@toa.io/extensions.exposition 1.0.0-alpha.31 → 1.0.0-alpha.310

package/components/identity.federation/operations/lib/exchange.js

@@ -0,0 +1,90 @@
+import { load } from './jose.js';
+import { createRemoteJWKSet, discover } from './discovery.js';
+import * as errors from './errors.js';
+export async function exchange(credentials, ctx) {
+    const jose = await load();
+    const properties = decode(credentials);
+    if (properties instanceof Error)
+        return properties;
+    const { code, iss, for: redirect } = properties;
+    const trusted = ctx.trust.find((trust) => trust.iss === iss);
+    if (trusted === undefined)
+        return errors.ERR_TRUST;
+    if (trusted.aud === undefined ||
+        (trusted.secret === undefined && trusted.signature === undefined))
+        return errors.ERR_CODE_NOT_ENABLED;
+    const configuration = await discover(iss, ctx.fetch);
+    if (configuration.token_endpoint === undefined)
+        return errors.ERR_CONFIG;
+    // array actually is not expected here, but it is a valid format
+    const aud = Array.isArray(trusted.aud) ? trusted.aud[0] : trusted.aud;
+    const secret = trusted.secret === undefined ? await sign(trusted) : trusted.secret.unwrap();
+    const params = new URLSearchParams();
+    params.append('grant_type', 'authorization_code');
+    params.append('code', code);
+    params.append('client_id', aud);
+    params.append('client_secret', secret);
+    params.append('redirect_uri', redirect);
+    ctx.logs.debug('Exchanging code', {
+        iss,
+        aud,
+        for: redirect,
+        auth: trusted.secret === undefined ? 'signature' : 'secret'
+    });
+    const response = await ctx.fetch(configuration.token_endpoint, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded'
+        },
+        body: params
+    });
+    if (!response.ok) {
+        ctx.logs.error('Code exchange failed', {
+            status: response.status,
+            text: await response.text()
+        });
+        return errors.ERR_RESPONSE;
+    }
+    const tokens = (await response.json());
+    if (tokens.id_token === undefined)
+        return errors.ERR_NO_TOKEN;
+    const jwks = await createRemoteJWKSet(iss, ctx.fetch);
+    try {
+        const { payload } = await jose.jwtVerify(tokens.id_token, jwks, {
+            issuer: iss,
+            audience: trusted.aud,
+            requiredClaims: ['exp']
+        });
+        return payload;
+    }
+    catch {
+        return errors.ERR_TOKEN;
+    }
+}
+function decode(credentials) {
+    const json = Buffer.from(credentials, 'base64').toString('utf8');
+    const properties = JSON.parse(json);
+    if (typeof properties.code !== 'string' ||
+        typeof properties.iss !== 'string' ||
+        typeof properties.for !== 'string' ||
+        Object.keys(properties).length !== CREDENTIAL_PROPERTIES.length)
+        return errors.ERR_CODE_SCHEMA;
