@toa.io/extensions.exposition 1.0.0-alpha.18 → 1.0.0-alpha.180

package/components/identity.basic/operations/create.d.ts

@@ -1,10 +0,0 @@
-import { type Context } from './types';
-export declare function effect(input: CreateInput, context: Context): Promise<CreateOutput>;
-interface CreateInput {
-    id: string;
-    credentials: string;
-}
-interface CreateOutput {
-    id: string;
-}
-export {};

package/components/identity.basic/operations/create.js

@@ -1,10 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.effect = void 0;
-async function effect(input, context) {
-    const [username, password] = atob(input.credentials).split(':');
-    const request = { input: { username, password }, query: { id: input.id } };
-    return await context.local.transit(request);
-}
-exports.effect = effect;
-//# sourceMappingURL=create.js.map

package/components/identity.basic/operations/create.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"create.js","sourceRoot":"","sources":["../source/create.ts"],"names":[],"mappings":";;;AAEO,KAAK,UAAU,MAAM,CAC3B,KAAkB,EAAE,OAAgB;IACnC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/D,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,CAAA;IAE1E,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;AAC7C,CAAC;AAND,wBAMC"}

package/components/identity.basic/source/create.ts

@@ -1,18 +0,0 @@
-import { type Context } from './types'
-
-export async function effect
-(input: CreateInput, context: Context): Promise<CreateOutput> {
-  const [username, password] = atob(input.credentials).split(':')
-  const request = { input: { username, password }, query: { id: input.id } }
-
-  return await context.local.transit(request)
-}
-
-interface CreateInput {
-  id: string
-  credentials: string
-}
-
-interface CreateOutput {
-  id: string
-}

package/components/identity.federation/operations/create.d.ts

@@ -1,10 +0,0 @@
-import type { Context } from './types';
-interface CreateInput {
-    id: string;
-    credentials: string;
-}
-interface CreateOutput {
-    id: string;
-}
-export declare const effect: (input: CreateInput, context: Context) => Promise<Error | Promise<CreateOutput>>;
-export {};

package/components/identity.federation/operations/create.js

@@ -1,15 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.effect = void 0;
-const assertions_as_values_js_1 = require("./lib/assertions-as-values.js");
-const jwt_1 = require("./lib/jwt");
-async function create(input, context) {
-    const { iss, sub } = await (0, jwt_1.validateIdToken)(input.credentials, context.configuration.trust);
-    const request = {
-        input: { iss, sub },
-        query: { id: input.id }
-    };
-    return await context.local.transit(request);
-}
-exports.effect = (0, assertions_as_values_js_1.assertionsAsValues)(create);
-//# sourceMappingURL=create.js.map

package/components/identity.federation/operations/create.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"create.js","sourceRoot":"","sources":["../source/create.ts"],"names":[],"mappings":";;;AAAA,2EAAkE;AAClE,mCAA2C;AAI3C,KAAK,UAAU,MAAM,CAAE,KAAkB,EAAE,OAAgB;IACzD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,IAAA,qBAAe,EAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;IAE1F,MAAM,OAAO,GAAY;QACvB,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAA+B;QAChD,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE;KACxB,CAAA;IAED,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;AAC7C,CAAC;AAWY,QAAA,MAAM,GAAG,IAAA,4CAAkB,EAAC,MAAM,CAAC,CAAA"}

package/components/identity.federation/operations/lib/assertions-as-values.d.ts

@@ -1,4 +0,0 @@
-/**
- * Wrapping function that returns assertion errors as function return value
- */
-export declare function assertionsAsValues<T extends (...args: any[]) => Promise<any>>(fn: T): (...args: Parameters<T>) => Promise<ReturnType<T> | Error>;

