@spinajs/authn-keys 3.0.2 → 3.0.4

package/README.md

@@ -24,8 +24,15 @@ The registry and the strategies get their dependencies through DI. Tests
 build them with `new`, passing the dependencies in one object, e.g.
 `new DefaultKeyRegistry({ store, secrets, throttle, options })` or
 `new HttpSignatureStrategy({ registry, nonces, options })`. `OrmKeyStore`
-and `DbKeyNonceStore` inject the `Orm`, so the `authn:key-*` commands bring
-the database up on their own.
+injects the `Orm`, so the `authn:key-*` commands bring the database up on
+their own.
+
+`JwsAssertionStrategy` and `HttpSignatureStrategy` claim each `jti` and
+signature nonce in the core `NonceStore` (`@spinajs/authn/contracts`). Only
+`@spinajs/authn-orm` registers one (`DbNonceStore`), so import it, or register
+your own `NonceStore`; without one the strategies fail at boot with an error
+naming `@spinajs/authn-orm`. `MemoryNonceStore` from `@spinajs/authn/nonces`
+is for tests and single-process apps, and is not registered for you.
 
 ## Challenges
 
@@ -146,7 +153,8 @@ unknown key with the same work and result as a bad signature, throttles by
 | `httpSignature.skewSeconds` | `30` |
 | `httpSignature.requiredComponents` | `['@method', '@target-uri', 'content-digest']` |
 
-`authn_nonce` comes with `@spinajs/authn-orm`'s `AuthnInitial` migration.
+`authn_nonce` and the `NonceStore` that fills it (`DbNonceStore`) come with
+`@spinajs/authn-orm`; this package has no nonce table or model of its own.
 
 List the strategies an app uses in `authn.strategies`; `service` is the
 class name:

package/lib/cjs/index.d.ts

@@ -5,7 +5,6 @@ export * from './models/index.js';
 export * from './migrations/index.js';
 export * from './registry/index.js';
 export * from './jws/index.js';
-export * from './nonce/index.js';
 export * from './strategies/index.js';
 export * from './httpsig/index.js';
 export * from './schema.js';

package/lib/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC"}

package/lib/cjs/index.js

@@ -21,7 +21,6 @@ __exportStar(require("./models/index.js"), exports);
 __exportStar(require("./migrations/index.js"), exports);
 __exportStar(require("./registry/index.js"), exports);
 __exportStar(require("./jws/index.js"), exports);
-__exportStar(require("./nonce/index.js"), exports);
 __exportStar(require("./strategies/index.js"), exports);
 __exportStar(require("./httpsig/index.js"), exports);
 __exportStar(require("./schema.js"), exports);

package/lib/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,uDAAqC;AACrC,qDAAmC;AACnC,oDAAkC;AAClC,wDAAsC;AACtC,sDAAoC;AACpC,iDAA+B;AAC/B,mDAAiC;AACjC,wDAAsC;AACtC,qDAAmC;AACnC,8CAA4B;AAC5B,iDAA+B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,uDAAqC;AACrC,qDAAmC;AACnC,oDAAkC;AAClC,wDAAsC;AACtC,sDAAoC;AACpC,iDAA+B;AAC/B,wDAAsC;AACtC,qDAAmC;AACnC,8CAA4B;AAC5B,iDAA+B"}

package/lib/cjs/jws/index.d.ts

@@ -1,4 +1,5 @@
 export * from './json.js';
 export * from './verifier.js';
 export * from './signer.js';
+export * from './register.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/cjs/jws/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/jws/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/jws/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC"}

package/lib/cjs/jws/index.js

@@ -17,4 +17,5 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./json.js"), exports);
 __exportStar(require("./verifier.js"), exports);
 __exportStar(require("./signer.js"), exports);
+__exportStar(require("./register.js"), exports);
 //# sourceMappingURL=index.js.map

package/lib/cjs/jws/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/jws/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,gDAA8B;AAC9B,8CAA4B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/jws/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,gDAA8B;AAC9B,8CAA4B;AAC5B,gDAA8B"}

package/lib/cjs/jws/register.d.ts

@@ -0,0 +1,18 @@
+import { Bootstrapper } from '@spinajs/di';
+import type { IContainer } from '@spinajs/di';
+import '../register-schema.js';
+import { LocalJwsSigner } from './signer.js';
+/** `authn.keys.signer`. */
+export interface SignerConfig {
+    readonly current: string;
+    /** Secret references the configuration resolves to private JWKs as JSON text. */
+    readonly keys: readonly string[];
+}
+/** Registers a JwsSigner built from `authn.keys.signer` in `container`; null, and nothing registered, when it is null. */
+export declare function registerJwsSigner(container: IContainer): Promise<LocalJwsSigner | null>;
+/** Registers the configured JwsSigner at boot, so the JWKS route and the verifiers' key lookup find it. */
+export declare class AuthnKeysSignerBootstrapper extends Bootstrapper {
+    protected Container: IContainer;
+    bootstrap(): Promise<void>;
+}
+//# sourceMappingURL=register.d.ts.map

