@spinajs/authn-keys 0.0.0-stage → 3.0.1

package/lib/cjs/strategies/keys.js

@@ -0,0 +1,93 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeyStrategy = exports.failure = exports.assertionIssuer = exports.MAX_CREDENTIAL_LENGTH = void 0;
+exports.keyThrottleKeys = keyThrottleKeys;
+exports.usableKey = usableKey;
+const di_1 = require("@spinajs/di");
+const configuration_1 = require("@spinajs/configuration");
+const log_1 = require("@spinajs/log");
+require("../register-schema.js");
+const contracts_1 = require("@spinajs/authn/contracts");
+const keys_js_1 = require("../jwk/keys.js");
+const signature_js_1 = require("../jwk/signature.js");
+const options_js_1 = require("../options/options.js");
+const registry_js_1 = require("../registry/registry.js");
+/** Credentials longer than this are refused before any parsing (a header is parsed before its signature is checked). */
+exports.MAX_CREDENTIAL_LENGTH = 8192;
+/** An assertion's `iss`: the key owner as `<type>:<id>` (lane notes D8), e.g. `user:<uuid>` or `service:runner-1`. */
+const assertionIssuer = (owner) => `${owner.type}:${owner.id}`;
+exports.assertionIssuer = assertionIssuer;
+/** Credentials name a kid before anything is verified; one that cannot be read throttles under one shared key. */
+function keyThrottleKeys(kid, ctx) {
+    const id = kid !== null && (0, keys_js_1.isValidKid)(kid) ? `key:${kid}` : 'key:?';
+    return [
+        { kind: 'account', value: id },
+        { kind: 'account-ip', value: `${id}|${ctx.ip ?? ''}` },
+    ];
+}
+/** byId for verifiers: only a key that is neither revoked nor expired at ctx.now is usable; the reason goes to audit. */
+async function usableKey(registry, kid, ctx) {
+    const key = (0, keys_js_1.isValidKid)(kid) ? await registry.byId(kid) : null;
+    if (!key) {
+        return { key: null, reason: 'invalid_credentials' };
+    }
+    if (!(0, registry_js_1.isUsableKey)(key, ctx.now)) {
+        return { key: null, reason: key.revokedAt ? 'revoked' : 'expired', alg: key.alg };
+    }
+    return { key };
+}
+const failure = (reason) => ({ ok: false, reason });
+exports.failure = failure;
+/** What the key strategies share: the registry, `authn.keys`, the cost of an unusable key and the success outcome. */
+class KeyStrategy extends contracts_1.AuthenticationStrategy {
+    constructor(Deps) {
+        super();
+        this.Deps = Deps;
+    }
+    get registry() {
+        return this.Deps?.registry ?? this.Registry;
+    }
+    get options() {
+        return (0, options_js_1.keysOptionsOf)(this.Deps?.options ?? this.KeysConfig);
+    }
+    /** The signature work an unknown, revoked or expired key costs, so it answers in the time a known key does (A02). */
+    unknownKeyWork(alg, data, signature) {
+        (0, signature_js_1.dummyVerify)(alg, data, signature);
+    }
+    /** Stamps the key's last use when the registry can; a failed stamp costs the stamp, never the login. */
+    async success(key, method, ctx) {
+        const registry = this.registry;
+        if (registry.touch) {
+            try {
+                await registry.touch(key.kid, ctx.now);
+            }
+            catch (err) {
+                this.Log.error({ error: err, kid: key.kid }, 'Could not stamp the last use of key ${kid}');
+            }
+        }
+        return { ok: true, identity: { type: key.owner.type, id: key.owner.id }, method, ...(key.scope ? { ceiling: key.scope } : {}) };
+    }
+}
+exports.KeyStrategy = KeyStrategy;
+__decorate([
+    (0, configuration_1.Config)('authn.keys'),
+    __metadata("design:type", Object)
+], KeyStrategy.prototype, "KeysConfig", void 0);
+__decorate([
+    (0, di_1.Autoinject)(contracts_1.KeyRegistry),
+    __metadata("design:type", contracts_1.KeyRegistry)
+], KeyStrategy.prototype, "Registry", void 0);
+__decorate([
+    (0, log_1.Logger)('authn-keys'),
+    __metadata("design:type", log_1.Log)
+], KeyStrategy.prototype, "Log", void 0);
+//# sourceMappingURL=keys.js.map