package/components/identity.federation/operations/lib/assertions-as-values.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"assertions-as-values.js","sourceRoot":"","sources":["../../source/lib/assertions-as-values.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oDAAqC;AAErC;;GAEG;AACH,SAAgB,kBAAkB,CAChC,EAAK;IACL,OAAO,KAAK,EAAE,GAAG,IAAmB,EAAkC,EAAE;QACtE,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAElB,IAAI,GAAG,YAAY,MAAM,CAAC,cAAc;gBAAE,OAAO,GAAG,CAAA;YAEpD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAbD,gDAaC"}

package/components/identity.federation/operations/lib/jwt.d.ts

@@ -1,20 +0,0 @@
-import { type JwtHeader, type IdToken } from '../types';
-import { type TrustConfiguration } from '../schemas';
-export declare function decodeJwt(token: string): {
-    header: unknown;
-    payload: unknown;
-    rawHeader: string;
-    rawPayload: string;
-    signature: string;
-};
-export declare function validateJwtHeader(header: unknown): asserts header is JwtHeader;
-export declare function validateJwtPayload(payload: unknown, trusted: TrustConfiguration[] | undefined, header: JwtHeader): asserts payload is IdToken;
-export declare function validateSignature({ header: { kid, alg }, payload: { iss }, rawHeader, rawPayload, signature, trusted }: {
-    readonly header: JwtHeader;
-    rawHeader: string;
-    readonly payload: IdToken;
-    rawPayload: string;
-    signature: string;
-    trusted?: TrustConfiguration[];
-}): Promise<void>;
-export declare function validateIdToken(token: string, trusted?: TrustConfiguration[]): Promise<IdToken>;

