@toa.io/extensions.exposition 1.0.0-alpha.28 → 1.0.0-alpha.283

package/components/identity.tokens/operations/decrypt.js

@@ -1,33 +1,140 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.computation = void 0;
-const paseto_1 = require("paseto");
-async function computation(token, context) {
-    let refresh = false;
-    let claim = await decrypt(token, context.configuration.key0);
-    if (claim === null && context.configuration.key1 !== undefined) {
-        refresh = true;
-        claim = await decrypt(token, context.configuration.key1);
-    }
-    if (claim === null)
-        return ERR_INVALID_TOKEN;
-    else
+import { DecryptFactory, ImportKeyFactory } from 'paseto/v3/local';
+import { LRUCache } from 'lru-cache';
+import { form, jweKey } from './lib/index.js';
+import { load } from './lib/jose.js';
+export class Computation {
+    keys = {};
+    legacy = {};
+    cache;
+    latest;
+    remote;
+    logs;
+    mount(context) {
+        const latest = context.configuration.keys.find(({ format }) => format !== 'paseto');
+        if (latest === undefined)
+            throw new TypeError('At least one JWE key must be configured');
+        this.latest = latest.id;
+        this.remote = context.remote.identity.keys;
+        this.cache = new LRUCache(context.configuration.cache);
+        this.logs = context.logs;
+        for (const { id, key, format } of context.configuration.keys) {
+            const branch = format === 'paseto' ? this.legacy : this.keys;
+            branch[id] = { key: key.unwrap() };
+        }
+    }
+    async execute(token) {
+        const legacy = form(token) === 'paseto';
+        const kid = legacy ? this.pasetoKid(token) : await this.jweKid(token);
+        if (kid instanceof Error)
+            return kid;
+        const key = await this.key(kid, legacy);
+        if (key instanceof Error)
+            return key;
+        const claims = legacy
+            ? await decryptPaseto(token, key.key)
+            : await decryptJWE(token, key.key);
+        if (claims instanceof Error)
+            return claims;
+        this.logs.debug('Token claims', claims);
+        if (key.identity !== undefined && claims.identity.id !== key.identity)
+            return ERR_FORGED_KEY;
+        if (key.revokedAt !== undefined)
+            return ERR_REVOKED_KEY;
         return {
-            authority: claim.aud,
-            identity: claim.identity,
-            iat: claim.iat,
-            exp: claim.exp,
-            refresh
+            iss: claims.iss,
+            iat: claims.iat,
+            exp: claims.exp,
+            identity: claims.identity,
+            refresh: legacy || (kid !== this.latest && key.identity === undefined),
+            custom: key.identity !== undefined
         };
+    }
+    pasetoKid(token) {
+        const [, , , footer] = token.split('.');
+        if (footer === undefined)
+            return ERR_INVALID_TOKEN;
+        try {
+            const json = Buffer.from(footer, 'base64url').toString('utf-8');
+            const { kid } = JSON.parse(json);
+            if (typeof kid !== 'string')
