@toa.io/extensions.exposition 1.0.0-alpha.28 → 1.0.0-alpha.282

package/components/identity.federation/operations/decode.js

@@ -0,0 +1,9 @@
+import { decode } from './lib/index.js';
+export async function effect(token, context) {
+    return await decode(token, {
+        trust: context.configuration.trust,
+        logs: context.logs,
+        fetch: context.fetch
+    });
+}
+//# sourceMappingURL=decode.js.map

package/components/identity.federation/operations/decode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decode.js","sourceRoot":"","sources":["../source/decode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAIvC,MAAM,CAAC,KAAK,UAAU,MAAM,CAAE,KAAa,EAAE,OAAgB;IAC3D,OAAO,MAAM,MAAM,CAAC,KAAK,EAAE;QACzB,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,KAAK;QAClC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAA;AACJ,CAAC"}

package/components/identity.federation/operations/delete.d.ts

@@ -0,0 +1,8 @@
+import type { Context } from './types/index.js';
+export declare function effect({ authority, identity, credential }: Input, context: Context): Promise<void | null>;
+interface Input {
+    authority: string;
+    identity: string;
+    credential: string;
+}
+export {};

package/components/identity.federation/operations/delete.js

@@ -0,0 +1,7 @@
+export async function effect({ authority, identity, credential }, context) {
+    const object = await context.local.observe({ query: { id: credential } });
+    if (object === null || object.authority !== authority || object.identity !== identity)
+        return null;
+    return await context.local.terminate({ query: { id: credential } });
+}
+//# sourceMappingURL=delete.js.map

package/components/identity.federation/operations/delete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.js","sourceRoot":"","sources":["../source/delete.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,KAAK,UAAU,MAAM,CAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAS,EAAE,OAAgB;IACxF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;IAEzE,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QACnF,OAAO,IAAI,CAAA;IAEb,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;AACrE,CAAC"}

package/components/identity.federation/operations/incept.d.ts

@@ -1,11 +1,11 @@
-import type { Context } from './types';
-interface Input {
+import type { Context, Scheme } from './types/index.js';
+export declare function effect(input: Input, context: Context): Promise<Output | Error>;
+export interface Input {
     authority: string;
+    scheme: Scheme;
     credentials: string;
-    id?: string;
+    id: string;
 }
-interface Output {
+export interface Output {
     id: string;
 }
-export declare const effect: (input: Input, context: Context) => Promise<Error | Promise<Output>>;
-export {};

package/components/identity.federation/operations/incept.js

@@ -1,14 +1,6 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.effect = void 0;
-const assertions_as_values_js_1 = require("./lib/assertions-as-values.js");
-const jwt_1 = require("./lib/jwt");
-async function incept(input, context) {
-    const { iss, sub } = await (0, jwt_1.validateIdToken)(input.credentials, context.configuration.trust);
-    const request = { input: { authority: input.authority, iss, sub } };
-    if (input.id !== undefined)
-        request.query = { id: input.id };
-    return await context.local.transit(request);
+import { effect as create } from './create.js';
+export async function effect(input, context) {
+    const credential = await create(input, context);
+    return credential instanceof Error ? credential : { id: credential.identity };
 }
-exports.effect = (0, assertions_as_values_js_1.assertionsAsValues)(incept);
 //# sourceMappingURL=incept.js.map

package/components/identity.federation/operations/incept.js.map

@@ -1 +1 @@
-{"version":3,"file":"incept.js","sourceRoot":"","sources":["../source/incept.ts"],"names":[],"mappings":";;;AAAA,2EAAkE;AAClE,mCAA2C;AAI3C,KAAK,UAAU,MAAM,CAAE,KAAY,EAAE,OAAgB;IACnD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,IAAA,qBAAe,EAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;IAE1F,MAAM,OAAO,GAAY,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,EAA+B,EAAE,CAAA;IAEzG,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS;QACxB,OAAO,CAAC,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAA;IAElC,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;AAC7C,CAAC;AAYY,QAAA,MAAM,GAAG,IAAA,4CAAkB,EAAC,MAAM,CAAC,CAAA"}
+{"version":3,"file":"incept.js","sourceRoot":"","sources":["../source/incept.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,MAAM,EAAE,MAAM,aAAa,CAAA;AAG9C,MAAM,CAAC,KAAK,UAAU,MAAM,CAAE,KAAY,EAAE,OAAgB;IAC1D,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAE/C,OAAO,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAA;AAC/E,CAAC"}

