@toa.io/extensions.exposition 1.0.0-alpha.27 → 1.0.0-alpha.271

package/components/identity.credentials/source/list.ts

@@ -0,0 +1,87 @@
+import type { Call, Operation } from '@toa.io/types'
+
+export class Computation implements Operation {
+  private basic: Basic = undefined as unknown as Basic
+  private federation: Federation = undefined as unknown as Federation
+  private passkeys: Passkeys = undefined as unknown as Passkeys
+
+  public mount (context: Context): void {
+    this.basic = context.remote.identity.basic
+    this.federation = context.remote.identity.federation
+
+    this.passkeys = context.remote.identity.passkeys
+  }
+
+  public async execute (input: Input): Promise<Output> {
+    const request = { input }
+
+    const [basic, federationObjects, passkeyObjects] = await Promise.all([
+      this.basic.info(request),
+      this.federation.list(request),
+      this.passkeys.list(request)
+    ])
+
+    const federation = federationObjects.map(({ id, iss, _created }) => ({ id, iss, _created }))
+
+    const passkeys = passkeyObjects.map(({ id, aid, synced, label, _created }) => ({
+      id,
+      aid,
+      synced,
+      label,
+      _created
+    }))
+
+    return { basic, federation, passkeys }
+  }
+}
+
+interface Input {
+  authority: string
+  identity: string
+}
+
+interface BasicCredential {
+  username: string
+}
+
+interface FederationCredential {
+  id: string
+  iss: string
+  _created: number
+}
+
+interface PasskeyCredential {
+  id: string
+  aid: string
+  synced: boolean
+  label?: string
+  _created: number
+}
+
+interface Output {
+  basic: BasicCredential | null
+  federation: FederationCredential[]
+  passkeys: PasskeyCredential[]
+}
+
+interface Context {
+  remote: {
+    identity: {
+      basic: Basic
+      federation: Federation
+      passkeys: Passkeys
+    }
+  }
+}
+
+interface Basic {
+  info: Call<BasicCredential | null, Input>
+}
+
+interface Federation {
+  list: Call<FederationCredential[], Input>
+}
+
+interface Passkeys {
+  list: Call<PasskeyCredential[], Input>
+}

package/components/identity.credentials/tsconfig.json

@@ -0,0 +1,7 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "outDir": "./operations"
+  },
+  "include": ["source"]
+}

package/components/identity.federation/events/principal.js

@@ -15,8 +15,8 @@ exports.condition = function (event, context) {
 }
 
 /**
- * @param {{ state: import('../source/types').Entity & { id: string } }} event
+ * @param {{ state: import('../source/types').Entity }} event
  */
 exports.payload = function (event) {
-  return { id: event.state.id }
+  return { identity: event.state.identity }
 }

package/components/identity.federation/manifest.toa.yaml

@@ -2,7 +2,6 @@ namespace: identity
 name: federation
 
 entity:
-  associated: true
   schema:
     type: object
     properties:
@@ -15,13 +14,23 @@ entity:
       sub:
         description: The ID that represents the principal making the request
         type: string
+      identity:
+        description: Identity associated with these credentials
+        type: string
     required:
       - authority
       - iss
       - sub
+      - identity
     additionalProperties: false
   unique:
     token: [authority, iss, sub]
+    identity: [authority, iss, identity]
+  index:
+    list:
+      authority: asc
+      identity: asc
+      _created: desc
 
 operations:
   transit:
@@ -30,30 +39,65 @@ operations:
       authority*: string
       iss*: string
       sub*: string
+      identity*: string
+  create:
+    input:
+      scheme*: [bearer, code]
+      authority*: string
+      credentials*: string
+      id*: string
+    errors:
+      - EXISTS
   incept:
     input:
-      authority: string
+      scheme*: [bearer, code]
+      authority*: string
       credentials*: string
-      id: string
+      id*: string
     output:
       id: string
+    errors:
+      - EXISTS
   authenticate:
     input:
+      scheme*: [bearer, code]
       authority*: string
       credentials*: string
     output:
-      identity:
-        id: string
-
-exposition:
-  /:
-    POST:
-      anonymous: true
-      io:input: [authority, credentials]
-      io:output: [id]
-      vary:embed:
-        authority: authority
-      endpoint: incept
+      properties:
+        identity:
+          properties:
+            id:
+              type: string
+            claims: &claims
+              properties:
+                iss:
+                  type: string
+                aud:
+                  type: string
+                sub:
+                  type: string
+              additionalProperties: true
+              required:
+                - iss
+                - sub
+          required:
+            - id
+            - claims
+    errors:
+      - ERR_NOT_FOUND
+  decode:
+    input: string
+    output: *claims
+  list:
+    input:
+      authority*: string
+      identity*: string
+  delete:
+    input:
+      authority*: string
+      identity*: string
+      credential*: string
 
