@toa.io/extensions.exposition 1.0.0-alpha.282 → 1.0.0-alpha.283

package/components/identity.federation/types/toa.d.ts

@@ -0,0 +1,127 @@
+// Written by `toa types`. Every run rewrites it.
+// What a manifest does not state belongs in a file of your own.
+
+import type { Query, RemoteError } from '@toa.io/core'
+import type { Secret } from '@toa.io/extensions.configuration'
+import type { FetchInit } from '@toa.io/extensions.fetch'
+import type { Logs, Span } from '@toa.io/extensions.telemetry'
+import type { Readable } from 'node:stream'
+
+export interface Entity {
+  /** The authority token is valid for */
+  authority: string
+  /** The issuer, or signer, of the token, URI like `https://accounts.google.com` */
+  iss: string
+  /** The ID that represents the principal making the request */
+  sub: string
+  /** Identity associated with these credentials */
+  identity: string
+  id: string
+  _version?: number
+  _created?: number
+  _updated?: number
+  _deleted?: number | null
+}
+
+export type TransitInput = {
+  authority: string
+  iss: string
+  sub: string
+  identity: string
+}
+
+export type CreateInput = {
+  scheme: "bearer" | "code"
+  authority: string
+  credentials: string
+  id: string
+}
+
+export type InceptInput = {
+  scheme: "bearer" | "code"
+  authority: string
+  credentials: string
+  id: string
+}
+
+export type InceptOutput = {
+  id?: string
+}
+
+export type AuthenticateInput = {
+  scheme: "bearer" | "code"
+  authority: string
+  credentials: string
+}
+
+export type AuthenticateOutput = {
+  identity?: {
+    id: string
+    claims: {
+      iss: string
+      aud?: string
+      sub: string
+      [key: string]: unknown
+    }
+  }
+}
+
+export type DecodeInput = string
+
+export type DecodeOutput = {
+  iss: string
+  aud?: string
+  sub: string
+  [key: string]: unknown
+}
+
+export type ListInput = {
+  authority: string
+  identity: string
+}
+
+export type DeleteInput = {
+  authority: string
+  identity: string
+  credential: string
+}
+
+export interface Component {
+  transit: (request: { input: TransitInput, query?: Query<Entity>, task?: boolean }) => Promise<Entity>
+  create: (request: { input: CreateInput, task?: boolean }) => Promise<unknown | RemoteError<"EXISTS" | "TOKEN" | "TRUST" | "RESPONSE" | "CONFIG" | "NO_TOKEN" | "ISS" | "SUB" | "EXP" | "REPLAY" | "CODE_NOT_ENABLED" | "CODE_SCHEMA">>
+  incept: (request: { input: InceptInput, task?: boolean }) => Promise<InceptOutput | RemoteError<"EXISTS" | "TOKEN" | "TRUST" | "RESPONSE" | "CONFIG" | "NO_TOKEN" | "ISS" | "SUB" | "EXP" | "REPLAY" | "CODE_NOT_ENABLED" | "CODE_SCHEMA">>
+  authenticate: (request: { input: AuthenticateInput, task?: boolean }) => Promise<AuthenticateOutput | RemoteError<"NOT_FOUND" | "TOKEN" | "TRUST" | "RESPONSE" | "CONFIG" | "NO_TOKEN" | "ISS" | "SUB" | "EXP" | "REPLAY" | "CODE_NOT_ENABLED" | "CODE_SCHEMA">>
+  decode: (request: { input: DecodeInput, task?: boolean }) => Promise<DecodeOutput>
+  list: (request: { input: ListInput, task?: boolean }) => Promise<unknown>
+  delete: (request: { input: DeleteInput, task?: boolean }) => Promise<unknown>
+  assign: (request: { input?: null, query?: Query<Entity>, task?: boolean }) => Promise<Entity>
+  ensure: (request: { input?: null, query?: Query<Entity>, task?: boolean }) => Promise<Entity>
+  enumerate: (request: { input?: null, query?: Query<Entity>, task?: boolean }) => Promise<Entity[]>
+  observe: (request: { input?: null, query?: Query<Entity>, task?: boolean }) => Promise<Entity | null>
+  stream: (request: { input?: null, query?: Query<Entity>, task?: boolean }) => Promise<Readable>
+  terminate: (request: { input?: null, query?: Query<Entity>, task?: boolean }) => Promise<Entity>
+}
+
+export interface Configuration {
+  trust?: Array<{
+    /** Allowed values for a token `iss` field */
+    iss: string
+    /** Acceptable `aud` value(s) */
+    aud: string | string[]
+    signature?: {
+      iss: string
+      kid: string
+      /** PKCS8 private key in PEM form */
+      key: string
+    }
+    /** Client secret for the Identity Provider. Required for Authorization Code Flow. */
+    secret?: string
+  }>
+  /** Subject that will be assigned the `system` Role */
+  principal?: {
+    authority: string
+    iss: string
+    sub: string
+  }
+  assert?: boolean
+}