package/components/identity.federation/operations/lib/Configuration.d.ts

@@ -0,0 +1,39 @@
+export interface Configuration extends Record<string, unknown> {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    userinfo_endpoint: string;
+    jwks_uri: string;
+    registration_endpoint?: string;
+    scopes_supported?: string[];
+    response_types_supported: string[];
+    response_modes_supported?: string[];
+    grant_types_supported?: string[];
+    acr_values_supported?: string[];
+    subject_types_supported: string[];
+    id_token_signing_alg_values_supported: string[];
+    id_token_encryption_alg_values_supported?: string[];
+    id_token_encryption_enc_values_supported?: string[];
+    userinfo_signing_alg_values_supported?: string[];
+    userinfo_encryption_alg_values_supported?: string[];
+    userinfo_encryption_enc_values_supported?: string[];
+    request_object_signing_alg_values_supported?: string[];
+    request_object_encryption_alg_values_supported?: string[];
+    request_object_encryption_enc_values_supported?: string[];
+    token_endpoint_auth_methods_supported?: string[];
+    token_endpoint_auth_signing_alg_values_supported?: string[];
+    display_values_supported?: string[];
+    claim_types_supported?: string[];
+    claims_supported?: string[];
+    service_documentation?: string;
+    claims_locales_supported?: string[];
+    ui_locales_supported?: string[];
+    claims_parameter_supported?: boolean;
+    request_parameter_supported?: boolean;
+    request_uri_parameter_supported?: boolean;
+    require_request_uri_registration?: boolean;
+    op_policy_uri?: string;
+    op_tos_uri?: string;
+    check_session_iframe?: string;
+    end_session_endpoint?: string;
+}

package/components/identity.federation/operations/lib/Configuration.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=Configuration.js.map

package/components/identity.federation/operations/lib/Configuration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Configuration.js","sourceRoot":"","sources":["../../source/lib/Configuration.ts"],"names":[],"mappings":""}

package/components/identity.federation/operations/lib/Ctx.d.ts

@@ -0,0 +1,8 @@
+import type { telemetry } from '@toa.io/types';
+import type { Trust } from '../types/index.js';
+import type { Fetch } from '../types/context.js';
+export interface Ctx {
+    trust: Trust[];
+    logs: telemetry.Logs;
+    fetch: Fetch;
+}

package/components/identity.federation/operations/lib/Ctx.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=Ctx.js.map

package/components/identity.federation/operations/lib/Ctx.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Ctx.js","sourceRoot":"","sources":["../../source/lib/Ctx.ts"],"names":[],"mappings":""}

package/components/identity.federation/operations/lib/Payload.d.ts

@@ -0,0 +1,5 @@
+import type * as jose from 'jose';
+export interface Payload extends jose.JWTPayload {
+    iss: string;
+    sub: string;
+}

package/components/identity.federation/operations/lib/Payload.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=Payload.js.map

package/components/identity.federation/operations/lib/Payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Payload.js","sourceRoot":"","sources":["../../source/lib/Payload.ts"],"names":[],"mappings":""}

package/components/identity.federation/operations/lib/decode.d.ts

@@ -0,0 +1,3 @@
+import type { Ctx } from './Ctx.js';
+import type { Payload } from './Payload.js';
+export declare function decode(token: string, ctx: Ctx): Promise<Payload | Error>;