 configuration:
   schema:
@@ -62,41 +106,39 @@ configuration:
       trust:
         type: array
         items:
-          title: Trust Configuration
+          title: Trusted Identity Providers
           type: object
           additionalProperties: false
           properties:
             iss:
-              description: Allowed origins for a token `iss` field
+              description: Allowed values for a token `iss` field
               type: string
               format: uri
             aud:
-              description: Acceptable `aud` value(s)
-              type: array
-              items:
-                type: string
-              uniqueItems: true
-              minItems: 1
-            secrets:
-              description: Symmetric encryption secrets
-              type: object
-              patternProperties:
-                ^HS\d{3}$:
-                  type: object
-                  patternProperties:
-                    ^\w+$:
-                      type: string
-                  minProperties: 1
-              additionalProperties: false
-              minProperties: 1
+              description: Acceptable `aud` value(s). Required for Authorization Code Flow.
+              anyOf:
+                - type: string
+                - type: array
+                  items: { type: string }
+                  uniqueItems: true
+                  minItems: 1
+            signature:
+              properties:
+                iss: { type: string }
+                kid: { type: string }
+                key:
+                  description: PKCS8 private key in PEM form
+                  type: string
+              required: [iss, kid, key]
+            secret:
+              description: Client secret for the Identity Provider. Required for Authorization Code Flow.
+              type: string
           required:
             - iss
-      explicit_identity_creation:
-        description: Force identities to be explicitly created or incept before being used in authentication
-        type: boolean
-        default: true
+        default: []
       principal:
-        description: The value of `sub` of an identity token that will be assigned the `system` Role
+        title: Principal
+        description: Subject that will be assigned the `system` Role
         type: object
         properties:
           iss:
@@ -108,4 +150,32 @@ configuration:
           - iss
           - sub
         additionalProperties: false
+      assert:
+        title: Implicitly incept Identity for new credentials
+        type: boolean
+        default: true
     additionalProperties: false
+
+exposition:
+  /:
+    /:id:
+      auth:id: id
+      POST:
+        map:authority: authority
+        io:input: [scheme, credentials]
+        io:output: &credential [id, iss, _created]
+        endpoint: create
+      GET:
+        map:authority: authority
+        map:segments:
+          identity: id
+        io:output: *credential
+        endpoint: list
+      /:credential:
+        DELETE:
+          map:authority: authority
+          map:segments:
+            identity: id
+            credential: credential
+          io:output: false
+          endpoint: delete

package/components/identity.federation/operations/authenticate.d.ts

@@ -1,3 +1,16 @@
-import { type Maybe } from '@toa.io/types';
-import type { AuthenticateInput, AuthenticateOutput, Context } from './types';
-export declare const computation: (args_0: AuthenticateInput, context: Context) => Promise<Error | Promise<Maybe<AuthenticateOutput>>>;
+import type { JWTPayload } from 'jose';
+import type { Maybe } from '@toa.io/types';
+import type { Context, Scheme } from './types';
+export declare function effect({ scheme, authority, credentials }: Input, context: Context): Promise<Maybe<Output>>;
+interface Input {
+    scheme: Scheme;
+    authority: string;
+    credentials: string;
+}
+interface Output {
+    identity: {
+        id: string;
+        claims: JWTPayload;
+    };
+}
+export {};

