@toa.io/extensions.exposition 1.0.0-alpha.29 → 1.0.0-alpha.292

package/components/identity.basic/manifest.toa.yaml

@@ -2,62 +2,235 @@ namespace: identity
 name: basic
 
 entity:
-  schema:
-    authority*: string
-    username*: string
-    password*: string
-  unique:
-    authority_username: [authority, username]
   associated: true
+  properties:
+    authority:
+      type: string
+    username:
+      type: string
+    password:
+      type: string
+  required:
+    - authority
+    - username
+    - password
 
 operations:
   transit:
     concurrency: retry
+    output: &id
+      type: object
+      required: [id]
+      properties:
+        id: { type: string }
     input:
-      authority: string
-      username: string
-      password: string
+      properties:
+        username:
+          type: string
+        password:
+          type: string
+        authority:
+          type: string
+        inception:
+          description: Whether the credentials are being created rather than changed
+          type: boolean
+      type: object
+    errors: &transit.errors
+      - PRINCIPAL_LOCKED
+      - INVALID_USERNAME
+      - INVALID_PASSWORD
+      - EXISTS
   create:
     forward: transit
     query: false
     input:
-      authority*: string
-      username*: string
-      password*: string
+      properties:
+        authority:
+          type: string
+        username:
+          type: string
+        password:
+          type: string
+      type: object
+      required:
+        - authority
+        - username
+        - password
+    errors: *transit.errors
+  add:
+    input:
+      properties:
+        id:
+          type: string
+        authority:
+          type: string
+        username:
+          type: string
+        password:
+          type: string
+      type: object
+      required:
+        - id
+        - authority
+        - username
+        - password
+    errors: *transit.errors
   incept:
     input:
-      authority*: string
-      id*: string
-      credentials*: string
+      properties:
+        authority:
+          type: string
+        id:
+          type: string
+        credentials:
+          type: string
+      type: object
+      required:
+        - authority
+        - id
+        - credentials
     output:
-      id: string
+      properties:
+        id:
+          type: string
+      type: object
+    errors:
+      - INVALID_CREDENTIALS
   authenticate:
     input:
-      authority*: string
-      credentials*: string
+      properties:
+        authority:
+          type: string
+        credentials:
+          type: string
+      type: object
+      required:
+        - authority
+        - credentials
+    output:
+      properties:
+        identity:
+          properties:
+            id:
+              type: string
+          type: object
+      type: object
+    errors:
+      - NOT_FOUND
+      - PASSWORD_MISMATCH
+  check:
+    input:
+      type: object
+      properties:
+        username:
+          type: string
+          minLength: 1
+      required:
+        - username
+    output: { type: 'null' }
+  info:
+    input:
+      properties:
+        authority:
+          type: string
+        identity:
+          type: string
+      type: object
+      required:
+        - authority
+        - identity
     output:
-      identity:
-        id: string
+      type: object
+      nullable: true
+      additionalProperties: false
+      properties:
+        username:
+          type: string
+      required:
+        - username
+  delete:
+    input:
+      properties:
+        authority:
+          type: string
+        identity:
+          type: string
+      type: object
+      required:
+        - authority
+        - identity
 
 configuration:
-  rounds: 10
-  pepper: ''
-  principal: string
-  username+: ^.{1,128}$
-  password+: ^.{8,32}$
+  schema:
+    type: object
+    properties:
+      rounds:
+        type: integer
+        minimum: 1
+      pepper:
+        description: Hashing pepper, a secret
+        type: string
+        format: secret
+      principal:
+        description: Basic credentials whose Identity is granted the `system` role
+        type: object
+        properties:
+          authority:
+            type: string
+          username:
+            type: string
+        required:
+          - authority
+          - username
+        additionalProperties: false
+      username:
+        type: array
+        items:
+          type: string
+      password:
+        type: array
+        items:
+          type: string
+    # every one of them has a default, so the component reads them without checking
+    required: [rounds, username, password]
+
+  defaults:
+    rounds: 10
+    username:
+    - ^.{1,128}$
+    password:
+    - ^.{8,32}$
 
 exposition:
   isolated: true
   /:
     POST:
       anonymous: true
+      map:authority: authority
       io:output: [id]
-      vary:embed:
-        authority: authority
       endpoint: create
   /:id:
     io:output: [id]
+    io:input: [username, password]
     auth:role: system:identity:basic
-    auth:scheme: basic
     auth:id: id
-    PATCH: transit
+    PATCH:
+      auth:scheme: basic
+      endpoint: transit
+    POST:
+      map:authority: authority
+      map:segments:
+        id: id
+      endpoint: add
+    DELETE:
+      map:authority: authority
+      map:segments:
+        identity: id
+      io:output: false
+      endpoint: delete
+
+  /usernames/:username:
+    GET:
+      map:authority: authority
+      anonymous: true
+      endpoint: check

