@toa.io/extensions.exposition 1.0.0-alpha.27 → 1.0.0-alpha.270

package/components/identity.federation/operations/types/index.js

@@ -0,0 +1,21 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./configuration"), exports);
+__exportStar(require("./context"), exports);
+__exportStar(require("./entity"), exports);
+__exportStar(require("./Scheme"), exports);
+//# sourceMappingURL=index.js.map

package/components/identity.federation/operations/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../source/types/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kDAA+B;AAC/B,4CAAyB;AACzB,2CAAwB;AACxB,2CAAwB"}

package/components/identity.federation/source/authenticate.ts

@@ -1,31 +1,51 @@
-import { type Maybe } from '@toa.io/types'
 import { Err } from 'error-value'
-import { assertionsAsValues } from './lib/assertions-as-values.js'
-import {
-  validateIdToken
-} from './lib/jwt'
-import type { AuthenticateInput, AuthenticateOutput, Context } from './types'
-import type { Request } from '@toa.io/core'
+import { newid } from '@toa.io/generic'
+import { resolve } from './lib'
+import type { JWTPayload } from 'jose'
+import type { Maybe } from '@toa.io/types'
+import type { Context, Scheme } from './types'
 
-async function authenticate ({ authority, credentials }: AuthenticateInput,
-  context: Context): Promise<Maybe<AuthenticateOutput>> {
-  const { iss, sub } = await validateIdToken(credentials, context.configuration.trust)
+export async function effect ({ scheme, authority, credentials }: Input, context: Context): Promise<Maybe<Output>> {
+  context.logs.debug('Authenticating', { scheme, authority, credentials })
 
-  const request: Request = { query: { criteria: `authority==${authority};iss==${iss};sub==${sub}` } }
+  const claims = await resolve(scheme, credentials, context)
 
-  let id = (await context.local.observe(request))?.id
+  if (claims instanceof Error)
+    return claims
 
-  if (id === undefined) {
-    if (context.configuration.explicit_identity_creation === true)
-      return NOT_FOUND
+  const { iss, sub } = claims
 
-    id = (await context.local.transit({ input: { authority, iss, sub } })).id
-  }
+  context.logs.debug('Token claims', claims)
+
+  const query = { criteria: `authority==${authority};iss==${iss};sub==${sub}` }
+
+  const credential = context.configuration.assert !== false
+    ? await context.local.ensure({
+      query,
+      entity: { authority, iss, sub, identity: newid() }
+    })
+    : await context.local.observe({ query })
+
+  if (credential === null)
+    return ERR_NOT_FOUND
+
+  if (credential instanceof Error)
+    return credential
 
-  return { identity: { id } }
+  return { identity: { id: credential.identity, claims } }
 }
 
-// Exporting as a function returning assertion errors as values
-export const computation = assertionsAsValues(authenticate)
+const ERR_NOT_FOUND = new Err('NOT_FOUND')
 
-const NOT_FOUND = Err('NOT_FOUND')
+interface Input {
+  scheme: Scheme
+  authority: string
+  credentials: string
+}
+
+interface Output {
+  identity: {
+    id: string
+    claims: JWTPayload
+  }
+}

package/components/identity.federation/source/create.ts

@@ -0,0 +1,39 @@
+import { Err } from 'error-value'
+import { resolve } from './lib'
+import type { Context, Entity, Scheme } from './types'
+
+export async function effect (input: Input, context: Context): Promise<Entity | Error> {
+  const claims = await resolve(input.scheme, input.credentials, context)
+
+  if (claims instanceof Error)
+    return claims
+
+  const { iss, sub } = claims
+
+  const existent = await context.local.observe({
+    query: { criteria: `authority==${input.authority};iss==${iss};sub==${sub}`, deleted: true }
+  })
+
+  const record = { authority: input.authority, iss, sub, identity: input.id }
+
+  if (existent === null)
+    return await context.local.transit({ input: record })
+
+  if (existent._deleted === undefined || existent._deleted === null)
+    return existent.identity === input.id ? existent : ERR_EXISTS
+
+  // a deleted record still occupies the unique index, so the transition revives it
+  return await context.local.transit({
+    input: record,
+    query: { id: existent.id, deleted: true }
+  })
+}
+
+export interface Input {
+  authority: string
+  scheme: Scheme
+  credentials: string
+  id: string
+}
+
+const ERR_EXISTS = new Err('EXISTS', 'Federation credentials are associated with another Identity')

