@toa.io/extensions.exposition 1.0.0-alpha.19 → 1.0.0-alpha.190

package/components/identity.federation/operations/lib/errors.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ERR_CODE_SCHEMA = exports.ERR_CODE_NOT_ENABLED = exports.ERR_REPLAY = exports.ERR_EXP = exports.ERR_SUB = exports.ERR_ISS = exports.ERR_NO_TOKEN = exports.ERR_CONFIG = exports.ERR_RESPONSE = exports.ERR_TRUST = void 0;
+const error_value_1 = require("error-value");
+exports.ERR_TRUST = new error_value_1.Err('TRUST', 'Issuer not trusted');
+exports.ERR_RESPONSE = new error_value_1.Err('RESPONSE', 'Request to IDP failed');
+exports.ERR_CONFIG = new error_value_1.Err('CONFIG', 'Invalid OpenID configuration');
+exports.ERR_NO_TOKEN = new error_value_1.Err('NO_TOKEN', 'No ID token received');
+exports.ERR_ISS = new error_value_1.Err('ISS', 'Invalid issuer claim');
+exports.ERR_SUB = new error_value_1.Err('SUB', 'Invalid subject claim');
+exports.ERR_EXP = new error_value_1.Err('EXP', 'Token does not have an expiration time');
+exports.ERR_REPLAY = new error_value_1.Err('REPLAY', 'Token has already been used');
+exports.ERR_CODE_NOT_ENABLED = new error_value_1.Err('CODE_NOT_ENABLED', 'Authorization code flow is not configured');
+exports.ERR_CODE_SCHEMA = new error_value_1.Err('CODE_SCHEMA', 'Invalid code credentials');
+//# sourceMappingURL=errors.js.map

package/components/identity.federation/operations/lib/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../source/lib/errors.ts"],"names":[],"mappings":";;;AAAA,6CAAiC;AAEpB,QAAA,SAAS,GAAG,IAAI,iBAAG,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAA;AAClD,QAAA,YAAY,GAAG,IAAI,iBAAG,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAA;AAC3D,QAAA,UAAU,GAAG,IAAI,iBAAG,CAAC,QAAQ,EAAE,8BAA8B,CAAC,CAAA;AAC9D,QAAA,YAAY,GAAG,IAAI,iBAAG,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAA;AAC1D,QAAA,OAAO,GAAG,IAAI,iBAAG,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAA;AAChD,QAAA,OAAO,GAAG,IAAI,iBAAG,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAA;AACjD,QAAA,OAAO,GAAG,IAAI,iBAAG,CAAC,KAAK,EAAE,wCAAwC,CAAC,CAAA;AAClE,QAAA,UAAU,GAAG,IAAI,iBAAG,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CAAA;AAC7D,QAAA,oBAAoB,GAAG,IAAI,iBAAG,CAAC,kBAAkB,EAAE,2CAA2C,CAAC,CAAA;AAC/F,QAAA,eAAe,GAAG,IAAI,iBAAG,CAAC,aAAa,EAAE,0BAA0B,CAAC,CAAA"}

package/components/identity.federation/operations/lib/exchange.d.ts

@@ -0,0 +1,3 @@
+import type { Ctx } from './Ctx';
+import type { Payload } from './Payload';
+export declare function exchange(credentials: string, ctx: Ctx): Promise<Payload | Error>;

package/components/identity.federation/operations/lib/exchange.js

@@ -0,0 +1,107 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exchange = void 0;
+const jose = __importStar(require("jose"));
+const discovery_1 = require("./discovery");
+const errors = __importStar(require("./errors"));
+const jwks = {};
+async function exchange(credentials, ctx) {
+    const properties = decode(credentials);
+    if (properties instanceof Error)
+        return properties;
+    const { code, iss, for: redirect } = properties;
+    const trusted = ctx.trust.find((trust) => trust.iss === iss);
+    if (trusted === undefined)
+        return errors.ERR_TRUST;
+    if (trusted.aud === undefined || (trusted.secret === undefined && trusted.signature === undefined))
+        return errors.ERR_CODE_NOT_ENABLED;
+    const configuration = await (0, discovery_1.discover)(iss);
+    if (configuration.token_endpoint === undefined)
+        return errors.ERR_CONFIG;
+    // array actually is not expected here, but it is a valid format
+    const aud = Array.isArray(trusted.aud) ? trusted.aud[0] : trusted.aud;
+    const secret = trusted.secret ?? await sign(trusted);
+    const params = new URLSearchParams();
+    params.append('grant_type', 'authorization_code');
+    params.append('code', code);
+    params.append('client_id', aud);
+    params.append('client_secret', secret);
+    params.append('redirect_uri', redirect);
+    ctx.logs.debug('Exchanging code', {
+        iss,
+        aud,
+        for: redirect,
+        auth: trusted.secret === undefined ? 'signature' : 'secret',
+        code
+    });
+    const response = await fetch(configuration.token_endpoint, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded'
+        },
+        body: params
+    });
+    if (!response.ok) {
+        ctx.logs.error('Code exchange failed', { status: response.status, text: await response.text() });
+        return errors.ERR_RESPONSE;
+    }
+    const tokens = await response.json();
+    if (tokens.id_token === undefined)
+        return errors.ERR_NO_TOKEN;
+    jwks[iss] ??= await (0, discovery_1.createRemoteJWKSet)(iss);
+    const { payload } = await jose.jwtVerify(tokens.id_token, jwks[iss], {
+        audience: trusted.aud,
+        issuer: iss
+    });
+    return payload;
+}
+exports.exchange = exchange;
+function decode(credentials) {
+    const json = Buffer.from(credentials, 'base64').toString('utf8');
+    const properties = JSON.parse(json);
+    if (typeof properties.code !== 'string' ||
+        typeof properties.iss !== 'string' ||
+        typeof properties.for !== 'string' ||
+        Object.keys(properties).length !== CREDENTIAL_PROPERTIES.length)
+        return errors.ERR_CODE_SCHEMA;
+    return properties;
+}
+async function sign(trust) {
+    const signature = trust.signature;
+    const aud = Array.isArray(trust.aud) ? trust.aud[0] : trust.aud;
+    const now = Math.floor(Date.now() / 1000);
+    const key = await jose.importPKCS8(atob(signature.key), 'ES256');
+    return await new jose.SignJWT({})
+        .setProtectedHeader({ alg: 'ES256', kid: signature.kid })
+        .setIssuedAt(now)
+        .setExpirationTime(now + 300)
+        .setIssuer(signature.iss)
+        .setSubject(aud)
+        .setAudience(trust.iss)
+        .sign(key);
+}
+const CREDENTIAL_PROPERTIES = ['for', 'iss', 'code'];
+//# sourceMappingURL=exchange.js.map

