@spinajs/authn-keys 0.0.0-stage → 3.0.1

package/lib/mjs/registry/registry.js

@@ -0,0 +1,239 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { createHash } from 'node:crypto';
+import { Autoinject, Injectable } from '@spinajs/di';
+import { Config } from '@spinajs/configuration';
+import '../register-schema.js';
+import { AuthnAudit } from '@spinajs/authn/audit';
+import { AuthnThrottle, KeyRegistry, SecretStore } from '@spinajs/authn/contracts';
+import { _between, _contains, _is_string, _try_check_arg, isPlainObject } from '@spinajs/util';
+import { InvalidArgument, InvalidOption, UnexpectedServerError } from '@spinajs/exceptions';
+import { challengeId, challengeSecretPurpose, isChallengeNonce, newChallengeRid, parseChallengeId, verifyChallengeSignature } from '../challenge/challenge.js';
+import { checkPublicJwk, isValidKid, thumbprint } from '../jwk/keys.js';
+import { keysOptionsOf } from '../options/options.js';
+import { decodeCeiling, encodeCeiling, encodePrincipalRef, KeyStore } from './store.js';
+const OWNER_TYPES = ['user', 'service', 'agent'];
+const MAX_OWNER_ID = 64;
+const MAX_NAME = 128;
+const TOUCH_INTERVAL_MS = 60_000;
+const MAX_CREATED_BY = 100;
+const CEILING_KEYS = ['roles', 'permissions', 'resources', 'expiresAt', 'reason'];
+const nonEmpty = (v, max) => typeof v === 'string' && v.length > 0 && v.length <= max;
+function ownerOf(v) {
+    const o = isPlainObject(v) ? v : {};
+    const [typeOk, type] = _try_check_arg(_is_string(_contains(OWNER_TYPES)))(o.type, 'owner.type');
+    const [idOk, id] = _try_check_arg(_is_string(_between(1, MAX_OWNER_ID)))(o.id, 'owner.id');
+    if (!typeOk || !idOk) {
+        throw new InvalidArgument('a key owner is a user, a service or an agent with an id of 1-64 characters');
+    }
+    return Object.freeze({ type: type, id: id });
+}
+/** An actor that fits authn_key.created_by (varchar 100). */
+function principalRefOf(v) {
+    const o = isPlainObject(v) ? v : {};
+    const [typeOk, type] = _try_check_arg(_is_string(_between(1, MAX_CREATED_BY)))(o.type, 'actor.type');
+    const [idOk, id] = _try_check_arg(_is_string(_between(1, MAX_CREATED_BY)))(o.id, 'actor.id');
+    if (!typeOk || !idOk) {
+        return null;
+    }
+    const ref = Object.freeze({ type: type, id: id });
+    return encodePrincipalRef(ref).length <= MAX_CREATED_BY ? ref : null;
+}
+const strings = (v) => Array.isArray(v) && v.every((x) => typeof x === 'string');
+/** The Ceiling shape (design §5), so a malformed scope never reaches storage. */
+function isCeiling(v) {
+    if (!isPlainObject(v) || Object.keys(v).some((k) => !CEILING_KEYS.includes(k))) {
+        return false;
+    }
+    const resources = v.resources;
+    return (v.roles === undefined || strings(v.roles)) && (v.permissions === undefined || strings(v.permissions)) && (resources === undefined || (Array.isArray(resources) && resources.every((r) => isPlainObject(r) && typeof r.type === 'string' && (r.id === undefined || typeof r.id === 'string')))) && (v.expiresAt === undefined || (v.expiresAt instanceof Date && !Number.isNaN(v.expiresAt.getTime()))) && (v.reason === undefined || typeof v.reason === 'string');
+}
+/** Usable for verification: neither revoked nor expired at `now`. */
+export const isUsableKey = (key, now) => !key.revokedAt && (!key.expiresAt || now.getTime() < key.expiresAt.getTime());
+/**
+ * A login challenge is stored for the key it names; a name that is not a kid still gets a challenge of the same shape
+ * (A02), stored under a digest so anonymous input never becomes a long identity id.
+ */
+export const loginChallengeIdentity = (kid) => ({ type: 'key', id: isValidKid(kid) ? kid : createHash('sha256').update(kid, 'utf8').digest('hex') });
+/** KeyRegistry over a KeyStore, challenges in SecretStore (lane notes D7, D12). */
+let DefaultKeyRegistry = class DefaultKeyRegistry extends KeyRegistry {
+    constructor(Deps) {
+        super();
+        this.Deps = Deps;
+        this.stamped = new Map();
+        /** Kids whose last stamp is remembered; past this the least recently stamped is forgotten and costs one extra write. */
+        this.maxStamped = 10_000;
+    }
+    get store() {
+        return this.Deps?.store ?? this.Store;
+    }
+    get secrets() {
+        return this.Deps?.secrets ?? this.Secrets;
+    }
+    get throttle() {
+        return this.Deps?.throttle ?? this.Throttle;
+    }
+    get options() {
+        return keysOptionsOf(this.Deps?.options ?? this.KeysConfig);
+    }
+    publish(ctx, e) {
+        return (this.Deps?.audit ?? this.Audit).publishIn(ctx, e);
+    }
+    /** The new key's signature over a 'register' challenge issued to this user; the challenge is redeemed only after the signature holds. */
+    async proofHolds(owner, key, proof) {
+        if (!isPlainObject(proof)) {
+            return false;
+        }
+        const parsed = parseChallengeId(proof.challengeId);
+        const audience = this.options.challenge.audience;
+        if (!parsed || audience === null || !verifyChallengeSignature(key, parsed.nonce, 'register', audience, proof.signature)) {
+            return false;
+        }
+        return this.secrets.redeem({ type: 'user', id: owner.id }, challengeSecretPurpose(parsed.rid), parsed.nonce);
+    }
+    async register(reg, ctx) {
+        const r = reg;
+        const owner = ownerOf(r.owner);
+        const fail = async (code) => {
+            await this.publish(ctx, { type: 'key.register', outcome: 'failure', identity: owner, reason: code });
+            return { ok: false, code };
+        };
+        const material = checkPublicJwk(r.jwk, this.options.algorithms);
+        const kid = r.kid === undefined && material ? thumbprint(material.jwk) : r.kid;
+        const expiresAt = r.expiresAt;
