@toa.io/extensions.exposition 1.0.0-alpha.330 → 1.0.0-alpha.331

package/components/identity.basic/manifest.toa.yaml

@@ -165,8 +165,10 @@ configuration:
     type: object
     properties:
       rounds:
+        description: bcrypt cost
         type: integer
-        minimum: 1
+        minimum: 4
+        maximum: 31
       pepper:
         description: Hashing pepper, a secret
         type: string

package/components/identity.basic/operations/transit.js

@@ -46,7 +46,7 @@ export class Transition {
             if (invalid(input.password, this.passwordRx))
                 return ERR_INVALID_PASSWORD;
             const spicy = input.password + this.pepper;
-            object.password = await hash(spicy, this.rounds);
+            object.password = await hash(spicy, { cost: this.rounds });
         }
         return { id: object.id };
     }
@@ -61,4 +61,4 @@ const ERR_PRINCIPAL_LOCKED = new Error('PRINCIPAL_LOCKED');
 const ERR_INVALID_USERNAME = new Error('INVALID_USERNAME');
 const ERR_INVALID_PASSWORD = new Error('INVALID_PASSWORD');
 const ERR_EXISTS = new Error('EXISTS');
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHJhbnNpdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NvdXJjZS90cmFuc2l0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxJQUFJLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQTtBQVd0QyxNQUFNLE9BQU8sVUFBVTtJQUNiLE1BQU0sR0FBVyxFQUFFLENBQUE7SUFDbkIsTUFBTSxHQUFXLEVBQUUsQ0FBQTtJQUNuQixTQUFTLENBQVk7SUFDckIsTUFBTSxHQUFXLFNBQThCLENBQUE7SUFDL0MsSUFBSSxHQUFTLFNBQTRCLENBQUE7SUFDekMsVUFBVSxHQUFhLEVBQUUsQ0FBQTtJQUN6QixVQUFVLEdBQWEsRUFBRSxDQUFBO0lBRTFCLEtBQUssQ0FBQyxPQUFnQjtRQUMzQixJQUFJLENBQUMsTUFBTSxHQUFHLE9BQU8sQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFBO1FBQzFDLElBQUksQ0FBQyxNQUFNLEdBQUcsT0FBTyxDQUFDLGFBQWEsQ0FBQyxNQUFNLEVBQUUsTUFBTSxFQUFFLElBQUksRUFBRSxDQUFBO1FBQzFELElBQUksQ0FBQyxTQUFTLEdBQUcsT0FBTyxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUE7UUFDaEQsSUFBSSxDQUFDLE1BQU0sR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUE7UUFDNUMsSUFBSSxDQUFDLElBQUksR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUE7UUFFeEMsSUFBSSxDQUFDLFVBQVUsR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsQ0FBQTtRQUN0RCxJQUFJLENBQUMsVUFBVSxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxDQUFBO0lBQ3hELENBQUM7SUFFTyxNQUFNLENBQUMsTUFBYztRQUMzQixPQUFPLENBQ0wsSUFBSSxDQUFDLFNBQVMsS0FBSyxTQUFTO1lBQzVCLE1BQU0sQ0FBQyxTQUFTLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxTQUFTO1lBQzdDLE1BQU0sQ0FBQyxRQUFRLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQzVDLENBQUE7SUFDSCxDQUFDO0lBRU0sS0FBSyxDQUFDLE9BQU8sQ0FDbEIsS0FBbUIsRUFDbkIsTUFBYztRQUVkLE1BQU0sT0FBTyxHQUFHLE1BQU0sQ0FBQyxPQUFPLEtBQUssU0FBUyxJQUFJLE1BQU0sQ0FBQyxPQUFPLEtBQUssSUFBSSxDQUFBO1FBQ3ZFLE1BQU0sUUFBUSxHQUFHLE1BQU0sQ0FBQyxPQUFPLEtBQUssQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFBO1FBRWpELElBQUksUUFBUSxFQUFFLENBQUM7WUFDYixJQUFJLEtBQUssQ0FBQyxTQUFTLEtBQUssSUFBSTtnQkFBRSxPQUFPLFVBQVUsQ0FBQTtZQUUvQyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUM7Z0JBQ2hCLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxFQUFFLE1BQU0sQ0FBQyxFQUFFLEVBQUUsRUFBRSxDQUFDO2dCQUNoRCxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLEtBQUssRUFBRSxFQUFFLFFBQVEsRUFBRSxNQUFNLENBQUMsRUFBRSxFQUFFLEVBQUUsQ0FBQzthQUNyRCxDQUFDLENBQUE7UUFDSixDQUFDO2FBQU0sSUFBSSxLQUFLLENBQUMsU0FBUyxLQUFLLFNBQVM7WUFDdEMsZ0ZBQWdGO1lBQ2hGLE1BQU0sQ0FBQyxTQUFTLEdBQUcsS0FBSyxDQUFDLFNBQVMsQ0FBQTtRQUVwQyxJQUFJLEtBQUssQ0FBQyxRQUFRLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDakMsSUFBSSxRQUFRLElBQUksSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUM7Z0JBQUUsT0FBTyxvQkFBb0IsQ0FBQTtZQUVoRSxJQUFJLE9BQU8sQ0FBQyxLQUFLLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxVQUFVLENBQUM7Z0JBQUUsT0FBTyxvQkFBb0IsQ0FBQTtZQUV6RSxNQUFNLENBQUMsUUFBUSxHQUFHLEtBQUssQ0FBQyxRQUFRLENBQUE7UUFDbEMsQ0FBQztRQUVELElBQUksS0FBSyxDQUFDLFFBQVEsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUNqQyxJQUFJLE9BQU8sQ0FBQyxLQUFLLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxVQUFVLENBQUM7Z0JBQUUsT0FBTyxvQkFBb0IsQ0FBQTtZQUV6RSxNQUFNLEtBQUssR0FBRyxLQUFLLENBQUMsUUFBUSxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUE7WUFFMUMsTUFBTSxDQUFDLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFBO1FBQ2xELENBQUM7UUFFRCxPQUFPLEVBQUUsRUFBRSxFQUFFLE1BQU0sQ0FBQyxFQUFFLEVBQUUsQ0FBQTtJQUMxQixDQUFDO0NBQ0Y7QUFFRCxTQUFTLElBQUksQ0FBQyxXQUFxQjtJQUNqQyxPQUFPLFdBQVcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxVQUFVLEVBQUUsRUFBRSxDQUFDLElBQUksTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUE7QUFDaEUsQ0FBQztBQUVELFNBQVMsT0FBTyxDQUFDLEtBQWEsRUFBRSxXQUFxQjtJQUNuRCxPQUFPLFdBQVcsQ0FBQyxJQUFJLENBQUMsQ0FBQyxVQUFVLEVBQUUsRUFBRSxDQUFDLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFBO0FBQ2xFLENBQUM7QUFFRCxNQUFNLG9CQUFvQixHQUFHLElBQUksS0FBSyxDQUFDLGtCQUFrQixDQUFDLENBQUE7QUFFMUQsTUFBTSxvQkFBb0IsR0FBRyxJQUFJLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQyxDQUFBO0FBRTFELE1BQU0sb0JBQW9CLEdBQUcsSUFBSSxLQUFLLENBQUMsa0JBQWtCLENBQUMsQ0FBQTtBQUUxRCxNQUFNLFVBQVUsR0FBRyxJQUFJLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQSJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHJhbnNpdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NvdXJjZS90cmFuc2l0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxJQUFJLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQTtBQVd0QyxNQUFNLE9BQU8sVUFBVTtJQUNiLE1BQU0sR0FBVyxFQUFFLENBQUE7SUFDbkIsTUFBTSxHQUFXLEVBQUUsQ0FBQTtJQUNuQixTQUFTLENBQVk7SUFDckIsTUFBTSxHQUFXLFNBQThCLENBQUE7SUFDL0MsSUFBSSxHQUFTLFNBQTRCLENBQUE7SUFDekMsVUFBVSxHQUFhLEVBQUUsQ0FBQTtJQUN6QixVQUFVLEdBQWEsRUFBRSxDQUFBO0lBRTFCLEtBQUssQ0FBQyxPQUFnQjtRQUMzQixJQUFJLENBQUMsTUFBTSxHQUFHLE9BQU8sQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFBO1FBQzFDLElBQUksQ0FBQyxNQUFNLEdBQUcsT0FBTyxDQUFDLGFBQWEsQ0FBQyxNQUFNLEVBQUUsTUFBTSxFQUFFLElBQUksRUFBRSxDQUFBO1FBQzFELElBQUksQ0FBQyxTQUFTLEdBQUcsT0FBTyxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUE7UUFDaEQsSUFBSSxDQUFDLE1BQU0sR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUE7UUFDNUMsSUFBSSxDQUFDLElBQUksR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUE7UUFFeEMsSUFBSSxDQUFDLFVBQVUsR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsQ0FBQTtRQUN0RCxJQUFJLENBQUMsVUFBVSxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxDQUFBO0lBQ3hELENBQUM7SUFFTyxNQUFNLENBQUMsTUFBYztRQUMzQixPQUFPLENBQ0wsSUFBSSxDQUFDLFNBQVMsS0FBSyxTQUFTO1lBQzVCLE1BQU0sQ0FBQyxTQUFTLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxTQUFTO1lBQzdDLE1BQU0sQ0FBQyxRQUFRLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQzVDLENBQUE7SUFDSCxDQUFDO0lBRU0sS0FBSyxDQUFDLE9BQU8sQ0FDbEIsS0FBbUIsRUFDbkIsTUFBYztRQUVkLE1BQU0sT0FBTyxHQUFHLE1BQU0sQ0FBQyxPQUFPLEtBQUssU0FBUyxJQUFJLE1BQU0sQ0FBQyxPQUFPLEtBQUssSUFBSSxDQUFBO1FBQ3ZFLE1BQU0sUUFBUSxHQUFHLE1BQU0sQ0FBQyxPQUFPLEtBQUssQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFBO1FBRWpELElBQUksUUFBUSxFQUFFLENBQUM7WUFDYixJQUFJLEtBQUssQ0FBQyxTQUFTLEtBQUssSUFBSTtnQkFBRSxPQUFPLFVBQVUsQ0FBQTtZQUUvQyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUM7Z0JBQ2hCLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxFQUFFLE1BQU0sQ0FBQyxFQUFFLEVBQUUsRUFBRSxDQUFDO2dCQUNoRCxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLEtBQUssRUFBRSxFQUFFLFFBQVEsRUFBRSxNQUFNLENBQUMsRUFBRSxFQUFFLEVBQUUsQ0FBQzthQUNyRCxDQUFDLENBQUE7UUFDSixDQUFDO2FBQU0sSUFBSSxLQUFLLENBQUMsU0FBUyxLQUFLLFNBQVM7WUFDdEMsZ0ZBQWdGO1lBQ2hGLE1BQU0sQ0FBQyxTQUFTLEdBQUcsS0FBSyxDQUFDLFNBQVMsQ0FBQTtRQUVwQyxJQUFJLEtBQUssQ0FBQyxRQUFRLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDakMsSUFBSSxRQUFRLElBQUksSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUM7Z0JBQUUsT0FBTyxvQkFBb0IsQ0FBQTtZQUVoRSxJQUFJLE9BQU8sQ0FBQyxLQUFLLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxVQUFVLENBQUM7Z0JBQUUsT0FBTyxvQkFBb0IsQ0FBQTtZQUV6RSxNQUFNLENBQUMsUUFBUSxHQUFHLEtBQUssQ0FBQyxRQUFRLENBQUE7UUFDbEMsQ0FBQztRQUVELElBQUksS0FBSyxDQUFDLFFBQVEsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUNqQyxJQUFJLE9BQU8sQ0FBQyxLQUFLLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxVQUFVLENBQUM7Z0JBQUUsT0FBTyxvQkFBb0IsQ0FBQTtZQUV6RSxNQUFNLEtBQUssR0FBRyxLQUFLLENBQUMsUUFBUSxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUE7WUFFMUMsTUFBTSxDQUFDLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxLQUFLLEVBQUUsRUFBRSxJQUFJLEVBQUUsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUE7UUFDNUQsQ0FBQztRQUVELE9BQU8sRUFBRSxFQUFFLEVBQUUsTUFBTSxDQUFDLEVBQUUsRUFBRSxDQUFBO0lBQzFCLENBQUM7Q0FDRjtBQUVELFNBQVMsSUFBSSxDQUFDLFdBQXFCO0lBQ2pDLE9BQU8sV0FBVyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsSUFBSSxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQTtBQUNoRSxDQUFDO0FBRUQsU0FBUyxPQUFPLENBQUMsS0FBYSxFQUFFLFdBQXFCO0lBQ25ELE9BQU8sV0FBVyxDQUFDLElBQUksQ0FBQyxDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUE7QUFDbEUsQ0FBQztBQUVELE1BQU0sb0JBQW9CLEdBQUcsSUFBSSxLQUFLLENBQUMsa0JBQWtCLENBQUMsQ0FBQTtBQUUxRCxNQUFNLG9CQUFvQixHQUFHLElBQUksS0FBSyxDQUFDLGtCQUFrQixDQUFDLENBQUE7QUFFMUQsTUFBTSxvQkFBb0IsR0FBRyxJQUFJLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQyxDQUFBO0FBRTFELE1BQU0sVUFBVSxHQUFHLElBQUksS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFBIn0=

