@toa.io/extensions.exposition 1.0.0-alpha.3 → 1.0.0-alpha.300

package/components/identity.clients/source/register.ts

@@ -0,0 +1,125 @@
+import { identify } from './lib/index.js'
+import type { Maybe } from '@toa.io/core/types'
+import type { Operation } from '@toa.io/bridges.node'
+import type { Context, Metadata } from './lib/index.js'
+
+/**
+ * Dynamic Client Registration, RFC 7591: the client sends what it is and is given an
+ * identifier for it. Unauthenticated, as the specification has it — a registration grants
+ * nothing on its own, and stays inert until a user consents to the client on a page that
+ * shows them its name and where it would send them.
+ *
+ * The identifier is a hash of the metadata, so registering the same thing twice is the
+ * same client rather than another row. A client cannot remember it registered here.
+ */
+export class Effect implements Operation {
+  private transit!: Context['local']['transit']
+  private ttl!: number
+
+  public mount(context: Context): void {
+    this.transit = context.local.transit
+    this.ttl = context.configuration.ttl
+  }
+
+  public async execute(input: Input): Promise<Maybe<Output>> {
+    const { authority } = input
+
+    if (
+      input.token_endpoint_auth_method !== undefined &&
+      input.token_endpoint_auth_method !== 'none'
+    )
+      return invalid(
+        'invalid_client_metadata',
+        'Only public clients are supported: token_endpoint_auth_method must be `none`'
+      )
+
+    const uris = input.redirect_uris.map(normalize)
+
+    for (const uri of uris)
+      if (uri instanceof Error) return invalid('invalid_redirect_uri', uri.message)
+
+    const metadata: Metadata = {
+      client_name: input.client_name,
+      client_uri: input.client_uri,
+      logo_uri: input.logo_uri,
+      scope: input.scope,
+      redirect_uris: uris as string[]
+    }
+
+    const id = identify(authority, metadata)
+
+    const entity = await this.transit({
+      query: { id },
+      input: {
+        authority,
+        name: metadata.client_name,
+        uri: metadata.client_uri,
+        logo: metadata.logo_uri,
+        scope: metadata.scope,
+        uris: metadata.redirect_uris,
+        expires: Date.now() + this.ttl * 1000
+      }
+    })
+
+    return {
+      client_id: id,
+      // of the record, not of this request: registering again answers what it answered
+      client_id_issued_at: Math.floor((entity.CREATED ?? Date.now()) / 1000),
+      client_name: entity.name,
+      client_uri: entity.uri,
+      logo_uri: entity.logo,
+      redirect_uris: entity.uris,
+      grant_types: ['authorization_code'],
+      response_types: ['code'],
+      token_endpoint_auth_method: 'none'
+    }
+  }
+}
+
+/** Absolute, no fragment, and either https or a loopback address (RFC 8252 §7.3). */
+function normalize(value: string): string | Error {
+  let url: URL
+
+  try {
+    url = new URL(value)
+  } catch {
+    return new Error(`\`${value}\` is not an absolute URI`)
+  }
+
+  if (url.hash !== '') return new Error(`\`${value}\` carries a fragment`)
+
+  if (url.protocol === 'https:') return url.href
+
+  if (url.protocol === 'http:' && LOOPBACK.has(url.hostname)) return url.href
+
+  return new Error(`\`${value}\` is neither https nor a loopback address`)
+}
+
+/** RFC 7591 §3.2.2: a registration error is a body, and `map:status` makes it the status. */
+function invalid(error: string, description: string): Output {
+  return { status: BAD_REQUEST, error, error_description: description }
+}
+
+const BAD_REQUEST = 400
+
+const LOOPBACK = new Set(['127.0.0.1', '[::1]', 'localhost'])
+
+interface Input extends Metadata {
+  authority: string
+}
+
+interface Output {
+  /** Read and removed by `map:status`; absent on a success, which answers 201. */
+  status?: number
+  client_id?: string
+  client_id_issued_at?: number
+  client_name?: string
+  client_uri?: string
+  logo_uri?: string
+  redirect_uris?: string[]
+  grant_types?: string[]
+  response_types?: string[]
+  token_endpoint_auth_method?: string
+  error?: string
+  error_description?: string
+}

package/components/identity.clients/tsconfig.json

@@ -0,0 +1,10 @@
+{
+  "extends": "../../../../tsconfig.component.json",
+  "compilerOptions": {
+    "outDir": "./operations",
+    "rootDir": "./source"
+  },
+  "include": [
+    "source"
+  ]
+}

package/components/identity.clients/types/index.d.ts

@@ -0,0 +1,3 @@
+export * from './toa.d.ts'
+
+// What a manifest does not state belongs here, and every run keeps it.