+                return ERR_INVALID_TOKEN;
+            return kid;
+        }
+        catch {
+            return ERR_INVALID_TOKEN;
+        }
+    }
+    async jweKid(token) {
+        try {
+            const { decodeProtectedHeader } = await load();
+            const header = decodeProtectedHeader(token);
+            if (header.alg !== 'dir' || header.enc !== 'A256GCM' || header.typ !== 'JWT' ||
+                typeof header.kid !== 'string')
+                return ERR_INVALID_TOKEN;
+            return header.kid;
+        }
+        catch {
+            return ERR_INVALID_TOKEN;
+        }
+    }
+    async key(kid, legacy) {
+        const configured = legacy ? this.legacy : this.keys;
+        if (kid in configured)
+            return configured[kid];
+        if (!this.cache.has(kid)) {
+            const value = await this.remote.observe({ query: { id: kid } });
+            this.cache.set(kid, { value });
+        }
+        const entry = this.cache.get(kid);
+        return entry?.value ?? ERR_INVALID_KEY;
+    }
 }
-exports.computation = computation;
-async function decrypt(token, key) {
+async function decryptPaseto(token, key) {
     try {
-        return await paseto_1.V3.decrypt(token, key);
+        const secret = await importKey(key);
+        // paseto 3 read a token that never expires; these are tokens already in the wild
+        const { claims } = await decryptLocal(secret, token, { allowNonExpiring: true });
+        return claims;
     }
     catch {
-        return null;
+        return ERR_INVALID_TOKEN;
+    }
+}
+async function decryptJWE(token, key) {
+    try {
+        const { jwtDecrypt } = await load();
+        const { payload } = await jwtDecrypt(token, jweKey(key), {
+            keyManagementAlgorithms: ['dir'],
+            contentEncryptionAlgorithms: ['A256GCM']
+        });
+        if (typeof payload.iss !== 'string' || typeof payload.iat !== 'number' ||
+            typeof payload.identity !== 'object' || payload.identity === null)
+            return ERR_INVALID_TOKEN;
+        if (payload.exp !== undefined && payload.exp * 1000 <= Date.now())
+            return ERR_INVALID_TOKEN;
+        return {
+            iss: payload.iss,
+            iat: new Date(payload.iat * 1000).toISOString(),
+            ...(payload.exp === undefined ? {} : { exp: new Date(payload.exp * 1000).toISOString() }),
+            identity: payload.identity
+        };
+    }
+    catch {
+        return ERR_INVALID_TOKEN;
     }
 }
-const ERR_INVALID_TOKEN = new Error('INVALID_TOKEN');
+const importKey = ImportKeyFactory().run;
+const decryptLocal = DecryptFactory().run;
+const ERR_INVALID_TOKEN = new (class InvalidTokenError extends Error {
+    code = 'INVALID_TOKEN';
+})();
+const ERR_INVALID_KEY = new (class InvalidKeyError extends Error {
+    code = 'INVALID_KEY';
+})();
+const ERR_FORGED_KEY = new (class ForgedKeyError extends Error {
+    code = 'FORGED_KEY';
+})();
+const ERR_REVOKED_KEY = new (class RevokedKeyError extends Error {
+    code = 'REVOKED_KEY';
+})();
 //# sourceMappingURL=decrypt.js.map