+    return properties;
+}
+async function sign(trust) {
+    const jose = await load();
+    const signature = trust.signature;
+    const aud = Array.isArray(trust.aud) ? trust.aud[0] : trust.aud;
+    const now = Math.floor(Date.now() / 1000);
+    const key = await jose.importPKCS8(signature.key.unwrap(), 'ES256');
+    return await new jose.SignJWT({})
+        .setProtectedHeader({ alg: 'ES256', kid: signature.kid })
+        .setIssuedAt(now)
+        .setExpirationTime(now + 300)
+        .setIssuer(signature.iss)
+        .setSubject(aud)
+        .setAudience(trust.iss)
+        .sign(key);
+}
+const CREDENTIAL_PROPERTIES = ['for', 'iss', 'code'];
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXhjaGFuZ2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zb3VyY2UvbGliL2V4Y2hhbmdlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxJQUFJLEVBQUUsTUFBTSxXQUFXLENBQUE7QUFDaEMsT0FBTyxFQUFFLGtCQUFrQixFQUFFLFFBQVEsRUFBRSxNQUFNLGdCQUFnQixDQUFBO0FBQzdELE9BQU8sS0FBSyxNQUFNLE1BQU0sYUFBYSxDQUFBO0FBS3JDLE1BQU0sQ0FBQyxLQUFLLFVBQVUsUUFBUSxDQUFDLFdBQW1CLEVBQUUsR0FBUTtJQUMxRCxNQUFNLElBQUksR0FBRyxNQUFNLElBQUksRUFBRSxDQUFBO0lBQ3pCLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxXQUFXLENBQUMsQ0FBQTtJQUV0QyxJQUFJLFVBQVUsWUFBWSxLQUFLO1FBQUUsT0FBTyxVQUFVLENBQUE7SUFFbEQsTUFBTSxFQUFFLElBQUksRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLFFBQVEsRUFBRSxHQUFHLFVBQVUsQ0FBQTtJQUUvQyxNQUFNLE9BQU8sR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLEdBQUcsS0FBSyxHQUFHLENBQUMsQ0FBQTtJQUU1RCxJQUFJLE9BQU8sS0FBSyxTQUFTO1FBQUUsT0FBTyxNQUFNLENBQUMsU0FBUyxDQUFBO0lBRWxELElBQ0UsT0FBTyxDQUFDLEdBQUcsS0FBSyxTQUFTO1FBQ3pCLENBQUMsT0FBTyxDQUFDLE1BQU0sS0FBSyxTQUFTLElBQUksT0FBTyxDQUFDLFNBQVMsS0FBSyxTQUFTLENBQUM7UUFFakUsT0FBTyxNQUFNLENBQUMsb0JBQW9CLENBQUE7SUFFcEMsTUFBTSxhQUFhLEdBQUcsTUFBTSxRQUFRLENBQUMsR0FBRyxFQUFFLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQTtJQUVwRCxJQUFJLGFBQWEsQ0FBQyxjQUFjLEtBQUssU0FBUztRQUFFLE9BQU8sTUFBTSxDQUFDLFVBQVUsQ0FBQTtJQUV4RSxnRUFBZ0U7SUFDaEUsTUFBTSxHQUFHLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUE7SUFDckUsTUFBTSxNQUFNLEdBQ1YsT0FBTyxDQUFDLE1BQU0sS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFBO0lBQzlFLE1BQU0sTUFBTSxHQUFHLElBQUksZUFBZSxFQUFFLENBQUE7SUFFcEMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxZQUFZLEVBQUUsb0JBQW9CLENBQUMsQ0FBQTtJQUNqRCxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxJQUFJLENBQUMsQ0FBQTtJQUMzQixNQUFNLENBQUMsTUFBTSxDQUFDLFdBQVcsRUFBRSxHQUFHLENBQUMsQ0FBQTtJQUMvQixNQUFNLENBQUMsTUFBTSxDQUFDLGVBQWUsRUFBRSxNQUFNLENBQUMsQ0FBQTtJQUN0QyxNQUFNLENBQUMsTUFBTSxDQUFDLGNBQWMsRUFBRSxRQUFRLENBQUMsQ0FBQTtJQUV2QyxHQUFHLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxpQkFBaUIsRUFBRTtRQUNoQyxHQUFHO1FBQ0gsR0FBRztRQUNILEdBQUcsRUFBRSxRQUFRO1FBQ2IsSUFBSSxFQUFFLE9BQU8sQ0FBQyxNQUFNLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLFFBQVE7S0FDNUQsQ0FBQyxDQUFBO0lBRUYsTUFBTSxRQUFRLEdBQUcsTUFBTSxHQUFHLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FBQyxjQUFjLEVBQUU7UUFDN0QsTUFBTSxFQUFFLE1BQU07UUFDZCxPQUFPLEVBQUU7WUFDUCxjQUFjLEVBQUUsbUNBQW1DO1NBQ3BEO1FBQ0QsSUFBSSxFQUFFLE1BQU07S0FDYixDQUFDLENBQUE7SUFFRixJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsRUFBRSxDQUFDO1FBQ2pCLEdBQUcsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLHNCQUFzQixFQUFFO1lBQ3JDLE1BQU0sRUFBRSxRQUFRLENBQUMsTUFBTTtZQUN2QixJQUFJLEVBQUUsTUFBTSxRQUFRLENBQUMsSUFBSSxFQUFFO1NBQzVCLENBQUMsQ0FBQTtRQUVGLE9BQU8sTUFBTSxDQUFDLFlBQVksQ0FBQTtJQUM1QixDQUFDO0lBRUQsTUFBTSxNQUFNLEdBQUcsQ0FBQyxNQUFNLFFBQVEsQ0FBQyxJQUFJLEVBQUUsQ0FBeUIsQ0FBQTtJQUU5RCxJQUFJLE1BQU0sQ0FBQyxRQUFRLEtBQUssU0FBUztRQUFFLE9BQU8sTUFBTSxDQUFDLFlBQVksQ0FBQTtJQUU3RCxNQUFNLElBQUksR0FBRyxNQUFNLGtCQUFrQixDQUFDLEdBQUcsRUFBRSxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUE7SUFFckQsSUFBSSxDQUFDO1FBQ0gsTUFBTSxFQUFFLE9BQU8sRUFBRSxHQUFHLE1BQU0sSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFLElBQUksRUFBRTtZQUM5RCxNQUFNLEVBQUUsR0FBRztZQUNYLFFBQVEsRUFBRSxPQUFPLENBQUMsR0FBRztZQUNyQixjQUFjLEVBQUUsQ0FBQyxLQUFLLENBQUM7U0FDeEIsQ0FBQyxDQUFBO1FBRUYsT0FBTyxPQUFrQixDQUFBO0lBQzNCLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLE1BQU0sQ0FBQyxTQUFTLENBQUE7SUFDekIsQ0FBQztBQUNILENBQUM7QUFFRCxTQUFTLE1BQU0sQ0FBQyxXQUFtQjtJQUNqQyxNQUFNLElBQUksR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLFdBQVcsRUFBRSxRQUFRLENBQUMsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUE7SUFDaEUsTUFBTSxVQUFVLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQWUsQ0FBQTtJQUVqRCxJQUNFLE9BQU8sVUFBVSxDQUFDLElBQUksS0FBSyxRQUFRO1FBQ25DLE9BQU8sVUFBVSxDQUFDLEdBQUcsS0FBSyxRQUFRO1FBQ2xDLE9BQU8sVUFBVSxDQUFDLEdBQUcsS0FBSyxRQUFRO1FBQ2xDLE1BQU0sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUMsTUFBTSxLQUFLLHFCQUFxQixDQUFDLE1BQU07UUFFL0QsT0FBTyxNQUFNLENBQUMsZUFBZSxDQUFBO0lBRS9CLE9BQU8sVUFBVSxDQUFBO0FBQ25CLENBQUM7QUFFRCxLQUFLLFVBQVUsSUFBSSxDQUFDLEtBQVk7SUFDOUIsTUFBTSxJQUFJLEdBQUcsTUFBTSxJQUFJLEVBQUUsQ0FBQTtJQUN6QixNQUFNLFNBQVMsR0FBRyxLQUFLLENBQUMsU0FBVSxDQUFBO0lBQ2xDLE1BQU0sR0FBRyxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBSSxDQUFBO0lBQ2hFLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQyxDQUFBO0lBQ3pDLE1BQU0sR0FBRyxHQUFHLE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxFQUFFLE9BQU8sQ0FBQyxDQUFBO0lBRW5FLE9BQU8sTUFBTSxJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1NBQzlCLGtCQUFrQixDQUFDLEVBQUUsR0FBRyxFQUFFLE9BQU8sRUFBRSxHQUFHLEVBQUUsU0FBUyxDQUFDLEdBQUcsRUFBRSxDQUFDO1NBQ3hELFdBQVcsQ0FBQyxHQUFHLENBQUM7U0FDaEIsaUJBQWlCLENBQUMsR0FBRyxHQUFHLEdBQUcsQ0FBQztTQUM1QixTQUFTLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQztTQUN4QixVQUFVLENBQUMsR0FBRyxDQUFDO1NBQ2YsV0FBVyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUM7U0FDdEIsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFBO0FBQ2QsQ0FBQztBQUVELE1BQU0scUJBQXFCLEdBQTRCLENBQUMsS0FBSyxFQUFFLEtBQUssRUFBRSxNQUFNLENBQUMsQ0FBQSJ9