package/components/identity.federation/source/decode.ts

@@ -0,0 +1,11 @@
+import { decode } from './lib'
+import type { JWTPayload } from 'jose'
+import type { Context } from './types'
+
+export async function effect (token: string, context: Context): Promise<JWTPayload | Error> {
+  return await decode(token, {
+    trust: context.configuration.trust,
+    logs: context.logs,
+    fetch: context.fetch
+  })
+}

package/components/identity.federation/source/delete.ts

@@ -0,0 +1,16 @@
+import type { Context } from './types'
+
+export async function effect ({ authority, identity, credential }: Input, context: Context): Promise<void | null> {
+  const object = await context.local.observe({ query: { id: credential } })
+
+  if (object === null || object.authority !== authority || object.identity !== identity)
+    return null
+
+  return await context.local.terminate({ query: { id: credential } })
+}
+
+interface Input {
+  authority: string
+  identity: string
+  credential: string
+}

package/components/identity.federation/source/incept.ts

@@ -1,27 +1,19 @@
-import { assertionsAsValues } from './lib/assertions-as-values.js'
-import { validateIdToken } from './lib/jwt'
-import type { Request } from '@toa.io/core'
-import type { Context, Entity } from './types'
+import { effect as create } from './create'
+import type { Context, Scheme } from './types'
 
-async function incept (input: Input, context: Context): Promise<Output> {
-  const { iss, sub } = await validateIdToken(input.credentials, context.configuration.trust)
+export async function effect (input: Input, context: Context): Promise<Output | Error> {
+  const credential = await create(input, context)
 
-  const request: Request = { input: { authority: input.authority, iss, sub } satisfies Omit<Entity, 'id'> }
-
-  if (input.id !== undefined)
-    request.query = { id: input.id }
-
-  return await context.local.transit(request)
+  return credential instanceof Error ? credential : { id: credential.identity }
 }
 
-interface Input {
+export interface Input {
   authority: string
+  scheme: Scheme
   credentials: string
-  id?: string
+  id: string
 }
 
-interface Output {
+export interface Output {
   id: string
 }
-
-export const effect = assertionsAsValues(incept)

package/components/identity.federation/source/lib/Configuration.ts

@@ -0,0 +1,39 @@
+export interface Configuration extends Record<string, unknown> {
+  issuer: string
+  authorization_endpoint: string
+  token_endpoint: string
+  userinfo_endpoint: string
+  jwks_uri: string
+  registration_endpoint?: string
+  scopes_supported?: string[]
+  response_types_supported: string[]
+  response_modes_supported?: string[]
+  grant_types_supported?: string[]
+  acr_values_supported?: string[]
+  subject_types_supported: string[]
+  id_token_signing_alg_values_supported: string[]
+  id_token_encryption_alg_values_supported?: string[]
+  id_token_encryption_enc_values_supported?: string[]
+  userinfo_signing_alg_values_supported?: string[]
+  userinfo_encryption_alg_values_supported?: string[]
+  userinfo_encryption_enc_values_supported?: string[]
+  request_object_signing_alg_values_supported?: string[]
+  request_object_encryption_alg_values_supported?: string[]
+  request_object_encryption_enc_values_supported?: string[]
+  token_endpoint_auth_methods_supported?: string[]
+  token_endpoint_auth_signing_alg_values_supported?: string[]
+  display_values_supported?: string[]
+  claim_types_supported?: string[]
+  claims_supported?: string[]
+  service_documentation?: string
+  claims_locales_supported?: string[]
+  ui_locales_supported?: string[]
+  claims_parameter_supported?: boolean
+  request_parameter_supported?: boolean
+  request_uri_parameter_supported?: boolean
+  require_request_uri_registration?: boolean
+  op_policy_uri?: string
+  op_tos_uri?: string
+  check_session_iframe?: string
+  end_session_endpoint?: string
+}

