@toa.io/extensions.exposition 1.0.0-alpha.29 → 1.0.0-alpha.291

package/components/identity.federation/operations/authenticate.js

@@ -1,21 +1,32 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.computation = void 0;
-const error_value_1 = require("error-value");
-const assertions_as_values_js_1 = require("./lib/assertions-as-values.js");
-const jwt_1 = require("./lib/jwt");
-async function authenticate({ authority, credentials }, context) {
-    const { iss, sub } = await (0, jwt_1.validateIdToken)(credentials, context.configuration.trust);
-    const request = { query: { criteria: `authority==${authority};iss==${iss};sub==${sub}` } };
-    let id = (await context.local.observe(request))?.id;
-    if (id === undefined) {
-        if (context.configuration.explicit_identity_creation === true)
-            return NOT_FOUND;
-        id = (await context.local.transit({ input: { authority, iss, sub } })).id;
-    }
-    return { identity: { id } };
+import { newid, quote } from '@toa.io/generic';
+import { principal, resolve } from './lib/index.js';
+export async function effect({ scheme, authority, credentials }, context) {
+    context.logs.debug('Authenticating', { scheme, authority });
+    const claims = await resolve(scheme, credentials, context);
+    if (claims instanceof Error)
+        return claims;
+    const { iss, sub } = claims;
+    context.logs.debug('Token claims', claims);
+    const query = {
+        criteria: `authority==${quote(authority)};iss==${quote(iss)};sub==${quote(sub)}`
+    };
+    const asserted = newid();
+    const credential = context.configuration.assert !== false
+        ? await context.local.ensure({
+            query,
+            entity: { authority, iss, sub, identity: asserted }
+        })
+        : await context.local.observe({ query });
+    if (credential === null)
+        return ERR_NOT_FOUND;
+    if (credential instanceof Error)
+        return credential;
+    // the Identity this call has just created is the only one whose Role is not granted yet
+    if (credential.identity === asserted)
+        await principal(credential, context);
+    return { identity: { id: credential.identity, claims } };
 }
-// Exporting as a function returning assertion errors as values
-exports.computation = (0, assertions_as_values_js_1.assertionsAsValues)(authenticate);
-const NOT_FOUND = (0, error_value_1.Err)('NOT_FOUND');
-//# sourceMappingURL=authenticate.js.map
+const ERR_NOT_FOUND = new (class NotFoundError extends Error {
+    code = 'NOT_FOUND';
+})();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aGVudGljYXRlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2F1dGhlbnRpY2F0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxNQUFNLGlCQUFpQixDQUFBO0FBQzlDLE9BQU8sRUFBRSxTQUFTLEVBQUUsT0FBTyxFQUFFLE1BQU0sZ0JBQWdCLENBQUE7QUFLbkQsTUFBTSxDQUFDLEtBQUssVUFBVSxNQUFNLENBQzFCLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxXQUFXLEVBQVMsRUFDekMsT0FBZ0I7SUFFaEIsT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsZ0JBQWdCLEVBQUUsRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLENBQUMsQ0FBQTtJQUUzRCxNQUFNLE1BQU0sR0FBRyxNQUFNLE9BQU8sQ0FBQyxNQUFNLEVBQUUsV0FBVyxFQUFFLE9BQU8sQ0FBQyxDQUFBO0lBRTFELElBQUksTUFBTSxZQUFZLEtBQUs7UUFBRSxPQUFPLE1BQU0sQ0FBQTtJQUUxQyxNQUFNLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLE1BQU0sQ0FBQTtJQUUzQixPQUFPLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxjQUFjLEVBQUUsTUFBTSxDQUFDLENBQUE7SUFFMUMsTUFBTSxLQUFLLEdBQUc7UUFDWixRQUFRLEVBQUUsY0FBYyxLQUFLLENBQUMsU0FBUyxDQUFDLFNBQVMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxTQUFTLEtBQUssQ0FBQyxHQUFHLENBQUMsRUFBRTtLQUNqRixDQUFBO0lBRUQsTUFBTSxRQUFRLEdBQUcsS0FBSyxFQUFFLENBQUE7SUFFeEIsTUFBTSxVQUFVLEdBQ2QsT0FBTyxDQUFDLGFBQWEsQ0FBQyxNQUFNLEtBQUssS0FBSztRQUNwQyxDQUFDLENBQUMsTUFBTSxPQUFPLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQztZQUN6QixLQUFLO1lBQ0wsTUFBTSxFQUFFLEVBQUUsU0FBUyxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsUUFBUSxFQUFFLFFBQVEsRUFBRTtTQUNwRCxDQUFDO1FBQ0osQ0FBQyxDQUFDLE1BQU0sT0FBTyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFBO0lBRTVDLElBQUksVUFBVSxLQUFLLElBQUk7UUFBRSxPQUFPLGFBQWEsQ0FBQTtJQUU3QyxJQUFJLFVBQVUsWUFBWSxLQUFLO1FBQUUsT0FBTyxVQUFVLENBQUE7SUFFbEQsd0ZBQXdGO0lBQ3hGLElBQUksVUFBVSxDQUFDLFFBQVEsS0FBSyxRQUFRO1FBQUUsTUFBTSxTQUFTLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxDQUFBO0lBRTFFLE9BQU8sRUFBRSxRQUFRLEVBQUUsRUFBRSxFQUFFLEVBQUUsVUFBVSxDQUFDLFFBQVEsRUFBRSxNQUFNLEVBQUUsRUFBRSxDQUFBO0FBQzFELENBQUM7QUFFRCxNQUFNLGFBQWEsR0FBRyxJQUFJLENBQUMsTUFBTSxhQUFjLFNBQVEsS0FBSztJQUMxQyxJQUFJLEdBQUcsV0FBVyxDQUFBO0NBQ25DLENBQUMsRUFBRSxDQUFBIn0=

