@toa.io/extensions.exposition 1.0.0-alpha.30 → 1.0.0-alpha.301

package/components/identity.federation/manifest.toa.yaml

@@ -2,58 +2,213 @@ namespace: identity
 name: federation
 
 entity:
-  associated: true
-  schema:
-    type: object
-    properties:
-      authority:
-        description: The authority token is valid for
-        type: string
-      iss:
-        description: The issuer, or signer, of the token, URI like `https://accounts.google.com`
-        type: string
-      sub:
-        description: The ID that represents the principal making the request
-        type: string
-    required:
-      - authority
-      - iss
-      - sub
-    additionalProperties: false
-  unique:
-    token: [authority, iss, sub]
+  properties:
+    authority:
+      description: The authority token is valid for
+      type: string
+    iss:
+      description: The issuer, or signer, of the token, URI like `https://accounts.google.com`
+      type: string
+    sub:
+      description: The ID that represents the principal making the request
+      type: string
+    identity:
+      description: Identity associated with these credentials
+      type: string
+  required:
+    - authority
+    - iss
+    - sub
+    - identity
 
 operations:
   transit:
     concurrency: retry
     input:
-      authority*: string
-      iss*: string
-      sub*: string
+      properties:
+        authority:
+          type: string
+        iss:
+          type: string
+        sub:
+          type: string
+        identity:
+          type: string
+      type: object
+      required:
+        - authority
+        - iss
+        - sub
+        - identity
+  create:
+    input:
+      properties:
+        scheme:
+          type: string
+          enum:
+            - bearer
+            - code
+        authority:
+          type: string
+        credentials:
+          type: string
+        id:
+          type: string
+      type: object
+      required:
+        - scheme
+        - authority
+        - credentials
+        - id
+    errors:
+      - EXISTS
+      # what resolving the credential refuses with, passed on
+      - TOKEN
+      - TRUST
+      - RESPONSE
+      - CONFIG
+      - NO_TOKEN
+      - ISS
+      - SUB
+      - EXP
+      - REPLAY
+      - CODE_NOT_ENABLED
+      - CODE_SCHEMA
   incept:
     input:
-      authority: string
-      credentials*: string
-      id: string
+      properties:
+        scheme:
+          type: string
+          enum:
+            - bearer
+            - code
+        authority:
+          type: string
+        credentials:
+          type: string
+        id:
+          type: string
+      type: object
+      required:
+        - scheme
+        - authority
+        - credentials
+        - id
     output:
-      id: string
+      properties:
+        id:
+          type: string
+      type: object
+    errors:
+      - EXISTS
+      # what resolving the credential refuses with, passed on
+      - TOKEN
+      - TRUST
+      - RESPONSE
+      - CONFIG
+      - NO_TOKEN
+      - ISS
+      - SUB
+      - EXP
+      - REPLAY
+      - CODE_NOT_ENABLED
+      - CODE_SCHEMA
   authenticate:
     input:
-      authority*: string
-      credentials*: string
+      properties:
+        scheme:
+          type: string
+          enum:
+            - bearer
+            - code
+        authority:
+          type: string
+        credentials:
+          type: string
+      type: object
+      required:
+        - scheme
+        - authority
+        - credentials
     output:
-      identity:
-        id: string
-
-exposition:
-  /:
-    POST:
-      anonymous: true
-      io:input: [authority, credentials]
-      io:output: [id]
-      vary:embed:
-        authority: authority
-      endpoint: incept
+      properties:
+        identity:
+          properties:
+            id:
+              type: string
+            claims:
+              properties:
+                iss:
+                  type: string
+                aud:
+                  type: string
+                sub:
+                  type: string
+              additionalProperties: true
+              required:
+                - iss
+                - sub
+              type: object
+          required:
+            - id
+            - claims
+          type: object
+      type: object
+    errors:
+      - NOT_FOUND
+      # what resolving the credential refuses with, passed on
+      - TOKEN
+      - TRUST
+      - RESPONSE
+      - CONFIG
+      - NO_TOKEN
+      - ISS
+      - SUB
+      - EXP
+      - REPLAY
+      - CODE_NOT_ENABLED
+      - CODE_SCHEMA
+  decode:
+    input:
+      type: string
+    output:
+      properties:
+        iss:
+          type: string
+        aud:
+          type: string
+        sub:
+          type: string
+      additionalProperties: true
+      required:
+        - iss
+        - sub
+      type: object
+  list:
+    input:
+      properties:
+        authority:
+          type: string
+        identity:
+          type: string
+      type: object
+      required:
+        - authority
+        - identity
+  delete:
+    input:
+      properties:
+        authority:
+          type: string
+        identity:
+          type: string
+        credential:
+          type: string
+      type: object
+      required:
+        - authority
+        - identity
+        - credential
 
 configuration:
   schema:
@@ -62,50 +217,88 @@ configuration:
       trust:
         type: array
         items:
-          title: Trust Configuration
+          title: Trusted Identity Providers
           type: object
           additionalProperties: false
           properties:
             iss:
-              description: Allowed origins for a token `iss` field
+              description: Allowed values for a token `iss` field
               type: string
               format: uri
             aud:
               description: Acceptable `aud` value(s)
-              type: array
-              items:
-                type: string
-              uniqueItems: true
-              minItems: 1
-            secrets:
-              description: Symmetric encryption secrets
-              type: object
-              patternProperties:
-                ^HS\d{3}$:
-                  type: object
-                  patternProperties:
-                    ^\w+$:
-                      type: string
-                  minProperties: 1
-              additionalProperties: false
-              minProperties: 1
+              anyOf:
+                - type: string
+                - type: array
+                  items:
+                    type: string
+                  uniqueItems: true
+                  minItems: 1
+            signature:
+              properties:
+                iss:
+                  type: string
+                kid:
+                  type: string
+                key:
+                  description: PKCS8 private key in PEM form
+                  type: string
+              required:
+                - iss
+                - kid
+                - key
+            secret:
+              description: Client secret for the Identity Provider. Required for Authorization Code Flow.
+              type: string
           required:
             - iss
-      explicit_identity_creation:
-        description: Force identities to be explicitly created or incept before being used in authentication
-        type: boolean
-        default: true
+            - aud
       principal:
-        description: The value of `sub` of an identity token that will be assigned the `system` Role
+        title: Principal
+        description: Subject that will be assigned the `system` Role
         type: object
         properties:
+          authority:
+            type: string
           iss:
             type: string
             format: uri
           sub:
             type: string
         required:
+          - authority
           - iss
           - sub
         additionalProperties: false
+      assert:
+        title: Implicitly incept Identity for new credentials
+        type: boolean
     additionalProperties: false
+
+  defaults:
+    trust: []
+    assert: true
+
+exposition:
+  /:
+    /:id:
+      auth:id: id
+      POST:
+        map:authority: authority
+        io:input: [scheme, credentials]
+        io:output: &credential [id, iss, CREATED]
+        endpoint: create
+      GET:
+        map:authority: authority
+        map:segments:
+          identity: id
+        io:output: *credential
+        endpoint: list
+      /:credential:
+        DELETE:
+          map:authority: authority
+          map:segments:
+            identity: id
+            credential: credential
+          io:output: false
+          endpoint: delete

package/components/identity.federation/migrations/0002-indexes.yaml

@@ -0,0 +1,25 @@
+- index:
+    name: unique_token
+    keys:
+      authority: asc
+      iss: asc
+      sub: asc
+    unique: true
+    partial:
+      DELETED: null
+- index:
+    name: unique_identity
+    keys:
+      authority: asc
+      iss: asc
+      identity: asc
+    unique: true
+    partial:
+      DELETED: null
+- index:
+    name: index_list
+    keys:
+      authority: asc
+      identity: asc
+      CREATED: desc
+    sparse: true