package/components/identity.federation/source/lib/Ctx.ts

@@ -0,0 +1,9 @@
+import type { telemetry } from '@toa.io/types'
+import type { Trust } from '../types'
+import type { Fetch } from '../types/context'
+
+export interface Ctx {
+  trust: Trust[]
+  logs: telemetry.Logs
+  fetch: Fetch
+}

package/components/identity.federation/source/lib/Payload.ts

@@ -0,0 +1,6 @@
+import type * as jose from 'jose'
+
+export interface Payload extends jose.JWTPayload {
+  iss: string
+  sub: string
+}

package/components/identity.federation/source/lib/decode.ts

@@ -0,0 +1,27 @@
+import { load } from './jose'
+import { createRemoteJWKSet } from './discovery'
+import { ERR_TRUST, ERR_ISS, ERR_SUB } from './errors'
+import type { Ctx } from './Ctx'
+import type { Payload } from './Payload'
+
+export async function decode (token: string, ctx: Ctx): Promise<Payload | Error> {
+  const jose = await load()
+  const { iss, sub } = jose.decodeJwt(token)
+
+  if (typeof iss !== 'string')
+    return ERR_ISS
+
+  if (typeof sub !== 'string')
+    return ERR_SUB
+
+  const trusted = ctx.trust.find((trust) => trust.iss === iss)
+
+  if (trusted === undefined)
+    return ERR_TRUST
+
+  const jwks = await createRemoteJWKSet(iss, ctx.fetch)
+
+  const { payload } = await jose.jwtVerify(token, jwks, { audience: trusted.aud })
+
+  return payload as Payload
+}

package/components/identity.federation/source/lib/discovery.test.ts

@@ -0,0 +1,45 @@
+import { createRemoteJWKSet, discover } from './discovery'
+import { load } from './jose'
+import type { Fetch } from '../types/context'
+
+it('discovers an issuer using the component fetch', async () => {
+  const iss = `https://${Math.random().toString(36).slice(2)}.example.com`
+  const configuration = { issuer: iss, jwks_uri: `${iss}/jwks` }
+
+  const fetch = jest.fn(async (_input: string | URL | Request) =>
+    Response.json(configuration)) as jest.MockedFunction<Fetch>
+
+  await expect(discover(iss, fetch)).resolves.toMatchObject(configuration)
+  expect(fetch).toHaveBeenCalledWith(`${iss}/.well-known/openid-configuration`)
+})
+
+it('loads and caches remote keys using the component fetch', async () => {
+  const jose = await load()
+  const iss = `https://${Math.random().toString(36).slice(2)}.example.com`
+  const jwksUri = `${iss}/jwks`
+  const { privateKey, publicKey } = await jose.generateKeyPair('ES256')
+  const jwk = await jose.exportJWK(publicKey)
+
+  const fetch = jest.fn(async (input: string | URL | Request) => {
+    const url = input instanceof Request ? input.url : input.toString()
+
+    if (url.endsWith('/.well-known/openid-configuration'))
+      return Response.json({ issuer: iss, jwks_uri: jwksUri })
+
+    return Response.json({ keys: [{ ...jwk, alg: 'ES256', kid: 'key0', use: 'sig' }] })
+  }) as jest.MockedFunction<Fetch>
+
+  const token = await new jose.SignJWT({ sub: 'subject' })
+    .setProtectedHeader({ alg: 'ES256', kid: 'key0' })
+    .setIssuer(iss)
+    .sign(privateKey)
+
+  const first = await createRemoteJWKSet(iss, fetch)
+  const second = await createRemoteJWKSet(iss, fetch)
+
+  expect(second).toBe(first)
+  await expect(jose.jwtVerify(token, first, { issuer: iss })).resolves.toMatchObject({
+    payload: { sub: 'subject' }
+  })
+  expect(fetch).toHaveBeenCalledTimes(2)
+})

