@toa.io/extensions.exposition 1.0.0-alpha.31 → 1.0.0-alpha.310

package/components/identity.tokens/operations/decrypt.js

@@ -1,33 +1,194 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.computation = void 0;
-const paseto_1 = require("paseto");
-async function computation(token, context) {
-    let refresh = false;
-    let claim = await decrypt(token, context.configuration.key0);
-    if (claim === null && context.configuration.key1 !== undefined) {
-        refresh = true;
-        claim = await decrypt(token, context.configuration.key1);
-    }
-    if (claim === null)
-        return ERR_INVALID_TOKEN;
-    else
+import { createDecipheriv } from 'node:crypto';
+import { DecryptFactory, ImportKeyFactory } from 'paseto/v3/local';
+import { LRUCache } from 'lru-cache';
+import { form, jweKey } from './lib/index.js';
+export class Computation {
+    keys = {};
+    legacy = {};
+    cache;
+    latest;
+    remote;
+    logs;
+    mount(context) {
+        const latest = context.configuration.keys.find(({ format }) => format !== 'paseto');
+        if (latest === undefined)
+            throw new TypeError('At least one JWE key must be configured');
+        this.latest = latest.id;
+        this.remote = context.remote.identity.keys;
+        this.cache = new LRUCache(context.configuration.cache);
+        this.logs = context.logs;
+        for (const { id, key, format } of context.configuration.keys) {
+            const branch = format === 'paseto' ? this.legacy : this.keys;
+            branch[id] = { key: key.unwrap() };
+        }
+    }
+    async execute(token) {
+        if (form(token) === 'paseto') {
+            const kid = this.pasetoKid(token);
+            if (kid instanceof Error)
+                return kid;
+            const key = await this.key(kid, true);
+            if (key instanceof Error)
+                return key;
+            const claims = await decryptPaseto(token, key.key);
+            if (claims instanceof Error)
+                return claims;
+            // a token of the form this component leaves behind is answered with a re-issue
+            return this.answer(claims, key, true);
+        }
+        const jwe = parse(token);
+        if (jwe instanceof Error)
+            return jwe;
+        const key = await this.key(jwe.kid, false);
+        if (key instanceof Error)
+            return key;
+        const claims = open(jwe, key.key);
+        if (claims instanceof Error)
+            return claims;
+        return this.answer(claims, key, jwe.kid !== this.latest && key.identity === undefined);
+    }
+    pasetoKid(token) {
+        const [, , , footer] = token.split('.');
+        if (footer === undefined)
+            return ERR_INVALID_TOKEN;
+        try {
+            const json = Buffer.from(footer, 'base64url').toString('utf-8');
+            const { kid } = JSON.parse(json);
+            if (typeof kid !== 'string')
+                return ERR_INVALID_TOKEN;
+            return kid;
+        }
+        catch {
+            return ERR_INVALID_TOKEN;
+        }
+    }
+    /** What both forms answer once their claims are open. */
+    answer(claims, key, refresh) {
+        this.logs.debug('Token claims', claims);
+        if (key.identity !== undefined && claims.identity.id !== key.identity)
+            return ERR_FORGED_KEY;
+        if (key.revokedAt !== undefined)
+            return ERR_REVOKED_KEY;
         return {
-            authority: claim.aud,
-            identity: claim.identity,
-            iat: claim.iat,
-            exp: claim.exp,
-            refresh
+            iss: claims.iss,
+            iat: claims.iat,
+            exp: claims.exp,
+            identity: claims.identity,
+            ...(claims.aud === undefined ? {} : { aud: claims.aud }),
+            refresh,
+            custom: key.identity !== undefined
         };
+    }
+    async key(kid, legacy) {
+        const configured = legacy ? this.legacy : this.keys;
+        if (kid in configured)
+            return configured[kid];
+        if (!this.cache.has(kid)) {
+            const value = await this.remote.observe({ query: { id: kid } });
+            this.cache.set(kid, { value });
+        }
+        const entry = this.cache.get(kid);
+        return entry?.value ?? ERR_INVALID_KEY;
+    }
+}
+async function decryptPaseto(token, key) {
+    try {
+        const secret = await importKey(key);
+        // paseto 3 read a token that never expires; these are tokens already in the wild
