@owlmeans/server-iam 0.1.18-rc.7 → 0.1.18

package/tests/context.ts

@@ -0,0 +1,100 @@
+import { AppType, createService, makeBasicContext } from '@owlmeans/context'
+import type { BasicContext } from '@owlmeans/context'
+import { createStaticResource } from '@owlmeans/static-resource'
+import type { Resource } from '@owlmeans/resource'
+import { AUTH_CACHE } from '@owlmeans/server-auth'
+import { AuthRole } from '@owlmeans/auth'
+import type { Auth } from '@owlmeans/auth'
+import type { AbstractRequest } from '@owlmeans/entrypoint'
+import type { OidcOrganizationClaim, OidcPermissionSetClaim, OidcProviderConfig } from '@owlmeans/oidc'
+import { DEFAULT_ALIAS, OIDC_TOKEN_STORE } from '@owlmeans/server-oidc-rp'
+import type {
+  Config, Context, OIDCAuthCache, OidcClientAdapter, OidcClientService, OidcServerMetadata,
+} from '@owlmeans/server-oidc-rp'
+
+export const CLIENT = 'acme-preview'
+export const ISSUER = 'https://iam.example.test/oidc'
+export const ACCESS_TOKEN = 'provider-access-token'
+
+export const ACME: OidcOrganizationClaim = { entitySlug: 'acme', entityKey: 'acme-key', owner: true, home: true, groups: ['admins'] }
+export const BETA: OidcOrganizationClaim = { entitySlug: 'beta', entityKey: 'beta-key', owner: false, title: 'Beta' }
+export const SETS: OidcPermissionSetClaim[] = [{ scope: CLIENT, permissions: { 'order--edit': true }, entitySlug: 'acme' }]
+
+export interface Provider {
+  /** What discovery answers; mutable so a spec can take the runtime field away. */
+  metadata: Record<string, unknown>
+  getClientCalls: number
+}
+
+/** The relying party's view of the provider: discovery metadata, nothing else is reached. */
+const makeProviderClientService = (provider: Provider, config: OidcProviderConfig): OidcClientService => {
+  const adapter: OidcClientAdapter = {
+    getMetadata: () => ({ issuer: ISSUER, ...provider.metadata }) as OidcServerMetadata,
+    getClientId: () => CLIENT,
+    getConfig: () => config,
+    makeAuthUrl: () => { throw new Error('no authorization in this spec') },
+    grantWithCredentials: async () => { throw new Error('no grant in this spec') },
+    grantWithCode: async () => { throw new Error('no grant in this spec') },
+    refresh: async () => { throw new Error('no refresh in this spec') },
+    introspect: async () => { throw new Error('no introspection in this spec') },
+    userinfo: async () => { throw new Error('no userinfo in this spec') },
+  }
+
+  return createService<OidcClientService>(DEFAULT_ALIAS, {
+    getConfiguration: async () => { throw new Error('no discovery in this spec') },
+    getClient: async () => {
+      provider.getClientCalls++
+      return adapter
+    },
+    getConfig: async () => config,
+    getDefault: () => CLIENT,
+    registerTemporaryProvider: cfg => cfg,
+    unregisterTemporaryProvider: () => undefined,
+    hasProvider: () => true,
+    entityToClientId: () => CLIENT,
+    providerApi: () => null,
+    accountLinking: () => null,
+    findProvider: () => config,
+  })
+}
+
+export const start = async (metadata: Record<string, unknown> = {}) => {
+  const config: OidcProviderConfig = { clientId: CLIENT, secret: 'client-secret', discoveryUrl: ISSUER }
+  const provider: Provider = { metadata, getClientCalls: 0 }
+
+  const context = makeBasicContext({
+    ready: false, service: 'server-iam-session-tests', type: AppType.Backend, oidc: { providers: [config] },
+  } as unknown as Config) as unknown as BasicContext<Config>
+  context.registerResource(createStaticResource(AUTH_CACHE, 'server-iam-session-cache'))
+  context.registerService(makeProviderClientService(provider, config))
+  context.configure()
+  await context.init()
+
+  return { context: context as unknown as Context, provider }
+}
+
+/** Seeds the `:token:` record a signed-in session of a tenanted client has, as the relying party writes it. */
+export const seedSession = async (context: Context, token: string, record: Partial<OIDCAuthCache> = {}) => {
+  await context.resource<Resource<OIDCAuthCache>>(AUTH_CACHE).save({
+    id: `${OIDC_TOKEN_STORE}:token:${token}`,
