@toa.io/extensions.exposition 1.0.0-alpha.2 → 1.0.0-alpha.200

package/components/identity.passkeys/manifest.toa.yaml

@@ -0,0 +1,268 @@
+namespace: identity
+name: passkeys
+
+entity:
+  schema:
+    type: object
+    properties:
+      authority:
+        type: string
+      identity:
+        type: string
+      kid:
+        type: string
+      aid:
+        description: AAGUID
+        type: string
+      synced:
+        description: credentialBackedUp
+        type: boolean
+      key:
+        description: Base64-encoded Uint8Array
+        type: string
+      counter:
+        type: number
+        minimum: 0
+        default: 0
+      transports:
+        type: array
+        items:
+          type: string
+      label: &label
+        type: string
+        minLength: 1
+        maxLength: 64
+    required:
+      - authority
+      - identity
+      - kid
+      - aid
+      - synced
+      - key
+      - counter
+      - _created
+  index:
+    list:
+      authority: asc
+      identity: asc
+      _created: desc
+    key:
+      authority: asc
+      kid: asc
+
+operations:
+  challenge:
+    input:
+      type: object
+      properties:
+        type:
+          type: string
+          enum: [creation, request]
+        authority:
+          type: string
+        identity:
+          type: string
+      required:
+        - type
+        - authority
+  create:
+    query: false
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        origin:
+          type: string
+        identity:
+          type: string
+        label: *label
+        id:
+          type: string
+        type:
+          type: string
+        response:
+          type: object
+          properties:
+            id:
+              type: string
+            response:
+              type: object
+              properties:
+                attestationObject:
+                  type: string
+                clientDataJSON:
+                  type: string
+                transports:
+                  type: array
+                  items:
+                    type: string
+                publicKeyAlgorithm:
+                  type: number
+                publicKey:
+                  type: string
+                authenticatorData:
+                  type: string
+              required:
+                - authenticatorData
+                - attestationObject
+                - clientDataJSON
+                - transports
+                - publicKeyAlgorithm
+                - publicKey
+        authenticatorAttachment:
+          type: string
+          nullable: true
+        clientExtensionResults:
+          type: object
+      required:
+        - authority
+        - identity
+        - origin
+        - label
+        - id
+        - type
+        - response
+  use:
+    concurrency: retry
+    query: true
+    input:
+      type: object
+      properties: &use.input
+        origin:
+          type: string
+        id:
+          type: string
+        type:
+          type: string
+        response:
+          type: object
+          properties:
+            authenticatorData:
+              type: string
+            clientDataJSON:
+              type: string
+            signature:
+              type: string
+            userHandle:
+              type: string
+        authenticatorAttachment:
+          type: string
+        clientExtensionResults:
+          type: object
+      required:
+        - origin
+        - id
+        - response
+  authenticate:
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        <<: *use.input
+      required:
+        - authority
+        - origin
+        - id
+        - response
+  list:
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        identity:
+          type: string
+      required:
+        - authority
+        - identity
+  delete:
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        identity:
+          type: string
+        id:
+          type: string
+      required:
+        - authority
+        - identity
+        - id
+
+exposition:
+  /:
+    POST:
+      auth:incept: identity
+      map:authority: authority
+      map:headers:
+        origin: origin
+      io:output: [identity]
+      endpoint: authenticate
+    /challenges:
+      auth:anonymous: true
+      POST:
+        map:authority: authority
+        io:output: &challenge [identity, challenge, timeout, userVerification, authenticatorSelection, pubKeyCredParams, allowCredentials, excludeCredentials]
+        auth:incept: identity
+        endpoint: challenge
+      /:identity:
+        POST:
+          map:authority: authority
+          map:segments:
+            identity: identity
+          io:output: *challenge
+          endpoint: challenge
+    /:identity:
+      auth:id: identity
+      POST:
+        map:authority: authority
+        map:segments:
+          identity: identity
+        map:headers:
+          origin: origin
+        io:output: [id, aid, synced, label, _created, _updated]
+        endpoint: create
+      GET:
+        map:authority: authority
+        map:segments:
+          identity: identity
+        io:output: [id, aid, synced, label, _created, _updated]
+        endpoint: list
+      /:id:
+        DELETE:
+          map:authority: authority
+          map:segments:
+            identity: identity
+            id: id
+          io:output: false
+          endpoint: delete
+
+configuration:
+  schema:
+    type: object
+    properties:
+      algorithms:
+        type: array
+        items:
+          type: number
+        default: [-7, -257]
+      timeout:
+        type: integer
+        default: 60000
+      verification:
+        description: AuthenticatorSelectionCriteria.userVerification
+        type: string
+        enum: &requirement
+          - required
+          - preferred
+          - discouraged
+      residence:
+        description: AuthenticatorSelectionCriteria.residentKey
+        type: string
+        enum: *requirement
+        default: required
+
+stash: ~

