@substrat-run/vertical-auth 0.18.5 → 0.19.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +7 -3
- package/dist/identity-do.d.ts +25 -10
- package/dist/identity-do.d.ts.map +1 -1
- package/dist/identity-do.js +30 -10
- package/dist/identity-do.js.map +1 -1
- package/dist/index.d.ts +1 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +2 -2
- package/dist/index.js.map +1 -1
- package/dist/invite-routes.d.ts.map +1 -1
- package/dist/invite-routes.js +1 -25
- package/dist/invite-routes.js.map +1 -1
- package/dist/owner-claim-link.d.ts +48 -14
- package/dist/owner-claim-link.d.ts.map +1 -1
- package/dist/owner-claim-link.js +55 -14
- package/dist/owner-claim-link.js.map +1 -1
- package/dist/owner-claim-routes.d.ts +90 -0
- package/dist/owner-claim-routes.d.ts.map +1 -0
- package/dist/owner-claim-routes.js +76 -0
- package/dist/owner-claim-routes.js.map +1 -0
- package/dist/owner-seat.d.ts +50 -11
- package/dist/owner-seat.d.ts.map +1 -1
- package/dist/owner-seat.js +78 -16
- package/dist/owner-seat.js.map +1 -1
- package/dist/request-body.d.ts +18 -0
- package/dist/request-body.d.ts.map +1 -0
- package/dist/request-body.js +31 -0
- package/dist/request-body.js.map +1 -0
- package/package.json +11 -7
package/README.md
CHANGED
|
@@ -57,9 +57,13 @@ emit), and bound later by a verified subject — two ways:
|
|
|
57
57
|
the app seconds later. After that a plain sign-in binds nobody: an instance nobody opened (a CI
|
|
58
58
|
deploy, an issuer with open sign-up) is no longer a seat anyone can take, indefinitely.
|
|
59
59
|
- **A claim link.** The platform asks `mintOwnerClaim` under its secret and the dashboard hands
|
|
60
|
-
the installer a short-lived `/?claim=<
|
|
61
|
-
|
|
62
|
-
|
|
60
|
+
the installer a short-lived `/?claim=<secret>` link. The link is a `become` capability in the
|
|
61
|
+
scope's own Durable Object: it expires after `OWNER_CLAIM_TTL_MS` (15 minutes), works once,
|
|
62
|
+
and its exchange is on the spine. The identity directory records which capability is the
|
|
63
|
+
current link, so minting again retires the earlier one (and revokes it in the scope).
|
|
64
|
+
`mintOwnerClaimLink` mints, records and revokes in one call, so a vertical's hook is a
|
|
65
|
+
one-liner. `mountOwnerClaim` (`@substrat-run/vertical-auth/owner-claim-routes`) is the
|
|
66
|
+
redemption, `POST /api/claim-owner`: one route, so a vertical does not write its own.
|
|
63
67
|
|
|
64
68
|
A closed window is not a lost desk: the seat stays pending (`needsSetup` keeps saying so, and
|
|
65
69
|
`ownerSeat` says *why* — open, closed, or already claimed) until a claim binds it. A re-provision
|
package/dist/identity-do.d.ts
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
import { DurableObject } from 'cloudflare:workers';
|
|
2
2
|
import type { AuthProvider } from './provider.js';
|
|
3
3
|
import { type SiteRow } from './site-registry.js';
|
|
4
|
-
import { type OwnerSeat, type OwnerTransfer, type OwnerTransferAbandon } from './owner-seat.js';
|
|
4
|
+
import { type OwnerClaimLinkRow, type OwnerSeat, type OwnerTransfer, type OwnerTransferAbandon } from './owner-seat.js';
|
|
5
5
|
export type IdentityDoEnv = Record<string, never>;
|
|
6
6
|
export declare class IdentityDO extends DurableObject<IdentityDoEnv> {
|
|
7
7
|
/** This tenant's Better Auth signing secret — generated in this DO, never shared, never a worker binding. */
|
|
@@ -97,16 +97,28 @@ export declare class IdentityDO extends DurableObject<IdentityDoEnv> {
|
|
|
97
97
|
*/
|
|
98
98
|
resolvePrincipal(scopeId: string, sub: string): Promise<string | null>;
|
|
99
99
|
/**
|
|
100
|
-
*
|
|
101
|
-
*
|
|
102
|
-
* replaces the previous link. Null ⇒ the seat is already claimed (nothing to mint).
|
|
100
|
+
* The principal a claim link would bind — the pending owner — or null when the seat is not
|
|
101
|
+
* pending (#1686). What a mint reads before asking the scope for a `become` capability.
|
|
103
102
|
*/
|
|
104
|
-
|
|
105
|
-
|
|
103
|
+
ownerClaimTarget(scopeId: string): Promise<string | null>;
|
|
104
|
+
/**
|
|
105
|
+
* Record a minted `become` capability as the scope's one claim link (#1686), replacing the
|
|
106
|
+
* previous link. Returns the previous capability id for the caller to revoke; null (nothing
|
|
107
|
+
* written) when the seat is no longer pending for `principal`.
|
|
108
|
+
*/
|
|
109
|
+
recordOwnerClaim(scopeId: string, principal: string, link: OwnerClaimLinkRow): Promise<{
|
|
110
|
+
previous: string | null;
|
|
106
111
|
} | null>;
|
|
112
|
+
/** Is `tokenHash` the scope's live claim link? Asked before an exchange spends a use (#1686). */
|
|
113
|
+
ownerClaimMatches(scopeId: string, tokenHash: string): Promise<boolean>;
|
|
114
|
+
/**
|
|
115
|
+
* Claim the seat with an exchanged claim-link capability (#1686): binds the subject when the
|
|
116
|
+
* capability is the recorded live link and names the pending owner. Null otherwise.
|
|
117
|
+
*/
|
|
118
|
+
claimOwnerByCapability(scopeId: string, sub: string, capabilityId: string, principal: string): Promise<string | null>;
|
|
107
119
|
/**
|
|
108
|
-
*
|
|
109
|
-
*
|
|
120
|
+
* LEGACY — claim the seat with a link minted before #1686, by its token's hash. Redeem-only;
|
|
121
|
+
* remove with `claimOwner` in owner-seat.ts (see the date there).
|
|
110
122
|
*/
|
|
111
123
|
claimOwner(scopeId: string, sub: string, tokenHash: string): Promise<string | null>;
|
|
112
124
|
/**
|
|
@@ -188,9 +200,12 @@ export type IdentityStub = {
|
|
|
188
200
|
needsSetup(scopeId: string): Promise<boolean>;
|
|
189
201
|
ownerSeat(scopeId: string): Promise<OwnerSeat>;
|
|
190
202
|
resolvePrincipal(scopeId: string, sub: string): Promise<string | null>;
|
|
191
|
-
|
|
192
|
-
|
|
203
|
+
ownerClaimTarget(scopeId: string): Promise<string | null>;
|
|
204
|
+
recordOwnerClaim(scopeId: string, principal: string, link: OwnerClaimLinkRow): Promise<{
|
|
205
|
+
previous: string | null;
|
|
193
206
|
} | null>;
|
|
207
|
+
ownerClaimMatches(scopeId: string, tokenHash: string): Promise<boolean>;
|
|
208
|
+
claimOwnerByCapability(scopeId: string, sub: string, capabilityId: string, principal: string): Promise<string | null>;
|
|
194
209
|
claimOwner(scopeId: string, sub: string, tokenHash: string): Promise<string | null>;
|
|
195
210
|
createInvite(scopeId: string, principal: string, roleKey: string, email: string | null, tokenHash: string): Promise<void>;
|
|
196
211
|
listInvites(scopeId: string): Promise<InviteRow[]>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"identity-do.d.ts","sourceRoot":"","sources":["../src/identity-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAKnD,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,eAAe,CAAC;AAG/D,OAAO,EAOL,KAAK,OAAO,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,
|
|
1
|
+
{"version":3,"file":"identity-do.d.ts","sourceRoot":"","sources":["../src/identity-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAKnD,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,eAAe,CAAC;AAG/D,OAAO,EAOL,KAAK,OAAO,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAaL,KAAK,iBAAiB,EAOtB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,oBAAoB,EAC1B,MAAM,iBAAiB,CAAC;AAiFzB,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAElD,qBAAa,UAAW,SAAQ,aAAa,CAAC,aAAa,CAAC;IAC1D,6GAA6G;IAC7G,OAAO,CAAC,UAAU,CAAU;IAE5B,YAAY,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,aAAa,EAmBtD;IAED;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnG;IAED;;;;;;;OAOG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAMrE;IAED;;;;;;OAMG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CASpG;IAED;;;;;OAKG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3E;IAED,uFAAuF;IACjF,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;IAED,0EAA0E;IACpE,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAEpC;IAED;;;;;OAKG;IACG,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE3D;IAED,oFAAoF;IACpF,OAAO,KAAK,WAAW,GAEtB;IAED;;;;;OAKG;IACG,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;IAED;;;;OAIG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE9D;IAED;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAE3G;IAED,kGAAkG;IAC5F,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEvF;IAED,iFAAiF;IAC3E,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAEzH;IAED;;;;OAIG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAElD;IAED,iHAAiH;IAC3G,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAEnD;IAED;;;;;;OAMG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE3E;IAED;;;OAGG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE9D;IAED;;;;OAIG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAE/H;IAED,iGAAiG;IAC3F,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE5E;IAED;;;OAGG;IACG,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE1H;IAED;;;OAGG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAExF;IAED;;;;OAIG;IACG,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK9H;IAED,oGAAoG;IAC9F,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAKvD;IAED;;;OAGG;IACG,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAM7E;IAED,qGAAqG;IAC/F,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGvE;IAED,0FAA0F;IACpF,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpE;IAED;;;;;OAKG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQzF;IAED;;;OAGG;IACG,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE3D;IAED;+FAC2F;IACrF,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAE3E;IAED,+FAA+F;IACzF,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAElE;IAED,kFAAkF;IAClF,OAAO,CAAC,IAAI;IAkBZ;;;;;;;;;OASG;IACY,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwCxD;CACF;AAED,2EAA2E;AAC3E,MAAM,MAAM,SAAS,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AASxG,sGAAsG;AACtG,MAAM,MAAM,YAAY,GAAG;IACzB,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3C,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/F,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChG,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAChC,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvD,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1D,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACvG,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnF,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACrH,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvE,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1D,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC3H,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxE,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtH,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpF,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1H,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACnD,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACzE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACrF,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC/D,CAAC;AAKF,KAAK,iBAAiB,GAAG,UAAU,SAAS,YAAY,GAAG,IAAI,GAAG,KAAK,CAAC;AACxE,KAAK,4BAA4B,GAAG,OAAO,CAAC,MAAM,UAAU,EAAE,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,CAAC;AACxG,eAAO,MAAM,gBAAgB,EAAE,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,IAAI,GAAG,KAAY,CAAC;AAE7H;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,EACjC,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACxE,YAAY,CASd"}
|
package/dist/identity-do.js
CHANGED
|
@@ -6,7 +6,7 @@ import * as schema from './auth-schema.js';
|
|
|
6
6
|
import { cookieDomainDecision, expireBetterAuthDomainCookies, forwardIdentityCookieConfig } from './cookie-domain.js';
|
|
7
7
|
import { parsePlatformBaseDomains } from '@substrat-run/contracts';
|
|
8
8
|
import { SITE_REGISTRY_DDL, recordSite as recordSiteRow, listSites as listSiteRows, resolveSiteScope as resolveSiteScopeRow, forgetSite as forgetSiteRow, } from './site-registry.js';
|
|
9
|
-
import { OWNER_SEAT_DDL, migrateOwnerSeat, recordOwnerSeat, ownerOfRecord as ownerOfRecordRow, needsSetup as needsSetupRow, ownerSeat as ownerSeatRow, resolvePrincipal as resolvePrincipalRow,
|
|
9
|
+
import { OWNER_SEAT_DDL, migrateOwnerSeat, recordOwnerSeat, ownerOfRecord as ownerOfRecordRow, needsSetup as needsSetupRow, ownerSeat as ownerSeatRow, resolvePrincipal as resolvePrincipalRow, ownerClaimTarget as ownerClaimTargetRow, recordOwnerClaim as recordOwnerClaimRow, ownerClaimMatches as ownerClaimMatchesRow, claimOwnerByCapability as claimOwnerByCapabilityRow, claimOwner as claimOwnerRow, unbindSubject as unbindSubjectRow, unbindPrincipal as unbindPrincipalRow, subjectsOf as subjectsOfRows, transferOwner as transferOwnerRow, completeOwnerTransfer as completeOwnerTransferRow, abandonOwnerTransfer as abandonOwnerTransferRow, } from './owner-seat.js';
|
|
10
10
|
/**
|
|
11
11
|
* The per-tenant IDENTITY Durable Object — one per tenant, running its OWN Better Auth
|
|
12
12
|
* over its OWN SQLite (Drizzle's Durable-Object driver, not a shared D1), and holding the
|
|
@@ -55,8 +55,10 @@ const SCHEMA_STATEMENTS = [
|
|
|
55
55
|
// `pending_owner` (claimed and consumed), `owner_of_record` (#332, never consumed: the
|
|
56
56
|
// vertical's own durable memory of the owner, in this per-tenant DO rather than the scope's
|
|
57
57
|
// data DO, so it survives a scope-DO wipe and a reconcile can re-grant from it) and
|
|
58
|
-
// `
|
|
59
|
-
// `
|
|
58
|
+
// `owner_claim_capability` (which `become` capability is the current claim link, #1686; the
|
|
59
|
+
// legacy `owner_claim` hash rows of #925 are redeem-only until they expire). The tables and
|
|
60
|
+
// the rules over them live in `owner-seat.ts` so they are unit-tested without a DO; the
|
|
61
|
+
// methods below delegate there.