+        const badExpiry = expiresAt !== undefined && (!(expiresAt instanceof Date) || !(expiresAt.getTime() > ctx.now.getTime()));
+        // Names reach admin terminals (authn:key-list): no control characters.
+        const badName = r.name !== undefined && (!nonEmpty(r.name, MAX_NAME) || /[\u0000-\u001f\u007f-\u009f]/.test(r.name));
+        const badScope = r.scope !== undefined && !isCeiling(r.scope);
+        if (!material || !isValidKid(kid) || badExpiry || badName || badScope) {
+            return fail('invalid_key');
+        }
+        let createdBy;
+        if (owner.type === 'user') {
+            if (!(await this.proofHolds(owner, material, r.proof))) {
+                return fail('invalid_proof');
+            }
+        }
+        else {
+            const actor = principalRefOf(r.actor);
+            if (!actor) {
+                throw new InvalidArgument('a service or agent key is registered by an actor (admin route or CLI)');
+            }
+            createdBy = actor;
+        }
+        const key = {
+            ...material,
+            kid,
+            owner,
+            thumbprint: thumbprint(material.jwk),
+            ...(r.name !== undefined ? { name: r.name } : {}),
+            // A copy through the stored form, so the memory store keeps what the ORM store would return.
+            ...(r.scope !== undefined ? { scope: decodeCeiling(encodeCeiling(r.scope)) } : {}),
+            createdAt: ctx.now,
+            ...(createdBy ? { createdBy } : {}),
+            ...(expiresAt !== undefined ? { expiresAt: expiresAt } : {}),
+        };
+        if ((await this.store.insert(key)) === 'duplicate') {
+            return fail('duplicate');
+        }
+        const stored = (await this.store.get(kid)) ?? key;
+        await this.publish(ctx, { type: 'key.register', outcome: 'success', identity: owner, ...(createdBy ? { actor: createdBy } : {}), data: { kid, thumbprint: stored.thumbprint, alg: stored.alg } });
+        return { ok: true, key: stored };
+    }
+    async list(owner) {
+        return this.store.listByOwner(owner);
+    }
+    async revoke(owner, kid, ctx, opts) {
+        const done = isValidKid(kid) ? await this.store.revoke(owner, kid, ctx.now) : 'none';
+        if (done === 'none') {
+            return false;
+        }
+        if (done === 'already') {
+            return true;
+        }
+        await this.publish(ctx, { type: 'key.revoke', outcome: 'success', identity: owner, ...(opts?.actor ? { actor: opts.actor } : {}), data: { kid } });
+        return true;
+    }
+    async byId(kid) {
+        return isValidKid(kid) ? this.store.get(kid) : null;
+    }
+    /** Stamps last_used_at after a successful verification, at most once a minute per key so busy clients write little. */
+    async touch(kid, at) {
+        const last = this.stamped.get(kid);
+        if (last !== undefined && at.getTime() - last < TOUCH_INTERVAL_MS && at.getTime() >= last) {
+            return;
+        }
+        this.stamped.delete(kid);
+        if (this.stamped.size >= this.maxStamped) {
+            this.stamped.delete(this.stamped.keys().next().value);
+        }
+        this.stamped.set(kid, at.getTime());
+        await this.store.touch(kid, at);
+    }
+    async challenge(req, ctx) {
+        const r = req;
+        let identity;
+        if (r.purpose === 'register') {
+            const owner = ownerOf(r.owner);
+            if (owner.type !== 'user') {
+                throw new InvalidArgument('register challenges are issued to users; services and agents register without a proof');
+            }
+            identity = owner;
+        }
+        else if (r.purpose === 'login' && typeof r.kid === 'string') {
+            if (ctx.ip) {
+                const t = await this.throttle.attempt([{ kind: 'ip', value: ctx.ip }], 'login', ctx);
+                if (!t.allowed) {
+                    return { ok: false, retryAfterSeconds: t.retryAfterSeconds };
+                }
+            }
+            identity = loginChallengeIdentity(r.kid);
+        }
+        else {
+            throw new InvalidArgument('a key challenge is { purpose: register, owner } or { purpose: login, kid }');
+        }
+        const { ttlSeconds: ttl, audience } = this.options.challenge;
+        if (audience === null) {
+            throw new InvalidOption('authn.keys.challenge.audience (or authn.keys.assertion.audience) must be set to issue key challenges');
+        }
+        const rid = newChallengeRid();
+        const nonce = await this.secrets.issue(identity, challengeSecretPurpose(rid), ttl);
+        if (!isChallengeNonce(nonce)) {
+            throw new UnexpectedServerError('the SecretStore must issue base64url secrets of at least 128 bits for key challenges');
+        }
+        return { ok: true, challenge: Object.freeze({ id: challengeId(rid, nonce), nonce, expiresAt: new Date(ctx.now.getTime() + ttl * 1000) }) };
+    }
+};
+__decorate([
+    Config('authn.keys'),
+    __metadata("design:type", Object)
+], DefaultKeyRegistry.prototype, "KeysConfig", void 0);
+__decorate([
+    Autoinject(AuthnAudit),
+    __metadata("design:type", AuthnAudit)
+], DefaultKeyRegistry.prototype, "Audit", void 0);
+__decorate([
+    Autoinject(KeyStore),
+    __metadata("design:type", KeyStore)
+], DefaultKeyRegistry.prototype, "Store", void 0);
+__decorate([
+    Autoinject(SecretStore),
+    __metadata("design:type", SecretStore)
+], DefaultKeyRegistry.prototype, "Secrets", void 0);
+__decorate([
+    Autoinject(AuthnThrottle),
+    __metadata("design:type", AuthnThrottle)
+], DefaultKeyRegistry.prototype, "Throttle", void 0);
+DefaultKeyRegistry = __decorate([
+    Injectable(KeyRegistry),
+    __metadata("design:paramtypes", [Object])
+], DefaultKeyRegistry);
+export { DefaultKeyRegistry };
+//# sourceMappingURL=registry.js.map

