@stigmer/server 3.14.0 → 3.15.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/boot/compose.d.ts +8 -1
- package/dist/boot/compose.d.ts.map +1 -1
- package/dist/boot/compose.js +98 -12
- package/dist/boot/compose.js.map +1 -1
- package/dist/domain/agentexecution/constants.d.ts +16 -0
- package/dist/domain/agentexecution/constants.d.ts.map +1 -1
- package/dist/domain/agentexecution/constants.js +22 -0
- package/dist/domain/agentexecution/constants.js.map +1 -1
- package/dist/domain/agentexecution/controller.d.ts.map +1 -1
- package/dist/domain/agentexecution/controller.js +10 -3
- package/dist/domain/agentexecution/controller.js.map +1 -1
- package/dist/domain/agentexecution/run-target.d.ts +26 -0
- package/dist/domain/agentexecution/run-target.d.ts.map +1 -0
- package/dist/domain/agentexecution/run-target.js +31 -0
- package/dist/domain/agentexecution/run-target.js.map +1 -0
- package/dist/domain/apikey/verifier.d.ts +8 -1
- package/dist/domain/apikey/verifier.d.ts.map +1 -1
- package/dist/domain/apikey/verifier.js +14 -2
- package/dist/domain/apikey/verifier.js.map +1 -1
- package/dist/domain/identityaccount/constants.d.ts +66 -0
- package/dist/domain/identityaccount/constants.d.ts.map +1 -0
- package/dist/domain/identityaccount/constants.js +153 -0
- package/dist/domain/identityaccount/constants.js.map +1 -0
- package/dist/domain/identityaccount/controller.d.ts +34 -0
- package/dist/domain/identityaccount/controller.d.ts.map +1 -0
- package/dist/domain/identityaccount/controller.js +342 -0
- package/dist/domain/identityaccount/controller.js.map +1 -0
- package/dist/domain/identityaccount/operator.d.ts +14 -0
- package/dist/domain/identityaccount/operator.d.ts.map +1 -0
- package/dist/domain/identityaccount/operator.js +67 -0
- package/dist/domain/identityaccount/operator.js.map +1 -0
- package/dist/domain/identityaccount/provisioning.d.ts +52 -0
- package/dist/domain/identityaccount/provisioning.d.ts.map +1 -0
- package/dist/domain/identityaccount/provisioning.js +114 -0
- package/dist/domain/identityaccount/provisioning.js.map +1 -0
- package/dist/domain/identityaccount/resolve.d.ts +36 -0
- package/dist/domain/identityaccount/resolve.d.ts.map +1 -0
- package/dist/domain/identityaccount/resolve.js +12 -0
- package/dist/domain/identityaccount/resolve.js.map +1 -0
- package/dist/domain/identityaccount/resource-store.d.ts +4 -0
- package/dist/domain/identityaccount/resource-store.d.ts.map +1 -0
- package/dist/domain/identityaccount/resource-store.js +131 -0
- package/dist/domain/identityaccount/resource-store.js.map +1 -0
- package/dist/domain/identityaccount/steps.d.ts +79 -0
- package/dist/domain/identityaccount/steps.d.ts.map +1 -0
- package/dist/domain/identityaccount/steps.js +291 -0
- package/dist/domain/identityaccount/steps.js.map +1 -0
- package/dist/domain/identityaccount/store-contract.d.ts +22 -0
- package/dist/domain/identityaccount/store-contract.d.ts.map +1 -0
- package/dist/domain/identityaccount/store-contract.js +307 -0
- package/dist/domain/identityaccount/store-contract.js.map +1 -0
- package/dist/domain/identityaccount/store.d.ts +66 -0
- package/dist/domain/identityaccount/store.d.ts.map +1 -0
- package/dist/domain/identityaccount/store.js +13 -0
- package/dist/domain/identityaccount/store.js.map +1 -0
- package/dist/domain/session/constants.d.ts +15 -0
- package/dist/domain/session/constants.d.ts.map +1 -0
- package/dist/domain/session/constants.js +17 -0
- package/dist/domain/session/constants.js.map +1 -0
- package/dist/domain/session/controller.d.ts.map +1 -1
- package/dist/domain/session/controller.js +10 -0
- package/dist/domain/session/controller.js.map +1 -1
- package/dist/domain/session/run-target.d.ts +15 -0
- package/dist/domain/session/run-target.d.ts.map +1 -0
- package/dist/domain/session/run-target.js +14 -0
- package/dist/domain/session/run-target.js.map +1 -0
- package/dist/domain/workflowexecution/constants.d.ts +9 -0
- package/dist/domain/workflowexecution/constants.d.ts.map +1 -1
- package/dist/domain/workflowexecution/constants.js +13 -0
- package/dist/domain/workflowexecution/constants.js.map +1 -1
- package/dist/domain/workflowexecution/controller.d.ts.map +1 -1
- package/dist/domain/workflowexecution/controller.js +8 -0
- package/dist/domain/workflowexecution/controller.js.map +1 -1
- package/dist/domain/workflowexecution/run-target.d.ts +18 -0
- package/dist/domain/workflowexecution/run-target.d.ts.map +1 -0
- package/dist/domain/workflowexecution/run-target.js +23 -0
- package/dist/domain/workflowexecution/run-target.js.map +1 -0
- package/dist/extensions/drivers.d.ts +26 -0
- package/dist/extensions/drivers.d.ts.map +1 -1
- package/dist/extensions/gate-slots.d.ts +16 -1
- package/dist/extensions/gate-slots.d.ts.map +1 -1
- package/dist/extensions/gate-slots.js +1 -0
- package/dist/extensions/gate-slots.js.map +1 -1
- package/dist/extensions/identity-federation.d.ts +36 -0
- package/dist/extensions/identity-federation.d.ts.map +1 -0
- package/dist/extensions/identity-federation.js +2 -0
- package/dist/extensions/identity-federation.js.map +1 -0
- package/dist/extensions/registry.d.ts +18 -1
- package/dist/extensions/registry.d.ts.map +1 -1
- package/dist/extensions/registry.js +20 -0
- package/dist/extensions/registry.js.map +1 -1
- package/dist/identity/oidc-discovery.d.ts +36 -0
- package/dist/identity/oidc-discovery.d.ts.map +1 -0
- package/dist/identity/oidc-discovery.js +60 -0
- package/dist/identity/oidc-discovery.js.map +1 -0
- package/dist/identity/oidc-userinfo.d.ts +30 -0
- package/dist/identity/oidc-userinfo.d.ts.map +1 -0
- package/dist/identity/oidc-userinfo.js +28 -0
- package/dist/identity/oidc-userinfo.js.map +1 -0
- package/dist/identity/oidc-verifier.d.ts +6 -0
- package/dist/identity/oidc-verifier.d.ts.map +1 -1
- package/dist/identity/oidc-verifier.js +35 -34
- package/dist/identity/oidc-verifier.js.map +1 -1
- package/dist/index.d.ts +8 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +10 -0
- package/dist/index.js.map +1 -1
- package/dist/pipeline/interceptors/auth.d.ts +10 -0
- package/dist/pipeline/interceptors/auth.d.ts.map +1 -1
- package/dist/pipeline/interceptors/auth.js +9 -1
- package/dist/pipeline/interceptors/auth.js.map +1 -1
- package/dist/pipeline/steps/authorize-run-target.d.ts +105 -0
- package/dist/pipeline/steps/authorize-run-target.d.ts.map +1 -0
- package/dist/pipeline/steps/authorize-run-target.js +61 -0
- package/dist/pipeline/steps/authorize-run-target.js.map +1 -0
- package/dist/query/search/criteria.d.ts +10 -3
- package/dist/query/search/criteria.d.ts.map +1 -1
- package/dist/query/search/criteria.js +11 -4
- package/dist/query/search/criteria.js.map +1 -1
- package/package.json +4 -4
- package/src/boot/__tests__/auth-enabled-composition.test.ts +226 -2
- package/src/boot/compose.ts +118 -13
- package/src/domain/agentexecution/__tests__/run-gate.test.ts +245 -0
- package/src/domain/agentexecution/__tests__/run-target.test.ts +117 -0
- package/src/domain/agentexecution/constants.ts +25 -0
- package/src/domain/agentexecution/controller.ts +10 -3
- package/src/domain/agentexecution/run-target.ts +64 -0
- package/src/domain/apikey/__tests__/verifier.test.ts +146 -22
- package/src/domain/apikey/verifier.ts +24 -2
- package/src/domain/identityaccount/__tests__/constants.test.ts +155 -0
- package/src/domain/identityaccount/__tests__/identityaccount.test.ts +484 -0
- package/src/domain/identityaccount/__tests__/operator.test.ts +180 -0
- package/src/domain/identityaccount/__tests__/provisioning.test.ts +281 -0
- package/src/domain/identityaccount/__tests__/resolve.test.ts +114 -0
- package/src/domain/identityaccount/__tests__/resource-store.test.ts +216 -0
- package/src/domain/identityaccount/__tests__/support.ts +58 -0
- package/src/domain/identityaccount/constants.ts +178 -0
- package/src/domain/identityaccount/controller.ts +667 -0
- package/src/domain/identityaccount/operator.ts +94 -0
- package/src/domain/identityaccount/provisioning.ts +182 -0
- package/src/domain/identityaccount/resolve.ts +52 -0
- package/src/domain/identityaccount/resource-store.ts +157 -0
- package/src/domain/identityaccount/steps.ts +377 -0
- package/src/domain/identityaccount/store-contract.ts +471 -0
- package/src/domain/identityaccount/store.ts +70 -0
- package/src/domain/session/__tests__/run-gate.test.ts +219 -0
- package/src/domain/session/__tests__/run-target.test.ts +43 -0
- package/src/domain/session/constants.ts +17 -0
- package/src/domain/session/controller.ts +10 -0
- package/src/domain/session/run-target.ts +30 -0
- package/src/domain/workflowexecution/__tests__/run-gate.test.ts +200 -0
- package/src/domain/workflowexecution/__tests__/run-target.test.ts +80 -0
- package/src/domain/workflowexecution/constants.ts +17 -0
- package/src/domain/workflowexecution/controller.ts +10 -0
- package/src/domain/workflowexecution/run-target.ts +47 -0
- package/src/extensions/__tests__/extension-composition.test.ts +49 -0
- package/src/extensions/__tests__/identity-account-composed.test.ts +803 -0
- package/src/extensions/__tests__/identity-account-points.test.ts +129 -0
- package/src/extensions/__tests__/registry.test.ts +4 -0
- package/src/extensions/__tests__/tier-truthfulness.test.ts +299 -0
- package/src/extensions/drivers.ts +26 -0
- package/src/extensions/gate-slots.ts +16 -0
- package/src/extensions/identity-federation.ts +58 -0
- package/src/extensions/registry.ts +44 -1
- package/src/identity/__tests__/oidc-discovery.test.ts +122 -0
- package/src/identity/__tests__/oidc-userinfo.test.ts +103 -0
- package/src/identity/__tests__/oidc-verifier.test.ts +173 -3
- package/src/identity/oidc-discovery.ts +84 -0
- package/src/identity/oidc-userinfo.ts +64 -0
- package/src/identity/oidc-verifier.ts +42 -45
- package/src/index.ts +26 -0
- package/src/pipeline/__tests__/support.ts +34 -0
- package/src/pipeline/interceptors/auth.ts +13 -1
- package/src/pipeline/steps/__tests__/authorize-annotation-completeness.test.ts +184 -0
- package/src/pipeline/steps/__tests__/authorize-run-target.test.ts +261 -0
- package/src/pipeline/steps/authorize-run-target.ts +148 -0
- package/src/query/search/__tests__/criteria.test.ts +18 -1
- package/src/query/search/criteria.ts +11 -4
|
@@ -13,6 +13,19 @@
|
|
|
13
13
|
* the Class A conformance engine-gate test.
