@toa.io/extensions.exposition 1.0.0-alpha.18 → 1.0.0-alpha.180

package/components/identity.federation/operations/types/context.d.ts

@@ -0,0 +1,36 @@
+import type { JWTPayload } from 'jose';
+import type { Call, Observation, Query, telemetry } from '@toa.io/types';
+import type { Entity } from './entity';
+import type { Configuration } from './configuration';
+export interface Context {
+    local: {
+        observe: Observation<Entity>;
+        transit: Call<TransitOutput, TransitInput>;
+        ensure: Call<EnsureOutput>;
+        decode: Call<JWTPayload, string>;
+    };
+    remote: {
+        identity: {
+            tokens: {
+                revoke: Call<void, IdentityTokensRevokeInput>;
+            };
+        };
+    };
+    logs: telemetry.Logs;
+    configuration: Configuration;
+}
+export interface TransitInput {
+    readonly authority: string;
+    readonly iss: string;
+    readonly sub: string;
+}
+export interface TransitOutput {
+    id: string;
+}
+export interface EnsureOutput {
+    id: string;
+}
+interface IdentityTokensRevokeInput {
+    query: Query;
+}
+export {};

package/components/identity.federation/operations/types/context.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=context.js.map

package/components/identity.federation/operations/types/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../source/types/context.ts"],"names":[],"mappings":""}

package/components/identity.federation/operations/types/entity.d.ts

@@ -0,0 +1,6 @@
+export interface Entity {
+    id: string;
+    authority: string;
+    iss: string;
+    sub: string;
+}

package/components/identity.federation/operations/types/entity.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=entity.js.map

package/components/identity.federation/operations/types/entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity.js","sourceRoot":"","sources":["../../source/types/entity.ts"],"names":[],"mappings":""}

package/components/identity.federation/operations/types/index.d.ts

@@ -0,0 +1,4 @@
+export * from './configuration';
+export * from './context';
+export * from './entity';
+export * from './Scheme';

package/components/identity.federation/operations/types/index.js

@@ -0,0 +1,21 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./configuration"), exports);
+__exportStar(require("./context"), exports);
+__exportStar(require("./entity"), exports);
+__exportStar(require("./Scheme"), exports);
+//# sourceMappingURL=index.js.map

package/components/identity.federation/operations/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../source/types/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kDAA+B;AAC/B,4CAAyB;AACzB,2CAAwB;AACxB,2CAAwB"}

package/components/identity.federation/source/authenticate.ts

@@ -1,28 +1,53 @@
-import { type Maybe } from '@toa.io/types'
 import { Err } from 'error-value'
-import { assertionsAsValues } from './lib/assertions-as-values.js'
-import {
-  validateIdToken
-} from './lib/jwt'
-import type { Request } from '@toa.io/core'
-import type { AuthenticateOutput, Context } from './types'
+import { decode, exchange } from './lib'
+import type { Ctx } from './lib'
+import type { JWTPayload } from 'jose'
+import type { Maybe } from '@toa.io/types'
+import type { Context, Scheme } from './types'
 
-async function authenticate (input: string,
-  context: Context): Promise<Maybe<AuthenticateOutput>> {
-  const { iss, sub } = await validateIdToken(input, context.configuration.trust)
+export async function effect ({ scheme, authority, credentials }: Input, context: Context): Promise<Maybe<Output>> {
+  context.logs.debug('Authenticating', { scheme, authority, credentials })
 
-  const request: Request = { query: { criteria: `iss==${iss};sub==${sub}` } }
+  const ctx: Ctx = {
+    trust: context.configuration.trust,
+    logs: context.logs
+  }
 
-  let id = (await context.local.observe(request))?.id
+  const claims = scheme === 'bearer'
+    ? await decode(credentials, ctx)
+    : await exchange(credentials, ctx)
 
-  if (id === undefined) {
-    if (context.configuration.explicit_identity_creation === true) return Err('NOT_FOUND')
+  if (claims instanceof Error)
+    return claims
 
