@toa.io/extensions.exposition 1.0.0-alpha.282 → 1.0.0-alpha.284

package/components/identity.grants/manifest.toa.yaml

@@ -0,0 +1,245 @@
+namespace: identity
+name: grants
+
+# What a user allowed a client to do on their behalf. The authorization code is not here:
+# it is single-use and lives seconds, so it is held in the stash and redeemed atomically.
+entity:
+  associated: true
+  schema:
+    type: object
+    properties:
+      authority:
+        type: string
+      identity:
+        type: string
+      client:
+        type: string
+      scope:
+        type: array
+        items:
+          type: string
+      resource:
+        type: array
+        items:
+          type: string
+      kid:
+        description: The identity.keys record backing the access token, revoked with the grant
+        type: string
+      revokedAt:
+        type: integer
+    required:
+      - authority
+      - identity
+      - client
+  index:
+    identity:
+      authority: asc
+      identity: asc
+
+operations:
+  transit:
+    concurrency: retry
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        identity:
+          type: string
+        client:
+          type: string
+        scope:
+          type: array
+          items:
+            type: string
+        resource:
+          type: array
+          items:
+            type: string
+        kid:
+          type: string
+      required:
+        - authority
+        - identity
+        - client
+
+  authorize:
+    query: false
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        identity:
+          type: string
+        client:
+          type: string
+          maxLength: 2048
+        redirect:
+          type: string
+          maxLength: 2048
+        challenge:
+          description: PKCE code challenge, S256 of the verifier
+          type: string
+          minLength: 43
+          maxLength: 128
+        method:
+          type: string
+        scope:
+          type: array
+          items:
+            type: string
+        resource:
+          type: array
+          items:
+            type: string
+            maxLength: 2048
+      required:
+        - authority
+        - identity
+        - client
+        - redirect
+        - challenge
+        - method
+    output:
+      type: object
+      properties:
+        status:
+          description: Read and removed by `io:status`
+          type: number
+        code:
+          type: string
+        expires_in:
+          type: number
+        error:
+          type: string
+        error_description:
+          type: string
+
+  exchange:
+    query: false
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        grant_type:
+          type: string
+        code:
+          type: string
+          maxLength: 512
+        code_verifier:
+          type: string
+          minLength: 43
+          maxLength: 128
+        redirect_uri:
+          type: string
+          maxLength: 2048
+        client_id:
+          type: string
+          maxLength: 2048
+        resource:
+          description: A form repeats a name to say a list, so either shape arrives
+          type: [string, array]
+      required:
+        - authority
+        - grant_type
+    output:
+      type: object
+      properties:
+        status:
+          type: number
+        access_token:
+          type: string
+        token_type:
+          type: string
+        expires_in:
+          type: number
+        scope:
+          type: string
+        error:
+          type: string
+        error_description:
+          type: string
+
+  list:
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        identity:
+          type: string
+      required:
+        - authority
+        - identity
+
+  revoke:
+    output: { type: 'null' }
+    concurrency: retry
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        identity:
+          type: string
+      required:
+        - authority
+        - identity
+    errors:
+      - NOT_FOUND
+
+configuration:
+  schema:
+    type: object
+    properties:
+      lifetime:
+        description: Seconds an authorization code may be redeemed within
+        type: integer
+        minimum: 1
+        maximum: 600
+        default: 60
+      token:
+        description: Seconds an access token is valid for; 0 is until it is revoked
+        type: integer
+        minimum: 0
+        default: 2592000
+    # both have defaults, so the component reads them without checking
+    required: [lifetime, token]
+
+stash: ~
+
+exposition:
+  isolated: true
+  /:
+    POST:
+      anonymous: true
+      map:authority: authority
+      io:input: [grant_type, code, code_verifier, redirect_uri, client_id, resource]
+      io:output: true
+      io:status: status
+      io:throttle:
+        key: ip
+        requests: 60
+        interval: 60
+      cache:exact: no-store
+      endpoint: exchange
+    /:identity:
+      auth:id: identity
+      map:authority: authority
+      map:segments:
+        identity: identity
+      GET:
+        io:output: [id, client, scope, resource, _created]
+        endpoint: list
+      POST:
+        io:input: [client, redirect, challenge, method, scope, resource]
+        io:output: [code, expires_in, error, error_description]
+        io:status: status
+        cache:exact: no-store
+        endpoint: authorize
+      /:id:
+        DELETE:
+          io:output: false
+          endpoint: revoke

