@owlmeans/server-oidc-rp 0.1.18-rc.2 → 0.1.18-rc.20
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +11 -11
- package/agent-meta/manifest.json +2 -2
- package/agent-meta/skills/server-oidc-rp/SKILL.md +151 -50
- package/build/actions/init.js +2 -2
- package/build/actions/init.js.map +1 -1
- package/build/actions/process.d.ts.map +1 -1
- package/build/actions/process.js +5 -3
- package/build/actions/process.js.map +1 -1
- package/build/auth/plugins/google-client.js +2 -2
- package/build/auth/plugins/google-client.js.map +1 -1
- package/build/auth/plugins/oidc-client.js +3 -3
- package/build/auth/plugins/oidc-client.js.map +1 -1
- package/build/entrypoints.d.ts +3 -0
- package/build/entrypoints.d.ts.map +1 -0
- package/build/entrypoints.js +12 -0
- package/build/entrypoints.js.map +1 -0
- package/build/guard.d.ts +1 -1
- package/build/guard.d.ts.map +1 -1
- package/build/guard.js +4 -4
- package/build/guard.js.map +1 -1
- package/build/index.d.ts +1 -1
- package/build/index.d.ts.map +1 -1
- package/build/index.js +1 -1
- package/build/index.js.map +1 -1
- package/build/model/gate.js +6 -6
- package/build/model/gate.js.map +1 -1
- package/build/utils/auth.js +1 -1
- package/build/wrapper.d.ts.map +1 -1
- package/build/wrapper.js +20 -5
- package/build/wrapper.js.map +1 -1
- package/package.json +18 -18
- package/src/actions/init.ts +2 -2
- package/src/actions/process.ts +5 -12
- package/src/auth/plugins/google-client.ts +2 -2
- package/src/auth/plugins/oidc-client.ts +3 -3
- package/src/{modules.ts → entrypoints.ts} +5 -5
- package/src/guard.ts +4 -4
- package/src/index.ts +1 -1
- package/src/model/gate.ts +6 -6
- package/src/utils/auth.ts +1 -1
- package/src/wrapper.ts +21 -5
- package/tests/context.ts +1 -2
- package/build/modules.d.ts +0 -3
- package/build/modules.d.ts.map +0 -1
- package/build/modules.js +0 -12
- package/build/modules.js.map +0 -1
package/README.md
CHANGED
|
@@ -6,15 +6,15 @@ Server-side OIDC relying party — registers the OIDC guard, wrapping service, g
|
|
|
6
6
|
|
|
7
7
|
- `appendOidcGuard(context)` — registers the OIDC guard service
|
|
8
8
|
- `makeOidcWrappingService()` / `makeOidcGate()` — token wrapping service and gate factory
|
|
9
|
-
- `setupOidcGuard(
|
|
10
|
-
- `
|
|
9
|
+
- `setupOidcGuard(entrypoints, coguards?, extras?)` — attaches the OIDC guard to entrypoint declarations
|
|
10
|
+
- `setupAuthServiceEntrypoints(...)` — wires external auth entrypoints
|
|
11
11
|
- `makeOidcClientService()` / `OidcClientService` — IdP-side client (e.g., Keycloak admin)
|
|
12
12
|
- Subpath `./auth` — admin-client constants like `OIDC_ADMIN_CLIENT`
|
|
13
13
|
|
|
14
14
|
## Installation
|
|
15
15
|
|
|
16
16
|
```bash
|
|
17
|
-
bun add @owlmeans/server-oidc-rp
|
|
17
|
+
bun add @owlmeans/server-oidc-rp@^0.1.18-rc.17
|
|
18
18
|
```
|
|
19
19
|
|
|
20
20
|
## Usage
|
|
@@ -32,13 +32,13 @@ context.registerService(makeOidcClientService())
|
|
|
32
32
|
appendOidcGuard<C, T>(context)
|
|
33
33
|
```
|
|
34
34
|
|
|
35
|
-
Wire onto
|
|
35
|
+
Wire onto entrypoints in `entrypoints.ts`:
|
|
36
36
|
|
|
37
37
|
```typescript
|
|
38
|
-
import { setupOidcGuard,
|
|
38
|
+
import { setupOidcGuard, setupAuthServiceEntrypoints } from '@owlmeans/server-oidc-rp'
|
|
39
39
|
|
|
40
|
-
setupOidcGuard(
|
|
41
|
-
|
|
40
|
+
setupOidcGuard(appEntrypoints)
|
|
41
|
+
setupAuthServiceEntrypoints(appEntrypoints)
|
|
42
42
|
```
|
|
43
43
|
|
|
44
44
|
Configure providers in `config.ts`:
|
|
@@ -75,10 +75,10 @@ const oidc = context.service<OidcClientService>(OIDC_SERVICE)
|
|
|
75
75
|
- `makeOidcGate(alias?)` — gate factory
|
|
76
76
|
- `makeOidcClientService(alias?)` — IdP-side client (used to call OIDC admin API)
|
|
77
77
|
|
|
78
|
-
###
|
|
78
|
+
### Entrypoint wiring
|
|
79
79
|
|
|
80
|
-
- `setupOidcGuard(
|
|
81
|
-
- `
|
|
80
|
+
- `setupOidcGuard(entrypoints, coguards?, extras?)` — attach guard to entrypoint declarations
|
|
81
|
+
- `setupAuthServiceEntrypoints(entrypoints, ...)` — register external auth entrypoints
|
|
82
82
|
|
|
83
83
|
### Constants
|
|
84
84
|
|
|
@@ -112,7 +112,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
|
|
|
112
112
|
your project's skill store (`.agents/skills/`):
|
|
113
113
|
|
|
114
114
|
```sh
|
|
115
|
-
npx @owlmeans/agent-skills
|
|
115
|
+
npx @owlmeans/agent-skills@^0.1.18-rc.14
|
|
116
116
|
```
|
|
117
117
|
|
|
118
118
|
The embedded files are version-matched to this package release. Do not edit them
|
package/agent-meta/manifest.json
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schemaVersion": 2,
|
|
3
3
|
"package": "@owlmeans/server-oidc-rp",
|
|
4
|
-
"version": "0.1.18-rc.
|
|
5
|
-
"generatedAt": "2026-
|
|
4
|
+
"version": "0.1.18-rc.20",
|
|
5
|
+
"generatedAt": "2026-09-10T23:12:07.513Z",
|
|
6
6
|
"canonicalRepo": "https://github.com/owlmeans/common",
|
|
7
7
|
"entries": [
|
|
8
8
|
{
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: server-oidc-rp
|
|
3
|
-
description: How to use @owlmeans/server-oidc-rp — OIDC relying party
|
|
3
|
+
description: How to use @owlmeans/server-oidc-rp — the server-side OIDC relying party — appendOidcGuard and setupOidcGuard, the OidcClientService and its adapter, the requested-scope contract, the UMA2 gate, the wrapped-token service, and the owned public types that keep openid-client out of the public surface. Auto-invoked when importing server-oidc-rp helpers or configuring identity providers on a server.
|
|
4
4
|
user-invocable: false
|
|
5
5
|
---
|
|
6
6
|
<!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
|
|
@@ -8,93 +8,194 @@ user-invocable: false
|
|
|
8
8
|
# @owlmeans/server-oidc-rp
|
|
9
9
|
|
|
10
10
|
**Layer:** Server
|
|
11
|
-
**Install:** `"@owlmeans/server-oidc-rp": "^0.1.18-rc.
|
|
11
|
+
**Install:** `"@owlmeans/server-oidc-rp": "^0.1.18-rc.20"` in `dependencies`
|
|
12
12
|
|
|
13
13
|
## Key Exports
|
|
14
14
|
|
|
15
15
|
| Export | Description |
|
|
16
16
|
|--------|-------------|
|
|
17
|
-
| `
|
|
18
|
-
| `makeOidcWrappingService()` | OIDC token
|
|
19
|
-
| `makeOidcGate()` |
|
|
20
|
-
| `
|
|
21
|
-
| `
|
|
22
|
-
|
|
|
23
|
-
| `
|
|
17
|
+
| `makeOidcClientService(alias?)` | The relying-party service: reads `cfg.oidc.providers`, runs discovery, hands back client adapters |
|
|
18
|
+
| `makeOidcWrappingService()` | Registers `WRAPPED_OIDC` — refreshes and re-issues an OIDC-wrapped token before it goes stale |
|
|
19
|
+
| `makeOidcGate(alias?)` | The UMA2 gate, registered under `OIDC_GATE` |
|
|
20
|
+
| `appendOidcGuard<C, T>(context, opts?)` | Registers the OIDC guard on a server context. `opts` is `OidcGuardOptions` (`@owlmeans/oidc`) and is forwarded to the base guard unchanged |
|
|
21
|
+
| `setupOidcGuard(entrypoints, coguards?)` | Appends the dispatcher entrypoints and elevates them with the `init` and `authenticate` handlers |
|
|
22
|
+
| `setupAuthServiceEntrypoints(entrypoints, serviceAlias, prefix?)` | Declares and elevates the provider-list and token-update service entrypoints, guarded by `GUARD_ED25519`. `prefix` defaults to `oidc-api` |
|
|
23
|
+
| `requestedScope(extraScopes?)` | The `scope` of an authorization request — base scopes plus the provider's extras, deduplicated |
|
|
24
|
+
| `createGateModel(ctx)` | The UMA2 permission model — `loadPermissions(auth, params)` |
|
|
25
|
+
| `extractPermissionSets(claim)` | Shape-validates a `permissions` claim into `PermissionSet[]`, or `undefined` |
|
|
26
|
+
| `authService` | The service entrypoint aliases: `authService.provider.list`, `authService.auth.update` |
|
|
27
|
+
| `DEFAULT_ALIAS` | `'oidc-client'` — the relying-party service alias |
|
|
28
|
+
| `DEF_OIDC_ACCOUNT_LINKING`, `DEF_OIDC_PROVIDER_API` | Default aliases of the two optional seams below |
|
|
29
|
+
| `OIDC_TOKEN_STORE` | The **record-id prefix** this package composes cache ids from — not a resource alias. See "Where the tokens are cached" |
|
|
30
|
+
| `OIDC_AUTH_LIFTETIME` | 24 h — the TTL a stored token record is saved with |
|
|
31
|
+
| `OIDC_WRAP_FRESHNESS` | How long a validated record stays fresh: inside this window of its last validation the wrapping service returns the token unchanged, past it the token is re-validated and re-issued |
|
|
32
|
+
| `PROVIDER_CACHE_TTL` | Exported, but its only use in the package is commented out — it configures nothing |
|
|
33
|
+
| `AccountLinkingService` | Optional seam: turn a provider profile into a local `AuthPayload` (`getLinkedProfile`, `linkProfile`, `linkCredentials`, `getOwnerProfiles`, `getOwnerCredentials`) |
|
|
34
|
+
| `ProviderApiService` | Optional seam onto the provider's own admin API (`getUserDetails`, `getSettings`) |
|
|
35
|
+
| `OidcRpConfig` | `cfg.oidc` plus `accountLinkingService?` and `providerApiService?` |
|
|
36
|
+
|
|
37
|
+
### Subpath exports
|
|
38
|
+
|
|
39
|
+
- `./auth` — `OIDC_ADMIN_CLIENT` (`'admin-cli'`)
|
|
40
|
+
- `./auth/plugins` — importing it registers the `OIDC_CLIENT_AUTH` and `GOOGLE_CLIENT_AUTH` plugins
|
|
41
|
+
into the `@owlmeans/server-auth` manager registry
|
|
42
|
+
|
|
43
|
+
## Wiring
|
|
24
44
|
|
|
25
|
-
## Requested scope
|
|
26
|
-
|
|
27
|
-
Every authorization request this package builds gets its `scope` from `requestedScope(cfg.extraScopes)`
|
|
28
|
-
— `OIDC_RP_BASE_SCOPES` (`@owlmeans/oidc`) plus the provider descriptor's `extraScopes`, deduplicated.
|
|
29
|
-
Both request sites (`actions/init.ts` for the browser-starts-server-finishes flow, and the
|
|
30
|
-
`oidc-client` auth plugin) call it; never write a scope literal at a call site, and never let the two
|
|
31
|
-
drift apart.
|
|
32
|
-
|
|
33
|
-
The provider's client registration must allow every scope this yields. A provider supports `email`
|
|
34
|
-
as soon as it declares `claims.email` — and then rejects the whole request with
|
|
35
|
-
`invalid_scope: requested scope is not allowed` if the client's own allowlist omits it, rather than
|
|
36
|
-
dropping the scope. A client provisioned by an older revision therefore stays broken until its
|
|
37
|
-
allowlist is backfilled.
