@sasjs/api 0.2.1 → 0.3.0

package/build/cjs/corpus/identity.js

@@ -0,0 +1,268 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDENTITY_CORPUS = exports.DEACTIVATED = exports.SIGNED_IN = void 0;
+const fixture_js_1 = require("../identity/fixture.js");
+/** The default fixture, plus a caller that is already signed in. */
+exports.SIGNED_IN = {
+    ...fixture_js_1.DEFAULT_IDENTITY,
+    tokens: [
+        {
+            username: 'user2',
+            clientId: 'web_app',
+            accessToken: 'seed-access',
+            refreshToken: 'seed-refresh'
+        },
+        {
+            username: 'admin',
+            clientId: 'removed_client',
+            accessToken: 'seed-access-orphan',
+            refreshToken: 'seed-refresh-orphan'
+        }
+    ],
+    codes: [
+        { code: 'seed-code', username: 'user2', clientId: 'web_app' },
+        { code: 'seed-orphan-code', username: 'user2', clientId: 'removed_client' },
+        // the same shape with a pair already issued: the exchange must still refuse,
+        // rather than handing back tokens that belong to a client that is gone
+        {
+            code: 'seed-orphan-pair-code',
+            username: 'admin',
+            clientId: 'removed_client'
+        }
+    ]
+};
+/** The same identity, with the restricted user switched off. */
+exports.DEACTIVATED = {
+    ...exports.SIGNED_IN,
+    users: exports.SIGNED_IN.users.map((user) => user.username === 'user2' ? { ...user, isActive: false } : user)
+};
+/** The user the seeded session belongs to, without the host's own identifier. */
+const user2 = {
+    username: 'user2',
+    displayName: 'Demo User',
+    isAdmin: false,
+    needsToUpdatePassword: false
+};
+exports.IDENTITY_CORPUS = [
+    {
+        id: 'login',
+        route: 'POST /SASLogon/login',
+        description: 'signs a seeded user in',
+        request: { body: { username: 'admin', password: 'admin123' } },
+        expect: {
+            status: 200,
+            partial: {
+                loggedIn: true,
+                user: {
+                    username: 'admin',
+                    displayName: 'Demo Admin',
+                    isAdmin: true,
+                    needsToUpdatePassword: false
+                }
+            }
+        }
+    },
+    {
+        id: 'login-missing-username',
+        route: 'POST /SASLogon/login',
+        description: 'refuses a sign-in with no username as 400, naming the field',
+        request: { body: { password: 'admin123' } },
+        expect: { status: 400, error: '"username" is required' }
+    },
+    {
+        id: 'login-deactivated',
+        route: 'POST /SASLogon/login',
+        description: 'refuses a deactivated account, naming it',
+        identity: exports.DEACTIVATED,
+        request: { body: { username: 'user2', password: 'user123' } },
+        expect: { status: 401, error: 'This account is not active.' }
+    },
+    {
+        id: 'login-wrong-password',
+        route: 'POST /SASLogon/login',
+        description: 'refuses a wrong password as 401, naming it',
+        request: { body: { username: 'admin', password: 'wrong123' } },
+        expect: { status: 401, error: 'Invalid Password.' }
+    },
+    {
+        id: 'login-unknown-user',
+        route: 'POST /SASLogon/login',
+        description: 'refuses an unknown username as 401, naming it',
+        request: { body: { username: 'nobody', password: 'admin123' } },
+        expect: { status: 401, error: 'Username is not found.' }
+    },
+    {
+        id: 'authorize',
+        route: 'POST /SASLogon/authorize',
+        description: 'issues a code to a signed-in caller',
+        identity: exports.SIGNED_IN,
+        request: {
+            token: 'seed-access',
+            body: { clientId: 'web_app' }
+        },
+        expect: { status: 200, keys: ['code'] }
+    },
+    {
+        id: 'authorize-missing-client',
+        route: 'POST /SASLogon/authorize',
+        description: 'refuses an authorize with no clientId as 400, naming the field',
+        identity: exports.SIGNED_IN,
+        request: { token: 'seed-access', body: {} },
+        expect: { status: 400, error: '"clientId" is required' }
+    },
+    {
+        id: 'authorize-without-session',
+        route: 'POST /SASLogon/authorize',
+        description: 'refuses with 401 when no caller is signed in',
+        request: { body: { clientId: 'web_app' } },
+        expect: { status: 401, error: 'Unauthorized' }