package/lib/mjs/registry/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/registry/registry.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,uBAAuB,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAElD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEnF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5F,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC/J,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAExF,MAAM,WAAW,GAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AACpE,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,QAAQ,GAAG,GAAG,CAAC;AACrB,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;AAElF,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAE,GAAW,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;AAEpH,SAAS,OAAO,CAAC,CAAU;IACzB,MAAM,CAAC,GAA4B,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAChG,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,cAAc,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAC3F,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,eAAe,CAAC,4EAA4E,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAwB,EAAE,EAAE,EAAE,EAAY,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,6DAA6D;AAC7D,SAAS,cAAc,CAAC,CAAU;IAChC,MAAM,CAAC,GAA4B,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,cAAc,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACrG,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,cAAc,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAC7F,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAc,EAAE,EAAE,EAAE,EAAY,EAAE,CAAC,CAAC;IACtE,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAEnG,iFAAiF;AACjF,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;IAC9B,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,SAAS,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;AAC7c,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAc,EAAE,GAAS,EAAW,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;AAEjJ;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAW,EAAe,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAa1K,mFAAmF;AAE5E,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,WAAW;IAqBjD,YAA+B,IAA6B;QAC1D,KAAK,EAAE,CAAC;QADqB,SAAI,GAAJ,IAAI,CAAyB;QAL3C,YAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;QAErD,wHAAwH;QACrG,eAAU,GAAW,MAAM,CAAC;IAI/C,CAAC;IAED,IAAc,KAAK;QACjB,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;IACxC,CAAC;IAED,IAAc,OAAO;QACnB,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;IAC5C,CAAC;IAED,IAAc,QAAQ;QACpB,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC;IAC9C,CAAC;IAED,IAAc,OAAO;QACnB,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9D,CAAC;IAES,OAAO,CAAC,GAAiB,EAAE,CAAiB;QACpD,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,yIAAyI;IAC/H,KAAK,CAAC,UAAU,CAAC,KAAe,EAAE,GAAgB,EAAE,KAAc;QAC1E,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;QACjD,IAAI,CAAC,MAAM,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACxH,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/G,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAoB,EAAE,GAAiB;QACpD,MAAM,CAAC,GAAG,GAAyC,CAAC;QACpD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,EAAE,IAAmD,EAA8B,EAAE;YACrG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACrG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC7B,CAAC,CAAC;QAEF,MAAM,QAAQ,GAAG,cAAc,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/E,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;QAC9B,MAAM,SAAS,GAAG,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC1H,uEAAuE;QACvE,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACrH,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;YACtE,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7B,CAAC;QAED,IAAI,SAAmC,CAAC;QACxC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACvD,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,eAAe,CAAC,uEAAuE,CAAC,CAAC;YACrG,CAAC;YACD,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;QAED,MAAM,GAAG,GAAG;YACV,GAAG,QAAQ;YACX,GAAG;YACH,KAAK;YACL,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;YACpC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,6FAA6F;YAC7F,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC,KAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,SAAS,EAAE,GAAG,CAAC,GAAG;YAClB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC;QACf,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC;QAClD,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClM,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAkB;QAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAkB,EAAE,GAAW,EAAE,GAAiB,EAAE,IAAwC;QACvG,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACrF,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACnJ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,CAAC;IAED,uHAAuH;IACvH,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,EAAQ;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,IAAI,KAAK,SAAS,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,iBAAiB,IAAI,EAAE,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC;YAC1F,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAwB,EAAE,GAAiB;QACzD,MAAM,CAAC,GAAG,GAAyC,CAAC;QACpD,IAAI,QAAqB,CAAC;QAC1B,IAAI,CAAC,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC1B,MAAM,IAAI,eAAe,CAAC,uFAAuF,CAAC,CAAC;YACrH,CAAC;YACD,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;aAAM,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC9D,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;gBACrF,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;oBACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC;gBAC/D,CAAC;YACH,CAAC;YACD,QAAQ,GAAG,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,eAAe,CAAC,4EAA4E,CAAC,CAAC;QAC1G,CAAC;QACD,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QAC7D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,aAAa,CAAC,sGAAsG,CAAC,CAAC;QAClI,CAAC;QACD,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,sBAAsB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACnF,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,qBAAqB,CAAC,sFAAsF,CAAC,CAAC;QAC1H,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IAC7I,CAAC;CACF,CAAA;AA7KW;IADT,MAAM,CAAC,YAAY,CAAC;;sDACY;AAGvB;IADT,UAAU,CAAC,UAAU,CAAC;8BACN,UAAU;iDAAC;AAGlB;IADT,UAAU,CAAC,QAAQ,CAAC;8BACJ,QAAQ;iDAAC;AAGhB;IADT,UAAU,CAAC,WAAW,CAAC;8BACL,WAAW;mDAAC;AAGrB;IADT,UAAU,CAAC,aAAa,CAAC;8BACN,aAAa;oDAAC;AAdvB,kBAAkB;IAD9B,UAAU,CAAC,WAAW,CAAC;;GACX,kBAAkB,CA+K9B"}