package/components/identity.federation/operations/lib/jwt.js

@@ -1,136 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateIdToken = exports.validateSignature = exports.validateJwtPayload = exports.validateJwtHeader = exports.decodeJwt = void 0;
-const node_crypto_1 = __importDefault(require("node:crypto"));
-const assert = __importStar(require("node:assert"));
-function decodeJwt(token) {
-    const [rawHeader, rawPayload, signature] = token.split('.', 3);
-    const header = JSON.parse(Buffer.from(rawHeader, 'base64url').toString());
-    const payload = JSON.parse(Buffer.from(rawPayload, 'base64url').toString());
-    return { header, payload, rawHeader, rawPayload, signature };
-}
-exports.decodeJwt = decodeJwt;
-function validateJwtHeader(header) {
-    assert.ok(header !== null && typeof header === 'object', 'Header is not an object');
-    assert.ok('alg' in header, 'Header is missing alg');
-    assert.ok(typeof header.alg === 'string', 'Header alg is not a string');
-    assert.match(header.alg, /^RS256|HS\d{3}$/, `Unknown algorithm ${header.alg}`);
-    assert.ok(!('kid' in header) || typeof header.kid === 'string', 'kid must be a string if present');
-}
-exports.validateJwtHeader = validateJwtHeader;
-function validateJwtPayload(payload, trusted = [], header) {
-    assert.ok(trusted.length > 0, 'No trusted issuers provided');
-    // full list of validations is
-    // at https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation
-    assert.ok(payload !== null && typeof payload === 'object', 'Payload is not an object');
-    assert.ok('iss' in payload, 'Payload is missing iss');
-    assert.ok(typeof payload.iss === 'string', 'Payload iss is not a string');
-    assert.ok('aud' in payload, 'Payload is missing aud');
-    assert.ok(typeof payload.aud === 'string', 'Payload aud is not a string');
-    const issuer = trusted.find((config) => config.issuer === payload.iss);
-    assert.ok(issuer !== undefined &&
-        (issuer.audience === undefined || issuer.audience.some((a) => a === payload.aud),
-            `Unknown issuer / audience: ${payload.iss} / ${payload.aud}`));
-    if (header.alg.startsWith('HS')) {
-        const secrets = issuer.secrets;
-        assert.ok(secrets, `We don't have known secrets for ${payload.iss}`);
-        const keys = secrets[header.alg];
-        assert.ok(keys, `No known secrets for ${header.alg}`);
-        if (typeof header.kid === 'string')
-            assert.ok(header.kid in keys, `No secret ${header.kid} provided for ${header.alg}`);
-    }
-    assert.ok('sub' in payload, 'Payload is missing sub');
-    assert.ok(typeof payload.sub === 'string', 'Payload sub is not a string');
-    assert.ok('exp' in payload, 'Payload is missing exp');
-    assert.ok(typeof payload.exp === 'number', 'Payload exp is not a number');
-    assert.ok(Date.now() < payload.exp * 1000, 'Token is expired');
-    assert.ok('iat' in payload, 'Payload is missing iat');
-    assert.ok(typeof payload.iat === 'number', 'Payload iat is not a number');
-    assert.ok(Date.now() >= payload.iat * 1000, 'Token was issued in the future');
-    assert.ok(payload.exp >= payload.iat, 'Payload exp is before iat');
-    if ('nbf' in payload) {
-        assert.ok(typeof payload.nbf === 'number', 'Payload nbf is not a number');
-        assert.ok(Date.now() >= payload.nbf * 1000, 'Token is not valid yet');
-    }
-}
-exports.validateJwtPayload = validateJwtPayload;
-async function validateSignature({ header: { kid, alg }, payload: { iss }, rawHeader, rawPayload, signature, trusted = [] }) {
-    if (alg.startsWith('HS')) {
-        // symmetric algorithm, issuer is validated at this point
-        // eslint-disable-next-line @typescript-eslint/no-non-null-assertion -- `kid` is validated
-        const secrets = trusted.find((c) => c.issuer === iss).secrets[alg];
-        const secret = kid !== undefined ? secrets[kid] : Object.values(secrets)[0];
-        const algorithm = alg.replace(/^HS(\d{3})$/, 'sha$1'); // HS256 -> sha256
-        const hmac = node_crypto_1.default.createHmac(algorithm, secret);
-        hmac.update(rawHeader);
-        hmac.update('.');
-        hmac.update(rawPayload);
-        assert.strictEqual(signature, hmac.digest('base64url'), 'Signature does not match');
-        return;
-    }
-    // Getting issuer public keys
-    const oidcRequest = await fetch(`${iss}/.well-known/openid-configuration`, {
-        cache: 'default'
-    });
-    assert.ok(oidcRequest.ok, `Failed to fetch OpenID configuration: ${oidcRequest.statusText}`);
-    const { jwks_uri: jwksUri } = (await oidcRequest.json());
-    const jwkRequest = await fetch(jwksUri, { cache: 'default' });
-    assert.ok(jwkRequest.ok, `Failed to fetch issuer keys: ${jwkRequest.statusText}`);
-    const { keys } = (await jwkRequest.json());
-    // getting corresponding signing key
-    const signingKeys = keys.filter((k) => k.use === 'sig' && k.alg === alg);
-    assert.ok(signingKeys.length > 0, 'No acceptable signing keys found');
-    assert.ok(kid === undefined || signingKeys.length === 1, 'Signing key selection is not deterministic');
-    const signingKey = kid === undefined ? signingKeys.find((k) => k.kid === kid) : keys[0];
-    assert.ok(signingKey, 'Signing key was not found in issuer keys');
-    const verifyFunction = node_crypto_1.default.createVerify('RSA-SHA256');
-    verifyFunction.write(rawHeader);
-    verifyFunction.write('.');
-    verifyFunction.write(rawPayload);
-    verifyFunction.end();
-    const signatureValid = verifyFunction.verify({ format: 'jwk', key: signingKey }, signature, 'base64url');
-    assert.ok(signatureValid, 'Failed to validate signature');
-}
-exports.validateSignature = validateSignature;
-async function validateIdToken(token, trusted) {
-    const { header, payload, rawHeader, rawPayload, signature } = decodeJwt(token);
-    validateJwtHeader(header);
-    validateJwtPayload(payload, trusted, header);
-    await validateSignature({
-        header,
-        rawHeader,
-        payload,
-        rawPayload,
-        signature,
-        trusted
-    });
-    return payload;
-}
-exports.validateIdToken = validateIdToken;
-//# sourceMappingURL=jwt.js.map

