@substrat-run/vertical-auth 0.14.5 → 0.15.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/identity-do.d.ts +9 -0
- package/dist/identity-do.d.ts.map +1 -1
- package/dist/identity-do.js +12 -1
- package/dist/identity-do.js.map +1 -1
- package/dist/index.d.ts +1 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +2 -0
- package/dist/index.js.map +1 -1
- package/dist/instance-auth.d.ts +6 -0
- package/dist/instance-auth.d.ts.map +1 -1
- package/dist/instance-auth.js +8 -2
- package/dist/instance-auth.js.map +1 -1
- package/dist/oidc-rp-provider.d.ts +8 -0
- package/dist/oidc-rp-provider.d.ts.map +1 -1
- package/dist/oidc-rp-provider.js +17 -7
- package/dist/oidc-rp-provider.js.map +1 -1
- package/dist/oidc.d.ts +14 -0
- package/dist/oidc.d.ts.map +1 -1
- package/dist/oidc.js +68 -3
- package/dist/oidc.js.map +1 -1
- package/dist/owner-seat.d.ts +16 -0
- package/dist/owner-seat.d.ts.map +1 -1
- package/dist/owner-seat.js +22 -0
- package/dist/owner-seat.js.map +1 -1
- package/dist/places.d.ts +94 -0
- package/dist/places.d.ts.map +1 -0
- package/dist/places.js +150 -0
- package/dist/places.js.map +1 -0
- package/dist/provider.d.ts +6 -1
- package/dist/provider.d.ts.map +1 -1
- package/package.json +3 -3
package/dist/identity-do.d.ts
CHANGED
|
@@ -122,6 +122,13 @@ export declare class IdentityDO extends DurableObject<IdentityDoEnv> {
|
|
|
122
122
|
* bound principal resolves its permissions immediately.
|
|
123
123
|
*/
|
|
124
124
|
claimInvite(scopeId: string, sub: string, tokenHash: string): Promise<string | null>;
|
|
125
|
+
/**
|
|
126
|
+
* Unbind a subject from this scope — the removal half of the directory (#1670). True when a
|
|
127
|
+
* binding was there. `unbindMember` in `places.ts` pairs it with telling the identity pool.
|
|
128
|
+
*/
|
|
129
|
+
unbind(scopeId: string, sub: string): Promise<boolean>;
|
|
130
|
+
/** The subjects bound in this scope, at most `limit` — the whole set a places repair sends. */
|
|
131
|
+
subjectsOf(scopeId: string, limit: number): Promise<string[]>;
|
|
125
132
|
/** A Better Auth instance over THIS DO's SQLite, trusting the caller's origin. */
|
|
126
133
|
private auth;
|
|
127
134
|
/**
|
|
@@ -167,6 +174,8 @@ export type IdentityStub = {
|
|
|
167
174
|
inviteExists(scopeId: string, tokenHash: string): Promise<boolean>;
|
|
168
175
|
revokeInvite(scopeId: string, principal: string): Promise<void>;
|
|
169
176
|
claimInvite(scopeId: string, sub: string, tokenHash: string): Promise<string | null>;
|
|
177
|
+
unbind(scopeId: string, sub: string): Promise<boolean>;
|
|
178
|
+
subjectsOf(scopeId: string, limit: number): Promise<string[]>;
|
|
170
179
|
};
|
|
171
180
|
/**
|
|
172
181
|
* The `AuthProvider` backed by a tenant's identity-DO stub (the `better-auth-do` config).
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"identity-do.d.ts","sourceRoot":"","sources":["../src/identity-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAKnD,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,eAAe,CAAC;AAE/D,OAAO,EAOL,KAAK,OAAO,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,
|
|
1
|
+
{"version":3,"file":"identity-do.d.ts","sourceRoot":"","sources":["../src/identity-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAKnD,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,eAAe,CAAC;AAE/D,OAAO,EAOL,KAAK,OAAO,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAYL,KAAK,SAAS,EACf,MAAM,iBAAiB,CAAC;AA+EzB,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAElD,qBAAa,UAAW,SAAQ,aAAa,CAAC,aAAa,CAAC;IAC1D,6GAA6G;IAC7G,OAAO,CAAC,UAAU,CAAU;IAE5B,YAAY,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,aAAa,EAmBtD;IAED;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnG;IAED;;;;;;;OAOG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAMrE;IAED;;;;;;OAMG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CASpG;IAED;;;;;OAKG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3E;IAED,uFAAuF;IACjF,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;IAED,0EAA0E;IACpE,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAEpC;IAED;;;;;OAKG;IACG,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE3D;IAED,oFAAoF;IACpF,OAAO,KAAK,WAAW,GAEtB;IAED;;;;;OAKG;IACG,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;IAED;;;;OAIG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE9D;IAED;;;;OAIG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAElD;IAED,iHAAiH;IAC3G,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAEnD;IAED;;;;;;OAMG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE3E;IAED;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAE9F;IAED;;;OAGG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAExF;IAED;;;;OAIG;IACG,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK9H;IAED,oGAAoG;IAC9F,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAKlI;IAED,qGAAqG;IAC/F,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGvE;IAED,0FAA0F;IACpF,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpE;IAED;;;;;OAKG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQzF;IAED;;;OAGG;IACG,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE3D;IAED,+FAA+F;IACzF,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAElE;IAED,kFAAkF;IAClF,OAAO,CAAC,IAAI;IAkBZ;;;;;;;;;OASG;IACY,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAuBxD;CACF;AAED,sGAAsG;AACtG,MAAM,MAAM,YAAY,GAAG;IACzB,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3C,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/F,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChG,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1D,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvE,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC1F,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpF,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1H,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAC9H,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACrF,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC/D,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,EACjC,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/B,YAAY,CAcd"}
|
package/dist/identity-do.js
CHANGED
|
@@ -5,7 +5,7 @@ import { drizzle } from 'drizzle-orm/durable-sqlite';
|
|
|
5
5
|
import * as schema from './auth-schema.js';
|
|
6
6
|
import { resolveCookieDomain } from './cookie-domain.js';
|
|
7
7
|
import { SITE_REGISTRY_DDL, recordSite as recordSiteRow, listSites as listSiteRows, resolveSiteScope as resolveSiteScopeRow, forgetSite as forgetSiteRow, } from './site-registry.js';
|
|
8
|
-
import { OWNER_SEAT_DDL, migrateOwnerSeat, recordOwnerSeat, ownerOfRecord as ownerOfRecordRow, needsSetup as needsSetupRow, ownerSeat as ownerSeatRow, resolvePrincipal as resolvePrincipalRow, mintOwnerClaim as mintOwnerClaimRow, claimOwner as claimOwnerRow, } from './owner-seat.js';
|
|
8
|
+
import { OWNER_SEAT_DDL, migrateOwnerSeat, recordOwnerSeat, ownerOfRecord as ownerOfRecordRow, needsSetup as needsSetupRow, ownerSeat as ownerSeatRow, resolvePrincipal as resolvePrincipalRow, mintOwnerClaim as mintOwnerClaimRow, claimOwner as claimOwnerRow, unbindSubject as unbindSubjectRow, subjectsOf as subjectsOfRows, } from './owner-seat.js';
|
|
9
9
|
/**
|
|
10
10
|
* The per-tenant IDENTITY Durable Object — one per tenant, running its OWN Better Auth
|
|
11
11
|
* over its OWN SQLite (Drizzle's Durable-Object driver, not a shared D1), and holding the
|
|
@@ -265,6 +265,17 @@ export class IdentityDO extends DurableObject {
|
|
|
265
265
|
this.ctx.storage.sql.exec('UPDATE invite SET claimed = 1 WHERE scope_id = ? AND token_hash = ?', scopeId, tokenHash);
|
|
266
266
|
return inv.principal;
|
|
267
267
|
}
|
|
268
|
+
/**
|
|
269
|
+
* Unbind a subject from this scope — the removal half of the directory (#1670). True when a
|
|
270
|
+
* binding was there. `unbindMember` in `places.ts` pairs it with telling the identity pool.
