@toa.io/extensions.exposition 1.0.0-alpha.278 → 1.0.0-alpha.282

package/CHANGELOG.md

@@ -3,6 +3,37 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [1.0.0-alpha.282](https://github.com/toa-io/toa/compare/v1.0.0-alpha.281...v1.0.0-alpha.282) (2026-09-03)
+
+### Bug Fixes
+
+* **exposition:** bouncer requires ip ([d470494](https://github.com/toa-io/toa/commit/d470494fdb42372a434d945205e93e27bca8880b))
+* **exposition:** bound OTP guessing ([44b5a6a](https://github.com/toa-io/toa/commit/44b5a6a1f743cca4bd80b0b7e9f9691af83fb2ab))
+* **exposition:** do not delegate the right to delegate ([cf1f83f](https://github.com/toa-io/toa/commit/cf1f83f6bb1051b8b399c632bb81f08a2fd9fb14))
+* **exposition:** keep credentials out of the logs ([17a5529](https://github.com/toa-io/toa/commit/17a55296ec530b6f3c3a1d4e746499e52ef1c126))
+* **exposition:** leave custom tokens unrefreshed ([ebec3d5](https://github.com/toa-io/toa/commit/ebec3d5ea421e8c780f7c7afd781c588851ef8fa))
+* **exposition:** match token permissions on the routed path ([6c888f5](https://github.com/toa-io/toa/commit/6c888f5e51a379c0cdf46e8e3b3b0fa406328de6))
+* **exposition:** name the client address header in the authentication annotation ([433ca3a](https://github.com/toa-io/toa/commit/433ca3ae19bc2c68fa26f6205e559ea7e652fcb9))
+* **exposition:** never key on the connection address ([ad719af](https://github.com/toa-io/toa/commit/ad719afb89455a9cbdb97f144928b233aababb73))
+* **exposition:** quote criteria values built from requests ([af3bf79](https://github.com/toa-io/toa/commit/af3bf794d8668a45a4390ad16ffa04aa4fe078e8))
+* **exposition:** read roles again when a token is refreshed ([96c59ca](https://github.com/toa-io/toa/commit/96c59cae39a1b023e6b2b05720ea0682d4c746ad))
+* **exposition:** read the client address from a header the deployment names ([216c2d8](https://github.com/toa-io/toa/commit/216c2d8f21bdb67c7d4387708c80f806f1c72360))
+* **exposition:** refuse rejected credentials before inception ([48e76a8](https://github.com/toa-io/toa/commit/48e76a8f421b95492d256b5c7a9ca61f71f0d7fd))
+* **exposition:** require the audience of a trusted issuer ([0d13604](https://github.com/toa-io/toa/commit/0d13604e3707ed2fcac01500beb27d992314c549))
+* **exposition:** resolve an authentication scheme by its own name only ([ae116d1](https://github.com/toa-io/toa/commit/ae116d1813fc1e5a42b5263daedb752703eb08f0))
+* **exposition:** resolve the client address once, into the request context ([2f36347](https://github.com/toa-io/toa/commit/2f36347d948bab0c421ff63105312549fffc660a))
+* **exposition:** revoke custom tokens through their keys ([359d882](https://github.com/toa-io/toa/commit/359d8825315fce010ea8ac3700d2778b48362f72))
+* **exposition:** revoke custom tokens when a role is revoked ([191a0c6](https://github.com/toa-io/toa/commit/191a0c603ef53dcab5ccd005dd7296d9c9bfaa0b))
+* **exposition:** scope the principal to an authority ([98a0d36](https://github.com/toa-io/toa/commit/98a0d36267523eb1a1aa58742744cd39a21e94e9))
+* **exposition:** split Basic credentials at the first colon ([596e5dc](https://github.com/toa-io/toa/commit/596e5dc2e6e589007dc7914374e1592ecc71c997))
+* **exposition:** validate the request authority ([68686c9](https://github.com/toa-io/toa/commit/68686c9340effb148532607caa1abbaaa5dc0519))
+
+### Features
+
+* **core:** a Host for extensions ([6315eac](https://github.com/toa-io/toa/commit/6315eac1e9fb05be472272de06385c54ad5934ce))
+* **exposition:** meter failed authentications per address ([98b07d3](https://github.com/toa-io/toa/commit/98b07d307815ee4a2a0f30f189cbcfc9d78a4d62))
+
+
 # [1.0.0-alpha.278](https://github.com/toa-io/toa/compare/v1.0.0-alpha.277...v1.0.0-alpha.278) (2026-09-03)
 