package/components/identity.tokens/operations/decrypt.js.map

@@ -1 +1 @@
-{"version":3,"file":"decrypt.js","sourceRoot":"","sources":["../source/decrypt.ts"],"names":[],"mappings":";;;AAAA,mCAA2B;AAIpB,KAAK,UAAU,WAAW,CAAE,KAAa,EAAE,OAAgB;IAChE,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;IAE5D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/D,OAAO,GAAG,IAAI,CAAA;QACd,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;IAC1D,CAAC;IAED,IAAI,KAAK,KAAK,IAAI;QAChB,OAAO,iBAAiB,CAAA;;QAExB,OAAO;YACL,SAAS,EAAE,KAAK,CAAC,GAAG;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,OAAO;SACR,CAAA;AACL,CAAC;AAnBD,kCAmBC;AAED,KAAK,UAAU,OAAO,CAAE,KAAa,EAAE,GAAW;IAChD,IAAI,CAAC;QACH,OAAO,MAAM,WAAE,CAAC,OAAO,CAAQ,KAAK,EAAE,GAAG,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,KAAK,CAAC,eAAe,CAAC,CAAA"}
+{"version":3,"file":"decrypt.js","sourceRoot":"","sources":["../source/decrypt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAA;AAKpC,MAAM,OAAO,WAAW;IACL,IAAI,GAAwB,EAAE,CAAA;IAC9B,MAAM,GAAwB,EAAE,CAAA;IACzC,KAAK,CAA6B;IAClC,MAAM,CAAS;IACf,MAAM,CAAwC;IAC9C,IAAI,CAAkB;IAEvB,KAAK,CAAE,OAAgB;QAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAA;QAEnF,IAAI,MAAM,KAAK,SAAS;YACtB,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAA;QAEhE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAA;QACvB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAA;QAC1C,IAAI,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAmB,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;QACxE,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QAExB,KAAK,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YAC7D,MAAM,MAAM,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA;YAE5D,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,CAAA;QACpC,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,OAAO,CAAE,KAAa;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAA;QACvC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAErE,IAAI,GAAG,YAAY,KAAK;YACtB,OAAO,GAAG,CAAA;QAEZ,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QAEvC,IAAI,GAAG,YAAY,KAAK;YACtB,OAAO,GAAG,CAAA;QAEZ,MAAM,MAAM,GAAG,MAAM;YACnB,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC;YACrC,CAAC,CAAC,MAAM,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAA;QAEpC,IAAI,MAAM,YAAY,KAAK;YACzB,OAAO,MAAM,CAAA;QAEf,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;QAEvC,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,CAAC,QAAQ;YACnE,OAAO,cAAc,CAAA;QAEvB,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS;YAC7B,OAAO,eAAe,CAAA;QAExB,OAAO;YACL,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC;YACtE,MAAM,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS;SACnC,CAAA;IACH,CAAC;IAEO,SAAS,CAAE,KAAa;QAC9B,MAAM,CAAC,EAAE,AAAD,EAAG,AAAD,EAAG,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAEvC,IAAI,MAAM,KAAK,SAAS;YACtB,OAAO,iBAAiB,CAAA;QAE1B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YAC/D,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAEhC,IAAI,OAAO,GAAG,KAAK,QAAQ;gBACzB,OAAO,iBAAiB,CAAA;YAE1B,OAAO,GAAG,CAAA;QACZ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,iBAAiB,CAAA;QAC1B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM,CAAE,KAAa;QACjC,IAAI,CAAC;YACH,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,IAAI,EAAE,CAAA;YAC9C,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;YAE3C,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK;gBAC1E,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;gBAC9B,OAAO,iBAAiB,CAAA;YAE1B,OAAO,MAAM,CAAC,GAAG,CAAA;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,iBAAiB,CAAA;QAC1B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,GAAG,CAAE,GAAW,EAAE,MAAe;QAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA;QAEnD,IAAI,GAAG,IAAI,UAAU;YACnB,OAAO,UAAU,CAAC,GAAG,CAAC,CAAA;QAExB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;YAE/D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QAChC,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAEjC,OAAO,KAAK,EAAE,KAAK,IAAI,eAAe,CAAA;IACxC,CAAC;CACF;AAED,KAAK,UAAU,aAAa,CAAE,KAAa,EAAE,GAAW;IACtD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAA2B,CAAC,CAAA;QAC3D,iFAAiF;QACjF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAA;QAEhF,OAAO,MAA2B,CAAA;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,iBAAiB,CAAA;IAC1B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAE,KAAa,EAAE,GAAW;IACnD,IAAI,CAAC;QACH,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,EAAE,CAAA;QAEnC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAAY,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;YAClE,uBAAuB,EAAE,CAAC,KAAK,CAAC;YAChC,2BAA2B,EAAE,CAAC,SAAS,CAAC;SACzC,CAAC,CAAA;QAEF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YACpE,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI;YACjE,OAAO,iBAAiB,CAAA;QAE1B,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE;YAC/D,OAAO,iBAAiB,CAAA;QAE1B,OAAO;YACL,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;YAC/C,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACzF,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,iBAAiB,CAAA;IAC1B,CAAC;AACH,CAAC;AAED,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC,GAAG,CAAA;AACxC,MAAM,YAAY,GAAG,cAAc,EAAE,CAAC,GAAG,CAAA;AAYzC,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,iBAAkB,SAAQ,KAAK;IAClD,IAAI,GAAG,eAAe,CAAA;CACvC,CAAC,EAAE,CAAA;AAEJ,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,eAAgB,SAAQ,KAAK;IAC9C,IAAI,GAAG,aAAa,CAAA;CACrC,CAAC,EAAE,CAAA;AAEJ,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,cAAe,SAAQ,KAAK;IAC5C,IAAI,GAAG,YAAY,CAAA;CACpC,CAAC,EAAE,CAAA;AAEJ,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,eAAgB,SAAQ,KAAK;IAC9C,IAAI,GAAG,aAAa,CAAA;CACrC,CAAC,EAAE,CAAA"}

