@toa.io/extensions.exposition 1.0.0-alpha.27 → 1.0.0-alpha.271

package/components/identity.tokens/operations/authenticate.js

@@ -1,31 +1,32 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Computation = void 0;
+const error_value_1 = require("error-value");
 class Computation {
     refresh = 0;
-    decrypt = undefined;
-    observe = undefined;
+    decrypt;
+    observe;
     mount(context) {
         this.refresh = context.configuration.refresh * 1000;
         this.decrypt = context.local.decrypt;
         this.observe = context.local.observe;
     }
     async execute(input) {
-        const claim = await this.decrypt({ input: input.credentials });
-        if (claim instanceof Error)
-            return claim;
-        if (claim.authority !== input.authority)
+        const claims = await this.decrypt({ input: input.credentials });
+        if (claims instanceof Error)
+            return claims;
+        if (claims.iss !== input.authority)
             return ERR_AUTHORITY;
-        const identity = claim.identity;
-        const iat = new Date(claim.iat).getTime();
-        const transient = claim.exp !== undefined;
+        const identity = claims.identity;
+        const iat = new Date(claims.iat).getTime();
+        const transient = claims.exp !== undefined;
         const stale = transient && (iat + this.refresh < Date.now());
         if (stale) {
             const revocation = await this.observe({ query: { id: identity.id } });
             if (revocation?.revokedAt !== undefined && iat < revocation.revokedAt)
                 return ERR_TOKEN_REVOKED;
         }
-        const refresh = stale || claim.refresh;
+        const refresh = stale || claims.refresh;
         return {
             identity,
             refresh
@@ -33,6 +34,6 @@ class Computation {
     }
 }
 exports.Computation = Computation;
-const ERR_AUTHORITY = new Error('AUTHORITY_MISMATCH');
-const ERR_TOKEN_REVOKED = new Error('TOKEN_REVOKED');
+const ERR_AUTHORITY = new error_value_1.Err('AUTHORITY_MISMATCH');
+const ERR_TOKEN_REVOKED = new error_value_1.Err('TOKEN_REVOKED');
 //# sourceMappingURL=authenticate.js.map

package/components/identity.tokens/operations/authenticate.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../source/authenticate.ts"],"names":[],"mappings":";;;AAGA,MAAa,WAAW;IACd,OAAO,GAAW,CAAC,CAAA;IACnB,OAAO,GAAgC,SAAmD,CAAA;IAC1F,OAAO,GAAgC,SAAmD,CAAA;IAE3F,KAAK,CAAE,OAAgB;QAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,GAAG,IAAI,CAAA;QACnD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAA;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAA;IACtC,CAAC;IAEM,KAAK,CAAC,OAAO,CAAE,KAAwB;QAC5C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;QAE9D,IAAI,KAAK,YAAY,KAAK;YACxB,OAAO,KAAK,CAAA;QAEd,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;YACrC,OAAO,aAAa,CAAA;QAEtB,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;QAC/B,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAA;QACzC,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,KAAK,SAAS,CAAA;QACzC,MAAM,KAAK,GAAG,SAAS,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QAE5D,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;YAErE,IAAI,UAAU,EAAE,SAAS,KAAK,SAAS,IAAI,GAAG,GAAG,UAAU,CAAC,SAAS;gBACnE,OAAO,iBAAiB,CAAA;QAC5B,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,IAAI,KAAK,CAAC,OAAO,CAAA;QAEtC,OAAO;YACL,QAAQ;YACR,OAAO;SACR,CAAA;IACH,CAAC;CACF;AAvCD,kCAuCC;AAED,MAAM,aAAa,GAAG,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;AACrD,MAAM,iBAAiB,GAAG,IAAI,KAAK,CAAC,eAAe,CAAC,CAAA"}
+{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../source/authenticate.ts"],"names":[],"mappings":";;;AAAA,6CAAiC;AAIjC,MAAa,WAAW;IACd,OAAO,GAAW,CAAC,CAAA;IACnB,OAAO,CAA8B;IACrC,OAAO,CAA8B;IAEtC,KAAK,CAAE,OAAgB;QAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,GAAG,IAAI,CAAA;QACnD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAA;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAA;IACtC,CAAC;IAEM,KAAK,CAAC,OAAO,CAAE,KAAwB;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;QAE/D,IAAI,MAAM,YAAY,KAAK;YACzB,OAAO,MAAM,CAAA;QAEf,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,SAAS;YAChC,OAAO,aAAa,CAAA;QAEtB,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;QAChC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAA;QAC1C,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,KAAK,SAAS,CAAA;QAC1C,MAAM,KAAK,GAAG,SAAS,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QAE5D,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;YAErE,IAAI,UAAU,EAAE,SAAS,KAAK,SAAS,IAAI,GAAG,GAAG,UAAU,CAAC,SAAS;gBACnE,OAAO,iBAAiB,CAAA;QAC5B,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,OAAO,CAAA;QAEvC,OAAO;YACL,QAAQ;YACR,OAAO;SACR,CAAA;IACH,CAAC;CACF;AAvCD,kCAuCC;AAED,MAAM,aAAa,GAAG,IAAI,iBAAG,CAAC,oBAAoB,CAAC,CAAA;AACnD,MAAM,iBAAiB,GAAG,IAAI,iBAAG,CAAC,eAAe,CAAC,CAAA"}