package/components/identity.federation/operations/create.js

@@ -0,0 +1,29 @@
+import { quote } from '@toa.io/generic';
+import { resolve } from './lib/index.js';
+export async function effect(input, context) {
+    const claims = await resolve(input.scheme, input.credentials, context);
+    if (claims instanceof Error)
+        return claims;
+    const { iss, sub } = claims;
+    const existent = await context.local.observe({
+        query: {
+            criteria: `authority==${quote(input.authority)};iss==${quote(iss)};sub==${quote(sub)}`,
+            deleted: true
+        }
+    });
+    const record = { authority: input.authority, iss, sub, identity: input.id };
+    if (existent === null)
+        return await context.local.transit({ input: record });
+    if (existent.DELETED === undefined || existent.DELETED === null)
+        return existent.identity === input.id ? existent : ERR_EXISTS;
+    // a deleted record still occupies the unique index, so the transition revives it
+    return await context.local.transit({
+        input: record,
+        query: { id: existent.id, deleted: true }
+    });
+}
+const ERR_EXISTS = new (class ExistsError extends Error {
+    code = 'EXISTS';
+    message = 'Federation credentials are associated with another Identity';
+})();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY3JlYXRlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2NyZWF0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsS0FBSyxFQUFFLE1BQU0saUJBQWlCLENBQUE7QUFDdkMsT0FBTyxFQUFFLE9BQU8sRUFBRSxNQUFNLGdCQUFnQixDQUFBO0FBR3hDLE1BQU0sQ0FBQyxLQUFLLFVBQVUsTUFBTSxDQUFDLEtBQVksRUFBRSxPQUFnQjtJQUN6RCxNQUFNLE1BQU0sR0FBRyxNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsTUFBTSxFQUFFLEtBQUssQ0FBQyxXQUFXLEVBQUUsT0FBTyxDQUFDLENBQUE7SUFFdEUsSUFBSSxNQUFNLFlBQVksS0FBSztRQUFFLE9BQU8sTUFBTSxDQUFBO0lBRTFDLE1BQU0sRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsTUFBTSxDQUFBO0lBRTNCLE1BQU0sUUFBUSxHQUFHLE1BQU0sT0FBTyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUM7UUFDM0MsS0FBSyxFQUFFO1lBQ0wsUUFBUSxFQUFFLGNBQWMsS0FBSyxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsU0FBUyxLQUFLLENBQUMsR0FBRyxDQUFDLFNBQVMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxFQUFFO1lBQ3RGLE9BQU8sRUFBRSxJQUFJO1NBQ2Q7S0FDRixDQUFDLENBQUE7SUFFRixNQUFNLE1BQU0sR0FBRyxFQUFFLFNBQVMsRUFBRSxLQUFLLENBQUMsU0FBUyxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsUUFBUSxFQUFFLEtBQUssQ0FBQyxFQUFFLEVBQUUsQ0FBQTtJQUUzRSxJQUFJLFFBQVEsS0FBSyxJQUFJO1FBQUUsT0FBTyxNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUE7SUFFNUUsSUFBSSxRQUFRLENBQUMsT0FBTyxLQUFLLFNBQVMsSUFBSSxRQUFRLENBQUMsT0FBTyxLQUFLLElBQUk7UUFDN0QsT0FBTyxRQUFRLENBQUMsUUFBUSxLQUFLLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsVUFBVSxDQUFBO0lBRS9ELGlGQUFpRjtJQUNqRixPQUFPLE1BQU0sT0FBTyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUM7UUFDakMsS0FBSyxFQUFFLE1BQU07UUFDYixLQUFLLEVBQUUsRUFBRSxFQUFFLEVBQUUsUUFBUSxDQUFDLEVBQUUsRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFO0tBQzFDLENBQUMsQ0FBQTtBQUNKLENBQUM7QUFTRCxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsTUFBTSxXQUFZLFNBQVEsS0FBSztJQUNyQyxJQUFJLEdBQUcsUUFBUSxDQUFBO0lBQ04sT0FBTyxHQUM5Qiw2REFBNkQsQ0FBQTtDQUNoRSxDQUFDLEVBQUUsQ0FBQSJ9

package/components/identity.federation/operations/decode.js

@@ -0,0 +1,9 @@
+import { decode } from './lib/index.js';
+export async function effect(token, context) {
+    return await decode(token, {
+        trust: context.configuration.trust,
+        logs: context.logs,
+        fetch: context.fetch
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVjb2RlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2RlY29kZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsTUFBTSxFQUFFLE1BQU0sZ0JBQWdCLENBQUE7QUFJdkMsTUFBTSxDQUFDLEtBQUssVUFBVSxNQUFNLENBQzFCLEtBQWEsRUFDYixPQUFnQjtJQUVoQixPQUFPLE1BQU0sTUFBTSxDQUFDLEtBQUssRUFBRTtRQUN6QixLQUFLLEVBQUUsT0FBTyxDQUFDLGFBQWEsQ0FBQyxLQUFLO1FBQ2xDLElBQUksRUFBRSxPQUFPLENBQUMsSUFBSTtRQUNsQixLQUFLLEVBQUUsT0FBTyxDQUFDLEtBQUs7S0FDckIsQ0FBQyxDQUFBO0FBQ0osQ0FBQyJ9

package/components/identity.federation/operations/delete.js

@@ -0,0 +1,7 @@
+export async function effect({ authority, identity, credential }, context) {
+    const object = await context.local.observe({ query: { id: credential } });
+    if (object === null || object.authority !== authority || object.identity !== identity)
+        return null;
+    return await context.local.terminate({ query: { id: credential } });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVsZXRlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2RlbGV0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFFQSxNQUFNLENBQUMsS0FBSyxVQUFVLE1BQU0sQ0FDMUIsRUFBRSxTQUFTLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBUyxFQUMxQyxPQUFnQjtJQUVoQixNQUFNLE1BQU0sR0FBRyxNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxFQUFFLFVBQVUsRUFBRSxFQUFFLENBQUMsQ0FBQTtJQUV6RSxJQUFJLE1BQU0sS0FBSyxJQUFJLElBQUksTUFBTSxDQUFDLFNBQVMsS0FBSyxTQUFTLElBQUksTUFBTSxDQUFDLFFBQVEsS0FBSyxRQUFRO1FBQ25GLE9BQU8sSUFBSSxDQUFBO0lBRWIsT0FBTyxNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxFQUFFLFVBQVUsRUFBRSxFQUFFLENBQUMsQ0FBQTtBQUNyRSxDQUFDIn0=

package/components/identity.federation/operations/incept.js

@@ -1,14 +1,10 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.effect = void 0;
-const assertions_as_values_js_1 = require("./lib/assertions-as-values.js");
-const jwt_1 = require("./lib/jwt");
-async function incept(input, context) {
-    const { iss, sub } = await (0, jwt_1.validateIdToken)(input.credentials, context.configuration.trust);
-    const request = { input: { authority: input.authority, iss, sub } };
-    if (input.id !== undefined)
-        request.query = { id: input.id };
-    return await context.local.transit(request);
+import { effect as create } from './create.js';
+import { principal } from './lib/index.js';
+export async function effect(input, context) {
+    const credential = await create(input, context);
+    if (credential instanceof Error)
+        return credential;
+    await principal(credential, context);
+    return { id: credential.identity };
 }
-exports.effect = (0, assertions_as_values_js_1.assertionsAsValues)(incept);
-//# sourceMappingURL=incept.js.map
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5jZXB0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2luY2VwdC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsTUFBTSxJQUFJLE1BQU0sRUFBRSxNQUFNLGFBQWEsQ0FBQTtBQUM5QyxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0sZ0JBQWdCLENBQUE7QUFHMUMsTUFBTSxDQUFDLEtBQUssVUFBVSxNQUFNLENBQUMsS0FBWSxFQUFFLE9BQWdCO0lBQ3pELE1BQU0sVUFBVSxHQUFHLE1BQU0sTUFBTSxDQUFDLEtBQUssRUFBRSxPQUFPLENBQUMsQ0FBQTtJQUUvQyxJQUFJLFVBQVUsWUFBWSxLQUFLO1FBQUUsT0FBTyxVQUFVLENBQUE7SUFFbEQsTUFBTSxTQUFTLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxDQUFBO0lBRXBDLE9BQU8sRUFBRSxFQUFFLEVBQUUsVUFBVSxDQUFDLFFBQVEsRUFBRSxDQUFBO0FBQ3BDLENBQUMifQ==

