@toa.io/extensions.exposition 1.0.0-alpha.28 → 1.0.0-alpha.283

package/components/identity.basic/manifest.toa.yaml

@@ -2,62 +2,241 @@ namespace: identity
 name: basic
 
 entity:
+  associated: true
   schema:
-    authority*: string
-    username*: string
-    password*: string
+    properties:
+      authority:
+        type: string
+      username:
+        type: string
+      password:
+        type: string
+    type: object
+    required:
+      - authority
+      - username
+      - password
   unique:
     authority_username: [authority, username]
-  associated: true
+  index:
+    username:
+      authority: asc
+      username: asc
 
 operations:
   transit:
     concurrency: retry
+    output: &id
+      type: object
+      required: [id]
+      properties:
+        id: { type: string }
     input:
-      authority: string
-      username: string
-      password: string
+      properties:
+        username:
+          type: string
+        password:
+          type: string
+        authority:
+          type: string
+        inception:
+          description: Whether the credentials are being created rather than changed
+          type: boolean
+      type: object
+    errors: &transit.errors
+      - PRINCIPAL_LOCKED
+      - INVALID_USERNAME
+      - INVALID_PASSWORD
+      - EXISTS
   create:
     forward: transit
     query: false
     input:
-      authority*: string
-      username*: string
-      password*: string
+      properties:
+        authority:
+          type: string
+        username:
+          type: string
+        password:
+          type: string
+      type: object
+      required:
+        - authority
+        - username
+        - password
+    errors: *transit.errors
+  add:
+    input:
+      properties:
+        id:
+          type: string
+        authority:
+          type: string
+        username:
+          type: string
+        password:
+          type: string
+      type: object
+      required:
+        - id
+        - authority
+        - username
+        - password
+    errors: *transit.errors
   incept:
     input:
-      authority*: string
-      id*: string
-      credentials*: string
+      properties:
+        authority:
+          type: string
+        id:
+          type: string
+        credentials:
+          type: string
+      type: object
+      required:
+        - authority
+        - id
+        - credentials
     output:
-      id: string
+      properties:
+        id:
+          type: string
+      type: object
+    errors:
+      - INVALID_CREDENTIALS
   authenticate:
     input:
-      authority*: string
-      credentials*: string
+      properties:
+        authority:
+          type: string
+        credentials:
+          type: string
+      type: object
+      required:
+        - authority
+        - credentials
+    output:
+      properties:
+        identity:
+          properties:
+            id:
+              type: string
+          type: object
+      type: object
+    errors:
+      - NOT_FOUND
+      - PASSWORD_MISMATCH
+  check:
+    input:
+      type: object
+      properties:
+        username:
+          type: string
+          minLength: 1
+      required:
+        - username
+    output: { type: 'null' }
+  info:
+    input:
+      properties:
+        authority:
+          type: string
+        identity:
+          type: string
+      type: object
+      required:
+        - authority
+        - identity
     output:
-      identity:
-        id: string
+      type: object
+      nullable: true
+      additionalProperties: false
+      properties:
+        username:
+          type: string
+      required:
+        - username
+  delete:
+    input:
+      properties:
+        authority:
+          type: string
+        identity:
+          type: string
+      type: object
+      required:
+        - authority
+        - identity
 
 configuration:
-  rounds: 10
-  pepper: ''
-  principal: string
-  username+: ^.{1,128}$
-  password+: ^.{8,32}$
+  schema:
+    type: object
+    properties:
+      rounds:
+        type: integer
+        default: 10
+        minimum: 1
+      pepper:
+        description: Hashing pepper, a secret
+        type: string
+        format: secret
+      principal:
+        description: Basic credentials whose Identity is granted the `system` role
+        type: object
+        properties:
+          authority:
+            type: string
+          username:
+            type: string
+        required:
+          - authority
+          - username
+        additionalProperties: false
+      username:
+        type: array
+        items:
+          type: string
+        default:
+          - ^.{1,128}$
+      password:
+        type: array
+        items:
+          type: string
+        default:
+          - ^.{8,32}$
+    # every one of them has a default, so the component reads them without checking
+    required: [rounds, username, password]
 