package/components/identity.tokens/operations/decrypt.d.ts

@@ -1,3 +1,15 @@
-import { type Maybe } from '@toa.io/types';
-import { type Context, type DecryptOutput } from './types';
-export declare function computation(token: string, context: Context): Promise<Maybe<DecryptOutput>>;
+import type { Maybe, Operation } from '@toa.io/types';
+import type { Context, DecryptOutput } from './lib';
+export declare class Computation implements Operation {
+    private readonly keys;
+    private readonly legacy;
+    private cache;
+    private latest;
+    private remote;
+    private logs;
+    mount(context: Context): void;
+    execute(token: string): Promise<Maybe<DecryptOutput>>;
+    private pasetoKid;
+    private jweKid;
+    private key;
+}

package/components/identity.tokens/operations/decrypt.js

@@ -1,33 +1,128 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.computation = void 0;
+exports.Computation = void 0;
 const paseto_1 = require("paseto");
-async function computation(token, context) {
-    let refresh = false;
-    let claim = await decrypt(token, context.configuration.key0);
-    if (claim === null && context.configuration.key1 !== undefined) {
-        refresh = true;
-        claim = await decrypt(token, context.configuration.key1);
-    }
-    if (claim === null)
-        return ERR_INVALID_TOKEN;
-    else
+const error_value_1 = require("error-value");
+const lru_cache_1 = require("lru-cache");
+const lib_1 = require("./lib");
+const jose_1 = require("./lib/jose");
+class Computation {
+    keys = {};
+    legacy = {};
+    cache;
+    latest;
+    remote;
+    logs;
+    mount(context) {
+        const latest = context.configuration.keys.find(({ format }) => format !== 'paseto');
+        if (latest === undefined)
+            throw new TypeError('At least one JWE key must be configured');
+        this.latest = latest.id;
+        this.remote = context.remote.identity.keys;
+        this.cache = new lru_cache_1.LRUCache(context.configuration.cache);
+        this.logs = context.logs;
+        for (const { id, key, format } of context.configuration.keys) {
+            const branch = format === 'paseto' ? this.legacy : this.keys;
+            branch[id] = { key };
+        }
+    }
+    async execute(token) {
+        const legacy = token.startsWith('v3.local.');
+        const kid = legacy ? this.pasetoKid(token) : await this.jweKid(token);
+        if (kid instanceof Error)
+            return kid;
+        const key = await this.key(kid, legacy);
+        if (key instanceof Error)
+            return key;
+        const claims = legacy
+            ? await decryptPaseto(token, key.key)
+            : await decryptJWE(token, key.key);
+        if (claims instanceof Error)
+            return claims;
+        this.logs.debug('Token claims', claims);
+        if (key.identity !== undefined && claims.identity.id !== key.identity)
+            return ERR_FORGED_KEY;
         return {
-            authority: claim.aud,
-            identity: claim.identity,
-            iat: claim.iat,
-            exp: claim.exp,
-            refresh
+            iss: claims.iss,
+            iat: claims.iat,
+            exp: claims.exp,
+            identity: claims.identity,
+            refresh: legacy || (kid !== this.latest && key.identity === undefined)
         };
+    }
+    pasetoKid(token) {
+        const [, , , footer] = token.split('.');
+        if (footer === undefined)
+            return ERR_INVALID_TOKEN;
+        try {
+            const json = Buffer.from(footer, 'base64url').toString('utf-8');
+            const { kid } = JSON.parse(json);
+            if (typeof kid !== 'string')
+                return ERR_INVALID_TOKEN;
+            return kid;
+        }
+        catch {
+            return ERR_INVALID_TOKEN;
+        }
+    }
+    async jweKid(token) {
+        try {
+            const { decodeProtectedHeader } = await (0, jose_1.load)();
+            const header = decodeProtectedHeader(token);
+            if (header.alg !== 'dir' || header.enc !== 'A256GCM' || header.typ !== 'JWT' ||
+                typeof header.kid !== 'string')
+                return ERR_INVALID_TOKEN;
+            return header.kid;
+        }
+        catch {
+            return ERR_INVALID_TOKEN;
+        }
+    }
+    async key(kid, legacy) {
+        const configured = legacy ? this.legacy : this.keys;
+        if (kid in configured)
+            return configured[kid];
+        if (!this.cache.has(kid)) {
+            const value = await this.remote.observe({ query: { id: kid } });
+            this.cache.set(kid, { value });
+        }
+        const entry = this.cache.get(kid);
+        return entry?.value ?? ERR_INVALID_KEY;
+    }
 }
-exports.computation = computation;
-async function decrypt(token, key) {
+exports.Computation = Computation;
+async function decryptPaseto(token, key) {
     try {
         return await paseto_1.V3.decrypt(token, key);
     }
     catch {
-        return null;
+        return ERR_INVALID_TOKEN;
+    }
+}
+async function decryptJWE(token, key) {
+    try {
+        const { jwtDecrypt } = await (0, jose_1.load)();
+        const { payload } = await jwtDecrypt(token, (0, lib_1.jweKey)(key), {
+            keyManagementAlgorithms: ['dir'],
+            contentEncryptionAlgorithms: ['A256GCM']
+        });
+        if (typeof payload.iss !== 'string' || typeof payload.iat !== 'number' ||
+            typeof payload.identity !== 'object' || payload.identity === null)
+            return ERR_INVALID_TOKEN;
+        if (payload.exp !== undefined && payload.exp * 1000 <= Date.now())
+            return ERR_INVALID_TOKEN;
+        return {
+            iss: payload.iss,
+            iat: new Date(payload.iat * 1000).toISOString(),
+            ...(payload.exp === undefined ? {} : { exp: new Date(payload.exp * 1000).toISOString() }),
+            identity: payload.identity
+        };
+    }
+    catch {
+        return ERR_INVALID_TOKEN;
     }
 }
-const ERR_INVALID_TOKEN = new Error('INVALID_TOKEN');
+const ERR_INVALID_TOKEN = new error_value_1.Err('INVALID_TOKEN');
+const ERR_INVALID_KEY = new error_value_1.Err('INVALID_KEY');
+const ERR_FORGED_KEY = new error_value_1.Err('FORGED_KEY');
 //# sourceMappingURL=decrypt.js.map

