@toa.io/extensions.exposition 1.0.0-alpha.282 → 1.0.0-alpha.284

package/components/identity.basic/types/toa.d.ts

@@ -0,0 +1,121 @@
+// Written by `toa types`. Every run rewrites it.
+// What a manifest does not state belongs in a file of your own.
+
+import type { Query, RemoteError } from '@toa.io/core'
+import type { Secret } from '@toa.io/extensions.configuration'
+import type { FetchInit } from '@toa.io/extensions.fetch'
+import type { Logs, Span } from '@toa.io/extensions.telemetry'
+import type { Readable } from 'node:stream'
+
+export interface Entity {
+  authority: string
+  username: string
+  password: string
+  id: string
+  _version?: number
+  _created?: number
+  _updated?: number
+  _deleted?: number | null
+}
+
+export type TransitInput = {
+  username?: string
+  password?: string
+  authority?: string
+  /** Whether the credentials are being created rather than changed */
+  inception?: boolean
+}
+
+export type TransitOutput = {
+  id: string
+}
+
+export type CreateInput = {
+  authority: string
+  username: string
+  password: string
+  /** Whether the credentials are being created rather than changed */
+  inception?: boolean
+}
+
+export type CreateOutput = {
+  id: string
+}
+
+export type AddInput = {
+  id: string
+  authority: string
+  username: string
+  password: string
+}
+
+export type InceptInput = {
+  authority: string
+  id: string
+  credentials: string
+}
+
+export type InceptOutput = {
+  id?: string
+}
+
+export type AuthenticateInput = {
+  authority: string
+  credentials: string
+}
+
+export type AuthenticateOutput = {
+  identity?: {
+    id?: string
+  }
+}
+
+export type CheckInput = {
+  username: string
+}
+
+export type CheckOutput = null
+
+export type InfoInput = {
+  authority: string
+  identity: string
+}
+
+export type InfoOutput = {
+  username: string
+} | null
+
+export type DeleteInput = {
+  authority: string
+  identity: string
+}
+
+export interface Component {
+  transit: (request: { input: TransitInput, query?: Query<Entity>, task?: boolean }) => Promise<TransitOutput | RemoteError<"PRINCIPAL_LOCKED" | "INVALID_USERNAME" | "INVALID_PASSWORD" | "EXISTS">>
+  create: (request: { input: CreateInput, task?: boolean }) => Promise<CreateOutput | RemoteError<"PRINCIPAL_LOCKED" | "INVALID_USERNAME" | "INVALID_PASSWORD" | "EXISTS">>
+  add: (request: { input: AddInput, task?: boolean }) => Promise<unknown | RemoteError<"PRINCIPAL_LOCKED" | "INVALID_USERNAME" | "INVALID_PASSWORD" | "EXISTS">>
+  incept: (request: { input: InceptInput, task?: boolean }) => Promise<InceptOutput | RemoteError<"INVALID_CREDENTIALS">>
+  authenticate: (request: { input: AuthenticateInput, task?: boolean }) => Promise<AuthenticateOutput | RemoteError<"NOT_FOUND" | "PASSWORD_MISMATCH">>
+  check: (request: { input: CheckInput, task?: boolean }) => Promise<CheckOutput>
+  info: (request: { input: InfoInput, task?: boolean }) => Promise<InfoOutput>
+  delete: (request: { input: DeleteInput, task?: boolean }) => Promise<unknown>
+  assign: (request: { input?: null, query?: Query<Entity>, task?: boolean }) => Promise<Entity>
+  ensure: (request: { input?: null, query?: Query<Entity>, task?: boolean }) => Promise<Entity>
+  enumerate: (request: { input?: null, query?: Query<Entity>, task?: boolean }) => Promise<Entity[]>
+  observe: (request: { input?: null, query?: Query<Entity>, task?: boolean }) => Promise<Entity | null>
+  stream: (request: { input?: null, query?: Query<Entity>, task?: boolean }) => Promise<Readable>
+  terminate: (request: { input?: null, query?: Query<Entity>, task?: boolean }) => Promise<Entity>
+}
+
+export interface Configuration {
+  rounds: number
+  /** Hashing pepper, a secret */
+  pepper?: Secret
+  /** Basic credentials whose Identity is granted the `system` role */
+  principal?: {
+    authority: string
+    username: string
+  }
+  username: string[]
+  password: string[]
+}