+    },
+    {
+        id: 'authorize-unknown-client',
+        route: 'POST /SASLogon/authorize',
+        description: 'refuses an unknown client with 403',
+        identity: exports.SIGNED_IN,
+        request: { token: 'seed-access', body: { clientId: 'nope' } },
+        expect: { status: 403, error: 'Invalid clientId.' }
+    },
+    {
+        id: 'exchange-code',
+        route: 'POST /SASjsApi/auth/token',
+        description: 'exchanges a code for a token pair',
+        identity: exports.SIGNED_IN,
+        request: { body: { clientId: 'web_app', code: 'seed-code' } },
+        expect: { status: 200, keys: ['accessToken', 'refreshToken'] }
+    },
+    {
+        id: 'exchange-missing-client',
+        route: 'POST /SASjsApi/auth/token',
+        description: 'refuses an exchange with no clientId as 400, naming the field',
+        identity: exports.SIGNED_IN,
+        request: { body: { code: 'seed-code' } },
+        expect: { status: 400, error: '"clientId" is required' }
+    },
+    {
+        id: 'exchange-code-unknown',
+        route: 'POST /SASjsApi/auth/token',
+        description: 'refuses a code the host never issued',
+        request: { body: { clientId: 'web_app', code: 'not-a-code' } },
+        expect: { status: 401, error: 'Invalid Auth Code' }
+    },
+    {
+        id: 'exchange-code-other-client',
+        route: 'POST /SASjsApi/auth/token',
+        description: 'refuses a code presented for another client, as a bad code',
+        identity: exports.SIGNED_IN,
+        request: { body: { clientId: 'sasjs', code: 'seed-code' } },
+        expect: { status: 401, error: 'Invalid Auth Code' }
+    },
+    {
+        id: 'exchange-code-client-gone',
+        route: 'POST /SASjsApi/auth/token',
+        description: 'refuses a valid code whose client no longer exists',
+        identity: exports.SIGNED_IN,
+        request: { body: { clientId: 'removed_client', code: 'seed-orphan-code' } },
+        expect: { status: 401, error: 'Invalid clientId.' }
+    },
+    {
+        id: 'exchange-code-client-gone-with-pair',
+        route: 'POST /SASjsApi/auth/token',
+        description: 'refuses an exchange whose client is gone even when a pair was issued before it was deleted',
+        identity: exports.SIGNED_IN,
+        request: {
+            body: { clientId: 'removed_client', code: 'seed-orphan-pair-code' }
+        },
+        expect: { status: 401, error: 'Invalid clientId.' }
+    },
+    {
+        id: 'exchange-code-deactivated',
+        route: 'POST /SASjsApi/auth/token',
+        description: 'refuses an exchange for an account that has been deactivated',
+        identity: exports.DEACTIVATED,
+        request: { body: { clientId: 'web_app', code: 'seed-code' } },
+        expect: { status: 401, error: 'Unauthorized' }
+    },
+    {
+        id: 'refresh',
+        route: 'POST /SASjsApi/auth/refresh',
+        description: 'mints a new pair from a refresh token',
+        identity: exports.SIGNED_IN,
+        request: { token: 'seed-refresh' },
+        expect: { status: 200, keys: ['accessToken', 'refreshToken'] }
+    },
+    {
+        id: 'refresh-invalid',
+        route: 'POST /SASjsApi/auth/refresh',
+        description: 'refuses a refresh token it did not issue',
+        request: { token: 'not-a-token' },
+        expect: { status: 401, error: 'Unauthorized' }
+    },
+    {
+        id: 'refresh-without-token',
+        route: 'POST /SASjsApi/auth/refresh',
+        description: 'refuses a refresh with no token at all',
+        request: {},
+        expect: { status: 401, error: 'Unauthorized' }
+    },
+    {
+        id: 'refresh-client-gone',
+        route: 'POST /SASjsApi/auth/refresh',
+        description: 'refuses a refresh whose client no longer exists',
+        identity: exports.SIGNED_IN,
+        request: { token: 'seed-refresh-orphan' },
+        expect: { status: 401, error: 'Invalid clientId.' }
+    },
+    {
+        id: 'refresh-deactivated',
+        route: 'POST /SASjsApi/auth/refresh',
+        description: 'refuses a refresh for an account that has been deactivated, as the server does on every request',
+        identity: exports.DEACTIVATED,
+        request: { token: 'seed-refresh' },
+        expect: { status: 401, error: 'Unauthorized' }
+    },
+    {
+        id: 'logout',
+        route: 'POST /SASjsApi/auth/logout',
+        description: 'revokes the caller pair and answers 204',