package/components/identity.passkeys/operations/authenticate.d.ts

@@ -0,0 +1,16 @@
+import type { Context } from './types';
+import type { AuthenticationResponseJSON } from '@simplewebauthn/server';
+import type { Operation } from '@toa.io/types';
+export declare class Effect implements Operation {
+    private use;
+    private logs;
+    mount(context: Context): void;
+    execute(input: Input): Promise<Output>;
+}
+export interface Input extends Omit<AuthenticationResponseJSON, 'rawId'> {
+    authority: string;
+    origin: string;
+}
+export type Output = {
+    identity: string;
+} | Error;

package/components/identity.passkeys/operations/authenticate.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Effect = void 0;
+const error_value_1 = require("error-value");
+class Effect {
+    use;
+    logs;
+    mount(context) {
+        this.use = context.local.use;
+        this.logs = context.logs;
+    }
+    async execute(input) {
+        const { authority, ...response } = input;
+        const identity = await this.use({
+            query: {
+                criteria: `authority=="${authority}";kid=="${response.id}"`
+            },
+            input: response
+        });
+        if (identity === null) {
+            this.logs.debug('Passkey not found', {
+                authority,
+                id: response.id
+            });
+            return ERR_MISS;
+        }
+        if (identity instanceof Error)
+            return identity;
+        return { identity };
+    }
+}
+exports.Effect = Effect;
+const ERR_MISS = new error_value_1.Err('MISS');
+//# sourceMappingURL=authenticate.js.map

package/components/identity.passkeys/operations/authenticate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../source/authenticate.ts"],"names":[],"mappings":";;;AAAA,6CAAiC;AAKjC,MAAa,MAAM;IACT,GAAG,CAA0B;IAC7B,IAAI,CAAkB;IAEvB,KAAK,CAAE,OAAgB;QAC5B,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAA;QAC5B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;IAC1B,CAAC;IAEM,KAAK,CAAC,OAAO,CAAE,KAAY;QAChC,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAA;QAExC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC;YAC9B,KAAK,EAAE;gBACL,QAAQ,EAAE,eAAe,SAAS,WAAW,QAAQ,CAAC,EAAE,GAAG;aAC5D;YACD,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAA;QAEF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE;gBACnC,SAAS;gBACT,EAAE,EAAE,QAAQ,CAAC,EAAE;aAChB,CAAC,CAAA;YAEF,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,IAAI,QAAQ,YAAY,KAAK;YAC3B,OAAO,QAAQ,CAAA;QAEjB,OAAO,EAAE,QAAQ,EAAE,CAAA;IACrB,CAAC;CACF;AAjCD,wBAiCC;AAED,MAAM,QAAQ,GAAG,IAAI,iBAAG,CAAC,MAAM,CAAC,CAAA"}