package/components/identity.clients/types/toa.d.ts

@@ -0,0 +1,110 @@
+// Written by `toa types`. Every run rewrites it.
+// What a manifest does not state belongs in a file of your own.
+
+import type { Options, Query, RemoteError } from '@toa.io/core/types'
+import type { FetchInit } from '@toa.io/extensions.fetch'
+import type { Stash } from '@toa.io/extensions.stash'
+import type { Logs, Span } from '@toa.io/extensions.telemetry'
+import type { Readable } from 'node:stream'
+
+export interface Entity {
+  authority: string
+  /** client_name */
+  name?: string
+  /** redirect_uris */
+  uris: string[]
+  /** client_uri */
+  uri?: string
+  /** logo_uri */
+  logo?: string
+  scope?: string
+  /** When a registration nothing has used is swept */
+  expires?: number
+  id: string
+  VERSION: number
+  CREATED: number
+  UPDATED: number
+  DELETED: number | null
+  REGION: number
+}
+
+export type TransitInput = {
+  authority: string
+  name?: string
+  uri?: string
+  logo?: string
+  scope?: string
+  uris: string[]
+  expires?: number
+}
+
+export type RegisterInput = {
+  authority: string
+  client_name?: string
+  client_uri?: string
+  logo_uri?: string
+  redirect_uris: string[]
+  scope?: string
+  grant_types?: string[]
+  response_types?: string[]
+  token_endpoint_auth_method?: string
+}
+
+export type RegisterOutput = {
+  /** Read and removed by `map:status` */
+  status?: number
+  client_id?: string
+  client_id_issued_at?: number
+  client_name?: string
+  client_uri?: string
+  logo_uri?: string
+  redirect_uris?: string[]
+  grant_types?: string[]
+  response_types?: string[]
+  token_endpoint_auth_method?: string
+  error?: string
+  error_description?: string
+}
+
+export type DescribeInput = {
+  authority: string
+  /** client_id, which is an https URL when the client publishes its own metadata */
+  id: string
+  /** Asked about together with the client, since only this component may answer it */
+  redirect?: string
+}
+
+export type DescribeOutput = {
+  client_id?: string
+  client_name?: string
+  client_uri?: string
+  logo_uri?: string
+  redirect_uris?: string[]
+  /** Whether `redirect` is one this client may receive a code at */
+  permitted?: boolean
+}
+
+export interface Component {
+  transit: (request: { input: TransitInput, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity>
+  register: (request: { input: RegisterInput, task?: boolean }, options?: Options) => Promise<RegisterOutput>
+  describe: (request: { input: DescribeInput, task?: boolean }, options?: Options) => Promise<DescribeOutput | RemoteError<"UNKNOWN_CLIENT">>
+  assign: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity>
+  ensure: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity>
+  enumerate: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity[]>
+  observe: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity | null>
+  stream: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Readable>
+  terminate: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity>
+}
+
+export interface Configuration {
+  /** Origins whose Client ID Metadata Documents may be read; none are without one */
+  trust?: string[]
+  /** Seconds a Client ID Metadata Document is held before it is read again */
+  lifetime?: number
+  /** Seconds a registration nothing has used is kept */
+  ttl?: number
+  /** Bytes of a Client ID Metadata Document that are read */
+  size?: number
+  /** Milliseconds a Client ID Metadata Document has to arrive */
+  timeout?: number
+}

