@toa.io/extensions.exposition 1.0.0-alpha.253 → 1.0.0-alpha.256

package/components/identity.federation/operations/types/context.d.ts

@@ -3,6 +3,7 @@ import type { Call, Observation, Query, telemetry, Transition } from '@toa.io/ty
 import type { Entity } from './entity';
 import type { Configuration } from './configuration';
 export interface Context {
+    fetch: Fetch;
     local: {
         observe: Observation<Entity>;
         enumerate: Observation<Entity[], never, Entity>;
@@ -21,6 +22,7 @@ export interface Context {
     logs: telemetry.Logs;
     configuration: Configuration;
 }
+export type Fetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
 export interface TransitInput {
     readonly authority: string;
     readonly iss: string;

package/components/identity.federation/source/authenticate.ts

@@ -10,7 +10,8 @@ export async function effect ({ scheme, authority, credentials }: Input, context
 
   const ctx: Ctx = {
     trust: context.configuration.trust,
-    logs: context.logs
+    logs: context.logs,
+    fetch: context.fetch
   }
 
   const claims = scheme === 'bearer'

package/components/identity.federation/source/decode.ts

@@ -5,6 +5,7 @@ import type { Context } from './types'
 export async function effect (token: string, context: Context): Promise<JWTPayload | Error> {
   return await decode(token, {
     trust: context.configuration.trust,
-    logs: context.logs
+    logs: context.logs,
+    fetch: context.fetch
   })
 }

package/components/identity.federation/source/delete.ts

@@ -1,16 +1,16 @@
 import type { Context } from './types'
 
-export async function effect ({ authority, identity, id }: Input, context: Context): Promise<void | null> {
-  const object = await context.local.observe({ query: { id } })
+export async function effect ({ authority, identity, credential }: Input, context: Context): Promise<void | null> {
+  const object = await context.local.observe({ query: { id: credential } })
 
   if (object === null || object.authority !== authority || (object.identity ?? object.id) !== identity)
     return null
 
-  return await context.local.terminate({ query: { id } })
+  return await context.local.terminate({ query: { id: credential } })
 }
 
 interface Input {
   authority: string
   identity: string
-  id: string
+  credential: string
 }

package/components/identity.federation/source/incept.ts

@@ -6,7 +6,8 @@ import type { Context, TransitInput, Scheme } from './types'
 export async function effect (input: Input, context: Context): Promise<Output | Error> {
   const ctx: Ctx = {
     trust: context.configuration.trust,
-    logs: context.logs
+    logs: context.logs,
+    fetch: context.fetch
   }
 
   const claims = input.scheme === 'bearer'

package/components/identity.federation/source/lib/Ctx.ts

@@ -1,7 +1,9 @@
 import type { telemetry } from '@toa.io/types'
 import type { Trust } from '../types'
+import type { Fetch } from '../types/context'
 
 export interface Ctx {
   trust: Trust[]
   logs: telemetry.Logs
+  fetch: Fetch
 }

package/components/identity.federation/source/lib/decode.ts

@@ -1,12 +1,11 @@
-import * as jose from 'jose'
+import { load } from './jose'
 import { createRemoteJWKSet } from './discovery'
 import { ERR_TRUST, ERR_ISS, ERR_SUB } from './errors'
 import type { Ctx } from './Ctx'
 import type { Payload } from './Payload'
 
-const jwks: Record<string, Awaited<ReturnType<typeof createRemoteJWKSet>>> = {}
-
 export async function decode (token: string, ctx: Ctx): Promise<Payload | Error> {
+  const jose = await load()
   const { iss, sub } = jose.decodeJwt(token)
 
   if (typeof iss !== 'string')
@@ -20,9 +19,9 @@ export async function decode (token: string, ctx: Ctx): Promise<Payload | Error>
   if (trusted === undefined)
     return ERR_TRUST
 
-  jwks[iss] ??= await createRemoteJWKSet(iss)
+  const jwks = await createRemoteJWKSet(iss, ctx.fetch)
 
-  const { payload } = await jose.jwtVerify(token, jwks[iss], { audience: trusted.aud })
+  const { payload } = await jose.jwtVerify(token, jwks, { audience: trusted.aud })
 