package/components/identity.basic/migrations/0002-indexes.yaml

@@ -0,0 +1,13 @@
+- index:
+    name: unique_authority_username
+    keys:
+      authority: asc
+      username: asc
+    unique: true
+    partial:
+      DELETED: null
+- index:
+    name: index_username
+    keys:
+      authority: asc
+      username: asc

package/components/identity.basic/operations/add.js

@@ -0,0 +1,13 @@
+export async function effect(input, context) {
+    return await context.local.transit({
+        input: {
+            authority: input.authority,
+            username: input.username,
+            password: input.password,
+            inception: true
+        },
+        // `delete` leaves a tombstone, which the transition revives
+        query: { id: input.id, deleted: true }
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWRkLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2FkZC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFHQSxNQUFNLENBQUMsS0FBSyxVQUFVLE1BQU0sQ0FDMUIsS0FBZSxFQUNmLE9BQWdCO0lBRWhCLE9BQU8sTUFBTSxPQUFPLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQztRQUNqQyxLQUFLLEVBQUU7WUFDTCxTQUFTLEVBQUUsS0FBSyxDQUFDLFNBQVM7WUFDMUIsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRO1lBQ3hCLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUTtZQUN4QixTQUFTLEVBQUUsSUFBSTtTQUNoQjtRQUNELDREQUE0RDtRQUM1RCxLQUFLLEVBQUUsRUFBRSxFQUFFLEVBQUUsS0FBSyxDQUFDLEVBQUUsRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFO0tBQ3ZDLENBQUMsQ0FBQTtBQUNKLENBQUMifQ==

package/components/identity.basic/operations/authenticate.js

@@ -1,27 +1,30 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.computation = void 0;
-const bcryptjs_1 = require("bcryptjs");
-const error_value_1 = require("error-value");
-async function computation(input, context) {
-    const [username, password] = Buffer
-        .from(input.credentials, 'base64')
-        .toString()
-        .split(':');
-    const query = { criteria: `authority==${input.authority};username=='${username}'` };
+import { compare } from '@node-rs/bcrypt';
+import { quote } from '@toa.io/generic';
+import { split } from './lib/credentials.js';
+export async function computation(input, context) {
+    const pair = split(input.credentials);
+    if (pair === null)
+        return ERR_NOT_FOUND;
+    const [username, password] = pair;
+    const query = {
+        criteria: `authority==${quote(input.authority)};username==${quote(username)}`
+    };
     const credentials = await context.local.observe({ query });
     if (credentials instanceof Error)
         return credentials;
     if (credentials === null)
         return ERR_NOT_FOUND;
-    const spicy = password + context.configuration.pepper;
-    const match = await (0, bcryptjs_1.compare)(spicy, credentials.password);
+    const spicy = password + (context.configuration.pepper?.unwrap() ?? '');
+    const match = await compare(spicy, credentials.password);
     if (match)
         return { identity: { id: credentials.id } };
     else
         return ERR_PASSWORD_MISMATCH;
 }
-exports.computation = computation;
-const ERR_NOT_FOUND = (0, error_value_1.Err)('NOT_FOUND');
-const ERR_PASSWORD_MISMATCH = (0, error_value_1.Err)('PASSWORD_MISMATCH');
-//# sourceMappingURL=authenticate.js.map
+const ERR_NOT_FOUND = new (class NotFoundError extends Error {
+    code = 'NOT_FOUND';
+})();
+const ERR_PASSWORD_MISMATCH = new (class PasswordMismatchError extends Error {
+    code = 'PASSWORD_MISMATCH';
+})();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aGVudGljYXRlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2F1dGhlbnRpY2F0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsT0FBTyxFQUFFLE1BQU0saUJBQWlCLENBQUE7QUFDekMsT0FBTyxFQUFFLEtBQUssRUFBRSxNQUFNLGlCQUFpQixDQUFBO0FBRXZDLE9BQU8sRUFBRSxLQUFLLEVBQUUsTUFBTSxzQkFBc0IsQ0FBQTtBQUc1QyxNQUFNLENBQUMsS0FBSyxVQUFVLFdBQVcsQ0FDL0IsS0FBWSxFQUNaLE9BQWdCO0lBRWhCLE1BQU0sSUFBSSxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLENBQUE7SUFFckMsSUFBSSxJQUFJLEtBQUssSUFBSTtRQUFFLE9BQU8sYUFBYSxDQUFBO0lBRXZDLE1BQU0sQ0FBQyxRQUFRLEVBQUUsUUFBUSxDQUFDLEdBQUcsSUFBSSxDQUFBO0lBRWpDLE1BQU0sS0FBSyxHQUFVO1FBQ25CLFFBQVEsRUFBRSxjQUFjLEtBQUssQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLGNBQWMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxFQUFFO0tBQzlFLENBQUE7SUFDRCxNQUFNLFdBQVcsR0FBRyxNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQTtJQUUxRCxJQUFJLFdBQVcsWUFBWSxLQUFLO1FBQUUsT0FBTyxXQUFXLENBQUE7SUFFcEQsSUFBSSxXQUFXLEtBQUssSUFBSTtRQUFFLE9BQU8sYUFBYSxDQUFBO0lBRTlDLE1BQU0sS0FBSyxHQUFHLFFBQVEsR0FBRyxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsTUFBTSxFQUFFLE1BQU0sRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFBO0lBQ3ZFLE1BQU0sS0FBSyxHQUFHLE1BQU0sT0FBTyxDQUFDLEtBQUssRUFBRSxXQUFXLENBQUMsUUFBUSxDQUFDLENBQUE7SUFFeEQsSUFBSSxLQUFLO1FBQUUsT0FBTyxFQUFFLFFBQVEsRUFBRSxFQUFFLEVBQUUsRUFBRSxXQUFXLENBQUMsRUFBRSxFQUFFLEVBQUUsQ0FBQTs7UUFDakQsT0FBTyxxQkFBcUIsQ0FBQTtBQUNuQyxDQUFDO0FBRUQsTUFBTSxhQUFhLEdBQUcsSUFBSSxDQUFDLE1BQU0sYUFBYyxTQUFRLEtBQUs7SUFDMUMsSUFBSSxHQUFHLFdBQVcsQ0FBQTtDQUNuQyxDQUFDLEVBQUUsQ0FBQTtBQUVKLE1BQU0scUJBQXFCLEdBQUcsSUFBSSxDQUFDLE1BQU0scUJBQXNCLFNBQVEsS0FBSztJQUMxRCxJQUFJLEdBQUcsbUJBQW1CLENBQUE7Q0FDM0MsQ0FBQyxFQUFFLENBQUEifQ==