package/components/identity.federation/operations/lib/jwt.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../source/lib/jwt.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,8DAAgC;AAChC,oDAAqC;AAIrC,SAAgB,SAAS,CAAE,KAAa;IAOtC,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IAE9D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;IAE3E,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,CAAA;AAC9D,CAAC;AAbD,8BAaC;AAED,SAAgB,iBAAiB,CAAE,MAAe;IAChD,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,yBAAyB,CAAC,CAAA;IACnF,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,MAAM,EAAE,uBAAuB,CAAC,CAAA;IACnD,MAAM,CAAC,EAAE,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,4BAA4B,CAAC,CAAA;IACvE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,iBAAiB,EAAE,qBAAqB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;IAC9E,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,iCAAiC,CAAC,CAAA;AACpG,CAAC;AAND,8CAMC;AAED,SAAgB,kBAAkB,CAAE,OAAgB,EAClD,UAAgC,EAAE,EAClC,MAAiB;IACjB,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,6BAA6B,CAAC,CAAA;IAE5D,8BAA8B;IAC9B,6EAA6E;IAC7E,MAAM,CAAC,EAAE,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,0BAA0B,CAAC,CAAA;IAEtF,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,OAAO,EAAE,wBAAwB,CAAC,CAAA;IACrD,MAAM,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,6BAA6B,CAAC,CAAA;IACzE,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,OAAO,EAAE,wBAAwB,CAAC,CAAA;IACrD,MAAM,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,6BAA6B,CAAC,CAAA;IAEzE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,CAAA;IAEtE,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS;QAC1B,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC;YAChF,8BAA8B,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IAElE,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QAE9B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,mCAAmC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;QAEpE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAEhC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,wBAAwB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;QAErD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAChC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,aAAa,MAAM,CAAC,GAAG,iBAAiB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;IACvF,CAAC;IAED,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,OAAO,EAAE,wBAAwB,CAAC,CAAA;IACrD,MAAM,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,6BAA6B,CAAC,CAAA;IAEzE,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,OAAO,EAAE,wBAAwB,CAAC,CAAA;IACrD,MAAM,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,6BAA6B,CAAC,CAAA;IACzE,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,EAAE,kBAAkB,CAAC,CAAA;IAE9D,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,OAAO,EAAE,wBAAwB,CAAC,CAAA;IACrD,MAAM,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,6BAA6B,CAAC,CAAA;IACzE,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,EAAE,gCAAgC,CAAC,CAAA;IAC7E,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAA;IAElE,IAAI,KAAK,IAAI,OAAO,EAAE,CAAC;QACrB,MAAM,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,6BAA6B,CAAC,CAAA;QACzE,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,EAAE,wBAAwB,CAAC,CAAA;IACvE,CAAC;AACH,CAAC;AAjDD,gDAiDC;AAEM,KAAK,UAAU,iBAAiB,CAAE,EACvC,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EACpB,OAAO,EAAE,EAAE,GAAG,EAAE,EAChB,SAAS,EACT,UAAU,EACV,SAAS,EACT,OAAO,GAAG,EAAE,EAQb;IACC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,yDAAyD;QACzD,0FAA0F;QAC1F,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAE,CAAC,OAAQ,CAAC,GAAG,CAAC,CAAA;QACpE,MAAM,MAAM,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3E,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA,CAAC,kBAAkB;QACxE,MAAM,IAAI,GAAG,qBAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QAEjD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QACtB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAChB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QACvB,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,0BAA0B,CAAC,CAAA;QAEnF,OAAM;IACR,CAAC;IAED,6BAA6B;IAC7B,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,mCAAmC,EAAE;QACzE,KAAK,EAAE,SAAS;KACjB,CAAC,CAAA;IAEF,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EACtB,yCAAyC,WAAW,CAAC,UAAU,EAAE,CAAC,CAAA;IAEpE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,CAAyB,CAAA;IAEhF,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;IAE7D,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,gCAAgC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAA;IAEjF,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAExC,CAAA;IAED,oCAAoC;IACpC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;IAExE,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,kCAAkC,CAAC,CAAA;IAErE,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EACrD,4CAA4C,CAAC,CAAA;IAE/C,MAAM,UAAU,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAEvF,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,0CAA0C,CAAC,CAAA;IAEjE,MAAM,cAAc,GAAG,qBAAM,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;IAExD,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAC/B,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACzB,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAChC,cAAc,CAAC,GAAG,EAAE,CAAA;IAEpB,MAAM,cAAc,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,EAC7E,SAAS,EACT,WAAW,CAAC,CAAA;IAEd,MAAM,CAAC,EAAE,CAAC,cAAc,EAAE,8BAA8B,CAAC,CAAA;AAC3D,CAAC;AAzED,8CAyEC;AAEM,KAAK,UAAU,eAAe,CAAE,KAAa,EAClD,OAA8B;IAC9B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;IAE9E,iBAAiB,CAAC,MAAM,CAAC,CAAA;IACzB,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;IAC5C,MAAM,iBAAiB,CAAC;QACtB,MAAM;QACN,SAAS;QACT,OAAO;QACP,UAAU;QACV,SAAS;QACT,OAAO;KACR,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC;AAhBD,0CAgBC"}