|
|
38
|
-
|
|
39
|
-
## Subpath Exports
|
|
40
|
-
|
|
41
|
-
- `./auth` — auth integration helpers
|
|
42
|
-
- `./auth/plugins` — pluggable token verifiers
|
|
43
|
-
|
|
44
|
-
## Usage
|
|
45
|
-
|
|
46
|
-
### In `context.ts`
|
|
47
45
|
```typescript
|
|
48
|
-
import { appendOidcGuard, makeOidcWrappingService, makeOidcGate } from '@owlmeans/server-oidc-rp'
|
|
46
|
+
import { appendOidcGuard, makeOidcWrappingService, makeOidcGate, makeOidcClientService } from '@owlmeans/server-oidc-rp'
|
|
49
47
|
|
|
48
|
+
context.registerService(makeOidcClientService())
|
|
50
49
|
context.registerService(makeOidcWrappingService())
|
|
51
50
|
context.registerService(makeOidcGate())
|
|
52
51
|
appendOidcGuard<C, T>(context)
|
|
53
52
|
```
|
|
54
53
|
|
|
55
|
-
### In `modules.ts`
|
|
56
54
|
```typescript
|
|
57
|
-
import { setupOidcGuard } from '@owlmeans/server-oidc-rp'
|
|
58
|
-
|
|
55
|
+
import { setupOidcGuard, setupAuthServiceEntrypoints } from '@owlmeans/server-oidc-rp'
|
|
56
|
+
|
|
57
|
+
setupOidcGuard(appEntrypoints)
|
|
58
|
+
// second argument: the alias of the registered service that hosts these two auth-service
|
|
59
|
+
// routes — they are elevated caller-side, so it addresses them rather than mounting them
|
|
60
|
+
setupAuthServiceEntrypoints(managerEntrypoints, 'my-auth-api')
|
|
59
61
|
```
|
|
60
62
|
|
|
61
|
-
### Configure OIDC providers in `config.ts`
|
|
62
63
|
```typescript
|
|
64
|
+
// config
|
|
63
65
|
cfg.oidc ??= {}
|
|
64
66
|
cfg.oidc.providers ??= []
|
|
65
67
|
cfg.oidc.providers.push({
|
|
66
68
|
clientId: OIDC_ADMIN_CLIENT,
|
|
67
69
|
basePath: 'realms/master',
|
|
68
|
-
service
|
|
70
|
+
// the alias of a registered service whose host the issuer is reassembled from;
|
|
71
|
+
// a provider reachable by its own URL carries `discoveryUrl` instead
|
|
72
|
+
service: 'my-iam',
|
|
69
73
|
secret: '/etc/master-secret/oidc-admin-secret',
|
|
70
74
|
internal: true
|
|
71
75
|
})
|
|
72
76
|
```
|
|
73
77
|
|
|
74
|
-
|
|
78
|
+
A consumer that only needs the IAM defaults calls `appendIam()` from `@owlmeans/server-iam`, which
|
|
79
|
+
performs the four registrations above with the IAM gate in place of `makeOidcGate()`.
|
|
75
80
|
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
81
|
+
## Resolving a provider
|
|
82
|
+
|
|
83
|
+
`OidcClientService` is the only way to reach a provider descriptor. Use `findProvider(predicate)`,
|
|
84
|
+
`hasProvider(params)`, `getConfig(clientId | partial)`, `getDefault()` and
|
|
85
|
+
`entityToClientId(params)` rather than scanning `cfg.oidc.providers` in downstream code.
|
|
86
|
+
`registerTemporaryProvider` / `unregisterTemporaryProvider` add a descriptor learned at runtime and
|
|
87
|
+
are reference-counted, so every registration needs its matching removal.
|
|
88
|
+
|
|
89
|
+
`getConfiguration` prefers `discoveryUrl` verbatim; it falls back to `service` + `basePath` and fails
|
|
90
|
+
with `AuthManagerError('oidc.client.basepath')` or `('oidc.client.service')` when neither is usable.
|
|
91
|
+
`getClient` returns an `OidcClientAdapter`: `getMetadata`, `getClientId`, `getConfig`, `makeAuthUrl`,
|
|
92
|
+
`grantWithCredentials`, `grantWithCode`, `refresh` and `introspect`. That adapter is the whole
|
|
93
|
+
supported surface — no `openid-client` object is ever handed out.
|
|
94
|
+
|
|
95
|
+
## Requested scope
|
|
96
|
+
|
|
97
|
+
`requestedScope(extraScopes)` is `OIDC_RP_BASE_SCOPES` (`@owlmeans/oidc`) plus the provider
|
|
98
|
+
descriptor's `extraScopes`, deduplicated and trimmed. The two generic request sites — the
|
|
99
|
+
browser-starts-server-finishes init handler and the `oidc-client` auth plugin — both build their
|
|
100
|
+
`scope` from it, and neither may grow a scope literal.
|
|
101
|
+
|
|
102
|
+
The `GOOGLE_CLIENT_AUTH` plugin is the exception, and it behaves differently on purpose: it sends
|
|
103
|
+
the descriptor's `extraScopes` as the **whole** scope, falling back to `'openid profile email'` when
|
|
104
|
+
the descriptor names none. So on a Google descriptor `extraScopes` replaces the base scopes instead
|
|
105
|
+
of extending them, and adding a scope to `OIDC_RP_BASE_SCOPES` does not reach it.
|
|
106
|
+
|
|
107
|
+
The provider's client registration must allow every scope this yields. A provider supports `email`
|
|
108
|
+
as soon as it declares `claims.email` — and then rejects the whole request with
|
|
109
|
+
`invalid_scope: requested scope is not allowed` if the client's own allowlist omits it, rather than
|
|
110
|
+
dropping the scope. A client provisioned by an older revision stays broken until its allowlist is
|
|
111
|
+
backfilled.
|
|
112
|
+
|
|
113
|
+
## Only the `id_token` is a JWT
|
|
114
|
+
|
|
115
|
+
`id_token` is a JWT by specification; an **access token's format is provider-private**. `oidc-provider`
|
|
116
|
+
issues opaque access tokens by default, so `decodeJwt(tokenSet.access_token)` (`jose`) throws
|
|
117
|
+
`JWTInvalid: Invalid JWT`. Inside the exchange handler that failure surfaces as a 500 on the
|
|
118
|
+
`DISPATCHER_OIDC` endpoint *after* the code exchange already succeeded, which reads as a broken login
|
|
119
|
+
rather than as the log line it came from. Decode only `tokenSet.id_token` — every claim this package
|
|
120
|
+
needs (`sub`, the `PERMISSIONS_CLAIM` grant) lives there. This applies to debug logging too: a
|
|
121
|
+
`console.log` argument is evaluated before the call, so a throwing decode in a log statement fails the
|
|
122
|
+
request just as hard as one in real logic. Never introspect an access token locally; use the
|
|
123
|
+
provider's introspection endpoint (`introspect`) when its contents are genuinely needed.
|
|
124
|
+
|
|
125
|
+
## Where the tokens are cached
|
|
126
|
+
|
|
127
|
+
There is no dedicated resource. The cache is `AUTH_CACHE` from `@owlmeans/server-auth`, and
|
|
128
|
+
`OIDC_TOKEN_STORE` is only the prefix of the ids written into it:
|
|
129
|
+
|
|
130
|
+
| Record id | Holds |
|
|
131
|
+
|---|---|
|
|
132
|
+
| `${OIDC_TOKEN_STORE}:verifier:<challenge or state>` | The PKCE verifier and the client it belongs to, until the exchange takes it |
|
|
133
|
+
| `${OIDC_TOKEN_STORE}:exchange:<exchange token>` | The token set from a completed code exchange, short-lived, deleted when the process step consumes it |
|
|
134
|
+
| `${OIDC_TOKEN_STORE}:token:<bearer token>` | The live token set for an issued bearer token, saved with `OIDC_AUTH_LIFTETIME` |
|
|
135
|
+
|
|
136
|
+
A consumer that needs the provider token set behind the request it is serving reads
|
|
137
|
+
`context.resource(AUTH_CACHE)` at `${OIDC_TOKEN_STORE}:token:<token>` — never
|
|
138
|
+
`context.resource(OIDC_TOKEN_STORE)`, which resolves nothing.
|
|
139
|
+
|
|
140
|
+
## PKCE verifiers are consume-once
|
|
141
|
+
|
|
142
|
+
The verifier cached at init is read back with the resource's `take` — a delete-and-return. The
|
|
143
|
+
exchange therefore succeeds exactly once per authorization code: a repeated exchange (a React effect
|
|
144
|
+
that runs twice for one `code`, a retried request) fails with `resource:unknown-record` even though
|
|
145
|
+
the first attempt worked. Callers guard against re-entry rather than expecting the read to be
|
|
146
|
+
idempotent.
|
|
147
|
+
|
|
148
|
+
## `entityId` in the browser-starts-server-finishes flow
|
|
149
|
+
|
|
150
|
+
The init handler resolves the OIDC client two ways: via `getDefault()` (a provider flagged `def: true`,
|
|
151
|
+
matched without looking at `entityId` at all) or, only when no default exists, via a remote provider
|
|
152
|
+
lookup keyed by the caller-supplied `entityId`. The cached verifier record carries `entityId` **only**
|
|
153
|
+
when that second path actually used it to resolve the client. The exchange step later calls
|
|
154
|
+
`getConfig({ clientId, ...(entityId != null ? { entityId } : {}) })`, which requires an exact match on
|
|
155
|
+
every field it is given; a stored `entityId` that was never validated against the registered provider
|
|
156
|
+
— a caller-side default or placeholder, say — makes the exchange fail with a bare `AuthenFailed()`
|
|
157
|
+
even though the same default provider is trivially available again at exchange time.
|
|
80
158
|
|
|
81
159
|
## Public type contract (isolation principle)
|
|
82
160
|
|
|
83
|
-
`openid-client` types **never appear in this package's public exports**. All public types are
|
|
161
|
+
`openid-client` types **never appear in this package's public exports**. All public types are
|
|
162
|
+
OwlMeans-owned:
|
|
84
163
|
|
|
85
164
|
| Owned type | Replaces upstream | Description |
|
|
86
165
|
|---|---|---|
|
|
87
|
-
| `OidcTokenSet` | `TokenEndpointResponse & TokenEndpointResponseHelpers` | `access_token`, `refresh_token`, `id_token`, `token_type`, `expires_in`, `scope` |
|
|
88
|
-
| `OidcTokenSetParameters` | `TokenEndpointResponse` |
|
|
166
|
+
| `OidcTokenSet` | `TokenEndpointResponse & TokenEndpointResponseHelpers` | `access_token`, `refresh_token`, `id_token`, `token_type`, `expires_in`, `scope`, `claims()` |
|
|
167
|
+
| `OidcTokenSetParameters` | `TokenEndpointResponse` | The same without the helper method |
|
|
89
168
|
| `OidcGrantChecks` | `AuthorizationCodeGrantChecks` | `{ pkceCodeVerifier?: string; idTokenExpected?: boolean }` |
|
|
90
169
|
| `OidcServerMetadata` | `ServerMetadata` | Issuer and endpoint metadata |
|
|
91
|
-
| `OidcIntrospectionResponse` | `IntrospectionResponse` |
|
|
170
|
+
| `OidcIntrospectionResponse` | `IntrospectionResponse` | `active`, `scope`, `sub`, `client_id`, … |
|
|
92
171
|
| `OidcClientDescriptor` | `Configuration` (opaque) | Pass-through; consumers must never read its internals |
|
|
93
172
|
|
|
94
|
-
|
|
173
|
+
What the owned names guarantee is the **exported** surface, not the internal imports. The type module
|
|
174
|
+
imports `Configuration`, `ServerMetadata`, `TokenEndpointResponse` and `TokenEndpointResponseHelpers`
|
|
175
|
+
from `openid-client` in order to alias them under those names; the service module imports the
|
|
176
|
+
functional `openid-client` API; and `jose`'s `decodeJwt` is read directly by the token wrapper, the
|
|
177
|
+
`oidc-client` auth plugin and the exchange handler. A library swap touches every one of those
|
|
178
|
+
modules — what the owned names buy is that it stops there and never reaches a consumer. See
|
|
179
|
+
[[oidc-versions]].
|
|
180
|
+
|
|
181
|
+
## Rules
|
|
182
|
+
|
|
183
|
+
- An application that uses an identity provider **only to log in**, and then maps the subject onto a
|
|
184
|
+
local identity through `@owlmeans/server-auth-identity`, must not adopt `appendOidcGuard()`,
|
|
185
|
+
`makeOidcGate()` or `setupOidcGuard()` as its authorization mechanism. Those decide against the
|
|
186
|
+
provider's grants; a product that owns its own identity records declares its own `GateService` over
|
|
187
|
+
them.
|
|
188
|
+
- The browser starts the flow and the server finishes it: the exchange, the account linking and the
|
|
189
|
+
bearer token an application actually carries are all produced here.