package/lib/mjs/registry/store.d.ts

@@ -0,0 +1,25 @@
+import type { Ceiling, IdentityRef, KeyRecord, PrincipalRef } from '@spinajs/authn/contracts';
+/** authn_key behind DefaultKeyRegistry: MemoryKeyStore, or OrmKeyStore in apps. */
+export declare abstract class KeyStore {
+    /** 'duplicate' when the kid or the thumbprint is taken, also when another insert won a race. */
+    abstract insert(key: KeyRecord): Promise<'inserted' | 'duplicate'>;
+    abstract get(kid: string): Promise<KeyRecord | null>;
+    abstract listByOwner(owner: IdentityRef): Promise<readonly KeyRecord[]>;
+    /** Sets revokedAt unless already set ('already'); 'none' when the key does not exist or belongs to another owner (type and id). */
+    abstract revoke(owner: IdentityRef, kid: string, at: Date): Promise<'revoked' | 'already' | 'none'>;
+    abstract touch(kid: string, at: Date): Promise<void>;
+}
+export declare function encodePrincipalRef(ref: PrincipalRef): string;
+export declare function decodePrincipalRef(text: string): PrincipalRef;
+export declare function encodeCeiling(scope: Ceiling): string;
+export declare function decodeCeiling(text: string): Ceiling;
+/** In-process authn_key, for tests and single-process apps. */
+export declare class MemoryKeyStore extends KeyStore {
+    private readonly rows;
+    insert(key: KeyRecord): Promise<'inserted' | 'duplicate'>;
+    get(kid: string): Promise<KeyRecord | null>;
+    listByOwner(owner: IdentityRef): Promise<readonly KeyRecord[]>;
+    revoke(owner: IdentityRef, kid: string, at: Date): Promise<'revoked' | 'already' | 'none'>;
+    touch(kid: string, at: Date): Promise<void>;
+}
+//# sourceMappingURL=store.d.ts.map