package/components/identity.grants/operations/authorize.js

@@ -0,0 +1,54 @@
+import { hold, identify } from './lib/index.js';
+/**
+ * What the consent page calls when a user allows a client. The page holds the user's own
+ * credentials, so this is the user's own route; the code it answers with is what the client
+ * redeems at the token endpoint.
+ *
+ * The grant is recorded so a user can see what they allowed and take it back. It is not
+ * consulted to skip the prompt — consent is asked every time, which is what keeps a client
+ * that changed where it wants a code sent from being waved through on an older one.
+ */
+export class Effect {
+    context;
+    mount(context) {
+        this.context = context;
+    }
+    async execute(input) {
+        const { authority, identity } = input;
+        if (input.method !== S256)
+            return invalid('invalid_request', 'Only the S256 code challenge method is supported');
+        const client = await this.context.remote.identity.clients.describe({
+            input: { authority, id: input.client, redirect: input.redirect }
+        });
+        if (client instanceof Error)
+            return invalid('invalid_client', 'No such client');
+        if (client.permitted !== true)
+            return invalid('invalid_request', 'The redirect is not one this client may receive a code at');
+        const scope = input.scope ?? [];
+        // recorded on the grant and carried to the token endpoint, and restricting nothing yet:
+        // a token carries the rights of the identity that consented, over every path it may
+        // reach. What binds it is a `permissions` argument in `exchange`, see documentation/oauth.md
+        const resource = input.resource ?? [];
+        const grant = await this.context.local.transit({
+            query: { id: identify(authority, identity, input.client) },
+            input: { authority, identity, client: input.client, scope, resource }
+        });
+        if (grant instanceof Error)
+            return grant;
+        const code = await hold(authority, {
+            identity,
+            client: input.client,
+            redirect: input.redirect,
+            challenge: input.challenge,
+            scope,
+            resource
+        }, this.context);
+        return { code, expires_in: this.context.configuration.lifetime };
+    }
+}
+function invalid(error, description) {
+    return { status: BAD_REQUEST, error, error_description: description };
+}
+const S256 = 'S256';
+const BAD_REQUEST = 400;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXplLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2F1dGhvcml6ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsSUFBSSxFQUFFLFFBQVEsRUFBRSxNQUFNLGdCQUFnQixDQUFBO0FBSy9DOzs7Ozs7OztHQVFHO0FBQ0gsTUFBTSxPQUFPLE1BQU07SUFDVCxPQUFPLENBQVU7SUFFbEIsS0FBSyxDQUFFLE9BQWdCO1FBQzVCLElBQUksQ0FBQyxPQUFPLEdBQUcsT0FBTyxDQUFBO0lBQ3hCLENBQUM7SUFFTSxLQUFLLENBQUMsT0FBTyxDQUFFLEtBQVk7UUFDaEMsTUFBTSxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsR0FBRyxLQUFLLENBQUE7UUFFckMsSUFBSSxLQUFLLENBQUMsTUFBTSxLQUFLLElBQUk7WUFDdkIsT0FBTyxPQUFPLENBQUMsaUJBQWlCLEVBQUUsa0RBQWtELENBQUMsQ0FBQTtRQUV2RixNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDO1lBQ2pFLEtBQUssRUFBRSxFQUFFLFNBQVMsRUFBRSxFQUFFLEVBQUUsS0FBSyxDQUFDLE1BQU0sRUFBRSxRQUFRLEVBQUUsS0FBSyxDQUFDLFFBQVEsRUFBRTtTQUNqRSxDQUFDLENBQUE7UUFFRixJQUFJLE1BQU0sWUFBWSxLQUFLO1lBQ3pCLE9BQU8sT0FBTyxDQUFDLGdCQUFnQixFQUFFLGdCQUFnQixDQUFDLENBQUE7UUFFcEQsSUFBSSxNQUFNLENBQUMsU0FBUyxLQUFLLElBQUk7WUFDM0IsT0FBTyxPQUFPLENBQUMsaUJBQWlCLEVBQUUsMkRBQTJELENBQUMsQ0FBQTtRQUVoRyxNQUFNLEtBQUssR0FBRyxLQUFLLENBQUMsS0FBSyxJQUFJLEVBQUUsQ0FBQTtRQUUvQix3RkFBd0Y7UUFDeEYsb0ZBQW9GO1FBQ3BGLDZGQUE2RjtRQUM3RixNQUFNLFFBQVEsR0FBRyxLQUFLLENBQUMsUUFBUSxJQUFJLEVBQUUsQ0FBQTtRQUVyQyxNQUFNLEtBQUssR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQztZQUM3QyxLQUFLLEVBQUUsRUFBRSxFQUFFLEVBQUUsUUFBUSxDQUFDLFNBQVMsRUFBRSxRQUFRLEVBQUUsS0FBSyxDQUFDLE1BQU0sQ0FBQyxFQUFFO1lBQzFELEtBQUssRUFBRSxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUFNLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRTtTQUN0RSxDQUFDLENBQUE7UUFFRixJQUFJLEtBQUssWUFBWSxLQUFLO1lBQ3hCLE9BQU8sS0FBSyxDQUFBO1FBRWQsTUFBTSxJQUFJLEdBQUcsTUFBTSxJQUFJLENBQUMsU0FBUyxFQUFFO1lBQ2pDLFFBQVE7WUFDUixNQUFNLEVBQUUsS0FBSyxDQUFDLE1BQU07WUFDcEIsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRO1lBQ3hCLFNBQVMsRUFBRSxLQUFLLENBQUMsU0FBUztZQUMxQixLQUFLO1lBQ0wsUUFBUTtTQUNULEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFBO1FBRWhCLE9BQU8sRUFBRSxJQUFJLEVBQUUsVUFBVSxFQUFFLElBQUksQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDLFFBQVEsRUFBRSxDQUFBO0lBQ2xFLENBQUM7Q0FDRjtBQUVELFNBQVMsT0FBTyxDQUFFLEtBQWEsRUFBRSxXQUFtQjtJQUNsRCxPQUFPLEVBQUUsTUFBTSxFQUFFLFdBQVcsRUFBRSxLQUFLLEVBQUUsaUJBQWlCLEVBQUUsV0FBVyxFQUFFLENBQUE7QUFDdkUsQ0FBQztBQUVELE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQTtBQUNuQixNQUFNLFdBQVcsR0FBRyxHQUFHLENBQUEifQ==

