@toa.io/extensions.exposition 1.0.0-alpha.3 → 1.0.0-alpha.300

package/components/identity.grants/operations/authorize.js

@@ -0,0 +1,53 @@
+import { hold, identify } from './lib/index.js';
+/**
+ * What the consent page calls when a user allows a client. The page holds the user's own
+ * credentials, so this is the user's own route; the code it answers with is what the client
+ * redeems at the token endpoint.
+ *
+ * The grant is recorded so a user can see what they allowed and take it back. It is not
+ * consulted to skip the prompt — consent is asked every time, which is what keeps a client
+ * that changed where it wants a code sent from being waved through on an older one.
+ */
+export class Effect {
+    context;
+    mount(context) {
+        this.context = context;
+    }
+    async execute(input) {
+        const { authority, identity } = input;
+        if (input.method !== S256)
+            return invalid('invalid_request', 'Only the S256 code challenge method is supported');
+        const client = await this.context.remote.identity.clients.describe({
+            input: { authority, id: input.client, redirect: input.redirect }
+        });
+        if (client instanceof Error)
+            return invalid('invalid_client', 'No such client');
+        if (client.permitted !== true)
+            return invalid('invalid_request', 'The redirect is not one this client may receive a code at');
+        const scope = input.scope ?? [];
+        // recorded on the grant and carried to the token endpoint, where it becomes the
+        // token's `aud` — the entry it may be presented at, see documentation/oauth.md
+        const resource = input.resource ?? [];
+        const grant = await this.context.local.transit({
+            query: { id: identify(authority, identity, input.client) },
+            input: { authority, identity, client: input.client, scope, resource }
+        });
+        if (grant instanceof Error)
+            return grant;
+        const code = await hold(authority, {
+            identity,
+            client: input.client,
+            redirect: input.redirect,
+            challenge: input.challenge,
+            scope,
+            resource
+        }, this.context);
+        return { code, expires_in: this.context.configuration.lifetime };
+    }
+}
+function invalid(error, description) {
+    return { status: BAD_REQUEST, error, error_description: description };
+}
+const S256 = 'S256';
+const BAD_REQUEST = 400;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXplLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2F1dGhvcml6ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsSUFBSSxFQUFFLFFBQVEsRUFBRSxNQUFNLGdCQUFnQixDQUFBO0FBSy9DOzs7Ozs7OztHQVFHO0FBQ0gsTUFBTSxPQUFPLE1BQU07SUFDVCxPQUFPLENBQVU7SUFFbEIsS0FBSyxDQUFDLE9BQWdCO1FBQzNCLElBQUksQ0FBQyxPQUFPLEdBQUcsT0FBTyxDQUFBO0lBQ3hCLENBQUM7SUFFTSxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQVk7UUFDL0IsTUFBTSxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsR0FBRyxLQUFLLENBQUE7UUFFckMsSUFBSSxLQUFLLENBQUMsTUFBTSxLQUFLLElBQUk7WUFDdkIsT0FBTyxPQUFPLENBQ1osaUJBQWlCLEVBQ2pCLGtEQUFrRCxDQUNuRCxDQUFBO1FBRUgsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQztZQUNqRSxLQUFLLEVBQUUsRUFBRSxTQUFTLEVBQUUsRUFBRSxFQUFFLEtBQUssQ0FBQyxNQUFNLEVBQUUsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRLEVBQUU7U0FDakUsQ0FBQyxDQUFBO1FBRUYsSUFBSSxNQUFNLFlBQVksS0FBSztZQUFFLE9BQU8sT0FBTyxDQUFDLGdCQUFnQixFQUFFLGdCQUFnQixDQUFDLENBQUE7UUFFL0UsSUFBSSxNQUFNLENBQUMsU0FBUyxLQUFLLElBQUk7WUFDM0IsT0FBTyxPQUFPLENBQ1osaUJBQWlCLEVBQ2pCLDJEQUEyRCxDQUM1RCxDQUFBO1FBRUgsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLEtBQUssSUFBSSxFQUFFLENBQUE7UUFFL0IsZ0ZBQWdGO1FBQ2hGLCtFQUErRTtRQUMvRSxNQUFNLFFBQVEsR0FBRyxLQUFLLENBQUMsUUFBUSxJQUFJLEVBQUUsQ0FBQTtRQUVyQyxNQUFNLEtBQUssR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQztZQUM3QyxLQUFLLEVBQUUsRUFBRSxFQUFFLEVBQUUsUUFBUSxDQUFDLFNBQVMsRUFBRSxRQUFRLEVBQUUsS0FBSyxDQUFDLE1BQU0sQ0FBQyxFQUFFO1lBQzFELEtBQUssRUFBRSxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUFNLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRTtTQUN0RSxDQUFDLENBQUE7UUFFRixJQUFJLEtBQUssWUFBWSxLQUFLO1lBQUUsT0FBTyxLQUFLLENBQUE7UUFFeEMsTUFBTSxJQUFJLEdBQUcsTUFBTSxJQUFJLENBQ3JCLFNBQVMsRUFDVDtZQUNFLFFBQVE7WUFDUixNQUFNLEVBQUUsS0FBSyxDQUFDLE1BQU07WUFDcEIsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRO1lBQ3hCLFNBQVMsRUFBRSxLQUFLLENBQUMsU0FBUztZQUMxQixLQUFLO1lBQ0wsUUFBUTtTQUNULEVBQ0QsSUFBSSxDQUFDLE9BQU8sQ0FDYixDQUFBO1FBRUQsT0FBTyxFQUFFLElBQUksRUFBRSxVQUFVLEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsUUFBUSxFQUFFLENBQUE7SUFDbEUsQ0FBQztDQUNGO0FBRUQsU0FBUyxPQUFPLENBQUMsS0FBYSxFQUFFLFdBQW1CO0lBQ2pELE9BQU8sRUFBRSxNQUFNLEVBQUUsV0FBVyxFQUFFLEtBQUssRUFBRSxpQkFBaUIsRUFBRSxXQUFXLEVBQUUsQ0FBQTtBQUN2RSxDQUFDO0FBRUQsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFBO0FBQ25CLE1BQU0sV0FBVyxHQUFHLEdBQUcsQ0FBQSJ9