package/components/identity.federation/operations/lib/Configuration.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiQ29uZmlndXJhdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS9saWIvQ29uZmlndXJhdGlvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiIn0=

package/components/identity.federation/operations/lib/Ctx.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiQ3R4LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc291cmNlL2xpYi9DdHgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiJ9

package/components/identity.federation/operations/lib/Payload.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiUGF5bG9hZC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS9saWIvUGF5bG9hZC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiIn0=

package/components/identity.federation/operations/lib/decode.js

@@ -0,0 +1,36 @@
+import { load } from './jose.js';
+import { createRemoteJWKSet } from './discovery.js';
+import { ERR_TRUST, ERR_ISS, ERR_SUB, ERR_TOKEN } from './errors.js';
+export async function decode(token, ctx) {
+    const jose = await load();
+    let claims;
+    // jose throws on anything it cannot read, and credentials are the client's to malform
+    try {
+        claims = jose.decodeJwt(token);
+    }
+    catch {
+        return ERR_TOKEN;
+    }
+    const { iss, sub } = claims;
+    if (typeof iss !== 'string')
+        return ERR_ISS;
+    if (typeof sub !== 'string')
+        return ERR_SUB;
+    const trusted = ctx.trust.find((trust) => trust.iss === iss);
+    if (trusted === undefined)
+        return ERR_TRUST;
+    // the issuer is a configured one by now, so reaching its keys is the deployment's to answer for
+    const jwks = await createRemoteJWKSet(iss, ctx.fetch);
+    try {
+        const { payload } = await jose.jwtVerify(token, jwks, {
+            issuer: iss,
+            audience: trusted.aud,
+            requiredClaims: ['exp']
+        });
+        return payload;
+    }
+    catch {
+        return ERR_TOKEN;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVjb2RlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc291cmNlL2xpYi9kZWNvZGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLElBQUksRUFBRSxNQUFNLFdBQVcsQ0FBQTtBQUNoQyxPQUFPLEVBQUUsa0JBQWtCLEVBQUUsTUFBTSxnQkFBZ0IsQ0FBQTtBQUNuRCxPQUFPLEVBQUUsU0FBUyxFQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0sYUFBYSxDQUFBO0FBS3BFLE1BQU0sQ0FBQyxLQUFLLFVBQVUsTUFBTSxDQUFDLEtBQWEsRUFBRSxHQUFRO0lBQ2xELE1BQU0sSUFBSSxHQUFHLE1BQU0sSUFBSSxFQUFFLENBQUE7SUFFekIsSUFBSSxNQUFrQixDQUFBO0lBRXRCLHNGQUFzRjtJQUN0RixJQUFJLENBQUM7UUFDSCxNQUFNLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsQ0FBQTtJQUNoQyxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxTQUFTLENBQUE7SUFDbEIsQ0FBQztJQUVELE1BQU0sRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsTUFBTSxDQUFBO0lBRTNCLElBQUksT0FBTyxHQUFHLEtBQUssUUFBUTtRQUFFLE9BQU8sT0FBTyxDQUFBO0lBRTNDLElBQUksT0FBTyxHQUFHLEtBQUssUUFBUTtRQUFFLE9BQU8sT0FBTyxDQUFBO0lBRTNDLE1BQU0sT0FBTyxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsR0FBRyxLQUFLLEdBQUcsQ0FBQyxDQUFBO0lBRTVELElBQUksT0FBTyxLQUFLLFNBQVM7UUFBRSxPQUFPLFNBQVMsQ0FBQTtJQUUzQyxnR0FBZ0c7SUFDaEcsTUFBTSxJQUFJLEdBQUcsTUFBTSxrQkFBa0IsQ0FBQyxHQUFHLEVBQUUsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFBO0lBRXJELElBQUksQ0FBQztRQUNILE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyxNQUFNLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxFQUFFLElBQUksRUFBRTtZQUNwRCxNQUFNLEVBQUUsR0FBRztZQUNYLFFBQVEsRUFBRSxPQUFPLENBQUMsR0FBRztZQUNyQixjQUFjLEVBQUUsQ0FBQyxLQUFLLENBQUM7U0FDeEIsQ0FBQyxDQUFBO1FBRUYsT0FBTyxPQUFrQixDQUFBO0lBQzNCLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLFNBQVMsQ0FBQTtJQUNsQixDQUFDO0FBQ0gsQ0FBQyJ9