package/components/identity.federation/operations/lib/decode.js

@@ -0,0 +1,22 @@
+import { load } from './jose.js';
+import { createRemoteJWKSet } from './discovery.js';
+import { ERR_TRUST, ERR_ISS, ERR_SUB } from './errors.js';
+export async function decode(token, ctx) {
+    const jose = await load();
+    const { iss, sub } = jose.decodeJwt(token);
+    if (typeof iss !== 'string')
+        return ERR_ISS;
+    if (typeof sub !== 'string')
+        return ERR_SUB;
+    const trusted = ctx.trust.find((trust) => trust.iss === iss);
+    if (trusted === undefined)
+        return ERR_TRUST;
+    const jwks = await createRemoteJWKSet(iss, ctx.fetch);
+    const { payload } = await jose.jwtVerify(token, jwks, {
+        issuer: iss,
+        audience: trusted.aud,
+        requiredClaims: ['exp']
+    });
+    return payload;
+}
+//# sourceMappingURL=decode.js.map

package/components/identity.federation/operations/lib/decode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decode.js","sourceRoot":"","sources":["../../source/lib/decode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAIzD,MAAM,CAAC,KAAK,UAAU,MAAM,CAAE,KAAa,EAAE,GAAQ;IACnD,MAAM,IAAI,GAAG,MAAM,IAAI,EAAE,CAAA;IACzB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAE1C,IAAI,OAAO,GAAG,KAAK,QAAQ;QACzB,OAAO,OAAO,CAAA;IAEhB,IAAI,OAAO,GAAG,KAAK,QAAQ;QACzB,OAAO,OAAO,CAAA;IAEhB,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;IAE5D,IAAI,OAAO,KAAK,SAAS;QACvB,OAAO,SAAS,CAAA;IAElB,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;IAErD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;QACpD,MAAM,EAAE,GAAG;QACX,QAAQ,EAAE,OAAO,CAAC,GAAG;QACrB,cAAc,EAAE,CAAC,KAAK,CAAC;KACxB,CAAC,CAAA;IAEF,OAAO,OAAkB,CAAA;AAC3B,CAAC"}

package/components/identity.federation/operations/lib/discovery.d.ts

@@ -0,0 +1,5 @@
+import type * as jose from 'jose';
+import type { Configuration } from './Configuration.js';
+import type { Fetch } from '../types/context.js';
+export declare function discover(iss: string, fetch: Fetch): Promise<Configuration>;
+export declare function createRemoteJWKSet(iss: string, fetch: Fetch): Promise<jose.RemoteJWKSet>;

package/components/identity.federation/operations/lib/discovery.js

@@ -0,0 +1,34 @@
+import { load } from './jose.js';
+const cache = new Map();
+const resolvers = new WeakMap();
+export async function discover(iss, fetch) {
+    if (!cache.has(iss)) {
+        const configuration = await fetchConfiguration(iss, fetch);
+        cache.set(iss, configuration);
+    }
+    return cache.get(iss);
+}
+async function fetchConfiguration(iss, fetch) {
+    const response = await fetch(`${iss}/.well-known/openid-configuration`);
+    if (!response.ok)
+        throw new Error('Failed to fetch OIDC configuration');
+    return await response.json();
+}
+export async function createRemoteJWKSet(iss, fetch) {
+    let entries = resolvers.get(fetch);
+    if (entries === undefined) {
+        entries = new Map();
+        resolvers.set(fetch, entries);
+    }
+    if (!entries.has(iss))
+        entries.set(iss, create(iss, fetch));
+    return await entries.get(iss);
+}
+async function create(iss, fetch) {
+    const jose = await load();
+    const configuration = await discover(iss, fetch);
+    return jose.createRemoteJWKSet(new URL(configuration.jwks_uri), {
+        [jose.customFetch]: fetch
+    });
+}
+//# sourceMappingURL=discovery.js.map

package/components/identity.federation/operations/lib/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../source/lib/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAKhC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAA;AAC9C,MAAM,SAAS,GAAG,IAAI,OAAO,EAAkD,CAAA;AAE/E,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAE,GAAW,EAAE,KAAY;IACvD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAE1D,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;IAC/B,CAAC;IAED,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,CAAE,CAAA;AACxB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAE,GAAW,EAAE,KAAY;IAC1D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,mCAAmC,CAAC,CAAA;IAEvE,IAAI,CAAC,QAAQ,CAAC,EAAE;QACd,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;IAEvD,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAmB,CAAA;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAE,GAAW,EAAE,KAAY;IACjE,IAAI,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAElC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,GAAG,IAAI,GAAG,EAAE,CAAA;QACnB,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAC/B,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;IAEtC,OAAO,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAE,CAAA;AAChC,CAAC;AAED,KAAK,UAAU,MAAM,CAAE,GAAW,EAAE,KAAY;IAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,EAAE,CAAA;IACzB,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAEhD,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE;QAC9D,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,KAAK;KAC1B,CAAC,CAAA;AACJ,CAAC"}