package/components/identity.grants/operations/exchange.js

@@ -0,0 +1,92 @@
+import { identify, spend, verifies } from './lib/index.js';
+/**
+ * The token endpoint, RFC 6749 §4.1.3. Anonymous, because the clients this server knows are
+ * public ones with no secret to authenticate with: what stands in for that is PKCE, since
+ * only the client that began the flow holds the verifier the challenge was made from.
+ *
+ * Every failure here is `invalid_grant` without saying which check failed. A code that was
+ * replayed, a verifier that does not match and a redirect that was swapped are all the same
+ * answer, and telling them apart would say whether a stolen code was still live.
+ */
+export class Effect {
+    context;
+    mount(context) {
+        this.context = context;
+    }
+    async execute(input) {
+        const { authority } = input;
+        if (input.grant_type !== AUTHORIZATION_CODE)
+            return invalid('unsupported_grant_type', 'Only the authorization code grant is supported');
+        if (input.code === undefined || input.code_verifier === undefined)
+            return invalid('invalid_request', 'A code and a code verifier are required');
+        // spent first: a wrong verifier burns the code, which is what stops it being guessed at
+        const code = await spend(authority, input.code, this.context);
+        if (code === null || !this.redeemable(code, input))
+            return invalid('invalid_grant', 'The authorization code is not redeemable');
+        // `aud` binds the token to `code.resource` — the entry it may be presented at,
+        // which `preflight` reads. A fork MCP or RPC makes is not that entry.
+        const issued = await this.context.remote.identity.tokens.issue({
+            input: {
+                authority,
+                identity: code.identity,
+                label: label(code.client),
+                lifetime: this.context.configuration.token,
+                ...(code.scope.length === 0 ? {} : { scopes: code.scope }),
+                ...(code.resource.length === 0 ? {} : { audience: code.resource })
+            }
+        });
+        // the only refusal `issue` makes is a scope the consenting identity does not hold, and
+        // what it says about that is its own; the client is told what it may act on
+        if (issued instanceof Error)
+            return invalid('invalid_scope', 'The requested scope is not one the identity holds');
+        // the key the token was issued under, so revoking the grant revokes the token. The token
+        // is already out, so a grant that fails to record it is logged rather than unwound — it
+        // costs the user the ability to revoke, and refusing here would cost them the token too
+        const grant = await this.context.local.transit({
+            query: { id: identify(authority, code.identity, code.client) },
+            input: {
+                authority,
+                identity: code.identity,
+                client: code.client,
+                scope: code.scope,
+                resource: code.resource,
+                kid: issued.kid
+            }
+        });
+        if (grant instanceof Error)
+            this.context.logs.error('Grant not recorded for an issued token', {
+                client: code.client,
+                kid: issued.kid
+            });
+        return {
+            // RFC 6749 §5.1 asks for 200, where a POST would otherwise answer 201
+            status: OK,
+            access_token: issued.token,
+            token_type: 'Bearer',
+            ...(issued.exp === undefined
+                ? {}
+                : { expires_in: Math.floor((issued.exp - Date.now()) / 1000) }),
+            ...(code.scope.length === 0 ? {} : { scope: code.scope.join(' ') })
+        };
+    }
+    redeemable(code, input) {
+        if (!verifies(code.challenge, input.code_verifier))
+            return false;
+        // RFC 6749 §4.1.3: what was sent to `authorize` must be sent again
+        if (input.redirect_uri !== undefined && input.redirect_uri !== code.redirect)
+            return false;
+        return input.client_id === undefined || input.client_id === code.client;
+    }
+}
+/** `identity.tokens` requires one, and it is what a user sees when listing what they issued. */
+function label(client) {
+    return client.slice(0, LABEL);
