@owlmeans/server-iam 0.1.18-rc.9 → 0.1.18

package/build/organization/types.d.ts

@@ -0,0 +1,21 @@
+import type { ResolvedEntity } from '@owlmeans/entrypoint';
+import type { OIDCAuthCache } from '@owlmeans/server-oidc-rp';
+/** The organizations of one request's subject, read from its session — built once per handler. */
+export interface OrganizationScope {
+    /** The session record behind the request's wrapped token — the guard has already refreshed it. */
+    sessionOf: () => Promise<OIDCAuthCache>;
+    /**
+     * Every organization of the request's subject, as request entities keyed by their frozen IAM key.
+     *
+     * The session record is the authority — the provider's last claim, re-read on every validation —
+     * never the browser: a relying party of a tenanted client has no organization registry of its own.
+     */
+    organizationsOf: () => Promise<ResolvedEntity[]>;
+    /**
+     * One organization of the request's subject by its slug — for a handler that acts in an
+     * organization the URL names rather than in the session's acting one. One the subject is not in is
+     * refused as `AuthForbidden(ORGANIZATION_REFUSAL)`, exactly as the switch refuses it.
+     */
+    organizationOf: (entitySlug: string) => Promise<ResolvedEntity>;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/organization/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/organization/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAE7D,kGAAkG;AAClG,MAAM,WAAW,iBAAiB;IAChC,kGAAkG;IAClG,SAAS,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAA;IACvC;;;;;OAKG;IACH,eAAe,EAAE,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,CAAA;IAChD;;;;OAIG;IACH,cAAc,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAA;CAChE"}

package/build/organization/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/organization/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/organization/types.ts"],"names":[],"mappings":""}

package/build/organization.d.ts

@@ -0,0 +1,9 @@
+import type { AbstractRequest, ResolvedEntity } from '@owlmeans/entrypoint';
+import type { Config, Context } from '@owlmeans/server-oidc-rp';
+import type { OrganizationScope } from './organization/types.js';
+export declare const makeOrganizationScope: <C extends Config, T extends Context<C>>(context: T, request: AbstractRequest) => OrganizationScope;
+/** @deprecated compat:factory-refactor — use `makeOrganizationScope(context, request).organizationsOf()` */
+export declare const organizationsOf: <C extends Config, T extends Context<C>>(context: T, request: AbstractRequest) => Promise<ResolvedEntity[]>;
+/** @deprecated compat:factory-refactor — use `makeOrganizationScope(context, request).organizationOf(…)` */
+export declare const organizationOf: <C extends Config, T extends Context<C>>(context: T, request: AbstractRequest, entitySlug: string) => Promise<ResolvedEntity>;
+//# sourceMappingURL=organization.d.ts.map

package/build/organization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization.d.ts","sourceRoot":"","sources":["../src/organization.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAI3E,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAiB,MAAM,0BAA0B,CAAA;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAShE,eAAO,MAAM,qBAAqB,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WACjE,CAAC,WAAW,eAAe,KACnC,iBAqBF,CAAA;AAED,4GAA4G;AAC5G,eAAO,MAAM,eAAe,GAAU,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WACjE,CAAC,WAAW,eAAe,KACnC,OAAO,CAAC,cAAc,EAAE,CAA0E,CAAA;AAErG,4GAA4G;AAC5G,eAAO,MAAM,cAAc,GAAU,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WAChE,CAAC,WAAW,eAAe,cAAc,MAAM,KACvD,OAAO,CAAC,cAAc,CAAmF,CAAA"}