package/lib/cjs/jws/register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../src/jws/register.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,YAAY,EAAyB,MAAM,aAAa,CAAC;AAC9E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAM9C,OAAO,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG7C,2BAA2B;AAC3B,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,iFAAiF;IACjF,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAgBD,0HAA0H;AAC1H,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAe7F;AAED,2GAA2G;AAC3G,qBACa,2BAA4B,SAAQ,YAAY;IAE3D,SAAS,CAAC,SAAS,EAAG,UAAU,CAAC;IAEpB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAEtC;CACF"}

package/lib/cjs/jws/register.js

@@ -0,0 +1,66 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthnKeysSignerBootstrapper = void 0;
+exports.registerJwsSigner = registerJwsSigner;
+const di_1 = require("@spinajs/di");
+const configuration_1 = require("@spinajs/configuration");
+const contracts_1 = require("@spinajs/authn/contracts");
+const exceptions_1 = require("@spinajs/exceptions");
+const util_1 = require("@spinajs/util");
+require("../register-schema.js");
+const signer_js_1 = require("./signer.js");
+// The error names the position only: the text is a private key.
+function privateJwkOf(secret, index) {
+    let jwk;
+    try {
+        jwk = JSON.parse(secret);
+    }
+    catch {
+        jwk = undefined;
+    }
+    if (!(0, util_1.isPlainObject)(jwk)) {
+        throw new exceptions_1.InvalidOption(`authn.keys.signer.keys.${index} does not resolve to a private JWK as a JSON object`);
+    }
+    return jwk;
+}
+/** Registers a JwsSigner built from `authn.keys.signer` in `container`; null, and nothing registered, when it is null. */
+async function registerJwsSigner(container) {
+    const configuration = await container.resolve(configuration_1.Configuration);
+    const config = configuration.get('authn.keys.signer', null);
+    if (!config) {
+        return null;
+    }
+    let signer;
+    try {
+        signer = new signer_js_1.LocalJwsSigner(config.keys.map(privateJwkOf), { current: config.current });
+    }
+    catch (e) {
+        throw e instanceof exceptions_1.InvalidArgument ? new exceptions_1.InvalidOption(`authn.keys.signer: ${e.message}`) : e;
+    }
+    container.register({ ConfiguredJwsSigner: () => signer }.ConfiguredJwsSigner).as(contracts_1.JwsSigner);
+    return signer;
+}
+/** Registers the configured JwsSigner at boot, so the JWKS route and the verifiers' key lookup find it. */
+let AuthnKeysSignerBootstrapper = class AuthnKeysSignerBootstrapper extends di_1.Bootstrapper {
+    async bootstrap() {
+        await registerJwsSigner(this.Container);
+    }
+};
+exports.AuthnKeysSignerBootstrapper = AuthnKeysSignerBootstrapper;
+__decorate([
+    (0, di_1.Autoinject)(di_1.Container),
+    __metadata("design:type", Object)
+], AuthnKeysSignerBootstrapper.prototype, "Container", void 0);
+exports.AuthnKeysSignerBootstrapper = AuthnKeysSignerBootstrapper = __decorate([
+    (0, di_1.Injectable)(di_1.Bootstrapper)
+], AuthnKeysSignerBootstrapper);
+//# sourceMappingURL=register.js.map

package/lib/cjs/jws/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../../src/jws/register.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,oCAA8E;AAE9E,0DAAuD;AACvD,wDAAqD;AACrD,oDAAqE;AACrE,wCAA8C;AAE9C,iCAA+B;AAC/B,2CAA6C;AAU7C,gEAAgE;AAChE,SAAS,YAAY,CAAC,MAAc,EAAE,KAAa;IACjD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,IAAA,oBAAa,EAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,0BAAa,CAAC,0BAA0B,KAAK,qDAAqD,CAAC,CAAC;IAChH,CAAC;IACD,OAAO,GAA4B,CAAC;AACtC,CAAC;AAED,0HAA0H;AACnH,KAAK,4BAA4B,SAAqB;IAC3D,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,6BAAa,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAsB,mBAAmB,EAAE,IAAI,CAAC,CAAC;IACjF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,0BAAc,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1F,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,YAAY,4BAAe,CAAC,CAAC,CAAC,IAAI,0BAAa,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChG,CAAC;IACD,SAAS,CAAC,QAAQ,CAAC,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,qBAAS,CAAC,CAAC;IAC5F,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2GAA2G;AAEpG,IAAM,2BAA2B,GAAjC,MAAM,2BAA4B,SAAQ,iBAAY;IAIpD,KAAK,CAAC,SAAS;QACpB,MAAM,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;CACF,CAAA;;AALW;IADT,IAAA,eAAU,EAAC,cAAS,CAAC;;8DACW;sCAFtB,2BAA2B;IADvC,IAAA,eAAU,EAAC,iBAAY,CAAC;GACZ,2BAA2B,CAOvC"}