package/components/identity.federation/operations/schemas.d.ts

@@ -1,59 +0,0 @@
-/**
- * This file was automatically generated by json-schema-to-typescript.
- * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
- * and run json-schema-to-typescript to regenerate this file.
- */
-export interface Schemas {
-    configuration?: {
-        trust?: TrustConfiguration[];
-        /**
-         * Force identities to be explicitly created or incept before being used in authentication
-         */
-        explicit_identity_creation?: boolean;
-        /**
-         * The value of `sub` of an identity token that will be assigned the `system` Role
-         */
-        principal?: {
-            iss: string;
-            sub: string;
-        };
-    };
-    entity?: {
-        /**
-         * The issuer, or signer, of the token, URI like `https://accounts.google.com`
-         */
-        iss: string;
-        /**
-         * the ID that represents the principal making the request
-         */
-        sub: string;
-    };
-}
-export interface TrustConfiguration {
-    /**
-     * Allowed origins for a token `iss` field
-     */
-    issuer: string;
-    /**
-     * Acceptable `aud` value(s)
-     *
-     * @minItems 1
-     */
-    audience?: [string, ...string[]];
-    /**
-     * Symmetric encryption secrets
-     */
-    secrets?: {
-        /**
-         * This interface was referenced by `undefined`'s JSON-Schema definition
-         * via the `patternProperty` "^HS\d{3}$".
-         */
-        [k: string]: {
-            /**
-             * This interface was referenced by `undefined`'s JSON-Schema definition
-             * via the `patternProperty` "^\w+$".
-             */
-            [k: string]: string;
-        };
-    };
-}

package/components/identity.federation/operations/schemas.js

@@ -1,9 +0,0 @@
-"use strict";
-/* eslint-disable */
-/**
- * This file was automatically generated by json-schema-to-typescript.
- * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
- * and run json-schema-to-typescript to regenerate this file.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=schemas.js.map

package/components/identity.federation/operations/schemas.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../source/schemas.ts"],"names":[],"mappings":";AAAA,oBAAoB;AACpB;;;;GAIG"}