package/components/identity.passkeys/operations/challenge.d.ts

@@ -0,0 +1,35 @@
+import type { Operation } from '@toa.io/types';
+import type { Context } from './types';
+export declare class Effect implements Operation {
+    private timeout;
+    private authenticator?;
+    private credParams;
+    private enumerate;
+    private stash;
+    private logs;
+    mount(context: Context): void;
+    execute(input: Input): Promise<Output>;
+    private createChallenge;
+}
+interface Input {
+    type: 'creation' | 'request';
+    authority: string;
+    identity?: string | null;
+}
+type Output = CreationOptions | RequestOptions;
+interface CommonOptions {
+    identity?: string;
+    challenge: string;
+    timeout: number;
+}
+interface KeyDescriptor {
+    id: string;
+    transports?: string[];
+}
+type CreationOptions = CommonOptions & Omit<PublicKeyCredentialCreationOptions, 'challenge' | 'rp' | 'user' | 'excludeCredentials'> & {
+    excludeCredentials?: KeyDescriptor[];
+};
+type RequestOptions = CommonOptions & Omit<PublicKeyCredentialRequestOptions, 'challenge' | 'allowCredentials'> & {
+    allowCredentials?: KeyDescriptor[];
+};
+export {};

package/components/identity.passkeys/operations/challenge.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Effect = void 0;
+const node_crypto_1 = require("node:crypto");
+const generic_1 = require("@toa.io/generic");
+const const_1 = require("./lib/const");
+class Effect {
+    timeout;
+    authenticator;
+    credParams;
+    enumerate;
+    stash;
+    logs;
+    mount(context) {
+        this.timeout = context.configuration.timeout;
+        this.credParams = context.configuration.algorithms.map((alg) => ({ type: 'public-key', alg }));
+        if (context.configuration.verification !== undefined) {
+            this.authenticator ??= {};
+            this.authenticator.userVerification = context.configuration.verification;
+        }
+        if (context.configuration.residence !== undefined) {
+            this.authenticator ??= {};
+            this.authenticator.residentKey = context.configuration.residence;
+            if (context.configuration.residence === 'required')
+                this.authenticator.requireResidentKey = true;
+        }
+        this.enumerate = context.local.enumerate;
+        this.stash = context.stash;
+        this.logs = context.logs;
+    }
+    async execute(input) {
+        const { type, identity, authority } = input;
+        const challenge = await this.createChallenge(authority);
+        const options = {
+            challenge,
+            timeout: this.timeout
+        };
+        if (type === 'creation')
+            options.identity = identity ?? (0, generic_1.newid)();
+        const keys = identity === undefined
+            ? []
+            : await this.enumerate({
+                query: {
+                    criteria: `identity==${identity}`,
+                    projection: ['kid', 'transports'],
+                    limit: const_1.MAX_KEYS
+                }
+            });
+        if (type === 'creation')
+            return {
+                ...options,
+                excludeCredentials: keys.map(({ kid, transports }) => ({ id: kid, transports })),
+                pubKeyCredParams: this.credParams,
+                authenticatorSelection: this.authenticator
+            };
+        else
+            return {
+                ...options,
+                allowCredentials: keys.map(({ kid, transports }) => ({ id: kid, transports })),
+                userVerification: this.authenticator?.userVerification
+            };
+    }
+    async createChallenge(authority) {
+        const challenge = (0, node_crypto_1.randomBytes)(32).toString('base64url');
+        const key = `challenge:${authority}:${challenge}`;
+        this.logs.debug('Creating challenge', { key });
+        await this.stash.set(key, 1, 'EX', this.timeout / 1000 * EX_GAP);
+        return challenge;
+    }
+}
+exports.Effect = Effect;
+const EX_GAP = 1.5;
+//# sourceMappingURL=challenge.js.map