package/components/identity.federation/source/lib/discovery.ts

@@ -0,0 +1,49 @@
+import { load } from './jose'
+import type * as jose from 'jose'
+import type { Configuration } from './Configuration'
+import type { Fetch } from '../types/context'
+
+const cache = new Map<string, Configuration>()
+const resolvers = new WeakMap<Fetch, Map<string, Promise<jose.RemoteJWKSet>>>()
+
+export async function discover (iss: string, fetch: Fetch): Promise<Configuration> {
+  if (!cache.has(iss)) {
+    const configuration = await fetchConfiguration(iss, fetch)
+
+    cache.set(iss, configuration)
+  }
+
+  return cache.get(iss)!
+}
+
+async function fetchConfiguration (iss: string, fetch: Fetch): Promise<Configuration> {
+  const response = await fetch(`${iss}/.well-known/openid-configuration`)
+
+  if (!response.ok)
+    throw new Error('Failed to fetch OIDC configuration')
+
+  return await response.json() as Configuration
+}
+
+export async function createRemoteJWKSet (iss: string, fetch: Fetch): Promise<jose.RemoteJWKSet> {
+  let entries = resolvers.get(fetch)
+
+  if (entries === undefined) {
+    entries = new Map()
+    resolvers.set(fetch, entries)
+  }
+
+  if (!entries.has(iss))
+    entries.set(iss, create(iss, fetch))
+
+  return await entries.get(iss)!
+}
+
+async function create (iss: string, fetch: Fetch): Promise<jose.RemoteJWKSet> {
+  const jose = await load()
+  const configuration = await discover(iss, fetch)
+
+  return jose.createRemoteJWKSet(new URL(configuration.jwks_uri), {
+    [jose.customFetch]: fetch
+  })
+}

package/components/identity.federation/source/lib/errors.ts

@@ -0,0 +1,12 @@
+import { Err } from 'error-value'
+
+export const ERR_TRUST = new Err('TRUST', 'Issuer not trusted')
+export const ERR_RESPONSE = new Err('RESPONSE', 'Request to IDP failed')
+export const ERR_CONFIG = new Err('CONFIG', 'Invalid OpenID configuration')
+export const ERR_NO_TOKEN = new Err('NO_TOKEN', 'No ID token received')
+export const ERR_ISS = new Err('ISS', 'Invalid issuer claim')
+export const ERR_SUB = new Err('SUB', 'Invalid subject claim')
+export const ERR_EXP = new Err('EXP', 'Token does not have an expiration time')
+export const ERR_REPLAY = new Err('REPLAY', 'Token has already been used')
+export const ERR_CODE_NOT_ENABLED = new Err('CODE_NOT_ENABLED', 'Authorization code flow is not configured')
+export const ERR_CODE_SCHEMA = new Err('CODE_SCHEMA', 'Invalid code credentials')