|
|
14
14
|
*/
|
|
15
15
|
export const ENGINE_UNAVAILABLE_MESSAGE = "The execution engine is temporarily unavailable. Please try again shortly.";
|
|
16
|
+
/**
|
|
17
|
+
* The run gate's deny copy per request shape (P1 sp.run-gate, ruling
|
|
18
|
+
* Q-RG-4; wire once merged, asserted by the conformance run-gate suite).
|
|
19
|
+
* NEW copy quotes the handle single-quoted (the ratified 2026-08-26 rule).
|
|
20
|
+
* The agent-execution domain's `runAgent*` functions are these copies'
|
|
21
|
+
* twins; each domain owns its own.
|
|
22
|
+
*/
|
|
23
|
+
export function runWorkflowDeniedMessage(workflowId) {
|
|
24
|
+
return `unauthorized to run workflow '${workflowId}'`;
|
|
25
|
+
}
|
|
26
|
+
export function runWorkflowInstanceDeniedMessage(workflowInstanceId) {
|
|
27
|
+
return `unauthorized to run workflow instance '${workflowInstanceId}'`;
|
|
28
|
+
}
|
|
16
29
|
/**
|
|
17
30
|
* The lifecycle steps' engineless refusal (lifecycle_steps.go, five
|
|
18
31
|
* sites: pause/resume/cancel/terminate signal steps and recover's
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/domain/workflowexecution/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GACrC,4EAA4E,CAAC;AAE/E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,2BAA2B,CAAC;AAExE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAC/C,sDAAsD,CAAC;AAEzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAC/C,mCAAmC,CAAC;AAEtC;;;;GAIG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAClD,mCAAmC,CAAC;AAEtC,0EAA0E;AAC1E,MAAM,UAAU,sBAAsB,CAAC,WAAmB;IACxD,OAAO,GAAG,uCAAuC,IAAI,WAAW,EAAE,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,WAAmB;IACjD,OAAO,iBAAiB,WAAW,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AACzC,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAC3C,MAAM,CAAC,MAAM,yBAAyB,GAAG,aAAa,CAAC;AAEvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,cAAc,CAAC;AAExD;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAC3C,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEvC;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,EAAE,CAAC;AACtD,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC"}
|
|
1
|
+
{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/domain/workflowexecution/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GACrC,4EAA4E,CAAC;AAE/E;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAkB;IACzD,OAAO,iCAAiC,UAAU,GAAG,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,kBAA0B;IAE1B,OAAO,0CAA0C,kBAAkB,GAAG,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,2BAA2B,CAAC;AAExE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAC/C,sDAAsD,CAAC;AAEzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAC/C,mCAAmC,CAAC;AAEtC;;;;GAIG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAClD,mCAAmC,CAAC;AAEtC,0EAA0E;AAC1E,MAAM,UAAU,sBAAsB,CAAC,WAAmB;IACxD,OAAO,GAAG,uCAAuC,IAAI,WAAW,EAAE,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,WAAmB;IACjD,OAAO,iBAAiB,WAAW,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AACzC,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAC3C,MAAM,CAAC,MAAM,yBAAyB,GAAG,aAAa,CAAC;AAEvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,cAAc,CAAC;AAExD;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAC3C,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEvC;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,EAAE,CAAC;AACtD,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/workflowexecution/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAkBzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAExE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAGzE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;
|
|
1
|
+
{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../src/domain/workflowexecution/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAkBzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAExE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAGzE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AAsCjG,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,sBAAsB,CAAC;AAEpF,OAAO,KAAK,EAAE,2CAA2C,EAAE,MAAM,2BAA2B,CAAC;AAG7F,OAAO,KAAK,EAAE,wCAAwC,EAAE,MAAM,mBAAmB,CAAC;AAOlF,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AAE9F,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAC;AAuBxE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAE9E,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAKvD,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kHAAkH;IAClH,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,qFAAqF;IACrF,QAAQ,CAAC,sBAAsB,EAAE,8BAA8B,GAAG,SAAS,CAAC;IAC5E,oFAAoF;IACpF,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;IAClD;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,oCAAoC,CAAC;IAC3D;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,uBAAuB,EAAE,wCAAwC,CAAC;IAC3E,QAAQ,CAAC,iBAAiB,EAAE,uCAAuC,CAAC;IACpE,QAAQ,CAAC,qBAAqB,EAAE,2CAA2C,CAAC;IAC5E,0EAA0E;IAC1E,QAAQ,CAAC,uBAAuB,EAAE,mCAAmC,CAAC;IACtE;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,6EAA6E;IAC7E,QAAQ,CAAC,cAAc,EAAE,+BAA+B,CAAC;IACzD;;;;OAIG;IACH,QAAQ,CAAC,uBAAuB,EAAE,+BAA+B,CAAC;CACnE;AAED,8EAA8E;AAC9E,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,+BAA+B,GACpC,IAAI,CAiDN"}
|
|
@@ -13,6 +13,7 @@ import { newPipeline } from "../../pipeline/pipeline.js";
|
|
|
13
13
|
import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
|
|
14
14
|
import { RequestContext } from "../../pipeline/request-context.js";
|
|
15
15
|
import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
|
|
16
|
+
import { newAuthorizeRunTargetStep } from "../../pipeline/steps/authorize-run-target.js";
|
|
16
17
|
import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
|
|
17
18
|
import { newBuildUpdateStateStep } from "../../pipeline/steps/build-update-state.js";
|
|
18
19
|
import { newBuildNewStateStep } from "../../pipeline/steps/defaults.js";
|
|
@@ -42,6 +43,7 @@ import { getEventLog } from "./get-event-log.js";
|
|
|
42
43
|
import { getExecutionSummary } from "./get-execution-summary.js";
|
|
43
44
|
import { listPendingApprovals } from "./list-pending-approvals.js";
|
|
44
45
|
import { loadAllWorkflowExecutions } from "./queries.js";
|
|
46
|
+
import { workflowExecutionRunTarget } from "./run-target.js";
|
|
45
47
|
import { workflowExecutionSearchExtractor } from "./search-extractor.js";
|
|
46
48
|
import { newEnsureWorkflowSandboxStep } from "../../sandbox/steps.js";
|
|
47
49
|
import { subscribeExecution } from "./subscribe.js";
|
|
@@ -91,6 +93,11 @@ export function registerWorkflowExecutionServices(router, deps) {
|
|
|
91
93
|
* Create — create.go buildCreatePipeline, step-for-step (the numbered
|
|
92
94
|
* 15-step chain): validation (proto → visibility → slug →
|
|
93
95
|
* workflow-or-instance presence, the #196 InvalidArgument contrast) →
|
|
96
|
+
* the run gate (AuthorizeRunTarget, P1 sp.run-gate: the first step after
|
|
97
|
+
* the target reference is guaranteed, asking workflow_instance#can_execute
|
|
98
|
+
* or workflow#can_execute by request shape — before the engine gate so a
|
|
99
|
+
* denied caller learns nothing about engine state, and before the workflow
|
|
100
|
+
* lookup, so a denial reads nothing) →
|
|
94
101
|
* the ENGINE GATE at its pinned position (before every side effect — a
|
|
95
102
|
* down engine orphans nothing; Go's unit test pins that it precedes even
|
|
96
103
|
* the workflow lookup) → default-instance resolution → the standard
|
|
@@ -107,6 +114,7 @@ async function createExecution(deps, execution, ctx) {
|
|
|
107
114
|
.addStep(newValidateVisibilityStep())
|
|
108
115
|
.addStep(newResolveSlugStep())
|
|
109
116
|
.addStep(newValidateWorkflowOrInstanceStep())
|
|
117
|
+
.addStep(newAuthorizeRunTargetStep(deps.authorizer, workflowExecutionRunTarget))
|
|
110
118
|
.addStep(newEnsureEngineAvailableStep(deps.engineState))
|
|
111
119
|
.addStep(newCreateDefaultInstanceIfNeededStep({
|
|
112
120
|