package/components/identity.federation/operations/lib/discovery.js

@@ -0,0 +1,34 @@
+import { load } from './jose.js';
+const cache = new Map();
+const resolvers = new WeakMap();
+export async function discover(iss, fetch) {
+    if (!cache.has(iss)) {
+        const configuration = await fetchConfiguration(iss, fetch);
+        cache.set(iss, configuration);
+    }
+    return cache.get(iss);
+}
+async function fetchConfiguration(iss, fetch) {
+    const response = await fetch(`${iss}/.well-known/openid-configuration`);
+    if (!response.ok)
+        throw new Error('Failed to fetch OIDC configuration');
+    return (await response.json());
+}
+export async function createRemoteJWKSet(iss, fetch) {
+    let entries = resolvers.get(fetch);
+    if (entries === undefined) {
+        entries = new Map();
+        resolvers.set(fetch, entries);
+    }
+    if (!entries.has(iss))
+        entries.set(iss, create(iss, fetch));
+    return await entries.get(iss);
+}
+async function create(iss, fetch) {
+    const jose = await load();
+    const configuration = await discover(iss, fetch);
+    return jose.createRemoteJWKSet(new URL(configuration.jwks_uri), {
+        [jose.customFetch]: fetch
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGlzY292ZXJ5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc291cmNlL2xpYi9kaXNjb3ZlcnkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLElBQUksRUFBRSxNQUFNLFdBQVcsQ0FBQTtBQUtoQyxNQUFNLEtBQUssR0FBRyxJQUFJLEdBQUcsRUFBeUIsQ0FBQTtBQUM5QyxNQUFNLFNBQVMsR0FBRyxJQUFJLE9BQU8sRUFBa0QsQ0FBQTtBQUUvRSxNQUFNLENBQUMsS0FBSyxVQUFVLFFBQVEsQ0FBQyxHQUFXLEVBQUUsS0FBWTtJQUN0RCxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3BCLE1BQU0sYUFBYSxHQUFHLE1BQU0sa0JBQWtCLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxDQUFBO1FBRTFELEtBQUssQ0FBQyxHQUFHLENBQUMsR0FBRyxFQUFFLGFBQWEsQ0FBQyxDQUFBO0lBQy9CLENBQUM7SUFFRCxPQUFPLEtBQUssQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFFLENBQUE7QUFDeEIsQ0FBQztBQUVELEtBQUssVUFBVSxrQkFBa0IsQ0FBQyxHQUFXLEVBQUUsS0FBWTtJQUN6RCxNQUFNLFFBQVEsR0FBRyxNQUFNLEtBQUssQ0FBQyxHQUFHLEdBQUcsbUNBQW1DLENBQUMsQ0FBQTtJQUV2RSxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUU7UUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLG9DQUFvQyxDQUFDLENBQUE7SUFFdkUsT0FBTyxDQUFDLE1BQU0sUUFBUSxDQUFDLElBQUksRUFBRSxDQUFrQixDQUFBO0FBQ2pELENBQUM7QUFFRCxNQUFNLENBQUMsS0FBSyxVQUFVLGtCQUFrQixDQUN0QyxHQUFXLEVBQ1gsS0FBWTtJQUVaLElBQUksT0FBTyxHQUFHLFNBQVMsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUE7SUFFbEMsSUFBSSxPQUFPLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDMUIsT0FBTyxHQUFHLElBQUksR0FBRyxFQUFFLENBQUE7UUFDbkIsU0FBUyxDQUFDLEdBQUcsQ0FBQyxLQUFLLEVBQUUsT0FBTyxDQUFDLENBQUE7SUFDL0IsQ0FBQztJQUVELElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQztRQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsR0FBRyxFQUFFLE1BQU0sQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLENBQUMsQ0FBQTtJQUUzRCxPQUFPLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUUsQ0FBQTtBQUNoQyxDQUFDO0FBRUQsS0FBSyxVQUFVLE1BQU0sQ0FBQyxHQUFXLEVBQUUsS0FBWTtJQUM3QyxNQUFNLElBQUksR0FBRyxNQUFNLElBQUksRUFBRSxDQUFBO0lBQ3pCLE1BQU0sYUFBYSxHQUFHLE1BQU0sUUFBUSxDQUFDLEdBQUcsRUFBRSxLQUFLLENBQUMsQ0FBQTtJQUVoRCxPQUFPLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLEVBQUU7UUFDOUQsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLEVBQUUsS0FBSztLQUMxQixDQUFDLENBQUE7QUFDSixDQUFDIn0=

package/components/identity.federation/operations/lib/errors.js

@@ -0,0 +1,45 @@
+export const ERR_TOKEN = new (class TokenError extends Error {
+    code = 'TOKEN';
+    message = 'Token is malformed or does not verify';
+})();
+export const ERR_TRUST = new (class TrustError extends Error {
+    code = 'TRUST';
+    message = 'Issuer not trusted';
+})();
+export const ERR_RESPONSE = new (class ResponseError extends Error {
+    code = 'RESPONSE';
+    message = 'Request to IDP failed';
+})();
+export const ERR_CONFIG = new (class ConfigError extends Error {
+    code = 'CONFIG';
+    message = 'Invalid OpenID configuration';
+})();
+export const ERR_NO_TOKEN = new (class NoTokenError extends Error {
+    code = 'NO_TOKEN';
+    message = 'No ID token received';
+})();
+export const ERR_ISS = new (class IssError extends Error {
+    code = 'ISS';
+    message = 'Invalid issuer claim';
+})();
+export const ERR_SUB = new (class SubError extends Error {
+    code = 'SUB';
+    message = 'Invalid subject claim';
+})();
+export const ERR_EXP = new (class ExpError extends Error {
+    code = 'EXP';
+    message = 'Token does not have an expiration time';
+})();
+export const ERR_REPLAY = new (class ReplayError extends Error {
+    code = 'REPLAY';
+    message = 'Token has already been used';
+})();
+export const ERR_CODE_NOT_ENABLED = new (class CodeNotEnabledError extends Error {
+    code = 'CODE_NOT_ENABLED';
+    message = 'Authorization code flow is not configured';
+})();
+export const ERR_CODE_SCHEMA = new (class CodeSchemaError extends Error {
+    code = 'CODE_SCHEMA';
+    message = 'Invalid code credentials';
+})();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXJyb3JzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc291cmNlL2xpYi9lcnJvcnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsTUFBTSxDQUFDLE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxNQUFNLFVBQVcsU0FBUSxLQUFLO0lBQzFDLElBQUksR0FBRyxPQUFPLENBQUE7SUFDTCxPQUFPLEdBQUcsdUNBQXVDLENBQUE7Q0FDM0UsQ0FBQyxFQUFFLENBQUE7QUFFSixNQUFNLENBQUMsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLE1BQU0sVUFBVyxTQUFRLEtBQUs7SUFDMUMsSUFBSSxHQUFHLE9BQU8sQ0FBQTtJQUNMLE9BQU8sR0FBRyxvQkFBb0IsQ0FBQTtDQUN4RCxDQUFDLEVBQUUsQ0FBQTtBQUVKLE1BQU0sQ0FBQyxNQUFNLFlBQVksR0FBRyxJQUFJLENBQUMsTUFBTSxhQUFjLFNBQVEsS0FBSztJQUNoRCxJQUFJLEdBQUcsVUFBVSxDQUFBO0lBQ1IsT0FBTyxHQUFHLHVCQUF1QixDQUFBO0NBQzNELENBQUMsRUFBRSxDQUFBO0FBRUosTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHLElBQUksQ0FBQyxNQUFNLFdBQVksU0FBUSxLQUFLO0lBQzVDLElBQUksR0FBRyxRQUFRLENBQUE7SUFDTixPQUFPLEdBQUcsOEJBQThCLENBQUE7Q0FDbEUsQ0FBQyxFQUFFLENBQUE7QUFFSixNQUFNLENBQUMsTUFBTSxZQUFZLEdBQUcsSUFBSSxDQUFDLE1BQU0sWUFBYSxTQUFRLEtBQUs7SUFDL0MsSUFBSSxHQUFHLFVBQVUsQ0FBQTtJQUNSLE9BQU8sR0FBRyxzQkFBc0IsQ0FBQTtDQUMxRCxDQUFDLEVBQUUsQ0FBQTtBQUVKLE1BQU0sQ0FBQyxNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsTUFBTSxRQUFTLFNBQVEsS0FBSztJQUN0QyxJQUFJLEdBQUcsS0FBSyxDQUFBO0lBQ0gsT0FBTyxHQUFHLHNCQUFzQixDQUFBO0NBQzFELENBQUMsRUFBRSxDQUFBO0FBRUosTUFBTSxDQUFDLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxNQUFNLFFBQVMsU0FBUSxLQUFLO0lBQ3RDLElBQUksR0FBRyxLQUFLLENBQUE7SUFDSCxPQUFPLEdBQUcsdUJBQXVCLENBQUE7Q0FDM0QsQ0FBQyxFQUFFLENBQUE7QUFFSixNQUFNLENBQUMsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLE1BQU0sUUFBUyxTQUFRLEtBQUs7SUFDdEMsSUFBSSxHQUFHLEtBQUssQ0FBQTtJQUNILE9BQU8sR0FBRyx3Q0FBd0MsQ0FBQTtDQUM1RSxDQUFDLEVBQUUsQ0FBQTtBQUVKLE1BQU0sQ0FBQyxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsTUFBTSxXQUFZLFNBQVEsS0FBSztJQUM1QyxJQUFJLEdBQUcsUUFBUSxDQUFBO0lBQ04sT0FBTyxHQUFHLDZCQUE2QixDQUFBO0NBQ2pFLENBQUMsRUFBRSxDQUFBO0FBRUosTUFBTSxDQUFDLE1BQU0sb0JBQW9CLEdBQUcsSUFBSSxDQUFDLE1BQU0sbUJBQW9CLFNBQVEsS0FBSztJQUM5RCxJQUFJLEdBQUcsa0JBQWtCLENBQUE7SUFDaEIsT0FBTyxHQUFHLDJDQUEyQyxDQUFBO0NBQy9FLENBQUMsRUFBRSxDQUFBO0FBRUosTUFBTSxDQUFDLE1BQU0sZUFBZSxHQUFHLElBQUksQ0FBQyxNQUFNLGVBQWdCLFNBQVEsS0FBSztJQUNyRCxJQUFJLEdBQUcsYUFBYSxDQUFBO0lBQ1gsT0FBTyxHQUFHLDBCQUEwQixDQUFBO0NBQzlELENBQUMsRUFBRSxDQUFBIn0=