package/components/identity.tokens/operations/decrypt.js.map

@@ -1 +1 @@
-{"version":3,"file":"decrypt.js","sourceRoot":"","sources":["../source/decrypt.ts"],"names":[],"mappings":";;;AAAA,mCAA2B;AAIpB,KAAK,UAAU,WAAW,CAAE,KAAa,EAAE,OAAgB;IAChE,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;IAE5D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/D,OAAO,GAAG,IAAI,CAAA;QACd,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;IAC1D,CAAC;IAED,IAAI,KAAK,KAAK,IAAI;QAChB,OAAO,iBAAiB,CAAA;;QAExB,OAAO;YACL,SAAS,EAAE,KAAK,CAAC,GAAG;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,OAAO;SACR,CAAA;AACL,CAAC;AAnBD,kCAmBC;AAED,KAAK,UAAU,OAAO,CAAE,KAAa,EAAE,GAAW;IAChD,IAAI,CAAC;QACH,OAAO,MAAM,WAAE,CAAC,OAAO,CAAQ,KAAK,EAAE,GAAG,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,KAAK,CAAC,eAAe,CAAC,CAAA"}
+{"version":3,"file":"decrypt.js","sourceRoot":"","sources":["../source/decrypt.ts"],"names":[],"mappings":";;;AAAA,mCAA2B;AAC3B,6CAAiC;AACjC,yCAAoC;AACpC,+BAA8B;AAC9B,qCAAiC;AAIjC,MAAa,WAAW;IACL,IAAI,GAAwB,EAAE,CAAA;IAC9B,MAAM,GAAwB,EAAE,CAAA;IACzC,KAAK,CAA6B;IAClC,MAAM,CAAS;IACf,MAAM,CAAwC;IAC9C,IAAI,CAAkB;IAEvB,KAAK,CAAE,OAAgB;QAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAA;QAEnF,IAAI,MAAM,KAAK,SAAS;YACtB,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAA;QAEhE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAA;QACvB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAA;QAC1C,IAAI,CAAC,KAAK,GAAG,IAAI,oBAAQ,CAAmB,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;QACxE,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QAExB,KAAK,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YAC7D,MAAM,MAAM,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA;YAE5D,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,CAAA;QACtB,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,OAAO,CAAE,KAAa;QACjC,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAErE,IAAI,GAAG,YAAY,KAAK;YACtB,OAAO,GAAG,CAAA;QAEZ,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QAEvC,IAAI,GAAG,YAAY,KAAK;YACtB,OAAO,GAAG,CAAA;QAEZ,MAAM,MAAM,GAAG,MAAM;YACnB,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC;YACrC,CAAC,CAAC,MAAM,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAA;QAEpC,IAAI,MAAM,YAAY,KAAK;YACzB,OAAO,MAAM,CAAA;QAEf,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;QAEvC,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,CAAC,QAAQ;YACnE,OAAO,cAAc,CAAA;QAEvB,OAAO;YACL,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC;SACvE,CAAA;IACH,CAAC;IAEO,SAAS,CAAE,KAAa;QAC9B,MAAM,CAAC,EAAE,AAAD,EAAG,AAAD,EAAG,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAEvC,IAAI,MAAM,KAAK,SAAS;YACtB,OAAO,iBAAiB,CAAA;QAE1B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YAC/D,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAEhC,IAAI,OAAO,GAAG,KAAK,QAAQ;gBACzB,OAAO,iBAAiB,CAAA;YAE1B,OAAO,GAAG,CAAA;QACZ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,iBAAiB,CAAA;QAC1B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM,CAAE,KAAa;QACjC,IAAI,CAAC;YACH,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,IAAA,WAAI,GAAE,CAAA;YAC9C,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;YAE3C,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK;gBAC1E,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;gBAC9B,OAAO,iBAAiB,CAAA;YAE1B,OAAO,MAAM,CAAC,GAAG,CAAA;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,iBAAiB,CAAA;QAC1B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,GAAG,CAAE,GAAW,EAAE,MAAe;QAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA;QAEnD,IAAI,GAAG,IAAI,UAAU;YACnB,OAAO,UAAU,CAAC,GAAG,CAAC,CAAA;QAExB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;YAE/D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QAChC,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAEjC,OAAO,KAAK,EAAE,KAAK,IAAI,eAAe,CAAA;IACxC,CAAC;CACF;AA7GD,kCA6GC;AAED,KAAK,UAAU,aAAa,CAAE,KAAa,EAAE,GAAW;IACtD,IAAI,CAAC;QACH,OAAO,MAAM,WAAE,CAAC,OAAO,CAAS,KAAK,EAAE,GAAG,CAAC,CAAA;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,iBAAiB,CAAA;IAC1B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAE,KAAa,EAAE,GAAW;IACnD,IAAI,CAAC;QACH,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAA,WAAI,GAAE,CAAA;QAEnC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAAY,KAAK,EAAE,IAAA,YAAM,EAAC,GAAG,CAAC,EAAE;YAClE,uBAAuB,EAAE,CAAC,KAAK,CAAC;YAChC,2BAA2B,EAAE,CAAC,SAAS,CAAC;SACzC,CAAC,CAAA;QAEF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YACpE,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI;YACjE,OAAO,iBAAiB,CAAA;QAE1B,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE;YAC/D,OAAO,iBAAiB,CAAA;QAE1B,OAAO;YACL,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;YAC/C,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACzF,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,iBAAiB,CAAA;IAC1B,CAAC;AACH,CAAC;AAWD,MAAM,iBAAiB,GAAG,IAAI,iBAAG,CAAC,eAAe,CAAC,CAAA;AAClD,MAAM,eAAe,GAAG,IAAI,iBAAG,CAAC,aAAa,CAAC,CAAA;AAC9C,MAAM,cAAc,GAAG,IAAI,iBAAG,CAAC,YAAY,CAAC,CAAA"}