package/lib/cjs/models/index.d.ts

@@ -1,3 +1,2 @@
 export * from './AuthnKey.js';
-export * from './AuthnNonce.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/cjs/models/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/models/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/models/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC"}

package/lib/cjs/models/index.js

@@ -15,5 +15,4 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./AuthnKey.js"), exports);
-__exportStar(require("./AuthnNonce.js"), exports);
 //# sourceMappingURL=index.js.map

package/lib/cjs/models/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/models/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gDAA8B;AAC9B,kDAAgC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/models/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gDAA8B"}

package/lib/cjs/options/options.d.ts

@@ -17,7 +17,16 @@ export interface KeysConfig {
         readonly skewSeconds: number;
         readonly requiredComponents: readonly string[];
     };
+    /** Absent: {@link DEFAULT_KEY_CACHE}. */
+    readonly cache?: KeyCacheOptions;
 }
+/** `authn.keys.cache`: how long `KeyRegistry.byId` serves a key from memory. */
+export interface KeyCacheOptions {
+    /** 0 turns the cache off. */
+    readonly ttlSeconds: number;
+    readonly maxEntries: number;
+}
+export declare const DEFAULT_KEY_CACHE: KeyCacheOptions;
 /** `authn.keys` (design §22.5) after defaults. */
 export interface KeysOptions {
     readonly algorithms: readonly KeyAlgorithm[];
@@ -38,6 +47,7 @@ export interface KeysOptions {
         readonly skewSeconds: number;
         readonly requiredComponents: readonly string[];
     };
+    readonly cache: KeyCacheOptions;
 }
 /**
  * The options of a validated `authn.keys`: frozen, with the challenge audience falling back to the assertion audience.

package/lib/cjs/options/options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../../src/options/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAG7D,4DAA4D;AAC5D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACtF,QAAQ,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClJ,QAAQ,CAAC,aAAa,EAAE;QAAE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;CAC1I;AAED,kDAAkD;AAClD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,iHAAiH;QACjH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;KAClC,CAAC;IACF,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,gEAAgE;QAChE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,QAAQ,CAAC,aAAa,EAAE;QACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;KAChD,CAAC;CACH;AAuBD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,WAAW,CAc7D"}
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../../src/options/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAG7D,4DAA4D;AAC5D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACtF,QAAQ,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClJ,QAAQ,CAAC,aAAa,EAAE;QAAE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IACzI,yCAAyC;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;CAClC;AAED,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,6BAA6B;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,eAAO,MAAM,iBAAiB,EAAE,eAAuE,CAAC;AAExG,kDAAkD;AAClD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,iHAAiH;QACjH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;KAClC,CAAC;IACF,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,gEAAgE;QAChE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,QAAQ,CAAC,aAAa,EAAE;QACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;KAChD,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;CACjC;AA6BD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,WAAW,CAe7D"}

package/lib/cjs/options/options.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_KEY_CACHE = void 0;
 exports.keysOptionsOf = keysOptionsOf;
 const exceptions_1 = require("@spinajs/exceptions");
+exports.DEFAULT_KEY_CACHE = Object.freeze({ ttlSeconds: 10, maxEntries: 10_000 });
 const derived = new WeakMap();
 const RANGES = [
     ['challenge', 'ttlSeconds', 1, 3600],
@@ -19,6 +21,12 @@ function checkRanges(config) {
             throw new exceptions_1.InvalidOption(`authn.keys.${block}.${key} must be an integer from ${min} to ${max}`);
         }
     }
+    if (config.cache !== undefined) {
+        const { ttlSeconds, maxEntries } = config.cache;
+        if (!(Number.isInteger(ttlSeconds) && ttlSeconds >= 0 && Number.isInteger(maxEntries) && maxEntries >= 1)) {
+            throw new exceptions_1.InvalidOption('authn.keys.cache needs an integer ttlSeconds >= 0 and an integer maxEntries >= 1');
+        }
+    }
 }
 /**
  * The options of a validated `authn.keys`: frozen, with the challenge audience falling back to the assertion audience.
@@ -33,6 +41,7 @@ function keysOptionsOf(config) {
             challenge: Object.freeze({ ttlSeconds: config.challenge.ttlSeconds, audience: config.challenge.audience ?? config.assertion.audience }),
             assertion: Object.freeze({ ...config.assertion }),
             httpSignature: Object.freeze({ ...config.httpSignature, requiredComponents: Object.freeze([...config.httpSignature.requiredComponents]) }),
+            cache: Object.freeze({ ...exports.DEFAULT_KEY_CACHE, ...config.cache }),
         });
         derived.set(config, options);
         derived.set(options, options);