package/components/identity.federation/operations/authenticate.js

@@ -1,21 +1,32 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.computation = void 0;
-const error_value_1 = require("error-value");
-const assertions_as_values_js_1 = require("./lib/assertions-as-values.js");
-const jwt_1 = require("./lib/jwt");
-async function authenticate({ authority, credentials }, context) {
-    const { iss, sub } = await (0, jwt_1.validateIdToken)(credentials, context.configuration.trust);
-    const request = { query: { criteria: `authority==${authority};iss==${iss};sub==${sub}` } };
-    let id = (await context.local.observe(request))?.id;
-    if (id === undefined) {
-        if (context.configuration.explicit_identity_creation === true)
-            return NOT_FOUND;
-        id = (await context.local.transit({ input: { authority, iss, sub } })).id;
-    }
-    return { identity: { id } };
+import { newid, quote } from '@toa.io/generic';
+import { principal, resolve } from './lib/index.js';
+export async function effect({ scheme, authority, credentials }, context) {
+    context.logs.debug('Authenticating', { scheme, authority });
+    const claims = await resolve(scheme, credentials, context);
+    if (claims instanceof Error)
+        return claims;
+    const { iss, sub } = claims;
+    context.logs.debug('Token claims', claims);
+    const query = {
+        criteria: `authority==${quote(authority)};iss==${quote(iss)};sub==${quote(sub)}`
+    };
+    const asserted = newid();
+    const credential = context.configuration.assert !== false
+        ? await context.local.ensure({
+            query,
+            entity: { authority, iss, sub, identity: asserted }
+        })
+        : await context.local.observe({ query });
+    if (credential === null)
+        return ERR_NOT_FOUND;
+    if (credential instanceof Error)
+        return credential;
+    // the Identity this call has just created is the only one whose Role is not granted yet
+    if (credential.identity === asserted)
+        await principal(credential, context);
+    return { identity: { id: credential.identity, claims } };
 }
-// Exporting as a function returning assertion errors as values
-exports.computation = (0, assertions_as_values_js_1.assertionsAsValues)(authenticate);
-const NOT_FOUND = (0, error_value_1.Err)('NOT_FOUND');
-//# sourceMappingURL=authenticate.js.map
+const ERR_NOT_FOUND = new (class NotFoundError extends Error {
+    code = 'NOT_FOUND';
+})();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aGVudGljYXRlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2F1dGhlbnRpY2F0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxNQUFNLGlCQUFpQixDQUFBO0FBQzlDLE9BQU8sRUFBRSxTQUFTLEVBQUUsT0FBTyxFQUFFLE1BQU0sZ0JBQWdCLENBQUE7QUFLbkQsTUFBTSxDQUFDLEtBQUssVUFBVSxNQUFNLENBQzFCLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxXQUFXLEVBQVMsRUFDekMsT0FBZ0I7SUFFaEIsT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsZ0JBQWdCLEVBQUUsRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLENBQUMsQ0FBQTtJQUUzRCxNQUFNLE1BQU0sR0FBRyxNQUFNLE9BQU8sQ0FBQyxNQUFNLEVBQUUsV0FBVyxFQUFFLE9BQU8sQ0FBQyxDQUFBO0lBRTFELElBQUksTUFBTSxZQUFZLEtBQUs7UUFBRSxPQUFPLE1BQU0sQ0FBQTtJQUUxQyxNQUFNLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLE1BQU0sQ0FBQTtJQUUzQixPQUFPLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxjQUFjLEVBQUUsTUFBTSxDQUFDLENBQUE7SUFFMUMsTUFBTSxLQUFLLEdBQUc7UUFDWixRQUFRLEVBQUUsY0FBYyxLQUFLLENBQUMsU0FBUyxDQUFDLFNBQVMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxTQUFTLEtBQUssQ0FBQyxHQUFHLENBQUMsRUFBRTtLQUNqRixDQUFBO0lBRUQsTUFBTSxRQUFRLEdBQUcsS0FBSyxFQUFFLENBQUE7SUFFeEIsTUFBTSxVQUFVLEdBQ2QsT0FBTyxDQUFDLGFBQWEsQ0FBQyxNQUFNLEtBQUssS0FBSztRQUNwQyxDQUFDLENBQUMsTUFBTSxPQUFPLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQztZQUN6QixLQUFLO1lBQ0wsTUFBTSxFQUFFLEVBQUUsU0FBUyxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsUUFBUSxFQUFFLFFBQVEsRUFBRTtTQUNwRCxDQUFDO1FBQ0osQ0FBQyxDQUFDLE1BQU0sT0FBTyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFBO0lBRTVDLElBQUksVUFBVSxLQUFLLElBQUk7UUFBRSxPQUFPLGFBQWEsQ0FBQTtJQUU3QyxJQUFJLFVBQVUsWUFBWSxLQUFLO1FBQUUsT0FBTyxVQUFVLENBQUE7SUFFbEQsd0ZBQXdGO0lBQ3hGLElBQUksVUFBVSxDQUFDLFFBQVEsS0FBSyxRQUFRO1FBQUUsTUFBTSxTQUFTLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxDQUFBO0lBRTFFLE9BQU8sRUFBRSxRQUFRLEVBQUUsRUFBRSxFQUFFLEVBQUUsVUFBVSxDQUFDLFFBQVEsRUFBRSxNQUFNLEVBQUUsRUFBRSxDQUFBO0FBQzFELENBQUM7QUFFRCxNQUFNLGFBQWEsR0FBRyxJQUFJLENBQUMsTUFBTSxhQUFjLFNBQVEsS0FBSztJQUMxQyxJQUFJLEdBQUcsV0FBVyxDQUFBO0NBQ25DLENBQUMsRUFBRSxDQUFBIn0=

