@semapps/auth 1.1.4 → 1.2.0

package/dist/services/auth.local.d.ts

@@ -0,0 +1,143 @@
+/** @type {import('moleculer').ServiceSchema} */
+declare const AuthLocalService: {
+    name: "auth";
+    mixins: {
+        settings: {
+            baseUrl: null;
+            jwtPath: null;
+            capabilitiesPath: undefined;
+            registrationAllowed: boolean;
+            reservedUsernames: never[];
+            minPasswordLength: number;
+            minUsernameLength: number;
+            webIdSelection: never[];
+            accountSelection: never[];
+            accountsDataset: string;
+            podProvider: boolean;
+        };
+        dependencies: string[];
+        created(this: Moleculer.Service<Moleculer.ServiceSettingSchema>): Promise<void>;
+        started(this: Moleculer.Service<Moleculer.ServiceSettingSchema>): Promise<void>;
+        actions: {
+            authenticate: {
+                handler(ctx: Moleculer.Context<Optionalize<{
+                    [x: string]: any;
+                }>, {}, Moleculer.GenericObject>): Promise<any>;
+            };
+            authorize: {
+                handler(ctx: Moleculer.Context<Optionalize<{
+                    [x: string]: any;
+                }>, {}, Moleculer.GenericObject>): Promise<any>;
+            };
+            impersonate: {
+                handler(ctx: Moleculer.Context<Optionalize<{
+                    [x: string]: any;
+                }>, {}, Moleculer.GenericObject>): Promise<any>;
+            };
+        };
+        methods: {
+            validateCapability(ctx: any, token: any): Promise<any>;
+            getStrategy(): never;
+            getApiRoutes(): never;
+            pickWebIdData(data: any): any;
+            pickAccountData(data: any): {
+                [k: string]: any;
+            };
+        };
+    }[];
+    settings: {
+        baseUrl: null;
+        jwtPath: null;
+        registrationAllowed: boolean;
+        reservedUsernames: never[];
+        minPasswordLength: number;
+        minUsernameLength: number;
+        webIdSelection: never[];
+        accountSelection: never[];
+        formUrl: null;
+        mail: {
+            from: null;
+            transport: {
+                host: null;
+                port: null;
+            };
+            defaults: {
+                locale: null;
+                frontUrl: null;
+            };
+        };
+    };
+    dependencies: string[];
+    created(this: Moleculer.Service<Moleculer.ServiceSettingSchema>): Promise<void>;
+    actions: {
+        signup: {
+            handler(ctx: Moleculer.Context<Optionalize<{
+                [x: string]: any;
+            }>, {}, Moleculer.GenericObject>): Promise<{
+                token: any;
+                webId: any;
+                newUser: boolean;
+            }>;
+        };
+        login: {
+            handler(ctx: Moleculer.Context<Optionalize<{
+                [x: string]: any;
+            }>, {}, Moleculer.GenericObject>): Promise<{
+                token: any;
+                webId: any;
+                newUser: boolean;
+            }>;
+        };
+        logout: {
+            handler(ctx: Moleculer.Context<Optionalize<{
+                [x: string]: any;
+            }>, {}, Moleculer.GenericObject>): Promise<void>;
+        };
+        redirectToForm: {
+            handler(ctx: Moleculer.Context<Optionalize<{
+                [x: string]: any;
+            }>, {}, Moleculer.GenericObject>): Promise<void>;
+        };
+        resetPassword: {
+            handler(ctx: Moleculer.Context<Optionalize<{
+                [x: string]: any;
+            }>, {}, Moleculer.GenericObject>): Promise<void>;
+        };
+        setNewPassword: {
+            handler(ctx: Moleculer.Context<Optionalize<{
+                [x: string]: any;
+            }>, {}, Moleculer.GenericObject>): Promise<void>;
+        };
+    };
+    methods: {
+        getStrategy(): any;
+        getApiRoutes(basePath: any): ({
+            path: string;
+            name: string;
+            use: any[];
+            aliases: {
+                'POST /': any[];
+            };
+        } | {
+            path: string;
+            name: string;
+            aliases: {
+                'GET /': string;
+            };
+        } | {
+            path: string;
+            name: string;
+            aliases: {
+                'POST /': string;
+            };
+        })[];
+    };
+};
+export default AuthLocalService;
+declare global {
+    export namespace Moleculer {
+        interface AllServices {
+            [AuthLocalService.name]: typeof AuthLocalService;
+        }