package/build/organization.js

@@ -0,0 +1,30 @@
+import { AuthForbidden, AuthorizationError } from '@owlmeans/auth';
+import { ORGANIZATION_REFUSAL } from '@owlmeans/oidc';
+import { resolvedEntityOf, sessionRecord } from '@owlmeans/server-oidc-rp';
+/**
+ * The organizations the provider last claimed for the session's subject. A session that acts in
+ * none — a client without the organizations scope — has none to offer, whatever its record holds.
+ */
+const claimedOf = (record) => record.acting == null ? [] : record.organizations ?? [];
+export const makeOrganizationScope = (context, request) => {
+    const sessionOf = async () => {
+        if (request.auth == null) {
+            throw new AuthorizationError('auth');
+        }
+        return sessionRecord(context, request.auth.token);
+    };
+    const organizationsOf = async () => claimedOf(await sessionOf()).map(resolvedEntityOf);
+    const organizationOf = async (entitySlug) => {
+        const org = claimedOf(await sessionOf()).find(org => org.entitySlug === entitySlug);
+        if (org == null) {
+            throw new AuthForbidden(ORGANIZATION_REFUSAL);
+        }
+        return resolvedEntityOf(org);
+    };
+    return { sessionOf, organizationsOf, organizationOf };
+};
+/** @deprecated compat:factory-refactor — use `makeOrganizationScope(context, request).organizationsOf()` */
+export const organizationsOf = async (context, request) => await makeOrganizationScope(context, request).organizationsOf();
+/** @deprecated compat:factory-refactor — use `makeOrganizationScope(context, request).organizationOf(…)` */
+export const organizationOf = async (context, request, entitySlug) => await makeOrganizationScope(context, request).organizationOf(entitySlug);
+//# sourceMappingURL=organization.js.map

package/build/organization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization.js","sourceRoot":"","sources":["../src/organization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAElE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AAErD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAI1E;;;GAGG;AACH,MAAM,SAAS,GAAG,CAAC,MAAqB,EAA2B,EAAE,CACnE,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAA;AAEzD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,OAAU,EAAE,OAAwB,EACjB,EAAE;IACrB,MAAM,SAAS,GAAG,KAAK,IAA4B,EAAE;QACnD,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAA;QACtC,CAAC;QAED,OAAO,aAAa,CAAO,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACzD,CAAC,CAAA;IAED,MAAM,eAAe,GAAG,KAAK,IAA+B,EAAE,CAAC,SAAS,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IAEjH,MAAM,cAAc,GAAG,KAAK,EAAE,UAAkB,EAA2B,EAAE;QAC3E,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,UAAU,CAAC,CAAA;QACnF,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;YAChB,MAAM,IAAI,aAAa,CAAC,oBAAoB,CAAC,CAAA;QAC/C,CAAC;QAED,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAA;IAED,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,cAAc,EAAE,CAAA;AACvD,CAAC,CAAA;AAED,4GAA4G;AAC5G,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,OAAU,EAAE,OAAwB,EACT,EAAE,CAAC,MAAM,qBAAqB,CAAO,OAAO,EAAE,OAAO,CAAC,CAAC,eAAe,EAAE,CAAA;AAErG,4GAA4G;AAC5G,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,OAAU,EAAE,OAAwB,EAAE,UAAkB,EAC/B,EAAE,CAAC,MAAM,qBAAqB,CAAO,OAAO,EAAE,OAAO,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA"}

package/build/runtime.d.ts

@@ -0,0 +1,15 @@
+import type { AbstractRequest } from '@owlmeans/entrypoint';
+import { type Config, type Context } from '@owlmeans/server-oidc-rp';
+import type { IamRuntimeClient } from './types.js';
+/**
+ * A typed client of the provider's runtime IAM API, bound to one request.
+ *
+ * It calls as the request's subject: the bearer is the provider access token of that request's
+ * session record, read afresh on every call, so a token the guard has just refreshed is the one
+ * sent. The base URL is the provider's discovery field `IAM_API_METADATA`. Calls travel over plain
+ * `fetch`, because the API is another service's tree and a relying party binds none of it.
+ */
+export declare const makeIamRuntimeClient: <C extends Config, T extends Context<C>>(context: T, request: AbstractRequest) => IamRuntimeClient;
+/** @deprecated compat:factory-refactor — use `makeIamRuntimeClient(context, request)` */
+export declare const iamRuntime: <C extends Config, T extends Context<C>>(context: T, request: AbstractRequest) => IamRuntimeClient;
+//# sourceMappingURL=runtime.d.ts.map