package/components/identity.basic/operations/check.js

@@ -0,0 +1,14 @@
+import { quote } from '@toa.io/generic';
+export async function computation(input, context) {
+    const username = Buffer.from(input.username, 'base64url').toString();
+    const found = await context.local.observe({
+        query: {
+            criteria: `authority==${quote(input.authority)};username==${quote(username)}`
+        }
+    });
+    if (found instanceof Error)
+        return found;
+    if (found === null)
+        return null;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hlY2suanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zb3VyY2UvY2hlY2sudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLEtBQUssRUFBRSxNQUFNLGlCQUFpQixDQUFBO0FBR3ZDLE1BQU0sQ0FBQyxLQUFLLFVBQVUsV0FBVyxDQUMvQixLQUFZLEVBQ1osT0FBZ0I7SUFFaEIsTUFBTSxRQUFRLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsUUFBUSxFQUFFLFdBQVcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxDQUFBO0lBRXBFLE1BQU0sS0FBSyxHQUFHLE1BQU0sT0FBTyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUM7UUFDeEMsS0FBSyxFQUFFO1lBQ0wsUUFBUSxFQUFFLGNBQWMsS0FBSyxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsY0FBYyxLQUFLLENBQUMsUUFBUSxDQUFDLEVBQUU7U0FDOUU7S0FDRixDQUFDLENBQUE7SUFFRixJQUFJLEtBQUssWUFBWSxLQUFLO1FBQUUsT0FBTyxLQUFLLENBQUE7SUFFeEMsSUFBSSxLQUFLLEtBQUssSUFBSTtRQUFFLE9BQU8sSUFBSSxDQUFBO0FBQ2pDLENBQUMifQ==

package/components/identity.basic/operations/delete.js

@@ -0,0 +1,7 @@
+export async function effect({ authority, identity }, context) {
+    const object = await context.local.observe({ query: { id: identity } });
+    if (object === null || object instanceof Error || object.authority !== authority)
+        return null;
+    return await context.local.terminate({ query: { id: identity } });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVsZXRlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2RlbGV0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFFQSxNQUFNLENBQUMsS0FBSyxVQUFVLE1BQU0sQ0FDMUIsRUFBRSxTQUFTLEVBQUUsUUFBUSxFQUFTLEVBQzlCLE9BQWdCO0lBRWhCLE1BQU0sTUFBTSxHQUFHLE1BQU0sT0FBTyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFFLEVBQUUsUUFBUSxFQUFFLEVBQUUsQ0FBQyxDQUFBO0lBRXZFLElBQUksTUFBTSxLQUFLLElBQUksSUFBSSxNQUFNLFlBQVksS0FBSyxJQUFJLE1BQU0sQ0FBQyxTQUFTLEtBQUssU0FBUztRQUM5RSxPQUFPLElBQUksQ0FBQTtJQUViLE9BQU8sTUFBTSxPQUFPLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxFQUFFLEtBQUssRUFBRSxFQUFFLEVBQUUsRUFBRSxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQUE7QUFDbkUsQ0FBQyJ9

