@toa.io/extensions.exposition 1.0.0-alpha.2 → 1.0.0-alpha.200

package/components/identity.basic/operations/create.d.ts

@@ -1,10 +0,0 @@
-import { type Context } from './types';
-export declare function effect(input: CreateInput, context: Context): Promise<CreateOutput>;
-interface CreateInput {
-    id: string;
-    credentials: string;
-}
-interface CreateOutput {
-    id: string;
-}
-export {};

package/components/identity.basic/operations/create.js

@@ -1,10 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.effect = void 0;
-async function effect(input, context) {
-    const [username, password] = atob(input.credentials).split(':');
-    const request = { input: { username, password }, query: { id: input.id } };
-    return await context.local.transit(request);
-}
-exports.effect = effect;
-//# sourceMappingURL=create.js.map

package/components/identity.basic/operations/create.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"create.js","sourceRoot":"","sources":["../source/create.ts"],"names":[],"mappings":";;;AAEO,KAAK,UAAU,MAAM,CAC3B,KAAkB,EAAE,OAAgB;IACnC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/D,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,CAAA;IAE1E,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;AAC7C,CAAC;AAND,wBAMC"}

package/components/identity.basic/source/create.ts

@@ -1,18 +0,0 @@
-import { type Context } from './types'
-
-export async function effect
-(input: CreateInput, context: Context): Promise<CreateOutput> {
-  const [username, password] = atob(input.credentials).split(':')
-  const request = { input: { username, password }, query: { id: input.id } }
-
-  return await context.local.transit(request)
-}
-
-interface CreateInput {
-  id: string
-  credentials: string
-}
-
-interface CreateOutput {
-  id: string
-}

package/components/identity.federation/operations/assertions-as-values.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"assertions-as-values.cjs","sourceRoot":"","sources":["../source/assertions-as-values.cts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oDAAqC;AAErC;;GAEG;AACH,SAAgB,kBAAkB,CAChC,EAAK;IAEL,OAAO,KAAK,EAAE,GAAG,IAAmB,EAAkC,EAAE;QACtE,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAElB,IAAI,GAAG,YAAY,MAAM,CAAC,cAAc;gBAAE,OAAO,GAAG,CAAA;YAEpD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAdD,gDAcC"}

package/components/identity.federation/operations/assertions-as-values.d.cts

@@ -1,4 +0,0 @@
-/**
- * Wrapping function that returns assertion errors as function return value
- */
-export declare function assertionsAsValues<T extends (...args: any[]) => Promise<any>>(fn: T): (...args: Parameters<T>) => Promise<ReturnType<T> | Error>;

package/components/identity.federation/operations/create.d.ts

@@ -1,10 +0,0 @@
-import type { Context } from './types';
-interface CreateInput {
-    id: string;
-    credentials: string;
-}
-interface CreateOutput {
-    id: string;
-}
-export declare const effect: (input: CreateInput, context: Context) => Promise<Error | Promise<CreateOutput>>;
-export {};

package/components/identity.federation/operations/create.js

@@ -1,15 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.effect = void 0;
-const assertions_as_values_cjs_1 = require("./assertions-as-values.cjs");
-const jwt_cjs_1 = require("./jwt.cjs");
-async function create(input, context) {
-    const { iss, sub } = await (0, jwt_cjs_1.validateIdToken)(input.credentials, context.configuration.trust);
-    const request = {
-        input: { iss, sub },
-        query: { id: input.id }
-    };
-    return await context.local.transit(request);
-}
-exports.effect = (0, assertions_as_values_cjs_1.assertionsAsValues)(create);
-//# sourceMappingURL=create.js.map

package/components/identity.federation/operations/create.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"create.js","sourceRoot":"","sources":["../source/create.ts"],"names":[],"mappings":";;;AAAA,yEAA+D;AAC/D,uCAA2C;AAI3C,KAAK,UAAU,MAAM,CAAE,KAAkB,EAAE,OAAgB;IACzD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,IAAA,yBAAe,EAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;IAE1F,MAAM,OAAO,GAAY;QACvB,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAA+B;QAChD,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE;KACxB,CAAA;IAED,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;AAC7C,CAAC;AAWY,QAAA,MAAM,GAAG,IAAA,6CAAkB,EAAC,MAAM,CAAC,CAAA"}