package/lib/mjs/registry/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/registry/store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAG9F,mFAAmF;AACnF,8BAAsB,QAAQ;IAC5B,gGAAgG;IAChG,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,WAAW,CAAC,CAAC;IACnE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACrD,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IACxE,mIAAmI;IACnI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC,CAAC;IACpG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,YAAY,GAAG,MAAM,CAE5D;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAG7D;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGnD;AAID,+DAA+D;AAC/D,qBAAa,cAAe,SAAQ,QAAQ;IAC1C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgC;IAE/C,MAAM,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,WAAW,CAAC,CAM9D;IAEK,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAEhD;IAEK,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAEnE;IAEK,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC,CAU/F;IAEK,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhD;CACF"}

package/lib/mjs/registry/store.js

@@ -0,0 +1,57 @@
+import { principalKey, sameRef } from '@spinajs/authn/contracts';
+/** authn_key behind DefaultKeyRegistry: MemoryKeyStore, or OrmKeyStore in apps. */
+export class KeyStore {
+}
+export function encodePrincipalRef(ref) {
+    return principalKey(ref);
+}
+export function decodePrincipalRef(text) {
+    const at = text.indexOf(':');
+    return { type: decodeURIComponent(text.slice(0, at)), id: text.slice(at + 1) };
+}
+export function encodeCeiling(scope) {
+    return JSON.stringify(scope);
+}
+export function decodeCeiling(text) {
+    const raw = JSON.parse(text);
+    return Object.freeze(raw.expiresAt === undefined ? raw : { ...raw, expiresAt: new Date(raw.expiresAt) });
+}
+const freeze = (k) => Object.freeze({ ...k, owner: Object.freeze({ ...k.owner }), jwk: Object.freeze({ ...k.jwk }) });
+/** In-process authn_key, for tests and single-process apps. */
+export class MemoryKeyStore extends KeyStore {
+    constructor() {
+        super(...arguments);
+        this.rows = new Map();
+    }
+    async insert(key) {
+        if (this.rows.has(key.kid) || [...this.rows.values()].some((r) => r.thumbprint === key.thumbprint)) {
+            return 'duplicate';
+        }
+        this.rows.set(key.kid, freeze(key));
+        return 'inserted';
+    }
+    async get(kid) {
+        return this.rows.get(kid) ?? null;
+    }
+    async listByOwner(owner) {
+        return [...this.rows.values()].filter((r) => sameRef(r.owner, owner));
+    }
+    async revoke(owner, kid, at) {
+        const row = this.rows.get(kid);
+        if (!row || !sameRef(row.owner, owner)) {
+            return 'none';
+        }
+        if (row.revokedAt) {
+            return 'already';
+        }
+        this.rows.set(kid, freeze({ ...row, revokedAt: at }));
+        return 'revoked';
+    }
+    async touch(kid, at) {
+        const row = this.rows.get(kid);
+        if (row) {
+            this.rows.set(kid, freeze({ ...row, lastUsedAt: at }));
+        }
+    }
+}
+//# sourceMappingURL=store.js.map

package/lib/mjs/registry/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/registry/store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAEjE,mFAAmF;AACnF,MAAM,OAAgB,QAAQ;CAQ7B;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAiB;IAClD,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqC,CAAC;IACjE,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;AAC3G,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,CAAY,EAAa,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAc,CAAC;AAEzJ,+DAA+D;AAC/D,MAAM,OAAO,cAAe,SAAQ,QAAQ;IAA5C;;QACmB,SAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IAoCvD,CAAC;IAlCC,KAAK,CAAC,MAAM,CAAC,GAAc;QACzB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACnG,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAkB;QAClC,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAkB,EAAE,GAAW,EAAE,EAAQ;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACtD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,EAAQ;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;CACF"}