package/build/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAI3D,OAAO,EAAwC,KAAK,MAAM,EAAE,KAAK,OAAO,EAA0B,MAAM,0BAA0B,CAAA;AAIlI,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAmDlD;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WAChE,CAAC,WAAW,eAAe,KACnC,gBAqHF,CAAA;AAED,yFAAyF;AACzF,eAAO,MAAM,UAAU,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WACtD,CAAC,WAAW,eAAe,KACnC,gBAAgE,CAAA"}

package/build/runtime.js

@@ -0,0 +1,167 @@
+import { AuthForbidden, AuthorizationError, AuthUnavailable } from '@owlmeans/auth';
+import { ResilientError } from '@owlmeans/error';
+import { IAM_RUNTIME_ROUTES, IamClientError, IamError } from '@owlmeans/iam';
+import { IAM_API_METADATA, ORGANIZATION_OWNER_REFUSAL, ORGANIZATION_REFUSAL } from '@owlmeans/oidc';
+import { DEFAULT_ALIAS as OIDC_CLIENT_SERVICE } from '@owlmeans/server-oidc-rp';
+import { makeOrganizationScope } from './organization.js';
+import { INCIDENT_ID_HEADER } from './consts.local.js';
+/**
+ * Discovered runtime bases, per context and per client. Discovery is a network round trip the OIDC
+ * client service does not memoise, and the base never changes while a provider runs. A failed
+ * lookup is forgotten, so the next request asks again rather than inheriting the error.
+ */
+const bases = new WeakMap();
+const pathOf = (path, params = {}) => path.replace(/:(\w+)/g, (_, key) => {
+    const value = params[key];
+    if (value == null || value === '') {
+        throw new IamError(`runtime:param:${key}`);
+    }
+    return encodeURIComponent(value);
+});
+/**
+ * The error a refused call rejects with.
+ *
+ * A development server sends the marshalled error, which is rebuilt into its own class. A production
+ * one sends only an incident id, so the status and the route's access level are all there is to go
+ * on: a 403 from an owner-level route is the subject not owning the organization, from any other
+ * route the subject not being in it.
+ */
+const failureOf = async (response, access) => {
+    const text = await response.text().catch(() => '');
+    const incidentId = response.headers.get(INCIDENT_ID_HEADER) ?? undefined;
+    if (text.includes(ResilientError.separator)) {
+        try {
+            const error = ResilientError.ensure(text, true);
+            error.incidentId ??= incidentId;
+            return error;
+        }
+        catch {
+            // Not a marshalled error after all — fall through to the status.
+        }
+    }
+    const error = response.status === 401 ? new AuthorizationError('iam-runtime')
+        : response.status === 403 ? new AuthForbidden(access === 'owner' ? ORGANIZATION_OWNER_REFUSAL : ORGANIZATION_REFUSAL)
+            : new IamError(`runtime:status:${response.status}`);
+    if (incidentId != null) {
+        error.incidentId = incidentId;
+    }
+    return error;
+};
+/**
+ * A typed client of the provider's runtime IAM API, bound to one request.
+ *
+ * It calls as the request's subject: the bearer is the provider access token of that request's
+ * session record, read afresh on every call, so a token the guard has just refreshed is the one
+ * sent. The base URL is the provider's discovery field `IAM_API_METADATA`. Calls travel over plain
+ * `fetch`, because the API is another service's tree and a relying party binds none of it.
+ */
+export const makeIamRuntimeClient = (context, request) => {
+    const runtimeBase = (clientId) => {
+        const known = bases.get(context) ?? new Map();
+        bases.set(context, known);
+        const cached = known.get(clientId);
+        if (cached != null) {
+            return cached;
+        }
+        const attempt = (async () => {
+            const client = await context.service(OIDC_CLIENT_SERVICE).getClient(clientId);
+            const base = client.getMetadata()[IAM_API_METADATA];
+            if (typeof base !== 'string' || base === '') {
+                // A provider that advertises no runtime API — Keycloak, or an integrated provider that does not
+                // serve it — has nothing to call.
+                throw new IamClientError(`runtime-api:${clientId}`);
+            }
