@owlmeans/web-auth 0.1.18-rc.61 → 0.1.18-rc.63
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/agent-meta/manifest.json +2 -2
- package/agent-meta/skills/web-auth/SKILL.md +1 -1
- package/build/auth/plugins/supervisor.d.ts.map +1 -1
- package/build/auth/plugins/supervisor.js +4 -3
- package/build/auth/plugins/supervisor.js.map +1 -1
- package/package.json +11 -11
- package/src/auth/plugins/supervisor.tsx +4 -3
- package/tests/supervisor.spec.ts +89 -0
package/README.md
CHANGED
|
@@ -6,7 +6,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
|
|
|
6
6
|
your project's skill store (`.agents/skills/`):
|
|
7
7
|
|
|
8
8
|
```sh
|
|
9
|
-
npx @owlmeans/agent-skills@^0.1.18-rc.
|
|
9
|
+
npx @owlmeans/agent-skills@^0.1.18-rc.51
|
|
10
10
|
```
|
|
11
11
|
|
|
12
12
|
The embedded files are version-matched to this package release. Do not edit them
|
package/agent-meta/manifest.json
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schemaVersion": 2,
|
|
3
3
|
"package": "@owlmeans/web-auth",
|
|
4
|
-
"version": "0.1.18-rc.
|
|
5
|
-
"generatedAt": "2026-10-
|
|
4
|
+
"version": "0.1.18-rc.63",
|
|
5
|
+
"generatedAt": "2026-10-06T11:45:57.663Z",
|
|
6
6
|
"canonicalRepo": "https://github.com/owlmeans/common",
|
|
7
7
|
"entries": [
|
|
8
8
|
{
|
|
@@ -8,7 +8,7 @@ user-invocable: false
|
|
|
8
8
|
# @owlmeans/web-auth
|
|
9
9
|
|
|
10
10
|
**Layer:** Web
|
|
11
|
-
**Install:** `"@owlmeans/web-auth": "^0.1.18-rc.
|
|
11
|
+
**Install:** `"@owlmeans/web-auth": "^0.1.18-rc.63"` in `dependencies`
|
|
12
12
|
|
|
13
13
|
Web-side auth UI plugins registering into the shared `@owlmeans/client-auth/manager` plugin registry
|
|
14
14
|
(mirroring `@owlmeans/web-oidc-rp`). It ships the **PK supervisor** login form.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../../../src/auth/plugins/supervisor.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAA;AAUjF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,EAAE,
|
|
1
|
+
{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../../../src/auth/plugins/supervisor.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAA;AAUjF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,EAAE,oBA+EpC,CAAA"}
|
|
@@ -3,7 +3,7 @@ import { useState } from 'react';
|
|
|
3
3
|
import { AuthenticationType, buildSupervisorPayload } from '@owlmeans/auth';
|
|
4
4
|
import { DEFAULT_ALIAS as AUTH_SERVICE } from '@owlmeans/client-auth';
|
|
5
5
|
import { useContext } from '@owlmeans/client';
|
|
6
|
-
import {
|
|
6
|
+
import { loginLandingOf } from '@owlmeans/client-auth/login';
|
|
7
7
|
import { makeKeyPairModel } from '@owlmeans/basic-keys';
|
|
8
8
|
import { createIdOfLength } from '@owlmeans/basic-ids';
|
|
9
9
|
/**
|
|
@@ -46,8 +46,9 @@ export const supervisorClientPlugin = {
|
|
|
46
46
|
// A registered step (marketing consent, say) or a device/authorization-code consent
|
|
47
47
|
// screen that suspended itself here before sending the browser to sign in both take
|
|
48
48
|
// priority over the app's own home — `landAfterLogin` is the whole decision.