+        identity: exports.SIGNED_IN,
+        request: { token: 'seed-access' },
+        expect: { status: 204 }
+    },
+    {
+        id: 'logout-without-token',
+        route: 'POST /SASjsApi/auth/logout',
+        description: 'refuses a logout with no valid token',
+        request: {},
+        expect: { status: 401, error: 'Unauthorized' }
+    },
+    {
+        id: 'session',
+        route: 'GET /SASjsApi/session',
+        description: 'reports the caller the token names',
+        identity: exports.SIGNED_IN,
+        request: { token: 'seed-access' },
+        expect: { status: 200, partial: user2 }
+    },
+    {
+        id: 'session-deactivated',
+        route: 'GET /SASjsApi/session',
+        description: 'stops resolving a token whose account has been deactivated',
+        identity: exports.DEACTIVATED,
+        request: { token: 'seed-access' },
+        expect: { status: 401, error: 'Unauthorized' }
+    },
+    {
+        id: 'session-without-token',
+        route: 'GET /SASjsApi/session',
+        description: 'refuses the session read with no caller',
+        request: {},
+        expect: { status: 401, error: 'Unauthorized' }
+    },
+    {
+        id: 'sign-out',
+        route: 'GET /SASLogon/logout',
+        description: 'answers the body the browser sign-out returns',
+        request: {},
+        expect: { status: 200, contents: 'OK!' }
+    }
+];

package/build/cjs/corpus/runner.js

@@ -4,10 +4,19 @@ exports.runCase = exports.servicesFor = void 0;
 const dispatch_js_1 = require("../host/dispatch.js");
 const service_js_1 = require("../drive/service.js");
 const memory_store_js_1 = require("../drive/memory-store.js");
+const service_js_2 = require("../identity/service.js");
+const memory_store_js_2 = require("../identity/memory-store.js");
+const fixture_js_1 = require("../identity/fixture.js");
 const types_js_1 = require("../types.js");
-/** Services over a fresh store, seeded with the case's files. */
+/**
+ * Services over fresh stores, seeded with the case's files and identity.
+ *
+ * The identity store is built for every case, drive or not, so a case that starts
+ * mid-flow can declare the tokens and codes it begins with.
+ */
 const servicesFor = (testCase) => ({
-    drive: (0, service_js_1.createDriveService)(new memory_store_js_1.MemoryDriveStore(testCase.seed || {}))
+    drive: (0, service_js_1.createDriveService)(new memory_store_js_1.MemoryDriveStore(testCase.seed || {})),
+    identity: (0, service_js_2.createIdentityService)(new memory_store_js_2.MemoryIdentityStore(testCase.identity || fixture_js_1.DEFAULT_IDENTITY))
 });
 exports.servicesFor = servicesFor;
 /**

package/build/cjs/host/dispatch.js

@@ -42,8 +42,56 @@ const dispatch = async (services, routeId, request = {}) => {
     if (!route)
         throw new types_js_1.ApiError(404, `No such operation: ${routeId}`);
     validate(route, request);
-    const { drive } = services;
+    const { drive, identity } = services;
     const query = request.query || {};
+    const body = request.body || {};
+    /** The caller, from the request's own subject or the token it carried. */
+    const caller = async () => {
+        if (request.subject)
+            return request.subject;
+        return identity?.authenticate(request.token);
+    };
+    if (routeId.startsWith('POST /SASjsApi/auth/') ||
+        routeId.startsWith('POST /SASLogon/') ||
+        routeId === 'GET /SASLogon/logout' ||
+        routeId === 'GET /SASjsApi/session') {
+        if (!identity)
+            throw new types_js_1.ApiError(501, `This host has no identity service, so it cannot answer ${routeId}.`);
+        switch (routeId) {
+            case 'POST /SASjsApi/auth/token':
+                return {
+                    status: 200,
+                    body: await identity.token({
+                        clientId: String(body.clientId ?? ''),
+                        code: String(body.code ?? '')
+                    })
+                };
+            case 'POST /SASjsApi/auth/refresh':
+                return { status: 200, body: await identity.refresh(request.token) };
+            case 'POST /SASjsApi/auth/logout':
+                await identity.logout(await caller());
+                return { status: 204 };
+            case 'POST /SASLogon/login':
+                return {
+                    status: 200,
+                    body: await identity.login({