 exposition:
   isolated: true
   /:
     POST:
       anonymous: true
+      map:authority: authority
       io:output: [id]
-      vary:embed:
-        authority: authority
       endpoint: create
   /:id:
     io:output: [id]
+    io:input: [username, password]
     auth:role: system:identity:basic
-    auth:scheme: basic
     auth:id: id
-    PATCH: transit
+    PATCH:
+      auth:scheme: basic
+      endpoint: transit
+    POST:
+      map:authority: authority
+      map:segments:
+        id: id
+      endpoint: add
+    DELETE:
+      map:authority: authority
+      map:segments:
+        identity: id
+      io:output: false
+      endpoint: delete
+
+  /usernames/:username:
+    GET:
+      map:authority: authority
+      anonymous: true
+      endpoint: check

package/components/identity.basic/operations/add.d.ts

@@ -0,0 +1,3 @@
+import type { AddInput, Context, TransitOutput } from '../types/index.js';
+import type { Maybe } from '@toa.io/core';
+export declare function effect(input: AddInput, context: Context): Promise<Maybe<TransitOutput>>;

package/components/identity.basic/operations/add.js

@@ -0,0 +1,13 @@
+export async function effect(input, context) {
+    return await context.local.transit({
+        input: {
+            authority: input.authority,
+            username: input.username,
+            password: input.password,
+            inception: true
+        },
+        // `delete` leaves a tombstone, which the transition revives
+        query: { id: input.id, deleted: true }
+    });
+}
+//# sourceMappingURL=add.js.map

package/components/identity.basic/operations/add.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add.js","sourceRoot":"","sources":["../source/add.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,KAAK,UAAU,MAAM,CAAE,KAAe,EAAE,OAAgB;IAC7D,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACjC,KAAK,EAAE;YACL,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,IAAI;SAChB;QACD,4DAA4D;QAC5D,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;KACvC,CAAC,CAAA;AACJ,CAAC"}

package/components/identity.basic/operations/authenticate.d.ts

@@ -1,5 +1,5 @@
-import { type Maybe } from '@toa.io/types';
-import { type Context } from './types';
+import { type Maybe } from '@toa.io/core';
+import { type Context } from '../types/index.js';
 export declare function computation(input: Input, context: Context): Promise<Maybe<Output>>;
 interface Input {
     authority: string;

package/components/identity.basic/operations/authenticate.js

@@ -1,27 +1,30 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.computation = void 0;
-const bcryptjs_1 = require("bcryptjs");
-const error_value_1 = require("error-value");
-async function computation(input, context) {
-    const [username, password] = Buffer
-        .from(input.credentials, 'base64')
-        .toString()
-        .split(':');
-    const query = { criteria: `authority==${input.authority};username=='${username}'` };
+import { compare } from 'bcryptjs';
+import { quote } from '@toa.io/generic';
+import { split } from './lib/credentials.js';
+export async function computation(input, context) {
+    const pair = split(input.credentials);
+    if (pair === null)
+        return ERR_NOT_FOUND;
+    const [username, password] = pair;
+    const query = {
+        criteria: `authority==${quote(input.authority)};username==${quote(username)}`
+    };
     const credentials = await context.local.observe({ query });
     if (credentials instanceof Error)
         return credentials;
     if (credentials === null)
         return ERR_NOT_FOUND;
-    const spicy = password + context.configuration.pepper;
-    const match = await (0, bcryptjs_1.compare)(spicy, credentials.password);
+    const spicy = password + (context.configuration.pepper?.unwrap() ?? '');
+    const match = await compare(spicy, credentials.password);
     if (match)
         return { identity: { id: credentials.id } };
     else
         return ERR_PASSWORD_MISMATCH;
 }
-exports.computation = computation;
-const ERR_NOT_FOUND = (0, error_value_1.Err)('NOT_FOUND');
-const ERR_PASSWORD_MISMATCH = (0, error_value_1.Err)('PASSWORD_MISMATCH');
+const ERR_NOT_FOUND = new (class NotFoundError extends Error {
+    code = 'NOT_FOUND';
+})();
+const ERR_PASSWORD_MISMATCH = new (class PasswordMismatchError extends Error {
+    code = 'PASSWORD_MISMATCH';
+})();
 //# sourceMappingURL=authenticate.js.map

