@toa.io/extensions.exposition 1.0.0-alpha.14 → 1.0.0-alpha.143

package/components/identity.passkeys/source/challenge.ts

@@ -0,0 +1,115 @@
+import { randomBytes } from 'node:crypto'
+import { newid } from '@toa.io/generic'
+import { MAX_KEYS } from './lib/const'
+import type { Operation } from '@toa.io/types'
+import type { Context } from './types'
+
+export class Effect implements Operation {
+  private timeout!: number
+  private authenticator?: AuthenticatorSelectionCriteria
+  private credParams!: PublicKeyCredentialParameters[]
+  private enumerate!: Context['local']['enumerate']
+  private stash!: Context['stash']
+  private logs!: Context['logs']
+
+  public mount (context: Context): void {
+    this.timeout = context.configuration.timeout
+    this.credParams = context.configuration.algorithms.map((alg) => ({ type: 'public-key', alg }))
+
+    if (context.configuration.verification !== undefined) {
+      this.authenticator ??= {}
+      this.authenticator.userVerification = context.configuration.verification
+    }
+
+    if (context.configuration.residence !== undefined) {
+      this.authenticator ??= {}
+      this.authenticator.residentKey = context.configuration.residence
+
+      if (context.configuration.residence === 'required')
+        this.authenticator.requireResidentKey = true
+    }
+
+    this.enumerate = context.local.enumerate
+    this.stash = context.stash
+    this.logs = context.logs
+  }
+
+  public async execute (input: Input): Promise<Output> {
+    const { type, identity, authority } = input
+    const challenge = await this.createChallenge(authority)
+
+    const options: Output = {
+      challenge,
+      timeout: this.timeout
+    }
+
+    if (type === 'creation')
+      options.identity = identity ?? newid()
+
+    const keys = identity === undefined
+      ? []
+      : await this.enumerate({
+        query: {
+          criteria: `identity==${identity}`,
+          projection: ['kid', 'transports'],
+          limit: MAX_KEYS
+        }
+      })
+
+    if (type === 'creation')
+      return {
+        ...options,
+        excludeCredentials: keys.map(({ kid, transports }) => ({ id: kid, transports })),
+        pubKeyCredParams: this.credParams,
+        authenticatorSelection: this.authenticator
+      } satisfies CreationOptions
+    else
+      return {
+        ...options,
+        allowCredentials: keys.map(({ kid, transports }) => ({ id: kid, transports })),
+        userVerification: this.authenticator?.userVerification
+      } satisfies RequestOptions
+  }
+
+  private async createChallenge (authority: string): Promise<string> {
+    const challenge = randomBytes(32).toString('base64url')
+    const key = `challenge:${authority}:${challenge}`
+
+    this.logs.debug('Creating challenge', { key })
+
+    await this.stash.set(key, 1, 'EX', this.timeout / 1000 * EX_GAP)
+
+    return challenge
+  }
+}
+
+const EX_GAP = 1.5
+
+interface Input {
+  type: 'creation' | 'request'
+  authority: string
+  identity?: string | null
+}
+
+type Output = CreationOptions | RequestOptions
+
+interface CommonOptions {
+  identity?: string
+  challenge: string
+  timeout: number
+}
+
+interface KeyDescriptor {
+  id: string
+  transports?: string[]
+}
+
+type CreationOptions =
+  CommonOptions
+  & Omit<PublicKeyCredentialCreationOptions, 'challenge' | 'rp' | 'user' | 'excludeCredentials'>
+  & { excludeCredentials?: KeyDescriptor[] }
+
+type RequestOptions =
+  CommonOptions
+  & Omit<PublicKeyCredentialRequestOptions, 'challenge' | 'allowCredentials'>
+  & { allowCredentials?: KeyDescriptor[] }

