@toa.io/extensions.exposition 1.0.0-alpha.285 → 1.0.0-alpha.286

package/components/identity.tokens/source/encrypt.test.ts

@@ -22,7 +22,11 @@ beforeEach(() => {
   context.configuration = {
     keys: [
       { id: 'key0', key: secret('sTxL6qVOadKkUJwh3FveU53XgTEo3Sdfg7k2FfiIKfs') },
-      { id: 'legacy0', key: secret('k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog'), format: 'paseto' }
+      {
+        id: 'legacy0',
+        key: secret('k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog'),
+        format: 'paseto'
+      }
     ],
     lifetime: 1,
     refresh: 2,
@@ -57,8 +61,7 @@ it('should use the first encryption key as active and expose its id as kid', asy
     identity: { id: generate(), roles: [] }
   })
 
-  if (encrypted instanceof Error)
-    throw encrypted
+  if (encrypted instanceof Error) throw encrypted
 
   const header = JSON.parse(Buffer.from(encrypted.split('.')[0], 'base64url').toString())
 
@@ -73,15 +76,17 @@ it('should encrypt with configured lifetime by default', async () => {
     identity
   })
 
-  if (encrypted instanceof Error)
-    throw encrypted
+  if (encrypted instanceof Error) throw encrypted
 
-  await assert.partialDeepStrictEqual(await decrypt.execute(encrypted), { iss: authority, identity })
+  await assert.partialDeepStrictEqual(await decrypt.execute(encrypted), {
+    iss: authority,
+    identity
+  })
 
   await timeout(context.configuration.lifetime * 1000)
 
   const thrown: any = await decrypt.execute(encrypted)
-        assert.deepStrictEqual(thrown.code, 'INVALID_TOKEN')
+  assert.deepStrictEqual(thrown.code, 'INVALID_TOKEN')
 })
 
 it('should encrypt with given lifetime', async () => {
@@ -94,15 +99,17 @@ it('should encrypt with given lifetime', async () => {
     lifetime
   })
 
-  if (encrypted instanceof Error)
-    throw encrypted
+  if (encrypted instanceof Error) throw encrypted
 
-  await assert.partialDeepStrictEqual(await decrypt.execute(encrypted), { iss: authority, identity })
+  await assert.partialDeepStrictEqual(await decrypt.execute(encrypted), {
+    iss: authority,
+    identity
+  })
 
   await timeout(lifetime * 1000)
 
   const thrown: any = await decrypt.execute(encrypted)
-        assert.deepStrictEqual(thrown.code, 'INVALID_TOKEN')
+  assert.deepStrictEqual(thrown.code, 'INVALID_TOKEN')
 })
 
 it('should encrypt without lifetime INSECURE', async () => {
@@ -115,8 +122,7 @@ it('should encrypt without lifetime INSECURE', async () => {
     lifetime
   })
 
-  if (encrypted instanceof Error)
-    throw encrypted
+  if (encrypted instanceof Error) throw encrypted
 
   const decrypted = await decrypt.execute(encrypted)
 
@@ -131,8 +137,7 @@ it('should keep the identity permissions when none are given', async () => {
 
   const encrypted = await encrypt.execute({ authority, identity, lifetime: 100 })
 
-  if (encrypted instanceof Error)
-    throw encrypted
+  if (encrypted instanceof Error) throw encrypted
 
   const decrypted = await decrypt.execute(encrypted)
 
@@ -140,6 +145,6 @@ it('should keep the identity permissions when none are given', async () => {
   assert.deepStrictEqual(decrypted.identity.permissions, permissions)
 })
 
-function secret (value: string): Secret {
+function secret(value: string): Secret {
   return { unwrap: () => value }
 }

package/components/identity.tokens/source/encrypt.ts

@@ -1,30 +1,29 @@
 import { jweKey } from './lib/index.js'
 import { load } from './lib/jose.js'
 import type { Operation } from '@toa.io/bridges.node'
-import type { Maybe } from '@toa.io/core'
+import type { Maybe } from '@toa.io/core/types'
 import type { Identity, Context, EncryptInput, Key } from './lib/index.js'
 
 export class Effect implements Operation {
   private key!: Pick<Key, 'id' | 'key'>
   private lifetime!: number
 