package/lib/mjs/schema.d.ts

@@ -0,0 +1,88 @@
+/** The authn.keys fragment of the authn configuration; `assertion.typ` is in the authn schema. */
+export declare const AUTHN_KEYS_CONFIGURATION_SCHEMA: {
+    $id: string;
+    $configurationModule: string;
+    description: string;
+    type: string;
+    properties: {
+        algorithms: {
+            type: string;
+            minItems: number;
+            uniqueItems: boolean;
+            items: {
+                type: string;
+                enum: string[];
+            };
+            default: string[];
+        };
+        challenge: {
+            type: string;
+            default: {};
+            properties: {
+                ttlSeconds: {
+                    type: string;
+                    minimum: number;
+                    maximum: number;
+                    default: number;
+                };
+                audience: {
+                    type: string[];
+                    minLength: number;
+                    default: null;
+                    description: string;
+                };
+            };
+        };
+        assertion: {
+            type: string;
+            default: {};
+            properties: {
+                audience: {
+                    type: string[];
+                    minLength: number;
+                    default: null;
+                    description: string;
+                };
+                maxLifetimeSeconds: {
+                    type: string;
+                    minimum: number;
+                    maximum: number;
+                    default: number;
+                };
+                skewSeconds: {
+                    type: string;
+                    minimum: number;
+                    maximum: number;
+                    default: number;
+                };
+            };
+        };
+        httpSignature: {
+            type: string;
+            default: {};
+            properties: {
+                maxAgeSeconds: {
+                    type: string;
+                    minimum: number;
+                    maximum: number;
+                    default: number;
+                };
+                skewSeconds: {
+                    type: string;
+                    minimum: number;
+                    maximum: number;
+                    default: number;
+                };
+                requiredComponents: {
+                    type: string;
+                    items: {
+                        type: string;
+                        minLength: number;
+                    };
+                    default: string[];
+                };
+            };
+        };
+    };
+};
+//# sourceMappingURL=schema.d.ts.map

package/lib/mjs/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/schema.ts"],"names":[],"mappings":"AAEA,kGAAkG;AAClG,eAAO,MAAM,+BAA+B;;;;;;;YAM1B,IAAI;YAAW,QAAQ;YAAK,WAAW;YAAQ,KAAK;gBAAI,IAAI;gBAAY,IAAI;;YAAwB,OAAO;;;YAEvH,IAAI;YACJ,OAAO;YACP,UAAU;gBACR,UAAU;oBAAI,IAAI;oBAAa,OAAO;oBAAK,OAAO;oBAAQ,OAAO;;gBACjE,QAAQ;oBAAI,IAAI;oBAAsB,SAAS;oBAAK,OAAO;oBAAQ,WAAW;;;;;YAIhF,IAAI;YACJ,OAAO;YACP,UAAU;gBACR,QAAQ;oBAAI,IAAI;oBAAsB,SAAS;oBAAK,OAAO;oBAAQ,WAAW;;gBAC9E,kBAAkB;oBAAI,IAAI;oBAAa,OAAO;oBAAK,OAAO;oBAAO,OAAO;;gBACxE,WAAW;oBAAI,IAAI;oBAAa,OAAO;oBAAK,OAAO;oBAAO,OAAO;;;;;;;;;oBAOhD,IAAI;oBAAa,OAAO;oBAAK,OAAO;oBAAO,OAAO;;;oBACpD,IAAI;oBAAa,OAAO;oBAAK,OAAO;oBAAO,OAAO;;;;;wBAhC5B,IAAI;wBAAY,SAAS;;;;;;;CAqCrE,CAAC"}

package/lib/mjs/schema.js

@@ -0,0 +1,38 @@
+const stringList = { type: 'array', items: { type: 'string', minLength: 1 } };
+/** The authn.keys fragment of the authn configuration; `assertion.typ` is in the authn schema. */
+export const AUTHN_KEYS_CONFIGURATION_SCHEMA = {
+    $id: 'spinajs/authn-keys.configuration.schema.json',
+    $configurationModule: 'authn.keys',
+    description: 'Client key configuration (authn.keys)',
+    type: 'object',
+    properties: {
+        algorithms: { type: 'array', minItems: 1, uniqueItems: true, items: { type: 'string', enum: ['EdDSA', 'ES256'] }, default: ['EdDSA', 'ES256'] },
+        challenge: {
+            type: 'object',
+            default: {},
+            properties: {
+                ttlSeconds: { type: 'integer', minimum: 1, maximum: 3600, default: 120 },
+                audience: { type: ['string', 'null'], minLength: 1, default: null, description: "What clients put in a challenge's signing input; default: assertion.audience. Challenges need one of them." },
+            },
+        },
+        assertion: {
+            type: 'object',
+            default: {},
+            properties: {
+                audience: { type: ['string', 'null'], minLength: 1, default: null, description: 'Required once a strategy that reads assertions is listed.' },
+                maxLifetimeSeconds: { type: 'integer', minimum: 1, maximum: 300, default: 300 },
+                skewSeconds: { type: 'integer', minimum: 0, maximum: 300, default: 30 },
+            },
+        },
+        httpSignature: {
+            type: 'object',
+            default: {},
+            properties: {
+                maxAgeSeconds: { type: 'integer', minimum: 1, maximum: 300, default: 300 },
+                skewSeconds: { type: 'integer', minimum: 0, maximum: 300, default: 30 },
+                requiredComponents: { ...stringList, default: ['@method', '@target-uri', 'content-digest'] },
+            },
+        },
+    },
+};
+//# sourceMappingURL=schema.js.map