package/components/identity.federation/operations/lib/index.js

@@ -0,0 +1,5 @@
+export { decode } from './decode.js';
+export { exchange } from './exchange.js';
+export { principal } from './principal.js';
+export { resolve } from './resolve.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zb3VyY2UvbGliL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxNQUFNLEVBQUUsTUFBTSxhQUFhLENBQUE7QUFDcEMsT0FBTyxFQUFFLFFBQVEsRUFBRSxNQUFNLGVBQWUsQ0FBQTtBQUN4QyxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0sZ0JBQWdCLENBQUE7QUFDMUMsT0FBTyxFQUFFLE9BQU8sRUFBRSxNQUFNLGNBQWMsQ0FBQSJ9

package/components/identity.federation/operations/lib/jose.js

@@ -0,0 +1,2 @@
+export const load = async () => await import('jose');
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiam9zZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS9saWIvam9zZS5qcyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxNQUFNLENBQUMsTUFBTSxJQUFJLEdBQUcsS0FBSyxJQUFJLEVBQUUsQ0FBQyxNQUFNLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQSJ9

package/components/identity.federation/operations/lib/principal.js

@@ -0,0 +1,14 @@
+/**
+ * The `system` Role is granted where the credentials are created, before the reply that mints
+ * a Token from them — the event that carries the same grant lands after it.
+ */
+export async function principal(credential, context) {
+    const configured = context.configuration.principal;
+    if (configured === undefined ||
+        configured.authority !== credential.authority ||
+        configured.iss !== credential.iss ||
+        configured.sub !== credential.sub)
+        return;
+    await context.remote.identity.roles.principal({ input: { id: credential.identity } });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJpbmNpcGFsLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc291cmNlL2xpYi9wcmluY2lwYWwudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBRUE7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSxTQUFTLENBQUMsVUFBa0IsRUFBRSxPQUFnQjtJQUNsRSxNQUFNLFVBQVUsR0FBRyxPQUFPLENBQUMsYUFBYSxDQUFDLFNBQVMsQ0FBQTtJQUVsRCxJQUNFLFVBQVUsS0FBSyxTQUFTO1FBQ3hCLFVBQVUsQ0FBQyxTQUFTLEtBQUssVUFBVSxDQUFDLFNBQVM7UUFDN0MsVUFBVSxDQUFDLEdBQUcsS0FBSyxVQUFVLENBQUMsR0FBRztRQUNqQyxVQUFVLENBQUMsR0FBRyxLQUFLLFVBQVUsQ0FBQyxHQUFHO1FBRWpDLE9BQU07SUFFUixNQUFNLE9BQU8sQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFFLEVBQUUsVUFBVSxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FBQTtBQUN2RixDQUFDIn0=

package/components/identity.federation/operations/lib/resolve.js

@@ -0,0 +1,13 @@
+import { decode } from './decode.js';
+import { exchange } from './exchange.js';
+export async function resolve(scheme, credentials, context) {
+    const ctx = {
+        trust: context.configuration.trust,
+        logs: context.logs,
+        fetch: context.fetch
+    };
+    return scheme === 'bearer'
+        ? await decode(credentials, ctx)
+        : await exchange(credentials, ctx);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVzb2x2ZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS9saWIvcmVzb2x2ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsTUFBTSxFQUFFLE1BQU0sYUFBYSxDQUFBO0FBQ3BDLE9BQU8sRUFBRSxRQUFRLEVBQUUsTUFBTSxlQUFlLENBQUE7QUFLeEMsTUFBTSxDQUFDLEtBQUssVUFBVSxPQUFPLENBQzNCLE1BQWMsRUFDZCxXQUFtQixFQUNuQixPQUFnQjtJQUVoQixNQUFNLEdBQUcsR0FBUTtRQUNmLEtBQUssRUFBRSxPQUFPLENBQUMsYUFBYSxDQUFDLEtBQUs7UUFDbEMsSUFBSSxFQUFFLE9BQU8sQ0FBQyxJQUFJO1FBQ2xCLEtBQUssRUFBRSxPQUFPLENBQUMsS0FBSztLQUNyQixDQUFBO0lBRUQsT0FBTyxNQUFNLEtBQUssUUFBUTtRQUN4QixDQUFDLENBQUMsTUFBTSxNQUFNLENBQUMsV0FBVyxFQUFFLEdBQUcsQ0FBQztRQUNoQyxDQUFDLENBQUMsTUFBTSxRQUFRLENBQUMsV0FBVyxFQUFFLEdBQUcsQ0FBQyxDQUFBO0FBQ3RDLENBQUMifQ==

package/components/identity.federation/operations/list.js

@@ -0,0 +1,12 @@
+import { quote } from '@toa.io/generic';
+export async function computation({ authority, identity }, context) {
+    return await context.local.enumerate({
+        query: {
+            criteria: `authority==${quote(authority)};identity==${quote(identity)}`,
+            projection: ['iss'],
+            sort: ['CREATED:desc'],
+            limit: 100
+        }
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibGlzdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NvdXJjZS9saXN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxLQUFLLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQTtBQUd2QyxNQUFNLENBQUMsS0FBSyxVQUFVLFdBQVcsQ0FDL0IsRUFBRSxTQUFTLEVBQUUsUUFBUSxFQUFTLEVBQzlCLE9BQWdCO0lBRWhCLE9BQU8sTUFBTSxPQUFPLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQztRQUNuQyxLQUFLLEVBQUU7WUFDTCxRQUFRLEVBQUUsY0FBYyxLQUFLLENBQUMsU0FBUyxDQUFDLGNBQWMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxFQUFFO1lBQ3ZFLFVBQVUsRUFBRSxDQUFDLEtBQUssQ0FBQztZQUNuQixJQUFJLEVBQUUsQ0FBQyxjQUFjLENBQUM7WUFDdEIsS0FBSyxFQUFFLEdBQUc7U0FDWDtLQUNGLENBQUMsQ0FBQTtBQUNKLENBQUMifQ==

package/components/identity.federation/operations/types/Scheme.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiU2NoZW1lLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc291cmNlL3R5cGVzL1NjaGVtZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiIn0=

package/components/identity.federation/operations/types/configuration.js

@@ -1,3 +1,2 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=configuration.js.map
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29uZmlndXJhdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS90eXBlcy9jb25maWd1cmF0aW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIifQ==

package/components/identity.federation/operations/types/context.js

@@ -1,3 +1,2 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=context.js.map
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29udGV4dC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS90eXBlcy9jb250ZXh0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIifQ==

package/components/identity.federation/operations/types/entity.js

@@ -1,3 +1,2 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=entity.js.map
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW50aXR5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc291cmNlL3R5cGVzL2VudGl0eS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiIn0=

package/components/identity.federation/operations/types/index.js

@@ -1,20 +1,5 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./configuration"), exports);
-__exportStar(require("./context"), exports);
-__exportStar(require("./entity"), exports);
-//# sourceMappingURL=index.js.map
+export * from './configuration.js';
+export * from './context.js';
+export * from './entity.js';
+export * from './Scheme.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zb3VyY2UvdHlwZXMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYyxvQkFBb0IsQ0FBQTtBQUNsQyxjQUFjLGNBQWMsQ0FBQTtBQUM1QixjQUFjLGFBQWEsQ0FBQTtBQUMzQixjQUFjLGFBQWEsQ0FBQSJ9

package/components/identity.federation/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "identity.federation",
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "jose": "6.2.10"
+  }
+}

package/components/identity.federation/source/authenticate.ts

@@ -1,29 +1,60 @@
-import { type Maybe } from '@toa.io/types'
-import { Err } from 'error-value'
-import { assertionsAsValues } from './lib/assertions-as-values.js'
-import { validateIdToken } from './lib/jwt'
-import type { AuthenticateInput, AuthenticateOutput, Context } from './types'
-import type { Request } from '@toa.io/core'
+import { newid, quote } from '@toa.io/generic'
+import { principal, resolve } from './lib/index.ts'
+import type { JWTPayload } from 'jose'
+import type { Maybe } from '@toa.io/core/types'
+import type { Context, Scheme } from './types/index.ts'
 
-async function authenticate ({ authority, credentials }: AuthenticateInput,
-  context: Context): Promise<Maybe<AuthenticateOutput>> {
-  const { iss, sub } = await validateIdToken(credentials, context.configuration.trust)
+export async function effect(
+  { scheme, authority, credentials }: Input,
+  context: Context
+): Promise<Maybe<Output>> {
+  context.logs.debug('Authenticating', { scheme, authority })
 
-  const request: Request = { query: { criteria: `authority==${authority};iss==${iss};sub==${sub}` } }
+  const claims = await resolve(scheme, credentials, context)
 
-  let id = (await context.local.observe(request))?.id
+  if (claims instanceof Error) return claims
 
-  if (id === undefined) {
-    if (context.configuration.explicit_identity_creation === true)
-      return NOT_FOUND
+  const { iss, sub } = claims
 