-    id = (await context.local.transit({ input: { iss, sub } })).id
-  }
+  const { iss, sub } = claims
+
+  context.logs.debug('Token claims', claims)
+
+  const identity = context.configuration.assert !== false
+    ? await context.local.ensure({ entity: { authority, iss, sub } })
+    : await context.local.observe({ query: { criteria: `authority==${authority};iss==${iss};sub==${sub}` } })
+
+  if (identity === null)
+    return ERR_NOT_FOUND
+
+  if (identity instanceof Error)
+    return identity
 
-  return { identity: { id } }
+  return { identity: { id: identity.id, claims } }
 }
 
-// Exporting as a function returning assertion errors as values
-export const computation = assertionsAsValues(authenticate)
+const ERR_NOT_FOUND = new Err('NOT_FOUND')
+
+interface Input {
+  scheme: Scheme
+  authority: string
+  credentials: string
+}
+
+interface Output {
+  identity: {
+    id: string
+    claims: JWTPayload
+  }
+}

package/components/identity.federation/source/decode.ts

@@ -0,0 +1,10 @@
+import { decode } from './lib'
+import type { JWTPayload } from 'jose'
+import type { Context } from './types'
+
+export async function effect (token: string, context: Context): Promise<JWTPayload | Error> {
+  return await decode(token, {
+    trust: context.configuration.trust,
+    logs: context.logs
+  })
+}

package/components/identity.federation/source/incept.ts

@@ -0,0 +1,37 @@
+import { Err } from 'error-value'
+import { decode } from './lib'
+import type { Request } from '@toa.io/types'
+import type { Context, Entity, TransitInput, Scheme } from './types'
+
+export async function effect (input: Input, context: Context): Promise<Output | Error> {
+  if (input.scheme === 'code') return ERR_SCHEME
+
+  const payload = await decode(input.credentials, {
+    trust: context.configuration.trust,
+    logs: context.logs
+  })
+
+  if (payload instanceof Error)
+    return payload
+
+  const { iss, sub } = payload
+  const request: Request<TransitInput> = { input: { authority: input.authority, iss, sub } satisfies Omit<Entity, 'id'> }
+
+  if (input.id !== undefined)
+    request.query = { id: input.id }
+
+  return await context.local.transit(request)
+}
+
+const ERR_SCHEME = new Err('ERR_SCHEME', 'Unsupported scheme')
+
+export interface Input {
+  authority: string
+  credentials: string
+  scheme?: Scheme
+  id?: string
+}
+
+export interface Output {
+  id: string
+}

package/components/identity.federation/source/lib/Configuration.ts

@@ -0,0 +1,39 @@
+export interface Configuration extends Record<string, unknown> {
+  issuer: string
+  authorization_endpoint: string
+  token_endpoint: string
+  userinfo_endpoint: string
+  jwks_uri: string
+  registration_endpoint?: string
+  scopes_supported?: string[]
+  response_types_supported: string[]
+  response_modes_supported?: string[]
+  grant_types_supported?: string[]
+  acr_values_supported?: string[]
+  subject_types_supported: string[]
+  id_token_signing_alg_values_supported: string[]
+  id_token_encryption_alg_values_supported?: string[]
+  id_token_encryption_enc_values_supported?: string[]
+  userinfo_signing_alg_values_supported?: string[]
+  userinfo_encryption_alg_values_supported?: string[]
+  userinfo_encryption_enc_values_supported?: string[]
+  request_object_signing_alg_values_supported?: string[]
+  request_object_encryption_alg_values_supported?: string[]
+  request_object_encryption_enc_values_supported?: string[]
+  token_endpoint_auth_methods_supported?: string[]
+  token_endpoint_auth_signing_alg_values_supported?: string[]
+  display_values_supported?: string[]
+  claim_types_supported?: string[]
+  claims_supported?: string[]
+  service_documentation?: string
+  claims_locales_supported?: string[]
+  ui_locales_supported?: string[]
+  claims_parameter_supported?: boolean
+  request_parameter_supported?: boolean
+  request_uri_parameter_supported?: boolean
+  require_request_uri_registration?: boolean
+  op_policy_uri?: string
+  op_tos_uri?: string
+  check_session_iframe?: string
+  end_session_endpoint?: string
+}

package/components/identity.federation/source/lib/Ctx.ts

@@ -0,0 +1,7 @@
+import type { telemetry } from '@toa.io/types'
+import type { Trust } from '../types'
+
+export interface Ctx {
+  trust: Trust[]
+  logs: telemetry.Logs
+}