package/components/identity.federation/operations/jwt.cjs

@@ -1,112 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateIdToken = exports.validateSignature = exports.validateJwtPayload = exports.validateJwtHeader = exports.decodeJwt = void 0;
-const node_crypto_1 = __importDefault(require("node:crypto"));
-const assert = __importStar(require("node:assert"));
-function decodeJwt(token) {
-    const [rawHeader, rawPayload, signature] = token.split('.', 3);
-    const header = JSON.parse(Buffer.from(rawHeader, 'base64url').toString());
-    const payload = JSON.parse(Buffer.from(rawPayload, 'base64url').toString());
-    return { header, payload, rawHeader, rawPayload, signature };
-}
-exports.decodeJwt = decodeJwt;
-function validateJwtHeader(header) {
-    assert.ok(header !== null && typeof header === 'object', 'Header is not an object');
-    assert.ok('typ' in header, 'Header is missing typ');
-    assert.equal(header.typ, 'JWT');
-    assert.ok('alg' in header, 'Header is missing alg');
-    assert.ok(typeof header.alg === 'string', 'Header alg is not a string');
-    assert.equal(header.alg, 'RS256', `We only validating RS256 id_tokens, but got ${header.alg}`);
-}
-exports.validateJwtHeader = validateJwtHeader;
-function validateJwtPayload(payload, trusted = []) {
-    assert.ok(trusted.length > 0, 'No trusted issuers provided');
-    // full list of validations is at https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation
-    assert.ok(payload !== null && typeof payload === 'object', 'Payload is not an object');
-    assert.ok('iss' in payload, 'Payload is missing iss');
-    assert.ok(typeof payload.iss === 'string', 'Payload iss is not a string');
-    assert.ok('aud' in payload, 'Payload is missing aud');
-    assert.ok(typeof payload.aud === 'string', 'Payload aud is not a string');
-    assert.ok(trusted.some(config => config.issuer === payload.iss &&
-        (config.audience === undefined || config.audience.some(a => a === payload.aud))), `Unknown issuer / audience: ${payload.iss} / ${payload.aud}`);
-    assert.ok('sub' in payload, 'Payload is missing sub');
-    assert.ok(typeof payload.sub === 'string', 'Payload sub is not a string');
-    assert.ok('exp' in payload, 'Payload is missing exp');
-    assert.ok(typeof payload.exp === 'number', 'Payload exp is not a number');
-    assert.ok(Date.now() < payload.exp * 1000, 'Token is expired');
-    assert.ok('iat' in payload, 'Payload is missing iat');
-    assert.ok(typeof payload.iat === 'number', 'Payload iat is not a number');
-    assert.ok(Date.now() >= payload.iat * 1000, 'Token was issued in the future');
-    assert.ok(payload.exp >= payload.iat, 'Payload exp is before iat');
-    if ('nbf' in payload) {
-        assert.ok(typeof payload.nbf === 'number', 'Payload nbf is not a number');
-        assert.ok(Date.now() >= payload.nbf * 1000, 'Token is not valid yet');
-    }
-}
-exports.validateJwtPayload = validateJwtPayload;
-async function validateSignature({ header: { kid, alg }, payload: { iss }, rawHeader, rawPayload, signature }) {
-    // Getting issuer public keys
-    const oidcRequest = await fetch(`${iss}/.well-known/openid-configuration`, {
-        cache: 'default'
-    });
-    assert.ok(oidcRequest.ok, `Failed to fetch OpenID configuration: ${oidcRequest.statusText}`);
-    const { jwks_uri: jwksUri } = (await oidcRequest.json());
-    const jwkRequest = await fetch(jwksUri, { cache: 'default' });
-    assert.ok(jwkRequest.ok, `Failed to fetch issuer keys: ${jwkRequest.statusText}`);
-    const { keys } = (await jwkRequest.json());
-    // getting corresponding signing key
-    const signingKeys = keys.filter((k) => k.use === 'sig' && k.alg === alg);
-    assert.ok(signingKeys.length > 0, 'No acceptable signing keys found');
-    assert.ok(kid === undefined || signingKeys.length === 1, 'Signing key selection is not deterministic');
-    const signingKey = kid === undefined ? signingKeys.find((k) => k.kid === kid) : keys[0];
-    assert.ok(signingKey, 'Signing key was not found in issuer keys');
-    const verifyFunction = node_crypto_1.default.createVerify('RSA-SHA256');
-    verifyFunction.write(rawHeader);
-    verifyFunction.write('.');
-    verifyFunction.write(rawPayload);
-    verifyFunction.end();
-    const signatureValid = verifyFunction.verify({ format: 'jwk', key: signingKey }, signature, 'base64url');
-    assert.ok(signatureValid, 'Failed to validate signature');
-}
-exports.validateSignature = validateSignature;
-async function validateIdToken(token, trusted) {
-    const { header, payload, rawHeader, rawPayload, signature } = decodeJwt(token);
-    validateJwtHeader(header);
-    validateJwtPayload(payload, trusted);
-    await validateSignature({
-        header,
-        rawHeader,
-        payload,
-        rawPayload,
-        signature
-    });
-    return payload;
-}
-exports.validateIdToken = validateIdToken;
-//# sourceMappingURL=jwt.cjs.map