|
|
49
|
-
const
|
|
50
|
-
|
|
49
|
+
const landings = loginLandingOf(context);
|
|
50
|
+
const landing = await landings.landAfterLogin();
|
|
51
|
+
window.location.href = await landings.landingUrl(landing);
|
|
51
52
|
}
|
|
52
53
|
catch (e) {
|
|
53
54
|
setError(e instanceof Error ? e.message : String(e));
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../../../src/auth/plugins/supervisor.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAGhC,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AAE3E,OAAO,EAAE,aAAa,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,cAAc,EAAE,
|
|
1
|
+
{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../../../src/auth/plugins/supervisor.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAGhC,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AAE3E,OAAO,EAAE,aAAa,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAyB;IAC1D,IAAI,EAAE,kBAAkB,CAAC,UAAU;IAEnC,gGAAgG;IAChG,+FAA+F;IAC/F,0DAA0D;IAC1D,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE;IAEvE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QAC1C,MAAM,OAAO,GAAG,UAAU,EAAE,CAAA;QAC5B,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;QACxC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;QAChC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;QACvD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAEvC,MAAM,QAAQ,GAAG,KAAK,EAAE,KAAgB,EAAE,EAAE;YAC1C,KAAK,CAAC,cAAc,EAAE,CAAA;YACtB,QAAQ,CAAC,IAAI,CAAC,CAAA;YACd,OAAO,CAAC,IAAI,CAAC,CAAA;YACb,IAAI,CAAC;gBACH,0EAA0E;gBAC1E,uEAAuE;gBACvE,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;gBAExC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;gBAEpE,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;oBACvB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAc,YAAY,CAAC,CAAA;oBAC9D,MAAM,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;gBACvC,CAAC;gBAED,oFAAoF;gBACpF,oFAAoF;gBACpF,6EAA6E;gBAC7E,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;gBACxC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAA;gBAC/C,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;YAC3D,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;gBACpD,OAAO,CAAC,KAAK,CAAC,CAAA;YAChB,CAAC;QACH,CAAC,CAAA;QAED,OAAO,CACL,gBAAM,QAAQ,EAAE,QAAQ,iBAAc,sBAAsB,EAC1D,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,aAC7F,4DAAyC,EACzC,iBAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,gCAEhE,gBAAO,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAC,MAAM,EAAC,YAAY,EAAC,KAAK,EAAC,KAAK,EAAE,MAAM,iBACnD,oBAAoB,EAChC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,SAAG,IACjD,EACR,iBAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,4BAEhE,gBAAO,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,UAAU,EAAC,YAAY,EAAC,KAAK,EAAC,KAAK,EAAE,EAAE,iBAC/C,eAAe,EAC3B,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,SAAG,IAC7C,EACR,iBAAQ,IAAI,EAAC,QAAQ,iBAAa,mBAAmB,EAAC,QAAQ,EAAE,IAAI,IAAI,MAAM,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAC/F,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,uBAAuB,GACxC,EACR,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,YAAG,IAAI,EAAC,OAAO,iBAAa,kBAAkB,EAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,YAAG,KAAK,GAAK,CAAC,CAAC,CAAC,IAAI,IAC1G,CACR,CAAA;IACH,CAAC;IAED,+EAA+E;IAC/E,8EAA8E;IAC9E,0EAA0E;IAC1E,YAAY,EAAE,KAAK,EAAE,WAAW,EAAsB,EAAE;QACtD,MAAM,GAAG,GAAG,gBAAgB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;QACpD,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;QACjC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,SAAS,IAAI,EAAE,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;QAC/G,WAAW,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;QAE5D,8EAA8E;QAC9E,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACtB,CAAC;CACF,CAAA"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@owlmeans/web-auth",
|
|
3
|
-
"version": "0.1.18-rc.
|
|
3
|
+
"version": "0.1.18-rc.63",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"scripts": {
|
|
@@ -29,16 +29,16 @@
|
|
|
29
29
|
}
|
|
30
30
|
},
|
|
31
31
|
"dependencies": {
|
|
32
|
-
"@owlmeans/auth": "^0.1.18-rc.
|
|
33
|
-
"@owlmeans/auth-common": "^0.1.18-rc.
|
|
34
|
-
"@owlmeans/basic-ids": "^0.1.18-rc.
|
|
35
|
-
"@owlmeans/basic-keys": "^0.1.18-rc.
|
|
36
|
-
"@owlmeans/client": "^0.1.18-rc.
|
|
37
|
-
"@owlmeans/client-auth": "^0.1.18-rc.
|
|
38
|
-
"@owlmeans/client-flow": "^0.1.18-rc.
|
|
39
|
-
"@owlmeans/config": "^0.1.18-rc.
|
|
40
|
-
"@owlmeans/context": "^0.1.18-rc.
|
|
41
|
-
"@owlmeans/web-client": "^0.1.18-rc.