package/lib/cjs/strategies/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../src/strategies/keys.ts"],"names":[],"mappings":";;;;;;;;;;;;;;AAAA,oCAAyC;AACzC,0DAAgD;AAChD,sCAA2C;AAC3C,iCAA+B;AAC/B,wDAA+E;AAE/E,4CAA4C;AAC5C,sDAAkD;AAClD,sDAAsD;AAEtD,yDAAsD;AAEtD,wHAAwH;AAC3G,QAAA,qBAAqB,GAAG,IAAI,CAAC;AAE1C,sHAAsH;AAC/G,MAAM,eAAe,GAAG,CAAC,KAA6B,EAAU,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;AAAzF,QAAA,eAAe,GAAf,eAAe,CAA0E;AAEtG,kHAAkH;AAClH,yBAAgC,GAAkB,EAAE,GAAiB;IACnE,MAAM,EAAE,GAAG,GAAG,KAAK,IAAI,IAAI,IAAA,oBAAU,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACpE,OAAO;QACL,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE;QAC9B,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;KACvD,CAAC;AACJ,CAAC;AAKD,yHAAyH;AAClH,KAAK,oBAAoB,QAAqB,EAAE,GAAW,EAAE,GAAiB;IACnF,MAAM,GAAG,GAAG,IAAA,oBAAU,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,IAAA,yBAAW,EAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,CAAC;AACjB,CAAC;AAEM,MAAM,OAAO,GAAG,CAAC,MAAoB,EAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AAA7E,QAAA,OAAO,GAAP,OAAO,CAAsE;AAS1F,sHAAsH;AACtH,iBAA+E,SAAQ,kCAAsB;IAU3G,YAA+B,IAAQ;QACrC,KAAK,EAAE,CAAC;oBADqB,IAAI;IAEnC,CAAC;IAED,IAAc,QAAQ;QACpB,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC;IAC9C,CAAC;IAED,IAAc,OAAO;QACnB,OAAO,IAAA,0BAAa,EAAC,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9D,CAAC;IAED,qHAAqH;IAC3G,cAAc,CAAC,GAAiB,EAAE,IAAgB,EAAE,SAAqB;QACjF,IAAA,0BAAW,EAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACpC,CAAC;IAED,wGAAwG;IAC9F,KAAK,CAAC,OAAO,CAAC,GAAc,EAAE,MAAc,EAAE,GAAiB;QACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,4CAA4C,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAClI,CAAC;CACF;;AArCW;IADT,IAAA,sBAAM,EAAC,YAAY,CAAC;;+CACY;AAGvB;IADT,IAAA,eAAU,EAAC,uBAAW,CAAC;8BACJ,uBAAW;6CAAC;AAGtB;IADT,IAAA,YAAM,EAAC,YAAY,CAAC;8BACN,SAAG;wCAAC"}

package/lib/mjs/bootstrap.d.ts

@@ -0,0 +1,6 @@
+import { Bootstrapper } from '@spinajs/di';
+/** Registers the authn.keys schema, so the configuration validates that subtree and fills its defaults. */
+export declare class AuthnKeysConfigBootstrapper extends Bootstrapper {
+    bootstrap(): void;
+}
+//# sourceMappingURL=bootstrap.d.ts.map

package/lib/mjs/bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../src/bootstrap.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAc,MAAM,aAAa,CAAC;AAIvD,2GAA2G;AAC3G,qBACa,2BAA4B,SAAQ,YAAY;IACpD,SAAS,IAAI,IAAI,CAEvB;CACF"}

package/lib/mjs/bootstrap.js

@@ -0,0 +1,20 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { registerConfigurationSchema } from '@spinajs/configuration';
+import { Bootstrapper, Injectable } from '@spinajs/di';
+import { AUTHN_KEYS_CONFIGURATION_SCHEMA } from './schema.js';
+/** Registers the authn.keys schema, so the configuration validates that subtree and fills its defaults. */
+let AuthnKeysConfigBootstrapper = class AuthnKeysConfigBootstrapper extends Bootstrapper {
+    bootstrap() {
+        registerConfigurationSchema(AUTHN_KEYS_CONFIGURATION_SCHEMA);
+    }
+};
+AuthnKeysConfigBootstrapper = __decorate([
+    Injectable(Bootstrapper)
+], AuthnKeysConfigBootstrapper);
+export { AuthnKeysConfigBootstrapper };
+//# sourceMappingURL=bootstrap.js.map

package/lib/mjs/bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/bootstrap.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EAAE,+BAA+B,EAAE,MAAM,aAAa,CAAC;AAE9D,2GAA2G;AAEpG,IAAM,2BAA2B,GAAjC,MAAM,2BAA4B,SAAQ,YAAY;IACpD,SAAS;QACd,2BAA2B,CAAC,+BAA+B,CAAC,CAAC;IAC/D,CAAC;CACF,CAAA;AAJY,2BAA2B;IADvC,UAAU,CAAC,YAAY,CAAC;GACZ,2BAA2B,CAIvC"}