+            return base.replace(/\/+$/, '');
+        })();
+        known.set(clientId, attempt);
+        attempt.catch(() => {
+            if (known.get(clientId) === attempt) {
+                known.delete(clientId);
+            }
+        });
+        return attempt;
+    };
+    const scope = makeOrganizationScope(context, request);
+    const call = async ({ method, path, access, params, query, body }) => {
+        const record = await scope.sessionOf();
+        const clientId = record.client ?? context.service(OIDC_CLIENT_SERVICE).getDefault();
+        if (clientId == null) {
+            throw new AuthUnavailable('oidc-client');
+        }
+        const token = record.payload?.access_token;
+        if (token == null || token === '') {
+            throw new AuthForbidden('record');
+        }
+        const url = new URL(`${await runtimeBase(clientId)}${pathOf(path, params)}`);
+        Object.entries(query ?? {}).forEach(([key, value]) => {
+            if (value != null) {
+                url.searchParams.set(key, String(value));
+            }
+        });
+        const response = await fetch(url, {
+            method,
+            headers: {
+                authorization: `Bearer ${token}`,
+                accept: 'application/json',
+                ...(method === 'POST' ? { 'content-type': 'application/json' } : {}),
+            },
+            // A JSON content type with an empty body is refused by the server, so a POST always sends one.
+            ...(method === 'POST' ? { body: JSON.stringify(body ?? {}) } : {}),
+        });
+        if (!response.ok) {
+            throw await failureOf(response, access);
+        }
+        return await response.json();
+    };
+    const R = IAM_RUNTIME_ROUTES;
+    return {
+        organizations: {
+            list: async () => (await call({
+                method: 'GET', path: R.organizations, access: 'subject',
+            })).items,
+            create: async (body) => call({
+                method: 'POST', path: R.organizations, access: 'subject', body: body ?? {},
+            }),
+            update: async (entitySlug, body) => call({
+                method: 'POST', path: R.organization, access: 'owner', params: { entitySlug }, body,
+            }),
+        },
+        members: {
+            list: async (entitySlug) => (await call({
+                method: 'GET', path: R.members, access: 'member', params: { entitySlug },
+            })).items,
+            add: async (entitySlug, invite) => call({
+                method: 'POST', path: R.members, access: 'owner', params: { entitySlug }, body: invite,
+            }),
+            update: async (entitySlug, profileId, update) => call({
+                method: 'POST', path: R.member, access: 'owner', params: { entitySlug, profileId }, body: update,
+            }),
+            remove: async (entitySlug, profileId) => {
+                await call({
+                    method: 'POST', path: R.memberRemove, access: 'owner', params: { entitySlug, profileId },
+                });
+            },
+        },
+        permissions: {
+            list: async (entitySlug) => (await call({
+                method: 'GET', path: R.permissions, access: 'member', params: { entitySlug },
+            })).items,
+        },
+        grants: {
+            list: async (entitySlug, query) => (await call({
+                method: 'GET', path: R.grants, access: 'owner', params: { entitySlug }, query,
+            })).items,
+            assign: async (entitySlug, grant) => call({
+                method: 'POST', path: R.grants, access: 'owner', params: { entitySlug }, body: grant,
+            }),
+            revoke: async (entitySlug, grant) => {
+                await call({
+                    method: 'POST', path: R.grantsRevoke, access: 'owner', params: { entitySlug }, body: grant,
+                });
+            },
+        },
+    };
+};
+/** @deprecated compat:factory-refactor — use `makeIamRuntimeClient(context, request)` */
+export const iamRuntime = (context, request) => makeIamRuntimeClient(context, request);
+//# sourceMappingURL=runtime.js.map

