@toa.io/extensions.exposition 1.0.0-alpha.282 → 1.0.0-alpha.284

package/components/identity.federation/operations/lib/exchange.js

@@ -45,12 +45,17 @@ export async function exchange(credentials, ctx) {
     if (tokens.id_token === undefined)
         return errors.ERR_NO_TOKEN;
     const jwks = await createRemoteJWKSet(iss, ctx.fetch);
-    const { payload } = await jose.jwtVerify(tokens.id_token, jwks, {
-        issuer: iss,
-        audience: trusted.aud,
-        requiredClaims: ['exp']
-    });
-    return payload;
+    try {
+        const { payload } = await jose.jwtVerify(tokens.id_token, jwks, {
+            issuer: iss,
+            audience: trusted.aud,
+            requiredClaims: ['exp']
+        });
+        return payload;
+    }
+    catch {
+        return errors.ERR_TOKEN;
+    }
 }
 function decode(credentials) {
     const json = Buffer.from(credentials, 'base64').toString('utf8');
@@ -78,4 +83,4 @@ async function sign(trust) {
         .sign(key);
 }
 const CREDENTIAL_PROPERTIES = ['for', 'iss', 'code'];
-//# sourceMappingURL=exchange.js.map
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXhjaGFuZ2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zb3VyY2UvbGliL2V4Y2hhbmdlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxJQUFJLEVBQUUsTUFBTSxXQUFXLENBQUE7QUFDaEMsT0FBTyxFQUFFLGtCQUFrQixFQUFFLFFBQVEsRUFBRSxNQUFNLGdCQUFnQixDQUFBO0FBQzdELE9BQU8sS0FBSyxNQUFNLE1BQU0sYUFBYSxDQUFBO0FBS3JDLE1BQU0sQ0FBQyxLQUFLLFVBQVUsUUFBUSxDQUFFLFdBQW1CLEVBQUUsR0FBUTtJQUMzRCxNQUFNLElBQUksR0FBRyxNQUFNLElBQUksRUFBRSxDQUFBO0lBQ3pCLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxXQUFXLENBQUMsQ0FBQTtJQUV0QyxJQUFJLFVBQVUsWUFBWSxLQUFLO1FBQzdCLE9BQU8sVUFBVSxDQUFBO0lBRW5CLE1BQU0sRUFBRSxJQUFJLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxRQUFRLEVBQUUsR0FBRyxVQUFVLENBQUE7SUFFL0MsTUFBTSxPQUFPLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxHQUFHLEtBQUssR0FBRyxDQUFDLENBQUE7SUFFNUQsSUFBSSxPQUFPLEtBQUssU0FBUztRQUN2QixPQUFPLE1BQU0sQ0FBQyxTQUFTLENBQUE7SUFFekIsSUFBSSxPQUFPLENBQUMsR0FBRyxLQUFLLFNBQVMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEtBQUssU0FBUyxJQUFJLE9BQU8sQ0FBQyxTQUFTLEtBQUssU0FBUyxDQUFDO1FBQ2hHLE9BQU8sTUFBTSxDQUFDLG9CQUFvQixDQUFBO0lBRXBDLE1BQU0sYUFBYSxHQUFHLE1BQU0sUUFBUSxDQUFDLEdBQUcsRUFBRSxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUE7SUFFcEQsSUFBSSxhQUFhLENBQUMsY0FBYyxLQUFLLFNBQVM7UUFDNUMsT0FBTyxNQUFNLENBQUMsVUFBVSxDQUFBO0lBRTFCLGdFQUFnRTtJQUNoRSxNQUFNLEdBQUcsR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQTtJQUNyRSxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsTUFBTSxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUE7SUFDM0YsTUFBTSxNQUFNLEdBQUcsSUFBSSxlQUFlLEVBQUUsQ0FBQTtJQUVwQyxNQUFNLENBQUMsTUFBTSxDQUFDLFlBQVksRUFBRSxvQkFBb0IsQ0FBQyxDQUFBO0lBQ2pELE1BQU0sQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxDQUFBO0lBQzNCLE1BQU0sQ0FBQyxNQUFNLENBQUMsV0FBVyxFQUFFLEdBQUcsQ0FBQyxDQUFBO0lBQy9CLE1BQU0sQ0FBQyxNQUFNLENBQUMsZUFBZSxFQUFFLE1BQU0sQ0FBQyxDQUFBO0lBQ3RDLE1BQU0sQ0FBQyxNQUFNLENBQUMsY0FBYyxFQUFFLFFBQVEsQ0FBQyxDQUFBO0lBRXZDLEdBQUcsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLGlCQUFpQixFQUFFO1FBQ2hDLEdBQUc7UUFDSCxHQUFHO1FBQ0gsR0FBRyxFQUFFLFFBQVE7UUFDYixJQUFJLEVBQUUsT0FBTyxDQUFDLE1BQU0sS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUMsUUFBUTtLQUM1RCxDQUFDLENBQUE7SUFFRixNQUFNLFFBQVEsR0FBRyxNQUFNLEdBQUcsQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLGNBQWMsRUFBRTtRQUM3RCxNQUFNLEVBQUUsTUFBTTtRQUNkLE9BQU8sRUFBRTtZQUNQLGNBQWMsRUFBRSxtQ0FBbUM7U0FDcEQ7UUFDRCxJQUFJLEVBQUUsTUFBTTtLQUNiLENBQUMsQ0FBQTtJQUVGLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxFQUFFLENBQUM7UUFDakIsR0FBRyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsc0JBQXNCLEVBQUUsRUFBRSxNQUFNLEVBQUUsUUFBUSxDQUFDLE1BQU0sRUFBRSxJQUFJLEVBQUUsTUFBTSxRQUFRLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxDQUFBO1FBRWhHLE9BQU8sTUFBTSxDQUFDLFlBQVksQ0FBQTtJQUM1QixDQUFDO0lBRUQsTUFBTSxNQUFNLEdBQUcsTUFBTSxRQUFRLENBQUMsSUFBSSxFQUEwQixDQUFBO0lBRTVELElBQUksTUFBTSxDQUFDLFFBQVEsS0FBSyxTQUFTO1FBQy9CLE9BQU8sTUFBTSxDQUFDLFlBQVksQ0FBQTtJQUU1QixNQUFNLElBQUksR0FBRyxNQUFNLGtCQUFrQixDQUFDLEdBQUcsRUFBRSxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUE7SUFFckQsSUFBSSxDQUFDO1FBQ0gsTUFBTSxFQUFFLE9BQU8sRUFBRSxHQUFHLE1BQU0sSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFLElBQUksRUFBRTtZQUM5RCxNQUFNLEVBQUUsR0FBRztZQUNYLFFBQVEsRUFBRSxPQUFPLENBQUMsR0FBRztZQUNyQixjQUFjLEVBQUUsQ0FBQyxLQUFLLENBQUM7U0FDeEIsQ0FBQyxDQUFBO1FBRUYsT0FBTyxPQUFrQixDQUFBO0lBQzNCLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLE1BQU0sQ0FBQyxTQUFTLENBQUE7SUFDekIsQ0FBQztBQUNILENBQUM7QUFFRCxTQUFTLE1BQU0sQ0FBRSxXQUFtQjtJQUNsQyxNQUFNLElBQUksR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLFdBQVcsRUFBRSxRQUFRLENBQUMsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUE7SUFDaEUsTUFBTSxVQUFVLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQWUsQ0FBQTtJQUVqRCxJQUNFLE9BQU8sVUFBVSxDQUFDLElBQUksS0FBSyxRQUFRO1FBQ25DLE9BQU8sVUFBVSxDQUFDLEdBQUcsS0FBSyxRQUFRO1FBQ2xDLE9BQU8sVUFBVSxDQUFDLEdBQUcsS0FBSyxRQUFRO1FBQ2xDLE1BQU0sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUMsTUFBTSxLQUFLLHFCQUFxQixDQUFDLE1BQU07UUFFL0QsT0FBTyxNQUFNLENBQUMsZUFBZSxDQUFBO0lBRS9CLE9BQU8sVUFBVSxDQUFBO0FBQ25CLENBQUM7QUFFRCxLQUFLLFVBQVUsSUFBSSxDQUFFLEtBQVk7SUFDL0IsTUFBTSxJQUFJLEdBQUcsTUFBTSxJQUFJLEVBQUUsQ0FBQTtJQUN6QixNQUFNLFNBQVMsR0FBRyxLQUFLLENBQUMsU0FBVSxDQUFBO0lBQ2xDLE1BQU0sR0FBRyxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBSSxDQUFBO0lBQ2hFLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQyxDQUFBO0lBQ3pDLE1BQU0sR0FBRyxHQUFHLE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxFQUFFLE9BQU8sQ0FBQyxDQUFBO0lBRW5FLE9BQU8sTUFBTSxJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1NBQzlCLGtCQUFrQixDQUFDLEVBQUUsR0FBRyxFQUFFLE9BQU8sRUFBRSxHQUFHLEVBQUUsU0FBUyxDQUFDLEdBQUcsRUFBRSxDQUFDO1NBQ3hELFdBQVcsQ0FBQyxHQUFHLENBQUM7U0FDaEIsaUJBQWlCLENBQUMsR0FBRyxHQUFHLEdBQUcsQ0FBQztTQUM1QixTQUFTLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQztTQUN4QixVQUFVLENBQUMsR0FBRyxDQUFDO1NBQ2YsV0FBVyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUM7U0FDdEIsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFBO0FBQ2QsQ0FBQztBQUVELE1BQU0scUJBQXFCLEdBQTRCLENBQUMsS0FBSyxFQUFFLEtBQUssRUFBRSxNQUFNLENBQUMsQ0FBQSJ9