 **Note:** Version bump only for package @toa.io/extensions.exposition

package/components/identity.basic/events/principal.js

@@ -1,5 +1,9 @@
 export const condition = function (event, context) {
-  return event.state.username === context.configuration.principal
+  const principal = context.configuration.principal
+
+  return principal !== undefined &&
+    event.state.authority === principal.authority &&
+    event.state.username === principal.username
 }
 
 export const payload = function (event) {

package/components/identity.basic/manifest.toa.yaml

@@ -172,7 +172,17 @@ configuration:
         description: Hashing pepper, a secret
         type: string
       principal:
-        type: string
+        description: Basic credentials whose Identity is granted the `system` role
+        type: object
+        properties:
+          authority:
+            type: string
+          username:
+            type: string
+        required:
+          - authority
+          - username
+        additionalProperties: false
       username:
         type: array
         items:

package/components/identity.basic/operations/authenticate.js

@@ -1,10 +1,14 @@
 import { compare } from 'bcryptjs';
+import { quote } from '@toa.io/generic';
+import { split } from './lib/credentials.js';
 export async function computation(input, context) {
-    const [username, password] = Buffer
-        .from(input.credentials, 'base64')
-        .toString()
-        .split(':');
-    const query = { criteria: `authority==${input.authority};username=='${username}'` };
+    const pair = split(input.credentials);
+    if (pair === null)
+        return ERR_NOT_FOUND;
+    const [username, password] = pair;
+    const query = {
+        criteria: `authority==${quote(input.authority)};username==${quote(username)}`
+    };
     const credentials = await context.local.observe({ query });
     if (credentials instanceof Error)
         return credentials;

package/components/identity.basic/operations/authenticate.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../source/authenticate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAIlC,MAAM,CAAC,KAAK,UAAU,WAAW,CAAE,KAAY,EAAE,OAAgB;IAC/D,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM;SAChC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC;SACjC,QAAQ,EAAE;SACV,KAAK,CAAC,GAAG,CAAC,CAAA;IAEb,MAAM,KAAK,GAAU,EAAE,QAAQ,EAAE,cAAc,KAAK,CAAC,SAAS,eAAe,QAAQ,GAAG,EAAE,CAAA;IAC1F,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IAE1D,IAAI,WAAW,YAAY,KAAK;QAC9B,OAAO,WAAW,CAAA;IAEpB,IAAI,WAAW,KAAK,IAAI;QACtB,OAAO,aAAa,CAAA;IAEtB,MAAM,KAAK,GAAG,QAAQ,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACvE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAA;IAExD,IAAI,KAAK;QACP,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE,CAAA;;QAE3C,OAAO,qBAAqB,CAAA;AAChC,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,aAAc,SAAQ,KAAK;IAC1C,IAAI,GAAG,WAAW,CAAA;CACnC,CAAC,EAAE,CAAA;AAEJ,MAAM,qBAAqB,GAAG,IAAI,CAAC,MAAM,qBAAsB,SAAQ,KAAK;IAC1D,IAAI,GAAG,mBAAmB,CAAA;CAC3C,CAAC,EAAE,CAAA"}
+{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../source/authenticate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAClC,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAEvC,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAG5C,MAAM,CAAC,KAAK,UAAU,WAAW,CAAE,KAAY,EAAE,OAAgB;IAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IAErC,IAAI,IAAI,KAAK,IAAI;QACf,OAAO,aAAa,CAAA;IAEtB,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAA;IAEjC,MAAM,KAAK,GAAU;QACnB,QAAQ,EAAE,cAAc,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,cAAc,KAAK,CAAC,QAAQ,CAAC,EAAE;KAC9E,CAAA;IACD,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IAE1D,IAAI,WAAW,YAAY,KAAK;QAC9B,OAAO,WAAW,CAAA;IAEpB,IAAI,WAAW,KAAK,IAAI;QACtB,OAAO,aAAa,CAAA;IAEtB,MAAM,KAAK,GAAG,QAAQ,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACvE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAA;IAExD,IAAI,KAAK;QACP,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE,CAAA;;QAE3C,OAAO,qBAAqB,CAAA;AAChC,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,aAAc,SAAQ,KAAK;IAC1C,IAAI,GAAG,WAAW,CAAA;CACnC,CAAC,EAAE,CAAA;AAEJ,MAAM,qBAAqB,GAAG,IAAI,CAAC,MAAM,qBAAsB,SAAQ,KAAK;IAC1D,IAAI,GAAG,mBAAmB,CAAA;CAC3C,CAAC,EAAE,CAAA"}