package/components/identity.federation/operations/jwt.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwt.cjs","sourceRoot":"","sources":["../source/jwt.cts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,8DAAgC;AAChC,oDAAqC;AAIrC,SAAgB,SAAS,CAAE,KAAa;IAOtC,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IAE9D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;IAE3E,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,CAAA;AAC9D,CAAC;AAbD,8BAaC;AAED,SAAgB,iBAAiB,CAAE,MAAe;IAChD,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,yBAAyB,CAAC,CAAA;IACnF,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,MAAM,EAAE,uBAAuB,CAAC,CAAA;IACnD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC/B,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,MAAM,EAAE,uBAAuB,CAAC,CAAA;IACnD,MAAM,CAAC,EAAE,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,4BAA4B,CAAC,CAAA;IACvE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,+CAA+C,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;AAChG,CAAC;AAPD,8CAOC;AAED,SAAgB,kBAAkB,CAChC,OAAgB,EAChB,UAAgC,EAAE;IAElC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,6BAA6B,CAAC,CAAA;IAE5D,yGAAyG;IACzG,MAAM,CAAC,EAAE,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,0BAA0B,CAAC,CAAA;IAEtF,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,OAAO,EAAE,wBAAwB,CAAC,CAAA;IACrD,MAAM,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,6BAA6B,CAAC,CAAA;IACzE,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,OAAO,EAAE,wBAAwB,CAAC,CAAA;IACrD,MAAM,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,6BAA6B,CAAC,CAAA;IAEzE,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG;QAC3D,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAChF,8BAA8B,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IAEhE,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,OAAO,EAAE,wBAAwB,CAAC,CAAA;IACrD,MAAM,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,6BAA6B,CAAC,CAAA;IAEzE,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,OAAO,EAAE,wBAAwB,CAAC,CAAA;IACrD,MAAM,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,6BAA6B,CAAC,CAAA;IACzE,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,EAAE,kBAAkB,CAAC,CAAA;IAE9D,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,OAAO,EAAE,wBAAwB,CAAC,CAAA;IACrD,MAAM,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,6BAA6B,CAAC,CAAA;IACzE,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,EAAE,gCAAgC,CAAC,CAAA;IAC7E,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAA;IAElE,IAAI,KAAK,IAAI,OAAO,EAAE,CAAC;QACrB,MAAM,CAAC,EAAE,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,6BAA6B,CAAC,CAAA;QACzE,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,EAAE,wBAAwB,CAAC,CAAA;IACvE,CAAC;AACH,CAAC;AAlCD,gDAkCC;AAEM,KAAK,UAAU,iBAAiB,CAAE,EACvC,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EACpB,OAAO,EAAE,EAAE,GAAG,EAAE,EAChB,SAAS,EACT,UAAU,EACV,SAAS,EAOV;IACC,6BAA6B;IAC7B,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,mCAAmC,EAAE;QACzE,KAAK,EAAE,SAAS;KACjB,CAAC,CAAA;IAEF,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,yCAAyC,WAAW,CAAC,UAAU,EAAE,CAAC,CAAA;IAE5F,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,CAAyB,CAAA;IAEhF,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;IAE7D,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,gCAAgC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAA;IAEjF,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAExC,CAAA;IAED,oCAAoC;IACpC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;IAExE,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,kCAAkC,CAAC,CAAA;IAErE,MAAM,CAAC,EAAE,CACP,GAAG,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAC7C,4CAA4C,CAC7C,CAAA;IAED,MAAM,UAAU,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAEvF,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,0CAA0C,CAAC,CAAA;IAEjE,MAAM,cAAc,GAAG,qBAAM,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;IAExD,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAC/B,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACzB,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAChC,cAAc,CAAC,GAAG,EAAE,CAAA;IAEpB,MAAM,cAAc,GAAG,cAAc,CAAC,MAAM,CAC1C,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,EAClC,SAAS,EACT,WAAW,CACZ,CAAA;IAED,MAAM,CAAC,EAAE,CAAC,cAAc,EAAE,8BAA8B,CAAC,CAAA;AAC3D,CAAC;AA1DD,8CA0DC;AAEM,KAAK,UAAU,eAAe,CACnC,KAAa,EACb,OAA8B;IAE9B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;IAE9E,iBAAiB,CAAC,MAAM,CAAC,CAAA;IACzB,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACpC,MAAM,iBAAiB,CAAC;QACtB,MAAM;QACN,SAAS;QACT,OAAO;QACP,UAAU;QACV,SAAS;KACV,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC;AAjBD,0CAiBC"}