+    }
+}

package/dist/services/auth.local.js

@@ -0,0 +1,229 @@
+import path from 'path';
+// @ts-expect-error TS(7016): Could not find a declaration file for module 'pass... Remove this comment to see the full error message
+import { Strategy } from 'passport-local';
+import AuthMixin from "../mixins/auth.js";
+import sendToken from "../middlewares/sendToken.js";
+import AuthMailService from "./mail.js";
+import { Errors } from 'moleculer';
+const { MoleculerError } = Errors;
+/** @type {import('moleculer').ServiceSchema} */
+const AuthLocalService = {
+    name: 'auth',
+    mixins: [AuthMixin],
+    settings: {
+        baseUrl: null,
+        jwtPath: null,
+        registrationAllowed: true,
+        reservedUsernames: [],
+        minPasswordLength: 1,
+        minUsernameLength: 1,
+        webIdSelection: [],
+        accountSelection: [],
+        formUrl: null,
+        mail: {
+            from: null,
+            transport: {
+                host: null,
+                port: null
+            },
+            defaults: {
+                locale: null,
+                frontUrl: null
+            }
+        }
+    },
+    dependencies: ['webid'],
+    async created() {
+        const { mail } = this.settings;
+        this.passportId = 'local';
+        if (mail !== false) {
+            // @ts-expect-error TS(2345): Argument of type '{ mixins: { name: "auth.mail"; m... Remove this comment to see the full error message
+            this.broker.createService({
+                mixins: [AuthMailService],
+                settings: {
+                    ...mail
+                }
+            });
+        }
+    },
+    actions: {
+        signup: {
+            async handler(ctx) {
+                const { username, email, password, ...rest } = ctx.params;
+                // This is going to get in our way otherwise when waiting for completions.
+                // @ts-expect-error TS(2339): Property 'skipObjectsWatcher' does not exist on ty... Remove this comment to see the full error message
+                ctx.meta.skipObjectsWatcher = true;
+                let accountData = await ctx.call('auth.account.create', {
+                    username,
+                    email,
+                    password,
+                    ...this.pickAccountData(rest)
+                });
+                try {
+                    const profileData = { nick: accountData.username, email: accountData.email, ...rest };
+                    const webId = await ctx.call('webid.createWebId', this.pickWebIdData(profileData), {
+                        meta: {
+                            isSignup: true // Allow services to handle directly the webId creation if it is generated by the AuthService
+                        }
+                    });
+                    // Link the webId with the account
+                    accountData = await ctx.call('auth.account.attachWebId', { accountUri: accountData['@id'], webId });
+                    ctx.emit('auth.registered', { webId, profileData, accountData });
+                    const token = await ctx.call('auth.jwt.generateServerSignedToken', { payload: { webId } });
+                    return { token, webId, newUser: true };
+                }
+                catch (e) {
+                    // Delete account if resource creation failed, or it may cause problems when retrying
+                    await ctx.call('auth.account.remove', { id: accountData['@id'] });
+                    throw e;
+                }
+            }
+        },
+        login: {
+            async handler(ctx) {
+                const { username, password } = ctx.params;
+                const accountData = await ctx.call('auth.account.verify', { username, password });
+                ctx.emit('auth.connected', { webId: accountData.webId, accountData }, { meta: { webId: null, dataset: null } });
+                const token = await ctx.call('auth.jwt.generateServerSignedToken', { payload: { webId: accountData.webId } });
+                return { token, webId: accountData.webId, newUser: false };
+            }
+        },
+        logout: {
+            async handler(ctx) {
+                // @ts-expect-error TS(2339): Property '$statusCode' does not exist on type '{}'... Remove this comment to see the full error message
+                ctx.meta.$statusCode = 302;
+                // @ts-expect-error TS(2339): Property '$location' does not exist on type '{}'.
+                ctx.meta.$location = ctx.params.redirectUrl || this.settings.formUrl;
+                // @ts-expect-error TS(2339): Property 'webId' does not exist on type '{}'.
