@toa.io/extensions.exposition 1.0.0-alpha.256 → 1.0.0-alpha.258

package/components/identity.federation/operations/types/context.d.ts

@@ -8,7 +8,7 @@ export interface Context {
         observe: Observation<Entity>;
         enumerate: Observation<Entity[], never, Entity>;
         terminate: Transition<void, void, Entity>;
-        transit: Call<TransitOutput, TransitInput>;
+        transit: Call<Entity, TransitInput>;
         ensure: Call<Entity>;
         decode: Call<JWTPayload, string>;
     };
@@ -27,10 +27,7 @@ export interface TransitInput {
     readonly authority: string;
     readonly iss: string;
     readonly sub: string;
-    readonly identity?: string;
-}
-export interface TransitOutput {
-    id: string;
+    readonly identity: string;
 }
 interface IdentityTokensRevokeInput {
     query: Query;

package/components/identity.federation/operations/types/entity.d.ts

@@ -3,6 +3,7 @@ export interface Entity {
     authority: string;
     iss: string;
     sub: string;
-    identity?: string;
+    identity: string;
     _created: number;
+    _deleted?: number | null;
 }

package/components/identity.federation/source/authenticate.ts

@@ -1,6 +1,6 @@
 import { Err } from 'error-value'
-import { decode, exchange } from './lib'
-import type { Ctx } from './lib'
+import { newid } from '@toa.io/generic'
+import { resolve } from './lib'
 import type { JWTPayload } from 'jose'
 import type { Maybe } from '@toa.io/types'
 import type { Context, Scheme } from './types'
@@ -8,15 +8,7 @@ import type { Context, Scheme } from './types'
 export async function effect ({ scheme, authority, credentials }: Input, context: Context): Promise<Maybe<Output>> {
   context.logs.debug('Authenticating', { scheme, authority, credentials })
 
-  const ctx: Ctx = {
-    trust: context.configuration.trust,
-    logs: context.logs,
-    fetch: context.fetch
-  }
-
-  const claims = scheme === 'bearer'
-    ? await decode(credentials, ctx)
-    : await exchange(credentials, ctx)
+  const claims = await resolve(scheme, credentials, context)
 
   if (claims instanceof Error)
     return claims
@@ -25,17 +17,22 @@ export async function effect ({ scheme, authority, credentials }: Input, context
 
   context.logs.debug('Token claims', claims)
 
-  const identity = context.configuration.assert !== false
-    ? await context.local.ensure({ entity: { authority, iss, sub } })
-    : await context.local.observe({ query: { criteria: `authority==${authority};iss==${iss};sub==${sub}` } })
+  const query = { criteria: `authority==${authority};iss==${iss};sub==${sub}` }
+
+  const credential = context.configuration.assert !== false
+    ? await context.local.ensure({
+      query,
+      entity: { authority, iss, sub, identity: newid() }
+    })
+    : await context.local.observe({ query })
 
-  if (identity === null)
+  if (credential === null)
     return ERR_NOT_FOUND
 
-  if (identity instanceof Error)
-    return identity
+  if (credential instanceof Error)
+    return credential
 
-  return { identity: { id: identity.identity ?? identity.id, claims } }
+  return { identity: { id: credential.identity, claims } }
 }
 
 const ERR_NOT_FOUND = new Err('NOT_FOUND')

package/components/identity.federation/source/create.ts

@@ -0,0 +1,39 @@
+import { Err } from 'error-value'
+import { resolve } from './lib'
+import type { Context, Entity, Scheme } from './types'
+
+export async function effect (input: Input, context: Context): Promise<Entity | Error> {
+  const claims = await resolve(input.scheme, input.credentials, context)
+
+  if (claims instanceof Error)
+    return claims
+
+  const { iss, sub } = claims
+
+  const existent = await context.local.observe({
+    query: { criteria: `authority==${input.authority};iss==${iss};sub==${sub}`, deleted: true }
+  })
+
+  const record = { authority: input.authority, iss, sub, identity: input.id }
+
+  if (existent === null)
+    return await context.local.transit({ input: record })
+
+  if (existent._deleted === undefined || existent._deleted === null)
+    return existent.identity === input.id ? existent : ERR_EXISTS
+
+  // a deleted record still occupies the unique index, so the transition revives it
+  return await context.local.transit({
+    input: record,
+    query: { id: existent.id, deleted: true }
+  })
+}
+
+export interface Input {
+  authority: string
+  scheme: Scheme
+  credentials: string
+  id: string
+}
+
+const ERR_EXISTS = new Err('EXISTS', 'Federation credentials are associated with another Identity')

package/components/identity.federation/source/delete.ts

@@ -3,7 +3,7 @@ import type { Context } from './types'
 export async function effect ({ authority, identity, credential }: Input, context: Context): Promise<void | null> {
   const object = await context.local.observe({ query: { id: credential } })
 