|
|
60
62
|
...OWNER_SEAT_DDL,
|
|
61
63
|
// Outstanding member invites (the post-setup join path). Each is a pre-minted principal +
|
|
62
64
|
// role the admin already granted at scope level, waiting for a login to claim it by token.
|
|
@@ -234,16 +236,34 @@ export class IdentityDO extends DurableObject {
|
|
|
234
236
|
return resolvePrincipalRow(this.registrySql, scopeId, sub, Date.now());
|
|
235
237
|
}
|
|
236
238
|
/**
|
|
237
|
-
*
|
|
238
|
-
*
|
|
239
|
-
* replaces the previous link. Null ⇒ the seat is already claimed (nothing to mint).
|
|
239
|
+
* The principal a claim link would bind — the pending owner — or null when the seat is not
|
|
240
|
+
* pending (#1686). What a mint reads before asking the scope for a `become` capability.
|
|
240
241
|
*/
|
|
241
|
-
async
|
|
242
|
-
return
|
|
242
|
+
async ownerClaimTarget(scopeId) {
|
|
243
|
+
return ownerClaimTargetRow(this.registrySql, scopeId);
|
|
243
244
|
}
|
|
244
245
|
/**
|
|
245
|
-
*
|
|
246
|
-
*
|
|
246
|
+
* Record a minted `become` capability as the scope's one claim link (#1686), replacing the
|
|
247
|
+
* previous link. Returns the previous capability id for the caller to revoke; null (nothing
|
|
248
|
+
* written) when the seat is no longer pending for `principal`.
|
|
249
|
+
*/
|
|
250
|
+
async recordOwnerClaim(scopeId, principal, link) {
|
|
251
|
+
return recordOwnerClaimRow(this.registrySql, scopeId, principal, link);
|
|
252
|
+
}
|
|
253
|
+
/** Is `tokenHash` the scope's live claim link? Asked before an exchange spends a use (#1686). */
|
|
254
|
+
async ownerClaimMatches(scopeId, tokenHash) {
|
|
255
|
+
return ownerClaimMatchesRow(this.registrySql, scopeId, tokenHash, Date.now());
|
|
256
|
+
}
|
|
257
|
+
/**
|
|
258
|
+
* Claim the seat with an exchanged claim-link capability (#1686): binds the subject when the
|
|
259
|
+
* capability is the recorded live link and names the pending owner. Null otherwise.
|
|
260
|
+
*/
|
|
261
|
+
async claimOwnerByCapability(scopeId, sub, capabilityId, principal) {
|
|
262
|
+
return claimOwnerByCapabilityRow(this.registrySql, scopeId, sub, capabilityId, principal, Date.now());
|
|
263
|
+
}
|
|
264
|
+
/**
|
|
265
|
+
* LEGACY — claim the seat with a link minted before #1686, by its token's hash. Redeem-only;
|
|
266
|
+
* remove with `claimOwner` in owner-seat.ts (see the date there).
|
|
247
267
|
*/
|
|
248
268
|
async claimOwner(scopeId, sub, tokenHash) {
|
|
249
269
|
return claimOwnerRow(this.registrySql, scopeId, sub, tokenHash, Date.now());
|
package/dist/identity-do.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"identity-do.js","sourceRoot":"","sources":["../src/identity-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AACrD,OAAO,KAAK,MAAM,MAAM,kBAAkB,CAAC;AAE3C,OAAO,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtH,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EACL,iBAAiB,EACjB,UAAU,IAAI,aAAa,EAC3B,SAAS,IAAI,YAAY,EACzB,gBAAgB,IAAI,mBAAmB,EACvC,UAAU,IAAI,aAAa,GAG5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,aAAa,IAAI,gBAAgB,EACjC,UAAU,IAAI,aAAa,EAC3B,SAAS,IAAI,YAAY,EACzB,gBAAgB,IAAI,mBAAmB,EACvC,cAAc,IAAI,iBAAiB,EACnC,UAAU,IAAI,aAAa,EAC3B,aAAa,IAAI,gBAAgB,EACjC,eAAe,IAAI,kBAAkB,EACrC,UAAU,IAAI,cAAc,EAC5B,aAAa,IAAI,gBAAgB,EACjC,qBAAqB,IAAI,wBAAwB,EACjD,oBAAoB,IAAI,uBAAuB,GAIhD,MAAM,iBAAiB,CAAC;AAEzB;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,iBAAiB,GAAa;IAClC;;;;0FAIwF;IACxF;;;;iEAI+D;IAC/D,oEAAoE;IACpE;;;;;;iCAM+B;IAC/B,oEAAoE;IACpE;;;0FAGwF;IACxF,qFAAqF;IACrF,wFAAwF;IACxF,4FAA4F;IAC5F,mFAAmF;IACnF,uFAAuF;IACvF,4FAA4F;IAC5F,oFAAoF;IACpF,0FAA0F;IAC1F,0FAA0F;IAC1F,GAAG,cAAc;IACjB,0FAA0F;IAC1F,2FAA2F;IAC3F,2FAA2F;IAC3F;;;0FAGwF;IACxF,iEAAiE;IACjE,wFAAwF;IACxF,+EAA+E;IAC/E,+EAA+E;IAC/E,sFAAsF;IACtF,wFAAwF;IACxF,mDAAmD;IACnD,uIAAuI;IACvI,8FAA8F;IAC9F,yFAAyF;IACzF,wFAAwF;IACxF,yFAAyF;IACzF,mFAAmF;IACnF,GAAG,iBAAiB;CACrB,CAAC;AAMF,MAAM,OAAO,UAAW,SAAQ,aAA4B;IAC1D,6GAA6G;IACrG,UAAU,CAAU;IAE5B,YAAY,GAAuB,EAAE,GAAkB;QACrD,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChB,GAAG,CAAC,qBAAqB,CAAC,KAAK,IAAI,EAAE;YACnC,KAAK,MAAM,IAAI,IAAI,iBAAiB;gBAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjE,oFAAoF;YACpF,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,GAA6B,CAAC,CAAC;YAC5D,sFAAsF;YACtF,qFAAqF;YACrF,mFAAmF;YACnF,2EAA2E;YAC3E,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC,CAAC,CAAC,CAAkC,CAAC;YAChI,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;gBACzD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;gBACtD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,2DAA2D,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACrG,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,OAA8C;QAClF,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACvB,6EAA6E,EAC7E,OAAO,EAAE,GAAG,EAAE,KAAK,CACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe;QAClC,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,wDAAwD,EAAE,OAAO,CAAC,EAAE,CAAC;YAC/G,MAAM,CAAC,GAAG,CAAC,GAAa,CAAC,GAAG,GAAG,CAAC,KAAe,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,MAAM,GAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC,CAAC,CAAC,CAAmC,EAAE,KAAK,CAAC;QAClJ,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;YACzD,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,8DAA8D,EAAE,MAAM,CAAC,CAAC;QACpG,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IAC3C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,IAAY,EAAE,IAAY;QAC1D,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,SAAS;QACb,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,OAAO,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,oFAAoF;IACpF,IAAY,WAAW;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAA6B,CAAC;IACxD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,SAAiB;QACtD,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe;QACpC,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,IAAY,EAAE,EAAU,EAAE,WAAoB;QACjF,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IAC5E,CAAC;IAED,kGAAkG;IAClG,KAAK,CAAC,qBAAqB,CAAC,OAAe,EAAE,IAAY,EAAE,EAAU;QACnE,OAAO,wBAAwB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,oBAAoB,CAAC,OAAe,EAAE,IAAY,EAAE,EAAU,EAAE,WAAoB;QACxF,OAAO,uBAAuB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IACnF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,OAAO,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAED,iHAAiH;IACjH,KAAK,CAAC,SAAS,CAAC,OAAe;QAC7B,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,GAAW;QACjD,OAAO,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACzE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,SAAiB;QACrD,OAAO,iBAAiB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,GAAW,EAAE,SAAiB;QAC9D,OAAO,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,SAAiB,EAAE,OAAe,EAAE,KAAoB,EAAE,SAAiB;QAC7G,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACvB,8FAA8F,EAC9F,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAC9C,CAAC;IACJ,CAAC;IAED,oGAAoG;IACpG,KAAK,CAAC,WAAW,CAAC,OAAe;QAC/B,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAClC,uHAAuH,EACvH,OAAO,CACR,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,SAAiB;QAChD,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACrC,gHAAgH,EAChH,OAAO,EAAE,SAAS,CACnB,CAAC,CAAC,CAAC,CAAC,CAAC;QACN,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;IAED,qGAAqG;IACrG,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,SAAiB;QACnD,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,4EAA4E,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9I,OAAO,CAAC,KAAK,SAAS,CAAC;IACzB,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,SAAiB;QACnD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,yEAAyE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3H,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,OAAe,EAAE,GAAW,EAAE,SAAiB;QAC/D,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,oFAAoF,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAEzI,CAAC;QACd,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,6EAA6E,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QACtI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,qEAAqE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACrH,OAAO,GAAG,CAAC,SAAS,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,GAAW;QACvC,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED;+FAC2F;IAC3F,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,SAAiB;QACtD,OAAO,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAClE,CAAC;IAED,+FAA+F;IAC/F,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,KAAa;QAC7C,OAAO,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED,kFAAkF;IAC1E,IAAI,CAAC,MAAc,EAAE,YAA4B,EAAE,sBAAsB,GAAG,KAAK;QACvF,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,UAAU,CAAC;YAChB,QAAQ,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAC5D,gBAAgB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE;YAC3E,qFAAqF;YACrF,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU;YAC/F,OAAO,EAAE,MAAM;YACf,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,iFAAiF;YACjF,oFAAoF;YACpF,sFAAsF;YACtF,GAAG,CAAC,YAAY;gBACd,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE;gBAClF,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACM,KAAK,CAAC,KAAK,CAAC,OAAgB;QACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,oBAAoB,CAClE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,SAAS,EAC5D,GAAG,CAAC,QAAQ,EACZ,wBAAwB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,CAClF,CAAC;QACF,IAAI,aAAa,EAAE,CAAC;YAClB,8EAA8E;YAC9E,8EAA8E;YAC9E,uDAAuD;YACvD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAC1C,+DAA+D,CAChE,CAAC,CAAC,CAAC,CAAkC,CAAC;YACvC,IAAI,MAAM,EAAE,KAAK,KAAK,aAAa,EAAE,CAAC;gBACpC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;gBACjD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACvB,iFAAiF,EAAE,aAAa,CACjG,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,aAAa,KAAK,IAAI,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,CAAC,QAAkB,EAAY,EAAE,CACnD,6BAA6B,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACrE,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,MAAM,OAAO,GAAuB,OAAO,EAAE,IAAI;gBAC/C,CAAC,CAAC;oBACE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;oBACpB,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI;oBACjC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI;oBAC/B,oEAAoE;oBACpE,6EAA6E;oBAC7E,sCAAsC;oBACtC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa;iBAC1C;gBACH,CAAC,CAAC,IAAI,CAAC;YACT,OAAO,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,WAAW,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;CACF;AAKD,MAAM,WAAW,GAAG,CAAC,CAAkC,EAAa,EAAE,CAAC,CAAC;IACtE,SAAS,EAAE,CAAC,CAAC,SAAmB;IAChC,OAAO,EAAE,CAAC,CAAC,QAAkB;IAC7B,KAAK,EAAG,CAAC,CAAC,KAAuB,IAAI,IAAI;IACzC,SAAS,EAAE,CAAC,CAAC,UAAoB;CAClC,CAAC,CAAC;AAsCH,MAAM,CAAC,MAAM,gBAAgB,GAA2F,IAAI,CAAC;AAE7H;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAiC,EACjC,MAAc,EACd,IAAyE;IAEzE,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAW,EAAE,CAAC,2BAA2B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1F,OAAO;QACL,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACjD,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,GAAG,MAAM,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YACvF,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;QAClD,CAAC;KACF,CAAC;AACJ,CAAC"}
|
|
1
|
+
{"version":3,"file":"identity-do.js","sourceRoot":"","sources":["../src/identity-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AACrD,OAAO,KAAK,MAAM,MAAM,kBAAkB,CAAC;AAE3C,OAAO,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtH,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EACL,iBAAiB,EACjB,UAAU,IAAI,aAAa,EAC3B,SAAS,IAAI,YAAY,EACzB,gBAAgB,IAAI,mBAAmB,EACvC,UAAU,IAAI,aAAa,GAG5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,aAAa,IAAI,gBAAgB,EACjC,UAAU,IAAI,aAAa,EAC3B,SAAS,IAAI,YAAY,EACzB,gBAAgB,IAAI,mBAAmB,EACvC,gBAAgB,IAAI,mBAAmB,EACvC,gBAAgB,IAAI,mBAAmB,EACvC,iBAAiB,IAAI,oBAAoB,EACzC,sBAAsB,IAAI,yBAAyB,EACnD,UAAU,IAAI,aAAa,EAE3B,aAAa,IAAI,gBAAgB,EACjC,eAAe,IAAI,kBAAkB,EACrC,UAAU,IAAI,cAAc,EAC5B,aAAa,IAAI,gBAAgB,EACjC,qBAAqB,IAAI,wBAAwB,EACjD,oBAAoB,IAAI,uBAAuB,GAIhD,MAAM,iBAAiB,CAAC;AAEzB;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,iBAAiB,GAAa;IAClC;;;;0FAIwF;IACxF;;;;iEAI+D;IAC/D,oEAAoE;IACpE;;;;;;iCAM+B;IAC/B,oEAAoE;IACpE;;;0FAGwF;IACxF,qFAAqF;IACrF,wFAAwF;IACxF,4FAA4F;IAC5F,mFAAmF;IACnF,uFAAuF;IACvF,4FAA4F;IAC5F,oFAAoF;IACpF,4FAA4F;IAC5F,4FAA4F;IAC5F,wFAAwF;IACxF,gCAAgC;IAChC,GAAG,cAAc;IACjB,0FAA0F;IAC1F,2FAA2F;IAC3F,2FAA2F;IAC3F;;;0FAGwF;IACxF,iEAAiE;IACjE,wFAAwF;IACxF,+EAA+E;IAC/E,+EAA+E;IAC/E,sFAAsF;IACtF,wFAAwF;IACxF,mDAAmD;IACnD,uIAAuI;IACvI,8FAA8F;IAC9F,yFAAyF;IACzF,wFAAwF;IACxF,yFAAyF;IACzF,mFAAmF;IACnF,GAAG,iBAAiB;CACrB,CAAC;AAMF,MAAM,OAAO,UAAW,SAAQ,aAA4B;IAC1D,6GAA6G;IACrG,UAAU,CAAU;IAE5B,YAAY,GAAuB,EAAE,GAAkB;QACrD,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChB,GAAG,CAAC,qBAAqB,CAAC,KAAK,IAAI,EAAE;YACnC,KAAK,MAAM,IAAI,IAAI,iBAAiB;gBAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjE,oFAAoF;YACpF,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,GAA6B,CAAC,CAAC;YAC5D,sFAAsF;YACtF,qFAAqF;YACrF,mFAAmF;YACnF,2EAA2E;YAC3E,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC,CAAC,CAAC,CAAkC,CAAC;YAChI,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;gBACzD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;gBACtD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,2DAA2D,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACrG,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,OAA8C;QAClF,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACvB,6EAA6E,EAC7E,OAAO,EAAE,GAAG,EAAE,KAAK,CACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe;QAClC,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,wDAAwD,EAAE,OAAO,CAAC,EAAE,CAAC;YAC/G,MAAM,CAAC,GAAG,CAAC,GAAa,CAAC,GAAG,GAAG,CAAC,KAAe,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,MAAM,GAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC,CAAC,CAAC,CAAmC,EAAE,KAAK,CAAC;QAClJ,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;YACzD,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,8DAA8D,EAAE,MAAM,CAAC,CAAC;QACpG,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IAC3C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,IAAY,EAAE,IAAY;QAC1D,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,SAAS;QACb,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,OAAO,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,oFAAoF;IACpF,IAAY,WAAW;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAA6B,CAAC;IACxD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,SAAiB;QACtD,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe;QACpC,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,IAAY,EAAE,EAAU,EAAE,WAAoB;QACjF,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IAC5E,CAAC;IAED,kGAAkG;IAClG,KAAK,CAAC,qBAAqB,CAAC,OAAe,EAAE,IAAY,EAAE,EAAU;QACnE,OAAO,wBAAwB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,oBAAoB,CAAC,OAAe,EAAE,IAAY,EAAE,EAAU,EAAE,WAAoB;QACxF,OAAO,uBAAuB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IACnF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,OAAO,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAED,iHAAiH;IACjH,KAAK,CAAC,SAAS,CAAC,OAAe;QAC7B,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,GAAW;QACjD,OAAO,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACzE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe;QACpC,OAAO,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,SAAiB,EAAE,IAAuB;QAChF,OAAO,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACzE,CAAC;IAED,iGAAiG;IACjG,KAAK,CAAC,iBAAiB,CAAC,OAAe,EAAE,SAAiB;QACxD,OAAO,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAChF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,sBAAsB,CAAC,OAAe,EAAE,GAAW,EAAE,YAAoB,EAAE,SAAiB;QAChG,OAAO,yBAAyB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACxG,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,GAAW,EAAE,SAAiB;QAC9D,OAAO,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,SAAiB,EAAE,OAAe,EAAE,KAAoB,EAAE,SAAiB;QAC7G,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACvB,8FAA8F,EAC9F,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAC9C,CAAC;IACJ,CAAC;IAED,oGAAoG;IACpG,KAAK,CAAC,WAAW,CAAC,OAAe;QAC/B,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAClC,uHAAuH,EACvH,OAAO,CACR,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,SAAiB;QAChD,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACrC,gHAAgH,EAChH,OAAO,EAAE,SAAS,CACnB,CAAC,CAAC,CAAC,CAAC,CAAC;QACN,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;IAED,qGAAqG;IACrG,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,SAAiB;QACnD,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,4EAA4E,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9I,OAAO,CAAC,KAAK,SAAS,CAAC;IACzB,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,SAAiB;QACnD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,yEAAyE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3H,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,OAAe,EAAE,GAAW,EAAE,SAAiB;QAC/D,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,oFAAoF,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAEzI,CAAC;QACd,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,6EAA6E,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QACtI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,qEAAqE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACrH,OAAO,GAAG,CAAC,SAAS,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,GAAW;QACvC,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED;+FAC2F;IAC3F,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,SAAiB;QACtD,OAAO,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAClE,CAAC;IAED,+FAA+F;IAC/F,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,KAAa;QAC7C,OAAO,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED,kFAAkF;IAC1E,IAAI,CAAC,MAAc,EAAE,YAA4B,EAAE,sBAAsB,GAAG,KAAK;QACvF,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,UAAU,CAAC;YAChB,QAAQ,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAC5D,gBAAgB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE;YAC3E,qFAAqF;YACrF,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU;YAC/F,OAAO,EAAE,MAAM;YACf,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,iFAAiF;YACjF,oFAAoF;YACpF,sFAAsF;YACtF,GAAG,CAAC,YAAY;gBACd,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE;gBAClF,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACM,KAAK,CAAC,KAAK,CAAC,OAAgB;QACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,oBAAoB,CAClE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,SAAS,EAC5D,GAAG,CAAC,QAAQ,EACZ,wBAAwB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,CAClF,CAAC;QACF,IAAI,aAAa,EAAE,CAAC;YAClB,8EAA8E;YAC9E,8EAA8E;YAC9E,uDAAuD;YACvD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAC1C,+DAA+D,CAChE,CAAC,CAAC,CAAC,CAAkC,CAAC;YACvC,IAAI,MAAM,EAAE,KAAK,KAAK,aAAa,EAAE,CAAC;gBACpC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;gBACjD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACvB,iFAAiF,EAAE,aAAa,CACjG,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,aAAa,KAAK,IAAI,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,CAAC,QAAkB,EAAY,EAAE,CACnD,6BAA6B,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACrE,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,MAAM,OAAO,GAAuB,OAAO,EAAE,IAAI;gBAC/C,CAAC,CAAC;oBACE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;oBACpB,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI;oBACjC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI;oBAC/B,oEAAoE;oBACpE,6EAA6E;oBAC7E,sCAAsC;oBACtC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa;iBAC1C;gBACH,CAAC,CAAC,IAAI,CAAC;YACT,OAAO,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,WAAW,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;CACF;AAKD,MAAM,WAAW,GAAG,CAAC,CAAkC,EAAa,EAAE,CAAC,CAAC;IACtE,SAAS,EAAE,CAAC,CAAC,SAAmB;IAChC,OAAO,EAAE,CAAC,CAAC,QAAkB;IAC7B,KAAK,EAAG,CAAC,CAAC,KAAuB,IAAI,IAAI;IACzC,SAAS,EAAE,CAAC,CAAC,UAAoB;CAClC,CAAC,CAAC;AAyCH,MAAM,CAAC,MAAM,gBAAgB,GAA2F,IAAI,CAAC;AAE7H;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAiC,EACjC,MAAc,EACd,IAAyE;IAEzE,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAW,EAAE,CAAC,2BAA2B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1F,OAAO;QACL,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACjD,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,GAAG,MAAM,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YACvF,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;QAClD,CAAC;KACF,CAAC;AACJ,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -4,7 +4,7 @@ export { oidcRpAuthProvider, type OidcRpConfig } from './oidc-rp-provider.js';
|
|
|
4
4
|
export { IdentityDO, doAuthProvider, type IdentityDoEnv, type IdentityStub } from './identity-do.js';
|
|
5
5
|
export { resolveCookieDomain } from './cookie-domain.js';
|
|
6
6
|
export { FIRST_SIGN_IN_WINDOW_MS, OWNER_CLAIM_TTL_MS, type OwnerSeat, type OwnerTransfer } from './owner-seat.js';
|
|
7
|
-
export { invitePath, mintOwnerClaimLink, ownerClaimPath, sha256Hex } from './owner-claim-link.js';
|
|
7
|
+
export { OWNER_CLAIM_LABEL, UNATTRIBUTED_PLATFORM_ACTOR, invitePath, mintOwnerClaimLink, ownerClaimPath, sha256Hex, type OwnerClaimMintDirectory, type OwnerClaimMintHost, } from './owner-claim-link.js';
|
|
8
8
|
export { AUTH_CONFIG_KEY, AuthConfigError, authChoice, authorizationServersOf, instanceAuthFor, parseAuthChoice, selectAuthProvider, type AuthChoice, type InstanceAuth, } from './instance-auth.js';
|
|
9
9
|
export { observePlace, placesReporter, reportScopeMembers, resetPlacesMemo, unbindMember, type PlaceReportResult, type PlacesReporter, } from './places.js';
|
|
10
10
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,KAAK,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAClH,OAAO,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,KAAK,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAClH,OAAO,EACL,iBAAiB,EACjB,2BAA2B,EAC3B,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,SAAS,EACT,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,GACxB,MAAM,uBAAuB,CAAC;AAO/B,OAAO,EACL,eAAe,EACf,eAAe,EACf,UAAU,EACV,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,KAAK,UAAU,EACf,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -3,8 +3,8 @@ export { oidcRpAuthProvider } from './oidc-rp-provider.js';
|
|
|
3
3
|
export { IdentityDO, doAuthProvider } from './identity-do.js';
|
|
4
4
|
export { resolveCookieDomain } from './cookie-domain.js';
|
|
5
5
|
export { FIRST_SIGN_IN_WINDOW_MS, OWNER_CLAIM_TTL_MS } from './owner-seat.js';
|
|
6
|
-
export { invitePath, mintOwnerClaimLink, ownerClaimPath, sha256Hex } from './owner-claim-link.js';
|
|
7
|
-
// `mountInviteRoutes` is deliberately NOT re-exported here. It is the one module in this
|
|
6
|
+
export { OWNER_CLAIM_LABEL, UNATTRIBUTED_PLATFORM_ACTOR, invitePath, mintOwnerClaimLink, ownerClaimPath, sha256Hex, } from './owner-claim-link.js';
|
|
7
|
+
// `mountInviteRoutes` (and `mountOwnerClaim`, on `./owner-claim-routes`) is deliberately NOT re-exported here. It is the one module in this
|
|
8
8
|
// package that imports `hono` at runtime, and a barrel re-export would make every
|
|
9
9
|
// `import '@substrat-run/vertical-auth'` evaluate it — so a consumer that wants only an
|
|
10
10
|
// `AuthProvider` or the OIDC helpers would resolve a peer it never uses. It lives on the
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAmB,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAqB,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,cAAc,EAAyC,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAsC,MAAM,iBAAiB,CAAC;AAClH,OAAO,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAmB,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAqB,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,cAAc,EAAyC,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAsC,MAAM,iBAAiB,CAAC;AAClH,OAAO,EACL,iBAAiB,EACjB,2BAA2B,EAC3B,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,SAAS,GAGV,MAAM,uBAAuB,CAAC;AAC/B,4IAA4I;AAC5I,kFAAkF;AAClF,wFAAwF;AACxF,yFAAyF;AACzF,yFAAyF;AACzF,gCAAgC;AAChC,OAAO,EACL,eAAe,EACf,eAAe,EACf,UAAU,EACV,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,kBAAkB,GAGnB,MAAM,oBAAoB,CAAC;AAC5B,yFAAyF;AACzF,OAAO,EACL,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,YAAY,GAGb,MAAM,aAAa,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"invite-routes.d.ts","sourceRoot":"","sources":["../src/invite-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAAyB,CAAC,EAAE,KAAK,QAAQ,EAAE,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEpG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;
|
|
1
|
+
{"version":3,"file":"invite-routes.d.ts","sourceRoot":"","sources":["../src/invite-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAAyB,CAAC,EAAE,KAAK,QAAQ,EAAE,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEpG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,YAAY,EAAE,aAAa,GAAG,WAAW,GAAG,cAAc,GAAG,cAAc,GAAG,aAAa,CAAC,CAAC;AAEhI,QAAA,MAAM,YAAY;;iBAAuC,CAAC;AAE1D,uFAAuF;AACvF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,0CAA0C;AAC1C,eAAO,MAAM,UAAU;;;iBAIrB,CAAC;AAEH,gDAAgD;AAChD,eAAO,MAAM,gBAAgB;;iBAAyC,CAAC;AAEvE;;;;GAIG;AACH,MAAM,WAAW,eAAe,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE;IAC9E,0FAA0F;IAC1F,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAClD;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC;QAAE,QAAQ,EAAE,CAAC,CAAA;KAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IACrE;;;;OAIG;IACH,SAAS,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3F,kGAAkG;IAClG,sBAAsB,EAAE,CACtB,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,KACzE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvB,6EAA6E;IAC7E,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,yFAAyF;IACzF,SAAS,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,eAAe,CAAC;IAChD;;;;;OAKG;IACH,eAAe,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9G,oGAAoG;IACpG,YAAY,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9D;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;CACnC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,EAC/E,GAAG,EAAE,IAAI,CAAC;IAAE,QAAQ,EAAE,CAAC,CAAA;CAAE,CAAC,EAC1B,IAAI,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,GAC1B,IAAI,CAoGN"}
|
package/dist/invite-routes.js
CHANGED
|
@@ -34,6 +34,7 @@ import { HTTPException } from 'hono/http-exception';
|
|
|
34
34
|
import { coverage, principalId, z } from '@substrat-run/contracts';
|
|
35
35
|
import { isUnknownRoleError, ulid } from '@substrat-run/kernel';
|
|
36
36
|
import { claimToken, invitePath, sha256Hex } from './owner-claim-link.js';
|
|
37
|
+
import { bodyOf } from './request-body.js';
|
|
37
38
|
const inviteCaller = z.object({ principal: principalId });
|
|
38
39
|
/** The body `POST /api/invites` takes. */
|
|
39
40
|
export const inviteBody = z.object({
|
|
@@ -43,31 +44,6 @@ export const inviteBody = z.object({
|
|
|
43
44
|
});
|
|
44
45
|
/** The body `POST /api/accept-invite` takes. */
|
|
45
46
|
export const acceptInviteBody = z.object({ token: z.string().min(1) });
|
|
46
|
-
/**
|
|
47
|
-
* The request body, parsed against the route's schema — or a 400 that names what was
|
|
48
|
-
* wrong. Both failure shapes are turned into an `HTTPException` here so the promise
|
|
49
|
-
* `mountInviteRoutes` makes holds: a body that is not JSON would otherwise surface as the
|
|
50
|
-
* `SyntaxError` `c.req.json()` throws (a 500 under any `onError` that does not know it),
|
|
51
|
-
* and a body that does not fit the schema as a `ZodError` the vertical would have to map
|
|
52
|
-
* itself. The issue list is written into the message rather than a structured body
|
|
53
|
-
* because the vertical's own envelope decides the body shape, and a message is the one
|
|
54
|
-
* thing every envelope carries through.