-  public mount (context: Context): void {
+  public mount(context: Context): void {
     const key = context.configuration.keys.find(({ format }) => format !== 'paseto')
 
-    if (key === undefined)
-      throw new TypeError('At least one JWE key must be configured')
+    if (key === undefined) throw new TypeError('At least one JWE key must be configured')
 
     this.key = { id: key.id, key: key.key.unwrap() }
     this.lifetime = context.configuration.lifetime * 1000
   }
 
-  public async execute (input: EncryptInput): Promise<Maybe<string>> {
+  public async execute(input: EncryptInput): Promise<Maybe<string>> {
     const { EncryptJWT } = await load()
 
     if (input.scopes?.some((scope) => !within(scope, input.identity.roles)) === true)
       return ERR_INACCESSIBLE_SCOPE
 
-    const lifetime = input.lifetime === undefined ? this.lifetime : (input.lifetime * 1000)
+    const lifetime = input.lifetime === undefined ? this.lifetime : input.lifetime * 1000
 
     const identity: Identity = {
       id: input.identity.id,
@@ -33,8 +32,7 @@ export class Effect implements Operation {
 
     const permissions = input.permissions ?? input.identity.permissions
 
-    if (permissions !== undefined)
-      identity.permissions = permissions
+    if (permissions !== undefined) identity.permissions = permissions
 
     const key = input.key ?? this.key
 
@@ -43,14 +41,13 @@ export class Effect implements Operation {
       .setIssuer(input.authority)
       .setIssuedAt(Date.now() / 1000)
 
-    if (lifetime !== 0)
-      token = token.setExpirationTime((Date.now() + lifetime) / 1000)
+    if (lifetime !== 0) token = token.setExpirationTime((Date.now() + lifetime) / 1000)
 
     return await token.encrypt(jweKey(key.key))
   }
 }
 
-function within (scope: string, roles: string[]): boolean {
+function within(scope: string, roles: string[]): boolean {
   return roles.some((role) => role === scope || scope.startsWith(role + ':'))
 }
 

package/components/identity.tokens/source/issue.test.ts

@@ -46,8 +46,10 @@ it('should expire a token issued without a lifetime as the configuration says',
 
   const seconds = (reply.exp - now) / 1000
 
-  assert.ok(Math.abs(seconds - LIFETIME) < 10,
-    `expected to expire in about ${LIFETIME} seconds, got ${seconds}`)
+  assert.ok(
+    Math.abs(seconds - LIFETIME) < 10,
+    `expected to expire in about ${LIFETIME} seconds, got ${seconds}`
+  )
 })
 
 it('should hand the lifetime to `encrypt` in the seconds it reads', async () => {

package/components/identity.tokens/source/issue.ts

@@ -1,5 +1,5 @@
 import { quote } from '@toa.io/generic'
-import type { Maybe } from '@toa.io/core'
+import type { Maybe } from '@toa.io/core/types'
 import type { Operation } from '@toa.io/bridges.node'
 import type { Context, Identity } from './lib/index.js'
 
@@ -9,7 +9,7 @@ export class Effect implements Operation {
   private encrypt!: Context['local']['encrypt']
   private lifetime!: number
 
-  public mount (context: Context): void {
+  public mount(context: Context): void {
     this.keys = context.remote.identity.keys
     this.roles = context.remote.identity.roles
     this.encrypt = context.local.encrypt
@@ -17,12 +17,11 @@ export class Effect implements Operation {
     this.lifetime = context.configuration.lifetime
   }
 
-  public async execute (input: Input): Promise<Maybe<Output>> {
+  public async execute(input: Input): Promise<Maybe<Output>> {
     const lifetime = input.lifetime ?? this.lifetime
 
-    const expires = lifetime === 0
-      ? undefined
-      : new Date(Date.now() + lifetime * 1000).getTime()
+    const expires =
+      lifetime === 0 ? undefined : new Date(Date.now() + lifetime * 1000).getTime()
 
     const key = await this.keys.create({
       input: {
@@ -57,8 +56,7 @@ export class Effect implements Operation {
       }
     })
 