package/components/identity.basic/operations/check.js

@@ -1,7 +1,8 @@
+import { quote } from '@toa.io/generic';
 export async function computation(input, context) {
     const username = Buffer.from(input.username, 'base64url').toString();
     const found = await context.local.observe({
-        query: { criteria: `authority==${input.authority};username=='${username}'` }
+        query: { criteria: `authority==${quote(input.authority)};username==${quote(username)}` }
     });
     if (found instanceof Error)
         return found;

package/components/identity.basic/operations/check.js.map

@@ -1 +1 @@
-{"version":3,"file":"check.js","sourceRoot":"","sources":["../source/check.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,KAAK,UAAU,WAAW,CAAE,KAAY,EAAE,OAAgB;IAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAA;IAEpE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACxC,KAAK,EAAE,EAAE,QAAQ,EAAE,cAAc,KAAK,CAAC,SAAS,eAAe,QAAQ,GAAG,EAAE;KAC7E,CAAC,CAAA;IAEF,IAAI,KAAK,YAAY,KAAK;QACxB,OAAO,KAAK,CAAA;IAEd,IAAI,KAAK,KAAK,IAAI;QAChB,OAAO,IAAI,CAAA;AACf,CAAC"}
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../source/check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAGvC,MAAM,CAAC,KAAK,UAAU,WAAW,CAAE,KAAY,EAAE,OAAgB;IAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAA;IAEpE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACxC,KAAK,EAAE,EAAE,QAAQ,EAAE,cAAc,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,cAAc,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE;KACzF,CAAC,CAAA;IAEF,IAAI,KAAK,YAAY,KAAK;QACxB,OAAO,KAAK,CAAA;IAEd,IAAI,KAAK,KAAK,IAAI;QAChB,OAAO,IAAI,CAAA;AACf,CAAC"}

package/components/identity.basic/operations/incept.js

@@ -1,10 +1,9 @@
+import { split } from './lib/credentials.js';
 export async function effect(input, context) {
-    const [username, password] = Buffer
-        .from(input.credentials, 'base64')
-        .toString()
-        .split(':');
-    if (typeof password !== 'string')
+    const pair = split(input.credentials);
+    if (pair === null)
         return INVALID_CREDENTIALS;
+    const [username, password] = pair;
     const request = {
         input: {
             authority: input.authority,

package/components/identity.basic/operations/incept.js.map

@@ -1 +1 @@
-{"version":3,"file":"incept.js","sourceRoot":"","sources":["../source/incept.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,KAAK,UAAU,MAAM,CAAE,KAAY,EAAE,OAAgB;IAC1D,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM;SAChC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC;SACjC,QAAQ,EAAE;SACV,KAAK,CAAC,GAAG,CAAC,CAAA;IAEb,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAC9B,OAAO,mBAAmB,CAAA;IAE5B,MAAM,OAAO,GAAG;QACd,KAAK,EAAE;YACL,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ;YACR,QAAQ;SACT;QACD,KAAK,EAAE;YACL,EAAE,EAAE,KAAK,CAAC,EAAE;SACb;KACF,CAAA;IAED,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;AAC7C,CAAC;AAED,MAAM,mBAAmB,GAAG,IAAI,CAAC,MAAM,uBAAwB,SAAQ,KAAK;IAC1D,IAAI,GAAG,qBAAqB,CAAA;CAC7C,CAAC,EAAE,CAAA"}
+{"version":3,"file":"incept.js","sourceRoot":"","sources":["../source/incept.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAI5C,MAAM,CAAC,KAAK,UAAU,MAAM,CAAE,KAAY,EAAE,OAAgB;IAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IAErC,IAAI,IAAI,KAAK,IAAI;QACf,OAAO,mBAAmB,CAAA;IAE5B,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAA;IAEjC,MAAM,OAAO,GAAG;QACd,KAAK,EAAE;YACL,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ;YACR,QAAQ;SACT;QACD,KAAK,EAAE;YACL,EAAE,EAAE,KAAK,CAAC,EAAE;SACb;KACF,CAAA;IAED,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;AAC7C,CAAC;AAED,MAAM,mBAAmB,GAAG,IAAI,CAAC,MAAM,uBAAwB,SAAQ,KAAK;IAC1D,IAAI,GAAG,qBAAqB,CAAA;CAC7C,CAAC,EAAE,CAAA"}