package/components/identity.basic/operations/incept.js

@@ -1,20 +1,38 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.effect = void 0;
-const error_value_1 = require("error-value");
-async function effect(input, context) {
-    const [username, password] = Buffer
-        .from(input.credentials, 'base64')
-        .toString()
-        .split(':');
-    if (typeof password !== 'string')
+import { split } from './lib/credentials.js';
+export async function effect(input, context) {
+    const pair = split(input.credentials);
+    if (pair === null)
         return INVALID_CREDENTIALS;
+    const [username, password] = pair;
     const request = {
-        input: { authority: input.authority, username, password },
-        query: { id: input.id }
+        input: {
+            authority: input.authority,
+            username,
+            password
+        },
+        query: {
+            id: input.id
+        }
     };
-    return await context.local.transit(request);
+    const incepted = await context.local.transit(request);
+    if (incepted instanceof Error)
+        return incepted;
+    await principal({ authority: input.authority, username }, incepted.id, context);
+    return incepted;
 }
-exports.effect = effect;
-const INVALID_CREDENTIALS = (0, error_value_1.Err)('INVALID_CREDENTIALS');
-//# sourceMappingURL=incept.js.map
+/**
+ * The `system` Role is granted here, before the reply that mints a Token from these
+ * credentials — the event that carries the same grant lands after it.
+ */
+async function principal(credentials, id, context) {
+    const configured = context.configuration.principal;
+    if (configured === undefined ||
+        configured.authority !== credentials.authority ||
+        configured.username !== credentials.username)
+        return;
+    await context.remote.identity.roles.principal({ input: { id } });
+}
+const INVALID_CREDENTIALS = new (class InvalidCredentialsError extends Error {
+    code = 'INVALID_CREDENTIALS';
+})();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5jZXB0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2luY2VwdC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsS0FBSyxFQUFFLE1BQU0sc0JBQXNCLENBQUE7QUFJNUMsTUFBTSxDQUFDLEtBQUssVUFBVSxNQUFNLENBQUMsS0FBWSxFQUFFLE9BQWdCO0lBQ3pELE1BQU0sSUFBSSxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLENBQUE7SUFFckMsSUFBSSxJQUFJLEtBQUssSUFBSTtRQUFFLE9BQU8sbUJBQW1CLENBQUE7SUFFN0MsTUFBTSxDQUFDLFFBQVEsRUFBRSxRQUFRLENBQUMsR0FBRyxJQUFJLENBQUE7SUFFakMsTUFBTSxPQUFPLEdBQUc7UUFDZCxLQUFLLEVBQUU7WUFDTCxTQUFTLEVBQUUsS0FBSyxDQUFDLFNBQVM7WUFDMUIsUUFBUTtZQUNSLFFBQVE7U0FDVDtRQUNELEtBQUssRUFBRTtZQUNMLEVBQUUsRUFBRSxLQUFLLENBQUMsRUFBRTtTQUNiO0tBQ0YsQ0FBQTtJQUVELE1BQU0sUUFBUSxHQUFHLE1BQU0sT0FBTyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLENBQUE7SUFFckQsSUFBSSxRQUFRLFlBQVksS0FBSztRQUFFLE9BQU8sUUFBUSxDQUFBO0lBRTlDLE1BQU0sU0FBUyxDQUFDLEVBQUUsU0FBUyxFQUFFLEtBQUssQ0FBQyxTQUFTLEVBQUUsUUFBUSxFQUFFLEVBQUUsUUFBUSxDQUFDLEVBQUUsRUFBRSxPQUFPLENBQUMsQ0FBQTtJQUUvRSxPQUFPLFFBQVEsQ0FBQTtBQUNqQixDQUFDO0FBRUQ7OztHQUdHO0FBQ0gsS0FBSyxVQUFVLFNBQVMsQ0FDdEIsV0FBd0IsRUFDeEIsRUFBVSxFQUNWLE9BQWdCO0lBRWhCLE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FBQyxhQUFhLENBQUMsU0FBUyxDQUFBO0lBRWxELElBQ0UsVUFBVSxLQUFLLFNBQVM7UUFDeEIsVUFBVSxDQUFDLFNBQVMsS0FBSyxXQUFXLENBQUMsU0FBUztRQUM5QyxVQUFVLENBQUMsUUFBUSxLQUFLLFdBQVcsQ0FBQyxRQUFRO1FBRTVDLE9BQU07SUFFUixNQUFNLE9BQU8sQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUE7QUFDbEUsQ0FBQztBQUVELE1BQU0sbUJBQW1CLEdBQUcsSUFBSSxDQUFDLE1BQU0sdUJBQXdCLFNBQVEsS0FBSztJQUMxRCxJQUFJLEdBQUcscUJBQXFCLENBQUE7Q0FDN0MsQ0FBQyxFQUFFLENBQUEifQ==

