@toa.io/extensions.exposition 1.0.0-alpha.23 → 1.0.0-alpha.231

package/components/identity.basic/operations/types.d.ts

@@ -2,7 +2,8 @@ import { type Call, type Maybe, type Observation, type Query } from '@toa.io/typ
 export interface Context {
     local: {
         observe: Observation<Maybe<Entity>>;
-        transit: Call<TransitOutput, TransitInput>;
+        transit: Call<IdOutput, TransitInput>;
+        create: Call<IdOutput, TransitInput>;
     };
     remote: {
         identity: {
@@ -15,23 +16,30 @@ export interface Context {
         readonly rounds: number;
         readonly pepper: string;
         readonly principal?: string;
-        readonly username: string | string[];
-        readonly password: string | string[];
+        readonly username: string[];
+        readonly password: string[];
     };
 }
 export interface Entity {
-    readonly id: string;
-    readonly _version: number;
+    id: string;
     authority: string;
     username: string;
     password: string;
+    readonly _version: number;
 }
 export interface TransitInput {
     authority: string;
     username?: string;
     password?: string;
+    inception?: boolean;
+}
+export interface AddInput {
+    id: string;
+    authority: string;
+    username: string;
+    password: string;
 }
-export interface TransitOutput {
+export interface IdOutput {
     id: string;
 }
 interface IdentityTokensRevokeInput {

package/components/identity.basic/source/add.ts

@@ -0,0 +1,14 @@
+import type { AddInput, Context, IdOutput } from './types'
+import type { Maybe } from '@toa.io/types'
+
+export async function effect (input: AddInput, context: Context): Promise<Maybe<IdOutput>> {
+  return await context.local.transit({
+    input: {
+      authority: input.authority,
+      username: input.username,
+      password: input.password,
+      inception: true
+    },
+    query: { id: input.id }
+  })
+}

package/components/identity.basic/source/authenticate.ts

@@ -4,8 +4,12 @@ import { Err } from 'error-value'
 import { type Context } from './types'
 
 export async function computation (input: Input, context: Context): Promise<Maybe<Output>> {
-  const [username, password] = Buffer.from(input.credentials, 'base64').toString().split(':')
-  const query: Query = { criteria: `authority==${input.authority};username==${username}` }
+  const [username, password] = Buffer
+    .from(input.credentials, 'base64')
+    .toString()
+    .split(':')
+
+  const query: Query = { criteria: `authority==${input.authority};username=='${username}'` }
   const credentials = await context.local.observe({ query })
 
   if (credentials instanceof Error)
@@ -23,8 +27,8 @@ export async function computation (input: Input, context: Context): Promise<Mayb
     return ERR_PASSWORD_MISMATCH
 }
 
-const ERR_NOT_FOUND = Err('NOT_FOUND')
-const ERR_PASSWORD_MISMATCH = Err('PASSWORD_MISMATCH')
+const ERR_NOT_FOUND = new Err('NOT_FOUND')
+const ERR_PASSWORD_MISMATCH = new Err('PASSWORD_MISMATCH')
 
 interface Input {
   authority: string

package/components/identity.basic/source/check.ts

@@ -0,0 +1,20 @@
+import type { Context } from './types'
+
+export async function computation (input: Input, context: Context): Promise<void | null | Error> {
+  const username = Buffer.from(input.username, 'base64url').toString()
+
+  const found = await context.local.observe({
+    query: { criteria: `authority==${input.authority};username=='${username}'` }
+  })
+
+  if (found instanceof Error)
+    return found
+
+  if (found === null)
+    return null
+}
+
+interface Input {
+  authority: string
+  username: string
+}

package/components/identity.basic/source/incept.ts

@@ -1,16 +1,32 @@
-import { type Context } from './types'
+import { Err } from 'error-value'
+import type { Context } from './types'
+import type { Maybe } from '@toa.io/types'
 
