@toa.io/extensions.exposition 1.0.0-alpha.3 → 1.0.0-alpha.300

package/components/identity.basic/migrations/0002-indexes.yaml

@@ -0,0 +1,13 @@
+- index:
+    name: unique_authority_username
+    keys:
+      authority: asc
+      username: asc
+    unique: true
+    partial:
+      DELETED: null
+- index:
+    name: index_username
+    keys:
+      authority: asc
+      username: asc

package/components/identity.basic/operations/add.js

@@ -0,0 +1,13 @@
+export async function effect(input, context) {
+    return await context.local.transit({
+        input: {
+            authority: input.authority,
+            username: input.username,
+            password: input.password,
+            inception: true
+        },
+        // `delete` leaves a tombstone, which the transition revives
+        query: { id: input.id, deleted: true }
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWRkLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2FkZC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFHQSxNQUFNLENBQUMsS0FBSyxVQUFVLE1BQU0sQ0FDMUIsS0FBZSxFQUNmLE9BQWdCO0lBRWhCLE9BQU8sTUFBTSxPQUFPLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQztRQUNqQyxLQUFLLEVBQUU7WUFDTCxTQUFTLEVBQUUsS0FBSyxDQUFDLFNBQVM7WUFDMUIsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRO1lBQ3hCLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUTtZQUN4QixTQUFTLEVBQUUsSUFBSTtTQUNoQjtRQUNELDREQUE0RDtRQUM1RCxLQUFLLEVBQUUsRUFBRSxFQUFFLEVBQUUsS0FBSyxDQUFDLEVBQUUsRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFO0tBQ3ZDLENBQUMsQ0FBQTtBQUNKLENBQUMifQ==

package/components/identity.basic/operations/authenticate.js

@@ -1,24 +1,30 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.computation = void 0;
-const bcryptjs_1 = require("bcryptjs");
-const error_value_1 = require("error-value");
-async function computation(input, context) {
-    const [username, password] = atob(input).split(':');
-    const query = { criteria: `username==${username}` };
+import { compare } from '@node-rs/bcrypt';
+import { quote } from '@toa.io/generic';
+import { split } from './lib/credentials.js';
+export async function computation(input, context) {
+    const pair = split(input.credentials);
+    if (pair === null)
+        return ERR_NOT_FOUND;
+    const [username, password] = pair;
+    const query = {
+        criteria: `authority==${quote(input.authority)};username==${quote(username)}`
+    };
     const credentials = await context.local.observe({ query });
     if (credentials instanceof Error)
         return credentials;
     if (credentials === null)
         return ERR_NOT_FOUND;
-    const spicy = password + context.configuration.pepper;
-    const match = await (0, bcryptjs_1.compare)(spicy, credentials.password);
+    const spicy = password + (context.configuration.pepper?.unwrap() ?? '');
+    const match = await compare(spicy, credentials.password);
     if (match)
         return { identity: { id: credentials.id } };
     else
         return ERR_PASSWORD_MISMATCH;
 }
-exports.computation = computation;
-const ERR_NOT_FOUND = (0, error_value_1.Err)('NOT_FOUND');
-const ERR_PASSWORD_MISMATCH = (0, error_value_1.Err)('PASSWORD_MISMATCH');
-//# sourceMappingURL=authenticate.js.map
+const ERR_NOT_FOUND = new (class NotFoundError extends Error {
+    code = 'NOT_FOUND';
+})();
+const ERR_PASSWORD_MISMATCH = new (class PasswordMismatchError extends Error {
+    code = 'PASSWORD_MISMATCH';
+})();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aGVudGljYXRlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2F1dGhlbnRpY2F0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsT0FBTyxFQUFFLE1BQU0saUJBQWlCLENBQUE7QUFDekMsT0FBTyxFQUFFLEtBQUssRUFBRSxNQUFNLGlCQUFpQixDQUFBO0FBRXZDLE9BQU8sRUFBRSxLQUFLLEVBQUUsTUFBTSxzQkFBc0IsQ0FBQTtBQUc1QyxNQUFNLENBQUMsS0FBSyxVQUFVLFdBQVcsQ0FDL0IsS0FBWSxFQUNaLE9BQWdCO0lBRWhCLE1BQU0sSUFBSSxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLENBQUE7SUFFckMsSUFBSSxJQUFJLEtBQUssSUFBSTtRQUFFLE9BQU8sYUFBYSxDQUFBO0lBRXZDLE1BQU0sQ0FBQyxRQUFRLEVBQUUsUUFBUSxDQUFDLEdBQUcsSUFBSSxDQUFBO0lBRWpDLE1BQU0sS0FBSyxHQUFVO1FBQ25CLFFBQVEsRUFBRSxjQUFjLEtBQUssQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLGNBQWMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxFQUFFO0tBQzlFLENBQUE7SUFDRCxNQUFNLFdBQVcsR0FBRyxNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQTtJQUUxRCxJQUFJLFdBQVcsWUFBWSxLQUFLO1FBQUUsT0FBTyxXQUFXLENBQUE7SUFFcEQsSUFBSSxXQUFXLEtBQUssSUFBSTtRQUFFLE9BQU8sYUFBYSxDQUFBO0lBRTlDLE1BQU0sS0FBSyxHQUFHLFFBQVEsR0FBRyxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsTUFBTSxFQUFFLE1BQU0sRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFBO0lBQ3ZFLE1BQU0sS0FBSyxHQUFHLE1BQU0sT0FBTyxDQUFDLEtBQUssRUFBRSxXQUFXLENBQUMsUUFBUSxDQUFDLENBQUE7SUFFeEQsSUFBSSxLQUFLO1FBQUUsT0FBTyxFQUFFLFFBQVEsRUFBRSxFQUFFLEVBQUUsRUFBRSxXQUFXLENBQUMsRUFBRSxFQUFFLEVBQUUsQ0FBQTs7UUFDakQsT0FBTyxxQkFBcUIsQ0FBQTtBQUNuQyxDQUFDO0FBRUQsTUFBTSxhQUFhLEdBQUcsSUFBSSxDQUFDLE1BQU0sYUFBYyxTQUFRLEtBQUs7SUFDMUMsSUFBSSxHQUFHLFdBQVcsQ0FBQTtDQUNuQyxDQUFDLEVBQUUsQ0FBQTtBQUVKLE1BQU0scUJBQXFCLEdBQUcsSUFBSSxDQUFDLE1BQU0scUJBQXNCLFNBQVEsS0FBSztJQUMxRCxJQUFJLEdBQUcsbUJBQW1CLENBQUE7Q0FDM0MsQ0FBQyxFQUFFLENBQUEifQ==