package/components/identity.basic/operations/info.js

@@ -0,0 +1,7 @@
+export async function effect({ authority, identity }, context) {
+    const object = await context.local.observe({ query: { id: identity } });
+    if (object === null || object instanceof Error || object.authority !== authority)
+        return null;
+    return { username: object.username };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5mby5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NvdXJjZS9pbmZvLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUVBLE1BQU0sQ0FBQyxLQUFLLFVBQVUsTUFBTSxDQUMxQixFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQVMsRUFDOUIsT0FBZ0I7SUFFaEIsTUFBTSxNQUFNLEdBQUcsTUFBTSxPQUFPLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLEtBQUssRUFBRSxFQUFFLEVBQUUsRUFBRSxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQUE7SUFFdkUsSUFBSSxNQUFNLEtBQUssSUFBSSxJQUFJLE1BQU0sWUFBWSxLQUFLLElBQUksTUFBTSxDQUFDLFNBQVMsS0FBSyxTQUFTO1FBQzlFLE9BQU8sSUFBSSxDQUFBO0lBRWIsT0FBTyxFQUFFLFFBQVEsRUFBRSxNQUFNLENBQUMsUUFBUSxFQUFFLENBQUE7QUFDdEMsQ0FBQyJ9

package/components/identity.basic/operations/lib/credentials.js

@@ -0,0 +1,12 @@
+/**
+ * The user-id and the password of Basic credentials. RFC 7617 forbids a colon in the
+ * user-id and allows any number of them in the password, so the split is at the first one.
+ */
+export function split(credentials) {
+    const decoded = Buffer.from(credentials, 'base64').toString();
+    const colon = decoded.indexOf(':');
+    if (colon === -1)
+        return null;
+    return [decoded.slice(0, colon), decoded.slice(colon + 1)];
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY3JlZGVudGlhbHMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zb3VyY2UvbGliL2NyZWRlbnRpYWxzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7R0FHRztBQUNILE1BQU0sVUFBVSxLQUFLLENBQUMsV0FBbUI7SUFDdkMsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxXQUFXLEVBQUUsUUFBUSxDQUFDLENBQUMsUUFBUSxFQUFFLENBQUE7SUFDN0QsTUFBTSxLQUFLLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQTtJQUVsQyxJQUFJLEtBQUssS0FBSyxDQUFDLENBQUM7UUFBRSxPQUFPLElBQUksQ0FBQTtJQUU3QixPQUFPLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsS0FBSyxDQUFDLEVBQUUsT0FBTyxDQUFDLEtBQUssQ0FBQyxLQUFLLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQTtBQUM1RCxDQUFDIn0=