package/components/identity.basic/operations/lib/credentials.d.ts

@@ -0,0 +1,5 @@
+/**
+ * The user-id and the password of Basic credentials. RFC 7617 forbids a colon in the
+ * user-id and allows any number of them in the password, so the split is at the first one.
+ */
+export declare function split(credentials: string): [string, string] | null;

package/components/identity.basic/operations/lib/credentials.js

@@ -0,0 +1,12 @@
+/**
+ * The user-id and the password of Basic credentials. RFC 7617 forbids a colon in the
+ * user-id and allows any number of them in the password, so the split is at the first one.
+ */
+export function split(credentials) {
+    const decoded = Buffer.from(credentials, 'base64').toString();
+    const colon = decoded.indexOf(':');
+    if (colon === -1)
+        return null;
+    return [decoded.slice(0, colon), decoded.slice(colon + 1)];
+}
+//# sourceMappingURL=credentials.js.map

package/components/identity.basic/operations/lib/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../source/lib/credentials.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,KAAK,CAAE,WAAmB;IACxC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAElC,IAAI,KAAK,KAAK,CAAC,CAAC;QACd,OAAO,IAAI,CAAA;IAEb,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;AAC5D,CAAC"}

package/components/identity.basic/operations/transit.d.ts

@@ -5,8 +5,10 @@ export declare class Transition implements Operation {
     private pepper;
     private principal?;
     private tokens;
+    private keys;
     private usernameRx;
     private passwordRx;
     mount(context: Context): void;
+    private locked;
     execute(input: TransitInput, object: Entity): Promise<Maybe<IdOutput>>;
 }

package/components/identity.basic/operations/transit.js

@@ -4,6 +4,7 @@ export class Transition {
     pepper = '';
     principal;
     tokens = undefined;
+    keys = undefined;
     usernameRx = [];
     passwordRx = [];
     mount(context) {
@@ -11,21 +12,30 @@ export class Transition {
         this.pepper = context.configuration.pepper?.unwrap() ?? '';
         this.principal = context.configuration.principal;
         this.tokens = context.remote.identity.tokens;
+        this.keys = context.remote.identity.keys;
         this.usernameRx = toRx(context.configuration.username);
         this.passwordRx = toRx(context.configuration.password);
     }
+    locked(object) {
+        return this.principal !== undefined &&
+            object.authority === this.principal.authority &&
+            object.username === this.principal.username;
+    }
     async execute(input, object) {
         const deleted = object._deleted !== undefined && object._deleted !== null;
         const existent = object._version !== 0 && !deleted;
         if (existent) {
             if (input.inception === true)
                 return ERR_EXISTS;
-            await this.tokens.revoke({ query: { id: object.id } });
+            await Promise.all([
+                this.tokens.revoke({ query: { id: object.id } }),
+                this.keys.revoke({ input: { identity: object.id } })
+            ]);
         }
         else
             object.authority = input.authority;
         if (input.username !== undefined) {
-            if (existent && object.username === this.principal)
+            if (existent && this.locked(object))
                 return ERR_PRINCIPAL_LOCKED;
             if (invalid(input.username, this.usernameRx))
                 return ERR_INVALID_USERNAME;