package/components/identity.grants/manifest.toa.yaml

@@ -0,0 +1,245 @@
+namespace: identity
+name: grants
+
+# What a user allowed a client to do on their behalf. The authorization code is not here:
+# it is single-use and lives seconds, so it is held in the stash and redeemed atomically.
+entity:
+  associated: true
+  schema:
+    type: object
+    properties:
+      authority:
+        type: string
+      identity:
+        type: string
+      client:
+        type: string
+      scope:
+        type: array
+        items:
+          type: string
+      resource:
+        type: array
+        items:
+          type: string
+      kid:
+        description: The identity.keys record backing the access token, revoked with the grant
+        type: string
+      revokedAt:
+        type: integer
+    required:
+      - authority
+      - identity
+      - client
+  index:
+    identity:
+      authority: asc
+      identity: asc
+
+operations:
+  transit:
+    concurrency: retry
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        identity:
+          type: string
+        client:
+          type: string
+        scope:
+          type: array
+          items:
+            type: string
+        resource:
+          type: array
+          items:
+            type: string
+        kid:
+          type: string
+      required:
+        - authority
+        - identity
+        - client
+
+  authorize:
+    query: false
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        identity:
+          type: string
+        client:
+          type: string
+          maxLength: 2048
+        redirect:
+          type: string
+          maxLength: 2048
+        challenge:
+          description: PKCE code challenge, S256 of the verifier
+          type: string
+          minLength: 43
+          maxLength: 128
+        method:
+          type: string
+        scope:
+          type: array
+          items:
+            type: string
+        resource:
+          type: array
+          items:
+            type: string
+            maxLength: 2048
+      required:
+        - authority
+        - identity
+        - client
+        - redirect
+        - challenge
+        - method
+    output:
+      type: object
+      properties:
+        status:
+          description: Read and removed by `io:status`
+          type: number
+        code:
+          type: string
+        expires_in:
+          type: number
+        error:
+          type: string
+        error_description:
+          type: string
+
+  exchange:
+    query: false
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        grant_type:
+          type: string
+        code:
+          type: string
+          maxLength: 512
+        code_verifier:
+          type: string
+          minLength: 43
+          maxLength: 128
+        redirect_uri:
+          type: string
+          maxLength: 2048
+        client_id:
+          type: string
+          maxLength: 2048
+        resource:
+          description: A form repeats a name to say a list, so either shape arrives
+          type: [string, array]
+      required:
+        - authority
+        - grant_type
+    output:
+      type: object
+      properties:
+        status:
+          type: number
+        access_token:
+          type: string
+        token_type:
+          type: string
+        expires_in:
+          type: number
+        scope:
+          type: string
+        error:
+          type: string
+        error_description:
+          type: string
+
+  list:
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        identity:
+          type: string
+      required:
+        - authority
+        - identity
+
+  revoke:
+    output: { type: 'null' }
+    concurrency: retry
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        identity:
+          type: string
+      required:
+        - authority
+        - identity
+    errors:
+      - NOT_FOUND
+
+configuration:
+  schema:
+    type: object
+    properties:
+      lifetime:
+        description: Seconds an authorization code may be redeemed within
+        type: integer
+        minimum: 1
+        maximum: 600
+        default: 60
+      token:
+        description: Seconds an access token is valid for; 0 is until it is revoked
+        type: integer
+        minimum: 0
+        default: 2592000
+    # both have defaults, so the component reads them without checking
+    required: [lifetime, token]
+
+stash: ~
+
+exposition:
+  isolated: true
+  /:
+    POST:
+      anonymous: true
+      map:authority: authority
+      io:input: [grant_type, code, code_verifier, redirect_uri, client_id, resource]
+      io:output: true
+      io:status: status
+      io:throttle:
+        key: ip
+        requests: 60
+        interval: 60
+      cache:exact: no-store
+      endpoint: exchange
+    /:identity:
+      auth:id: identity
+      map:authority: authority
+      map:segments:
+        identity: identity
+      GET:
+        io:output: [id, client, scope, resource, _created]
+        endpoint: list
+      POST:
+        io:input: [client, redirect, challenge, method, scope, resource]
+        io:output: [code, expires_in, error, error_description]
+        io:status: status
+        cache:exact: no-store
+        endpoint: authorize
+      /:id:
+        DELETE:
+          io:output: false
+          endpoint: revoke