package/components/identity.basic/operations/transit.js

@@ -1,31 +1,42 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Transition = void 0;
-const bcryptjs_1 = require("bcryptjs");
-const error_value_1 = require("error-value");
-class Transition {
+import { hash } from '@node-rs/bcrypt';
+export class Transition {
     rounds = 10;
     pepper = '';
     principal;
     tokens = undefined;
+    keys = undefined;
     usernameRx = [];
     passwordRx = [];
     mount(context) {
         this.rounds = context.configuration.rounds;
-        this.pepper = context.configuration.pepper;
+        this.pepper = context.configuration.pepper?.unwrap() ?? '';
         this.principal = context.configuration.principal;
         this.tokens = context.remote.identity.tokens;
+        this.keys = context.remote.identity.keys;
         this.usernameRx = toRx(context.configuration.username);
         this.passwordRx = toRx(context.configuration.password);
     }
+    locked(object) {
+        return (this.principal !== undefined &&
+            object.authority === this.principal.authority &&
+            object.username === this.principal.username);
+    }
     async execute(input, object) {
-        const existent = object._version !== 0;
-        if (existent)
-            await this.tokens.revoke({ query: { id: object.id } });
-        else
+        const deleted = object.DELETED !== undefined && object.DELETED !== null;
+        const existent = object.VERSION !== 0 && !deleted;
+        if (existent) {
+            if (input.inception === true)
+                return ERR_EXISTS;
+            await Promise.all([
+                this.tokens.revoke({ query: { id: object.id } }),
+                this.keys.revoke({ input: { identity: object.id } })
+            ]);
+        }
+        else if (input.authority !== undefined)
+            // a record that is new and names no authority is refused by the entity contract
             object.authority = input.authority;
         if (input.username !== undefined) {
-            if (existent && object.username === this.principal)
+            if (existent && this.locked(object))
                 return ERR_PRINCIPAL_LOCKED;
             if (invalid(input.username, this.usernameRx))
                 return ERR_INVALID_USERNAME;
@@ -34,22 +45,32 @@ class Transition {
         if (input.password !== undefined) {
             if (invalid(input.password, this.passwordRx))
                 return ERR_INVALID_PASSWORD;
-            const salt = await (0, bcryptjs_1.genSalt)(this.rounds);
             const spicy = input.password + this.pepper;
-            object.password = await (0, bcryptjs_1.hash)(spicy, salt);
+            object.password = await hash(spicy, this.rounds);
         }
         return { id: object.id };
     }
 }
-exports.Transition = Transition;
-function toRx(input) {
-    const expressions = typeof input === 'string' ? [input] : input;
+function toRx(expressions) {
     return expressions.map((expression) => new RegExp(expression));
 }
 function invalid(value, expressions) {
     return expressions.some((expression) => !expression.test(value));
 }
-const ERR_PRINCIPAL_LOCKED = (0, error_value_1.Err)('PRINCIPAL_LOCKED', 'Principal username cannot be changed.');
-const ERR_INVALID_USERNAME = (0, error_value_1.Err)('INVALID_USERNAME', 'Username is not meeting the requirements.');
-const ERR_INVALID_PASSWORD = (0, error_value_1.Err)('INVALID_PASSWORD', 'Password is not meeting the requirements.');
-//# sourceMappingURL=transit.js.map
+const ERR_PRINCIPAL_LOCKED = new (class PrincipalLockedError extends Error {
+    code = 'PRINCIPAL_LOCKED';
+    message = 'Principal username cannot be changed';
+})();
+const ERR_INVALID_USERNAME = new (class InvalidUsernameError extends Error {
+    code = 'INVALID_USERNAME';
+    message = 'Username is not meeting the requirements';
+})();
+const ERR_INVALID_PASSWORD = new (class InvalidPasswordError extends Error {
+    code = 'INVALID_PASSWORD';
+    message = 'Password is not meeting the requirements';
+})();
+const ERR_EXISTS = new (class ExistsError extends Error {
+    code = 'EXISTS';
+    message = 'Basic credentials already exist';
