@toa.io/extensions.exposition 1.0.0-alpha.254 → 1.0.0-alpha.257

package/components/identity.federation/operations/types/context.d.ts

@@ -8,7 +8,7 @@ export interface Context {
         observe: Observation<Entity>;
         enumerate: Observation<Entity[], never, Entity>;
         terminate: Transition<void, void, Entity>;
-        transit: Call<TransitOutput, TransitInput>;
+        transit: Call<Entity, TransitInput>;
         ensure: Call<Entity>;
         decode: Call<JWTPayload, string>;
     };
@@ -27,10 +27,7 @@ export interface TransitInput {
     readonly authority: string;
     readonly iss: string;
     readonly sub: string;
-    readonly identity?: string;
-}
-export interface TransitOutput {
-    id: string;
+    readonly identity: string;
 }
 interface IdentityTokensRevokeInput {
     query: Query;

package/components/identity.federation/operations/types/entity.d.ts

@@ -3,6 +3,7 @@ export interface Entity {
     authority: string;
     iss: string;
     sub: string;
-    identity?: string;
+    identity: string;
     _created: number;
+    _deleted?: number | null;
 }

package/components/identity.federation/source/authenticate.ts

@@ -1,6 +1,6 @@
 import { Err } from 'error-value'
-import { decode, exchange } from './lib'
-import type { Ctx } from './lib'
+import { newid } from '@toa.io/generic'
+import { resolve } from './lib'
 import type { JWTPayload } from 'jose'
 import type { Maybe } from '@toa.io/types'
 import type { Context, Scheme } from './types'
@@ -8,15 +8,7 @@ import type { Context, Scheme } from './types'
 export async function effect ({ scheme, authority, credentials }: Input, context: Context): Promise<Maybe<Output>> {
   context.logs.debug('Authenticating', { scheme, authority, credentials })
 
-  const ctx: Ctx = {
-    trust: context.configuration.trust,
-    logs: context.logs,
-    fetch: context.fetch
-  }
-
-  const claims = scheme === 'bearer'
-    ? await decode(credentials, ctx)
-    : await exchange(credentials, ctx)
+  const claims = await resolve(scheme, credentials, context)
 
   if (claims instanceof Error)
     return claims
@@ -25,17 +17,22 @@ export async function effect ({ scheme, authority, credentials }: Input, context
 
   context.logs.debug('Token claims', claims)
 
-  const identity = context.configuration.assert !== false
-    ? await context.local.ensure({ entity: { authority, iss, sub } })
-    : await context.local.observe({ query: { criteria: `authority==${authority};iss==${iss};sub==${sub}` } })
+  const query = { criteria: `authority==${authority};iss==${iss};sub==${sub}` }
+
+  const credential = context.configuration.assert !== false
+    ? await context.local.ensure({
+      query,
+      entity: { authority, iss, sub, identity: newid() }
+    })
+    : await context.local.observe({ query })
 
-  if (identity === null)
+  if (credential === null)
     return ERR_NOT_FOUND
 
-  if (identity instanceof Error)
-    return identity
+  if (credential instanceof Error)
+    return credential
 
-  return { identity: { id: identity.identity ?? identity.id, claims } }
+  return { identity: { id: credential.identity, claims } }
 }
 
 const ERR_NOT_FOUND = new Err('NOT_FOUND')

package/components/identity.federation/source/create.ts

@@ -0,0 +1,39 @@
+import { Err } from 'error-value'
+import { resolve } from './lib'
+import type { Context, Entity, Scheme } from './types'
+
+export async function effect (input: Input, context: Context): Promise<Entity | Error> {
+  const claims = await resolve(input.scheme, input.credentials, context)
+
+  if (claims instanceof Error)
+    return claims
+
+  const { iss, sub } = claims
+
+  const existent = await context.local.observe({
+    query: { criteria: `authority==${input.authority};iss==${iss};sub==${sub}`, deleted: true }
+  })
+
+  const record = { authority: input.authority, iss, sub, identity: input.id }
+
+  if (existent === null)
+    return await context.local.transit({ input: record })
+
+  if (existent._deleted === undefined || existent._deleted === null)
+    return existent.identity === input.id ? existent : ERR_EXISTS
+
+  // a deleted record still occupies the unique index, so the transition revives it
+  return await context.local.transit({
+    input: record,
+    query: { id: existent.id, deleted: true }
+  })
+}
+
+export interface Input {
+  authority: string
+  scheme: Scheme
+  credentials: string
+  id: string
+}
+
+const ERR_EXISTS = new Err('EXISTS', 'Federation credentials are associated with another Identity')

package/components/identity.federation/source/delete.ts

@@ -3,7 +3,7 @@ import type { Context } from './types'
 export async function effect ({ authority, identity, credential }: Input, context: Context): Promise<void | null> {
   const object = await context.local.observe({ query: { id: credential } })
 