+}
+function invalid(error, description) {
+    return { status: BAD_REQUEST, error, error_description: description };
+}
+const AUTHORIZATION_CODE = 'authorization_code';
+const OK = 200;
+const BAD_REQUEST = 400;
+const LABEL = 64;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXhjaGFuZ2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zb3VyY2UvZXhjaGFuZ2UudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLFFBQVEsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLE1BQU0sZ0JBQWdCLENBQUE7QUFLMUQ7Ozs7Ozs7O0dBUUc7QUFDSCxNQUFNLE9BQU8sTUFBTTtJQUNULE9BQU8sQ0FBVTtJQUVsQixLQUFLLENBQUMsT0FBZ0I7UUFDM0IsSUFBSSxDQUFDLE9BQU8sR0FBRyxPQUFPLENBQUE7SUFDeEIsQ0FBQztJQUVNLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBWTtRQUMvQixNQUFNLEVBQUUsU0FBUyxFQUFFLEdBQUcsS0FBSyxDQUFBO1FBRTNCLElBQUksS0FBSyxDQUFDLFVBQVUsS0FBSyxrQkFBa0I7WUFDekMsT0FBTyxPQUFPLENBQ1osd0JBQXdCLEVBQ3hCLGdEQUFnRCxDQUNqRCxDQUFBO1FBRUgsSUFBSSxLQUFLLENBQUMsSUFBSSxLQUFLLFNBQVMsSUFBSSxLQUFLLENBQUMsYUFBYSxLQUFLLFNBQVM7WUFDL0QsT0FBTyxPQUFPLENBQUMsaUJBQWlCLEVBQUUseUNBQXlDLENBQUMsQ0FBQTtRQUU5RSx3RkFBd0Y7UUFDeEYsTUFBTSxJQUFJLEdBQUcsTUFBTSxLQUFLLENBQUMsU0FBUyxFQUFFLEtBQUssQ0FBQyxJQUFJLEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFBO1FBRTdELElBQUksSUFBSSxLQUFLLElBQUksSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsSUFBSSxFQUFFLEtBQUssQ0FBQztZQUNoRCxPQUFPLE9BQU8sQ0FBQyxlQUFlLEVBQUUsMENBQTBDLENBQUMsQ0FBQTtRQUU3RSwrRUFBK0U7UUFDL0Usc0VBQXNFO1FBQ3RFLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUM7WUFDN0QsS0FBSyxFQUFFO2dCQUNMLFNBQVM7Z0JBQ1QsUUFBUSxFQUFFLElBQUksQ0FBQyxRQUFRO2dCQUN2QixLQUFLLEVBQUUsS0FBSyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUM7Z0JBQ3pCLFFBQVEsRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxLQUFLO2dCQUMxQyxHQUFHLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztnQkFDMUQsR0FBRyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLFFBQVEsRUFBRSxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUM7YUFDbkU7U0FDRixDQUFDLENBQUE7UUFFRix1RkFBdUY7UUFDdkYsNEVBQTRFO1FBQzVFLElBQUksTUFBTSxZQUFZLEtBQUs7WUFDekIsT0FBTyxPQUFPLENBQUMsZUFBZSxFQUFFLG1EQUFtRCxDQUFDLENBQUE7UUFFdEYseUZBQXlGO1FBQ3pGLHdGQUF3RjtRQUN4Rix3RkFBd0Y7UUFDeEYsTUFBTSxLQUFLLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUM7WUFDN0MsS0FBSyxFQUFFLEVBQUUsRUFBRSxFQUFFLFFBQVEsQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUU7WUFDOUQsS0FBSyxFQUFFO2dCQUNMLFNBQVM7Z0JBQ1QsUUFBUSxFQUFFLElBQUksQ0FBQyxRQUFRO2dCQUN2QixNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU07Z0JBQ25CLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSztnQkFDakIsUUFBUSxFQUFFLElBQUksQ0FBQyxRQUFRO2dCQUN2QixHQUFHLEVBQUUsTUFBTSxDQUFDLEdBQUc7YUFDaEI7U0FDRixDQUFDLENBQUE7UUFFRixJQUFJLEtBQUssWUFBWSxLQUFLO1lBQ3hCLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyx3Q0FBd0MsRUFBRTtnQkFDaEUsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNO2dCQUNuQixHQUFHLEVBQUUsTUFBTSxDQUFDLEdBQUc7YUFDaEIsQ0FBQyxDQUFBO1FBRUosT0FBTztZQUNMLHNFQUFzRTtZQUN0RSxNQUFNLEVBQUUsRUFBRTtZQUNWLFlBQVksRUFBRSxNQUFNLENBQUMsS0FBSztZQUMxQixVQUFVLEVBQUUsUUFBUTtZQUNwQixHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsS0FBSyxTQUFTO2dCQUMxQixDQUFDLENBQUMsRUFBRTtnQkFDSixDQUFDLENBQUMsRUFBRSxVQUFVLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU0sQ0FBQyxHQUFHLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLEdBQUcsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUNqRSxHQUFHLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7U0FDcEUsQ0FBQTtJQUNILENBQUM7SUFFTyxVQUFVLENBQUMsSUFBVSxFQUFFLEtBQVk7UUFDekMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLEtBQUssQ0FBQyxhQUFjLENBQUM7WUFBRSxPQUFPLEtBQUssQ0FBQTtRQUVqRSxtRUFBbUU7UUFDbkUsSUFBSSxLQUFLLENBQUMsWUFBWSxLQUFLLFNBQVMsSUFBSSxLQUFLLENBQUMsWUFBWSxLQUFLLElBQUksQ0FBQyxRQUFRO1lBQzFFLE9BQU8sS0FBSyxDQUFBO1FBRWQsT0FBTyxLQUFLLENBQUMsU0FBUyxLQUFLLFNBQVMsSUFBSSxLQUFLLENBQUMsU0FBUyxLQUFLLElBQUksQ0FBQyxNQUFNLENBQUE7SUFDekUsQ0FBQztDQUNGO0FBRUQsZ0dBQWdHO0FBQ2hHLFNBQVMsS0FBSyxDQUFDLE1BQWM7SUFDM0IsT0FBTyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxLQUFLLENBQUMsQ0FBQTtBQUMvQixDQUFDO0FBRUQsU0FBUyxPQUFPLENBQUMsS0FBYSxFQUFFLFdBQW1CO0lBQ2pELE9BQU8sRUFBRSxNQUFNLEVBQUUsV0FBVyxFQUFFLEtBQUssRUFBRSxpQkFBaUIsRUFBRSxXQUFXLEVBQUUsQ0FBQTtBQUN2RSxDQUFDO0FBRUQsTUFBTSxrQkFBa0IsR0FBRyxvQkFBb0IsQ0FBQTtBQUMvQyxNQUFNLEVBQUUsR0FBRyxHQUFHLENBQUE7QUFDZCxNQUFNLFdBQVcsR0FBRyxHQUFHLENBQUE7QUFDdkIsTUFBTSxLQUFLLEdBQUcsRUFBRSxDQUFBIn0=