+})();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHJhbnNpdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NvdXJjZS90cmFuc2l0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxJQUFJLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQTtBQVd0QyxNQUFNLE9BQU8sVUFBVTtJQUNiLE1BQU0sR0FBVyxFQUFFLENBQUE7SUFDbkIsTUFBTSxHQUFXLEVBQUUsQ0FBQTtJQUNuQixTQUFTLENBQVk7SUFDckIsTUFBTSxHQUFXLFNBQThCLENBQUE7SUFDL0MsSUFBSSxHQUFTLFNBQTRCLENBQUE7SUFDekMsVUFBVSxHQUFhLEVBQUUsQ0FBQTtJQUN6QixVQUFVLEdBQWEsRUFBRSxDQUFBO0lBRTFCLEtBQUssQ0FBQyxPQUFnQjtRQUMzQixJQUFJLENBQUMsTUFBTSxHQUFHLE9BQU8sQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFBO1FBQzFDLElBQUksQ0FBQyxNQUFNLEdBQUcsT0FBTyxDQUFDLGFBQWEsQ0FBQyxNQUFNLEVBQUUsTUFBTSxFQUFFLElBQUksRUFBRSxDQUFBO1FBQzFELElBQUksQ0FBQyxTQUFTLEdBQUcsT0FBTyxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUE7UUFDaEQsSUFBSSxDQUFDLE1BQU0sR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUE7UUFDNUMsSUFBSSxDQUFDLElBQUksR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUE7UUFFeEMsSUFBSSxDQUFDLFVBQVUsR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsQ0FBQTtRQUN0RCxJQUFJLENBQUMsVUFBVSxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxDQUFBO0lBQ3hELENBQUM7SUFFTyxNQUFNLENBQUMsTUFBYztRQUMzQixPQUFPLENBQ0wsSUFBSSxDQUFDLFNBQVMsS0FBSyxTQUFTO1lBQzVCLE1BQU0sQ0FBQyxTQUFTLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxTQUFTO1lBQzdDLE1BQU0sQ0FBQyxRQUFRLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQzVDLENBQUE7SUFDSCxDQUFDO0lBRU0sS0FBSyxDQUFDLE9BQU8sQ0FDbEIsS0FBbUIsRUFDbkIsTUFBYztRQUVkLE1BQU0sT0FBTyxHQUFHLE1BQU0sQ0FBQyxPQUFPLEtBQUssU0FBUyxJQUFJLE1BQU0sQ0FBQyxPQUFPLEtBQUssSUFBSSxDQUFBO1FBQ3ZFLE1BQU0sUUFBUSxHQUFHLE1BQU0sQ0FBQyxPQUFPLEtBQUssQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFBO1FBRWpELElBQUksUUFBUSxFQUFFLENBQUM7WUFDYixJQUFJLEtBQUssQ0FBQyxTQUFTLEtBQUssSUFBSTtnQkFBRSxPQUFPLFVBQVUsQ0FBQTtZQUUvQyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUM7Z0JBQ2hCLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxFQUFFLE1BQU0sQ0FBQyxFQUFFLEVBQUUsRUFBRSxDQUFDO2dCQUNoRCxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLEtBQUssRUFBRSxFQUFFLFFBQVEsRUFBRSxNQUFNLENBQUMsRUFBRSxFQUFFLEVBQUUsQ0FBQzthQUNyRCxDQUFDLENBQUE7UUFDSixDQUFDO2FBQU0sSUFBSSxLQUFLLENBQUMsU0FBUyxLQUFLLFNBQVM7WUFDdEMsZ0ZBQWdGO1lBQ2hGLE1BQU0sQ0FBQyxTQUFTLEdBQUcsS0FBSyxDQUFDLFNBQVMsQ0FBQTtRQUVwQyxJQUFJLEtBQUssQ0FBQyxRQUFRLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDakMsSUFBSSxRQUFRLElBQUksSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUM7Z0JBQUUsT0FBTyxvQkFBb0IsQ0FBQTtZQUVoRSxJQUFJLE9BQU8sQ0FBQyxLQUFLLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxVQUFVLENBQUM7Z0JBQUUsT0FBTyxvQkFBb0IsQ0FBQTtZQUV6RSxNQUFNLENBQUMsUUFBUSxHQUFHLEtBQUssQ0FBQyxRQUFRLENBQUE7UUFDbEMsQ0FBQztRQUVELElBQUksS0FBSyxDQUFDLFFBQVEsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUNqQyxJQUFJLE9BQU8sQ0FBQyxLQUFLLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxVQUFVLENBQUM7Z0JBQUUsT0FBTyxvQkFBb0IsQ0FBQTtZQUV6RSxNQUFNLEtBQUssR0FBRyxLQUFLLENBQUMsUUFBUSxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUE7WUFFMUMsTUFBTSxDQUFDLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFBO1FBQ2xELENBQUM7UUFFRCxPQUFPLEVBQUUsRUFBRSxFQUFFLE1BQU0sQ0FBQyxFQUFFLEVBQUUsQ0FBQTtJQUMxQixDQUFDO0NBQ0Y7QUFFRCxTQUFTLElBQUksQ0FBQyxXQUFxQjtJQUNqQyxPQUFPLFdBQVcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxVQUFVLEVBQUUsRUFBRSxDQUFDLElBQUksTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUE7QUFDaEUsQ0FBQztBQUVELFNBQVMsT0FBTyxDQUFDLEtBQWEsRUFBRSxXQUFxQjtJQUNuRCxPQUFPLFdBQVcsQ0FBQyxJQUFJLENBQUMsQ0FBQyxVQUFVLEVBQUUsRUFBRSxDQUFDLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFBO0FBQ2xFLENBQUM7QUFFRCxNQUFNLG9CQUFvQixHQUFHLElBQUksQ0FBQyxNQUFNLG9CQUFxQixTQUFRLEtBQUs7SUFDeEQsSUFBSSxHQUFHLGtCQUFrQixDQUFBO0lBQ2hCLE9BQU8sR0FBRyxzQ0FBc0MsQ0FBQTtDQUMxRSxDQUFDLEVBQUUsQ0FBQTtBQUVKLE1BQU0sb0JBQW9CLEdBQUcsSUFBSSxDQUFDLE1BQU0sb0JBQXFCLFNBQVEsS0FBSztJQUN4RCxJQUFJLEdBQUcsa0JBQWtCLENBQUE7SUFDaEIsT0FBTyxHQUFHLDBDQUEwQyxDQUFBO0NBQzlFLENBQUMsRUFBRSxDQUFBO0FBRUosTUFBTSxvQkFBb0IsR0FBRyxJQUFJLENBQUMsTUFBTSxvQkFBcUIsU0FBUSxLQUFLO0lBQ3hELElBQUksR0FBRyxrQkFBa0IsQ0FBQTtJQUNoQixPQUFPLEdBQUcsMENBQTBDLENBQUE7Q0FDOUUsQ0FBQyxFQUFFLENBQUE7QUFFSixNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsTUFBTSxXQUFZLFNBQVEsS0FBSztJQUNyQyxJQUFJLEdBQUcsUUFBUSxDQUFBO0lBQ04sT0FBTyxHQUFHLGlDQUFpQyxDQUFBO0NBQ3JFLENBQUMsRUFBRSxDQUFBIn0=