package/components/identity.basic/operations/transit.js.map

@@ -1 +1 @@
-{"version":3,"file":"transit.js","sourceRoot":"","sources":["../source/transit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAIxC,MAAM,OAAO,UAAU;IACb,MAAM,GAAW,EAAE,CAAA;IACnB,MAAM,GAAW,EAAE,CAAA;IACnB,SAAS,CAAS;IAClB,MAAM,GAAW,SAA8B,CAAA;IAC/C,UAAU,GAAa,EAAE,CAAA;IACzB,UAAU,GAAa,EAAE,CAAA;IAE1B,KAAK,CAAE,OAAgB;QAC5B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAA;QAC1C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;QAC1D,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,SAAS,CAAA;QAChD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAA;QAE5C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAA;QACtD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAA;IACxD,CAAC;IAEM,KAAK,CAAC,OAAO,CAAE,KAAmB,EAAE,MAAc;QACvD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAA;QACzE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,OAAO,CAAA;QAElD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI;gBAC1B,OAAO,UAAU,CAAA;YAEnB,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QACxD,CAAC;;YACC,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAA;QAEpC,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS;gBAChD,OAAO,oBAAoB,CAAA;YAE7B,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;gBAC1C,OAAO,oBAAoB,CAAA;YAE7B,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;QAClC,CAAC;QAED,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;gBAC1C,OAAO,oBAAoB,CAAA;YAE7B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACvC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAA;YAE1C,MAAM,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QAC3C,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAA;IAC1B,CAAC;CACF;AAED,SAAS,IAAI,CAAE,WAAqB;IAClC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAA;AAChE,CAAC;AAED,SAAS,OAAO,CAAE,KAAa,EAAE,WAAqB;IACpD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;AAClE,CAAC;AAED,MAAM,oBAAoB,GAAG,IAAI,CAAC,MAAM,oBAAqB,SAAQ,KAAK;IACxD,IAAI,GAAG,kBAAkB,CAAA;IAChB,OAAO,GAAG,sCAAsC,CAAA;CAC1E,CAAC,EAAE,CAAA;AAEJ,MAAM,oBAAoB,GAAG,IAAI,CAAC,MAAM,oBAAqB,SAAQ,KAAK;IACxD,IAAI,GAAG,kBAAkB,CAAA;IAChB,OAAO,GAAG,0CAA0C,CAAA;CAC9E,CAAC,EAAE,CAAA;AAEJ,MAAM,oBAAoB,GAAG,IAAI,CAAC,MAAM,oBAAqB,SAAQ,KAAK;IACxD,IAAI,GAAG,kBAAkB,CAAA;IAChB,OAAO,GAAG,0CAA0C,CAAA;CAC9E,CAAC,EAAE,CAAA;AAEJ,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,WAAY,SAAQ,KAAK;IACrC,IAAI,GAAG,QAAQ,CAAA;IACN,OAAO,GAAG,iCAAiC,CAAA;CACrE,CAAC,EAAE,CAAA"}
+{"version":3,"file":"transit.js","sourceRoot":"","sources":["../source/transit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAIxC,MAAM,OAAO,UAAU;IACb,MAAM,GAAW,EAAE,CAAA;IACnB,MAAM,GAAW,EAAE,CAAA;IACnB,SAAS,CAAY;IACrB,MAAM,GAAW,SAA8B,CAAA;IAC/C,IAAI,GAAS,SAA4B,CAAA;IACzC,UAAU,GAAa,EAAE,CAAA;IACzB,UAAU,GAAa,EAAE,CAAA;IAE1B,KAAK,CAAE,OAAgB;QAC5B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAA;QAC1C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;QAC1D,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,SAAS,CAAA;QAChD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAA;QAC5C,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAA;QAExC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAA;QACtD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAA;IACxD,CAAC;IAEO,MAAM,CAAE,MAAc;QAC5B,OAAO,IAAI,CAAC,SAAS,KAAK,SAAS;YACjC,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC,SAAS;YAC7C,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAA;IAC/C,CAAC;IAEM,KAAK,CAAC,OAAO,CAAE,KAAmB,EAAE,MAAc;QACvD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAA;QACzE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,OAAO,CAAA;QAElD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI;gBAC1B,OAAO,UAAU,CAAA;YAEnB,MAAM,OAAO,CAAC,GAAG,CAAC;gBAChB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC;gBAChD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC;aACrD,CAAC,CAAA;QACJ,CAAC;;YACC,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAA;QAEpC,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;gBACjC,OAAO,oBAAoB,CAAA;YAE7B,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;gBAC1C,OAAO,oBAAoB,CAAA;YAE7B,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;QAClC,CAAC;QAED,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;gBAC1C,OAAO,oBAAoB,CAAA;YAE7B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACvC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAA;YAE1C,MAAM,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QAC3C,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAA;IAC1B,CAAC;CACF;AAED,SAAS,IAAI,CAAE,WAAqB;IAClC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAA;AAChE,CAAC;AAED,SAAS,OAAO,CAAE,KAAa,EAAE,WAAqB;IACpD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;AAClE,CAAC;AAED,MAAM,oBAAoB,GAAG,IAAI,CAAC,MAAM,oBAAqB,SAAQ,KAAK;IACxD,IAAI,GAAG,kBAAkB,CAAA;IAChB,OAAO,GAAG,sCAAsC,CAAA;CAC1E,CAAC,EAAE,CAAA;AAEJ,MAAM,oBAAoB,GAAG,IAAI,CAAC,MAAM,oBAAqB,SAAQ,KAAK;IACxD,IAAI,GAAG,kBAAkB,CAAA;IAChB,OAAO,GAAG,0CAA0C,CAAA;CAC9E,CAAC,EAAE,CAAA;AAEJ,MAAM,oBAAoB,GAAG,IAAI,CAAC,MAAM,oBAAqB,SAAQ,KAAK;IACxD,IAAI,GAAG,kBAAkB,CAAA;IAChB,OAAO,GAAG,0CAA0C,CAAA;CAC9E,CAAC,EAAE,CAAA;AAEJ,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,WAAY,SAAQ,KAAK;IACrC,IAAI,GAAG,QAAQ,CAAA;IACN,OAAO,GAAG,iCAAiC,CAAA;CACrE,CAAC,EAAE,CAAA"}