package/components/identity.grants/operations/exchange.js

@@ -0,0 +1,89 @@
+import { identify, spend, verifies } from './lib/index.js';
+/**
+ * The token endpoint, RFC 6749 §4.1.3. Anonymous, because the clients this server knows are
+ * public ones with no secret to authenticate with: what stands in for that is PKCE, since
+ * only the client that began the flow holds the verifier the challenge was made from.
+ *
+ * Every failure here is `invalid_grant` without saying which check failed. A code that was
+ * replayed, a verifier that does not match and a redirect that was swapped are all the same
+ * answer, and telling them apart would say whether a stolen code was still live.
+ */
+export class Effect {
+    context;
+    mount(context) {
+        this.context = context;
+    }
+    async execute(input) {
+        const { authority } = input;
+        if (input.grant_type !== AUTHORIZATION_CODE)
+            return invalid('unsupported_grant_type', 'Only the authorization code grant is supported');
+        if (input.code === undefined || input.code_verifier === undefined)
+            return invalid('invalid_request', 'A code and a code verifier are required');
+        // spent first: a wrong verifier burns the code, which is what stops it being guessed at
+        const code = await spend(authority, input.code, this.context);
+        if (code === null || !this.redeemable(code, input))
+            return invalid('invalid_grant', 'The authorization code is not redeemable');
+        // `permissions` would bind the token to `code.resource` — `{'/mcp/**': ['*']}` for a
+        // resource at `/mcp/`, which `permits()` reads on every request. Left unset: the token
+        // carries the rights of the identity that consented, see documentation/oauth.md#audience
+        const issued = await this.context.remote.identity.tokens.issue({
+            input: {
+                authority,
+                identity: code.identity,
+                label: label(code.client),
+                lifetime: this.context.configuration.token,
+                ...(code.scope.length === 0 ? {} : { scopes: code.scope })
+            }
+        });
+        // the only refusal `issue` makes is a scope the consenting identity does not hold, and
+        // what it says about that is its own; the client is told what it may act on
+        if (issued instanceof Error)
+            return invalid('invalid_scope', 'The requested scope is not one the identity holds');
+        // the key the token was issued under, so revoking the grant revokes the token. The token
+        // is already out, so a grant that fails to record it is logged rather than unwound — it
+        // costs the user the ability to revoke, and refusing here would cost them the token too
+        const grant = await this.context.local.transit({