+                ctx.emit('auth.disconnected', { webId: ctx.meta.webId });
+            }
+        },
+        redirectToForm: {
+            async handler(ctx) {
+                if (this.settings.formUrl) {
+                    const formUrl = new URL(this.settings.formUrl);
+                    if (ctx.params) {
+                        for (const [key, value] of Object.entries(ctx.params)) {
+                            formUrl.searchParams.set(key, value);
+                        }
+                    }
+                    // @ts-expect-error TS(2339): Property '$statusCode' does not exist on type '{}'... Remove this comment to see the full error message
+                    ctx.meta.$statusCode = 302;
+                    // @ts-expect-error TS(2339): Property '$location' does not exist on type '{}'.
+                    ctx.meta.$location = formUrl.toString();
+                }
+                else {
+                    throw new Error('No formUrl defined in auth.local settings');
+                }
+            }
+        },
+        resetPassword: {
+            async handler(ctx) {
+                const { email } = ctx.params;
+                const account = await ctx.call('auth.account.findByEmail', { email });
+                if (!account) {
+                    throw new MoleculerError('email.not.exists', 400, 'BAD_REQUEST');
+                }
+                const token = await ctx.call('auth.account.generateResetPasswordToken', { webId: account.webId });
+                await ctx.call('auth.mail.sendResetPasswordEmail', {
+                    account,
+                    token
+                });
+            }
+        },
+        setNewPassword: {
+            async handler(ctx) {
+                const { email, token, password } = ctx.params;
+                const account = await ctx.call('auth.account.findByEmail', { email });
+                if (!account) {
+                    throw new MoleculerError('email.not.exists', 400, 'BAD_REQUEST');
+                }
+                await ctx.call('auth.account.setNewPassword', { webId: account.webId, token, password });
+            }
+        }
+    },
+    methods: {
+        getStrategy() {
+            return new Strategy({
+                passReqToCallback: true // We want to have access to req below
+            }, (req, username, password, done) => {
+                req.$ctx
+                    .call('auth.login', req.$params)
+                    .then((returnedData) => {
+                    done(null, returnedData);
+                })
+                    .catch((e) => {
+                    done(new MoleculerError(e.message, 401), false);
+                });
+            });
+        },
+        getApiRoutes(basePath) {
+            const loginRoute = {
+                path: path.join(basePath, '/auth/login'),
+                name: 'auth-login',
+                use: [this.passport.initialize()],
+                aliases: {
+                    'POST /': [this.passport.authenticate(this.passportId, { session: false }), sendToken]
+                }
+            };
+            const logoutRoute = {
+                path: path.join(basePath, '/auth/logout'),
+                name: 'auth-logout',
+                aliases: {
+                    'GET /': 'auth.logout'
+                }
+            };
+            const signupRoute = {
+                path: path.join(basePath, '/auth/signup'),
+                name: 'auth-signup',
+                aliases: {
+                    'POST /': 'auth.signup'
+                }
+            };
+            const formRoute = {
+                path: path.join(basePath, '/auth'),
+                name: 'auth',
+                aliases: {
+                    'GET /': 'auth.redirectToForm'
+                }
+            };
+            const resetPasswordRoute = {
+                path: path.join(basePath, '/auth/reset_password'),
+                name: 'auth-reset-password',
+                aliases: {
+                    'POST /': 'auth.resetPassword'
+                }
+            };
+            const setNewPasswordRoute = {
+                path: path.join(basePath, '/auth/new_password'),
+                name: 'auth-new-password',
+                aliases: {
+                    'POST /': 'auth.setNewPassword'
+                }
+            };