package/components/identity.federation/operations/create.js

@@ -0,0 +1,29 @@
+import { quote } from '@toa.io/generic';
+import { resolve } from './lib/index.js';
+export async function effect(input, context) {
+    const claims = await resolve(input.scheme, input.credentials, context);
+    if (claims instanceof Error)
+        return claims;
+    const { iss, sub } = claims;
+    const existent = await context.local.observe({
+        query: {
+            criteria: `authority==${quote(input.authority)};iss==${quote(iss)};sub==${quote(sub)}`,
+            deleted: true
+        }
+    });
+    const record = { authority: input.authority, iss, sub, identity: input.id };
+    if (existent === null)
+        return await context.local.transit({ input: record });
+    if (existent.DELETED === undefined || existent.DELETED === null)
+        return existent.identity === input.id ? existent : ERR_EXISTS;
+    // a deleted record still occupies the unique index, so the transition revives it
+    return await context.local.transit({
+        input: record,
+        query: { id: existent.id, deleted: true }
+    });
+}
+const ERR_EXISTS = new (class ExistsError extends Error {
+    code = 'EXISTS';
+    message = 'Federation credentials are associated with another Identity';
+})();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY3JlYXRlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2NyZWF0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsS0FBSyxFQUFFLE1BQU0saUJBQWlCLENBQUE7QUFDdkMsT0FBTyxFQUFFLE9BQU8sRUFBRSxNQUFNLGdCQUFnQixDQUFBO0FBR3hDLE1BQU0sQ0FBQyxLQUFLLFVBQVUsTUFBTSxDQUFDLEtBQVksRUFBRSxPQUFnQjtJQUN6RCxNQUFNLE1BQU0sR0FBRyxNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsTUFBTSxFQUFFLEtBQUssQ0FBQyxXQUFXLEVBQUUsT0FBTyxDQUFDLENBQUE7SUFFdEUsSUFBSSxNQUFNLFlBQVksS0FBSztRQUFFLE9BQU8sTUFBTSxDQUFBO0lBRTFDLE1BQU0sRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsTUFBTSxDQUFBO0lBRTNCLE1BQU0sUUFBUSxHQUFHLE1BQU0sT0FBTyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUM7UUFDM0MsS0FBSyxFQUFFO1lBQ0wsUUFBUSxFQUFFLGNBQWMsS0FBSyxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsU0FBUyxLQUFLLENBQUMsR0FBRyxDQUFDLFNBQVMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxFQUFFO1lBQ3RGLE9BQU8sRUFBRSxJQUFJO1NBQ2Q7S0FDRixDQUFDLENBQUE7SUFFRixNQUFNLE1BQU0sR0FBRyxFQUFFLFNBQVMsRUFBRSxLQUFLLENBQUMsU0FBUyxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsUUFBUSxFQUFFLEtBQUssQ0FBQyxFQUFFLEVBQUUsQ0FBQTtJQUUzRSxJQUFJLFFBQVEsS0FBSyxJQUFJO1FBQUUsT0FBTyxNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUE7SUFFNUUsSUFBSSxRQUFRLENBQUMsT0FBTyxLQUFLLFNBQVMsSUFBSSxRQUFRLENBQUMsT0FBTyxLQUFLLElBQUk7UUFDN0QsT0FBTyxRQUFRLENBQUMsUUFBUSxLQUFLLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsVUFBVSxDQUFBO0lBRS9ELGlGQUFpRjtJQUNqRixPQUFPLE1BQU0sT0FBTyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUM7UUFDakMsS0FBSyxFQUFFLE1BQU07UUFDYixLQUFLLEVBQUUsRUFBRSxFQUFFLEVBQUUsUUFBUSxDQUFDLEVBQUUsRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFO0tBQzFDLENBQUMsQ0FBQTtBQUNKLENBQUM7QUFTRCxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsTUFBTSxXQUFZLFNBQVEsS0FBSztJQUNyQyxJQUFJLEdBQUcsUUFBUSxDQUFBO0lBQ04sT0FBTyxHQUM5Qiw2REFBNkQsQ0FBQTtDQUNoRSxDQUFDLEVBQUUsQ0FBQSJ9

package/components/identity.federation/operations/decode.js

@@ -0,0 +1,9 @@
+import { decode } from './lib/index.js';
+export async function effect(token, context) {
+    return await decode(token, {
+        trust: context.configuration.trust,
+        logs: context.logs,
+        fetch: context.fetch
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVjb2RlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2RlY29kZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsTUFBTSxFQUFFLE1BQU0sZ0JBQWdCLENBQUE7QUFJdkMsTUFBTSxDQUFDLEtBQUssVUFBVSxNQUFNLENBQzFCLEtBQWEsRUFDYixPQUFnQjtJQUVoQixPQUFPLE1BQU0sTUFBTSxDQUFDLEtBQUssRUFBRTtRQUN6QixLQUFLLEVBQUUsT0FBTyxDQUFDLGFBQWEsQ0FBQyxLQUFLO1FBQ2xDLElBQUksRUFBRSxPQUFPLENBQUMsSUFBSTtRQUNsQixLQUFLLEVBQUUsT0FBTyxDQUFDLEtBQUs7S0FDckIsQ0FBQyxDQUFBO0FBQ0osQ0FBQyJ9