package/components/identity.federation/operations/lib/errors.d.ts

@@ -0,0 +1,70 @@
+export declare const ERR_TRUST: {
+    readonly code: "TRUST";
+    readonly message: "Issuer not trusted";
+    name: string;
+    stack?: string;
+    cause?: unknown;
+};
+export declare const ERR_RESPONSE: {
+    readonly code: "RESPONSE";
+    readonly message: "Request to IDP failed";
+    name: string;
+    stack?: string;
+    cause?: unknown;
+};
+export declare const ERR_CONFIG: {
+    readonly code: "CONFIG";
+    readonly message: "Invalid OpenID configuration";
+    name: string;
+    stack?: string;
+    cause?: unknown;
+};
+export declare const ERR_NO_TOKEN: {
+    readonly code: "NO_TOKEN";
+    readonly message: "No ID token received";
+    name: string;
+    stack?: string;
+    cause?: unknown;
+};
+export declare const ERR_ISS: {
+    readonly code: "ISS";
+    readonly message: "Invalid issuer claim";
+    name: string;
+    stack?: string;
+    cause?: unknown;
+};
+export declare const ERR_SUB: {
+    readonly code: "SUB";
+    readonly message: "Invalid subject claim";
+    name: string;
+    stack?: string;
+    cause?: unknown;
+};
+export declare const ERR_EXP: {
+    readonly code: "EXP";
+    readonly message: "Token does not have an expiration time";
+    name: string;
+    stack?: string;
+    cause?: unknown;
+};
+export declare const ERR_REPLAY: {
+    readonly code: "REPLAY";
+    readonly message: "Token has already been used";
+    name: string;
+    stack?: string;
+    cause?: unknown;
+};
+export declare const ERR_CODE_NOT_ENABLED: {
+    readonly code: "CODE_NOT_ENABLED";
+    readonly message: "Authorization code flow is not configured";
+    name: string;
+    stack?: string;
+    cause?: unknown;
+};
+export declare const ERR_CODE_SCHEMA: {
+    readonly code: "CODE_SCHEMA";
+    readonly message: "Invalid code credentials";
+    name: string;
+    stack?: string;
+    cause?: unknown;
+};

package/components/identity.federation/operations/lib/errors.js

@@ -0,0 +1,41 @@
+export const ERR_TRUST = new (class TrustError extends Error {
+    code = 'TRUST';
+    message = 'Issuer not trusted';
+})();
+export const ERR_RESPONSE = new (class ResponseError extends Error {
+    code = 'RESPONSE';
+    message = 'Request to IDP failed';
+})();
+export const ERR_CONFIG = new (class ConfigError extends Error {
+    code = 'CONFIG';
+    message = 'Invalid OpenID configuration';
+})();
+export const ERR_NO_TOKEN = new (class NoTokenError extends Error {
+    code = 'NO_TOKEN';
+    message = 'No ID token received';
+})();
+export const ERR_ISS = new (class IssError extends Error {
+    code = 'ISS';
+    message = 'Invalid issuer claim';
+})();
+export const ERR_SUB = new (class SubError extends Error {
+    code = 'SUB';
+    message = 'Invalid subject claim';
+})();
+export const ERR_EXP = new (class ExpError extends Error {
+    code = 'EXP';
+    message = 'Token does not have an expiration time';
+})();
+export const ERR_REPLAY = new (class ReplayError extends Error {
+    code = 'REPLAY';
+    message = 'Token has already been used';
+})();
+export const ERR_CODE_NOT_ENABLED = new (class CodeNotEnabledError extends Error {
+    code = 'CODE_NOT_ENABLED';
+    message = 'Authorization code flow is not configured';
+})();
+export const ERR_CODE_SCHEMA = new (class CodeSchemaError extends Error {
+    code = 'CODE_SCHEMA';
+    message = 'Invalid code credentials';
+})();
+//# sourceMappingURL=errors.js.map