   return payload as Payload
 }

package/components/identity.federation/source/lib/discovery.test.ts

@@ -0,0 +1,45 @@
+import { createRemoteJWKSet, discover } from './discovery'
+import { load } from './jose'
+import type { Fetch } from '../types/context'
+
+it('discovers an issuer using the component fetch', async () => {
+  const iss = `https://${Math.random().toString(36).slice(2)}.example.com`
+  const configuration = { issuer: iss, jwks_uri: `${iss}/jwks` }
+
+  const fetch = jest.fn(async (_input: string | URL | Request) =>
+    Response.json(configuration)) as jest.MockedFunction<Fetch>
+
+  await expect(discover(iss, fetch)).resolves.toMatchObject(configuration)
+  expect(fetch).toHaveBeenCalledWith(`${iss}/.well-known/openid-configuration`)
+})
+
+it('loads and caches remote keys using the component fetch', async () => {
+  const jose = await load()
+  const iss = `https://${Math.random().toString(36).slice(2)}.example.com`
+  const jwksUri = `${iss}/jwks`
+  const { privateKey, publicKey } = await jose.generateKeyPair('ES256')
+  const jwk = await jose.exportJWK(publicKey)
+
+  const fetch = jest.fn(async (input: string | URL | Request) => {
+    const url = input instanceof Request ? input.url : input.toString()
+
+    if (url.endsWith('/.well-known/openid-configuration'))
+      return Response.json({ issuer: iss, jwks_uri: jwksUri })
+
+    return Response.json({ keys: [{ ...jwk, alg: 'ES256', kid: 'key0', use: 'sig' }] })
+  }) as jest.MockedFunction<Fetch>
+
+  const token = await new jose.SignJWT({ sub: 'subject' })
+    .setProtectedHeader({ alg: 'ES256', kid: 'key0' })
+    .setIssuer(iss)
+    .sign(privateKey)
+
+  const first = await createRemoteJWKSet(iss, fetch)
+  const second = await createRemoteJWKSet(iss, fetch)
+
+  expect(second).toBe(first)
+  await expect(jose.jwtVerify(token, first, { issuer: iss })).resolves.toMatchObject({
+    payload: { sub: 'subject' }
+  })
+  expect(fetch).toHaveBeenCalledTimes(2)
+})

package/components/identity.federation/source/lib/discovery.ts

@@ -1,11 +1,14 @@
-import * as jose from 'jose'
+import { load } from './jose'
+import type * as jose from 'jose'
 import type { Configuration } from './Configuration'
+import type { Fetch } from '../types/context'
 
 const cache = new Map<string, Configuration>()
+const resolvers = new WeakMap<Fetch, Map<string, Promise<jose.RemoteJWKSet>>>()
 
-export async function discover (iss: string): Promise<Configuration> {
+export async function discover (iss: string, fetch: Fetch): Promise<Configuration> {
   if (!cache.has(iss)) {
-    const configuration = await fetchConfiguration(iss)
+    const configuration = await fetchConfiguration(iss, fetch)
 
     cache.set(iss, configuration)
   }
@@ -13,7 +16,7 @@ export async function discover (iss: string): Promise<Configuration> {
   return cache.get(iss)!
 }
 
-async function fetchConfiguration (iss: string): Promise<Configuration> {
+async function fetchConfiguration (iss: string, fetch: Fetch): Promise<Configuration> {
   const response = await fetch(`${iss}/.well-known/openid-configuration`)
 
   if (!response.ok)
@@ -22,9 +25,25 @@ async function fetchConfiguration (iss: string): Promise<Configuration> {
   return await response.json() as Configuration
 }
 
-export async function createRemoteJWKSet (iss: string): Promise<ReturnType<typeof jose.createRemoteJWKSet>> {
-  const configuration = await discover(iss)
-  const url = new URL(configuration.jwks_uri)
+export async function createRemoteJWKSet (iss: string, fetch: Fetch): Promise<jose.RemoteJWKSet> {
+  let entries = resolvers.get(fetch)
 
-  return jose.createRemoteJWKSet(url)
+  if (entries === undefined) {
+    entries = new Map()
+    resolvers.set(fetch, entries)
+  }
+
+  if (!entries.has(iss))
+    entries.set(iss, create(iss, fetch))
+
+  return await entries.get(iss)!
+}
+
+async function create (iss: string, fetch: Fetch): Promise<jose.RemoteJWKSet> {
+  const jose = await load()
+  const configuration = await discover(iss, fetch)
+
+  return jose.createRemoteJWKSet(new URL(configuration.jwks_uri), {
+    [jose.customFetch]: fetch
+  })
 }

package/components/identity.federation/source/lib/exchange.ts

@@ -1,13 +1,12 @@
-import * as jose from 'jose'
+import { load } from './jose'
 import { createRemoteJWKSet, discover } from './discovery'
 import * as errors from './errors'
 import type { Trust } from '../types'
 import type { Ctx } from './Ctx'
 import type { Payload } from './Payload'
 
-const jwks: Record<string, Awaited<ReturnType<typeof createRemoteJWKSet>>> = {}
-
 export async function exchange (credentials: string, ctx: Ctx): Promise<Payload | Error> {
+  const jose = await load()
   const properties = decode(credentials)
 
   if (properties instanceof Error)
@@ -23,7 +22,7 @@ export async function exchange (credentials: string, ctx: Ctx): Promise<Payload
   if (trusted.aud === undefined || (trusted.secret === undefined && trusted.signature === undefined))
     return errors.ERR_CODE_NOT_ENABLED
 
-  const configuration = await discover(iss)
+  const configuration = await discover(iss, ctx.fetch)
 
   if (configuration.token_endpoint === undefined)
     return errors.ERR_CONFIG
@@ -47,7 +46,7 @@ export async function exchange (credentials: string, ctx: Ctx): Promise<Payload
     code
   })
 