store: deps.store,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/workflowexecution/controller.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,uBAAuB,EAAE,MAAM,gEAAgE,CAAC;AAEzG,OAAO,EAAE,kCAAkC,EAAE,MAAM,oEAAoE,CAAC;AACxH,OAAO,EAAE,kBAAkB,EAAE,MAAM,+DAA+D,CAAC;AACnG,OAAO,EAAE,2BAA2B,EAAE,MAAM,+DAA+D,CAAC;AAO5G,OAAO,EAAE,gCAAgC,EAAE,MAAM,kEAAkE,CAAC;AAEpH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAK5C,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAG9E,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AACxF,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAI1E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAEhF,OAAO,EACL,oCAAoC,EACpC,sBAAsB,EACtB,oBAAoB,EACpB,iCAAiC,GAClC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AAEnF,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AAGzE,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AAGtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AA4DlD,8EAA8E;AAC9E,MAAM,UAAU,iCAAiC,CAC/C,MAAqB,EACrB,IAAqC;IAErC,MAAM,aAAa,GAAG;QACpB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;IACF,MAAM,CAAC,OAAO,CAAC,kCAAkC,EAAE;QACjD,MAAM,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC;QACjE,MAAM,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC;QACxD,YAAY,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAC3B,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAClD,cAAc,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAC7B,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACpD,kBAAkB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACjC,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxD,0BAA0B,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACzC,0BAA0B,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACnD,UAAU,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC1E,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACrB,eAAe,CAAC,aAAa,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC9D,SAAS,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACxB,kBAAkB,CAAC,aAAa,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACtB,gBAAgB,CAAC,aAAa,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC/D,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACpB,cAAc,CAAC,aAAa,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACrB,eAAe,CAAC,aAAa,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;KAC/D,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,gCAAgC,EAAE;QAC/C,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC1D,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC9E,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC3D,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxE,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC9D,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAChC,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACvD,oBAAoB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CACjC,oBAAoB,CAAC,IAAI,EAAE,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;KACzD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,eAAe,CAC5B,IAAqC,EACrC,SAA4B,EAC5B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,uBAAuB,EACvB,SAAS,EACT,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,OAAO,GAAG,WAAW,CACzB,0BAA0B,EAC1B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,kCAAkC,CAAC,MAAM,CAAC,MAAM,EAChD,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,yBAAyB,EAAE,CAAC;SACpC,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,iCAAiC,EAAE,CAAC;SAC5C,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;SACvD,OAAO,CACN,oCAAoC,CAAC;QACnC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;KACpD,CAAC,CACH;SACA,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,0BAA0B,EAAE,CAAC,CAAC;IACzC,qEAAqE;IACrE,uEAAuE;IACvE,mEAAmE;IACnE,kEAAkE;IAClE,wEAAwE;IACxE,KAAK,MAAM,IAAI,IAAI,YAAY,CAC7B,IAAI,CAAC,SAAS,EACd,0BAA0B,CAC3B,EAAE,CAAC;QACF,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,OAAO;SACV,OAAO,CAAC,sBAAsB,EAAE,CAAC;SACjC,OAAO,CAAC,2BAA2B,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SAC7D,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SAC3D,OAAO,CAAC,6BAA6B,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACrE,2DAA2D;QAC3D,qEAAqE;QACrE,mEAAmE;QACnE,6DAA6D;SAC5D,OAAO,CACN,4BAA4B,CAAC;QAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,IAAI,CAAC,WAAW;QACtB,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC,CACH;SACA,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,OAAO,CACN,gCAAgC,CAC9B,IAAI,CAAC,sBAAsB,EAC3B,IAAI,CAAC,MAAM,CACZ,CACF;SACA,OAAO,CACN,kBAAkB,CAChB,IAAI,CAAC,KAAK,EACV,gCAAgC,EAChC,IAAI,CAAC,MAAM,CACZ,CACF;SACA,OAAO,CACN,oBAAoB,CAAC;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CACH;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,MAAM,CACnB,IAAqC,EACrC,SAA4B,EAC5B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,uBAAuB,EACvB,SAAS,EACT,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,0BAA0B,EAC1B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,kCAAkC,CAAC,MAAM,CAAC,MAAM,EAChD,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,OAAO,CAAC,uBAAuB,EAAE,CAAC;SAClC,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,0BAA0B,EAAE,CAAC;SACrC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,OAAO,CACN,kBAAkB,CAChB,IAAI,CAAC,KAAK,EACV,gCAAgC,EAChC,IAAI,CAAC,MAAM,CACZ,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAC5B,IAAqC,EACrC,EAAiB,EACjB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,kCAAkC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EACtD,EAAE,EACF,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAEf,0BAA0B,EAAE,IAAI,CAAC,MAAM,CAAC;SACvC,OAAO,CACN,gBAAgB,CACd,kCAAkC,CAAC,MAAM,CAAC,MAAM,EAChD,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,wBAAwB,EAAE,CAAC;SACnC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;SAC1E,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CACN,yBAAyB,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SAC1D,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,iDAAiD,CAAC,EAC5D,iDAAiD,CAClD,CAAC;IACJ,CAAC;IACD,OAAO,OAA4B,CAAC;AACtC,CAAC;AAED,iEAAiE;AACjE,KAAK,UAAU,GAAG,CAChB,IAAqC,EACrC,EAAuB,EACvB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,gCAAgC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EACjD,EAAE,EACF,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,uBAAuB,EACvB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,gCAAgC,CAAC,MAAM,CAAC,GAAG,EAC3C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;SAC/D,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAsB,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,IAAI,CACjB,IAAqC,EACrC,GAAkC,EAClC,QAAwB;IAExB,IAAI,UAAU,GAAG,MAAM,uBAAuB,CAC5C,IAAI,CAAC,aAAa,EAClB,QAAQ,EACR,eAAe,CAAC,kBAAkB,EAClC,MAAM,yBAAyB,CAC7B,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,MAAM,EACX,oCAAoC,CACrC,EACD,GAAG,CAAC,GAAG,CACR,CAAC;IAEF,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,UAAU,GAAG,sBAAsB,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;IACD,UAAU,GAAG,mBAAmB,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAEzD,IAAI,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;IAC9B,IAAI,SAAS,GAAG,GAAG,CAAC,aAAa,CAAC;IAClC,IAAI,SAAS,KAAK,kBAAkB,CAAC,WAAW,EAAE,CAAC;QACjD,SAAS,GAAG,kBAAkB,CAAC,UAAU,CAAC;QAC1C,SAAS,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,cAAc,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAEjD,OAAO,MAAM,CAAC,2BAA2B,EAAE;QACzC,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,CAAC;KACd,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAC3B,IAAqC,EACrC,GAA4C,EAC5C,QAAwB;IAExB,IAAI,GAAG,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC1B,MAAM,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;IACxD,CAAC;IAED,oEAAoE;IACpE,gEAAgE;IAChE,MAAM,GAAG,GAAG,MAAM,uBAAuB,CACvC,IAAI,CAAC,aAAa,EAClB,QAAQ,EACR,eAAe,CAAC,kBAAkB,EAClC,MAAM,yBAAyB,CAC7B,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,MAAM,EACX,oCAAoC,CACrC,EACD,EAAE,CACH,CAAC;IACF,IAAI,UAAU,GAAG,GAAG,CAAC,MAAM,CACzB,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,IAAI,EAAE,kBAAkB,KAAK,GAAG,CAAC,UAAU;QACrD,SAAS,CAAC,IAAI,EAAE,UAAU,KAAK,GAAG,CAAC,UAAU,CAChD,CAAC;IAEF,UAAU,GAAG,mBAAmB,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAEzD,IAAI,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;IAC9B,IAAI,SAAS,GAAG,GAAG,CAAC,aAAa,CAAC;IAClC,IAAI,SAAS,KAAK,kBAAkB,CAAC,WAAW,EAAE,CAAC;QACjD,SAAS,GAAG,kBAAkB,CAAC,UAAU,CAAC;QAC1C,SAAS,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,cAAc,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAEjD,OAAO,MAAM,CAAC,2BAA2B,EAAE;QACzC,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,CAAC;KACd,CAAC,CAAC;AACL,CAAC"}
|
|
1
|
+