package/components/identity.basic/package.json

@@ -3,6 +3,6 @@
   "private": true,
   "type": "module",
   "dependencies": {
-    "@node-rs/bcrypt": "1.10.9"
+    "@node-rs/bcrypt": "2.0.0"
   }
 }

package/components/identity.basic/source/transit.ts

@@ -68,7 +68,7 @@ export class Transition implements Operation {
 
       const spicy = input.password + this.pepper
 
-      object.password = await hash(spicy, this.rounds)
+      object.password = await hash(spicy, { cost: this.rounds })
     }
 
     return { id: object.id }

package/components/identity.basic/types/toa.d.ts

@@ -111,6 +111,7 @@ export interface Component {
 }
 
 export interface Configuration {
+  /** bcrypt cost */
   rounds: number
   /** Hashing pepper, a secret */
   pepper?: Secret

package/components/identity.otp/manifest.toa.yaml

@@ -38,6 +38,30 @@ operations:
         - authority
         - username
       type: object
+  confirm:
+    input:
+      properties:
+        authority:
+          type: string
+        username:
+          type: string
+          minLength: 1
+          maxLength: 256
+        code:
+          type: string
+        identity:
+          type: string
+          pattern: ^[0-9a-f]{32}$
+      required:
+        - authority
+        - username
+        - code
+        - identity
+      type: object
+    errors:
+      - EXPIRED
+      - TOO_MANY_ATTEMPTS
+      - EXISTS
   authenticate:
     input:
       properties:
@@ -86,11 +110,16 @@ stash: ~
 exposition:
   /:identity:
     auth:id: identity
-    auth:role: system:identity:otp
     POST:
+      auth:role: system:identity:otp
       io:input: []
       io:output: [code]
       map:authority: authority
       map:segments:
         username: identity
       endpoint: issue
+    PUT:
+      io:input: [username, code]
+      io:output: false
+      map:authority: authority
+      endpoint: confirm