package/components/identity.grants/operations/lib/code.js

@@ -0,0 +1,30 @@
+import { createHash, randomBytes } from 'node:crypto';
+/**
+ * An authorization code is a bearer credential that lives for seconds. It is held under a
+ * hash of itself, so a dump of the store hands out none of them, and redeemed with `GETDEL`,
+ * so it is spent once however many requests arrive at once — the property the whole flow
+ * rests on, since a replayed code is a stolen grant.
+ */
+export async function hold(authority, code, context) {
+    const value = randomBytes(32).toString('base64url');
+    await context.stash.set(key(authority, value), JSON.stringify(code), 'EX', context.configuration.lifetime);
+    return value;
+}
+export async function spend(authority, value, context) {
+    const held = await context.stash.getdel(key(authority, value));
+    return held === null ? null : JSON.parse(held);
+}
+/**
+ * PKCE, RFC 7636: the client kept a verifier and sent its hash, and only the client that
+ * began the flow can present the verifier now. `S256` alone — `plain` proves nothing.
+ */
+export function verifies(challenge, verifier) {
+    return digest(verifier) === challenge;
+}
+export function digest(verifier) {
+    return createHash('sha256').update(verifier).digest('base64url');
+}
+function key(authority, value) {
+    return `oauth:code:${authority}:${createHash('sha256').update(value).digest('hex')}`;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29kZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS9saWIvY29kZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsVUFBVSxFQUFFLFdBQVcsRUFBRSxNQUFNLGFBQWEsQ0FBQTtBQUdyRDs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxLQUFLLFVBQVUsSUFBSSxDQUN4QixTQUFpQixFQUNqQixJQUFVLEVBQ1YsT0FBZ0I7SUFFaEIsTUFBTSxLQUFLLEdBQUcsV0FBVyxDQUFDLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsQ0FBQTtJQUVuRCxNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUNyQixHQUFHLENBQUMsU0FBUyxFQUFFLEtBQUssQ0FBQyxFQUNyQixJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxFQUNwQixJQUFJLEVBQ0osT0FBTyxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQy9CLENBQUE7SUFFRCxPQUFPLEtBQUssQ0FBQTtBQUNkLENBQUM7QUFFRCxNQUFNLENBQUMsS0FBSyxVQUFVLEtBQUssQ0FDekIsU0FBaUIsRUFDakIsS0FBYSxFQUNiLE9BQWdCO0lBRWhCLE1BQU0sSUFBSSxHQUFHLE1BQU0sT0FBTyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLFNBQVMsRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFBO0lBRTlELE9BQU8sSUFBSSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBRSxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBVSxDQUFBO0FBQzFELENBQUM7QUFFRDs7O0dBR0c7QUFDSCxNQUFNLFVBQVUsUUFBUSxDQUFDLFNBQWlCLEVBQUUsUUFBZ0I7SUFDMUQsT0FBTyxNQUFNLENBQUMsUUFBUSxDQUFDLEtBQUssU0FBUyxDQUFBO0FBQ3ZDLENBQUM7QUFFRCxNQUFNLFVBQVUsTUFBTSxDQUFDLFFBQWdCO0lBQ3JDLE9BQU8sVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLENBQUE7QUFDbEUsQ0FBQztBQUVELFNBQVMsR0FBRyxDQUFDLFNBQWlCLEVBQUUsS0FBYTtJQUMzQyxPQUFPLGNBQWMsU0FBUyxJQUFJLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUE7QUFDdEYsQ0FBQyJ9