package/lib/mjs/challenge/challenge.d.ts

@@ -0,0 +1,27 @@
+import type { KeyObject } from 'node:crypto';
+import type { KeyAlgorithm, KeyChallenge, KeyMaterial } from '@spinajs/authn/contracts';
+export type ChallengePurpose = 'register' | 'login';
+/** The SecretStore purpose of one challenge; `rid` keeps it within authn_secret.purpose (varchar 32). */
+export declare const challengeSecretPurpose: (rid: string) => string;
+export declare const newChallengeRid: () => string;
+/**
+ * `<rid>.<nonce>`. SecretStore keeps only a hash of the nonce and redeems by the raw value, and the credentials carry
+ * only the challenge id and a signature, so the id has to bring the nonce back.
+ */
+export declare const challengeId: (rid: string, nonce: string) => string;
+export declare function parseChallengeId(id: unknown): {
+    rid: string;
+    nonce: string;
+} | null;
+/** Nonces are base64url, so the first ':' after one ends it and the signing input has exactly one reading. */
+export declare const isChallengeNonce: (nonce: unknown) => nonce is string;
+/**
+ * The bytes a key signs to answer a challenge: UTF-8 of `spinajs-key-<purpose>:<nonce>:<audience>`. The purpose keeps
+ * a login signature from proving a registration; the audience is the service as the client knows it (never taken from
+ * the challenge answer), so a service that relays another one's challenge gets a signature the other one refuses.
+ */
+export declare function challengeSigningInput(challenge: Pick<KeyChallenge, 'nonce'>, purpose: ChallengePurpose, audience: string): Buffer;
+/** The answer a client sends: the raw signature (64 bytes; ES256 as IEEE P1363) as unpadded base64url. */
+export declare function signChallenge(challenge: Pick<KeyChallenge, 'nonce'>, purpose: ChallengePurpose, audience: string, privateKey: KeyObject, alg: KeyAlgorithm): string;
+export declare function verifyChallengeSignature(key: KeyMaterial, nonce: string, purpose: ChallengePurpose, audience: string, signature: unknown): boolean;
+//# sourceMappingURL=challenge.d.ts.map

package/lib/mjs/challenge/challenge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge.d.ts","sourceRoot":"","sources":["../../../src/challenge/challenge.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAKxF,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,OAAO,CAAC;AAEpD,yGAAyG;AACzG,eAAO,MAAM,sBAAsB,QAAS,MAAM,KAAG,MAAgC,CAAC;AAQtF,eAAO,MAAM,eAAe,QAAO,MAAsD,CAAC;AAE1F;;;GAGG;AACH,eAAO,MAAM,WAAW,QAAS,MAAM,SAAS,MAAM,KAAG,MAA2B,CAAC;AAErF,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,OAAO,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQnF;AAED,8GAA8G;AAC9G,eAAO,MAAM,gBAAgB,UAAW,OAAO,KAAG,KAAK,IAAI,MAAwD,CAAC;AAEpH;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEjI;AAED,0GAA0G;AAC1G,wBAAgB,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,MAAM,CAEnK;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAGlJ"}

package/lib/mjs/challenge/challenge.js

@@ -0,0 +1,45 @@
+import { randomBytes } from 'node:crypto';
+import { _between, _custom, _is_string, _try_check_arg } from '@spinajs/util';
+import { decodeB64url, encodeB64url } from '../jwk/base64url.js';
+import { signRaw, verifySignature } from '../jwk/signature.js';
+/** The SecretStore purpose of one challenge; `rid` keeps it within authn_secret.purpose (varchar 32). */
+export const challengeSecretPurpose = (rid) => `key-challenge:${rid}`;
+const RID_BYTES = 12;
+const RID_LENGTH = 16;
+const RID = /^[A-Za-z0-9_-]{16}$/;
+const MAX_NONCE_LENGTH = 512;
+const NONCE = /^[A-Za-z0-9_-]{22,512}$/;
+export const newChallengeRid = () => randomBytes(RID_BYTES).toString('base64url');
+/**
+ * `<rid>.<nonce>`. SecretStore keeps only a hash of the nonce and redeems by the raw value, and the credentials carry
+ * only the challenge id and a signature, so the id has to bring the nonce back.
+ */
+export const challengeId = (rid, nonce) => `${rid}.${nonce}`;
+export function parseChallengeId(id) {
+    const [ok, text] = _try_check_arg(_is_string(_between(RID_LENGTH + 2, RID_LENGTH + 1 + MAX_NONCE_LENGTH), _custom((s) => s[RID_LENGTH] === '.')))(id, 'id');
+    if (!ok) {
+        return null;
+    }
+    const rid = text.slice(0, RID_LENGTH);
+    const nonce = text.slice(RID_LENGTH + 1);
+    return RID.test(rid) && isChallengeNonce(nonce) ? { rid, nonce } : null;
+}
+/** Nonces are base64url, so the first ':' after one ends it and the signing input has exactly one reading. */
+export const isChallengeNonce = (nonce) => typeof nonce === 'string' && NONCE.test(nonce);
+/**
+ * The bytes a key signs to answer a challenge: UTF-8 of `spinajs-key-<purpose>:<nonce>:<audience>`. The purpose keeps
+ * a login signature from proving a registration; the audience is the service as the client knows it (never taken from
+ * the challenge answer), so a service that relays another one's challenge gets a signature the other one refuses.
+ */
+export function challengeSigningInput(challenge, purpose, audience) {
+    return Buffer.from(`spinajs-key-${purpose}:${challenge.nonce}:${audience}`, 'utf8');
+}
+/** The answer a client sends: the raw signature (64 bytes; ES256 as IEEE P1363) as unpadded base64url. */
+export function signChallenge(challenge, purpose, audience, privateKey, alg) {
+    return encodeB64url(signRaw(alg, privateKey, challengeSigningInput(challenge, purpose, audience)));
+}
+export function verifyChallengeSignature(key, nonce, purpose, audience, signature) {
+    const raw = decodeB64url(signature);
+    return raw !== null && isChallengeNonce(nonce) && verifySignature(key, challengeSigningInput({ nonce }, purpose, audience), raw);
+}
+//# sourceMappingURL=challenge.js.map