package/components/identity.federation/operations/lib/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../source/lib/errors.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,UAAW,SAAQ,KAAK;IAC1C,IAAI,GAAG,OAAO,CAAA;IACL,OAAO,GAAG,oBAAoB,CAAA;CACxD,CAAC,EAAE,CAAA;AAEJ,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,aAAc,SAAQ,KAAK;IAChD,IAAI,GAAG,UAAU,CAAA;IACR,OAAO,GAAG,uBAAuB,CAAA;CAC3D,CAAC,EAAE,CAAA;AAEJ,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,WAAY,SAAQ,KAAK;IAC5C,IAAI,GAAG,QAAQ,CAAA;IACN,OAAO,GAAG,8BAA8B,CAAA;CAClE,CAAC,EAAE,CAAA;AAEJ,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,YAAa,SAAQ,KAAK;IAC/C,IAAI,GAAG,UAAU,CAAA;IACR,OAAO,GAAG,sBAAsB,CAAA;CAC1D,CAAC,EAAE,CAAA;AAEJ,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,QAAS,SAAQ,KAAK;IACtC,IAAI,GAAG,KAAK,CAAA;IACH,OAAO,GAAG,sBAAsB,CAAA;CAC1D,CAAC,EAAE,CAAA;AAEJ,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,QAAS,SAAQ,KAAK;IACtC,IAAI,GAAG,KAAK,CAAA;IACH,OAAO,GAAG,uBAAuB,CAAA;CAC3D,CAAC,EAAE,CAAA;AAEJ,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,QAAS,SAAQ,KAAK;IACtC,IAAI,GAAG,KAAK,CAAA;IACH,OAAO,GAAG,wCAAwC,CAAA;CAC5E,CAAC,EAAE,CAAA;AAEJ,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,WAAY,SAAQ,KAAK;IAC5C,IAAI,GAAG,QAAQ,CAAA;IACN,OAAO,GAAG,6BAA6B,CAAA;CACjE,CAAC,EAAE,CAAA;AAEJ,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC,MAAM,mBAAoB,SAAQ,KAAK;IAC9D,IAAI,GAAG,kBAAkB,CAAA;IAChB,OAAO,GAAG,2CAA2C,CAAA;CAC/E,CAAC,EAAE,CAAA;AAEJ,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,eAAgB,SAAQ,KAAK;IACrD,IAAI,GAAG,aAAa,CAAA;IACX,OAAO,GAAG,0BAA0B,CAAA;CAC9D,CAAC,EAAE,CAAA"}

package/components/identity.federation/operations/lib/exchange.d.ts

@@ -0,0 +1,3 @@
+import type { Ctx } from './Ctx.js';
+import type { Payload } from './Payload.js';
+export declare function exchange(credentials: string, ctx: Ctx): Promise<Payload | Error>;