+        const { claims } = await decryptLocal(secret, token, { allowNonExpiring: true });
+        return claims;
+    }
+    catch {
+        return ERR_INVALID_TOKEN;
+    }
+}
+/**
+ * The five parts of a compact JWE (RFC 7516), of the one form this component issues: `dir`, so
+ * the encrypted key is empty, `A256GCM`, and a `kid` naming the key. A header that asks for
+ * anything else — another algorithm, a critical extension, compression — is refused, as jose
+ * refuses it.
+ */
+function parse(token) {
+    const parts = token.split('.');
+    if (parts.length !== PARTS || parts[1] !== '')
+        return ERR_INVALID_TOKEN;
+    const [header, , iv, ciphertext, tag] = parts;
+    let declared;
+    try {
+        declared = JSON.parse(Buffer.from(header, 'base64url').toString('utf-8'));
+    }
+    catch {
+        return ERR_INVALID_TOKEN;
+    }
+    if (declared === null ||
+        typeof declared !== 'object' ||
+        declared.alg !== 'dir' ||
+        declared.enc !== 'A256GCM' ||
+        declared.typ !== 'JWT' ||
+        typeof declared.kid !== 'string' ||
+        declared.crit !== undefined ||
+        declared.zip !== undefined)
+        return ERR_INVALID_TOKEN;
+    return {
+        kid: declared.kid,
+        // the header as it was written, which is what it was encrypted against
+        aad: Buffer.from(header, 'ascii'),
+        iv: Buffer.from(iv, 'base64url'),
+        ciphertext: Buffer.from(ciphertext, 'base64url'),
+        tag: Buffer.from(tag, 'base64url')
+    };
 }
-exports.computation = computation;
-async function decrypt(token, key) {
+/** The claims a token carries, where its tag holds and its times admit it. */
+function open(jwe, key) {
+    if (jwe.iv.length !== IV || jwe.tag.length !== TAG)
+        return ERR_INVALID_TOKEN;
+    let payload;
     try {
-        return await paseto_1.V3.decrypt(token, key);
+        const decipher = createDecipheriv('aes-256-gcm', jweKey(key), jwe.iv);
+        decipher.setAAD(jwe.aad);
+        decipher.setAuthTag(jwe.tag);
+        payload = JSON.parse(Buffer.concat([decipher.update(jwe.ciphertext), decipher.final()]).toString('utf-8'));
     }
     catch {
-        return null;
+        return ERR_INVALID_TOKEN;
     }
+    if (payload === null ||
+        typeof payload !== 'object' ||
+        typeof payload.iss !== 'string' ||
+        typeof payload.iat !== 'number' ||
+        typeof payload.identity !== 'object' ||
+        payload.identity === null)
+        return ERR_INVALID_TOKEN;
+    const now = Date.now();
+    if (payload.exp !== undefined && payload.exp * 1000 <= now)
+        return ERR_INVALID_TOKEN;
+    if (payload.nbf !== undefined && payload.nbf * 1000 > now)
+        return ERR_INVALID_TOKEN;
+    return {
+        iss: payload.iss,
+        iat: new Date(payload.iat * 1000).toISOString(),
+        ...(payload.exp === undefined
+            ? {}
+            : { exp: new Date(payload.exp * 1000).toISOString() }),
+        identity: payload.identity,
+        ...(payload.aud === undefined ? {} : { aud: payload.aud })
+    };
 }
-const ERR_INVALID_TOKEN = new Error('INVALID_TOKEN');
-//# sourceMappingURL=decrypt.js.map
+const PARTS = 5;
+const IV = 12;
+const TAG = 16;
+const importKey = ImportKeyFactory().run;
+const decryptLocal = DecryptFactory().run;
+const ERR_INVALID_TOKEN = new (class InvalidTokenError extends Error {
+    code = 'INVALID_TOKEN';
+})();
+const ERR_INVALID_KEY = new (class InvalidKeyError extends Error {
+    code = 'INVALID_KEY';
+})();
+const ERR_FORGED_KEY = new (class ForgedKeyError extends Error {
+    code = 'FORGED_KEY';
+})();
+const ERR_REVOKED_KEY = new (class RevokedKeyError extends Error {
+    code = 'REVOKED_KEY';
+})();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVjcnlwdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NvdXJjZS9kZWNyeXB0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLGFBQWEsQ0FBQTtBQUM5QyxPQUFPLEVBQUUsY0FBYyxFQUFFLGdCQUFnQixFQUFFLE1BQU0saUJBQWlCLENBQUE7QUFDbEUsT0FBTyxFQUFFLFFBQVEsRUFBRSxNQUFNLFdBQVcsQ0FBQTtBQUNwQyxPQUFPLEVBQUUsSUFBSSxFQUFFLE1BQU0sRUFBRSxNQUFNLGdCQUFnQixDQUFBO0FBSzdDLE1BQU0sT0FBTyxXQUFXO0lBQ0wsSUFBSSxHQUF3QixFQUFFLENBQUE7SUFDOUIsTUFBTSxHQUF3QixFQUFFLENBQUE7SUFDekMsS0FBSyxDQUE2QjtJQUNsQyxNQUFNLENBQVM7SUFDZixNQUFNLENBQXdDO0lBQzlDLElBQUksQ0FBa0I7SUFFdkIsS0FBSyxDQUFDLE9BQWdCO1FBQzNCLE1BQU0sTUFBTSxHQUFHLE9BQU8sQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLEVBQUUsRUFBRSxDQUFDLE1BQU0sS0FBSyxRQUFRLENBQUMsQ0FBQTtRQUVuRixJQUFJLE1BQU0sS0FBSyxTQUFTO1lBQ3RCLE1BQU0sSUFBSSxTQUFTLENBQUMseUNBQXlDLENBQUMsQ0FBQTtRQUVoRSxJQUFJLENBQUMsTUFBTSxHQUFHLE1BQU0sQ0FBQyxFQUFFLENBQUE7UUFDdkIsSUFBSSxDQUFDLE1BQU0sR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUE7UUFDMUMsSUFBSSxDQUFDLEtBQUssR0FBRyxJQUFJLFFBQVEsQ0FBbUIsT0FBTyxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsQ0FBQTtRQUN4RSxJQUFJLENBQUMsSUFBSSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUE7UUFFeEIsS0FBSyxNQUFNLEVBQUUsRUFBRSxFQUFFLEdBQUcsRUFBRSxNQUFNLEVBQUUsSUFBSSxPQUFPLENBQUMsYUFBYSxDQUFDLElBQUksRUFBRSxDQUFDO1lBQzdELE1BQU0sTUFBTSxHQUFHLE1BQU0sS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUE7WUFFNUQsTUFBTSxDQUFDLEVBQUUsQ0FBQyxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFBO1FBQ3BDLENBQUM7SUFDSCxDQUFDO0lBRU0sS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFhO1FBQ2hDLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQzdCLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLENBQUE7WUFFakMsSUFBSSxHQUFHLFlBQVksS0FBSztnQkFBRSxPQUFPLEdBQUcsQ0FBQTtZQUVwQyxNQUFNLEdBQUcsR0FBRyxNQUFNLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxFQUFFLElBQUksQ0FBQyxDQUFBO1lBRXJDLElBQUksR0FBRyxZQUFZLEtBQUs7Z0JBQUUsT0FBTyxHQUFHLENBQUE7WUFFcEMsTUFBTSxNQUFNLEdBQUcsTUFBTSxhQUFhLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQTtZQUVsRCxJQUFJLE1BQU0sWUFBWSxLQUFLO2dCQUFFLE9BQU8sTUFBTSxDQUFBO1lBRTFDLCtFQUErRTtZQUMvRSxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLEdBQUcsRUFBRSxJQUFJLENBQUMsQ0FBQTtRQUN2QyxDQUFDO1FBRUQsTUFBTSxHQUFHLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFBO1FBRXhCLElBQUksR0FBRyxZQUFZLEtBQUs7WUFBRSxPQUFPLEdBQUcsQ0FBQTtRQUVwQyxNQUFNLEdBQUcsR0FBRyxNQUFNLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRSxLQUFLLENBQUMsQ0FBQTtRQUUxQyxJQUFJLEdBQUcsWUFBWSxLQUFLO1lBQUUsT0FBTyxHQUFHLENBQUE7UUFFcEMsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUE7UUFFakMsSUFBSSxNQUFNLFlBQVksS0FBSztZQUFFLE9BQU8sTUFBTSxDQUFBO1FBRTFDLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FDaEIsTUFBTSxFQUNOLEdBQUcsRUFDSCxHQUFHLENBQUMsR0FBRyxLQUFLLElBQUksQ0FBQyxNQUFNLElBQUksR0FBRyxDQUFDLFFBQVEsS0FBSyxTQUFTLENBQ3RELENBQUE7SUFDSCxDQUFDO0lBRU8sU0FBUyxDQUFDLEtBQWE7UUFDN0IsTUFBTSxDQUFDLEVBQUUsQUFBRCxFQUFHLEFBQUQsRUFBRyxNQUFNLENBQUMsR0FBRyxLQUFLLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFBO1FBRXZDLElBQUksTUFBTSxLQUFLLFNBQVM7WUFBRSxPQUFPLGlCQUFpQixDQUFBO1FBRWxELElBQUksQ0FBQztZQUNILE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLFdBQVcsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQTtZQUMvRCxNQUFNLEVBQUUsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQTtZQUVoQyxJQUFJLE9BQU8sR0FBRyxLQUFLLFFBQVE7Z0JBQUUsT0FBTyxpQkFBaUIsQ0FBQTtZQUVyRCxPQUFPLEdBQUcsQ0FBQTtRQUNaLENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUCxPQUFPLGlCQUFpQixDQUFBO1FBQzFCLENBQUM7SUFDSCxDQUFDO0lBRUQseURBQXlEO0lBQ2pELE1BQU0sQ0FBQyxNQUFjLEVBQUUsR0FBUSxFQUFFLE9BQWdCO1FBQ3ZELElBQUksQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLGNBQWMsRUFBRSxNQUFNLENBQUMsQ0FBQTtRQUV2QyxJQUFJLEdBQUcsQ0FBQyxRQUFRLEtBQUssU0FBUyxJQUFJLE1BQU0sQ0FBQyxRQUFRLENBQUMsRUFBRSxLQUFLLEdBQUcsQ0FBQyxRQUFRO1lBQ25FLE9BQU8sY0FBYyxDQUFBO1FBRXZCLElBQUksR0FBRyxDQUFDLFNBQVMsS0FBSyxTQUFTO1lBQUUsT0FBTyxlQUFlLENBQUE7UUFFdkQsT0FBTztZQUNMLEdBQUcsRUFBRSxNQUFNLENBQUMsR0FBRztZQUNmLEdBQUcsRUFBRSxNQUFNLENBQUMsR0FBRztZQUNmLEdBQUcsRUFBRSxNQUFNLENBQUMsR0FBRztZQUNmLFFBQVEsRUFBRSxNQUFNLENBQUMsUUFBUTtZQUN6QixHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxHQUFHLEVBQUUsTUFBTSxDQUFDLEdBQUcsRUFBRSxDQUFDO1lBQ3hELE9BQU87WUFDUCxNQUFNLEVBQUUsR0FBRyxDQUFDLFFBQVEsS0FBSyxTQUFTO1NBQ25DLENBQUE7SUFDSCxDQUFDO0lBRU8sS0FBSyxDQUFDLEdBQUcsQ0FBQyxHQUFXLEVBQUUsTUFBZTtRQUM1QyxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUE7UUFFbkQsSUFBSSxHQUFHLElBQUksVUFBVTtZQUFFLE9BQU8sVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFBO1FBRTdDLElBQUksQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ3pCLE1BQU0sS0FBSyxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFFLEVBQUUsR0FBRyxFQUFFLEVBQUUsQ0FBQyxDQUFBO1lBRS9ELElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUE7UUFDaEMsQ0FBQztRQUVELE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFBO1FBRWpDLE9BQU8sS0FBSyxFQUFFLEtBQUssSUFBSSxlQUFlLENBQUE7SUFDeEMsQ0FBQztDQUNGO0FBRUQsS0FBSyxVQUFVLGFBQWEsQ0FBQyxLQUFhLEVBQUUsR0FBVztJQUNyRCxJQUFJLENBQUM7UUFDSCxNQUFNLE1BQU0sR0FBRyxNQUFNLFNBQVMsQ0FBQyxHQUEyQixDQUFDLENBQUE7UUFDM0QsaUZBQWlGO1FBQ2pGLE1BQU0sRUFBRSxNQUFNLEVBQUUsR0FBRyxNQUFNLFlBQVksQ0FBQyxNQUFNLEVBQUUsS0FBSyxFQUFFLEVBQUUsZ0JBQWdCLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQTtRQUVoRixPQUFPLE1BQTJCLENBQUE7SUFDcEMsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8saUJBQWlCLENBQUE7SUFDMUIsQ0FBQztBQUNILENBQUM7QUFFRDs7Ozs7R0FLRztBQUNILFNBQVMsS0FBSyxDQUFDLEtBQWE7SUFDMUIsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQTtJQUU5QixJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssS0FBSyxJQUFJLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxFQUFFO1FBQUUsT0FBTyxpQkFBaUIsQ0FBQTtJQUV2RSxNQUFNLENBQUMsTUFBTSxFQUFFLEFBQUQsRUFBRyxFQUFFLEVBQUUsVUFBVSxFQUFFLEdBQUcsQ0FBQyxHQUFHLEtBQUssQ0FBQTtJQUU3QyxJQUFJLFFBQWlDLENBQUE7SUFFckMsSUFBSSxDQUFDO1FBQ0gsUUFBUSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsV0FBVyxDQUFDLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUE7SUFDM0UsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8saUJBQWlCLENBQUE7SUFDMUIsQ0FBQztJQUVELElBQ0UsUUFBUSxLQUFLLElBQUk7UUFDakIsT0FBTyxRQUFRLEtBQUssUUFBUTtRQUM1QixRQUFRLENBQUMsR0FBRyxLQUFLLEtBQUs7UUFDdEIsUUFBUSxDQUFDLEdBQUcsS0FBSyxTQUFTO1FBQzFCLFFBQVEsQ0FBQyxHQUFHLEtBQUssS0FBSztRQUN0QixPQUFPLFFBQVEsQ0FBQyxHQUFHLEtBQUssUUFBUTtRQUNoQyxRQUFRLENBQUMsSUFBSSxLQUFLLFNBQVM7UUFDM0IsUUFBUSxDQUFDLEdBQUcsS0FBSyxTQUFTO1FBRTFCLE9BQU8saUJBQWlCLENBQUE7SUFFMUIsT0FBTztRQUNMLEdBQUcsRUFBRSxRQUFRLENBQUMsR0FBRztRQUNqQix1RUFBdUU7UUFDdkUsR0FBRyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLE9BQU8sQ0FBQztRQUNqQyxFQUFFLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLEVBQUUsV0FBVyxDQUFDO1FBQ2hDLFVBQVUsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxXQUFXLENBQUM7UUFDaEQsR0FBRyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLFdBQVcsQ0FBQztLQUNuQyxDQUFBO0FBQ0gsQ0FBQztBQUVELDhFQUE4RTtBQUM5RSxTQUFTLElBQUksQ0FBQyxHQUFRLEVBQUUsR0FBVztJQUNqQyxJQUFJLEdBQUcsQ0FBQyxFQUFFLENBQUMsTUFBTSxLQUFLLEVBQUUsSUFBSSxHQUFHLENBQUMsR0FBRyxDQUFDLE1BQU0sS0FBSyxHQUFHO1FBQUUsT0FBTyxpQkFBaUIsQ0FBQTtJQUU1RSxJQUFJLE9BQWtCLENBQUE7SUFFdEIsSUFBSSxDQUFDO1FBQ0gsTUFBTSxRQUFRLEdBQUcsZ0JBQWdCLENBQUMsYUFBYSxFQUFFLE1BQU0sQ0FBQyxHQUFHLENBQUMsRUFBRSxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUE7UUFFckUsUUFBUSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUE7UUFDeEIsUUFBUSxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUE7UUFFNUIsT0FBTyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQ2xCLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsRUFBRSxRQUFRLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FDckYsQ0FBQTtJQUNILENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLGlCQUFpQixDQUFBO0lBQzFCLENBQUM7SUFFRCxJQUNFLE9BQU8sS0FBSyxJQUFJO1FBQ2hCLE9BQU8sT0FBTyxLQUFLLFFBQVE7UUFDM0IsT0FBTyxPQUFPLENBQUMsR0FBRyxLQUFLLFFBQVE7UUFDL0IsT0FBTyxPQUFPLENBQUMsR0FBRyxLQUFLLFFBQVE7UUFDL0IsT0FBTyxPQUFPLENBQUMsUUFBUSxLQUFLLFFBQVE7UUFDcEMsT0FBTyxDQUFDLFFBQVEsS0FBSyxJQUFJO1FBRXpCLE9BQU8saUJBQWlCLENBQUE7SUFFMUIsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFBO0lBRXRCLElBQUksT0FBTyxDQUFDLEdBQUcsS0FBSyxTQUFTLElBQUksT0FBTyxDQUFDLEdBQUcsR0FBRyxJQUFJLElBQUksR0FBRztRQUFFLE9BQU8saUJBQWlCLENBQUE7SUFFcEYsSUFBSSxPQUFPLENBQUMsR0FBRyxLQUFLLFNBQVMsSUFBSSxPQUFPLENBQUMsR0FBRyxHQUFHLElBQUksR0FBRyxHQUFHO1FBQUUsT0FBTyxpQkFBaUIsQ0FBQTtJQUVuRixPQUFPO1FBQ0wsR0FBRyxFQUFFLE9BQU8sQ0FBQyxHQUFHO1FBQ2hCLEdBQUcsRUFBRSxJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxHQUFHLElBQUksQ0FBQyxDQUFDLFdBQVcsRUFBRTtRQUMvQyxHQUFHLENBQUMsT0FBTyxDQUFDLEdBQUcsS0FBSyxTQUFTO1lBQzNCLENBQUMsQ0FBQyxFQUFFO1lBQ0osQ0FBQyxDQUFDLEVBQUUsR0FBRyxFQUFFLElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLEdBQUcsSUFBSSxDQUFDLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQztRQUN4RCxRQUFRLEVBQUUsT0FBTyxDQUFDLFFBQVE7UUFDMUIsR0FBRyxDQUFDLE9BQU8sQ0FBQyxHQUFHLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsR0FBRyxFQUFFLE9BQU8sQ0FBQyxHQUFHLEVBQUUsQ0FBQztLQUMzRCxDQUFBO0FBQ0gsQ0FBQztBQVVELE1BQU0sS0FBSyxHQUFHLENBQUMsQ0FBQTtBQUNmLE1BQU0sRUFBRSxHQUFHLEVBQUUsQ0FBQTtBQUNiLE1BQU0sR0FBRyxHQUFHLEVBQUUsQ0FBQTtBQUVkLE1BQU0sU0FBUyxHQUFHLGdCQUFnQixFQUFFLENBQUMsR0FBRyxDQUFBO0FBQ3hDLE1BQU0sWUFBWSxHQUFHLGNBQWMsRUFBRSxDQUFDLEdBQUcsQ0FBQTtBQVl6QyxNQUFNLGlCQUFpQixHQUFHLElBQUksQ0FBQyxNQUFNLGlCQUFrQixTQUFRLEtBQUs7SUFDbEQsSUFBSSxHQUFHLGVBQWUsQ0FBQTtDQUN2QyxDQUFDLEVBQUUsQ0FBQTtBQUVKLE1BQU0sZUFBZSxHQUFHLElBQUksQ0FBQyxNQUFNLGVBQWdCLFNBQVEsS0FBSztJQUM5QyxJQUFJLEdBQUcsYUFBYSxDQUFBO0NBQ3JDLENBQUMsRUFBRSxDQUFBO0FBRUosTUFBTSxjQUFjLEdBQUcsSUFBSSxDQUFDLE1BQU0sY0FBZSxTQUFRLEtBQUs7SUFDNUMsSUFBSSxHQUFHLFlBQVksQ0FBQTtDQUNwQyxDQUFDLEVBQUUsQ0FBQTtBQUVKLE1BQU0sZUFBZSxHQUFHLElBQUksQ0FBQyxNQUFNLGVBQWdCLFNBQVEsS0FBSztJQUM5QyxJQUFJLEdBQUcsYUFBYSxDQUFBO0NBQ3JDLENBQUMsRUFBRSxDQUFBIn0=