|
|
55
|
-
*/
|
|
56
|
-
async function bodyOf(c, schema) {
|
|
57
|
-
let raw;
|
|
58
|
-
try {
|
|
59
|
-
raw = await c.req.json();
|
|
60
|
-
}
|
|
61
|
-
catch {
|
|
62
|
-
throw new HTTPException(400, { message: 'the request body must be JSON' });
|
|
63
|
-
}
|
|
64
|
-
const parsed = schema.safeParse(raw);
|
|
65
|
-
if (!parsed.success) {
|
|
66
|
-
const issues = parsed.error.issues.map((i) => `${i.path.join('.') || 'body'}: ${i.message}`).join('; ');
|
|
67
|
-
throw new HTTPException(400, { message: `invalid request body — ${issues}` });
|
|
68
|
-
}
|
|
69
|
-
return parsed.data;
|
|
70
|
-
}
|
|
71
47
|
/**
|
|
72
48
|
* Mount the four invite routes on a vertical's Hono app:
|
|
73
49
|
*
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"invite-routes.js","sourceRoot":"","sources":["../src/invite-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,EAAmC,MAAM,yBAAyB,CAAC;AACpG,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAEhE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;
|
|
1
|
+
{"version":3,"file":"invite-routes.js","sourceRoot":"","sources":["../src/invite-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,EAAmC,MAAM,yBAAyB,CAAC;AACpG,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAEhE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAM3C,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;AAK1D,0CAA0C;AAC1C,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IACpC,qEAAqE;IACrE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAEH,gDAAgD;AAChD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AA+CvE;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAA0B,EAC1B,IAA2B;IAE3B,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAU,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAE9G,uFAAuF;IACvF,MAAM,QAAQ,GAAG,CAAC,MAAe,EAAgB,EAAE;QACjD,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YACzC,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,wFAAwF,EAAE,CAAC,CAAC;QACtI,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,sBAAsB,KAAK,UAAU,EAAE,CAAC;YACtD,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,sFAAsF,EAAE,CAAC,CAAC;QACpI,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,4FAA4F,EAAE,CAAC,CAAC;QAC1I,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC,CAAC;IAEF,iFAAiF;IACjF,MAAM,cAAc,GAAG,CAAC,MAAe,EAAE,OAAe,EAAE,GAAW,EAAQ,EAAE;QAC7E,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,cAAc,GAAG,KAAK,OAAO,sBAAsB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAChI,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,KAAK,EAAE,GAAM,EAAE,IAAO,EAAE,MAAoB,EAAE,OAAe,EAAE,GAAW,EAAiB,EAAE,CACnH,cAAc,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAE3F,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC3B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,+FAA+F;QAC/F,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,iBAAiB,OAAO,GAAG,EAAE,CAAC,CAAC;QAC1G,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5C,oFAAoF;QACpF,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;QAC3B,sFAAsF;QACtF,uFAAuF;QACvF,cAAc,CACZ,MAAM,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,EACpF,OAAO,EACP,WAAW,CACZ,CAAC;QACF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1H,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,6EAA6E;YAC7E,gFAAgF;YAChF,iFAAiF;YACjF,kFAAkF;YAClF,kFAAkF;YAClF,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC3F,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5H,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3C,uFAAuF;QACvF,yCAAyC;QACzC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAClE,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;YACpF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,uFAAuF;gBACvF,mFAAmF;gBACnF,uFAAuF;gBACvF,mFAAmF;gBACnF,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC;oBAAE,MAAM,GAAG,CAAC;YAC1D,CAAC;YACD,MAAM,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7F,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;QAC9F,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACnH,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC,CAAC;QACpG,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC"}
|
|
@@ -1,10 +1,12 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* The claim-link half of the owner seat (#925), from the worker's side: mint
|
|
3
|
-
*
|
|
4
|
-
*
|
|
5
|
-
*
|
|
6
|
-
*
|
|
2
|
+
* The claim-link half of the owner seat (#925), from the worker's side: mint the link, tell the
|
|
3
|
+
* identity directory which link is current, and return the URL the installer opens. Written once
|
|
4
|
+
* here so each vertical's `mintOwnerClaim` hook is a one-liner, and so the link's shape and the
|
|
5
|
+
* URL convention (`/?claim=<secret>`, the SPA's counterpart to `?invite=`) are one fact rather
|
|
6
|
+
* than four copies. Since #1686 the link is a `become` capability (see `mintOwnerClaimLink`).
|
|
7
7
|
*/
|
|
8
|
+
import { type BecomeCapabilityInput, type CapabilityId, type MintedCapability, type PlatformActorId, type ScopeId, type TenantId } from '@substrat-run/contracts';
|
|
9
|
+
import type { IdentityStub } from './identity-do.js';
|
|
8
10
|
/** SHA-256 hex (Web Crypto — the same call in workerd, node and browsers). */
|
|
9
11
|
export declare function sha256Hex(s: string): Promise<string>;
|
|
10
12
|
/** A long, URL-safe token: two UUIDs = 256 bits of entropy. Only its hash is ever stored. */
|
|
@@ -13,17 +15,49 @@ export declare function claimToken(): string;
|
|
|
13
15
|
export declare function ownerClaimPath(token: string): string;
|
|
14
16
|
/** Its counterpart for a member invite — what the SPA reads back as `?invite=`. */
|
|
15
17
|
export declare function invitePath(token: string): string;
|
|
18
|
+
/** The label every owner claim link's capability carries — what an operator's capability read shows. */
|
|
19
|
+
export declare const OWNER_CLAIM_LABEL = "owner claim link";
|
|
16
20
|
/**
|
|
17
|
-
*
|
|
18
|
-
*
|
|
19
|
-
*
|
|
20
|
-
* the seat is already claimed (or unknown), and there is nothing to mint for.
|
|
21
|
+
* The minter recorded when the platform names none — a control plane from before #1686 sends no
|
|
22
|
+
* `actor`. The zero ULID: a platform actor id that is no one, rather than one made up per call.
|
|
23
|
+
* The control plane's admin log, not this record, is where who-asked is kept either way.
|
|
21
24
|
*/
|
|
22
|
-
export declare
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
25
|
+
export declare const UNATTRIBUTED_PLATFORM_ACTOR: PlatformActorId;
|
|
26
|
+
/**
|
|
27
|
+
* What minting a claim link needs of the scope host: the platform's `become` mint and revoke on
|
|
28
|
+
* the CP-less path, in the deployment that serves the scope (`@substrat-run/adapter-cloudflare`'s
|
|
29
|
+
* `CloudflareScopeHost` has both). Neither is a module verb.
|
|
30
|
+
*/
|
|
31
|
+
export interface OwnerClaimMintHost {
|
|
32
|
+
mintCapabilityLocal(tenantId: TenantId, scopeId: ScopeId, input: BecomeCapabilityInput, actor: PlatformActorId): Promise<MintedCapability>;
|
|
33
|
+
revokeCapabilityLocal(scopeId: ScopeId, capabilityId: CapabilityId, actor: PlatformActorId): Promise<boolean>;
|
|
34
|
+
}
|
|
35
|
+
/** The slice of the identity directory a mint touches. */
|
|
36
|
+
export type OwnerClaimMintDirectory = Pick<IdentityStub, 'ownerClaimTarget' | 'recordOwnerClaim'>;
|
|
37
|
+
/**
|
|
38
|
+
* Mint a claim link for a scope's unclaimed owner seat (#925) — since #1686 a `become` capability:
|
|
39
|
+
* whoever exchanges its secret becomes the pending owner, once (`maxUses: 1`), until
|
|
40
|
+
* `OWNER_CLAIM_TTL_MS` from now. `origin` is the instance's public origin — supplied by the
|
|
41
|
+
* platform, which owns the hostname directory; a `/internal` call reaches the worker through the
|
|
42
|
+
* dispatcher and carries no usable host of its own. Null ⇒ the seat is already claimed (or
|
|
43
|
+
* unknown), and there is nothing to mint for.
|
|
44
|
+
*
|
|
45
|
+
* Three writes in two Durable Objects, ordered so every partial failure fails closed:
|
|
46
|
+
* 1. the scope mints the capability — on its own it redeems nothing, because a redemption
|
|
47
|
+
* must name the capability the identity directory records;
|
|
48
|
+
* 2. the directory records it as THE link, which retires the previous one there (and deletes a
|
|
49
|
+
* legacy hash link outright). A seat claimed in the meantime records nothing, and the
|
|
50
|
+
* capability just minted is revoked;
|
|
51
|
+
* 3. the scope revokes the previous capability, so it is dead in the scope's own directory too
|
|
52
|
+
* — and shows as revoked to an operator. Step 2 already refuses it if this does not land.
|
|
53
|
+
*/
|
|
54
|
+
export declare function mintOwnerClaimLink(deps: {
|
|
55
|
+
directory: OwnerClaimMintDirectory;
|
|
56
|
+
host: OwnerClaimMintHost;
|
|
57
|
+
}, ref: {
|
|
58
|
+
tenantId: TenantId;
|
|
59
|
+
scopeId: ScopeId;
|
|
60
|
+
}, origin: string, actor?: PlatformActorId): Promise<{
|
|
27
61
|
claimUrl: string;
|
|
28
62
|
expiresAt: string;
|
|
29
63
|
} | null>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"owner-claim-link.d.ts","sourceRoot":"","sources":["../src/owner-claim-link.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,8EAA8E;AAC9E,wBAAsB,SAAS,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG1D;AAED,6FAA6F;AAC7F,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED
|
|
1
|
+
{"version":3,"file":"owner-claim-link.d.ts","sourceRoot":"","sources":["../src/owner-claim-link.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAKL,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,OAAO,EACZ,KAAK,QAAQ,EACd,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGrD,8EAA8E;AAC9E,wBAAsB,SAAS,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG1D;AAED,6FAA6F;AAC7F,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,wGAAwG;AACxG,eAAO,MAAM,iBAAiB,qBAAqB,CAAC;AAEpD;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAE,eAAqE,CAAC;AAEhH;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,mBAAmB,CACjB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,qBAAqB,EAC5B,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7B,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC/G;AAED,0DAA0D;AAC1D,MAAM,MAAM,uBAAuB,GAAG,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,kBAAkB,CAAC,CAAC;AAElG;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE;IAAE,SAAS,EAAE,uBAAuB,CAAC;IAAC,IAAI,EAAE,kBAAkB,CAAA;CAAE,EACtE,GAAG,EAAE;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,EAC7C,MAAM,EAAE,MAAM,EACd,KAAK,GAAE,eAA6C,GACnD,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA4BzD"}
|
package/dist/owner-claim-link.js
CHANGED
|
@@ -1,10 +1,13 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* The claim-link half of the owner seat (#925), from the worker's side: mint
|
|
3
|
-
*
|
|
4
|
-
*
|
|
5
|
-
*
|
|
6
|
-
*
|
|
2
|
+
* The claim-link half of the owner seat (#925), from the worker's side: mint the link, tell the
|
|
3
|
+
* identity directory which link is current, and return the URL the installer opens. Written once
|
|
4
|
+
* here so each vertical's `mintOwnerClaim` hook is a one-liner, and so the link's shape and the
|
|
5
|
+
* URL convention (`/?claim=<secret>`, the SPA's counterpart to `?invite=`) are one fact rather
|
|
6
|
+
* than four copies. Since #1686 the link is a `become` capability (see `mintOwnerClaimLink`).