package/components/identity.federation/operations/lib/exchange.js

@@ -0,0 +1,81 @@
+import { load } from './jose.js';
+import { createRemoteJWKSet, discover } from './discovery.js';
+import * as errors from './errors.js';
+export async function exchange(credentials, ctx) {
+    const jose = await load();
+    const properties = decode(credentials);
+    if (properties instanceof Error)
+        return properties;
+    const { code, iss, for: redirect } = properties;
+    const trusted = ctx.trust.find((trust) => trust.iss === iss);
+    if (trusted === undefined)
+        return errors.ERR_TRUST;
+    if (trusted.aud === undefined || (trusted.secret === undefined && trusted.signature === undefined))
+        return errors.ERR_CODE_NOT_ENABLED;
+    const configuration = await discover(iss, ctx.fetch);
+    if (configuration.token_endpoint === undefined)
+        return errors.ERR_CONFIG;
+    // array actually is not expected here, but it is a valid format
+    const aud = Array.isArray(trusted.aud) ? trusted.aud[0] : trusted.aud;
+    const secret = trusted.secret === undefined ? await sign(trusted) : trusted.secret.unwrap();
+    const params = new URLSearchParams();
+    params.append('grant_type', 'authorization_code');
+    params.append('code', code);
+    params.append('client_id', aud);
+    params.append('client_secret', secret);
+    params.append('redirect_uri', redirect);
+    ctx.logs.debug('Exchanging code', {
+        iss,
+        aud,
+        for: redirect,
+        auth: trusted.secret === undefined ? 'signature' : 'secret'
+    });
+    const response = await ctx.fetch(configuration.token_endpoint, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded'
+        },
+        body: params
+    });
+    if (!response.ok) {
+        ctx.logs.error('Code exchange failed', { status: response.status, text: await response.text() });
+        return errors.ERR_RESPONSE;
+    }
+    const tokens = await response.json();
+    if (tokens.id_token === undefined)
+        return errors.ERR_NO_TOKEN;
+    const jwks = await createRemoteJWKSet(iss, ctx.fetch);
+    const { payload } = await jose.jwtVerify(tokens.id_token, jwks, {
+        issuer: iss,
+        audience: trusted.aud,
+        requiredClaims: ['exp']
+    });
+    return payload;
+}
+function decode(credentials) {
+    const json = Buffer.from(credentials, 'base64').toString('utf8');
+    const properties = JSON.parse(json);
+    if (typeof properties.code !== 'string' ||
+        typeof properties.iss !== 'string' ||
+        typeof properties.for !== 'string' ||
+        Object.keys(properties).length !== CREDENTIAL_PROPERTIES.length)
+        return errors.ERR_CODE_SCHEMA;
+    return properties;
+}
+async function sign(trust) {
+    const jose = await load();
+    const signature = trust.signature;
+    const aud = Array.isArray(trust.aud) ? trust.aud[0] : trust.aud;
+    const now = Math.floor(Date.now() / 1000);
+    const key = await jose.importPKCS8(signature.key.unwrap(), 'ES256');
+    return await new jose.SignJWT({})
+        .setProtectedHeader({ alg: 'ES256', kid: signature.kid })
+        .setIssuedAt(now)
+        .setExpirationTime(now + 300)
+        .setIssuer(signature.iss)
+        .setSubject(aud)
+        .setAudience(trust.iss)
+        .sign(key);
+}
+const CREDENTIAL_PROPERTIES = ['for', 'iss', 'code'];
+//# sourceMappingURL=exchange.js.map

package/components/identity.federation/operations/lib/exchange.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exchange.js","sourceRoot":"","sources":["../../source/lib/exchange.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAC7D,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AAKrC,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAE,WAAmB,EAAE,GAAQ;IAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,EAAE,CAAA;IACzB,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,CAAA;IAEtC,IAAI,UAAU,YAAY,KAAK;QAC7B,OAAO,UAAU,CAAA;IAEnB,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAA;IAE/C,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;IAE5D,IAAI,OAAO,KAAK,SAAS;QACvB,OAAO,MAAM,CAAC,SAAS,CAAA;IAEzB,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC;QAChG,OAAO,MAAM,CAAC,oBAAoB,CAAA;IAEpC,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;IAEpD,IAAI,aAAa,CAAC,cAAc,KAAK,SAAS;QAC5C,OAAO,MAAM,CAAC,UAAU,CAAA;IAE1B,gEAAgE;IAChE,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAA;IACrE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;IAC3F,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;IAEpC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAA;IACjD,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC3B,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;IAC/B,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAA;IACtC,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;IAEvC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE;QAChC,GAAG;QACH,GAAG;QACH,GAAG,EAAE,QAAQ;QACb,IAAI,EAAE,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;KAC5D,CAAC,CAAA;IAEF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,cAAc,EAAE;QAC7D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;SACpD;QACD,IAAI,EAAE,MAAM;KACb,CAAC,CAAA;IAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAEhG,OAAO,MAAM,CAAC,YAAY,CAAA;IAC5B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA0B,CAAA;IAE5D,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;QAC/B,OAAO,MAAM,CAAC,YAAY,CAAA;IAE5B,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;IAErD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE;QAC9D,MAAM,EAAE,GAAG;QACX,QAAQ,EAAE,OAAO,CAAC,GAAG;QACrB,cAAc,EAAE,CAAC,KAAK,CAAC;KACxB,CAAC,CAAA;IAEF,OAAO,OAAkB,CAAA;AAC3B,CAAC;AAED,SAAS,MAAM,CAAE,WAAmB;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAChE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAA;IAEjD,IACE,OAAO,UAAU,CAAC,IAAI,KAAK,QAAQ;QACnC,OAAO,UAAU,CAAC,GAAG,KAAK,QAAQ;QAClC,OAAO,UAAU,CAAC,GAAG,KAAK,QAAQ;QAClC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,qBAAqB,CAAC,MAAM;QAE/D,OAAO,MAAM,CAAC,eAAe,CAAA;IAE/B,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,KAAK,UAAU,IAAI,CAAE,KAAY;IAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,EAAE,CAAA;IACzB,MAAM,SAAS,GAAG,KAAK,CAAC,SAAU,CAAA;IAClC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAI,CAAA;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,CAAA;IAEnE,OAAO,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;SAC9B,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC;SACxD,WAAW,CAAC,GAAG,CAAC;SAChB,iBAAiB,CAAC,GAAG,GAAG,GAAG,CAAC;SAC5B,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC;SACxB,UAAU,CAAC,GAAG,CAAC;SACf,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC;SACtB,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC;AAED,MAAM,qBAAqB,GAA4B,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA"}