package/components/identity.federation/source/lib/Payload.ts

@@ -0,0 +1,6 @@
+import type * as jose from 'jose'
+
+export interface Payload extends jose.JWTPayload {
+  iss: string
+  sub: string
+}

package/components/identity.federation/source/lib/decode.ts

@@ -0,0 +1,28 @@
+import * as jose from 'jose'
+import { createRemoteJWKSet } from './discovery'
+import { ERR_TRUST, ERR_ISS, ERR_SUB } from './errors'
+import type { Ctx } from './Ctx'
+import type { Payload } from './Payload'
+
+const jwks: Record<string, Awaited<ReturnType<typeof createRemoteJWKSet>>> = {}
+
+export async function decode (token: string, ctx: Ctx): Promise<Payload | Error> {
+  const { iss, sub } = jose.decodeJwt(token)
+
+  if (typeof iss !== 'string')
+    return ERR_ISS
+
+  if (typeof sub !== 'string')
+    return ERR_SUB
+
+  const trusted = ctx.trust.find((trust) => trust.iss === iss)
+
+  if (trusted === undefined)
+    return ERR_TRUST
+
+  jwks[iss] ??= await createRemoteJWKSet(iss)
+
+  const { payload } = await jose.jwtVerify(token, jwks[iss], { audience: trusted.aud })
+
+  return payload as Payload
+}

package/components/identity.federation/source/lib/discovery.ts

@@ -0,0 +1,30 @@
+import * as jose from 'jose'
+import type { Configuration } from './Configuration'
+
+const cache = new Map<string, Configuration>()
+
+export async function discover (iss: string): Promise<Configuration> {
+  if (!cache.has(iss)) {
+    const configuration = await fetchConfiguration(iss)
+
+    cache.set(iss, configuration)
+  }
+
+  return cache.get(iss)!
+}
+
+async function fetchConfiguration (iss: string): Promise<Configuration> {
+  const response = await fetch(`${iss}/.well-known/openid-configuration`)
+
+  if (!response.ok)
+    throw new Error('Failed to fetch OIDC configuration')
+
+  return await response.json() as Configuration
+}
+
+export async function createRemoteJWKSet (iss: string): Promise<ReturnType<typeof jose.createRemoteJWKSet>> {
+  const configuration = await discover(iss)
+  const url = new URL(configuration.jwks_uri)
+
+  return jose.createRemoteJWKSet(url)
+}

package/components/identity.federation/source/lib/errors.ts

@@ -0,0 +1,12 @@
+import { Err } from 'error-value'
+
+export const ERR_TRUST = new Err('TRUST', 'Issuer not trusted')
+export const ERR_RESPONSE = new Err('RESPONSE', 'Request to IDP failed')
+export const ERR_CONFIG = new Err('CONFIG', 'Invalid OpenID configuration')
+export const ERR_NO_TOKEN = new Err('NO_TOKEN', 'No ID token received')
+export const ERR_ISS = new Err('ISS', 'Invalid issuer claim')
+export const ERR_SUB = new Err('SUB', 'Invalid subject claim')
+export const ERR_EXP = new Err('EXP', 'Token does not have an expiration time')
+export const ERR_REPLAY = new Err('REPLAY', 'Token has already been used')
+export const ERR_CODE_NOT_ENABLED = new Err('CODE_NOT_ENABLED', 'Authorization code flow is not configured')
+export const ERR_CODE_SCHEMA = new Err('CODE_SCHEMA', 'Invalid code credentials')