package/components/identity.tokens/operations/encrypt.d.ts

@@ -1,8 +1,8 @@
-import { type Operation } from '@toa.io/types';
-import { type Context, type EncryptInput } from './types';
+import type { Operation, Maybe } from '@toa.io/types';
+import type { Context, EncryptInput } from './lib';
 export declare class Effect implements Operation {
     private key;
     private lifetime;
     mount(context: Context): void;
-    execute(input: EncryptInput): Promise<string>;
+    execute(input: EncryptInput): Promise<Maybe<string>>;
 }

package/components/identity.tokens/operations/encrypt.js

@@ -1,26 +1,43 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Effect = void 0;
-const paseto_1 = require("paseto");
+const error_value_1 = require("error-value");
+const lib_1 = require("./lib");
+const jose_1 = require("./lib/jose");
 class Effect {
-    key = '';
-    lifetime = 0;
+    key;
+    lifetime;
     mount(context) {
-        this.key = context.configuration.key0;
+        const key = context.configuration.keys.find(({ format }) => format !== 'paseto');
+        if (key === undefined)
+            throw new TypeError('At least one JWE key must be configured');
+        this.key = key;
         this.lifetime = context.configuration.lifetime * 1000;
     }
     async execute(input) {
-        const lifetime = input.lifetime === undefined ? this.lifetime : input.lifetime * 1000;
-        const exp = lifetime === 0
-            ? undefined
-            : new Date(Date.now() + lifetime).toISOString();
-        const payload = {
-            identity: input.identity,
-            aud: input.authority,
-            exp
+        const { EncryptJWT } = await (0, jose_1.load)();
+        if (input.scopes?.some((scope) => !within(scope, input.identity.roles)) === true)
+            return ERR_INACCESSIBLE_SCOPE;
+        const lifetime = input.lifetime === undefined ? this.lifetime : (input.lifetime * 1000);
+        const identity = {
+            id: input.identity.id,
+            roles: input.scopes ?? input.identity.roles
         };
-        return await paseto_1.V3.encrypt(payload, this.key);
+        if (input.permissions !== undefined)
+            identity.permissions = input.permissions;
+        const key = input.key ?? this.key;
+        let token = new EncryptJWT({ identity })
+            .setProtectedHeader({ alg: 'dir', enc: 'A256GCM', typ: 'JWT', kid: key.id })
+            .setIssuer(input.authority)
+            .setIssuedAt(Date.now() / 1000);
+        if (lifetime !== 0)
+            token = token.setExpirationTime((Date.now() + lifetime) / 1000);
+        return await token.encrypt((0, lib_1.jweKey)(key.key));
     }
 }
 exports.Effect = Effect;
+function within(scope, roles) {
+    return roles.some((role) => role === scope || scope.startsWith(role + ':'));
+}
+const ERR_INACCESSIBLE_SCOPE = new error_value_1.Err('INACCESSIBLE_SCOPE');
 //# sourceMappingURL=encrypt.js.map

package/components/identity.tokens/operations/encrypt.js.map

@@ -1 +1 @@
-{"version":3,"file":"encrypt.js","sourceRoot":"","sources":["../source/encrypt.ts"],"names":[],"mappings":";;;AAAA,mCAA2B;AAI3B,MAAa,MAAM;IACT,GAAG,GAAW,EAAE,CAAA;IAChB,QAAQ,GAAW,CAAC,CAAA;IAErB,KAAK,CAAE,OAAgB;QAC5B,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,IAAI,CAAA;QACrC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,GAAG,IAAI,CAAA;IACvD,CAAC;IAEM,KAAK,CAAC,OAAO,CAAE,KAAmB;QACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAA;QAErF,MAAM,GAAG,GAAG,QAAQ,KAAK,CAAC;YACxB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAA;QAEjD,MAAM,OAAO,GAAmB;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,GAAG,EAAE,KAAK,CAAC,SAAS;YACpB,GAAG;SACJ,CAAA;QAED,OAAO,MAAM,WAAE,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;IAC5C,CAAC;CACF;AAxBD,wBAwBC"}
+{"version":3,"file":"encrypt.js","sourceRoot":"","sources":["../source/encrypt.ts"],"names":[],"mappings":";;;AAAA,6CAAiC;AACjC,+BAA8B;AAC9B,qCAAiC;AAIjC,MAAa,MAAM;IACT,GAAG,CAA0B;IAC7B,QAAQ,CAAS;IAElB,KAAK,CAAE,OAAgB;QAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAA;QAEhF,IAAI,GAAG,KAAK,SAAS;YACnB,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAA;QAEhE,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;QACd,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,GAAG,IAAI,CAAA;IACvD,CAAC;IAEM,KAAK,CAAC,OAAO,CAAE,KAAmB;QACvC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAA,WAAI,GAAE,CAAA;QAEnC,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI;YAC9E,OAAO,sBAAsB,CAAA;QAE/B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAA;QAEvF,MAAM,QAAQ,GAAa;YACzB,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;YACrB,KAAK,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK;SAC5C,CAAA;QAED,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;YACjC,QAAQ,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAA;QAE1C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;QAEjC,IAAI,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;aACrC,kBAAkB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;aAC3E,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC;aAC1B,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QAEjC,IAAI,QAAQ,KAAK,CAAC;YAChB,KAAK,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAA;QAEjE,OAAO,MAAM,KAAK,CAAC,OAAO,CAAC,IAAA,YAAM,EAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,CAAC;CACF;AA1CD,wBA0CC;AAED,SAAS,MAAM,CAAE,KAAa,EAAE,KAAe;IAC7C,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAA;AAC7E,CAAC;AAED,MAAM,sBAAsB,GAAG,IAAI,iBAAG,CAAC,oBAAoB,CAAC,CAAA"}