+    client: CLIENT,
+    payload: { access_token: ACCESS_TOKEN, token_type: 'Bearer' },
+    acting: ACME.entityKey,
+    entity: { id: ACME.entityKey, slug: ACME.entitySlug, iamKey: ACME.entityKey },
+    organizations: [ACME, BETA],
+    sets: SETS,
+    ...record,
+  } as OIDCAuthCache)
+}
+
+export const requestOf = (token?: string): AbstractRequest => ({
+  alias: 'test', path: '/', params: {}, query: {}, headers: {},
+  ...(token != null
+    ? {
+      auth: {
+        type: 'oidc-wrapped-token', token, userId: 'acme-preview:subject', role: AuthRole.User,
+        scopes: [], entitySlug: ACME.entitySlug, isUser: true, createdAt: new Date(),
+      } satisfies Auth,
+    }
+    : {}),
+}) as unknown as AbstractRequest

package/tests/gate.spec.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from 'bun:test'
-import { AppType, Layer, makeBasicContext } from '@owlmeans/context'
+import { AppType, makeBasicContext } from '@owlmeans/context'
 import type { BasicConfig } from '@owlmeans/context'
 import type { AbstractRequest, AbstractResponse, GateService } from '@owlmeans/entrypoint'
 import type { Auth } from '@owlmeans/auth'
@@ -11,7 +11,6 @@ const makeGate = async (): Promise<GateService> => {
   const ctx = makeBasicContext<BasicConfig>({
     ready: false,
     service: 'server-iam-tests',
-    layer: Layer.Service,
     type: AppType.Backend,
   })
   ctx.registerService(makeIamGate())
@@ -21,12 +20,16 @@ const makeGate = async (): Promise<GateService> => {
   return ctx.service<GateService>(OIDC_GATE)
 }
 
-const makeRequest = (params: Record<string, string> = {}): AbstractRequest => ({
+const makeRequest = (
+  params: Record<string, string> = {},
+  rest: Partial<Pick<AbstractRequest, 'query' | 'body' | 'headers'>> = {}
+): AbstractRequest => ({
   alias: 'test',
   headers: {},
   params,
   query: {},
   body: {},
+  ...rest,
   path: '/',
   auth: {
     type: 'oidc-wrapped-token',
@@ -34,7 +37,7 @@ const makeRequest = (params: Record<string, string> = {}): AbstractRequest => ({
     userId: 'user-1',
     role: AuthRole.User,
     scopes: [],
-    entityId: 'entity-1',
+    entitySlug: 'entity-1',
     isUser: true,
     createdAt: new Date(),
     permissions: [
@@ -72,4 +75,129 @@ describe('@owlmeans/server-iam — makeIamGate (claims mode)', () => {
       gate.assert(makeRequest({ depId: 'dep-87654321' }), res, ['department--modify@depId'])
     ).rejects.toBeInstanceOf(AuthForbidden)
   })
+
+  test('resolves a resource id from an explicitly named source', async () => {
+    const gate = await makeGate()
+    await gate.assert(
+      makeRequest({}, { body: { department: { id: 'dep-12345678' } } }), res,
+      ['department--modify@body:department.id']
+    )
+  })
+
+  test('resolves a resource id from the auth object', async () => {
+    const gate = await makeGate()
+    // `entity-1` is this subject's own organization slug, and the unscoped grant covers every resource.
+    await gate.assert(makeRequest(), res, ['article--modify@auth:entitySlug'])
+  })
+
+  /**
+   * Params are OR'd, so a param the gate cannot even evaluate must contribute nothing. Letting one
+   * throw would turn a typo in an unrelated sibling into a denial of a grant the subject really has.
+   */
+  test('a malformed param does not refuse a sibling that passes', async () => {
+    const gate = await makeGate()
+    await gate.assert(makeRequest(), res, ['article--modify@cookies:sid', 'article--modify'])
+  })
+
+  test('an unresolvable selector refuses without breaking the OR', async () => {
+    const gate = await makeGate()
+    await gate.assert(makeRequest(), res, ['department--modify@missingParam', 'article--modify'])
+
+    expect(
+      gate.assert(makeRequest(), res, ['department--modify@missingParam'])
+    ).rejects.toBeInstanceOf(AuthForbidden)
+  })
+
+  /**
+   * The stored grant is keyed `department--modify`; the gate splits the selector off before looking
+   * it up. A grant written under the whole string — the corruption this grammar exists to stop —
+   * is a key nothing reads.
+   */
+  test('a permission granted WITH the selector in its name never satisfies the gate', async () => {
+    const gate = await makeGate()
+    const req = makeRequest({ depId: 'dep-1' })
+    ;(req.auth as unknown as Auth).permissions = [
+      { scope: 'my-project', permissions: { 'department--modify@depId': true } }
+    ]
+
+    expect(
+      gate.assert(req, res, ['department--modify@depId'])
+    ).rejects.toBeInstanceOf(AuthForbidden)
+  })
+})
+
+/**
+ * The four permission kinds, as a relying party hands them to the gate. Normally the relying party
+ * strips the binding of the acting organization's sets and drops every other bound set; a bound set
+ * in a token is therefore a leak, and the gate applies it only in its own organization.
+ */
+describe('@owlmeans/server-iam — makeIamGate and the acting organization', () => {
+  const CLIENT = 'acme-preview'
+
+  const kindsRequest = (opts: {
+    entitySlug?: string
+    entity?: { id: string, slug: string }
+    params?: Record<string, string>
+  }): AbstractRequest => ({
+    alias: 'kinds',
+    headers: {},
+    params: opts.params ?? {},
+    query: {},
+    body: {},
+    path: '/',
+    ...(opts.entity != null ? { entity: { ...opts.entity, iamKey: opts.entity.id } } : {}),
+    auth: {
+      type: 'oidc-wrapped-token',
+      token: 'test',
+      userId: 'user-1',
+      role: AuthRole.User,
+      scopes: [],
+      ...(opts.entitySlug != null ? { entitySlug: opts.entitySlug } : {}),
+      isUser: true,
+      createdAt: new Date(),
+      permissions: [
+        // unbound
+        { scope: CLIENT, permissions: { 'report--view': true } },
+        // entity-bound
+        { scope: CLIENT, permissions: { 'order--edit': true }, entitySlug: 'acme' },
+        // resource-bound
+        { scope: CLIENT, title: 'department--modify', permissions: { 'department--modify': true }, resources: ['dep-1'] },
+        // both
+        {
+          scope: CLIENT, title: 'order--delete', permissions: { 'order--delete': true },
+          resources: ['ord-1'], entitySlug: 'acme',
+        },
+        // the per-organization marker, granted against the organization's stable id
+        { scope: CLIENT, permissions: { 'tenant-0123456789abcdef01234567--admin': true } },
+      ],
+    } as Auth,
+  }) as unknown as AbstractRequest
+
+  test.each([
+    ['unbound: applies in any organization', 'report--view', { entitySlug: 'beta' }, true],
+    ['unbound: applies with no organization at all', 'report--view', {}, true],
+    ['entity-bound: applies in its organization', 'order--edit', { entitySlug: 'acme' }, true],
+    ['entity-bound: refused in another organization', 'order--edit', { entitySlug: 'beta' }, false],
+    ['entity-bound: refused with no organization (fail-closed)', 'order--edit', {}, false],
+    ['resource-bound: the granted record', 'department--modify@depId', { entitySlug: 'beta', params: { depId: 'dep-1' } }, true],
+    ['resource-bound: another record', 'department--modify@depId', { entitySlug: 'acme', params: { depId: 'dep-2' } }, false],
+    ['both: its organization and its record', 'order--delete@id', { entitySlug: 'acme', params: { id: 'ord-1' } }, true],
+    ['both: its organization, another record', 'order--delete@id', { entitySlug: 'acme', params: { id: 'ord-2' } }, false],
+    ['both: its record, another organization', 'order--delete@id', { entitySlug: 'beta', params: { id: 'ord-1' } }, false],
+    // The guard-attached entity is what the request acts in; the token's slug is the fallback.