package/components/identity.basic/operations/authenticate.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../source/authenticate.ts"],"names":[],"mappings":";;;AAAA,uCAAkC;AAElC,6CAAiC;AAG1B,KAAK,UAAU,WAAW,CAAE,KAAY,EAAE,OAAgB;IAC/D,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM;SAChC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC;SACjC,QAAQ,EAAE;SACV,KAAK,CAAC,GAAG,CAAC,CAAA;IAEb,MAAM,KAAK,GAAU,EAAE,QAAQ,EAAE,cAAc,KAAK,CAAC,SAAS,eAAe,QAAQ,GAAG,EAAE,CAAA;IAC1F,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IAE1D,IAAI,WAAW,YAAY,KAAK;QAC9B,OAAO,WAAW,CAAA;IAEpB,IAAI,WAAW,KAAK,IAAI;QACtB,OAAO,aAAa,CAAA;IAEtB,MAAM,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAA;IACrD,MAAM,KAAK,GAAG,MAAM,IAAA,kBAAO,EAAC,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAA;IAExD,IAAI,KAAK;QACP,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE,CAAA;;QAE3C,OAAO,qBAAqB,CAAA;AAChC,CAAC;AAtBD,kCAsBC;AAED,MAAM,aAAa,GAAG,IAAA,iBAAG,EAAC,WAAW,CAAC,CAAA;AACtC,MAAM,qBAAqB,GAAG,IAAA,iBAAG,EAAC,mBAAmB,CAAC,CAAA"}
+{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../source/authenticate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAClC,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAEvC,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAG5C,MAAM,CAAC,KAAK,UAAU,WAAW,CAAE,KAAY,EAAE,OAAgB;IAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IAErC,IAAI,IAAI,KAAK,IAAI;QACf,OAAO,aAAa,CAAA;IAEtB,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAA;IAEjC,MAAM,KAAK,GAAU;QACnB,QAAQ,EAAE,cAAc,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,cAAc,KAAK,CAAC,QAAQ,CAAC,EAAE;KAC9E,CAAA;IACD,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IAE1D,IAAI,WAAW,YAAY,KAAK;QAC9B,OAAO,WAAW,CAAA;IAEpB,IAAI,WAAW,KAAK,IAAI;QACtB,OAAO,aAAa,CAAA;IAEtB,MAAM,KAAK,GAAG,QAAQ,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACvE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAA;IAExD,IAAI,KAAK;QACP,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE,CAAA;;QAE3C,OAAO,qBAAqB,CAAA;AAChC,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,aAAc,SAAQ,KAAK;IAC1C,IAAI,GAAG,WAAW,CAAA;CACnC,CAAC,EAAE,CAAA;AAEJ,MAAM,qBAAqB,GAAG,IAAI,CAAC,MAAM,qBAAsB,SAAQ,KAAK;IAC1D,IAAI,GAAG,mBAAmB,CAAA;CAC3C,CAAC,EAAE,CAAA"}

package/components/identity.basic/operations/check.d.ts

@@ -0,0 +1,7 @@
+import type { Context } from '../types/index.js';
+export declare function computation(input: Input, context: Context): Promise<void | null | Error>;
+interface Input {
+    authority: string;
+    username: string;
+}
+export {};

package/components/identity.basic/operations/check.js

@@ -0,0 +1,12 @@
+import { quote } from '@toa.io/generic';
+export async function computation(input, context) {
+    const username = Buffer.from(input.username, 'base64url').toString();
+    const found = await context.local.observe({
+        query: { criteria: `authority==${quote(input.authority)};username==${quote(username)}` }
+    });
+    if (found instanceof Error)
+        return found;
+    if (found === null)
+        return null;
+}
+//# sourceMappingURL=check.js.map

package/components/identity.basic/operations/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../source/check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAGvC,MAAM,CAAC,KAAK,UAAU,WAAW,CAAE,KAAY,EAAE,OAAgB;IAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAA;IAEpE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QACxC,KAAK,EAAE,EAAE,QAAQ,EAAE,cAAc,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,cAAc,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE;KACzF,CAAC,CAAA;IAEF,IAAI,KAAK,YAAY,KAAK;QACxB,OAAO,KAAK,CAAA;IAEd,IAAI,KAAK,KAAK,IAAI;QAChB,OAAO,IAAI,CAAA;AACf,CAAC"}

package/components/identity.basic/operations/delete.d.ts

@@ -0,0 +1,7 @@
+import type { Context, Entity } from '../types/index.js';
+export declare function effect({ authority, identity }: Input, context: Context): Promise<Entity | null>;
+interface Input {
+    authority: string;
+    identity: string;
+}
+export {};