package/components/identity.grants/operations/lib/identify.js

@@ -0,0 +1,15 @@
+import { createHash } from 'node:crypto';
+/**
+ * A user holds one grant per client, so the record is addressed by the three things that
+ * say which: authorizing again replaces what is there rather than leaving another row, and
+ * revoking has one thing to revoke.
+ */
+export function identify(authority, identity, client) {
+    return createHash('sha256')
+        .update(JSON.stringify([authority, identity, client]))
+        .digest('hex')
+        .slice(0, LENGTH);
+}
+/** What the entity prototype accepts as an id. */
+const LENGTH = 32;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaWRlbnRpZnkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zb3VyY2UvbGliL2lkZW50aWZ5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSxhQUFhLENBQUE7QUFFeEM7Ozs7R0FJRztBQUNILE1BQU0sVUFBVSxRQUFRLENBQUMsU0FBaUIsRUFBRSxRQUFnQixFQUFFLE1BQWM7SUFDMUUsT0FBTyxVQUFVLENBQUMsUUFBUSxDQUFDO1NBQ3hCLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsU0FBUyxFQUFFLFFBQVEsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDO1NBQ3JELE1BQU0sQ0FBQyxLQUFLLENBQUM7U0FDYixLQUFLLENBQUMsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFBO0FBQ3JCLENBQUM7QUFFRCxrREFBa0Q7QUFDbEQsTUFBTSxNQUFNLEdBQUcsRUFBRSxDQUFBIn0=

package/components/identity.grants/operations/lib/index.js

@@ -0,0 +1,3 @@
+export * from './code.js';
+export * from './identify.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zb3VyY2UvbGliL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsV0FBVyxDQUFBO0FBQ3pCLGNBQWMsZUFBZSxDQUFBIn0=

package/components/identity.grants/operations/list.js

@@ -0,0 +1,18 @@
+import { quote } from '@toa.io/generic';
+/** What a user has allowed, for a screen that lets them take it back. */
+export class Computation {
+    enumerate;
+    mount(context) {
+        this.enumerate = context.local.enumerate;
+    }
+    async execute(input) {
+        return await this.enumerate({
+            query: {
+                criteria: `authority==${quote(input.authority)};identity==${quote(input.identity)}`,
+                limit: LIMIT
+            }
+        });
+    }
+}
+const LIMIT = 256;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibGlzdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NvdXJjZS9saXN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxLQUFLLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQTtBQUl2Qyx5RUFBeUU7QUFDekUsTUFBTSxPQUFPLFdBQVc7SUFDZCxTQUFTLENBQWdDO0lBRTFDLEtBQUssQ0FBQyxPQUFnQjtRQUMzQixJQUFJLENBQUMsU0FBUyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFBO0lBQzFDLENBQUM7SUFFTSxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQVk7UUFDL0IsT0FBTyxNQUFNLElBQUksQ0FBQyxTQUFTLENBQUM7WUFDMUIsS0FBSyxFQUFFO2dCQUNMLFFBQVEsRUFBRSxjQUFjLEtBQUssQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLGNBQWMsS0FBSyxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsRUFBRTtnQkFDbkYsS0FBSyxFQUFFLEtBQUs7YUFDYjtTQUNGLENBQUMsQ0FBQTtJQUNKLENBQUM7Q0FDRjtBQUVELE1BQU0sS0FBSyxHQUFHLEdBQUcsQ0FBQSJ9