-  if (object === null || object.authority !== authority || (object.identity ?? object.id) !== identity)
+  if (object === null || object.authority !== authority || object.identity !== identity)
     return null
 
   return await context.local.terminate({ query: { id: credential } })

package/components/identity.federation/source/incept.ts

@@ -1,51 +1,19 @@
-import { Err } from 'error-value'
-import { decode, exchange, type Ctx } from './lib'
-import type { Request } from '@toa.io/types'
-import type { Context, TransitInput, Scheme } from './types'
+import { effect as create } from './create'
+import type { Context, Scheme } from './types'
 
 export async function effect (input: Input, context: Context): Promise<Output | Error> {
-  const ctx: Ctx = {
-    trust: context.configuration.trust,
-    logs: context.logs,
-    fetch: context.fetch
-  }
+  const credential = await create(input, context)
 
-  const claims = input.scheme === 'bearer'
-    ? await decode(input.credentials, ctx)
-    : await exchange(input.credentials, ctx)
-
-  if (claims instanceof Error)
-    return claims
-
-  const { iss, sub } = claims
-
-  if (input.id === undefined) {
-    const request: Request<TransitInput> = { input: { authority: input.authority, iss, sub } }
-
-    return await context.local.transit(request)
-  }
-
-  const existent = await context.local.observe({
-    query: { criteria: `authority==${input.authority};iss==${iss};sub==${sub}` }
-  })
-
-  if (existent !== null)
-    return (existent.identity ?? existent.id) === input.id ? { id: input.id } : ERR_EXISTS
-
-  return await context.local.transit({
-    input: { authority: input.authority, iss, sub, identity: input.id }
-  })
+  return credential instanceof Error ? credential : { id: credential.identity }
 }
 
 export interface Input {
   authority: string
   scheme: Scheme
   credentials: string
-  id?: string
+  id: string
 }
 
 export interface Output {
   id: string
 }
-
-const ERR_EXISTS = new Err('EXISTS', 'Federation credentials are associated with another Identity')

package/components/identity.federation/source/lib/exchange.ts

@@ -95,7 +95,7 @@ async function sign (trust: Trust): Promise<string> {
   const signature = trust.signature!
   const aud = Array.isArray(trust.aud) ? trust.aud[0] : trust.aud!
   const now = Math.floor(Date.now() / 1000)
-  const key = await jose.importPKCS8(atob(signature.key), 'ES256')
+  const key = await jose.importPKCS8(signature.key, 'ES256')
 
   return await new jose.SignJWT({})
     .setProtectedHeader({ alg: 'ES256', kid: signature.kid })

package/components/identity.federation/source/lib/index.ts

@@ -1,3 +1,4 @@
 export { decode } from './decode'
 export { exchange } from './exchange'
+export { resolve } from './resolve'
 export { type Ctx } from './Ctx'

package/components/identity.federation/source/lib/resolve.ts

@@ -0,0 +1,17 @@
+import { decode } from './decode'
+import { exchange } from './exchange'
+import type { Ctx } from './Ctx'
+import type { Payload } from './Payload'
+import type { Context, Scheme } from '../types'
+
+export async function resolve (scheme: Scheme, credentials: string, context: Context): Promise<Payload | Error> {
+  const ctx: Ctx = {
+    trust: context.configuration.trust,
+    logs: context.logs,
+    fetch: context.fetch
+  }
+
+  return scheme === 'bearer'
+    ? await decode(credentials, ctx)
+    : await exchange(credentials, ctx)
+}

package/components/identity.federation/source/list.test.ts

@@ -1,18 +1,16 @@
 import { computation } from './list'
 
-it('lists indexed credentials and a legacy associated credential', async () => {
+it('lists indexed credentials', async () => {
   const current = { id: 'credential', authority: 'nex', identity: 'identity', iss: 'apple', sub: '1', _created: 2 }
-  const legacy = { id: 'identity', authority: 'nex', iss: 'google', sub: '2', _created: 1 }
 
   const context = {
     local: {
-      enumerate: jest.fn(async () => [current]),
-      observe: jest.fn(async () => legacy)
+      enumerate: jest.fn(async () => [current])
     }
   }
 
   await expect(computation({ authority: 'nex', identity: 'identity' }, context as never))
-    .resolves.toEqual([current, legacy])
+    .resolves.toEqual([current])
   expect(context.local.enumerate).toHaveBeenCalledWith({
     query: {
       criteria: 'authority==nex;identity==identity',

package/components/identity.federation/source/list.ts

@@ -1,7 +1,7 @@
 import type { Context, Entity } from './types'
 
 export async function computation ({ authority, identity }: Input, context: Context): Promise<Entity[]> {
-  const objects = await context.local.enumerate({
+  return await context.local.enumerate({
     query: {
       criteria: `authority==${authority};identity==${identity}`,
       projection: ['iss'],
@@ -9,13 +9,6 @@ export async function computation ({ authority, identity }: Input, context: Cont
       limit: 100
     }
   })
-
-  const legacy = await context.local.observe({ query: { id: identity } })
-
-  if (legacy !== null && legacy.authority === authority && legacy.identity === undefined)
-    objects.push(legacy)
-
-  return objects.sort((a, b) => b._created - a._created)
 }
 
 interface Input {

package/components/identity.federation/source/types/context.ts

@@ -9,7 +9,7 @@ export interface Context {
     observe: Observation<Entity>
     enumerate: Observation<Entity[], never, Entity>
     terminate: Transition<void, void, Entity>
-    transit: Call<TransitOutput, TransitInput>
+    transit: Call<Entity, TransitInput>
     ensure: Call<Entity>
     decode: Call<JWTPayload, string>
   }
@@ -30,11 +30,7 @@ export interface TransitInput {
   readonly authority: string
   readonly iss: string
   readonly sub: string
-  readonly identity?: string
-}
-
-export interface TransitOutput {
-  id: string
+  readonly identity: string
 }
 
 interface IdentityTokensRevokeInput {

package/components/identity.federation/source/types/entity.ts

@@ -3,6 +3,7 @@ export interface Entity {
   authority: string
   iss: string
   sub: string
-  identity?: string
+  identity: string
   _created: number
+  _deleted?: number | null
 }

package/components/identity.roles/receivers/identity.federation.principal.js

@@ -0,0 +1,6 @@
+'use strict'
+
+/**
+ * @param {{ identity: string }} payload
+ */
+exports.request = (payload) => ({ input: { id: payload.identity } })

package/documentation/credentials.md

@@ -57,12 +57,15 @@ constraints, and principal configuration.
 
 ## Federated credentials
 
-- `POST /identity/federation/:identity/` associates credentials from a trusted issuer.
+- `POST /identity/federation/:identity/` associates credentials from a trusted issuer and returns
+  the associated credential as it is listed.
 - `GET /identity/federation/:identity/` lists federated credentials.
 - `DELETE /identity/federation/:identity/:credential/` removes one federated credential.
 
+If the credentials are already associated with the Identity, the existing credential is returned.
+
 An Identity can have credentials from multiple issuers and can have multiple subjects from the
-same issuer. The `:credential` segment is the `id` returned by either listing resource. Federation
+same issuer. The `:credential` segment is the `id` returned by any of these resources. Federation
 resources are provider-independent; issuer-specific authorization flows remain the responsibility
 of the application.
 