package/components/identity.federation/source/lib/exchange.ts

@@ -0,0 +1,116 @@
+import * as jose from 'jose'
+import { createRemoteJWKSet, discover } from './discovery'
+import * as errors from './errors'
+import type { Trust } from '../types'
+import type { Ctx } from './Ctx'
+import type { Payload } from './Payload'
+
+const jwks: Record<string, Awaited<ReturnType<typeof createRemoteJWKSet>>> = {}
+
+export async function exchange (credentials: string, ctx: Ctx): Promise<Payload | Error> {
+  const properties = decode(credentials)
+
+  if (properties instanceof Error)
+    return properties
+
+  const { code, iss, for: redirect } = properties
+
+  const trusted = ctx.trust.find((trust) => trust.iss === iss)
+
+  if (trusted === undefined)
+    return errors.ERR_TRUST
+
+  if (trusted.aud === undefined || (trusted.secret === undefined && trusted.signature === undefined))
+    return errors.ERR_CODE_NOT_ENABLED
+
+  const configuration = await discover(iss)
+
+  if (configuration.token_endpoint === undefined)
+    return errors.ERR_CONFIG
+
+  // array actually is not expected here, but it is a valid format
+  const aud = Array.isArray(trusted.aud) ? trusted.aud[0] : trusted.aud
+  const secret = trusted.secret ?? await sign(trusted)
+  const params = new URLSearchParams()
+
+  params.append('grant_type', 'authorization_code')
+  params.append('code', code)
+  params.append('client_id', aud)
+  params.append('client_secret', secret)
+  params.append('redirect_uri', redirect)
+
+  ctx.logs.debug('Exchanging code', {
+    iss,
+    aud,
+    for: redirect,
+    auth: trusted.secret === undefined ? 'signature' : 'secret',
+    code
+  })
+
+  const response = await fetch(configuration.token_endpoint, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/x-www-form-urlencoded'
+    },
+    body: params
+  })
+
+  if (!response.ok) {
+    ctx.logs.error('Code exchange failed', { status: response.status, text: await response.text() })
+
+    return errors.ERR_RESPONSE
+  }
+
+  const tokens = await response.json() as { id_token: string }
+
+  if (tokens.id_token === undefined)
+    return errors.ERR_NO_TOKEN
+
+  jwks[iss] ??= await createRemoteJWKSet(iss)
+
+  const { payload } = await jose.jwtVerify(tokens.id_token, jwks[iss], {
+    audience: trusted.aud,
+    issuer: iss
+  })
+
+  return payload as Payload
+}
+
+function decode (credentials: string): Properties | Error {
+  const json = Buffer.from(credentials, 'base64').toString('utf8')
+  const properties = JSON.parse(json) as Properties
+
+  if (
+    typeof properties.code !== 'string' ||
+    typeof properties.iss !== 'string' ||
+    typeof properties.for !== 'string' ||
+    Object.keys(properties).length !== CREDENTIAL_PROPERTIES.length
+  )
+    return errors.ERR_CODE_SCHEMA
+
+  return properties
+}
+
+async function sign (trust: Trust): Promise<string> {
+  const signature = trust.signature!
+  const aud = Array.isArray(trust.aud) ? trust.aud[0] : trust.aud!
+  const now = Math.floor(Date.now() / 1000)
+  const key = await jose.importPKCS8(atob(signature.key), 'ES256')
+
+  return await new jose.SignJWT({})
+    .setProtectedHeader({ alg: 'ES256', kid: signature.kid })
+    .setIssuedAt(now)
+    .setExpirationTime(now + 300)
+    .setIssuer(signature.iss)
+    .setSubject(aud)
+    .setAudience(trust.iss)
+    .sign(key)
+}
+
+const CREDENTIAL_PROPERTIES: Array<keyof Properties> = ['for', 'iss', 'code']
+
+interface Properties {
+  code: string
+  iss: string
+  for: string
+}

package/components/identity.federation/source/lib/index.ts

@@ -0,0 +1,3 @@
+export { decode } from './decode'
+export { exchange } from './exchange'
+export { type Ctx } from './Ctx'

package/components/identity.federation/source/types/Scheme.ts

@@ -0,0 +1 @@
+export type Scheme = 'bearer' | 'code'

package/components/identity.federation/source/types/configuration.ts

@@ -0,0 +1,21 @@
+export interface Configuration {
+  trust: Trust[]
+  principal?: Principal
+  assert?: boolean
+}
+
+export interface Trust {
+  iss: string
+  aud?: string | [string, ...string[]]
+  secret?: string
+  signature?: {
+    iss: string
+    kid: string
+    key: string
+  }
+}
+
+interface Principal {
+  iss: string
+  sub: string
+}