package/components/identity.clients/manifest.toa.yaml

@@ -0,0 +1,243 @@
+namespace: identity
+name: clients
+
+# A registration is addressed by the hash of what it says, so the same metadata is the
+# same client however many times it arrives. `associated` is what lets a transition create
+# the record at an id decided outside the storage.
+entity:
+  associated: true
+  schema:
+    type: object
+    properties:
+      authority:
+        type: string
+      name:
+        description: client_name
+        type: string
+        maxLength: 128
+      uris:
+        description: redirect_uris
+        type: array
+        minItems: 1
+        maxItems: 8
+        items:
+          type: string
+          maxLength: 2048
+      uri:
+        description: client_uri
+        type: string
+        maxLength: 2048
+      logo:
+        description: logo_uri
+        type: string
+        maxLength: 2048
+      scope:
+        type: string
+        maxLength: 512
+      expires:
+        description: When a registration nothing has used is swept
+        type: number
+    required:
+      - authority
+      - uris
+  index:
+    authority:
+      authority: asc
+
+operations:
+  transit:
+    concurrency: retry
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        name:
+          type: string
+        uri:
+          type: string
+        logo:
+          type: string
+        scope:
+          type: string
+        uris:
+          type: array
+          items:
+            type: string
+        expires:
+          type: number
+      required:
+        - authority
+        - uris
+
+  register:
+    query: false
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        client_name:
+          type: string
+          maxLength: 128
+        client_uri:
+          type: string
+          maxLength: 2048
+        logo_uri:
+          type: string
+          maxLength: 2048
+        redirect_uris:
+          type: array
+          minItems: 1
+          maxItems: 8
+          items:
+            type: string
+            maxLength: 2048
+        scope:
+          type: string
+          maxLength: 512
+        grant_types:
+          type: array
+          items:
+            type: string
+        response_types:
+          type: array
+          items:
+            type: string
+        token_endpoint_auth_method:
+          type: string
+      required:
+        - authority
+        - redirect_uris
+    # RFC 7591 §3.2.2 states a registration error as a body, not as a status of its own
+    output:
+      type: object
+      properties:
+        status:
+          description: Read and removed by `map:status`
+          type: number
+        client_id:
+          type: string
+        client_id_issued_at:
+          type: number
+        client_name:
+          type: string
+        client_uri:
+          type: string
+        logo_uri:
+          type: string
+        redirect_uris:
+          type: array
+          items:
+            type: string
+        grant_types:
+          type: array
+          items:
+            type: string
+        response_types:
+          type: array
+          items:
+            type: string
+        token_endpoint_auth_method:
+          type: string
+        error:
+          type: string
+        error_description:
+          type: string
+
+  describe:
+    query: false
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        id:
+          description: client_id, which is an https URL when the client publishes its own metadata
+          type: string
+          maxLength: 2048
+        redirect:
+          description: Asked about together with the client, since only this component may answer it
+          type: string
+          maxLength: 2048
+      required:
+        - authority
+        - id
+    output:
+      type: object
+      properties:
+        client_id:
+          type: string
+        client_name:
+          type: string
+        client_uri:
+          type: string
+        logo_uri:
+          type: string
+        redirect_uris:
+          type: array
+          items:
+            type: string
+        permitted:
+          description: Whether `redirect` is one this client may receive a code at
+          type: boolean
+    errors:
+      - UNKNOWN_CLIENT
+
+configuration:
+  schema:
+    type: object
+    properties:
+      trust:
+        description: Origins whose Client ID Metadata Documents may be read; none are without one
+        type: array
+        items:
+          type: string
+          pattern: ^https://
+        default: []
+      lifetime:
+        description: Seconds a Client ID Metadata Document is held before it is read again
+        type: integer
+        minimum: 1
+        default: 3600
+      ttl:
+        description: Seconds a registration nothing has used is kept
+        type: integer
+        minimum: 1
+        default: 2592000
+      size:
+        description: Bytes of a Client ID Metadata Document that are read
+        type: integer
+        minimum: 1
+        default: 16384
+      timeout:
+        description: Milliseconds a Client ID Metadata Document has to arrive
+        type: integer
+        minimum: 1
+        default: 3000
+
+stash: ~
+
+exposition:
+  isolated: true
+  /:
+    POST:
+      anonymous: true
+      map:authority: authority
+      io:input: [client_name, client_uri, logo_uri, redirect_uris, scope, grant_types, response_types, token_endpoint_auth_method]
+      io:output: true
+      io:throttle:
+        key: ip
+        requests: 10
+        interval: 3600
+      io:status: status
+      cache:exact: no-store
+      endpoint: register
+    /:id:
+      GET:
+        anyone: true
+        map:authority: authority
+        map:segments:
+          id: id
+        io:output: [client_id, client_name, client_uri, logo_uri, redirect_uris]
+        endpoint: describe