package/documentation/identity.md

@@ -131,7 +131,7 @@ configuration:
         signature:
           iss: team-id
           kid: key-id
-          key: $APPLE_PRIVATE_KEY
+          key: $APPLE_PRIVATE_KEY # PKCS8 PEM, as in the .p8 file
 ```
 
 ### OTP scheme

package/features/identity.basic.feature

@@ -474,3 +474,57 @@ Feature: Basic authentication
 
       code: EXISTS
       """
+
+  Scenario: Adding basic credentials after they have been deleted
+    Given transient identity
+    When the following request is received:
+      """
+      POST /identity/basic/${{ identity.id }}/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ identity.token }}
+      content-type: application/yaml
+
+      username: developer
+      password: secret#1234
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      """
+    When the following request is received:
+      """
+      DELETE /identity/basic/${{ identity.id }}/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ identity.token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+    When the following request is received:
+      """
+      POST /identity/basic/${{ identity.id }}/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ identity.token }}
+      content-type: application/yaml
+
+      username: painter
+      password: secret#4321
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      """
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic cGFpbnRlcjpzZWNyZXQjNDMyMQ==
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      id: ${{ identity.id }}
+      """

package/features/identity.federation.feature

@@ -54,6 +54,21 @@ Feature: Identity Federation
 
       id: ${{ User.id }}
       """
+    # credential id is detached from the Identity
+    When the following request is received:
+      """
+      GET /identity/federation/${{ User.id }}/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Bearer ${{ User.id_token }}
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      - id: ${{ User.credential }}
+        iss: http://localhost:44444
+      """
 
   Scenario: Creating an Identity using inception
     Given the `identity.federation` configuration:
@@ -88,8 +103,10 @@ Feature: Identity Federation
       """
       201 Created
       authorization: Token ${{ Bill.token }}
+
+      id: ${{ Bill.id }}
       """
-    # check that both tokens authenticate the created federation identity
+    # check that both tokens authenticate the created user's Identity
     When the following request is received:
       """
       GET /identity/ HTTP/1.1
@@ -100,6 +117,8 @@ Feature: Identity Federation
     Then the following reply is sent:
       """
       200 OK
+
+      id: ${{ Bill.id }}
       roles: []
       """
     When the following request is received:
@@ -113,8 +132,24 @@ Feature: Identity Federation
       """
       200 OK
 
+      id: ${{ Bill.id }}
       roles: []
       """
+    # credential id is detached from the Identity
+    When the following request is received:
+      """
+      GET /identity/federation/${{ Bill.id }}/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Bearer ${{ Bill.id_token }}
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      - id: ${{ Bill.credential }}
+        iss: http://localhost:44444
+      """
     And the following request is received:
       # same credentials
       """
@@ -214,6 +249,64 @@ Feature: Identity Federation
       content-type: application/yaml
       accept: application/yaml
 
+      scheme: bearer
+      credentials: ${{ Bob.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+
+      id: ${{ Bob.credential }}
+      iss: http://localhost:44444
+      """
+    # the created credential is listed as is
+    When the following request is received:
+      """
+      GET /identity/federation/${{ Bob.id }}/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic #{{ basic Bob }}
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      - id: ${{ Bob.credential }}
+        iss: http://localhost:44444
+      """
+    And the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Bearer ${{ Bob.id_token }}
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      id: ${{ Bob.id }}
+      """
+    # delete the federation credential
+    When the following request is received:
+      """
+      DELETE /identity/federation/${{ Bob.id }}/${{ Bob.credential }}/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic #{{ basic Bob }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+    # add the same federation again
+    When the following request is received:
+      """
+      POST /identity/federation/${{ Bob.id }}/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic #{{ basic Bob }}
+      content-type: application/yaml
+      accept: application/yaml
+
       scheme: bearer
       credentials: ${{ Bob.id_token }}
       """
@@ -268,7 +361,12 @@ Feature: Identity Federation
           signature:
             iss: io.toa.nex.id
             kid: key-id
-            key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JR0hBZ0VBTUJNR0J5cUdTTTQ5QWdFR0NDcUdTTTQ5QXdFSEJHMHdhd0lCQVFRZzl4OURhdHdIMEdaSFNDbzkKVE1IVFZYeWVZMFlROHFiNzNqSFYydjRNc3llaFJBTkNBQVF3YVlsbmEyaFNWM0cvUklsTkxWNDFsZzhQbTRLZgpIZkN1S0tpdzNCSUpUblNBckFNSkxTeTF2WXdTSU1IejcyMG1rbVdUcld1UWtranZrRHBaeGZSdgotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0t
+            key: |
+              -----BEGIN PRIVATE KEY-----
+              MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg9x9DatwH0GZHSCo9
+              TMHTVXyeY0YQ8qb73jHV2v4MsyehRANCAAQwaYlna2hSV3G/RIlNLV41lg8Pm4Kf
+              HfCuKKiw3BIJTnSArAMJLSy1vYwSIMHz720mkmWTrWuQkkjvkDpZxfRv
+              -----END PRIVATE KEY-----
       """
     And auth code for Bob is issued for https://web.toa.io/callback/
     When the following request is received:

package/features/map.feature

@@ -269,6 +269,7 @@ Feature: HTTP context mapping
       """yaml
       trust:
         - iss: http://localhost:44444
+      assert: false
       """
     And the `pots` is running with the following manifest:
       """yaml
@@ -299,8 +300,8 @@ Feature: HTTP context mapping
       201 Created
 
       id: ${{ id }}
-      title: ${{ random.email }}
       volume: 1.5
+      title: ${{ random.email }}
       """
 
   Scenario: Mapping non-exposed properties

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@toa.io/extensions.exposition",
-  "version": "1.0.0-alpha.256",
+  "version": "1.0.0-alpha.258",
   "description": "Toa Exposition",
   "author": "temich <tema.gurtovoy@gmail.com>",
   "homepage": "https://github.com/toa-io/toa#readme",
@@ -18,7 +18,7 @@
   },
   "dependencies": {
     "@simplewebauthn/server": "13.3.2",
-    "@toa.io/core": "1.0.0-alpha.254",
+    "@toa.io/core": "1.0.0-alpha.257",
     "@toa.io/generic": "1.0.0-alpha.254",
     "@toa.io/schemas": "1.0.0-alpha.254",
     "bcryptjs": "3.0.3",
@@ -62,5 +62,5 @@
     },
     "testEnvironment": "node"
   },
-  "gitHead": "a8990df97f971060686bd70a965f78e98070a983"
+  "gitHead": "35a7cb8922be6921239562ebb3ab833893b5bd6e"
 }