|
|
7
7
|
*/
|
|
8
|
+
import { capabilityId, instant, platformActorId, principalId, } from '@substrat-run/contracts';
|
|
9
|
+
import { capabilityTokenHash } from '@substrat-run/kernel';
|
|
10
|
+
import { OWNER_CLAIM_TTL_MS } from './owner-seat.js';
|
|
8
11
|
/** SHA-256 hex (Web Crypto — the same call in workerd, node and browsers). */
|
|
9
12
|
export async function sha256Hex(s) {
|
|
10
13
|
const buf = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(s));
|
|
@@ -22,17 +25,55 @@ export function ownerClaimPath(token) {
|
|
|
22
25
|
export function invitePath(token) {
|
|
23
26
|
return `/?invite=${encodeURIComponent(token)}`;
|
|
24
27
|
}
|
|
28
|
+
/** The label every owner claim link's capability carries — what an operator's capability read shows. */
|
|
29
|
+
export const OWNER_CLAIM_LABEL = 'owner claim link';
|
|
25
30
|
/**
|
|
26
|
-
*
|
|
27
|
-
*
|
|
28
|
-
*
|
|
29
|
-
* the seat is already claimed (or unknown), and there is nothing to mint for.
|
|
31
|
+
* The minter recorded when the platform names none — a control plane from before #1686 sends no
|
|
32
|
+
* `actor`. The zero ULID: a platform actor id that is no one, rather than one made up per call.
|
|
33
|
+
* The control plane's admin log, not this record, is where who-asked is kept either way.
|
|
30
34
|
*/
|
|
31
|
-
export
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
+
export const UNATTRIBUTED_PLATFORM_ACTOR = platformActorId.parse('00000000000000000000000000');
|
|
36
|
+
/**
|
|
37
|
+
* Mint a claim link for a scope's unclaimed owner seat (#925) — since #1686 a `become` capability:
|
|
38
|
+
* whoever exchanges its secret becomes the pending owner, once (`maxUses: 1`), until
|
|
39
|
+
* `OWNER_CLAIM_TTL_MS` from now. `origin` is the instance's public origin — supplied by the
|
|
40
|
+
* platform, which owns the hostname directory; a `/internal` call reaches the worker through the
|
|
41
|
+
* dispatcher and carries no usable host of its own. Null ⇒ the seat is already claimed (or
|
|
42
|
+
* unknown), and there is nothing to mint for.
|
|
43
|
+
*
|
|
44
|
+
* Three writes in two Durable Objects, ordered so every partial failure fails closed:
|
|
45
|
+
* 1. the scope mints the capability — on its own it redeems nothing, because a redemption
|
|
46
|
+
* must name the capability the identity directory records;
|
|
47
|
+
* 2. the directory records it as THE link, which retires the previous one there (and deletes a
|
|
48
|
+
* legacy hash link outright). A seat claimed in the meantime records nothing, and the
|
|
49
|
+
* capability just minted is revoked;
|
|
50
|
+
* 3. the scope revokes the previous capability, so it is dead in the scope's own directory too
|
|
51
|
+
* — and shows as revoked to an operator. Step 2 already refuses it if this does not land.
|
|
52
|
+
*/
|
|
53
|
+
export async function mintOwnerClaimLink(deps, ref, origin, actor = UNATTRIBUTED_PLATFORM_ACTOR) {
|
|
54
|
+
const principal = await deps.directory.ownerClaimTarget(ref.scopeId);
|
|
55
|
+
if (principal === null)
|
|
56
|
+
return null;
|
|
57
|
+
const minted = await deps.host.mintCapabilityLocal(ref.tenantId, ref.scopeId, {
|
|
58
|
+
principal: principalId.parse(principal),
|
|
59
|
+
expiresAt: instant.parse(new Date(Date.now() + OWNER_CLAIM_TTL_MS).toISOString()),
|
|
60
|
+
maxUses: 1,
|
|
61
|
+
label: OWNER_CLAIM_LABEL,
|
|
62
|
+
}, actor);
|
|
63
|
+
if (minted.expiresAt === null)
|
|
64
|
+
throw new Error('a become capability always expires — the host answered none');
|
|
65
|
+
const recorded = await deps.directory.recordOwnerClaim(ref.scopeId, principal, {
|
|
66
|
+
capabilityId: minted.id,
|
|
67
|
+
tokenHash: await capabilityTokenHash(minted.secret),
|
|
68
|
+
expiresAt: Date.parse(minted.expiresAt),
|
|
69
|
+
});
|
|
70
|
+
if (!recorded) {
|
|
71
|
+
await deps.host.revokeCapabilityLocal(ref.scopeId, minted.id, actor);
|
|
35
72
|
return null;
|
|
36
|
-
|
|
73
|
+
}
|
|
74
|
+
if (recorded.previous !== null) {
|
|
75
|
+
await deps.host.revokeCapabilityLocal(ref.scopeId, capabilityId.parse(recorded.previous), actor);
|
|
76
|
+
}
|
|
77
|
+
return { claimUrl: `${origin.replace(/\/$/, '')}${ownerClaimPath(minted.secret)}`, expiresAt: minted.expiresAt };
|
|
37
78
|
}
|
|
38
79
|
//# sourceMappingURL=owner-claim-link.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"owner-claim-link.js","sourceRoot":"","sources":["../src/owner-claim-link.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,CAAS;IACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,UAAU;IACxB,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,WAAW,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,YAAY,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;AACjD,CAAC;AAED
|
|
1
|
+
{"version":3,"file":"owner-claim-link.js","sourceRoot":"","sources":["../src/owner-claim-link.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,YAAY,EACZ,OAAO,EACP,eAAe,EACf,WAAW,GAOZ,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,CAAS;IACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,UAAU;IACxB,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,WAAW,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,YAAY,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,wGAAwG;AACxG,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAEpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAoB,eAAe,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;AAoBhH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAsE,EACtE,GAA6C,EAC7C,MAAc,EACd,KAAK,GAAoB,2BAA2B;IAEpD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrE,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAChD,GAAG,CAAC,QAAQ,EACZ,GAAG,CAAC,OAAO,EACX;QACE,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC;QACvC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC,CAAC,WAAW,EAAE,CAAC;QACjF,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,iBAAiB;KACzB,EACD,KAAK,CACN,CAAC;IACF,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAC9G,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE;QAC7E,YAAY,EAAE,MAAM,CAAC,EAAE;QACvB,SAAS,EAAE,MAAM,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC;QACnD,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC;KACxC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;AACnH,CAAC"}
|
|
@@ -0,0 +1,90 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* The OWNER CLAIM redemption a vertical mounts — `POST /api/claim-owner` (#925, #1686).
|
|
3
|
+
*
|
|
4
|
+
* Four demo workers carried this route verbatim: resolve who is signing in, hash the presented
|
|
5
|
+
* token, ask the identity directory to bind, and answer one refusal for every failure. Since
|
|
6
|
+
* #1686 a claim link is a `become` capability, and redeeming one is an exchange in the scope's
|
|
7
|
+
* own Durable Object followed by a bind in the identity directory — two calls in the right order,
|
|
8
|
+
* which is the kind of thing that should be written once. So the route lives here, and a
|
|
9
|
+
* vertical supplies only what is its own: how a request resolves to a scope, its auth provider,
|
|
10
|
+
* its directory and host, and anything it does once the owner is seated.
|
|
11
|
+
*
|
|
12
|
+
* What a redemption checks, in order, each step failing closed:
|
|
13
|
+
* 1. **Somebody is signed in.** Before anything is read, so a signed-out visitor never spends
|
|
14
|
+
* the link — they sign in and open it again.
|
|
15
|
+
* 2. **The secret is the scope's current link** (`ownerClaimMatches`, by hash). A stale link,
|
|
16
|
+
* or a `become` capability minted for something else, is refused here WITHOUT taking its use.
|
|
17
|
+
* 3. **The scope exchanges it** — the capability's expiry, revocation and single use are judged
|
|
18
|
+
* by the scope's directory, atomically, and the exchange is on the spine as
|
|
19
|
+
* `capability.exercised` with the capability as its actor.
|
|
20
|
+
* 4. **The directory binds** the signed-in subject to the principal the capability became,
|
|
21
|
+
* only if that capability is still the recorded link and names the pending owner.
|
|
22
|
+
*
|
|
23
|
+
* Every refusal after step 1 is the same 400, so a probe learns nothing about which step said no.
|
|
24
|
+
*
|
|
25
|
+
* LEGACY: a token that is not a capability secret is a link minted before #1686, and is redeemed
|
|
26
|
+
* the old way (`claimOwner`, by hash) until it expires — at most `OWNER_CLAIM_TTL_MS` after the
|
|
27
|
+
* deploy that ships this. REMOVE that branch in the release after the one that ships #1686
|
|
28
|
+
* (written 2026-10-04), with `claimOwner` in owner-seat.ts.
|
|
29
|
+
*/
|
|
30
|
+
import type { Context, Hono } from 'hono';
|
|
31
|
+
import { z, type CapabilityExchange, type ScopeId, type TenantId } from '@substrat-run/contracts';
|
|
32
|
+
import type { IdentityStub } from './identity-do.js';
|
|
33
|
+
import type { AuthProvider, AuthSubject } from './provider.js';
|
|
34
|
+
/** The slice of the identity directory the redemption touches. */
|
|
35
|
+
export type OwnerClaimDirectory = Pick<IdentityStub, 'ownerClaimMatches' | 'claimOwnerByCapability' | 'claimOwner'>;
|
|
36
|
+
/** What the redemption needs of the scope host: the exchange, asked for a `become` capability only. */
|
|
37
|
+
export interface OwnerClaimExchangeHost {
|
|
38
|
+
exchangeCapability(tenantId: TenantId, scopeId: ScopeId, secret: string, options?: {
|
|
39
|
+
mode?: 'act' | 'become';
|
|
40
|
+
}): Promise<CapabilityExchange | null>;
|
|
41
|
+
}
|
|
42
|
+
/** The body `POST /api/claim-owner` takes. */
|
|
43
|
+
export declare const claimOwnerBody: z.ZodObject<{
|
|
44
|
+
token: z.ZodString;
|
|
45
|
+
}, z.core.$strip>;
|
|
46
|
+
/** A seated owner, as `onClaimed` is told about it. */
|
|
47
|
+
export interface OwnerClaimed<N> {
|
|
48
|
+
node: N;
|
|
49
|
+
principal: string;
|
|
50
|
+
subject: AuthSubject;
|
|
51
|
+
}
|
|
52
|
+
/** What the vertical supplies. `E` is its worker's bindings; `N` what a request resolves to. */
|
|
53
|
+
export interface OwnerClaimRouteDeps<E extends object, N extends {
|
|
54
|
+
tenantId: TenantId;
|
|
55
|
+
scopeId: ScopeId;
|
|
56
|
+
}> {
|
|
57
|
+
/** The (tenant, scope) this request addresses — behind the router, from the assertion. */
|
|
58
|
+
nodeFor: (req: Request, env: E) => N | Promise<N>;
|
|
59
|
+
/** The configured `AuthProvider` — who is claiming. Resolved per request, as the vertical does. */
|
|
60
|
+
authProvider: (env: E, req: Request) => Promise<AuthProvider>;
|
|
61
|
+
/** The tenant's identity directory — the owner seat and the sub → principal binding. */
|
|
62
|
+
directory: (env: E, node: N) => OwnerClaimDirectory;
|
|
63
|
+
/** The scope host — where the claim link's capability lives. */
|
|
64
|
+
host: (env: E) => OwnerClaimExchangeHost;
|
|
65
|
+
/**
|
|
66
|
+
* What the vertical calls the thing being claimed, for the signed-out refusal: "sign in
|
|
67
|
+
* before claiming this <noun>". Defaults to `workspace`.
|
|
68
|
+
*/
|
|
69
|
+
noun?: string;
|
|
70
|
+
/**
|
|
71
|
+
* Run once the owner is seated, before the answer — a support desk records its first colleague
|
|
72
|
+
* here. A throw is the vertical's error to shape; the seat is already bound by then.
|
|
73
|
+
*/
|
|
74
|
+
onClaimed?: (c: Context<{
|
|
75
|
+
Bindings: E;
|
|
76
|
+
}>, claimed: OwnerClaimed<N>) => Promise<void>;
|
|
77
|
+
}
|
|
78
|
+
/**
|
|
79
|
+
* Mount `POST /api/claim-owner` → `{ ok: true, principal }` on a vertical's Hono app. 401 for
|
|
80
|
+
* nobody signed in, 400 for a body that is not `{ token }` (`bodyOf`, as the invite routes) and
|
|
81
|
+
* for every refused link. Errors the route raises itself are `HTTPException`s, so the vertical's
|
|
82
|
+
* own `onError` renders them; what its deps throw is passed through untouched.