package/components/identity.clients/operations/describe.js

@@ -0,0 +1,44 @@
+import { ERR_UNKNOWN_CLIENT, permits, read } from './lib/index.js';
+/**
+ * What a client is, whichever way it came to be known: a `client_id` that is an https URL
+ * publishes its own metadata, and anything else was registered here. The caller is not told
+ * which, and neither mechanism is visible past this operation.
+ *
+ * Whether a redirect is one the client may receive a code at is answered here too. The rule
+ * is this component's — nothing else knows a loopback port is ignored — and asking for it
+ * with the client saves a second call on the path a person is waiting on.
+ */
+export class Computation {
+    context;
+    mount(context) {
+        this.context = context;
+    }
+    async execute(input) {
+        const client = input.id.startsWith(HTTPS)
+            ? await read(input.id, this.context)
+            : await this.registered(input);
+        if (client instanceof Error)
+            return client;
+        return {
+            ...client,
+            ...(input.redirect === undefined
+                ? {}
+                : { permitted: permits(client.redirect_uris, input.redirect) })
+        };
+    }
+    async registered(input) {
+        const entity = await this.context.local.observe({ query: { id: input.id } });
+        // credentials are scoped to an authority, and so is what may act for them
+        if (entity === null || entity.authority !== input.authority)
+            return ERR_UNKNOWN_CLIENT;
+        return {
+            client_id: entity.id,
+            client_name: entity.name,
+            client_uri: entity.uri,
+            logo_uri: entity.logo,
+            redirect_uris: entity.uris
+        };
+    }
+}
+const HTTPS = 'https://';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVzY3JpYmUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zb3VyY2UvZGVzY3JpYmUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLGtCQUFrQixFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsTUFBTSxnQkFBZ0IsQ0FBQTtBQUtsRTs7Ozs7Ozs7R0FRRztBQUNILE1BQU0sT0FBTyxXQUFXO0lBQ2QsT0FBTyxDQUFVO0lBRWxCLEtBQUssQ0FBRSxPQUFnQjtRQUM1QixJQUFJLENBQUMsT0FBTyxHQUFHLE9BQU8sQ0FBQTtJQUN4QixDQUFDO0lBRU0sS0FBSyxDQUFDLE9BQU8sQ0FBRSxLQUFZO1FBQ2hDLE1BQU0sTUFBTSxHQUFHLEtBQUssQ0FBQyxFQUFFLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQztZQUN2QyxDQUFDLENBQUMsTUFBTSxJQUFJLENBQUMsS0FBSyxDQUFDLEVBQUUsRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDO1lBQ3BDLENBQUMsQ0FBQyxNQUFNLElBQUksQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUE7UUFFaEMsSUFBSSxNQUFNLFlBQVksS0FBSztZQUN6QixPQUFPLE1BQU0sQ0FBQTtRQUVmLE9BQU87WUFDTCxHQUFHLE1BQU07WUFDVCxHQUFHLENBQUMsS0FBSyxDQUFDLFFBQVEsS0FBSyxTQUFTO2dCQUM5QixDQUFDLENBQUMsRUFBRTtnQkFDSixDQUFDLENBQUMsRUFBRSxTQUFTLEVBQUUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxhQUFhLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7U0FDbEUsQ0FBQTtJQUNILENBQUM7SUFFTyxLQUFLLENBQUMsVUFBVSxDQUFFLEtBQVk7UUFDcEMsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFFLEVBQUUsS0FBSyxDQUFDLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQTtRQUU1RSwwRUFBMEU7UUFDMUUsSUFBSSxNQUFNLEtBQUssSUFBSSxJQUFJLE1BQU0sQ0FBQyxTQUFTLEtBQUssS0FBSyxDQUFDLFNBQVM7WUFDekQsT0FBTyxrQkFBa0IsQ0FBQTtRQUUzQixPQUFPO1lBQ0wsU0FBUyxFQUFFLE1BQU0sQ0FBQyxFQUFFO1lBQ3BCLFdBQVcsRUFBRSxNQUFNLENBQUMsSUFBSTtZQUN4QixVQUFVLEVBQUUsTUFBTSxDQUFDLEdBQUc7WUFDdEIsUUFBUSxFQUFFLE1BQU0sQ0FBQyxJQUFJO1lBQ3JCLGFBQWEsRUFBRSxNQUFNLENBQUMsSUFBSTtTQUMzQixDQUFBO0lBQ0gsQ0FBQztDQUNGO0FBRUQsTUFBTSxLQUFLLEdBQUcsVUFBVSxDQUFBIn0=

package/components/identity.clients/operations/lib/Context.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiQ29udGV4dC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS9saWIvQ29udGV4dC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiIn0=

package/components/identity.clients/operations/lib/Entity.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiRW50aXR5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc291cmNlL2xpYi9FbnRpdHkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiJ9

package/components/identity.clients/operations/lib/canonical.js

@@ -0,0 +1,24 @@
+import { createHash } from 'node:crypto';
+/**
+ * The id of a registration: a hash of what it says, so identical metadata is one client
+ * however many times it arrives. A client cannot remember that it registered here, and
+ * registers again on every fresh connection; without this the registry only grows.
+ *
+ * Only what is honoured is hashed. A field this component ignores would otherwise mint a
+ * client per release of whoever sends it, and the authority is in there because credentials
+ * are scoped to one.
+ */
+export function identify(authority, metadata) {
+    const canonical = JSON.stringify([
+        authority,
+        metadata.client_name ?? null,
+        metadata.client_uri ?? null,
+        metadata.logo_uri ?? null,
+        metadata.scope ?? null,
+        [...metadata.redirect_uris].sort()
+    ]);
+    return createHash('sha256').update(canonical).digest('hex').slice(0, LENGTH);
+}
+/** What the entity prototype accepts as an id. */
+const LENGTH = 32;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2Fub25pY2FsLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc291cmNlL2xpYi9jYW5vbmljYWwudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLGFBQWEsQ0FBQTtBQUd4Qzs7Ozs7Ozs7R0FRRztBQUNILE1BQU0sVUFBVSxRQUFRLENBQUUsU0FBaUIsRUFBRSxRQUFrQjtJQUM3RCxNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDO1FBQy9CLFNBQVM7UUFDVCxRQUFRLENBQUMsV0FBVyxJQUFJLElBQUk7UUFDNUIsUUFBUSxDQUFDLFVBQVUsSUFBSSxJQUFJO1FBQzNCLFFBQVEsQ0FBQyxRQUFRLElBQUksSUFBSTtRQUN6QixRQUFRLENBQUMsS0FBSyxJQUFJLElBQUk7UUFDdEIsQ0FBQyxHQUFHLFFBQVEsQ0FBQyxhQUFhLENBQUMsQ0FBQyxJQUFJLEVBQUU7S0FDbkMsQ0FBQyxDQUFBO0lBRUYsT0FBTyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFBO0FBQzlFLENBQUM7QUFFRCxrREFBa0Q7QUFDbEQsTUFBTSxNQUFNLEdBQUcsRUFBRSxDQUFBIn0=