|
|
271
|
+
*/
|
|
272
|
+
async unbind(scopeId, sub) {
|
|
273
|
+
return unbindSubjectRow(this.registrySql, scopeId, sub);
|
|
274
|
+
}
|
|
275
|
+
/** The subjects bound in this scope, at most `limit` — the whole set a places repair sends. */
|
|
276
|
+
async subjectsOf(scopeId, limit) {
|
|
277
|
+
return subjectsOfRows(this.registrySql, scopeId, limit);
|
|
278
|
+
}
|
|
268
279
|
/** A Better Auth instance over THIS DO's SQLite, trusting the caller's origin. */
|
|
269
280
|
auth(origin, cookieDomain) {
|
|
270
281
|
const db = drizzle(this.ctx.storage, { schema });
|
package/dist/identity-do.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"identity-do.js","sourceRoot":"","sources":["../src/identity-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AACrD,OAAO,KAAK,MAAM,MAAM,kBAAkB,CAAC;AAE3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,UAAU,IAAI,aAAa,EAC3B,SAAS,IAAI,YAAY,EACzB,gBAAgB,IAAI,mBAAmB,EACvC,UAAU,IAAI,aAAa,GAG5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,aAAa,IAAI,gBAAgB,EACjC,UAAU,IAAI,aAAa,EAC3B,SAAS,IAAI,YAAY,EACzB,gBAAgB,IAAI,mBAAmB,EACvC,cAAc,IAAI,iBAAiB,EACnC,UAAU,IAAI,aAAa,
|
|
1
|
+
{"version":3,"file":"identity-do.js","sourceRoot":"","sources":["../src/identity-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AACrD,OAAO,KAAK,MAAM,MAAM,kBAAkB,CAAC;AAE3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,UAAU,IAAI,aAAa,EAC3B,SAAS,IAAI,YAAY,EACzB,gBAAgB,IAAI,mBAAmB,EACvC,UAAU,IAAI,aAAa,GAG5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,aAAa,IAAI,gBAAgB,EACjC,UAAU,IAAI,aAAa,EAC3B,SAAS,IAAI,YAAY,EACzB,gBAAgB,IAAI,mBAAmB,EACvC,cAAc,IAAI,iBAAiB,EACnC,UAAU,IAAI,aAAa,EAC3B,aAAa,IAAI,gBAAgB,EACjC,UAAU,IAAI,cAAc,GAE7B,MAAM,iBAAiB,CAAC;AAEzB;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,iBAAiB,GAAa;IAClC;;;;0FAIwF;IACxF;;;;iEAI+D;IAC/D,oEAAoE;IACpE;;;;;;iCAM+B;IAC/B,oEAAoE;IACpE;;;0FAGwF;IACxF,qFAAqF;IACrF,wFAAwF;IACxF,4FAA4F;IAC5F,mFAAmF;IACnF,uFAAuF;IACvF,4FAA4F;IAC5F,oFAAoF;IACpF,0FAA0F;IAC1F,0FAA0F;IAC1F,GAAG,cAAc;IACjB,0FAA0F;IAC1F,2FAA2F;IAC3F,2FAA2F;IAC3F;;;0FAGwF;IACxF,iEAAiE;IACjE,wFAAwF;IACxF,+EAA+E;IAC/E,+EAA+E;IAC/E,sFAAsF;IACtF,wFAAwF;IACxF,mDAAmD;IACnD,uIAAuI;IACvI,8FAA8F;IAC9F,yFAAyF;IACzF,wFAAwF;IACxF,yFAAyF;IACzF,mFAAmF;IACnF,GAAG,iBAAiB;CACrB,CAAC;AAMF,MAAM,OAAO,UAAW,SAAQ,aAA4B;IAC1D,6GAA6G;IACrG,UAAU,CAAU;IAE5B,YAAY,GAAuB,EAAE,GAAkB;QACrD,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChB,GAAG,CAAC,qBAAqB,CAAC,KAAK,IAAI,EAAE;YACnC,KAAK,MAAM,IAAI,IAAI,iBAAiB;gBAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjE,oFAAoF;YACpF,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,GAA6B,CAAC,CAAC;YAC5D,sFAAsF;YACtF,qFAAqF;YACrF,mFAAmF;YACnF,2EAA2E;YAC3E,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC,CAAC,CAAC,CAAkC,CAAC;YAChI,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;gBACzD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;gBACtD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,2DAA2D,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACrG,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,OAA8C;QAClF,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACvB,6EAA6E,EAC7E,OAAO,EAAE,GAAG,EAAE,KAAK,CACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe;QAClC,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,wDAAwD,EAAE,OAAO,CAAC,EAAE,CAAC;YAC/G,MAAM,CAAC,GAAG,CAAC,GAAa,CAAC,GAAG,GAAG,CAAC,KAAe,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,MAAM,GAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC,CAAC,CAAC,CAAmC,EAAE,KAAK,CAAC;QAClJ,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;YACzD,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,8DAA8D,EAAE,MAAM,CAAC,CAAC;QACpG,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IAC3C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,IAAY,EAAE,IAAY;QAC1D,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,SAAS;QACb,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,OAAO,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,oFAAoF;IACpF,IAAY,WAAW;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAA6B,CAAC;IACxD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,SAAiB;QACtD,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe;QACpC,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,OAAO,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAED,iHAAiH;IACjH,KAAK,CAAC,SAAS,CAAC,OAAe;QAC7B,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,GAAW;QACjD,OAAO,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACzE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,SAAiB;QACrD,OAAO,iBAAiB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,GAAW,EAAE,SAAiB;QAC9D,OAAO,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,SAAiB,EAAE,OAAe,EAAE,KAAoB,EAAE,SAAiB;QAC7G,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACvB,8FAA8F,EAC9F,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAC9C,CAAC;IACJ,CAAC;IAED,oGAAoG;IACpG,KAAK,CAAC,WAAW,CAAC,OAAe;QAC/B,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAClC,uHAAuH,EACvH,OAAO,CACR,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAmB,EAAE,OAAO,EAAE,CAAC,CAAC,QAAkB,EAAE,KAAK,EAAG,CAAC,CAAC,KAAuB,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,UAAoB,EAAE,CAAC,CAAC,CAAC;IACrK,CAAC;IAED,qGAAqG;IACrG,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,SAAiB;QACnD,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,4EAA4E,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9I,OAAO,CAAC,KAAK,SAAS,CAAC;IACzB,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,SAAiB;QACnD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,yEAAyE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3H,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,OAAe,EAAE,GAAW,EAAE,SAAiB;QAC/D,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,oFAAoF,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAEzI,CAAC;QACd,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,6EAA6E,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QACtI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,qEAAqE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACrH,OAAO,GAAG,CAAC,SAAS,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,GAAW;QACvC,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED,+FAA+F;IAC/F,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,KAAa;QAC7C,OAAO,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED,kFAAkF;IAC1E,IAAI,CAAC,MAAc,EAAE,YAA4B;QACvD,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,UAAU,CAAC;YAChB,QAAQ,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAC5D,gBAAgB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE;YAC3E,qFAAqF;YACrF,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,OAAO,EAAE,MAAM;YACf,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,iFAAiF;YACjF,oFAAoF;YACpF,sFAAsF;YACtF,GAAG,CAAC,YAAY;gBACd,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE;gBAClF,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACM,KAAK,CAAC,KAAK,CAAC,OAAgB;QACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,YAAY,GAAG,mBAAmB,CACtC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,SAAS,EAC5D,GAAG,CAAC,QAAQ,CACb,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACjD,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,MAAM,OAAO,GAAuB,OAAO,EAAE,IAAI;gBAC/C,CAAC,CAAC;oBACE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;oBACpB,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI;oBACjC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI;oBAC/B,oEAAoE;oBACpE,6EAA6E;oBAC7E,sCAAsC;oBACtC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa;iBAC1C;gBACH,CAAC,CAAC,IAAI,CAAC;YACT,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;CACF;AAwBD;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAiC,EACjC,MAAc,EACd,IAAgC;IAEhC,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAW,EAAE;QAC5C,IAAI,CAAC,IAAI,EAAE,YAAY;YAAE,OAAO,OAAO,CAAC;QACxC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACnE,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IACF,OAAO;QACL,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACjD,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,MAAM,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YAC9E,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;QAClD,CAAC;KACF,CAAC;AACJ,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -6,4 +6,5 @@ export { resolveCookieDomain } from './cookie-domain.js';
|
|
|
6
6
|
export { FIRST_SIGN_IN_WINDOW_MS, OWNER_CLAIM_TTL_MS, type OwnerSeat } from './owner-seat.js';
|
|
7
7
|
export { invitePath, mintOwnerClaimLink, ownerClaimPath, sha256Hex } from './owner-claim-link.js';
|
|
8
8
|
export { AUTH_CONFIG_KEY, AuthConfigError, authChoice, authorizationServersOf, instanceAuthFor, parseAuthChoice, selectAuthProvider, type AuthChoice, type InstanceAuth, } from './instance-auth.js';
|
|
9
|
+
export { observePlace, placesReporter, reportScopeMembers, resetPlacesMemo, unbindMember, type PlaceReportResult, type PlacesReporter, } from './places.js';
|
|
9
10
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAOlG,OAAO,EACL,eAAe,EACf,eAAe,EACf,UAAU,EACV,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,KAAK,UAAU,EACf,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAOlG,OAAO,EACL,eAAe,EACf,eAAe,EACf,UAAU,EACV,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,KAAK,UAAU,EACf,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -11,4 +11,6 @@ export { invitePath, mintOwnerClaimLink, ownerClaimPath, sha256Hex } from './own
|
|
|
11
11
|
// `@substrat-run/vertical-auth/invite-routes` subpath, beside `./provider` and `./oidc`,
|
|
12
12
|
// for the same reason those do.
|
|
13
13
|
export { AUTH_CONFIG_KEY, AuthConfigError, authChoice, authorizationServersOf, instanceAuthFor, parseAuthChoice, selectAuthProvider, } from './instance-auth.js';
|
|
14
|
+
// A login's places (#1670): what a vertical tells the identity pool about its own scope.
|
|
15
|
+
export { observePlace, placesReporter, reportScopeMembers, resetPlacesMemo, unbindMember, } from './places.js';
|
|
14
16
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAmB,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAqB,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,cAAc,EAAyC,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAkB,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClG,yFAAyF;AACzF,kFAAkF;AAClF,wFAAwF;AACxF,yFAAyF;AACzF,yFAAyF;AACzF,gCAAgC;AAChC,OAAO,EACL,eAAe,EACf,eAAe,EACf,UAAU,EACV,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,kBAAkB,GAGnB,MAAM,oBAAoB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAmB,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAqB,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,cAAc,EAAyC,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAkB,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClG,yFAAyF;AACzF,kFAAkF;AAClF,wFAAwF;AACxF,yFAAyF;AACzF,yFAAyF;AACzF,gCAAgC;AAChC,OAAO,EACL,eAAe,EACf,eAAe,EACf,UAAU,EACV,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,kBAAkB,GAGnB,MAAM,oBAAoB,CAAC;AAC5B,yFAAyF;AACzF,OAAO,EACL,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,YAAY,GAGb,MAAM,aAAa,CAAC"}
|
package/dist/instance-auth.d.ts
CHANGED
|
@@ -120,5 +120,11 @@ export declare function selectAuthProvider(opts: {
|
|
|
120
120
|
identity: AuthChoice | null;
|
|
121
121
|
sessionSecret: string;
|
|
122
122
|
settings: Record<string, string | undefined>;
|
|
123
|
+
/**
|
|
124
|
+
* The delivered `SHARED_ISSUER_CONFIG_KEY`: the `substrat:auth` issuer is a team
|
|
125
|
+
* auth-server, so a bearer must be this app's own (#1683). Applies to the delivered
|
|
126
|
+
* choice only — the deployment default's issuer is the operator's own.