package/components/identity.federation/operations/lib/index.d.ts

@@ -0,0 +1,4 @@
+export { decode } from './decode.js';
+export { exchange } from './exchange.js';
+export { resolve } from './resolve.js';
+export { type Ctx } from './Ctx.js';

package/components/identity.federation/operations/lib/index.js

@@ -0,0 +1,4 @@
+export { decode } from './decode.js';
+export { exchange } from './exchange.js';
+export { resolve } from './resolve.js';
+//# sourceMappingURL=index.js.map

package/components/identity.federation/operations/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../source/lib/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA"}

package/components/identity.federation/operations/lib/jose.d.ts

@@ -0,0 +1 @@
+export function load(): Promise<typeof import("jose")>;

package/components/identity.federation/operations/lib/jose.js

@@ -0,0 +1,2 @@
+export const load = async () => await import('jose');
+//# sourceMappingURL=jose.js.map

package/components/identity.federation/operations/lib/jose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jose.js","sourceRoot":"","sources":["../../source/lib/jose.js"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAA"}

package/components/identity.federation/operations/lib/resolve.d.ts

@@ -0,0 +1,3 @@
+import type { Payload } from './Payload.js';
+import type { Context, Scheme } from '../types/index.js';
+export declare function resolve(scheme: Scheme, credentials: string, context: Context): Promise<Payload | Error>;

package/components/identity.federation/operations/lib/resolve.js

@@ -0,0 +1,13 @@
+import { decode } from './decode.js';
+import { exchange } from './exchange.js';
+export async function resolve(scheme, credentials, context) {
+    const ctx = {
+        trust: context.configuration.trust,
+        logs: context.logs,
+        fetch: context.fetch
+    };
+    return scheme === 'bearer'
+        ? await decode(credentials, ctx)
+        : await exchange(credentials, ctx);
+}
+//# sourceMappingURL=resolve.js.map

package/components/identity.federation/operations/lib/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../source/lib/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAKxC,MAAM,CAAC,KAAK,UAAU,OAAO,CAAE,MAAc,EAAE,WAAmB,EAAE,OAAgB;IAClF,MAAM,GAAG,GAAQ;QACf,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,KAAK;QAClC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAA;IAED,OAAO,MAAM,KAAK,QAAQ;QACxB,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC;QAChC,CAAC,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;AACtC,CAAC"}

package/components/identity.federation/operations/list.d.ts

@@ -0,0 +1,7 @@
+import type { Context, Entity } from './types/index.js';
+export declare function computation({ authority, identity }: Input, context: Context): Promise<Entity[]>;
+interface Input {
+    authority: string;
+    identity: string;
+}
+export {};