|
|
32
|
+
"@owlmeans/auth": "^0.1.18-rc.40",
|
|
33
|
+
"@owlmeans/auth-common": "^0.1.18-rc.48",
|
|
34
|
+
"@owlmeans/basic-ids": "^0.1.18-rc.38",
|
|
35
|
+
"@owlmeans/basic-keys": "^0.1.18-rc.49",
|
|
36
|
+
"@owlmeans/client": "^0.1.18-rc.52",
|
|
37
|
+
"@owlmeans/client-auth": "^0.1.18-rc.59",
|
|
38
|
+
"@owlmeans/client-flow": "^0.1.18-rc.55",
|
|
39
|
+
"@owlmeans/config": "^0.1.18-rc.44",
|
|
40
|
+
"@owlmeans/context": "^0.1.18-rc.34",
|
|
41
|
+
"@owlmeans/web-client": "^0.1.18-rc.62"
|
|
42
42
|
},
|
|
43
43
|
"peerDependencies": {
|
|
44
44
|
"react": "*"
|
|
@@ -6,7 +6,7 @@ import type { AuthToken } from '@owlmeans/auth'
|
|
|
6
6
|
import { DEFAULT_ALIAS as AUTH_SERVICE } from '@owlmeans/client-auth'
|
|
7
7
|
import type { AuthService } from '@owlmeans/auth-common'
|
|
8
8
|
import { useContext } from '@owlmeans/client'
|
|
9
|
-
import {
|
|
9
|
+
import { loginLandingOf } from '@owlmeans/client-auth/login'
|
|
10
10
|
import { makeKeyPairModel } from '@owlmeans/basic-keys'
|
|
11
11
|
import { createIdOfLength } from '@owlmeans/basic-ids'
|
|
12
12
|
|
|
@@ -56,8 +56,9 @@ export const supervisorClientPlugin: AuthenticationPlugin = {
|
|
|
56
56
|
// A registered step (marketing consent, say) or a device/authorization-code consent
|
|
57
57
|
// screen that suspended itself here before sending the browser to sign in both take
|
|
58
58
|
// priority over the app's own home — `landAfterLogin` is the whole decision.
|
|
59
|
-
const
|
|
60
|
-
|
|
59
|
+
const landings = loginLandingOf(context)
|
|
60
|
+
const landing = await landings.landAfterLogin()
|
|
61
|
+
window.location.href = await landings.landingUrl(landing)
|
|
61
62
|
} catch (e) {
|
|
62
63
|
setError(e instanceof Error ? e.message : String(e))
|
|
63
64
|
setBusy(false)
|
|
@@ -0,0 +1,89 @@
|
|
|
1
|
+
import { afterEach, describe, expect, test } from 'bun:test'
|
|
2
|
+
import { AuthenticationType, buildSupervisorPayload } from '@owlmeans/auth'
|
|
3
|
+
import type { AuthCredentials } from '@owlmeans/auth'
|
|
4
|
+
import { makeKeyPairModel, keyHelper } from '@owlmeans/basic-keys'
|
|
5
|
+
import { plugins as authPlugins } from '@owlmeans/client-auth/manager'
|
|
6
|
+
import type { CommonConfig } from '@owlmeans/config'
|
|
7
|
+
import { appendSupervisorAuth, SUPERVISOR_LOGIN_PATH, supervisorClientPlugin } from '../src/index.js'
|
|
8
|
+
|
|
9
|
+
type Cfg = { debug?: { all?: boolean, supervisor?: boolean }, security?: CommonConfig['security'] }
|
|
10
|
+
const carrier = (cfg: Cfg = {}) => ({ cfg })
|
|
11
|
+
|
|
12
|
+
afterEach(() => { delete authPlugins[AuthenticationType.Supervisor] })
|
|
13
|
+
|
|
14
|
+
describe('appendSupervisorAuth — who gets an operator login', () => {
|
|
15
|
+
test('nothing is registered unless the deployment asks for the supervisor on purpose', () => {
|
|
16
|
+
const context = carrier({ debug: { all: true } })
|
|
17
|
+
appendSupervisorAuth(context)
|
|
18
|
+
|
|
19
|
+
expect(authPlugins[AuthenticationType.Supervisor]).toBeUndefined()
|
|
20
|
+
expect(context.cfg.security).toBeUndefined()
|
|
21
|
+
})
|
|
22
|
+
|
|
23
|
+
test('`debug.supervisor` registers the plugin and offers it on the sign-in screen', () => {
|
|
24
|
+
const context = carrier({ debug: { supervisor: true } })
|
|
25
|
+
appendSupervisorAuth(context)
|
|
26
|
+
|
|
27
|
+
expect(authPlugins[AuthenticationType.Supervisor]).toBe(supervisorClientPlugin)
|
|
28
|
+
expect(context.cfg.security?.auth?.login?.secretKey).toBe(true)