package/components/identity.federation/operations/jwt.d.cts

@@ -1,19 +0,0 @@
-import type { JwtHeader, IdToken } from './types';
-import { type TrustConfiguration } from './schemas';
-export declare function decodeJwt(token: string): {
-    header: unknown;
-    payload: unknown;
-    rawHeader: string;
-    rawPayload: string;
-    signature: string;
-};
-export declare function validateJwtHeader(header: unknown): asserts header is JwtHeader;
-export declare function validateJwtPayload(payload: unknown, trusted?: TrustConfiguration[]): asserts payload is IdToken;
-export declare function validateSignature({ header: { kid, alg }, payload: { iss }, rawHeader, rawPayload, signature }: {
-    readonly header: JwtHeader;
-    rawHeader: string;
-    readonly payload: IdToken;
-    rawPayload: string;
-    signature: string;
-}): Promise<void>;
-export declare function validateIdToken(token: string, trusted?: TrustConfiguration[]): Promise<IdToken>;

package/components/identity.federation/operations/schemas.d.ts

@@ -1,43 +0,0 @@
-/**
- * This file was automatically generated by json-schema-to-typescript.
- * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
- * and run json-schema-to-typescript to regenerate this file.
- */
-export interface Schemas {
-    configuration?: {
-        trust?: TrustConfiguration[];
-        /**
-         * Force identities to be explicitly created or incept before being used in authentication
-         */
-        explicit_identity_creation?: boolean;
-        /**
-         * The value of `sub` of an identity token that will be assigned the `system` Role
-         */
-        principal?: {
-            iss: string;
-            sub: string;
-        };
-    };
-    entity?: {
-        /**
-         * The issuer, or signer, of the token, URI like `https://accounts.google.com`
-         */
-        iss: string;
-        /**
-         * the ID that represents the principal making the request
-         */
-        sub: string;
-    };
-}
-export interface TrustConfiguration {
-    /**
-     * Allowed origins for a token `iss` field
-     */
-    issuer: string;
-    /**
-     * Acceptable `aud` value(s)
-     *
-     * @minItems 1
-     */
-    audience?: [string, ...string[]];
-}

package/components/identity.federation/operations/schemas.js

@@ -1,9 +0,0 @@
-"use strict";
-/* eslint-disable */
-/**
- * This file was automatically generated by json-schema-to-typescript.
- * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
- * and run json-schema-to-typescript to regenerate this file.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=schemas.js.map

package/components/identity.federation/operations/schemas.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../source/schemas.ts"],"names":[],"mappings":";AAAA,oBAAoB;AACpB;;;;GAIG"}

package/components/identity.federation/operations/types.d.ts

@@ -1,51 +0,0 @@
-import { type Call, type Observation, type Query } from '@toa.io/types';
-import type { Schemas } from './schemas';
-export interface Context {
-    local: {
-        observe: Observation<Entity & {
-            id: string;
-        }>;
-        transit: Call<TransitOutput, TransitInput>;
-    };
-    remote: {
-        identity: {
-            tokens: {
-                revoke: Call<void, IdentityTokensRevokeInput>;
-            };
-        };
-    };
-    configuration: Required<Schemas>['configuration'];
-}
-export type Entity = Required<Schemas>['entity'];
-export interface TransitInput {
-    readonly iss: string;
-    readonly sub: string;
-}
-export interface TransitOutput {
-    id: string;
-}
-interface IdentityTokensRevokeInput {
-    query: Query;
-}
-export interface JwtHeader {
-    typ: string;
-    alg: string;
-    kid?: string;
-}
-/**
- * @see {@link https://openid.net/specs/openid-connect-core-1_0.html#IDToken}
- */
-export interface IdToken {
-    iss: string;
-    sub: string;
-    aud: string;
-    exp: number;
-    iat: number;
-    nbf?: number;
-}
-export interface AuthenticateOutput {
-    identity: {
-        id: string;
-    };
-}
-export {};

package/components/identity.federation/operations/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../source/types.ts"],"names":[],"mappings":""}

package/components/identity.federation/source/assertions-as-values.cts

@@ -1,20 +0,0 @@
-import * as assert from 'node:assert'
-
-/**
- * Wrapping function that returns assertion errors as function return value
- */
-export function assertionsAsValues<T extends (...args: any[]) => Promise<any>> (
-  fn: T
-) {
-  return async (...args: Parameters<T>): Promise<ReturnType<T> | Error> => {
-    try {
-      return await fn(...args)
-    } catch (err) {
-      console.error(err)
-
-      if (err instanceof assert.AssertionError) return err
-
-      throw err
-    }
-  }
-}

package/components/identity.federation/source/create.ts

@@ -1,26 +0,0 @@
-import { assertionsAsValues } from './assertions-as-values.cjs'
-import { validateIdToken } from './jwt.cjs'
-import type { Request } from '@toa.io/core'
-import type { Context, Entity } from './types'
-
-async function create (input: CreateInput, context: Context): Promise<CreateOutput> {
-  const { iss, sub } = await validateIdToken(input.credentials, context.configuration.trust)
-
-  const request: Request = {
-    input: { iss, sub } satisfies Omit<Entity, 'id'>,
-    query: { id: input.id }
-  }
-
-  return await context.local.transit(request)
-}
-
-interface CreateInput {
-  id: string
-  credentials: string
-}
-
-interface CreateOutput {
-  id: string
-}
-
-export const effect = assertionsAsValues(create)