package/components/identity.federation/operations/authenticate.js

@@ -1,21 +1,29 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.computation = void 0;
+exports.effect = void 0;
 const error_value_1 = require("error-value");
-const assertions_as_values_js_1 = require("./lib/assertions-as-values.js");
-const jwt_1 = require("./lib/jwt");
-async function authenticate({ authority, credentials }, context) {
-    const { iss, sub } = await (0, jwt_1.validateIdToken)(credentials, context.configuration.trust);
-    const request = { query: { criteria: `authority==${authority};iss==${iss};sub==${sub}` } };
-    let id = (await context.local.observe(request))?.id;
-    if (id === undefined) {
-        if (context.configuration.explicit_identity_creation === true)
-            return NOT_FOUND;
-        id = (await context.local.transit({ input: { authority, iss, sub } })).id;
-    }
-    return { identity: { id } };
+const generic_1 = require("@toa.io/generic");
+const lib_1 = require("./lib");
+async function effect({ scheme, authority, credentials }, context) {
+    context.logs.debug('Authenticating', { scheme, authority, credentials });
+    const claims = await (0, lib_1.resolve)(scheme, credentials, context);
+    if (claims instanceof Error)
+        return claims;
+    const { iss, sub } = claims;
+    context.logs.debug('Token claims', claims);
+    const query = { criteria: `authority==${authority};iss==${iss};sub==${sub}` };
+    const credential = context.configuration.assert !== false
+        ? await context.local.ensure({
+            query,
+            entity: { authority, iss, sub, identity: (0, generic_1.newid)() }
+        })
+        : await context.local.observe({ query });
+    if (credential === null)
+        return ERR_NOT_FOUND;
+    if (credential instanceof Error)
+        return credential;
+    return { identity: { id: credential.identity, claims } };
 }
-// Exporting as a function returning assertion errors as values
-exports.computation = (0, assertions_as_values_js_1.assertionsAsValues)(authenticate);
-const NOT_FOUND = (0, error_value_1.Err)('NOT_FOUND');
+exports.effect = effect;
+const ERR_NOT_FOUND = new error_value_1.Err('NOT_FOUND');
 //# sourceMappingURL=authenticate.js.map

package/components/identity.federation/operations/authenticate.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../source/authenticate.ts"],"names":[],"mappings":";;;AACA,6CAAiC;AACjC,2EAAkE;AAClE,mCAEkB;AAIlB,KAAK,UAAU,YAAY,CAAE,EAAE,SAAS,EAAE,WAAW,EAAqB,EACxE,OAAgB;IAChB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,IAAA,qBAAe,EAAC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;IAEpF,MAAM,OAAO,GAAY,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,cAAc,SAAS,SAAS,GAAG,SAAS,GAAG,EAAE,EAAE,EAAE,CAAA;IAEnG,IAAI,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAA;IAEnD,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,IAAI,OAAO,CAAC,aAAa,CAAC,0BAA0B,KAAK,IAAI;YAC3D,OAAO,SAAS,CAAA;QAElB,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3E,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,CAAA;AAC7B,CAAC;AAED,+DAA+D;AAClD,QAAA,WAAW,GAAG,IAAA,4CAAkB,EAAC,YAAY,CAAC,CAAA;AAE3D,MAAM,SAAS,GAAG,IAAA,iBAAG,EAAC,WAAW,CAAC,CAAA"}
+{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../source/authenticate.ts"],"names":[],"mappings":";;;AAAA,6CAAiC;AACjC,6CAAuC;AACvC,+BAA+B;AAKxB,KAAK,UAAU,MAAM,CAAE,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAS,EAAE,OAAgB;IACvF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAA;IAExE,MAAM,MAAM,GAAG,MAAM,IAAA,aAAO,EAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;IAE1D,IAAI,MAAM,YAAY,KAAK;QACzB,OAAO,MAAM,CAAA;IAEf,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;IAE3B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;IAE1C,MAAM,KAAK,GAAG,EAAE,QAAQ,EAAE,cAAc,SAAS,SAAS,GAAG,SAAS,GAAG,EAAE,EAAE,CAAA;IAE7E,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,KAAK;QACvD,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;YAC3B,KAAK;YACL,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAA,eAAK,GAAE,EAAE;SACnD,CAAC;QACF,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IAE1C,IAAI,UAAU,KAAK,IAAI;QACrB,OAAO,aAAa,CAAA;IAEtB,IAAI,UAAU,YAAY,KAAK;QAC7B,OAAO,UAAU,CAAA;IAEnB,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAA;AAC1D,CAAC;AA5BD,wBA4BC;AAED,MAAM,aAAa,GAAG,IAAI,iBAAG,CAAC,WAAW,CAAC,CAAA"}

package/components/identity.federation/operations/create.d.ts

@@ -0,0 +1,8 @@
+import type { Context, Entity, Scheme } from './types';
+export declare function effect(input: Input, context: Context): Promise<Entity | Error>;
+export interface Input {
+    authority: string;
+    scheme: Scheme;
+    credentials: string;
+    id: string;
+}