package/components/identity.passkeys/operations/challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge.js","sourceRoot":"","sources":["../source/challenge.ts"],"names":[],"mappings":";;;AAAA,6CAAyC;AACzC,6CAAuC;AACvC,uCAAsC;AAItC,MAAa,MAAM;IACT,OAAO,CAAS;IAChB,aAAa,CAAiC;IAC9C,UAAU,CAAkC;IAC5C,SAAS,CAAgC;IACzC,KAAK,CAAmB;IACxB,IAAI,CAAkB;IAEvB,KAAK,CAAE,OAAgB;QAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,CAAA;QAC5C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;QAE9F,IAAI,OAAO,CAAC,aAAa,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACrD,IAAI,CAAC,aAAa,KAAK,EAAE,CAAA;YACzB,IAAI,CAAC,aAAa,CAAC,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC,YAAY,CAAA;QAC1E,CAAC;QAED,IAAI,OAAO,CAAC,aAAa,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClD,IAAI,CAAC,aAAa,KAAK,EAAE,CAAA;YACzB,IAAI,CAAC,aAAa,CAAC,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,SAAS,CAAA;YAEhE,IAAI,OAAO,CAAC,aAAa,CAAC,SAAS,KAAK,UAAU;gBAChD,IAAI,CAAC,aAAa,CAAC,kBAAkB,GAAG,IAAI,CAAA;QAChD,CAAC;QAED,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAA;QACxC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;QAC1B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;IAC1B,CAAC;IAEM,KAAK,CAAC,OAAO,CAAE,KAAY;QAChC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,KAAK,CAAA;QAC3C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAA;QAEvD,MAAM,OAAO,GAAW;YACtB,SAAS;YACT,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAA;QAED,IAAI,IAAI,KAAK,UAAU;YACrB,OAAO,CAAC,QAAQ,GAAG,QAAQ,IAAI,IAAA,eAAK,GAAE,CAAA;QAExC,MAAM,IAAI,GAAG,QAAQ,KAAK,SAAS;YACjC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC;gBACrB,KAAK,EAAE;oBACL,QAAQ,EAAE,aAAa,QAAQ,EAAE;oBACjC,UAAU,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;oBACjC,KAAK,EAAE,gBAAQ;iBAChB;aACF,CAAC,CAAA;QAEJ,IAAI,IAAI,KAAK,UAAU;YACrB,OAAO;gBACL,GAAG,OAAO;gBACV,kBAAkB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;gBAChF,gBAAgB,EAAE,IAAI,CAAC,UAAU;gBACjC,sBAAsB,EAAE,IAAI,CAAC,aAAa;aACjB,CAAA;;YAE3B,OAAO;gBACL,GAAG,OAAO;gBACV,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;gBAC9E,gBAAgB,EAAE,IAAI,CAAC,aAAa,EAAE,gBAAgB;aAC9B,CAAA;IAC9B,CAAC;IAEO,KAAK,CAAC,eAAe,CAAE,SAAiB;QAC9C,MAAM,SAAS,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACvD,MAAM,GAAG,GAAG,aAAa,SAAS,IAAI,SAAS,EAAE,CAAA;QAEjD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;QAE9C,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,MAAM,CAAC,CAAA;QAEhE,OAAO,SAAS,CAAA;IAClB,CAAC;CACF;AA7ED,wBA6EC;AAED,MAAM,MAAM,GAAG,GAAG,CAAA"}

package/components/identity.passkeys/operations/create.d.ts

@@ -0,0 +1,19 @@
+import { type RegistrationResponseJSON } from '@simplewebauthn/server';
+import type { Operation } from '@toa.io/types';
+import type { Context, Passkey } from './types';
+export declare class Transition implements Operation {
+    private algorithms;
+    private stash;
+    private logs;
+    private verification;
+    private presence;
+    mount(context: Context): void;
+    execute(input: Input, object: Passkey): Promise<Passkey | Error>;
+    private verifyChallenge;
+}
+export interface Input extends RegistrationResponseJSON {
+    authority: string;
+    origin: string;
+    identity: string;
+    label?: string;
+}