+                        username: String(body.username ?? ''),
+                        password: String(body.password ?? '')
+                    })
+                };
+            case 'POST /SASLogon/authorize':
+                return {
+                    status: 200,
+                    body: {
+                        code: await identity.authorize(await caller(), String(body.clientId ?? ''))
+                    }
+                };
+            case 'GET /SASLogon/logout':
+                return { status: 200, contents: await identity.logoutSession() };
+            case 'GET /SASjsApi/session':
+                return { status: 200, body: await identity.session(await caller()) };
+        }
+    }
     switch (routeId) {
         case 'GET /SASjsApi/drive/file': {
             const file = await drive.read(String(query._filePath || ''));
@@ -98,5 +146,12 @@ exports.HANDLED_ROUTES = [
     'POST /SASjsApi/drive/folder',
     'DELETE /SASjsApi/drive/folder',
     'POST /SASjsApi/drive/rename',
-    'GET /SASjsApi/drive/filetree'
+    'GET /SASjsApi/drive/filetree',
+    'POST /SASjsApi/auth/token',
+    'POST /SASjsApi/auth/refresh',
+    'POST /SASjsApi/auth/logout',
+    'POST /SASLogon/login',
+    'POST /SASLogon/authorize',
+    'GET /SASLogon/logout',
+    'GET /SASjsApi/session'
 ];

package/build/cjs/identity/fixture.js

@@ -0,0 +1,118 @@
+"use strict";
+/**
+ * The identity a browser build starts from, and the format it travels in.
+ *
+ * A shipped fixture is what makes a mock build work with no configuration: it
+ * is small, legible, and declared to be fake. Passwords are plain text because
+ * nothing verifies them beyond an equality check - there is no boundary here,
+ * and pretending otherwise by shipping a hash would suggest one.
+ *
+ * `format` is stamped the way the drive's snapshot is: a store written by an
+ * older build is refused with a named reason rather than misread.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseIdentity = exports.DEFAULT_IDENTITY = exports.IDENTITY_FORMAT = void 0;
+exports.IDENTITY_FORMAT = 1;
+const SECONDS_IN_A_DAY = 86400;
+exports.DEFAULT_IDENTITY = {
+    format: exports.IDENTITY_FORMAT,
+    users: [
+        {
+            uid: 'user-admin',
+            username: 'admin',
+            displayName: 'Demo Admin',
+            // long enough to pass the API's own password rule (six characters), so a
+            // demo can sign in against a real server as well as a mock
+            password: 'admin123',
+            isAdmin: true,
+            isActive: true,
+            needsToUpdatePassword: false
+        },
+        {
+            uid: 'user-restricted',
+            username: 'user2',
+            displayName: 'Demo User',
+            password: 'user123',
+            isAdmin: false,
+            isActive: true,
+            needsToUpdatePassword: false
+        }
+    ],
+    groups: [
+        {
+            uid: 'group-data-controller',
+            name: 'DCGroup',
+            description: 'Data Controller users',
+            isActive: true,
+            users: ['user2']
+        },
+        {
+            uid: 'group-admins',
+            name: 'Admins',
+            description: 'Everything the API offers',
+            isActive: true,
+            users: ['admin']
+        }
+    ],
+    permissions: [
+        {
+            uid: 'rule-routes',
+            path: '/SASjsApi/info',
+            type: 'Route',
+            setting: 'Grant',
+            group: 'group-data-controller'
+        },
+        {
+            uid: 'rule-execute',
+            path: '/SASjsApi/stp/execute',
+            type: 'Route',
+            setting: 'Grant',
+            group: 'group-data-controller'
+        },
+        {
+            uid: 'rule-code',
+            path: '/SASjsApi/code/execute',
+            type: 'Route',
+            setting: 'Deny',
+            user: 'user-restricted'
+        }
+    ],
+    clients: [
+        {
+            clientId: 'web_app',
+            clientSecret: 'web_app',
+            accessTokenExpiration: SECONDS_IN_A_DAY,
+            refreshTokenExpiration: SECONDS_IN_A_DAY * 30
+        },
+        {
+            clientId: 'sasjs',
+            clientSecret: 'sasjs',
+            accessTokenExpiration: 3600,
+            refreshTokenExpiration: SECONDS_IN_A_DAY
+        }
+    ]
+};
+/**
+ * Parses a fixture a build wrote, refusing one this package cannot read.