package/lib/cjs/options/options.js.map

@@ -1 +1 @@
-{"version":3,"file":"options.js","sourceRoot":"","sources":["../../../src/options/options.ts"],"names":[],"mappings":";;;AACA,oDAAoD;AAgCpD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAuB,CAAC;AAEnD,MAAM,MAAM,GAAsH;IAChI,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC,EAAE,IAAI,CAAC;IACpC,CAAC,WAAW,EAAE,oBAAoB,EAAE,CAAC,EAAE,GAAG,CAAC;IAC3C,CAAC,WAAW,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,CAAC;IACpC,CAAC,eAAe,EAAE,eAAe,EAAE,CAAC,EAAE,GAAG,CAAC;IAC1C,CAAC,eAAe,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,CAAC;CACzC,CAAC;AAEF,4GAA4G;AAC5G,wFAAwF;AACxF,SAAS,WAAW,CAAC,MAAkB;IACrC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAa,MAAM,CAAC,KAAK,CAAoD,EAAE,CAAC,GAAG,CAAC,CAAC;QAChG,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAK,KAAgB,IAAI,GAAG,IAAK,KAAgB,IAAI,GAAG,CAAC,EAAE,CAAC;YACvF,MAAM,IAAI,0BAAa,CAAC,cAAc,KAAK,IAAI,GAAG,4BAA4B,GAAG,OAAO,GAAG,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,uBAA8B,MAAkB;IAC9C,IAAI,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,WAAW,CAAC,MAAM,CAAC,CAAC;QACpB,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;YACtB,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;YACjD,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;YACvI,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YACjD,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,aAAa,EAAE,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;SAC3I,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../../../src/options/options.ts"],"names":[],"mappings":";;;;AACA,oDAAoD;AAmBvC,QAAA,iBAAiB,GAAoB,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;AAyBxG,MAAM,OAAO,GAAG,IAAI,OAAO,EAAuB,CAAC;AAEnD,MAAM,MAAM,GAAsH;IAChI,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC,EAAE,IAAI,CAAC;IACpC,CAAC,WAAW,EAAE,oBAAoB,EAAE,CAAC,EAAE,GAAG,CAAC;IAC3C,CAAC,WAAW,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,CAAC;IACpC,CAAC,eAAe,EAAE,eAAe,EAAE,CAAC,EAAE,GAAG,CAAC;IAC1C,CAAC,eAAe,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,CAAC;CACzC,CAAC;AAEF,4GAA4G;AAC5G,wFAAwF;AACxF,SAAS,WAAW,CAAC,MAAkB;IACrC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAa,MAAM,CAAC,KAAK,CAAoD,EAAE,CAAC,GAAG,CAAC,CAAC;QAChG,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAK,KAAgB,IAAI,GAAG,IAAK,KAAgB,IAAI,GAAG,CAAC,EAAE,CAAC;YACvF,MAAM,IAAI,0BAAa,CAAC,cAAc,KAAK,IAAI,GAAG,4BAA4B,GAAG,OAAO,GAAG,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,KAAiC,CAAC;QAC5E,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAK,UAAqB,IAAI,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAK,UAAqB,IAAI,CAAC,CAAC,EAAE,CAAC;YAClI,MAAM,IAAI,0BAAa,CAAC,kFAAkF,CAAC,CAAC;QAC9G,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,uBAA8B,MAAkB;IAC9C,IAAI,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,WAAW,CAAC,MAAM,CAAC,CAAC;QACpB,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;YACtB,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;YACjD,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;YACvI,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YACjD,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,aAAa,EAAE,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;YAC1I,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAA,iBAAiB,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;SAChE,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/lib/cjs/registry/cache.d.ts