{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/workflowexecution/controller.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,uBAAuB,EAAE,MAAM,gEAAgE,CAAC;AAEzG,OAAO,EAAE,kCAAkC,EAAE,MAAM,oEAAoE,CAAC;AACxH,OAAO,EAAE,kBAAkB,EAAE,MAAM,+DAA+D,CAAC;AACnG,OAAO,EAAE,2BAA2B,EAAE,MAAM,+DAA+D,CAAC;AAO5G,OAAO,EAAE,gCAAgC,EAAE,MAAM,kEAAkE,CAAC;AAEpH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAK5C,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAG9E,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAC;AACzF,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AACxF,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAI1E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAEhF,OAAO,EACL,oCAAoC,EACpC,sBAAsB,EACtB,oBAAoB,EACpB,iCAAiC,GAClC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AAEnF,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AAGzE,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AAGtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AA4DlD,8EAA8E;AAC9E,MAAM,UAAU,iCAAiC,CAC/C,MAAqB,EACrB,IAAqC;IAErC,MAAM,aAAa,GAAG;QACpB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;IACF,MAAM,CAAC,OAAO,CAAC,kCAAkC,EAAE;QACjD,MAAM,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC;QACjE,MAAM,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC;QACxD,YAAY,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAC3B,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAClD,cAAc,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAC7B,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACpD,kBAAkB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACjC,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxD,0BAA0B,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACzC,0BAA0B,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACnD,UAAU,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC1E,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACrB,eAAe,CAAC,aAAa,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC9D,SAAS,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACxB,kBAAkB,CAAC,aAAa,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACtB,gBAAgB,CAAC,aAAa,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC/D,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACpB,cAAc,CAAC,aAAa,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACrB,eAAe,CAAC,aAAa,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;KAC/D,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,gCAAgC,EAAE;QAC/C,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC1D,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC9E,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC3D,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxE,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC9D,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAChC,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACvD,oBAAoB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CACjC,oBAAoB,CAAC,IAAI,EAAE,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;KACzD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,KAAK,UAAU,eAAe,CAC5B,IAAqC,EACrC,SAA4B,EAC5B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,uBAAuB,EACvB,SAAS,EACT,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,OAAO,GAAG,WAAW,CACzB,0BAA0B,EAC1B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,kCAAkC,CAAC,MAAM,CAAC,MAAM,EAChD,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,yBAAyB,EAAE,CAAC;SACpC,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,iCAAiC,EAAE,CAAC;SAC5C,OAAO,CACN,yBAAyB,CAAC,IAAI,CAAC,UAAU,EAAE,0BAA0B,CAAC,CACvE;SACA,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;SACvD,OAAO,CACN,oCAAoC,CAAC;QACnC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;KACpD,CAAC,CACH;SACA,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,0BAA0B,EAAE,CAAC,CAAC;IACzC,qEAAqE;IACrE,uEAAuE;IACvE,mEAAmE;IACnE,kEAAkE;IAClE,wEAAwE;IACxE,KAAK,MAAM,IAAI,IAAI,YAAY,CAC7B,IAAI,CAAC,SAAS,EACd,0BAA0B,CAC3B,EAAE,CAAC;QACF,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,OAAO;SACV,OAAO,CAAC,sBAAsB,EAAE,CAAC;SACjC,OAAO,CAAC,2BAA2B,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SAC7D,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SAC3D,OAAO,CAAC,6BAA6B,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACrE,2DAA2D;QAC3D,qEAAqE;QACrE,mEAAmE;QACnE,6DAA6D;SAC5D,OAAO,CACN,4BAA4B,CAAC;QAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,IAAI,CAAC,WAAW;QACtB,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC,CACH;SACA,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,OAAO,CACN,gCAAgC,CAC9B,IAAI,CAAC,sBAAsB,EAC3B,IAAI,CAAC,MAAM,CACZ,CACF;SACA,OAAO,CACN,kBAAkB,CAChB,IAAI,CAAC,KAAK,EACV,gCAAgC,EAChC,IAAI,CAAC,MAAM,CACZ,CACF;SACA,OAAO,CACN,oBAAoB,CAAC;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CACH;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,MAAM,CACnB,IAAqC,EACrC,SAA4B,EAC5B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,uBAAuB,EACvB,SAAS,EACT,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,0BAA0B,EAC1B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,kCAAkC,CAAC,MAAM,CAAC,MAAM,EAChD,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,OAAO,CAAC,uBAAuB,EAAE,CAAC;SAClC,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,0BAA0B,EAAE,CAAC;SACrC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,OAAO,CACN,kBAAkB,CAChB,IAAI,CAAC,KAAK,EACV,gCAAgC,EAChC,IAAI,CAAC,MAAM,CACZ,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAC5B,IAAqC,EACrC,EAAiB,EACjB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,kCAAkC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EACtD,EAAE,EACF,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAEf,0BAA0B,EAAE,IAAI,CAAC,MAAM,CAAC;SACvC,OAAO,CACN,gBAAgB,CACd,kCAAkC,CAAC,MAAM,CAAC,MAAM,EAChD,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,wBAAwB,EAAE,CAAC;SACnC,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;SAC1E,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CACN,yBAAyB,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SAC1D,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,iDAAiD,CAAC,EAC5D,iDAAiD,CAClD,CAAC;IACJ,CAAC;IACD,OAAO,OAA4B,CAAC;AACtC,CAAC;AAED,iEAAiE;AACjE,KAAK,UAAU,GAAG,CAChB,IAAqC,EACrC,EAAuB,EACvB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,gCAAgC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EACjD,EAAE,EACF,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,uBAAuB,EACvB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,gCAAgC,CAAC,MAAM,CAAC,GAAG,EAC3C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;SAC/D,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAsB,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,IAAI,CACjB,IAAqC,EACrC,GAAkC,EAClC,QAAwB;IAExB,IAAI,UAAU,GAAG,MAAM,uBAAuB,CAC5C,IAAI,CAAC,aAAa,EAClB,QAAQ,EACR,eAAe,CAAC,kBAAkB,EAClC,MAAM,yBAAyB,CAC7B,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,MAAM,EACX,oCAAoC,CACrC,EACD,GAAG,CAAC,GAAG,CACR,CAAC;IAEF,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,UAAU,GAAG,sBAAsB,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;IACD,UAAU,GAAG,mBAAmB,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAEzD,IAAI,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;IAC9B,IAAI,SAAS,GAAG,GAAG,CAAC,aAAa,CAAC;IAClC,IAAI,SAAS,KAAK,kBAAkB,CAAC,WAAW,EAAE,CAAC;QACjD,SAAS,GAAG,kBAAkB,CAAC,UAAU,CAAC;QAC1C,SAAS,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,cAAc,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAEjD,OAAO,MAAM,CAAC,2BAA2B,EAAE;QACzC,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,CAAC;KACd,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAC3B,IAAqC,EACrC,GAA4C,EAC5C,QAAwB;IAExB,IAAI,GAAG,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC1B,MAAM,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;IACxD,CAAC;IAED,oEAAoE;IACpE,gEAAgE;IAChE,MAAM,GAAG,GAAG,MAAM,uBAAuB,CACvC,IAAI,CAAC,aAAa,EAClB,QAAQ,EACR,eAAe,CAAC,kBAAkB,EAClC,MAAM,yBAAyB,CAC7B,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,MAAM,EACX,oCAAoC,CACrC,EACD,EAAE,CACH,CAAC;IACF,IAAI,UAAU,GAAG,GAAG,CAAC,MAAM,CACzB,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,IAAI,EAAE,kBAAkB,KAAK,GAAG,CAAC,UAAU;QACrD,SAAS,CAAC,IAAI,EAAE,UAAU,KAAK,GAAG,CAAC,UAAU,CAChD,CAAC;IAEF,UAAU,GAAG,mBAAmB,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAEzD,IAAI,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;IAC9B,IAAI,SAAS,GAAG,GAAG,CAAC,aAAa,CAAC;IAClC,IAAI,SAAS,KAAK,kBAAkB,CAAC,WAAW,EAAE,CAAC;QACjD,SAAS,GAAG,kBAAkB,CAAC,UAAU,CAAC;QAC1C,SAAS,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,cAAc,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAEjD,OAAO,MAAM,CAAC,2BAA2B,EAAE;QACzC,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,CAAC;KACd,CAAC,CAAC;AACL,CAAC"}
|
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* The workflow-execution run-target resolver (P1 sp.run-gate): the chain's
|
|
3
|
+
* own precedence — an explicit workflow_instance_id fully names the target
|
|
4
|
+
* (CreateDefaultInstanceIfNeeded returns early on it):
|
|
5
|
+
* workflow_instance#can_execute; else workflow_id names the blueprint whose
|
|
6
|
+
* default instance the chain resolves (or mints) only AFTER the gate:
|
|
7
|
+
* workflow#can_execute (the model derives the default instance's viewers
|
|
8
|
+
* from the blueprint's, so asking the blueprint's question is what lets the
|
|
9
|
+
* gate precede the side effect).
|
|
10
|
+
*
|
|
11
|
+
* Neither set is ValidateWorkflowOrInstance's INVALID_ARGUMENT, thrown
|
|
12
|
+
* before this resolver runs — never a check. Pure over the record being
|
|
13
|
+
* built.