package/components/identity.tokens/operations/encrypt.d.ts

@@ -1,8 +1,9 @@
-import { type Operation } from '@toa.io/types';
-import { type Context, type EncryptInput } from './types';
+import type { Operation } from '@toa.io/bridges.node';
+import type { Maybe } from '@toa.io/core';
+import type { Context, EncryptInput } from './lib/index.js';
 export declare class Effect implements Operation {
     private key;
     private lifetime;
     mount(context: Context): void;
-    execute(input: EncryptInput): Promise<string>;
+    execute(input: EncryptInput): Promise<Maybe<string>>;
 }

package/components/identity.tokens/operations/encrypt.js

@@ -1,26 +1,41 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Effect = void 0;
-const paseto_1 = require("paseto");
-class Effect {
-    key = '';
-    lifetime = 0;
+import { jweKey } from './lib/index.js';
+import { load } from './lib/jose.js';
+export class Effect {
+    key;
+    lifetime;
     mount(context) {
-        this.key = context.configuration.key0;
+        const key = context.configuration.keys.find(({ format }) => format !== 'paseto');
+        if (key === undefined)
+            throw new TypeError('At least one JWE key must be configured');
+        this.key = { id: key.id, key: key.key.unwrap() };
         this.lifetime = context.configuration.lifetime * 1000;
     }
     async execute(input) {
-        const lifetime = input.lifetime === undefined ? this.lifetime : input.lifetime * 1000;
-        const exp = lifetime === 0
-            ? undefined
-            : new Date(Date.now() + lifetime).toISOString();
-        const payload = {
-            identity: input.identity,
-            aud: input.authority,
-            exp
+        const { EncryptJWT } = await load();
+        if (input.scopes?.some((scope) => !within(scope, input.identity.roles)) === true)
+            return ERR_INACCESSIBLE_SCOPE;
+        const lifetime = input.lifetime === undefined ? this.lifetime : (input.lifetime * 1000);
+        const identity = {
+            id: input.identity.id,
+            roles: input.scopes ?? input.identity.roles
         };
-        return await paseto_1.V3.encrypt(payload, this.key);
+        const permissions = input.permissions ?? input.identity.permissions;
+        if (permissions !== undefined)
+            identity.permissions = permissions;
+        const key = input.key ?? this.key;
+        let token = new EncryptJWT({ identity })
+            .setProtectedHeader({ alg: 'dir', enc: 'A256GCM', typ: 'JWT', kid: key.id })
+            .setIssuer(input.authority)
+            .setIssuedAt(Date.now() / 1000);
+        if (lifetime !== 0)
+            token = token.setExpirationTime((Date.now() + lifetime) / 1000);
+        return await token.encrypt(jweKey(key.key));
     }
 }
-exports.Effect = Effect;
+function within(scope, roles) {
+    return roles.some((role) => role === scope || scope.startsWith(role + ':'));
+}
+const ERR_INACCESSIBLE_SCOPE = new (class InaccessibleScopeError extends Error {
+    code = 'INACCESSIBLE_SCOPE';
+})();
 //# sourceMappingURL=encrypt.js.map

