerEntrypoints(entrypoints)
+await context.configure().init()
 ```
 
 ## API Endpoints
@@ -504,4 +500,4 @@ This manager app depends on:
 - [`@owlmeans/server-auth`](../../../README.md) - Parent server authentication package
 - [`@owlmeans/auth`](../../../auth/README.md) - Core authentication library
 - [`@owlmeans/client-auth`](../../../client-auth/README.md) - Client-side authentication
-- [`@owlmeans/context`](../../../context/README.md) - Context management system
+- [`@owlmeans/context`](../../../context/README.md) - Context management system

package/src/manager/actions/authenticate.ts

@@ -0,0 +1,12 @@
+import type { AuthCredentials, AuthToken } from '@owlmeans/auth'
+import type { EntrypointProtocol } from '@owlmeans/entrypoint'
+import { handlers } from '@owlmeans/server-api'
+import { makeAuthModel } from '../model.js'
+import type { AppContext, AppConfig } from '../types.js'
+
+const api = handlers<AppContext<AppConfig>>()
+
+export const authenticate = (protocol: EntrypointProtocol<{ body: AuthCredentials }, AuthToken>) =>
+  api.body(protocol, async (body, context) =>
+  await makeAuthModel(context).authenticate(body)
+)

package/src/manager/actions/index.ts

@@ -1,2 +1,4 @@
 
-export * from './manager.js'
+export * from './init.js'
+export * from './authenticate.js'
+export * from './rely.js'

package/src/manager/actions/init.ts

@@ -0,0 +1,12 @@
+import type { AllowanceRequest, AllowanceResponse } from '@owlmeans/auth'
+import type { EntrypointProtocol } from '@owlmeans/entrypoint'
+import { handlers } from '@owlmeans/server-api'
+import { makeAuthModel } from '../model.js'
+import type { AppContext, AppConfig } from '../types.js'
+
+const api = handlers<AppContext<AppConfig>>()
+
+export const authenticationInit = (protocol: EntrypointProtocol<{ body: AllowanceRequest }, AllowanceResponse>) =>
+  api.body(protocol, async (body, context) =>
+  await makeAuthModel(context).init(body)
+)

package/src/manager/actions/rely.ts

@@ -0,0 +1,12 @@
+import type { AuthToken } from '@owlmeans/auth'
+import type { EntrypointProtocol } from '@owlmeans/entrypoint'
+import { makeAuthModel } from '../model.js'
+import type { AppContext, AppConfig } from '../types.js'
+import { connection } from '@owlmeans/server-socket'
+
+export const rely = (protocol: EntrypointProtocol<{ query: Partial<AuthToken> }, undefined>) => connection(protocol,
+  // @TODO Request will contain information is there requrest 
+  // privileged or not (privileged request implies auth provider)
+  async (conn, context, request) =>
+    await makeAuthModel(context as AppContext<AppConfig>).rely(conn, request.auth)
+)

package/src/manager/consts.local.ts

@@ -0,0 +1 @@
+export const DEFAULT_SUPERVISORS = ['master', 'superuser']

package/src/manager/context.ts

@@ -27,7 +27,5 @@ export const makeContext = <C extends AppConfig, T extends AppContext<C>>(cfg: C
     appendStaticResource<C, T>(context, AUTH_CACHE)
   }
 
-  context.makeContext = (cfg => makeContext(cfg, customize)) as typeof context.makeContext
-
   return context as T
 }

package/src/manager/entrypoints.ts

@@ -0,0 +1,17 @@
+import { authProtocols } from '@owlmeans/auth-common'
+import { entrypoints as apiConfigBindings } from '@owlmeans/api-config-server'
+import { bind } from '@owlmeans/server-entrypoint'
+import { decorateEntrypoint } from '@owlmeans/entrypoint'
+import * as actions from './actions/index.js'
+import { DEFAULT_RELY } from './consts.js'
+
+const relyProtocol = decorateEntrypoint(authProtocols.rely, { guards: DEFAULT_RELY })
+
+/** Server entrypoints for the full authentication manager. */
+export const entrypoints = [
+  bind(authProtocols.authen, undefined, { intermediate: true }),
+  bind(authProtocols.init, actions.authenticationInit(authProtocols.init)),
+  bind(authProtocols.authenticate, actions.authenticate(authProtocols.authenticate)),
+  bind(relyProtocol, actions.rely(relyProtocol)),
+  ...apiConfigBindings,
+]

package/src/manager/exports.ts

@@ -5,8 +5,7 @@ export { addWebService } from '@owlmeans/client-config'
 export { service, TRUSTED } from '@owlmeans/config'
 export { AppType, assertContext } from '@owlmeans/context'
 export { klusterize } from '@owlmeans/kluster'
-export { elevate } from '@owlmeans/server-entrypoint'
-export { elevate as celevate, stab } from '@owlmeans/client-entrypoint'
+export { stab } from '@owlmeans/client-entrypoint'
 export type { RefedEntrypointHandler } from '@owlmeans/server-entrypoint'
 export { handleIntermediate, handleBody, handleRequest, handleParams } from '@owlmeans/server-api'
 export type { AbstractRequest, AbstractResponse } from '@owlmeans/entrypoint'

package/src/manager/index.ts

@@ -1,6 +1,6 @@
 export type * from './types.js'
 
-export * from './modules.js'
+export * from './entrypoints.js'
 export * from './exports.js'
 export * from './context.js'
 export * from './main.js'

package/src/manager/main.ts

@@ -1,9 +1,9 @@
 
-import { modules } from './modules.js'
+import { entrypoints } from './entrypoints.js'
 import type { AppContext, AppConfig } from './types.js'
 
 export const main = async <C extends AppConfig, T extends AppContext<C>>(ctx: T) => {
-  ctx.registerEntrypoints(modules)
+  ctx.registerEntrypoints(entrypoints)
   await ctx.configure().init()
   await ctx.getApiServer().listen()
 }