|
|
14
|
+
*/
|
|
15
|
+
import type { WorkflowExecution } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/api_pb";
|
|
16
|
+
import { type RunTarget } from "../../pipeline/steps/authorize-run-target.js";
|
|
17
|
+
export declare function workflowExecutionRunTarget(execution: WorkflowExecution): RunTarget | undefined;
|
|
18
|
+
//# sourceMappingURL=run-target.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"run-target.d.ts","sourceRoot":"","sources":["../../../src/domain/workflowexecution/run-target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gEAAgE,CAAC;AAExG,OAAO,EAEL,KAAK,SAAS,EACf,MAAM,8CAA8C,CAAC;AAMtD,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,iBAAiB,GAC3B,SAAS,GAAG,SAAS,CAmBvB"}
|
|
@@ -0,0 +1,23 @@
|
|
|
1
|
+
import { RUN_GATE_CHECKS, } from "../../pipeline/steps/authorize-run-target.js";
|
|
2
|
+
import { runWorkflowDeniedMessage, runWorkflowInstanceDeniedMessage, } from "./constants.js";
|
|
3
|
+
export function workflowExecutionRunTarget(execution) {
|
|
4
|
+
const spec = execution.spec;
|
|
5
|
+
const workflowInstanceId = spec?.workflowInstanceId ?? "";
|
|
6
|
+
if (workflowInstanceId !== "") {
|
|
7
|
+
return {
|
|
8
|
+
...RUN_GATE_CHECKS.workflowInstance,
|
|
9
|
+
resourceId: workflowInstanceId,
|
|
10
|
+
deniedMessage: runWorkflowInstanceDeniedMessage(workflowInstanceId),
|
|
11
|
+
};
|
|
12
|
+
}
|
|
13
|
+
const workflowId = spec?.workflowId ?? "";
|
|
14
|
+
if (workflowId !== "") {
|
|
15
|
+
return {
|
|
16
|
+
...RUN_GATE_CHECKS.workflow,
|
|
17
|
+
resourceId: workflowId,
|
|
18
|
+
deniedMessage: runWorkflowDeniedMessage(workflowId),
|
|
19
|
+
};
|
|
20
|
+
}
|
|
21
|
+
return undefined;
|
|
22
|
+
}
|
|
23
|
+
//# sourceMappingURL=run-target.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"run-target.js","sourceRoot":"","sources":["../../../src/domain/workflowexecution/run-target.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,eAAe,GAEhB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,wBAAwB,EACxB,gCAAgC,GACjC,MAAM,gBAAgB,CAAC;AAExB,MAAM,UAAU,0BAA0B,CACxC,SAA4B;IAE5B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;IAC5B,MAAM,kBAAkB,GAAG,IAAI,EAAE,kBAAkB,IAAI,EAAE,CAAC;IAC1D,IAAI,kBAAkB,KAAK,EAAE,EAAE,CAAC;QAC9B,OAAO;YACL,GAAG,eAAe,CAAC,gBAAgB;YACnC,UAAU,EAAE,kBAAkB;YAC9B,aAAa,EAAE,gCAAgC,CAAC,kBAAkB,CAAC;SACpE,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC;IAC1C,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACtB,OAAO;YACL,GAAG,eAAe,CAAC,QAAQ;YAC3B,UAAU,EAAE,UAAU;YACtB,aAAa,EAAE,wBAAwB,CAAC,UAAU,CAAC;SACpD,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
|
|
@@ -23,6 +23,9 @@
|
|
|
23
23
|
* - schedule-fire caller (who a schedule fire acts as) — landed with
|
|
24
24
|
* the stigmer-cloud#572 fix (the Java schedule-token mechanism's
|
|
25
25
|
* seam; ruled 2026-09-01)
|
|
26
|
+
* - identity-account store + identity federation (the first domain
|
|
27
|
+
* whose persistence is a PORT, and the four federated RPC arms only
|
|
28
|
+
* one edition serves) — landed with 20260911.11, gate ruling Q-IA-9
|
|
26
29
|
*
|
|
27
30
|
* Merge rules (enforced by resolveExtensions, DD-006 §2b): the two
|
|
28
31
|
* provider kinds are single-instance points — a second declaring unit is
|
|
@@ -36,11 +39,13 @@
|
|
|
36
39
|
*/
|
|
37
40
|
import type { ArtifactStorageDriverFactory } from "../artifactstorage/artifact-storage.js";
|
|
38
41
|
import type { ChannelRuntime } from "../domain/agentchannel/channel-runtime.js";
|
|
42
|
+
import type { IdentityAccountStore } from "../domain/identityaccount/store.js";
|
|
39
43
|
import type { SecretCodec } from "../encryption/codec.js";
|
|
40
44
|
import type { ModelCatalogProvider } from "../domain/workflow/registry/model-catalog-provider.js";
|
|
41
45
|
import type { VisitorErrorPolicy } from "../pipeline/interceptors/error-boundary.js";
|
|
42
46
|
import type { RunnerCredentialProvider } from "../runnerauth/runner-credential-provider.js";
|
|
43
47
|
import type { SandboxProvisionerFactory } from "../sandbox/provisioner.js";
|
|
48
|
+
import type { IdentityFederation } from "./identity-federation.js";
|
|
44
49
|
import type { ListReadScope } from "./list-read-scope.js";
|
|
45
50
|
import type { OrganizationDirectory } from "./organization-directory.js";
|
|
46
51
|
import type { ResourceAuthorizationLifecycle } from "./resource-authorization.js";
|
|
@@ -136,5 +141,26 @@ export interface ExtensionDrivers {
|
|
|
136
141
|
* the `internal` class — OSS behavior byte-identical.
|
|
137
142
|
*/
|
|
138
143
|
readonly scheduleFireCaller?: ScheduleFireCallerMint;
|
|
144
|
+
/**
|
|
145
|
+
* The identity-account store driver (20260911.11, Q-IA-9;
|
|
146
|
+
* single-instance point). The identity-account domain is the first
|
|
147
|
+
* whose persistence is a PORT rather than the generic Store: when
|
|
148
|
+
* composed, the domain's every read and write — the create path, the
|
|
149
|
+
* provisioner, the boot-time operator ensure and BOTH OSS verifiers'
|
|
150
|
+
* subject resolution — goes through this driver (the cloud serves the
|
|
151
|
+
* domain over its own `cloud.iam_identity_account` table this way).
|
|
152
|
+
* When absent, the OSS adapter over the generic Store installs at the
|
|
153
|
+
* compose.ts consumption site — OSS behavior byte-identical.
|
|
154
|
+
*/
|
|
155
|
+
readonly identityAccountStore?: IdentityAccountStore;
|
|
156
|
+
/**
|
|
157
|
+
* The identity-federation capability (20260911.11, Q-IA-9;
|
|
158
|
+
* single-instance point): the four federated-account RPC arms plus the
|
|
159
|
+
* IdP-exists probe their shared precondition rides. When composed, the
|
|
160
|
+
* identity-account controller dispatches to it after its own shared
|
|
161
|
+
* checks; when absent, the four RPCs refuse UNIMPLEMENTED with the
|
|
162
|
+
* edition reason — the organizationDirectory absent-method shape.
|
|
163
|
+
*/
|
|
164
|
+
readonly identityFederation?: IdentityFederation;
|
|
139
165
|
}
|
|
140
166
|
//# sourceMappingURL=drivers.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"drivers.d.ts","sourceRoot":"","sources":["../../src/extensions/drivers.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"drivers.d.ts","sourceRoot":"","sources":["../../src/extensions/drivers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAC3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uDAAuD,CAAC;AAClG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAExE,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IAC7D;;;;OAIG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,WAAW,CAC3C,MAAM,EACN,4BAA4B,CAC7B,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,WAAW,CAC9C,MAAM,EACN,yBAAyB,CAC1B,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,8BAA8B,CAAC;IACzE;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACzD;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;IACrD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CAClD"}
|
|
@@ -19,6 +19,21 @@
|
|
|
19
19
|
* splice — its capacity gates ride the two declared agent-execution
|
|
20
20
|
* slots, whose positions coincide exactly with the Java session gate.
|
|
21
21
|
*
|
|
22
|
+
* 20260911.11 (Q-IA-9) declares the seventh,
|
|
23
|
+
* `identity-account-provision:post-persist`: inside provisionMyAccount,
|
|
24
|
+
* after the provisioner has answered the caller's row — created on this
|
|
25
|
+
* call or found by the idempotent early return — and before the reply,
|
|
26
|
+
* with the caller RE-STAMPED as the account (the position-1 identity was
|
|
27
|
+
* idp-shaped because no row existed when the verifier ran). It fires on
|
|
28
|
+
* EVERY provisionMyAccount, not only the creating one: the cloud's
|
|
29
|
+
* personal-organization step backfills accounts that predate personal
|
|
30
|
+
* organizations on the idempotent path, which is exactly why a slot was
|
|
31
|
+
* chosen over the tuple lifecycle's onResourceCreated (never fired for a
|
|
32
|
+
* row that already exists). Never on the create RPC and never at the
|
|
33
|
+
* boot-time operator ensure, which take the create path, not this one.
|
|
34
|
+
* Non-transactional in the `org-create:post-persist` sense: a gate
|
|
35
|
+
* failure fails the request, the row survives, the next call heals.
|
|
36
|
+
*
|
|
22
37
|
* Two enforcement layers, deliberately redundant, both derived from the
|
|
23
38
|
* ONE literal tuple below (lockstep by construction):
|
|
24
39
|
* - GateSlotName (compile time): the union of declared slot literals.
|
|
@@ -46,7 +61,7 @@ import type { PipelineStep } from "../pipeline/pipeline.js";
|
|
|
46
61
|
* owner-visible slot additions — each entry cites its chain position in
|
|
47
62
|
* the guidelines' slot table, which must match the splice sites exactly.
|
|
48
63
|
*/
|
|
49
|
-
export declare const GATE_SLOT_NAMES: readonly ["agent-execution-create:pre-side-effect-gate", "agent-execution-recover:pre-side-effect-gate", "agent-execution-submit-approval:gate", "session-create:pre-side-effect-gate", "org-create:post-persist", "sandbox-acquisition:gate"];
|
|
64
|
+
export declare const GATE_SLOT_NAMES: readonly ["agent-execution-create:pre-side-effect-gate", "agent-execution-recover:pre-side-effect-gate", "agent-execution-submit-approval:gate", "session-create:pre-side-effect-gate", "org-create:post-persist", "sandbox-acquisition:gate", "identity-account-provision:post-persist"];
|
|
50
65
|
/** The declared slot-name union — a registration outside it fails tsc. */
|
|
51
66
|
export type GateSlotName = (typeof GATE_SLOT_NAMES)[number];
|
|
52
67
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"gate-slots.d.ts","sourceRoot":"","sources":["../../src/extensions/gate-slots.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"gate-slots.d.ts","sourceRoot":"","sources":["../../src/extensions/gate-slots.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,eAAe,2RAQlB,CAAC;AAEX,0EAA0E;AAC1E,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAEnD,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,WAAW,CACzC,MAAM,EACN,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CACzC,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,SAAS,WAAW,EACnD,SAAS,EAAE,iBAAiB,EAC5B,IAAI,EAAE,YAAY,GACjB,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAOnC"}
|
|
@@ -10,6 +10,7 @@ export const GATE_SLOT_NAMES = [
|
|
|
10
10
|
"session-create:pre-side-effect-gate",
|
|
11
11
|
"org-create:post-persist",
|
|
12
12
|
"sandbox-acquisition:gate",
|
|
13
|
+
"identity-account-provision:post-persist",
|
|
13
14
|
];
|
|
14
15
|
/**
|
|
15
16
|
* The boot-time declared-slot set — resolveExtensions validates every
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"gate-slots.js","sourceRoot":"","sources":["../../src/extensions/gate-slots.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"gate-slots.js","sourceRoot":"","sources":["../../src/extensions/gate-slots.ts"],"names":[],"mappings":"AA4DA;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,6CAA6C;IAC7C,8CAA8C;IAC9C,sCAAsC;IACtC,qCAAqC;IACrC,yBAAyB;IACzB,0BAA0B;IAC1B,yCAAyC;CACjC,CAAC;AAKX;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAC7D,eAAe,CAChB,CAAC;AAWF;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,SAA4B,EAC5B,IAAkB;IAElB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACxC,kDAAkD;IAClD,oEAAoE;IACpE,sEAAsE;IACtE,cAAc;IACd,OAAO,KAA0C,CAAC;AACpD,CAAC"}
|
|
@@ -0,0 +1,36 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* The identity-federation capability (20260911.11, Q-IA-9): the four
|
|
3
|
+
* federated-account RPC arms the identity-account controller dispatches
|
|
4
|
+
* to when a composed unit provides them, plus the identity-provider
|
|
5
|
+
* existence check their shared precondition rides. Single instance,
|
|
6
|
+
* registered as `drivers.identityFederation` (the organizationDirectory
|
|
7
|
+
* shape: a driver point that is byte-identical OSS behaviour when absent).