package/components/identity.grants/operations/revoke.js

@@ -0,0 +1,26 @@
+/**
+ * Taking back what was allowed. The token itself is not deleted — it is out in the world —
+ * so what is revoked is the key it was issued under, which is what `identity.tokens` reads
+ * it with. It stops being a token within `identity.tokens.cache.ttl`.
+ */
+export class Transition {
+    keys;
+    mount(context) {
+        this.keys = context.remote.identity.keys;
+    }
+    async execute(input, object) {
+        // the id is a route parameter, so a grant of another identity is asked for by anyone
+        // who guesses one; the authority and the identity are what say it is theirs
+        if (object.VERSION === 0 ||
+            object.authority !== input.authority ||
+            object.identity !== input.identity)
+            return ERR_NOT_FOUND;
+        if (object.kid !== undefined)
+            await this.keys.disable({ query: { id: object.kid } });
+        object.revokedAt = Date.now();
+    }
+}
+const ERR_NOT_FOUND = new (class NotFoundError extends Error {
+    code = 'NOT_FOUND';
+})();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmV2b2tlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL3Jldm9rZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFJQTs7OztHQUlHO0FBQ0gsTUFBTSxPQUFPLFVBQVU7SUFDYixJQUFJLENBQXdDO0lBRTdDLEtBQUssQ0FBQyxPQUFnQjtRQUMzQixJQUFJLENBQUMsSUFBSSxHQUFHLE9BQU8sQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQTtJQUMxQyxDQUFDO0lBRU0sS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFZLEVBQUUsTUFBYztRQUMvQyxxRkFBcUY7UUFDckYsNEVBQTRFO1FBQzVFLElBQ0UsTUFBTSxDQUFDLE9BQU8sS0FBSyxDQUFDO1lBQ3BCLE1BQU0sQ0FBQyxTQUFTLEtBQUssS0FBSyxDQUFDLFNBQVM7WUFDcEMsTUFBTSxDQUFDLFFBQVEsS0FBSyxLQUFLLENBQUMsUUFBUTtZQUVsQyxPQUFPLGFBQWEsQ0FBQTtRQUV0QixJQUFJLE1BQU0sQ0FBQyxHQUFHLEtBQUssU0FBUztZQUFFLE1BQU0sSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFFLEVBQUUsTUFBTSxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsQ0FBQTtRQUVwRixNQUFNLENBQUMsU0FBUyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQTtJQUMvQixDQUFDO0NBQ0Y7QUFFRCxNQUFNLGFBQWEsR0FBRyxJQUFJLENBQUMsTUFBTSxhQUFjLFNBQVEsS0FBSztJQUMxQyxJQUFJLEdBQUcsV0FBVyxDQUFBO0NBQ25DLENBQUMsRUFBRSxDQUFBIn0=

package/components/identity.grants/source/authorize.ts

@@ -0,0 +1,97 @@
+import { hold, identify } from './lib/index.js'
+import type { Maybe } from '@toa.io/core/types'
+import type { Operation } from '@toa.io/bridges.node'
+import type { Context } from './lib/index.js'
+
+/**
+ * What the consent page calls when a user allows a client. The page holds the user's own
+ * credentials, so this is the user's own route; the code it answers with is what the client
+ * redeems at the token endpoint.
+ *
+ * The grant is recorded so a user can see what they allowed and take it back. It is not
+ * consulted to skip the prompt — consent is asked every time, which is what keeps a client
+ * that changed where it wants a code sent from being waved through on an older one.
+ */
+export class Effect implements Operation {
+  private context!: Context
+
+  public mount(context: Context): void {
+    this.context = context
+  }
+
+  public async execute(input: Input): Promise<Maybe<Output>> {
+    const { authority, identity } = input
+
+    if (input.method !== S256)
+      return invalid(
+        'invalid_request',
+        'Only the S256 code challenge method is supported'
+      )
+
+    const client = await this.context.remote.identity.clients.describe({
+      input: { authority, id: input.client, redirect: input.redirect }
+    })
+
+    if (client instanceof Error) return invalid('invalid_client', 'No such client')
+
+    if (client.permitted !== true)
+      return invalid(
+        'invalid_request',
+        'The redirect is not one this client may receive a code at'
+      )
+
+    const scope = input.scope ?? []
+
+    // recorded on the grant and carried to the token endpoint, where it becomes the
+    // token's `aud` — the entry it may be presented at, see documentation/oauth.md
+    const resource = input.resource ?? []
+
+    const grant = await this.context.local.transit({
+      query: { id: identify(authority, identity, input.client) },
+      input: { authority, identity, client: input.client, scope, resource }
+    })
+
+    if (grant instanceof Error) return grant
+
+    const code = await hold(
+      authority,
+      {
+        identity,
+        client: input.client,
+        redirect: input.redirect,
+        challenge: input.challenge,
+        scope,
+        resource
+      },
+      this.context
+    )
+
+    return { code, expires_in: this.context.configuration.lifetime }
+  }
+}
+
+function invalid(error: string, description: string): Output {
+  return { status: BAD_REQUEST, error, error_description: description }
+}
+
+const S256 = 'S256'
+const BAD_REQUEST = 400
+
+interface Input {
+  authority: string
+  identity: string
+  client: string
+  redirect: string
+  challenge: string
+  method: string
+  scope?: string[]
+  resource?: string[]
+}
+
+interface Output {
+  status?: number
+  code?: string
+  expires_in?: number
+  error?: string
+  error_description?: string
+}