package/components/identity.federation/operations/types.d.ts

@@ -1,51 +0,0 @@
-import { type Call, type Observation, type Query } from '@toa.io/types';
-import type { Schemas } from './schemas';
-export interface Context {
-    local: {
-        observe: Observation<Entity & {
-            id: string;
-        }>;
-        transit: Call<TransitOutput, TransitInput>;
-    };
-    remote: {
-        identity: {
-            tokens: {
-                revoke: Call<void, IdentityTokensRevokeInput>;
-            };
-        };
-    };
-    configuration: Required<Schemas>['configuration'];
-}
-export type Entity = Required<Schemas>['entity'];
-export interface TransitInput {
-    readonly iss: string;
-    readonly sub: string;
-}
-export interface TransitOutput {
-    id: string;
-}
-interface IdentityTokensRevokeInput {
-    query: Query;
-}
-export interface JwtHeader {
-    typ?: string;
-    alg: string;
-    kid?: string;
-}
-/**
- * @see {@link https://openid.net/specs/openid-connect-core-1_0.html#IDToken}
- */
-export interface IdToken {
-    iss: string;
-    sub: string;
-    aud: string;
-    exp: number;
-    iat: number;
-    nbf?: number;
-}
-export interface AuthenticateOutput {
-    identity: {
-        id: string;
-    };
-}
-export {};

package/components/identity.federation/operations/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../source/types.ts"],"names":[],"mappings":""}

package/components/identity.federation/source/create.ts

@@ -1,26 +0,0 @@
-import { assertionsAsValues } from './lib/assertions-as-values.js'
-import { validateIdToken } from './lib/jwt'
-import type { Request } from '@toa.io/core'
-import type { Context, Entity } from './types'
-
-async function create (input: CreateInput, context: Context): Promise<CreateOutput> {
-  const { iss, sub } = await validateIdToken(input.credentials, context.configuration.trust)
-
-  const request: Request = {
-    input: { iss, sub } satisfies Omit<Entity, 'id'>,
-    query: { id: input.id }
-  }
-
-  return await context.local.transit(request)
-}
-
-interface CreateInput {
-  id: string
-  credentials: string
-}
-
-interface CreateOutput {
-  id: string
-}
-
-export const effect = assertionsAsValues(create)

package/components/identity.federation/source/lib/assertions-as-values.ts

@@ -1,19 +0,0 @@
-import * as assert from 'node:assert'
-
-/**
- * Wrapping function that returns assertion errors as function return value
- */
-export function assertionsAsValues<T extends (...args: any[]) => Promise<any>> (
-  fn: T) {
-  return async (...args: Parameters<T>): Promise<ReturnType<T> | Error> => {
-    try {
-      return await fn(...args)
-    } catch (err) {
-      console.error(err)
-
-      if (err instanceof assert.AssertionError) return err
-
-      throw err
-    }
-  }
-}

package/components/identity.federation/source/lib/jwt.test.ts

@@ -1,56 +0,0 @@
-/* eslint-disable max-len */
-/* eslint-disable @typescript-eslint/consistent-type-assertions */
-import { validateSignature, decodeJwt } from './jwt'
-
-describe('jwt', () => {
-  test('decode', () => {
-    const { header, payload } = decodeJwt('eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzb21lIjoicGF5bG9hZCJ9.4twFt5NiznN84AWoo1d7KO1T_yoc0Z6XOpOVswacPZg')
-
-    expect(header).toMatchObject({ alg: 'HS256' })
-    expect(payload).toEqual({ some: 'payload' })
-  })
-
-  test('symmetric pass', async () => {
-    // example from
-    // https://pyjwt.readthedocs.io/en/latest/usage.html#encoding-decoding-tokens-with-hs256
-
-    await expect(validateSignature({
-      header: { alg: 'HS256', kid: 'k2' },
-      payload: { iss: 'test-issuer', aud: 'test', sub: '0', exp: 0, iat: 0 },
-      rawHeader: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9',
-      rawPayload: 'eyJzb21lIjoicGF5bG9hZCJ9',
-      signature: '4twFt5NiznN84AWoo1d7KO1T_yoc0Z6XOpOVswacPZg',
-      trusted: [
-        {
-          issuer: 'test-issuer',
-          secrets: {
-            HS256: {
-              k1: 'old-secret',
-              k2: 'secret'
-            }
-          }
-        }
-      ]
-    } as Parameters<typeof validateSignature>[0])).resolves.toBeUndefined()
-  })
-
-  test('symmetric fail', async () => {
-    await expect(validateSignature({
-      header: { alg: 'HS256' },
-      payload: { iss: 'test-issuer', aud: 'test', sub: '0', exp: 0, iat: 0 },
-      rawHeader: 'header',
-      rawPayload: 'payload',
-      signature: 'signature',
-      trusted: [
-        {
-          issuer: 'test-issuer',
-          secrets: {
-            HS256: {
-              theKey: 'secret'
-            }
-          }
-        }
-      ]
-    } as Parameters<typeof validateSignature>[0])).rejects.toThrow('Signature does not match')
-  })
-})