|
|
127
|
+
*/
|
|
128
|
+
sharedIssuer?: boolean;
|
|
123
129
|
}): AuthProvider;
|
|
124
130
|
//# sourceMappingURL=instance-auth.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"instance-auth.d.ts","sourceRoot":"","sources":["../src/instance-auth.ts"],"names":[],"mappings":"AAAA,OAAO,
|
|
1
|
+
{"version":3,"file":"instance-auth.d.ts","sourceRoot":"","sources":["../src/instance-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkD,CAAC,EAAE,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAG7G,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD;;;;;;;;;;;GAWG;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU;;;;;;;iBAQrB,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,4EAA4E;AAC5E,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAE/C;;;;;;GAMG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IAEtC,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG;IAD5B,YACW,MAAM,EAAE,GAAG,GAAG,GAAG,EAC1B,OAAO,EAAE,MAAM,EAIhB;CACF;AAED,MAAM,WAAW,YAAY;IAC3B,oFAAoF;IACpF,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC;IAC5B,qDAAqD;IACrD,aAAa,EAAE,MAAM,CAAC;IACtB,qFAAqF;IACrF,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,IAAI,YAAY,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,qCAAqC;IACrC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B,GAAG,OAAO,CAAC,YAAY,CAAC,CAiBxB;AAED,wFAAwF;AACxF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,IAAI,CAQ1E;AAED;;;;;;;;;;;;;GAaG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC9C,GAAG,MAAM,EAAE,CAKX;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,GAAG,YAAY,CAgCf"}
|
package/dist/instance-auth.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { resolveScopedEnvSpec, z } from '@substrat-run/contracts';
|
|
1
|
+
import { SHARED_ISSUER_CONFIG_KEY, resolveScopedEnvSpec, z } from '@substrat-run/contracts';
|
|
2
2
|
import { oidcAuthProvider } from './oidc.js';
|
|
3
3
|
import { oidcRpAuthProvider } from './oidc-rp-provider.js';
|
|
4
4
|
/**
|
|
@@ -66,7 +66,12 @@ export async function instanceAuthFor(opts) {
|
|
|
66
66
|
sessionSecret: wiring.sessionSecret,
|
|
67
67
|
settings,
|
|
68
68
|
config: wiring.config,
|
|
69
|
-
provider: () => selectAuthProvider({
|
|
69
|
+
provider: () => selectAuthProvider({
|
|
70
|
+
identity,
|
|
71
|
+
sessionSecret: wiring.sessionSecret,
|
|
72
|
+
settings,
|
|
73
|
+
sharedIssuer: wiring.config[SHARED_ISSUER_CONFIG_KEY] === 'true',
|
|
74
|
+
}),
|
|
70
75
|
};
|
|
71
76
|
}
|
|
72
77
|
/** The delivered `substrat:auth` entry, parsed leniently: anything unusable is null. */
|
|
@@ -134,6 +139,7 @@ export function selectAuthProvider(opts) {
|
|
|
134
139
|
sessionSecret: opts.sessionSecret,
|
|
135
140
|
...(identity.audience ? { audience: identity.audience } : {}),
|
|
136
141
|
...(identity.cookieDomain ? { cookieDomain: identity.cookieDomain } : {}),
|
|
142
|
+
...(opts.sharedIssuer ? { sharedIssuer: true } : {}),
|
|
137
143
|
});
|
|
138
144
|
}
|
|
139
145
|
if (settings.AUTH_PROVIDER === 'oidc') {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"instance-auth.js","sourceRoot":"","sources":["../src/instance-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,CAAC,EAAmB,MAAM,yBAAyB,CAAC;
|
|
1
|
+
{"version":3,"file":"instance-auth.js","sourceRoot":"","sources":["../src/instance-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,CAAC,EAAmB,MAAM,yBAAyB,CAAC;AAC7G,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAI3D;;;;;;;;;;;GAWG;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,0FAA0F;IAC1F,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAIH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAE7B,MAAM;IADjB,YACW,MAAiB,EAC1B,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;sBAHN,MAAM;QAIf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAmBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAQrC;IACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACpF,OAAO;QACL,QAAQ;QACR,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,GAAG,EAAE,CACb,kBAAkB,CAAC;YACjB,QAAQ;YACR,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,QAAQ;YACR,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,KAAK,MAAM;SACjE,CAAC;KACL,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,eAAe,CAAC,GAAuB;IACrD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAGtC;IACC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACpC,IAAI,QAAQ,EAAE,IAAI,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,IAAI,QAAQ,CAAC,aAAa,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAUlC;IACC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACpC,IAAI,QAAQ,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC3C,MAAM,IAAI,eAAe,CACvB,GAAG,EACH,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,OAAO,kBAAkB,CAAC;YACxB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,EAAE;YACzC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC1B,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,6CAA6C,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,gBAAgB,CAAC;YACtB,MAAM,EAAE,QAAQ,CAAC,WAAW;YAC5B,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,eAAe,CACvB,GAAG,EACH,uIAAuI,CACxI,CAAC;AACJ,CAAC"}
|
|
@@ -22,6 +22,14 @@ export interface OidcRpConfig {
|
|
|
22
22
|
sessionSecret: string;
|
|
23
23
|
/** Expected `aud` for PRESENTED bearer tokens (the API-client path), if the issuer sets one. */
|
|
24
24
|
audience?: string;
|
|
25
|
+
/**
|
|
26
|
+
* The issuer is shared with other clients: a team auth-server, which the dashboard marks
|
|
27
|
+
* by delivering `SHARED_ISSUER_CONFIG_KEY` (#1683). With no `audience`, a presented bearer
|
|
28
|
+
* must then be THIS app's own token — its own `id_token`, a token issued to its client,
|
|
29
|
+
* or an access token for its own MCP resource — never another client's that the same
|
|
30
|
+
* issuer happened to sign. Unset, the bearer path is exactly what it was.
|
|
31
|
+
*/
|
|
32
|
+
sharedIssuer?: boolean;
|
|
25
33
|
/**
|
|
26
34
|
* Share the login across every surface under this parent domain (`acme.se` covers
|
|
27
35
|
* `crm.` and `eka.` alike) — the session cookie is set with `Domain=…` instead of
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc-rp-provider.d.ts","sourceRoot":"","sources":["../src/oidc-rp-provider.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"oidc-rp-provider.d.ts","sourceRoot":"","sources":["../src/oidc-rp-provider.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,eAAe,CAAC;AAI/D;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,YAAY;IAC3B,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,0FAA0F;IAC1F,aAAa,EAAE,MAAM,CAAC;IACtB,gGAAgG;IAChG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAoGD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,YAAY,GAAG,YAAY,CAgGlE"}
|
package/dist/oidc-rp-provider.js
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import { beginLogin, completeLogin, federatedLogoutUrl, verifySession, readCookie, safePath, SESSION_COOKIE, FLOW_COOKIE, LOGOUT_HINT_COOKIE, LOGOUT_PATH, SESSION_MAXAGE, FLOW_MAXAGE, } from '@substrat-run/oidc-rp';
|
|
2
|
+
import { mcpResourceOf } from '@substrat-run/contracts';
|
|
2
3
|
import { oidcAuthProvider } from './oidc.js';
|
|
3
4
|
import { resolveCookieDomain } from './cookie-domain.js';
|
|
4
5
|
const envOf = (cfg) => ({
|
|
@@ -70,14 +71,22 @@ function redirectWith(location, cookies) {
|
|
|
70
71
|
headers.append('set-cookie', c);
|
|
71
72
|
return new Response(null, { status: 302, headers });
|
|
72
73
|
}
|
|
73
|
-
// Bearer verifiers cached per issuer+audience so the JWKS
|
|
74
|
-
// requests in an isolate even though the provider object itself is
|
|
74
|
+
// Bearer verifiers cached per issuer+audience(+own client, on a shared issuer) so the JWKS
|
|
75
|
+
// fetch survives across requests in an isolate even though the provider object itself is
|
|
76
|
+
// per-request. The client is part of the key because two apps on one team auth-server
|
|
77
|
+
// share an issuer and must never share a verifier that admits the other's tokens.
|
|
75
78
|
const bearerCache = new Map();
|
|
76
79
|
function bearerVerifier(cfg) {
|
|
77
|
-
|
|
80
|
+
// A delivered `audience` still wins over it; `oidcAuthProvider` is where that is decided.
|
|
81
|
+
const own = cfg.sharedIssuer ? cfg.clientId : undefined;
|
|
82
|
+
const key = `${cfg.issuer}|${cfg.audience ?? ''}|${own ?? ''}`;
|
|
78
83
|
let p = bearerCache.get(key);
|
|
79
84
|
if (!p) {
|
|
80
|
-
p = oidcAuthProvider({
|
|
85
|
+
p = oidcAuthProvider({
|
|
86
|
+
issuer: cfg.issuer,
|
|
87
|
+
...(cfg.audience ? { audience: cfg.audience } : {}),
|
|
88
|
+
...(own ? { clientId: own, resourceOf: (origin) => mcpResourceOf(origin) } : {}),
|
|
89
|
+
});
|
|
81
90
|
bearerCache.set(key, p);
|
|
82
91
|
}
|
|
83
92
|
return p;
|
|
@@ -153,7 +162,7 @@ export function oidcRpAuthProvider(cfg) {
|
|
|
153
162
|
// here — accounts live at the issuer. JSON, never a fall-through to the SPA.
|
|
154
163
|
return Response.json({ error: 'this instance authenticates at its OIDC issuer', issuer: cfg.issuer }, { status: 404 });
|
|
155
164
|
}
|
|
156
|
-
async function resolve(headers) {
|
|
165
|
+
async function resolve(headers, url) {
|
|
157
166
|
const session = await verifySession(env, readCookie(headers.get('cookie'), SESSION_COOKIE));
|
|
158
167
|
if (session) {
|
|
159
168
|
return {
|
|
@@ -165,8 +174,9 @@ export function oidcRpAuthProvider(cfg) {
|
|
|
165
174
|
emailVerified: session.emailVerified,
|
|
166
175
|
};
|
|
167
176
|
}
|
|
168
|
-
// No cookie session — an API client presenting the issuer's own token directly.
|
|
169
|
-
|
|
177
|
+
// No cookie session — an API client presenting the issuer's own token directly. On a
|
|
178
|
+
// shared issuer it must be one minted for THIS app (#1683); `url` names our resource.