package/components/identity.passkeys/source/create.ts

@@ -0,0 +1,77 @@
+import { verifyRegistrationResponse, type RegistrationResponseJSON } from '@simplewebauthn/server'
+import { Err } from 'error-value'
+import type { Operation } from '@toa.io/types'
+import type { Context, Passkey } from './types'
+
+// https://github.com/MasterKale/SimpleWebAuthn/blob/master/packages/server/src/registration/verifyRegistrationResponse.ts#L51
+
+export class Transition implements Operation {
+  private algorithms!: number[]
+  private stash!: Context['stash']
+  private logs!: Context['logs']
+  private verification!: boolean
+  private presence!: boolean
+
+  public mount (context: Context): void {
+    this.algorithms = context.configuration.algorithms
+    this.verification = context.configuration.verification === 'required'
+    this.presence = context.configuration.residence === 'required'
+    this.stash = context.stash
+    this.logs = context.logs
+  }
+
+  public async execute (input: Input, object: Passkey): Promise<Passkey | Error> {
+    const { authority, identity, label, ...response } = input
+
+    // rawId is not sent from the client
+    response.rawId = response.id
+
+    const verified = await verifyRegistrationResponse({
+      response,
+      expectedOrigin: input.origin,
+      expectedChallenge: async (challenge) => this.verifyChallenge(authority, challenge),
+      supportedAlgorithmIDs: this.algorithms,
+      requireUserVerification: this.verification,
+      requireUserPresence: this.presence
+    }).catch((e) => {
+      this.logs.info('Failed to verify registration response', { message: e.message })
+
+      return ERR_FAILED as Error
+    })
+
+    if (verified instanceof Error)
+      return verified
+
+    if (!verified.verified || verified.registrationInfo?.credential === undefined)
+      return ERR_INVALID
+
+    const reg = verified.registrationInfo
+
+    object.authority = authority
+    object.identity = identity
+    object.kid = reg.credential.id
+    object.aid = reg.aaguid
+    object.synced = reg.credentialBackedUp
+    object.key = Buffer.from(reg.credential.publicKey).toString('base64url')
+    object.transports = reg.credential.transports
+    object.label = label
+
+    return object
+  }
+
+  private async verifyChallenge (authority: string, challenge: string): Promise<boolean> {
+    const n = await this.stash.del(`challenge:${authority}:${challenge}`)
+
+    return n === 1
+  }
+}
+
+const ERR_FAILED = new Err('FAILED')
+const ERR_INVALID = new Err('INVALID')
+
+export interface Input extends RegistrationResponseJSON {
+  authority: string
+  origin: string
+  identity: string
+  label?: string
+}

package/components/identity.passkeys/source/delete.ts

@@ -0,0 +1,15 @@
+import type { Context } from './types'
+
+export async function effect ({ authority, identity, id }: Input, context: Context): Promise<void | null> {
+  return await context.local.terminate({
+    query: {
+      criteria: `authority==${authority};identity==${identity};id==${id}`
+    }
+  })
+}
+
+interface Input {
+  authority: string
+  identity: string
+  id: string
+}

package/components/identity.passkeys/source/lib/const.ts

@@ -0,0 +1 @@
+export const MAX_KEYS = 128

package/components/identity.passkeys/source/list.ts

@@ -0,0 +1,17 @@
+import { MAX_KEYS } from './lib/const'
+import type { Context, Passkey } from './types'
+
+export async function computation ({ authority, identity }: Input, context: Context): Promise<Passkey[]> {
+  return await context.local.enumerate({
+    query: {
+      criteria: `authority==${authority};identity==${identity}`,
+      projection: ['aid', 'synced', 'label'],
+      limit: MAX_KEYS
+    }
+  })
+}
+
+interface Input {
+  authority: string
+  identity: string
+}

package/components/identity.passkeys/source/types/Configuration.ts

@@ -0,0 +1,6 @@
+export interface Configuration {
+  algorithms: number[]
+  timeout: number
+  verification?: UserVerificationRequirement
+  residence?: ResidentKeyRequirement
+}

package/components/identity.passkeys/source/types/Context.ts

@@ -0,0 +1,17 @@
+import type { Observation, Transition } from '@toa.io/types'
+import type { Redis } from 'ioredis'
+import type { Logs } from '@toa.io/extensions.telemetry'
+import type { Configuration } from './Configuration'
+import type { Passkey } from './Passkey'
+import type { Input as UseInput, Output as UseOutput } from '../use'
+
+export interface Context {
+  configuration: Configuration
+  stash: Redis
+  logs: Logs
+  local: {
+    enumerate: Observation<Passkey[], never, Passkey>
+    terminate: Transition<void, void, Passkey>
+    use: Transition<UseOutput, UseInput>
+  }
+}

package/components/identity.passkeys/source/types/Passkey.ts

@@ -0,0 +1,14 @@
+import type { AuthenticatorTransportFuture } from '@simplewebauthn/server'
+
+export interface Passkey {
+  id: string
+  authority: string
+  identity: string
+  kid: string
+  aid: string
+  synced: boolean
+  key: string
+  counter: number
+  transports?: AuthenticatorTransportFuture[]
+  label?: string
+}

package/components/identity.passkeys/source/types/index.ts

@@ -0,0 +1,2 @@
+export type { Context } from './Context'
+export type { Passkey } from './Passkey'