package/components/identity.tokens/operations/encrypt.js

@@ -1,26 +1,43 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Effect = void 0;
-const paseto_1 = require("paseto");
-class Effect {
-    key = '';
-    lifetime = 0;
+import { jweKey } from './lib/index.js';
+import { load } from './lib/jose.js';
+export class Effect {
+    key;
+    lifetime;
     mount(context) {
-        this.key = context.configuration.key0;
+        const key = context.configuration.keys.find(({ format }) => format !== 'paseto');
+        if (key === undefined)
+            throw new TypeError('At least one JWE key must be configured');
+        this.key = { id: key.id, key: key.key.unwrap() };
         this.lifetime = context.configuration.lifetime * 1000;
     }
     async execute(input) {
+        const { EncryptJWT } = await load();
+        if (input.scopes?.some((scope) => !within(scope, input.identity.roles)) === true)
+            return ERR_INACCESSIBLE_SCOPE;
         const lifetime = input.lifetime === undefined ? this.lifetime : input.lifetime * 1000;
-        const exp = lifetime === 0
-            ? undefined
-            : new Date(Date.now() + lifetime).toISOString();
-        const payload = {
-            identity: input.identity,
-            aud: input.authority,
-            exp
+        const identity = {
+            id: input.identity.id,
+            roles: input.scopes ?? input.identity.roles
         };
-        return await paseto_1.V3.encrypt(payload, this.key);
+        const permissions = input.permissions ?? input.identity.permissions;
+        if (permissions !== undefined)
+            identity.permissions = permissions;
+        const key = input.key ?? this.key;
+        let token = new EncryptJWT({ identity })
+            .setProtectedHeader({ alg: 'dir', enc: 'A256GCM', typ: 'JWT', kid: key.id })
+            .setIssuer(input.authority)
+            .setIssuedAt(Date.now() / 1000);
+        if (input.audience !== undefined && input.audience.length > 0)
+            token = token.setAudience(input.audience.length === 1 ? input.audience[0] : input.audience);
+        if (lifetime !== 0)
+            token = token.setExpirationTime((Date.now() + lifetime) / 1000);
+        return await token.encrypt(jweKey(key.key));
     }
 }
-exports.Effect = Effect;
-//# sourceMappingURL=encrypt.js.map
+function within(scope, roles) {
+    return roles.some((role) => role === scope || scope.startsWith(role + ':'));
+}
+const ERR_INACCESSIBLE_SCOPE = new (class InaccessibleScopeError extends Error {
+    code = 'INACCESSIBLE_SCOPE';
+})();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW5jcnlwdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NvdXJjZS9lbmNyeXB0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxNQUFNLEVBQUUsTUFBTSxnQkFBZ0IsQ0FBQTtBQUN2QyxPQUFPLEVBQUUsSUFBSSxFQUFFLE1BQU0sZUFBZSxDQUFBO0FBS3BDLE1BQU0sT0FBTyxNQUFNO0lBQ1QsR0FBRyxDQUEwQjtJQUM3QixRQUFRLENBQVM7SUFFbEIsS0FBSyxDQUFDLE9BQWdCO1FBQzNCLE1BQU0sR0FBRyxHQUFHLE9BQU8sQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLEVBQUUsRUFBRSxDQUFDLE1BQU0sS0FBSyxRQUFRLENBQUMsQ0FBQTtRQUVoRixJQUFJLEdBQUcsS0FBSyxTQUFTO1lBQUUsTUFBTSxJQUFJLFNBQVMsQ0FBQyx5Q0FBeUMsQ0FBQyxDQUFBO1FBRXJGLElBQUksQ0FBQyxHQUFHLEdBQUcsRUFBRSxFQUFFLEVBQUUsR0FBRyxDQUFDLEVBQUUsRUFBRSxHQUFHLEVBQUUsR0FBRyxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFBO1FBQ2hELElBQUksQ0FBQyxRQUFRLEdBQUcsT0FBTyxDQUFDLGFBQWEsQ0FBQyxRQUFRLEdBQUcsSUFBSSxDQUFBO0lBQ3ZELENBQUM7SUFFTSxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQW1CO1FBQ3RDLE1BQU0sRUFBRSxVQUFVLEVBQUUsR0FBRyxNQUFNLElBQUksRUFBRSxDQUFBO1FBRW5DLElBQUksS0FBSyxDQUFDLE1BQU0sRUFBRSxJQUFJLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxLQUFLLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLEtBQUssSUFBSTtZQUM5RSxPQUFPLHNCQUFzQixDQUFBO1FBRS9CLE1BQU0sUUFBUSxHQUFHLEtBQUssQ0FBQyxRQUFRLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsUUFBUSxHQUFHLElBQUksQ0FBQTtRQUVyRixNQUFNLFFBQVEsR0FBYTtZQUN6QixFQUFFLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxFQUFFO1lBQ3JCLEtBQUssRUFBRSxLQUFLLENBQUMsTUFBTSxJQUFJLEtBQUssQ0FBQyxRQUFRLENBQUMsS0FBSztTQUM1QyxDQUFBO1FBRUQsTUFBTSxXQUFXLEdBQUcsS0FBSyxDQUFDLFdBQVcsSUFBSSxLQUFLLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQTtRQUVuRSxJQUFJLFdBQVcsS0FBSyxTQUFTO1lBQUUsUUFBUSxDQUFDLFdBQVcsR0FBRyxXQUFXLENBQUE7UUFFakUsTUFBTSxHQUFHLEdBQUcsS0FBSyxDQUFDLEdBQUcsSUFBSSxJQUFJLENBQUMsR0FBRyxDQUFBO1FBRWpDLElBQUksS0FBSyxHQUFHLElBQUksVUFBVSxDQUFDLEVBQUUsUUFBUSxFQUFFLENBQUM7YUFDckMsa0JBQWtCLENBQUMsRUFBRSxHQUFHLEVBQUUsS0FBSyxFQUFFLEdBQUcsRUFBRSxTQUFTLEVBQUUsR0FBRyxFQUFFLEtBQUssRUFBRSxHQUFHLEVBQUUsR0FBRyxDQUFDLEVBQUUsRUFBRSxDQUFDO2FBQzNFLFNBQVMsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDO2FBQzFCLFdBQVcsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDLENBQUE7UUFFakMsSUFBSSxLQUFLLENBQUMsUUFBUSxLQUFLLFNBQVMsSUFBSSxLQUFLLENBQUMsUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDO1lBQzNELEtBQUssR0FBRyxLQUFLLENBQUMsV0FBVyxDQUN2QixLQUFLLENBQUMsUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQ2pFLENBQUE7UUFFSCxJQUFJLFFBQVEsS0FBSyxDQUFDO1lBQUUsS0FBSyxHQUFHLEtBQUssQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsR0FBRyxRQUFRLENBQUMsR0FBRyxJQUFJLENBQUMsQ0FBQTtRQUVuRixPQUFPLE1BQU0sS0FBSyxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUE7SUFDN0MsQ0FBQztDQUNGO0FBRUQsU0FBUyxNQUFNLENBQUMsS0FBYSxFQUFFLEtBQWU7SUFDNUMsT0FBTyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxJQUFJLEtBQUssS0FBSyxJQUFJLEtBQUssQ0FBQyxVQUFVLENBQUMsSUFBSSxHQUFHLEdBQUcsQ0FBQyxDQUFDLENBQUE7QUFDN0UsQ0FBQztBQUVELE1BQU0sc0JBQXNCLEdBQUcsSUFBSSxDQUFDLE1BQU0sc0JBQXVCLFNBQVEsS0FBSztJQUM1RCxJQUFJLEdBQUcsb0JBQW9CLENBQUE7Q0FDNUMsQ0FBQyxFQUFFLENBQUEifQ==