|
|
179
|
+
return bearerVerifier(cfg).resolve(headers, url);
|
|
170
180
|
}
|
|
171
181
|
return { handle, resolve };
|
|
172
182
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc-rp-provider.js","sourceRoot":"","sources":["../src/oidc-rp-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,UAAU,EACV,QAAQ,EACR,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,WAAW,GAEZ,MAAM,uBAAuB,CAAC;
|
|
1
|
+
{"version":3,"file":"oidc-rp-provider.js","sourceRoot":"","sources":["../src/oidc-rp-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,UAAU,EACV,QAAQ,EACR,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,WAAW,GAEZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AA0CzD,MAAM,KAAK,GAAG,CAAC,GAAiB,EAAW,EAAE,CAAC,CAAC;IAC7C,WAAW,EAAE,GAAG,CAAC,MAAM;IACvB,cAAc,EAAE,GAAG,CAAC,QAAQ;IAC5B,kBAAkB,EAAE,GAAG,CAAC,YAAY;IACpC,cAAc,EAAE,GAAG,CAAC,aAAa;CAClC,CAAC,CAAC;AAEH,2GAA2G;AAC3G,SAAS,MAAM,CACb,IAAY,EACZ,KAAa,EACb,MAAc,EACd,MAAc,EACd,MAAsB,EACtB,IAAI,GAAG,GAAG,EACV,QAAQ,GAAqB,KAAK;IAElC,MAAM,KAAK,GAAG;QACZ,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE;QACtC,QAAQ,IAAI,EAAE;QACd,WAAW,MAAM,EAAE;QACnB,UAAU;QACV,YAAY,QAAQ,EAAE;KACvB,CAAC;IACF,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,EAAE,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,KAAa,EAAE,MAAc,EAAE,MAAc,EAAE,MAAqB;IAC1F,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AACxG,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,WAAW,CAAC,KAAa,EAAE,MAAc,EAAE,MAAc,EAAE,MAAqB;IACvF,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrG,OAAO;QACL,MAAM,CAAC,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC;QAChF,MAAM,CAAC,kBAAkB,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,OAAiB;IACvD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,2FAA2F;AAC3F,yFAAyF;AACzF,sFAAsF;AACtF,kFAAkF;AAClF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAwB,CAAC;AACpD,SAAS,cAAc,CAAC,GAAiB;IACvC,0FAA0F;IAC1F,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC;IAC/D,IAAI,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,gBAAgB,CAAC;YACnB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,MAAc,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzF,CAAC,CAAC;QACH,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAiB;IAClD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAEvB,KAAK,UAAU,MAAM,CAAC,OAAgB;QACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC1B,qFAAqF;QACrF,wFAAwF;QACxF,iFAAiF;QACjF,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEnE,IAAI,GAAG,CAAC,QAAQ,KAAK,iBAAiB,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACnD,oFAAoF;YACpF,qFAAqF;YACrF,mFAAmF;YACnF,6EAA6E;YAC7E,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE;gBACvD,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACpD,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS;gBAC1D,UAAU,EAAE,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;gBAC1E,MAAM,EAAE,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;aAC/E,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,oBAAoB,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;YACpE,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACrD,IAAI,CAAC;gBACH,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;gBACnF,OAAO,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE;oBAC7C,SAAS;oBACT,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC;oBAC1D,+EAA+E;oBAC/E,6BAA6B;oBAC7B,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC;iBACxD,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,8EAA8E;gBAC9E,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACpG,OAAO,YAAY,CAAC,cAAc,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,GAAG,CAAC;YAChE,MAAM,OAAO,GAAG,CAAC,GAAG,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YAClG;;;;;;;;;;;;eAYG;YACH,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,CAAC;gBAC3E,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;gBAChE,IAAI,IAAI;oBAAE,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC/C,CAAC;YACD,OAAO,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACtC,CAAC;QAED,iFAAiF;QACjF,6EAA6E;QAC7E,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,gDAAgD,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAC/E,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,OAAgB,EAAE,GAAY;QACnD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC;QAC5F,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO;gBACL,GAAG,EAAE,OAAO,CAAC,EAAE;gBACf,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;gBAC5B,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;gBAC1B,+EAA+E;gBAC/E,6EAA6E;gBAC7E,aAAa,EAAE,OAAO,CAAC,aAAa;aACrC,CAAC;QACJ,CAAC;QACD,qFAAqF;QACrF,sFAAsF;QACtF,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC"}
|
package/dist/oidc.d.ts
CHANGED
|
@@ -14,6 +14,20 @@ export interface OidcConfig {
|
|
|
14
14
|
issuer: string;
|
|
15
15
|
/** Expected audience (`aud`), if the issuer sets one for this app. */
|
|
16
16
|
audience?: string;
|
|
17
|
+
/**
|
|
18
|
+
* Set ONLY when the issuer is shared with other clients (a team auth-server, #1683): the
|
|
19
|
+
* relying-party client this app is there. A bearer must then be this app's own token,
|
|
20
|
+
* not merely one the issuer signed — see `isOwnToken`. Absent, any `aud` passes, as it
|
|
21
|
+
* always has, because an issuer the operator configured by hand is theirs and its knob
|
|
22
|
+
* is `audience`. Ignored when `audience` is set: an explicit audience keeps winning.
|
|
23
|
+
*/
|
|
24
|
+
clientId?: string;
|
|
25
|
+
/**
|
|
26
|
+
* With `clientId`: this app's MCP resource identifier on an origin — `mcpResourceOf` from
|
|
27
|
+
* `@substrat-run/contracts`, handed in rather than imported so this subpath keeps its
|
|
28
|
+
* jose-only dependency. An access token whose `aud` names it is this app's own too.
|
|
29
|
+
*/
|
|
30
|
+
resourceOf?: (origin: string) => string;
|
|
17
31
|
/** Override the JWKS URI (skip discovery) — e.g. a self-hosted issuer. */
|
|
18
32
|
jwksUri?: string;
|
|
19
33
|
/** Inject the key resolver directly — tests / a static JWKS. Defaults to the issuer's remote JWKS. */
|
package/dist/oidc.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,
|
|
1
|
+
{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkD,KAAK,eAAe,EAAE,MAAM,MAAM,CAAC;AAC5F,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,eAAe,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU;IACzB,uFAAuF;IACvF,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC;IACxC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sGAAsG;IACtG,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAoFD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,UAAU,GAAG,YAAY,CAoE9D"}
|
package/dist/oidc.js
CHANGED
|
@@ -24,6 +24,66 @@ function bearerFrom(headers) {
|
|
|
24
24
|
return auth.slice(7).trim() || null;
|
|
25
25
|
return null;
|
|
26
26
|
}
|
|
27
|
+
/**
|
|
28
|
+
* The MCP resource identifiers this request's own origin answers to — the `aud` an access
|
|
29
|
+
* token minted for this app's MCP endpoint carries (#1619). Built with the caller's
|
|
30
|
+
* `resourceOf` — `mcpResourceOf`, the one spelling the endpoint, the dashboard and the
|
|
31
|
+
* issuer all share.
|
|
32
|
+
*
|
|
33
|
+
* The request URL is the answer when the caller hands it over. Every caller written
|
|
34
|
+
* before #1683 passes headers alone, so the `Host` header stands in, under both schemes
|
|
35
|
+
* because it carries none. That is sound only because this list can do nothing but admit
|
|
36
|
+
* a token that would otherwise be REFUSED — today's behaviour admitted every token, so no
|
|
37
|
+
* value of `Host` makes this check weaker than what it replaces. And the router
|
|
38
|
+
* dispatches by hostname, so a request naming another vertical's host does not reach
|
|
39
|
+
* this one. The strings are only ever compared for equality with a signed `aud`, so a
|
|
40
|
+
* `Host` that is not a bare authority builds one that matches nothing.
|
|
41
|
+
*/
|
|
42
|
+
function ownResources(headers, url, resourceOf) {
|
|
43
|
+
if (url) {
|
|
44
|
+
try {
|
|
45
|
+
return [resourceOf(new URL(url).origin)];
|
|
46
|
+
}
|
|
47
|
+
catch {
|
|
48
|
+
return [];
|
|
49
|
+
}
|
|
50
|
+
}
|
|
51
|
+
const host = headers.get('host')?.toLowerCase();
|
|
52
|
+
if (!host)
|
|
53
|
+
return [];
|
|
54
|
+
return [resourceOf(`https://${host}`), resourceOf(`http://${host}`)];
|
|
55
|
+
}
|
|
56
|
+
/**
|
|
57
|
+
* Whether a verified token was minted FOR this app, rather than only BY its issuer
|
|
58
|
+
* (#1683). Every client of a team auth-server shares one issuer and one JWKS, so signature
|
|
59
|
+
* and `iss` say nothing about which app a token is for: without this, any client's
|
|
60
|
+
* `id_token` — including one an anonymous dynamic registration obtained — and another
|
|
61
|
+
* vertical's MCP access token resolved to the user they name on every route.
|
|
62
|
+
*
|
|
63
|
+
* Admitted, in order:
|
|
64
|
+
*
|
|
65
|
+
* 1. **`aud` names this app's own MCP resource.** An access token for this app's
|
|
66
|
+
* endpoint. Its `azp` is the MCP *client's* id, never ours, so this has to come first.
|
|
67
|
+
* 2. **An authorized party that is us.** When `azp` or `client_id` is present, every one
|
|
68
|
+
* present must equal our client id — and then the token was issued to our client,
|
|
69
|
+
* whatever its `aud`. When one is present and is someone else, that is the answer:
|
|
70
|
+
* refused, even with our id in `aud` (OIDC Core §3.1.3.7, item 5).
|
|
71
|
+
* 3. **No authorized party, and `aud` is exactly our client id.** Our own `id_token`:
|
|
72
|
+
* Better Auth, like most issuers, puts no `azp` on one. A multi-valued `aud` with no
|
|
73
|
+
* `azp` is refused — OIDC Core asks for `azp` exactly then, and without it nothing
|
|
74
|
+
* says which of the audiences the token was handed to.
|
|
75
|
+
*
|
|
76
|
+
* Everything else is refused, a token with neither `aud` nor an authorized party included.