-export async function effect (input: Input, context: Context): Promise<Output> {
-  const [username, password] = Buffer.from(input.credentials, 'base64').toString().split(':')
+export async function effect (input: Input, context: Context): Promise<Maybe<Output>> {
+  const [username, password] = Buffer
+    .from(input.credentials, 'base64')
+    .toString()
+    .split(':')
+
+  if (typeof password !== 'string')
+    return INVALID_CREDENTIALS
 
   const request = {
-    input: { authority: input.authority, username, password },
-    query: { id: input.id }
+    input: {
+      authority: input.authority,
+      username,
+      password
+    },
+    query: {
+      id: input.id
+    }
   }
 
   return await context.local.transit(request)
 }
 
+const INVALID_CREDENTIALS = new Err('INVALID_CREDENTIALS')
+
 interface Input {
   authority: string
   id: string

package/components/identity.basic/source/transit.ts

@@ -1,7 +1,7 @@
 import { genSalt, hash } from 'bcryptjs'
 import { Err } from 'error-value'
 import type { Maybe, Operation } from '@toa.io/types'
-import type { Context, Entity, TransitInput, TransitOutput } from './types'
+import type { Context, Entity, TransitInput, IdOutput } from './types'
 
 export class Transition implements Operation {
   private rounds: number = 10
@@ -21,12 +21,15 @@ export class Transition implements Operation {
     this.passwordRx = toRx(context.configuration.password)
   }
 
-  public async execute (input: TransitInput, object: Entity): Promise<Maybe<TransitOutput>> {
+  public async execute (input: TransitInput, object: Entity): Promise<Maybe<IdOutput>> {
     const existent = object._version !== 0
 
-    if (existent)
+    if (existent) {
+      if (input.inception === true)
+        return ERR_EXISTS
+
       await this.tokens.revoke({ query: { id: object.id } })
-    else
+    } else
       object.authority = input.authority
 
     if (input.username !== undefined) {
@@ -53,9 +56,7 @@ export class Transition implements Operation {
   }
 }
 
-function toRx (input: string | string[]): RegExp[] {
-  const expressions = typeof input === 'string' ? [input] : input
-
+function toRx (expressions: string[]): RegExp[] {
   return expressions.map((expression) => new RegExp(expression))
 }
 
@@ -63,8 +64,9 @@ function invalid (value: string, expressions: RegExp[]): boolean {
   return expressions.some((expression) => !expression.test(value))
 }
 
-const ERR_PRINCIPAL_LOCKED = Err('PRINCIPAL_LOCKED', 'Principal username cannot be changed.')
-const ERR_INVALID_USERNAME = Err('INVALID_USERNAME', 'Username is not meeting the requirements.')
-const ERR_INVALID_PASSWORD = Err('INVALID_PASSWORD', 'Password is not meeting the requirements.')
+const ERR_PRINCIPAL_LOCKED = new Err('PRINCIPAL_LOCKED', 'Principal username cannot be changed')
+const ERR_INVALID_USERNAME = new Err('INVALID_USERNAME', 'Username is not meeting the requirements')
+const ERR_INVALID_PASSWORD = new Err('INVALID_PASSWORD', 'Password is not meeting the requirements')
+const ERR_EXISTS = new Err('EXISTS', 'Basic credentials already exist')
 
 type Tokens = Context['remote']['identity']['tokens']

package/components/identity.basic/source/types.ts

@@ -3,7 +3,8 @@ import { type Call, type Maybe, type Observation, type Query } from '@toa.io/typ
 export interface Context {
   local: {
     observe: Observation<Maybe<Entity>>
-    transit: Call<TransitOutput, TransitInput>
+    transit: Call<IdOutput, TransitInput>
+    create: Call<IdOutput, TransitInput>
   }
   remote: {
     identity: {
@@ -16,26 +17,34 @@ export interface Context {
     readonly rounds: number
     readonly pepper: string
     readonly principal?: string
-    readonly username: string | string[]
-    readonly password: string | string[]
+    readonly username: string[]
+    readonly password: string[]
   }
 }
 
 export interface Entity {
-  readonly id: string
-  readonly _version: number
+  id: string
   authority: string
   username: string
   password: string
+  readonly _version: number
 }
 
 export interface TransitInput {
   authority: string
   username?: string
   password?: string
+  inception?: boolean
+}
+
+export interface AddInput {
+  id: string
+  authority: string
+  username: string
+  password: string
 }
 