package/lib/mjs/challenge/challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge.js","sourceRoot":"","sources":["../../../src/challenge/challenge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAI/D,yGAAyG;AACzG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,iBAAiB,GAAG,EAAE,CAAC;AAEtF,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,GAAG,GAAG,qBAAqB,CAAC;AAClC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,KAAK,GAAG,yBAAyB,CAAC;AAExC,MAAM,CAAC,MAAM,eAAe,GAAG,GAAW,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAE1F;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAW,EAAE,KAAa,EAAU,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC;AAErF,MAAM,UAAU,gBAAgB,CAAC,EAAW;IAC1C,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,cAAc,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,GAAG,CAAC,EAAE,UAAU,GAAG,CAAC,GAAG,gBAAgB,CAAC,EAAE,OAAO,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACpK,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAI,IAAe,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAClD,MAAM,KAAK,GAAI,IAAe,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IACrD,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED,8GAA8G;AAC9G,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAEpH;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAsC,EAAE,OAAyB,EAAE,QAAgB;IACvH,OAAO,MAAM,CAAC,IAAI,CAAC,eAAe,OAAO,IAAI,SAAS,CAAC,KAAK,IAAI,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;AACtF,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,aAAa,CAAC,SAAsC,EAAE,OAAyB,EAAE,QAAgB,EAAE,UAAqB,EAAE,GAAiB;IACzJ,OAAO,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,qBAAqB,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,GAAgB,EAAE,KAAa,EAAE,OAAyB,EAAE,QAAgB,EAAE,SAAkB;IACvI,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACpC,OAAO,GAAG,KAAK,IAAI,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,GAAG,EAAE,qBAAqB,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;AACnI,CAAC"}

package/lib/mjs/challenge/index.d.ts

@@ -0,0 +1,2 @@
+export * from './challenge.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/challenge/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/challenge/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC"}

package/lib/mjs/challenge/index.js

@@ -0,0 +1,2 @@
+export * from './challenge.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/challenge/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/challenge/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC"}

package/lib/mjs/cli/AddKey.d.ts

@@ -0,0 +1,18 @@
+import { CliCommand } from '@spinajs/cli';
+import { Log } from '@spinajs/log';
+import { KeyRegistry } from '@spinajs/authn/contracts';
+interface AddKeyOptions {
+    jwk?: string;
+    file?: string;
+    kid?: string;
+    name?: string;
+    expires?: string;
+}
+/** Services and agents only: a user registers a key with a proof of possession, which the CLI cannot give. */
+export declare class AddKey extends CliCommand {
+    protected Log: Log;
+    protected Registry: KeyRegistry;
+    execute(ownerType: string, ownerId: string, options: AddKeyOptions): Promise<void>;
+}
+export {};
+//# sourceMappingURL=AddKey.d.ts.map

package/lib/mjs/cli/AddKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AddKey.d.ts","sourceRoot":"","sources":["../../../src/cli/AddKey.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,UAAU,EAAmB,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,WAAW,EAAc,MAAM,0BAA0B,CAAC;AAK9E,UAAU,aAAa;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,8GAA8G;AAC9G,qBAQa,MAAO,SAAQ,UAAU;IAEpC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC;IAEnB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB9F;CACF"}