@@ -0,0 +1,26 @@
+import type { CredentialChangeBus, IdentityRef, KeyRecord } from '@spinajs/authn/contracts';
+import type { KeyCacheOptions } from '../options/options.js';
+import { KeyStore } from './store.js';
+/**
+ * A KeyStore whose `get` is served from memory for `ttlSeconds`. Every write through it and every change the bus
+ * delivers evicts; a key revoked in another process is seen within the ttl. Unknown kids are never cached.
+ */
+export declare class CachedKeyStore extends KeyStore {
+    protected readonly inner: KeyStore;
+    protected readonly options: KeyCacheOptions;
+    protected readonly bus?: CredentialChangeBus | undefined;
+    private readonly keys;
+    /** Bumped by every eviction: a read that started before it must not store what it read. */
+    private epoch;
+    private readonly unsubscribe;
+    constructor(inner: KeyStore, options: KeyCacheOptions, bus?: CredentialChangeBus | undefined);
+    insert(key: KeyRecord): Promise<'inserted' | 'duplicate'>;
+    get(kid: string): Promise<KeyRecord | null>;
+    listByOwner(owner: IdentityRef): Promise<readonly KeyRecord[]>;
+    revoke(owner: IdentityRef, kid: string, at: Date): Promise<'revoked' | 'already' | 'none'>;
+    touch(kid: string, at: Date): Promise<void>;
+    /** Stops listening to the bus. */
+    dispose(): Promise<void>;
+    private evict;
+}
+//# sourceMappingURL=cache.d.ts.map

package/lib/cjs/registry/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../src/registry/cache.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAG5F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC;;;GAGG;AACH,qBAAa,cAAe,SAAQ,QAAQ;IAOxC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ;IAClC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,eAAe;IAC3C,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,mBAAmB;IAR9C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAwC;IAC7D,2FAA2F;IAC3F,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA2B;IAEvD,YACqB,KAAK,EAAE,QAAQ,EACf,OAAO,EAAE,eAAe,EACxB,GAAG,CAAC,EAAE,mBAAmB,YAAA,EAK7C;IAEY,MAAM,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,WAAW,CAAC,CAMrE;IAEY,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAWvD;IAEM,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAEpE;IAEY,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC,CAMtG;IAEY,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAMvD;IAED,kCAAkC;IAC3B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAI9B;IAED,OAAO,CAAC,KAAK;CAId"}

package/lib/cjs/registry/cache.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CachedKeyStore = void 0;
+const bus_1 = require("@spinajs/authn/bus");
+const util_1 = require("@spinajs/util");
+const store_js_1 = require("./store.js");
+/**
+ * A KeyStore whose `get` is served from memory for `ttlSeconds`. Every write through it and every change the bus
+ * delivers evicts; a key revoked in another process is seen within the ttl. Unknown kids are never cached.
+ */
+class CachedKeyStore extends store_js_1.KeyStore {
+    constructor(inner, options, bus) {
+        super();
+        this.inner = inner;
+        this.options = options;
+        this.bus = bus;
+        /** Bumped by every eviction: a read that started before it must not store what it read. */
+        this.epoch = 0;
+        this.keys = options.ttlSeconds > 0 ? new util_1.LruTtlCache({ maxEntries: options.maxEntries, ttlMs: options.ttlSeconds * 1000, expireOnClockRewind: true }) : null;
+        this.unsubscribe = this.keys && bus ? bus.subscribe((change) => this.evict((0, bus_1.credentialChangeTags)(change))) : undefined;
+    }
+    async insert(key) {
+        try {
+            return await this.inner.insert(key);
+        }
+        finally {
+            this.evict([(0, bus_1.credentialTag)('key', key.kid)]);
+        }
+    }
+    async get(kid) {
+        const cached = this.keys?.get(kid);
+        if (cached !== undefined) {
+            return cached;
+        }
+        const since = this.epoch;
+        const key = await this.inner.get(kid);
+        if (key !== null && this.keys !== null && since === this.epoch) {
+            this.keys.set(kid, key, { tags: [(0, bus_1.credentialTag)('key', kid), (0, bus_1.identityTag)(key.owner)] });
+        }
+        return key;
+    }
+    listByOwner(owner) {
+        return this.inner.listByOwner(owner);
+    }
+    async revoke(owner, kid, at) {
+        try {
+            return await this.inner.revoke(owner, kid, at);
+        }
+        finally {
+            this.evict([(0, bus_1.credentialTag)('key', kid)]);
+        }
+    }
+    async touch(kid, at) {
+        try {
+            await this.inner.touch(kid, at);
+        }
+        finally {
+            this.evict([(0, bus_1.credentialTag)('key', kid)]);
+        }
+    }
+    /** Stops listening to the bus. */
+    dispose() {
+        this.unsubscribe?.();
+        this.keys?.clear();
+        return Promise.resolve();
+    }
+    evict(tags) {
+        this.epoch++;
+        this.keys?.invalidate(tags);
+    }
+}
+exports.CachedKeyStore = CachedKeyStore;
+//# sourceMappingURL=cache.js.map