+            query: { id: identify(authority, code.identity, code.client) },
+            input: {
+                authority,
+                identity: code.identity,
+                client: code.client,
+                scope: code.scope,
+                resource: code.resource,
+                kid: issued.kid
+            }
+        });
+        if (grant instanceof Error)
+            this.context.logs.error('Grant not recorded for an issued token', { client: code.client, kid: issued.kid });
+        return {
+            // RFC 6749 §5.1 asks for 200, where a POST would otherwise answer 201
+            status: OK,
+            access_token: issued.token,
+            token_type: 'Bearer',
+            ...(issued.exp === undefined
+                ? {}
+                : { expires_in: Math.floor((issued.exp - Date.now()) / 1000) }),
+            ...(code.scope.length === 0 ? {} : { scope: code.scope.join(' ') })
+        };
+    }
+    redeemable(code, input) {
+        if (!verifies(code.challenge, input.code_verifier))
+            return false;
+        // RFC 6749 §4.1.3: what was sent to `authorize` must be sent again
+        if (input.redirect_uri !== undefined && input.redirect_uri !== code.redirect)
+            return false;
+        return input.client_id === undefined || input.client_id === code.client;
+    }
+}
+/** `identity.tokens` requires one, and it is what a user sees when listing what they issued. */
+function label(client) {
+    return client.slice(0, LABEL);
+}
+function invalid(error, description) {
+    return { status: BAD_REQUEST, error, error_description: description };
+}
+const AUTHORIZATION_CODE = 'authorization_code';
+const OK = 200;
+const BAD_REQUEST = 400;
+const LABEL = 64;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXhjaGFuZ2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zb3VyY2UvZXhjaGFuZ2UudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLFFBQVEsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLE1BQU0sZ0JBQWdCLENBQUE7QUFLMUQ7Ozs7Ozs7O0dBUUc7QUFDSCxNQUFNLE9BQU8sTUFBTTtJQUNULE9BQU8sQ0FBVTtJQUVsQixLQUFLLENBQUUsT0FBZ0I7UUFDNUIsSUFBSSxDQUFDLE9BQU8sR0FBRyxPQUFPLENBQUE7SUFDeEIsQ0FBQztJQUVNLEtBQUssQ0FBQyxPQUFPLENBQUUsS0FBWTtRQUNoQyxNQUFNLEVBQUUsU0FBUyxFQUFFLEdBQUcsS0FBSyxDQUFBO1FBRTNCLElBQUksS0FBSyxDQUFDLFVBQVUsS0FBSyxrQkFBa0I7WUFDekMsT0FBTyxPQUFPLENBQUMsd0JBQXdCLEVBQUUsZ0RBQWdELENBQUMsQ0FBQTtRQUU1RixJQUFJLEtBQUssQ0FBQyxJQUFJLEtBQUssU0FBUyxJQUFJLEtBQUssQ0FBQyxhQUFhLEtBQUssU0FBUztZQUMvRCxPQUFPLE9BQU8sQ0FBQyxpQkFBaUIsRUFBRSx5Q0FBeUMsQ0FBQyxDQUFBO1FBRTlFLHdGQUF3RjtRQUN4RixNQUFNLElBQUksR0FBRyxNQUFNLEtBQUssQ0FBQyxTQUFTLEVBQUUsS0FBSyxDQUFDLElBQUksRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUE7UUFFN0QsSUFBSSxJQUFJLEtBQUssSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxJQUFJLEVBQUUsS0FBSyxDQUFDO1lBQ2hELE9BQU8sT0FBTyxDQUFDLGVBQWUsRUFBRSwwQ0FBMEMsQ0FBQyxDQUFBO1FBRTdFLHFGQUFxRjtRQUNyRix1RkFBdUY7UUFDdkYseUZBQXlGO1FBQ3pGLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUM7WUFDN0QsS0FBSyxFQUFFO2dCQUNMLFNBQVM7Z0JBQ1QsUUFBUSxFQUFFLElBQUksQ0FBQyxRQUFRO2dCQUN2QixLQUFLLEVBQUUsS0FBSyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUM7Z0JBQ3pCLFFBQVEsRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxLQUFLO2dCQUMxQyxHQUFHLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQzthQUMzRDtTQUNGLENBQUMsQ0FBQTtRQUVGLHVGQUF1RjtRQUN2Riw0RUFBNEU7UUFDNUUsSUFBSSxNQUFNLFlBQVksS0FBSztZQUN6QixPQUFPLE9BQU8sQ0FBQyxlQUFlLEVBQUUsbURBQW1ELENBQUMsQ0FBQTtRQUV0Rix5RkFBeUY7UUFDekYsd0ZBQXdGO1FBQ3hGLHdGQUF3RjtRQUN4RixNQUFNLEtBQUssR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQztZQUM3QyxLQUFLLEVBQUUsRUFBRSxFQUFFLEVBQUUsUUFBUSxDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRTtZQUM5RCxLQUFLLEVBQUU7Z0JBQ0wsU0FBUztnQkFDVCxRQUFRLEVBQUUsSUFBSSxDQUFDLFFBQVE7Z0JBQ3ZCLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTTtnQkFDbkIsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLO2dCQUNqQixRQUFRLEVBQUUsSUFBSSxDQUFDLFFBQVE7Z0JBQ3ZCLEdBQUcsRUFBRSxNQUFNLENBQUMsR0FBRzthQUNoQjtTQUNGLENBQUMsQ0FBQTtRQUVGLElBQUksS0FBSyxZQUFZLEtBQUs7WUFDeEIsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLHdDQUF3QyxFQUM5RCxFQUFFLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTSxFQUFFLEdBQUcsRUFBRSxNQUFNLENBQUMsR0FBRyxFQUFFLENBQUMsQ0FBQTtRQUU3QyxPQUFPO1lBQ0wsc0VBQXNFO1lBQ3RFLE1BQU0sRUFBRSxFQUFFO1lBQ1YsWUFBWSxFQUFFLE1BQU0sQ0FBQyxLQUFLO1lBQzFCLFVBQVUsRUFBRSxRQUFRO1lBQ3BCLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxLQUFLLFNBQVM7Z0JBQzFCLENBQUMsQ0FBQyxFQUFFO2dCQUNKLENBQUMsQ0FBQyxFQUFFLFVBQVUsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsTUFBTSxDQUFDLEdBQUcsR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsR0FBRyxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQ2pFLEdBQUcsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztTQUNwRSxDQUFBO0lBQ0gsQ0FBQztJQUVPLFVBQVUsQ0FBRSxJQUFVLEVBQUUsS0FBWTtRQUMxQyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsS0FBSyxDQUFDLGFBQWMsQ0FBQztZQUNqRCxPQUFPLEtBQUssQ0FBQTtRQUVkLG1FQUFtRTtRQUNuRSxJQUFJLEtBQUssQ0FBQyxZQUFZLEtBQUssU0FBUyxJQUFJLEtBQUssQ0FBQyxZQUFZLEtBQUssSUFBSSxDQUFDLFFBQVE7WUFDMUUsT0FBTyxLQUFLLENBQUE7UUFFZCxPQUFPLEtBQUssQ0FBQyxTQUFTLEtBQUssU0FBUyxJQUFJLEtBQUssQ0FBQyxTQUFTLEtBQUssSUFBSSxDQUFDLE1BQU0sQ0FBQTtJQUN6RSxDQUFDO0NBQ0Y7QUFFRCxnR0FBZ0c7QUFDaEcsU0FBUyxLQUFLLENBQUUsTUFBYztJQUM1QixPQUFPLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLEtBQUssQ0FBQyxDQUFBO0FBQy9CLENBQUM7QUFFRCxTQUFTLE9BQU8sQ0FBRSxLQUFhLEVBQUUsV0FBbUI7SUFDbEQsT0FBTyxFQUFFLE1BQU0sRUFBRSxXQUFXLEVBQUUsS0FBSyxFQUFFLGlCQUFpQixFQUFFLFdBQVcsRUFBRSxDQUFBO0FBQ3ZFLENBQUM7QUFFRCxNQUFNLGtCQUFrQixHQUFHLG9CQUFvQixDQUFBO0FBQy9DLE1BQU0sRUFBRSxHQUFHLEdBQUcsQ0FBQTtBQUNkLE1BQU0sV0FBVyxHQUFHLEdBQUcsQ0FBQTtBQUN2QixNQUFNLEtBQUssR0FBRyxFQUFFLENBQUEifQ==