+    ['the attached entity wins over the token slug', 'order--edit',
+      { entitySlug: 'beta', entity: { id: 'acme-key', slug: 'acme' } }, true],
+    ['the attached entity refuses another organization', 'order--edit',
+      { entitySlug: 'acme', entity: { id: 'beta-key', slug: 'beta' } }, false],
+    ['{entity} is still the attached entity id', 'tenant-{entity}--admin',
+      { entity: { id: '0123456789abcdef01234567', slug: 'acme' } }, true],
+  ] as const)('%s', async (_, param, opts, granted) => {
+    const gate = await makeGate()
+    const attempt = gate.assert(kindsRequest(opts), res, [param])
+    if (granted) {
+      await attempt
+    } else {
+      await expect(attempt).rejects.toBeInstanceOf(AuthForbidden)
+    }
+  })
 })

package/tests/organization.spec.ts

@@ -0,0 +1,52 @@
+import { describe, expect, test } from 'bun:test'
+import { AuthForbidden, AuthorizationError } from '@owlmeans/auth'
+import { ORGANIZATION_REFUSAL } from '@owlmeans/oidc'
+import { makeOrganizationScope } from '@owlmeans/server-iam'
+import { ACME, BETA, requestOf, seedSession, start } from './context.js'
+
+describe('@owlmeans/server-iam — organizations of the session', () => {
+  test('organizationsOf answers every claimed organization as a request entity keyed by its IAM key', async () => {
+    const { context } = await start()
+    await seedSession(context, 'session-1')
+
+    expect(await makeOrganizationScope(context, requestOf('session-1')).organizationsOf()).toEqual([
+      { id: ACME.entityKey, slug: ACME.entitySlug, iamKey: ACME.entityKey },
+      { id: BETA.entityKey, slug: BETA.entitySlug, iamKey: BETA.entityKey },
+    ])
+  })
+
+  test('organizationOf resolves one by slug — not only the acting one', async () => {
+    const { context } = await start()
+    await seedSession(context, 'session-2')
+
+    expect(await makeOrganizationScope(context, requestOf('session-2')).organizationOf('beta'))
+      .toEqual({ id: 'beta-key', slug: 'beta', iamKey: 'beta-key' })
+  })
+
+  test('an organization the subject is not in is refused', async () => {
+    const { context } = await start()
+    await seedSession(context, 'session-3')
+
+    const attempt = makeOrganizationScope(context, requestOf('session-3')).organizationOf('gamma')
+    await expect(attempt).rejects.toBeInstanceOf(AuthForbidden)
+    await expect(attempt).rejects.toThrow(ORGANIZATION_REFUSAL)
+  })
+
+  /** A client without the organizations scope keeps no acting organization: there is nothing to resolve. */
+  test('a session that acts in no organization has none', async () => {
+    const { context } = await start()
+    await seedSession(context, 'session-4', { acting: undefined, entity: undefined })
+
+    expect(await makeOrganizationScope(context, requestOf('session-4')).organizationsOf()).toEqual([])
+    await expect(makeOrganizationScope(context, requestOf('session-4')).organizationOf('acme')).rejects.toBeInstanceOf(AuthForbidden)
+  })
+
+  test('a request without authentication, or whose session is gone, is a 401', async () => {
+    const { context } = await start()
+
+    await expect(makeOrganizationScope(context, requestOf()).organizationsOf()).rejects.toBeInstanceOf(AuthorizationError)
+    const gone = makeOrganizationScope(context, requestOf('never-signed-in')).organizationOf('acme')
+    await expect(gone).rejects.toBeInstanceOf(AuthorizationError)
+    await expect(gone).rejects.not.toBeInstanceOf(AuthForbidden)
+  })
+})

package/tests/runtime.spec.ts

@@ -0,0 +1,169 @@
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test'
+import type { Server } from 'bun'
+import { AuthForbidden, AuthorizationError } from '@owlmeans/auth'
+import { ResilientError } from '@owlmeans/error'
+import { IAM_API_METADATA, ORGANIZATION_OWNER_REFUSAL, ORGANIZATION_REFUSAL } from '@owlmeans/oidc'
+import { IamClientError, IamError, IamGrantMode, IamGrantOrigin } from '@owlmeans/iam'
+import { makeIamRuntimeClient } from '@owlmeans/server-iam'
+import type { IamRuntimeClient } from '@owlmeans/server-iam'
+import { ACCESS_TOKEN, requestOf, seedSession, start } from './context.js'
+
+/**
+ * The runtime client against a stand-in for the provider's runtime API, served on an OS-assigned
+ * port. The stand-in records what reached it and answers whatever `answer` says for the path.