|
|
8
|
+
*
|
|
9
|
+
* Absent, the controller refuses the four RPCs UNIMPLEMENTED with the
|
|
10
|
+
* edition reason (domain/identityaccount/constants.ts) — never INTERNAL,
|
|
11
|
+
* the organization directory's absent-method precedent. Present, the
|
|
12
|
+
* controller still owns what is shared: the annotation's Authorize step
|
|
13
|
+
* on the organization, the ref-with-slug and org-match checks, and the
|
|
14
|
+
* IdP-exists refusal through `providerExists`; the arm receives the
|
|
15
|
+
* RESOLVED ref (org filled from the input when the ref left it empty)
|
|
16
|
+
* and the authenticated caller, and owns only what differs per edition —
|
|
17
|
+
* the natural-key lookups and writes on the federated rows.
|
|
18
|
+
*
|
|
19
|
+
* The federated natural key (provider ref + external subject) and its
|
|
20
|
+
* lookups stay on the unit's own store: the IdentityAccountStore port
|
|
21
|
+
* carries direct-account methods only, because a port does not carry
|
|
22
|
+
* methods only one edition calls.
|
|
23
|
+
*/
|
|
24
|
+
import type { ApiResourceReference } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
|
|
25
|
+
import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
|
|
26
|
+
import type { CreateFederatedAccountInput, DeprovisionFederatedAccountInput, ExternalSubLookup, UpdateFederatedAccountInput } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/io_pb";
|
|
27
|
+
import type { CallerIdentity } from "./identity.js";
|
|
28
|
+
export interface IdentityFederation {
|
|
29
|
+
createFederatedAccount(input: CreateFederatedAccountInput, ref: ApiResourceReference, caller: CallerIdentity): Promise<IdentityAccount>;
|
|
30
|
+
updateFederatedAccount(input: UpdateFederatedAccountInput, ref: ApiResourceReference, caller: CallerIdentity): Promise<IdentityAccount>;
|
|
31
|
+
deprovisionFederatedAccount(input: DeprovisionFederatedAccountInput, ref: ApiResourceReference, caller: CallerIdentity): Promise<IdentityAccount>;
|
|
32
|
+
getByExternalSub(lookup: ExternalSubLookup, ref: ApiResourceReference, caller: CallerIdentity): Promise<IdentityAccount>;
|
|
33
|
+
/** Whether the IdentityProvider `org/slug` exists — the arms' shared precondition. */
|
|
34
|
+
providerExists(org: string, slug: string): Promise<boolean>;
|
|
35
|
+
}
|
|
36
|
+
//# sourceMappingURL=identity-federation.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"identity-federation.d.ts","sourceRoot":"","sources":["../../src/extensions/identity-federation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AACjG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EACV,2BAA2B,EAC3B,gCAAgC,EAChC,iBAAiB,EACjB,2BAA2B,EAC5B,MAAM,yDAAyD,CAAC;AAEjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,WAAW,kBAAkB;IACjC,sBAAsB,CACpB,KAAK,EAAE,2BAA2B,EAClC,GAAG,EAAE,oBAAoB,EACzB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5B,sBAAsB,CACpB,KAAK,EAAE,2BAA2B,EAClC,GAAG,EAAE,oBAAoB,EACzB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5B,2BAA2B,CACzB,KAAK,EAAE,gCAAgC,EACvC,GAAG,EAAE,oBAAoB,EACzB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5B,gBAAgB,CACd,MAAM,EAAE,iBAAiB,EACzB,GAAG,EAAE,oBAAoB,EACzB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5B,sFAAsF;IACtF,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7D"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"identity-federation.js","sourceRoot":"","sources":["../../src/extensions/identity-federation.ts"],"names":[],"mappings":""}
|
|
@@ -30,14 +30,20 @@
|
|
|
30
30
|
* provider) and O6's sandbox provisioners are consumed at their
|
|
31
31
|
* compose.ts construction sites; the require-authentication posture
|
|
32
32
|
* (20260904.02) is consumed where compose.ts builds the serving chain's
|
|
33
|
-
* identity source, OR'd with the OIDC-issuer arm
|
|
33
|
+
* identity source, OR'd with the OIDC-issuer arm; the identity-account
|
|
34
|
+
* points (20260911.11) at the identity-accounts stage (the store driver,
|
|
35
|
+
* ahead of the boot-time operator ensure) and the routes stage (the
|
|
36
|
+
* federation capability and the provision slot's steps, into the
|
|
37
|
+
* identity-account controller).
|
|
34
38
|
*/
|
|
35
39
|
import type { DescMessage } from "@bufbuild/protobuf";
|
|
36
40
|
import type { ConnectRouter } from "@connectrpc/connect";
|
|
37
41
|
import { ServerEdition } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
|
|
38
42
|
import type { ArtifactStorageDriverFactory } from "../artifactstorage/artifact-storage.js";
|
|
39
43
|
import type { ChannelRuntime } from "../domain/agentchannel/channel-runtime.js";
|
|
44
|
+
import type { IdentityAccountStore } from "../domain/identityaccount/store.js";
|
|
40
45
|
import type { SecretCodec } from "../encryption/codec.js";
|
|
46
|
+
import type { IdentityFederation } from "./identity-federation.js";
|
|
41
47
|
import type { ListReadScope } from "./list-read-scope.js";
|
|
42
48
|
import type { ModelCatalogProvider } from "../domain/workflow/registry/model-catalog-provider.js";
|
|
43
49
|
import type { VisitorErrorPolicy } from "../pipeline/interceptors/error-boundary.js";
|
|
@@ -210,6 +216,17 @@ export interface ResolvedExtensionDrivers {
|
|
|
210
216
|
* codec in and resolves the write version fail-fast.
|
|
211
217
|
*/
|
|
212
218
|
readonly secretCodecs: ReadonlyMap<string, SecretCodec>;
|
|
219
|
+
/**
|
|
220
|
+
* The 20260911.11 identity-account store driver — undefined = the
|
|
221
|
+
* compose.ts identity-accounts stage installs the OSS adapter over the
|
|
222
|
+
* generic Store, OSS behavior byte-identical.
|
|
223
|
+
*/
|
|
224
|
+
readonly identityAccountStore: IdentityAccountStore | undefined;
|
|
225
|
+
/**
|
|
226
|
+
* The 20260911.11 identity-federation capability — undefined = the
|
|
227
|
+
* four federated RPCs refuse UNIMPLEMENTED with the edition reason.