|
|
83
|
+
*/
|
|
84
|
+
export declare function mountOwnerClaim<E extends object, N extends {
|
|
85
|
+
tenantId: TenantId;
|
|
86
|
+
scopeId: ScopeId;
|
|
87
|
+
}>(app: Hono<{
|
|
88
|
+
Bindings: E;
|
|
89
|
+
}>, deps: OwnerClaimRouteDeps<E, N>): void;
|
|
90
|
+
//# sourceMappingURL=owner-claim-routes.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"owner-claim-routes.d.ts","sourceRoot":"","sources":["../src/owner-claim-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAAE,CAAC,EAAE,KAAK,kBAAkB,EAAE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAElG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAG/D,kEAAkE;AAClE,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,YAAY,EAAE,mBAAmB,GAAG,wBAAwB,GAAG,YAAY,CAAC,CAAC;AAEpH,uGAAuG;AACvG,MAAM,WAAW,sBAAsB;IACrC,kBAAkB,CAChB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAA;KAAE,GACpC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;CACvC;AAED,8CAA8C;AAC9C,eAAO,MAAM,cAAc;;iBAAyC,CAAC;AAErE,uDAAuD;AACvD,MAAM,WAAW,YAAY,CAAC,CAAC;IAC7B,IAAI,EAAE,CAAC,CAAC;IACR,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,WAAW,CAAC;CACtB;AAED,gGAAgG;AAChG,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE;IACvG,0FAA0F;IAC1F,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAClD,mGAAmG;IACnG,YAAY,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9D,wFAAwF;IACxF,SAAS,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,mBAAmB,CAAC;IACpD,gEAAgE;IAChE,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,sBAAsB,CAAC;IACzC;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC;QAAE,QAAQ,EAAE,CAAC,CAAA;KAAE,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACtF;AAKD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,EAClG,GAAG,EAAE,IAAI,CAAC;IAAE,QAAQ,EAAE,CAAC,CAAA;CAAE,CAAC,EAC1B,IAAI,EAAE,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,GAC9B,IAAI,CA4BN"}
|
|
@@ -0,0 +1,76 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* The OWNER CLAIM redemption a vertical mounts — `POST /api/claim-owner` (#925, #1686).
|
|
3
|
+
*
|
|
4
|
+
* Four demo workers carried this route verbatim: resolve who is signing in, hash the presented
|
|
5
|
+
* token, ask the identity directory to bind, and answer one refusal for every failure. Since
|
|
6
|
+
* #1686 a claim link is a `become` capability, and redeeming one is an exchange in the scope's
|
|
7
|
+
* own Durable Object followed by a bind in the identity directory — two calls in the right order,
|
|
8
|
+
* which is the kind of thing that should be written once. So the route lives here, and a
|
|
9
|
+
* vertical supplies only what is its own: how a request resolves to a scope, its auth provider,
|
|
10
|
+
* its directory and host, and anything it does once the owner is seated.
|
|
11
|
+
*
|
|
12
|
+
* What a redemption checks, in order, each step failing closed:
|
|
13
|
+
* 1. **Somebody is signed in.** Before anything is read, so a signed-out visitor never spends
|
|
14
|
+
* the link — they sign in and open it again.
|
|
15
|
+
* 2. **The secret is the scope's current link** (`ownerClaimMatches`, by hash). A stale link,
|
|
16
|
+
* or a `become` capability minted for something else, is refused here WITHOUT taking its use.
|
|
17
|
+
* 3. **The scope exchanges it** — the capability's expiry, revocation and single use are judged
|
|
18
|
+
* by the scope's directory, atomically, and the exchange is on the spine as
|
|
19
|
+
* `capability.exercised` with the capability as its actor.
|
|
20
|
+
* 4. **The directory binds** the signed-in subject to the principal the capability became,
|
|
21
|
+
* only if that capability is still the recorded link and names the pending owner.
|
|
22
|
+
*
|
|
23
|
+
* Every refusal after step 1 is the same 400, so a probe learns nothing about which step said no.
|
|
24
|
+
*
|
|
25
|
+
* LEGACY: a token that is not a capability secret is a link minted before #1686, and is redeemed
|
|
26
|
+
* the old way (`claimOwner`, by hash) until it expires — at most `OWNER_CLAIM_TTL_MS` after the
|
|
27
|
+
* deploy that ships this. REMOVE that branch in the release after the one that ships #1686
|
|
28
|
+
* (written 2026-10-04), with `claimOwner` in owner-seat.ts.
|
|
29
|
+
*/
|
|
30
|
+
import { HTTPException } from 'hono/http-exception';
|
|
31
|
+
import { z } from '@substrat-run/contracts';
|
|
32
|
+
import { capabilityTokenHash, plausibleCapabilitySecret } from '@substrat-run/kernel';
|
|
33
|
+
import { sha256Hex } from './owner-claim-link.js';
|
|
34
|
+
import { bodyOf } from './request-body.js';
|
|
35
|
+
/** The body `POST /api/claim-owner` takes. */
|
|
36
|
+
export const claimOwnerBody = z.object({ token: z.string().min(1) });
|
|
37
|
+
/** The ONE refusal every invalid, expired, used, revoked or stale link gets. */
|
|
38
|
+
const REFUSED = 'this claim link is invalid, expired, or already used';
|
|
39
|
+
/**
|
|
40
|
+
* Mount `POST /api/claim-owner` → `{ ok: true, principal }` on a vertical's Hono app. 401 for
|
|
41
|
+
* nobody signed in, 400 for a body that is not `{ token }` (`bodyOf`, as the invite routes) and
|
|
42
|
+
* for every refused link. Errors the route raises itself are `HTTPException`s, so the vertical's
|
|
43
|
+
* own `onError` renders them; what its deps throw is passed through untouched.
|
|
44
|
+
*/
|
|
45
|
+
export function mountOwnerClaim(app, deps) {
|
|
46
|
+
/**
|
|
47
|
+
* The capability path, steps 2–4: refused before the exchange unless the secret is the
|
|
48
|
+
* scope's current link, so a stale or unrelated secret keeps its use.
|
|
49
|
+
*/
|
|
50
|
+
const redeem = async (env, node, directory, sub, secret) => {
|
|
51
|
+
if (!(await directory.ownerClaimMatches(node.scopeId, await capabilityTokenHash(secret))))
|
|
52
|
+
return null;
|
|
53
|
+
const exchanged = await deps.host(env).exchangeCapability(node.tenantId, node.scopeId, secret, { mode: 'become' });
|
|
54
|
+
if (exchanged?.kind !== 'principal')
|
|
55
|
+
return null;
|
|
56
|
+
return directory.claimOwnerByCapability(node.scopeId, sub, exchanged.capabilityId, exchanged.principal);
|
|
57
|
+
};
|
|
58
|
+
app.post('/api/claim-owner', async (c) => {
|
|
59
|
+
const node = await deps.nodeFor(c.req.raw, c.env);
|
|
60
|
+
const subject = await (await deps.authProvider(c.env, c.req.raw)).resolve(c.req.raw.headers);
|
|
61
|
+
if (!subject) {
|
|
62
|
+
throw new HTTPException(401, { message: `sign in before claiming this ${deps.noun ?? 'workspace'}` });
|
|
63
|
+
}
|
|
64
|
+
const { token } = await bodyOf(c, claimOwnerBody);
|
|
65
|
+
const directory = deps.directory(c.env, node);
|
|
66
|
+
const principal = plausibleCapabilitySecret(token)
|
|
67
|
+
? await redeem(c.env, node, directory, subject.sub, token)
|
|
68
|
+
: // LEGACY — a link minted before #1686. Remove with `claimOwner` (see the header).
|
|
69
|
+
await directory.claimOwner(node.scopeId, subject.sub, await sha256Hex(token));
|
|
70
|
+
if (!principal)
|
|
71
|
+
throw new HTTPException(400, { message: REFUSED });
|
|
72
|
+
await deps.onClaimed?.(c, { node, principal, subject });
|
|
73
|
+
return c.json({ ok: true, principal });
|
|
74
|
+
});
|
|
75
|
+
}
|
|
76
|
+
//# sourceMappingURL=owner-claim-routes.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"owner-claim-routes.js","sourceRoot":"","sources":["../src/owner-claim-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,CAAC,EAAwD,MAAM,yBAAyB,CAAC;AAClG,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAEtF,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAe3C,8CAA8C;AAC9C,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AA+BrE,gFAAgF;AAChF,MAAM,OAAO,GAAG,sDAAsD,CAAC;AAEvE;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,GAA0B,EAC1B,IAA+B;IAE/B;;;OAGG;IACH,MAAM,MAAM,GAAG,KAAK,EAAE,GAAM,EAAE,IAAO,EAAE,SAA8B,EAAE,GAAW,EAAE,MAAc,EAA0B,EAAE;QAC5H,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACvG,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnH,IAAI,SAAS,EAAE,IAAI,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QACjD,OAAO,SAAS,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IAC1G,CAAC,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7F,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,gCAAgC,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,EAAE,CAAC,CAAC;QACxG,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,yBAAyB,CAAC,KAAK,CAAC;YAChD,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC;YAC1D,CAAC,CAAC,kFAAkF;gBAClF,MAAM,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACnE,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QACxD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC"}
|
package/dist/owner-seat.d.ts
CHANGED
|
@@ -14,9 +14,11 @@
|
|
|
14
14
|
* was unbounded in time and audience: a CI-deployed instance whose issuer had open
|
|
15
15
|
* sign-up was a seat anyone could take, indefinitely, and nothing said so.
|
|
16
16
|
* 2. **A claim link.** After the window (or instead of it), the platform asks the
|
|
17
|
-
* vertical for a short-lived claim
|
|
18
|
-
* dashboard hands the installer the link.
|
|
19
|
-
* the
|
|
17
|
+
* vertical for a short-lived claim link under the platform secret, and the
|
|
18
|
+
* dashboard hands the installer the link. Since #1686 the link is a `become`
|
|
19
|
+
* capability in the scope's own DO (expiry, one use, revocable, on the spine); this
|
|
20
|
+
* directory records which capability is the current link. Only hashes are stored;
|
|
21
|
+
* the secret rides one HTTP exchange and is never persisted anywhere.
|
|
20
22
|
* 3. **Reconcile never re-opens.** A re-provision (the platform's reconciliation
|
|
21
23
|
* sweep, a retry) keeps whatever window the seat already has, and a seat already
|
|
22
24
|
* claimed is left claimed — before, `INSERT OR REPLACE` re-minted the pending seat
|
|
@@ -178,17 +180,54 @@ export declare function unbindPrincipal(sql: RegistrySql, scopeId: string, princ
|
|
|
178
180
|
*/
|
|
179
181
|
export declare function subjectsOf(sql: RegistrySql, scopeId: string, limit: number): string[];
|
|
180
182
|
/**
|
|
181
|
-
*
|
|
182
|
-
*
|
|
183
|
-
*
|
|
183
|
+
* The principal a claim link for this scope binds — the pending owner — or null when the seat is
|
|
184
|
+
* not pending (already claimed, or never provisioned here) and there is nothing to mint for. What
|
|
185
|
+
* a mint reads before it asks the scope for a `become` capability naming that principal (#1686).
|
|
184
186
|
*/
|
|
185
|
-
export declare function
|
|
186
|
-
|
|
187
|
+
export declare function ownerClaimTarget(sql: RegistrySql, scopeId: string): string | null;
|
|
188
|
+
/** A claim link as the directory records it (#1686): which capability, its secret's hash, its expiry. */
|
|
189
|
+
export interface OwnerClaimLinkRow {
|
|
190
|
+
capabilityId: string;
|
|
191
|
+
tokenHash: string;
|
|
192
|
+
/** ms epoch — the capability's own expiry. */
|
|
193
|
+
expiresAt: number;
|
|
194
|
+
}
|
|
195
|
+
/**
|
|
196
|
+
* Record a freshly minted `become` capability as the scope's ONE claim link (#1686), replacing
|
|
197
|
+
* whatever link was current — a capability one or a legacy hash row alike. Returns the previous
|
|
198
|
+
* capability id, which the caller revokes in the scope DO: "a new mint retires the old link"
|
|
199
|
+
* holds here first, since a redemption must name the recorded capability, and the revoke makes it
|
|
200
|
+
* hold in the scope's directory too.
|
|
201
|
+
*
|
|
202
|
+
* Null, writing nothing, when the seat is no longer pending for `principal` — claimed between the
|
|
203
|
+
* caller's read and this write. The caller then revokes the capability it just minted.
|
|
204
|
+
*/
|
|
205
|
+
export declare function recordOwnerClaim(sql: RegistrySql, scopeId: string, principal: string, link: OwnerClaimLinkRow): {
|
|
206
|
+
previous: string | null;
|
|
187
207
|
} | null;
|
|
188
208
|
/**
|
|
189
|
-
*
|
|
190
|
-
*
|
|
191
|
-
*
|
|
209
|
+
* Is `tokenHash` the scope's live claim link (#1686)? Asked BEFORE the secret is exchanged, so a
|
|
210
|
+
* secret that is not this link — a stale one, or a `become` capability minted for something else —
|
|
211
|
+
* is refused without spending its use. The exchange is still the authority: this only decides
|
|
212
|
+
* whether to ask it.
|
|
213
|
+
*/
|
|
214
|
+
export declare function ownerClaimMatches(sql: RegistrySql, scopeId: string, tokenHash: string, now: number): boolean;
|
|
215
|
+
/**
|
|
216
|
+
* Claim the seat with an exchanged `become` capability (#1686): the scope's directory has taken
|
|
217
|
+
* the capability's one use and answered the principal it becomes. Binds the subject when the seat
|
|
218
|
+
* is still pending, the capability is the recorded live link, and it names the pending principal.
|
|
219
|
+
* Consumes the seat and the link. Null otherwise — one answer, as `claimOwner`.