package/components/identity.basic/operations/types.d.ts

@@ -11,16 +11,23 @@ export interface Context {
             tokens: {
                 revoke: Call<void, IdentityTokensRevokeInput>;
             };
+            keys: {
+                revoke: Call<void, IdentityKeysRevokeInput>;
+            };
         };
     };
     configuration: {
         readonly rounds: number;
         readonly pepper?: Secret;
-        readonly principal?: string;
+        readonly principal?: Principal;
         readonly username: string[];
         readonly password: string[];
     };
 }
+export interface Principal {
+    authority: string;
+    username: string;
+}
 export interface Entity {
     id: string;
     authority: string;
@@ -48,4 +55,7 @@ export interface IdOutput {
 interface IdentityTokensRevokeInput {
     query: Query;
 }
+interface IdentityKeysRevokeInput {
+    identity: string;
+}
 export {};

package/components/identity.basic/source/authenticate.ts

@@ -1,14 +1,20 @@
 import { compare } from 'bcryptjs'
+import { quote } from '@toa.io/generic'
 import { type Query, type Maybe } from '@toa.io/types'
+import { split } from './lib/credentials.js'
 import { type Context } from './types.js'
 
 export async function computation (input: Input, context: Context): Promise<Maybe<Output>> {
-  const [username, password] = Buffer
-    .from(input.credentials, 'base64')
-    .toString()
-    .split(':')
+  const pair = split(input.credentials)
 
-  const query: Query = { criteria: `authority==${input.authority};username=='${username}'` }
+  if (pair === null)
+    return ERR_NOT_FOUND
+
+  const [username, password] = pair
+
+  const query: Query = {
+    criteria: `authority==${quote(input.authority)};username==${quote(username)}`
+  }
   const credentials = await context.local.observe({ query })
 
   if (credentials instanceof Error)

package/components/identity.basic/source/check.ts

@@ -1,10 +1,11 @@
+import { quote } from '@toa.io/generic'
 import type { Context } from './types.js'
 
 export async function computation (input: Input, context: Context): Promise<void | null | Error> {
   const username = Buffer.from(input.username, 'base64url').toString()
 
   const found = await context.local.observe({
-    query: { criteria: `authority==${input.authority};username=='${username}'` }
+    query: { criteria: `authority==${quote(input.authority)};username==${quote(username)}` }
   })
 
   if (found instanceof Error)

package/components/identity.basic/source/incept.ts

@@ -1,15 +1,15 @@
+import { split } from './lib/credentials.js'
 import type { Context } from './types.js'
 import type { Maybe } from '@toa.io/types'
 
 export async function effect (input: Input, context: Context): Promise<Maybe<Output>> {
-  const [username, password] = Buffer
-    .from(input.credentials, 'base64')
-    .toString()
-    .split(':')
+  const pair = split(input.credentials)
 
-  if (typeof password !== 'string')
+  if (pair === null)
     return INVALID_CREDENTIALS
 