package/components/identity.federation/source/jwt.cts

@@ -1,143 +0,0 @@
-import crypto from 'node:crypto'
-import * as assert from 'node:assert'
-import type { JwtHeader, IdToken } from './types'
-import { type TrustConfiguration } from './schemas'
-
-export function decodeJwt (token: string): {
-  header: unknown
-  payload: unknown
-  rawHeader: string
-  rawPayload: string
-  signature: string
-} {
-  const [rawHeader, rawPayload, signature] = token.split('.', 3)
-
-  const header = JSON.parse(Buffer.from(rawHeader, 'base64url').toString())
-  const payload = JSON.parse(Buffer.from(rawPayload, 'base64url').toString())
-
-  return { header, payload, rawHeader, rawPayload, signature }
-}
-
-export function validateJwtHeader (header: unknown): asserts header is JwtHeader {
-  assert.ok(header !== null && typeof header === 'object', 'Header is not an object')
-  assert.ok('typ' in header, 'Header is missing typ')
-  assert.equal(header.typ, 'JWT')
-  assert.ok('alg' in header, 'Header is missing alg')
-  assert.ok(typeof header.alg === 'string', 'Header alg is not a string')
-  assert.equal(header.alg, 'RS256', `We only validating RS256 id_tokens, but got ${header.alg}`)
-}
-
-export function validateJwtPayload (
-  payload: unknown,
-  trusted: TrustConfiguration[] = []
-): asserts payload is IdToken {
-  assert.ok(trusted.length > 0, 'No trusted issuers provided')
-
-  // full list of validations is at https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation
-  assert.ok(payload !== null && typeof payload === 'object', 'Payload is not an object')
-
-  assert.ok('iss' in payload, 'Payload is missing iss')
-  assert.ok(typeof payload.iss === 'string', 'Payload iss is not a string')
-  assert.ok('aud' in payload, 'Payload is missing aud')
-  assert.ok(typeof payload.aud === 'string', 'Payload aud is not a string')
-
-  assert.ok(trusted.some(config => config.issuer === payload.iss &&
-     (config.audience === undefined || config.audience.some(a => a === payload.aud))),
-     `Unknown issuer / audience: ${payload.iss} / ${payload.aud}`)
-
-  assert.ok('sub' in payload, 'Payload is missing sub')
-  assert.ok(typeof payload.sub === 'string', 'Payload sub is not a string')
-
-  assert.ok('exp' in payload, 'Payload is missing exp')
-  assert.ok(typeof payload.exp === 'number', 'Payload exp is not a number')
-  assert.ok(Date.now() < payload.exp * 1000, 'Token is expired')
-
-  assert.ok('iat' in payload, 'Payload is missing iat')
-  assert.ok(typeof payload.iat === 'number', 'Payload iat is not a number')
-  assert.ok(Date.now() >= payload.iat * 1000, 'Token was issued in the future')
-  assert.ok(payload.exp >= payload.iat, 'Payload exp is before iat')
-
-  if ('nbf' in payload) {
-    assert.ok(typeof payload.nbf === 'number', 'Payload nbf is not a number')
-    assert.ok(Date.now() >= payload.nbf * 1000, 'Token is not valid yet')
-  }
-}
-
-export async function validateSignature ({
-  header: { kid, alg },
-  payload: { iss },
-  rawHeader,
-  rawPayload,
-  signature
-}: {
-  readonly header: JwtHeader
-  rawHeader: string
-  readonly payload: IdToken
-  rawPayload: string
-  signature: string
-}): Promise<void> {
-  // Getting issuer public keys
-  const oidcRequest = await fetch(`${iss}/.well-known/openid-configuration`, {
-    cache: 'default'
-  })
-
-  assert.ok(oidcRequest.ok, `Failed to fetch OpenID configuration: ${oidcRequest.statusText}`)
-
-  const { jwks_uri: jwksUri } = (await oidcRequest.json()) as { jwks_uri: string }
-
-  const jwkRequest = await fetch(jwksUri, { cache: 'default' })
-
-  assert.ok(jwkRequest.ok, `Failed to fetch issuer keys: ${jwkRequest.statusText}`)
-
-  const { keys } = (await jwkRequest.json()) as {
-    keys: Array<{ use: string, kid?: string, alg?: string } & crypto.JsonWebKey>
-  }
-
-  // getting corresponding signing key
-  const signingKeys = keys.filter((k) => k.use === 'sig' && k.alg === alg)
-
-  assert.ok(signingKeys.length > 0, 'No acceptable signing keys found')
-
-  assert.ok(
-    kid === undefined || signingKeys.length === 1,
-    'Signing key selection is not deterministic'
-  )
-
-  const signingKey = kid === undefined ? signingKeys.find((k) => k.kid === kid) : keys[0]
-
-  assert.ok(signingKey, 'Signing key was not found in issuer keys')
-
-  const verifyFunction = crypto.createVerify('RSA-SHA256')
-
-  verifyFunction.write(rawHeader)
-  verifyFunction.write('.')
-  verifyFunction.write(rawPayload)
-  verifyFunction.end()
-
-  const signatureValid = verifyFunction.verify(
-    { format: 'jwk', key: signingKey },
-    signature,
-    'base64url'
-  )
-
-  assert.ok(signatureValid, 'Failed to validate signature')
-}
-
-export async function validateIdToken (
-  token: string,
-  trusted?: TrustConfiguration[]
-): Promise<IdToken> {
-  const { header, payload, rawHeader, rawPayload, signature } = decodeJwt(token)
-
-  validateJwtHeader(header)
-  validateJwtPayload(payload, trusted)
-  await validateSignature({
-    header,
-    rawHeader,
-    payload,
-    rawPayload,
-    signature
-  })
-
-  return payload
-}