package/components/identity.federation/source/types/context.ts

@@ -0,0 +1,40 @@
+import type { JWTPayload } from 'jose'
+import type { Call, Observation, Query, telemetry } from '@toa.io/types'
+import type { Entity } from './entity'
+import type { Configuration } from './configuration'
+
+export interface Context {
+  local: {
+    observe: Observation<Entity>
+    transit: Call<TransitOutput, TransitInput>
+    ensure: Call<EnsureOutput>
+    decode: Call<JWTPayload, string>
+  }
+  remote: {
+    identity: {
+      tokens: {
+        revoke: Call<void, IdentityTokensRevokeInput>
+      }
+    }
+  }
+  logs: telemetry.Logs
+  configuration: Configuration
+}
+
+export interface TransitInput {
+  readonly authority: string
+  readonly iss: string
+  readonly sub: string
+}
+
+export interface TransitOutput {
+  id: string
+}
+
+export interface EnsureOutput {
+  id: string
+}
+
+interface IdentityTokensRevokeInput {
+  query: Query
+}

package/components/identity.federation/source/types/entity.ts

@@ -0,0 +1,6 @@
+export interface Entity {
+  id: string
+  authority: string
+  iss: string
+  sub: string
+}

package/components/identity.federation/source/types/index.ts

@@ -0,0 +1,4 @@
+export * from './configuration'
+export * from './context'
+export * from './entity'
+export * from './Scheme'

package/components/identity.federation/tsconfig.json

@@ -1,9 +1,10 @@
 {
   "extends": "../../tsconfig.json",
   "compilerOptions": {
-    "outDir": "./operations"
+    "outDir": "./operations",
+    "module": "Node16",
+    "moduleResolution": "Node16",
+    "target": "ES2022"
   },
-  "include": [
-    "source"
-  ]
+  "include": ["source"]
 }

package/components/identity.keys/manifest.toa.yaml

@@ -0,0 +1,57 @@
+namespace: identity
+name: keys
+
+entity:
+  schema:
+    properties:
+      identity: &identity
+        type: string
+      key:
+        type: string
+      label: &label
+        type: string
+        minLength: 1
+        maxLength: 64
+      expires: &expires
+        type: number
+    required:
+      - identity
+      - key
+      - label
+  index:
+    identity:
+      identity: asc
+
+operations:
+  create:
+    query: false
+    input:
+      properties:
+        identity: *identity
+        label: *label
+        expires: *expires
+      required:
+        - identity
+        - label
+    output:
+      properties:
+        id:
+          type: string
+        key:
+          type: string
+      required:
+        - id
+        - key
+exposition:
+  /:identity:
+    auth:id: identity
+    auth:role: system:identity:keys
+    GET:
+      io:output: [id, label, expires, _created]
+      query:
+        sort: _created:desc
+      endpoint: enumerate
+    /:id:
+      DELETE:
+        io:output: false
+        endpoint: terminate

package/components/identity.keys/operations/create.d.ts

@@ -0,0 +1,22 @@
+import type { Operation } from '@toa.io/types';
+export declare class Transition implements Operation {
+    execute(input: Input, object: Key): Promise<Output>;
+}
+interface Input {
+    identity: string;
+    label: string;
+    expires?: number;
+}
+interface Output {
+    id: string;
+    label: string;
+    key: string;
+}
+interface Key {
+    id: string;
+    identity: string;
+    key: string;
+    label: string;
+    expires?: number;
+}
+export {};

package/components/identity.keys/operations/create.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Transition = void 0;
+const paseto_1 = require("paseto");
+class Transition {
+    async execute(input, object) {
+        object.key = await paseto_1.V3.generateKey('local', { format: 'paserk' });
+        object.identity = input.identity;
+        object.label = input.label;
+        if (input.expires !== undefined)
+            object.expires = input.expires;
+        return { id: object.id, label: object.label, key: object.key };
+    }
+}
+exports.Transition = Transition;
+//# sourceMappingURL=create.js.map

package/components/identity.keys/operations/create.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.js","sourceRoot":"","sources":["../source/create.ts"],"names":[],"mappings":";;;AAAA,mCAA2B;AAG3B,MAAa,UAAU;IACd,KAAK,CAAC,OAAO,CAAE,KAAY,EAAE,MAAW;QAC7C,MAAM,CAAC,GAAG,GAAG,MAAM,WAAE,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;QAChE,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;QAChC,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;QAE1B,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;YAC7B,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAA;QAEhC,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAA;IAChE,CAAC;CACF;AAXD,gCAWC"}