package/components/identity.tokens/operations/encrypt.js.map

@@ -1 +1 @@
-{"version":3,"file":"encrypt.js","sourceRoot":"","sources":["../source/encrypt.ts"],"names":[],"mappings":";;;AAAA,mCAA2B;AAI3B,MAAa,MAAM;IACT,GAAG,GAAW,EAAE,CAAA;IAChB,QAAQ,GAAW,CAAC,CAAA;IAErB,KAAK,CAAE,OAAgB;QAC5B,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,IAAI,CAAA;QACrC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,GAAG,IAAI,CAAA;IACvD,CAAC;IAEM,KAAK,CAAC,OAAO,CAAE,KAAmB;QACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAA;QAErF,MAAM,GAAG,GAAG,QAAQ,KAAK,CAAC;YACxB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAA;QAEjD,MAAM,OAAO,GAAmB;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,GAAG,EAAE,KAAK,CAAC,SAAS;YACpB,GAAG;SACJ,CAAA;QAED,OAAO,MAAM,WAAE,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;IAC5C,CAAC;CACF;AAxBD,wBAwBC"}
+{"version":3,"file":"encrypt.js","sourceRoot":"","sources":["../source/encrypt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAA;AAKpC,MAAM,OAAO,MAAM;IACT,GAAG,CAA0B;IAC7B,QAAQ,CAAS;IAElB,KAAK,CAAE,OAAgB;QAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAA;QAEhF,IAAI,GAAG,KAAK,SAAS;YACnB,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAA;QAEhE,IAAI,CAAC,GAAG,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAA;QAChD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,GAAG,IAAI,CAAA;IACvD,CAAC;IAEM,KAAK,CAAC,OAAO,CAAE,KAAmB;QACvC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,EAAE,CAAA;QAEnC,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI;YAC9E,OAAO,sBAAsB,CAAA;QAE/B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAA;QAEvF,MAAM,QAAQ,GAAa;YACzB,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;YACrB,KAAK,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK;SAC5C,CAAA;QAED,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAA;QAEnE,IAAI,WAAW,KAAK,SAAS;YAC3B,QAAQ,CAAC,WAAW,GAAG,WAAW,CAAA;QAEpC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;QAEjC,IAAI,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;aACrC,kBAAkB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;aAC3E,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC;aAC1B,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QAEjC,IAAI,QAAQ,KAAK,CAAC;YAChB,KAAK,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAA;QAEjE,OAAO,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,CAAC;CACF;AAED,SAAS,MAAM,CAAE,KAAa,EAAE,KAAe;IAC7C,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAA;AAC7E,CAAC;AAED,MAAM,sBAAsB,GAAG,IAAI,CAAC,MAAM,sBAAuB,SAAQ,KAAK;IAC5D,IAAI,GAAG,oBAAoB,CAAA;CAC5C,CAAC,EAAE,CAAA"}

package/components/identity.tokens/operations/issue.d.ts

@@ -0,0 +1,25 @@
+import type { Maybe } from '@toa.io/core';
+import type { Operation } from '@toa.io/bridges.node';
+import type { Context } from './lib/index.js';
+export declare class Effect implements Operation {
+    private keys;
+    private roles;
+    private encrypt;
+    private lifetime;
+    mount(context: Context): void;
+    execute(input: Input): Promise<Maybe<Output>>;
+}
+interface Input {
+    authority: string;
+    identity: string;
+    label: string;
+    lifetime?: number;
+    scopes?: string[];
+    permissions?: Record<string, string[]>;
+}
+interface Output {
+    kid: string;
+    exp?: number;
+    token: string;
+}
+export {};

package/components/identity.tokens/operations/issue.js

@@ -0,0 +1,57 @@
+import { quote } from '@toa.io/generic';
+export class Effect {
+    keys;
+    roles;
+    encrypt;
+    lifetime;
+    mount(context) {
+        this.keys = context.remote.identity.keys;
+        this.roles = context.remote.identity.roles;
+        this.encrypt = context.local.encrypt;
+        // seconds, as `input.lifetime` and `encrypt` both are
+        this.lifetime = context.configuration.lifetime;
+    }
+    async execute(input) {
+        const lifetime = input.lifetime ?? this.lifetime;
+        const expires = lifetime === 0
+            ? undefined
+            : new Date(Date.now() + lifetime * 1000).getTime();
+        const key = await this.keys.create({
+            input: {
+                identity: input.identity,
+                label: input.label,
+                expires
+            }
+        });
+        const roles = await this.roles.list({
+            query: {
+                criteria: `identity==${quote(input.identity)}`,
+                limit: 1024
+            }
+        });
+        const identity = {
+            id: input.identity,
+            roles
+        };
+        const { authority, scopes, permissions } = input;
+        const token = await this.encrypt({
+            input: {
+                authority,
+                identity,
+                lifetime,
+                scopes,
+                permissions,
+                key
+            }
+        });
+        if (token instanceof Error)
+            return token;
+        return {
+            kid: key.id,
+            // technically, the token expires some time later
+            ...(expires !== undefined && { exp: expires }),
+            token
+        };
+    }
+}
+//# sourceMappingURL=issue.js.map