package/components/identity.clients/operations/lib/cimd.js

@@ -0,0 +1,86 @@
+import { createHash } from 'node:crypto';
+import { ERR_UNKNOWN_CLIENT } from './errors.js';
+/**
+ * A Client ID Metadata Document: the client publishes what it is at an https URL, and that
+ * URL is its `client_id`. Control of the origin is what proves the identity, so nothing is
+ * registered and nothing is written — the document is read and held for a while.
+ */
+export async function read(id, context) {
+    // before anything is fetched: the id is the caller's to choose, and this runs inside
+    // the cluster. An origin the configuration does not name is not reached at all.
+    if (!trusted(id, context.configuration.trust))
+        return ERR_UNKNOWN_CLIENT;
+    const key = CACHE + createHash('sha256').update(id).digest('hex');
+    const cached = await context.stash.get(key);
+    if (cached !== null)
+        return cached === MISS ? ERR_UNKNOWN_CLIENT : JSON.parse(cached);
+    const client = await fetch(id, context);
+    // a document that does not answer is remembered too, or a bad id is fetched per request
+    await context.stash.set(key, client instanceof Error ? MISS : JSON.stringify(client), 'EX', context.configuration.lifetime);
+    return client;
+}
+/**
+ * An https URL whose origin the configuration names. Compared by origin so that a path on a
+ * trusted host cannot be escaped by one that merely starts the same way.
+ */
+function trusted(id, trust) {
+    let url;
+    try {
+        url = new URL(id);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol !== 'https:')
+        return false;
+    return trust.some((origin) => {
+        try {
+            return new URL(origin).origin === url.origin;
+        }
+        catch {
+            return false;
+        }
+    });
+}
+async function fetch(id, context) {
+    const { size, timeout } = context.configuration;
+    try {
+        const response = await context.fetch(id, {
+            redirect: 'error', // a redirect leaves the origin that was trusted
+            signal: AbortSignal.timeout(timeout),
+            headers: { accept: 'application/json' }
+        });
+        if (!response.ok)
+            return ERR_UNKNOWN_CLIENT;
+        const text = await response.text();
+        if (text.length > size)
+            return ERR_UNKNOWN_CLIENT;
+        return validate(id, JSON.parse(text));
+    }
+    catch (error) {
+        context.logs.debug('Client metadata document is unreadable', {
+            client: id,
+            error: error?.toString?.()
+        });
+        return ERR_UNKNOWN_CLIENT;
+    }
+}
+function validate(id, metadata) {
+    // the document names itself, so one client's cannot claim another's identity
+    if (metadata.client_id !== id)
+        return ERR_UNKNOWN_CLIENT;
+    if (!Array.isArray(metadata.redirect_uris) || metadata.redirect_uris.length === 0 ||
+        metadata.redirect_uris.some((uri) => typeof uri !== 'string'))
+        return ERR_UNKNOWN_CLIENT;
+    return {
+        client_id: id,
+        client_name: metadata.client_name,
+        client_uri: metadata.client_uri,
+        logo_uri: metadata.logo_uri,
+        redirect_uris: metadata.redirect_uris
+    };
+}
+const CACHE = 'cimd:';
+/** Held in place of a document that could not be read, so a bad id is not refetched. */