-    id = (await context.local.transit({ input: { authority, iss, sub } })).id
+  context.logs.debug('Token claims', claims)
+
+  const query = {
+    criteria: `authority==${quote(authority)};iss==${quote(iss)};sub==${quote(sub)}`
   }
 
-  return { identity: { id } }
+  const asserted = newid()
+
+  const credential =
+    context.configuration.assert !== false
+      ? await context.local.ensure({
+          query,
+          entity: { authority, iss, sub, identity: asserted }
+        })
+      : await context.local.observe({ query })
+
+  if (credential === null) return ERR_NOT_FOUND
+
+  if (credential instanceof Error) return credential
+
+  // the Identity this call has just created is the only one whose Role is not granted yet
+  if (credential.identity === asserted) await principal(credential, context)
+
+  return { identity: { id: credential.identity, claims } }
 }
 
-// Exporting as a function returning assertion errors as values
-export const computation = assertionsAsValues(authenticate)
+const ERR_NOT_FOUND = new (class NotFoundError extends Error {
+  public readonly code = 'NOT_FOUND'
+})()
+
+interface Input {
+  scheme: Scheme
+  authority: string
+  credentials: string
+}
 
-const NOT_FOUND = Err('NOT_FOUND')
+interface Output {
+  identity: {
+    id: string
+    claims: JWTPayload
+  }
+}

package/components/identity.federation/source/create.ts

@@ -0,0 +1,44 @@
+import { quote } from '@toa.io/generic'
+import { resolve } from './lib/index.ts'
+import type { Context, Entity, Scheme } from './types/index.ts'
+
+export async function effect(input: Input, context: Context): Promise<Entity | Error> {
+  const claims = await resolve(input.scheme, input.credentials, context)
+
+  if (claims instanceof Error) return claims
+
+  const { iss, sub } = claims
+
+  const existent = await context.local.observe({
+    query: {
+      criteria: `authority==${quote(input.authority)};iss==${quote(iss)};sub==${quote(sub)}`,
+      deleted: true
+    }
+  })
+
+  const record = { authority: input.authority, iss, sub, identity: input.id }
+
+  if (existent === null) return await context.local.transit({ input: record })
+
+  if (existent.DELETED === undefined || existent.DELETED === null)
+    return existent.identity === input.id ? existent : ERR_EXISTS
+
+  // a deleted record still occupies the unique index, so the transition revives it
+  return await context.local.transit({
+    input: record,
+    query: { id: existent.id, deleted: true }
+  })
+}
+
+export interface Input {
+  authority: string
+  scheme: Scheme
+  credentials: string
+  id: string
+}
+
+const ERR_EXISTS = new (class ExistsError extends Error {
+  public readonly code = 'EXISTS'
+  public override readonly message =
+    'Federation credentials are associated with another Identity'
+})()

package/components/identity.federation/source/decode.ts

@@ -0,0 +1,14 @@
+import { decode } from './lib/index.ts'
+import type { JWTPayload } from 'jose'
+import type { Context } from './types/index.ts'
+
+export async function effect(
+  token: string,
+  context: Context
+): Promise<JWTPayload | Error> {
+  return await decode(token, {
+    trust: context.configuration.trust,
+    logs: context.logs,
+    fetch: context.fetch
+  })
+}

package/components/identity.federation/source/delete.ts

@@ -0,0 +1,19 @@
+import type { Context } from './types/index.ts'
+
+export async function effect(
+  { authority, identity, credential }: Input,
+  context: Context
+): Promise<void | null> {
+  const object = await context.local.observe({ query: { id: credential } })
+
+  if (object === null || object.authority !== authority || object.identity !== identity)
+    return null
+
+  return await context.local.terminate({ query: { id: credential } })
+}
+
+interface Input {
+  authority: string
+  identity: string
+  credential: string
+}

package/components/identity.federation/source/incept.ts

@@ -1,27 +1,24 @@
-import { assertionsAsValues } from './lib/assertions-as-values.js'
-import { validateIdToken } from './lib/jwt'
-import type { Request } from '@toa.io/core'
-import type { Context, Entity } from './types'
+import { effect as create } from './create.ts'
+import { principal } from './lib/index.ts'
+import type { Context, Scheme } from './types/index.ts'
 