package/components/identity.tokens/operations/issue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue.js","sourceRoot":"","sources":["../source/issue.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAKvC,MAAM,OAAO,MAAM;IACT,IAAI,CAAwC;IAC5C,KAAK,CAAyC;IAC9C,OAAO,CAA8B;IACrC,QAAQ,CAAS;IAElB,KAAK,CAAE,OAAgB;QAC5B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAA;QACxC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAA;QAC1C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAA;QACpC,sDAAsD;QACtD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAA;IAChD,CAAC;IAEM,KAAK,CAAC,OAAO,CAAE,KAAY;QAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAA;QAEhD,MAAM,OAAO,GAAG,QAAQ,KAAK,CAAC;YAC5B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAA;QAEpD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YACjC,KAAK,EAAE;gBACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO;aACR;SACF,CAAC,CAAA;QAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAClC,KAAK,EAAE;gBACL,QAAQ,EAAE,aAAa,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;gBAC9C,KAAK,EAAE,IAAI;aACZ;SACF,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAa;YACzB,EAAE,EAAE,KAAK,CAAC,QAAQ;YAClB,KAAK;SACN,CAAA;QAED,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAA;QAEhD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAC/B,KAAK,EAAE;gBACL,SAAS;gBACT,QAAQ;gBACR,QAAQ;gBACR,MAAM;gBACN,WAAW;gBACX,GAAG;aACJ;SACF,CAAC,CAAA;QAEF,IAAI,KAAK,YAAY,KAAK;YACxB,OAAO,KAAK,CAAA;QAEd,OAAO;YACL,GAAG,EAAE,GAAG,CAAC,EAAE;YACX,iDAAiD;YACjD,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YAC9C,KAAK;SACN,CAAA;IACH,CAAC;CACF"}

package/components/identity.tokens/operations/lib/form.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The form of a token this component issues, or nothing for a credential it did not:
+ * a compact JWE has five segments, where a JWS — an OpenID `id_token`, say — has three.
+ * Read without decrypting, and without trusting: a credential that lies about its form
+ * only reaches a verifier that rejects it.
+ */
+export declare function form(token: string): Form | null;
+export type Form = 'paseto' | 'jwe';

package/components/identity.tokens/operations/lib/form.js

@@ -0,0 +1,24 @@
+/**
+ * The form of a token this component issues, or nothing for a credential it did not:
+ * a compact JWE has five segments, where a JWS — an OpenID `id_token`, say — has three.
+ * Read without decrypting, and without trusting: a credential that lies about its form
+ * only reaches a verifier that rejects it.
+ */
+export function form(token) {
+    if (token.startsWith(PASETO))
+        return 'paseto';
+    if (segments(token) === JWE_SEGMENTS)
+        return 'jwe';
+    return null;
+}
+function segments(token) {
+    let count = 1;
+    for (let i = 0; i < token.length; i++)
+        if (token.charCodeAt(i) === DOT)
+            count++;
+    return count;
+}
+const PASETO = 'v3.local.';
+const JWE_SEGMENTS = 5;
+const DOT = 46;
+//# sourceMappingURL=form.js.map

package/components/identity.tokens/operations/lib/form.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"form.js","sourceRoot":"","sources":["../../source/lib/form.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,IAAI,CAAE,KAAa;IACjC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAC1B,OAAO,QAAQ,CAAA;IAEjB,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,YAAY;QAClC,OAAO,KAAK,CAAA;IAEd,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,QAAQ,CAAE,KAAa;IAC9B,IAAI,KAAK,GAAG,CAAC,CAAA;IAEb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QACnC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,GAAG;YAC7B,KAAK,EAAE,CAAA;IAEX,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,MAAM,GAAG,WAAW,CAAA;AAC1B,MAAM,YAAY,GAAG,CAAC,CAAA;AACtB,MAAM,GAAG,GAAG,EAAE,CAAA"}

package/components/identity.tokens/operations/lib/index.d.ts

@@ -0,0 +1,4 @@
+export * from './form.js';
+export * from './pad.js';
+export type * from '../../types/index.js';
+export { jweKey } from './key.js';