package/components/identity.credentials/manifest.toa.yaml

@@ -0,0 +1,78 @@
+namespace: identity
+name: credentials
+
+operations:
+  list:
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        identity:
+          type: string
+      required:
+        - authority
+        - identity
+    output:
+      type: object
+      properties:
+        basic:
+          type: object
+          nullable: true
+          additionalProperties: false
+          properties:
+            username:
+              type: string
+          required:
+            - username
+        federation:
+          type: array
+          items:
+            type: object
+            additionalProperties: false
+            properties:
+              id:
+                type: string
+              iss:
+                type: string
+              CREATED:
+                type: number
+            required:
+              - id
+              - iss
+              - CREATED
+        passkeys:
+          type: array
+          items:
+            type: object
+            additionalProperties: false
+            properties:
+              id:
+                type: string
+              aid:
+                type: string
+              synced:
+                type: boolean
+              label:
+                type: string
+              CREATED:
+                type: number
+            required:
+              - id
+              - aid
+              - synced
+              - CREATED
+      required:
+        - basic
+        - federation
+        - passkeys
+
+exposition:
+  /:identity:
+    GET:
+      auth:id: identity
+      map:authority: authority
+      map:segments:
+        identity: identity
+      io:output: true
+      endpoint: list

package/components/identity.credentials/operations/list.js

@@ -0,0 +1,32 @@
+export class Computation {
+    basic = undefined;
+    federation = undefined;
+    passkeys = undefined;
+    mount(context) {
+        this.basic = context.remote.identity.basic;
+        this.federation = context.remote.identity.federation;
+        this.passkeys = context.remote.identity.passkeys;
+    }
+    async execute(input) {
+        const request = { input };
+        const [basic, federationObjects, passkeyObjects] = await Promise.all([
+            this.basic.info(request),
+            this.federation.list(request),
+            this.passkeys.list(request)
+        ]);
+        const federation = federationObjects.map(({ id, iss, CREATED }) => ({
+            id,
+            iss,
+            CREATED
+        }));
+        const passkeys = passkeyObjects.map(({ id, aid, synced, label, CREATED }) => ({
+            id,
+            aid,
+            synced,
+            label,
+            CREATED
+        }));
+        return { basic, federation, passkeys };
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibGlzdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NvdXJjZS9saXN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUdBLE1BQU0sT0FBTyxXQUFXO0lBQ2QsS0FBSyxHQUFVLFNBQTZCLENBQUE7SUFDNUMsVUFBVSxHQUFlLFNBQWtDLENBQUE7SUFDM0QsUUFBUSxHQUFhLFNBQWdDLENBQUE7SUFFdEQsS0FBSyxDQUFDLE9BQWdCO1FBQzNCLElBQUksQ0FBQyxLQUFLLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFBO1FBQzFDLElBQUksQ0FBQyxVQUFVLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFBO1FBRXBELElBQUksQ0FBQyxRQUFRLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFBO0lBQ2xELENBQUM7SUFFTSxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQVk7UUFDL0IsTUFBTSxPQUFPLEdBQUcsRUFBRSxLQUFLLEVBQUUsQ0FBQTtRQUV6QixNQUFNLENBQUMsS0FBSyxFQUFFLGlCQUFpQixFQUFFLGNBQWMsQ0FBQyxHQUFHLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQztZQUNuRSxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUM7WUFDeEIsSUFBSSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDO1lBQzdCLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQztTQUM1QixDQUFDLENBQUE7UUFFRixNQUFNLFVBQVUsR0FBRyxpQkFBaUIsQ0FBQyxHQUFHLENBQUMsQ0FBQyxFQUFFLEVBQUUsRUFBRSxHQUFHLEVBQUUsT0FBTyxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUM7WUFDbEUsRUFBRTtZQUNGLEdBQUc7WUFDSCxPQUFPO1NBQ1IsQ0FBQyxDQUFDLENBQUE7UUFFSCxNQUFNLFFBQVEsR0FBRyxjQUFjLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxFQUFFLEVBQUUsR0FBRyxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUM7WUFDNUUsRUFBRTtZQUNGLEdBQUc7WUFDSCxNQUFNO1lBQ04sS0FBSztZQUNMLE9BQU87U0FDUixDQUFDLENBQUMsQ0FBQTtRQUVILE9BQU8sRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxDQUFBO0lBQ3hDLENBQUM7Q0FDRiJ9