package/lib/mjs/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/schema.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;AAE9E,kGAAkG;AAClG,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,GAAG,EAAE,8CAA8C;IACnD,oBAAoB,EAAE,YAAY;IAClC,WAAW,EAAE,uCAAuC;IACpD,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE;QAC/I,SAAS,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,EAAE;YACX,UAAU,EAAE;gBACV,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE;gBACxE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,4GAA4G,EAAE;aAC/L;SACF;QACD,SAAS,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,EAAE;YACX,UAAU,EAAE;gBACV,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,2DAA2D,EAAE;gBAC7I,kBAAkB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;gBAC/E,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE;aACxE;SACF;QACD,aAAa,EAAE;YACb,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,EAAE;YACX,UAAU,EAAE;gBACV,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;gBAC1E,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE;gBACvE,kBAAkB,EAAE,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,gBAAgB,CAAC,EAAE;aAC7F;SACF;KACF;CACF,CAAC"}

package/lib/mjs/strategies/assertion.d.ts

@@ -0,0 +1,29 @@
+import { JwsVerifier } from '@spinajs/authn/contracts';
+import type { AuthnContext, Credentials, StrategyOutcome, ThrottleKey } from '@spinajs/authn/contracts';
+import { KeyNonceStore } from '../nonce/store.js';
+import { KeyStrategy } from './keys.js';
+import type { KeyStrategyDeps } from './keys.js';
+export interface JwsAssertionStrategyDeps extends KeyStrategyDeps {
+    readonly verifier?: JwsVerifier;
+    readonly nonces?: KeyNonceStore;
+}
+/**
+ * Machine clients: `Authorization: Bearer <jws>` signed by a registered key (design §22.10, A17). Header typ
+ * `authn.keys.assertion.typ`; claims iss = the key owner as `<type>:<id>`, aud = `authn.keys.assertion.audience`,
+ * iat, exp (lifetime at most 300 s) and a jti accepted once within its lifetime.
+ */
+export declare class JwsAssertionStrategy extends KeyStrategy<JwsAssertionStrategyDeps> {
+    readonly name = "keys-jws";
+    readonly kinds: string[];
+    readonly interactive = false;
+    protected Verifier: JwsVerifier;
+    protected Nonces: KeyNonceStore;
+    protected get verifier(): JwsVerifier;
+    protected get nonces(): KeyNonceStore;
+    /** The audience the assertions name; which strategies are listed decides that one is required, so this is a boot check, not a schema rule. */
+    protected get audience(): string;
+    resolve(): Promise<void>;
+    throttleKeys(c: Credentials, ctx: AuthnContext): readonly ThrottleKey[];
+    verify(c: Credentials, ctx: AuthnContext): Promise<StrategyOutcome>;
+}
+//# sourceMappingURL=assertion.d.ts.map

package/lib/mjs/strategies/assertion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertion.d.ts","sourceRoot":"","sources":["../../../src/strategies/assertion.ts"],"names":[],"mappings":"AACA,OAAO,EAA0B,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,KAAK,EAAE,YAAY,EAAgB,WAAW,EAAsC,eAAe,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAM1J,OAAO,EAAE,aAAa,EAAY,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAA+E,MAAM,WAAW,CAAC;AACrH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAkBjD,MAAM,WAAW,wBAAyB,SAAQ,eAAe;IAC/D,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;CACjC;AAED;;;;GAIG;AACH,qBACa,oBAAqB,SAAQ,WAAW,CAAC,wBAAwB,CAAC;IAC7E,QAAQ,CAAC,IAAI,cAAc;IAC3B,QAAQ,CAAC,KAAK,WAAqB;IACnC,QAAQ,CAAC,WAAW,SAAS;IAG7B,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC;IAGhC,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC;IAEhC,SAAS,KAAK,QAAQ,IAAI,WAAW,CAEpC;IAED,SAAS,KAAK,MAAM,IAAI,aAAa,CAEpC;IAED,8IAA8I;IAC9I,SAAS,KAAK,QAAQ,IAAI,MAAM,CAM/B;IAEY,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAGpC;IAED,YAAY,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,GAAG,SAAS,WAAW,EAAE,CAEtE;IAEK,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,CAwCxE;CACF"}