package/lib/mjs/cli/AddKey.js

@@ -0,0 +1,62 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Autoinject } from '@spinajs/di';
+import { Argument, CliCommand, Command, Option } from '@spinajs/cli';
+import { Log, Logger } from '@spinajs/log';
+import { CLI_ACTOR, KeyRegistry, cliContext } from '@spinajs/authn/contracts';
+import { InvalidArgument } from '@spinajs/exceptions';
+import { ownerArg, readPublicJwk } from './common.js';
+/** Services and agents only: a user registers a key with a proof of possession, which the CLI cannot give. */
+let AddKey = class AddKey extends CliCommand {
+    async execute(ownerType, ownerId, options) {
+        const owner = ownerArg(ownerType, ownerId);
+        if (owner.type === 'user') {
+            throw new InvalidArgument('a user registers a key with a proof of possession, through POST /user/keys');
+        }
+        const expiresAt = options.expires === undefined ? undefined : new Date(options.expires);
+        // Without a zone, Date reads the time as local, which differs per host.
+        if (expiresAt !== undefined && (Number.isNaN(expiresAt.getTime()) || !/T.*(Z|[+-]\d{2}:?\d{2})$/i.test(options.expires))) {
+            throw new InvalidArgument(`--expires is not an ISO 8601 instant with Z or an offset: ${options.expires}`);
+        }
+        const reg = {
+            owner,
+            actor: CLI_ACTOR,
+            jwk: readPublicJwk(options),
+            ...(options.kid !== undefined ? { kid: options.kid } : {}),
+            ...(options.name !== undefined ? { name: options.name } : {}),
+            ...(expiresAt ? { expiresAt } : {}),
+        };
+        const r = await this.Registry.register(reg, cliContext());
+        if (!r.ok) {
+            throw new InvalidArgument(`key not registered: ${r.code}`);
+        }
+        this.Log.success({ kid: r.key.kid, alg: r.key.alg, thumbprint: r.key.thumbprint }, 'Key registered: kid ${kid}, ${alg}, thumbprint ${thumbprint}');
+    }
+};
+__decorate([
+    Logger('authn-keys'),
+    __metadata("design:type", Log)
+], AddKey.prototype, "Log", void 0);
+__decorate([
+    Autoinject(KeyRegistry),
+    __metadata("design:type", KeyRegistry)
+], AddKey.prototype, "Registry", void 0);
+AddKey = __decorate([
+    Command('authn:key-add', 'Registers an Ed25519 or P-256 public key for a service or an agent'),
+    Argument({ name: 'ownerType', required: true, description: 'service or agent', choices: ['service', 'agent'] }),
+    Argument('ownerId', true, 'id of the service or agent'),
+    Option('--jwk <json>', false, 'the public JWK as JSON'),
+    Option('--file <path>', false, 'a file with the public JWK (JSON) or a PEM public key'),
+    Option('--kid <kid>', false, 'key id, 1-64 of [A-Za-z0-9._-]; default: the RFC 7638 thumbprint'),
+    Option('--name <name>', false, 'label, up to 128 characters'),
+    Option('--expires <iso>', false, 'ISO 8601 expiry instant with Z or an offset')
+], AddKey);
+export { AddKey };
+//# sourceMappingURL=AddKey.js.map

package/lib/mjs/cli/AddKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AddKey.js","sourceRoot":"","sources":["../../../src/cli/AddKey.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE9E,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAUtD,8GAA8G;AASvG,IAAM,MAAM,GAAZ,MAAM,MAAO,SAAQ,UAAU;IAO7B,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,OAAe,EAAE,OAAsB;QAC7E,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,eAAe,CAAC,4EAA4E,CAAC,CAAC;QAC1G,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxF,wEAAwE;QACxE,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,OAAQ,CAAC,CAAC,EAAE,CAAC;YAC1H,MAAM,IAAI,eAAe,CAAC,6DAA6D,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,MAAM,GAAG,GAAG;YACV,KAAK;YACL,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,aAAa,CAAC,OAAO,CAAC;YAC3B,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjB,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,IAAI,eAAe,CAAC,uBAAuB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,8DAA8D,CAAC,CAAC;IACrJ,CAAC;CACF,CAAA;AA7BW;IADT,MAAM,CAAC,YAAY,CAAC;8BACN,GAAG;mCAAC;AAGT;IADT,UAAU,CAAC,WAAW,CAAC;8BACJ,WAAW;wCAAC;AALrB,MAAM;IARlB,OAAO,CAAC,eAAe,EAAE,oEAAoE,CAAC;IAC9F,QAAQ,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;IAC/G,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,4BAA4B,CAAC;IACvD,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,wBAAwB,CAAC;IACvD,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,uDAAuD,CAAC;IACvF,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,kEAAkE,CAAC;IAChG,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,6BAA6B,CAAC;IAC7D,MAAM,CAAC,iBAAiB,EAAE,KAAK,EAAE,6CAA6C,CAAC;GACnE,MAAM,CA+BlB"}