package/components/identity.federation/operations/delete.js

@@ -0,0 +1,7 @@
+export async function effect({ authority, identity, credential }, context) {
+    const object = await context.local.observe({ query: { id: credential } });
+    if (object === null || object.authority !== authority || object.identity !== identity)
+        return null;
+    return await context.local.terminate({ query: { id: credential } });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVsZXRlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2RlbGV0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFFQSxNQUFNLENBQUMsS0FBSyxVQUFVLE1BQU0sQ0FDMUIsRUFBRSxTQUFTLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBUyxFQUMxQyxPQUFnQjtJQUVoQixNQUFNLE1BQU0sR0FBRyxNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxFQUFFLFVBQVUsRUFBRSxFQUFFLENBQUMsQ0FBQTtJQUV6RSxJQUFJLE1BQU0sS0FBSyxJQUFJLElBQUksTUFBTSxDQUFDLFNBQVMsS0FBSyxTQUFTLElBQUksTUFBTSxDQUFDLFFBQVEsS0FBSyxRQUFRO1FBQ25GLE9BQU8sSUFBSSxDQUFBO0lBRWIsT0FBTyxNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxFQUFFLFVBQVUsRUFBRSxFQUFFLENBQUMsQ0FBQTtBQUNyRSxDQUFDIn0=

package/components/identity.federation/operations/incept.js

@@ -1,14 +1,10 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.effect = void 0;
-const assertions_as_values_js_1 = require("./lib/assertions-as-values.js");
-const jwt_1 = require("./lib/jwt");
-async function incept(input, context) {
-    const { iss, sub } = await (0, jwt_1.validateIdToken)(input.credentials, context.configuration.trust);
-    const request = { input: { authority: input.authority, iss, sub } };
-    if (input.id !== undefined)
-        request.query = { id: input.id };
-    return await context.local.transit(request);
+import { effect as create } from './create.js';
+import { principal } from './lib/index.js';
+export async function effect(input, context) {
+    const credential = await create(input, context);
+    if (credential instanceof Error)
+        return credential;
+    await principal(credential, context);
+    return { id: credential.identity };
 }
-exports.effect = (0, assertions_as_values_js_1.assertionsAsValues)(incept);
-//# sourceMappingURL=incept.js.map
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5jZXB0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2luY2VwdC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsTUFBTSxJQUFJLE1BQU0sRUFBRSxNQUFNLGFBQWEsQ0FBQTtBQUM5QyxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0sZ0JBQWdCLENBQUE7QUFHMUMsTUFBTSxDQUFDLEtBQUssVUFBVSxNQUFNLENBQUMsS0FBWSxFQUFFLE9BQWdCO0lBQ3pELE1BQU0sVUFBVSxHQUFHLE1BQU0sTUFBTSxDQUFDLEtBQUssRUFBRSxPQUFPLENBQUMsQ0FBQTtJQUUvQyxJQUFJLFVBQVUsWUFBWSxLQUFLO1FBQUUsT0FBTyxVQUFVLENBQUE7SUFFbEQsTUFBTSxTQUFTLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxDQUFBO0lBRXBDLE9BQU8sRUFBRSxFQUFFLEVBQUUsVUFBVSxDQUFDLFFBQVEsRUFBRSxDQUFBO0FBQ3BDLENBQUMifQ==

package/components/identity.federation/operations/lib/Configuration.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiQ29uZmlndXJhdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS9saWIvQ29uZmlndXJhdGlvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiIn0=

package/components/identity.federation/operations/lib/Ctx.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiQ3R4LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc291cmNlL2xpYi9DdHgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiJ9

package/components/identity.federation/operations/lib/Payload.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiUGF5bG9hZC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS9saWIvUGF5bG9hZC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiIn0=

