@toa.io/extensions.exposition 1.0.0-alpha.282 → 1.0.0-alpha.283

package/components/identity.tokens/operations/issue.js.map

@@ -1 +1 @@
-{"version":3,"file":"issue.js","sourceRoot":"","sources":["../source/issue.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAIvC,MAAM,OAAO,MAAM;IACT,IAAI,CAAwC;IAC5C,KAAK,CAAyC;IAC9C,OAAO,CAA8B;IACrC,QAAQ,CAAS;IAElB,KAAK,CAAE,OAAgB;QAC5B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAA;QACxC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAA;QAC1C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAA;QACpC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,GAAG,IAAI,CAAA;IACvD,CAAC;IAEM,KAAK,CAAC,OAAO,CAAE,KAAY;QAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAA;QAEhD,MAAM,OAAO,GAAG,QAAQ,KAAK,CAAC;YAC5B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAA;QAEpD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YACjC,KAAK,EAAE;gBACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO;aACR;SACF,CAAC,CAAA;QAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAClC,KAAK,EAAE;gBACL,QAAQ,EAAE,aAAa,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;gBAC9C,KAAK,EAAE,IAAI;aACZ;SACF,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAa;YACzB,EAAE,EAAE,KAAK,CAAC,QAAQ;YAClB,KAAK;SACN,CAAA;QAED,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAA;QAEhD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAC/B,KAAK,EAAE;gBACL,SAAS;gBACT,QAAQ;gBACR,QAAQ;gBACR,MAAM;gBACN,WAAW;gBACX,GAAG;aACJ;SACF,CAAC,CAAA;QAEF,IAAI,KAAK,YAAY,KAAK;YACxB,OAAO,KAAK,CAAA;QAEd,OAAO;YACL,GAAG,EAAE,GAAG,CAAC,EAAE;YACX,iDAAiD;YACjD,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YAC9C,KAAK;SACN,CAAA;IACH,CAAC;CACF"}
+{"version":3,"file":"issue.js","sourceRoot":"","sources":["../source/issue.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAKvC,MAAM,OAAO,MAAM;IACT,IAAI,CAAwC;IAC5C,KAAK,CAAyC;IAC9C,OAAO,CAA8B;IACrC,QAAQ,CAAS;IAElB,KAAK,CAAE,OAAgB;QAC5B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAA;QACxC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAA;QAC1C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAA;QACpC,sDAAsD;QACtD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAA;IAChD,CAAC;IAEM,KAAK,CAAC,OAAO,CAAE,KAAY;QAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAA;QAEhD,MAAM,OAAO,GAAG,QAAQ,KAAK,CAAC;YAC5B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAA;QAEpD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YACjC,KAAK,EAAE;gBACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO;aACR;SACF,CAAC,CAAA;QAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAClC,KAAK,EAAE;gBACL,QAAQ,EAAE,aAAa,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;gBAC9C,KAAK,EAAE,IAAI;aACZ;SACF,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAa;YACzB,EAAE,EAAE,KAAK,CAAC,QAAQ;YAClB,KAAK;SACN,CAAA;QAED,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAA;QAEhD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAC/B,KAAK,EAAE;gBACL,SAAS;gBACT,QAAQ;gBACR,QAAQ;gBACR,MAAM;gBACN,WAAW;gBACX,GAAG;aACJ;SACF,CAAC,CAAA;QAEF,IAAI,KAAK,YAAY,KAAK;YACxB,OAAO,KAAK,CAAA;QAEd,OAAO;YACL,GAAG,EAAE,GAAG,CAAC,EAAE;YACX,iDAAiD;YACjD,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YAC9C,KAAK;SACN,CAAA;IACH,CAAC;CACF"}

package/components/identity.tokens/operations/lib/form.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The form of a token this component issues, or nothing for a credential it did not:
+ * a compact JWE has five segments, where a JWS — an OpenID `id_token`, say — has three.
+ * Read without decrypting, and without trusting: a credential that lies about its form
+ * only reaches a verifier that rejects it.
+ */
+export declare function form(token: string): Form | null;
+export type Form = 'paseto' | 'jwe';