+const MISS = '';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2ltZC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS9saWIvY2ltZC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsVUFBVSxFQUFFLE1BQU0sYUFBYSxDQUFBO0FBQ3hDLE9BQU8sRUFBRSxrQkFBa0IsRUFBRSxNQUFNLGFBQWEsQ0FBQTtBQUloRDs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSxJQUFJLENBQUUsRUFBVSxFQUFFLE9BQWdCO0lBQ3RELHFGQUFxRjtJQUNyRixnRkFBZ0Y7SUFDaEYsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLEVBQUUsT0FBTyxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUM7UUFDM0MsT0FBTyxrQkFBa0IsQ0FBQTtJQUUzQixNQUFNLEdBQUcsR0FBRyxLQUFLLEdBQUcsVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUE7SUFDakUsTUFBTSxNQUFNLEdBQUcsTUFBTSxPQUFPLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQTtJQUUzQyxJQUFJLE1BQU0sS0FBSyxJQUFJO1FBQ2pCLE9BQU8sTUFBTSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsa0JBQWtCLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFXLENBQUE7SUFFNUUsTUFBTSxNQUFNLEdBQUcsTUFBTSxLQUFLLENBQUMsRUFBRSxFQUFFLE9BQU8sQ0FBQyxDQUFBO0lBRXZDLHdGQUF3RjtJQUN4RixNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRSxNQUFNLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLEVBQ2xGLElBQUksRUFBRSxPQUFPLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxDQUFBO0lBRXZDLE9BQU8sTUFBTSxDQUFBO0FBQ2YsQ0FBQztBQUVEOzs7R0FHRztBQUNILFNBQVMsT0FBTyxDQUFFLEVBQVUsRUFBRSxLQUFlO0lBQzNDLElBQUksR0FBUSxDQUFBO0lBRVosSUFBSSxDQUFDO1FBQ0gsR0FBRyxHQUFHLElBQUksR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFBO0lBQ25CLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLEtBQUssQ0FBQTtJQUNkLENBQUM7SUFFRCxJQUFJLEdBQUcsQ0FBQyxRQUFRLEtBQUssUUFBUTtRQUMzQixPQUFPLEtBQUssQ0FBQTtJQUVkLE9BQU8sS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFO1FBQzNCLElBQUksQ0FBQztZQUNILE9BQU8sSUFBSSxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUMsTUFBTSxLQUFLLEdBQUcsQ0FBQyxNQUFNLENBQUE7UUFDOUMsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNQLE9BQU8sS0FBSyxDQUFBO1FBQ2QsQ0FBQztJQUNILENBQUMsQ0FBQyxDQUFBO0FBQ0osQ0FBQztBQUVELEtBQUssVUFBVSxLQUFLLENBQUUsRUFBVSxFQUFFLE9BQWdCO0lBQ2hELE1BQU0sRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLEdBQUcsT0FBTyxDQUFDLGFBQWEsQ0FBQTtJQUUvQyxJQUFJLENBQUM7UUFDSCxNQUFNLFFBQVEsR0FBRyxNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsRUFBRSxFQUFFO1lBQ3ZDLFFBQVEsRUFBRSxPQUFPLEVBQUUsZ0RBQWdEO1lBQ25FLE1BQU0sRUFBRSxXQUFXLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQztZQUNwQyxPQUFPLEVBQUUsRUFBRSxNQUFNLEVBQUUsa0JBQWtCLEVBQUU7U0FDeEMsQ0FBQyxDQUFBO1FBRUYsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFO1lBQ2QsT0FBTyxrQkFBa0IsQ0FBQTtRQUUzQixNQUFNLElBQUksR0FBRyxNQUFNLFFBQVEsQ0FBQyxJQUFJLEVBQUUsQ0FBQTtRQUVsQyxJQUFJLElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSTtZQUNwQixPQUFPLGtCQUFrQixDQUFBO1FBRTNCLE9BQU8sUUFBUSxDQUFDLEVBQUUsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBc0MsQ0FBQyxDQUFBO0lBQzVFLENBQUM7SUFBQyxPQUFPLEtBQWMsRUFBRSxDQUFDO1FBQ3hCLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLHdDQUF3QyxFQUFFO1lBQzNELE1BQU0sRUFBRSxFQUFFO1lBQ1YsS0FBSyxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUUsRUFBRTtTQUMzQixDQUFDLENBQUE7UUFFRixPQUFPLGtCQUFrQixDQUFBO0lBQzNCLENBQUM7QUFDSCxDQUFDO0FBRUQsU0FBUyxRQUFRLENBQUUsRUFBVSxFQUFFLFFBQTJDO0lBQ3hFLDZFQUE2RTtJQUM3RSxJQUFJLFFBQVEsQ0FBQyxTQUFTLEtBQUssRUFBRTtRQUMzQixPQUFPLGtCQUFrQixDQUFBO0lBRTNCLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxhQUFhLENBQUMsSUFBSSxRQUFRLENBQUMsYUFBYSxDQUFDLE1BQU0sS0FBSyxDQUFDO1FBQy9FLFFBQVEsQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQyxPQUFPLEdBQUcsS0FBSyxRQUFRLENBQUM7UUFDN0QsT0FBTyxrQkFBa0IsQ0FBQTtJQUUzQixPQUFPO1FBQ0wsU0FBUyxFQUFFLEVBQUU7UUFDYixXQUFXLEVBQUUsUUFBUSxDQUFDLFdBQVc7UUFDakMsVUFBVSxFQUFFLFFBQVEsQ0FBQyxVQUFVO1FBQy9CLFFBQVEsRUFBRSxRQUFRLENBQUMsUUFBUTtRQUMzQixhQUFhLEVBQUUsUUFBUSxDQUFDLGFBQWE7S0FDdEMsQ0FBQTtBQUNILENBQUM7QUFFRCxNQUFNLEtBQUssR0FBRyxPQUFPLENBQUE7QUFFckIsd0ZBQXdGO0FBQ3hGLE1BQU0sSUFBSSxHQUFHLEVBQUUsQ0FBQSJ9