|
|
190
|
+
- Register the wrapping service whenever the guard is registered — an OIDC-wrapped token that nothing
|
|
191
|
+
refreshes expires mid-session.
|
|
95
192
|
|
|
96
193
|
## Depends On
|
|
97
194
|
|
|
98
|
-
- `@owlmeans/oidc`, `@owlmeans/server-auth`, `@owlmeans/server-context`, `@owlmeans/server-entrypoint
|
|
99
|
-
- `@owlmeans/auth-common`, `@owlmeans/basic-
|
|
100
|
-
-
|
|
195
|
+
- `@owlmeans/oidc`, `@owlmeans/server-auth`, `@owlmeans/server-context`, `@owlmeans/server-entrypoint`,
|
|
196
|
+
`@owlmeans/server-api`, `@owlmeans/auth`, `@owlmeans/auth-common`, `@owlmeans/basic-envelope`,
|
|
197
|
+
`@owlmeans/client-entrypoint`, `@owlmeans/config`, `@owlmeans/context`, `@owlmeans/did`,
|
|
198
|
+
`@owlmeans/entrypoint`, `@owlmeans/resource`, `@owlmeans/route`, `@noble/hashes`, `@scure/base`,
|
|
199
|
+
`dayjs`
|
|
200
|
+
- `ajv` (peer)
|
|
201
|
+
- `openid-client@6.8.4` (exact), `jose@6.2.5` (exact) — see [[oidc-versions]]
|
package/build/actions/init.js
CHANGED
|
@@ -35,7 +35,7 @@ export const init = handleBody(async (body, ctx) => {
|
|
|
35
35
|
* @TODO We need to move it to some remote resource.
|
|
36
36
|
* And make oidc service itself use such a resource to get required client.
|
|
37
37
|
*/
|
|
38
|
-
const
|
|
38
|
+
const providers = await context.entrypoint(authService.provider.list).call({
|
|
39
39
|
params: { service: context.cfg.alias ?? context.cfg.service },
|
|
40
40
|
query: { entityId }
|
|
41
41
|
});
|
|
@@ -72,7 +72,7 @@ export const init = handleBody(async (body, ctx) => {
|
|
|
72
72
|
client: client.getClientId(),
|
|
73
73
|
...(entityIdUsedForResolution ? { entityId } : {}),
|
|
74
74
|
}, { ttl: AUTHEN_TIMEFRAME / 1000 });
|
|
75
|
-
const
|
|
75
|
+
const dispatcherUrl = await context.entrypoint(DISPATCHER).url();
|
|
76
76
|
const cfg = client.getConfig();
|
|
77
77
|
const url = client.makeAuthUrl({
|
|
78
78
|
scope: requestedScope(cfg?.extraScopes),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/actions/init.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEjD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAGjD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACzD,qDAAqD;AACrD,8CAA8C;AAE9C,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAExD,MAAM,CAAC,MAAM,IAAI,GAA2B,UAAU,CAAC,KAAK,EAAE,IAAwB,EAAE,GAAG,EAAE,EAAE;IAC7F,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IACxC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAA;IAE5B,MAAM,OAAO,GAAG,aAAa,CAAkB,GAAG,CAAC,CAAA;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;IAE9D,IAAI,MAAM,GAA6B,IAAI,CAAA;IAC3C,4FAA4F;IAC5F,sFAAsF;IACtF,4FAA4F;IAC5F,0FAA0F;IAC1F,0EAA0E;IAC1E,IAAI,yBAAyB,GAAG,KAAK,CAAA;IAErC,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;IACzC,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;IAChD,CAAC;IACD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,yBAAyB,GAAG,IAAI,CAAA;QAChC,yCAAyC;QACzC;;;WAGG;QACH,MAAM,
|
|
1
|
+
{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/actions/init.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEjD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAGjD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACzD,qDAAqD;AACrD,8CAA8C;AAE9C,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAExD,MAAM,CAAC,MAAM,IAAI,GAA2B,UAAU,CAAC,KAAK,EAAE,IAAwB,EAAE,GAAG,EAAE,EAAE;IAC7F,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IACxC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAA;IAE5B,MAAM,OAAO,GAAG,aAAa,CAAkB,GAAG,CAAC,CAAA;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;IAE9D,IAAI,MAAM,GAA6B,IAAI,CAAA;IAC3C,4FAA4F;IAC5F,sFAAsF;IACtF,4FAA4F;IAC5F,0FAA0F;IAC1F,0EAA0E;IAC1E,IAAI,yBAAyB,GAAG,KAAK,CAAA;IAErC,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;IACzC,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;IAChD,CAAC;IACD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,yBAAyB,GAAG,IAAI,CAAA;QAChC,yCAAyC;QACzC;;;WAGG;QACH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,UAAU,CACxC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAC1B,CAAC,IAAI,CAAC;YACL,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE;YAC7D,KAAK,EAAE,EAAE,QAAQ,EAAE;SACpB,CAAC,CAAA;QAEF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,WAAW,EAAE,CAAA;QACzB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,qDAAqD,EAAE,SAAS,CAAC,CAAA;QAE7E,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,CAAA;QACzE,iFAAiF;QACjF,IAAI,QAAQ,IAAI,IAAI,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC1C,OAAO,QAAQ,CAAC,GAAG,CAAA;QACrB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAA;QAChD,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;QAEjC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,EAAE,CAAA;QACzB,CAAC;QACD,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,oEAAoE;IACpE,+FAA+F;IAC/F,WAAW;IACX,oCAAoC;IACpC,8DAA8D;IAC9D,OAAO;IACP,IAAI;IAEJ,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;IAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEjD,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAA;IAE3H,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAC1B,EAAE,EAAE,UAAU,CAAC,SAAS,CAAC;QACzB,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE;QAC5B,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;IAEpC,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,UAAU,CAA2B,UAAU,CAAC,CAAC,GAAG,EAAE,CAAA;IAE1F,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;IAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC;QAC7B,KAAK,EAAE,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC;QACvC,cAAc,EAAE,SAAS;QACzB,qBAAqB,EAAE,MAAM;QAC7B,YAAY,EAAE,aAAa;KAC5B,CAAC,CAAA;IAEF,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAA;IAE9B,OAAO,GAAG,CAAA;AACZ,CAAC,CAAC,CAAA"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"process.d.ts","sourceRoot":"","sources":["../../src/actions/process.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAoBzE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,YAAY,EAAE,
|
|
1
|
+
{"version":3,"file":"process.d.ts","sourceRoot":"","sources":["../../src/actions/process.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAoBzE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,YAAY,EAAE,sBA6EzB,CAAA"}
|
package/build/actions/process.js
CHANGED
|
@@ -43,9 +43,11 @@ export const authenticate = handleBody(async ({ authUrl, ...params }, ctx) => {
|
|
|
43
43
|
throw new AuthManagerError('service');
|
|
44
44
|
}
|
|
45
45
|
await cache(context).delete(exchangeId(token));
|
|
46
|
-
|
|
46
|
+
// Only the id_token is guaranteed to be a JWT. An access token's format is provider-private —
|
|
47
|
+
// `oidc-provider` issues opaque ones by default — so decoding it throws `JWTInvalid` and, from
|
|
48
|
+
// inside this handler, fails the whole exchange after it has already succeeded. Nothing here
|
|
49
|
+
// needs it either: the permission grant is read from the id_token below.
|
|
47
50
|
const id = decodeJwt(tokenSet.id_token);
|
|
48
|
-
console.log('token set', tokenSet, tokenSet.claims(), id);
|
|
49
51
|
// Integrated IAM mode: the provider mints the subject's PermissionSet[] into the id_token
|
|
50
52
|
const permissions = extractPermissionSets(id[PERMISSIONS_CLAIM]);
|
|
51
53
|
let user = {
|
|
@@ -68,7 +70,7 @@ export const authenticate = handleBody(async ({ authUrl, ...params }, ctx) => {
|
|
|
68
70
|
// @TODO Actually this is highly incorrect - we need to get profile details
|
|
69
71
|
// from the OwlMeans Auth intead
|
|
70
72
|
// profileId: user?.userId,
|
|
71
|
-
|
|
73
|
+
entitySlug: cfg.entityId,
|
|
72
74
|
...(permissions != null ? { permissions, permissioned: true } : {}),
|
|
73
75
|
isUser: true,
|
|
74
76
|
createdAt: new Date(),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"process.js","sourceRoot":"","sources":["../../src/actions/process.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,GAAG,MAAM,KAAK,CAAA;AACrB,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEzD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAChC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,YAAY,GAA2B,UAAU,CAAC,KAAK,EAClE,EAAE,OAAO,EAAE,GAAG,MAAM,EAAyB,EAC7C,GAAG,EACH,EAAE;IACF,MAAM,OAAO,GAAG,aAAa,CAAkB,GAAG,CAAC,CAAA;IAEnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAChC,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IAExD,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACnE,SAAS,EAAE,WAAW,GAAG,GAAG,GAAG,OAAO;QACtC,UAAU,EAAE,IAAI,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;KACpC,CAAC,CAAA;IAGrB,OAAO,CAAC,GAAG,CAAC,6DAA6D,EAAE,GAAG,CAAC,CAAA;IAE/E,IAAI,QAAQ,CAAC,QAAQ,IAAI,IAAI,IAAI,QAAQ,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;QAC/D,MAAM,IAAI,YAAY,EAAE,CAAA;IAC1B,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAA;IACvC,CAAC;IAED,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IAE9C,
|
|
1
|
+
{"version":3,"file":"process.js","sourceRoot":"","sources":["../../src/actions/process.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,GAAG,MAAM,KAAK,CAAA;AACrB,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEzD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAChC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,YAAY,GAA2B,UAAU,CAAC,KAAK,EAClE,EAAE,OAAO,EAAE,GAAG,MAAM,EAAyB,EAC7C,GAAG,EACH,EAAE;IACF,MAAM,OAAO,GAAG,aAAa,CAAkB,GAAG,CAAC,CAAA;IAEnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAChC,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IAExD,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACnE,SAAS,EAAE,WAAW,GAAG,GAAG,GAAG,OAAO;QACtC,UAAU,EAAE,IAAI,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;KACpC,CAAC,CAAA;IAGrB,OAAO,CAAC,GAAG,CAAC,6DAA6D,EAAE,GAAG,CAAC,CAAA;IAE/E,IAAI,QAAQ,CAAC,QAAQ,IAAI,IAAI,IAAI,QAAQ,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;QAC/D,MAAM,IAAI,YAAY,EAAE,CAAA;IAC1B,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAA;IACvC,CAAC;IAED,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IAE9C,8FAA8F;IAC9F,+FAA+F;IAC/F,6FAA6F;IAC7F,yEAAyE;IACzE,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAEvC,0FAA0F;IAC1F,MAAM,WAAW,GAAG,qBAAqB,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAA;IAEhE,IAAI,IAAI,GAAS;QACf,IAAI,EAAE,kBAAkB;QACxB,KAAK;QACL,2EAA2E;QAC3E,kCAAkC;QAClC,MAAM,EAAE,EAAE,CAAC,GAAa;QACxB,mEAAmE;QACnE,sBAAsB;QACtB,IAAI,EAAE,QAAQ,CAAC,KAAK;QACpB,kEAAkE;QAClE,MAAM,EAAE;YACN,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,OAAO;YACnB,GAAG,CAAC,OAAO;SACZ;QACD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1E,2EAA2E;QAC3E,gCAAgC;QAChC,2BAA2B;QAC3B,UAAU,EAAE,GAAG,CAAC,QAAQ;QACxB,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAA;IAED,OAAO,CAAC,GAAG,CAAC,oCAAoC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;IACnE,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CACzB,EAAE,EAAE,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,EACjE,EAAE,GAAG,EAAE,mBAAmB,GAAG,IAAI,EAAE,CACpC,CAAA;IAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACxG,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAO,kBAAkB,CAAC;SACpE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;IAEzD,IAAI,IAAI,GAAG,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,WAAW,EAAE,IAAI,aAAa,EAAE,EAAE,CAAA;IAE5E,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAA;IAExD,OAAO,IAAI,CAAA;AACb,CAAC,CAAC,CAAA"}
|
|
@@ -67,7 +67,7 @@ export const googleClientPlugin = (context, service = GOOGLE_SERVICE) => {
|
|
|
67
67
|
throw new AuthenPayloadError('state');
|
|
68
68
|
}
|
|
69
69
|
// Look up the PKCE verifier using the state parameter
|
|
70
|
-
const verification = await cache(context).
|
|
70
|
+
const verification = await cache(context).take(verifierId(state));
|
|
71
71
|
if (verification == null || verification.verifier == null) {
|
|
72
72
|
throw new AuthenFailed();
|
|
73
73
|
}
|
|
@@ -138,7 +138,7 @@ export const googleClientPlugin = (context, service = GOOGLE_SERVICE) => {
|
|
|
138
138
|
credential.type = GOOGLE_CLIENT_AUTH;
|
|
139
139
|
credential.userId = profile.userId;
|
|
140
140
|
credential.profileId = profile.profileId;
|
|
141
|
-
credential.