package/components/identity.passkeys/source/use.ts

@@ -0,0 +1,75 @@
+import { Err } from 'error-value'
+import { verifyAuthenticationResponse } from '@simplewebauthn/server'
+import type { AuthenticationResponseJSON, WebAuthnCredential } from '@simplewebauthn/server'
+import type { Operation } from '@toa.io/types'
+import type { Context, Passkey } from './types'
+
+export class Transition implements Operation {
+  private stash!: Context['stash']
+  private logs!: Context['logs']
+  private verification!: boolean
+  private presence!: boolean
+
+  public mount (context: Context): void {
+    this.stash = context.stash
+    this.logs = context.logs
+    this.verification = context.configuration.verification === 'required'
+    this.presence = context.configuration.residence === 'required'
+  }
+
+  public async execute (input: Input, object: Passkey): Promise<Output> {
+    const { origin, ...rest } = input
+    const response: AuthenticationResponseJSON = { ...rest, rawId: input.id }
+    const credential = toCredential(object)
+
+    const verified = await verifyAuthenticationResponse({
+      response,
+      credential,
+      expectedOrigin: origin,
+      expectedRPID: new URL(origin).hostname,
+      expectedChallenge: async (challenge) => this.verifyChallenge(object.authority, challenge),
+      requireUserVerification: this.verification
+    }).catch((e) => {
+      this.logs.info('Failed to verify authentication response', { message: e.message })
+
+      return ERR_FAILED as Error
+    })
+
+    if (verified instanceof Error)
+      return verified
+
+    if (!verified.verified)
+      return ERR_INVALID
+
+    object.counter = verified.authenticationInfo.newCounter
+
+    return object.identity
+  }
+
+  private async verifyChallenge (authority: string, challenge: string): Promise<boolean> {
+    const key = `challenge:${authority}:${challenge}`
+    const n = await this.stash.del(`challenge:${authority}:${challenge}`)
+
+    this.logs.debug(n === 1 ? 'Challenge verified' : 'Challenge not found', { key, n })
+
+    return n === 1
+  }
+}
+
+function toCredential (passkey: Passkey): WebAuthnCredential {
+  return {
+    id: passkey.id,
+    publicKey: new Uint8Array(Buffer.from(passkey.key, 'base64url')),
+    counter: passkey.counter,
+    transports: passkey.transports
+  }
+}
+
+const ERR_FAILED = new Err('FAILED')
+const ERR_INVALID = new Err('INVALID')
+
+export interface Input extends Omit<AuthenticationResponseJSON, 'rawId'> {
+  origin: string
+}
+
+export type Output = string | Error

package/components/identity.passkeys/tsconfig.json

@@ -0,0 +1,9 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "outDir": "./operations",
+  },
+  "include": [
+    "source"
+  ]
+}

package/components/identity.roles/manifest.toa.yaml

@@ -4,7 +4,7 @@ name: roles
 entity:
   schema:
     identity*: string
-    role*: /^[a-zA-Z0-9]{1,32}(:[a-zA-Z0-9]{1,32}){0,8}$/
+    role*: /^[a-zA-Z0-9]{0,32}(:[a-zA-Z0-9]{0,32}){0,8}$/
     grantor: string
   unique:
     role: [identity, role]
@@ -18,6 +18,8 @@ operations:
       grantor:
         id: string
         roles: [string]
+    errors:
+      - INACCESSIBLE_SCOPE
   list:
     output: [string]
   principal:

package/components/identity.roles/operations/grant.js

@@ -7,7 +7,7 @@ async function transition(input, object) {
         return Object.assign(object, input);
     if (!within('system:identity:roles', input.grantor.roles) &&
         !within(input.role, input.grantor.roles))
-        return ERR_OUT_OF_SCOPE;
+        return ERR_INACCESSIBLE_SCOPE;
     object.role = input.role;
     object.identity = input.identity;
     object.grantor = input.grantor.id;
@@ -17,5 +17,5 @@ exports.transition = transition;
 function within(role, scopes) {
     return scopes.some((scope) => role === scope || role.startsWith(scope + ':'));
 }
-const ERR_OUT_OF_SCOPE = (0, error_value_1.Err)('OUT_OF_SCOPE');
+const ERR_INACCESSIBLE_SCOPE = new error_value_1.Err('INACCESSIBLE_SCOPE');
 //# sourceMappingURL=grant.js.map

package/components/identity.roles/operations/grant.js.map

@@ -1 +1 @@
-{"version":3,"file":"grant.js","sourceRoot":"","sources":["../source/grant.ts"],"names":[],"mappings":";;;AAAA,6CAAiC;AAG1B,KAAK,UAAU,UAAU,CAAE,KAAY,EAAE,MAAc;IAC5D,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAErC,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACvD,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACxC,OAAO,gBAAgB,CAAA;IAEzB,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA;IACxB,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;IAChC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAA;IAEjC,OAAO,MAAM,CAAA;AACf,CAAC;AAbD,gCAaC;AAED,SAAS,MAAM,CAAE,IAAY,EAAE,MAAgB;IAC7C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAA;AAC/E,CAAC;AAED,MAAM,gBAAgB,GAAG,IAAA,iBAAG,EAAC,cAAc,CAAC,CAAA"}
+{"version":3,"file":"grant.js","sourceRoot":"","sources":["../source/grant.ts"],"names":[],"mappings":";;;AAAA,6CAAiC;AAG1B,KAAK,UAAU,UAAU,CAAE,KAAY,EAAE,MAAc;IAC5D,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAErC,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACvD,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACxC,OAAO,sBAAsB,CAAA;IAE/B,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA;IACxB,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;IAChC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAA;IAEjC,OAAO,MAAM,CAAA;AACf,CAAC;AAbD,gCAaC;AAED,SAAS,MAAM,CAAE,IAAY,EAAE,MAAgB;IAC7C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAA;AAC/E,CAAC;AAED,MAAM,sBAAsB,GAAG,IAAI,iBAAG,CAAC,oBAAoB,CAAC,CAAA"}