package/components/identity.tokens/operations/issue.d.ts

@@ -0,0 +1,24 @@
+import type { Maybe, Operation } from '@toa.io/types';
+import type { Context } from './lib';
+export declare class Effect implements Operation {
+    private keys;
+    private roles;
+    private encrypt;
+    private lifetime;
+    mount(context: Context): void;
+    execute(input: Input): Promise<Maybe<Output>>;
+}
+interface Input {
+    authority: string;
+    identity: string;
+    label: string;
+    lifetime?: number;
+    scopes?: string[];
+    permissions?: Record<string, string[]>;
+}
+interface Output {
+    kid: string;
+    exp?: number;
+    token: string;
+}
+export {};

package/components/identity.tokens/operations/issue.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Effect = void 0;
+class Effect {
+    keys;
+    roles;
+    encrypt;
+    lifetime;
+    mount(context) {
+        this.keys = context.remote.identity.keys;
+        this.roles = context.remote.identity.roles;
+        this.encrypt = context.local.encrypt;
+        this.lifetime = context.configuration.lifetime * 1000;
+    }
+    async execute(input) {
+        const lifetime = input.lifetime ?? this.lifetime;
+        const expires = lifetime === 0
+            ? undefined
+            : new Date(Date.now() + lifetime * 1000).getTime();
+        const key = await this.keys.create({
+            input: {
+                identity: input.identity,
+                label: input.label,
+                expires
+            }
+        });
+        const roles = await this.roles.list({
+            query: {
+                criteria: `identity==${input.identity}`,
+                limit: 1024
+            }
+        });
+        const identity = {
+            id: input.identity,
+            roles
+        };
+        const { authority, scopes, permissions } = input;
+        const token = await this.encrypt({
+            input: {
+                authority,
+                identity,
+                lifetime,
+                scopes,
+                permissions,
+                key
+            }
+        });
+        if (token instanceof Error)
+            return token;
+        return {
+            kid: key.id,
+            // technically, the token expires some time later
+            ...(expires !== undefined && { exp: expires }),
+            token
+        };
+    }
+}
+exports.Effect = Effect;
+//# sourceMappingURL=issue.js.map

package/components/identity.tokens/operations/issue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue.js","sourceRoot":"","sources":["../source/issue.ts"],"names":[],"mappings":";;;AAGA,MAAa,MAAM;IACT,IAAI,CAAwC;IAC5C,KAAK,CAAyC;IAC9C,OAAO,CAA8B;IACrC,QAAQ,CAAS;IAElB,KAAK,CAAE,OAAgB;QAC5B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAA;QACxC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAA;QAC1C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAA;QACpC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,GAAG,IAAI,CAAA;IACvD,CAAC;IAEM,KAAK,CAAC,OAAO,CAAE,KAAY;QAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAA;QAEhD,MAAM,OAAO,GAAG,QAAQ,KAAK,CAAC;YAC5B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAA;QAEpD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YACjC,KAAK,EAAE;gBACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO;aACR;SACF,CAAC,CAAA;QAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAClC,KAAK,EAAE;gBACL,QAAQ,EAAE,aAAa,KAAK,CAAC,QAAQ,EAAE;gBACvC,KAAK,EAAE,IAAI;aACZ;SACF,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAa;YACzB,EAAE,EAAE,KAAK,CAAC,QAAQ;YAClB,KAAK;SACN,CAAA;QAED,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAA;QAEhD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAC/B,KAAK,EAAE;gBACL,SAAS;gBACT,QAAQ;gBACR,QAAQ;gBACR,MAAM;gBACN,WAAW;gBACX,GAAG;aACJ;SACF,CAAC,CAAA;QAEF,IAAI,KAAK,YAAY,KAAK;YACxB,OAAO,KAAK,CAAA;QAEd,OAAO;YACL,GAAG,EAAE,GAAG,CAAC,EAAE;YACX,iDAAiD;YACjD,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YAC9C,KAAK;SACN,CAAA;IACH,CAAC;CACF;AA/DD,wBA+DC"}