package/lib/cjs/registry/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../../src/registry/cache.ts"],"names":[],"mappings":";;;AAAA,4CAAsF;AAEtF,wCAA4C;AAG5C,yCAAsC;AAEtC;;;GAGG;AACH,oBAA4B,SAAQ,mBAAQ;IAM1C,YACqB,KAAe,EACf,OAAwB,EACxB,GAAyB;QAE5C,KAAK,EAAE,CAAC;QAJW,UAAK,GAAL,KAAK,CAAU;QACf,YAAO,GAAP,OAAO,CAAiB;QACxB,QAAG,GAAH,GAAG,CAAsB;QAP9C,2FAA2F;QACnF,UAAK,GAAG,CAAC,CAAC;QAShB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,kBAAW,CAAoB,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,GAAG,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChL,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAA,0BAAoB,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxH,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,GAAc;QAChC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,KAAK,CAAC,CAAC,IAAA,mBAAa,EAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,GAAW;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YAC/D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,IAAA,mBAAa,EAAC,KAAK,EAAE,GAAG,CAAC,EAAE,IAAA,iBAAW,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEM,WAAW,CAAC,KAAkB;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,KAAkB,EAAE,GAAW,EAAE,EAAQ;QAC3D,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACjD,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,KAAK,CAAC,CAAC,IAAA,mBAAa,EAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,EAAQ;QACtC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClC,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,KAAK,CAAC,CAAC,IAAA,mBAAa,EAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,kCAAkC;IAC3B,OAAO;QACZ,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACnB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,IAAc;QAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;CACF"}

package/lib/cjs/registry/index.d.ts

@@ -1,4 +1,5 @@
 export * from './store.js';
 export * from './orm-store.js';
+export * from './cache.js';
 export * from './registry.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/cjs/registry/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/registry/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/registry/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC"}

package/lib/cjs/registry/index.js

@@ -16,5 +16,6 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./store.js"), exports);
 __exportStar(require("./orm-store.js"), exports);
+__exportStar(require("./cache.js"), exports);
 __exportStar(require("./registry.js"), exports);
 //# sourceMappingURL=index.js.map

package/lib/cjs/registry/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/registry/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6CAA2B;AAC3B,iDAA+B;AAC/B,gDAA8B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/registry/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6CAA2B;AAC3B,iDAA+B;AAC/B,6CAA2B;AAC3B,gDAA8B"}

package/lib/cjs/registry/registry.d.ts

@@ -1,8 +1,10 @@
 import '../register-schema.js';
 import { AuthnAudit } from '@spinajs/authn/audit';
+import '@spinajs/authn/bus';
 import type { AuthnAuditor, AuthnEventBody } from '@spinajs/authn/audit';
-import { AuthnThrottle, KeyRegistry, SecretStore } from '@spinajs/authn/contracts';
+import { AuthnThrottle, CredentialChangeBus, KeyRegistry, SecretStore } from '@spinajs/authn/contracts';
 import type { AuthnContext, IdentityRef, KeyChallengeRequest, KeyChallengeResult, KeyMaterial, KeyOwner, KeyRecord, KeyRegisterResult, KeyRegistration, PrincipalRef } from '@spinajs/authn/contracts';
+import { Log } from '@spinajs/log';
 import type { KeysConfig, KeysOptions } from '../options/options.js';
 import { KeyStore } from './store.js';
 /** Usable for verification: neither revoked nor expired at `now`. */
@@ -21,8 +23,13 @@ export interface DefaultKeyRegistryDeps {
     readonly audit?: AuthnAuditor;
     /** Complete options that bypass the configuration. */
     readonly options?: KeysOptions;
+    /** Told about revoked keys, and evicts the key cache; otherwise the registered CredentialChangeBus. */
+    readonly bus?: CredentialChangeBus;
 }
-/** KeyRegistry over a KeyStore, challenges in SecretStore (lane notes D7, D12). */
+/**
+ * KeyRegistry over a KeyStore, challenges in SecretStore (lane notes D7, D12). The store is wrapped in a
+ * {@link CachedKeyStore} unless `authn.keys.cache.ttlSeconds` is 0.
+ */
 export declare class DefaultKeyRegistry extends KeyRegistry {
     protected readonly Deps?: DefaultKeyRegistryDeps | undefined;
     protected KeysConfig: KeysConfig;
@@ -30,11 +37,15 @@ export declare class DefaultKeyRegistry extends KeyRegistry {
     protected Store: KeyStore;
     protected Secrets: SecretStore;
     protected Throttle: AuthnThrottle;
+    protected Bus: CredentialChangeBus | undefined;
+    protected Log: Log;
+    private cached;
     private readonly stamped;
     /** Kids whose last stamp is remembered; past this the least recently stamped is forgotten and costs one extra write. */
     protected readonly maxStamped: number;
     constructor(Deps?: DefaultKeyRegistryDeps | undefined);
     protected get store(): KeyStore;
+    protected get bus(): CredentialChangeBus | undefined;
     protected get secrets(): SecretStore;
     protected get throttle(): AuthnThrottle;
     protected get options(): KeysOptions;
@@ -46,6 +57,8 @@ export declare class DefaultKeyRegistry extends KeyRegistry {
     revoke(owner: IdentityRef, kid: string, ctx: AuthnContext, opts?: {
         readonly actor?: PrincipalRef;
     }): Promise<boolean>;
+    /** The store already evicted its own cache; this tells the other caches of the process. */
+    protected changed(kid: string): Promise<void>;
     byId(kid: string): Promise<KeyRecord | null>;
     /** Stamps last_used_at after a successful verification, at most once a minute per key so busy clients write little. */
     touch(kid: string, at: Date): Promise<void>;