package/components/identity.grants/source/exchange.ts

@@ -0,0 +1,134 @@
+import { identify, spend, verifies } from './lib/index.js'
+import type { Maybe } from '@toa.io/core/types'
+import type { Operation } from '@toa.io/bridges.node'
+import type { Code, Context } from './lib/index.js'
+
+/**
+ * The token endpoint, RFC 6749 §4.1.3. Anonymous, because the clients this server knows are
+ * public ones with no secret to authenticate with: what stands in for that is PKCE, since
+ * only the client that began the flow holds the verifier the challenge was made from.
+ *
+ * Every failure here is `invalid_grant` without saying which check failed. A code that was
+ * replayed, a verifier that does not match and a redirect that was swapped are all the same
+ * answer, and telling them apart would say whether a stolen code was still live.
+ */
+export class Effect implements Operation {
+  private context!: Context
+
+  public mount(context: Context): void {
+    this.context = context
+  }
+
+  public async execute(input: Input): Promise<Maybe<Output>> {
+    const { authority } = input
+
+    if (input.grant_type !== AUTHORIZATION_CODE)
+      return invalid(
+        'unsupported_grant_type',
+        'Only the authorization code grant is supported'
+      )
+
+    if (input.code === undefined || input.code_verifier === undefined)
+      return invalid('invalid_request', 'A code and a code verifier are required')
+
+    // spent first: a wrong verifier burns the code, which is what stops it being guessed at
+    const code = await spend(authority, input.code, this.context)
+
+    if (code === null || !this.redeemable(code, input))
+      return invalid('invalid_grant', 'The authorization code is not redeemable')
+
+    // `aud` binds the token to `code.resource` — the entry it may be presented at,
+    // which `preflight` reads. A fork MCP or RPC makes is not that entry.
+    const issued = await this.context.remote.identity.tokens.issue({
+      input: {
+        authority,
+        identity: code.identity,
+        label: label(code.client),
+        lifetime: this.context.configuration.token,
+        ...(code.scope.length === 0 ? {} : { scopes: code.scope }),
+        ...(code.resource.length === 0 ? {} : { audience: code.resource })
+      }
+    })
+
+    // the only refusal `issue` makes is a scope the consenting identity does not hold, and
+    // what it says about that is its own; the client is told what it may act on
+    if (issued instanceof Error)
+      return invalid('invalid_scope', 'The requested scope is not one the identity holds')
+
+    // the key the token was issued under, so revoking the grant revokes the token. The token
+    // is already out, so a grant that fails to record it is logged rather than unwound — it
+    // costs the user the ability to revoke, and refusing here would cost them the token too
+    const grant = await this.context.local.transit({
+      query: { id: identify(authority, code.identity, code.client) },
+      input: {
+        authority,
+        identity: code.identity,
+        client: code.client,
+        scope: code.scope,
+        resource: code.resource,
+        kid: issued.kid
+      }
+    })
+
+    if (grant instanceof Error)
+      this.context.logs.error('Grant not recorded for an issued token', {
+        client: code.client,
+        kid: issued.kid
+      })
+
+    return {
+      // RFC 6749 §5.1 asks for 200, where a POST would otherwise answer 201
+      status: OK,
+      access_token: issued.token,
+      token_type: 'Bearer',
+      ...(issued.exp === undefined
+        ? {}
+        : { expires_in: Math.floor((issued.exp - Date.now()) / 1000) }),
+      ...(code.scope.length === 0 ? {} : { scope: code.scope.join(' ') })
+    }
+  }
+
+  private redeemable(code: Code, input: Input): boolean {
+    if (!verifies(code.challenge, input.code_verifier!)) return false
+
+    // RFC 6749 §4.1.3: what was sent to `authorize` must be sent again
+    if (input.redirect_uri !== undefined && input.redirect_uri !== code.redirect)
+      return false
+
+    return input.client_id === undefined || input.client_id === code.client
+  }
+}
+
+/** `identity.tokens` requires one, and it is what a user sees when listing what they issued. */
+function label(client: string): string {
+  return client.slice(0, LABEL)
+}
+
+function invalid(error: string, description: string): Output {
+  return { status: BAD_REQUEST, error, error_description: description }
+}
+
+const AUTHORIZATION_CODE = 'authorization_code'
+const OK = 200
+const BAD_REQUEST = 400
+const LABEL = 64
+
+interface Input {
+  authority: string
+  grant_type: string
+  code?: string
+  code_verifier?: string
+  redirect_uri?: string
+  client_id?: string
+  resource?: string | string[]
+}
+
+interface Output {
+  status?: number
+  access_token?: string
+  token_type?: string
+  expires_in?: number
+  scope?: string
+  error?: string
+  error_description?: string
+}