package/components/identity.federation/operations/create.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.effect = void 0;
+const error_value_1 = require("error-value");
+const lib_1 = require("./lib");
+async function effect(input, context) {
+    const claims = await (0, lib_1.resolve)(input.scheme, input.credentials, context);
+    if (claims instanceof Error)
+        return claims;
+    const { iss, sub } = claims;
+    const existent = await context.local.observe({
+        query: { criteria: `authority==${input.authority};iss==${iss};sub==${sub}`, deleted: true }
+    });
+    const record = { authority: input.authority, iss, sub, identity: input.id };
+    if (existent === null)
+        return await context.local.transit({ input: record });
+    if (existent._deleted === undefined || existent._deleted === null)
+        return existent.identity === input.id ? existent : ERR_EXISTS;
+    // a deleted record still occupies the unique index, so the transition revives it
+    return await context.local.transit({
+        input: record,
+        query: { id: existent.id, deleted: true }
+    });
+}
+exports.effect = effect;
+const ERR_EXISTS = new error_value_1.Err('EXISTS', 'Federation credentials are associated with another Identity');
+//# sourceMappingURL=create.js.map

package/components/identity.federation/operations/create.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.js","sourceRoot":"","sources":["../source/create.ts"],"names":[],"mappings":";;;AAAA,6CAAiC;AACjC,+BAA+B;AAGxB,KAAK,UAAU,MAAM,CAAE,KAAY,EAAE,OAAgB;IAC1D,MAAM,MAAM,GAAG,MAAM,IAAA,aAAO,EAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IAEtE,IAAI,MAAM,YAAY,KAAK;QACzB,OAAO,MAAM,CAAA;IAEf,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;IAE3B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QAC3C,KAAK,EAAE,EAAE,QAAQ,EAAE,cAAc,KAAK,CAAC,SAAS,SAAS,GAAG,SAAS,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;KAC5F,CAAC,CAAA;IAEF,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,CAAA;IAE3E,IAAI,QAAQ,KAAK,IAAI;QACnB,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IAEvD,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI;QAC/D,OAAO,QAAQ,CAAC,QAAQ,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAA;IAE/D,iFAAiF;IACjF,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACjC,KAAK,EAAE,MAAM;QACb,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;KAC1C,CAAC,CAAA;AACJ,CAAC;AAzBD,wBAyBC;AASD,MAAM,UAAU,GAAG,IAAI,iBAAG,CAAC,QAAQ,EAAE,6DAA6D,CAAC,CAAA"}

package/components/identity.federation/operations/decode.d.ts

@@ -0,0 +1,3 @@
+import type { JWTPayload } from 'jose';
+import type { Context } from './types';
+export declare function effect(token: string, context: Context): Promise<JWTPayload | Error>;

package/components/identity.federation/operations/decode.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.effect = void 0;
+const lib_1 = require("./lib");
+async function effect(token, context) {
+    return await (0, lib_1.decode)(token, {
+        trust: context.configuration.trust,
+        logs: context.logs,
+        fetch: context.fetch
+    });
+}
+exports.effect = effect;
+//# sourceMappingURL=decode.js.map

package/components/identity.federation/operations/decode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decode.js","sourceRoot":"","sources":["../source/decode.ts"],"names":[],"mappings":";;;AAAA,+BAA8B;AAIvB,KAAK,UAAU,MAAM,CAAE,KAAa,EAAE,OAAgB;IAC3D,OAAO,MAAM,IAAA,YAAM,EAAC,KAAK,EAAE;QACzB,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,KAAK;QAClC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAA;AACJ,CAAC;AAND,wBAMC"}

package/components/identity.federation/operations/delete.d.ts

@@ -0,0 +1,8 @@
+import type { Context } from './types';
+export declare function effect({ authority, identity, credential }: Input, context: Context): Promise<void | null>;
+interface Input {
+    authority: string;
+    identity: string;
+    credential: string;
+}
+export {};

package/components/identity.federation/operations/delete.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.effect = void 0;
+async function effect({ authority, identity, credential }, context) {
+    const object = await context.local.observe({ query: { id: credential } });
+    if (object === null || object.authority !== authority || object.identity !== identity)
+        return null;
+    return await context.local.terminate({ query: { id: credential } });
+}
+exports.effect = effect;
+//# sourceMappingURL=delete.js.map