package/build/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAEnF,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,QAAQ,EAAqN,MAAM,eAAe,CAAA;AAC/R,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AACnG,OAAO,EAAE,aAAa,IAAI,mBAAmB,EAAqD,MAAM,0BAA0B,CAAA;AAClI,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAItD;;;;GAIG;AACH,MAAM,KAAK,GAAG,IAAI,OAAO,EAAwC,CAAA;AAEjE,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,MAAM,GAA2B,EAAE,EAAU,EAAE,CAC3E,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,GAAW,EAAE,EAAE;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACzB,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,QAAQ,CAAC,iBAAiB,GAAG,EAAE,CAAC,CAAA;IAC5C,CAAC;IAED,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAA;AAClC,CAAC,CAAC,CAAA;AAEJ;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,KAAK,EAAE,QAAkB,EAAE,MAAc,EAAkB,EAAE;IAC7E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;IAClD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAA;IAExE,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YAC/C,KAAK,CAAC,UAAU,KAAK,UAAU,CAAA;YAC/B,OAAO,KAAK,CAAA;QACd,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,aAAa,CAAC;QAC3E,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,oBAAoB,CAAC;YACnH,CAAC,CAAC,IAAI,QAAQ,CAAC,kBAAkB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IACvD,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,CAAC,UAAU,GAAG,UAAU,CAAA;IAC/B,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,OAAU,EAAE,OAAwB,EAClB,EAAE;IACpB,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAmB,EAAE;QACxD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,EAA2B,CAAA;QACtE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QACzB,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAClC,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,OAAO,MAAM,CAAA;QACf,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAoB,mBAAmB,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YAChG,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,gBAAgB,CAAC,CAAA;YACnD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;gBAC5C,gGAAgG;gBAChG,kCAAkC;gBAClC,MAAM,IAAI,cAAc,CAAC,eAAe,QAAQ,EAAE,CAAC,CAAA;YACrD,CAAC;YAED,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QACjC,CAAC,CAAC,EAAE,CAAA;QACJ,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QAC5B,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;YACjB,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,OAAO,EAAE,CAAC;gBACpC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YACxB,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,OAAO,OAAO,CAAA;IAChB,CAAC,CAAA;IAED,MAAM,KAAK,GAAG,qBAAqB,CAAO,OAAO,EAAE,OAAO,CAAC,CAAA;IAE3D,MAAM,IAAI,GAAG,KAAK,EAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAQ,EAAc,EAAE;QACxF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE,CAAA;QACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,CAAoB,mBAAmB,CAAC,CAAC,UAAU,EAAE,CAAA;QACtG,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,eAAe,CAAC,aAAa,CAAC,CAAA;QAC1C,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,YAAY,CAAA;QAC1C,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAA;QACnC,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QAC5E,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;YACnD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;YAC1C,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM;YACN,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrE;YACD,+FAA+F;YAC/F,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QACzC,CAAC;QAED,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAO,CAAA;IACnC,CAAC,CAAA;IAED,MAAM,CAAC,GAAG,kBAAkB,CAAA;IAE5B,OAAO;QACL,aAAa,EAAE;YACb,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,IAAI,CAA6B;gBACxD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS;aACxD,CAAC,CAAC,CAAC,KAAK;YACT,MAAM,EAAE,KAAK,EAAC,IAAI,EAAC,EAAE,CAAC,IAAI,CAAyB;gBACjD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE;aAC3E,CAAC;YACF,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAyB;gBAC/D,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI;aACpF,CAAC;SACH;QACD,OAAO,EAAE;YACP,IAAI,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE,CAAC,CAAC,MAAM,IAAI,CAAuB;gBAC1D,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE;aACzE,CAAC,CAAC,CAAC,KAAK;YACT,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAmB;gBACxD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM;aACvF,CAAC;YACF,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAmB;gBACtE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM;aACjG,CAAC;YACF,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE;gBACtC,MAAM,IAAI,CAAgB;oBACxB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;iBACzF,CAAC,CAAA;YACJ,CAAC;SACF;QACD,WAAW,EAAE;YACX,IAAI,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE,CAAC,CAAC,MAAM,IAAI,CAA2B;gBAC9D,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE;aAC7E,CAAC,CAAC,CAAC,KAAK;SACV;QACD,MAAM,EAAE;YACN,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAsB;gBAClE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,KAAK;aAC9E,CAAC,CAAC,CAAC,KAAK;YACT,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAkB;gBACzD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK;aACrF,CAAC;YACF,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE;gBAClC,MAAM,IAAI,CAAgB;oBACxB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK;iBAC3F,CAAC,CAAA;YACJ,CAAC;SACF;KACF,CAAA;AACH,CAAC,CAAA;AAED,yFAAyF;AACzF,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,OAAU,EAAE,OAAwB,EAClB,EAAE,CAAC,oBAAoB,CAAO,OAAO,EAAE,OAAO,CAAC,CAAA"}