package/components/identity.federation/operations/lib/exchange.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exchange.js","sourceRoot":"","sources":["../../source/lib/exchange.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA4B;AAC5B,2CAA0D;AAC1D,iDAAkC;AAKlC,MAAM,IAAI,GAAmE,EAAE,CAAA;AAExE,KAAK,UAAU,QAAQ,CAAE,WAAmB,EAAE,GAAQ;IAC3D,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,CAAA;IAEtC,IAAI,UAAU,YAAY,KAAK;QAC7B,OAAO,UAAU,CAAA;IAEnB,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAA;IAE/C,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;IAE5D,IAAI,OAAO,KAAK,SAAS;QACvB,OAAO,MAAM,CAAC,SAAS,CAAA;IAEzB,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC;QAChG,OAAO,MAAM,CAAC,oBAAoB,CAAA;IAEpC,MAAM,aAAa,GAAG,MAAM,IAAA,oBAAQ,EAAC,GAAG,CAAC,CAAA;IAEzC,IAAI,aAAa,CAAC,cAAc,KAAK,SAAS;QAC5C,OAAO,MAAM,CAAC,UAAU,CAAA;IAE1B,gEAAgE;IAChE,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAA;IACrE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,CAAA;IACpD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;IAEpC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAA;IACjD,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC3B,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;IAC/B,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAA;IACtC,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;IAEvC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE;QAChC,GAAG;QACH,GAAG;QACH,GAAG,EAAE,QAAQ;QACb,IAAI,EAAE,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;QAC3D,IAAI;KACL,CAAC,CAAA;IAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,cAAc,EAAE;QACzD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;SACpD;QACD,IAAI,EAAE,MAAM;KACb,CAAC,CAAA;IAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAEhG,OAAO,MAAM,CAAC,YAAY,CAAA;IAC5B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA0B,CAAA;IAE5D,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;QAC/B,OAAO,MAAM,CAAC,YAAY,CAAA;IAE5B,IAAI,CAAC,GAAG,CAAC,KAAK,MAAM,IAAA,8BAAkB,EAAC,GAAG,CAAC,CAAA;IAE3C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;QACnE,QAAQ,EAAE,OAAO,CAAC,GAAG;QACrB,MAAM,EAAE,GAAG;KACZ,CAAC,CAAA;IAEF,OAAO,OAAkB,CAAA;AAC3B,CAAC;AAnED,4BAmEC;AAED,SAAS,MAAM,CAAE,WAAmB;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAChE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAA;IAEjD,IACE,OAAO,UAAU,CAAC,IAAI,KAAK,QAAQ;QACnC,OAAO,UAAU,CAAC,GAAG,KAAK,QAAQ;QAClC,OAAO,UAAU,CAAC,GAAG,KAAK,QAAQ;QAClC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,qBAAqB,CAAC,MAAM;QAE/D,OAAO,MAAM,CAAC,eAAe,CAAA;IAE/B,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,KAAK,UAAU,IAAI,CAAE,KAAY;IAC/B,MAAM,SAAS,GAAG,KAAK,CAAC,SAAU,CAAA;IAClC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAI,CAAA;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAA;IAEhE,OAAO,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;SAC9B,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC;SACxD,WAAW,CAAC,GAAG,CAAC;SAChB,iBAAiB,CAAC,GAAG,GAAG,GAAG,CAAC;SAC5B,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC;SACxB,UAAU,CAAC,GAAG,CAAC;SACf,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC;SACtB,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC;AAED,MAAM,qBAAqB,GAA4B,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA"}

package/components/identity.federation/operations/lib/index.d.ts

@@ -0,0 +1,3 @@
+export { decode } from './decode';
+export { exchange } from './exchange';
+export { type Ctx } from './Ctx';

package/components/identity.federation/operations/lib/index.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exchange = exports.decode = void 0;
+var decode_1 = require("./decode");
+Object.defineProperty(exports, "decode", { enumerable: true, get: function () { return decode_1.decode; } });
+var exchange_1 = require("./exchange");
+Object.defineProperty(exports, "exchange", { enumerable: true, get: function () { return exchange_1.exchange; } });
+//# sourceMappingURL=index.js.map

package/components/identity.federation/operations/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../source/lib/index.ts"],"names":[],"mappings":";;;AAAA,mCAAiC;AAAxB,gGAAA,MAAM,OAAA;AACf,uCAAqC;AAA5B,oGAAA,QAAQ,OAAA"}