|
|
77
|
+
*/
|
|
78
|
+
function isOwnToken(payload, clientId, resources) {
|
|
79
|
+
const aud = typeof payload.aud === 'string' ? [payload.aud] : Array.isArray(payload.aud) ? payload.aud : [];
|
|
80
|
+
if (resources.some((r) => aud.includes(r)))
|
|
81
|
+
return true;
|
|
82
|
+
const parties = [payload['azp'], payload['client_id']].filter((v) => typeof v === 'string');
|
|
83
|
+
if (parties.length > 0)
|
|
84
|
+
return parties.every((p) => p === clientId);
|
|
85
|
+
return aud.length === 1 && aud[0] === clientId;
|
|
86
|
+
}
|
|
27
87
|
export function oidcAuthProvider(cfg) {
|
|
28
88
|
let keysPromise;
|
|
29
89
|
const getKeys = async () => {
|
|
@@ -37,7 +97,7 @@ export function oidcAuthProvider(cfg) {
|
|
|
37
97
|
}
|
|
38
98
|
return keysPromise;
|
|
39
99
|
};
|
|
40
|
-
async function verify(token) {
|
|
100
|
+
async function verify(token, headers, url) {
|
|
41
101
|
try {
|
|
42
102
|
const { payload } = await jwtVerify(token, await getKeys(), {
|
|
43
103
|
issuer: cfg.issuer,
|
|
@@ -45,6 +105,11 @@ export function oidcAuthProvider(cfg) {
|
|
|
45
105
|
});
|
|
46
106
|
if (!payload.sub)
|
|
47
107
|
return null;
|
|
108
|
+
if (!cfg.audience && cfg.clientId) {
|
|
109
|
+
const resources = cfg.resourceOf ? ownResources(headers, url, cfg.resourceOf) : [];
|
|
110
|
+
if (!isOwnToken(payload, cfg.clientId, resources))
|
|
111
|
+
return null;
|
|
112
|
+
}
|
|
48
113
|
const meta = payload;
|
|
49
114
|
// `email_verified`, read exactly as `@substrat-run/oidc-rp` reads it on the
|
|
50
115
|
// browser-login path: a boolean when the issuer asserts one, and the `"true"` /
|
|
@@ -82,9 +147,9 @@ export function oidcAuthProvider(cfg) {
|
|
|
82
147
|
note: 'authenticate at the issuer, then present the token as `Authorization: Bearer`',
|
|
83
148
|
});
|
|
84
149
|
},
|
|
85
|
-
async resolve(headers) {
|
|
150
|
+
async resolve(headers, url) {
|
|
86
151
|
const token = bearerFrom(headers);
|
|
87
|
-
return token ? verify(token) : null;
|
|
152
|
+
return token ? verify(token, headers, url) : null;
|
|
88
153
|
},
|
|
89
154
|
};
|
|
90
155
|
}
|
package/dist/oidc.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,kBAAkB,
|
|
1
|
+
{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAyC,MAAM,MAAM,CAAC;AAqC5F,gGAAgG;AAChG,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2B,CAAC;AAC1D,SAAS,eAAe,CAAC,MAAc;IACrC,IAAI,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;YACd,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC;YAC5E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACnF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;YACzD,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,kBAAkB,CAAC,CAAC;YACpF,OAAO,IAAI,CAAC,QAAQ,CAAC;QACvB,CAAC,CAAC,EAAE,CAAC;QACL,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,UAAU,CAAC,OAAgB;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC1C,IAAI,IAAI,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IACnF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,YAAY,CAAC,OAAgB,EAAE,GAAuB,EAAE,UAAsC;IACrG,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,OAAO,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;IAChD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,CAAC,UAAU,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,UAAU,CAAC,OAAmB,EAAE,QAAgB,EAAE,SAA4B;IACrF,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5G,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACzG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;IACpE,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAe;IAC9C,IAAI,WAAiD,CAAC;IACtD,MAAM,OAAO,GAAG,KAAK,IAA8B,EAAE;QACnD,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC;QAC9B,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,WAAW,GAAG,CAAC,KAAK,IAAI,EAAE;gBACxB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;gBACnE,OAAO,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9C,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IAEF,KAAK,UAAU,MAAM,CAAC,KAAa,EAAE,OAAgB,EAAE,GAAuB;QAC5E,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,OAAO,EAAE,EAAE;gBAC1D,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBAClC,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnF,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC;oBAAE,OAAO,IAAI,CAAC;YACjE,CAAC;YACD,MAAM,IAAI,GAAG,OAAkC,CAAC;YAChD,4EAA4E;YAC5E,gFAAgF;YAChF,oFAAoF;YACpF,gFAAgF;YAChF,6EAA6E;YAC7E,0EAA0E;YAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACxC,OAAO;gBACL,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;gBACxB,KAAK,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,IAAI;gBAC3E,aAAa,EACX,OAAO,QAAQ,KAAK,SAAS;oBAC3B,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,QAAQ,KAAK,MAAM;wBACnB,CAAC,CAAC,IAAI;wBACN,CAAC,CAAC,QAAQ,KAAK,OAAO;4BACpB,CAAC,CAAC,KAAK;4BACP,CAAC,CAAC,SAAS;gBACnB,IAAI,EACF,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ;oBAC9B,CAAC,CAAE,IAAI,CAAC,MAAM,CAAY;oBAC1B,CAAC,CAAC,OAAQ,IAAI,CAAC,eAAe,CAAwB,EAAE,IAAI,KAAK,QAAQ;wBACvE,CAAC,CAAC,CAAE,IAAI,CAAC,eAAe,CAAsB,CAAC,IAAI,CAAC;wBACpD,CAAC,CAAC,IAAI;aACb,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,0EAA0E;QACzF,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,MAAM;YACV,OAAO,QAAQ,CAAC,IAAI,CAAC;gBACnB,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,+EAA+E;aACtF,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG;YACxB,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;YAClC,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpD,CAAC;KACF,CAAC;AACJ,CAAC"}
|
package/dist/owner-seat.d.ts
CHANGED
|
@@ -89,6 +89,22 @@ export declare function ownerSeat(sql: RegistrySql, scopeId: string, now: number
|
|
|
89
89
|
* OIDC issuer.
|
|
90
90
|
*/
|
|
91
91
|
export declare function resolvePrincipal(sql: RegistrySql, scopeId: string, sub: string, now: number): string | null;
|
|
92
|
+
/**
|
|
93
|
+
* Unbind a subject from a scope (#1670) — the removal every "remove this member" path shares,
|
|
94
|
+
* and the one write that takes a binding away. True when there was one to take.
|
|
95
|
+
*
|
|
96
|
+
* It removes only the binding. A role the principal holds at scope level is the vertical's to
|
|
97
|
+
* revoke through the kernel; without a binding no login resolves to that principal, so the
|
|
98
|
+
* grant authorizes nobody. It never re-opens the owner seat: unbinding the owner leaves the
|
|
99
|
+
* seat claimed and the owner of record intact, and getting back in is a claim link's job.
|
|
100
|
+
*/
|
|
101
|
+
export declare function unbindSubject(sql: RegistrySql, scopeId: string, sub: string): boolean;
|
|
102
|
+
/**
|
|
103
|
+
* The subjects bound in a scope, at most `limit`, in a stable order — the whole set a places
|
|
104
|
+
* repair reports (#1670). The caller asks for one more than it will send, so it can tell a
|
|
105
|
+
* scope that fits from one it must refuse rather than truncate.
|
|
106
|
+
*/
|
|
107
|
+
export declare function subjectsOf(sql: RegistrySql, scopeId: string, limit: number): string[];
|
|
92
108
|
/**
|
|
93
109
|
* Mint a claim link for a pending seat: store the token's hash with an expiry, replacing any
|
|
94
110
|
* earlier link (so minting again is also how one is revoked). Null ⇒ the seat is not pending
|
package/dist/owner-seat.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"owner-seat.d.ts","sourceRoot":"","sources":["../src/owner-seat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB,QAAc,CAAC;AACnD,gDAAgD;AAChD,eAAO,MAAM,kBAAkB,QAAc,CAAC;AAE9C;;;;;GAKG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAa3C,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI,CAKvD;AAED,uFAAuF;AACvF,MAAM,WAAW,SAAS;IACxB,2EAA2E;IAC3E,KAAK,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;IAC3C,gFAAgF;IAChF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,4FAA4F;IAC5F,WAAW,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC5D,6FAA6F;IAC7F,SAAS,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACzC;AAID;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,MAAgC,GACzC,IAAI,CASN;AAED,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK9E;AAED,qGAAqG;AACrG,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAErE;AAuBD,wCAAwC;AACxC,wBAAgB,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAenF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS3G;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,KAAK,GAAE,MAA2B,GACjC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAU9B;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMxH"}
|
|
1
|
+
{"version":3,"file":"owner-seat.d.ts","sourceRoot":"","sources":["../src/owner-seat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB,QAAc,CAAC;AACnD,gDAAgD;AAChD,eAAO,MAAM,kBAAkB,QAAc,CAAC;AAE9C;;;;;GAKG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAa3C,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI,CAKvD;AAED,uFAAuF;AACvF,MAAM,WAAW,SAAS;IACxB,2EAA2E;IAC3E,KAAK,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;IAC3C,gFAAgF;IAChF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,4FAA4F;IAC5F,WAAW,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC5D,6FAA6F;IAC7F,SAAS,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACzC;AAID;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,MAAgC,GACzC,IAAI,CASN;AAED,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK9E;AAED,qGAAqG;AACrG,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAErE;AAuBD,wCAAwC;AACxC,wBAAgB,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAenF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS3G;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAIrF;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAIrF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,KAAK,GAAE,MAA2B,GACjC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAU9B;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMxH"}
|
package/dist/owner-seat.js
CHANGED
|
@@ -142,6 +142,28 @@ export function resolvePrincipal(sql, scopeId, sub, now) {
|
|
|
142
142
|
return null;
|
|
143
143
|
return bindSeat(sql, scopeId, sub, pending.principal);
|
|
144
144
|
}
|
|
145
|
+
/**
|
|
146
|
+
* Unbind a subject from a scope (#1670) — the removal every "remove this member" path shares,
|
|
147
|
+
* and the one write that takes a binding away. True when there was one to take.
|
|
148
|
+
*
|
|
149
|
+
* It removes only the binding. A role the principal holds at scope level is the vertical's to
|
|
150
|
+
* revoke through the kernel; without a binding no login resolves to that principal, so the
|
|
151
|
+
* grant authorizes nobody. It never re-opens the owner seat: unbinding the owner leaves the
|
|
152
|
+
* seat claimed and the owner of record intact, and getting back in is a claim link's job.
|
|
153
|
+
*/
|
|
154
|
+
export function unbindSubject(sql, scopeId, sub) {
|
|
155
|
+
const had = [...sql.exec('SELECT 1 FROM identity WHERE scope_id = ? AND sub = ?', scopeId, sub)].length > 0;
|
|
156
|
+
sql.exec('DELETE FROM identity WHERE scope_id = ? AND sub = ?', scopeId, sub);
|
|
157
|
+
return had;
|
|
158
|
+
}
|
|
159
|
+
/**
|
|
160
|
+
* The subjects bound in a scope, at most `limit`, in a stable order — the whole set a places
|
|
161
|
+
* repair reports (#1670). The caller asks for one more than it will send, so it can tell a
|
|
162
|
+
* scope that fits from one it must refuse rather than truncate.