package/components/identity.tokens/operations/lib/form.js

@@ -0,0 +1,24 @@
+/**
+ * The form of a token this component issues, or nothing for a credential it did not:
+ * a compact JWE has five segments, where a JWS — an OpenID `id_token`, say — has three.
+ * Read without decrypting, and without trusting: a credential that lies about its form
+ * only reaches a verifier that rejects it.
+ */
+export function form(token) {
+    if (token.startsWith(PASETO))
+        return 'paseto';
+    if (segments(token) === JWE_SEGMENTS)
+        return 'jwe';
+    return null;
+}
+function segments(token) {
+    let count = 1;
+    for (let i = 0; i < token.length; i++)
+        if (token.charCodeAt(i) === DOT)
+            count++;
+    return count;
+}
+const PASETO = 'v3.local.';
+const JWE_SEGMENTS = 5;
+const DOT = 46;
+//# sourceMappingURL=form.js.map

package/components/identity.tokens/operations/lib/form.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"form.js","sourceRoot":"","sources":["../../source/lib/form.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,IAAI,CAAE,KAAa;IACjC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAC1B,OAAO,QAAQ,CAAA;IAEjB,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,YAAY;QAClC,OAAO,KAAK,CAAA;IAEd,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,QAAQ,CAAE,KAAa;IAC9B,IAAI,KAAK,GAAG,CAAC,CAAA;IAEb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QACnC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,GAAG;YAC7B,KAAK,EAAE,CAAA;IAEX,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,MAAM,GAAG,WAAW,CAAA;AAC1B,MAAM,YAAY,GAAG,CAAC,CAAA;AACtB,MAAM,GAAG,GAAG,EAAE,CAAA"}

package/components/identity.tokens/operations/lib/index.d.ts

@@ -1,3 +1,4 @@
+export * from './form.js';
 export * from './pad.js';
-export * from './types.js';
+export type * from '../../types/index.js';
 export { jweKey } from './key.js';

package/components/identity.tokens/operations/lib/index.js

@@ -1,4 +1,4 @@
+export * from './form.js';
 export * from './pad.js';
-export * from './types.js';
 export { jweKey } from './key.js';
 //# sourceMappingURL=index.js.map

package/components/identity.tokens/operations/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../source/lib/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAA;AACxB,cAAc,YAAY,CAAA;AAC1B,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../source/lib/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAA;AACzB,cAAc,UAAU,CAAA;AAExB,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA"}

package/components/identity.tokens/source/authenticate.test.ts

@@ -4,7 +4,7 @@ import assert from 'node:assert/strict'
 import { generate } from 'randomstring'
 import { Computation as Authenticate } from './authenticate.js'
 import type { Configuration, Context, DecryptOutput, Identity } from './lib/index.js'
-import type { Secret } from '@toa.io/types'
+import type { Secret } from '@toa.io/extensions.configuration'
 
 let configuration: Configuration
 let context: Context
@@ -14,6 +14,9 @@ let authenticate: Authenticate
 const identity: Identity = { id: generate(), roles: [] }
 const authority = generate()
 
+/** Compact JWE shape: `authenticate` reads it before decrypting, and `decrypt` is mocked. */
+const credentials = 'header.key.iv.ciphertext.tag'
+
 beforeEach(() => {
   configuration = {
     keys: [
@@ -53,7 +56,7 @@ for (const [expected, shift] of [
 
   const result = await authenticate.execute({
     authority,
-    credentials: ''
+    credentials
   })
 
   assert.deepStrictEqual(result, { identity, refresh: expected })
@@ -68,7 +71,7 @@ for (const refresh of [true, false])
 
     const result = await authenticate.execute({
       authority,
-      credentials: ''
+      credentials
     })
 
     assert.deepStrictEqual(result, { identity, refresh })
@@ -80,7 +83,7 @@ it('should not refresh an aged custom token', async () => {
 
   output = { iss: authority, identity, exp, iat, refresh: false, custom: true }
 
-  const result = await authenticate.execute({ authority, credentials: '' })
+  const result = await authenticate.execute({ authority, credentials })
 
   assert.deepStrictEqual(result, { identity, refresh: false })
 })
@@ -93,7 +96,7 @@ it('should check revocation of an aged custom token', async () => {
   context.local.observe = mock.fn(async () => ({ revokedAt: Date.now() })) as unknown as Context['local']['observe']
   authenticate.mount(context)
 