-export interface TransitOutput {
+export interface IdOutput {
   id: string
 }
 

package/components/identity.federation/manifest.toa.yaml

@@ -32,28 +32,43 @@ operations:
       sub*: string
   incept:
     input:
-      authority: string
+      scheme*: [bearer, code]
+      authority*: string
       credentials*: string
       id: string
     output:
       id: string
   authenticate:
     input:
+      scheme*: [bearer, code]
       authority*: string
       credentials*: string
     output:
-      identity:
-        id: string
-
-exposition:
-  /:
-    POST:
-      anonymous: true
-      io:input: [authority, credentials]
-      io:output: [id]
-      vary:embed:
-        authority: authority
-      endpoint: incept
+      properties:
+        identity:
+          properties:
+            id:
+              type: string
+            claims: &claims
+              properties:
+                iss:
+                  type: string
+                aud:
+                  type: string
+                sub:
+                  type: string
+              additionalProperties: true
+              required:
+                - iss
+                - sub
+          required:
+            - id
+            - claims
+    errors:
+      - ERR_NOT_FOUND
+  decode:
+    input: string
+    output: *claims
 
 configuration:
   schema:
@@ -62,41 +77,37 @@ configuration:
       trust:
         type: array
         items:
-          title: Trust Configuration
+          title: Trusted Identity Providers
           type: object
           additionalProperties: false
           properties:
             iss:
-              description: Allowed origins for a token `iss` field
+              description: Allowed values for a token `iss` field
               type: string
               format: uri
             aud:
-              description: Acceptable `aud` value(s)
-              type: array
-              items:
-                type: string
-              uniqueItems: true
-              minItems: 1
-            secrets:
-              description: Symmetric encryption secrets
-              type: object
-              patternProperties:
-                ^HS\d{3}$:
-                  type: object
-                  patternProperties:
-                    ^\w+$:
-                      type: string
-                  minProperties: 1
-              additionalProperties: false
-              minProperties: 1
+              description: Acceptable `aud` value(s). Required for Authorization Code Flow.
+              anyOf:
+                - type: string
+                - type: array
+                  items: { type: string }
+                  uniqueItems: true
+                  minItems: 1
+            signature:
+              properties:
+                iss: { type: string }
+                kid: { type: string }
+                key: { type: string }
+              required: [iss, kid, key]
+            secret:
+              description: Client secret for the Identity Provider. Required for Authorization Code Flow.
+              type: string
           required:
             - iss
-      explicit_identity_creation:
-        description: Force identities to be explicitly created or incept before being used in authentication
-        type: boolean
-        default: true
+        default: []
       principal:
-        description: The value of `sub` of an identity token that will be assigned the `system` Role
+        title: Principal
+        description: Subject that will be assigned the `system` Role
         type: object
         properties:
           iss:
@@ -108,4 +119,18 @@ configuration:
           - iss
           - sub
         additionalProperties: false
+      assert:
+        title: Implicitly incept Identity for new credentials
+        type: boolean
+        default: true
     additionalProperties: false
+
+exposition:
+  /:
+    /:id:
+      POST:
+        map:authority: authority
+        auth:id: id
+        io:input: [scheme, credentials]
+        io:output: false
+        endpoint: incept

package/components/identity.federation/operations/authenticate.d.ts

@@ -1,3 +1,16 @@
-import { type Maybe } from '@toa.io/types';
-import type { AuthenticateInput, AuthenticateOutput, Context } from './types';
-export declare const computation: (args_0: AuthenticateInput, context: Context) => Promise<Error | Promise<Maybe<AuthenticateOutput>>>;
+import type { JWTPayload } from 'jose';
+import type { Maybe } from '@toa.io/types';
+import type { Context, Scheme } from './types';
+export declare function effect({ scheme, authority, credentials }: Input, context: Context): Promise<Maybe<Output>>;
+interface Input {
+    scheme: Scheme;
+    authority: string;
+    credentials: string;
+}
+interface Output {
+    identity: {
+        id: string;
+        claims: JWTPayload;
+    };
+}
+export {};