+            const accountSettingsRoute = {
+                path: path.join(basePath, '/auth/account'),
+                name: 'auth-account',
+                aliases: {
+                    'GET /': 'auth.account.findSettingsByWebId',
+                    'POST /': 'auth.account.updateAccountSettings'
+                },
+                authorization: true
+            };
+            const routes = [
+                loginRoute,
+                logoutRoute,
+                formRoute,
+                resetPasswordRoute,
+                setNewPasswordRoute,
+                accountSettingsRoute
+            ];
+            if (this.settings.registrationAllowed) {
+                return [...routes, signupRoute];
+            }
+            return routes;
+        }
+    }
+};
+export default AuthLocalService;
+//# sourceMappingURL=auth.local.js.map

package/dist/services/auth.local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.local.js","sourceRoot":"","sources":["../../services/auth.local.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,qIAAqI;AACrI,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,OAAO,SAAS,MAAM,mBAAmB,CAAC;AAC1C,OAAO,SAAS,MAAM,6BAA6B,CAAC;AACpD,OAAO,eAAe,MAAM,WAAW,CAAC;AAExC,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAEnC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC;AAElC,gDAAgD;AAChD,MAAM,gBAAgB,GAAG;IACvB,IAAI,EAAE,MAAe;IACrB,MAAM,EAAE,CAAC,SAAS,CAAC;IACnB,QAAQ,EAAE;QACR,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,IAAI;QACb,mBAAmB,EAAE,IAAI;QACzB,iBAAiB,EAAE,EAAE;QACrB,iBAAiB,EAAE,CAAC;QACpB,iBAAiB,EAAE,CAAC;QACpB,cAAc,EAAE,EAAE;QAClB,gBAAgB,EAAE,EAAE;QACpB,OAAO,EAAE,IAAI;QACb,IAAI,EAAE;YACJ,IAAI,EAAE,IAAI;YACV,SAAS,EAAE;gBACT,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,IAAI;aACX;YACD,QAAQ,EAAE;gBACR,MAAM,EAAE,IAAI;gBACZ,QAAQ,EAAE,IAAI;aACf;SACF;KACF;IACD,YAAY,EAAE,CAAC,OAAO,CAAC;IACvB,KAAK,CAAC,OAAO;QACX,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE/B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC;QAE1B,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,qIAAqI;YACrI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;gBACxB,MAAM,EAAE,CAAC,eAAe,CAAC;gBACzB,QAAQ,EAAE;oBACR,GAAG,IAAI;iBACR;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,EAAE;QACP,MAAM,EAAE;YACN,KAAK,CAAC,OAAO,CAAC,GAAG;gBACf,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;gBAE1D,0EAA0E;gBAC1E,qIAAqI;gBACrI,GAAG,CAAC,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;gBAEnC,IAAI,WAAW,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE;oBACtD,QAAQ;oBACR,KAAK;oBACL,QAAQ;oBACR,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;iBAC9B,CAAC,CAAC;gBAEH,IAAI,CAAC;oBACH,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC;oBACtF,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE;wBACjF,IAAI,EAAE;4BACJ,QAAQ,EAAE,IAAI,CAAC,6FAA6F;yBAC7G;qBACF,CAAC,CAAC;oBAEH,kCAAkC;oBAClC,WAAW,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,UAAU,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;oBAEpG,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;oBAEjE,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;oBAE3F,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBACzC,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,qFAAqF;oBACrF,MAAM,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBAClE,MAAM,CAAC,CAAC;gBACV,CAAC;YACH,CAAC;SACF;QAED,KAAK,EAAE;YACL,KAAK,CAAC,OAAO,CAAC,GAAG;gBACf,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;gBAE1C,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAElF,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;gBAEhH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAE9G,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC7D,CAAC;SACF;QAED,MAAM,EAAE;YACN,KAAK,CAAC,OAAO,CAAC,GAAG;gBACf,qIAAqI;gBACrI,GAAG,CAAC,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC;gBAC3B,+EAA+E;gBAC/E,GAAG,CAAC,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACrE,2EAA2E;gBAC3E,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YAC3D,CAAC;SACF;QAED,cAAc,EAAE;YACd,KAAK,CAAC,OAAO,CAAC,GAAG;gBACf,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBAC1B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;oBAC/C,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;wBACf,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;4BACtD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