+ */
+interface Seen {
+  method: string
+  path: string
+  query: Record<string, string>
+  authorization: string | null
+  body?: unknown
+}
+
+const seen: Seen[] = []
+let answer: (seen: Seen) => Response = () => Response.json({ items: [] })
+let server: Server<undefined>
+let base: string
+
+beforeAll(() => {
+  server = Bun.serve({
+    port: 0,
+    hostname: '127.0.0.1',
+    fetch: async request => {
+      const url = new URL(request.url)
+      const text = request.method === 'POST' ? await request.text() : ''
+      const entry: Seen = {
+        method: request.method,
+        path: url.pathname,
+        query: Object.fromEntries(url.searchParams),
+        authorization: request.headers.get('authorization'),
+        ...(text !== '' ? { body: JSON.parse(text) } : {}),
+      }
+      seen.push(entry)
+      return answer(entry)
+    },
+  })
+  base = `http://127.0.0.1:${server.port}/iam/api/runtime`
+})
+
+afterAll(() => server.stop(true))
+
+const lastSeen = (): Seen => seen[seen.length - 1]
+
+const runtimeOf = async (token: string, metadata?: Record<string, unknown>) => {
+  const env = await start(metadata ?? { [IAM_API_METADATA]: `${base}/` })
+  await seedSession(env.context, token)
+
+  return { ...env, client: makeIamRuntimeClient(env.context, requestOf(token)) }
+}
+
+describe('@owlmeans/server-iam — iamRuntime', () => {
+  test('calls the base the provider advertises, as the session subject', async () => {
+    const { client } = await runtimeOf('runtime-1')
+    answer = () => Response.json({ items: [{ entitySlug: 'acme', owner: true, home: true }] })
+
+    expect(await client.organizations.list()).toEqual([{ entitySlug: 'acme', owner: true, home: true }])
+    expect(lastSeen()).toEqual({
+      method: 'GET', path: '/iam/api/runtime/organizations', query: {}, authorization: `Bearer ${ACCESS_TOKEN}`,
+    })
+  })
+
+  test('discovery is read once per client', async () => {
+    const { client, provider } = await runtimeOf('runtime-2')
+    answer = () => Response.json({ items: [] })
+
+    await client.organizations.list()
+    await client.members.list('acme')
+    await client.permissions.list('acme')
+    expect(provider.getClientCalls).toBe(1)
+  })
+
+  test.each([
+    ['create', (c: Client) => c.organizations.create({ title: 'Gamma' }), 'POST', '/organizations', { title: 'Gamma' }],
+    ['update', (c: Client) => c.organizations.update('acme', { title: 'Acme' }), 'POST', '/organizations/acme', { title: 'Acme' }],
+    ['add', (c: Client) => c.members.add('acme', { email: 'a@example.test', owner: false }),
+      'POST', '/organizations/acme/members', { email: 'a@example.test', owner: false }],
+    ['member update', (c: Client) => c.members.update('acme', 'acme-preview:sub', { groups: ['staff'] }),
+      'POST', '/organizations/acme/members/acme-preview%3Asub', { groups: ['staff'] }],
+    ['remove', (c: Client) => c.members.remove('acme', 'acme-preview:sub'),
+      'POST', '/organizations/acme/members/acme-preview%3Asub/remove', {}],
+    ['assign', (c: Client) => c.grants.assign('acme', { profileId: 'acme-preview:sub', permission: 'order--edit' }),
+      'POST', '/organizations/acme/grants', { profileId: 'acme-preview:sub', permission: 'order--edit' }],
+    ['revoke', (c: Client) => c.grants.revoke('acme', {
+      profileId: 'acme-preview:sub', permission: 'order--edit', mode: IamGrantMode.All,
+    }), 'POST', '/organizations/acme/grants/revoke', { profileId: 'acme-preview:sub', permission: 'order--edit', mode: 'all' }],
+  ] as const)('%s: method, path and body', async (_, run, method, path, body) => {
+    const { client } = await runtimeOf(`runtime-call-${path}`)
+    answer = () => Response.json({ ok: true, entitySlug: 'acme', owner: true, profileId: 'acme-preview:sub', groups: [] })
+
+    await run(client)
+    expect(lastSeen()).toMatchObject({ method, path: `/iam/api/runtime${path}`, body, authorization: `Bearer ${ACCESS_TOKEN}` })