package/components/identity.basic/operations/delete.js

@@ -0,0 +1,7 @@
+export async function effect({ authority, identity }, context) {
+    const object = await context.local.observe({ query: { id: identity } });
+    if (object === null || object instanceof Error || object.authority !== authority)
+        return null;
+    return await context.local.terminate({ query: { id: identity } });
+}
+//# sourceMappingURL=delete.js.map

package/components/identity.basic/operations/delete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.js","sourceRoot":"","sources":["../source/delete.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,KAAK,UAAU,MAAM,CAAE,EAAE,SAAS,EAAE,QAAQ,EAAS,EAAE,OAAgB;IAC5E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;IAEvE,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,YAAY,KAAK,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;QAC9E,OAAO,IAAI,CAAA;IAEb,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;AACnE,CAAC"}

package/components/identity.basic/operations/incept.d.ts

@@ -1,5 +1,5 @@
-import { type Context } from './types';
-import type { Maybe } from '@toa.io/types';
+import type { Context } from '../types/index.js';
+import type { Maybe } from '@toa.io/core';
 export declare function effect(input: Input, context: Context): Promise<Maybe<Output>>;
 interface Input {
     authority: string;

package/components/identity.basic/operations/incept.js

@@ -1,20 +1,22 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.effect = void 0;
-const error_value_1 = require("error-value");
-async function effect(input, context) {
-    const [username, password] = Buffer
-        .from(input.credentials, 'base64')
-        .toString()
-        .split(':');
-    if (typeof password !== 'string')
+import { split } from './lib/credentials.js';
+export async function effect(input, context) {
+    const pair = split(input.credentials);
+    if (pair === null)
         return INVALID_CREDENTIALS;
+    const [username, password] = pair;
     const request = {
-        input: { authority: input.authority, username, password },
-        query: { id: input.id }
+        input: {
+            authority: input.authority,
+            username,
+            password
+        },
+        query: {
+            id: input.id
+        }
     };
     return await context.local.transit(request);
 }
-exports.effect = effect;
-const INVALID_CREDENTIALS = (0, error_value_1.Err)('INVALID_CREDENTIALS');
+const INVALID_CREDENTIALS = new (class InvalidCredentialsError extends Error {
+    code = 'INVALID_CREDENTIALS';
+})();
 //# sourceMappingURL=incept.js.map

package/components/identity.basic/operations/incept.js.map

@@ -1 +1 @@
-{"version":3,"file":"incept.js","sourceRoot":"","sources":["../source/incept.ts"],"names":[],"mappings":";;;AAAA,6CAAiC;AAI1B,KAAK,UAAU,MAAM,CAAE,KAAY,EAAE,OAAgB;IAC1D,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM;SAChC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC;SACjC,QAAQ,EAAE;SACV,KAAK,CAAC,GAAG,CAAC,CAAA;IAEb,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAC9B,OAAO,mBAAmB,CAAA;IAE5B,MAAM,OAAO,GAAG;QACd,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE;QACzD,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE;KACxB,CAAA;IAED,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;AAC7C,CAAC;AAfD,wBAeC;AAED,MAAM,mBAAmB,GAAG,IAAA,iBAAG,EAAC,qBAAqB,CAAC,CAAA"}
+{"version":3,"file":"incept.js","sourceRoot":"","sources":["../source/incept.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAI5C,MAAM,CAAC,KAAK,UAAU,MAAM,CAAE,KAAY,EAAE,OAAgB;IAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IAErC,IAAI,IAAI,KAAK,IAAI;QACf,OAAO,mBAAmB,CAAA;IAE5B,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAA;IAEjC,MAAM,OAAO,GAAG;QACd,KAAK,EAAE;YACL,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ;YACR,QAAQ;SACT;QACD,KAAK,EAAE;YACL,EAAE,EAAE,KAAK,CAAC,EAAE;SACb;KACF,CAAA;IAED,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;AAC7C,CAAC;AAED,MAAM,mBAAmB,GAAG,IAAI,CAAC,MAAM,uBAAwB,SAAQ,KAAK;IAC1D,IAAI,GAAG,qBAAqB,CAAA;CAC7C,CAAC,EAAE,CAAA"}