|
|
228
|
+
*/
|
|
229
|
+
readonly identityFederation: IdentityFederation | undefined;
|
|
213
230
|
}
|
|
214
231
|
/**
|
|
215
232
|
* Merges the composed units, enforcing the §2b loud-fail rules. Runs
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/extensions/registry.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/extensions/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAEtF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAE3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uDAAuD,CAAC;AAClG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAExE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,KAAK,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC7B,MAAM,mBAAmB,CAAC;AAE3B;;;;;;GAMG;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;AAE3E;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,+EAA+E;IAC/E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC7D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IACnD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAC9B,YAAY,EACZ,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CACzC,CAAC;IACF,oEAAoE;IACpE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,yBAAyB,CAAC;IAC3D,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;IACpC,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;IAChE,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CACjD;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC5E;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC5D,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAClD,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;IACtE,QAAQ,CAAC,kBAAkB,EAAE,aAAa,CAAC,+BAA+B,CAAC,CAAC;IAC5E,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;IAC/D,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CAChD;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,wBAAwB,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACxE,0EAA0E;IAC1E,QAAQ,CAAC,8BAA8B,EACnC,8BAA8B,GAC9B,SAAS,CAAC;IACd,sEAAsE;IACtE,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAClE,uEAAuE;IACvE,QAAQ,CAAC,sBAAsB,EAAE,WAAW,CAC1C,MAAM,EACN,4BAA4B,CAC7B,CAAC;IACF,6EAA6E;IAC7E,QAAQ,CAAC,yBAAyB,EAAE,WAAW,CAC7C,MAAM,EACN,yBAAyB,CAC1B,CAAC;IACF;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,GAAG,SAAS,CAAC;IACpD,uEAAuE;IACvE,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;IAClD;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC5D;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAChE;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACxD;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAChE;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,SAAS,CAAC;CAC7D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,GAAE,aAAa,CAAC,eAAe,CAAM,GACzC,kBAAkB,CAoUpB"}
|
|
@@ -39,6 +39,10 @@ export function resolveExtensions(units = []) {
|
|
|
39
39
|
let visitorErrorPolicyDeclaredBy;
|
|
40
40
|
let scheduleFireCaller;
|
|
41
41
|
let scheduleFireCallerDeclaredBy;
|
|
42
|
+
let identityAccountStore;
|
|
43
|
+
let identityAccountStoreDeclaredBy;
|
|
44
|
+
let identityFederation;
|
|
45
|
+
let identityFederationDeclaredBy;
|
|
42
46
|
const artifactStorageDrivers = new Map();
|
|
43
47
|
const storageDriverDeclaredBy = new Map();
|
|
44
48
|
const sandboxProvisionerDrivers = new Map();
|
|
@@ -133,6 +137,20 @@ export function resolveExtensions(units = []) {
|
|
|
133
137
|
scheduleFireCaller = unit.drivers.scheduleFireCaller;
|
|
134
138
|
scheduleFireCallerDeclaredBy = unit.name;
|
|
135
139
|
}
|
|
140
|
+
if (unit.drivers?.identityAccountStore !== undefined) {
|
|
141
|
+
if (identityAccountStoreDeclaredBy !== undefined) {
|
|
142
|
+
throw new Error(`extension '${unit.name}' registers an IdentityAccountStore, but '${identityAccountStoreDeclaredBy}' already did — exactly one may be composed`);
|
|
143
|
+
}
|
|
144
|
+
identityAccountStore = unit.drivers.identityAccountStore;
|
|
145
|
+
identityAccountStoreDeclaredBy = unit.name;
|
|
146
|
+
}
|
|
147
|
+
if (unit.drivers?.identityFederation !== undefined) {
|
|
148
|
+
if (identityFederationDeclaredBy !== undefined) {
|
|
149
|
+
throw new Error(`extension '${unit.name}' registers an IdentityFederation, but '${identityFederationDeclaredBy}' already did — exactly one may be composed`);
|
|
150
|
+
}
|
|
151
|
+
identityFederation = unit.drivers.identityFederation;
|
|
152
|
+
identityFederationDeclaredBy = unit.name;
|
|
153
|
+
}
|
|
136
154
|
if (unit.drivers?.artifactStorageDrivers !== undefined) {
|
|
137
155
|
for (const [name, factory] of unit.drivers.artifactStorageDrivers) {
|
|
138
156
|
if (BUILT_IN_STORAGE_TYPES.includes(name)) {
|
|
@@ -222,6 +240,8 @@ export function resolveExtensions(units = []) {
|
|
|
222
240
|
visitorErrorPolicy,
|
|
223
241
|
secretCodecs,
|
|
224
242
|
scheduleFireCaller,
|
|
243
|
+
identityAccountStore,
|
|
244
|
+
identityFederation,
|
|
225
245
|
},
|
|
226
246
|
services,
|
|
227
247
|
workers,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/extensions/registry.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/extensions/registry.ts"],"names":[],"mappings":"AAyCA,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAGtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAIhF,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AASvD,OAAO,EAAE,kCAAkC,EAAE,MAAM,2BAA2B,CAAC;AAK/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAgMtD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAwC,EAAE;IAE1C,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,iBAAiB,GAAuB,EAAE,CAAC;IACjD,MAAM,YAAY,GAAkB,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoD,CAAC;IAC9E,MAAM,eAAe,GAAmC,EAAE,CAAC;IAC3D,MAAM,kBAAkB,GAAsC,EAAE,CAAC;IACjE,MAAM,QAAQ,GAAmC,EAAE,CAAC;IACpD,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,IAAI,OAAkC,CAAC;IACvC,IAAI,iBAAqC,CAAC;IAC1C,IAAI,+BAAmD,CAAC;IACxD,IAAI,UAAkC,CAAC;IACvC,IAAI,oBAAwC,CAAC;IAC7C,IAAI,oBAAsD,CAAC;IAC3D,IAAI,iBAAqC,CAAC;IAC1C,IAAI,wBAA8D,CAAC;IACnE,IAAI,oBAAwC,CAAC;IAC7C,IAAI,8BAES,CAAC;IACd,IAAI,gCAAoD,CAAC;IACzD,IAAI,qBAAwD,CAAC;IAC7D,IAAI,+BAAmD,CAAC;IACxD,IAAI,cAA0C,CAAC;IAC/C,IAAI,wBAA4C,CAAC;IACjD,IAAI,aAAwC,CAAC;IAC7C,IAAI,uBAA2C,CAAC;IAChD,IAAI,kBAAkD,CAAC;IACvD,IAAI,4BAAgD,CAAC;IACrD,IAAI,kBAAsD,CAAC;IAC3D,IAAI,4BAAgD,CAAC;IACrD,IAAI,oBAAsD,CAAC;IAC3D,IAAI,8BAAkD,CAAC;IACvD,IAAI,kBAAkD,CAAC;IACvD,IAAI,4BAAgD,CAAC;IACrD,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAGnC,CAAC;IACJ,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1D,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAGtC,CAAC;IACJ,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1D,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IACpD,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAExD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,uHAAuH,CACxH,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,CAAC,IAAI,4DAA4D,CACnG,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE1B,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,OAAO,KAAK,aAAa,CAAC,0BAA0B,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,gGAAgG,CACxH,CAAC;YACJ,CAAC;YACD,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,uCAAuC,iBAAiB,+DAA+D,CAC/I,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YACvB,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC;QAChC,CAAC;QAED,IAAI,IAAI,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;YAC7C,IAAI,+BAA+B,KAAK,SAAS,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,uDAAuD,+BAA+B,sDAAsD,CACpK,CAAC;YACJ,CAAC;YACD,+BAA+B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC9C,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,mCAAmC,oBAAoB,wDAAwD,CACvI,CAAC;YACJ,CAAC;YACD,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YAC7B,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC;QACnC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACrD,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,4CAA4C,iBAAiB,6CAA6C,CAClI,CAAC;YACJ,CAAC;YACD,oBAAoB,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;YACzD,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC;QAChC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,wBAAwB,KAAK,SAAS,EAAE,CAAC;YACzD,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,gDAAgD,oBAAoB,6CAA6C,CACzI,CAAC;YACJ,CAAC;YACD,wBAAwB,GAAG,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC;YACjE,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC;QACnC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,8BAA8B,KAAK,SAAS,EAAE,CAAC;YAC/D,IAAI,gCAAgC,KAAK,SAAS,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,sDAAsD,gCAAgC,6CAA6C,CAC3J,CAAC;YACJ,CAAC;YACD,8BAA8B;gBAC5B,IAAI,CAAC,OAAO,CAAC,8BAA8B,CAAC;YAC9C,gCAAgC,GAAG,IAAI,CAAC,IAAI,CAAC;QAC/C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,qBAAqB,KAAK,SAAS,EAAE,CAAC;YACtD,IAAI,+BAA+B,KAAK,SAAS,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,8CAA8C,+BAA+B,6CAA6C,CAClJ,CAAC;YACJ,CAAC;YACD,qBAAqB,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC;YAC3D,+BAA+B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC9C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,cAAc,KAAK,SAAS,EAAE,CAAC;YAC/C,IAAI,wBAAwB,KAAK,SAAS,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,sCAAsC,wBAAwB,6CAA6C,CACnI,CAAC;YACJ,CAAC;YACD,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;YAC7C,wBAAwB,GAAG,IAAI,CAAC,IAAI,CAAC;QACvC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,aAAa,KAAK,SAAS,EAAE,CAAC;YAC9C,IAAI,uBAAuB,KAAK,SAAS,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,qCAAqC,uBAAuB,6CAA6C,CACjI,CAAC;YACJ,CAAC;YACD,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;YAC3C,uBAAuB,GAAG,IAAI,CAAC,IAAI,CAAC;QACtC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACnD,IAAI,4BAA4B,KAAK,SAAS,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,0CAA0C,4BAA4B,6CAA6C,CAC3I,CAAC;YACJ,CAAC;YACD,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACrD,4BAA4B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC3C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACnD,IAAI,4BAA4B,KAAK,SAAS,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,8CAA8C,4BAA4B,6CAA6C,CAC/I,CAAC;YACJ,CAAC;YACD,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACrD,4BAA4B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC3C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACrD,IAAI,8BAA8B,KAAK,SAAS,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,6CAA6C,8BAA8B,6CAA6C,CAChJ,CAAC;YACJ,CAAC;YACD,oBAAoB,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;YACzD,8BAA8B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC7C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACnD,IAAI,4BAA4B,KAAK,SAAS,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,2CAA2C,4BAA4B,6CAA6C,CAC5I,CAAC;YACJ,CAAC;YACD,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACrD,4BAA4B,GAAG,IAAI,CAAC,IAAI,CAAC;QAC3C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,sBAAsB,KAAK,SAAS,EAAE,CAAC;YACvD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC;gBAClE,IAAK,sBAAgD,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrE,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,wCAAwC,IAAI,mEAAmE,CACvI,CAAC;gBACJ,CAAC;gBACD,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,wCAAwC,IAAI,WAAW,UAAU,qEAAqE,CAC9J,CAAC;gBACJ,CAAC;gBACD,sBAAsB,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC1C,uBAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,yBAAyB,KAAK,SAAS,EAAE,CAAC;YAC1D,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC;gBACrE,IAEI,kCACD,CAAC,QAAQ,CAAC,IAAI,CAAC,EAChB,CAAC;oBACD,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,oCAAoC,IAAI,kEAAkE,CAClI,CAAC;gBACJ,CAAC;gBACD,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,oCAAoC,IAAI,WAAW,UAAU,qEAAqE,CAC1J,CAAC;gBACJ,CAAC;gBACD,yBAAyB,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC7C,uBAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;YAC7C,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;gBACzD,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;oBAC3B,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,6BAA6B,OAAO,2EAA2E,CACvI,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;oBACzD,8DAA8D;oBAC9D,4DAA4D;oBAC5D,4DAA4D;oBAC5D,WAAW;oBACX,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,6BAA6B,OAAO,sBAAsB,KAAK,CAAC,OAAO,kEAAkE,CACjK,CAAC;gBACJ,CAAC;gBACD,MAAM,UAAU,GAAG,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACtD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,6BAA6B,OAAO,WAAW,UAAU,uEAAuE,CACxJ,CAAC;gBACJ,CAAC;gBACD,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACjC,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC3C,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnC,MAAM,QAAQ,GACZ,mBAAmB,CAAC,IAAI,GAAG,CAAC;wBAC1B,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;wBAC9C,CAAC,CAAC,EAAE,CAAC;oBACT,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,CAAC,IAAI,8CAA8C,IAAI,uBACvE,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,QAAQ,GACzD,EAAE,CACH,CAAC;gBACJ,CAAC;gBACD,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC3C,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,CAAC;QAC1D,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QAChD,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,kBAAkB,CAAC,IAAI,CACrB,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAC1D,CAAC;QACF,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,OAAO;QACL,SAAS;QACT,OAAO,EAAE,OAAO,IAAI,aAAa,CAAC,GAAG;QACrC,qBAAqB,EACnB,+BAA+B,KAAK,SAAS;YAC3C,CAAC,CAAC,EAAE,UAAU,EAAE,+BAA+B,EAAE;YACjD,CAAC,CAAC,SAAS;QACf,UAAU;QACV,iBAAiB;QACjB,YAAY;QACZ,SAAS;QACT,eAAe;QACf,kBAAkB;QAClB,OAAO,EAAE;YACP,oBAAoB;YACpB,wBAAwB;YACxB,8BAA8B;YAC9B,qBAAqB;YACrB,sBAAsB;YACtB,yBAAyB;YACzB,cAAc;YACd,aAAa;YACb,kBAAkB;YAClB,YAAY;YACZ,kBAAkB;YAClB,oBAAoB;YACpB,kBAAkB;SACnB;QACD,QAAQ;QACR,OAAO;KACR,CAAC;AACJ,CAAC"}
|
|
@@ -0,0 +1,36 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* OIDC issuer discovery (20260911.11, T01_1_review.md A8) — the one
|
|
3
|
+
* reader of `/.well-known/openid-configuration`, shared by every lane
|
|
4
|
+
* that needs an issuer's endpoints: the userinfo client (oidc-userinfo.ts)
|
|
5
|
+
* and the identity verifier's JWKS location (oidc-verifier.ts), so one
|
|
6
|
+
* issuer is discovered once and validated the same way wherever it is
|
|
7
|
+
* consumed. The composition root builds ONE instance and hands it to
|
|
8
|
+
* both.