|
|
141
|
+
credential.entitySlug = profile.entitySlug;
|
|
142
142
|
return { token: exchangeToken };
|
|
143
143
|
}
|
|
144
144
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"google-client.js","sourceRoot":"","sources":["../../../src/auth/plugins/google-client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAA;AAElE,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEnE,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzG,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEpE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAE/C,MAAM,oBAAoB,GAAG,8CAA8C,CAAA;AAC3E,MAAM,qBAAqB,GAAG,qCAAqC,CAAA;AACnE,MAAM,wBAAwB,GAAG,+CAA+C,CAAA;AAEhF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAyC,OAAU,EAAE,OAAO,GAAW,cAAc,EAAc,EAAE;IACrI,MAAM,eAAe,GAAG,KAAK,IAAqG,EAAE;QAClI,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;QAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;QAC7C,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,QAAQ,IAAI,IAAI,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;YAC9D,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAA;QAC7C,CAAC;QACD,OAAO,GAA6F,CAAA;IACtG,CAAC,CAAA;IAED,MAAM,MAAM,GAAe;QACzB,IAAI,EAAE,kBAAkB;QAExB,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACpB,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAEhC,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAA;YAEtC,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAA;YAC9C,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;YACjD,kDAAkD;YAClD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YAE5C,MAAM,KAAK,CAAO,OAAO,CAAC,CAAC,MAAM,CAAC;gBAChC,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC;gBACrB,QAAQ;gBACR,MAAM,EAAE,MAAM,CAAC,QAAQ;gBACvB,WAAW,EAAE,OAAO,CAAC,MAAM;aAC5B,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;YAEpC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,IAAI,sBAAsB,CAAA;YAC3D,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,oBAAoB,CAAA;YAEhE,gFAAgF;YAChF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;gBACjC,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,YAAY,EAAE,OAAO,CAAC,MAAM;gBAC5B,aAAa,EAAE,MAAM;gBACrB,KAAK,EAAE,MAAM;gBACb,cAAc,EAAE,SAAS;gBACzB,qBAAqB,EAAE,MAAM;gBAC7B,KAAK;gBACL,WAAW,EAAE,SAAS;gBACtB,MAAM,EAAE,SAAS;aAClB,CAAC,CAAA;YAEF,MAAM,GAAG,GAAG,GAAG,YAAY,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;YAElD,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAA;QAC3B,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAA;YAEtC,uEAAuE;YACvE,MAAM,cAAc,GAAG,IAAI,eAAe,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;YACjE,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACvC,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAEzC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;gBACjB,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAA;YACtC,CAAC;YAED,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBAClC,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACvC,CAAC;YAED,sDAAsD;YACtD,MAAM,YAAY,GAAG,MAAM,KAAK,CAAO,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;YACvE,IAAI,YAAY,IAAI,IAAI,IAAI,YAAY,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;gBAC1D,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,6DAA6D;YAC7D,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,CAAA;YAC5C,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;gBACxB,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,2BAA2B;YAC3B,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,qBAAqB,CAAA;YACnE,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;gBAC/C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,IAAI;oBACJ,SAAS,EAAE,MAAM,CAAC,QAAQ;oBAC1B,aAAa,EAAE,MAAM,CAAC,MAAM;oBAC5B,YAAY,EAAE,WAAW;oBACzB,UAAU,EAAE,oBAAoB;oBAChC,aAAa,EAAE,YAAY,CAAC,QAAQ;iBACrC,CAAC;aACH,CAAC,CAAA;YAEF,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;gBACtB,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAiD,CAAA;YACxF,IAAI,MAAM,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;gBAChC,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,kBAAkB;YAClB,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,wBAAwB,CAAA;YAC5E,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;gBACrD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,YAAY,EAAE,EAAE;aAC5D,CAAC,CAAA;YAEF,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;gBACzB,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAE3C,CAAA;YAED,IAAI,QAAQ,CAAC,GAAG,IAAI,IAAI,IAAI,QAAQ,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;gBACnD,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,6DAA6D;YAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;YAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAkC,CAAA;YACnE,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAA;YACpD,CAAC;YAED,MAAM,cAAc,GAA2B;gBAC7C,IAAI,EAAE,kBAAkB;gBACxB,OAAO;gBACP,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,QAAQ,CAAC,GAAG;gBACpB,QAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK;aAC1C,CAAA;YAED,IAAI,OAAO,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAA;YAE1D,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,cAAc,EAAE;oBAChD,QAAQ,EAAE,QAAQ,CAAC,KAAK;oBACxB,KAAK,EAAE,KAAK;iBACb,CAAC,CAAA;YACJ,CAAC;YAED,qEAAqE;YACrE,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YACpD,MAAM,KAAK,CAAO,OAAO,CAAC,CAAC,MAAM,CAC/B,EAAE,EAAE,EAAE,UAAU,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,MAAa,EAAE,EACzD,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CACjC,CAAA;YAED,UAAU,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,CAAA;YAChC,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAA;YACnC,UAAU,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;YAC/B,UAAU,CAAC,IAAI,GAAG,kBAAkB,CAAA;YACpC,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;YAClC,UAAU,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;YACxC,UAAU,CAAC,
|
|
1
|
+
{"version":3,"file":"google-client.js","sourceRoot":"","sources":["../../../src/auth/plugins/google-client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAA;AAElE,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEnE,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzG,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEpE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAE/C,MAAM,oBAAoB,GAAG,8CAA8C,CAAA;AAC3E,MAAM,qBAAqB,GAAG,qCAAqC,CAAA;AACnE,MAAM,wBAAwB,GAAG,+CAA+C,CAAA;AAEhF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAyC,OAAU,EAAE,OAAO,GAAW,cAAc,EAAc,EAAE;IACrI,MAAM,eAAe,GAAG,KAAK,IAAqG,EAAE;QAClI,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;QAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;QAC7C,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,QAAQ,IAAI,IAAI,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;YAC9D,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAA;QAC7C,CAAC;QACD,OAAO,GAA6F,CAAA;IACtG,CAAC,CAAA;IAED,MAAM,MAAM,GAAe;QACzB,IAAI,EAAE,kBAAkB;QAExB,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACpB,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAEhC,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAA;YAEtC,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAA;YAC9C,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;YACjD,kDAAkD;YAClD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YAE5C,MAAM,KAAK,CAAO,OAAO,CAAC,CAAC,MAAM,CAAC;gBAChC,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC;gBACrB,QAAQ;gBACR,MAAM,EAAE,MAAM,CAAC,QAAQ;gBACvB,WAAW,EAAE,OAAO,CAAC,MAAM;aAC5B,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;YAEpC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,IAAI,sBAAsB,CAAA;YAC3D,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,oBAAoB,CAAA;YAEhE,gFAAgF;YAChF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;gBACjC,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,YAAY,EAAE,OAAO,CAAC,MAAM;gBAC5B,aAAa,EAAE,MAAM;gBACrB,KAAK,EAAE,MAAM;gBACb,cAAc,EAAE,SAAS;gBACzB,qBAAqB,EAAE,MAAM;gBAC7B,KAAK;gBACL,WAAW,EAAE,SAAS;gBACtB,MAAM,EAAE,SAAS;aAClB,CAAC,CAAA;YAEF,MAAM,GAAG,GAAG,GAAG,YAAY,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;YAElD,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAA;QAC3B,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAA;YAEtC,uEAAuE;YACvE,MAAM,cAAc,GAAG,IAAI,eAAe,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;YACjE,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACvC,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAEzC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;gBACjB,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAA;YACtC,CAAC;YAED,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBAClC,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACvC,CAAC;YAED,sDAAsD;YACtD,MAAM,YAAY,GAAG,MAAM,KAAK,CAAO,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;YACvE,IAAI,YAAY,IAAI,IAAI,IAAI,YAAY,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;gBAC1D,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,6DAA6D;YAC7D,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,CAAA;YAC5C,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;gBACxB,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,2BAA2B;YAC3B,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,qBAAqB,CAAA;YACnE,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;gBAC/C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,IAAI;oBACJ,SAAS,EAAE,MAAM,CAAC,QAAQ;oBAC1B,aAAa,EAAE,MAAM,CAAC,MAAM;oBAC5B,YAAY,EAAE,WAAW;oBACzB,UAAU,EAAE,oBAAoB;oBAChC,aAAa,EAAE,YAAY,CAAC,QAAQ;iBACrC,CAAC;aACH,CAAC,CAAA;YAEF,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;gBACtB,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAiD,CAAA;YACxF,IAAI,MAAM,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;gBAChC,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,kBAAkB;YAClB,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,wBAAwB,CAAA;YAC5E,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;gBACrD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,YAAY,EAAE,EAAE;aAC5D,CAAC,CAAA;YAEF,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;gBACzB,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAE3C,CAAA;YAED,IAAI,QAAQ,CAAC,GAAG,IAAI,IAAI,IAAI,QAAQ,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;gBACnD,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,6DAA6D;YAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;YAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAkC,CAAA;YACnE,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAA;YACpD,CAAC;YAED,MAAM,cAAc,GAA2B;gBAC7C,IAAI,EAAE,kBAAkB;gBACxB,OAAO;gBACP,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,QAAQ,CAAC,GAAG;gBACpB,QAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK;aAC1C,CAAA;YAED,IAAI,OAAO,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAA;YAE1D,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,cAAc,EAAE;oBAChD,QAAQ,EAAE,QAAQ,CAAC,KAAK;oBACxB,KAAK,EAAE,KAAK;iBACb,CAAC,CAAA;YACJ,CAAC;YAED,qEAAqE;YACrE,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YACpD,MAAM,KAAK,CAAO,OAAO,CAAC,CAAC,MAAM,CAC/B,EAAE,EAAE,EAAE,UAAU,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,MAAa,EAAE,EACzD,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CACjC,CAAA;YAED,UAAU,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,CAAA;YAChC,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAA;YACnC,UAAU,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;YAC/B,UAAU,CAAC,IAAI,GAAG,kBAAkB,CAAA;YACpC,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;YAClC,UAAU,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;YACxC,UAAU,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;YAE1C,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAA;QACjC,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}
|
|
@@ -4,7 +4,7 @@ import { OIDC_CLIENT_AUTH } from '@owlmeans/oidc';
|
|
|
4
4
|
import { base64urlnopad as base64 } from '@scure/base';
|
|
5
5
|
import { randomBytes } from '@noble/hashes/utils';
|
|
6
6
|
import { sha256 } from '@noble/hashes/sha256';
|
|
7
|
-
import { ALL_SCOPES, AuthenFailed, AuthenPayloadError, AuthManagerError, AuthRole } from '@owlmeans/auth';
|
|
7
|
+
import { ALL_SCOPES, AuthenFailed, AuthenPayloadError, AuthManagerError, AuthRole, entitySlugOf } from '@owlmeans/auth';
|
|
8
8
|
import { AUTHEN_TIMEFRAME } from '@owlmeans/server-auth';
|
|
9
9
|
import { decodeJwt } from 'jose';
|
|
10
10
|
import { KEY_OWL } from '@owlmeans/did';
|
|
@@ -69,7 +69,7 @@ export const oidcClientPlugin = (context) => {
|
|
|
69
69
|
}
|
|
70
70
|
// @TODO Actually think about how to make oidc service configurable
|
|
71
71
|
const oidc = context.service(DEFAULT_ALIAS);
|
|
72
|
-
let entityId = request
|
|
72
|
+
let entityId = entitySlugOf(request) ?? oidc.getDefault();
|
|
73
73
|
if (entityId == null) {
|
|
74
74
|
throw new AuthenPayloadError('client');
|
|
75
75
|
}
|
|
@@ -203,7 +203,7 @@ export const oidcClientPlugin = (context) => {
|
|
|
203
203
|
credential.type = OIDC_CLIENT_AUTH;
|
|
204
204
|
credential.userId = profile.userId;
|
|
205
205
|
credential.profileId = profile.profileId;
|
|
206
|
-
credential.