-  const response = await fetch(configuration.token_endpoint, {
+  const response = await ctx.fetch(configuration.token_endpoint, {
     method: 'POST',
     headers: {
       'Content-Type': 'application/x-www-form-urlencoded'
@@ -66,9 +65,9 @@ export async function exchange (credentials: string, ctx: Ctx): Promise<Payload
   if (tokens.id_token === undefined)
     return errors.ERR_NO_TOKEN
 
-  jwks[iss] ??= await createRemoteJWKSet(iss)
+  const jwks = await createRemoteJWKSet(iss, ctx.fetch)
 
-  const { payload } = await jose.jwtVerify(tokens.id_token, jwks[iss], {
+  const { payload } = await jose.jwtVerify(tokens.id_token, jwks, {
     audience: trusted.aud,
     issuer: iss
   })
@@ -92,6 +91,7 @@ function decode (credentials: string): Properties | Error {
 }
 
 async function sign (trust: Trust): Promise<string> {
+  const jose = await load()
   const signature = trust.signature!
   const aud = Array.isArray(trust.aud) ? trust.aud[0] : trust.aud!
   const now = Math.floor(Date.now() / 1000)

package/components/identity.federation/source/lib/jose.d.ts

@@ -0,0 +1 @@
+export function load (): Promise<typeof import('jose')>

package/components/identity.federation/source/lib/jose.js

@@ -0,0 +1,5 @@
+'use strict'
+
+const load = async () => await import('jose')
+
+exports.load = load

package/components/identity.federation/source/list.test.ts

@@ -17,7 +17,8 @@ it('lists indexed credentials and a legacy associated credential', async () => {
     query: {
       criteria: 'authority==nex;identity==identity',
       projection: ['iss'],
-      sort: ['_created:desc']
+      sort: ['_created:desc'],
+      limit: 100
     }
   })
 })

package/components/identity.federation/source/list.ts

@@ -5,7 +5,8 @@ export async function computation ({ authority, identity }: Input, context: Cont
     query: {
       criteria: `authority==${authority};identity==${identity}`,
       projection: ['iss'],
-      sort: ['_created:desc']
+      sort: ['_created:desc'],
+      limit: 100
     }
   })
 

package/components/identity.federation/source/types/context.ts

@@ -4,6 +4,7 @@ import type { Entity } from './entity'
 import type { Configuration } from './configuration'
 
 export interface Context {
+  fetch: Fetch
   local: {
     observe: Observation<Entity>
     enumerate: Observation<Entity[], never, Entity>
@@ -23,6 +24,8 @@ export interface Context {
   configuration: Configuration
 }
 
+export type Fetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>
+
 export interface TransitInput {
   readonly authority: string
   readonly iss: string

package/components/identity.federation/tsconfig.json

@@ -1,10 +1,7 @@
 {
   "extends": "../../tsconfig.json",
   "compilerOptions": {
-    "outDir": "./operations",
-    "module": "Node16",
-    "moduleResolution": "Node16",
-    "target": "ES2022"
+    "outDir": "./operations"
   },
   "include": ["source"]
 }

package/components/identity.keys/manifest.toa.yaml

@@ -42,6 +42,7 @@ operations:
       required:
         - id
         - key
+
 exposition:
   /:identity:
     auth:id: identity

package/components/identity.keys/operations/create.js

@@ -1,10 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Transition = void 0;
-const paseto_1 = require("paseto");
+const node_crypto_1 = require("node:crypto");
 class Transition {
     async execute(input, object) {
-        object.key = await paseto_1.V3.generateKey('local', { format: 'paserk' });
+        object.key = (0, node_crypto_1.randomBytes)(32).toString('base64url');
         object.identity = input.identity;
         object.label = input.label;
         if (input.expires !== undefined)

package/components/identity.keys/operations/create.js.map

@@ -1 +1 @@
-{"version":3,"file":"create.js","sourceRoot":"","sources":["../source/create.ts"],"names":[],"mappings":";;;AAAA,mCAA2B;AAG3B,MAAa,UAAU;IACd,KAAK,CAAC,OAAO,CAAE,KAAY,EAAE,MAAW;QAC7C,MAAM,CAAC,GAAG,GAAG,MAAM,WAAE,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;QAChE,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;QAChC,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;QAE1B,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;YAC7B,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAA;QAEhC,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAA;IAChE,CAAC;CACF;AAXD,gCAWC"}
+{"version":3,"file":"create.js","sourceRoot":"","sources":["../source/create.ts"],"names":[],"mappings":";;;AAAA,6CAAyC;AAGzC,MAAa,UAAU;IACd,KAAK,CAAC,OAAO,CAAE,KAAY,EAAE,MAAW;QAC7C,MAAM,CAAC,GAAG,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QAClD,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;QAChC,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;QAE1B,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;YAC7B,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAA;QAEhC,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAA;IAChE,CAAC;CACF;AAXD,gCAWC"}