|
|
163
|
+
*/
|
|
164
|
+
export function subjectsOf(sql, scopeId, limit) {
|
|
165
|
+
return [...sql.exec('SELECT sub FROM identity WHERE scope_id = ? ORDER BY sub LIMIT ?', scopeId, limit)].map((r) => r.sub);
|
|
166
|
+
}
|
|
145
167
|
/**
|
|
146
168
|
* Mint a claim link for a pending seat: store the token's hash with an expiry, replacing any
|
|
147
169
|
* earlier link (so minting again is also how one is revoked). Null ⇒ the seat is not pending
|
package/dist/owner-seat.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"owner-seat.js","sourceRoot":"","sources":["../src/owner-seat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAIH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,MAAM,CAAC;AACnD,gDAAgD;AAChD,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C,uIAAuI;IACvI,+FAA+F;IAC/F,gGAAgG;IAChG,0FAA0F;IAC1F,oHAAoH;IACpH,iGAAiG;IACjG,4FAA4F;IAC5F,4FAA4F;IAC5F,iGAAiG;IACjG,0FAA0F;IAC1F,iFAAiF;IACjF,2HAA2H;CAC5H,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAgB;IAC/C,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC;IAC/F,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAcD,MAAM,GAAG,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAgB,EAChB,OAAe,EACf,SAAiB,EACjB,GAAW,EACX,QAAQ,GAAW,uBAAuB;IAE1C,IAAI,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,IAAI;QAAE,OAAO;IACjD,GAAG,CAAC,IAAI,CAAC,iEAAiE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAChG,GAAG,CAAC,IAAI,CACN,+EAA+E,EAC/E,OAAO,EACP,SAAS,EACT,GAAG,GAAG,QAAQ,CACf,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,aAAa,CAAC,GAAgB,EAAE,OAAe;IAC7D,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,0DAA0D,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAEnF,CAAC;IACd,OAAO,GAAG,EAAE,SAAS,IAAI,IAAI,CAAC;AAChC,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,UAAU,CAAC,GAAgB,EAAE,OAAe;IAC1D,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,gDAAgD,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;AACnG,CAAC;AAED,SAAS,UAAU,CAAC,GAAgB,EAAE,OAAe;IACnD,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,qEAAqE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAEzF,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW;IAC/D,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,mEAAmE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAE5F,CAAC;IACd,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,iGAAiG;AACjG,SAAS,QAAQ,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,SAAiB;IACjF,GAAG,CAAC,IAAI,CAAC,6EAA6E,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACjH,GAAG,CAAC,IAAI,CAAC,8CAA8C,EAAE,OAAO,CAAC,CAAC;IAClE,GAAG,CAAC,IAAI,CAAC,4CAA4C,EAAE,OAAO,CAAC,CAAC;IAChE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,SAAS,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW;IACtE,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACzF,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACrF,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3C,OAAO;QACL,KAAK,EAAE,WAAW;QAClB,KAAK;QACL,WAAW,EAAE;YACX,IAAI,EAAE,OAAO,CAAC,WAAW,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,GAAG,GAAG;YAC/D,KAAK,EAAE,OAAO,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC;SACtE;QACD,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;KAC/D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,GAAW;IAC1F,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,+DAA+D,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAE/F,CAAC;IACd,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC,SAAS,CAAC;IAClC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAgB,EAChB,OAAe,EACf,SAAiB,EACjB,GAAW,EACX,KAAK,GAAW,kBAAkB;IAElC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,SAAS,GAAG,GAAG,GAAG,KAAK,CAAC;IAC9B,GAAG,CAAC,IAAI,CACN,wFAAwF,EACxF,OAAO,EACP,SAAS,EACT,SAAS,CACV,CAAC;IACF,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,SAAiB,EAAE,GAAW;IACvG,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;AACxD,CAAC"}
|
|
1
|
+
{"version":3,"file":"owner-seat.js","sourceRoot":"","sources":["../src/owner-seat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAIH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,MAAM,CAAC;AACnD,gDAAgD;AAChD,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C,uIAAuI;IACvI,+FAA+F;IAC/F,gGAAgG;IAChG,0FAA0F;IAC1F,oHAAoH;IACpH,iGAAiG;IACjG,4FAA4F;IAC5F,4FAA4F;IAC5F,iGAAiG;IACjG,0FAA0F;IAC1F,iFAAiF;IACjF,2HAA2H;CAC5H,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAgB;IAC/C,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC;IAC/F,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAcD,MAAM,GAAG,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAgB,EAChB,OAAe,EACf,SAAiB,EACjB,GAAW,EACX,QAAQ,GAAW,uBAAuB;IAE1C,IAAI,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,IAAI;QAAE,OAAO;IACjD,GAAG,CAAC,IAAI,CAAC,iEAAiE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAChG,GAAG,CAAC,IAAI,CACN,+EAA+E,EAC/E,OAAO,EACP,SAAS,EACT,GAAG,GAAG,QAAQ,CACf,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,aAAa,CAAC,GAAgB,EAAE,OAAe;IAC7D,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,0DAA0D,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAEnF,CAAC;IACd,OAAO,GAAG,EAAE,SAAS,IAAI,IAAI,CAAC;AAChC,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,UAAU,CAAC,GAAgB,EAAE,OAAe;IAC1D,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,gDAAgD,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;AACnG,CAAC;AAED,SAAS,UAAU,CAAC,GAAgB,EAAE,OAAe;IACnD,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,qEAAqE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAEzF,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW;IAC/D,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,mEAAmE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAE5F,CAAC;IACd,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,iGAAiG;AACjG,SAAS,QAAQ,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,SAAiB;IACjF,GAAG,CAAC,IAAI,CAAC,6EAA6E,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACjH,GAAG,CAAC,IAAI,CAAC,8CAA8C,EAAE,OAAO,CAAC,CAAC;IAClE,GAAG,CAAC,IAAI,CAAC,4CAA4C,EAAE,OAAO,CAAC,CAAC;IAChE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,SAAS,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW;IACtE,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACzF,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACrF,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3C,OAAO;QACL,KAAK,EAAE,WAAW;QAClB,KAAK;QACL,WAAW,EAAE;YACX,IAAI,EAAE,OAAO,CAAC,WAAW,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,GAAG,GAAG;YAC/D,KAAK,EAAE,OAAO,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC;SACtE;QACD,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;KAC/D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,GAAW;IAC1F,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,+DAA+D,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAE/F,CAAC;IACd,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC,SAAS,CAAC;IAClC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW;IAC1E,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,uDAAuD,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5G,GAAG,CAAC,IAAI,CAAC,qDAAqD,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9E,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAAgB,EAAE,OAAe,EAAE,KAAa;IACzE,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,kEAAkE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAC1G,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAa,CACvB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAgB,EAChB,OAAe,EACf,SAAiB,EACjB,GAAW,EACX,KAAK,GAAW,kBAAkB;IAElC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,SAAS,GAAG,GAAG,GAAG,KAAK,CAAC;IAC9B,GAAG,CAAC,IAAI,CACN,wFAAwF,EACxF,OAAO,EACP,SAAS,EACT,SAAS,CACV,CAAC;IACF,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,SAAiB,EAAE,GAAW;IACvG,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;AACxD,CAAC"}
|
package/dist/places.d.ts
ADDED
|
@@ -0,0 +1,94 @@
|
|
|
1
|
+
import { type FetchLike } from '@substrat-run/kernel';
|
|
2
|
+
import type { AuthChoice } from './instance-auth.js';
|
|
3
|
+
import type { IdentityStub } from './identity-do.js';
|
|
4
|
+
/**
|
|
5
|
+
* The vertical's half of a login's PLACES (#1670): telling the identity pool when a `sub`
|
|
6
|
+
* becomes, or stops being, bound in this app's scope.
|
|
7
|
+
*
|
|
8
|
+
* The index lives at the issuer, keyed on the `sub` it minted, and is shown only to that login
|
|
9
|
+
* on the issuer's own origin. A vertical never reads it; this module only writes to it, and
|
|
10
|
+
* only about its own scope. What the vertical says is deliberately thin: "this subject is bound
|
|
11
|
+
* here" or "no longer", authenticated as the OIDC client the platform registered for this app.
|
|
12
|
+
* Which tenant, hostname and name the entry carries is the platform's registration, not
|
|
13
|
+
* anything sent from here, and the issuer keeps an addition only for a login it has itself
|
|
14
|
+
* issued to this client for (`demos/auth-server/src/places.ts` has the checks).
|
|
15
|
+
*
|
|
16
|
+
* ## When it reports
|
|
17
|
+
*
|
|
18
|
+
* - **`observePlace`**, after the vertical resolves a signed-in subject (its `/api/me`):
|
|
19
|
+
* bound ⇒ present, unbound ⇒ absent. Deduplicated per isolate, so it costs one request per
|
|
20
|
+
* login per isolate, not per page load. It catches every way a binding is made (the first
|
|
21
|
+
* sign-in claiming the owner seat, a claim link, an accepted invite) at the next request
|
|
22
|
+
* the person makes, without wiring each of those paths.
|
|
23
|
+
* - **`unbindMember`**, which removes a binding and reports it gone in the same call.
|
|
24
|
+
* - **`reportScopeMembers`**, the repair: the whole set bound in the scope, which drops every
|
|
25
|
+
* entry it does not name. Run it from the platform's reconcile.
|
|
26
|
+
*
|
|
27
|
+
* Every report is best-effort and **never throws**: a login must never fail because the index
|
|
28
|
+
* could not be told. A lost report is what the repair exists for.
|
|
29
|
+
*
|
|
30
|
+
* ## Which issuers hear anything
|
|
31
|
+
*
|
|
32
|
+
* Only one that answers `PLACES_DISCOVERY_PATH`, which the platform's team auth-server does. An
|
|
33
|
+
* external issuer (Supabase, Auth0, …) keeps no index for us, so it is asked once per isolate
|
|
34
|
+
* where to report, answers 404, and is never sent a report.