|
|
206
|
+
credential.entitySlug = profile.entitySlug;
|
|
207
207
|
return { token: exchangeToken };
|
|
208
208
|
}
|
|
209
209
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc-client.js","sourceRoot":"","sources":["../../../src/auth/plugins/oidc-client.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAA;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEjD,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;
|
|
1
|
+
{"version":3,"file":"oidc-client.js","sourceRoot":"","sources":["../../../src/auth/plugins/oidc-client.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAA;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEjD,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACvH,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,4BAA4B;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAyC,OAAU,EAAc,EAAE;IACjG,MAAM,YAAY,GAAG,sBAAsB,CAAO,OAAO,CAAC,CAAA;IAE1D,MAAM,MAAM,GAAe;QACzB,IAAI,EAAE,gBAAgB;QAEtB,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACpB,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAEhC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,KAAK,KAAK,EAAE,CAAC;gBACnD,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAA;YAC7C,CAAC;YAED,mEAAmE;YACnE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;YAC9D,IAAI,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAA;YAEzD,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YAED,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACpF,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC;mBAClD,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;YAEjD,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;YAEnH,MAAM,KAAK,CAAO,OAAO,CAAC,CAAC,MAAM,CAAC;gBAChC,EAAE,EAAE,UAAU,CAAC,SAAS,CAAC;gBACzB,QAAQ;gBACR,MAAM,EAAE,QAAQ;aACjB,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;YAEpC,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAA;YAC9C,CAAC;YAED,8CAA8C;YAE9C,qDAAqD;YACrD,yCAAyC;YACzC,IAAI;YAEJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;YAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC;gBAC7B,KAAK,EAAE,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC;gBACvC,cAAc,EAAE,SAAS;gBACzB,qBAAqB,EAAE,MAAM;gBAC7B,YAAY,EAAE,OAAO,CAAC,MAAM;aAC7B,CAAC,CAAA;YAEF,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAA;QAC3B,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;YAC9B,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,aAAa,CAAC,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,CAAA;YAErE,IAAI,QAAQ,CAAC,QAAQ,IAAI,IAAI,IAAI,QAAQ,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;gBAC/D,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;YAC9D,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAExC,IAAI,GAAG,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;gBACpB,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAA;YACnC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAA;YAClD,CAAC;YAED,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBACxB,MAAM,IAAI,gBAAgB,CAAC,cAAc,CAAC,CAAA;YAC5C,CAAC;YAED,IAAI,OAAO,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC;gBACzC,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,MAAM,EAAE,GAAG,CAAC,GAAG;aACiB,CAAC,CAAA;YAEnC,oEAAoE;YACpE,6CAA6C;YAC7C,oEAAoE;YACpE,sEAAsE;YACtE,IAAI,OAAwB,CAAA;YAC5B,IAAI,GAAG,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBACd,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;gBACvD,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,oBAAoB,EAAE,CAAA;gBAC1D,IAAI,WAAW,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;oBACrC,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAA;gBACzC,CAAC;gBACD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;gBAC9B,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;oBAChB,mEAAmE;oBACnE,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAA;gBAC7C,CAAC;gBACD,OAAO,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,CAAA;YACvE,CAAC;iBAAM,CAAC;gBACN,2EAA2E;gBAC3E,yCAAyC;gBACzC,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAA;YAC3C,CAAC;YAED;YACE,iBAAiB;YACjB,OAAO,IAAI,IAAI;gBACf,yDAAyD;mBACtD,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC,EACjG,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBACd,OAAO,CAAC,YAAY,KAAK,GAAG,CAAC,QAAQ,IAAI,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,GAAG,CAAC,eAAe,CAAA;gBAC7F,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;oBAChE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAA;gBAC9C,CAAC;gBACD,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAA;gBACpF,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;oBAC7B,oFAAoF;oBACpF,gFAAgF;oBAChF,MAAM,IAAI,gBAAgB,CAAC,YAAY,CAAC,CAAA;gBAC1C,CAAC;gBAGD,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;gBAElG,4DAA4D;gBAC5D,uCAAuC;gBACvC,IAAI,OAAO,IAAI,IAAI,IAAI,CACrB,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,GAAG,CAAC,eAAe;oBAChD,4CAA4C;oBAC5C,iEAAiE;oBACjE,wEAAwE;oBACxE,8DAA8D;oBAC9D,oEAAoE;oBACpE,kFAAkF;oBAClF,4EAA4E;oBAC5E,oFAAoF;oBACpF,uDAAuD;uBACpD,OAAO,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,CACrC,EAAE,CAAC;oBACF,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;oBACvB,OAAO,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC;wBAChC,GAAG,OAAO;wBACV,OAAO,EAAE,GAAG,CAAC,OAAO;wBACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;wBACtB,IAAI,EAAE,gBAAgB;qBACvB,EAAE;wBACD,QAAQ,EAAE,GAAG,CAAC,kBAA4B,IAAI,OAAO,CAAC,QAAQ;wBAC9D,kFAAkF;wBAClF,KAAK,EAAE,KAAK;qBACb,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YAEd,UAAU,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,CAAA;YAChC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAA;YAChC,UAAU,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;YAC/B,UAAU,CAAC,IAAI,GAAG,gBAAgB,CAAA;YAClC,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;YAClC,UAAU,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;YACxC,UAAU,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;YAE1C,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAA;QACjC,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAQ5D,eAAO,MAAM,2BAA2B,gBACzB,gBAAgB,EAAE,gBACjB,MAAM,WACZ,MAAM,SAkBf,CAAA"}
|
|
@@ -0,0 +1,12 @@
|
|
|
1
|
+
import { entrypoint, guard, filter, body } from '@owlmeans/entrypoint';
|
|
2
|
+
import { backend, route, RouteMethod, service } from '@owlmeans/route';
|
|
3
|
+
import { authService } from './consts.js';
|
|
4
|
+
import { elevate } from '@owlmeans/client-entrypoint';
|
|
5
|
+
import { GUARD_ED25519 } from '@owlmeans/auth-common';
|
|
6
|
+
import { OIDCTokenUpdateSchema } from '@owlmeans/oidc';
|
|
7
|
+
export const setupAuthServiceEntrypoints = (entrypoints, serviceAlias, prefix = 'oidc-api') => {
|
|
8
|
+
entrypoints.push(entrypoint(route(authService.provider.list, `/${prefix}/provider/:service`, service(serviceAlias)), guard(GUARD_ED25519)), entrypoint(route(authService.auth.update, `/${prefix}/auth/update`, backend(service(serviceAlias), RouteMethod.POST)), filter(body(OIDCTokenUpdateSchema), guard(GUARD_ED25519))));
|
|
9
|
+
elevate(entrypoints, authService.provider.list);
|
|
10
|
+
elevate(entrypoints, authService.auth.update);
|
|
11
|
+
};
|
|
12
|
+
//# sourceMappingURL=entrypoints.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAA;AACtE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAEtD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,WAA+B,EAC/B,YAAoB,EACpB,MAAM,GAAW,UAAU,EAC3B,EAAE;IACF,WAAW,CAAC,IAAI,CACd,UAAU,CACR,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,MAAM,oBAAoB,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,EACvF,KAAK,CAAC,aAAa,CAAC,CACrB,EACD,UAAU,CACR,KAAK,CACH,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,MAAM,cAAc,EACjD,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,CACjD,EACD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAC1D,CACF,CAAA;IAED,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC/C,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AAC/C,CAAC,CAAA"}
|
package/build/guard.d.ts
CHANGED
|
@@ -2,5 +2,5 @@ import type { OidcGuardOptions } from '@owlmeans/oidc';
|
|
|
2
2
|
import type { Config, Context } from './types.js';
|
|
3
3
|
import type { CommonEntrypoint } from '@owlmeans/entrypoint';
|
|
4
4
|
export declare const appendOidcGuard: <C extends Config, T extends Context<C>>(context: T, opts?: OidcGuardOptions) => T;
|
|
5
|
-
export declare const setupOidcGuard: (
|
|
5
|
+
export declare const setupOidcGuard: (entrypoints: CommonEntrypoint[], coguards?: string | string[]) => void;
|
|
6
6
|
//# sourceMappingURL=guard.d.ts.map
|
package/build/guard.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAS5D,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WAC3D,CAAC,SAAS,gBAAgB,MAKpC,CAAA;AAED,eAAO,MAAM,cAAc,
|
|
1
|
+
{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAS5D,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WAC3D,CAAC,SAAS,gBAAgB,MAKpC,CAAA;AAED,eAAO,MAAM,cAAc,gBAAiB,gBAAgB,EAAE,aAAa,MAAM,GAAG,MAAM,EAAE,SAK3F,CAAA"}
|
package/build/guard.js
CHANGED
|
@@ -5,9 +5,9 @@ export const appendOidcGuard = (context, opts) => {
|
|
|
5
5
|
const ctx = appendBasicOidcGuard(context, opts);
|
|
6
6
|
return ctx;
|
|
7
7
|
};
|
|
8
|
-
export const setupOidcGuard = (
|
|
9
|
-
setupBasicOidcGuard(
|
|
10
|
-
elevate(
|
|
11
|
-
elevate(
|
|
8
|
+
export const setupOidcGuard = (entrypoints, coguards) => {
|
|
9
|
+
setupBasicOidcGuard(entrypoints, coguards);
|
|
10
|
+
elevate(entrypoints, DISPATCHER_OIDC_INIT, actions.init);
|
|
11
|
+
elevate(entrypoints, DISPATCHER_OIDC, actions.authenticate);
|
|
12
12
|
};
|
|
13
13
|
//# sourceMappingURL=guard.js.map
|
package/build/guard.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,eAAe,IAAI,oBAAoB,EACvC,cAAc,IAAI,mBAAmB,EACrC,eAAe,EAAE,oBAAoB,EACtC,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AACrD,OAAO,KAAK,OAAO,MAAM,oBAAoB,CAAA;AAE7C,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,OAAU,EAAE,IAAuB,EACnC,EAAE;IACF,MAAM,GAAG,GAAG,oBAAoB,CAAO,OAAO,EAAE,IAAI,CAAC,CAAA;IAErD,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,
|
|
1
|
+
{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,eAAe,IAAI,oBAAoB,EACvC,cAAc,IAAI,mBAAmB,EACrC,eAAe,EAAE,oBAAoB,EACtC,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AACrD,OAAO,KAAK,OAAO,MAAM,oBAAoB,CAAA;AAE7C,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,OAAU,EAAE,IAAuB,EACnC,EAAE;IACF,MAAM,GAAG,GAAG,oBAAoB,CAAO,OAAO,EAAE,IAAI,CAAC,CAAA;IAErD,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,WAA+B,EAAE,QAA4B,EAAE,EAAE;IAC9F,mBAAmB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IAE1C,OAAO,CAAC,WAAW,EAAE,oBAAoB,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IACxD,OAAO,CAAC,WAAW,EAAE,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;AAC7D,CAAC,CAAA"}
|
package/build/index.d.ts
CHANGED
|
@@ -3,7 +3,7 @@ export * from './consts.js';
|
|
|
3
3
|
export * from './service.js';
|
|
4
4
|
export * from './guard.js';
|
|
5
5
|
export * from './gate.js';
|
|
6
|
-
export * from './
|
|
6
|
+
export * from './entrypoints.js';
|
|
7
7
|
export * from './wrapper.js';
|
|
8
8
|
export { createGateModel } from './model/gate.js';
|
|
9
9
|
export { extractPermissionSets } from './utils/permissions.js';
|
package/build/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,oBAAoB,EACpB,YAAY,EACZ,sBAAsB,EACtB,eAAe,EACf,kBAAkB,EAClB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,EACZ,MAAM,EACN,OAAO,EACP,qBAAqB,EACrB,WAAW,EACX,kBAAkB,GACnB,MAAM,YAAY,CAAA;AACnB,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,oBAAoB,EACpB,YAAY,EACZ,sBAAsB,EACtB,eAAe,EACf,kBAAkB,EAClB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,EACZ,MAAM,EACN,OAAO,EACP,qBAAqB,EACrB,WAAW,EACX,kBAAkB,GACnB,MAAM,YAAY,CAAA;AACnB,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,kBAAkB,CAAA;AAChC,cAAc,cAAc,CAAA;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA"}
|
package/build/index.js
CHANGED
|
@@ -2,7 +2,7 @@ export * from './consts.js';
|
|
|
2
2
|
export * from './service.js';
|
|
3
3
|
export * from './guard.js';
|
|
4
4
|
export * from './gate.js';
|
|
5
|
-
export * from './
|
|
5
|
+
export * from './entrypoints.js';
|
|
6
6
|
export * from './wrapper.js';
|
|
7
7
|
export { createGateModel } from './model/gate.js';
|
|
8
8
|
export { extractPermissionSets } from './utils/permissions.js';
|
package/build/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAiBA,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAiBA,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,kBAAkB,CAAA;AAChC,cAAc,cAAc,CAAA;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA"}
|
package/build/model/gate.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { AuthForbidden, AuthManagerError, AuthManagerUnsupported, AuthUnknown } from '@owlmeans/auth';
|
|
1
|
+
import { AuthForbidden, AuthManagerError, AuthManagerUnsupported, AuthUnknown, entitySlugOf } from '@owlmeans/auth';
|
|
2
2
|
import { authService, DEFAULT_ALIAS } from '../consts.js';
|
|
3
3
|
import { cache, managedId } from '../utils/cache.js';
|
|
4
4
|
import { ResponseMode } from './consts.js';
|
|
@@ -8,15 +8,15 @@ export const createGateModel = (ctx) => {
|
|
|
8
8
|
const oidc = ctx.service(DEFAULT_ALIAS);
|
|
9
9
|
try {
|
|
10
10
|
return await oidc.getClient({
|
|
11
|
-
entityId: user
|
|
12
|
-
clientId: oidc.entityToClientId({ entityId: user
|
|
11
|
+
entityId: entitySlugOf(user),
|
|
12
|
+
clientId: oidc.entityToClientId({ entityId: entitySlugOf(user) })
|
|
13
13
|
});
|
|
14
14
|
}
|
|
15
15
|
catch (e) {
|
|
16
16
|
if (e instanceof AuthManagerError) {
|
|
17
|
-
const
|
|
17
|
+
const providers = await ctx.entrypoint(authService.provider.list).call({
|
|
18
18
|
params: { service: ctx.cfg.alias ?? ctx.cfg.service },
|
|
19
|
-
query: { entityId: user
|
|
19
|
+
query: { entityId: entitySlugOf(user) }
|
|
20
20
|
});
|
|
21
21
|
if (providers.length < 1) {
|
|
22
22
|
throw new AuthUnknown();
|
|
@@ -57,7 +57,7 @@ export const createGateModel = (ctx) => {
|
|
|
57
57
|
&& (scope == null || (proof.scopes?.includes(scope) ?? false));
|
|
58
58
|
});
|
|
59
59
|
},
|
|
60
|
-
fixPermissions: (permissions, user) => permissions.map(perm => perm.replaceAll('{entity}', user
|
|
60
|
+
fixPermissions: (permissions, user) => permissions.map(perm => perm.replaceAll('{entity}', entitySlugOf(user) ?? '-')),
|
|
61
61
|
prepareRequest: async (client, request) => {
|
|
62
62
|
let { permission, ..._request } = request;
|
|
63
63
|
const params = new URLSearchParams(_request);
|
package/build/model/gate.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/model/gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;
|
|
1
|
+