package/components/identity.grants/operations/authorize.d.ts

@@ -0,0 +1,35 @@
+import type { Maybe } from '@toa.io/core';
+import type { Operation } from '@toa.io/bridges.node';
+import type { Context } from './lib/index.js';
+/**
+ * What the consent page calls when a user allows a client. The page holds the user's own
+ * credentials, so this is the user's own route; the code it answers with is what the client
+ * redeems at the token endpoint.
+ *
+ * The grant is recorded so a user can see what they allowed and take it back. It is not
+ * consulted to skip the prompt — consent is asked every time, which is what keeps a client
+ * that changed where it wants a code sent from being waved through on an older one.
+ */
+export declare class Effect implements Operation {
+    private context;
+    mount(context: Context): void;
+    execute(input: Input): Promise<Maybe<Output>>;
+}
+interface Input {
+    authority: string;
+    identity: string;
+    client: string;
+    redirect: string;
+    challenge: string;
+    method: string;
+    scope?: string[];
+    resource?: string[];
+}
+interface Output {
+    status?: number;
+    code?: string;
+    expires_in?: number;
+    error?: string;
+    error_description?: string;
+}
+export {};

package/components/identity.grants/operations/authorize.js

@@ -0,0 +1,54 @@
+import { hold, identify } from './lib/index.js';
+/**
+ * What the consent page calls when a user allows a client. The page holds the user's own
+ * credentials, so this is the user's own route; the code it answers with is what the client
+ * redeems at the token endpoint.
+ *
+ * The grant is recorded so a user can see what they allowed and take it back. It is not
+ * consulted to skip the prompt — consent is asked every time, which is what keeps a client
+ * that changed where it wants a code sent from being waved through on an older one.
+ */
+export class Effect {
+    context;
+    mount(context) {
+        this.context = context;
+    }
+    async execute(input) {
+        const { authority, identity } = input;
+        if (input.method !== S256)
+            return invalid('invalid_request', 'Only the S256 code challenge method is supported');
+        const client = await this.context.remote.identity.clients.describe({
+            input: { authority, id: input.client, redirect: input.redirect }
+        });
+        if (client instanceof Error)
+            return invalid('invalid_client', 'No such client');
+        if (client.permitted !== true)
+            return invalid('invalid_request', 'The redirect is not one this client may receive a code at');
+        const scope = input.scope ?? [];
+        // recorded on the grant and carried to the token endpoint, and restricting nothing yet:
+        // a token carries the rights of the identity that consented, over every path it may
+        // reach. What binds it is a `permissions` argument in `exchange`, see documentation/oauth.md
+        const resource = input.resource ?? [];
+        const grant = await this.context.local.transit({
+            query: { id: identify(authority, identity, input.client) },
+            input: { authority, identity, client: input.client, scope, resource }
+        });
+        if (grant instanceof Error)
+            return grant;
+        const code = await hold(authority, {
+            identity,
+            client: input.client,
+            redirect: input.redirect,
+            challenge: input.challenge,
+            scope,
+            resource
+        }, this.context);
+        return { code, expires_in: this.context.configuration.lifetime };
+    }
+}
+function invalid(error, description) {
+    return { status: BAD_REQUEST, error, error_description: description };
+}
+const S256 = 'S256';
+const BAD_REQUEST = 400;
+//# sourceMappingURL=authorize.js.map