|
|
220
|
+
*/
|
|
221
|
+
export declare function claimOwnerByCapability(sql: RegistrySql, scopeId: string, sub: string, capabilityId: string, principal: string, now: number): string | null;
|
|
222
|
+
/**
|
|
223
|
+
* LEGACY — claim the seat with a link minted before #1686, by its token's hash. Nothing mints
|
|
224
|
+
* such a link any more, so this serves only rows an older deployment wrote, each of which dies
|
|
225
|
+
* `OWNER_CLAIM_TTL_MS` after it was minted, and any capability-era mint deletes it first.
|
|
226
|
+
* REMOVE in the release after the one that ships #1686 (written 2026-10-04): by then every
|
|
227
|
+
* deployment has run the new code for longer than a legacy link can live.
|
|
228
|
+
*
|
|
229
|
+
* Binds the subject, consumes the seat and the link. Null ⇒ invalid, expired, already used, or
|
|
230
|
+
* nothing to claim — one answer, so a probe learns nothing.
|
|
192
231
|
*/
|
|
193
232
|
export declare function claimOwner(sql: RegistrySql, scopeId: string, sub: string, tokenHash: string, now: number): string | null;
|
|
194
233
|
//# sourceMappingURL=owner-seat.d.ts.map
|
package/dist/owner-seat.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"owner-seat.d.ts","sourceRoot":"","sources":["../src/owner-seat.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"owner-seat.d.ts","sourceRoot":"","sources":["../src/owner-seat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAE,CAAC,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC5F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB,QAAc,CAAC;AACnD,gDAAgD;AAChD,eAAO,MAAM,kBAAkB,QAAc,CAAC;AAE9C;;;;;GAKG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EA4B3C,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI,CAKvD;AAED,uFAAuF;AACvF,MAAM,WAAW,SAAS;IACxB,2EAA2E;IAC3E,KAAK,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;IAC3C,gFAAgF;IAChF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,4FAA4F;IAC5F,WAAW,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC5D,6FAA6F;IAC7F,SAAS,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACzC;AAID;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,MAAgC,GACzC,IAAI,CASN;AAED,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK9E;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,+EAA+E;AAC/E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,OAAO,GACnB,aAAa,CAoCf;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAK1G;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,OAAO,GACnB,oBAAoB,CAMtB;AAgBD,qGAAqG;AACrG,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAErE;AAoCD,wCAAwC;AACxC,wBAAgB,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAenF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS3G;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAIrF;AAED;;2FAE2F;AAC3F,wBAAgB,eAAe,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAQ9F;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAIrF;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEjF;AAED,yGAAyG;AACzG,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,iBAAiB,GACtB;IAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAcpC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAG5G;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,GACV,MAAM,GAAG,IAAI,CAKf;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMxH"}
|
package/dist/owner-seat.js
CHANGED
|
@@ -14,9 +14,11 @@
|
|
|
14
14
|
* was unbounded in time and audience: a CI-deployed instance whose issuer had open
|
|
15
15
|
* sign-up was a seat anyone could take, indefinitely, and nothing said so.
|
|
16
16
|
* 2. **A claim link.** After the window (or instead of it), the platform asks the
|
|
17
|
-
* vertical for a short-lived claim
|
|
18
|
-
* dashboard hands the installer the link.
|
|
19
|
-
* the
|
|
17
|
+
* vertical for a short-lived claim link under the platform secret, and the
|
|
18
|
+
* dashboard hands the installer the link. Since #1686 the link is a `become`
|
|
19
|
+
* capability in the scope's own DO (expiry, one use, revocable, on the spine); this
|
|
20
|
+
* directory records which capability is the current link. Only hashes are stored;
|
|
21
|
+
* the secret rides one HTTP exchange and is never persisted anywhere.
|
|
20
22
|
* 3. **Reconcile never re-opens.** A re-provision (the platform's reconciliation
|
|
21
23
|
* sweep, a retry) keeps whatever window the seat already has, and a seat already
|
|
22
24
|
* claimed is left claimed — before, `INSERT OR REPLACE` re-minted the pending seat
|
|
@@ -52,9 +54,17 @@ export const OWNER_SEAT_DDL = [
|
|
|
52
54
|
// is gone the moment the owner claims, so it can't answer "who owns this scope" after that.
|
|
53
55
|
// This can — it survives a scope-DO storage wipe, and the reconcile path re-grants from it.
|
|
54
56
|
`CREATE TABLE IF NOT EXISTS owner_of_record (scope_id TEXT PRIMARY KEY, principal TEXT NOT NULL)`,
|
|
55
|
-
//
|
|
56
|
-
//
|
|
57
|
+
// LEGACY (#925, redeem-only since #1686): a claim link minted before links became `become`
|
|
58
|
+
// capabilities — the hash of its token and when it stops working. Nothing writes a row here
|
|
59
|
+
// any more; a row an older deployment wrote is still redeemed until it expires (at most
|
|
60
|
+
// `OWNER_CLAIM_TTL_MS` after the deploy), and a capability mint deletes it.
|
|
57
61
|
`CREATE TABLE IF NOT EXISTS owner_claim (scope_id TEXT PRIMARY KEY, token_hash TEXT NOT NULL, expires_at INTEGER NOT NULL)`,
|
|
62
|
+
// The scope's CURRENT claim link (#1686): a `become` capability in the scope's own DO, which
|
|
63
|
+
// holds its secret's hash, expiry, single use and revocation. This row says which capability
|
|
64
|
+
// is the live link — so a re-mint, which replaces it, retires the previous one here even if
|
|
65
|
+
// revoking it in the scope DO did not land — and carries its hash, so a redemption can tell
|
|
66
|
+
// a secret that is not this link from one that is BEFORE spending anybody's use.
|
|
67
|
+
`CREATE TABLE IF NOT EXISTS owner_claim_capability (scope_id TEXT PRIMARY KEY, capability_id TEXT NOT NULL, token_hash TEXT NOT NULL, expires_at INTEGER NOT NULL)`,
|
|
58
68
|
// The last owner hand-over (#1665): who handed to whom, and whether the platform's flow has
|
|
59
69
|
// finished seating and revoking around it (`pending` → `done`), or staff abandoned it
|
|
60
70
|
// (`pending` → `abandoned`). What tells a retry of THAT
|
|
@@ -227,8 +237,16 @@ function bindSeat(sql, scopeId, sub, principal) {
|
|
|
227
237
|
sql.exec('INSERT OR REPLACE INTO identity (scope_id, sub, principal) VALUES (?, ?, ?)', scopeId, sub, principal);
|
|
228
238
|
sql.exec('DELETE FROM pending_owner WHERE scope_id = ?', scopeId);
|
|
229
239
|
sql.exec('DELETE FROM owner_claim WHERE scope_id = ?', scopeId);
|
|
240
|
+
sql.exec('DELETE FROM owner_claim_capability WHERE scope_id = ?', scopeId);
|
|
230
241
|
return principal;
|
|
231
242
|
}
|
|
243
|
+
/** The capability-era link (#1686), while it lives. */
|
|
244
|
+
function liveCapabilityClaim(sql, scopeId, now) {
|
|
245
|
+
const row = [
|
|
246
|
+
...sql.exec('SELECT capability_id, token_hash, expires_at FROM owner_claim_capability WHERE scope_id = ?', scopeId),
|
|
247
|
+
][0];
|
|
248
|
+
return row && row.expires_at > now ? row : undefined;
|
|
249
|
+
}
|
|
232
250
|
/** The seat as the platform sees it. */
|
|
233
251
|
export function ownerSeat(sql, scopeId, now) {
|
|
234
252
|
const owner = ownerOfRecord(sql, scopeId);
|
|
@@ -237,7 +255,7 @@ export function ownerSeat(sql, scopeId, now) {
|
|
|
237
255
|
const pending = pendingRow(sql, scopeId);
|
|
238
256
|
if (!pending)
|
|
239
257
|
return { state: 'claimed', owner, firstSignIn: null, claimLink: null };
|
|
240
|
-
const claim = liveClaim(sql, scopeId, now);
|
|
258
|
+
const claim = liveCapabilityClaim(sql, scopeId, now) ?? liveClaim(sql, scopeId, now);
|
|
241
259
|
return {
|
|
242
260
|
state: 'unclaimed',
|
|
243
261
|
owner,
|
|
@@ -297,21 +315,65 @@ export function subjectsOf(sql, scopeId, limit) {
|
|
|
297
315
|
return [...sql.exec('SELECT sub FROM identity WHERE scope_id = ? ORDER BY sub LIMIT ?', scopeId, limit)].map((r) => r.sub);
|
|
298
316
|
}
|
|
299
317
|
/**
|
|
300
|
-
*
|
|
301
|
-
*
|
|
302
|
-
*
|
|
318
|
+
* The principal a claim link for this scope binds — the pending owner — or null when the seat is
|
|
319
|
+
* not pending (already claimed, or never provisioned here) and there is nothing to mint for. What
|
|
320
|
+
* a mint reads before it asks the scope for a `become` capability naming that principal (#1686).
|
|
321
|
+
*/
|
|
322
|
+
export function ownerClaimTarget(sql, scopeId) {
|
|
323
|
+
return pendingRow(sql, scopeId)?.principal ?? null;
|
|
324
|
+
}
|
|
325
|
+
/**
|
|
326
|
+
* Record a freshly minted `become` capability as the scope's ONE claim link (#1686), replacing
|
|
327
|
+
* whatever link was current — a capability one or a legacy hash row alike. Returns the previous
|
|
328
|
+
* capability id, which the caller revokes in the scope DO: "a new mint retires the old link"
|
|
329
|
+
* holds here first, since a redemption must name the recorded capability, and the revoke makes it
|
|
330
|
+
* hold in the scope's directory too.
|
|
331
|
+
*
|
|
332
|
+
* Null, writing nothing, when the seat is no longer pending for `principal` — claimed between the
|
|
333
|
+
* caller's read and this write. The caller then revokes the capability it just minted.
|
|
334
|
+
*/
|
|
335
|
+
export function recordOwnerClaim(sql, scopeId, principal, link) {
|
|
336
|
+
if (ownerClaimTarget(sql, scopeId) !== principal)
|
|
337
|
+
return null;
|
|
338
|
+
const prior = [...sql.exec('SELECT capability_id FROM owner_claim_capability WHERE scope_id = ?', scopeId)][0];
|
|
339
|
+
sql.exec('DELETE FROM owner_claim WHERE scope_id = ?', scopeId);
|
|
340
|
+
sql.exec('INSERT OR REPLACE INTO owner_claim_capability (scope_id, capability_id, token_hash, expires_at) VALUES (?, ?, ?, ?)', scopeId, link.capabilityId, link.tokenHash, link.expiresAt);
|
|
341
|
+
return { previous: prior?.capability_id ?? null };
|
|
342
|
+
}
|
|
343
|
+
/**
|
|
344
|
+
* Is `tokenHash` the scope's live claim link (#1686)? Asked BEFORE the secret is exchanged, so a
|
|
345
|
+
* secret that is not this link — a stale one, or a `become` capability minted for something else —
|
|
346
|
+
* is refused without spending its use. The exchange is still the authority: this only decides
|
|
347
|
+
* whether to ask it.
|
|
303
348
|
*/
|
|
304
|
-
export function
|
|
349
|
+
export function ownerClaimMatches(sql, scopeId, tokenHash, now) {
|
|
305
350
|
if (!pendingRow(sql, scopeId))
|
|
351
|
+
return false;
|
|
352
|
+
return liveCapabilityClaim(sql, scopeId, now)?.token_hash === tokenHash;
|
|
353
|
+
}
|
|
354
|
+
/**
|
|
355
|
+
* Claim the seat with an exchanged `become` capability (#1686): the scope's directory has taken
|
|
356
|
+
* the capability's one use and answered the principal it becomes. Binds the subject when the seat
|
|
357
|
+
* is still pending, the capability is the recorded live link, and it names the pending principal.
|
|
358
|
+
* Consumes the seat and the link. Null otherwise — one answer, as `claimOwner`.
|
|
359
|
+
*/
|
|
360
|
+
export function claimOwnerByCapability(sql, scopeId, sub, capabilityId, principal, now) {
|
|
361
|
+
const pending = pendingRow(sql, scopeId);
|
|
362
|
+
if (!pending || pending.principal !== principal)
|
|
363
|
+
return null;
|
|
364
|
+
if (liveCapabilityClaim(sql, scopeId, now)?.capability_id !== capabilityId)
|
|
306
365
|
return null;
|
|
307
|
-
|
|
308
|
-
sql.exec('INSERT OR REPLACE INTO owner_claim (scope_id, token_hash, expires_at) VALUES (?, ?, ?)', scopeId, tokenHash, expiresAt);
|
|
309
|
-
return { expiresAt: iso(expiresAt) };
|
|
366
|
+
return bindSeat(sql, scopeId, sub, pending.principal);
|
|
310
367
|
}
|
|
311
368
|
/**
|
|
312
|
-
*
|
|
313
|
-
*
|
|
314
|
-
*
|
|
369
|
+
* LEGACY — claim the seat with a link minted before #1686, by its token's hash. Nothing mints
|
|
370
|
+
* such a link any more, so this serves only rows an older deployment wrote, each of which dies
|
|
371
|
+
* `OWNER_CLAIM_TTL_MS` after it was minted, and any capability-era mint deletes it first.
|
|
372
|
+
* REMOVE in the release after the one that ships #1686 (written 2026-10-04): by then every
|
|
373
|
+
* deployment has run the new code for longer than a legacy link can live.
|
|
374
|
+
*
|
|
375
|
+
* Binds the subject, consumes the seat and the link. Null ⇒ invalid, expired, already used, or
|
|
376
|
+
* nothing to claim — one answer, so a probe learns nothing.