package/components/identity.basic/operations/info.d.ts

@@ -0,0 +1,10 @@
+import type { Context, Entity } from '../types/index.js';
+export declare function effect({ authority, identity }: Input, context: Context): Promise<Output | null>;
+interface Input {
+    authority: string;
+    identity: string;
+}
+interface Output {
+    username: Entity['username'];
+}
+export {};

package/components/identity.basic/operations/info.js

@@ -0,0 +1,7 @@
+export async function effect({ authority, identity }, context) {
+    const object = await context.local.observe({ query: { id: identity } });
+    if (object === null || object instanceof Error || object.authority !== authority)
+        return null;
+    return { username: object.username };
+}
+//# sourceMappingURL=info.js.map

package/components/identity.basic/operations/info.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"info.js","sourceRoot":"","sources":["../source/info.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,KAAK,UAAU,MAAM,CAAE,EAAE,SAAS,EAAE,QAAQ,EAAS,EAAE,OAAgB;IAC5E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;IAEvE,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,YAAY,KAAK,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;QAC9E,OAAO,IAAI,CAAA;IAEb,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAA;AACtC,CAAC"}

package/components/identity.basic/operations/lib/credentials.d.ts

@@ -0,0 +1,5 @@
+/**
+ * The user-id and the password of Basic credentials. RFC 7617 forbids a colon in the
+ * user-id and allows any number of them in the password, so the split is at the first one.
+ */
+export declare function split(credentials: string): [string, string] | null;

package/components/identity.basic/operations/lib/credentials.js

@@ -0,0 +1,12 @@
+/**
+ * The user-id and the password of Basic credentials. RFC 7617 forbids a colon in the
+ * user-id and allows any number of them in the password, so the split is at the first one.
+ */
+export function split(credentials) {
+    const decoded = Buffer.from(credentials, 'base64').toString();
+    const colon = decoded.indexOf(':');
+    if (colon === -1)
+        return null;
+    return [decoded.slice(0, colon), decoded.slice(colon + 1)];
+}
+//# sourceMappingURL=credentials.js.map

package/components/identity.basic/operations/lib/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../source/lib/credentials.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,KAAK,CAAE,WAAmB;IACxC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAElC,IAAI,KAAK,KAAK,CAAC,CAAC;QACd,OAAO,IAAI,CAAA;IAEb,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;AAC5D,CAAC"}

package/components/identity.basic/operations/transit.d.ts

@@ -1,12 +1,15 @@
-import type { Maybe, Operation } from '@toa.io/types';
-import type { Context, Entity, TransitInput, TransitOutput } from './types';
+import type { Maybe } from '@toa.io/core';
+import type { Operation } from '@toa.io/bridges.node';
+import type { Context, Entity, TransitInput, TransitOutput } from '../types/index.js';
 export declare class Transition implements Operation {
     private rounds;
     private pepper;
     private principal?;
     private tokens;
+    private keys;
     private usernameRx;
     private passwordRx;
     mount(context: Context): void;
+    private locked;
     execute(input: TransitInput, object: Entity): Promise<Maybe<TransitOutput>>;
 }