package/components/identity.grants/operations/authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../source/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAK/C;;;;;;;;GAQG;AACH,MAAM,OAAO,MAAM;IACT,OAAO,CAAU;IAElB,KAAK,CAAE,OAAgB;QAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;IAEM,KAAK,CAAC,OAAO,CAAE,KAAY;QAChC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAA;QAErC,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;YACvB,OAAO,OAAO,CAAC,iBAAiB,EAAE,kDAAkD,CAAC,CAAA;QAEvF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;YACjE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;SACjE,CAAC,CAAA;QAEF,IAAI,MAAM,YAAY,KAAK;YACzB,OAAO,OAAO,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAA;QAEpD,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI;YAC3B,OAAO,OAAO,CAAC,iBAAiB,EAAE,2DAA2D,CAAC,CAAA;QAEhG,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAA;QAE/B,wFAAwF;QACxF,oFAAoF;QACpF,6FAA6F;QAC7F,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAA;QAErC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;YAC7C,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;YAC1D,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE;SACtE,CAAC,CAAA;QAEF,IAAI,KAAK,YAAY,KAAK;YACxB,OAAO,KAAK,CAAA;QAEd,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE;YACjC,QAAQ;YACR,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK;YACL,QAAQ;SACT,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;QAEhB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAA;IAClE,CAAC;CACF;AAED,SAAS,OAAO,CAAE,KAAa,EAAE,WAAmB;IAClD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAA;AACvE,CAAC;AAED,MAAM,IAAI,GAAG,MAAM,CAAA;AACnB,MAAM,WAAW,GAAG,GAAG,CAAA"}

package/components/identity.grants/operations/exchange.d.ts

@@ -0,0 +1,37 @@
+import type { Maybe } from '@toa.io/core';
+import type { Operation } from '@toa.io/bridges.node';
+import type { Context } from './lib/index.js';
+/**
+ * The token endpoint, RFC 6749 §4.1.3. Anonymous, because the clients this server knows are
+ * public ones with no secret to authenticate with: what stands in for that is PKCE, since
+ * only the client that began the flow holds the verifier the challenge was made from.
+ *
+ * Every failure here is `invalid_grant` without saying which check failed. A code that was
+ * replayed, a verifier that does not match and a redirect that was swapped are all the same
+ * answer, and telling them apart would say whether a stolen code was still live.
+ */
+export declare class Effect implements Operation {
+    private context;
+    mount(context: Context): void;
+    execute(input: Input): Promise<Maybe<Output>>;
+    private redeemable;
+}
+interface Input {
+    authority: string;
+    grant_type: string;
+    code?: string;
+    code_verifier?: string;
+    redirect_uri?: string;
+    client_id?: string;
+    resource?: string | string[];
+}
+interface Output {
+    status?: number;
+    access_token?: string;
+    token_type?: string;
+    expires_in?: number;
+    scope?: string;
+    error?: string;
+    error_description?: string;
+}
+export {};