package/components/identity.tokens/operations/lib/index.js

@@ -0,0 +1,4 @@
+export * from './form.js';
+export * from './pad.js';
+export { jweKey } from './key.js';
+//# sourceMappingURL=index.js.map

package/components/identity.tokens/operations/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../source/lib/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAA;AACzB,cAAc,UAAU,CAAA;AAExB,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA"}

package/components/identity.tokens/operations/lib/jose.d.ts

@@ -0,0 +1 @@
+export function load(): Promise<typeof import("jose")>;

package/components/identity.tokens/operations/lib/jose.js

@@ -0,0 +1,2 @@
+export const load = async () => await import('jose');
+//# sourceMappingURL=jose.js.map

package/components/identity.tokens/operations/lib/jose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jose.js","sourceRoot":"","sources":["../../source/lib/jose.js"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAA"}

package/components/identity.tokens/operations/lib/key.d.ts

@@ -0,0 +1 @@
+export declare function jweKey(value: string): Uint8Array;

package/components/identity.tokens/operations/lib/key.js

@@ -0,0 +1,7 @@
+export function jweKey(value) {
+    const key = Buffer.from(value, 'base64url');
+    if (key.length !== 32 || key.toString('base64url') !== value)
+        throw new TypeError('JWE key must be a base64url-encoded 256-bit secret');
+    return new Uint8Array(key);
+}
+//# sourceMappingURL=key.js.map

package/components/identity.tokens/operations/lib/key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key.js","sourceRoot":"","sources":["../../source/lib/key.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,MAAM,CAAE,KAAa;IACnC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAA;IAE3C,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK;QAC1D,MAAM,IAAI,SAAS,CAAC,oDAAoD,CAAC,CAAA;IAE3E,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAA;AAC5B,CAAC"}

package/components/identity.tokens/operations/lib/pad.d.ts

@@ -0,0 +1 @@
+export declare const PAD = "v3.local.";

package/components/identity.tokens/operations/lib/pad.js

@@ -0,0 +1,2 @@
+export const PAD = 'v3.local.';
+//# sourceMappingURL=pad.js.map

package/components/identity.tokens/operations/lib/pad.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pad.js","sourceRoot":"","sources":["../../source/lib/pad.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,GAAG,GAAG,WAAW,CAAA"}

package/components/identity.tokens/operations/revoke.d.ts

@@ -1,2 +1,2 @@
-import { type Entity } from './types';
-export declare function transition(_: never, object: Entity): void;
+import type { Entity } from './lib/index.js';
+export declare function transition(_: unknown, object: Entity): void;

package/components/identity.tokens/operations/revoke.js

@@ -1,8 +1,4 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.transition = void 0;
-function transition(_, object) {
+export function transition(_, object) {
     object.revokedAt = Date.now();
 }
-exports.transition = transition;
 //# sourceMappingURL=revoke.js.map

package/components/identity.tokens/operations/revoke.js.map

@@ -1 +1 @@
-{"version":3,"file":"revoke.js","sourceRoot":"","sources":["../source/revoke.ts"],"names":[],"mappings":";;;AAEA,SAAgB,UAAU,CAAE,CAAQ,EAAE,MAAc;IAClD,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;AAC/B,CAAC;AAFD,gCAEC"}
+{"version":3,"file":"revoke.js","sourceRoot":"","sources":["../source/revoke.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,UAAU,CAAE,CAAU,EAAE,MAAc;IACpD,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;AAC/B,CAAC"}

package/components/identity.tokens/receivers/identity.bans.created.js

@@ -1,3 +1 @@
-'use strict'
-
-exports.request = (payload) => ({ query: { id: payload.id } })
+export const request = (payload) => ({ query: { id: payload.id } })

package/components/identity.tokens/receivers/identity.bans.updated.js

@@ -1,3 +1 @@
-'use strict'
-
-exports.request = (payload) => ({ query: { id: payload.id } })
+export const request = (payload) => ({ query: { id: payload.id } })

package/components/identity.tokens/source/authenticate.test.ts

@@ -1,63 +1,106 @@
+import { it, beforeEach, mock } from 'node:test'
+import assert from 'node:assert/strict'
+
 import { generate } from 'randomstring'
-import { type Configuration, type Context, type DecryptOutput, type Identity } from './types'
-import { Computation as Authenticate } from './authenticate'
+import { Computation as Authenticate } from './authenticate.js'
+import type { Configuration, Context, DecryptOutput, Identity } from './lib/index.js'
+import type { Secret } from '@toa.io/extensions.configuration'
 
 let configuration: Configuration
 let context: Context
 let output: DecryptOutput
 let authenticate: Authenticate
 