|
|
29
|
+
expect(context.cfg.security?.auth?.login?.overrides?.[AuthenticationType.Supervisor]).toEqual({ enabled: true })
|
|
30
|
+
})
|
|
31
|
+
|
|
32
|
+
test('`offer: false` registers the route without putting it on the screen', () => {
|
|
33
|
+
const context = carrier()
|
|
34
|
+
appendSupervisorAuth(context, { enabled: true, offer: false })
|
|
35
|
+
|
|
36
|
+
expect(authPlugins[AuthenticationType.Supervisor]).toBe(supervisorClientPlugin)
|
|
37
|
+
expect(context.cfg.security).toBeUndefined()
|
|
38
|
+
})
|
|
39
|
+
|
|
40
|
+
test('an override the configuration already states is kept', () => {
|
|
41
|
+
const context = carrier({
|
|
42
|
+
debug: { supervisor: true },
|
|
43
|
+
security: { auth: { login: { secretKey: false, overrides: { [AuthenticationType.Supervisor]: { enabled: false } } } } },
|
|
44
|
+
} as Cfg)
|
|
45
|
+
appendSupervisorAuth(context)
|
|
46
|
+
|
|
47
|
+
expect(context.cfg.security?.auth?.login?.secretKey).toBe(false)
|
|
48
|
+
expect(context.cfg.security?.auth?.login?.overrides?.[AuthenticationType.Supervisor]).toEqual({ enabled: false })
|
|
49
|
+
})
|
|
50
|
+
|
|
51
|
+
test('the form lives on the standard typed authentication route', () => {
|
|
52
|
+
expect(SUPERVISOR_LOGIN_PATH).toBe(`/authentication/login/${AuthenticationType.Supervisor}`)
|
|
53
|
+
})
|
|
54
|
+
})
|
|
55
|
+
|
|
56
|
+
describe('supervisorClientPlugin — what it sends', () => {
|
|
57
|
+
test('is a restricted method, shown last as a link', () => {
|
|
58
|
+
expect(supervisorClientPlugin.type).toBe(AuthenticationType.Supervisor)
|
|
59
|
+
expect(supervisorClientPlugin.method).toMatchObject({ restricted: true, emphasis: 'link', order: 900 })
|
|
60
|
+
})
|
|
61
|
+
|
|
62
|
+
test('signs the challenge, the user and a fresh salt with the entered key and sends no key', async () => {
|
|
63
|
+
const key = makeKeyPairModel()
|
|
64
|
+
const credentials = { userId: 'person@example.com', credential: key.export(), challenge: 'one-time' } as AuthCredentials
|
|
65
|
+
|
|
66
|
+
const token = await supervisorClientPlugin.authenticate!(credentials)
|
|
67
|
+
|
|
68
|
+
expect(token).toEqual({ token: '' })
|
|
69
|
+
const packed = JSON.parse(credentials.credential) as { salt: string, signature: string }
|
|
70
|
+
expect(Object.keys(packed).sort()).toEqual(['salt', 'signature'])
|
|
71
|
+
expect(packed.salt).toHaveLength(16)
|
|
72
|
+
expect(credentials.credential).not.toContain(key.export())
|
|
73
|
+
// Verified the way the server's supervisor plugin verifies it.
|
|
74
|
+
const verifier = keyHelper.fromPubKey(key.exportPublic())
|
|
75
|
+
expect(await verifier.verify(buildSupervisorPayload('one-time', 'person@example.com', packed.salt), packed.signature)).toBe(true)
|
|
76
|
+
expect(await verifier.verify(buildSupervisorPayload('replayed', 'person@example.com', packed.salt), packed.signature)).toBe(false)
|
|
77
|
+
})
|
|
78
|
+
|
|
79
|
+
test('two sign-ins never share a salt', async () => {
|
|
80
|
+
const key = makeKeyPairModel().export()
|
|
81
|
+
const salts = await Promise.all([1, 2].map(async () => {
|
|
82
|
+
const credentials = { userId: 'u', credential: key, challenge: 'c' } as AuthCredentials
|
|
83
|
+
await supervisorClientPlugin.authenticate!(credentials)
|
|
84
|
+
return (JSON.parse(credentials.credential) as { salt: string }).salt
|
|
85
|
+
}))
|
|
86
|
+
|
|
87
|
+
expect(salts[0]).not.toBe(salts[1])
|
|
88
|
+
})
|
|
89
|
+
})
|