+  const [username, password] = pair
+
   const request = {
     input: {
       authority: input.authority,

package/components/identity.basic/source/lib/credentials.test.ts

@@ -0,0 +1,18 @@
+import { it } from 'node:test'
+import assert from 'node:assert/strict'
+
+import { split } from './credentials.js'
+
+const encode = (value: string): string => Buffer.from(value).toString('base64')
+
+it('should split at the first colon', () => {
+  assert.deepEqual(split(encode('user:pa:ss:word')), ['user', 'pa:ss:word'])
+})
+
+it('should accept an empty password', () => {
+  assert.deepEqual(split(encode('user:')), ['user', ''])
+})
+
+it('should refuse credentials without a colon', () => {
+  assert.equal(split(encode('user')), null)
+})

package/components/identity.basic/source/lib/credentials.ts

@@ -0,0 +1,13 @@
+/**
+ * The user-id and the password of Basic credentials. RFC 7617 forbids a colon in the
+ * user-id and allows any number of them in the password, so the split is at the first one.
+ */
+export function split (credentials: string): [string, string] | null {
+  const decoded = Buffer.from(credentials, 'base64').toString()
+  const colon = decoded.indexOf(':')
+
+  if (colon === -1)
+    return null
+
+  return [decoded.slice(0, colon), decoded.slice(colon + 1)]
+}

package/components/identity.basic/source/transit.ts

@@ -1,12 +1,13 @@
 import { genSalt, hash } from 'bcryptjs'
 import type { Maybe, Operation } from '@toa.io/types'
-import type { Context, Entity, TransitInput, IdOutput } from './types.js'
+import type { Context, Entity, Principal, TransitInput, IdOutput } from './types.js'
 
 export class Transition implements Operation {
   private rounds: number = 10
   private pepper: string = ''
-  private principal?: string
+  private principal?: Principal
   private tokens: Tokens = undefined as unknown as Tokens
+  private keys: Keys = undefined as unknown as Keys
   private usernameRx: RegExp[] = []
   private passwordRx: RegExp[] = []
 
@@ -15,11 +16,18 @@ export class Transition implements Operation {
     this.pepper = context.configuration.pepper?.unwrap() ?? ''
     this.principal = context.configuration.principal
     this.tokens = context.remote.identity.tokens
+    this.keys = context.remote.identity.keys
 
     this.usernameRx = toRx(context.configuration.username)
     this.passwordRx = toRx(context.configuration.password)
   }
 
+  private locked (object: Entity): boolean {
+    return this.principal !== undefined &&
+      object.authority === this.principal.authority &&
+      object.username === this.principal.username
+  }
+
   public async execute (input: TransitInput, object: Entity): Promise<Maybe<IdOutput>> {
     const deleted = object._deleted !== undefined && object._deleted !== null
     const existent = object._version !== 0 && !deleted
@@ -28,12 +36,15 @@ export class Transition implements Operation {
       if (input.inception === true)
         return ERR_EXISTS
 
-      await this.tokens.revoke({ query: { id: object.id } })
+      await Promise.all([
+        this.tokens.revoke({ query: { id: object.id } }),
+        this.keys.revoke({ input: { identity: object.id } })
+      ])
     } else
       object.authority = input.authority
 
     if (input.username !== undefined) {
-      if (existent && object.username === this.principal)
+      if (existent && this.locked(object))
         return ERR_PRINCIPAL_LOCKED
 
       if (invalid(input.username, this.usernameRx))
@@ -85,3 +96,4 @@ const ERR_EXISTS = new (class ExistsError extends Error {
 })()
 
 type Tokens = Context['remote']['identity']['tokens']
+type Keys = Context['remote']['identity']['keys']

package/components/identity.basic/source/types.ts

@@ -12,17 +12,25 @@ export interface Context {
       tokens: {
         revoke: Call<void, IdentityTokensRevokeInput>
       }
+      keys: {
+        revoke: Call<void, IdentityKeysRevokeInput>
+      }
     }
   }
   configuration: {
     readonly rounds: number
     readonly pepper?: Secret
-    readonly principal?: string
+    readonly principal?: Principal
     readonly username: string[]
     readonly password: string[]
   }
 }
 
+export interface Principal {
+  authority: string
+  username: string
+}
+
 export interface Entity {
   id: string
   authority: string
@@ -55,3 +63,7 @@ export interface IdOutput {
 interface IdentityTokensRevokeInput {
   query: Query
 }
+
+interface IdentityKeysRevokeInput {
+  identity: string
+}