+ *
+ * The checks name what is wrong and what to do about it: a fixture is hand-
+ * editable, so "invalid identity" would send the reader to the type rather than
+ * to the line.
+ */
+const parseIdentity = (raw) => {
+    const fixture = raw;
+    if (!fixture || typeof fixture !== 'object')
+        throw new Error('The identity fixture is not an object.');
+    if (fixture.format !== exports.IDENTITY_FORMAT)
+        throw new Error(`The identity fixture states format ${String(fixture.format)}, and this build reads format ${exports.IDENTITY_FORMAT}. Rebuild the site, or replace mock-identity.json with one this version wrote.`);
+    for (const key of ['users', 'groups', 'permissions', 'clients'])
+        if (!Array.isArray(fixture[key]))
+            throw new Error(`The identity fixture has no \`${key}\` array.`);
+    for (const token of fixture.tokens || [])
+        if (!token.accessToken || !token.refreshToken)
+            throw new Error(`The identity fixture declares a half pair for ${token.username}/${token.clientId}: a seeded token needs both an accessToken and a refreshToken, because a token only authenticates while the subject's pair holds it.`);
+    if (!fixture.users.some((user) => user.isAdmin))
+        throw new Error('The identity fixture declares no administrator: a demo with nobody able to administer it cannot exercise the admin routes.');
+    return fixture;
+};
+exports.parseIdentity = parseIdentity;

package/build/cjs/identity/memory-store.js

@@ -0,0 +1,179 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MemoryIdentityStore = void 0;
+const fixture_js_1 = require("./fixture.js");
+const types_js_1 = require("../types.js");
+const keyOf = (subject) => `${subject.userId}|${subject.clientId}`;
+/**
+ * Opaque identity strings, from the platform's cryptographic source.
+ *
+ * These strings are credentials: whoever holds one is the caller it names. A
+ * counter or `Math.random` is a sequence a reader can reproduce, so it would
+ * let one caller name another - the store is small and demo-shaped, but a token
+ * that can be guessed is not a demo quirk, it is an authentication bypass.
+ *
+ * `globalThis.crypto` is present in every browser and in Node from 19, which is
+ * the same reach the rest of this package has (no node imports, so the browser
+ * build bundles it unchanged).
+ */
+const randomHex = (bytes) => {
+    const source = globalThis.crypto;
+    if (!source)
+        throw new types_js_1.ApiError(500, 'This host has no Web Crypto (`globalThis.crypto`), so it cannot mint an unguessable identity string.');
+    const buffer = new Uint8Array(bytes);
+    source.getRandomValues(buffer);
+    return Array.from(buffer, (byte) => byte.toString(16).padStart(2, '0')).join('');
+};
+/**
+ * How long a code buys tokens, in seconds.
+ *
+ * The same lifetime `sasjs/server` signs into its auth code JWT, so a code a
+ * mock issues and one a server issues age out together.
+ */
+const CODE_LIFETIME_SECONDS = 30;
+const live = (issued, now) => issued && (issued.expiresAt === undefined || issued.expiresAt > now)
+    ? issued.subject
+    : undefined;
+/**
+ * Whether a token minted for one subject names the same user and client.
+ *
+ * The fixture can declare a token that outlives the map it is seeded into, so
+ * the read paths compare rather than trust the reference.