package/components/identity.tokens/operations/issue.js

@@ -0,0 +1,56 @@
+import { quote } from '@toa.io/generic';
+export class Effect {
+    keys;
+    roles;
+    encrypt;
+    lifetime;
+    mount(context) {
+        this.keys = context.remote.identity.keys;
+        this.roles = context.remote.identity.roles;
+        this.encrypt = context.local.encrypt;
+        // seconds, as `input.lifetime` and `encrypt` both are
+        this.lifetime = context.configuration.lifetime;
+    }
+    async execute(input) {
+        const lifetime = input.lifetime ?? this.lifetime;
+        const expires = lifetime === 0 ? undefined : new Date(Date.now() + lifetime * 1000).getTime();
+        const key = await this.keys.create({
+            input: {
+                identity: input.identity,
+                label: input.label,
+                expires
+            }
+        });
+        const roles = await this.roles.list({
+            query: {
+                criteria: `identity==${quote(input.identity)}`,
+                limit: 1024
+            }
+        });
+        const identity = {
+            id: input.identity,
+            roles
+        };
+        const { authority, scopes, permissions, audience } = input;
+        const token = await this.encrypt({
+            input: {
+                authority,
+                identity,
+                lifetime,
+                scopes,
+                permissions,
+                audience,
+                key
+            }
+        });
+        if (token instanceof Error)
+            return token;
+        return {
+            kid: key.id,
+            // technically, the token expires some time later
+            ...(expires !== undefined && { exp: expires }),
+            token
+        };
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaXNzdWUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zb3VyY2UvaXNzdWUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLEtBQUssRUFBRSxNQUFNLGlCQUFpQixDQUFBO0FBS3ZDLE1BQU0sT0FBTyxNQUFNO0lBQ1QsSUFBSSxDQUF3QztJQUM1QyxLQUFLLENBQXlDO0lBQzlDLE9BQU8sQ0FBOEI7SUFDckMsUUFBUSxDQUFTO0lBRWxCLEtBQUssQ0FBQyxPQUFnQjtRQUMzQixJQUFJLENBQUMsSUFBSSxHQUFHLE9BQU8sQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQTtRQUN4QyxJQUFJLENBQUMsS0FBSyxHQUFHLE9BQU8sQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQTtRQUMxQyxJQUFJLENBQUMsT0FBTyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFBO1FBQ3BDLHNEQUFzRDtRQUN0RCxJQUFJLENBQUMsUUFBUSxHQUFHLE9BQU8sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFBO0lBQ2hELENBQUM7SUFFTSxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQVk7UUFDL0IsTUFBTSxRQUFRLEdBQUcsS0FBSyxDQUFDLFFBQVEsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFBO1FBRWhELE1BQU0sT0FBTyxHQUNYLFFBQVEsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLFFBQVEsR0FBRyxJQUFJLENBQUMsQ0FBQyxPQUFPLEVBQUUsQ0FBQTtRQUUvRSxNQUFNLEdBQUcsR0FBRyxNQUFNLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDO1lBQ2pDLEtBQUssRUFBRTtnQkFDTCxRQUFRLEVBQUUsS0FBSyxDQUFDLFFBQVE7Z0JBQ3hCLEtBQUssRUFBRSxLQUFLLENBQUMsS0FBSztnQkFDbEIsT0FBTzthQUNSO1NBQ0YsQ0FBQyxDQUFBO1FBRUYsTUFBTSxLQUFLLEdBQUcsTUFBTSxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQztZQUNsQyxLQUFLLEVBQUU7Z0JBQ0wsUUFBUSxFQUFFLGFBQWEsS0FBSyxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsRUFBRTtnQkFDOUMsS0FBSyxFQUFFLElBQUk7YUFDWjtTQUNGLENBQUMsQ0FBQTtRQUVGLE1BQU0sUUFBUSxHQUFhO1lBQ3pCLEVBQUUsRUFBRSxLQUFLLENBQUMsUUFBUTtZQUNsQixLQUFLO1NBQ04sQ0FBQTtRQUVELE1BQU0sRUFBRSxTQUFTLEVBQUUsTUFBTSxFQUFFLFdBQVcsRUFBRSxRQUFRLEVBQUUsR0FBRyxLQUFLLENBQUE7UUFFMUQsTUFBTSxLQUFLLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDO1lBQy9CLEtBQUssRUFBRTtnQkFDTCxTQUFTO2dCQUNULFFBQVE7Z0JBQ1IsUUFBUTtnQkFDUixNQUFNO2dCQUNOLFdBQVc7Z0JBQ1gsUUFBUTtnQkFDUixHQUFHO2FBQ0o7U0FDRixDQUFDLENBQUE7UUFFRixJQUFJLEtBQUssWUFBWSxLQUFLO1lBQUUsT0FBTyxLQUFLLENBQUE7UUFFeEMsT0FBTztZQUNMLEdBQUcsRUFBRSxHQUFHLENBQUMsRUFBRTtZQUNYLGlEQUFpRDtZQUNqRCxHQUFHLENBQUMsT0FBTyxLQUFLLFNBQVMsSUFBSSxFQUFFLEdBQUcsRUFBRSxPQUFPLEVBQUUsQ0FBQztZQUM5QyxLQUFLO1NBQ04sQ0FBQTtJQUNILENBQUM7Q0FDRiJ9