-async function incept (input: Input, context: Context): Promise<Output> {
-  const { iss, sub } = await validateIdToken(input.credentials, context.configuration.trust)
+export async function effect(input: Input, context: Context): Promise<Output | Error> {
+  const credential = await create(input, context)
 
-  const request: Request = { input: { authority: input.authority, iss, sub } satisfies Omit<Entity, 'id'> }
+  if (credential instanceof Error) return credential
 
-  if (input.id !== undefined)
-    request.query = { id: input.id }
+  await principal(credential, context)
 
-  return await context.local.transit(request)
+  return { id: credential.identity }
 }
 
-interface Input {
+export interface Input {
   authority: string
+  scheme: Scheme
   credentials: string
-  id?: string
+  id: string
 }
 
-interface Output {
+export interface Output {
   id: string
 }
-
-export const effect = assertionsAsValues(incept)

package/components/identity.federation/source/lib/Configuration.ts

@@ -0,0 +1,39 @@
+export interface Configuration extends Record<string, unknown> {
+  issuer: string
+  authorization_endpoint: string
+  token_endpoint: string
+  userinfo_endpoint: string
+  jwks_uri: string
+  registration_endpoint?: string
+  scopes_supported?: string[]
+  response_types_supported: string[]
+  response_modes_supported?: string[]
+  grant_types_supported?: string[]
+  acr_values_supported?: string[]
+  subject_types_supported: string[]
+  id_token_signing_alg_values_supported: string[]
+  id_token_encryption_alg_values_supported?: string[]
+  id_token_encryption_enc_values_supported?: string[]
+  userinfo_signing_alg_values_supported?: string[]
+  userinfo_encryption_alg_values_supported?: string[]
+  userinfo_encryption_enc_values_supported?: string[]
+  request_object_signing_alg_values_supported?: string[]
+  request_object_encryption_alg_values_supported?: string[]
+  request_object_encryption_enc_values_supported?: string[]
+  token_endpoint_auth_methods_supported?: string[]
+  token_endpoint_auth_signing_alg_values_supported?: string[]
+  display_values_supported?: string[]
+  claim_types_supported?: string[]
+  claims_supported?: string[]
+  service_documentation?: string
+  claims_locales_supported?: string[]
+  ui_locales_supported?: string[]
+  claims_parameter_supported?: boolean
+  request_parameter_supported?: boolean
+  request_uri_parameter_supported?: boolean
+  require_request_uri_registration?: boolean
+  op_policy_uri?: string
+  op_tos_uri?: string
+  check_session_iframe?: string
+  end_session_endpoint?: string
+}

package/components/identity.federation/source/lib/Ctx.ts

@@ -0,0 +1,9 @@
+import type { Logs } from '@toa.io/extensions.telemetry'
+import type { Trust } from '../types/index.ts'
+import type { Fetch } from '../types/context.ts'
+
+export interface Ctx {
+  trust: Trust[]
+  logs: Logs
+  fetch: Fetch
+}

package/components/identity.federation/source/lib/Payload.ts

@@ -0,0 +1,6 @@
+import type * as jose from 'jose'
+
+export interface Payload extends jose.JWTPayload {
+  iss: string
+  sub: string
+}

package/components/identity.federation/source/lib/decode.ts

@@ -0,0 +1,44 @@
+import { load } from './jose.js'
+import { createRemoteJWKSet } from './discovery.ts'
+import { ERR_TRUST, ERR_ISS, ERR_SUB, ERR_TOKEN } from './errors.ts'
+import type { JWTPayload } from 'jose'
+import type { Ctx } from './Ctx.ts'
+import type { Payload } from './Payload.ts'
+
+export async function decode(token: string, ctx: Ctx): Promise<Payload | Error> {
+  const jose = await load()
+
+  let claims: JWTPayload
+
+  // jose throws on anything it cannot read, and credentials are the client's to malform
+  try {
+    claims = jose.decodeJwt(token)
+  } catch {
+    return ERR_TOKEN
+  }
+
+  const { iss, sub } = claims
+
+  if (typeof iss !== 'string') return ERR_ISS
+
+  if (typeof sub !== 'string') return ERR_SUB
+
+  const trusted = ctx.trust.find((trust) => trust.iss === iss)
+
+  if (trusted === undefined) return ERR_TRUST
+
+  // the issuer is a configured one by now, so reaching its keys is the deployment's to answer for
+  const jwks = await createRemoteJWKSet(iss, ctx.fetch)
+
+  try {
+    const { payload } = await jose.jwtVerify(token, jwks, {
+      issuer: iss,
+      audience: trusted.aud,
+      requiredClaims: ['exp']
+    })
+
+    return payload as Payload
+  } catch {
+    return ERR_TOKEN
+  }
+}