package/components/identity.federation/operations/authenticate.js

@@ -1,21 +1,30 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.computation = void 0;
+exports.effect = void 0;
 const error_value_1 = require("error-value");
-const assertions_as_values_js_1 = require("./lib/assertions-as-values.js");
-const jwt_1 = require("./lib/jwt");
-async function authenticate({ authority, credentials }, context) {
-    const { iss, sub } = await (0, jwt_1.validateIdToken)(credentials, context.configuration.trust);
-    const request = { query: { criteria: `authority==${authority};iss==${iss};sub==${sub}` } };
-    let id = (await context.local.observe(request))?.id;
-    if (id === undefined) {
-        if (context.configuration.explicit_identity_creation === true)
-            return NOT_FOUND;
-        id = (await context.local.transit({ input: { authority, iss, sub } })).id;
-    }
-    return { identity: { id } };
+const lib_1 = require("./lib");
+async function effect({ scheme, authority, credentials }, context) {
+    context.logs.debug('Authenticating', { scheme, authority, credentials });
+    const ctx = {
+        trust: context.configuration.trust,
+        logs: context.logs
+    };
+    const claims = scheme === 'bearer'
+        ? await (0, lib_1.decode)(credentials, ctx)
+        : await (0, lib_1.exchange)(credentials, ctx);
+    if (claims instanceof Error)
+        return claims;
+    const { iss, sub } = claims;
+    context.logs.debug('Token claims', claims);
+    const identity = context.configuration.assert !== false
+        ? await context.local.ensure({ entity: { authority, iss, sub } })
+        : await context.local.observe({ query: { criteria: `authority==${authority};iss==${iss};sub==${sub}` } });
+    if (identity === null)
+        return ERR_NOT_FOUND;
+    if (identity instanceof Error)
+        return identity;
+    return { identity: { id: identity.id, claims } };
 }
-// Exporting as a function returning assertion errors as values
-exports.computation = (0, assertions_as_values_js_1.assertionsAsValues)(authenticate);
-const NOT_FOUND = (0, error_value_1.Err)('NOT_FOUND');
+exports.effect = effect;
+const ERR_NOT_FOUND = new error_value_1.Err('NOT_FOUND');
 //# sourceMappingURL=authenticate.js.map

package/components/identity.federation/operations/authenticate.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../source/authenticate.ts"],"names":[],"mappings":";;;AACA,6CAAiC;AACjC,2EAAkE;AAClE,mCAEkB;AAIlB,KAAK,UAAU,YAAY,CAAE,EAAE,SAAS,EAAE,WAAW,EAAqB,EACxE,OAAgB;IAChB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,IAAA,qBAAe,EAAC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;IAEpF,MAAM,OAAO,GAAY,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,cAAc,SAAS,SAAS,GAAG,SAAS,GAAG,EAAE,EAAE,EAAE,CAAA;IAEnG,IAAI,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAA;IAEnD,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,IAAI,OAAO,CAAC,aAAa,CAAC,0BAA0B,KAAK,IAAI;YAC3D,OAAO,SAAS,CAAA;QAElB,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3E,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,CAAA;AAC7B,CAAC;AAED,+DAA+D;AAClD,QAAA,WAAW,GAAG,IAAA,4CAAkB,EAAC,YAAY,CAAC,CAAA;AAE3D,MAAM,SAAS,GAAG,IAAA,iBAAG,EAAC,WAAW,CAAC,CAAA"}
+{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../source/authenticate.ts"],"names":[],"mappings":";;;AAAA,6CAAiC;AACjC,+BAAwC;AAMjC,KAAK,UAAU,MAAM,CAAE,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAS,EAAE,OAAgB;IACvF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAA;IAExE,MAAM,GAAG,GAAQ;QACf,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,KAAK;QAClC,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAA;IAED,MAAM,MAAM,GAAG,MAAM,KAAK,QAAQ;QAChC,CAAC,CAAC,MAAM,IAAA,YAAM,EAAC,WAAW,EAAE,GAAG,CAAC;QAChC,CAAC,CAAC,MAAM,IAAA,cAAQ,EAAC,WAAW,EAAE,GAAG,CAAC,CAAA;IAEpC,IAAI,MAAM,YAAY,KAAK;QACzB,OAAO,MAAM,CAAA;IAEf,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;IAE3B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;IAE1C,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,KAAK;QACrD,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;QACjE,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,cAAc,SAAS,SAAS,GAAG,SAAS,GAAG,EAAE,EAAE,EAAE,CAAC,CAAA;IAE3G,IAAI,QAAQ,KAAK,IAAI;QACnB,OAAO,aAAa,CAAA;IAEtB,IAAI,QAAQ,YAAY,KAAK;QAC3B,OAAO,QAAQ,CAAA;IAEjB,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAA;AAClD,CAAC;AA9BD,wBA8BC;AAED,MAAM,aAAa,GAAG,IAAI,iBAAG,CAAC,WAAW,CAAC,CAAA"}