{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/model/gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACnH,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAEzD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAEpD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAI1C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAyC,GAAM,EAAa,EAAE;IAC3F,MAAM,KAAK,GAAc;QACvB,SAAS,EAAE,KAAK,EAAC,IAAI,EAAC,EAAE;YACtB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;YAC1D,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC;oBAC1B,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC;oBAC5B,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;iBAClE,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,gBAAgB,EAAE,CAAC;oBAClC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,UAAU,CACpC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAC1B,CAAC,IAAI,CAAC;wBACL,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE;wBACrD,KAAK,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE;qBACxC,CAAC,CAAA;oBACF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACzB,MAAM,IAAI,WAAW,EAAE,CAAA;oBACzB,CAAC;oBACD,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;oBAE5C,OAAO,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;gBAC9B,CAAC;gBACD,MAAM,CAAC,CAAA;YACT,CAAC;QACH,CAAC;QAED,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;YAC3C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAO,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;YAChE,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAA;YACnC,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YAE1C,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,EAAE,CAAA;YACrC,MAAM,aAAa,GAAG,QAAQ,CAAC,cAAc,CAAA;YAE7C,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,MAAM,IAAI,sBAAsB,CAAC,WAAW,CAAC,CAAA;YAC/C,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,WAAW,CACrC,KAAK,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,EACvC,MAAM,CACP,CAAA;YAED,OAAO,CAAC,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAA;YAEnD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,aAAa,EACb,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAC5C,CAAA;YAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC5B,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC,CAAA;gBAClC,CAAC;gBAED,OAAO,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;gBACnC,OAAO,EAAE,CAAA;YACX,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA0B,CAAA;YAE5D,OAAO,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;gBACrC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAA;gBACxD,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAA;gBAC5E,OAAO,KAAK,IAAI,IAAI;uBACf,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAA;YAClE,CAAC,CAAC,CAAA;QACJ,CAAC;QAED,cAAc,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CACpD,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAC/D;QAED,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;YACxC,IAAI,EAAE,UAAU,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAA;YACzC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAA;YAC5C,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;YAClE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAA;YAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;YAE9B,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;YAE9B,MAAM,OAAO,GAAG;gBACd,cAAc,EAAE,mCAAmC;gBACnD,eAAe,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;gBACnG,gBAAgB,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE;aACnC,CAAA;YAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;QAC1C,CAAC;QAED,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE;YACzC,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;YAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,EAAE,CAAA;YACrC,MAAM,UAAU,GAAG;gBACjB,UAAU,EAAE,6CAA6C;gBACzD,QAAQ,EAAE,QAAQ;gBAClB,SAAS,EAAE,QAAQ;gBACnB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE;oBACpD,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;oBAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;oBAC/D,IAAI,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;wBACb,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,EAAE,CAAA;oBAC7B,CAAC;yBAAM,CAAC;wBACN,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;oBACvD,CAAC;oBACD,OAAO,MAAM,CAAA;gBACf,CAAC,EAAE,EAAc,CAAC;gBAClB,aAAa,EAAE,YAAY,CAAC,WAAW;aACZ,CAAA;YAE7B,OAAO,UAAU,CAAA;QACnB,CAAC;KACF,CAAA;IAED,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}
|
package/build/utils/auth.js
CHANGED
|
@@ -18,7 +18,7 @@ export const makeOidcAuthentication = (context) => async (credential) => {
|
|
|
18
18
|
throw new AuthenPayloadError('code_challenge');
|
|
19
19
|
}
|
|
20
20
|
console.log("\n\nWe are picking verifier by id: ", verifierId(challenge));
|
|
21
|
-
const verification = await cache(context).
|
|
21
|
+
const verification = await cache(context).take(verifierId(challenge));
|
|
22
22
|
console.log("Verification we get: ", verification, "\n\n");
|
|
23
23
|
if (verification.verifier == null) {
|
|
24
24
|
throw new AuthenFailed();
|
package/build/wrapper.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"wrapper.d.ts","sourceRoot":"","sources":["../src/wrapper.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAyC,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAc/F,eAAO,MAAM,uBAAuB,QAAO,
|
|
1
|
+
{"version":3,"file":"wrapper.d.ts","sourceRoot":"","sources":["../src/wrapper.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAyC,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAc/F,eAAO,MAAM,uBAAuB,QAAO,kBAqI1C,CAAA"}
|
package/build/wrapper.js
CHANGED
|
@@ -33,7 +33,7 @@ export const makeOidcWrappingService = () => {
|
|
|
33
33
|
}
|
|
34
34
|
record.validated = new Date();
|
|
35
35
|
if (ctx.hasEntrypoint(authService.auth.update)) {
|
|
36
|
-
const
|
|
36
|
+
const update = await ctx.entrypoint(authService.auth.update)
|
|
37
37
|
.call({ body: { token, tokenSet: record.payload } });
|
|
38
38
|
const updateEnvelope = makeEnvelopeModel(update.token, EnvelopeKind.Token);
|
|
39
39
|
const authManager = await trust(ctx, TRUSTED, AUTH_SRV_KEY);
|
|
@@ -46,11 +46,11 @@ export const makeOidcWrappingService = () => {
|
|
|
46
46
|
role: updatedAuth.role ?? AuthRole.Guest,
|
|
47
47
|
userId: updatedAuth.userId ?? user.userId,
|
|
48
48
|
profileId: updatedAuth.profileId,
|
|
49
|
-
|
|
49
|
+
entitySlug: updatedAuth.entitySlug ?? user.entitySlug,
|
|
50
50
|
createdAt: new Date()
|
|
51
51
|
};
|
|
52
52
|
if (updatedAuth.challenge !== user.token) {
|
|
53
|
-
await cache(ctx).delete(
|
|
53
|
+
await cache(ctx).delete(managedId(user.token));
|
|
54
54
|
updatedUser.token = updatedAuth.challenge;
|
|
55
55
|
record.id = managedId(updatedUser.token);
|
|
56
56
|
}
|
|
@@ -67,10 +67,25 @@ export const makeOidcWrappingService = () => {
|
|
|
67
67
|
if (defaultClientId != null) {
|
|
68
68
|
let tokenSet = record.payload;
|
|
69
69
|
const client = await oidc.getClient(defaultClientId);
|
|
70
|
-
|
|
70
|
+
// Revalidate using only what this session and this provider actually support.
|
|
71
|
+
// `expires_at` is the token set's own absolute expiry; **absent is not expired** —
|
|
72
|
+
// reading a missing value as the epoch (the former `?? 0`) sent every single
|
|
73
|
+
// validation, including one moments after login, down the refresh path. That path
|
|
74
|
+
// cannot work for a session granted without `offline_access`, because such a token
|
|
75
|
+
// set carries no refresh token at all, so a valid login died as a 403.
|
|
76
|
+
const expiresAt = tokenSet.expires_at;
|
|
77
|
+
if (expiresAt != null && days.unix(expiresAt).isBefore()) {
|
|
78
|
+
if (tokenSet.refresh_token == null) {
|
|
79
|
+
// Expired with nothing to renew it — the user has to authenticate again.
|
|
80
|
+
throw new AuthorizationError('access-token');
|
|
81
|
+
}
|
|
71
82
|
tokenSet = await client.refresh(tokenSet);
|
|
72
83
|
}
|
|
73
|
-
else {
|
|
84
|
+
else if (client.getMetadata().introspection_endpoint != null) {
|
|
85
|
+
// Introspection is the only way to notice a revocation that happened before the
|
|
86
|
+
// token's own expiry, so it stays the check of choice — but it is an optional
|
|
87
|
+
// provider feature. Calling an endpoint the discovery document never advertised
|
|
88
|
+
// throws, which would fail the session for the opposite reason to the one above.
|
|
74
89
|
const result = await client.introspect(tokenSet, 'access_token');
|
|
75
90
|
if (!result.active) {
|
|
76
91
|
throw new AuthorizationError('access-token');
|
package/build/wrapper.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"wrapper.js","sourceRoot":"","sources":["../src/wrapper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAE3E,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACjE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAEnD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAClG,OAAO,IAAI,MAAM,OAAO,CAAA;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAChC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAE9D,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AAEnD,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAuB,EAAE;IAC9D,MAAM,OAAO,GAAG,aAAa,CAAqB,YAAY,EAAE;QAC9D,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YAChD,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAA;YACxD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACvC,CAAC;YACD,MAAM,CAAC,EAAE,cAAc,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC3C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,cAAc,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAC5E,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YAE/B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;gBAC1D,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;oBAC7C,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;gBACxC,CAAC;gBAED,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;qBACnD,GAAG,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;oBACtD,OAAO,EAAE,KAAK,EAAE,CAAA;gBAClB,CAAC;gBAED,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAA;gBAE7B,IAAI,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC/C,MAAM,
|
|
1
|
+
{"version":3,"file":"wrapper.js","sourceRoot":"","sources":["../src/wrapper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAE3E,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACjE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAEnD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAClG,OAAO,IAAI,MAAM,OAAO,CAAA;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAChC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAE9D,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AAEnD,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAuB,EAAE;IAC9D,MAAM,OAAO,GAAG,aAAa,CAAqB,YAAY,EAAE;QAC9D,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YAChD,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAA;YACxD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACvC,CAAC;YACD,MAAM,CAAC,EAAE,cAAc,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC3C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,cAAc,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAC5E,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YAE/B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;gBAC1D,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;oBAC7C,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;gBACxC,CAAC;gBAED,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;qBACnD,GAAG,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;oBACtD,OAAO,EAAE,KAAK,EAAE,CAAA;gBAClB,CAAC;gBAED,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAA;gBAE7B,IAAI,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC/C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAoC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;yBAC5F,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;oBAEtD,MAAM,cAAc,GAAG,iBAAiB,CAAkB,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;oBAC3F,MAAM,WAAW,GAAG,MAAM,KAAK,CAAkB,GAAG,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;oBAC5E,IAAI,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;wBAClD,MAAM,IAAI,YAAY,EAAE,CAAA;oBAC1B,CAAC;oBAED,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,EAAE,CAAA;oBAE5C,MAAM,WAAW,GAAS;wBACxB,GAAG,IAAI;wBACP,IAAI,EAAE,WAAW,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK;wBACxC,MAAM,EAAE,WAAW,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM;wBACzC,SAAS,EAAE,WAAW,CAAC,SAAS;wBAChC,UAAU,EAAE,WAAW,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU;wBACrD,SAAS,EAAE,IAAI,IAAI,EAAE;qBACtB,CAAA;oBAED,IAAI,WAAW,CAAC,SAAS,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;wBACzC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;wBAC9C,WAAW,CAAC,KAAK,GAAG,WAAW,CAAC,SAAS,CAAA;wBACzC,MAAM,CAAC,EAAE,GAAG,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;oBAC1C,CAAC;oBAGD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;oBAC5F,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAO,kBAAkB,CAAC;yBACpE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;oBAEhE,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,QAAkC,CAAA;oBAE1D,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,mBAAmB,GAAG,IAAI,EAAE,CAAC,CAAA;oBAElE,OAAO,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,WAAW,EAAE,IAAI,aAAa,EAAE,EAAE,CAAA;gBAC1E,CAAC;qBAAM,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;oBAClC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;oBAC1D,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;oBACzC,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;wBAC5B,IAAI,QAAQ,GAAyB,MAAM,CAAC,OAA+B,CAAA;wBAC3E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;wBAEpD,8EAA8E;wBAC9E,mFAAmF;wBACnF,6EAA6E;wBAC7E,kFAAkF;wBAClF,mFAAmF;wBACnF,uEAAuE;wBACvE,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAA;wBACrC,IAAI,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;4BACzD,IAAI,QAAQ,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;gCACnC,yEAAyE;gCACzE,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAA;4BAC9C,CAAC;4BACD,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,QAAkC,CAAyB,CAAA;wBAC7F,CAAC;6BAAM,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,sBAAsB,IAAI,IAAI,EAAE,CAAC;4BAC/D,gFAAgF;4BAChF,8EAA8E;4BAC9E,gFAAgF;4BAChF,iFAAiF;4BACjF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,QAAkC,EAAE,cAAc,CAAC,CAAA;4BAC1F,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gCACnB,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAA;4BAC9C,CAAC;wBACH,CAAC;wBAED,MAAM,WAAW,GAAS;4BACxB,GAAG,IAAI;4BACP,SAAS,EAAE,IAAI,IAAI,EAAE;yBACtB,CAAA;wBAED,qEAAqE;wBACrE,IAAI,QAAQ,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;4BAC9B,MAAM,WAAW,GAAG,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAA;4BAC1F,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;gCACxB,WAAW,CAAC,WAAW,GAAG,WAAW,CAAA;gCACrC,WAAW,CAAC,YAAY,GAAG,IAAI,CAAA;4BACjC,CAAC;wBACH,CAAC;wBAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;wBAC5F,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAO,kBAAkB,CAAC;6BACpE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;wBAEhE,MAAM,CAAC,OAAO,GAAG,QAAkC,CAAA;wBAEnD,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,mBAAmB,GAAG,IAAI,EAAE,CAAC,CAAA;wBAElE,OAAO,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,WAAW,EAAE,IAAI,aAAa,EAAE,EAAE,CAAA;oBAC1E,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAClB,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;gBAC9C,IAAI,GAAG,EAAE,CAAC;oBACR,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;wBACtC,MAAM,GAAG,CAAA;oBACX,CAAC;oBACD,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;gBACzC,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@owlmeans/server-oidc-rp",
|
|
3
|
-
"version": "0.1.18-rc.