package/lib/mjs/cli/ListKeys.d.ts

@@ -0,0 +1,11 @@
+import { CliCommand } from '@spinajs/cli';
+import { Log } from '@spinajs/log';
+import { KeyRegistry } from '@spinajs/authn/contracts';
+import type { KeyRecord } from '@spinajs/authn/contracts';
+export declare function keyLine(k: KeyRecord): string;
+export declare class ListKeys extends CliCommand {
+    protected Log: Log;
+    protected Registry: KeyRegistry;
+    execute(ownerType: string, ownerId: string): Promise<void>;
+}
+//# sourceMappingURL=ListKeys.d.ts.map

package/lib/mjs/cli/ListKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ListKeys.d.ts","sourceRoot":"","sources":["../../../src/cli/ListKeys.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,UAAU,EAAW,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAK1D,wBAAgB,OAAO,CAAC,CAAC,EAAE,SAAS,GAAG,MAAM,CAE5C;AAED,qBAGa,QAAS,SAAQ,UAAU;IAEtC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC;IAEnB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQtE;CACF"}

package/lib/mjs/cli/ListKeys.js

@@ -0,0 +1,44 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Autoinject } from '@spinajs/di';
+import { Argument, CliCommand, Command } from '@spinajs/cli';
+import { Log, Logger } from '@spinajs/log';
+import { KeyRegistry } from '@spinajs/authn/contracts';
+import { OWNER_TYPES, ownerArg } from './common.js';
+const iso = (d) => (d ? d.toISOString() : '-');
+export function keyLine(k) {
+    return [k.kid, k.alg, k.name ?? '-', `created ${iso(k.createdAt)}`, `expires ${iso(k.expiresAt)}`, `revoked ${iso(k.revokedAt)}`, `last used ${iso(k.lastUsedAt)}`].join('  ');
+}
+let ListKeys = class ListKeys extends CliCommand {
+    async execute(ownerType, ownerId) {
+        const keys = await this.Registry.list(ownerArg(ownerType, ownerId));
+        if (keys.length === 0) {
+            this.Log.info('No keys');
+        }
+        for (const k of keys) {
+            this.Log.info(keyLine(k));
+        }
+    }
+};
+__decorate([
+    Logger('authn-keys'),
+    __metadata("design:type", Log)
+], ListKeys.prototype, "Log", void 0);
+__decorate([
+    Autoinject(KeyRegistry),
+    __metadata("design:type", KeyRegistry)
+], ListKeys.prototype, "Registry", void 0);
+ListKeys = __decorate([
+    Command('authn:key-list', 'Lists the public keys of a user, a service or an agent, revoked and expired ones included'),
+    Argument({ name: 'ownerType', required: true, description: OWNER_TYPES.join(', '), choices: OWNER_TYPES }),
+    Argument('ownerId', true, 'id of the owner (users.Uuid for users)')
+], ListKeys);
+export { ListKeys };
+//# sourceMappingURL=ListKeys.js.map

package/lib/mjs/cli/ListKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ListKeys.js","sourceRoot":"","sources":["../../../src/cli/ListKeys.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,GAAG,GAAG,CAAC,CAAQ,EAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAE9D,MAAM,UAAU,OAAO,CAAC,CAAY;IAClC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,IAAI,GAAG,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,aAAa,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjL,CAAC;AAKM,IAAM,QAAQ,GAAd,MAAM,QAAS,SAAQ,UAAU;IAO/B,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,OAAe;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;CACF,CAAA;AAdW;IADT,MAAM,CAAC,YAAY,CAAC;8BACN,GAAG;qCAAC;AAGT;IADT,UAAU,CAAC,WAAW,CAAC;8BACJ,WAAW;0CAAC;AALrB,QAAQ;IAHpB,OAAO,CAAC,gBAAgB,EAAE,2FAA2F,CAAC;IACtH,QAAQ,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC1G,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,wCAAwC,CAAC;GACvD,QAAQ,CAgBpB"}

package/lib/mjs/cli/RevokeKey.d.ts

@@ -0,0 +1,9 @@
+import { CliCommand } from '@spinajs/cli';
+import { Log } from '@spinajs/log';
+import { KeyRegistry } from '@spinajs/authn/contracts';
+export declare class RevokeKey extends CliCommand {
+    protected Log: Log;
+    protected Registry: KeyRegistry;
+    execute(ownerType: string, ownerId: string, kid: string): Promise<void>;
+}
+//# sourceMappingURL=RevokeKey.d.ts.map