package/components/identity.grants/operations/exchange.js

@@ -0,0 +1,89 @@
+import { identify, spend, verifies } from './lib/index.js';
+/**
+ * The token endpoint, RFC 6749 §4.1.3. Anonymous, because the clients this server knows are
+ * public ones with no secret to authenticate with: what stands in for that is PKCE, since
+ * only the client that began the flow holds the verifier the challenge was made from.
+ *
+ * Every failure here is `invalid_grant` without saying which check failed. A code that was
+ * replayed, a verifier that does not match and a redirect that was swapped are all the same
+ * answer, and telling them apart would say whether a stolen code was still live.
+ */
+export class Effect {
+    context;
+    mount(context) {
+        this.context = context;
+    }
+    async execute(input) {
+        const { authority } = input;
+        if (input.grant_type !== AUTHORIZATION_CODE)
+            return invalid('unsupported_grant_type', 'Only the authorization code grant is supported');
+        if (input.code === undefined || input.code_verifier === undefined)
+            return invalid('invalid_request', 'A code and a code verifier are required');
+        // spent first: a wrong verifier burns the code, which is what stops it being guessed at
+        const code = await spend(authority, input.code, this.context);
+        if (code === null || !this.redeemable(code, input))
+            return invalid('invalid_grant', 'The authorization code is not redeemable');
+        // `permissions` would bind the token to `code.resource` — `{'/mcp/**': ['*']}` for a
+        // resource at `/mcp/`, which `permits()` reads on every request. Left unset: the token
+        // carries the rights of the identity that consented, see documentation/oauth.md#audience
+        const issued = await this.context.remote.identity.tokens.issue({
+            input: {
+                authority,
+                identity: code.identity,
+                label: label(code.client),
+                lifetime: this.context.configuration.token,
+                ...(code.scope.length === 0 ? {} : { scopes: code.scope })
+            }
+        });
+        // the only refusal `issue` makes is a scope the consenting identity does not hold, and
+        // what it says about that is its own; the client is told what it may act on
+        if (issued instanceof Error)
+            return invalid('invalid_scope', 'The requested scope is not one the identity holds');
+        // the key the token was issued under, so revoking the grant revokes the token. The token
+        // is already out, so a grant that fails to record it is logged rather than unwound — it
+        // costs the user the ability to revoke, and refusing here would cost them the token too
+        const grant = await this.context.local.transit({
+            query: { id: identify(authority, code.identity, code.client) },
+            input: {
+                authority,
+                identity: code.identity,
+                client: code.client,
+                scope: code.scope,
+                resource: code.resource,
+                kid: issued.kid
+            }
+        });
+        if (grant instanceof Error)
+            this.context.logs.error('Grant not recorded for an issued token', { client: code.client, kid: issued.kid });
+        return {
+            // RFC 6749 §5.1 asks for 200, where a POST would otherwise answer 201
+            status: OK,
+            access_token: issued.token,
+            token_type: 'Bearer',
+            ...(issued.exp === undefined
+                ? {}
+                : { expires_in: Math.floor((issued.exp - Date.now()) / 1000) }),
+            ...(code.scope.length === 0 ? {} : { scope: code.scope.join(' ') })
+        };
+    }
+    redeemable(code, input) {
+        if (!verifies(code.challenge, input.code_verifier))
+            return false;
+        // RFC 6749 §4.1.3: what was sent to `authorize` must be sent again
+        if (input.redirect_uri !== undefined && input.redirect_uri !== code.redirect)
+            return false;
+        return input.client_id === undefined || input.client_id === code.client;
+    }
+}
+/** `identity.tokens` requires one, and it is what a user sees when listing what they issued. */
+function label(client) {
+    return client.slice(0, LABEL);
+}
+function invalid(error, description) {
+    return { status: BAD_REQUEST, error, error_description: description };
+}
+const AUTHORIZATION_CODE = 'authorization_code';
+const OK = 200;
+const BAD_REQUEST = 400;
+const LABEL = 64;
+//# sourceMappingURL=exchange.js.map