-const identity: Identity = { id: generate() }
+const identity: Identity = { id: generate(), roles: [] }
 const authority = generate()
 
+/** Compact JWE shape: `authenticate` reads it before decrypting, and `decrypt` is mocked. */
+const credentials = 'header.key.iv.ciphertext.tag'
+
 beforeEach(() => {
   configuration = {
-    key0: 'k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog',
+    keys: [
+      { id: 'key0', key: secret('sTxL6qVOadKkUJwh3FveU53XgTEo3Sdfg7k2FfiIKfs') },
+      { id: 'legacy0', key: secret('k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog'), format: 'paseto' }
+    ],
     lifetime: 2592000,
-    refresh: 600
+    refresh: 600,
+    cache: {
+      max: 1024,
+      ttl: 600
+    }
   }
 
   context = {
     configuration,
     local: {
-      decrypt: jest.fn(async () => (output)),
-      observe: jest.fn(async () => null)
+      decrypt: mock.fn(async () => (output)),
+      observe: mock.fn(async () => null)
     }
-  }
+  } as unknown as Context
 
   authenticate = new Authenticate()
   authenticate.mount(context)
 })
 
-it.each([
+for (const [expected, shift] of [
   [true, -50],
   [false, +50]
-])('should mark as stale: %s', async (expected: boolean, shift: number) => {
+])
+   it(`should mark as stale: ${expected}`, async () => {
   const now = Date.now()
   const iat = new Date(now - configuration.refresh * 1000 + shift).toISOString()
   const exp = new Date(now + 1000).toISOString()
 
-  output = { authority, identity, exp, iat, refresh: false }
+  output = { iss: authority, identity, exp, iat, refresh: false, custom: false }
 
   const result = await authenticate.execute({
     authority,
-    credentials: ''
+    credentials
   })
 
-  expect(result).toEqual({ identity, refresh: expected })
+  assert.deepStrictEqual(result, { identity, refresh: expected })
 })
 
-it.each([true, false])('should return stale: %s',
-  async (refresh) => {
+for (const refresh of [true, false])
+   it(`should return stale: ${refresh}`, async () => {
     const iat = new Date().toISOString()
     const exp = new Date(Date.now() + 1000).toISOString()
 
-    output = { authority, identity, exp, iat, refresh }
+    output = { iss: authority, identity, exp, iat, refresh, custom: false }
 
     const result = await authenticate.execute({
       authority,
-      credentials: ''
+      credentials
     })
 
-    expect(result).toEqual({ identity, refresh })
+    assert.deepStrictEqual(result, { identity, refresh })
   })
+
+it('should not refresh an aged custom token', async () => {
+  const iat = new Date(Date.now() - configuration.refresh * 1000 - 50).toISOString()
+  const exp = new Date(Date.now() + 1000).toISOString()
+
+  output = { iss: authority, identity, exp, iat, refresh: false, custom: true }
+
+  const result = await authenticate.execute({ authority, credentials })
+
+  assert.deepStrictEqual(result, { identity, refresh: false })
+})
+
+it('should check revocation of an aged custom token', async () => {
+  const iat = new Date(Date.now() - configuration.refresh * 1000 - 50).toISOString()
+  const exp = new Date(Date.now() + 1000).toISOString()
+
+  output = { iss: authority, identity, exp, iat, refresh: false, custom: true }
+  context.local.observe = mock.fn(async () => ({ revokedAt: Date.now() })) as unknown as Context['local']['observe']
+  authenticate.mount(context)
+
+  const result: any = await authenticate.execute({ authority, credentials })
+
+  assert.deepStrictEqual(result.code, 'TOKEN_REVOKED')
+})
+
+function secret (value: string): Secret {
+  return { unwrap: () => value }
+}