package/components/identity.otp/operations/authenticate.js

@@ -1,23 +1,21 @@
+import { redeem, SIGN_IN } from './lib/index.js';
 export async function effect(input, context) {
     const { authority, credentials } = input;
     const [username, code] = Buffer.from(credentials, 'base64').toString().split(':');
     if (code === undefined)
         return ERR_INVALID_CREDENTIALS;
-    const attempts = `${authority}:${username}:attempts`;
-    const attempt = await context.stash.incr(attempts);
-    if (attempt === 1)
-        await context.stash.expire(attempts, context.configuration.lifetime);
-    if (attempt > context.configuration.attempts) {
-        context.logs.debug('OTP attempts exceeded', { authority, username, attempt });
-        return ERR_TOO_MANY_ATTEMPTS;
-    }
-    const key = `${authority}:${username}:${code}`;
-    const n = await context.stash.del(key);
-    if (n === 0) {
-        context.logs.debug('OTP code not found', { authority, username, attempt });
-        return ERR_EXPIRED;
-    }
-    await context.stash.del(attempts);
+    // a code issued with an identity signs in only where the username is that identity's own id:
+    // any other is for `confirm`, and would tie the username to an identity of someone else's choosing
+    const issued = await redeem({
+        authority,
+        username,
+        code,
+        accepts: (value) => value === SIGN_IN || value === username
+    }, context);
+    if (issued instanceof Error)
+        return issued;
+    if (issued === username)
+        return { identity: { id: issued } };
     const entry = await context.local.ensure({
         entity: {
             authority,
@@ -30,7 +28,5 @@ export async function effect(input, context) {
     return { identity: { id } };
 }
 const ERR_INVALID_CREDENTIALS = new Error('INVALID_CREDENTIALS');
-const ERR_EXPIRED = new Error('EXPIRED');
-const ERR_TOO_MANY_ATTEMPTS = new Error('TOO_MANY_ATTEMPTS');
 const ERR_NOT_FOUND = new Error('NOT_FOUND');
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aGVudGljYXRlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2F1dGhlbnRpY2F0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFFQSxNQUFNLENBQUMsS0FBSyxVQUFVLE1BQU0sQ0FBQyxLQUFZLEVBQUUsT0FBZ0I7SUFDekQsTUFBTSxFQUFFLFNBQVMsRUFBRSxXQUFXLEVBQUUsR0FBRyxLQUFLLENBQUE7SUFDeEMsTUFBTSxDQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLFdBQVcsRUFBRSxRQUFRLENBQUMsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUE7SUFFakYsSUFBSSxJQUFJLEtBQUssU0FBUztRQUFFLE9BQU8sdUJBQXVCLENBQUE7SUFFdEQsTUFBTSxRQUFRLEdBQUcsR0FBRyxTQUFTLElBQUksUUFBUSxXQUFXLENBQUE7SUFDcEQsTUFBTSxPQUFPLEdBQUcsTUFBTSxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQTtJQUVsRCxJQUFJLE9BQU8sS0FBSyxDQUFDO1FBQUUsTUFBTSxPQUFPLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsQ0FBQTtJQUV2RixJQUFJLE9BQU8sR0FBRyxPQUFPLENBQUMsYUFBYSxDQUFDLFFBQVEsRUFBRSxDQUFDO1FBQzdDLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLHVCQUF1QixFQUFFLEVBQUUsU0FBUyxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFBO1FBRTdFLE9BQU8scUJBQXFCLENBQUE7SUFDOUIsQ0FBQztJQUVELE1BQU0sR0FBRyxHQUFHLEdBQUcsU0FBUyxJQUFJLFFBQVEsSUFBSSxJQUFJLEVBQUUsQ0FBQTtJQUM5QyxNQUFNLENBQUMsR0FBRyxNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFBO0lBRXRDLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ1osT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsb0JBQW9CLEVBQUUsRUFBRSxTQUFTLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUE7UUFFMUUsT0FBTyxXQUFXLENBQUE7SUFDcEIsQ0FBQztJQUVELE1BQU0sT0FBTyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUE7SUFFakMsTUFBTSxLQUFLLEdBQUcsTUFBTSxPQUFPLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQztRQUN2QyxNQUFNLEVBQUU7WUFDTixTQUFTO1lBQ1QsUUFBUTtTQUNUO0tBQ0YsQ0FBQyxDQUFBO0lBRUYsSUFBSSxLQUFLLEtBQUssSUFBSTtRQUFFLE9BQU8sYUFBYSxDQUFBO0lBRXhDLE1BQU0sRUFBRSxHQUFHLEtBQUssQ0FBQyxRQUFRLElBQUksS0FBSyxDQUFDLEVBQUUsQ0FBQSxDQUFDLHFCQUFxQjtJQUUzRCxPQUFPLEVBQUUsUUFBUSxFQUFFLEVBQUUsRUFBRSxFQUFFLEVBQUUsQ0FBQTtBQUM3QixDQUFDO0FBRUQsTUFBTSx1QkFBdUIsR0FBRyxJQUFJLEtBQUssQ0FBQyxxQkFBcUIsQ0FBQyxDQUFBO0FBRWhFLE1BQU0sV0FBVyxHQUFHLElBQUksS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFBO0FBRXhDLE1BQU0scUJBQXFCLEdBQUcsSUFBSSxLQUFLLENBQUMsbUJBQW1CLENBQUMsQ0FBQTtBQUU1RCxNQUFNLGFBQWEsR0FBRyxJQUFJLEtBQUssQ0FBQyxXQUFXLENBQUMsQ0FBQSJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aGVudGljYXRlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2F1dGhlbnRpY2F0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBRSxNQUFNLGdCQUFnQixDQUFBO0FBR2hELE1BQU0sQ0FBQyxLQUFLLFVBQVUsTUFBTSxDQUFDLEtBQVksRUFBRSxPQUFnQjtJQUN6RCxNQUFNLEVBQUUsU0FBUyxFQUFFLFdBQVcsRUFBRSxHQUFHLEtBQUssQ0FBQTtJQUN4QyxNQUFNLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsV0FBVyxFQUFFLFFBQVEsQ0FBQyxDQUFDLFFBQVEsRUFBRSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQTtJQUVqRixJQUFJLElBQUksS0FBSyxTQUFTO1FBQUUsT0FBTyx1QkFBdUIsQ0FBQTtJQUV0RCw2RkFBNkY7SUFDN0YsbUdBQW1HO0lBQ25HLE1BQU0sTUFBTSxHQUFHLE1BQU0sTUFBTSxDQUN6QjtRQUNFLFNBQVM7UUFDVCxRQUFRO1FBQ1IsSUFBSTtRQUNKLE9BQU8sRUFBRSxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxLQUFLLE9BQU8sSUFBSSxLQUFLLEtBQUssUUFBUTtLQUM1RCxFQUNELE9BQU8sQ0FDUixDQUFBO0lBRUQsSUFBSSxNQUFNLFlBQVksS0FBSztRQUFFLE9BQU8sTUFBTSxDQUFBO0lBRTFDLElBQUksTUFBTSxLQUFLLFFBQVE7UUFBRSxPQUFPLEVBQUUsUUFBUSxFQUFFLEVBQUUsRUFBRSxFQUFFLE1BQU0sRUFBRSxFQUFFLENBQUE7SUFFNUQsTUFBTSxLQUFLLEdBQUcsTUFBTSxPQUFPLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQztRQUN2QyxNQUFNLEVBQUU7WUFDTixTQUFTO1lBQ1QsUUFBUTtTQUNUO0tBQ0YsQ0FBQyxDQUFBO0lBRUYsSUFBSSxLQUFLLEtBQUssSUFBSTtRQUFFLE9BQU8sYUFBYSxDQUFBO0lBRXhDLE1BQU0sRUFBRSxHQUFHLEtBQUssQ0FBQyxRQUFRLElBQUksS0FBSyxDQUFDLEVBQUUsQ0FBQSxDQUFDLHFCQUFxQjtJQUUzRCxPQUFPLEVBQUUsUUFBUSxFQUFFLEVBQUUsRUFBRSxFQUFFLEVBQUUsQ0FBQTtBQUM3QixDQUFDO0FBRUQsTUFBTSx1QkFBdUIsR0FBRyxJQUFJLEtBQUssQ0FBQyxxQkFBcUIsQ0FBQyxDQUFBO0FBRWhFLE1BQU0sYUFBYSxHQUFHLElBQUksS0FBSyxDQUFDLFdBQVcsQ0FBQyxDQUFBIn0=