package/components/identity.federation/source/schemas.ts

@@ -1,45 +0,0 @@
-/* eslint-disable */
-/**
- * This file was automatically generated by json-schema-to-typescript.
- * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
- * and run json-schema-to-typescript to regenerate this file.
- */
-
-export interface Schemas {
-  configuration?: {
-    trust?: TrustConfiguration[];
-    /**
-     * Force identities to be explicitly created or incept before being used in authentication
-     */
-    explicit_identity_creation?: boolean;
-    /**
-     * The value of `sub` of an identity token that will be assigned the `system` Role
-     */
-    principal?: {
-      iss: string;
-      sub: string;
-    };
-  };
-  entity?: {
-    /**
-     * The issuer, or signer, of the token, URI like `https://accounts.google.com`
-     */
-    iss: string;
-    /**
-     * the ID that represents the principal making the request
-     */
-    sub: string;
-  };
-}
-export interface TrustConfiguration {
-  /**
-   * Allowed origins for a token `iss` field
-   */
-  issuer: string;
-  /**
-   * Acceptable `aud` value(s)
-   *
-   * @minItems 1
-   */
-  audience?: [string, ...string[]];
-}

package/components/identity.federation/source/types.ts

@@ -1,56 +0,0 @@
-import { type Call, type Observation, type Query } from '@toa.io/types'
-import type { Schemas } from './schemas'
-
-export interface Context {
-  local: {
-    observe: Observation<Entity & { id: string }>
-    transit: Call<TransitOutput, TransitInput>
-  }
-  remote: {
-    identity: {
-      tokens: {
-        revoke: Call<void, IdentityTokensRevokeInput>
-      }
-    }
-  }
-  configuration: Required<Schemas>['configuration']
-}
-
-export type Entity = Required<Schemas>['entity']
-
-export interface TransitInput {
-  readonly iss: string
-  readonly sub: string
-}
-
-export interface TransitOutput {
-  id: string
-}
-
-interface IdentityTokensRevokeInput {
-  query: Query
-}
-
-export interface JwtHeader {
-  typ: string
-  alg: string
-  kid?: string
-}
-
-/**
- * @see {@link https://openid.net/specs/openid-connect-core-1_0.html#IDToken}
- */
-export interface IdToken {
-  iss: string
-  sub: string
-  aud: string
-  exp: number
-  iat: number
-  nbf?: number
-}
-
-export interface AuthenticateOutput {
-  identity: {
-    id: string
-  }
-}