package/lib/mjs/cli/RevokeKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RevokeKey.d.ts","sourceRoot":"","sources":["../../../src/cli/RevokeKey.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,UAAU,EAAW,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,WAAW,EAAc,MAAM,0BAA0B,CAAC;AAI9E,qBAIa,SAAU,SAAQ,UAAU;IAEvC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC;IAEnB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKnF;CACF"}

package/lib/mjs/cli/RevokeKey.js

@@ -0,0 +1,39 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Autoinject } from '@spinajs/di';
+import { Argument, CliCommand, Command } from '@spinajs/cli';
+import { Log, Logger } from '@spinajs/log';
+import { CLI_ACTOR, KeyRegistry, cliContext } from '@spinajs/authn/contracts';
+import { InvalidArgument } from '@spinajs/exceptions';
+import { OWNER_TYPES, ownerArg } from './common.js';
+let RevokeKey = class RevokeKey extends CliCommand {
+    async execute(ownerType, ownerId, kid) {
+        if (!(await this.Registry.revoke(ownerArg(ownerType, ownerId), kid, cliContext(), { actor: CLI_ACTOR }))) {
+            throw new InvalidArgument(`no key ${kid} of ${ownerType} ${ownerId}`);
+        }
+        this.Log.success({ kid }, 'Key ${kid} revoked');
+    }
+};
+__decorate([
+    Logger('authn-keys'),
+    __metadata("design:type", Log)
+], RevokeKey.prototype, "Log", void 0);
+__decorate([
+    Autoinject(KeyRegistry),
+    __metadata("design:type", KeyRegistry)
+], RevokeKey.prototype, "Registry", void 0);
+RevokeKey = __decorate([
+    Command('authn:key-revoke', 'Revokes a public key; it fails on the next request'),
+    Argument({ name: 'ownerType', required: true, description: OWNER_TYPES.join(', '), choices: OWNER_TYPES }),
+    Argument('ownerId', true, 'id of the owner (users.Uuid for users)'),
+    Argument('kid', true, 'key id')
+], RevokeKey);
+export { RevokeKey };
+//# sourceMappingURL=RevokeKey.js.map

package/lib/mjs/cli/RevokeKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RevokeKey.js","sourceRoot":"","sources":["../../../src/cli/RevokeKey.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAM7C,IAAM,SAAS,GAAf,MAAM,SAAU,SAAQ,UAAU;IAOhC,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,OAAe,EAAE,GAAW;QAClE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC;YACzG,MAAM,IAAI,eAAe,CAAC,UAAU,GAAG,OAAO,SAAS,IAAI,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAClD,CAAC;CACF,CAAA;AAXW;IADT,MAAM,CAAC,YAAY,CAAC;8BACN,GAAG;sCAAC;AAGT;IADT,UAAU,CAAC,WAAW,CAAC;8BACJ,WAAW;2CAAC;AALrB,SAAS;IAJrB,OAAO,CAAC,kBAAkB,EAAE,oDAAoD,CAAC;IACjF,QAAQ,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC1G,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,wCAAwC,CAAC;IACnE,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC;GACnB,SAAS,CAarB"}

package/lib/mjs/cli/common.d.ts

@@ -0,0 +1,9 @@
+import type { IdentityRef } from '@spinajs/authn/contracts';
+export declare const OWNER_TYPES: string[];
+export declare function ownerArg(type: string, id: string): IdentityRef;
+/** A public JWK given inline as JSON, or a file holding JSON or a PEM public key; private keys are refused. */
+export declare function readPublicJwk(opts: {
+    jwk?: string;
+    file?: string;
+}): unknown;
+//# sourceMappingURL=common.d.ts.map

package/lib/mjs/cli/common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../src/cli/common.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAG5D,eAAO,MAAM,WAAW,UAA+B,CAAC;AAExD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,WAAW,CAK9D;AAED,+GAA+G;AAC/G,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAgB5E"}

package/lib/mjs/cli/common.js

@@ -0,0 +1,30 @@
+import { readFileSync } from 'node:fs';
+import { createPublicKey } from 'node:crypto';
+import { InvalidArgument } from '@spinajs/exceptions';
+export const OWNER_TYPES = ['user', 'service', 'agent'];
+export function ownerArg(type, id) {
+    if (!OWNER_TYPES.includes(type)) {
+        throw new InvalidArgument(`owner type must be one of ${OWNER_TYPES.join(', ')}, not ${JSON.stringify(type)}`);
+    }
+    return { type, id };
+}
+/** A public JWK given inline as JSON, or a file holding JSON or a PEM public key; private keys are refused. */
+export function readPublicJwk(opts) {
+    if ((opts.jwk === undefined) === (opts.file === undefined)) {
+        throw new InvalidArgument('give the key with exactly one of --jwk or --file');
+    }
+    const text = opts.jwk ?? readFileSync(opts.file, 'utf8');
+    if (text.includes('-----BEGIN')) {
+        if (!text.includes('-----BEGIN PUBLIC KEY-----') || text.includes('PRIVATE KEY')) {
+            throw new InvalidArgument('the PEM file must hold a public key (SPKI), never a private key');
+        }
+        return createPublicKey(text).export({ format: 'jwk' });
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new InvalidArgument('the key is neither JSON nor a PEM public key');
+    }
+}
+//# sourceMappingURL=common.js.map