package/components/identity.federation/operations/lib/exchange.js

@@ -0,0 +1,90 @@
+import { load } from './jose.js';
+import { createRemoteJWKSet, discover } from './discovery.js';
+import * as errors from './errors.js';
+export async function exchange(credentials, ctx) {
+    const jose = await load();
+    const properties = decode(credentials);
+    if (properties instanceof Error)
+        return properties;
+    const { code, iss, for: redirect } = properties;
+    const trusted = ctx.trust.find((trust) => trust.iss === iss);
+    if (trusted === undefined)
+        return errors.ERR_TRUST;
+    if (trusted.aud === undefined ||
+        (trusted.secret === undefined && trusted.signature === undefined))
+        return errors.ERR_CODE_NOT_ENABLED;
+    const configuration = await discover(iss, ctx.fetch);
+    if (configuration.token_endpoint === undefined)
+        return errors.ERR_CONFIG;
+    // array actually is not expected here, but it is a valid format
+    const aud = Array.isArray(trusted.aud) ? trusted.aud[0] : trusted.aud;
+    const secret = trusted.secret === undefined ? await sign(trusted) : trusted.secret.unwrap();
+    const params = new URLSearchParams();
+    params.append('grant_type', 'authorization_code');
+    params.append('code', code);
+    params.append('client_id', aud);
+    params.append('client_secret', secret);
+    params.append('redirect_uri', redirect);
+    ctx.logs.debug('Exchanging code', {
+        iss,
+        aud,
+        for: redirect,
+        auth: trusted.secret === undefined ? 'signature' : 'secret'
+    });
+    const response = await ctx.fetch(configuration.token_endpoint, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded'
+        },
+        body: params
+    });
+    if (!response.ok) {
+        ctx.logs.error('Code exchange failed', {
+            status: response.status,
+            text: await response.text()
+        });
+        return errors.ERR_RESPONSE;
+    }
+    const tokens = (await response.json());
+    if (tokens.id_token === undefined)
+        return errors.ERR_NO_TOKEN;
+    const jwks = await createRemoteJWKSet(iss, ctx.fetch);
+    try {
+        const { payload } = await jose.jwtVerify(tokens.id_token, jwks, {
+            issuer: iss,
+            audience: trusted.aud,
+            requiredClaims: ['exp']
+        });
+        return payload;
+    }
+    catch {
+        return errors.ERR_TOKEN;
+    }
+}
+function decode(credentials) {
+    const json = Buffer.from(credentials, 'base64').toString('utf8');
+    const properties = JSON.parse(json);
+    if (typeof properties.code !== 'string' ||
+        typeof properties.iss !== 'string' ||
+        typeof properties.for !== 'string' ||
+        Object.keys(properties).length !== CREDENTIAL_PROPERTIES.length)
+        return errors.ERR_CODE_SCHEMA;
+    return properties;
+}
+async function sign(trust) {
+    const jose = await load();
+    const signature = trust.signature;
+    const aud = Array.isArray(trust.aud) ? trust.aud[0] : trust.aud;
+    const now = Math.floor(Date.now() / 1000);
+    const key = await jose.importPKCS8(signature.key.unwrap(), 'ES256');
+    return await new jose.SignJWT({})
+        .setProtectedHeader({ alg: 'ES256', kid: signature.kid })
+        .setIssuedAt(now)
+        .setExpirationTime(now + 300)
+        .setIssuer(signature.iss)
+        .setSubject(aud)
+        .setAudience(trust.iss)
+        .sign(key);
+}
+const CREDENTIAL_PROPERTIES = ['for', 'iss', 'code'];
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXhjaGFuZ2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zb3VyY2UvbGliL2V4Y2hhbmdlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxJQUFJLEVBQUUsTUFBTSxXQUFXLENBQUE7QUFDaEMsT0FBTyxFQUFFLGtCQUFrQixFQUFFLFFBQVEsRUFBRSxNQUFNLGdCQUFnQixDQUFBO0FBQzdELE9BQU8sS0FBSyxNQUFNLE1BQU0sYUFBYSxDQUFBO0FBS3JDLE1BQU0sQ0FBQyxLQUFLLFVBQVUsUUFBUSxDQUFDLFdBQW1CLEVBQUUsR0FBUTtJQUMxRCxNQUFNLElBQUksR0FBRyxNQUFNLElBQUksRUFBRSxDQUFBO0lBQ3pCLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxXQUFXLENBQUMsQ0FBQTtJQUV0QyxJQUFJLFVBQVUsWUFBWSxLQUFLO1FBQUUsT0FBTyxVQUFVLENBQUE7SUFFbEQsTUFBTSxFQUFFLElBQUksRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLFFBQVEsRUFBRSxHQUFHLFVBQVUsQ0FBQTtJQUUvQyxNQUFNLE9BQU8sR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLEdBQUcsS0FBSyxHQUFHLENBQUMsQ0FBQTtJQUU1RCxJQUFJLE9BQU8sS0FBSyxTQUFTO1FBQUUsT0FBTyxNQUFNLENBQUMsU0FBUyxDQUFBO0lBRWxELElBQ0UsT0FBTyxDQUFDLEdBQUcsS0FBSyxTQUFTO1FBQ3pCLENBQUMsT0FBTyxDQUFDLE1BQU0sS0FBSyxTQUFTLElBQUksT0FBTyxDQUFDLFNBQVMsS0FBSyxTQUFTLENBQUM7UUFFakUsT0FBTyxNQUFNLENBQUMsb0JBQW9CLENBQUE7SUFFcEMsTUFBTSxhQUFhLEdBQUcsTUFBTSxRQUFRLENBQUMsR0FBRyxFQUFFLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQTtJQUVwRCxJQUFJLGFBQWEsQ0FBQyxjQUFjLEtBQUssU0FBUztRQUFFLE9BQU8sTUFBTSxDQUFDLFVBQVUsQ0FBQTtJQUV4RSxnRUFBZ0U7SUFDaEUsTUFBTSxHQUFHLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUE7SUFDckUsTUFBTSxNQUFNLEdBQ1YsT0FBTyxDQUFDLE1BQU0sS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFBO0lBQzlFLE1BQU0sTUFBTSxHQUFHLElBQUksZUFBZSxFQUFFLENBQUE7SUFFcEMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxZQUFZLEVBQUUsb0JBQW9CLENBQUMsQ0FBQTtJQUNqRCxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxJQUFJLENBQUMsQ0FBQTtJQUMzQixNQUFNLENBQUMsTUFBTSxDQUFDLFdBQVcsRUFBRSxHQUFHLENBQUMsQ0FBQTtJQUMvQixNQUFNLENBQUMsTUFBTSxDQUFDLGVBQWUsRUFBRSxNQUFNLENBQUMsQ0FBQTtJQUN0QyxNQUFNLENBQUMsTUFBTSxDQUFDLGNBQWMsRUFBRSxRQUFRLENBQUMsQ0FBQTtJQUV2QyxHQUFHLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxpQkFBaUIsRUFBRTtRQUNoQyxHQUFHO1FBQ0gsR0FBRztRQUNILEdBQUcsRUFBRSxRQUFRO1FBQ2IsSUFBSSxFQUFFLE9BQU8sQ0FBQyxNQUFNLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLFFBQVE7S0FDNUQsQ0FBQyxDQUFBO0lBRUYsTUFBTSxRQUFRLEdBQUcsTUFBTSxHQUFHLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FBQyxjQUFjLEVBQUU7UUFDN0QsTUFBTSxFQUFFLE1BQU07UUFDZCxPQUFPLEVBQUU7WUFDUCxjQUFjLEVBQUUsbUNBQW1DO1NBQ3BEO1FBQ0QsSUFBSSxFQUFFLE1BQU07S0FDYixDQUFDLENBQUE7SUFFRixJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsRUFBRSxDQUFDO1FBQ2pCLEdBQUcsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLHNCQUFzQixFQUFFO1lBQ3JDLE1BQU0sRUFBRSxRQUFRLENBQUMsTUFBTTtZQUN2QixJQUFJLEVBQUUsTUFBTSxRQUFRLENBQUMsSUFBSSxFQUFFO1NBQzVCLENBQUMsQ0FBQTtRQUVGLE9BQU8sTUFBTSxDQUFDLFlBQVksQ0FBQTtJQUM1QixDQUFDO0lBRUQsTUFBTSxNQUFNLEdBQUcsQ0FBQyxNQUFNLFFBQVEsQ0FBQyxJQUFJLEVBQUUsQ0FBeUIsQ0FBQTtJQUU5RCxJQUFJLE1BQU0sQ0FBQyxRQUFRLEtBQUssU0FBUztRQUFFLE9BQU8sTUFBTSxDQUFDLFlBQVksQ0FBQTtJQUU3RCxNQUFNLElBQUksR0FBRyxNQUFNLGtCQUFrQixDQUFDLEdBQUcsRUFBRSxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUE7SUFFckQsSUFBSSxDQUFDO1FBQ0gsTUFBTSxFQUFFLE9BQU8sRUFBRSxHQUFHLE1BQU0sSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFLElBQUksRUFBRTtZQUM5RCxNQUFNLEVBQUUsR0FBRztZQUNYLFFBQVEsRUFBRSxPQUFPLENBQUMsR0FBRztZQUNyQixjQUFjLEVBQUUsQ0FBQyxLQUFLLENBQUM7U0FDeEIsQ0FBQyxDQUFBO1FBRUYsT0FBTyxPQUFrQixDQUFBO0lBQzNCLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLE1BQU0sQ0FBQyxTQUFTLENBQUE7SUFDekIsQ0FBQztBQUNILENBQUM7QUFFRCxTQUFTLE1BQU0sQ0FBQyxXQUFtQjtJQUNqQyxNQUFNLElBQUksR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLFdBQVcsRUFBRSxRQUFRLENBQUMsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUE7SUFDaEUsTUFBTSxVQUFVLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQWUsQ0FBQTtJQUVqRCxJQUNFLE9BQU8sVUFBVSxDQUFDLElBQUksS0FBSyxRQUFRO1FBQ25DLE9BQU8sVUFBVSxDQUFDLEdBQUcsS0FBSyxRQUFRO1FBQ2xDLE9BQU8sVUFBVSxDQUFDLEdBQUcsS0FBSyxRQUFRO1FBQ2xDLE1BQU0sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUMsTUFBTSxLQUFLLHFCQUFxQixDQUFDLE1BQU07UUFFL0QsT0FBTyxNQUFNLENBQUMsZUFBZSxDQUFBO0lBRS9CLE9BQU8sVUFBVSxDQUFBO0FBQ25CLENBQUM7QUFFRCxLQUFLLFVBQVUsSUFBSSxDQUFDLEtBQVk7SUFDOUIsTUFBTSxJQUFJLEdBQUcsTUFBTSxJQUFJLEVBQUUsQ0FBQTtJQUN6QixNQUFNLFNBQVMsR0FBRyxLQUFLLENBQUMsU0FBVSxDQUFBO0lBQ2xDLE1BQU0sR0FBRyxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBSSxDQUFBO0lBQ2hFLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQyxDQUFBO0lBQ3pDLE1BQU0sR0FBRyxHQUFHLE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxFQUFFLE9BQU8sQ0FBQyxDQUFBO0lBRW5FLE9BQU8sTUFBTSxJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1NBQzlCLGtCQUFrQixDQUFDLEVBQUUsR0FBRyxFQUFFLE9BQU8sRUFBRSxHQUFHLEVBQUUsU0FBUyxDQUFDLEdBQUcsRUFBRSxDQUFDO1NBQ3hELFdBQVcsQ0FBQyxHQUFHLENBQUM7U0FDaEIsaUJBQWlCLENBQUMsR0FBRyxHQUFHLEdBQUcsQ0FBQztTQUM1QixTQUFTLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQztTQUN4QixVQUFVLENBQUMsR0FBRyxDQUFDO1NBQ2YsV0FBVyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUM7U0FDdEIsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFBO0FBQ2QsQ0FBQztBQUVELE1BQU0scUJBQXFCLEdBQTRCLENBQUMsS0FBSyxFQUFFLEtBQUssRUFBRSxNQUFNLENBQUMsQ0FBQSJ9