package/components/identity.federation/source/lib/discovery.ts

@@ -0,0 +1,50 @@
+import { load } from './jose.js'
+import type * as jose from 'jose'
+import type { Configuration } from './Configuration.ts'
+import type { Fetch } from '../types/context.ts'
+
+const cache = new Map<string, Configuration>()
+const resolvers = new WeakMap<Fetch, Map<string, Promise<jose.RemoteJWKSet>>>()
+
+export async function discover(iss: string, fetch: Fetch): Promise<Configuration> {
+  if (!cache.has(iss)) {
+    const configuration = await fetchConfiguration(iss, fetch)
+
+    cache.set(iss, configuration)
+  }
+
+  return cache.get(iss)!
+}
+
+async function fetchConfiguration(iss: string, fetch: Fetch): Promise<Configuration> {
+  const response = await fetch(`${iss}/.well-known/openid-configuration`)
+
+  if (!response.ok) throw new Error('Failed to fetch OIDC configuration')
+
+  return (await response.json()) as Configuration
+}
+
+export async function createRemoteJWKSet(
+  iss: string,
+  fetch: Fetch
+): Promise<jose.RemoteJWKSet> {
+  let entries = resolvers.get(fetch)
+
+  if (entries === undefined) {
+    entries = new Map()
+    resolvers.set(fetch, entries)
+  }
+
+  if (!entries.has(iss)) entries.set(iss, create(iss, fetch))
+
+  return await entries.get(iss)!
+}
+
+async function create(iss: string, fetch: Fetch): Promise<jose.RemoteJWKSet> {
+  const jose = await load()
+  const configuration = await discover(iss, fetch)
+
+  return jose.createRemoteJWKSet(new URL(configuration.jwks_uri), {
+    [jose.customFetch]: fetch
+  })
+}

package/components/identity.federation/source/lib/errors.ts

@@ -0,0 +1,54 @@
+export const ERR_TOKEN = new (class TokenError extends Error {
+  public readonly code = 'TOKEN'
+  public override readonly message = 'Token is malformed or does not verify'
+})()
+
+export const ERR_TRUST = new (class TrustError extends Error {
+  public readonly code = 'TRUST'
+  public override readonly message = 'Issuer not trusted'
+})()
+
+export const ERR_RESPONSE = new (class ResponseError extends Error {
+  public readonly code = 'RESPONSE'
+  public override readonly message = 'Request to IDP failed'
+})()
+
+export const ERR_CONFIG = new (class ConfigError extends Error {
+  public readonly code = 'CONFIG'
+  public override readonly message = 'Invalid OpenID configuration'
+})()
+
+export const ERR_NO_TOKEN = new (class NoTokenError extends Error {
+  public readonly code = 'NO_TOKEN'
+  public override readonly message = 'No ID token received'
+})()
+
+export const ERR_ISS = new (class IssError extends Error {
+  public readonly code = 'ISS'
+  public override readonly message = 'Invalid issuer claim'
+})()
+
+export const ERR_SUB = new (class SubError extends Error {
+  public readonly code = 'SUB'
+  public override readonly message = 'Invalid subject claim'
+})()
+
+export const ERR_EXP = new (class ExpError extends Error {
+  public readonly code = 'EXP'
+  public override readonly message = 'Token does not have an expiration time'
+})()
+
+export const ERR_REPLAY = new (class ReplayError extends Error {
+  public readonly code = 'REPLAY'
+  public override readonly message = 'Token has already been used'
+})()
+
+export const ERR_CODE_NOT_ENABLED = new (class CodeNotEnabledError extends Error {
+  public readonly code = 'CODE_NOT_ENABLED'
+  public override readonly message = 'Authorization code flow is not configured'
+})()
+
+export const ERR_CODE_SCHEMA = new (class CodeSchemaError extends Error {
+  public readonly code = 'CODE_SCHEMA'
+  public override readonly message = 'Invalid code credentials'
+})()