package/components/identity.federation/operations/delete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.js","sourceRoot":"","sources":["../source/delete.ts"],"names":[],"mappings":";;;AAEO,KAAK,UAAU,MAAM,CAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAS,EAAE,OAAgB;IACxF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;IAEzE,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QACnF,OAAO,IAAI,CAAA;IAEb,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;AACrE,CAAC;AAPD,wBAOC"}

package/components/identity.federation/operations/incept.d.ts

@@ -1,11 +1,11 @@
-import type { Context } from './types';
-interface Input {
+import type { Context, Scheme } from './types';
+export declare function effect(input: Input, context: Context): Promise<Output | Error>;
+export interface Input {
     authority: string;
+    scheme: Scheme;
     credentials: string;
-    id?: string;
+    id: string;
 }
-interface Output {
+export interface Output {
     id: string;
 }
-export declare const effect: (input: Input, context: Context) => Promise<Error | Promise<Output>>;
-export {};

package/components/identity.federation/operations/incept.js

@@ -1,14 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.effect = void 0;
-const assertions_as_values_js_1 = require("./lib/assertions-as-values.js");
-const jwt_1 = require("./lib/jwt");
-async function incept(input, context) {
-    const { iss, sub } = await (0, jwt_1.validateIdToken)(input.credentials, context.configuration.trust);
-    const request = { input: { authority: input.authority, iss, sub } };
-    if (input.id !== undefined)
-        request.query = { id: input.id };
-    return await context.local.transit(request);
+const create_1 = require("./create");
+async function effect(input, context) {
+    const credential = await (0, create_1.effect)(input, context);
+    return credential instanceof Error ? credential : { id: credential.identity };
 }
-exports.effect = (0, assertions_as_values_js_1.assertionsAsValues)(incept);
+exports.effect = effect;
 //# sourceMappingURL=incept.js.map

package/components/identity.federation/operations/incept.js.map

@@ -1 +1 @@
-{"version":3,"file":"incept.js","sourceRoot":"","sources":["../source/incept.ts"],"names":[],"mappings":";;;AAAA,2EAAkE;AAClE,mCAA2C;AAI3C,KAAK,UAAU,MAAM,CAAE,KAAY,EAAE,OAAgB;IACnD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,IAAA,qBAAe,EAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;IAE1F,MAAM,OAAO,GAAY,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,EAA+B,EAAE,CAAA;IAEzG,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS;QACxB,OAAO,CAAC,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAA;IAElC,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;AAC7C,CAAC;AAYY,QAAA,MAAM,GAAG,IAAA,4CAAkB,EAAC,MAAM,CAAC,CAAA"}
+{"version":3,"file":"incept.js","sourceRoot":"","sources":["../source/incept.ts"],"names":[],"mappings":";;;AAAA,qCAA2C;AAGpC,KAAK,UAAU,MAAM,CAAE,KAAY,EAAE,OAAgB;IAC1D,MAAM,UAAU,GAAG,MAAM,IAAA,eAAM,EAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAE/C,OAAO,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAA;AAC/E,CAAC;AAJD,wBAIC"}

package/components/identity.federation/operations/lib/Configuration.d.ts

@@ -0,0 +1,39 @@
+export interface Configuration extends Record<string, unknown> {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    userinfo_endpoint: string;
+    jwks_uri: string;
+    registration_endpoint?: string;
+    scopes_supported?: string[];
+    response_types_supported: string[];
+    response_modes_supported?: string[];
+    grant_types_supported?: string[];
+    acr_values_supported?: string[];
+    subject_types_supported: string[];
+    id_token_signing_alg_values_supported: string[];
+    id_token_encryption_alg_values_supported?: string[];
+    id_token_encryption_enc_values_supported?: string[];
+    userinfo_signing_alg_values_supported?: string[];
+    userinfo_encryption_alg_values_supported?: string[];
+    userinfo_encryption_enc_values_supported?: string[];
+    request_object_signing_alg_values_supported?: string[];
+    request_object_encryption_alg_values_supported?: string[];
+    request_object_encryption_enc_values_supported?: string[];
+    token_endpoint_auth_methods_supported?: string[];
+    token_endpoint_auth_signing_alg_values_supported?: string[];
+    display_values_supported?: string[];
+    claim_types_supported?: string[];
+    claims_supported?: string[];
+    service_documentation?: string;
+    claims_locales_supported?: string[];
+    ui_locales_supported?: string[];
+    claims_parameter_supported?: boolean;
+    request_parameter_supported?: boolean;
+    request_uri_parameter_supported?: boolean;
+    require_request_uri_registration?: boolean;
+    op_policy_uri?: string;
+    op_tos_uri?: string;
+    check_session_iframe?: string;
+    end_session_endpoint?: string;
+}