package/components/identity.grants/operations/lib/code.js

@@ -0,0 +1,30 @@
+import { createHash, randomBytes } from 'node:crypto';
+/**
+ * An authorization code is a bearer credential that lives for seconds. It is held under a
+ * hash of itself, so a dump of the store hands out none of them, and redeemed with `GETDEL`,
+ * so it is spent once however many requests arrive at once — the property the whole flow
+ * rests on, since a replayed code is a stolen grant.
+ */
+export async function hold(authority, code, context) {
+    const value = randomBytes(32).toString('base64url');
+    await context.stash.set(key(authority, value), JSON.stringify(code), 'EX', context.configuration.lifetime);
+    return value;
+}
+export async function spend(authority, value, context) {
+    const held = await context.stash.getdel(key(authority, value));
+    return held === null ? null : JSON.parse(held);
+}
+/**
+ * PKCE, RFC 7636: the client kept a verifier and sent its hash, and only the client that
+ * began the flow can present the verifier now. `S256` alone — `plain` proves nothing.
+ */
+export function verifies(challenge, verifier) {
+    return digest(verifier) === challenge;
+}
+export function digest(verifier) {
+    return createHash('sha256').update(verifier).digest('base64url');
+}
+function key(authority, value) {
+    return `oauth:code:${authority}:${createHash('sha256').update(value).digest('hex')}`;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29kZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS9saWIvY29kZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsVUFBVSxFQUFFLFdBQVcsRUFBRSxNQUFNLGFBQWEsQ0FBQTtBQUdyRDs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxLQUFLLFVBQVUsSUFBSSxDQUFFLFNBQWlCLEVBQUUsSUFBVSxFQUFFLE9BQWdCO0lBQ3pFLE1BQU0sS0FBSyxHQUFHLFdBQVcsQ0FBQyxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLENBQUE7SUFFbkQsTUFBTSxPQUFPLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsU0FBUyxFQUFFLEtBQUssQ0FBQyxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLEVBQ2pFLElBQUksRUFBRSxPQUFPLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxDQUFBO0lBRXZDLE9BQU8sS0FBSyxDQUFBO0FBQ2QsQ0FBQztBQUVELE1BQU0sQ0FBQyxLQUFLLFVBQVUsS0FBSyxDQUFFLFNBQWlCLEVBQUUsS0FBYSxFQUFFLE9BQWdCO0lBQzdFLE1BQU0sSUFBSSxHQUFHLE1BQU0sT0FBTyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLFNBQVMsRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFBO0lBRTlELE9BQU8sSUFBSSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBUyxDQUFBO0FBQ3hELENBQUM7QUFFRDs7O0dBR0c7QUFDSCxNQUFNLFVBQVUsUUFBUSxDQUFFLFNBQWlCLEVBQUUsUUFBZ0I7SUFDM0QsT0FBTyxNQUFNLENBQUMsUUFBUSxDQUFDLEtBQUssU0FBUyxDQUFBO0FBQ3ZDLENBQUM7QUFFRCxNQUFNLFVBQVUsTUFBTSxDQUFFLFFBQWdCO0lBQ3RDLE9BQU8sVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLENBQUE7QUFDbEUsQ0FBQztBQUVELFNBQVMsR0FBRyxDQUFFLFNBQWlCLEVBQUUsS0FBYTtJQUM1QyxPQUFPLGNBQWMsU0FBUyxJQUFJLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUE7QUFDdEYsQ0FBQyJ9