;wBACvC,CAAC;oBACH,CAAC;oBACD,qIAAqI;oBACrI,GAAG,CAAC,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC;oBAC3B,+EAA+E;oBAC/E,GAAG,CAAC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAC1C,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;SACF;QAED,aAAa,EAAE;YACb,KAAK,CAAC,OAAO,CAAC,GAAG;gBACf,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;gBAE7B,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;gBAEtE,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,cAAc,CAAC,kBAAkB,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;gBACnE,CAAC;gBAED,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,yCAAyC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;gBAElG,MAAM,GAAG,CAAC,IAAI,CAAC,kCAAkC,EAAE;oBACjD,OAAO;oBACP,KAAK;iBACN,CAAC,CAAC;YACL,CAAC;SACF;QAED,cAAc,EAAE;YACd,KAAK,CAAC,OAAO,CAAC,GAAG;gBACf,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;gBAE9C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;gBAEtE,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,cAAc,CAAC,kBAAkB,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;gBACnE,CAAC;gBAED,MAAM,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC3F,CAAC;SACF;KACF;IACD,OAAO,EAAE;QACP,WAAW;YACT,OAAO,IAAI,QAAQ,CACjB;gBACE,iBAAiB,EAAE,IAAI,CAAC,sCAAsC;aAC/D,EACD,CAAC,GAAQ,EAAE,QAAa,EAAE,QAAa,EAAE,IAAS,EAAE,EAAE;gBACpD,GAAG,CAAC,IAAI;qBACL,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC;qBAC/B,IAAI,CAAC,CAAC,YAAiB,EAAE,EAAE;oBAC1B,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;gBAC3B,CAAC,CAAC;qBACD,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;oBAChB,IAAI,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;gBAClD,CAAC,CAAC,CAAC;YACP,CAAC,CACF,CAAC;QACJ,CAAC;QACD,YAAY,CAAC,QAAQ;YACnB,MAAM,UAAU,GAAG;gBACjB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC;gBACxC,IAAI,EAAE,YAAY;gBAClB,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;gBACjC,OAAO,EAAE;oBACP,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,CAAC;iBACvF;aACF,CAAC;YAEF,MAAM,WAAW,GAAG;gBAClB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC;gBACzC,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE;oBACP,OAAO,EAAE,aAAa;iBACvB;aACF,CAAC;YAEF,MAAM,WAAW,GAAG;gBAClB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC;gBACzC,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE;oBACP,QAAQ,EAAE,aAAa;iBACxB;aACF,CAAC;YAEF,MAAM,SAAS,GAAG;gBAChB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC;gBAClC,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,OAAO,EAAE,qBAAqB;iBAC/B;aACF,CAAC;YAEF,MAAM,kBAAkB,GAAG;gBACzB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,sBAAsB,CAAC;gBACjD,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE;oBACP,QAAQ,EAAE,oBAAoB;iBAC/B;aACF,CAAC;YACF,MAAM,mBAAmB,GAAG;gBAC1B,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,oBAAoB,CAAC;gBAC/C,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE;oBACP,QAAQ,EAAE,qBAAqB;iBAChC;aACF,CAAC;YAEF,MAAM,oBAAoB,GAAG;gBAC3B,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC;gBAC1C,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE;oBACP,OAAO,EAAE,kCAAkC;oBAC3C,QAAQ,EAAE,oCAAoC;iBAC/C;gBACD,aAAa,EAAE,IAAI;aACpB,CAAC;YAEF,MAAM,MAAM,GAAG;gBACb,UAAU;gBACV,WAAW;gBACX,SAAS;gBACT,kBAAkB;gBAClB,mBAAmB;gBACnB,oBAAoB;aACrB,CAAC;YAEF,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC;gBACtC,OAAO,CAAC,GAAG,MAAM,EAAE,WAAW,CAAC,CAAC;YAClC,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC;KACF;CACsB,CAAC;AAE1B,eAAe,gBAAgB,CAAC"}

package/dist/services/auth.oidc.d.ts

@@ -0,0 +1,102 @@
+declare const AuthOIDCService: {
+    name: "auth";
+    mixins: {
+        mixins: {
+            settings: {
+                baseUrl: null;
+                jwtPath: null;
+                capabilitiesPath: undefined;
+                registrationAllowed: boolean;
+                reservedUsernames: never[];
+                minPasswordLength: number;
+                minUsernameLength: number;
+                webIdSelection: never[];
+                accountSelection: never[];
+                accountsDataset: string;
+                podProvider: boolean;
+            };
+            dependencies: string[];
+            created(this: Moleculer.Service<Moleculer.ServiceSettingSchema>): Promise<void>;
+            started(this: Moleculer.Service<Moleculer.ServiceSettingSchema>): Promise<void>;
+            actions: {