package/components/identity.clients/operations/lib/errors.js

@@ -0,0 +1,5 @@
+export const ERR_UNKNOWN_CLIENT = new (class UnknownClientError extends Error {
+    code = 'UNKNOWN_CLIENT';
+    message = 'No such client';
+})();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXJyb3JzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc291cmNlL2xpYi9lcnJvcnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsTUFBTSxDQUFDLE1BQU0sa0JBQWtCLEdBQUcsSUFBSSxDQUFDLE1BQU0sa0JBQW1CLFNBQVEsS0FBSztJQUMzRCxJQUFJLEdBQUcsZ0JBQWdCLENBQUE7SUFDZCxPQUFPLEdBQUcsZ0JBQWdCLENBQUE7Q0FDcEQsQ0FBQyxFQUFFLENBQUEifQ==

package/components/identity.clients/operations/lib/index.js

@@ -0,0 +1,7 @@
+export * from './canonical.js';
+export * from './cimd.js';
+export * from './Context.js';
+export * from './Entity.js';
+export * from './errors.js';
+export * from './redirect.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zb3VyY2UvbGliL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsZ0JBQWdCLENBQUE7QUFDOUIsY0FBYyxXQUFXLENBQUE7QUFDekIsY0FBYyxjQUFjLENBQUE7QUFDNUIsY0FBYyxhQUFhLENBQUE7QUFDM0IsY0FBYyxhQUFhLENBQUE7QUFDM0IsY0FBYyxlQUFlLENBQUEifQ==

package/components/identity.clients/operations/lib/redirect.js

@@ -0,0 +1,32 @@
+/**
+ * Whether a client may receive a code at this address.
+ *
+ * Exact string comparison, which RFC 6749 §3.1.2.3 requires, except for a loopback
+ * address: a native client binds whatever port is free when it starts, so RFC 8252 §7.3
+ * has the port ignored there. Claude Code registers `http://localhost/callback` and
+ * `http://127.0.0.1/callback` and comes back on an ephemeral port; comparing those
+ * literally would refuse every one of them.
+ */
+export function permits(registered, redirect) {
+    return registered.some((uri) => uri === redirect || loopback(uri, redirect));
+}
+function loopback(registered, redirect) {
+    const a = parse(registered);
+    const b = parse(redirect);
+    if (a === null || b === null)
+        return false;
+    return a.protocol === 'http:' && b.protocol === 'http:' &&
+        LOOPBACK.has(a.hostname) && a.hostname === b.hostname &&
+        a.pathname === b.pathname && a.search === b.search;
+}
+function parse(value) {
+    try {
+        return new URL(value);
+    }
+    catch {
+        return null;
+    }
+}
+/** `localhost` resolves through the host's own configuration, which RFC 8252 §8.3 warns of. */
+const LOOPBACK = new Set(['127.0.0.1', '[::1]', 'localhost']);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVkaXJlY3QuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zb3VyY2UvbGliL3JlZGlyZWN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7Ozs7OztHQVFHO0FBQ0gsTUFBTSxVQUFVLE9BQU8sQ0FBRSxVQUFvQixFQUFFLFFBQWdCO0lBQzdELE9BQU8sVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsR0FBRyxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsR0FBRyxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUE7QUFDOUUsQ0FBQztBQUVELFNBQVMsUUFBUSxDQUFFLFVBQWtCLEVBQUUsUUFBZ0I7SUFDckQsTUFBTSxDQUFDLEdBQUcsS0FBSyxDQUFDLFVBQVUsQ0FBQyxDQUFBO0lBQzNCLE1BQU0sQ0FBQyxHQUFHLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQTtJQUV6QixJQUFJLENBQUMsS0FBSyxJQUFJLElBQUksQ0FBQyxLQUFLLElBQUk7UUFDMUIsT0FBTyxLQUFLLENBQUE7SUFFZCxPQUFPLENBQUMsQ0FBQyxRQUFRLEtBQUssT0FBTyxJQUFJLENBQUMsQ0FBQyxRQUFRLEtBQUssT0FBTztRQUNyRCxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUMsUUFBUSxLQUFLLENBQUMsQ0FBQyxRQUFRO1FBQ3JELENBQUMsQ0FBQyxRQUFRLEtBQUssQ0FBQyxDQUFDLFFBQVEsSUFBSSxDQUFDLENBQUMsTUFBTSxLQUFLLENBQUMsQ0FBQyxNQUFNLENBQUE7QUFDdEQsQ0FBQztBQUVELFNBQVMsS0FBSyxDQUFFLEtBQWE7SUFDM0IsSUFBSSxDQUFDO1FBQ0gsT0FBTyxJQUFJLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQTtJQUN2QixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxJQUFJLENBQUE7SUFDYixDQUFDO0FBQ0gsQ0FBQztBQUVELCtGQUErRjtBQUMvRixNQUFNLFFBQVEsR0FBRyxJQUFJLEdBQUcsQ0FBQyxDQUFDLFdBQVcsRUFBRSxPQUFPLEVBQUUsV0FBVyxDQUFDLENBQUMsQ0FBQSJ9

