@toa.io/extensions.exposition 1.0.0-alpha.3 → 1.0.0-alpha.300

package/components/identity.roles/manifest.toa.yaml

@@ -2,30 +2,76 @@ namespace: identity
 name: roles
 
 entity:
-  schema:
-    identity*: string
-    role*: string
+  properties:
+    grantor:
+      type: string
+    identity:
+      type: string
+      pattern: '[a-z0-9]{32}'
+    role:
+      type: string
+      pattern: ^[a-zA-Z0-9]{0,32}(:[a-zA-Z0-9]{0,32}){0,8}$
+  required:
+    - identity
+    - role
 
 operations:
-  transit:
+  grant:
     query: false
     input:
-      identity*: string
-      role*: string
+      properties:
+        grantor:
+          properties:
+            id:
+              type: string
+            roles:
+              type: array
+              items:
+                type: string
+          type: object
+        identity:
+          type: string
+          default: .
+        role:
+          type: string
+          default: .
+      type: object
+      required:
+        - identity
+        - role
+    errors:
+      - INACCESSIBLE_SCOPE
   list:
-    output: [string]
+    output:
+      type: array
+      items:
+        type: string
   principal:
     input:
-      id: string
+      properties:
+        id:
+          type: string
+      type: object
 
 receivers:
   identity.basic.principal: principal
+  identity.federation.principal: principal
 
 exposition:
   isolated: true
   /:identity:
     auth:role: system:identity:roles
-    POST: transit
+    POST:
+      io:output: [id, grantor]
+      auth:rule:
+        delegate: grantor
+        role: system:identity:roles:delegation
+      endpoint: grant
     GET:
+      io:output: true # array of strings
       auth:id: identity
       endpoint: list
+    /:role:
+      DELETE:
+        io:output: false
+        endpoint: terminate

package/components/identity.roles/migrations/0002-indexes.yaml

@@ -0,0 +1,8 @@
+- index:
+    name: unique_role
+    keys:
+      identity: asc
+      role: asc
+    unique: true
+    partial:
+      DELETED: null

package/components/identity.roles/operations/grant.js

@@ -0,0 +1,21 @@
+export async function transition(input, object) {
+    if (input.grantor === undefined)
+        return Object.assign(object, input);
+    // a manager grants any role; a delegate grants within its own scopes, and never the
+    // right to grant
+    if (!within(MANAGEMENT, input.grantor.roles) &&
+        (!within(input.role, input.grantor.roles) || within(input.role, [MANAGEMENT])))
+        return ERR_INACCESSIBLE_SCOPE;
+    object.role = input.role;
+    object.identity = input.identity;
+    object.grantor = input.grantor.id;
+    return object;
+}
+function within(role, scopes) {
+    return scopes.some((scope) => role === scope || role.startsWith(scope + ':'));
+}
+const MANAGEMENT = 'system:identity:roles';
+const ERR_INACCESSIBLE_SCOPE = new (class InaccessibleScopeError extends Error {
+    code = 'INACCESSIBLE_SCOPE';
+})();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ3JhbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zb3VyY2UvZ3JhbnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBRUEsTUFBTSxDQUFDLEtBQUssVUFBVSxVQUFVLENBQUMsS0FBWSxFQUFFLE1BQWM7SUFDM0QsSUFBSSxLQUFLLENBQUMsT0FBTyxLQUFLLFNBQVM7UUFBRSxPQUFPLE1BQU0sQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLEtBQUssQ0FBQyxDQUFBO0lBRXBFLG9GQUFvRjtJQUNwRixpQkFBaUI7SUFDakIsSUFDRSxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUM7UUFDeEMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsSUFBSSxFQUFFLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksTUFBTSxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDO1FBRTlFLE9BQU8sc0JBQXNCLENBQUE7SUFFL0IsTUFBTSxDQUFDLElBQUksR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFBO0lBQ3hCLE1BQU0sQ0FBQyxRQUFRLEdBQUcsS0FBSyxDQUFDLFFBQVEsQ0FBQTtJQUNoQyxNQUFNLENBQUMsT0FBTyxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFBO0lBRWpDLE9BQU8sTUFBTSxDQUFBO0FBQ2YsQ0FBQztBQUVELFNBQVMsTUFBTSxDQUFDLElBQVksRUFBRSxNQUFnQjtJQUM1QyxPQUFPLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLElBQUksS0FBSyxLQUFLLElBQUksSUFBSSxDQUFDLFVBQVUsQ0FBQyxLQUFLLEdBQUcsR0FBRyxDQUFDLENBQUMsQ0FBQTtBQUMvRSxDQUFDO0FBRUQsTUFBTSxVQUFVLEdBQUcsdUJBQXVCLENBQUE7QUFFMUMsTUFBTSxzQkFBc0IsR0FBRyxJQUFJLENBQUMsTUFBTSxzQkFBdUIsU0FBUSxLQUFLO0lBQzVELElBQUksR0FBRyxvQkFBb0IsQ0FBQTtDQUM1QyxDQUFDLEVBQUUsQ0FBQSJ9

package/components/identity.roles/operations/lib/Entity.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiRW50aXR5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc291cmNlL2xpYi9FbnRpdHkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiJ9

package/components/identity.roles/operations/list.js

@@ -1,8 +1,4 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.observation = void 0;
-function observation(_, objects) {
+export function observation(_, objects) {
     return objects.map(({ role }) => role);
 }
-exports.observation = observation;
-//# sourceMappingURL=list.js.map
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibGlzdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NvdXJjZS9saXN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUVBLE1BQU0sVUFBVSxXQUFXLENBQUMsQ0FBVSxFQUFFLE9BQWlCO0lBQ3ZELE9BQU8sT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFBO0FBQ3hDLENBQUMifQ==

package/components/identity.roles/operations/principal.js

@@ -1,8 +1,33 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.effect = void 0;
-async function effect(input, context) {
-    await context.local.transit({ input: { identity: input.id, role: 'system' } });
+import { quote } from '@toa.io/generic';
+const SYSTEM = 'system';
+/**
+ * The Role is asked for more than once: inception grants it before the reply that mints its
+ * token, and the event fires again on every later change to those credentials.
+ */
+export async function effect(input, context) {
+    if (await granted(input.id, context))
+        return;
+    try {
+        await context.local.grant({
+            input: {
+                identity: input.id,
+                role: SYSTEM
+            }
+        });
+    }
+    catch (error) {
+        // two inceptions of the same credentials race, and the unique index refuses the second
+        if (!(await granted(input.id, context)))
+            throw error;
+    }
 }
-exports.effect = effect;
-//# sourceMappingURL=principal.js.map
+async function granted(identity, context) {
+    const roles = await context.local.list({
+        query: {
+            criteria: `identity==${quote(identity)};role==${quote(SYSTEM)}`,
+            limit: 1
+        }
+    });
+    return roles.length > 0;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJpbmNpcGFsLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL3ByaW5jaXBhbC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsS0FBSyxFQUFFLE1BQU0saUJBQWlCLENBQUE7QUFLdkMsTUFBTSxNQUFNLEdBQUcsUUFBUSxDQUFBO0FBRXZCOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxLQUFLLFVBQVUsTUFBTSxDQUFDLEtBQWUsRUFBRSxPQUFnQjtJQUM1RCxJQUFJLE1BQU0sT0FBTyxDQUFDLEtBQUssQ0FBQyxFQUFFLEVBQUUsT0FBTyxDQUFDO1FBQUUsT0FBTTtJQUU1QyxJQUFJLENBQUM7UUFDSCxNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDO1lBQ3hCLEtBQUssRUFBRTtnQkFDTCxRQUFRLEVBQUUsS0FBSyxDQUFDLEVBQUU7Z0JBQ2xCLElBQUksRUFBRSxNQUFNO2FBQ2I7U0FDRixDQUFDLENBQUE7SUFDSixDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLHVGQUF1RjtRQUN2RixJQUFJLENBQUMsQ0FBQyxNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsRUFBRSxFQUFFLE9BQU8sQ0FBQyxDQUFDO1lBQUUsTUFBTSxLQUFLLENBQUE7SUFDdEQsQ0FBQztBQUNILENBQUM7QUFFRCxLQUFLLFVBQVUsT0FBTyxDQUFDLFFBQWdCLEVBQUUsT0FBZ0I7SUFDdkQsTUFBTSxLQUFLLEdBQUcsTUFBTSxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQztRQUNyQyxLQUFLLEVBQUU7WUFDTCxRQUFRLEVBQUUsYUFBYSxLQUFLLENBQUMsUUFBUSxDQUFDLFVBQVUsS0FBSyxDQUFDLE1BQU0sQ0FBQyxFQUFFO1lBQy9ELEtBQUssRUFBRSxDQUFDO1NBQ1Q7S0FDRixDQUFDLENBQUE7SUFFRixPQUFPLEtBQUssQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFBO0FBQ3pCLENBQUMifQ==

package/components/identity.roles/receivers/identity.federation.principal.js

@@ -0,0 +1,4 @@
+/**
+ * @param {{ identity: string }} payload
+ */
+export const request = (payload) => ({ input: { id: payload.identity } })

package/components/identity.roles/source/grant.ts

@@ -0,0 +1,38 @@
+import type { Entity } from './lib/Entity.js'
+
+export async function transition(input: Input, object: Entity): Promise<Entity | Error> {
+  if (input.grantor === undefined) return Object.assign(object, input)
+
+  // a manager grants any role; a delegate grants within its own scopes, and never the
+  // right to grant
+  if (
+    !within(MANAGEMENT, input.grantor.roles) &&
+    (!within(input.role, input.grantor.roles) || within(input.role, [MANAGEMENT]))
+  )
+    return ERR_INACCESSIBLE_SCOPE
+
+  object.role = input.role
+  object.identity = input.identity
+  object.grantor = input.grantor.id
+
+  return object
+}
+
+function within(role: string, scopes: string[]): boolean {
+  return scopes.some((scope) => role === scope || role.startsWith(scope + ':'))
+}
+
+const MANAGEMENT = 'system:identity:roles'
+
+const ERR_INACCESSIBLE_SCOPE = new (class InaccessibleScopeError extends Error {
+  public readonly code = 'INACCESSIBLE_SCOPE'
+})()
+
+export interface Input {
+  identity: string
+  role: string
+  grantor?: {
+    id: string
+    roles: string[]
+  }
+}

package/components/identity.roles/source/lib/Entity.ts

@@ -0,0 +1,5 @@
+export interface Entity {
+  identity: string
+  role: string
+  grantor?: string
+}

package/components/identity.roles/source/list.ts

@@ -1,7 +1,5 @@
-export function observation (_: unknown, objects: Entity[]): string[] {
-  return objects.map(({ role }) => role)
-}
+import type { Entity } from './lib/Entity.js'
 
-interface Entity {
-  role: string
+export function observation(_: unknown, objects: Entity[]): string[] {
+  return objects.map(({ role }) => role)
 }

package/components/identity.roles/source/principal.ts

@@ -1,7 +1,39 @@
-import { type Call } from '@toa.io/types'
+import { quote } from '@toa.io/generic'
+import type { Entity } from './lib/Entity.js'
+import type { Call, Query } from '@toa.io/core/types'
+import type { Input as GrantInput } from './grant.js'
 
-export async function effect (input: Identity, context: Context): Promise<void> {
-  await context.local.transit({ input: { identity: input.id, role: 'system' } })
+const SYSTEM = 'system'
+
+/**
+ * The Role is asked for more than once: inception grants it before the reply that mints its
+ * token, and the event fires again on every later change to those credentials.
+ */
+export async function effect(input: Identity, context: Context): Promise<void> {
+  if (await granted(input.id, context)) return
+
+  try {
+    await context.local.grant({
+      input: {
+        identity: input.id,
+        role: SYSTEM
+      }
+    })
+  } catch (error) {
+    // two inceptions of the same credentials race, and the unique index refuses the second
+    if (!(await granted(input.id, context))) throw error
+  }
+}
+
+async function granted(identity: string, context: Context): Promise<boolean> {
+  const roles = await context.local.list({
+    query: {
+      criteria: `identity==${quote(identity)};role==${quote(SYSTEM)}`,
+      limit: 1
+    }
+  })
+
+  return roles.length > 0
 }
 
 interface Identity {
@@ -10,11 +42,7 @@ interface Identity {
 
 export interface Context {
   local: {
-    transit: Call<void, TransitInput>
+    grant: Call<Entity, GrantInput>
+    list: (request: { query: Query }) => Promise<string[]>
   }
 }
-
-interface TransitInput {
-  identity: string
-  role: string
-}

package/components/identity.roles/tsconfig.json

@@ -1,7 +1,8 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../../../tsconfig.component.json",
   "compilerOptions": {
     "outDir": "./operations",
+    "rootDir": "./source"
   },
   "include": [
     "source"

package/components/identity.roles/types/index.d.ts

@@ -0,0 +1,3 @@
+export * from './toa.d.ts'
+
+// What a manifest does not state belongs here, and every run keeps it.

package/components/identity.roles/types/toa.d.ts

@@ -0,0 +1,44 @@
+// Written by `toa types`. Every run rewrites it.
+// What a manifest does not state belongs in a file of your own.
+
+import type { Options, Query, RemoteError } from '@toa.io/core/types'
+import type { Readable } from 'node:stream'
+
+export interface Entity {
+  grantor?: string
+  identity: string
+  role: string
+  id: string
+  VERSION: number
+  CREATED: number
+  UPDATED: number
+  DELETED: number | null
+  REGION: number
+}
+
+export type GrantInput = {
+  grantor?: {
+    id?: string
+    roles?: string[]
+  }
+  identity: string
+  role: string
+}
+
+export type ListOutput = string[]
+
+export type PrincipalInput = {
+  id?: string
+}
+
+export interface Component {
+  grant: (request: { input: GrantInput, task?: boolean }, options?: Options) => Promise<unknown | RemoteError<"INACCESSIBLE_SCOPE">>
+  list: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<ListOutput>
+  principal: (request: { input: PrincipalInput, task?: boolean }, options?: Options) => Promise<unknown>
+  assign: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity>
+  ensure: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity>
+  enumerate: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity[]>
+  observe: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity | null>
+  stream: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Readable>
+  terminate: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity>
+}

package/components/identity.tokens/manifest.toa.yaml

@@ -2,38 +2,259 @@ namespace: identity
 name: tokens
 
 entity:
-  schema:
-    revokedAt: number   # timestamp
-  dependent: true
+  associated: true
+  properties:
+    revokedAt:
+      type: integer
 
 operations:
   encrypt:
     input:
-      identity*: &identity
-        id: string
-        ...: true
-      lifetime: number # seconds
-    output: string
+      properties:
+        lifetime:
+          type: number
+          minimum: 0
+        scopes:
+          type: array
+          items:
+            type: string
+        permissions:
+          type: object
+          patternProperties:
+            ^.*$:
+              type: array
+              items:
+                type: string
+        audience:
+          description: Resource URIs this token may be presented at (RFC 8707)
+          type: array
+          items:
+            type: string
+        key:
+          type: object
+          properties:
+            id:
+              type: string
+            key:
+              type: string
+          required:
+            - id
+            - key
+        authority:
+          type: string
+        identity:
+          required: [id, roles]
+          properties:
+            id:
+              type: string
+            roles:
+              type: array
+              items:
+                type: string
+          additionalProperties: true
+          type: object
+      type: object
+      required:
+        - authority
+        - identity
+    output:
+      type: string
+    errors:
+      - INACCESSIBLE_SCOPE
   decrypt:
-    input: string
+    input:
+      type: string
     output:
-      identity: *identity
-      iat: string
-      exp: string
-      refresh: boolean
+      required: [iss, iat, identity, refresh, custom]
+      properties:
+        iss:
+          description: The authority the token names as its issuer
+          type: string
+        identity:
+          required: [id, roles]
+          properties:
+            id:
+              type: string
+            roles:
+              type: array
+              items:
+                type: string
+          additionalProperties: true
+          type: object
+        iat:
+          type: string
+        exp:
+          type: string
+        aud:
+          description: Resource URIs this token may be presented at
+          type: [string, array]
+        custom:
+          type: boolean
+        refresh:
+          type: boolean
+      type: object
+    errors:
+      - INVALID_TOKEN
+      - INVALID_KEY
+      - FORGED_KEY
+      - REVOKED_KEY
   authenticate:
-    input: string
+    input:
+      properties:
+        authority:
+          type: string
+        credentials:
+          type: string
+      type: object
+      required:
+        - authority
+        - credentials
     output:
-      identity: *identity
-      refresh: boolean
+      required: [identity, refresh]
+      properties:
+        identity:
+          required: [id, roles]
+          properties:
+            id:
+              type: string
+            roles:
+              type: array
+              items:
+                type: string
+          additionalProperties: true
+          type: object
+        refresh:
+          type: boolean
+      type: object
+    errors:
+      - UNRECOGNIZED
+      - AUTHORITY_MISMATCH
+      - TOKEN_REVOKED
+      # what `decrypt` refuses with, passed on
+      - INVALID_TOKEN
+      - INVALID_KEY
+      - FORGED_KEY
+      - REVOKED_KEY
+  issue:
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        identity:
+          type: string
+        lifetime:
+          type: number
+          minimum: 0
+        scopes:
+          type: array
+          items:
+            type: string
+        permissions:
+          type: object
+          additionalProperties:
+            type: array
+            items:
+              type: string
+        audience:
+          description: Resource URIs this token may be presented at (RFC 8707)
+          type: array
+          items:
+            type: string
+        label:
+          type: string
+          minLength: 1
+          maxLength: 64
+      required:
+        - authority
+        - identity
+        - label
+    output:
+      required: [kid, token]
+      properties:
+        kid:
+          type: string
+        exp:
+          type: number
+        token:
+          type: string
+      type: object
+    errors:
+      - INACCESSIBLE_SCOPE
   revoke:
+    output: { type: 'null' }
     concurrency: retry
 
 receivers:
+  identity.bans.created: revoke
   identity.bans.updated: revoke
 
 configuration:
-  key0*: string
-  key1: string
-  lifetime: 2592000 # seconds, 30 days
-  refresh: 600      # seconds, 10 minutes
+  schema:
+    type: object
+    properties:
+      keys:
+        type: array
+        minItems: 1
+        # at least one key issues, which a `paseto` one does not
+        contains:
+          not:
+            properties:
+              format:
+                const: paseto
+            required: [format]
+        items:
+          type: object
+          properties:
+            id:
+              type: string
+              minLength: 1
+            key:
+              type: string
+              format: secret
+            format:
+              # a key that does not say is a JWE, which is what the component reads it as
+              type: string
+              enum:
+                - jwe
+                - paseto
+          required:
+            - id
+            - key
+          additionalProperties: false
+      lifetime:
+        description: Token expiration time in seconds (default 30 days)
+        type: integer
+      refresh:
+        description: Token refresh time in seconds (default 10 minutes)
+        type: integer
+      cache:
+        description: Custom token keys LRU cache configuration
+        properties:
+          max:
+            type: integer
+          ttl:
+            type: integer
+        required: [max, ttl]
+    required:
+      - keys
+      - lifetime
+      - refresh
+      - cache
+
+  defaults:
+    lifetime: 2592000
+    refresh: 600
+    cache:
+      max: 1024
+      ttl: 600000
+
+exposition:
+  /:identity:
+    auth:id: identity
+    auth:role: system:identity:tokens
+    POST:
+      map:authority: authority
+      io:input: [lifetime, label, scopes, permissions]
+      io:output: [kid, exp, token, label]
+      endpoint: issue