package/components/identity.federation/source/lib/exchange.ts

@@ -0,0 +1,116 @@
+import { load } from './jose'
+import { createRemoteJWKSet, discover } from './discovery'
+import * as errors from './errors'
+import type { Trust } from '../types'
+import type { Ctx } from './Ctx'
+import type { Payload } from './Payload'
+
+export async function exchange (credentials: string, ctx: Ctx): Promise<Payload | Error> {
+  const jose = await load()
+  const properties = decode(credentials)
+
+  if (properties instanceof Error)
+    return properties
+
+  const { code, iss, for: redirect } = properties
+
+  const trusted = ctx.trust.find((trust) => trust.iss === iss)
+
+  if (trusted === undefined)
+    return errors.ERR_TRUST
+
+  if (trusted.aud === undefined || (trusted.secret === undefined && trusted.signature === undefined))
+    return errors.ERR_CODE_NOT_ENABLED
+
+  const configuration = await discover(iss, ctx.fetch)
+
+  if (configuration.token_endpoint === undefined)
+    return errors.ERR_CONFIG
+
+  // array actually is not expected here, but it is a valid format
+  const aud = Array.isArray(trusted.aud) ? trusted.aud[0] : trusted.aud
+  const secret = trusted.secret ?? await sign(trusted)
+  const params = new URLSearchParams()
+
+  params.append('grant_type', 'authorization_code')
+  params.append('code', code)
+  params.append('client_id', aud)
+  params.append('client_secret', secret)
+  params.append('redirect_uri', redirect)
+
+  ctx.logs.debug('Exchanging code', {
+    iss,
+    aud,
+    for: redirect,
+    auth: trusted.secret === undefined ? 'signature' : 'secret',
+    code
+  })
+
+  const response = await ctx.fetch(configuration.token_endpoint, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/x-www-form-urlencoded'
+    },
+    body: params
+  })
+
+  if (!response.ok) {
+    ctx.logs.error('Code exchange failed', { status: response.status, text: await response.text() })
+
+    return errors.ERR_RESPONSE
+  }
+
+  const tokens = await response.json() as { id_token: string }
+
+  if (tokens.id_token === undefined)
+    return errors.ERR_NO_TOKEN
+
+  const jwks = await createRemoteJWKSet(iss, ctx.fetch)
+
+  const { payload } = await jose.jwtVerify(tokens.id_token, jwks, {
+    audience: trusted.aud,
+    issuer: iss
+  })
+
+  return payload as Payload
+}
+
+function decode (credentials: string): Properties | Error {
+  const json = Buffer.from(credentials, 'base64').toString('utf8')
+  const properties = JSON.parse(json) as Properties
+
+  if (
+    typeof properties.code !== 'string' ||
+    typeof properties.iss !== 'string' ||
+    typeof properties.for !== 'string' ||
+    Object.keys(properties).length !== CREDENTIAL_PROPERTIES.length
+  )
+    return errors.ERR_CODE_SCHEMA
+
+  return properties
+}
+
+async function sign (trust: Trust): Promise<string> {
+  const jose = await load()
+  const signature = trust.signature!
+  const aud = Array.isArray(trust.aud) ? trust.aud[0] : trust.aud!
+  const now = Math.floor(Date.now() / 1000)
+  const key = await jose.importPKCS8(signature.key, 'ES256')
+
+  return await new jose.SignJWT({})
+    .setProtectedHeader({ alg: 'ES256', kid: signature.kid })
+    .setIssuedAt(now)
+    .setExpirationTime(now + 300)
+    .setIssuer(signature.iss)
+    .setSubject(aud)
+    .setAudience(trust.iss)
+    .sign(key)
+}
+
+const CREDENTIAL_PROPERTIES: Array<keyof Properties> = ['for', 'iss', 'code']
+
+interface Properties {
+  code: string
+  iss: string
+  for: string
+}

package/components/identity.federation/source/lib/index.ts

@@ -0,0 +1,4 @@
+export { decode } from './decode'
+export { exchange } from './exchange'
+export { resolve } from './resolve'
+export { type Ctx } from './Ctx'

package/components/identity.federation/source/lib/jose.d.ts

@@ -0,0 +1 @@
+export function load (): Promise<typeof import('jose')>

package/components/identity.federation/source/lib/jose.js

@@ -0,0 +1,5 @@
+'use strict'
+
+const load = async () => await import('jose')
+
+exports.load = load