package/components/identity.tokens/operations/lib/index.d.ts

@@ -0,0 +1,3 @@
+export * from './pad';
+export * from './types';
+export { jweKey } from './key';

package/components/identity.tokens/operations/lib/index.js

@@ -0,0 +1,22 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.jweKey = void 0;
+__exportStar(require("./pad"), exports);
+__exportStar(require("./types"), exports);
+var key_1 = require("./key");
+Object.defineProperty(exports, "jweKey", { enumerable: true, get: function () { return key_1.jweKey; } });
+//# sourceMappingURL=index.js.map

package/components/identity.tokens/operations/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../source/lib/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,wCAAqB;AACrB,0CAAuB;AACvB,6BAA8B;AAArB,6FAAA,MAAM,OAAA"}

package/components/identity.tokens/operations/lib/jose.d.ts

@@ -0,0 +1,41 @@
+export function load(): Promise<{
+    default: typeof import("jose");
+    compactDecrypt: typeof import("jose").compactDecrypt;
+    flattenedDecrypt: typeof import("jose").flattenedDecrypt;
+    generalDecrypt: typeof import("jose").generalDecrypt;
+    GeneralEncrypt: typeof import("jose").GeneralEncrypt;
+    compactVerify: typeof import("jose").compactVerify;
+    flattenedVerify: typeof import("jose").flattenedVerify;
+    generalVerify: typeof import("jose").generalVerify;
+    jwtVerify: typeof import("jose").jwtVerify;
+    jwtDecrypt: typeof import("jose").jwtDecrypt;
+    CompactEncrypt: typeof import("jose").CompactEncrypt;
+    FlattenedEncrypt: typeof import("jose").FlattenedEncrypt;
+    CompactSign: typeof import("jose").CompactSign;
+    FlattenedSign: typeof import("jose").FlattenedSign;
+    GeneralSign: typeof import("jose").GeneralSign;
+    SignJWT: typeof import("jose").SignJWT;
+    EncryptJWT: typeof import("jose").EncryptJWT;
+    calculateJwkThumbprint: typeof import("jose").calculateJwkThumbprint;
+    calculateJwkThumbprintUri: typeof import("jose").calculateJwkThumbprintUri;
+    EmbeddedJWK: typeof import("jose").EmbeddedJWK;
+    createLocalJWKSet: typeof import("jose").createLocalJWKSet;
+    createRemoteJWKSet: typeof import("jose").createRemoteJWKSet;
+    jwksCache: typeof import("jose").jwksCache;
+    customFetch: typeof import("jose").customFetch;
+    UnsecuredJWT: typeof import("jose").UnsecuredJWT;
+    exportPKCS8: typeof import("jose").exportPKCS8;
+    exportSPKI: typeof import("jose").exportSPKI;
+    exportJWK: typeof import("jose").exportJWK;
+    importSPKI: typeof import("jose").importSPKI;
+    importPKCS8: typeof import("jose").importPKCS8;
+    importX509: typeof import("jose").importX509;
+    importJWK: typeof import("jose").importJWK;
+    decodeProtectedHeader: typeof import("jose").decodeProtectedHeader;
+    decodeJwt: typeof import("jose").decodeJwt;
+    errors: typeof import("jose/dist/types/util/errors");
+    generateKeyPair: typeof import("jose").generateKeyPair;
+    generateSecret: typeof import("jose").generateSecret;
+    base64url: typeof import("jose/dist/types/util/base64url");
+    cryptoRuntime: "WebCryptoAPI";
+}>;

package/components/identity.tokens/operations/lib/jose.js

@@ -0,0 +1,27 @@
+'use strict';
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+const load = async () => await Promise.resolve().then(() => __importStar(require('jose')));
+exports.load = load;
+//# sourceMappingURL=jose.js.map