|
|
3
|
+
"version": "0.1.18-rc.20",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"scripts": {
|
|
@@ -37,29 +37,29 @@
|
|
|
37
37
|
},
|
|
38
38
|
"devDependencies": {
|
|
39
39
|
"@owlmeans/dep-config": "workspace:*",
|
|
40
|
-
"@owlmeans/test-auth": "^0.1.18-rc.
|
|
41
|
-
"@types/bun": "^1.
|
|
40
|
+
"@owlmeans/test-auth": "^0.1.18-rc.15",
|
|
41
|
+
"@types/bun": "^1.4.0",
|
|
42
42
|
"@types/node": "^26.1.0",
|
|
43
43
|
"nodemon": "^3.1.14",
|
|
44
44
|
"typescript": "^7.0.2"
|
|
45
45
|
},
|
|
46
46
|
"dependencies": {
|
|
47
47
|
"@noble/hashes": "^1.5.0",
|
|
48
|
-
"@owlmeans/auth": "^0.1.18-rc.
|
|
49
|
-
"@owlmeans/auth-common": "^0.1.18-rc.
|
|
50
|
-
"@owlmeans/basic-envelope": "^0.1.18-rc.
|
|
51
|
-
"@owlmeans/client-entrypoint": "^0.1.18-rc.
|
|
52
|
-
"@owlmeans/config": "^0.1.18-rc.
|
|
53
|
-
"@owlmeans/context": "^0.1.18-rc.
|
|
54
|
-
"@owlmeans/did": "^0.1.18-rc.
|
|
55
|
-
"@owlmeans/entrypoint": "^0.1.18-rc.
|
|
56
|
-
"@owlmeans/oidc": "^0.1.18-rc.
|
|
57
|
-
"@owlmeans/resource": "^0.1.18-rc.
|
|
58
|
-
"@owlmeans/route": "^0.1.18-rc.
|
|
59
|
-
"@owlmeans/server-api": "^0.1.18-rc.
|
|
60
|
-
"@owlmeans/server-auth": "^0.1.18-rc.
|
|
61
|
-
"@owlmeans/server-context": "^0.1.18-rc.
|
|
62
|
-
"@owlmeans/server-entrypoint": "^0.1.18-rc.
|
|
48
|
+
"@owlmeans/auth": "^0.1.18-rc.11",
|
|
49
|
+
"@owlmeans/auth-common": "^0.1.18-rc.15",
|
|
50
|
+
"@owlmeans/basic-envelope": "^0.1.18-rc.14",
|
|
51
|
+
"@owlmeans/client-entrypoint": "^0.1.18-rc.15",
|
|
52
|
+
"@owlmeans/config": "^0.1.18-rc.14",
|
|
53
|
+
"@owlmeans/context": "^0.1.18-rc.10",
|
|
54
|
+
"@owlmeans/did": "^0.1.18-rc.14",
|
|
55
|
+
"@owlmeans/entrypoint": "^0.1.18-rc.13",
|
|
56
|
+
"@owlmeans/oidc": "^0.1.18-rc.15",
|
|
57
|
+
"@owlmeans/resource": "^0.1.18-rc.11",
|
|
58
|
+
"@owlmeans/route": "^0.1.18-rc.11",
|
|
59
|
+
"@owlmeans/server-api": "^0.1.18-rc.19",
|
|
60
|
+
"@owlmeans/server-auth": "^0.1.18-rc.20",
|
|
61
|
+
"@owlmeans/server-context": "^0.1.18-rc.14",
|
|
62
|
+
"@owlmeans/server-entrypoint": "^0.1.18-rc.13",
|
|
63
63
|
"@scure/base": "^2.3.0",
|
|
64
64
|
"dayjs": "^1.11.13",
|
|
65
65
|
"jose": "6.2.5",
|
package/src/actions/init.ts
CHANGED
|
@@ -45,7 +45,7 @@ export const init: RefedEntrypointHandler = handleBody(async (body: OIDCAuthInit
|
|
|
45
45
|
* @TODO We need to move it to some remote resource.
|
|
46
46
|
* And make oidc service itself use such a resource to get required client.
|
|
47
47
|
*/
|
|
48
|
-
const
|
|
48
|
+
const providers = await context.entrypoint<ClientEntrypoint<OidcProviderDescriptor[]>>(
|
|
49
49
|
authService.provider.list
|
|
50
50
|
).call({
|
|
51
51
|
params: { service: context.cfg.alias ?? context.cfg.service },
|
|
@@ -93,7 +93,7 @@ export const init: RefedEntrypointHandler = handleBody(async (body: OIDCAuthInit
|
|
|
93
93
|
...(entityIdUsedForResolution ? { entityId } : {}),
|
|
94
94
|
}, { ttl: AUTHEN_TIMEFRAME / 1000 })
|
|
95
95
|
|
|
96
|
-
const
|
|
96
|
+
const dispatcherUrl = await context.entrypoint<ClientEntrypoint<string>>(DISPATCHER).url()
|
|
97
97
|
|
|
98
98
|
const cfg = client.getConfig()
|
|
99
99
|
const url = client.makeAuthUrl({
|
package/src/actions/process.ts
CHANGED
|
@@ -59,18 +59,11 @@ export const authenticate: RefedEntrypointHandler = handleBody(async (
|
|
|
59
59
|
|
|
60
60
|
await cache(context).delete(exchangeId(token))
|
|
61
61
|
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
62
|
+
// Only the id_token is guaranteed to be a JWT. An access token's format is provider-private —
|
|
63
|
+
// `oidc-provider` issues opaque ones by default — so decoding it throws `JWTInvalid` and, from
|
|
64
|
+
// inside this handler, fails the whole exchange after it has already succeeded. Nothing here
|
|
65
|
+
// needs it either: the permission grant is read from the id_token below.
|
|
67
66
|
const id = decodeJwt(tokenSet.id_token)
|
|
68
|
-
console.log(
|
|
69
|
-
'token set',
|
|
70
|
-
tokenSet,
|
|
71
|
-
tokenSet.claims(),
|
|
72
|
-
id
|
|
73
|
-
)
|
|
74
67
|
|
|
75
68
|
// Integrated IAM mode: the provider mints the subject's PermissionSet[] into the id_token
|
|
76
69
|
const permissions = extractPermissionSets(id[PERMISSIONS_CLAIM])
|
|
@@ -95,7 +88,7 @@ export const authenticate: RefedEntrypointHandler = handleBody(async (
|
|
|
95
88
|
// @TODO Actually this is highly incorrect - we need to get profile details
|
|
96
89
|
// from the OwlMeans Auth intead
|
|
97
90
|
// profileId: user?.userId,
|
|
98
|
-
|
|
91
|
+
entitySlug: cfg.entityId,
|
|
99
92
|
...(permissions != null ? { permissions, permissioned: true } : {}),
|
|
100
93
|
isUser: true,
|
|
101
94
|
createdAt: new Date(),
|
|
@@ -89,7 +89,7 @@ export const googleClientPlugin = <C extends Config, T extends Context<C>>(conte
|
|
|
89
89
|
}
|
|
90
90
|
|
|
91
91
|
// Look up the PKCE verifier using the state parameter
|
|
92
|
-
const verification = await cache<C, T>(context).
|
|
92
|
+
const verification = await cache<C, T>(context).take(verifierId(state))
|
|
93
93
|
if (verification == null || verification.verifier == null) {
|
|
94
94
|
throw new AuthenFailed()
|
|
95
95
|
}
|
|
@@ -179,7 +179,7 @@ export const googleClientPlugin = <C extends Config, T extends Context<C>>(conte
|
|
|
179
179
|
credential.type = GOOGLE_CLIENT_AUTH
|
|
180
180
|
credential.userId = profile.userId
|
|
181
181
|
credential.profileId = profile.profileId
|
|
182
|
-
credential.
|
|
182
|
+
credential.entitySlug = profile.entitySlug
|
|
183
183
|
|
|
184
184
|
return { token: exchangeToken }
|
|
185
185
|
}
|
|
@@ -8,7 +8,7 @@ import type { OidcUserDetails, ProviderProfileDetails } from '@owlmeans/oidc'
|
|
|
8
8
|
import { base64urlnopad as base64 } from '@scure/base'
|
|
9
9
|
import { randomBytes } from '@noble/hashes/utils'
|
|
10
10
|
import { sha256 } from '@noble/hashes/sha256'
|
|
11
|
-
import { ALL_SCOPES, AuthenFailed, AuthenPayloadError, AuthManagerError, AuthRole } from '@owlmeans/auth'
|
|
11
|
+
import { ALL_SCOPES, AuthenFailed, AuthenPayloadError, AuthManagerError, AuthRole, entitySlugOf } from '@owlmeans/auth'
|
|
12
12
|
import { AUTHEN_TIMEFRAME } from '@owlmeans/server-auth'
|
|
13
13
|
import { decodeJwt } from 'jose'
|
|
14
14
|
import { KEY_OWL } from '@owlmeans/did'
|
|
@@ -78,7 +78,7 @@ export const oidcClientPlugin = <C extends Config, T extends Context<C>>(context
|
|
|
78
78
|
|
|
79
79
|
// @TODO Actually think about how to make oidc service configurable
|
|
80
80
|
const oidc = context.service<OidcClientService>(DEFAULT_ALIAS)
|
|
81
|
-
let entityId = request
|
|
81
|
+
let entityId = entitySlugOf(request) ?? oidc.getDefault()
|
|
82
82
|
|
|
83
83
|
if (entityId == null) {
|
|
84
84
|
throw new AuthenPayloadError('client')
|
|
@@ -237,7 +237,7 @@ export const oidcClientPlugin = <C extends Config, T extends Context<C>>(context
|
|
|
237
237
|
credential.type = OIDC_CLIENT_AUTH
|
|
238
238
|
credential.userId = profile.userId
|
|
239
239
|
credential.profileId = profile.profileId
|
|
240
|
-
credential.