package/components/identity.federation/source/lib/jwt.ts

@@ -1,171 +0,0 @@
-import crypto from 'node:crypto'
-import * as assert from 'node:assert'
-import { type JwtHeader, type IdToken } from '../types'
-import { type TrustConfiguration } from '../schemas'
-
-export function decodeJwt (token: string): {
-  header: unknown
-  payload: unknown
-  rawHeader: string
-  rawPayload: string
-  signature: string
-} {
-  const [rawHeader, rawPayload, signature] = token.split('.', 3)
-
-  const header = JSON.parse(Buffer.from(rawHeader, 'base64url').toString())
-  const payload = JSON.parse(Buffer.from(rawPayload, 'base64url').toString())
-
-  return { header, payload, rawHeader, rawPayload, signature }
-}
-
-export function validateJwtHeader (header: unknown): asserts header is JwtHeader {
-  assert.ok(header !== null && typeof header === 'object', 'Header is not an object')
-  assert.ok('alg' in header, 'Header is missing alg')
-  assert.ok(typeof header.alg === 'string', 'Header alg is not a string')
-  assert.match(header.alg, /^RS256|HS\d{3}$/, `Unknown algorithm ${header.alg}`)
-  assert.ok(!('kid' in header) || typeof header.kid === 'string', 'kid must be a string if present')
-}
-
-export function validateJwtPayload (payload: unknown,
-  trusted: TrustConfiguration[] = [],
-  header: JwtHeader): asserts payload is IdToken {
-  assert.ok(trusted.length > 0, 'No trusted issuers provided')
-
-  // full list of validations is
-  // at https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation
-  assert.ok(payload !== null && typeof payload === 'object', 'Payload is not an object')
-
-  assert.ok('iss' in payload, 'Payload is missing iss')
-  assert.ok(typeof payload.iss === 'string', 'Payload iss is not a string')
-  assert.ok('aud' in payload, 'Payload is missing aud')
-  assert.ok(typeof payload.aud === 'string', 'Payload aud is not a string')
-
-  const issuer = trusted.find((config) => config.issuer === payload.iss)
-
-  assert.ok(issuer !== undefined &&
-      (issuer.audience === undefined || issuer.audience.some((a) => a === payload.aud),
-      `Unknown issuer / audience: ${payload.iss} / ${payload.aud}`))
-
-  if (header.alg.startsWith('HS')) {
-    const secrets = issuer.secrets
-
-    assert.ok(secrets, `We don't have known secrets for ${payload.iss}`)
-
-    const keys = secrets[header.alg]
-
-    assert.ok(keys, `No known secrets for ${header.alg}`)
-
-    if (typeof header.kid === 'string')
-      assert.ok(header.kid in keys, `No secret ${header.kid} provided for ${header.alg}`)
-  }
-
-  assert.ok('sub' in payload, 'Payload is missing sub')
-  assert.ok(typeof payload.sub === 'string', 'Payload sub is not a string')
-
-  assert.ok('exp' in payload, 'Payload is missing exp')
-  assert.ok(typeof payload.exp === 'number', 'Payload exp is not a number')
-  assert.ok(Date.now() < payload.exp * 1000, 'Token is expired')
-
-  assert.ok('iat' in payload, 'Payload is missing iat')
-  assert.ok(typeof payload.iat === 'number', 'Payload iat is not a number')
-  assert.ok(Date.now() >= payload.iat * 1000, 'Token was issued in the future')