-    if (token instanceof Error)
-      return token
+    if (token instanceof Error) return token
 
     return {
       kid: key.id,

package/components/identity.tokens/source/lib/form.ts

@@ -4,22 +4,18 @@
  * Read without decrypting, and without trusting: a credential that lies about its form
  * only reaches a verifier that rejects it.
  */
-export function form (token: string): Form | null {
-  if (token.startsWith(PASETO))
-    return 'paseto'
+export function form(token: string): Form | null {
+  if (token.startsWith(PASETO)) return 'paseto'
 
-  if (segments(token) === JWE_SEGMENTS)
-    return 'jwe'
+  if (segments(token) === JWE_SEGMENTS) return 'jwe'
 
   return null
 }
 
-function segments (token: string): number {
+function segments(token: string): number {
   let count = 1
 
-  for (let i = 0; i < token.length; i++)
-    if (token.charCodeAt(i) === DOT)
-      count++
+  for (let i = 0; i < token.length; i++) if (token.charCodeAt(i) === DOT) count++
 
   return count
 }

package/components/identity.tokens/source/lib/jose.d.ts

@@ -1 +1 @@
-export function load (): Promise<typeof import('jose')>
+export function load(): Promise<typeof import('jose')>

package/components/identity.tokens/source/lib/key.ts

@@ -1,4 +1,4 @@
-export function jweKey (value: string): Uint8Array {
+export function jweKey(value: string): Uint8Array {
   const key = Buffer.from(value, 'base64url')
 
   if (key.length !== 32 || key.toString('base64url') !== value)

package/components/identity.tokens/source/lib/paseto.test.ts

@@ -1,8 +1,13 @@
 import { it } from 'node:test'
 import assert from 'node:assert/strict'
 
-import { DecryptFactory, EncryptFactory, ExportKeyFactory, GenerateKeyFactory, ImportKeyFactory }
-  from 'paseto/v3/local'
+import {
+  DecryptFactory,
+  EncryptFactory,
+  ExportKeyFactory,
+  GenerateKeyFactory,
+  ImportKeyFactory
+} from 'paseto/v3/local'
 
 const generateKey = GenerateKeyFactory().run
 const exportKey = ExportKeyFactory().run
@@ -29,19 +34,25 @@ it('should round trip a token', async () => {
 
 it('should carry the key id in the footer, which is read without the key', async () => {
   const key = await importKey(await exportKey(await generateKey({ extractable: true })))
-  const token = await encrypt(key, { iss: 'test' },
-    { footer: new TextEncoder().encode(JSON.stringify({ kid: 'key0' })) })
+  const token = await encrypt(
+    key,
+    { iss: 'test' },
+    { footer: new TextEncoder().encode(JSON.stringify({ kid: 'key0' })) }
+  )
 
   // decrypt reads it, and so does anyone holding only the token
   const [, , , footer] = token.split('.')
 
-  assert.deepStrictEqual(JSON.parse(Buffer.from(footer, 'base64url').toString()), { kid: 'key0' })
+  assert.deepStrictEqual(JSON.parse(Buffer.from(footer, 'base64url').toString()), {
+    kid: 'key0'
+  })
 })
 
 it('should decrypt a token issued under paseto 3', async () => {
   // both written by paseto 3.1.4: the legacy path exists to read tokens already in the wild
   const key = await importKey('k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog')
-  const token = 'v3.local.Fm7vzrYSDh7Kc9j_2eNr4vwWw5jSEOIKrh_vCbteQQP57tFo5xxk7koNIJQNcH9b' +
+  const token =
+    'v3.local.Fm7vzrYSDh7Kc9j_2eNr4vwWw5jSEOIKrh_vCbteQQP57tFo5xxk7koNIJQNcH9b' +
     'O4yH9ItoC-fWL3ycm-YqBIsadjfbSOvwhffP130-tw3MZZ5PNJzFe6afNa4wxbKpa1bWtOwwULJpAqmZ' +
     '.eyJraWQiOiJsZWdhY3kwIn0'
 

package/components/identity.tokens/source/revoke.ts

@@ -1,5 +1,5 @@
 import type { Entity } from './lib/index.js'
 
-export function transition (_: unknown, object: Entity): void {
+export function transition(_: unknown, object: Entity): void {
   object.revokedAt = Date.now()
 }