package/components/identity.federation/operations/lib/Configuration.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=Configuration.js.map

package/components/identity.federation/operations/lib/Configuration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Configuration.js","sourceRoot":"","sources":["../../source/lib/Configuration.ts"],"names":[],"mappings":""}

package/components/identity.federation/operations/lib/Ctx.d.ts

@@ -0,0 +1,8 @@
+import type { telemetry } from '@toa.io/types';
+import type { Trust } from '../types';
+import type { Fetch } from '../types/context';
+export interface Ctx {
+    trust: Trust[];
+    logs: telemetry.Logs;
+    fetch: Fetch;
+}

package/{transpiled/directives/vary/embeddings/Embedding.js → components/identity.federation/operations/lib/Ctx.js}

@@ -1,3 +1,3 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=Embedding.js.map
+//# sourceMappingURL=Ctx.js.map

package/components/identity.federation/operations/lib/Ctx.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Ctx.js","sourceRoot":"","sources":["../../source/lib/Ctx.ts"],"names":[],"mappings":""}

package/components/identity.federation/operations/lib/Payload.d.ts

@@ -0,0 +1,5 @@
+import type * as jose from 'jose';
+export interface Payload extends jose.JWTPayload {
+    iss: string;
+    sub: string;
+}

package/components/identity.federation/operations/lib/Payload.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=Payload.js.map

package/components/identity.federation/operations/lib/Payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Payload.js","sourceRoot":"","sources":["../../source/lib/Payload.ts"],"names":[],"mappings":""}

package/components/identity.federation/operations/lib/decode.d.ts

@@ -0,0 +1,3 @@
+import type { Ctx } from './Ctx';
+import type { Payload } from './Payload';
+export declare function decode(token: string, ctx: Ctx): Promise<Payload | Error>;

package/components/identity.federation/operations/lib/decode.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decode = void 0;
+const jose_1 = require("./jose");
+const discovery_1 = require("./discovery");
+const errors_1 = require("./errors");
+async function decode(token, ctx) {
+    const jose = await (0, jose_1.load)();
+    const { iss, sub } = jose.decodeJwt(token);
+    if (typeof iss !== 'string')
+        return errors_1.ERR_ISS;
+    if (typeof sub !== 'string')
+        return errors_1.ERR_SUB;
+    const trusted = ctx.trust.find((trust) => trust.iss === iss);
+    if (trusted === undefined)
+        return errors_1.ERR_TRUST;
+    const jwks = await (0, discovery_1.createRemoteJWKSet)(iss, ctx.fetch);
+    const { payload } = await jose.jwtVerify(token, jwks, { audience: trusted.aud });
+    return payload;
+}
+exports.decode = decode;
+//# sourceMappingURL=decode.js.map

package/components/identity.federation/operations/lib/decode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decode.js","sourceRoot":"","sources":["../../source/lib/decode.ts"],"names":[],"mappings":";;;AAAA,iCAA6B;AAC7B,2CAAgD;AAChD,qCAAsD;AAI/C,KAAK,UAAU,MAAM,CAAE,KAAa,EAAE,GAAQ;IACnD,MAAM,IAAI,GAAG,MAAM,IAAA,WAAI,GAAE,CAAA;IACzB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAE1C,IAAI,OAAO,GAAG,KAAK,QAAQ;QACzB,OAAO,gBAAO,CAAA;IAEhB,IAAI,OAAO,GAAG,KAAK,QAAQ;QACzB,OAAO,gBAAO,CAAA;IAEhB,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;IAE5D,IAAI,OAAO,KAAK,SAAS;QACvB,OAAO,kBAAS,CAAA;IAElB,MAAM,IAAI,GAAG,MAAM,IAAA,8BAAkB,EAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;IAErD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IAEhF,OAAO,OAAkB,CAAA;AAC3B,CAAC;AApBD,wBAoBC"}