package/lib/mjs/strategies/assertion.js

@@ -0,0 +1,115 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Autoinject, Injectable } from '@spinajs/di';
+import { AuthenticationStrategy, JwsVerifier } from '@spinajs/authn/contracts';
+import { _is_string, _max_length, _try_check_arg, isPlainObject } from '@spinajs/util';
+import { InvalidOption } from '@spinajs/exceptions';
+import { decodeB64url } from '../jwk/base64url.js';
+import { KEY_ALGORITHMS } from '../jwk/keys.js';
+import { parseStrictJson } from '../jws/json.js';
+import { KeyNonceStore, nonceKey } from '../nonce/store.js';
+import { KeyStrategy, MAX_CREDENTIAL_LENGTH, assertionIssuer, failure, keyThrottleKeys, usableKey } from './keys.js';
+const MAX_JTI = 128;
+const assertionClaims = (p) => (typeof p.jti === 'string' && p.jti.length > 0 && p.jti.length <= MAX_JTI ? p : null);
+function headerOf(jws) {
+    const text = typeof jws === 'string' && jws.length <= MAX_CREDENTIAL_LENGTH ? jws.slice(0, jws.indexOf('.')) : '';
+    const bytes = decodeB64url(text);
+    const h = bytes ? parseStrictJson(bytes) : undefined;
+    const alg = isPlainObject(h) && KEY_ALGORITHMS.includes(h.alg) ? h.alg : 'EdDSA';
+    return { kid: isPlainObject(h) && typeof h.kid === 'string' ? h.kid : null, alg };
+}
+/**
+ * Machine clients: `Authorization: Bearer <jws>` signed by a registered key (design §22.10, A17). Header typ
+ * `authn.keys.assertion.typ`; claims iss = the key owner as `<type>:<id>`, aud = `authn.keys.assertion.audience`,
+ * iat, exp (lifetime at most 300 s) and a jti accepted once within its lifetime.
+ */
+let JwsAssertionStrategy = class JwsAssertionStrategy extends KeyStrategy {
+    constructor() {
+        super(...arguments);
+        this.name = 'keys-jws';
+        this.kinds = ['jws-assertion'];
+        this.interactive = false;
+    }
+    get verifier() {
+        return this.Deps?.verifier ?? this.Verifier;
+    }
+    get nonces() {
+        return this.Deps?.nonces ?? this.Nonces;
+    }
+    /** The audience the assertions name; which strategies are listed decides that one is required, so this is a boot check, not a schema rule. */
+    get audience() {
+        const audience = this.options.assertion.audience;
+        if (audience === null) {
+            throw new InvalidOption('authn.keys.assertion.audience must be set to accept JWS assertions');
+        }
+        return audience;
+    }
+    async resolve() {
+        void this.audience;
+        await super.resolve();
+    }
+    throttleKeys(c, ctx) {
+        return keyThrottleKeys(c.kind === 'jws-assertion' ? headerOf(c.jws).kid : null, ctx);
+    }
+    async verify(c, ctx) {
+        if (c.kind !== 'jws-assertion') {
+            return failure('unsupported_credentials');
+        }
+        const [ok, jws] = _try_check_arg(_is_string(_max_length(MAX_CREDENTIAL_LENGTH)))(c.jws, 'jws');
+        if (!ok) {
+            return failure('invalid_credentials');
+        }
+        const a = this.options.assertion;
+        let unusable = 'invalid_credentials';
+        const r = await this.verifier.verify(jws, {
+            typ: a.typ,
+            algorithms: this.options.algorithms,
+            keys: async (kid) => {
+                const found = await usableKey(this.registry, kid, ctx);
+                if (!found.key) {
+                    unusable = found.reason;
+                    return null;
+                }
+                return found.key;
+            },
+            claims: assertionClaims,
+            issuer: (iss, key) => iss === assertionIssuer(key.owner),
+            audience: this.audience,
+            now: ctx.now,
+            skewSeconds: a.skewSeconds,
+            maxLifetimeSeconds: a.maxLifetimeSeconds,
+        });
+        if (!r.ok) {
+            if (r.code === 'unknown_key') {
+                const [h, p, s] = jws.split('.');
+                this.unknownKeyWork(headerOf(jws).alg, Buffer.from(`${h}.${p}`, 'ascii'), decodeB64url(s) ?? Buffer.alloc(0));
+                return failure(unusable);
+            }
+            return failure('invalid_credentials');
+        }
+        if (!(await this.nonces.claim(nonceKey('jti', r.key.kid, r.claims.jti), new Date((r.claims.exp + a.skewSeconds) * 1000), ctx.now))) {
+            return failure('invalid_credentials');
+        }
+        return this.success(r.key, 'jws', ctx);
+    }
+};
+__decorate([
+    Autoinject(JwsVerifier),
+    __metadata("design:type", JwsVerifier)
+], JwsAssertionStrategy.prototype, "Verifier", void 0);
+__decorate([
+    Autoinject(KeyNonceStore),
+    __metadata("design:type", KeyNonceStore)
+], JwsAssertionStrategy.prototype, "Nonces", void 0);
+JwsAssertionStrategy = __decorate([
+    Injectable(AuthenticationStrategy)
+], JwsAssertionStrategy);
+export { JwsAssertionStrategy };
+//# sourceMappingURL=assertion.js.map