-  if (object === null || object.authority !== authority || (object.identity ?? object.id) !== identity)
+  if (object === null || object.authority !== authority || object.identity !== identity)
     return null
 
   return await context.local.terminate({ query: { id: credential } })

package/components/identity.federation/source/incept.ts

@@ -1,51 +1,19 @@
-import { Err } from 'error-value'
-import { decode, exchange, type Ctx } from './lib'
-import type { Request } from '@toa.io/types'
-import type { Context, TransitInput, Scheme } from './types'
+import { effect as create } from './create'
+import type { Context, Scheme } from './types'
 
 export async function effect (input: Input, context: Context): Promise<Output | Error> {
-  const ctx: Ctx = {
-    trust: context.configuration.trust,
-    logs: context.logs,
-    fetch: context.fetch
-  }
+  const credential = await create(input, context)
 
-  const claims = input.scheme === 'bearer'
-    ? await decode(input.credentials, ctx)
-    : await exchange(input.credentials, ctx)
-
-  if (claims instanceof Error)
-    return claims
-
-  const { iss, sub } = claims
-
-  if (input.id === undefined) {
-    const request: Request<TransitInput> = { input: { authority: input.authority, iss, sub } }
-
-    return await context.local.transit(request)
-  }
-
-  const existent = await context.local.observe({
-    query: { criteria: `authority==${input.authority};iss==${iss};sub==${sub}` }
-  })
-
-  if (existent !== null)
-    return (existent.identity ?? existent.id) === input.id ? { id: input.id } : ERR_EXISTS
-
-  return await context.local.transit({
-    input: { authority: input.authority, iss, sub, identity: input.id }
-  })
+  return credential instanceof Error ? credential : { id: credential.identity }
 }
 
 export interface Input {
   authority: string
   scheme: Scheme
   credentials: string
-  id?: string
+  id: string
 }
 
 export interface Output {
   id: string
 }
-
-const ERR_EXISTS = new Err('EXISTS', 'Federation credentials are associated with another Identity')

package/components/identity.federation/source/lib/index.ts

@@ -1,3 +1,4 @@
 export { decode } from './decode'
 export { exchange } from './exchange'
+export { resolve } from './resolve'
 export { type Ctx } from './Ctx'

package/components/identity.federation/source/lib/resolve.ts

@@ -0,0 +1,17 @@
+import { decode } from './decode'
+import { exchange } from './exchange'
+import type { Ctx } from './Ctx'
+import type { Payload } from './Payload'
+import type { Context, Scheme } from '../types'
+
+export async function resolve (scheme: Scheme, credentials: string, context: Context): Promise<Payload | Error> {
+  const ctx: Ctx = {
+    trust: context.configuration.trust,
+    logs: context.logs,
+    fetch: context.fetch
+  }
+
+  return scheme === 'bearer'
+    ? await decode(credentials, ctx)
+    : await exchange(credentials, ctx)
+}

package/components/identity.federation/source/list.test.ts

@@ -1,18 +1,16 @@
 import { computation } from './list'
 
-it('lists indexed credentials and a legacy associated credential', async () => {
+it('lists indexed credentials', async () => {
   const current = { id: 'credential', authority: 'nex', identity: 'identity', iss: 'apple', sub: '1', _created: 2 }
-  const legacy = { id: 'identity', authority: 'nex', iss: 'google', sub: '2', _created: 1 }
 
   const context = {
     local: {
-      enumerate: jest.fn(async () => [current]),
-      observe: jest.fn(async () => legacy)
+      enumerate: jest.fn(async () => [current])
     }
   }
 
   await expect(computation({ authority: 'nex', identity: 'identity' }, context as never))
-    .resolves.toEqual([current, legacy])
+    .resolves.toEqual([current])
   expect(context.local.enumerate).toHaveBeenCalledWith({
     query: {
       criteria: 'authority==nex;identity==identity',

package/components/identity.federation/source/list.ts

@@ -1,7 +1,7 @@
 import type { Context, Entity } from './types'
 
 export async function computation ({ authority, identity }: Input, context: Context): Promise<Entity[]> {
-  const objects = await context.local.enumerate({
+  return await context.local.enumerate({
     query: {
       criteria: `authority==${authority};identity==${identity}`,
       projection: ['iss'],
@@ -9,13 +9,6 @@ export async function computation ({ authority, identity }: Input, context: Cont
       limit: 100
     }
   })
-
-  const legacy = await context.local.observe({ query: { id: identity } })
-
-  if (legacy !== null && legacy.authority === authority && legacy.identity === undefined)
-    objects.push(legacy)
-
-  return objects.sort((a, b) => b._created - a._created)
 }
 
 interface Input {

package/components/identity.federation/source/types/context.ts

@@ -9,7 +9,7 @@ export interface Context {
     observe: Observation<Entity>
     enumerate: Observation<Entity[], never, Entity>
     terminate: Transition<void, void, Entity>
-    transit: Call<TransitOutput, TransitInput>
+    transit: Call<Entity, TransitInput>
     ensure: Call<Entity>
     decode: Call<JWTPayload, string>
   }
@@ -30,11 +30,7 @@ export interface TransitInput {
   readonly authority: string
   readonly iss: string
   readonly sub: string
-  readonly identity?: string
-}
-
-export interface TransitOutput {
-  id: string
+  readonly identity: string
 }
 
 interface IdentityTokensRevokeInput {

package/components/identity.federation/source/types/entity.ts

@@ -3,6 +3,7 @@ export interface Entity {
   authority: string
   iss: string
   sub: string
-  identity?: string
+  identity: string
   _created: number
+  _deleted?: number | null
 }