|
|
9
|
+
*
|
|
10
|
+
* The verifier's rules, kept: the document's `issuer` must equal the
|
|
11
|
+
* requested issuer exactly (RFC 8414 §3.3 — a document that names another
|
|
12
|
+
* issuer is a misconfiguration or a redirect to somewhere else); `jwks_uri`
|
|
13
|
+
* is required (OpenID Connect Discovery 1.0 §3 says so). `userinfo_endpoint`
|
|
14
|
+
* is RECOMMENDED by the spec, so it is carried when present and its
|
|
15
|
+
* consumer decides what its absence means.
|
|
16
|
+
*
|
|
17
|
+
* Memoized per issuer ON SUCCESS only: a failed fetch is retried on the
|
|
18
|
+
* next call, so a flaky IdP at boot never permanently bricks a lane. An
|
|
19
|
+
* outage is an infrastructure fault thrown as a plain error — the caller
|
|
20
|
+
* maps it (the chassis to INTERNAL, the provisioning handler to
|
|
21
|
+
* UNAVAILABLE), never a credential rejection. The fetch is injected so
|
|
22
|
+
* tests never dial out and the composition root owns the process boundary.
|
|
23
|
+
*/
|
|
24
|
+
export interface DiscoveredIssuer {
|
|
25
|
+
readonly issuer: string;
|
|
26
|
+
readonly jwksUri: string;
|
|
27
|
+
/** Absent when the document names none. */
|
|
28
|
+
readonly userinfoEndpoint: string | undefined;
|
|
29
|
+
}
|
|
30
|
+
export interface IssuerDiscovery {
|
|
31
|
+
/** The validated document for `issuer`, from the cache after the first success. */
|
|
32
|
+
discover(issuer: string): Promise<DiscoveredIssuer>;
|
|
33
|
+
}
|
|
34
|
+
export declare function discoveryUrl(issuer: string): string;
|
|
35
|
+
export declare function newIssuerDiscovery(fetchImpl?: typeof fetch): IssuerDiscovery;
|
|
36
|
+
//# sourceMappingURL=oidc-discovery.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"oidc-discovery.d.ts","sourceRoot":"","sources":["../../src/identity/oidc-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2CAA2C;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/C;AAED,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACrD;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wBAAgB,kBAAkB,CAChC,SAAS,GAAE,OAAO,KAAa,GAC9B,eAAe,CAyCjB"}
|
|
@@ -0,0 +1,60 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* OIDC issuer discovery (20260911.11, T01_1_review.md A8) — the one
|
|
3
|
+
* reader of `/.well-known/openid-configuration`, shared by every lane
|
|
4
|
+
* that needs an issuer's endpoints: the userinfo client (oidc-userinfo.ts)
|
|
5
|
+
* and the identity verifier's JWKS location (oidc-verifier.ts), so one
|
|
6
|
+
* issuer is discovered once and validated the same way wherever it is
|
|
7
|
+
* consumed. The composition root builds ONE instance and hands it to
|
|
8
|
+
* both.
|
|
9
|
+
*
|
|
10
|
+
* The verifier's rules, kept: the document's `issuer` must equal the
|
|
11
|
+
* requested issuer exactly (RFC 8414 §3.3 — a document that names another
|
|
12
|
+
* issuer is a misconfiguration or a redirect to somewhere else); `jwks_uri`
|
|
13
|
+
* is required (OpenID Connect Discovery 1.0 §3 says so). `userinfo_endpoint`
|
|
14
|
+
* is RECOMMENDED by the spec, so it is carried when present and its
|
|
15
|
+
* consumer decides what its absence means.
|
|
16
|
+
*
|
|
17
|
+
* Memoized per issuer ON SUCCESS only: a failed fetch is retried on the
|
|
18
|
+
* next call, so a flaky IdP at boot never permanently bricks a lane. An
|
|
19
|
+
* outage is an infrastructure fault thrown as a plain error — the caller
|
|
20
|
+
* maps it (the chassis to INTERNAL, the provisioning handler to
|
|
21
|
+
* UNAVAILABLE), never a credential rejection. The fetch is injected so
|
|
22
|
+
* tests never dial out and the composition root owns the process boundary.
|
|
23
|
+
*/
|
|
24
|
+
export function discoveryUrl(issuer) {
|
|
25
|
+
return `${issuer.replace(/\/$/, "")}/.well-known/openid-configuration`;
|
|
26
|
+
}
|
|
27
|
+
export function newIssuerDiscovery(fetchImpl = fetch) {
|
|
28
|
+
const discovered = new Map();
|
|
29
|
+
return {
|
|
30
|
+
async discover(issuer) {
|
|
31
|
+
const cached = discovered.get(issuer);
|
|
32
|
+
if (cached !== undefined) {
|
|
33
|
+
return cached;
|
|
34
|
+
}
|
|
35
|
+
const url = discoveryUrl(issuer);
|
|
36
|
+
const response = await fetchImpl(url);
|
|
37
|
+
if (!response.ok) {
|
|
38
|
+
throw new Error(`OIDC discovery failed: ${url} answered HTTP ${response.status}`);
|
|
39
|
+
}
|
|
40
|
+
const document = (await response.json());
|
|
41
|
+
if (document.issuer !== issuer) {
|
|
42
|
+
throw new Error(`OIDC discovery failed: document issuer '${typeof document.issuer === "string" ? document.issuer : ""}' does not match configured issuer '${issuer}'`);
|
|
43
|
+
}
|
|
44
|
+
if (typeof document.jwks_uri !== "string" || document.jwks_uri === "") {
|
|
45
|
+
throw new Error(`OIDC discovery failed: ${url} carries no jwks_uri`);
|
|
46
|
+
}
|
|
47
|
+
const result = {
|
|
48
|
+
issuer,
|
|
49
|
+
jwksUri: document.jwks_uri,
|
|
50
|
+
userinfoEndpoint: typeof document.userinfo_endpoint === "string" &&
|
|
51
|
+
document.userinfo_endpoint !== ""
|
|
52
|
+
? document.userinfo_endpoint
|
|
53
|
+
: undefined,
|
|
54
|
+
};
|
|
55
|
+
discovered.set(issuer, result);
|
|
56
|
+
return result;
|
|
57
|
+
},
|
|
58
|
+
};
|
|
59
|
+
}
|
|
60
|
+
//# sourceMappingURL=oidc-discovery.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"oidc-discovery.js","sourceRoot":"","sources":["../../src/identity/oidc-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAcH,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,YAA0B,KAAK;IAE/B,MAAM,UAAU,GAAG,IAAI,GAAG,EAA4B,CAAC;IACvD,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,MAAc;YAC3B,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CACb,0BAA0B,GAAG,kBAAkB,QAAQ,CAAC,MAAM,EAAE,CACjE,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAItC,CAAC;YACF,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CACb,2CAA2C,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,uCAAuC,MAAM,GAAG,CACtJ,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;gBACtE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,sBAAsB,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,MAAM,GAAqB;gBAC/B,MAAM;gBACN,OAAO,EAAE,QAAQ,CAAC,QAAQ;gBAC1B,gBAAgB,EACd,OAAO,QAAQ,CAAC,iBAAiB,KAAK,QAAQ;oBAC9C,QAAQ,CAAC,iBAAiB,KAAK,EAAE;oBAC/B,CAAC,CAAC,QAAQ,CAAC,iBAAiB;oBAC5B,CAAC,CAAC,SAAS;aAChB,CAAC;YACF,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC/B,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}
|