-  assert.ok(payload.exp >= payload.iat, 'Payload exp is before iat')
-
-  if ('nbf' in payload) {
-    assert.ok(typeof payload.nbf === 'number', 'Payload nbf is not a number')
-    assert.ok(Date.now() >= payload.nbf * 1000, 'Token is not valid yet')
-  }
-}
-
-export async function validateSignature ({
-  header: { kid, alg },
-  payload: { iss },
-  rawHeader,
-  rawPayload,
-  signature,
-  trusted = []
-}: {
-  readonly header: JwtHeader
-  rawHeader: string
-  readonly payload: IdToken
-  rawPayload: string
-  signature: string
-  trusted?: TrustConfiguration[]
-}): Promise<void> {
-  if (alg.startsWith('HS')) {
-    // symmetric algorithm, issuer is validated at this point
-    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion -- `kid` is validated
-    const secrets = trusted.find((c) => c.issuer === iss)!.secrets![alg]
-    const secret = kid !== undefined ? secrets[kid] : Object.values(secrets)[0]
-    const algorithm = alg.replace(/^HS(\d{3})$/, 'sha$1') // HS256 -> sha256
-    const hmac = crypto.createHmac(algorithm, secret)
-
-    hmac.update(rawHeader)
-    hmac.update('.')
-    hmac.update(rawPayload)
-    assert.strictEqual(signature, hmac.digest('base64url'), 'Signature does not match')
-
-    return
-  }
-
-  // Getting issuer public keys
-  const oidcRequest = await fetch(`${iss}/.well-known/openid-configuration`, {
-    cache: 'default'
-  })
-
-  assert.ok(oidcRequest.ok,
-    `Failed to fetch OpenID configuration: ${oidcRequest.statusText}`)
-
-  const { jwks_uri: jwksUri } = (await oidcRequest.json()) as { jwks_uri: string }
-
-  const jwkRequest = await fetch(jwksUri, { cache: 'default' })
-
-  assert.ok(jwkRequest.ok, `Failed to fetch issuer keys: ${jwkRequest.statusText}`)
-
-  const { keys } = (await jwkRequest.json()) as {
-    keys: Array<{ use: string, kid?: string, alg?: string } & crypto.JsonWebKey>
-  }
-
-  // getting corresponding signing key
-  const signingKeys = keys.filter((k) => k.use === 'sig' && k.alg === alg)
-
-  assert.ok(signingKeys.length > 0, 'No acceptable signing keys found')
-
-  assert.ok(kid === undefined || signingKeys.length === 1,
-    'Signing key selection is not deterministic')
-
-  const signingKey = kid === undefined ? signingKeys.find((k) => k.kid === kid) : keys[0]
-
-  assert.ok(signingKey, 'Signing key was not found in issuer keys')
-
-  const verifyFunction = crypto.createVerify('RSA-SHA256')
-
-  verifyFunction.write(rawHeader)
-  verifyFunction.write('.')
-  verifyFunction.write(rawPayload)
-  verifyFunction.end()
-
-  const signatureValid = verifyFunction.verify({ format: 'jwk', key: signingKey },
-    signature,
-    'base64url')
-
-  assert.ok(signatureValid, 'Failed to validate signature')
-}
-
-export async function validateIdToken (token: string,
-  trusted?: TrustConfiguration[]): Promise<IdToken> {
-  const { header, payload, rawHeader, rawPayload, signature } = decodeJwt(token)
-
-  validateJwtHeader(header)
-  validateJwtPayload(payload, trusted, header)
-  await validateSignature({
-    header,
-    rawHeader,
-    payload,
-    rawPayload,
-    signature,
-    trusted
-  })
-
-  return payload
-}