package/components/identity.federation/operations/lib/index.js

@@ -1,4 +1,5 @@
 export { decode } from './decode.js';
 export { exchange } from './exchange.js';
+export { principal } from './principal.js';
 export { resolve } from './resolve.js';
-//# sourceMappingURL=index.js.map
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zb3VyY2UvbGliL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxNQUFNLEVBQUUsTUFBTSxhQUFhLENBQUE7QUFDcEMsT0FBTyxFQUFFLFFBQVEsRUFBRSxNQUFNLGVBQWUsQ0FBQTtBQUN4QyxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0sZ0JBQWdCLENBQUE7QUFDMUMsT0FBTyxFQUFFLE9BQU8sRUFBRSxNQUFNLGNBQWMsQ0FBQSJ9

package/components/identity.federation/operations/lib/jose.js

@@ -1,2 +1,2 @@
 export const load = async () => await import('jose');
-//# sourceMappingURL=jose.js.map
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiam9zZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS9saWIvam9zZS5qcyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxNQUFNLENBQUMsTUFBTSxJQUFJLEdBQUcsS0FBSyxJQUFJLEVBQUUsQ0FBQyxNQUFNLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQSJ9

package/components/identity.federation/operations/lib/principal.js

@@ -0,0 +1,14 @@
+/**
+ * The `system` Role is granted where the credentials are created, before the reply that mints
+ * a Token from them — the event that carries the same grant lands after it.
+ */
+export async function principal(credential, context) {
+    const configured = context.configuration.principal;
+    if (configured === undefined ||
+        configured.authority !== credential.authority ||
+        configured.iss !== credential.iss ||
+        configured.sub !== credential.sub)
+        return;
+    await context.remote.identity.roles.principal({ input: { id: credential.identity } });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJpbmNpcGFsLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc291cmNlL2xpYi9wcmluY2lwYWwudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBRUE7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSxTQUFTLENBQUUsVUFBa0IsRUFBRSxPQUFnQjtJQUNuRSxNQUFNLFVBQVUsR0FBRyxPQUFPLENBQUMsYUFBYSxDQUFDLFNBQVMsQ0FBQTtJQUVsRCxJQUFJLFVBQVUsS0FBSyxTQUFTO1FBQzFCLFVBQVUsQ0FBQyxTQUFTLEtBQUssVUFBVSxDQUFDLFNBQVM7UUFDN0MsVUFBVSxDQUFDLEdBQUcsS0FBSyxVQUFVLENBQUMsR0FBRztRQUNqQyxVQUFVLENBQUMsR0FBRyxLQUFLLFVBQVUsQ0FBQyxHQUFHO1FBQ2pDLE9BQU07SUFFUixNQUFNLE9BQU8sQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFFLEVBQUUsVUFBVSxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FBQTtBQUN2RixDQUFDIn0=

package/components/identity.federation/operations/lib/resolve.js

@@ -10,4 +10,4 @@ export async function resolve(scheme, credentials, context) {
         ? await decode(credentials, ctx)
         : await exchange(credentials, ctx);
 }
-//# sourceMappingURL=resolve.js.map
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVzb2x2ZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS9saWIvcmVzb2x2ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsTUFBTSxFQUFFLE1BQU0sYUFBYSxDQUFBO0FBQ3BDLE9BQU8sRUFBRSxRQUFRLEVBQUUsTUFBTSxlQUFlLENBQUE7QUFLeEMsTUFBTSxDQUFDLEtBQUssVUFBVSxPQUFPLENBQUUsTUFBYyxFQUFFLFdBQW1CLEVBQUUsT0FBZ0I7SUFDbEYsTUFBTSxHQUFHLEdBQVE7UUFDZixLQUFLLEVBQUUsT0FBTyxDQUFDLGFBQWEsQ0FBQyxLQUFLO1FBQ2xDLElBQUksRUFBRSxPQUFPLENBQUMsSUFBSTtRQUNsQixLQUFLLEVBQUUsT0FBTyxDQUFDLEtBQUs7S0FDckIsQ0FBQTtJQUVELE9BQU8sTUFBTSxLQUFLLFFBQVE7UUFDeEIsQ0FBQyxDQUFDLE1BQU0sTUFBTSxDQUFDLFdBQVcsRUFBRSxHQUFHLENBQUM7UUFDaEMsQ0FBQyxDQUFDLE1BQU0sUUFBUSxDQUFDLFdBQVcsRUFBRSxHQUFHLENBQUMsQ0FBQTtBQUN0QyxDQUFDIn0=

package/components/identity.federation/operations/list.js

@@ -9,4 +9,4 @@ export async function computation({ authority, identity }, context) {
         }
     });
 }
-//# sourceMappingURL=list.js.map
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibGlzdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NvdXJjZS9saXN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxLQUFLLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQTtBQUd2QyxNQUFNLENBQUMsS0FBSyxVQUFVLFdBQVcsQ0FBRSxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQVMsRUFBRSxPQUFnQjtJQUNqRixPQUFPLE1BQU0sT0FBTyxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUM7UUFDbkMsS0FBSyxFQUFFO1lBQ0wsUUFBUSxFQUFFLGNBQWMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxjQUFjLEtBQUssQ0FBQyxRQUFRLENBQUMsRUFBRTtZQUN2RSxVQUFVLEVBQUUsQ0FBQyxLQUFLLENBQUM7WUFDbkIsSUFBSSxFQUFFLENBQUMsZUFBZSxDQUFDO1lBQ3ZCLEtBQUssRUFBRSxHQUFHO1NBQ1g7S0FDRixDQUFDLENBQUE7QUFDSixDQUFDIn0=

package/components/identity.federation/operations/types/Scheme.js

@@ -1,2 +1,2 @@
 export {};
-//# sourceMappingURL=Scheme.js.map
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiU2NoZW1lLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc291cmNlL3R5cGVzL1NjaGVtZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiIn0=

package/components/identity.federation/operations/types/configuration.js

@@ -1,2 +1,2 @@
 export {};
-//# sourceMappingURL=configuration.js.map
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29uZmlndXJhdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS90eXBlcy9jb25maWd1cmF0aW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIifQ==

package/components/identity.federation/operations/types/context.js

@@ -1,2 +1,2 @@
 export {};
-//# sourceMappingURL=context.js.map
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29udGV4dC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS90eXBlcy9jb250ZXh0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIifQ==

package/components/identity.federation/operations/types/entity.js

@@ -1,2 +1,2 @@
 export {};
-//# sourceMappingURL=entity.js.map
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW50aXR5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc291cmNlL3R5cGVzL2VudGl0eS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiIn0=