package/components/identity.basic/operations/transit.js

@@ -1,31 +1,42 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Transition = void 0;
-const bcryptjs_1 = require("bcryptjs");
-const error_value_1 = require("error-value");
-class Transition {
+import { genSalt, hash } from 'bcryptjs';
+export class Transition {
     rounds = 10;
     pepper = '';
     principal;
     tokens = undefined;
+    keys = undefined;
     usernameRx = [];
     passwordRx = [];
     mount(context) {
         this.rounds = context.configuration.rounds;
-        this.pepper = context.configuration.pepper;
+        this.pepper = context.configuration.pepper?.unwrap() ?? '';
         this.principal = context.configuration.principal;
         this.tokens = context.remote.identity.tokens;
+        this.keys = context.remote.identity.keys;
         this.usernameRx = toRx(context.configuration.username);
         this.passwordRx = toRx(context.configuration.password);
     }
+    locked(object) {
+        return this.principal !== undefined &&
+            object.authority === this.principal.authority &&
+            object.username === this.principal.username;
+    }
     async execute(input, object) {
-        const existent = object._version !== 0;
-        if (existent)
-            await this.tokens.revoke({ query: { id: object.id } });
-        else
+        const deleted = object._deleted !== undefined && object._deleted !== null;
+        const existent = object._version !== 0 && !deleted;
+        if (existent) {
+            if (input.inception === true)
+                return ERR_EXISTS;
+            await Promise.all([
+                this.tokens.revoke({ query: { id: object.id } }),
+                this.keys.revoke({ input: { identity: object.id } })
+            ]);
+        }
+        else if (input.authority !== undefined)
+            // a record that is new and names no authority is refused by the entity contract
             object.authority = input.authority;
         if (input.username !== undefined) {
-            if (existent && object.username === this.principal)
+            if (existent && this.locked(object))
                 return ERR_PRINCIPAL_LOCKED;
             if (invalid(input.username, this.usernameRx))
                 return ERR_INVALID_USERNAME;
@@ -34,22 +45,33 @@ class Transition {
         if (input.password !== undefined) {
             if (invalid(input.password, this.passwordRx))
                 return ERR_INVALID_PASSWORD;
-            const salt = await (0, bcryptjs_1.genSalt)(this.rounds);
+            const salt = await genSalt(this.rounds);
             const spicy = input.password + this.pepper;
-            object.password = await (0, bcryptjs_1.hash)(spicy, salt);
+            object.password = await hash(spicy, salt);
         }
         return { id: object.id };
     }
 }
-exports.Transition = Transition;
-function toRx(input) {
-    const expressions = typeof input === 'string' ? [input] : input;
+function toRx(expressions) {
     return expressions.map((expression) => new RegExp(expression));
 }
 function invalid(value, expressions) {
     return expressions.some((expression) => !expression.test(value));
 }
-const ERR_PRINCIPAL_LOCKED = (0, error_value_1.Err)('PRINCIPAL_LOCKED', 'Principal username cannot be changed.');
-const ERR_INVALID_USERNAME = (0, error_value_1.Err)('INVALID_USERNAME', 'Username is not meeting the requirements.');
-const ERR_INVALID_PASSWORD = (0, error_value_1.Err)('INVALID_PASSWORD', 'Password is not meeting the requirements.');
+const ERR_PRINCIPAL_LOCKED = new (class PrincipalLockedError extends Error {
+    code = 'PRINCIPAL_LOCKED';
+    message = 'Principal username cannot be changed';
+})();
+const ERR_INVALID_USERNAME = new (class InvalidUsernameError extends Error {
+    code = 'INVALID_USERNAME';
+    message = 'Username is not meeting the requirements';
+})();
+const ERR_INVALID_PASSWORD = new (class InvalidPasswordError extends Error {
+    code = 'INVALID_PASSWORD';
+    message = 'Password is not meeting the requirements';
+})();
+const ERR_EXISTS = new (class ExistsError extends Error {
+    code = 'EXISTS';
+    message = 'Basic credentials already exist';
+})();
 //# sourceMappingURL=transit.js.map