+  })
+
+  test('a grant listing sends its filter as the query and answers the items', async () => {
+    const { client } = await runtimeOf('runtime-3')
+    const grant = { profileId: 'acme-preview:sub', permission: 'order--edit', origin: IamGrantOrigin.Group, through: 'staff' }
+    answer = () => Response.json({ items: [grant] })
+
+    expect(await client.grants.list('acme', { profileId: 'acme-preview:sub' })).toEqual([grant])
+    expect(lastSeen()).toMatchObject({ method: 'GET', path: '/iam/api/runtime/organizations/acme/grants', query: { profileId: 'acme-preview:sub' } })
+  })
+
+  test('a bare 403 on an owner route is the owner refusal, on a member route the organization refusal', async () => {
+    const { client } = await runtimeOf('runtime-4')
+    answer = () => new Response('incident-1', { status: 403, headers: { 'X-Incident-ID': 'incident-1' } })
+
+    const write = client.members.add('acme', { email: 'a@example.test' })
+    await expect(write).rejects.toBeInstanceOf(AuthForbidden)
+    await expect(write).rejects.toThrow(ORGANIZATION_OWNER_REFUSAL)
+    await expect(write.catch(error => error.incidentId)).resolves.toBe('incident-1')
+
+    const read = client.members.list('beta')
+    await expect(read).rejects.toBeInstanceOf(AuthForbidden)
+    await expect(read.catch(error => (error as Error).message.includes(ORGANIZATION_OWNER_REFUSAL))).resolves.toBe(false)
+    await expect(read).rejects.toThrow(ORGANIZATION_REFUSAL)
+  })
+
+  test('a marshalled error is rebuilt into its own class', async () => {
+    const { client } = await runtimeOf('runtime-5')
+    const marshalled = ResilientError.marshal(new AuthForbidden(ORGANIZATION_OWNER_REFUSAL)).message
+    answer = () => new Response(marshalled, { status: 403 })
+
+    const attempt = client.grants.assign('acme', { profileId: 'acme-preview:sub', permission: 'order--edit' })
+    await expect(attempt).rejects.toBeInstanceOf(AuthForbidden)
+    await expect(attempt).rejects.toThrow(ORGANIZATION_OWNER_REFUSAL)
+  })
+
+  test('a 401 is a session to sign in again; any other failure an IAM error', async () => {
+    const { client } = await runtimeOf('runtime-6')
+
+    answer = () => new Response('incident-2', { status: 401 })
+    const unauthorized = client.organizations.list()
+    await expect(unauthorized).rejects.toBeInstanceOf(AuthorizationError)
+    await expect(unauthorized).rejects.not.toBeInstanceOf(AuthForbidden)
+
+    answer = () => new Response('incident-3', { status: 502 })
+    await expect(client.organizations.list()).rejects.toBeInstanceOf(IamError)
+  })
+
+  test('a provider that advertises no runtime API is a client error, and is asked again next time', async () => {
+    const { client, provider } = await runtimeOf('runtime-7', {})
+
+    await expect(client.organizations.list()).rejects.toBeInstanceOf(IamClientError)
+    provider.metadata[IAM_API_METADATA] = base
+    answer = () => Response.json({ items: [] })
+    expect(await client.organizations.list()).toEqual([])
+    expect(provider.getClientCalls).toBe(2)
+  })
+
+  test('a session without a provider token is refused before anything is sent', async () => {
+    const env = await start({ [IAM_API_METADATA]: base })
+    await seedSession(env.context, 'runtime-8', { payload: { token_type: 'Bearer' } })
+    const before = seen.length
+
+    await expect(makeIamRuntimeClient(env.context, requestOf('runtime-8')).organizations.list()).rejects.toBeInstanceOf(AuthForbidden)
+    expect(seen.length).toBe(before)
+  })
+})
+
+type Client = IamRuntimeClient

package/tests/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "extends": [
+    "@owlmeans/dep-config/tsconfig.base.json",
+    "@owlmeans/dep-config/tsconfig.node.json"
+  ],
+  "compilerOptions": {
+    "types": ["bun"],
+    "rootDir": "../",
+    "noEmit": true
+  },
+  "include": ["./**/*", "../src/**/*"]
+}