package/components/identity.federation/operations/lib/index.js

@@ -0,0 +1,5 @@
+export { decode } from './decode.js';
+export { exchange } from './exchange.js';
+export { principal } from './principal.js';
+export { resolve } from './resolve.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zb3VyY2UvbGliL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxNQUFNLEVBQUUsTUFBTSxhQUFhLENBQUE7QUFDcEMsT0FBTyxFQUFFLFFBQVEsRUFBRSxNQUFNLGVBQWUsQ0FBQTtBQUN4QyxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0sZ0JBQWdCLENBQUE7QUFDMUMsT0FBTyxFQUFFLE9BQU8sRUFBRSxNQUFNLGNBQWMsQ0FBQSJ9

package/components/identity.federation/operations/lib/jose.js

@@ -0,0 +1,2 @@
+export const load = async () => await import('jose');
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiam9zZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS9saWIvam9zZS5qcyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxNQUFNLENBQUMsTUFBTSxJQUFJLEdBQUcsS0FBSyxJQUFJLEVBQUUsQ0FBQyxNQUFNLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQSJ9

package/components/identity.federation/operations/lib/principal.js

@@ -0,0 +1,14 @@
+/**
+ * The `system` Role is granted where the credentials are created, before the reply that mints
+ * a Token from them — the event that carries the same grant lands after it.
+ */
+export async function principal(credential, context) {
+    const configured = context.configuration.principal;
+    if (configured === undefined ||
+        configured.authority !== credential.authority ||
+        configured.iss !== credential.iss ||
+        configured.sub !== credential.sub)
+        return;
+    await context.remote.identity.roles.principal({ input: { id: credential.identity } });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJpbmNpcGFsLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc291cmNlL2xpYi9wcmluY2lwYWwudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBRUE7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSxTQUFTLENBQUMsVUFBa0IsRUFBRSxPQUFnQjtJQUNsRSxNQUFNLFVBQVUsR0FBRyxPQUFPLENBQUMsYUFBYSxDQUFDLFNBQVMsQ0FBQTtJQUVsRCxJQUNFLFVBQVUsS0FBSyxTQUFTO1FBQ3hCLFVBQVUsQ0FBQyxTQUFTLEtBQUssVUFBVSxDQUFDLFNBQVM7UUFDN0MsVUFBVSxDQUFDLEdBQUcsS0FBSyxVQUFVLENBQUMsR0FBRztRQUNqQyxVQUFVLENBQUMsR0FBRyxLQUFLLFVBQVUsQ0FBQyxHQUFHO1FBRWpDLE9BQU07SUFFUixNQUFNLE9BQU8sQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFFLEVBQUUsVUFBVSxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FBQTtBQUN2RixDQUFDIn0=

package/components/identity.federation/operations/lib/resolve.js

@@ -0,0 +1,13 @@
+import { decode } from './decode.js';
+import { exchange } from './exchange.js';
+export async function resolve(scheme, credentials, context) {
+    const ctx = {
+        trust: context.configuration.trust,
+        logs: context.logs,
+        fetch: context.fetch
+    };
+    return scheme === 'bearer'
+        ? await decode(credentials, ctx)
+        : await exchange(credentials, ctx);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVzb2x2ZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS9saWIvcmVzb2x2ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsTUFBTSxFQUFFLE1BQU0sYUFBYSxDQUFBO0FBQ3BDLE9BQU8sRUFBRSxRQUFRLEVBQUUsTUFBTSxlQUFlLENBQUE7QUFLeEMsTUFBTSxDQUFDLEtBQUssVUFBVSxPQUFPLENBQzNCLE1BQWMsRUFDZCxXQUFtQixFQUNuQixPQUFnQjtJQUVoQixNQUFNLEdBQUcsR0FBUTtRQUNmLEtBQUssRUFBRSxPQUFPLENBQUMsYUFBYSxDQUFDLEtBQUs7UUFDbEMsSUFBSSxFQUFFLE9BQU8sQ0FBQyxJQUFJO1FBQ2xCLEtBQUssRUFBRSxPQUFPLENBQUMsS0FBSztLQUNyQixDQUFBO0lBRUQsT0FBTyxNQUFNLEtBQUssUUFBUTtRQUN4QixDQUFDLENBQUMsTUFBTSxNQUFNLENBQUMsV0FBVyxFQUFFLEdBQUcsQ0FBQztRQUNoQyxDQUFDLENBQUMsTUFBTSxRQUFRLENBQUMsV0FBVyxFQUFFLEdBQUcsQ0FBQyxDQUFBO0FBQ3RDLENBQUMifQ==

package/components/identity.federation/operations/list.js

@@ -0,0 +1,12 @@
+import { quote } from '@toa.io/generic';
+export async function computation({ authority, identity }, context) {
+    return await context.local.enumerate({
+        query: {
+            criteria: `authority==${quote(authority)};identity==${quote(identity)}`,
+            projection: ['iss'],
+            sort: ['CREATED:desc'],
+            limit: 100
+        }
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibGlzdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NvdXJjZS9saXN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxLQUFLLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQTtBQUd2QyxNQUFNLENBQUMsS0FBSyxVQUFVLFdBQVcsQ0FDL0IsRUFBRSxTQUFTLEVBQUUsUUFBUSxFQUFTLEVBQzlCLE9BQWdCO0lBRWhCLE9BQU8sTUFBTSxPQUFPLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQztRQUNuQyxLQUFLLEVBQUU7WUFDTCxRQUFRLEVBQUUsY0FBYyxLQUFLLENBQUMsU0FBUyxDQUFDLGNBQWMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxFQUFFO1lBQ3ZFLFVBQVUsRUFBRSxDQUFDLEtBQUssQ0FBQztZQUNuQixJQUFJLEVBQUUsQ0FBQyxjQUFjLENBQUM7WUFDdEIsS0FBSyxFQUFFLEdBQUc7U0FDWDtLQUNGLENBQUMsQ0FBQTtBQUNKLENBQUMifQ==