package/components/identity.credentials/source/list.ts

@@ -0,0 +1,92 @@
+import type { Call } from '@toa.io/core/types'
+import type { Operation } from '@toa.io/bridges.node'
+
+export class Computation implements Operation {
+  private basic: Basic = undefined as unknown as Basic
+  private federation: Federation = undefined as unknown as Federation
+  private passkeys: Passkeys = undefined as unknown as Passkeys
+
+  public mount(context: Context): void {
+    this.basic = context.remote.identity.basic
+    this.federation = context.remote.identity.federation
+
+    this.passkeys = context.remote.identity.passkeys
+  }
+
+  public async execute(input: Input): Promise<Output> {
+    const request = { input }
+
+    const [basic, federationObjects, passkeyObjects] = await Promise.all([
+      this.basic.info(request),
+      this.federation.list(request),
+      this.passkeys.list(request)
+    ])
+
+    const federation = federationObjects.map(({ id, iss, CREATED }) => ({
+      id,
+      iss,
+      CREATED
+    }))
+
+    const passkeys = passkeyObjects.map(({ id, aid, synced, label, CREATED }) => ({
+      id,
+      aid,
+      synced,
+      label,
+      CREATED
+    }))
+
+    return { basic, federation, passkeys }
+  }
+}
+
+interface Input {
+  authority: string
+  identity: string
+}
+
+interface BasicCredential {
+  username: string
+}
+
+interface FederationCredential {
+  id: string
+  iss: string
+  CREATED: number
+}
+
+interface PasskeyCredential {
+  id: string
+  aid: string
+  synced: boolean
+  label?: string
+  CREATED: number
+}
+
+interface Output {
+  basic: BasicCredential | null
+  federation: FederationCredential[]
+  passkeys: PasskeyCredential[]
+}
+
+interface Context {
+  remote: {
+    identity: {
+      basic: Basic
+      federation: Federation
+      passkeys: Passkeys
+    }
+  }
+}
+
+interface Basic {
+  info: Call<BasicCredential | null, Input>
+}
+
+interface Federation {
+  list: Call<FederationCredential[], Input>
+}
+
+interface Passkeys {
+  list: Call<PasskeyCredential[], Input>
+}

package/components/identity.credentials/tsconfig.json

@@ -0,0 +1,10 @@
+{
+  "extends": "../../../../tsconfig.component.json",
+  "compilerOptions": {
+    "outDir": "./operations",
+    "rootDir": "./source"
+  },
+  "include": [
+    "source"
+  ]
+}

package/components/identity.credentials/types/index.d.ts

@@ -0,0 +1,3 @@
+export * from './toa.d.ts'
+
+// What a manifest does not state belongs here, and every run keeps it.

package/components/identity.credentials/types/toa.d.ts

@@ -0,0 +1,31 @@
+// Written by `toa types`. Every run rewrites it.
+// What a manifest does not state belongs in a file of your own.
+
+import type { Options } from '@toa.io/core/types'
+
+export type ListInput = {
+  authority: string
+  identity: string
+}
+
+export type ListOutput = {
+  basic: {
+    username: string
+  } | null
+  federation: Array<{
+    id: string
+    iss: string
+    CREATED: number
+  }>
+  passkeys: Array<{
+    id: string
+    aid: string
+    synced: boolean
+    label?: string
+    CREATED: number
+  }>
+}
+
+export interface Component {
+  list: (request: { input: ListInput, task?: boolean }, options?: Options) => Promise<ListOutput>
+}

package/components/identity.federation/events/principal.js

@@ -1,22 +1,21 @@
 // @ts-check
-'use strict'
-
 /**
- * @param {{ state: import('../source/types').Entity }} event
- * @param {import('../source/types').Context} context
+ * @param {{ state: import('../source/types/index.js').Entity }} event
+ * @param {import('../source/types/index.js').Context} context
  * @returns boolean
  */
-exports.condition = function (event, context) {
+export const condition = function (event, context) {
   return (
     context.configuration.principal !== undefined &&
+    event.state.authority === context.configuration.principal.authority &&
     event.state.sub === context.configuration.principal.sub &&
     event.state.iss === context.configuration.principal.iss
   )
 }
 
 /**
- * @param {{ state: import('../source/types').Entity & { id: string } }} event
+ * @param {{ state: import('../source/types/index.js').Entity }} event
  */
-exports.payload = function (event) {
-  return { id: event.state.id }
+export const payload = function (event) {
+  return { identity: event.state.identity }
 }