package/components/identity.federation/operations/types/index.js

@@ -2,4 +2,4 @@ export * from './configuration.js';
 export * from './context.js';
 export * from './entity.js';
 export * from './Scheme.js';
-//# sourceMappingURL=index.js.map
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zb3VyY2UvdHlwZXMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYyxvQkFBb0IsQ0FBQTtBQUNsQyxjQUFjLGNBQWMsQ0FBQTtBQUM1QixjQUFjLGFBQWEsQ0FBQTtBQUMzQixjQUFjLGFBQWEsQ0FBQSJ9

package/components/identity.federation/source/authenticate.ts

@@ -1,7 +1,7 @@
 import { newid, quote } from '@toa.io/generic'
-import { resolve } from './lib/index.js'
+import { principal, resolve } from './lib/index.js'
 import type { JWTPayload } from 'jose'
-import type { Maybe } from '@toa.io/types'
+import type { Maybe } from '@toa.io/core'
 import type { Context, Scheme } from './types/index.js'
 
 export async function effect ({ scheme, authority, credentials }: Input, context: Context): Promise<Maybe<Output>> {
@@ -18,10 +18,12 @@ export async function effect ({ scheme, authority, credentials }: Input, context
 
   const query = { criteria: `authority==${quote(authority)};iss==${quote(iss)};sub==${quote(sub)}` }
 
+  const asserted = newid()
+
   const credential = context.configuration.assert !== false
     ? await context.local.ensure({
       query,
-      entity: { authority, iss, sub, identity: newid() }
+      entity: { authority, iss, sub, identity: asserted }
     })
     : await context.local.observe({ query })
 
@@ -31,6 +33,10 @@ export async function effect ({ scheme, authority, credentials }: Input, context
   if (credential instanceof Error)
     return credential
 
+  // the Identity this call has just created is the only one whose Role is not granted yet
+  if (credential.identity === asserted)
+    await principal(credential, context)
+
   return { identity: { id: credential.identity, claims } }
 }
 

package/components/identity.federation/source/incept.ts

@@ -1,10 +1,16 @@
 import { effect as create } from './create.js'
+import { principal } from './lib/index.js'
 import type { Context, Scheme } from './types/index.js'
 
 export async function effect (input: Input, context: Context): Promise<Output | Error> {
   const credential = await create(input, context)
 
-  return credential instanceof Error ? credential : { id: credential.identity }
+  if (credential instanceof Error)
+    return credential
+
+  await principal(credential, context)
+
+  return { id: credential.identity }
 }
 
 export interface Input {

package/components/identity.federation/source/lib/Ctx.ts

@@ -1,9 +1,9 @@
-import type { telemetry } from '@toa.io/types'
+import type { Logs } from '@toa.io/extensions.telemetry'
 import type { Trust } from '../types/index.js'
 import type { Fetch } from '../types/context.js'
 
 export interface Ctx {
   trust: Trust[]
-  logs: telemetry.Logs
+  logs: Logs
   fetch: Fetch
 }

package/components/identity.federation/source/lib/decode.ts

@@ -1,12 +1,23 @@
 import { load } from './jose.js'
 import { createRemoteJWKSet } from './discovery.js'
-import { ERR_TRUST, ERR_ISS, ERR_SUB } from './errors.js'
+import { ERR_TRUST, ERR_ISS, ERR_SUB, ERR_TOKEN } from './errors.js'
+import type { JWTPayload } from 'jose'
 import type { Ctx } from './Ctx.js'
 import type { Payload } from './Payload.js'
 
 export async function decode (token: string, ctx: Ctx): Promise<Payload | Error> {
   const jose = await load()
-  const { iss, sub } = jose.decodeJwt(token)
+
+  let claims: JWTPayload
+
+  // jose throws on anything it cannot read, and credentials are the client's to malform
+  try {
+    claims = jose.decodeJwt(token)
+  } catch {
+    return ERR_TOKEN
+  }
+
+  const { iss, sub } = claims
 
   if (typeof iss !== 'string')
     return ERR_ISS
@@ -19,13 +30,18 @@ export async function decode (token: string, ctx: Ctx): Promise<Payload | Error>
   if (trusted === undefined)
     return ERR_TRUST
 