package/components/identity.federation/operations/types/Scheme.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiU2NoZW1lLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc291cmNlL3R5cGVzL1NjaGVtZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiIn0=

package/components/identity.federation/operations/types/configuration.js

@@ -1,3 +1,2 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=configuration.js.map
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29uZmlndXJhdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS90eXBlcy9jb25maWd1cmF0aW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIifQ==

package/components/identity.federation/operations/types/context.js

@@ -1,3 +1,2 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=context.js.map
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29udGV4dC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS90eXBlcy9jb250ZXh0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIifQ==

package/components/identity.federation/operations/types/entity.js

@@ -1,3 +1,2 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=entity.js.map
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW50aXR5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc291cmNlL3R5cGVzL2VudGl0eS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiIn0=

package/components/identity.federation/operations/types/index.js

@@ -1,20 +1,5 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./configuration"), exports);
-__exportStar(require("./context"), exports);
-__exportStar(require("./entity"), exports);
-//# sourceMappingURL=index.js.map
+export * from './configuration.js';
+export * from './context.js';
+export * from './entity.js';
+export * from './Scheme.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zb3VyY2UvdHlwZXMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYyxvQkFBb0IsQ0FBQTtBQUNsQyxjQUFjLGNBQWMsQ0FBQTtBQUM1QixjQUFjLGFBQWEsQ0FBQTtBQUMzQixjQUFjLGFBQWEsQ0FBQSJ9

package/components/identity.federation/source/authenticate.ts

@@ -1,29 +1,60 @@
-import { type Maybe } from '@toa.io/types'
-import { Err } from 'error-value'
-import { assertionsAsValues } from './lib/assertions-as-values.js'
-import { validateIdToken } from './lib/jwt'
-import type { AuthenticateInput, AuthenticateOutput, Context } from './types'
-import type { Request } from '@toa.io/core'
+import { newid, quote } from '@toa.io/generic'
+import { principal, resolve } from './lib/index.js'
+import type { JWTPayload } from 'jose'
+import type { Maybe } from '@toa.io/core/types'
+import type { Context, Scheme } from './types/index.js'
 
-async function authenticate ({ authority, credentials }: AuthenticateInput,
-  context: Context): Promise<Maybe<AuthenticateOutput>> {
-  const { iss, sub } = await validateIdToken(credentials, context.configuration.trust)
+export async function effect(
+  { scheme, authority, credentials }: Input,
+  context: Context
+): Promise<Maybe<Output>> {
+  context.logs.debug('Authenticating', { scheme, authority })
 
-  const request: Request = { query: { criteria: `authority==${authority};iss==${iss};sub==${sub}` } }
+  const claims = await resolve(scheme, credentials, context)
 
-  let id = (await context.local.observe(request))?.id
+  if (claims instanceof Error) return claims
 
-  if (id === undefined) {
-    if (context.configuration.explicit_identity_creation === true)
-      return NOT_FOUND
+  const { iss, sub } = claims
 
-    id = (await context.local.transit({ input: { authority, iss, sub } })).id
+  context.logs.debug('Token claims', claims)
+
+  const query = {
+    criteria: `authority==${quote(authority)};iss==${quote(iss)};sub==${quote(sub)}`
   }
 
-  return { identity: { id } }
+  const asserted = newid()
+
+  const credential =
+    context.configuration.assert !== false
+      ? await context.local.ensure({
+          query,
+          entity: { authority, iss, sub, identity: asserted }
+        })
+      : await context.local.observe({ query })
+
+  if (credential === null) return ERR_NOT_FOUND
+
+  if (credential instanceof Error) return credential
+
+  // the Identity this call has just created is the only one whose Role is not granted yet
+  if (credential.identity === asserted) await principal(credential, context)
+
+  return { identity: { id: credential.identity, claims } }
 }
 
-// Exporting as a function returning assertion errors as values
-export const computation = assertionsAsValues(authenticate)
+const ERR_NOT_FOUND = new (class NotFoundError extends Error {
+  public readonly code = 'NOT_FOUND'
+})()
+
+interface Input {
+  scheme: Scheme
+  authority: string
+  credentials: string
+}
 
-const NOT_FOUND = Err('NOT_FOUND')
+interface Output {
+  identity: {
+    id: string
+    claims: JWTPayload
+  }
+}

package/components/identity.federation/source/create.ts

@@ -0,0 +1,44 @@
+import { quote } from '@toa.io/generic'
+import { resolve } from './lib/index.js'
+import type { Context, Entity, Scheme } from './types/index.js'
+
+export async function effect(input: Input, context: Context): Promise<Entity | Error> {
+  const claims = await resolve(input.scheme, input.credentials, context)
+
+  if (claims instanceof Error) return claims
+
+  const { iss, sub } = claims
+
+  const existent = await context.local.observe({
+    query: {
+      criteria: `authority==${quote(input.authority)};iss==${quote(iss)};sub==${quote(sub)}`,
+      deleted: true
+    }
+  })
+
+  const record = { authority: input.authority, iss, sub, identity: input.id }
+
+  if (existent === null) return await context.local.transit({ input: record })
+
+  if (existent.DELETED === undefined || existent.DELETED === null)
+    return existent.identity === input.id ? existent : ERR_EXISTS
+
+  // a deleted record still occupies the unique index, so the transition revives it
+  return await context.local.transit({
+    input: record,
+    query: { id: existent.id, deleted: true }
+  })
+}
+
+export interface Input {
+  authority: string
+  scheme: Scheme
+  credentials: string
+  id: string
+}
+
+const ERR_EXISTS = new (class ExistsError extends Error {
+  public readonly code = 'EXISTS'
+  public override readonly message =
+    'Federation credentials are associated with another Identity'
+})()

package/components/identity.federation/source/decode.ts

@@ -0,0 +1,14 @@
+import { decode } from './lib/index.js'
+import type { JWTPayload } from 'jose'
+import type { Context } from './types/index.js'
+
+export async function effect(
+  token: string,
+  context: Context
+): Promise<JWTPayload | Error> {
+  return await decode(token, {
+    trust: context.configuration.trust,
+    logs: context.logs,
+    fetch: context.fetch
+  })
+}