package/components/identity.grants/operations/exchange.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exchange.js","sourceRoot":"","sources":["../source/exchange.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAK1D;;;;;;;;GAQG;AACH,MAAM,OAAO,MAAM;IACT,OAAO,CAAU;IAElB,KAAK,CAAE,OAAgB;QAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;IAEM,KAAK,CAAC,OAAO,CAAE,KAAY;QAChC,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAA;QAE3B,IAAI,KAAK,CAAC,UAAU,KAAK,kBAAkB;YACzC,OAAO,OAAO,CAAC,wBAAwB,EAAE,gDAAgD,CAAC,CAAA;QAE5F,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;YAC/D,OAAO,OAAO,CAAC,iBAAiB,EAAE,yCAAyC,CAAC,CAAA;QAE9E,wFAAwF;QACxF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;QAE7D,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC;YAChD,OAAO,OAAO,CAAC,eAAe,EAAE,0CAA0C,CAAC,CAAA;QAE7E,qFAAqF;QACrF,uFAAuF;QACvF,yFAAyF;QACzF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;YAC7D,KAAK,EAAE;gBACL,SAAS;gBACT,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;gBACzB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK;gBAC1C,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;aAC3D;SACF,CAAC,CAAA;QAEF,uFAAuF;QACvF,4EAA4E;QAC5E,IAAI,MAAM,YAAY,KAAK;YACzB,OAAO,OAAO,CAAC,eAAe,EAAE,mDAAmD,CAAC,CAAA;QAEtF,yFAAyF;QACzF,wFAAwF;QACxF,wFAAwF;QACxF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;YAC7C,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;YAC9D,KAAK,EAAE;gBACL,SAAS;gBACT,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,GAAG,EAAE,MAAM,CAAC,GAAG;aAChB;SACF,CAAC,CAAA;QAEF,IAAI,KAAK,YAAY,KAAK;YACxB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,wCAAwC,EAC9D,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;QAE7C,OAAO;YACL,sEAAsE;YACtE,MAAM,EAAE,EAAE;YACV,YAAY,EAAE,MAAM,CAAC,KAAK;YAC1B,UAAU,EAAE,QAAQ;YACpB,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS;gBAC1B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;SACpE,CAAA;IACH,CAAC;IAEO,UAAU,CAAE,IAAU,EAAE,KAAY;QAC1C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,aAAc,CAAC;YACjD,OAAO,KAAK,CAAA;QAEd,mEAAmE;QACnE,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,QAAQ;YAC1E,OAAO,KAAK,CAAA;QAEd,OAAO,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,MAAM,CAAA;IACzE,CAAC;CACF;AAED,gGAAgG;AAChG,SAAS,KAAK,CAAE,MAAc;IAC5B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;AAC/B,CAAC;AAED,SAAS,OAAO,CAAE,KAAa,EAAE,WAAmB;IAClD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAA;AACvE,CAAC;AAED,MAAM,kBAAkB,GAAG,oBAAoB,CAAA;AAC/C,MAAM,EAAE,GAAG,GAAG,CAAA;AACd,MAAM,WAAW,GAAG,GAAG,CAAA;AACvB,MAAM,KAAK,GAAG,EAAE,CAAA"}

package/components/identity.grants/operations/lib/code.d.ts

@@ -0,0 +1,15 @@
+import type { Code, Context } from '../../types/index.js';
+/**
+ * An authorization code is a bearer credential that lives for seconds. It is held under a
+ * hash of itself, so a dump of the store hands out none of them, and redeemed with `GETDEL`,
+ * so it is spent once however many requests arrive at once — the property the whole flow
+ * rests on, since a replayed code is a stolen grant.
+ */
+export declare function hold(authority: string, code: Code, context: Context): Promise<string>;
+export declare function spend(authority: string, value: string, context: Context): Promise<Code | null>;
+/**
+ * PKCE, RFC 7636: the client kept a verifier and sent its hash, and only the client that
+ * began the flow can present the verifier now. `S256` alone — `plain` proves nothing.
+ */
+export declare function verifies(challenge: string, verifier: string): boolean;
+export declare function digest(verifier: string): string;