-  const result: any = await authenticate.execute({ authority, credentials: '' })
+  const result: any = await authenticate.execute({ authority, credentials })
 
   assert.deepStrictEqual(result.code, 'TOKEN_REVOKED')
 })

package/components/identity.tokens/source/authenticate.ts

@@ -1,4 +1,6 @@
-import type { Maybe, Operation } from '@toa.io/types'
+import type { Maybe } from '@toa.io/core'
+import type { Operation } from '@toa.io/bridges.node'
+import { form } from './lib/index.js'
 import type { AuthenticateInput, AuthenticateOutput, Context } from './lib/index.js'
 
 export class Computation implements Operation {
@@ -13,6 +15,11 @@ export class Computation implements Operation {
   }
 
   public async execute (input: AuthenticateInput): Promise<Maybe<AuthenticateOutput>> {
+    // `Bearer` is presented by an OpenID id_token too, and the gateway asks each provider
+    // in turn: a credential this component did not issue is declined, not rejected
+    if (form(input.credentials) === null)
+      return ERR_UNRECOGNIZED
+
     const claims = await this.decrypt({ input: input.credentials })
 
     if (claims instanceof Error)
@@ -43,6 +50,10 @@ export class Computation implements Operation {
   }
 }
 
+const ERR_UNRECOGNIZED = new (class UnrecognizedError extends Error {
+  public readonly code = 'UNRECOGNIZED'
+})()
+
 const ERR_AUTHORITY = new (class AuthorityMismatchError extends Error {
   public readonly code = 'AUTHORITY_MISMATCH'
 })()

package/components/identity.tokens/source/decrypt.test.ts

@@ -6,7 +6,7 @@ import { EncryptFactory, ImportKeyFactory } from 'paseto/v3/local'
 import { Effect as Encrypt } from './encrypt.js'
 import { Computation as Decrypt } from './decrypt.js'
 import { type Configuration, type Context, type Identity } from './lib/index.js'
-import type { Secret } from '@toa.io/types'
+import type { Secret } from '@toa.io/extensions.configuration'
 
 let configuration: Configuration
 let context: Context

package/components/identity.tokens/source/decrypt.ts

@@ -1,8 +1,9 @@
 import { DecryptFactory, ImportKeyFactory } from 'paseto/v3/local'
 import { LRUCache } from 'lru-cache'
-import { jweKey } from './lib/index.js'
+import { form, jweKey } from './lib/index.js'
 import { load } from './lib/jose.js'
-import type { Maybe, Operation } from '@toa.io/types'
+import type { Maybe } from '@toa.io/core'
+import type { Operation } from '@toa.io/bridges.node'
 import type { Context, Claims, DecryptOutput, JWEClaims } from './lib/index.js'
 
 export class Computation implements Operation {
@@ -32,7 +33,7 @@ export class Computation implements Operation {
   }
 
   public async execute (token: string): Promise<Maybe<DecryptOutput>> {
-    const legacy = token.startsWith('v3.local.')
+    const legacy = form(token) === 'paseto'
     const kid = legacy ? this.pasetoKid(token) : await this.jweKid(token)
 
     if (kid instanceof Error)

package/components/identity.tokens/source/encrypt.test.ts

@@ -6,7 +6,7 @@ import { timeout } from '@toa.io/generic'
 import { Effect as Encrypt } from './encrypt.js'
 import { Computation as Decrypt } from './decrypt.js'
 import { type Context, type Identity } from './lib/index.js'
-import type { Secret } from '@toa.io/types'
+import type { Secret } from '@toa.io/extensions.configuration'
 
 let encrypt: Encrypt
 let decrypt: Decrypt

package/components/identity.tokens/source/encrypt.ts

@@ -1,6 +1,7 @@
 import { jweKey } from './lib/index.js'
 import { load } from './lib/jose.js'
-import type { Operation, Maybe } from '@toa.io/types'
+import type { Operation } from '@toa.io/bridges.node'
+import type { Maybe } from '@toa.io/core'
 import type { Identity, Context, EncryptInput, Key } from './lib/index.js'
 