package/components/identity.clients/operations/register.js

@@ -0,0 +1,84 @@
+import { identify } from './lib/index.js';
+/**
+ * Dynamic Client Registration, RFC 7591: the client sends what it is and is given an
+ * identifier for it. Unauthenticated, as the specification has it — a registration grants
+ * nothing on its own, and stays inert until a user consents to the client on a page that
+ * shows them its name and where it would send them.
+ *
+ * The identifier is a hash of the metadata, so registering the same thing twice is the
+ * same client rather than another row. A client cannot remember it registered here.
+ */
+export class Effect {
+    transit;
+    ttl;
+    mount(context) {
+        this.transit = context.local.transit;
+        this.ttl = context.configuration.ttl;
+    }
+    async execute(input) {
+        const { authority } = input;
+        if (input.token_endpoint_auth_method !== undefined &&
+            input.token_endpoint_auth_method !== 'none')
+            return invalid('invalid_client_metadata', 'Only public clients are supported: token_endpoint_auth_method must be `none`');
+        const uris = input.redirect_uris.map(normalize);
+        for (const uri of uris)
+            if (uri instanceof Error)
+                return invalid('invalid_redirect_uri', uri.message);
+        const metadata = {
+            client_name: input.client_name,
+            client_uri: input.client_uri,
+            logo_uri: input.logo_uri,
+            scope: input.scope,
+            redirect_uris: uris
+        };
+        const id = identify(authority, metadata);
+        const entity = await this.transit({
+            query: { id },
+            input: {
+                authority,
+                name: metadata.client_name,
+                uri: metadata.client_uri,
+                logo: metadata.logo_uri,
+                scope: metadata.scope,
+                uris: metadata.redirect_uris,
+                expires: Date.now() + this.ttl * 1000
+            }
+        });
+        return {
+            client_id: id,
+            // of the record, not of this request: registering again answers what it answered
+            client_id_issued_at: Math.floor((entity._created ?? Date.now()) / 1000),
+            client_name: entity.name,
+            client_uri: entity.uri,
+            logo_uri: entity.logo,
+            redirect_uris: entity.uris,
+            grant_types: ['authorization_code'],
+            response_types: ['code'],
+            token_endpoint_auth_method: 'none'
+        };
+    }
+}
+/** Absolute, no fragment, and either https or a loopback address (RFC 8252 §7.3). */
+function normalize(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return new Error(`\`${value}\` is not an absolute URI`);
+    }
+    if (url.hash !== '')
+        return new Error(`\`${value}\` carries a fragment`);
+    if (url.protocol === 'https:')
+        return url.href;
+    if (url.protocol === 'http:' && LOOPBACK.has(url.hostname))
+        return url.href;
+    return new Error(`\`${value}\` is neither https nor a loopback address`);
+}
+/** RFC 7591 §3.2.2: a registration error is a body, and `map:status` makes it the status. */
+function invalid(error, description) {
+    return { status: BAD_REQUEST, error, error_description: description };
+}
+const BAD_REQUEST = 400;