package/components/identity.grants/source/lib/code.ts

@@ -0,0 +1,51 @@
+import { createHash, randomBytes } from 'node:crypto'
+import type { Code, Context } from '../../types/index.js'
+
+/**
+ * An authorization code is a bearer credential that lives for seconds. It is held under a
+ * hash of itself, so a dump of the store hands out none of them, and redeemed with `GETDEL`,
+ * so it is spent once however many requests arrive at once — the property the whole flow
+ * rests on, since a replayed code is a stolen grant.
+ */
+export async function hold(
+  authority: string,
+  code: Code,
+  context: Context
+): Promise<string> {
+  const value = randomBytes(32).toString('base64url')
+
+  await context.stash.set(
+    key(authority, value),
+    JSON.stringify(code),
+    'EX',
+    context.configuration.lifetime
+  )
+
+  return value
+}
+
+export async function spend(
+  authority: string,
+  value: string,
+  context: Context
+): Promise<Code | null> {
+  const held = await context.stash.getdel(key(authority, value))
+
+  return held === null ? null : (JSON.parse(held) as Code)
+}
+
+/**
+ * PKCE, RFC 7636: the client kept a verifier and sent its hash, and only the client that
+ * began the flow can present the verifier now. `S256` alone — `plain` proves nothing.
+ */
+export function verifies(challenge: string, verifier: string): boolean {
+  return digest(verifier) === challenge
+}
+
+export function digest(verifier: string): string {
+  return createHash('sha256').update(verifier).digest('base64url')
+}
+
+function key(authority: string, value: string): string {
+  return `oauth:code:${authority}:${createHash('sha256').update(value).digest('hex')}`
+}

package/components/identity.grants/source/lib/identify.ts

@@ -0,0 +1,16 @@
+import { createHash } from 'node:crypto'
+
+/**
+ * A user holds one grant per client, so the record is addressed by the three things that
+ * say which: authorizing again replaces what is there rather than leaving another row, and
+ * revoking has one thing to revoke.
+ */
+export function identify(authority: string, identity: string, client: string): string {
+  return createHash('sha256')
+    .update(JSON.stringify([authority, identity, client]))
+    .digest('hex')
+    .slice(0, LENGTH)
+}
+
+/** What the entity prototype accepts as an id. */
+const LENGTH = 32

package/components/identity.grants/source/lib/index.ts

@@ -0,0 +1,3 @@
+export * from './code.js'
+export * from './identify.js'
+export type * from '../../types/index.js'

package/components/identity.grants/source/list.ts

@@ -0,0 +1,28 @@
+import { quote } from '@toa.io/generic'
+import type { Operation } from '@toa.io/bridges.node'
+import type { Context, Entity } from './lib/index.js'
+
+/** What a user has allowed, for a screen that lets them take it back. */
+export class Computation implements Operation {
+  private enumerate!: Context['local']['enumerate']
+
+  public mount(context: Context): void {
+    this.enumerate = context.local.enumerate
+  }
+
+  public async execute(input: Input): Promise<Entity[]> {
+    return await this.enumerate({
+      query: {
+        criteria: `authority==${quote(input.authority)};identity==${quote(input.identity)}`,
+        limit: LIMIT
+      }
+    })
+  }
+}
+
+const LIMIT = 256
+
+interface Input {
+  authority: string
+  identity: string
+}

package/components/identity.grants/source/revoke.ts

@@ -0,0 +1,40 @@
+import type { Maybe } from '@toa.io/core/types'
+import type { Operation } from '@toa.io/bridges.node'
+import type { Context, Entity } from './lib/index.js'
+
+/**
+ * Taking back what was allowed. The token itself is not deleted — it is out in the world —
+ * so what is revoked is the key it was issued under, which is what `identity.tokens` reads
+ * it with. It stops being a token within `identity.tokens.cache.ttl`.
+ */
+export class Transition implements Operation {
+  private keys!: Context['remote']['identity']['keys']
+
+  public mount(context: Context): void {
+    this.keys = context.remote.identity.keys
+  }
+
+  public async execute(input: Input, object: Entity): Promise<Maybe<void>> {
+    // the id is a route parameter, so a grant of another identity is asked for by anyone
+    // who guesses one; the authority and the identity are what say it is theirs
+    if (
+      object.VERSION === 0 ||
+      object.authority !== input.authority ||
+      object.identity !== input.identity
+    )
+      return ERR_NOT_FOUND
+
+    if (object.kid !== undefined) await this.keys.disable({ query: { id: object.kid } })
+
+    object.revokedAt = Date.now()
+  }
+}
+
+const ERR_NOT_FOUND = new (class NotFoundError extends Error {
+  public readonly code = 'NOT_FOUND'
+})()
+
+interface Input {
+  authority: string
+  identity: string
+}

package/components/identity.grants/tsconfig.json

@@ -0,0 +1,10 @@
+{
+  "extends": "../../../../tsconfig.component.json",
+  "compilerOptions": {
+    "outDir": "./operations",
+    "rootDir": "./source"
+  },
+  "include": [
+    "source"
+  ]
+}