package/components/identity.passkeys/operations/create.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Transition = void 0;
+const server_1 = require("@simplewebauthn/server");
+const error_value_1 = require("error-value");
+// https://github.com/MasterKale/SimpleWebAuthn/blob/master/packages/server/src/registration/verifyRegistrationResponse.ts#L51
+class Transition {
+    algorithms;
+    stash;
+    logs;
+    verification;
+    presence;
+    mount(context) {
+        this.algorithms = context.configuration.algorithms;
+        this.verification = context.configuration.verification === 'required';
+        this.presence = context.configuration.residence === 'required';
+        this.stash = context.stash;
+        this.logs = context.logs;
+    }
+    async execute(input, object) {
+        const { authority, identity, label, ...response } = input;
+        // rawId is not sent from the client
+        response.rawId = response.id;
+        const verified = await (0, server_1.verifyRegistrationResponse)({
+            response,
+            expectedOrigin: input.origin,
+            expectedChallenge: async (challenge) => this.verifyChallenge(authority, challenge),
+            supportedAlgorithmIDs: this.algorithms,
+            requireUserVerification: this.verification,
+            requireUserPresence: this.presence
+        }).catch((e) => {
+            this.logs.info('Failed to verify registration response', { message: e.message });
+            return ERR_FAILED;
+        });
+        if (verified instanceof Error)
+            return verified;
+        if (!verified.verified || verified.registrationInfo?.credential === undefined)
+            return ERR_INVALID;
+        const reg = verified.registrationInfo;
+        object.authority = authority;
+        object.identity = identity;
+        object.kid = reg.credential.id;
+        object.aid = reg.aaguid;
+        object.synced = reg.credentialBackedUp;
+        object.key = Buffer.from(reg.credential.publicKey).toString('base64url');
+        object.transports = reg.credential.transports;
+        object.label = label;
+        return object;
+    }
+    async verifyChallenge(authority, challenge) {
+        const n = await this.stash.del(`challenge:${authority}:${challenge}`);
+        return n === 1;
+    }
+}
+exports.Transition = Transition;
+const ERR_FAILED = new error_value_1.Err('FAILED');
+const ERR_INVALID = new error_value_1.Err('INVALID');
+//# sourceMappingURL=create.js.map

package/components/identity.passkeys/operations/create.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.js","sourceRoot":"","sources":["../source/create.ts"],"names":[],"mappings":";;;AAAA,mDAAkG;AAClG,6CAAiC;AAIjC,8HAA8H;AAE9H,MAAa,UAAU;IACb,UAAU,CAAW;IACrB,KAAK,CAAmB;IACxB,IAAI,CAAkB;IACtB,YAAY,CAAU;IACtB,QAAQ,CAAU;IAEnB,KAAK,CAAE,OAAgB;QAC5B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,UAAU,CAAA;QAClD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,YAAY,KAAK,UAAU,CAAA;QACrE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,SAAS,KAAK,UAAU,CAAA;QAC9D,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;QAC1B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;IAC1B,CAAC;IAEM,KAAK,CAAC,OAAO,CAAE,KAAY,EAAE,MAAe;QACjD,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAA;QAEzD,oCAAoC;QACpC,QAAQ,CAAC,KAAK,GAAG,QAAQ,CAAC,EAAE,CAAA;QAE5B,MAAM,QAAQ,GAAG,MAAM,IAAA,mCAA0B,EAAC;YAChD,QAAQ;YACR,cAAc,EAAE,KAAK,CAAC,MAAM;YAC5B,iBAAiB,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC;YAClF,qBAAqB,EAAE,IAAI,CAAC,UAAU;YACtC,uBAAuB,EAAE,IAAI,CAAC,YAAY;YAC1C,mBAAmB,EAAE,IAAI,CAAC,QAAQ;SACnC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;YACb,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;YAEhF,OAAO,UAAmB,CAAA;QAC5B,CAAC,CAAC,CAAA;QAEF,IAAI,QAAQ,YAAY,KAAK;YAC3B,OAAO,QAAQ,CAAA;QAEjB,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,gBAAgB,EAAE,UAAU,KAAK,SAAS;YAC3E,OAAO,WAAW,CAAA;QAEpB,MAAM,GAAG,GAAG,QAAQ,CAAC,gBAAgB,CAAA;QAErC,MAAM,CAAC,SAAS,GAAG,SAAS,CAAA;QAC5B,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAA;QAC1B,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,CAAA;QAC9B,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAA;QACvB,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,kBAAkB,CAAA;QACtC,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACxE,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,UAAU,CAAA;QAC7C,MAAM,CAAC,KAAK,GAAG,KAAK,CAAA;QAEpB,OAAO,MAAM,CAAA;IACf,CAAC;IAEO,KAAK,CAAC,eAAe,CAAE,SAAiB,EAAE,SAAiB;QACjE,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,SAAS,IAAI,SAAS,EAAE,CAAC,CAAA;QAErE,OAAO,CAAC,KAAK,CAAC,CAAA;IAChB,CAAC;CACF;AA3DD,gCA2DC;AAED,MAAM,UAAU,GAAG,IAAI,iBAAG,CAAC,QAAQ,CAAC,CAAA;AACpC,MAAM,WAAW,GAAG,IAAI,iBAAG,CAAC,SAAS,CAAC,CAAA"}