package/components/identity.basic/source/add.ts

@@ -0,0 +1,18 @@
+import type { AddInput, Context, TransitOutput } from '../types/index.js'
+import type { Maybe } from '@toa.io/core/types'
+
+export async function effect(
+  input: AddInput,
+  context: Context
+): Promise<Maybe<TransitOutput>> {
+  return await context.local.transit({
+    input: {
+      authority: input.authority,
+      username: input.username,
+      password: input.password,
+      inception: true
+    },
+    // `delete` leaves a tombstone, which the transition revives
+    query: { id: input.id, deleted: true }
+  })
+}

package/components/identity.basic/source/authenticate.ts

@@ -1,34 +1,42 @@
-import { compare } from 'bcryptjs'
-import { type Query, type Maybe } from '@toa.io/types'
-import { Err } from 'error-value'
-import { type Context } from './types'
-
-export async function computation (input: Input, context: Context): Promise<Maybe<Output>> {
-  const [username, password] = Buffer
-    .from(input.credentials, 'base64')
-    .toString()
-    .split(':')
-
-  const query: Query = { criteria: `authority==${input.authority};username=='${username}'` }
+import { compare } from '@node-rs/bcrypt'
+import { quote } from '@toa.io/generic'
+import type { Query, Maybe } from '@toa.io/core/types'
+import { split } from './lib/credentials.js'
+import { type Context } from '../types/index.js'
+
+export async function computation(
+  input: Input,
+  context: Context
+): Promise<Maybe<Output>> {
+  const pair = split(input.credentials)
+
+  if (pair === null) return ERR_NOT_FOUND
+
+  const [username, password] = pair
+
+  const query: Query = {
+    criteria: `authority==${quote(input.authority)};username==${quote(username)}`
+  }
   const credentials = await context.local.observe({ query })
 
-  if (credentials instanceof Error)
-    return credentials
+  if (credentials instanceof Error) return credentials
 
-  if (credentials === null)
-    return ERR_NOT_FOUND
+  if (credentials === null) return ERR_NOT_FOUND
 
-  const spicy = password + context.configuration.pepper
+  const spicy = password + (context.configuration.pepper?.unwrap() ?? '')
   const match = await compare(spicy, credentials.password)
 
-  if (match)
-    return { identity: { id: credentials.id } }
-  else
-    return ERR_PASSWORD_MISMATCH
+  if (match) return { identity: { id: credentials.id } }
+  else return ERR_PASSWORD_MISMATCH
 }
 
-const ERR_NOT_FOUND = Err('NOT_FOUND')
-const ERR_PASSWORD_MISMATCH = Err('PASSWORD_MISMATCH')
+const ERR_NOT_FOUND = new (class NotFoundError extends Error {
+  public readonly code = 'NOT_FOUND'
+})()
+
+const ERR_PASSWORD_MISMATCH = new (class PasswordMismatchError extends Error {
+  public readonly code = 'PASSWORD_MISMATCH'
+})()
 
 interface Input {
   authority: string

package/components/identity.basic/source/check.ts

@@ -0,0 +1,24 @@
+import { quote } from '@toa.io/generic'
+import type { Context } from '../types/index.js'
+
+export async function computation(
+  input: Input,
+  context: Context
+): Promise<void | null | Error> {
+  const username = Buffer.from(input.username, 'base64url').toString()
+
+  const found = await context.local.observe({
+    query: {
+      criteria: `authority==${quote(input.authority)};username==${quote(username)}`
+    }
+  })
+
+  if (found instanceof Error) return found
+
+  if (found === null) return null
+}
+
+interface Input {
+  authority: string
+  username: string
+}