package/lib/cjs/registry/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/registry/registry.ts"],"names":[],"mappings":"AAGA,OAAO,uBAAuB,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,KAAK,EAAE,YAAY,EAAW,WAAW,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAMhN,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAoD,QAAQ,EAAE,MAAM,YAAY,CAAC;AA4CxF,qEAAqE;AACrE,eAAO,MAAM,WAAW,QAAS,SAAS,OAAO,IAAI,KAAG,OAAwF,CAAC;AAEjJ;;;GAGG;AACH,eAAO,MAAM,sBAAsB,QAAS,MAAM,KAAG,WAAoH,CAAC;AAE1K,6FAA6F;AAC7F,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;IAC9B,sDAAsD;IACtD,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;CAChC;AAED,mFAAmF;AACnF,qBACa,kBAAmB,SAAQ,WAAW;IAqBrC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,sBAAsB;IAnB5D,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC;IAGjC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC;IAG5B,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC;IAG1B,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC;IAG/B,SAAS,CAAC,QAAQ,EAAE,aAAa,CAAC;IAElC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IAErD,wHAAwH;IACxH,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAU;IAE/C,YAA+B,IAAI,CAAC,EAAE,sBAAsB,YAAA,EAE3D;IAED,SAAS,KAAK,KAAK,IAAI,QAAQ,CAE9B;IAED,SAAS,KAAK,OAAO,IAAI,WAAW,CAEnC;IAED,SAAS,KAAK,QAAQ,IAAI,aAAa,CAEtC;IAED,SAAS,KAAK,OAAO,IAAI,WAAW,CAEnC;IAED,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAErE;IAED,yIAAyI;IACzI,UAAgB,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAU9F;IAEK,QAAQ,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAkDlF;IAEK,IAAI,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAE5D;IAEK,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAU3H;IAEK,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAEjD;IAED,uHAAuH;IACjH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhD;IAEK,SAAS,CAAC,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA8BxF;CACF"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/registry/registry.ts"],"names":[],"mappings":"AAGA,OAAO,uBAAuB,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAElD,OAAO,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACxG,OAAO,KAAK,EAAE,YAAY,EAAW,WAAW,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAGhN,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAI3C,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAErE,OAAO,EAAoD,QAAQ,EAAE,MAAM,YAAY,CAAC;AA4CxF,qEAAqE;AACrE,eAAO,MAAM,WAAW,QAAS,SAAS,OAAO,IAAI,KAAG,OAAwF,CAAC;AAEjJ;;;GAGG;AACH,eAAO,MAAM,sBAAsB,QAAS,MAAM,KAAG,WAAoH,CAAC;AAE1K,6FAA6F;AAC7F,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;IAC9B,sDAAsD;IACtD,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B,uGAAuG;IACvG,QAAQ,CAAC,GAAG,CAAC,EAAE,mBAAmB,CAAC;CACpC;AAED;;;GAGG;AACH,qBACa,kBAAmB,SAAQ,WAAW;IA6BrC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,sBAAsB;IA3B5D,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC;IAGjC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC;IAG5B,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC;IAG1B,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC;IAG/B,SAAS,CAAC,QAAQ,EAAE,aAAa,CAAC;IAGlC,SAAS,CAAC,GAAG,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAG/C,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAEnB,OAAO,CAAC,MAAM,CAAqE;IAEnF,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IAErD,wHAAwH;IACxH,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAU;IAE/C,YAA+B,IAAI,CAAC,EAAE,sBAAsB,YAAA,EAE3D;IAED,SAAS,KAAK,KAAK,IAAI,QAAQ,CAO9B;IAED,SAAS,KAAK,GAAG,IAAI,mBAAmB,GAAG,SAAS,CAEnD;IAED,SAAS,KAAK,OAAO,IAAI,WAAW,CAEnC;IAED,SAAS,KAAK,QAAQ,IAAI,aAAa,CAEtC;IAED,SAAS,KAAK,OAAO,IAAI,WAAW,CAEnC;IAED,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAErE;IAED,yIAAyI;IACzI,UAAgB,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAU9F;IAEK,QAAQ,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAkDlF;IAEK,IAAI,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAE5D;IAEK,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAW3H;IAED,2FAA2F;IAC3F,UAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMlD;IAEK,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAEjD;IAED,uHAAuH;IACjH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhD;IAEK,SAAS,CAAC,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA8BxF;CACF"}