package/components/identity.federation/operations/list.js

@@ -0,0 +1,12 @@
+import { quote } from '@toa.io/generic';
+export async function computation({ authority, identity }, context) {
+    return await context.local.enumerate({
+        query: {
+            criteria: `authority==${quote(authority)};identity==${quote(identity)}`,
+            projection: ['iss'],
+            sort: ['_created:desc'],
+            limit: 100
+        }
+    });
+}
+//# sourceMappingURL=list.js.map

package/components/identity.federation/operations/list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../source/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAGvC,MAAM,CAAC,KAAK,UAAU,WAAW,CAAE,EAAE,SAAS,EAAE,QAAQ,EAAS,EAAE,OAAgB;IACjF,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QACnC,KAAK,EAAE;YACL,QAAQ,EAAE,cAAc,KAAK,CAAC,SAAS,CAAC,cAAc,KAAK,CAAC,QAAQ,CAAC,EAAE;YACvE,UAAU,EAAE,CAAC,KAAK,CAAC;YACnB,IAAI,EAAE,CAAC,eAAe,CAAC;YACvB,KAAK,EAAE,GAAG;SACX;KACF,CAAC,CAAA;AACJ,CAAC"}

package/components/identity.federation/operations/types/Scheme.d.ts

@@ -0,0 +1 @@
+export type Scheme = 'bearer' | 'code';

package/components/identity.federation/operations/types/Scheme.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=Scheme.js.map

package/components/identity.federation/operations/types/Scheme.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Scheme.js","sourceRoot":"","sources":["../../source/types/Scheme.ts"],"names":[],"mappings":""}

package/components/identity.federation/operations/types/configuration.d.ts

@@ -0,0 +1,22 @@
+import type { Secret } from '@toa.io/types';
+export interface Configuration {
+    trust: Trust[];
+    principal?: Principal;
+    assert?: boolean;
+}
+export interface Trust {
+    iss: string;
+    aud: string | [string, ...string[]];
+    secret?: Secret;
+    signature?: {
+        iss: string;
+        kid: string;
+        key: Secret;
+    };
+}
+interface Principal {
+    authority: string;
+    iss: string;
+    sub: string;
+}
+export {};

package/components/identity.federation/operations/types/configuration.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=configuration.js.map

package/components/identity.federation/operations/types/configuration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration.js","sourceRoot":"","sources":["../../source/types/configuration.ts"],"names":[],"mappings":""}

package/components/identity.federation/operations/types/context.d.ts

@@ -0,0 +1,35 @@
+import type { JWTPayload } from 'jose';
+import type { Call, Observation, Query, telemetry, Transition } from '@toa.io/types';
+import type { Entity } from './entity.js';
+import type { Configuration } from './configuration.js';
+export interface Context {
+    fetch: Fetch;
+    local: {
+        observe: Observation<Entity>;
+        enumerate: Observation<Entity[], never, Entity>;
+        terminate: Transition<void, void, Entity>;
+        transit: Call<Entity, TransitInput>;
+        ensure: Call<Entity>;
+        decode: Call<JWTPayload, string>;
+    };
+    remote: {
+        identity: {
+            tokens: {
+                revoke: Call<void, IdentityTokensRevokeInput>;
+            };
+        };
+    };
+    logs: telemetry.Logs;
+    configuration: Configuration;
+}
+export type Fetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+export interface TransitInput {
+    readonly authority: string;
+    readonly iss: string;
+    readonly sub: string;
+    readonly identity: string;
+}
+interface IdentityTokensRevokeInput {
+    query: Query;
+}
+export {};

package/components/identity.federation/operations/types/context.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=context.js.map

package/components/identity.federation/operations/types/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../source/types/context.ts"],"names":[],"mappings":""}

package/components/identity.federation/operations/types/entity.d.ts

@@ -0,0 +1,9 @@
+export interface Entity {
+    id: string;
+    authority: string;
+    iss: string;
+    sub: string;
+    identity: string;
+    _created: number;
+    _deleted?: number | null;
+}