package/components/identity.grants/operations/lib/code.js

@@ -0,0 +1,30 @@
+import { createHash, randomBytes } from 'node:crypto';
+/**
+ * An authorization code is a bearer credential that lives for seconds. It is held under a
+ * hash of itself, so a dump of the store hands out none of them, and redeemed with `GETDEL`,
+ * so it is spent once however many requests arrive at once — the property the whole flow
+ * rests on, since a replayed code is a stolen grant.
+ */
+export async function hold(authority, code, context) {
+    const value = randomBytes(32).toString('base64url');
+    await context.stash.set(key(authority, value), JSON.stringify(code), 'EX', context.configuration.lifetime);
+    return value;
+}
+export async function spend(authority, value, context) {
+    const held = await context.stash.getdel(key(authority, value));
+    return held === null ? null : JSON.parse(held);
+}
+/**
+ * PKCE, RFC 7636: the client kept a verifier and sent its hash, and only the client that
+ * began the flow can present the verifier now. `S256` alone — `plain` proves nothing.
+ */
+export function verifies(challenge, verifier) {
+    return digest(verifier) === challenge;
+}
+export function digest(verifier) {
+    return createHash('sha256').update(verifier).digest('base64url');
+}
+function key(authority, value) {
+    return `oauth:code:${authority}:${createHash('sha256').update(value).digest('hex')}`;
+}
+//# sourceMappingURL=code.js.map

package/components/identity.grants/operations/lib/code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code.js","sourceRoot":"","sources":["../../source/lib/code.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAGrD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAE,SAAiB,EAAE,IAAU,EAAE,OAAgB;IACzE,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAEnD,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EACjE,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAA;IAEvC,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAE,SAAiB,EAAE,KAAa,EAAE,OAAgB;IAC7E,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAA;IAE9D,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAS,CAAA;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAE,SAAiB,EAAE,QAAgB;IAC3D,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAA;AACvC,CAAC;AAED,MAAM,UAAU,MAAM,CAAE,QAAgB;IACtC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;AAClE,CAAC;AAED,SAAS,GAAG,CAAE,SAAiB,EAAE,KAAa;IAC5C,OAAO,cAAc,SAAS,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;AACtF,CAAC"}

package/components/identity.grants/operations/lib/identify.d.ts

@@ -0,0 +1,6 @@
+/**
+ * A user holds one grant per client, so the record is addressed by the three things that
+ * say which: authorizing again replaces what is there rather than leaving another row, and
+ * revoking has one thing to revoke.
+ */
+export declare function identify(authority: string, identity: string, client: string): string;

package/components/identity.grants/operations/lib/identify.js

@@ -0,0 +1,15 @@
+import { createHash } from 'node:crypto';
+/**
+ * A user holds one grant per client, so the record is addressed by the three things that
+ * say which: authorizing again replaces what is there rather than leaving another row, and
+ * revoking has one thing to revoke.
+ */
+export function identify(authority, identity, client) {
+    return createHash('sha256')
+        .update(JSON.stringify([authority, identity, client]))
+        .digest('hex')
+        .slice(0, LENGTH);
+}
+/** What the entity prototype accepts as an id. */
+const LENGTH = 32;
+//# sourceMappingURL=identify.js.map

package/components/identity.grants/operations/lib/identify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identify.js","sourceRoot":"","sources":["../../source/lib/identify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAE,SAAiB,EAAE,QAAgB,EAAE,MAAc;IAC3E,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;SACrD,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;AACrB,CAAC;AAED,kDAAkD;AAClD,MAAM,MAAM,GAAG,EAAE,CAAA"}