|
|
35
|
+
*/
|
|
36
|
+
/** How a report came out. Never thrown; for a caller that logs it and a test that pins it. */
|
|
37
|
+
export type PlaceReportResult = {
|
|
38
|
+
outcome: 'sent';
|
|
39
|
+
}
|
|
40
|
+
/** The issuer keeps no places index (an external issuer) — nothing was sent. */
|
|
41
|
+
| {
|
|
42
|
+
outcome: 'no-index';
|
|
43
|
+
}
|
|
44
|
+
/** The issuer refused: credentials, registration or scope. Its status says which. */
|
|
45
|
+
| {
|
|
46
|
+
outcome: 'refused';
|
|
47
|
+
status: number;
|
|
48
|
+
} | {
|
|
49
|
+
outcome: 'failed';
|
|
50
|
+
reason: string;
|
|
51
|
+
};
|
|
52
|
+
export interface PlacesReporter {
|
|
53
|
+
/** The issuer this reporter reports to. */
|
|
54
|
+
readonly issuer: string;
|
|
55
|
+
present(scopeId: string, sub: string): Promise<PlaceReportResult>;
|
|
56
|
+
absent(scopeId: string, sub: string): Promise<PlaceReportResult>;
|
|
57
|
+
/** The WHOLE set bound in the scope. At most `MAX_PLACE_MEMBERS`. */
|
|
58
|
+
replace(scopeId: string, subs: readonly string[]): Promise<PlaceReportResult>;
|
|
59
|
+
}
|
|
60
|
+
/**
|
|
61
|
+
* The reporter for an instance's configured identity, or null when it has none to report
|
|
62
|
+
* with: no delivered `substrat:auth`, or one without a client secret (a public client cannot
|
|
63
|
+
* authenticate a report, and the issuer would refuse it).
|
|
64
|
+
*/
|
|
65
|
+
export declare function placesReporter(opts: {
|
|
66
|
+
identity: AuthChoice | null;
|
|
67
|
+
fetch?: FetchLike;
|
|
68
|
+
now?: () => number;
|
|
69
|
+
}): PlacesReporter | null;
|
|
70
|
+
/**
|
|
71
|
+
* Tell the pool what a resolve just established: `principal` non-null ⇒ the subject is bound
|
|
72
|
+
* in this scope, null ⇒ it is not. Reported once per isolate per state and per hour. A report
|
|
73
|
+
* that FAILED is not remembered, so the next request retries it.
|
|
74
|
+
*/
|
|
75
|
+
export declare function observePlace(reporter: PlacesReporter | null, scopeId: string, sub: string, principal: string | null, now?: () => number): Promise<PlaceReportResult | null>;
|
|
76
|
+
/**
|
|
77
|
+
* Remove a member: unbind the subject from the scope in the tenant's directory, then tell the
|
|
78
|
+
* pool the place is gone. Returns whether a binding was there. The unbinding is the fact; the
|
|
79
|
+
* report can be lost, and the next repair drops the entry regardless.
|
|
80
|
+
*/
|
|
81
|
+
export declare function unbindMember(directory: Pick<IdentityStub, 'unbind'>, reporter: PlacesReporter | null, scopeId: string, sub: string): Promise<{
|
|
82
|
+
unbound: boolean;
|
|
83
|
+
report: PlaceReportResult | null;
|
|
84
|
+
}>;
|
|
85
|
+
/**
|
|
86
|
+
* The repair: report the WHOLE set of subjects bound in the scope, so the pool's entries for
|
|
87
|
+
* this app become exactly those (a lost `present` and a lost `absent` both heal). A scope with
|
|
88
|
+
* more than `MAX_PLACE_MEMBERS` bindings is refused and logged, never half-reported: a partial
|
|
89
|
+
* set would REMOVE every entry it left out.
|
|
90
|
+
*/
|
|
91
|
+
export declare function reportScopeMembers(directory: Pick<IdentityStub, 'subjectsOf'>, reporter: PlacesReporter | null, scopeId: string, log?: (line: string) => void): Promise<PlaceReportResult | null>;
|
|
92
|
+
/** For tests: forget what this isolate discovered and observed. */
|
|
93
|
+
export declare function resetPlacesMemo(): void;
|
|
94
|
+
//# sourceMappingURL=places.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"places.d.ts","sourceRoot":"","sources":["../src/places.ts"],"names":[],"mappings":"AAKA,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,8FAA8F;AAC9F,MAAM,MAAM,iBAAiB,GACzB;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE;AACrB,gFAAgF;GAC9E;IAAE,OAAO,EAAE,UAAU,CAAA;CAAE;AACzB,qFAAqF;GACnF;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,OAAO,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C,MAAM,WAAW,cAAc;IAC7B,2CAA2C;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAClE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjE,qEAAqE;IACrE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC/E;AA4BD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC;IAC5B,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GAAG,cAAc,GAAG,IAAI,CAsCxB;AAoBD;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,cAAc,GAAG,IAAI,EAC/B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,GAAG,GAAE,MAAM,MAAiB,GAC3B,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAanC;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,EACvC,QAAQ,EAAE,cAAc,GAAG,IAAI,EAC/B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAAE,CAAC,CAMjE;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,EAC3C,QAAQ,EAAE,cAAc,GAAG,IAAI,EAC/B,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAmC,GACzD,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAgBnC;AAED,mEAAmE;AACnE,wBAAgB,eAAe,IAAI,IAAI,CAGtC"}
|
package/dist/places.js
ADDED
|
@@ -0,0 +1,150 @@
|
|
|
1
|
+
import { MAX_PLACE_MEMBERS, PLACES_DISCOVERY_PATH, placesDiscovery, } from '@substrat-run/contracts';
|
|
2
|
+
import { globalFetch } from '@substrat-run/kernel';
|
|
3
|
+
/** How long an issuer's answer to discovery is believed, either way. */
|
|
4
|
+
const DISCOVERY_TTL_MS = 10 * 60_000;
|
|
5
|
+
/** Per isolate: issuer → where it takes reports (null = it keeps no index), and until when. */
|
|
6
|
+
const discovered = new Map();
|
|
7
|
+
const reasonOf = (e) => (e instanceof Error ? e.message : String(e));
|
|
8
|
+
async function reportEndpointOf(issuer, fetchImpl, now) {
|
|
9
|
+
const cached = discovered.get(issuer);
|
|
10
|
+
if (cached && cached.until > now)
|
|
11
|
+
return cached.endpoint;
|
|
12
|
+
const res = await fetchImpl(`${issuer.replace(/\/$/, '')}${PLACES_DISCOVERY_PATH}`, {
|
|
13
|
+
headers: { accept: 'application/json' },
|
|
14
|
+
});
|
|
15
|
+
// A definite "no" is a 4xx. A 5xx or a network failure is NOT an answer, so it is thrown
|
|
16
|
+
// and not cached: an issuer that hiccuped must not be written off for ten minutes.
|
|
17
|
+
if (res.status >= 500)
|
|
18
|
+
throw new Error(`places discovery at ${issuer} answered ${res.status}`);
|
|
19
|
+
let endpoint = null;
|
|
20
|
+
if (res.ok) {
|
|
21
|
+
const parsed = placesDiscovery.safeParse(await res.json().catch(() => null));
|
|
22
|
+
endpoint = parsed.success ? parsed.data.report_endpoint : null;
|
|
23
|
+
}
|
|
24
|
+
discovered.set(issuer, { endpoint, until: now + DISCOVERY_TTL_MS });
|
|
25
|
+
return endpoint;
|
|
26
|
+
}
|
|
27
|
+
/**
|
|
28
|
+
* The reporter for an instance's configured identity, or null when it has none to report
|
|
29
|
+
* with: no delivered `substrat:auth`, or one without a client secret (a public client cannot
|
|
30
|
+
* authenticate a report, and the issuer would refuse it).
|
|
31
|
+
*/
|
|
32
|
+
export function placesReporter(opts) {
|
|
33
|
+
const identity = opts.identity;
|
|
34
|
+
if (!identity?.issuer || !identity.clientId || !identity.clientSecret)
|
|
35
|
+
return null;
|
|
36
|
+
const { issuer, clientId, clientSecret } = identity;
|
|
37
|
+
const fetchImpl = opts.fetch ?? globalFetch;
|
|
38
|
+
const now = opts.now ?? Date.now;
|
|
39
|
+
async function send(body) {
|
|
40
|
+
try {
|
|
41
|
+
const endpoint = await reportEndpointOf(issuer, fetchImpl, now());
|
|
42
|
+
if (!endpoint)
|
|
43
|
+
return { outcome: 'no-index' };
|
|
44
|
+
const res = await fetchImpl(endpoint, {
|
|
45
|
+
method: 'POST',
|
|
46
|
+
headers: { 'content-type': 'application/json' },
|
|
47
|
+
body: JSON.stringify({ client_id: clientId, client_secret: clientSecret, ...body }),
|
|
48
|
+
});
|
|
49
|
+
if (res.status === 204 || res.ok)
|
|
50
|
+
return { outcome: 'sent' };
|
|
51
|
+
if (res.status >= 400 && res.status < 500)
|
|
52
|
+
return { outcome: 'refused', status: res.status };
|
|
53
|
+
return { outcome: 'failed', reason: `places report answered ${res.status}` };
|
|
54
|
+
}
|
|
55
|
+
catch (e) {
|
|
56
|
+
return { outcome: 'failed', reason: reasonOf(e) };
|
|
57
|
+
}
|
|
58
|
+
}
|
|
59
|
+
return {
|
|
60
|
+
issuer,
|
|
61
|
+
present: (scopeId, sub) => send({ scope_id: scopeId, op: 'present', sub }),
|
|
62
|
+
absent: (scopeId, sub) => send({ scope_id: scopeId, op: 'absent', sub }),
|
|
63
|
+
replace: async (scopeId, subs) => {
|
|
64
|
+
if (subs.length > MAX_PLACE_MEMBERS) {
|
|
65
|
+
return { outcome: 'failed', reason: `${subs.length} subjects exceed the ${MAX_PLACE_MEMBERS} one repair may carry` };
|
|
66
|
+
}
|
|
67
|
+
return send({ scope_id: scopeId, op: 'replace', subs: [...subs] });
|
|
68
|
+
},
|
|
69
|
+
};
|
|
70
|
+
}
|
|
71
|
+
/** How many observations one isolate remembers before it forgets the oldest. */
|
|
72
|
+
const OBSERVED_LIMIT = 5_000;
|
|
73
|
+
/**
|
|
74
|
+
* How long a landed report is believed. Long enough that an active login costs one request an
|
|
75
|
+
* hour, not one per page; short enough that the index heals for anyone still using the app
|
|
76
|
+
* even if the pool somehow lost what it was told.