package/components/identity.federation/operations/decode.d.ts

@@ -0,0 +1,3 @@
+import type { JWTPayload } from 'jose';
+import type { Context } from './types';
+export declare function effect(token: string, context: Context): Promise<JWTPayload | Error>;

package/components/identity.federation/operations/decode.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.effect = void 0;
+const lib_1 = require("./lib");
+async function effect(token, context) {
+    return await (0, lib_1.decode)(token, {
+        trust: context.configuration.trust,
+        logs: context.logs
+    });
+}
+exports.effect = effect;
+//# sourceMappingURL=decode.js.map

package/components/identity.federation/operations/decode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decode.js","sourceRoot":"","sources":["../source/decode.ts"],"names":[],"mappings":";;;AAAA,+BAA8B;AAIvB,KAAK,UAAU,MAAM,CAAE,KAAa,EAAE,OAAgB;IAC3D,OAAO,MAAM,IAAA,YAAM,EAAC,KAAK,EAAE;QACzB,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,KAAK;QAClC,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAA;AACJ,CAAC;AALD,wBAKC"}

package/components/identity.federation/operations/incept.d.ts

@@ -1,11 +1,11 @@
-import type { Context } from './types';
-interface Input {
+import type { Context, Scheme } from './types';
+export declare function effect(input: Input, context: Context): Promise<Output | Error>;
+export interface Input {
     authority: string;
+    scheme: Scheme;
     credentials: string;
     id?: string;
 }
-interface Output {
+export interface Output {
     id: string;
 }
-export declare const effect: (input: Input, context: Context) => Promise<Error | Promise<Output>>;
-export {};

package/components/identity.federation/operations/incept.js

@@ -1,14 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.effect = void 0;
-const assertions_as_values_js_1 = require("./lib/assertions-as-values.js");
-const jwt_1 = require("./lib/jwt");
-async function incept(input, context) {
-    const { iss, sub } = await (0, jwt_1.validateIdToken)(input.credentials, context.configuration.trust);
+const lib_1 = require("./lib");
+async function effect(input, context) {
+    const ctx = {
+        trust: context.configuration.trust,
+        logs: context.logs
+    };
+    const claims = input.scheme === 'bearer'
+        ? await (0, lib_1.decode)(input.credentials, ctx)
+        : await (0, lib_1.exchange)(input.credentials, ctx);
+    if (claims instanceof Error)
+        return claims;
+    const { iss, sub } = claims;
     const request = { input: { authority: input.authority, iss, sub } };
     if (input.id !== undefined)
         request.query = { id: input.id };
     return await context.local.transit(request);
 }
-exports.effect = (0, assertions_as_values_js_1.assertionsAsValues)(incept);
+exports.effect = effect;
 //# sourceMappingURL=incept.js.map

package/components/identity.federation/operations/incept.js.map

@@ -1 +1 @@
-{"version":3,"file":"incept.js","sourceRoot":"","sources":["../source/incept.ts"],"names":[],"mappings":";;;AAAA,2EAAkE;AAClE,mCAA2C;AAI3C,KAAK,UAAU,MAAM,CAAE,KAAY,EAAE,OAAgB;IACnD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,IAAA,qBAAe,EAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;IAE1F,MAAM,OAAO,GAAY,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,EAA+B,EAAE,CAAA;IAEzG,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS;QACxB,OAAO,CAAC,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAA;IAElC,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;AAC7C,CAAC;AAYY,QAAA,MAAM,GAAG,IAAA,4CAAkB,EAAC,MAAM,CAAC,CAAA"}
+{"version":3,"file":"incept.js","sourceRoot":"","sources":["../source/incept.ts"],"names":[],"mappings":";;;AAAA,+BAAkD;AAI3C,KAAK,UAAU,MAAM,CAAE,KAAY,EAAE,OAAgB;IAC1D,MAAM,GAAG,GAAQ;QACf,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,KAAK;QAClC,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAA;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,QAAQ;QACtC,CAAC,CAAC,MAAM,IAAA,YAAM,EAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC;QACtC,CAAC,CAAC,MAAM,IAAA,cAAQ,EAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;IAE1C,IAAI,MAAM,YAAY,KAAK;QACzB,OAAO,MAAM,CAAA;IAEf,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;IAC3B,MAAM,OAAO,GAA0B,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAA;IAE1F,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS;QACxB,OAAO,CAAC,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAA;IAElC,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;AAC7C,CAAC;AApBD,wBAoBC"}