 export class Effect implements Operation {

package/components/identity.tokens/source/issue.test.ts

@@ -0,0 +1,71 @@
+import { it, beforeEach, mock } from 'node:test'
+import assert from 'node:assert/strict'
+
+import { generate } from 'randomstring'
+import { Effect as Issue } from './issue.js'
+import type { Context, EncryptInput } from './lib/index.js'
+
+const LIFETIME = 2592000 // seconds, the configured default
+const identity = generate()
+const authority = generate()
+const label = generate()
+
+let issue: Issue
+let encrypted: EncryptInput
+
+beforeEach(() => {
+  const context = {
+    configuration: { lifetime: LIFETIME },
+    remote: {
+      identity: {
+        keys: { create: mock.fn(async () => ({ id: 'kid0', key: 'secret' })) },
+        roles: { list: mock.fn(async () => []) }
+      }
+    },
+    local: {
+      encrypt: mock.fn(async ({ input }: { input: EncryptInput }) => {
+        encrypted = input
+
+        return 'token'
+      })
+    }
+  } as unknown as Context
+
+  issue = new Issue()
+  issue.mount(context)
+})
+
+/**
+ * The configured lifetime is seconds, as the schema says and as `encrypt` reads it. Storing
+ * it as milliseconds and then multiplying again put the expiration some eighty thousand years
+ * out, and only on this path — every scenario passes a lifetime of its own.
+ */
+it('should expire a token issued without a lifetime as the configuration says', async () => {
+  const now = Date.now()
+  const reply: any = await issue.execute({ authority, identity, label })
+
+  const seconds = (reply.exp - now) / 1000
+
+  assert.ok(Math.abs(seconds - LIFETIME) < 10,
+    `expected to expire in about ${LIFETIME} seconds, got ${seconds}`)
+})
+
+it('should hand the lifetime to `encrypt` in the seconds it reads', async () => {
+  await issue.execute({ authority, identity, label })
+
+  assert.equal(encrypted.lifetime, LIFETIME)
+})
+
+it('should expire a token as its own lifetime says', async () => {
+  const now = Date.now()
+  const reply: any = await issue.execute({ authority, identity, label, lifetime: 600 })
+
+  assert.ok(Math.abs((reply.exp - now) / 1000 - 600) < 10)
+  assert.equal(encrypted.lifetime, 600)
+})
+
+it('should issue a token that does not expire INSECURE', async () => {
+  const reply: any = await issue.execute({ authority, identity, label, lifetime: 0 })
+
+  assert.equal(reply.exp, undefined)
+})

package/components/identity.tokens/source/issue.ts

@@ -1,5 +1,6 @@
 import { quote } from '@toa.io/generic'
-import type { Maybe, Operation } from '@toa.io/types'
+import type { Maybe } from '@toa.io/core'
+import type { Operation } from '@toa.io/bridges.node'
 import type { Context, Identity } from './lib/index.js'
 
 export class Effect implements Operation {
@@ -12,7 +13,8 @@ export class Effect implements Operation {
     this.keys = context.remote.identity.keys
     this.roles = context.remote.identity.roles
     this.encrypt = context.local.encrypt
-    this.lifetime = context.configuration.lifetime * 1000
+    // seconds, as `input.lifetime` and `encrypt` both are
+    this.lifetime = context.configuration.lifetime
   }
 
   public async execute (input: Input): Promise<Maybe<Output>> {

package/components/identity.tokens/source/lib/form.test.ts

@@ -0,0 +1,25 @@
+import { it } from 'node:test'
+import assert from 'node:assert/strict'
+
+import { form } from './form.js'
+
+it('should recognize a compact JWE by its five segments', () => {
+  assert.equal(form('header.key.iv.ciphertext.tag'), 'jwe')
+})
+
+it('should recognize a legacy PASETO by its prefix', () => {
+  assert.equal(form('v3.local.payload'), 'paseto')
+})
+
+it('should not recognize a JWS, which is what an id_token is', () => {
+  assert.equal(form('header.payload.signature'), null)
+})
+
+it('should not recognize what is not a token at all', () => {
+  for (const value of ['', 'token', 'header.key.iv.ciphertext.tag.extra'])
+    assert.equal(form(value), null)
+})
+
+it('should read the shape and nothing else, leaving the rest to the verifier', () => {
+  assert.equal(form('....'), 'jwe')
+})

package/components/identity.tokens/source/lib/form.ts

@@ -0,0 +1,31 @@
+/**
+ * The form of a token this component issues, or nothing for a credential it did not:
+ * a compact JWE has five segments, where a JWS — an OpenID `id_token`, say — has three.
+ * Read without decrypting, and without trusting: a credential that lies about its form
+ * only reaches a verifier that rejects it.
+ */
+export function form (token: string): Form | null {
+  if (token.startsWith(PASETO))
+    return 'paseto'
+
+  if (segments(token) === JWE_SEGMENTS)
+    return 'jwe'
+
+  return null
+}
+
+function segments (token: string): number {
+  let count = 1
+
+  for (let i = 0; i < token.length; i++)
+    if (token.charCodeAt(i) === DOT)
+      count++
+
+  return count
+}
+
+const PASETO = 'v3.local.'
+const JWE_SEGMENTS = 5
+const DOT = 46
+
+export type Form = 'paseto' | 'jwe'

package/components/identity.tokens/source/lib/index.ts

@@ -1,3 +1,4 @@
+export * from './form.js'
 export * from './pad.js'
-export * from './types.js'
+export type * from '../../types/index.js'
 export { jweKey } from './key.js'