package/components/identity.grants/operations/lib/identify.js

@@ -0,0 +1,15 @@
+import { createHash } from 'node:crypto';
+/**
+ * A user holds one grant per client, so the record is addressed by the three things that
+ * say which: authorizing again replaces what is there rather than leaving another row, and
+ * revoking has one thing to revoke.
+ */
+export function identify(authority, identity, client) {
+    return createHash('sha256')
+        .update(JSON.stringify([authority, identity, client]))
+        .digest('hex')
+        .slice(0, LENGTH);
+}
+/** What the entity prototype accepts as an id. */
+const LENGTH = 32;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaWRlbnRpZnkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zb3VyY2UvbGliL2lkZW50aWZ5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSxhQUFhLENBQUE7QUFFeEM7Ozs7R0FJRztBQUNILE1BQU0sVUFBVSxRQUFRLENBQUUsU0FBaUIsRUFBRSxRQUFnQixFQUFFLE1BQWM7SUFDM0UsT0FBTyxVQUFVLENBQUMsUUFBUSxDQUFDO1NBQ3hCLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsU0FBUyxFQUFFLFFBQVEsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDO1NBQ3JELE1BQU0sQ0FBQyxLQUFLLENBQUM7U0FDYixLQUFLLENBQUMsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFBO0FBQ3JCLENBQUM7QUFFRCxrREFBa0Q7QUFDbEQsTUFBTSxNQUFNLEdBQUcsRUFBRSxDQUFBIn0=

package/components/identity.grants/operations/lib/index.js

@@ -0,0 +1,3 @@
+export * from './code.js';
+export * from './identify.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zb3VyY2UvbGliL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsV0FBVyxDQUFBO0FBQ3pCLGNBQWMsZUFBZSxDQUFBIn0=

package/components/identity.grants/operations/list.js

@@ -0,0 +1,18 @@
+import { quote } from '@toa.io/generic';
+/** What a user has allowed, for a screen that lets them take it back. */
+export class Computation {
+    enumerate;
+    mount(context) {
+        this.enumerate = context.local.enumerate;
+    }
+    async execute(input) {
+        return await this.enumerate({
+            query: {
+                criteria: `authority==${quote(input.authority)};identity==${quote(input.identity)}`,
+                limit: LIMIT
+            }
+        });
+    }
+}
+const LIMIT = 256;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibGlzdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NvdXJjZS9saXN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxLQUFLLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQTtBQUl2Qyx5RUFBeUU7QUFDekUsTUFBTSxPQUFPLFdBQVc7SUFDZCxTQUFTLENBQWdDO0lBRTFDLEtBQUssQ0FBRSxPQUFnQjtRQUM1QixJQUFJLENBQUMsU0FBUyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFBO0lBQzFDLENBQUM7SUFFTSxLQUFLLENBQUMsT0FBTyxDQUFFLEtBQVk7UUFDaEMsT0FBTyxNQUFNLElBQUksQ0FBQyxTQUFTLENBQUM7WUFDMUIsS0FBSyxFQUFFO2dCQUNMLFFBQVEsRUFBRSxjQUFjLEtBQUssQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLGNBQWMsS0FBSyxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsRUFBRTtnQkFDbkYsS0FBSyxFQUFFLEtBQUs7YUFDYjtTQUNGLENBQUMsQ0FBQTtJQUNKLENBQUM7Q0FDRjtBQUVELE1BQU0sS0FBSyxHQUFHLEdBQUcsQ0FBQSJ9