package/lib/cjs/registry/registry.js

@@ -15,12 +15,16 @@ const di_1 = require("@spinajs/di");
 const configuration_1 = require("@spinajs/configuration");
 require("../register-schema.js");
 const audit_1 = require("@spinajs/authn/audit");
+// Registers the default CredentialChangeBus.
+require("@spinajs/authn/bus");
 const contracts_1 = require("@spinajs/authn/contracts");
 const util_1 = require("@spinajs/util");
 const exceptions_1 = require("@spinajs/exceptions");
+const log_1 = require("@spinajs/log");
 const challenge_js_1 = require("../challenge/challenge.js");
 const keys_js_1 = require("../jwk/keys.js");
 const options_js_1 = require("../options/options.js");
+const cache_js_1 = require("./cache.js");
 const store_js_1 = require("./store.js");
 const OWNER_TYPES = ['user', 'service', 'agent'];
 const MAX_OWNER_ID = 64;
@@ -67,7 +71,10 @@ exports.isUsableKey = isUsableKey;
  */
 const loginChallengeIdentity = (kid) => ({ type: 'key', id: (0, keys_js_1.isValidKid)(kid) ? kid : (0, node_crypto_1.createHash)('sha256').update(kid, 'utf8').digest('hex') });
 exports.loginChallengeIdentity = loginChallengeIdentity;
-/** KeyRegistry over a KeyStore, challenges in SecretStore (lane notes D7, D12). */
+/**
+ * KeyRegistry over a KeyStore, challenges in SecretStore (lane notes D7, D12). The store is wrapped in a
+ * {@link CachedKeyStore} unless `authn.keys.cache.ttlSeconds` is 0.
+ */
 let DefaultKeyRegistry = class DefaultKeyRegistry extends contracts_1.KeyRegistry {
     constructor(Deps) {
         super();
@@ -77,7 +84,15 @@ let DefaultKeyRegistry = class DefaultKeyRegistry extends contracts_1.KeyRegistr
         this.maxStamped = 10_000;
     }
     get store() {
-        return this.Deps?.store ?? this.Store;
+        const inner = this.Deps?.store ?? this.Store;
+        if (this.cached?.inner !== inner) {
+            const cache = this.options.cache ?? options_js_1.DEFAULT_KEY_CACHE;
+            this.cached = { inner, store: cache.ttlSeconds > 0 ? new cache_js_1.CachedKeyStore(inner, cache, this.bus) : inner };
+        }
+        return this.cached.store;
+    }
+    get bus() {
+        return this.Deps?.bus ?? this.Bus;
     }
     get secrets() {
         return this.Deps?.secrets ?? this.Secrets;
@@ -160,12 +175,22 @@ let DefaultKeyRegistry = class DefaultKeyRegistry extends contracts_1.KeyRegistr
         if (done === 'none') {
             return false;
         }
+        await this.changed(kid);
         if (done === 'already') {
             return true;
         }
         await this.publish(ctx, { type: 'key.revoke', outcome: 'success', identity: owner, ...(opts?.actor ? { actor: opts.actor } : {}), data: { kid } });
         return true;
     }
+    /** The store already evicted its own cache; this tells the other caches of the process. */
+    async changed(kid) {
+        try {
+            await this.bus?.publish({ kind: 'key', id: kid });
+        }
+        catch (err) {
+            this.Log.error({ error: err, kid }, 'Could not publish the revoke of key ${kid}');
+        }
+    }
     async byId(kid) {
         return (0, keys_js_1.isValidKid)(kid) ? this.store.get(kid) : null;
     }
@@ -237,6 +262,14 @@ __decorate([
     (0, di_1.Autoinject)(contracts_1.AuthnThrottle),
     __metadata("design:type", contracts_1.AuthnThrottle)
 ], DefaultKeyRegistry.prototype, "Throttle", void 0);
+__decorate([
+    (0, di_1.Autoinject)(contracts_1.CredentialChangeBus, { optional: true }),
+    __metadata("design:type", Object)
+], DefaultKeyRegistry.prototype, "Bus", void 0);
+__decorate([
+    (0, log_1.Logger)('authn-keys'),
+    __metadata("design:type", log_1.Log)
+], DefaultKeyRegistry.prototype, "Log", void 0);
 exports.DefaultKeyRegistry = DefaultKeyRegistry = __decorate([
     (0, di_1.Injectable)(contracts_1.KeyRegistry),
     __metadata("design:paramtypes", [Object])