+                authenticate: {
+                    handler(ctx: Moleculer.Context<Optionalize<{
+                        [x: string]: any;
+                    }>, {}, Moleculer.GenericObject>): Promise<any>;
+                };
+                authorize: {
+                    handler(ctx: Moleculer.Context<Optionalize<{
+                        [x: string]: any;
+                    }>, {}, Moleculer.GenericObject>): Promise<any>;
+                };
+                impersonate: {
+                    handler(ctx: Moleculer.Context<Optionalize<{
+                        [x: string]: any;
+                    }>, {}, Moleculer.GenericObject>): Promise<any>;
+                };
+            };
+            methods: {
+                validateCapability(ctx: any, token: any): Promise<any>;
+                getStrategy(): never;
+                getApiRoutes(): never;
+                pickWebIdData(data: any): any;
+                pickAccountData(data: any): {
+                    [k: string]: any;
+                };
+            };
+        }[];
+        settings: {
+            baseUrl: null;
+            jwtPath: null;
+            registrationAllowed: boolean;
+            reservedUsernames: never[];
+            webIdSelection: never[];
+            sessionSecret: string;
+            selectSsoData: null;
+        };
+        actions: {
+            loginOrSignup: {
+                handler(ctx: Moleculer.Context<Optionalize<{
+                    [x: string]: any;
+                }>, {}, Moleculer.GenericObject>): Promise<{
+                    token: any;
+                    newUser: boolean;
+                }>;
+            };
+        };
+        methods: {
+            getApiRoutes(basePath: any): {
+                path: string;
+                name: string;
+                use: any[];
+                aliases: {
+                    'GET /': any[];
+                };
+            }[];
+        };
+    }[];
+    settings: {
+        baseUrl: null;
+        jwtPath: null;
+        registrationAllowed: boolean;
+        reservedUsernames: never[];
+        webIdSelection: never[];
+        sessionSecret: string;
+        selectSsoData: null;
+        issuer: null;
+        clientId: null;
+        clientSecret: null;
+    };
+    created(this: Moleculer.Service<Moleculer.ServiceSettingSchema>): Promise<void>;
+    methods: {
+        getStrategy(): Promise<any>;
+    };
+};
+export default AuthOIDCService;
+declare global {
+    export namespace Moleculer {
+        interface AllServices {
+            [AuthOIDCService.name]: typeof AuthOIDCService;
+        }
+    }
+}

package/dist/services/auth.oidc.js

@@ -0,0 +1,63 @@
+import urlJoin from 'url-join';
+// @ts-expect-error TS(7016): Could not find a declaration file for module 'open... Remove this comment to see the full error message
+import { Issuer, Strategy, custom } from 'openid-client';
+import AuthSSOMixin from "../mixins/auth.sso.js";
+custom.setHttpOptionsDefaults({
+    timeout: 10000
+});
+const AuthOIDCService = {
+    name: 'auth',
+    mixins: [AuthSSOMixin],
+    settings: {
+        baseUrl: null,
+        jwtPath: null,
+        registrationAllowed: true,
+        reservedUsernames: [],
+        webIdSelection: [],
+        // SSO-specific settings
+        sessionSecret: 's€m@pps',
+        selectSsoData: null,
+        // OIDC-specific settings
+        issuer: null,
+        clientId: null,
+        clientSecret: null
+    },
+    async created() {
+        this.passportId = 'oidc';
+    },
+    methods: {
+        async getStrategy() {
+            const issuer = await Issuer.discover(this.settings.issuer);
+            const client = new issuer.Client({
+                client_id: this.settings.clientId,
+                client_secret: this.settings.clientSecret,
+                redirect_uri: urlJoin(this.settings.baseUrl, 'auth'),
+                token_endpoint_auth_method: this.settings.clientSecret ? undefined : 'none'
+            });
+            const params = {
+            // ... any authorization params override client properties
+            // client_id defaults to client.client_id
+            // redirect_uri defaults to client.redirect_uris[0]
+            // response type defaults to client.response_types[0], then 'code'
+            // scope defaults to 'openid'
+            };