package/components/identity.federation/operations/lib/Configuration.d.ts

@@ -0,0 +1,39 @@
+export interface Configuration extends Record<string, unknown> {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    userinfo_endpoint: string;
+    jwks_uri: string;
+    registration_endpoint?: string;
+    scopes_supported?: string[];
+    response_types_supported: string[];
+    response_modes_supported?: string[];
+    grant_types_supported?: string[];
+    acr_values_supported?: string[];
+    subject_types_supported: string[];
+    id_token_signing_alg_values_supported: string[];
+    id_token_encryption_alg_values_supported?: string[];
+    id_token_encryption_enc_values_supported?: string[];
+    userinfo_signing_alg_values_supported?: string[];
+    userinfo_encryption_alg_values_supported?: string[];
+    userinfo_encryption_enc_values_supported?: string[];
+    request_object_signing_alg_values_supported?: string[];
+    request_object_encryption_alg_values_supported?: string[];
+    request_object_encryption_enc_values_supported?: string[];
+    token_endpoint_auth_methods_supported?: string[];
+    token_endpoint_auth_signing_alg_values_supported?: string[];
+    display_values_supported?: string[];
+    claim_types_supported?: string[];
+    claims_supported?: string[];
+    service_documentation?: string;
+    claims_locales_supported?: string[];
+    ui_locales_supported?: string[];
+    claims_parameter_supported?: boolean;
+    request_parameter_supported?: boolean;
+    request_uri_parameter_supported?: boolean;
+    require_request_uri_registration?: boolean;
+    op_policy_uri?: string;
+    op_tos_uri?: string;
+    check_session_iframe?: string;
+    end_session_endpoint?: string;
+}

package/components/identity.federation/operations/lib/Configuration.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=Configuration.js.map

package/components/identity.federation/operations/lib/Configuration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Configuration.js","sourceRoot":"","sources":["../../source/lib/Configuration.ts"],"names":[],"mappings":""}

package/components/identity.federation/operations/lib/Ctx.d.ts

@@ -0,0 +1,6 @@
+import type { telemetry } from '@toa.io/types';
+import type { Trust } from '../types';
+export interface Ctx {
+    trust: Trust[];
+    logs: telemetry.Logs;
+}

package/{transpiled/directives/vary/embeddings/Embedding.js → components/identity.federation/operations/lib/Ctx.js}

@@ -1,3 +1,3 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=Embedding.js.map
+//# sourceMappingURL=Ctx.js.map

package/components/identity.federation/operations/lib/Ctx.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Ctx.js","sourceRoot":"","sources":["../../source/lib/Ctx.ts"],"names":[],"mappings":""}

package/components/identity.federation/operations/lib/Payload.d.ts

@@ -0,0 +1,5 @@
+import type * as jose from 'jose';
+export interface Payload extends jose.JWTPayload {
+    iss: string;
+    sub: string;
+}

package/components/identity.federation/operations/lib/Payload.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=Payload.js.map

package/components/identity.federation/operations/lib/Payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Payload.js","sourceRoot":"","sources":["../../source/lib/Payload.ts"],"names":[],"mappings":""}

package/components/identity.federation/operations/lib/decode.d.ts

@@ -0,0 +1,3 @@
+import type { Ctx } from './Ctx';
+import type { Payload } from './Payload';
+export declare function decode(token: string, ctx: Ctx): Promise<Payload | Error>;