package/components/identity.passkeys/operations/delete.d.ts

@@ -0,0 +1,8 @@
+import type { Context } from './types';
+export declare function effect({ authority, identity, id }: Input, context: Context): Promise<void | null>;
+interface Input {
+    authority: string;
+    identity: string;
+    id: string;
+}
+export {};

package/components/identity.passkeys/operations/delete.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.effect = void 0;
+async function effect({ authority, identity, id }, context) {
+    return await context.local.terminate({
+        query: {
+            criteria: `authority==${authority};identity==${identity};id==${id}`
+        }
+    });
+}
+exports.effect = effect;
+//# sourceMappingURL=delete.js.map

package/components/identity.passkeys/operations/delete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.js","sourceRoot":"","sources":["../source/delete.ts"],"names":[],"mappings":";;;AAEO,KAAK,UAAU,MAAM,CAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAS,EAAE,OAAgB;IAChF,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QACnC,KAAK,EAAE;YACL,QAAQ,EAAE,cAAc,SAAS,cAAc,QAAQ,QAAQ,EAAE,EAAE;SACpE;KACF,CAAC,CAAA;AACJ,CAAC;AAND,wBAMC"}

package/components/identity.passkeys/operations/lib/const.d.ts

@@ -0,0 +1 @@
+export declare const MAX_KEYS = 128;

package/components/identity.passkeys/operations/lib/const.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_KEYS = void 0;
+exports.MAX_KEYS = 128;
+//# sourceMappingURL=const.js.map

package/components/identity.passkeys/operations/lib/const.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"const.js","sourceRoot":"","sources":["../../source/lib/const.ts"],"names":[],"mappings":";;;AAAa,QAAA,QAAQ,GAAG,GAAG,CAAA"}

package/components/identity.passkeys/operations/list.d.ts

@@ -0,0 +1,7 @@
+import type { Context, Passkey } from './types';
+export declare function computation({ authority, identity }: Input, context: Context): Promise<Passkey[]>;
+interface Input {
+    authority: string;
+    identity: string;
+}
+export {};

package/components/identity.passkeys/operations/list.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computation = void 0;
+const const_1 = require("./lib/const");
+async function computation({ authority, identity }, context) {
+    return await context.local.enumerate({
+        query: {
+            criteria: `authority==${authority};identity==${identity}`,
+            projection: ['aid', 'synced', 'label'],
+            limit: const_1.MAX_KEYS
+        }
+    });
+}
+exports.computation = computation;
+//# sourceMappingURL=list.js.map

package/components/identity.passkeys/operations/list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../source/list.ts"],"names":[],"mappings":";;;AAAA,uCAAsC;AAG/B,KAAK,UAAU,WAAW,CAAE,EAAE,SAAS,EAAE,QAAQ,EAAS,EAAE,OAAgB;IACjF,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QACnC,KAAK,EAAE;YACL,QAAQ,EAAE,cAAc,SAAS,cAAc,QAAQ,EAAE;YACzD,UAAU,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC;YACtC,KAAK,EAAE,gBAAQ;SAChB;KACF,CAAC,CAAA;AACJ,CAAC;AARD,kCAQC"}