+            return new Strategy({
+                client,
+                params,
+                passReqToCallback: true
+            }, (req, tokenset, userinfo, done) => {
+                req.$ctx
+                    .call('auth.loginOrSignup', { ssoData: userinfo })
+                    .then((loginData) => {
+                    done(null, loginData);
+                })
+                    .catch((e) => {
+                    console.error(e);
+                    done(null, false);
+                });
+            });
+        }
+    }
+};
+export default AuthOIDCService;
+//# sourceMappingURL=auth.oidc.js.map

package/dist/services/auth.oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.oidc.js","sourceRoot":"","sources":["../../services/auth.oidc.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,UAAU,CAAC;AAC/B,qIAAqI;AACrI,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAGzD,OAAO,YAAY,MAAM,uBAAuB,CAAC;AAEjD,MAAM,CAAC,sBAAsB,CAAC;IAC5B,OAAO,EAAE,KAAK;CACf,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG;IACtB,IAAI,EAAE,MAAe;IACrB,MAAM,EAAE,CAAC,YAAY,CAAC;IACtB,QAAQ,EAAE;QACR,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,IAAI;QACb,mBAAmB,EAAE,IAAI;QACzB,iBAAiB,EAAE,EAAE;QACrB,cAAc,EAAE,EAAE;QAClB,wBAAwB;QACxB,aAAa,EAAE,SAAS;QACxB,aAAa,EAAE,IAAI;QACnB,yBAAyB;QACzB,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,IAAI;KACnB;IACD,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC;IAC3B,CAAC;IACD,OAAO,EAAE;QACP,KAAK,CAAC,WAAW;YACf,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAE3D,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC;gBAC/B,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;gBACjC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY;gBACzC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBACpD,0BAA0B,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;aAC5E,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG;YACb,0DAA0D;YAC1D,yCAAyC;YACzC,mDAAmD;YACnD,kEAAkE;YAClE,6BAA6B;aAC9B,CAAC;YAEF,OAAO,IAAI,QAAQ,CACjB;gBACE,MAAM;gBACN,MAAM;gBACN,iBAAiB,EAAE,IAAI;aACxB,EACD,CAAC,GAAQ,EAAE,QAAa,EAAE,QAAa,EAAE,IAAS,EAAE,EAAE;gBACpD,GAAG,CAAC,IAAI;qBACL,IAAI,CAAC,oBAAoB,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;qBACjD,IAAI,CAAC,CAAC,SAAc,EAAE,EAAE;oBACvB,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACxB,CAAC,CAAC;qBACD,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;oBAChB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBACjB,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACpB,CAAC,CAAC,CAAC;YACP,CAAC,CACF,CAAC;QACJ,CAAC;KACF;CACsB,CAAC;AAE1B,eAAe,eAAe,CAAC"}

package/dist/services/jwt.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Service that creates and validates JSON web tokens(JWT).
+ * Tokens are signed against this server's keys.
+ * This is useful for generating/validating authentication tokens.
+ *
+ * TODO: Tokens do not expire.
+ */
+declare const AuthJwtSchema: {
+    name: "auth.jwt";
+    settings: {
+        jwtPath: null;
+    };
+    created(this: Moleculer.Service<Moleculer.ServiceSettingSchema>): Promise<void>;
+    actions: {
+        generateKeyPair: {
+            handler(ctx: Moleculer.Context<Optionalize<{
+                [x: string]: any;
+            }>, {}, Moleculer.GenericObject>): Promise<unknown>;
+        };
+        generateServerSignedToken: {
+            handler(ctx: Moleculer.Context<Optionalize<{
+                [x: string]: any;
+            }>, {}, Moleculer.GenericObject>): Promise<any>;
+        };
+        verifyServerSignedToken: {
+            /** Verifies that the token was signed by this server. */
+            handler(ctx: Moleculer.Context<Optionalize<{
+                [x: string]: any;
+            }>, {}, Moleculer.GenericObject>): Promise<any>;
+        };
+        generateUnsignedToken: {
+            handler(ctx: Moleculer.Context<Optionalize<{
+                [x: string]: any;
+            }>, {}, Moleculer.GenericObject>): Promise<any>;
+        };
+        decodeToken: {
+            handler(ctx: Moleculer.Context<Optionalize<{
+                [x: string]: any;
+            }>, {}, Moleculer.GenericObject>): Promise<any>;
+        };
+    };
+};
+export default AuthJwtSchema;
+declare global {
+    export namespace Moleculer {
+        interface AllServices {
+            [AuthJwtSchema.name]: typeof AuthJwtSchema;
+        }
+    }
+}