|
|
315
377
|
*/
|
|
316
378
|
export function claimOwner(sql, scopeId, sub, tokenHash, now) {
|
|
317
379
|
const pending = pendingRow(sql, scopeId);
|
package/dist/owner-seat.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"owner-seat.js","sourceRoot":"","sources":["../src/owner-seat.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"owner-seat.js","sourceRoot":"","sources":["../src/owner-seat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAKH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,MAAM,CAAC;AACnD,gDAAgD;AAChD,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C,uIAAuI;IACvI,yFAAyF;IACzF,+FAA+F;IAC/F,gGAAgG;IAChG,0FAA0F;IAC1F,oHAAoH;IACpH,iGAAiG;IACjG,4FAA4F;IAC5F,4FAA4F;IAC5F,iGAAiG;IACjG,2FAA2F;IAC3F,4FAA4F;IAC5F,wFAAwF;IACxF,4EAA4E;IAC5E,2HAA2H;IAC3H,6FAA6F;IAC7F,6FAA6F;IAC7F,4FAA4F;IAC5F,4FAA4F;IAC5F,iFAAiF;IACjF,mKAAmK;IACnK,4FAA4F;IAC5F,sFAAsF;IACtF,wDAAwD;IACxD,8FAA8F;IAC9F,uCAAuC;IACvC,mJAAmJ;CACpJ,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAgB;IAC/C,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC;IAC/F,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAcD,MAAM,GAAG,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAgB,EAChB,OAAe,EACf,SAAiB,EACjB,GAAW,EACX,QAAQ,GAAW,uBAAuB;IAE1C,IAAI,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,IAAI;QAAE,OAAO;IACjD,GAAG,CAAC,IAAI,CAAC,iEAAiE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAChG,GAAG,CAAC,IAAI,CACN,+EAA+E,EAC/E,OAAO,EACP,SAAS,EACT,GAAG,GAAG,QAAQ,CACf,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,aAAa,CAAC,GAAgB,EAAE,OAAe;IAC7D,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,0DAA0D,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAEnF,CAAC;IACd,OAAO,GAAG,EAAE,SAAS,IAAI,IAAI,CAAC;AAChC,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAgB,EAChB,OAAe,EACf,IAAY,EACZ,EAAU,EACV,WAAoB;IAEpB,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC5E,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAChF,IAAI,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACxF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,KAAK,IAAI,WAAW,CAAC;IACpC,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxC,0FAA0F;IAC1F,yDAAyD;IACzD,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACnE,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YAC1D,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAC9E,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACvE,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1E,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,yFAAyF;QACzF,IAAI,IAAI,EAAE,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YACpF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5D,CAAC;IACD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC9E,GAAG,CAAC,IAAI,CAAC,+EAA+E,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7G,GAAG,CAAC,IAAI,CACN,gHAAgH,EAChH,OAAO,EACP,IAAI,EACJ,EAAE,CACH,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAgB,EAAE,OAAe,EAAE,IAAY,EAAE,EAAU;IAC/F,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACrG,GAAG,CAAC,IAAI,CAAC,6DAA6D,EAAE,OAAO,CAAC,CAAC;IACjF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAgB,EAChB,OAAe,EACf,IAAY,EACZ,EAAU,EACV,WAAoB;IAEpB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE;QAAE,OAAO,UAAU,CAAC;IAC1G,IAAI,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,GAAG,CAAC,IAAI,CAAC,kEAAkE,EAAE,OAAO,CAAC,CAAC;IACtF,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,YAAY,CACnB,GAAgB,EAChB,OAAe;IAEf,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,gFAAgF,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAEpG,CAAC;AAChB,CAAC;AAED,sFAAsF;AACtF,SAAS,OAAO,CAAC,GAAgB,EAAE,OAAe,EAAE,SAAiB;IACnE,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,qEAAqE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7H,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,UAAU,CAAC,GAAgB,EAAE,OAAe;IAC1D,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,gDAAgD,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;AACnG,CAAC;AAED,SAAS,UAAU,CAAC,GAAgB,EAAE,OAAe;IACnD,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,qEAAqE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAEzF,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW;IAC/D,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,mEAAmE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAE5F,CAAC;IACd,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,iGAAiG;AACjG,SAAS,QAAQ,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,SAAiB;IACjF,GAAG,CAAC,IAAI,CAAC,6EAA6E,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACjH,GAAG,CAAC,IAAI,CAAC,8CAA8C,EAAE,OAAO,CAAC,CAAC;IAClE,GAAG,CAAC,IAAI,CAAC,4CAA4C,EAAE,OAAO,CAAC,CAAC;IAChE,GAAG,CAAC,IAAI,CAAC,uDAAuD,EAAE,OAAO,CAAC,CAAC;IAC3E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,uDAAuD;AACvD,SAAS,mBAAmB,CAC1B,GAAgB,EAChB,OAAe,EACf,GAAW;IAEX,MAAM,GAAG,GAAG;QACV,GAAG,GAAG,CAAC,IAAI,CAAC,6FAA6F,EAAE,OAAO,CAAC;KACpH,CAAC,CAAC,CAAkF,CAAC;IACtF,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,SAAS,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW;IACtE,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACzF,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACrF,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACrF,OAAO;QACL,KAAK,EAAE,WAAW;QAClB,KAAK;QACL,WAAW,EAAE;YACX,IAAI,EAAE,OAAO,CAAC,WAAW,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,GAAG,GAAG;YAC/D,KAAK,EAAE,OAAO,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC;SACtE;QACD,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;KAC/D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,GAAW;IAC1F,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,+DAA+D,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAE/F,CAAC;IACd,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC,SAAS,CAAC;IAClC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW;IAC1E,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,uDAAuD,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5G,GAAG,CAAC,IAAI,CAAC,qDAAqD,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9E,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;2FAE2F;AAC3F,MAAM,UAAU,eAAe,CAAC,GAAgB,EAAE,OAAe,EAAE,SAAiB;IAClF,MAAM,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CACvB,4EAA4E,EAC5E,OAAO,EACP,SAAS,CACV,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAa,CAAC,CAAC;IAC/B,GAAG,CAAC,IAAI,CAAC,2DAA2D,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1F,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAAgB,EAAE,OAAe,EAAE,KAAa;IACzE,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,kEAAkE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAC1G,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAa,CACvB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAgB,EAAE,OAAe;IAChE,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,SAAS,IAAI,IAAI,CAAC;AACrD,CAAC;AAUD;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAgB,EAChB,OAAe,EACf,SAAiB,EACjB,IAAuB;IAEvB,IAAI,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,qEAAqE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAEhG,CAAC;IACd,GAAG,CAAC,IAAI,CAAC,4CAA4C,EAAE,OAAO,CAAC,CAAC;IAChE,GAAG,CAAC,IAAI,CACN,qHAAqH,EACrH,OAAO,EACP,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,CACf,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,IAAI,IAAI,EAAE,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAgB,EAAE,OAAe,EAAE,SAAiB,EAAE,GAAW;IACjG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,UAAU,KAAK,SAAS,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAgB,EAChB,OAAe,EACf,GAAW,EACX,YAAoB,EACpB,SAAiB,EACjB,GAAW;IAEX,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,aAAa,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IACxF,OAAO,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,SAAiB,EAAE,GAAW;IACvG,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;AACxD,CAAC"}
|
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Request-body parsing for the routes vertical-auth mounts (`mountInviteRoutes`,
|
|
3
|
+
* `mountOwnerClaim`) — one definition, so they answer a bad body the same way.
|
|
4
|
+
*/
|
|
5
|
+
import type { Context } from 'hono';
|
|
6
|
+
import type { z } from '@substrat-run/contracts';
|
|
7
|
+
/**
|
|
8
|
+
* The request body, parsed against the route's schema — or a 400 that names what was
|
|
9
|
+
* wrong. Both failure shapes are turned into an `HTTPException` here so the promise
|
|
10
|
+
* each mount here makes holds: a body that is not JSON would otherwise surface as the
|
|
11
|
+
* `SyntaxError` `c.req.json()` throws (a 500 under any `onError` that does not know it),
|
|
12
|
+
* and a body that does not fit the schema as a `ZodError` the vertical would have to map
|
|
13
|
+
* itself. The issue list is written into the message rather than a structured body
|
|
14
|
+
* because the vertical's own envelope decides the body shape, and a message is the one
|
|
15
|
+
* thing every envelope carries through.
|
|
16
|
+
*/
|
|
17
|
+
export declare function bodyOf<T>(c: Context, schema: z.ZodType<T>): Promise<T>;
|
|
18
|
+
//# sourceMappingURL=request-body.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"request-body.d.ts","sourceRoot":"","sources":["../src/request-body.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,yBAAyB,CAAC;AAEjD;;;;;;;;;GASG;AACH,wBAAsB,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAa5E"}
|
|
@@ -0,0 +1,31 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Request-body parsing for the routes vertical-auth mounts (`mountInviteRoutes`,
|
|
3
|
+
* `mountOwnerClaim`) — one definition, so they answer a bad body the same way.
|
|
4
|
+
*/
|
|
5
|
+
import { HTTPException } from 'hono/http-exception';
|
|
6
|
+
/**
|
|
7
|
+
* The request body, parsed against the route's schema — or a 400 that names what was
|
|
8
|
+
* wrong. Both failure shapes are turned into an `HTTPException` here so the promise
|
|
9
|
+
* each mount here makes holds: a body that is not JSON would otherwise surface as the
|
|
10
|
+
* `SyntaxError` `c.req.json()` throws (a 500 under any `onError` that does not know it),
|
|
11
|
+
* and a body that does not fit the schema as a `ZodError` the vertical would have to map
|
|
12
|
+
* itself. The issue list is written into the message rather than a structured body
|
|
13
|
+
* because the vertical's own envelope decides the body shape, and a message is the one
|
|
14
|
+
* thing every envelope carries through.
|
|
15
|
+
*/
|
|
16
|
+
export async function bodyOf(c, schema) {
|
|
17
|
+
let raw;
|
|
18
|
+
try {
|
|
19
|
+
raw = await c.req.json();
|
|
20
|
+
}
|
|
21
|
+
catch {
|
|
22
|
+
throw new HTTPException(400, { message: 'the request body must be JSON' });
|
|
23
|
+
}
|
|
24
|
+
const parsed = schema.safeParse(raw);
|
|
25
|
+
if (!parsed.success) {
|
|
26
|
+
const issues = parsed.error.issues.map((i) => `${i.path.join('.') || 'body'}: ${i.message}`).join('; ');
|
|
27
|
+
throw new HTTPException(400, { message: `invalid request body — ${issues}` });
|
|
28
|
+
}
|
|
29
|
+
return parsed.data;
|
|
30
|
+
}
|
|
31
|
+
//# sourceMappingURL=request-body.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"request-body.js","sourceRoot":"","sources":["../src/request-body.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAI,CAAU,EAAE,MAAoB;IAC9D,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxG,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,0BAA0B,MAAM,EAAE,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@substrat-run/vertical-auth",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.19.1",
|
|
4
4
|
"description": "Pluggable auth for Substrat verticals — the AuthProvider contract, an OIDC provider (Supabase/Auth0/AuthHero/Keycloak), a full relying-party login flow, and a per-tenant identity Durable Object (Better Auth + sub→principal directory). Workers-targeted; the vertical worker bundles it.",
|
|
5
5
|
"license": "AGPL-3.0-only",
|
|
6
6
|
"repository": {
|
|
@@ -35,6 +35,10 @@
|
|
|
35
35
|
"./invite-routes": {
|
|
36
36
|
"types": "./dist/invite-routes.d.ts",
|
|
37
37
|
"default": "./dist/invite-routes.js"
|
|
38
|
+
},
|
|
39
|
+
"./owner-claim-routes": {
|
|
40
|
+
"types": "./dist/owner-claim-routes.d.ts",
|
|
41
|
+
"default": "./dist/owner-claim-routes.js"
|
|
38
42
|
}
|
|
39
43
|
},
|
|
40
44
|
"files": [
|
|
@@ -44,19 +48,19 @@
|
|
|
44
48
|
"better-auth": "^1.7.1",
|
|
45
49
|
"drizzle-orm": "^0.45.2",
|
|
46
50
|
"jose": "^6.2.3",
|
|
47
|
-
"@substrat-run/contracts": "^0.
|
|
48
|
-
"@substrat-run/
|
|
49
|
-
"@substrat-run/
|
|
50
|
-
"@substrat-run/
|
|
51
|
+
"@substrat-run/contracts": "^0.138.0",
|
|
52
|
+
"@substrat-run/oidc-rp": "^0.10.0",
|
|
53
|
+
"@substrat-run/psl": "^0.2.5",
|
|
54
|
+
"@substrat-run/kernel": "^0.138.0"
|
|
51
55
|
},
|
|
52
56
|
"peerDependencies": {
|
|
53
|
-
"hono": "^4.13.
|
|
57
|
+
"hono": "^4.13.12"
|
|
54
58
|
},
|
|
55
59
|
"devDependencies": {
|
|
56
60
|
"@cloudflare/workers-types": "^4.20250109.0",
|
|
57
61
|
"@types/better-sqlite3": "^9.6.0",
|
|
58
62
|
"better-sqlite3": "^13.0.3",
|
|
59
|
-
"hono": "^4.13.
|
|
63
|
+
"hono": "^4.13.12",
|
|
60
64
|
"typescript": "^7.0.0",
|
|
61
65
|
"vitest": "^3.2.7"
|
|
62
66
|
},
|