package/components/identity.basic/operations/transit.js.map

@@ -1 +1 @@
-{"version":3,"file":"transit.js","sourceRoot":"","sources":["../source/transit.ts"],"names":[],"mappings":";;;AAAA,uCAAwC;AACxC,6CAAiC;AAIjC,MAAa,UAAU;IACb,MAAM,GAAW,EAAE,CAAA;IACnB,MAAM,GAAW,EAAE,CAAA;IACnB,SAAS,CAAS;IAClB,MAAM,GAAW,SAA8B,CAAA;IAC/C,UAAU,GAAa,EAAE,CAAA;IACzB,UAAU,GAAa,EAAE,CAAA;IAE1B,KAAK,CAAE,OAAgB;QAC5B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAA;QAC1C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAA;QAC1C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,SAAS,CAAA;QAChD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAA;QAE5C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAA;QACtD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAA;IACxD,CAAC;IAEM,KAAK,CAAC,OAAO,CAAE,KAAmB,EAAE,MAAc;QACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAA;QAEtC,IAAI,QAAQ;YACV,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;;YAEtD,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAA;QAEpC,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS;gBAChD,OAAO,oBAAoB,CAAA;YAE7B,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;gBAC1C,OAAO,oBAAoB,CAAA;YAE7B,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;QAClC,CAAC;QAED,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;gBAC1C,OAAO,oBAAoB,CAAA;YAE7B,MAAM,IAAI,GAAG,MAAM,IAAA,kBAAO,EAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACvC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAA;YAE1C,MAAM,CAAC,QAAQ,GAAG,MAAM,IAAA,eAAI,EAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QAC3C,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAA;IAC1B,CAAC;CACF;AAhDD,gCAgDC;AAED,SAAS,IAAI,CAAE,KAAwB;IACrC,MAAM,WAAW,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAE/D,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAA;AAChE,CAAC;AAED,SAAS,OAAO,CAAE,KAAa,EAAE,WAAqB;IACpD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;AAClE,CAAC;AAED,MAAM,oBAAoB,GAAG,IAAA,iBAAG,EAAC,kBAAkB,EAAE,uCAAuC,CAAC,CAAA;AAC7F,MAAM,oBAAoB,GAAG,IAAA,iBAAG,EAAC,kBAAkB,EAAE,2CAA2C,CAAC,CAAA;AACjG,MAAM,oBAAoB,GAAG,IAAA,iBAAG,EAAC,kBAAkB,EAAE,2CAA2C,CAAC,CAAA"}
+{"version":3,"file":"transit.js","sourceRoot":"","sources":["../source/transit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAKxC,MAAM,OAAO,UAAU;IACb,MAAM,GAAW,EAAE,CAAA;IACnB,MAAM,GAAW,EAAE,CAAA;IACnB,SAAS,CAAY;IACrB,MAAM,GAAW,SAA8B,CAAA;IAC/C,IAAI,GAAS,SAA4B,CAAA;IACzC,UAAU,GAAa,EAAE,CAAA;IACzB,UAAU,GAAa,EAAE,CAAA;IAE1B,KAAK,CAAE,OAAgB;QAC5B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAA;QAC1C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;QAC1D,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,SAAS,CAAA;QAChD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAA;QAC5C,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAA;QAExC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAA;QACtD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAA;IACxD,CAAC;IAEO,MAAM,CAAE,MAAc;QAC5B,OAAO,IAAI,CAAC,SAAS,KAAK,SAAS;YACjC,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC,SAAS;YAC7C,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAA;IAC/C,CAAC;IAEM,KAAK,CAAC,OAAO,CAAE,KAAmB,EAAE,MAAc;QACvD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAA;QACzE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,OAAO,CAAA;QAElD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI;gBAC1B,OAAO,UAAU,CAAA;YAEnB,MAAM,OAAO,CAAC,GAAG,CAAC;gBAChB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC;gBAChD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC;aACrD,CAAC,CAAA;QACJ,CAAC;aAAM,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;YACtC,gFAAgF;YAChF,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAA;QAEpC,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;gBACjC,OAAO,oBAAoB,CAAA;YAE7B,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;gBAC1C,OAAO,oBAAoB,CAAA;YAE7B,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;QAClC,CAAC;QAED,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;gBAC1C,OAAO,oBAAoB,CAAA;YAE7B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACvC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAA;YAE1C,MAAM,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QAC3C,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAA;IAC1B,CAAC;CACF;AAED,SAAS,IAAI,CAAE,WAAqB;IAClC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAA;AAChE,CAAC;AAED,SAAS,OAAO,CAAE,KAAa,EAAE,WAAqB;IACpD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;AAClE,CAAC;AAED,MAAM,oBAAoB,GAAG,IAAI,CAAC,MAAM,oBAAqB,SAAQ,KAAK;IACxD,IAAI,GAAG,kBAAkB,CAAA;IAChB,OAAO,GAAG,sCAAsC,CAAA;CAC1E,CAAC,EAAE,CAAA;AAEJ,MAAM,oBAAoB,GAAG,IAAI,CAAC,MAAM,oBAAqB,SAAQ,KAAK;IACxD,IAAI,GAAG,kBAAkB,CAAA;IAChB,OAAO,GAAG,0CAA0C,CAAA;CAC9E,CAAC,EAAE,CAAA;AAEJ,MAAM,oBAAoB,GAAG,IAAI,CAAC,MAAM,oBAAqB,SAAQ,KAAK;IACxD,IAAI,GAAG,kBAAkB,CAAA;IAChB,OAAO,GAAG,0CAA0C,CAAA;CAC9E,CAAC,EAAE,CAAA;AAEJ,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,WAAY,SAAQ,KAAK;IACrC,IAAI,GAAG,QAAQ,CAAA;IACN,OAAO,GAAG,iCAAiC,CAAA;CACrE,CAAC,EAAE,CAAA"}