+  // the issuer is a configured one by now, so reaching its keys is the deployment's to answer for
   const jwks = await createRemoteJWKSet(iss, ctx.fetch)
 
-  const { payload } = await jose.jwtVerify(token, jwks, {
-    issuer: iss,
-    audience: trusted.aud,
-    requiredClaims: ['exp']
-  })
-
-  return payload as Payload
+  try {
+    const { payload } = await jose.jwtVerify(token, jwks, {
+      issuer: iss,
+      audience: trusted.aud,
+      requiredClaims: ['exp']
+    })
+
+    return payload as Payload
+  } catch {
+    return ERR_TOKEN
+  }
 }

package/components/identity.federation/source/lib/errors.ts

@@ -1,3 +1,8 @@
+export const ERR_TOKEN = new (class TokenError extends Error {
+  public readonly code = 'TOKEN'
+  public override readonly message = 'Token is malformed or does not verify'
+})()
+
 export const ERR_TRUST = new (class TrustError extends Error {
   public readonly code = 'TRUST'
   public override readonly message = 'Issuer not trusted'

package/components/identity.federation/source/lib/exchange.ts

@@ -66,13 +66,17 @@ export async function exchange (credentials: string, ctx: Ctx): Promise<Payload
 
   const jwks = await createRemoteJWKSet(iss, ctx.fetch)
 
-  const { payload } = await jose.jwtVerify(tokens.id_token, jwks, {
-    issuer: iss,
-    audience: trusted.aud,
-    requiredClaims: ['exp']
-  })
-
-  return payload as Payload
+  try {
+    const { payload } = await jose.jwtVerify(tokens.id_token, jwks, {
+      issuer: iss,
+      audience: trusted.aud,
+      requiredClaims: ['exp']
+    })
+
+    return payload as Payload
+  } catch {
+    return errors.ERR_TOKEN
+  }
 }
 
 function decode (credentials: string): Properties | Error {

package/components/identity.federation/source/lib/index.ts

@@ -1,4 +1,5 @@
 export { decode } from './decode.js'
 export { exchange } from './exchange.js'
+export { principal } from './principal.js'
 export { resolve } from './resolve.js'
 export { type Ctx } from './Ctx.js'

package/components/identity.federation/source/lib/principal.ts

@@ -0,0 +1,17 @@
+import type { Context, Entity } from '../types/index.js'
+
+/**
+ * The `system` Role is granted where the credentials are created, before the reply that mints
+ * a Token from them — the event that carries the same grant lands after it.
+ */
+export async function principal (credential: Entity, context: Context): Promise<void> {
+  const configured = context.configuration.principal
+
+  if (configured === undefined ||
+    configured.authority !== credential.authority ||
+    configured.iss !== credential.iss ||
+    configured.sub !== credential.sub)
+    return
+
+  await context.remote.identity.roles.principal({ input: { id: credential.identity } })
+}

package/components/identity.federation/source/types/configuration.ts

@@ -1,4 +1,4 @@
-import type { Secret } from '@toa.io/types'
+import type { Secret } from '@toa.io/extensions.configuration'
 
 export interface Configuration {
   trust: Trust[]

package/components/identity.federation/source/types/context.ts

@@ -1,5 +1,6 @@
 import type { JWTPayload } from 'jose'
-import type { Call, Observation, Query, telemetry, Transition } from '@toa.io/types'
+import type { Call, Observation, Query, Transition } from '@toa.io/core'
+import type { Logs } from '@toa.io/extensions.telemetry'
 import type { Entity } from './entity.js'
 import type { Configuration } from './configuration.js'
 
@@ -18,9 +19,12 @@ export interface Context {
       tokens: {
         revoke: Call<void, IdentityTokensRevokeInput>
       }
+      roles: {
+        principal: Call<void, { id: string }>
+      }
     }
   }
-  logs: telemetry.Logs
+  logs: Logs
   configuration: Configuration
 }
 

package/components/identity.federation/tsconfig.json

@@ -1,8 +1,10 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../../../tsconfig.component.json",
   "compilerOptions": {
     "outDir": "./operations",
     "rootDir": "./source"
   },
-  "include": ["source"]
+  "include": [
+    "source"
+  ]
 }