package/components/identity.federation/operations/lib/decode.js

@@ -0,0 +1,36 @@
+import { load } from './jose.js';
+import { createRemoteJWKSet } from './discovery.js';
+import { ERR_TRUST, ERR_ISS, ERR_SUB, ERR_TOKEN } from './errors.js';
+export async function decode(token, ctx) {
+    const jose = await load();
+    let claims;
+    // jose throws on anything it cannot read, and credentials are the client's to malform
+    try {
+        claims = jose.decodeJwt(token);
+    }
+    catch {
+        return ERR_TOKEN;
+    }
+    const { iss, sub } = claims;
+    if (typeof iss !== 'string')
+        return ERR_ISS;
+    if (typeof sub !== 'string')
+        return ERR_SUB;
+    const trusted = ctx.trust.find((trust) => trust.iss === iss);
+    if (trusted === undefined)
+        return ERR_TRUST;
+    // the issuer is a configured one by now, so reaching its keys is the deployment's to answer for
+    const jwks = await createRemoteJWKSet(iss, ctx.fetch);
+    try {
+        const { payload } = await jose.jwtVerify(token, jwks, {
+            issuer: iss,
+            audience: trusted.aud,
+            requiredClaims: ['exp']
+        });
+        return payload;
+    }
+    catch {
+        return ERR_TOKEN;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVjb2RlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc291cmNlL2xpYi9kZWNvZGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLElBQUksRUFBRSxNQUFNLFdBQVcsQ0FBQTtBQUNoQyxPQUFPLEVBQUUsa0JBQWtCLEVBQUUsTUFBTSxnQkFBZ0IsQ0FBQTtBQUNuRCxPQUFPLEVBQUUsU0FBUyxFQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0sYUFBYSxDQUFBO0FBS3BFLE1BQU0sQ0FBQyxLQUFLLFVBQVUsTUFBTSxDQUFDLEtBQWEsRUFBRSxHQUFRO0lBQ2xELE1BQU0sSUFBSSxHQUFHLE1BQU0sSUFBSSxFQUFFLENBQUE7SUFFekIsSUFBSSxNQUFrQixDQUFBO0lBRXRCLHNGQUFzRjtJQUN0RixJQUFJLENBQUM7UUFDSCxNQUFNLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsQ0FBQTtJQUNoQyxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxTQUFTLENBQUE7SUFDbEIsQ0FBQztJQUVELE1BQU0sRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsTUFBTSxDQUFBO0lBRTNCLElBQUksT0FBTyxHQUFHLEtBQUssUUFBUTtRQUFFLE9BQU8sT0FBTyxDQUFBO0lBRTNDLElBQUksT0FBTyxHQUFHLEtBQUssUUFBUTtRQUFFLE9BQU8sT0FBTyxDQUFBO0lBRTNDLE1BQU0sT0FBTyxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsR0FBRyxLQUFLLEdBQUcsQ0FBQyxDQUFBO0lBRTVELElBQUksT0FBTyxLQUFLLFNBQVM7UUFBRSxPQUFPLFNBQVMsQ0FBQTtJQUUzQyxnR0FBZ0c7SUFDaEcsTUFBTSxJQUFJLEdBQUcsTUFBTSxrQkFBa0IsQ0FBQyxHQUFHLEVBQUUsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFBO0lBRXJELElBQUksQ0FBQztRQUNILE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyxNQUFNLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxFQUFFLElBQUksRUFBRTtZQUNwRCxNQUFNLEVBQUUsR0FBRztZQUNYLFFBQVEsRUFBRSxPQUFPLENBQUMsR0FBRztZQUNyQixjQUFjLEVBQUUsQ0FBQyxLQUFLLENBQUM7U0FDeEIsQ0FBQyxDQUFBO1FBRUYsT0FBTyxPQUFrQixDQUFBO0lBQzNCLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLFNBQVMsQ0FBQTtJQUNsQixDQUFDO0FBQ0gsQ0FBQyJ9