package/components/identity.tokens/operations/lib/form.js

@@ -0,0 +1,24 @@
+/**
+ * The form of a token this component issues, or nothing for a credential it did not:
+ * a compact JWE has five segments, where a JWS — an OpenID `id_token`, say — has three.
+ * Read without decrypting, and without trusting: a credential that lies about its form
+ * only reaches a verifier that rejects it.
+ */
+export function form(token) {
+    if (token.startsWith(PASETO))
+        return 'paseto';
+    if (segments(token) === JWE_SEGMENTS)
+        return 'jwe';
+    return null;
+}
+function segments(token) {
+    let count = 1;
+    for (let i = 0; i < token.length; i++)
+        if (token.charCodeAt(i) === DOT)
+            count++;
+    return count;
+}
+const PASETO = 'v3.local.';
+const JWE_SEGMENTS = 5;
+const DOT = 46;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZm9ybS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS9saWIvZm9ybS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7Ozs7R0FLRztBQUNILE1BQU0sVUFBVSxJQUFJLENBQUMsS0FBYTtJQUNoQyxJQUFJLEtBQUssQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDO1FBQUUsT0FBTyxRQUFRLENBQUE7SUFFN0MsSUFBSSxRQUFRLENBQUMsS0FBSyxDQUFDLEtBQUssWUFBWTtRQUFFLE9BQU8sS0FBSyxDQUFBO0lBRWxELE9BQU8sSUFBSSxDQUFBO0FBQ2IsQ0FBQztBQUVELFNBQVMsUUFBUSxDQUFDLEtBQWE7SUFDN0IsSUFBSSxLQUFLLEdBQUcsQ0FBQyxDQUFBO0lBRWIsS0FBSyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxHQUFHLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQyxFQUFFO1FBQUUsSUFBSSxLQUFLLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxLQUFLLEdBQUc7WUFBRSxLQUFLLEVBQUUsQ0FBQTtJQUUvRSxPQUFPLEtBQUssQ0FBQTtBQUNkLENBQUM7QUFFRCxNQUFNLE1BQU0sR0FBRyxXQUFXLENBQUE7QUFDMUIsTUFBTSxZQUFZLEdBQUcsQ0FBQyxDQUFBO0FBQ3RCLE1BQU0sR0FBRyxHQUFHLEVBQUUsQ0FBQSJ9

package/components/identity.tokens/operations/lib/index.js

@@ -0,0 +1,4 @@
+export * from './form.js';
+export * from './pad.js';
+export { jweKey } from './key.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zb3VyY2UvbGliL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsV0FBVyxDQUFBO0FBQ3pCLGNBQWMsVUFBVSxDQUFBO0FBRXhCLE9BQU8sRUFBRSxNQUFNLEVBQUUsTUFBTSxVQUFVLENBQUEifQ==

package/components/identity.tokens/operations/lib/jose.js

@@ -0,0 +1,5 @@
+/** @type {Promise<typeof import('jose')> | undefined} */
+let loading;
+// resolved once: an import per call resolves the module again on every token
+export const load = () => (loading ??= import('jose'));
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiam9zZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS9saWIvam9zZS5qcyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSx5REFBeUQ7QUFDekQsSUFBSSxPQUFPLENBQUE7QUFFWCw2RUFBNkU7QUFDN0UsTUFBTSxDQUFDLE1BQU0sSUFBSSxHQUFHLEdBQUcsRUFBRSxDQUFDLENBQUMsT0FBTyxLQUFLLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFBIn0=