package/components/identity.basic/operations/check.js

@@ -0,0 +1,14 @@
+import { quote } from '@toa.io/generic';
+export async function computation(input, context) {
+    const username = Buffer.from(input.username, 'base64url').toString();
+    const found = await context.local.observe({
+        query: {
+            criteria: `authority==${quote(input.authority)};username==${quote(username)}`
+        }
+    });
+    if (found instanceof Error)
+        return found;
+    if (found === null)
+        return null;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hlY2suanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zb3VyY2UvY2hlY2sudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLEtBQUssRUFBRSxNQUFNLGlCQUFpQixDQUFBO0FBR3ZDLE1BQU0sQ0FBQyxLQUFLLFVBQVUsV0FBVyxDQUMvQixLQUFZLEVBQ1osT0FBZ0I7SUFFaEIsTUFBTSxRQUFRLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsUUFBUSxFQUFFLFdBQVcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxDQUFBO0lBRXBFLE1BQU0sS0FBSyxHQUFHLE1BQU0sT0FBTyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUM7UUFDeEMsS0FBSyxFQUFFO1lBQ0wsUUFBUSxFQUFFLGNBQWMsS0FBSyxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsY0FBYyxLQUFLLENBQUMsUUFBUSxDQUFDLEVBQUU7U0FDOUU7S0FDRixDQUFDLENBQUE7SUFFRixJQUFJLEtBQUssWUFBWSxLQUFLO1FBQUUsT0FBTyxLQUFLLENBQUE7SUFFeEMsSUFBSSxLQUFLLEtBQUssSUFBSTtRQUFFLE9BQU8sSUFBSSxDQUFBO0FBQ2pDLENBQUMifQ==

package/components/identity.basic/operations/delete.js

@@ -0,0 +1,7 @@
+export async function effect({ authority, identity }, context) {
+    const object = await context.local.observe({ query: { id: identity } });
+    if (object === null || object instanceof Error || object.authority !== authority)
+        return null;
+    return await context.local.terminate({ query: { id: identity } });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVsZXRlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2RlbGV0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFFQSxNQUFNLENBQUMsS0FBSyxVQUFVLE1BQU0sQ0FDMUIsRUFBRSxTQUFTLEVBQUUsUUFBUSxFQUFTLEVBQzlCLE9BQWdCO0lBRWhCLE1BQU0sTUFBTSxHQUFHLE1BQU0sT0FBTyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFFLEVBQUUsUUFBUSxFQUFFLEVBQUUsQ0FBQyxDQUFBO0lBRXZFLElBQUksTUFBTSxLQUFLLElBQUksSUFBSSxNQUFNLFlBQVksS0FBSyxJQUFJLE1BQU0sQ0FBQyxTQUFTLEtBQUssU0FBUztRQUM5RSxPQUFPLElBQUksQ0FBQTtJQUViLE9BQU8sTUFBTSxPQUFPLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxFQUFFLEtBQUssRUFBRSxFQUFFLEVBQUUsRUFBRSxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQUE7QUFDbkUsQ0FBQyJ9

package/components/identity.basic/operations/incept.js

@@ -0,0 +1,38 @@
+import { split } from './lib/credentials.js';
+export async function effect(input, context) {
+    const pair = split(input.credentials);
+    if (pair === null)
+        return INVALID_CREDENTIALS;
+    const [username, password] = pair;
+    const request = {
+        input: {
+            authority: input.authority,
+            username,
+            password
+        },
+        query: {
+            id: input.id
+        }
+    };
+    const incepted = await context.local.transit(request);
+    if (incepted instanceof Error)
+        return incepted;
+    await principal({ authority: input.authority, username }, incepted.id, context);
+    return incepted;
+}
+/**
+ * The `system` Role is granted here, before the reply that mints a Token from these
+ * credentials — the event that carries the same grant lands after it.
+ */
+async function principal(credentials, id, context) {
+    const configured = context.configuration.principal;
+    if (configured === undefined ||
+        configured.authority !== credentials.authority ||
+        configured.username !== credentials.username)
+        return;
+    await context.remote.identity.roles.principal({ input: { id } });
+}
+const INVALID_CREDENTIALS = new (class InvalidCredentialsError extends Error {
+    code = 'INVALID_CREDENTIALS';
+})();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5jZXB0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2luY2VwdC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsS0FBSyxFQUFFLE1BQU0sc0JBQXNCLENBQUE7QUFJNUMsTUFBTSxDQUFDLEtBQUssVUFBVSxNQUFNLENBQUMsS0FBWSxFQUFFLE9BQWdCO0lBQ3pELE1BQU0sSUFBSSxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLENBQUE7SUFFckMsSUFBSSxJQUFJLEtBQUssSUFBSTtRQUFFLE9BQU8sbUJBQW1CLENBQUE7SUFFN0MsTUFBTSxDQUFDLFFBQVEsRUFBRSxRQUFRLENBQUMsR0FBRyxJQUFJLENBQUE7SUFFakMsTUFBTSxPQUFPLEdBQUc7UUFDZCxLQUFLLEVBQUU7WUFDTCxTQUFTLEVBQUUsS0FBSyxDQUFDLFNBQVM7WUFDMUIsUUFBUTtZQUNSLFFBQVE7U0FDVDtRQUNELEtBQUssRUFBRTtZQUNMLEVBQUUsRUFBRSxLQUFLLENBQUMsRUFBRTtTQUNiO0tBQ0YsQ0FBQTtJQUVELE1BQU0sUUFBUSxHQUFHLE1BQU0sT0FBTyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLENBQUE7SUFFckQsSUFBSSxRQUFRLFlBQVksS0FBSztRQUFFLE9BQU8sUUFBUSxDQUFBO0lBRTlDLE1BQU0sU0FBUyxDQUFDLEVBQUUsU0FBUyxFQUFFLEtBQUssQ0FBQyxTQUFTLEVBQUUsUUFBUSxFQUFFLEVBQUUsUUFBUSxDQUFDLEVBQUUsRUFBRSxPQUFPLENBQUMsQ0FBQTtJQUUvRSxPQUFPLFFBQVEsQ0FBQTtBQUNqQixDQUFDO0FBRUQ7OztHQUdHO0FBQ0gsS0FBSyxVQUFVLFNBQVMsQ0FDdEIsV0FBd0IsRUFDeEIsRUFBVSxFQUNWLE9BQWdCO0lBRWhCLE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FBQyxhQUFhLENBQUMsU0FBUyxDQUFBO0lBRWxELElBQ0UsVUFBVSxLQUFLLFNBQVM7UUFDeEIsVUFBVSxDQUFDLFNBQVMsS0FBSyxXQUFXLENBQUMsU0FBUztRQUM5QyxVQUFVLENBQUMsUUFBUSxLQUFLLFdBQVcsQ0FBQyxRQUFRO1FBRTVDLE9BQU07SUFFUixNQUFNLE9BQU8sQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUE7QUFDbEUsQ0FBQztBQUVELE1BQU0sbUJBQW1CLEdBQUcsSUFBSSxDQUFDLE1BQU0sdUJBQXdCLFNBQVEsS0FBSztJQUMxRCxJQUFJLEdBQUcscUJBQXFCLENBQUE7Q0FDN0MsQ0FBQyxFQUFFLENBQUEifQ==

package/components/identity.basic/operations/info.js

@@ -0,0 +1,7 @@
+export async function effect({ authority, identity }, context) {
+    const object = await context.local.observe({ query: { id: identity } });
+    if (object === null || object instanceof Error || object.authority !== authority)
+        return null;
+    return { username: object.username };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5mby5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NvdXJjZS9pbmZvLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUVBLE1BQU0sQ0FBQyxLQUFLLFVBQVUsTUFBTSxDQUMxQixFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQVMsRUFDOUIsT0FBZ0I7SUFFaEIsTUFBTSxNQUFNLEdBQUcsTUFBTSxPQUFPLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLEtBQUssRUFBRSxFQUFFLEVBQUUsRUFBRSxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQUE7SUFFdkUsSUFBSSxNQUFNLEtBQUssSUFBSSxJQUFJLE1BQU0sWUFBWSxLQUFLLElBQUksTUFBTSxDQUFDLFNBQVMsS0FBSyxTQUFTO1FBQzlFLE9BQU8sSUFBSSxDQUFBO0lBRWIsT0FBTyxFQUFFLFFBQVEsRUFBRSxNQUFNLENBQUMsUUFBUSxFQUFFLENBQUE7QUFDdEMsQ0FBQyJ9

package/components/identity.basic/operations/lib/credentials.js

@@ -0,0 +1,12 @@
+/**
+ * The user-id and the password of Basic credentials. RFC 7617 forbids a colon in the
+ * user-id and allows any number of them in the password, so the split is at the first one.
+ */
+export function split(credentials) {
+    const decoded = Buffer.from(credentials, 'base64').toString();
+    const colon = decoded.indexOf(':');
+    if (colon === -1)
+        return null;
+    return [decoded.slice(0, colon), decoded.slice(colon + 1)];
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY3JlZGVudGlhbHMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zb3VyY2UvbGliL2NyZWRlbnRpYWxzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7R0FHRztBQUNILE1BQU0sVUFBVSxLQUFLLENBQUMsV0FBbUI7SUFDdkMsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxXQUFXLEVBQUUsUUFBUSxDQUFDLENBQUMsUUFBUSxFQUFFLENBQUE7SUFDN0QsTUFBTSxLQUFLLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQTtJQUVsQyxJQUFJLEtBQUssS0FBSyxDQUFDLENBQUM7UUFBRSxPQUFPLElBQUksQ0FBQTtJQUU3QixPQUFPLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsS0FBSyxDQUFDLEVBQUUsT0FBTyxDQUFDLEtBQUssQ0FBQyxLQUFLLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQTtBQUM1RCxDQUFDIn0=

package/components/identity.basic/operations/transit.js

@@ -1,53 +1,76 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Transition = void 0;
-const bcryptjs_1 = require("bcryptjs");
-const error_value_1 = require("error-value");
-class Transition {
+import { hash } from '@node-rs/bcrypt';
+export class Transition {
     rounds = 10;
     pepper = '';
     principal;
     tokens = undefined;
+    keys = undefined;
     usernameRx = [];
-    passwrodRx = [];
+    passwordRx = [];
     mount(context) {
         this.rounds = context.configuration.rounds;
-        this.pepper = context.configuration.pepper;
+        this.pepper = context.configuration.pepper?.unwrap() ?? '';
         this.principal = context.configuration.principal;
         this.tokens = context.remote.identity.tokens;
+        this.keys = context.remote.identity.keys;
         this.usernameRx = toRx(context.configuration.username);
-        this.passwrodRx = toRx(context.configuration.password);
+        this.passwordRx = toRx(context.configuration.password);
+    }
+    locked(object) {
+        return (this.principal !== undefined &&
+            object.authority === this.principal.authority &&
+            object.username === this.principal.username);
     }
     async execute(input, object) {
-        const existent = object._version !== 0;
-        if (existent)
-            await this.tokens.revoke({ query: { id: object.id } });
+        const deleted = object.DELETED !== undefined && object.DELETED !== null;
+        const existent = object.VERSION !== 0 && !deleted;
+        if (existent) {
+            if (input.inception === true)
+                return ERR_EXISTS;
+            await Promise.all([
+                this.tokens.revoke({ query: { id: object.id } }),
+                this.keys.revoke({ input: { identity: object.id } })
+            ]);
+        }
+        else if (input.authority !== undefined)
+            // a record that is new and names no authority is refused by the entity contract
+            object.authority = input.authority;
         if (input.username !== undefined) {
-            if (existent && object.username === this.principal)
+            if (existent && this.locked(object))
                 return ERR_PRINCIPAL_LOCKED;
             if (invalid(input.username, this.usernameRx))
                 return ERR_INVALID_USERNAME;
             object.username = input.username;
         }
         if (input.password !== undefined) {
-            if (invalid(input.password, this.passwrodRx))
+            if (invalid(input.password, this.passwordRx))
                 return ERR_INVALID_PASSWORD;
-            const salt = await (0, bcryptjs_1.genSalt)(this.rounds);
             const spicy = input.password + this.pepper;
-            object.password = await (0, bcryptjs_1.hash)(spicy, salt);
+            object.password = await hash(spicy, this.rounds);
         }
         return { id: object.id };
     }
 }
-exports.Transition = Transition;
-function toRx(input) {
-    const expressions = typeof input === 'string' ? [input] : input;
+function toRx(expressions) {
     return expressions.map((expression) => new RegExp(expression));
 }
 function invalid(value, expressions) {
     return expressions.some((expression) => !expression.test(value));
 }
-const ERR_PRINCIPAL_LOCKED = (0, error_value_1.Err)('PRINCIPAL_LOCKED', 'Principal username cannot be changed.');
-const ERR_INVALID_USERNAME = (0, error_value_1.Err)('INVALID_USERNAME', 'Username is not meeting the requirements.');
-const ERR_INVALID_PASSWORD = (0, error_value_1.Err)('INVALID_PASSWORD', 'Password is not meeting the requirements.');
-//# sourceMappingURL=transit.js.map
+const ERR_PRINCIPAL_LOCKED = new (class PrincipalLockedError extends Error {
+    code = 'PRINCIPAL_LOCKED';
+    message = 'Principal username cannot be changed';
+})();
+const ERR_INVALID_USERNAME = new (class InvalidUsernameError extends Error {
+    code = 'INVALID_USERNAME';
+    message = 'Username is not meeting the requirements';
+})();
+const ERR_INVALID_PASSWORD = new (class InvalidPasswordError extends Error {
+    code = 'INVALID_PASSWORD';
+    message = 'Password is not meeting the requirements';
+})();
+const ERR_EXISTS = new (class ExistsError extends Error {
+    code = 'EXISTS';
+    message = 'Basic credentials already exist';
+})();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHJhbnNpdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NvdXJjZS90cmFuc2l0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxJQUFJLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQTtBQVd0QyxNQUFNLE9BQU8sVUFBVTtJQUNiLE1BQU0sR0FBVyxFQUFFLENBQUE7SUFDbkIsTUFBTSxHQUFXLEVBQUUsQ0FBQTtJQUNuQixTQUFTLENBQVk7SUFDckIsTUFBTSxHQUFXLFNBQThCLENBQUE7SUFDL0MsSUFBSSxHQUFTLFNBQTRCLENBQUE7SUFDekMsVUFBVSxHQUFhLEVBQUUsQ0FBQTtJQUN6QixVQUFVLEdBQWEsRUFBRSxDQUFBO0lBRTFCLEtBQUssQ0FBQyxPQUFnQjtRQUMzQixJQUFJLENBQUMsTUFBTSxHQUFHLE9BQU8sQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFBO1FBQzFDLElBQUksQ0FBQyxNQUFNLEdBQUcsT0FBTyxDQUFDLGFBQWEsQ0FBQyxNQUFNLEVBQUUsTUFBTSxFQUFFLElBQUksRUFBRSxDQUFBO1FBQzFELElBQUksQ0FBQyxTQUFTLEdBQUcsT0FBTyxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUE7UUFDaEQsSUFBSSxDQUFDLE1BQU0sR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUE7UUFDNUMsSUFBSSxDQUFDLElBQUksR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUE7UUFFeEMsSUFBSSxDQUFDLFVBQVUsR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsQ0FBQTtRQUN0RCxJQUFJLENBQUMsVUFBVSxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxDQUFBO0lBQ3hELENBQUM7SUFFTyxNQUFNLENBQUMsTUFBYztRQUMzQixPQUFPLENBQ0wsSUFBSSxDQUFDLFNBQVMsS0FBSyxTQUFTO1lBQzVCLE1BQU0sQ0FBQyxTQUFTLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxTQUFTO1lBQzdDLE1BQU0sQ0FBQyxRQUFRLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQzVDLENBQUE7SUFDSCxDQUFDO0lBRU0sS0FBSyxDQUFDLE9BQU8sQ0FDbEIsS0FBbUIsRUFDbkIsTUFBYztRQUVkLE1BQU0sT0FBTyxHQUFHLE1BQU0sQ0FBQyxPQUFPLEtBQUssU0FBUyxJQUFJLE1BQU0sQ0FBQyxPQUFPLEtBQUssSUFBSSxDQUFBO1FBQ3ZFLE1BQU0sUUFBUSxHQUFHLE1BQU0sQ0FBQyxPQUFPLEtBQUssQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFBO1FBRWpELElBQUksUUFBUSxFQUFFLENBQUM7WUFDYixJQUFJLEtBQUssQ0FBQyxTQUFTLEtBQUssSUFBSTtnQkFBRSxPQUFPLFVBQVUsQ0FBQTtZQUUvQyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUM7Z0JBQ2hCLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxFQUFFLE1BQU0sQ0FBQyxFQUFFLEVBQUUsRUFBRSxDQUFDO2dCQUNoRCxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLEtBQUssRUFBRSxFQUFFLFFBQVEsRUFBRSxNQUFNLENBQUMsRUFBRSxFQUFFLEVBQUUsQ0FBQzthQUNyRCxDQUFDLENBQUE7UUFDSixDQUFDO2FBQU0sSUFBSSxLQUFLLENBQUMsU0FBUyxLQUFLLFNBQVM7WUFDdEMsZ0ZBQWdGO1lBQ2hGLE1BQU0sQ0FBQyxTQUFTLEdBQUcsS0FBSyxDQUFDLFNBQVMsQ0FBQTtRQUVwQyxJQUFJLEtBQUssQ0FBQyxRQUFRLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDakMsSUFBSSxRQUFRLElBQUksSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUM7Z0JBQUUsT0FBTyxvQkFBb0IsQ0FBQTtZQUVoRSxJQUFJLE9BQU8sQ0FBQyxLQUFLLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxVQUFVLENBQUM7Z0JBQUUsT0FBTyxvQkFBb0IsQ0FBQTtZQUV6RSxNQUFNLENBQUMsUUFBUSxHQUFHLEtBQUssQ0FBQyxRQUFRLENBQUE7UUFDbEMsQ0FBQztRQUVELElBQUksS0FBSyxDQUFDLFFBQVEsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUNqQyxJQUFJLE9BQU8sQ0FBQyxLQUFLLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxVQUFVLENBQUM7Z0JBQUUsT0FBTyxvQkFBb0IsQ0FBQTtZQUV6RSxNQUFNLEtBQUssR0FBRyxLQUFLLENBQUMsUUFBUSxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUE7WUFFMUMsTUFBTSxDQUFDLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFBO1FBQ2xELENBQUM7UUFFRCxPQUFPLEVBQUUsRUFBRSxFQUFFLE1BQU0sQ0FBQyxFQUFFLEVBQUUsQ0FBQTtJQUMxQixDQUFDO0NBQ0Y7QUFFRCxTQUFTLElBQUksQ0FBQyxXQUFxQjtJQUNqQyxPQUFPLFdBQVcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxVQUFVLEVBQUUsRUFBRSxDQUFDLElBQUksTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUE7QUFDaEUsQ0FBQztBQUVELFNBQVMsT0FBTyxDQUFDLEtBQWEsRUFBRSxXQUFxQjtJQUNuRCxPQUFPLFdBQVcsQ0FBQyxJQUFJLENBQUMsQ0FBQyxVQUFVLEVBQUUsRUFBRSxDQUFDLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFBO0FBQ2xFLENBQUM7QUFFRCxNQUFNLG9CQUFvQixHQUFHLElBQUksQ0FBQyxNQUFNLG9CQUFxQixTQUFRLEtBQUs7SUFDeEQsSUFBSSxHQUFHLGtCQUFrQixDQUFBO0lBQ2hCLE9BQU8sR0FBRyxzQ0FBc0MsQ0FBQTtDQUMxRSxDQUFDLEVBQUUsQ0FBQTtBQUVKLE1BQU0sb0JBQW9CLEdBQUcsSUFBSSxDQUFDLE1BQU0sb0JBQXFCLFNBQVEsS0FBSztJQUN4RCxJQUFJLEdBQUcsa0JBQWtCLENBQUE7SUFDaEIsT0FBTyxHQUFHLDBDQUEwQyxDQUFBO0NBQzlFLENBQUMsRUFBRSxDQUFBO0FBRUosTUFBTSxvQkFBb0IsR0FBRyxJQUFJLENBQUMsTUFBTSxvQkFBcUIsU0FBUSxLQUFLO0lBQ3hELElBQUksR0FBRyxrQkFBa0IsQ0FBQTtJQUNoQixPQUFPLEdBQUcsMENBQTBDLENBQUE7Q0FDOUUsQ0FBQyxFQUFFLENBQUE7QUFFSixNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsTUFBTSxXQUFZLFNBQVEsS0FBSztJQUNyQyxJQUFJLEdBQUcsUUFBUSxDQUFBO0lBQ04sT0FBTyxHQUFHLGlDQUFpQyxDQUFBO0NBQ3JFLENBQUMsRUFBRSxDQUFBIn0=

package/components/identity.basic/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "identity.basic",
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "@node-rs/bcrypt": "1.10.8"
+  }
+}

package/components/identity.basic/source/add.ts

@@ -0,0 +1,18 @@
+import type { AddInput, Context, TransitOutput } from '../types/index.js'
+import type { Maybe } from '@toa.io/core/types'
+
+export async function effect(
+  input: AddInput,
+  context: Context
+): Promise<Maybe<TransitOutput>> {
+  return await context.local.transit({
+    input: {
+      authority: input.authority,
+      username: input.username,
+      password: input.password,
+      inception: true
+    },
+    // `delete` leaves a tombstone, which the transition revives
+    query: { id: input.id, deleted: true }
+  })
+}

package/components/identity.basic/source/authenticate.ts

@@ -1,28 +1,47 @@
-import { compare } from 'bcryptjs'
-import { type Query, type Maybe } from '@toa.io/types'
-import { Err } from 'error-value'
-import { type Context } from './types'
-
-export async function computation (input: string, context: Context): Promise<Maybe<Output>> {
-  const [username, password] = atob(input).split(':')
-  const query: Query = { criteria: `username==${username}` }
+import { compare } from '@node-rs/bcrypt'
+import { quote } from '@toa.io/generic'
+import type { Query, Maybe } from '@toa.io/core/types'
+import { split } from './lib/credentials.js'
+import { type Context } from '../types/index.js'
+
+export async function computation(
+  input: Input,
+  context: Context
+): Promise<Maybe<Output>> {
+  const pair = split(input.credentials)
+
+  if (pair === null) return ERR_NOT_FOUND
+
+  const [username, password] = pair
+
+  const query: Query = {
+    criteria: `authority==${quote(input.authority)};username==${quote(username)}`
+  }
   const credentials = await context.local.observe({ query })
 
-  if (credentials instanceof Error)
-    return credentials
+  if (credentials instanceof Error) return credentials
 
-  if (credentials === null)
-    return ERR_NOT_FOUND
+  if (credentials === null) return ERR_NOT_FOUND
 
-  const spicy = password + context.configuration.pepper
+  const spicy = password + (context.configuration.pepper?.unwrap() ?? '')
   const match = await compare(spicy, credentials.password)
 
   if (match) return { identity: { id: credentials.id } }
   else return ERR_PASSWORD_MISMATCH
 }
 
-const ERR_NOT_FOUND = Err('NOT_FOUND')
-const ERR_PASSWORD_MISMATCH = Err('PASSWORD_MISMATCH')
+const ERR_NOT_FOUND = new (class NotFoundError extends Error {
+  public readonly code = 'NOT_FOUND'
+})()
+
+const ERR_PASSWORD_MISMATCH = new (class PasswordMismatchError extends Error {
+  public readonly code = 'PASSWORD_MISMATCH'
+})()
+
+interface Input {
+  authority: string
+  credentials: string
+}
 
 interface Output {
   identity: {

package/components/identity.basic/source/check.ts

@@ -0,0 +1,24 @@
+import { quote } from '@toa.io/generic'
+import type { Context } from '../types/index.js'
+
+export async function computation(
+  input: Input,
+  context: Context
+): Promise<void | null | Error> {
+  const username = Buffer.from(input.username, 'base64url').toString()
+
+  const found = await context.local.observe({
+    query: {
+      criteria: `authority==${quote(input.authority)};username==${quote(username)}`
+    }
+  })
+
+  if (found instanceof Error) return found
+
+  if (found === null) return null
+}
+
+interface Input {
+  authority: string
+  username: string
+}

package/components/identity.basic/source/delete.ts

@@ -0,0 +1,18 @@
+import type { Context, Entity } from '../types/index.js'
+
+export async function effect(
+  { authority, identity }: Input,
+  context: Context
+): Promise<Entity | null> {
+  const object = await context.local.observe({ query: { id: identity } })
+
+  if (object === null || object instanceof Error || object.authority !== authority)
+    return null
+
+  return await context.local.terminate({ query: { id: identity } })
+}
+
+interface Input {
+  authority: string
+  identity: string
+}

package/components/identity.basic/source/incept.ts

@@ -0,0 +1,70 @@
+import { split } from './lib/credentials.js'
+import type { Context } from '../types/index.js'
+import type { Maybe } from '@toa.io/core/types'
+
+export async function effect(input: Input, context: Context): Promise<Maybe<Output>> {
+  const pair = split(input.credentials)
+
+  if (pair === null) return INVALID_CREDENTIALS
+
+  const [username, password] = pair
+
+  const request = {
+    input: {
+      authority: input.authority,
+      username,
+      password
+    },
+    query: {
+      id: input.id
+    }
+  }
+
+  const incepted = await context.local.transit(request)
+
+  if (incepted instanceof Error) return incepted
+
+  await principal({ authority: input.authority, username }, incepted.id, context)
+
+  return incepted
+}
+
+/**
+ * The `system` Role is granted here, before the reply that mints a Token from these
+ * credentials — the event that carries the same grant lands after it.
+ */
+async function principal(
+  credentials: Credentials,
+  id: string,
+  context: Context
+): Promise<void> {
+  const configured = context.configuration.principal
+
+  if (
+    configured === undefined ||
+    configured.authority !== credentials.authority ||
+    configured.username !== credentials.username
+  )
+    return
+
+  await context.remote.identity.roles.principal({ input: { id } })
+}
+
+const INVALID_CREDENTIALS = new (class InvalidCredentialsError extends Error {
+  public readonly code = 'INVALID_CREDENTIALS'
+})()
+
+interface Credentials {
+  authority: string
+  username: string
+}
+
+interface Input {
+  authority: string
+  id: string
+  credentials: string
+}
+
+interface Output {
+  id: string
+}

package/components/identity.basic/source/info.ts

@@ -0,0 +1,22 @@
+import type { Context, Entity } from '../types/index.js'
+
+export async function effect(
+  { authority, identity }: Input,
+  context: Context
+): Promise<Output | null> {
+  const object = await context.local.observe({ query: { id: identity } })
+
+  if (object === null || object instanceof Error || object.authority !== authority)
+    return null
+
+  return { username: object.username }
+}
+
+interface Input {
+  authority: string
+  identity: string
+}
+
+interface Output {
+  username: Entity['username']
+}

package/components/identity.basic/source/lib/credentials.ts

@@ -0,0 +1,12 @@
+/**
+ * The user-id and the password of Basic credentials. RFC 7617 forbids a colon in the
+ * user-id and allows any number of them in the password, so the split is at the first one.
+ */
+export function split(credentials: string): [string, string] | null {
+  const decoded = Buffer.from(credentials, 'base64').toString()
+  const colon = decoded.indexOf(':')
+
+  if (colon === -1) return null
+
+  return [decoded.slice(0, colon), decoded.slice(colon + 1)]
+}