package/lib/mjs/cli/common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../../src/cli/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAExD,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,EAAU;IAC/C,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,eAAe,CAAC,6BAA6B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AACtB,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,aAAa,CAAC,IAAqC;IACjE,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,eAAe,CAAC,kDAAkD,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,IAAK,EAAE,MAAM,CAAC,CAAC;IAC1D,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,eAAe,CAAC,iEAAiE,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,8CAA8C,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC"}

package/lib/mjs/cli/index.d.ts

@@ -0,0 +1,5 @@
+export * from './common.js';
+export * from './AddKey.js';
+export * from './ListKeys.js';
+export * from './RevokeKey.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cli/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC"}

package/lib/mjs/cli/index.js

@@ -0,0 +1,5 @@
+export * from './common.js';
+export * from './AddKey.js';
+export * from './ListKeys.js';
+export * from './RevokeKey.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC"}

package/lib/mjs/config/authn-keys.d.ts

@@ -0,0 +1,9 @@
+declare const authnKeys: {
+    system: {
+        dirs: {
+            cli: string[];
+        };
+    };
+};
+export default authnKeys;
+//# sourceMappingURL=authn-keys.d.ts.map

package/lib/mjs/config/authn-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authn-keys.d.ts","sourceRoot":"","sources":["../../../src/config/authn-keys.ts"],"names":[],"mappings":"AAeA,QAAA,MAAM,SAAS;IACb,MAAM;QACJ,IAAI;YACF,GAAG;;;CAGR,CAAC;eAEa,SAAS"}

package/lib/mjs/config/authn-keys.js

@@ -0,0 +1,21 @@
+import { join, normalize, resolve } from 'path';
+function dir(path) {
+    const inCommonJs = typeof module !== 'undefined';
+    return [
+        resolve(normalize(join(process.env.WORKSPACE_ROOT_PATH ?? process.cwd(), 'node_modules', '@spinajs', 'authn-keys', 'lib', inCommonJs ? 'cjs' : 'mjs', path))),
+        // one up if we run from app or build folder
+        resolve(normalize(join(process.env.WORKSPACE_ROOT_PATH ?? process.cwd(), '../', 'node_modules', '@spinajs', 'authn-keys', 'lib', inCommonJs ? 'cjs' : 'mjs', path))),
+    ];
+}
+// Only the CLI scan dir. A non-empty system.dirs.migrations would replace the orm's defaults in every app (see
+// authn-token's config); the migration and the models register through their decorators. The authn.keys defaults
+// live in the authn schema.
+const authnKeys = {
+    system: {
+        dirs: {
+            cli: [...dir('cli')],
+        },
+    },
+};
+export default authnKeys;
+//# sourceMappingURL=authn-keys.js.map

package/lib/mjs/config/authn-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authn-keys.js","sourceRoot":"","sources":["../../../src/config/authn-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEhD,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO;QACL,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAE7J,4CAA4C;QAC5C,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;KACrK,CAAC;AACJ,CAAC;AAED,+GAA+G;AAC/G,iHAAiH;AACjH,4BAA4B;AAC5B,MAAM,SAAS,GAAG;IAChB,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;SACrB;KACF;CACF,CAAC;AAEF,eAAe,SAAS,CAAC"}

package/lib/mjs/httpsig/base.d.ts

@@ -0,0 +1,8 @@
+import type { SignedRequest } from '@spinajs/authn/contracts';
+import type { SignatureInput } from './fields.js';
+export declare const lowerCaseHeaders: (headers: Readonly<Record<string, string>>) => Record<string, string>;
+/** RFC 9421 §2.5 for the covered components; null when one may not be covered or has no value. */
+export declare function signatureBase(req: SignedRequest, input: SignatureInput): string | null;
+/** RFC 9530 Content-Digest: every member is sha-256 or sha-512 and matches the body. */
+export declare function digestMatches(header: unknown, body: Uint8Array): boolean;
+//# sourceMappingURL=base.d.ts.map

package/lib/mjs/httpsig/base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../src/httpsig/base.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAOlD,eAAO,MAAM,gBAAgB,YAAa,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAA4F,CAAC;AA6B/L,kGAAkG;AAClG,wBAAgB,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAetF;AAID,wFAAwF;AACxF,wBAAgB,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAYxE"}