package/components/identity.federation/operations/lib/discovery.js

@@ -0,0 +1,34 @@
+import { load } from './jose.js';
+const cache = new Map();
+const resolvers = new WeakMap();
+export async function discover(iss, fetch) {
+    if (!cache.has(iss)) {
+        const configuration = await fetchConfiguration(iss, fetch);
+        cache.set(iss, configuration);
+    }
+    return cache.get(iss);
+}
+async function fetchConfiguration(iss, fetch) {
+    const response = await fetch(`${iss}/.well-known/openid-configuration`);
+    if (!response.ok)
+        throw new Error('Failed to fetch OIDC configuration');
+    return (await response.json());
+}
+export async function createRemoteJWKSet(iss, fetch) {
+    let entries = resolvers.get(fetch);
+    if (entries === undefined) {
+        entries = new Map();
+        resolvers.set(fetch, entries);
+    }
+    if (!entries.has(iss))
+        entries.set(iss, create(iss, fetch));
+    return await entries.get(iss);
+}
+async function create(iss, fetch) {
+    const jose = await load();
+    const configuration = await discover(iss, fetch);
+    return jose.createRemoteJWKSet(new URL(configuration.jwks_uri), {
+        [jose.customFetch]: fetch
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGlzY292ZXJ5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc291cmNlL2xpYi9kaXNjb3ZlcnkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLElBQUksRUFBRSxNQUFNLFdBQVcsQ0FBQTtBQUtoQyxNQUFNLEtBQUssR0FBRyxJQUFJLEdBQUcsRUFBeUIsQ0FBQTtBQUM5QyxNQUFNLFNBQVMsR0FBRyxJQUFJLE9BQU8sRUFBa0QsQ0FBQTtBQUUvRSxNQUFNLENBQUMsS0FBSyxVQUFVLFFBQVEsQ0FBQyxHQUFXLEVBQUUsS0FBWTtJQUN0RCxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3BCLE1BQU0sYUFBYSxHQUFHLE1BQU0sa0JBQWtCLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxDQUFBO1FBRTFELEtBQUssQ0FBQyxHQUFHLENBQUMsR0FBRyxFQUFFLGFBQWEsQ0FBQyxDQUFBO0lBQy9CLENBQUM7SUFFRCxPQUFPLEtBQUssQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFFLENBQUE7QUFDeEIsQ0FBQztBQUVELEtBQUssVUFBVSxrQkFBa0IsQ0FBQyxHQUFXLEVBQUUsS0FBWTtJQUN6RCxNQUFNLFFBQVEsR0FBRyxNQUFNLEtBQUssQ0FBQyxHQUFHLEdBQUcsbUNBQW1DLENBQUMsQ0FBQTtJQUV2RSxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUU7UUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLG9DQUFvQyxDQUFDLENBQUE7SUFFdkUsT0FBTyxDQUFDLE1BQU0sUUFBUSxDQUFDLElBQUksRUFBRSxDQUFrQixDQUFBO0FBQ2pELENBQUM7QUFFRCxNQUFNLENBQUMsS0FBSyxVQUFVLGtCQUFrQixDQUN0QyxHQUFXLEVBQ1gsS0FBWTtJQUVaLElBQUksT0FBTyxHQUFHLFNBQVMsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUE7SUFFbEMsSUFBSSxPQUFPLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDMUIsT0FBTyxHQUFHLElBQUksR0FBRyxFQUFFLENBQUE7UUFDbkIsU0FBUyxDQUFDLEdBQUcsQ0FBQyxLQUFLLEVBQUUsT0FBTyxDQUFDLENBQUE7SUFDL0IsQ0FBQztJQUVELElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQztRQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsR0FBRyxFQUFFLE1BQU0sQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLENBQUMsQ0FBQTtJQUUzRCxPQUFPLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUUsQ0FBQTtBQUNoQyxDQUFDO0FBRUQsS0FBSyxVQUFVLE1BQU0sQ0FBQyxHQUFXLEVBQUUsS0FBWTtJQUM3QyxNQUFNLElBQUksR0FBRyxNQUFNLElBQUksRUFBRSxDQUFBO0lBQ3pCLE1BQU0sYUFBYSxHQUFHLE1BQU0sUUFBUSxDQUFDLEdBQUcsRUFBRSxLQUFLLENBQUMsQ0FBQTtJQUVoRCxPQUFPLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLEVBQUU7UUFDOUQsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLEVBQUUsS0FBSztLQUMxQixDQUFDLENBQUE7QUFDSixDQUFDIn0=