|
|
240
|
+
credential.entitySlug = profile.entitySlug
|
|
241
241
|
|
|
242
242
|
return { token: exchangeToken }
|
|
243
243
|
}
|
|
@@ -6,12 +6,12 @@ import { elevate } from '@owlmeans/client-entrypoint'
|
|
|
6
6
|
import { GUARD_ED25519 } from '@owlmeans/auth-common'
|
|
7
7
|
import { OIDCTokenUpdateSchema } from '@owlmeans/oidc'
|
|
8
8
|
|
|
9
|
-
export const
|
|
10
|
-
|
|
9
|
+
export const setupAuthServiceEntrypoints = (
|
|
10
|
+
entrypoints: CommonEntrypoint[],
|
|
11
11
|
serviceAlias: string,
|
|
12
12
|
prefix: string = 'oidc-api'
|
|
13
13
|
) => {
|
|
14
|
-
|
|
14
|
+
entrypoints.push(
|
|
15
15
|
entrypoint(
|
|
16
16
|
route(authService.provider.list, `/${prefix}/provider/:service`, service(serviceAlias)),
|
|
17
17
|
guard(GUARD_ED25519)
|
|
@@ -25,6 +25,6 @@ export const setupAuthServiceModules = (
|
|
|
25
25
|
)
|
|
26
26
|
)
|
|
27
27
|
|
|
28
|
-
elevate(
|
|
29
|
-
elevate(
|
|
28
|
+
elevate(entrypoints, authService.provider.list)
|
|
29
|
+
elevate(entrypoints, authService.auth.update)
|
|
30
30
|
}
|
package/src/guard.ts
CHANGED
|
@@ -17,9 +17,9 @@ export const appendOidcGuard = <C extends Config, T extends Context<C>>(
|
|
|
17
17
|
return ctx
|
|
18
18
|
}
|
|
19
19
|
|
|
20
|
-
export const setupOidcGuard = (
|
|
21
|
-
setupBasicOidcGuard(
|
|
20
|
+
export const setupOidcGuard = (entrypoints: CommonEntrypoint[], coguards?: string | string[]) => {
|
|
21
|
+
setupBasicOidcGuard(entrypoints, coguards)
|
|
22
22
|
|
|
23
|
-
elevate(
|
|
24
|
-
elevate(
|
|
23
|
+
elevate(entrypoints, DISPATCHER_OIDC_INIT, actions.init)
|
|
24
|
+
elevate(entrypoints, DISPATCHER_OIDC, actions.authenticate)
|
|
25
25
|
}
|
package/src/index.ts
CHANGED
|
@@ -19,7 +19,7 @@ export * from './consts.js'
|
|
|
19
19
|
export * from './service.js'
|
|
20
20
|
export * from './guard.js'
|
|
21
21
|
export * from './gate.js'
|
|
22
|
-
export * from './
|
|
22
|
+
export * from './entrypoints.js'
|
|
23
23
|
export * from './wrapper.js'
|
|
24
24
|
export { createGateModel } from './model/gate.js'
|
|
25
25
|
export { extractPermissionSets } from './utils/permissions.js'
|
package/src/model/gate.ts
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { AuthForbidden, AuthManagerError, AuthManagerUnsupported, AuthUnknown } from '@owlmeans/auth'
|
|
1
|
+
import { AuthForbidden, AuthManagerError, AuthManagerUnsupported, AuthUnknown, entitySlugOf } from '@owlmeans/auth'
|
|
2
2
|
import { authService, DEFAULT_ALIAS } from '../consts.js'
|
|
3
3
|
import type { Config, Context, OidcClientService } from '../types.js'
|
|
4
4
|
import { cache, managedId } from '../utils/cache.js'
|
|
@@ -13,16 +13,16 @@ export const createGateModel = <C extends Config, T extends Context<C>>(ctx: T):
|
|
|
13
13
|
const oidc = ctx.service<OidcClientService>(DEFAULT_ALIAS)
|
|
14
14
|
try {
|
|
15
15
|
return await oidc.getClient({
|
|
16
|
-
entityId: user
|
|
17
|
-
clientId: oidc.entityToClientId({ entityId: user
|
|
16
|
+
entityId: entitySlugOf(user),
|
|
17
|
+
clientId: oidc.entityToClientId({ entityId: entitySlugOf(user) })
|
|
18
18
|
})
|
|
19
19
|
} catch (e) {
|
|
20
20
|
if (e instanceof AuthManagerError) {
|
|
21
|
-
const
|
|
21
|
+
const providers = await ctx.entrypoint<ClientEntrypoint<OidcProviderDescriptor[]>>(
|
|
22
22
|
authService.provider.list
|
|
23
23
|
).call({
|
|
24
24
|
params: { service: ctx.cfg.alias ?? ctx.cfg.service },
|
|
25
|
-
query: { entityId: user
|
|
25
|
+
query: { entityId: entitySlugOf(user) }
|
|
26
26
|
})
|
|
27
27
|
if (providers.length < 1) {
|
|
28
28
|
throw new AuthUnknown()
|
|
@@ -83,7 +83,7 @@ export const createGateModel = <C extends Config, T extends Context<C>>(ctx: T):
|
|
|
83
83
|
},
|
|
84
84
|
|
|
85
85
|
fixPermissions: (permissions, user) => permissions.map(
|
|
86
|
-
perm => perm.replaceAll('{entity}', user
|
|
86
|
+
perm => perm.replaceAll('{entity}', entitySlugOf(user) ?? '-')
|
|
87
87
|
),
|
|
88
88
|
|
|
89
89
|
prepareRequest: async (client, request) => {
|
package/src/utils/auth.ts
CHANGED
|
@@ -24,7 +24,7 @@ export const makeOidcAuthentication = <C extends Config, T extends Context<C>>(c
|
|
|
24
24
|
}
|
|
25
25
|
|
|
26
26
|
console.log("\n\nWe are picking verifier by id: ", verifierId(challenge))
|
|
27
|
-
const verification = await cache<C, T>(context).
|
|
27
|
+
const verification = await cache<C, T>(context).take(verifierId(challenge))
|
|
28
28
|
console.log("Verification we get: ", verification, "\n\n")
|
|
29
29
|
if (verification.verifier == null) {
|
|
30
30
|
throw new AuthenFailed()
|
package/src/wrapper.ts
CHANGED
|
@@ -42,7 +42,7 @@ export const makeOidcWrappingService = (): WrappedOIDCService => {
|
|
|
42
42
|
record.validated = new Date()
|
|
43
43
|
|
|
44
44
|
if (ctx.hasEntrypoint(authService.auth.update)) {
|
|
45
|
-
const
|
|
45
|
+
const update = await ctx.entrypoint<ClientEntrypoint<OIDCTokenUpdate>>(authService.auth.update)
|
|
46
46
|
.call({ body: { token, tokenSet: record.payload } })
|
|
47
47
|
|
|
48
48
|
const updateEnvelope = makeEnvelopeModel<AuthCredentials>(update.token, EnvelopeKind.Token)
|
|
@@ -58,12 +58,12 @@ export const makeOidcWrappingService = (): WrappedOIDCService => {
|
|
|
58
58
|
role: updatedAuth.role ?? AuthRole.Guest,
|
|
59
59
|
userId: updatedAuth.userId ?? user.userId,
|
|
60
60
|
profileId: updatedAuth.profileId,
|
|
61
|
-
|
|
61
|
+
entitySlug: updatedAuth.entitySlug ?? user.entitySlug,
|
|
62
62
|
createdAt: new Date()
|
|
63
63
|
}
|
|
64
64
|
|
|
65
65
|
if (updatedAuth.challenge !== user.token) {
|
|
66
|
-
await cache(ctx).delete(
|
|
66
|
+
await cache(ctx).delete(managedId(user.token))
|
|
67
67
|
updatedUser.token = updatedAuth.challenge
|
|
68
68
|
record.id = managedId(updatedUser.token)
|
|
69
69
|
}
|
|
@@ -84,9 +84,25 @@ export const makeOidcWrappingService = (): WrappedOIDCService => {
|
|
|
84
84
|
if (defaultClientId != null) {
|
|
85
85
|
let tokenSet: CommonTokenSetParams = record.payload as CommonTokenSetParams
|
|
86
86
|
const client = await oidc.getClient(defaultClientId)
|
|
87
|
-
|
|
87
|
+
|
|
88
|
+
// Revalidate using only what this session and this provider actually support.
|
|
89
|
+
// `expires_at` is the token set's own absolute expiry; **absent is not expired** —
|
|
90
|
+
// reading a missing value as the epoch (the former `?? 0`) sent every single
|
|
91
|
+
// validation, including one moments after login, down the refresh path. That path
|
|
92
|
+
// cannot work for a session granted without `offline_access`, because such a token
|
|
93
|
+
// set carries no refresh token at all, so a valid login died as a 403.
|
|
94
|
+
const expiresAt = tokenSet.expires_at
|
|
95
|
+
if (expiresAt != null && days.unix(expiresAt).isBefore()) {
|
|
96
|
+
if (tokenSet.refresh_token == null) {
|
|
97
|
+
// Expired with nothing to renew it — the user has to authenticate again.
|
|
98
|
+
throw new AuthorizationError('access-token')
|
|
99
|
+
}
|
|
88
100
|
tokenSet = await client.refresh(tokenSet as OidcTokenSetParameters) as CommonTokenSetParams
|
|
89
|
-
} else {
|
|
101
|
+
} else if (client.getMetadata().introspection_endpoint != null) {
|
|
102
|
+
// Introspection is the only way to notice a revocation that happened before the
|
|
103
|
+
// token's own expiry, so it stays the check of choice — but it is an optional
|
|
104
|
+
// provider feature. Calling an endpoint the discovery document never advertised
|
|
105
|
+
// throws, which would fail the session for the opposite reason to the one above.
|
|
90
106
|
const result = await client.introspect(tokenSet as OidcTokenSetParameters, 'access_token')
|
|
91
107
|
if (!result.active) {
|
|
92
108
|
throw new AuthorizationError('access-token')
|
package/tests/context.ts
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { AppType,
|
|
1
|
+
import { AppType, makeBasicContext } from '@owlmeans/context'
|
|
2
2
|
import type { BasicConfig, BasicContext } from '@owlmeans/context'
|
|
3
3
|
import { createStaticResource } from '@owlmeans/static-resource'
|
|
4
4
|
import { AUTH_CACHE } from '@owlmeans/server-auth'
|
|
@@ -12,7 +12,6 @@ export const makeTestContext = () => {
|
|
|
12
12
|
const cfg: Config = {
|
|
13
13
|
ready: false,
|
|
14
14
|
service: 'server-oidc-rp-tests',
|
|
15
|
-
layer: Layer.Service,
|
|
16
15
|
type: AppType.Backend,
|
|
17
16
|
services: {},
|
|
18
17
|
oidc: {
|
package/build/modules.d.ts
DELETED
package/build/modules.d.ts.map
DELETED
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAQ5D,eAAO,MAAM,uBAAuB,YACzB,gBAAgB,EAAE,gBACb,MAAM,WACZ,MAAM,SAkBf,CAAA"}
|
package/build/modules.js
DELETED
|
@@ -1,12 +0,0 @@
|
|
|
1
|
-
import { entrypoint, guard, filter, body } from '@owlmeans/entrypoint';
|
|
2
|
-
import { backend, route, RouteMethod, service } from '@owlmeans/route';
|
|
3
|
-
import { authService } from './consts.js';
|
|
4
|
-
import { elevate } from '@owlmeans/client-entrypoint';
|
|
5
|
-
import { GUARD_ED25519 } from '@owlmeans/auth-common';
|
|
6
|
-
import { OIDCTokenUpdateSchema } from '@owlmeans/oidc';
|
|
7
|
-
export const setupAuthServiceModules = (modules, serviceAlias, prefix = 'oidc-api') => {
|
|
8
|
-
modules.push(entrypoint(route(authService.provider.list, `/${prefix}/provider/:service`, service(serviceAlias)), guard(GUARD_ED25519)), entrypoint(route(authService.auth.update, `/${prefix}/auth/update`, backend(service(serviceAlias), RouteMethod.POST)), filter(body(OIDCTokenUpdateSchema), guard(GUARD_ED25519))));
|
|
9
|
-
elevate(modules, authService.provider.list);
|
|
10
|
-
elevate(modules, authService.auth.update);
|
|
11
|
-
};
|
|
12
|
-
//# sourceMappingURL=modules.js.map
|
package/build/modules.js.map
DELETED
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"modules.js","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAA;AACtE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAEtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,OAA2B,EAC3B,YAAoB,EACpB,MAAM,GAAW,UAAU,EAC3B,EAAE;IACF,OAAO,CAAC,IAAI,CACV,UAAU,CACR,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,MAAM,oBAAoB,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,EACvF,KAAK,CAAC,aAAa,CAAC,CACrB,EACD,UAAU,CACR,KAAK,CACH,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,MAAM,cAAc,EACjD,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,CACjD,EACD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAC1D,CACF,CAAA;IAED,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC3C,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AAC3C,CAAC,CAAA"}
|