package/components/identity.tokens/operations/lib/key.js

@@ -0,0 +1,7 @@
+export function jweKey(value) {
+    const key = Buffer.from(value, 'base64url');
+    if (key.length !== 32 || key.toString('base64url') !== value)
+        throw new TypeError('JWE key must be a base64url-encoded 256-bit secret');
+    return new Uint8Array(key);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoia2V5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc291cmNlL2xpYi9rZXkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsTUFBTSxVQUFVLE1BQU0sQ0FBQyxLQUFhO0lBQ2xDLE1BQU0sR0FBRyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLFdBQVcsQ0FBQyxDQUFBO0lBRTNDLElBQUksR0FBRyxDQUFDLE1BQU0sS0FBSyxFQUFFLElBQUksR0FBRyxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsS0FBSyxLQUFLO1FBQzFELE1BQU0sSUFBSSxTQUFTLENBQUMsb0RBQW9ELENBQUMsQ0FBQTtJQUUzRSxPQUFPLElBQUksVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFBO0FBQzVCLENBQUMifQ==

package/components/identity.tokens/operations/lib/pad.js

@@ -0,0 +1,2 @@
+export const PAD = 'v3.local.';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGFkLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc291cmNlL2xpYi9wYWQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsTUFBTSxDQUFDLE1BQU0sR0FBRyxHQUFHLFdBQVcsQ0FBQSJ9

package/components/identity.tokens/operations/revoke.js

@@ -1,8 +1,4 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.transition = void 0;
-function transition(_, object) {
+export function transition(_, object) {
     object.revokedAt = Date.now();
 }
-exports.transition = transition;
-//# sourceMappingURL=revoke.js.map
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmV2b2tlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL3Jldm9rZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFFQSxNQUFNLFVBQVUsVUFBVSxDQUFDLENBQVUsRUFBRSxNQUFjO0lBQ25ELE1BQU0sQ0FBQyxTQUFTLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFBO0FBQy9CLENBQUMifQ==

package/components/identity.tokens/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "identity.tokens",
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "jose": "6.2.10",
+    "lru-cache": "11.5.2",
+    "paseto": "4.0.0"
+  }
+}

package/components/identity.tokens/receivers/identity.bans.created.js

@@ -1,3 +1 @@
-'use strict'
-
-exports.request = (payload) => ({ query: { id: payload.id } })
+export const request = (payload) => ({ query: { id: payload.id } })

package/components/identity.tokens/receivers/identity.bans.updated.js

@@ -1,3 +1 @@
-'use strict'
-
-exports.request = (payload) => ({ query: { id: payload.id } })
+export const request = (payload) => ({ query: { id: payload.id } })

package/components/identity.tokens/source/authenticate.ts

@@ -1,46 +1,66 @@
-import { type Maybe, type Operation } from '@toa.io/types'
-import type { AuthenticateInput, AuthenticateOutput, Context } from './types'
+import type { Maybe } from '@toa.io/core/types'
+import type { Operation } from '@toa.io/bridges.node'
+import { form } from './lib/index.ts'
+import type { AuthenticateInput, AuthenticateOutput, Context } from './lib/index.ts'
 
 export class Computation implements Operation {
   private refresh: number = 0
-  private decrypt: Context['local']['decrypt'] = undefined as unknown as Context['local']['decrypt']
-  private observe: Context['local']['observe'] = undefined as unknown as Context['local']['observe']
+  private decrypt!: Context['local']['decrypt']
+  private observe!: Context['local']['observe']
 
-  public mount (context: Context): void {
+  public mount(context: Context): void {
     this.refresh = context.configuration.refresh * 1000
     this.decrypt = context.local.decrypt
     this.observe = context.local.observe
   }
 
-  public async execute (input: AuthenticateInput): Promise<Maybe<AuthenticateOutput>> {
-    const claim = await this.decrypt({ input: input.credentials })
+  public async execute(input: AuthenticateInput): Promise<Maybe<AuthenticateOutput>> {
+    // `Bearer` is presented by an OpenID id_token too, and the gateway asks each provider
+    // in turn: a credential this component did not issue is declined, not rejected
+    if (form(input.credentials) === null) return ERR_UNRECOGNIZED
 
-    if (claim instanceof Error)
-      return claim
+    const claims = await this.decrypt({ input: input.credentials })
 
-    if (claim.authority !== input.authority)
-      return ERR_AUTHORITY
+    if (claims instanceof Error) return claims
 
-    const identity = claim.identity
-    const iat = new Date(claim.iat).getTime()
-    const transient = claim.exp !== undefined
-    const stale = transient && (iat + this.refresh < Date.now())
+    if (claims.iss !== input.authority) return ERR_AUTHORITY
 
-    if (stale) {
+    const identity = claims.identity
+    const iat = new Date(claims.iat).getTime()
+    const transient = claims.exp !== undefined
+    const aged = transient && iat + this.refresh < Date.now()
+
+    if (aged) {
       const revocation = await this.observe({ query: { id: identity.id } })
 
       if (revocation?.revokedAt !== undefined && iat < revocation.revokedAt)
         return ERR_TOKEN_REVOKED
     }
 
-    const refresh = stale || claim.refresh
+    // a custom token is invalidated by deleting its key, not replaced
+    const refresh = (aged && !claims.custom) || claims.refresh
 
     return {
-      identity,
+      identity: claims.aud === undefined ? identity : { ...identity, aud: list(claims.aud) },
       refresh
     }
   }
 }
 
-const ERR_AUTHORITY = new Error('AUTHORITY_MISMATCH')
-const ERR_TOKEN_REVOKED = new Error('TOKEN_REVOKED')
+function list(aud: string | unknown[]): string[] {
+  if (typeof aud === 'string') return [aud]
+
+  return aud.filter((value): value is string => typeof value === 'string')
+}
+
+const ERR_UNRECOGNIZED = new (class UnrecognizedError extends Error {
+  public readonly code = 'UNRECOGNIZED'
+})()
+
+const ERR_AUTHORITY = new (class AuthorityMismatchError extends Error {
+  public readonly code = 'AUTHORITY_MISMATCH'
+})()
+
+const ERR_TOKEN_REVOKED = new (class TokenRevokedError extends Error {
+  public readonly code = 'TOKEN_REVOKED'
+})()