package/components/identity.federation/operations/lib/errors.js

@@ -0,0 +1,45 @@
+export const ERR_TOKEN = new (class TokenError extends Error {
+    code = 'TOKEN';
+    message = 'Token is malformed or does not verify';
+})();
+export const ERR_TRUST = new (class TrustError extends Error {
+    code = 'TRUST';
+    message = 'Issuer not trusted';
+})();
+export const ERR_RESPONSE = new (class ResponseError extends Error {
+    code = 'RESPONSE';
+    message = 'Request to IDP failed';
+})();
+export const ERR_CONFIG = new (class ConfigError extends Error {
+    code = 'CONFIG';
+    message = 'Invalid OpenID configuration';
+})();
+export const ERR_NO_TOKEN = new (class NoTokenError extends Error {
+    code = 'NO_TOKEN';
+    message = 'No ID token received';
+})();
+export const ERR_ISS = new (class IssError extends Error {
+    code = 'ISS';
+    message = 'Invalid issuer claim';
+})();
+export const ERR_SUB = new (class SubError extends Error {
+    code = 'SUB';
+    message = 'Invalid subject claim';
+})();
+export const ERR_EXP = new (class ExpError extends Error {
+    code = 'EXP';
+    message = 'Token does not have an expiration time';
+})();
+export const ERR_REPLAY = new (class ReplayError extends Error {
+    code = 'REPLAY';
+    message = 'Token has already been used';
+})();
+export const ERR_CODE_NOT_ENABLED = new (class CodeNotEnabledError extends Error {
+    code = 'CODE_NOT_ENABLED';
+    message = 'Authorization code flow is not configured';
+})();
+export const ERR_CODE_SCHEMA = new (class CodeSchemaError extends Error {
+    code = 'CODE_SCHEMA';
+    message = 'Invalid code credentials';
+})();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXJyb3JzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc291cmNlL2xpYi9lcnJvcnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsTUFBTSxDQUFDLE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxNQUFNLFVBQVcsU0FBUSxLQUFLO0lBQzFDLElBQUksR0FBRyxPQUFPLENBQUE7SUFDTCxPQUFPLEdBQUcsdUNBQXVDLENBQUE7Q0FDM0UsQ0FBQyxFQUFFLENBQUE7QUFFSixNQUFNLENBQUMsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLE1BQU0sVUFBVyxTQUFRLEtBQUs7SUFDMUMsSUFBSSxHQUFHLE9BQU8sQ0FBQTtJQUNMLE9BQU8sR0FBRyxvQkFBb0IsQ0FBQTtDQUN4RCxDQUFDLEVBQUUsQ0FBQTtBQUVKLE1BQU0sQ0FBQyxNQUFNLFlBQVksR0FBRyxJQUFJLENBQUMsTUFBTSxhQUFjLFNBQVEsS0FBSztJQUNoRCxJQUFJLEdBQUcsVUFBVSxDQUFBO0lBQ1IsT0FBTyxHQUFHLHVCQUF1QixDQUFBO0NBQzNELENBQUMsRUFBRSxDQUFBO0FBRUosTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHLElBQUksQ0FBQyxNQUFNLFdBQVksU0FBUSxLQUFLO0lBQzVDLElBQUksR0FBRyxRQUFRLENBQUE7SUFDTixPQUFPLEdBQUcsOEJBQThCLENBQUE7Q0FDbEUsQ0FBQyxFQUFFLENBQUE7QUFFSixNQUFNLENBQUMsTUFBTSxZQUFZLEdBQUcsSUFBSSxDQUFDLE1BQU0sWUFBYSxTQUFRLEtBQUs7SUFDL0MsSUFBSSxHQUFHLFVBQVUsQ0FBQTtJQUNSLE9BQU8sR0FBRyxzQkFBc0IsQ0FBQTtDQUMxRCxDQUFDLEVBQUUsQ0FBQTtBQUVKLE1BQU0sQ0FBQyxNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsTUFBTSxRQUFTLFNBQVEsS0FBSztJQUN0QyxJQUFJLEdBQUcsS0FBSyxDQUFBO0lBQ0gsT0FBTyxHQUFHLHNCQUFzQixDQUFBO0NBQzFELENBQUMsRUFBRSxDQUFBO0FBRUosTUFBTSxDQUFDLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxNQUFNLFFBQVMsU0FBUSxLQUFLO0lBQ3RDLElBQUksR0FBRyxLQUFLLENBQUE7SUFDSCxPQUFPLEdBQUcsdUJBQXVCLENBQUE7Q0FDM0QsQ0FBQyxFQUFFLENBQUE7QUFFSixNQUFNLENBQUMsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLE1BQU0sUUFBUyxTQUFRLEtBQUs7SUFDdEMsSUFBSSxHQUFHLEtBQUssQ0FBQTtJQUNILE9BQU8sR0FBRyx3Q0FBd0MsQ0FBQTtDQUM1RSxDQUFDLEVBQUUsQ0FBQTtBQUVKLE1BQU0sQ0FBQyxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsTUFBTSxXQUFZLFNBQVEsS0FBSztJQUM1QyxJQUFJLEdBQUcsUUFBUSxDQUFBO0lBQ04sT0FBTyxHQUFHLDZCQUE2QixDQUFBO0NBQ2pFLENBQUMsRUFBRSxDQUFBO0FBRUosTUFBTSxDQUFDLE1BQU0sb0JBQW9CLEdBQUcsSUFBSSxDQUFDLE1BQU0sbUJBQW9CLFNBQVEsS0FBSztJQUM5RCxJQUFJLEdBQUcsa0JBQWtCLENBQUE7SUFDaEIsT0FBTyxHQUFHLDJDQUEyQyxDQUFBO0NBQy9FLENBQUMsRUFBRSxDQUFBO0FBRUosTUFBTSxDQUFDLE1BQU0sZUFBZSxHQUFHLElBQUksQ0FBQyxNQUFNLGVBQWdCLFNBQVEsS0FBSztJQUNyRCxJQUFJLEdBQUcsYUFBYSxDQUFBO0lBQ1gsT0FBTyxHQUFHLDBCQUEwQixDQUFBO0NBQzlELENBQUMsRUFBRSxDQUFBIn0=