|
|
77
|
+
*/
|
|
78
|
+
const OBSERVED_TTL_MS = 60 * 60_000;
|
|
79
|
+
/**
|
|
80
|
+
* How long a REFUSAL is believed. An app the platform has not registered yet is refused until
|
|
81
|
+
* the dashboard's next pass registers it, which is minutes, so asking again on every request
|
|
82
|
+
* would be noise and never asking again would leave the entry to the next repair.
|
|
83
|
+
*/
|
|
84
|
+
const REFUSED_TTL_MS = 5 * 60_000;
|
|
85
|
+
/** Per isolate: `issuer|scope|sub` → the state last reported, and until when to believe it. */
|
|
86
|
+
const observed = new Map();
|
|
87
|
+
/**
|
|
88
|
+
* Tell the pool what a resolve just established: `principal` non-null ⇒ the subject is bound
|
|
89
|
+
* in this scope, null ⇒ it is not. Reported once per isolate per state and per hour. A report
|
|
90
|
+
* that FAILED is not remembered, so the next request retries it.
|
|
91
|
+
*/
|
|
92
|
+
export async function observePlace(reporter, scopeId, sub, principal, now = Date.now) {
|
|
93
|
+
if (!reporter)
|
|
94
|
+
return null;
|
|
95
|
+
const key = `${reporter.issuer}|${scopeId}|${sub}`;
|
|
96
|
+
const bound = principal !== null;
|
|
97
|
+
const seen = observed.get(key);
|
|
98
|
+
if (seen && seen.bound === bound && seen.until > now())
|
|
99
|
+
return null;
|
|
100
|
+
const result = bound ? await reporter.present(scopeId, sub) : await reporter.absent(scopeId, sub);
|
|
101
|
+
if (result.outcome !== 'failed') {
|
|
102
|
+
observed.delete(key);
|
|
103
|
+
observed.set(key, { bound, until: now() + (result.outcome === 'refused' ? REFUSED_TTL_MS : OBSERVED_TTL_MS) });
|
|
104
|
+
if (observed.size > OBSERVED_LIMIT)
|
|
105
|
+
observed.delete(observed.keys().next().value);
|
|
106
|
+
}
|
|
107
|
+
return result;
|
|
108
|
+
}
|
|
109
|
+
/**
|
|
110
|
+
* Remove a member: unbind the subject from the scope in the tenant's directory, then tell the
|
|
111
|
+
* pool the place is gone. Returns whether a binding was there. The unbinding is the fact; the
|
|
112
|
+
* report can be lost, and the next repair drops the entry regardless.
|
|
113
|
+
*/
|
|
114
|
+
export async function unbindMember(directory, reporter, scopeId, sub) {
|
|
115
|
+
const unbound = await directory.unbind(scopeId, sub);
|
|
116
|
+
const report = reporter ? await reporter.absent(scopeId, sub) : null;
|
|
117
|
+
// Whatever this isolate remembered about the subject is now wrong.
|
|
118
|
+
if (reporter)
|
|
119
|
+
observed.delete(`${reporter.issuer}|${scopeId}|${sub}`);
|
|
120
|
+
return { unbound, report };
|
|
121
|
+
}
|
|
122
|
+
/**
|
|
123
|
+
* The repair: report the WHOLE set of subjects bound in the scope, so the pool's entries for
|
|
124
|
+
* this app become exactly those (a lost `present` and a lost `absent` both heal). A scope with
|
|
125
|
+
* more than `MAX_PLACE_MEMBERS` bindings is refused and logged, never half-reported: a partial
|
|
126
|
+
* set would REMOVE every entry it left out.
|
|
127
|
+
*/
|
|
128
|
+
export async function reportScopeMembers(directory, reporter, scopeId, log = (line) => console.warn(line)) {
|
|
129
|
+
if (!reporter)
|
|
130
|
+
return null;
|
|
131
|
+
let subs;
|
|
132
|
+
try {
|
|
133
|
+
subs = await directory.subjectsOf(scopeId, MAX_PLACE_MEMBERS + 1);
|
|
134
|
+
}
|
|
135
|
+
catch (e) {
|
|
136
|
+
return { outcome: 'failed', reason: reasonOf(e) };
|
|
137
|
+
}
|
|
138
|
+
if (subs.length > MAX_PLACE_MEMBERS) {
|
|
139
|
+
log(`vertical-auth: places repair for scope ${scopeId} skipped — more than ${MAX_PLACE_MEMBERS} bindings; ` +
|
|
140
|
+
'a partial set would remove every entry it left out');
|
|
141
|
+
return { outcome: 'failed', reason: `more than ${MAX_PLACE_MEMBERS} bindings` };
|
|
142
|
+
}
|
|
143
|
+
return reporter.replace(scopeId, subs);
|
|
144
|
+
}
|
|
145
|
+
/** For tests: forget what this isolate discovered and observed. */
|
|
146
|
+
export function resetPlacesMemo() {
|
|
147
|
+
discovered.clear();
|
|
148
|
+
observed.clear();
|
|
149
|
+
}
|
|
150
|
+
//# sourceMappingURL=places.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"places.js","sourceRoot":"","sources":["../src/places.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,GAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,EAAkB,MAAM,sBAAsB,CAAC;AAuDnE,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,EAAE,GAAG,MAAM,CAAC;AAErC,+FAA+F;AAC/F,MAAM,UAAU,GAAG,IAAI,GAAG,EAAsD,CAAC;AAEjF,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAEtF,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,SAAoB,EAAE,GAAW;IAC/E,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,GAAG,GAAG;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,qBAAqB,EAAE,EAAE;QAClF,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACxC,CAAC,CAAC;IACH,yFAAyF;IACzF,mFAAmF;IACnF,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/F,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7E,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,CAAC;IACD,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,GAAG,gBAAgB,EAAE,CAAC,CAAC;IACpE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAI9B;IACC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IACnF,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,QAAQ,CAAC;IACpD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAKjC,KAAK,UAAU,IAAI,CAAC,IAAgB;QAClC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;YAClE,IAAI,CAAC,QAAQ;gBAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;YAC9C,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE;gBACpC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,CAAC;aACpF,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YAC7D,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;gBAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;YAC7F,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,0BAA0B,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM;QACN,OAAO,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QAC1E,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;QACxE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;YAC/B,IAAI,IAAI,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;gBACpC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,wBAAwB,iBAAiB,uBAAuB,EAAE,CAAC;YACvH,CAAC;YACD,OAAO,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B;;;;GAIG;AACH,MAAM,eAAe,GAAG,EAAE,GAAG,MAAM,CAAC;AACpC;;;;GAIG;AACH,MAAM,cAAc,GAAG,CAAC,GAAG,MAAM,CAAC;AAElC,+FAA+F;AAC/F,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA6C,CAAC;AAEtE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAA+B,EAC/B,OAAe,EACf,GAAW,EACX,SAAwB,EACxB,GAAG,GAAiB,IAAI,CAAC,GAAG;IAE5B,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,MAAM,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,SAAS,KAAK,IAAI,CAAC;IACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAClG,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAC/G,IAAI,QAAQ,CAAC,IAAI,GAAG,cAAc;YAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,SAAuC,EACvC,QAA+B,EAC/B,OAAe,EACf,GAAW;IAEX,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,mEAAmE;IACnE,IAAI,QAAQ;QAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;IACtE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAA2C,EAC3C,QAA+B,EAC/B,OAAe,EACf,GAAG,GAA2B,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;IAE1D,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACpC,GAAG,CACD,0CAA0C,OAAO,wBAAwB,iBAAiB,aAAa;YACrG,oDAAoD,CACvD,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,iBAAiB,WAAW,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,eAAe;IAC7B,UAAU,CAAC,KAAK,EAAE,CAAC;IACnB,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC"}
|
package/dist/provider.d.ts
CHANGED
|
@@ -32,6 +32,11 @@ export interface AuthSubject {
|
|
|
32
32
|
}
|
|
33
33
|
export interface AuthProvider {
|
|
34
34
|
handle(request: Request): Promise<Response>;
|
|
35
|
-
|
|
35
|
+
/**
|
|
36
|
+
* `url` is the request's own URL, when the caller has it. Optional and additive: a
|
|
37
|
+
* provider that needs the origin (an OIDC bearer on a shared issuer holds an MCP token
|
|
38
|
+
* to this app's own resource, #1683) falls back to the `Host` header without it.
|
|
39
|
+
*/
|
|
40
|
+
resolve(headers: Headers, url?: string): Promise<AuthSubject | null>;
|
|
36
41
|
}
|
|
37
42
|
//# sourceMappingURL=provider.d.ts.map
|
package/dist/provider.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,WAAW;IAC1B,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,WAAW;IAC1B,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C;;;;OAIG;IACH,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACtE"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@substrat-run/vertical-auth",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.15.0",
|
|
4
4
|
"description": "Pluggable auth for Substrat verticals — the AuthProvider contract, an OIDC provider (Supabase/Auth0/AuthHero/Keycloak), a full relying-party login flow, and a per-tenant identity Durable Object (Better Auth + sub→principal directory). Workers-targeted; the vertical worker bundles it.",
|
|
5
5
|
"license": "AGPL-3.0-only",
|
|
6
6
|
"repository": {
|
|
@@ -44,9 +44,9 @@
|
|
|
44
44
|
"better-auth": "^1.7.1",
|
|
45
45
|
"drizzle-orm": "^0.45.2",
|
|
46
46
|
"jose": "^6.2.3",
|
|
47
|
-
"@substrat-run/
|
|
48
|
-
"@substrat-run/contracts": "^0.116.0",
|
|
47
|
+
"@substrat-run/contracts": "^0.118.0",
|
|
49
48
|
"@substrat-run/oidc-rp": "^0.9.0",
|
|
49
|
+
"@substrat-run/kernel": "^0.118.0",
|
|
50
50
|
"@substrat-run/psl": "^0.2.5"
|
|
51
51
|
},
|
|
52
52
|
"peerDependencies": {
|