package/build/types.d.ts

@@ -0,0 +1,42 @@
+import type { IamRuntimeGrant, IamRuntimeGrantQuery, IamRuntimeGrantRequest, IamRuntimeMember, IamRuntimeMemberInvite, IamRuntimeMemberUpdate, IamRuntimeOrganization, IamRuntimeOrganizationCreate, IamRuntimeOrganizationUpdate, IamRuntimePermission } from '@owlmeans/iam';
+export interface IamGateOptions {
+    /**
+     * Refuse a resource-scoped param on the UMA2 fallback path instead of widening it to a
+     * project-wide check.
+     *
+     * Off by default, and deliberately so. A Keycloak-backed deployment cannot hold a resource-scoped
+     * grant at all — the adapter throws `IamUnsupported('resource-scoped-grant')` — so denying would
+     * lock every user out of every scoped endpoint rather than tightening anything. Turn it on only
+     * where the resulting refusals are the intended outcome.
+     */
+    strictResourceScope?: boolean;
+}
+/**
+ * The runtime IAM API as the signed-in subject of one request: its organizations, their members,
+ * the grantable definitions and the grants. Every call acts as that subject — the provider decides
+ * owner and member rights from the access token, never from anything sent here.
+ */
+export interface IamRuntimeClient {
+    organizations: {
+        list: () => Promise<IamRuntimeOrganization[]>;
+        /** The subject becomes the new organization's owner. */
+        create: (body?: IamRuntimeOrganizationCreate) => Promise<IamRuntimeOrganization>;
+        update: (entitySlug: string, body: IamRuntimeOrganizationUpdate) => Promise<IamRuntimeOrganization>;
+    };
+    members: {
+        list: (entitySlug: string) => Promise<IamRuntimeMember[]>;
+        /** Find-or-create by e-mail: adding an address twice answers the same member. */
+        add: (entitySlug: string, invite: IamRuntimeMemberInvite) => Promise<IamRuntimeMember>;
+        update: (entitySlug: string, profileId: string, update: IamRuntimeMemberUpdate) => Promise<IamRuntimeMember>;
+        remove: (entitySlug: string, profileId: string) => Promise<void>;
+    };
+    permissions: {
+        list: (entitySlug: string) => Promise<IamRuntimePermission[]>;
+    };
+    grants: {
+        list: (entitySlug: string, query?: IamRuntimeGrantQuery) => Promise<IamRuntimeGrant[]>;
+        assign: (entitySlug: string, grant: IamRuntimeGrantRequest) => Promise<IamRuntimeGrant>;
+        revoke: (entitySlug: string, grant: IamRuntimeGrantRequest) => Promise<void>;
+    };
+}
+//# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AAE9Q,MAAM,WAAW,cAAc;IAC7B;;;;;;;;OAQG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE;QACb,IAAI,EAAE,MAAM,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAA;QAC7C,wDAAwD;QACxD,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,4BAA4B,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAA;QAChF,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAA;KACpG,CAAA;IACD,OAAO,EAAE;QACP,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;QACzD,iFAAiF;QACjF,GAAG,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAA;QACtF,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAA;QAC5G,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KACjE,CAAA;IACD,WAAW,EAAE;QACX,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAA;KAC9D,CAAA;IACD,MAAM,EAAE;QACN,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,eAAe,EAAE,CAAC,CAAA;QACtF,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,sBAAsB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAA;QACvF,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,sBAAsB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KAC7E,CAAA;CACF"}

package/build/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/build/types.local.d.ts