package/components/identity.grants/operations/revoke.js

@@ -0,0 +1,25 @@
+/**
+ * Taking back what was allowed. The token itself is not deleted — it is out in the world —
+ * so what is revoked is the key it was issued under, which is what `identity.tokens` reads
+ * it with. It stops being a token within `identity.tokens.cache.ttl`.
+ */
+export class Transition {
+    keys;
+    mount(context) {
+        this.keys = context.remote.identity.keys;
+    }
+    async execute(input, object) {
+        // the id is a route parameter, so a grant of another identity is asked for by anyone
+        // who guesses one; the authority and the identity are what say it is theirs
+        if (object._version === 0 || object.authority !== input.authority ||
+            object.identity !== input.identity)
+            return ERR_NOT_FOUND;
+        if (object.kid !== undefined)
+            await this.keys.disable({ query: { id: object.kid } });
+        object.revokedAt = Date.now();
+    }
+}
+const ERR_NOT_FOUND = new (class NotFoundError extends Error {
+    code = 'NOT_FOUND';
+})();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmV2b2tlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL3Jldm9rZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFJQTs7OztHQUlHO0FBQ0gsTUFBTSxPQUFPLFVBQVU7SUFDYixJQUFJLENBQXdDO0lBRTdDLEtBQUssQ0FBRSxPQUFnQjtRQUM1QixJQUFJLENBQUMsSUFBSSxHQUFHLE9BQU8sQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQTtJQUMxQyxDQUFDO0lBRU0sS0FBSyxDQUFDLE9BQU8sQ0FBRSxLQUFZLEVBQUUsTUFBYztRQUNoRCxxRkFBcUY7UUFDckYsNEVBQTRFO1FBQzVFLElBQUksTUFBTSxDQUFDLFFBQVEsS0FBSyxDQUFDLElBQUksTUFBTSxDQUFDLFNBQVMsS0FBSyxLQUFLLENBQUMsU0FBUztZQUMvRCxNQUFNLENBQUMsUUFBUSxLQUFLLEtBQUssQ0FBQyxRQUFRO1lBQ2xDLE9BQU8sYUFBYSxDQUFBO1FBRXRCLElBQUksTUFBTSxDQUFDLEdBQUcsS0FBSyxTQUFTO1lBQzFCLE1BQU0sSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFFLEVBQUUsTUFBTSxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsQ0FBQTtRQUV4RCxNQUFNLENBQUMsU0FBUyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQTtJQUMvQixDQUFDO0NBQ0Y7QUFFRCxNQUFNLGFBQWEsR0FBRyxJQUFJLENBQUMsTUFBTSxhQUFjLFNBQVEsS0FBSztJQUMxQyxJQUFJLEdBQUcsV0FBVyxDQUFBO0NBQ25DLENBQUMsRUFBRSxDQUFBIn0=

package/components/identity.grants/source/authorize.ts

@@ -0,0 +1,90 @@
+import { hold, identify } from './lib/index.js'
+import type { Maybe } from '@toa.io/core'
+import type { Operation } from '@toa.io/bridges.node'
+import type { Context } from './lib/index.js'
+
+/**
+ * What the consent page calls when a user allows a client. The page holds the user's own
+ * credentials, so this is the user's own route; the code it answers with is what the client
+ * redeems at the token endpoint.
+ *
+ * The grant is recorded so a user can see what they allowed and take it back. It is not
+ * consulted to skip the prompt — consent is asked every time, which is what keeps a client
+ * that changed where it wants a code sent from being waved through on an older one.
+ */
+export class Effect implements Operation {
+  private context!: Context
+
+  public mount (context: Context): void {
+    this.context = context
+  }
+
+  public async execute (input: Input): Promise<Maybe<Output>> {
+    const { authority, identity } = input
+
+    if (input.method !== S256)
+      return invalid('invalid_request', 'Only the S256 code challenge method is supported')
+
+    const client = await this.context.remote.identity.clients.describe({
+      input: { authority, id: input.client, redirect: input.redirect }
+    })
+
+    if (client instanceof Error)
+      return invalid('invalid_client', 'No such client')
+
+    if (client.permitted !== true)
+      return invalid('invalid_request', 'The redirect is not one this client may receive a code at')
+
+    const scope = input.scope ?? []
+
+    // recorded on the grant and carried to the token endpoint, and restricting nothing yet:
+    // a token carries the rights of the identity that consented, over every path it may
+    // reach. What binds it is a `permissions` argument in `exchange`, see documentation/oauth.md
+    const resource = input.resource ?? []
+
+    const grant = await this.context.local.transit({
+      query: { id: identify(authority, identity, input.client) },
+      input: { authority, identity, client: input.client, scope, resource }
+    })
+
+    if (grant instanceof Error)
+      return grant
+
+    const code = await hold(authority, {
+      identity,
+      client: input.client,
+      redirect: input.redirect,
+      challenge: input.challenge,
+      scope,
+      resource
+    }, this.context)
+
+    return { code, expires_in: this.context.configuration.lifetime }
+  }
+}
+
+function invalid (error: string, description: string): Output {
+  return { status: BAD_REQUEST, error, error_description: description }
+}
+
+const S256 = 'S256'
+const BAD_REQUEST = 400
+
+interface Input {
+  authority: string
+  identity: string
+  client: string
+  redirect: string
+  challenge: string
+  method: string
+  scope?: string[]
+  resource?: string[]
+}
+
+interface Output {
+  status?: number
+  code?: string
+  expires_in?: number
+  error?: string
+  error_description?: string
+}