package/components/identity.tokens/operations/lib/jose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jose.js","sourceRoot":"","sources":["../../source/lib/jose.js"],"names":[],"mappings":"AAAA,YAAY,CAAA;;;;;;;;;;;;;;;;;;;;;;;;AAEZ,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC,wDAAa,MAAM,GAAC,CAAA;AAE7C,OAAO,CAAC,IAAI,GAAG,IAAI,CAAA"}

package/components/identity.tokens/operations/lib/key.d.ts

@@ -0,0 +1 @@
+export declare function jweKey(value: string): Uint8Array;

package/components/identity.tokens/operations/lib/key.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.jweKey = void 0;
+function jweKey(value) {
+    const key = Buffer.from(value, 'base64url');
+    if (key.length !== 32 || key.toString('base64url') !== value)
+        throw new TypeError('JWE key must be a base64url-encoded 256-bit secret');
+    return new Uint8Array(key);
+}
+exports.jweKey = jweKey;
+//# sourceMappingURL=key.js.map

package/components/identity.tokens/operations/lib/key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key.js","sourceRoot":"","sources":["../../source/lib/key.ts"],"names":[],"mappings":";;;AAAA,SAAgB,MAAM,CAAE,KAAa;IACnC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAA;IAE3C,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK;QAC1D,MAAM,IAAI,SAAS,CAAC,oDAAoD,CAAC,CAAA;IAE3E,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAA;AAC5B,CAAC;AAPD,wBAOC"}

package/components/identity.tokens/operations/lib/pad.d.ts

@@ -0,0 +1 @@
+export declare const PAD = "v3.local.";

package/components/identity.tokens/operations/lib/pad.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PAD = void 0;
+exports.PAD = 'v3.local.';
+//# sourceMappingURL=pad.js.map

package/components/identity.tokens/operations/lib/pad.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pad.js","sourceRoot":"","sources":["../../source/lib/pad.ts"],"names":[],"mappings":";;;AAAa,QAAA,GAAG,GAAG,WAAW,CAAA"}

package/components/identity.tokens/operations/lib/types.d.ts

@@ -0,0 +1,84 @@
+import type { Call, Maybe, Observation, telemetry } from '@toa.io/types';
+export interface Context {
+    local: {
+        observe: Observation<Entity>;
+        encrypt: Call<Maybe<string>, EncryptInput>;
+        decrypt: Call<Maybe<DecryptOutput>, string>;
+    };
+    remote: {
+        identity: {
+            keys: {
+                observe: Observation<CustomKey>;
+                create: Call<Key>;
+            };
+            roles: {
+                list: Call<string[]>;
+            };
+        };
+    };
+    configuration: Configuration;
+    logs: telemetry.Logs;
+}
+export interface Configuration {
+    readonly keys: ConfiguredKey[];
+    readonly lifetime: number;
+    readonly refresh: number;
+    readonly cache: {
+        max: number;
+        ttl: number;
+    };
+}
+export interface ConfiguredKey extends Pick<Key, 'id' | 'key'> {
+    format?: 'jwe' | 'paseto';
+}
+export interface Entity {
+    revokedAt?: number;
+}
+export interface Identity extends Record<string, any> {
+    id: string;
+    roles: string[];
+    permissions?: Record<string, string[]>;
+}
+export interface AuthenticateInput {
+    authority: string;
+    credentials: string;
+}
+export interface AuthenticateOutput {
+    identity: Identity;
+    refresh: boolean;
+}
+export interface EncryptInput {
+    authority: string;
+    identity: Identity;
+    lifetime?: number;
+    scopes?: string[];
+    permissions?: Record<string, string[]>;
+    key?: Key;
+}
+export interface DecryptOutput {
+    iss: string;
+    iat: string;
+    exp?: string;
+    identity: Identity;
+    refresh: boolean;
+}
+export interface Claims {
+    identity: Identity;
+    iss: string;
+    iat: string;
+    exp?: string;
+}
+export interface JWEClaims {
+    identity: Identity;
+    iss: string;
+    iat: number;
+    exp?: number;
+}
+export interface Key {
+    id: string;
+    key: string;
+    label: string;
+}
+export interface CustomKey extends Key {
+    identity: string;
+}

package/components/identity.tokens/operations/lib/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../source/lib/types.ts"],"names":[],"mappings":""}