+ */
+class MemoryIdentityStore {
+    constructor(fixture = fixture_js_1.DEFAULT_IDENTITY) {
+        this.users = [];
+        this.passwords = new Map();
+        this.clients = new Map();
+        this.pairs = new Map();
+        this.access = new Map();
+        this.refresh = new Map();
+        this.codes = new Map();
+        this.claimed = new Set();
+        if (fixture.format !== fixture_js_1.IDENTITY_FORMAT)
+            throw new types_js_1.ApiError(500, `The identity fixture states format ${String(fixture.format)}; this store reads ${fixture_js_1.IDENTITY_FORMAT}.`);
+        for (const user of fixture.users) {
+            this.users.push({
+                uid: user.uid,
+                username: user.username,
+                displayName: user.displayName,
+                isAdmin: user.isAdmin,
+                isActive: user.isActive,
+                needsToUpdatePassword: user.needsToUpdatePassword
+            });
+            this.passwords.set(user.uid, user.password);
+        }
+        for (const client of fixture.clients)
+            this.clients.set(client.clientId, {
+                clientId: client.clientId,
+                accessTokenExpiration: client.accessTokenExpiration,
+                refreshTokenExpiration: client.refreshTokenExpiration
+            });
+        for (const token of fixture.tokens || []) {
+            const user = this.users.find((candidate) => candidate.username === token.username);
+            if (!user)
+                continue;
+            const subject = { userId: user.uid, clientId: token.clientId };
+            if (token.accessToken)
+                this.access.set(token.accessToken, { subject });
+            if (token.refreshToken)
+                this.refresh.set(token.refreshToken, { subject });
+            // a seeded token is the subject's live pair, which is what makes it
+            // authenticate: the read paths check the pair, not the token alone
+            if (token.accessToken && token.refreshToken)
+                this.pairs.set(keyOf(subject), {
+                    accessToken: token.accessToken,
+                    refreshToken: token.refreshToken
+                });
+        }
+        for (const code of fixture.codes || []) {
+            const user = this.users.find((candidate) => candidate.username === code.username);
+            if (!user)
+                continue;
+            this.codes.set(code.code, {
+                subject: { userId: user.uid, clientId: code.clientId }
+            });
+        }
+    }
+    async userByName(username) {
+        return this.users.find((user) => user.username === username);
+    }
+    async userById(uid) {
+        return this.users.find((user) => user.uid === uid);
+    }
+    /** A fixture holds the password in clear, so the check is an equality. */
+    async passwordMatches(user, password) {
+        return this.passwords.get(user.uid) === password;
+    }
+    async client(clientId) {
+        return this.clients.get(clientId);
+    }
+    async issue(subject, client) {
+        // The lifetimes are the client's, recorded against the instant of issue: a
+        // token's expiry is a fact about this pair, so the read paths can answer
+        // "invalid or expired" rather than carrying a number nothing compares.
+        const issuedAt = Date.now();
+        const pair = {
+            accessToken: `access-${randomHex(16)}`,
+            refreshToken: `refresh-${randomHex(16)}`
+        };
+        this.access.set(pair.accessToken, {
+            subject,
+            expiresAt: issuedAt + client.accessTokenExpiration * 1000
+        });
+        this.refresh.set(pair.refreshToken, {
+            subject,
+            expiresAt: issuedAt + client.refreshTokenExpiration * 1000
+        });
+        return pair;
+    }
+    /**
+     * A token names its subject only while that subject's CURRENT pair holds it.
+     * The server verifies a token against the pair saved for the user and client,
+     * so a logged-out or rotated token stops working there too; without the same
+     * check here, the browser host would honour a token the server had revoked.
+     */
+    async readAccess(token) {
+        return this.current(token, this.access, 'accessToken');
+    }
+    async readRefresh(token) {
+        return this.current(token, this.refresh, 'refreshToken');
+    }
+    current(token, issued, kind) {
+        const entry = issued.get(token);
+        if (!entry)
+            return undefined;
+        const subject = live(entry, Date.now());
+        if (!subject)
+            return undefined;
+        const pair = this.pairs.get(keyOf(subject));
+        return pair && pair[kind] === token ? subject : undefined;
+    }
+    async pairFor(subject) {
+        return this.pairs.get(keyOf(subject));
+    }
+    async savePair(subject, pair) {
+        this.pairs.set(keyOf(subject), pair);
+    }
+    async deletePair(subject) {
+        this.pairs.delete(keyOf(subject));
+    }
+    async issueCode(subject) {
+        const code = `code-${randomHex(16)}`;
+        this.codes.set(code, {
+            subject,
+            expiresAt: Date.now() + CODE_LIFETIME_SECONDS * 1000
+        });
+        return code;
+    }
+    async readCode(code) {
+        return live(this.codes.get(code), Date.now());
+    }
+    async claimCode(code) {
+        if (this.claimed.has(code) || !this.codes.has(code))
+            return false;
+        this.claimed.add(code);
+        return true;
+    }
+}
+exports.MemoryIdentityStore = MemoryIdentityStore;