package/components/identity.federation/source/lib/resolve.ts

@@ -0,0 +1,17 @@
+import { decode } from './decode'
+import { exchange } from './exchange'
+import type { Ctx } from './Ctx'
+import type { Payload } from './Payload'
+import type { Context, Scheme } from '../types'
+
+export async function resolve (scheme: Scheme, credentials: string, context: Context): Promise<Payload | Error> {
+  const ctx: Ctx = {
+    trust: context.configuration.trust,
+    logs: context.logs,
+    fetch: context.fetch
+  }
+
+  return scheme === 'bearer'
+    ? await decode(credentials, ctx)
+    : await exchange(credentials, ctx)
+}

package/components/identity.federation/source/list.test.ts

@@ -0,0 +1,22 @@
+import { computation } from './list'
+
+it('lists indexed credentials', async () => {
+  const current = { id: 'credential', authority: 'nex', identity: 'identity', iss: 'apple', sub: '1', _created: 2 }
+
+  const context = {
+    local: {
+      enumerate: jest.fn(async () => [current])
+    }
+  }
+
+  await expect(computation({ authority: 'nex', identity: 'identity' }, context as never))
+    .resolves.toEqual([current])
+  expect(context.local.enumerate).toHaveBeenCalledWith({
+    query: {
+      criteria: 'authority==nex;identity==identity',
+      projection: ['iss'],
+      sort: ['_created:desc'],
+      limit: 100
+    }
+  })
+})

package/components/identity.federation/source/list.ts

@@ -0,0 +1,17 @@
+import type { Context, Entity } from './types'
+
+export async function computation ({ authority, identity }: Input, context: Context): Promise<Entity[]> {
+  return await context.local.enumerate({
+    query: {
+      criteria: `authority==${authority};identity==${identity}`,
+      projection: ['iss'],
+      sort: ['_created:desc'],
+      limit: 100
+    }
+  })
+}
+
+interface Input {
+  authority: string
+  identity: string
+}

package/components/identity.federation/source/types/Scheme.ts

@@ -0,0 +1 @@
+export type Scheme = 'bearer' | 'code'

package/components/identity.federation/source/types/configuration.ts

@@ -0,0 +1,21 @@
+export interface Configuration {
+  trust: Trust[]
+  principal?: Principal
+  assert?: boolean
+}
+
+export interface Trust {
+  iss: string
+  aud?: string | [string, ...string[]]
+  secret?: string
+  signature?: {
+    iss: string
+    kid: string
+    key: string
+  }
+}
+
+interface Principal {
+  iss: string
+  sub: string
+}

package/components/identity.federation/source/types/context.ts

@@ -0,0 +1,38 @@
+import type { JWTPayload } from 'jose'
+import type { Call, Observation, Query, telemetry, Transition } from '@toa.io/types'
+import type { Entity } from './entity'
+import type { Configuration } from './configuration'
+
+export interface Context {
+  fetch: Fetch
+  local: {
+    observe: Observation<Entity>
+    enumerate: Observation<Entity[], never, Entity>
+    terminate: Transition<void, void, Entity>
+    transit: Call<Entity, TransitInput>
+    ensure: Call<Entity>
+    decode: Call<JWTPayload, string>
+  }
+  remote: {
+    identity: {
+      tokens: {
+        revoke: Call<void, IdentityTokensRevokeInput>
+      }
+    }
+  }
+  logs: telemetry.Logs
+  configuration: Configuration
+}
+
+export type Fetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>
+
+export interface TransitInput {
+  readonly authority: string
+  readonly iss: string
+  readonly sub: string
+  readonly identity: string
+}
+
+interface IdentityTokensRevokeInput {
+  query: Query
+}

package/components/identity.federation/source/types/entity.ts

@@ -0,0 +1,9 @@
+export interface Entity {
+  id: string
+  authority: string
+  iss: string
+  sub: string
+  identity: string
+  _created: number
+  _deleted?: number | null
+}