@@ -0,0 +1,16 @@
+import type { ServerConfig, ServerContext } from '@owlmeans/server-context';
+import type { WithSharedConfig } from '@owlmeans/oidc';
+export interface IamServerConfig extends ServerConfig, WithSharedConfig {
+}
+export type IamServerContext<C extends IamServerConfig = IamServerConfig> = ServerContext<C>;
+/** Who a route admits — and therefore which refusal a bare 403 from it means. */
+export type Access = 'subject' | 'member' | 'owner';
+export interface Call {
+    method: 'GET' | 'POST';
+    path: string;
+    access: Access;
+    params?: Record<string, string>;
+    query?: object;
+    body?: object;
+}
+//# sourceMappingURL=types.local.d.ts.map

package/build/types.local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.local.d.ts","sourceRoot":"","sources":["../src/types.local.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC3E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEtD,MAAM,WAAW,eAAgB,SAAQ,YAAY,EAAE,gBAAgB;CAAG;AAE1E,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe,IAAI,aAAa,CAAC,CAAC,CAAC,CAAA;AAE5F,iFAAiF;AACjF,MAAM,MAAM,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAA;AAEnD,MAAM,WAAW,IAAI;IACnB,MAAM,EAAE,KAAK,GAAG,MAAM,CAAA;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;CACd"}

package/build/types.local.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.local.js.map

package/build/types.local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.local.js","sourceRoot":"","sources":["../src/types.local.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-iam",
-  "version": "0.1.18-rc.9",
+  "version": "0.1.18",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -22,17 +22,19 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.6",
-    "@owlmeans/context": "^0.1.18-rc.6",
-    "@owlmeans/entrypoint": "^0.1.18-rc.6",
-    "@owlmeans/iam": "^0.1.18-rc.7",
-    "@owlmeans/oidc": "^0.1.18-rc.6",
-    "@owlmeans/server-context": "^0.1.18-rc.6",
-    "@owlmeans/server-oidc-rp": "^0.1.18-rc.8"
+    "@owlmeans/auth": "^0.1.18",
+    "@owlmeans/context": "^0.1.18",
+    "@owlmeans/entrypoint": "^0.1.18",
+    "@owlmeans/error": "^0.1.18",
+    "@owlmeans/iam": "^0.1.18",
+    "@owlmeans/log": "^0.1.18",
+    "@owlmeans/oidc": "^0.1.18",
+    "@owlmeans/server-context": "^0.1.18",
+    "@owlmeans/server-oidc-rp": "^0.1.18"
   },
   "devDependencies": {
-    "@owlmeans/dep-config": "workspace:*",
-    "@types/bun": "^1.3.14",
+    "@owlmeans/dep-config": "^0.1.18",
+    "@types/bun": "^1.4.2",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"
   },

package/src/append.ts

@@ -1,10 +1,7 @@
-import type { ServerConfig, ServerContext } from '@owlmeans/server-context'
-import type { WithSharedConfig } from '@owlmeans/oidc'
 import { appendOidcGuard, makeOidcClientService, makeOidcWrappingService } from '@owlmeans/server-oidc-rp'
 import { makeIamGate } from './gate.js'
+import type { IamServerConfig, IamServerContext } from './types.local.js'
 
-type IamServerConfig = ServerConfig & WithSharedConfig
-type IamServerContext<C extends IamServerConfig = IamServerConfig> = ServerContext<C>
 
 /**
  * One-call OIDC RP setup for a server context.

package/src/consts.local.ts

@@ -0,0 +1,2 @@
+/** `@owlmeans/server-api`'s incident header; a production error body is nothing but this id. */
+export const INCIDENT_ID_HEADER = 'x-incident-id'