@toa.io/extensions.exposition 1.0.0-alpha.272 → 1.0.0-alpha.274

package/components/identity.federation/operations/types/configuration.d.ts

@@ -1,3 +1,4 @@
+import type { Secret } from '@toa.io/types';
 export interface Configuration {
     trust: Trust[];
     principal?: Principal;
@@ -6,11 +7,11 @@ export interface Configuration {
 export interface Trust {
     iss: string;
     aud?: string | [string, ...string[]];
-    secret?: string;
+    secret?: Secret;
     signature?: {
         iss: string;
         kid: string;
-        key: string;
+        key: Secret;
     };
 }
 interface Principal {

package/components/identity.federation/source/authenticate.ts

@@ -1,4 +1,3 @@
-import { Err } from 'error-value'
 import { newid } from '@toa.io/generic'
 import { resolve } from './lib'
 import type { JWTPayload } from 'jose'
@@ -35,7 +34,9 @@ export async function effect ({ scheme, authority, credentials }: Input, context
   return { identity: { id: credential.identity, claims } }
 }
 
-const ERR_NOT_FOUND = new Err('NOT_FOUND')
+const ERR_NOT_FOUND = new (class NotFoundError extends Error {
+  public readonly code = 'NOT_FOUND'
+})()
 
 interface Input {
   scheme: Scheme

package/components/identity.federation/source/create.ts

@@ -1,4 +1,3 @@
-import { Err } from 'error-value'
 import { resolve } from './lib'
 import type { Context, Entity, Scheme } from './types'
 
@@ -36,4 +35,7 @@ export interface Input {
   id: string
 }
 
-const ERR_EXISTS = new Err('EXISTS', 'Federation credentials are associated with another Identity')
+const ERR_EXISTS = new (class ExistsError extends Error {
+  public readonly code = 'EXISTS'
+  public override readonly message = 'Federation credentials are associated with another Identity'
+})()

package/components/identity.federation/source/lib/errors.ts

@@ -1,12 +1,49 @@
-import { Err } from 'error-value'
-
-export const ERR_TRUST = new Err('TRUST', 'Issuer not trusted')
-export const ERR_RESPONSE = new Err('RESPONSE', 'Request to IDP failed')
-export const ERR_CONFIG = new Err('CONFIG', 'Invalid OpenID configuration')
-export const ERR_NO_TOKEN = new Err('NO_TOKEN', 'No ID token received')
-export const ERR_ISS = new Err('ISS', 'Invalid issuer claim')
-export const ERR_SUB = new Err('SUB', 'Invalid subject claim')
-export const ERR_EXP = new Err('EXP', 'Token does not have an expiration time')
-export const ERR_REPLAY = new Err('REPLAY', 'Token has already been used')
-export const ERR_CODE_NOT_ENABLED = new Err('CODE_NOT_ENABLED', 'Authorization code flow is not configured')
-export const ERR_CODE_SCHEMA = new Err('CODE_SCHEMA', 'Invalid code credentials')
+export const ERR_TRUST = new (class TrustError extends Error {
+  public readonly code = 'TRUST'
+  public override readonly message = 'Issuer not trusted'
+})()
+
+export const ERR_RESPONSE = new (class ResponseError extends Error {
+  public readonly code = 'RESPONSE'
+  public override readonly message = 'Request to IDP failed'
+})()
+
+export const ERR_CONFIG = new (class ConfigError extends Error {
+  public readonly code = 'CONFIG'
+  public override readonly message = 'Invalid OpenID configuration'
+})()
+
+export const ERR_NO_TOKEN = new (class NoTokenError extends Error {
+  public readonly code = 'NO_TOKEN'
+  public override readonly message = 'No ID token received'
+})()
+
+export const ERR_ISS = new (class IssError extends Error {
+  public readonly code = 'ISS'
+  public override readonly message = 'Invalid issuer claim'
+})()
+
+export const ERR_SUB = new (class SubError extends Error {
+  public readonly code = 'SUB'
+  public override readonly message = 'Invalid subject claim'
+})()
+
+export const ERR_EXP = new (class ExpError extends Error {
+  public readonly code = 'EXP'
+  public override readonly message = 'Token does not have an expiration time'
+})()
+
+export const ERR_REPLAY = new (class ReplayError extends Error {
+  public readonly code = 'REPLAY'
+  public override readonly message = 'Token has already been used'
+})()
+
+export const ERR_CODE_NOT_ENABLED = new (class CodeNotEnabledError extends Error {
+  public readonly code = 'CODE_NOT_ENABLED'
+  public override readonly message = 'Authorization code flow is not configured'
+})()
+
+export const ERR_CODE_SCHEMA = new (class CodeSchemaError extends Error {
+  public readonly code = 'CODE_SCHEMA'
+  public override readonly message = 'Invalid code credentials'
+})()

package/components/identity.federation/source/lib/exchange.ts

@@ -29,7 +29,7 @@ export async function exchange (credentials: string, ctx: Ctx): Promise<Payload
 
   // array actually is not expected here, but it is a valid format
   const aud = Array.isArray(trusted.aud) ? trusted.aud[0] : trusted.aud
-  const secret = trusted.secret ?? await sign(trusted)
+  const secret = trusted.secret === undefined ? await sign(trusted) : trusted.secret.unwrap()
   const params = new URLSearchParams()
 
   params.append('grant_type', 'authorization_code')
@@ -95,7 +95,7 @@ async function sign (trust: Trust): Promise<string> {
   const signature = trust.signature!
   const aud = Array.isArray(trust.aud) ? trust.aud[0] : trust.aud!
   const now = Math.floor(Date.now() / 1000)
-  const key = await jose.importPKCS8(signature.key, 'ES256')
+  const key = await jose.importPKCS8(signature.key.unwrap(), 'ES256')
 
   return await new jose.SignJWT({})
     .setProtectedHeader({ alg: 'ES256', kid: signature.kid })

package/components/identity.federation/source/types/configuration.ts

@@ -1,3 +1,5 @@
+import type { Secret } from '@toa.io/types'
+
 export interface Configuration {
   trust: Trust[]
   principal?: Principal
@@ -7,11 +9,11 @@ export interface Configuration {
 export interface Trust {
   iss: string
   aud?: string | [string, ...string[]]
-  secret?: string
+  secret?: Secret
   signature?: {
     iss: string
     kid: string
-    key: string
+    key: Secret
   }
 }
 

package/components/identity.keys/manifest.toa.yaml

@@ -4,20 +4,21 @@ name: keys
 entity:
   schema:
     properties:
-      identity: &identity
+      identity:
         type: string
       key:
         type: string
-      label: &label
+      label:
         type: string
         minLength: 1
         maxLength: 64
-      expires: &expires
+      expires:
         type: number
     required:
       - identity
       - key
       - label
+    type: object
   index:
     identity:
       identity: asc
@@ -27,12 +28,18 @@ operations:
     query: false
     input:
       properties:
-        identity: *identity
-        label: *label
-        expires: *expires
+        identity:
+          type: string
+        label:
+          type: string
+          minLength: 1
+          maxLength: 64
+        expires:
+          type: number
       required:
         - identity
         - label
+      type: object
     output:
       properties:
         id:
@@ -42,6 +49,7 @@ operations:
       required:
         - id
         - key
+      type: object
 
 exposition:
   /:identity: