@toa.io/extensions.exposition 1.0.0-alpha.31 → 1.0.0-alpha.310

package/components/identity.grants/manifest.toa.yaml

@@ -0,0 +1,243 @@
+namespace: identity
+name: grants
+
+# What a user allowed a client to do on their behalf. The authorization code is not here:
+# it is single-use and lives seconds, so it is held in the stash and redeemed atomically.
+entity:
+  associated: true
+  properties:
+    authority:
+      type: string
+    identity:
+      type: string
+    client:
+      type: string
+    scope:
+      type: array
+      items:
+        type: string
+    resource:
+      type: array
+      items:
+        type: string
+    kid:
+      description: The identity.keys record backing the access token, revoked with the grant
+      type: string
+    revokedAt:
+      type: integer
+  required:
+    - authority
+    - identity
+    - client
+
+operations:
+  transit:
+    concurrency: retry
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        identity:
+          type: string
+        client:
+          type: string
+        scope:
+          type: array
+          items:
+            type: string
+        resource:
+          type: array
+          items:
+            type: string
+        kid:
+          type: string
+      required:
+        - authority
+        - identity
+        - client
+
+  authorize:
+    query: false
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        identity:
+          type: string
+        client:
+          type: string
+          maxLength: 2048
+        redirect:
+          type: string
+          maxLength: 2048
+        challenge:
+          description: PKCE code challenge, S256 of the verifier
+          type: string
+          minLength: 43
+          maxLength: 128
+        method:
+          type: string
+        scope:
+          type: array
+          items:
+            type: string
+        resource:
+          type: array
+          items:
+            type: string
+            maxLength: 2048
+      required:
+        - authority
+        - identity
+        - client
+        - redirect
+        - challenge
+        - method
+    output:
+      type: object
+      properties:
+        status:
+          description: Read and removed by `io:status`
+          type: number
+        code:
+          type: string
+        expires_in:
+          type: number
+        error:
+          type: string
+        error_description:
+          type: string
+
+  exchange:
+    query: false
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        grant_type:
+          type: string
+        code:
+          type: string
+          maxLength: 512
+        code_verifier:
+          type: string
+          minLength: 43
+          maxLength: 128
+        redirect_uri:
+          type: string
+          maxLength: 2048
+        client_id:
+          type: string
+          maxLength: 2048
+        resource:
+          description: A form repeats a name to say a list, so either shape arrives
+          type: [string, array]
+      required:
+        - authority
+        - grant_type
+    output:
+      type: object
+      properties:
+        status:
+          type: number
+        access_token:
+          type: string
+        token_type:
+          type: string
+        expires_in:
+          type: number
+        scope:
+          type: string
+        error:
+          type: string
+        error_description:
+          type: string
+
+  list:
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        identity:
+          type: string
+      required:
+        - authority
+        - identity
+
+  revoke:
+    output: { type: 'null' }
+    concurrency: retry
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        identity:
+          type: string
+      required:
+        - authority
+        - identity
+    errors:
+      - NOT_FOUND
+
+configuration:
+  schema:
+    type: object
+    properties:
+      lifetime:
+        description: Seconds an authorization code may be redeemed within
+        type: integer
+        minimum: 1
+        maximum: 600
+      token:
+        description: Seconds an access token is valid for; 0 is until it is revoked
+        type: integer
+        minimum: 0
+    # both have defaults, so the component reads them without checking
+    required: [lifetime, token]
+
+  defaults:
+    lifetime: 60
+    token: 2592000
+
+stash: ~
+
+exposition:
+  isolated: true
+  /:
+    POST:
+      anonymous: true
+      map:authority: authority
+      io:input: [grant_type, code, code_verifier, redirect_uri, client_id, resource]
+      io:output: true
+      io:status: status
+      io:throttle:
+        key: ip
+        requests: 60
+        interval: 60
+      cache:exact: no-store
+      endpoint: exchange
+    /:identity:
+      auth:id: identity
+      map:authority: authority
+      map:segments:
+        identity: identity
+      GET:
+        io:output: [id, client, scope, resource, CREATED]
+        endpoint: list
+      POST:
+        io:input: [client, redirect, challenge, method, scope, resource]
+        # `status` is read by `io:status` out of what the operation answers, and taken out of the
+        # body before it is sent
+        io:output: [code, expires_in, error, error_description, status]
+        io:status: status
+        cache:exact: no-store
+        endpoint: authorize
+      /:id:
+        DELETE:
+          io:output: false
+          endpoint: revoke

package/components/identity.grants/migrations/0002-indexes.yaml

@@ -0,0 +1,5 @@
+- index:
+    name: index_identity
+    keys:
+      authority: asc
+      identity: asc

package/components/identity.grants/operations/authorize.js

@@ -0,0 +1,53 @@
+import { hold, identify } from './lib/index.js';
+/**
+ * What the consent page calls when a user allows a client. The page holds the user's own
+ * credentials, so this is the user's own route; the code it answers with is what the client
+ * redeems at the token endpoint.
+ *
+ * The grant is recorded so a user can see what they allowed and take it back. It is not
+ * consulted to skip the prompt — consent is asked every time, which is what keeps a client
+ * that changed where it wants a code sent from being waved through on an older one.
+ */
+export class Effect {
+    context;
+    mount(context) {
+        this.context = context;
+    }
+    async execute(input) {
+        const { authority, identity } = input;
+        if (input.method !== S256)
+            return invalid('invalid_request', 'Only the S256 code challenge method is supported');
+        const client = await this.context.remote.identity.clients.describe({
+            input: { authority, id: input.client, redirect: input.redirect }
+        });
+        if (client instanceof Error)
+            return invalid('invalid_client', 'No such client');
+        if (client.permitted !== true)
+            return invalid('invalid_request', 'The redirect is not one this client may receive a code at');
+        const scope = input.scope ?? [];
+        // recorded on the grant and carried to the token endpoint, where it becomes the
+        // token's `aud` — the entry it may be presented at, see documentation/oauth.md
+        const resource = input.resource ?? [];
+        const grant = await this.context.local.transit({
+            query: { id: identify(authority, identity, input.client) },
+            input: { authority, identity, client: input.client, scope, resource }
+        });
+        if (grant instanceof Error)
+            return grant;
+        const code = await hold(authority, {
+            identity,
+            client: input.client,
+            redirect: input.redirect,
+            challenge: input.challenge,
+            scope,
+            resource
+        }, this.context);
+        return { code, expires_in: this.context.configuration.lifetime };
+    }
+}
+function invalid(error, description) {
+    return { status: BAD_REQUEST, error, error_description: description };
+}
+const S256 = 'S256';
+const BAD_REQUEST = 400;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXplLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2F1dGhvcml6ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsSUFBSSxFQUFFLFFBQVEsRUFBRSxNQUFNLGdCQUFnQixDQUFBO0FBSy9DOzs7Ozs7OztHQVFHO0FBQ0gsTUFBTSxPQUFPLE1BQU07SUFDVCxPQUFPLENBQVU7SUFFbEIsS0FBSyxDQUFDLE9BQWdCO1FBQzNCLElBQUksQ0FBQyxPQUFPLEdBQUcsT0FBTyxDQUFBO0lBQ3hCLENBQUM7SUFFTSxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQVk7UUFDL0IsTUFBTSxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsR0FBRyxLQUFLLENBQUE7UUFFckMsSUFBSSxLQUFLLENBQUMsTUFBTSxLQUFLLElBQUk7WUFDdkIsT0FBTyxPQUFPLENBQ1osaUJBQWlCLEVBQ2pCLGtEQUFrRCxDQUNuRCxDQUFBO1FBRUgsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQztZQUNqRSxLQUFLLEVBQUUsRUFBRSxTQUFTLEVBQUUsRUFBRSxFQUFFLEtBQUssQ0FBQyxNQUFNLEVBQUUsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRLEVBQUU7U0FDakUsQ0FBQyxDQUFBO1FBRUYsSUFBSSxNQUFNLFlBQVksS0FBSztZQUFFLE9BQU8sT0FBTyxDQUFDLGdCQUFnQixFQUFFLGdCQUFnQixDQUFDLENBQUE7UUFFL0UsSUFBSSxNQUFNLENBQUMsU0FBUyxLQUFLLElBQUk7WUFDM0IsT0FBTyxPQUFPLENBQ1osaUJBQWlCLEVBQ2pCLDJEQUEyRCxDQUM1RCxDQUFBO1FBRUgsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLEtBQUssSUFBSSxFQUFFLENBQUE7UUFFL0IsZ0ZBQWdGO1FBQ2hGLCtFQUErRTtRQUMvRSxNQUFNLFFBQVEsR0FBRyxLQUFLLENBQUMsUUFBUSxJQUFJLEVBQUUsQ0FBQTtRQUVyQyxNQUFNLEtBQUssR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQztZQUM3QyxLQUFLLEVBQUUsRUFBRSxFQUFFLEVBQUUsUUFBUSxDQUFDLFNBQVMsRUFBRSxRQUFRLEVBQUUsS0FBSyxDQUFDLE1BQU0sQ0FBQyxFQUFFO1lBQzFELEtBQUssRUFBRSxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUFNLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRTtTQUN0RSxDQUFDLENBQUE7UUFFRixJQUFJLEtBQUssWUFBWSxLQUFLO1lBQUUsT0FBTyxLQUFLLENBQUE7UUFFeEMsTUFBTSxJQUFJLEdBQUcsTUFBTSxJQUFJLENBQ3JCLFNBQVMsRUFDVDtZQUNFLFFBQVE7WUFDUixNQUFNLEVBQUUsS0FBSyxDQUFDLE1BQU07WUFDcEIsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRO1lBQ3hCLFNBQVMsRUFBRSxLQUFLLENBQUMsU0FBUztZQUMxQixLQUFLO1lBQ0wsUUFBUTtTQUNULEVBQ0QsSUFBSSxDQUFDLE9BQU8sQ0FDYixDQUFBO1FBRUQsT0FBTyxFQUFFLElBQUksRUFBRSxVQUFVLEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsUUFBUSxFQUFFLENBQUE7SUFDbEUsQ0FBQztDQUNGO0FBRUQsU0FBUyxPQUFPLENBQUMsS0FBYSxFQUFFLFdBQW1CO0lBQ2pELE9BQU8sRUFBRSxNQUFNLEVBQUUsV0FBVyxFQUFFLEtBQUssRUFBRSxpQkFBaUIsRUFBRSxXQUFXLEVBQUUsQ0FBQTtBQUN2RSxDQUFDO0FBRUQsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFBO0FBQ25CLE1BQU0sV0FBVyxHQUFHLEdBQUcsQ0FBQSJ9

package/components/identity.grants/operations/exchange.js

@@ -0,0 +1,92 @@
+import { identify, spend, verifies } from './lib/index.js';
+/**
+ * The token endpoint, RFC 6749 §4.1.3. Anonymous, because the clients this server knows are
+ * public ones with no secret to authenticate with: what stands in for that is PKCE, since
+ * only the client that began the flow holds the verifier the challenge was made from.
+ *
+ * Every failure here is `invalid_grant` without saying which check failed. A code that was
+ * replayed, a verifier that does not match and a redirect that was swapped are all the same
+ * answer, and telling them apart would say whether a stolen code was still live.
+ */
+export class Effect {
+    context;
+    mount(context) {
+        this.context = context;
+    }
+    async execute(input) {
+        const { authority } = input;
+        if (input.grant_type !== AUTHORIZATION_CODE)
+            return invalid('unsupported_grant_type', 'Only the authorization code grant is supported');
+        if (input.code === undefined || input.code_verifier === undefined)
+            return invalid('invalid_request', 'A code and a code verifier are required');
+        // spent first: a wrong verifier burns the code, which is what stops it being guessed at
+        const code = await spend(authority, input.code, this.context);
+        if (code === null || !this.redeemable(code, input))
+            return invalid('invalid_grant', 'The authorization code is not redeemable');
+        // `aud` binds the token to `code.resource` — the entry it may be presented at,
+        // which `preflight` reads. A fork MCP or RPC makes is not that entry.
+        const issued = await this.context.remote.identity.tokens.issue({
+            input: {
+                authority,
+                identity: code.identity,
+                label: label(code.client),
+                lifetime: this.context.configuration.token,
+                ...(code.scope.length === 0 ? {} : { scopes: code.scope }),
+                ...(code.resource.length === 0 ? {} : { audience: code.resource })
+            }
+        });
+        // the only refusal `issue` makes is a scope the consenting identity does not hold, and
+        // what it says about that is its own; the client is told what it may act on
+        if (issued instanceof Error)
+            return invalid('invalid_scope', 'The requested scope is not one the identity holds');
+        // the key the token was issued under, so revoking the grant revokes the token. The token
+        // is already out, so a grant that fails to record it is logged rather than unwound — it
+        // costs the user the ability to revoke, and refusing here would cost them the token too
+        const grant = await this.context.local.transit({
+            query: { id: identify(authority, code.identity, code.client) },
+            input: {
+                authority,
+                identity: code.identity,
+                client: code.client,
+                scope: code.scope,
+                resource: code.resource,
+                kid: issued.kid
+            }
+        });
+        if (grant instanceof Error)
+            this.context.logs.error('Grant not recorded for an issued token', {
+                client: code.client,
+                kid: issued.kid
+            });
+        return {
+            // RFC 6749 §5.1 asks for 200, where a POST would otherwise answer 201
+            status: OK,
+            access_token: issued.token,
+            token_type: 'Bearer',
+            ...(issued.exp === undefined
+                ? {}
+                : { expires_in: Math.floor((issued.exp - Date.now()) / 1000) }),
+            ...(code.scope.length === 0 ? {} : { scope: code.scope.join(' ') })
+        };
+    }
+    redeemable(code, input) {
+        if (!verifies(code.challenge, input.code_verifier))
+            return false;
+        // RFC 6749 §4.1.3: what was sent to `authorize` must be sent again
+        if (input.redirect_uri !== undefined && input.redirect_uri !== code.redirect)
+            return false;
+        return input.client_id === undefined || input.client_id === code.client;
+    }
+}
+/** `identity.tokens` requires one, and it is what a user sees when listing what they issued. */
+function label(client) {
+    return client.slice(0, LABEL);
+}
+function invalid(error, description) {
+    return { status: BAD_REQUEST, error, error_description: description };
+}
+const AUTHORIZATION_CODE = 'authorization_code';
+const OK = 200;
+const BAD_REQUEST = 400;
+const LABEL = 64;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXhjaGFuZ2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zb3VyY2UvZXhjaGFuZ2UudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLFFBQVEsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLE1BQU0sZ0JBQWdCLENBQUE7QUFLMUQ7Ozs7Ozs7O0dBUUc7QUFDSCxNQUFNLE9BQU8sTUFBTTtJQUNULE9BQU8sQ0FBVTtJQUVsQixLQUFLLENBQUMsT0FBZ0I7UUFDM0IsSUFBSSxDQUFDLE9BQU8sR0FBRyxPQUFPLENBQUE7SUFDeEIsQ0FBQztJQUVNLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBWTtRQUMvQixNQUFNLEVBQUUsU0FBUyxFQUFFLEdBQUcsS0FBSyxDQUFBO1FBRTNCLElBQUksS0FBSyxDQUFDLFVBQVUsS0FBSyxrQkFBa0I7WUFDekMsT0FBTyxPQUFPLENBQ1osd0JBQXdCLEVBQ3hCLGdEQUFnRCxDQUNqRCxDQUFBO1FBRUgsSUFBSSxLQUFLLENBQUMsSUFBSSxLQUFLLFNBQVMsSUFBSSxLQUFLLENBQUMsYUFBYSxLQUFLLFNBQVM7WUFDL0QsT0FBTyxPQUFPLENBQUMsaUJBQWlCLEVBQUUseUNBQXlDLENBQUMsQ0FBQTtRQUU5RSx3RkFBd0Y7UUFDeEYsTUFBTSxJQUFJLEdBQUcsTUFBTSxLQUFLLENBQUMsU0FBUyxFQUFFLEtBQUssQ0FBQyxJQUFJLEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFBO1FBRTdELElBQUksSUFBSSxLQUFLLElBQUksSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsSUFBSSxFQUFFLEtBQUssQ0FBQztZQUNoRCxPQUFPLE9BQU8sQ0FBQyxlQUFlLEVBQUUsMENBQTBDLENBQUMsQ0FBQTtRQUU3RSwrRUFBK0U7UUFDL0Usc0VBQXNFO1FBQ3RFLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUM7WUFDN0QsS0FBSyxFQUFFO2dCQUNMLFNBQVM7Z0JBQ1QsUUFBUSxFQUFFLElBQUksQ0FBQyxRQUFRO2dCQUN2QixLQUFLLEVBQUUsS0FBSyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUM7Z0JBQ3pCLFFBQVEsRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxLQUFLO2dCQUMxQyxHQUFHLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztnQkFDMUQsR0FBRyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLFFBQVEsRUFBRSxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUM7YUFDbkU7U0FDRixDQUFDLENBQUE7UUFFRix1RkFBdUY7UUFDdkYsNEVBQTRFO1FBQzVFLElBQUksTUFBTSxZQUFZLEtBQUs7WUFDekIsT0FBTyxPQUFPLENBQUMsZUFBZSxFQUFFLG1EQUFtRCxDQUFDLENBQUE7UUFFdEYseUZBQXlGO1FBQ3pGLHdGQUF3RjtRQUN4Rix3RkFBd0Y7UUFDeEYsTUFBTSxLQUFLLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUM7WUFDN0MsS0FBSyxFQUFFLEVBQUUsRUFBRSxFQUFFLFFBQVEsQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUU7WUFDOUQsS0FBSyxFQUFFO2dCQUNMLFNBQVM7Z0JBQ1QsUUFBUSxFQUFFLElBQUksQ0FBQyxRQUFRO2dCQUN2QixNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU07Z0JBQ25CLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSztnQkFDakIsUUFBUSxFQUFFLElBQUksQ0FBQyxRQUFRO2dCQUN2QixHQUFHLEVBQUUsTUFBTSxDQUFDLEdBQUc7YUFDaEI7U0FDRixDQUFDLENBQUE7UUFFRixJQUFJLEtBQUssWUFBWSxLQUFLO1lBQ3hCLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyx3Q0FBd0MsRUFBRTtnQkFDaEUsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNO2dCQUNuQixHQUFHLEVBQUUsTUFBTSxDQUFDLEdBQUc7YUFDaEIsQ0FBQyxDQUFBO1FBRUosT0FBTztZQUNMLHNFQUFzRTtZQUN0RSxNQUFNLEVBQUUsRUFBRTtZQUNWLFlBQVksRUFBRSxNQUFNLENBQUMsS0FBSztZQUMxQixVQUFVLEVBQUUsUUFBUTtZQUNwQixHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsS0FBSyxTQUFTO2dCQUMxQixDQUFDLENBQUMsRUFBRTtnQkFDSixDQUFDLENBQUMsRUFBRSxVQUFVLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU0sQ0FBQyxHQUFHLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLEdBQUcsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUNqRSxHQUFHLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7U0FDcEUsQ0FBQTtJQUNILENBQUM7SUFFTyxVQUFVLENBQUMsSUFBVSxFQUFFLEtBQVk7UUFDekMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLEtBQUssQ0FBQyxhQUFjLENBQUM7WUFBRSxPQUFPLEtBQUssQ0FBQTtRQUVqRSxtRUFBbUU7UUFDbkUsSUFBSSxLQUFLLENBQUMsWUFBWSxLQUFLLFNBQVMsSUFBSSxLQUFLLENBQUMsWUFBWSxLQUFLLElBQUksQ0FBQyxRQUFRO1lBQzFFLE9BQU8sS0FBSyxDQUFBO1FBRWQsT0FBTyxLQUFLLENBQUMsU0FBUyxLQUFLLFNBQVMsSUFBSSxLQUFLLENBQUMsU0FBUyxLQUFLLElBQUksQ0FBQyxNQUFNLENBQUE7SUFDekUsQ0FBQztDQUNGO0FBRUQsZ0dBQWdHO0FBQ2hHLFNBQVMsS0FBSyxDQUFDLE1BQWM7SUFDM0IsT0FBTyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxLQUFLLENBQUMsQ0FBQTtBQUMvQixDQUFDO0FBRUQsU0FBUyxPQUFPLENBQUMsS0FBYSxFQUFFLFdBQW1CO0lBQ2pELE9BQU8sRUFBRSxNQUFNLEVBQUUsV0FBVyxFQUFFLEtBQUssRUFBRSxpQkFBaUIsRUFBRSxXQUFXLEVBQUUsQ0FBQTtBQUN2RSxDQUFDO0FBRUQsTUFBTSxrQkFBa0IsR0FBRyxvQkFBb0IsQ0FBQTtBQUMvQyxNQUFNLEVBQUUsR0FBRyxHQUFHLENBQUE7QUFDZCxNQUFNLFdBQVcsR0FBRyxHQUFHLENBQUE7QUFDdkIsTUFBTSxLQUFLLEdBQUcsRUFBRSxDQUFBIn0=

package/components/identity.grants/operations/lib/code.js

@@ -0,0 +1,30 @@
+import { createHash, randomBytes } from 'node:crypto';
+/**
+ * An authorization code is a bearer credential that lives for seconds. It is held under a
+ * hash of itself, so a dump of the store hands out none of them, and redeemed with `GETDEL`,
+ * so it is spent once however many requests arrive at once — the property the whole flow
+ * rests on, since a replayed code is a stolen grant.
+ */
+export async function hold(authority, code, context) {
+    const value = randomBytes(32).toString('base64url');
+    await context.stash.set(key(authority, value), JSON.stringify(code), 'EX', context.configuration.lifetime);
+    return value;
+}
+export async function spend(authority, value, context) {
+    const held = await context.stash.getdel(key(authority, value));
+    return held === null ? null : JSON.parse(held);
+}
+/**
+ * PKCE, RFC 7636: the client kept a verifier and sent its hash, and only the client that
+ * began the flow can present the verifier now. `S256` alone — `plain` proves nothing.
+ */
+export function verifies(challenge, verifier) {
+    return digest(verifier) === challenge;
+}
+export function digest(verifier) {
+    return createHash('sha256').update(verifier).digest('base64url');
+}
+function key(authority, value) {
+    return `oauth:code:${authority}:${createHash('sha256').update(value).digest('hex')}`;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29kZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS9saWIvY29kZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsVUFBVSxFQUFFLFdBQVcsRUFBRSxNQUFNLGFBQWEsQ0FBQTtBQUdyRDs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxLQUFLLFVBQVUsSUFBSSxDQUN4QixTQUFpQixFQUNqQixJQUFVLEVBQ1YsT0FBZ0I7SUFFaEIsTUFBTSxLQUFLLEdBQUcsV0FBVyxDQUFDLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsQ0FBQTtJQUVuRCxNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUNyQixHQUFHLENBQUMsU0FBUyxFQUFFLEtBQUssQ0FBQyxFQUNyQixJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxFQUNwQixJQUFJLEVBQ0osT0FBTyxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQy9CLENBQUE7SUFFRCxPQUFPLEtBQUssQ0FBQTtBQUNkLENBQUM7QUFFRCxNQUFNLENBQUMsS0FBSyxVQUFVLEtBQUssQ0FDekIsU0FBaUIsRUFDakIsS0FBYSxFQUNiLE9BQWdCO0lBRWhCLE1BQU0sSUFBSSxHQUFHLE1BQU0sT0FBTyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLFNBQVMsRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFBO0lBRTlELE9BQU8sSUFBSSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBRSxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBVSxDQUFBO0FBQzFELENBQUM7QUFFRDs7O0dBR0c7QUFDSCxNQUFNLFVBQVUsUUFBUSxDQUFDLFNBQWlCLEVBQUUsUUFBZ0I7SUFDMUQsT0FBTyxNQUFNLENBQUMsUUFBUSxDQUFDLEtBQUssU0FBUyxDQUFBO0FBQ3ZDLENBQUM7QUFFRCxNQUFNLFVBQVUsTUFBTSxDQUFDLFFBQWdCO0lBQ3JDLE9BQU8sVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLENBQUE7QUFDbEUsQ0FBQztBQUVELFNBQVMsR0FBRyxDQUFDLFNBQWlCLEVBQUUsS0FBYTtJQUMzQyxPQUFPLGNBQWMsU0FBUyxJQUFJLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUE7QUFDdEYsQ0FBQyJ9

package/components/identity.grants/operations/lib/identify.js

@@ -0,0 +1,15 @@
+import { createHash } from 'node:crypto';
+/**
+ * A user holds one grant per client, so the record is addressed by the three things that
+ * say which: authorizing again replaces what is there rather than leaving another row, and
+ * revoking has one thing to revoke.
+ */
+export function identify(authority, identity, client) {
+    return createHash('sha256')
+        .update(JSON.stringify([authority, identity, client]))
+        .digest('hex')
+        .slice(0, LENGTH);
+}
+/** What the entity prototype accepts as an id. */
+const LENGTH = 32;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaWRlbnRpZnkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zb3VyY2UvbGliL2lkZW50aWZ5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSxhQUFhLENBQUE7QUFFeEM7Ozs7R0FJRztBQUNILE1BQU0sVUFBVSxRQUFRLENBQUMsU0FBaUIsRUFBRSxRQUFnQixFQUFFLE1BQWM7SUFDMUUsT0FBTyxVQUFVLENBQUMsUUFBUSxDQUFDO1NBQ3hCLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsU0FBUyxFQUFFLFFBQVEsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDO1NBQ3JELE1BQU0sQ0FBQyxLQUFLLENBQUM7U0FDYixLQUFLLENBQUMsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFBO0FBQ3JCLENBQUM7QUFFRCxrREFBa0Q7QUFDbEQsTUFBTSxNQUFNLEdBQUcsRUFBRSxDQUFBIn0=

package/components/identity.grants/operations/lib/index.js

@@ -0,0 +1,3 @@
+export * from './code.js';
+export * from './identify.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zb3VyY2UvbGliL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsV0FBVyxDQUFBO0FBQ3pCLGNBQWMsZUFBZSxDQUFBIn0=

package/components/identity.grants/operations/list.js

@@ -0,0 +1,18 @@
+import { quote } from '@toa.io/generic';
+/** What a user has allowed, for a screen that lets them take it back. */
+export class Computation {
+    enumerate;
+    mount(context) {
+        this.enumerate = context.local.enumerate;
+    }
+    async execute(input) {
+        return await this.enumerate({
+            query: {
+                criteria: `authority==${quote(input.authority)};identity==${quote(input.identity)}`,
+                limit: LIMIT
+            }
+        });
+    }
+}
+const LIMIT = 256;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibGlzdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NvdXJjZS9saXN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxLQUFLLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQTtBQUl2Qyx5RUFBeUU7QUFDekUsTUFBTSxPQUFPLFdBQVc7SUFDZCxTQUFTLENBQWdDO0lBRTFDLEtBQUssQ0FBQyxPQUFnQjtRQUMzQixJQUFJLENBQUMsU0FBUyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFBO0lBQzFDLENBQUM7SUFFTSxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQVk7UUFDL0IsT0FBTyxNQUFNLElBQUksQ0FBQyxTQUFTLENBQUM7WUFDMUIsS0FBSyxFQUFFO2dCQUNMLFFBQVEsRUFBRSxjQUFjLEtBQUssQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLGNBQWMsS0FBSyxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsRUFBRTtnQkFDbkYsS0FBSyxFQUFFLEtBQUs7YUFDYjtTQUNGLENBQUMsQ0FBQTtJQUNKLENBQUM7Q0FDRjtBQUVELE1BQU0sS0FBSyxHQUFHLEdBQUcsQ0FBQSJ9

package/components/identity.grants/operations/revoke.js

@@ -0,0 +1,26 @@
+/**
+ * Taking back what was allowed. The token itself is not deleted — it is out in the world —
+ * so what is revoked is the key it was issued under, which is what `identity.tokens` reads
+ * it with. It stops being a token within `identity.tokens.cache.ttl`.
+ */
+export class Transition {
+    keys;
+    mount(context) {
+        this.keys = context.remote.identity.keys;
+    }
+    async execute(input, object) {
+        // the id is a route parameter, so a grant of another identity is asked for by anyone
+        // who guesses one; the authority and the identity are what say it is theirs
+        if (object.VERSION === 0 ||
+            object.authority !== input.authority ||
+            object.identity !== input.identity)
+            return ERR_NOT_FOUND;
+        if (object.kid !== undefined)
+            await this.keys.disable({ query: { id: object.kid } });
+        object.revokedAt = Date.now();
+    }
+}
+const ERR_NOT_FOUND = new (class NotFoundError extends Error {
+    code = 'NOT_FOUND';
+})();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmV2b2tlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL3Jldm9rZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFJQTs7OztHQUlHO0FBQ0gsTUFBTSxPQUFPLFVBQVU7SUFDYixJQUFJLENBQXdDO0lBRTdDLEtBQUssQ0FBQyxPQUFnQjtRQUMzQixJQUFJLENBQUMsSUFBSSxHQUFHLE9BQU8sQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQTtJQUMxQyxDQUFDO0lBRU0sS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFZLEVBQUUsTUFBYztRQUMvQyxxRkFBcUY7UUFDckYsNEVBQTRFO1FBQzVFLElBQ0UsTUFBTSxDQUFDLE9BQU8sS0FBSyxDQUFDO1lBQ3BCLE1BQU0sQ0FBQyxTQUFTLEtBQUssS0FBSyxDQUFDLFNBQVM7WUFDcEMsTUFBTSxDQUFDLFFBQVEsS0FBSyxLQUFLLENBQUMsUUFBUTtZQUVsQyxPQUFPLGFBQWEsQ0FBQTtRQUV0QixJQUFJLE1BQU0sQ0FBQyxHQUFHLEtBQUssU0FBUztZQUFFLE1BQU0sSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFFLEVBQUUsTUFBTSxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsQ0FBQTtRQUVwRixNQUFNLENBQUMsU0FBUyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQTtJQUMvQixDQUFDO0NBQ0Y7QUFFRCxNQUFNLGFBQWEsR0FBRyxJQUFJLENBQUMsTUFBTSxhQUFjLFNBQVEsS0FBSztJQUMxQyxJQUFJLEdBQUcsV0FBVyxDQUFBO0NBQ25DLENBQUMsRUFBRSxDQUFBIn0=

package/components/identity.grants/source/authorize.ts

@@ -0,0 +1,97 @@
+import { hold, identify } from './lib/index.ts'
+import type { Maybe } from '@toa.io/core/types'
+import type { Operation } from '@toa.io/bridges.node'
+import type { Context } from './lib/index.ts'
+
+/**
+ * What the consent page calls when a user allows a client. The page holds the user's own
+ * credentials, so this is the user's own route; the code it answers with is what the client
+ * redeems at the token endpoint.
+ *
+ * The grant is recorded so a user can see what they allowed and take it back. It is not
+ * consulted to skip the prompt — consent is asked every time, which is what keeps a client
+ * that changed where it wants a code sent from being waved through on an older one.
+ */
+export class Effect implements Operation {
+  private context!: Context
+
+  public mount(context: Context): void {
+    this.context = context
+  }
+
+  public async execute(input: Input): Promise<Maybe<Output>> {
+    const { authority, identity } = input
+
+    if (input.method !== S256)
+      return invalid(
+        'invalid_request',
+        'Only the S256 code challenge method is supported'
+      )
+
+    const client = await this.context.remote.identity.clients.describe({
+      input: { authority, id: input.client, redirect: input.redirect }
+    })
+
+    if (client instanceof Error) return invalid('invalid_client', 'No such client')
+
+    if (client.permitted !== true)
+      return invalid(
+        'invalid_request',
+        'The redirect is not one this client may receive a code at'
+      )
+
+    const scope = input.scope ?? []
+
+    // recorded on the grant and carried to the token endpoint, where it becomes the
+    // token's `aud` — the entry it may be presented at, see documentation/oauth.md
+    const resource = input.resource ?? []
+
+    const grant = await this.context.local.transit({
+      query: { id: identify(authority, identity, input.client) },
+      input: { authority, identity, client: input.client, scope, resource }
+    })
+
+    if (grant instanceof Error) return grant
+
+    const code = await hold(
+      authority,
+      {
+        identity,
+        client: input.client,
+        redirect: input.redirect,
+        challenge: input.challenge,
+        scope,
+        resource
+      },
+      this.context
+    )
+
+    return { code, expires_in: this.context.configuration.lifetime }
+  }
+}
+
+function invalid(error: string, description: string): Output {
+  return { status: BAD_REQUEST, error, error_description: description }
+}
+
+const S256 = 'S256'
+const BAD_REQUEST = 400
+
+interface Input {
+  authority: string
+  identity: string
+  client: string
+  redirect: string
+  challenge: string
+  method: string
+  scope?: string[]
+  resource?: string[]
+}
+
+interface Output {
+  status?: number
+  code?: string
+  expires_in?: number
+  error?: string
+  error_description?: string
+}