+const LOOPBACK = new Set(['127.0.0.1', '[::1]', 'localhost']);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVnaXN0ZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zb3VyY2UvcmVnaXN0ZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLFFBQVEsRUFBRSxNQUFNLGdCQUFnQixDQUFBO0FBS3pDOzs7Ozs7OztHQVFHO0FBQ0gsTUFBTSxPQUFPLE1BQU07SUFDVCxPQUFPLENBQThCO0lBQ3JDLEdBQUcsQ0FBUztJQUViLEtBQUssQ0FBRSxPQUFnQjtRQUM1QixJQUFJLENBQUMsT0FBTyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFBO1FBQ3BDLElBQUksQ0FBQyxHQUFHLEdBQUcsT0FBTyxDQUFDLGFBQWEsQ0FBQyxHQUFHLENBQUE7SUFDdEMsQ0FBQztJQUVNLEtBQUssQ0FBQyxPQUFPLENBQUUsS0FBWTtRQUNoQyxNQUFNLEVBQUUsU0FBUyxFQUFFLEdBQUcsS0FBSyxDQUFBO1FBRTNCLElBQUksS0FBSyxDQUFDLDBCQUEwQixLQUFLLFNBQVM7WUFDaEQsS0FBSyxDQUFDLDBCQUEwQixLQUFLLE1BQU07WUFDM0MsT0FBTyxPQUFPLENBQUMseUJBQXlCLEVBQ3RDLDhFQUE4RSxDQUFDLENBQUE7UUFFbkYsTUFBTSxJQUFJLEdBQUcsS0FBSyxDQUFDLGFBQWEsQ0FBQyxHQUFHLENBQUMsU0FBUyxDQUFDLENBQUE7UUFFL0MsS0FBSyxNQUFNLEdBQUcsSUFBSSxJQUFJO1lBQ3BCLElBQUksR0FBRyxZQUFZLEtBQUs7Z0JBQ3RCLE9BQU8sT0FBTyxDQUFDLHNCQUFzQixFQUFFLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQTtRQUV2RCxNQUFNLFFBQVEsR0FBYTtZQUN6QixXQUFXLEVBQUUsS0FBSyxDQUFDLFdBQVc7WUFDOUIsVUFBVSxFQUFFLEtBQUssQ0FBQyxVQUFVO1lBQzVCLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUTtZQUN4QixLQUFLLEVBQUUsS0FBSyxDQUFDLEtBQUs7WUFDbEIsYUFBYSxFQUFFLElBQWdCO1NBQ2hDLENBQUE7UUFFRCxNQUFNLEVBQUUsR0FBRyxRQUFRLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFBO1FBRXhDLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQztZQUNoQyxLQUFLLEVBQUUsRUFBRSxFQUFFLEVBQUU7WUFDYixLQUFLLEVBQUU7Z0JBQ0wsU0FBUztnQkFDVCxJQUFJLEVBQUUsUUFBUSxDQUFDLFdBQVc7Z0JBQzFCLEdBQUcsRUFBRSxRQUFRLENBQUMsVUFBVTtnQkFDeEIsSUFBSSxFQUFFLFFBQVEsQ0FBQyxRQUFRO2dCQUN2QixLQUFLLEVBQUUsUUFBUSxDQUFDLEtBQUs7Z0JBQ3JCLElBQUksRUFBRSxRQUFRLENBQUMsYUFBYTtnQkFDNUIsT0FBTyxFQUFFLElBQUksQ0FBQyxHQUFHLEVBQUUsR0FBRyxJQUFJLENBQUMsR0FBRyxHQUFHLElBQUk7YUFDdEM7U0FDRixDQUFDLENBQUE7UUFFRixPQUFPO1lBQ0wsU0FBUyxFQUFFLEVBQUU7WUFDYixpRkFBaUY7WUFDakYsbUJBQW1CLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU0sQ0FBQyxRQUFRLElBQUksSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLEdBQUcsSUFBSSxDQUFDO1lBQ3ZFLFdBQVcsRUFBRSxNQUFNLENBQUMsSUFBSTtZQUN4QixVQUFVLEVBQUUsTUFBTSxDQUFDLEdBQUc7WUFDdEIsUUFBUSxFQUFFLE1BQU0sQ0FBQyxJQUFJO1lBQ3JCLGFBQWEsRUFBRSxNQUFNLENBQUMsSUFBSTtZQUMxQixXQUFXLEVBQUUsQ0FBQyxvQkFBb0IsQ0FBQztZQUNuQyxjQUFjLEVBQUUsQ0FBQyxNQUFNLENBQUM7WUFDeEIsMEJBQTBCLEVBQUUsTUFBTTtTQUNuQyxDQUFBO0lBQ0gsQ0FBQztDQUNGO0FBRUQscUZBQXFGO0FBQ3JGLFNBQVMsU0FBUyxDQUFFLEtBQWE7SUFDL0IsSUFBSSxHQUFRLENBQUE7SUFFWixJQUFJLENBQUM7UUFDSCxHQUFHLEdBQUcsSUFBSSxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUE7SUFDdEIsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sSUFBSSxLQUFLLENBQUMsS0FBSyxLQUFLLDJCQUEyQixDQUFDLENBQUE7SUFDekQsQ0FBQztJQUVELElBQUksR0FBRyxDQUFDLElBQUksS0FBSyxFQUFFO1FBQ2pCLE9BQU8sSUFBSSxLQUFLLENBQUMsS0FBSyxLQUFLLHVCQUF1QixDQUFDLENBQUE7SUFFckQsSUFBSSxHQUFHLENBQUMsUUFBUSxLQUFLLFFBQVE7UUFDM0IsT0FBTyxHQUFHLENBQUMsSUFBSSxDQUFBO0lBRWpCLElBQUksR0FBRyxDQUFDLFFBQVEsS0FBSyxPQUFPLElBQUksUUFBUSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDO1FBQ3hELE9BQU8sR0FBRyxDQUFDLElBQUksQ0FBQTtJQUVqQixPQUFPLElBQUksS0FBSyxDQUFDLEtBQUssS0FBSyw0Q0FBNEMsQ0FBQyxDQUFBO0FBQzFFLENBQUM7QUFFRCw2RkFBNkY7QUFDN0YsU0FBUyxPQUFPLENBQUUsS0FBYSxFQUFFLFdBQW1CO0lBQ2xELE9BQU8sRUFBRSxNQUFNLEVBQUUsV0FBVyxFQUFFLEtBQUssRUFBRSxpQkFBaUIsRUFBRSxXQUFXLEVBQUUsQ0FBQTtBQUN2RSxDQUFDO0FBRUQsTUFBTSxXQUFXLEdBQUcsR0FBRyxDQUFBO0FBRXZCLE1BQU0sUUFBUSxHQUFHLElBQUksR0FBRyxDQUFDLENBQUMsV0FBVyxFQUFFLE9BQU8sRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFBIn0=