package/components/identity.otp/operations/confirm.js

@@ -0,0 +1,23 @@
+import { quote } from '@toa.io/generic';
+import { redeem } from './lib/index.js';
+export async function effect(input, context) {
+    const { authority, username, code, identity } = input;
+    const issued = await redeem({ authority, username, code, accepts: (value) => value === identity }, context);
+    if (issued instanceof Error)
+        return issued;
+    const entry = await context.local.ensure({
+        query: { criteria: `authority==${quote(authority)};username==${quote(username)}` },
+        entity: { authority, username, identity }
+    });
+    const bound = entry.identity ?? entry.id; // identity inception
+    if (bound !== identity) {
+        context.logs.debug('OTP username is tied to another identity', {
+            authority,
+            username
+        });
+        return ERR_EXISTS;
+    }
+    return undefined;
+}
+const ERR_EXISTS = new Error('EXISTS');
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29uZmlybS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NvdXJjZS9jb25maXJtLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxLQUFLLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQTtBQUN2QyxPQUFPLEVBQUUsTUFBTSxFQUFFLE1BQU0sZ0JBQWdCLENBQUE7QUFHdkMsTUFBTSxDQUFDLEtBQUssVUFBVSxNQUFNLENBQUMsS0FBWSxFQUFFLE9BQWdCO0lBQ3pELE1BQU0sRUFBRSxTQUFTLEVBQUUsUUFBUSxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsR0FBRyxLQUFLLENBQUE7SUFFckQsTUFBTSxNQUFNLEdBQUcsTUFBTSxNQUFNLENBQ3pCLEVBQUUsU0FBUyxFQUFFLFFBQVEsRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxLQUFLLEtBQUssUUFBUSxFQUFFLEVBQ3JFLE9BQU8sQ0FDUixDQUFBO0lBRUQsSUFBSSxNQUFNLFlBQVksS0FBSztRQUFFLE9BQU8sTUFBTSxDQUFBO0lBRTFDLE1BQU0sS0FBSyxHQUFHLE1BQU0sT0FBTyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUM7UUFDdkMsS0FBSyxFQUFFLEVBQUUsUUFBUSxFQUFFLGNBQWMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxjQUFjLEtBQUssQ0FBQyxRQUFRLENBQUMsRUFBRSxFQUFFO1FBQ2xGLE1BQU0sRUFBRSxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsUUFBUSxFQUFFO0tBQzFDLENBQUMsQ0FBQTtJQUVGLE1BQU0sS0FBSyxHQUFHLEtBQUssQ0FBQyxRQUFRLElBQUksS0FBSyxDQUFDLEVBQUUsQ0FBQSxDQUFDLHFCQUFxQjtJQUU5RCxJQUFJLEtBQUssS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUN2QixPQUFPLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQywwQ0FBMEMsRUFBRTtZQUM3RCxTQUFTO1lBQ1QsUUFBUTtTQUNULENBQUMsQ0FBQTtRQUVGLE9BQU8sVUFBVSxDQUFBO0lBQ25CLENBQUM7SUFFRCxPQUFPLFNBQVMsQ0FBQTtBQUNsQixDQUFDO0FBRUQsTUFBTSxVQUFVLEdBQUcsSUFBSSxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUEifQ==

package/components/identity.otp/operations/issue.js

@@ -1,19 +1,13 @@
 import { randomInt } from 'node:crypto';
+import { SIGN_IN } from './lib/index.js';
 export async function effect(input, context) {
     const { authority, username, identity } = input;
     const code = randomInt(100000, 1000000).toString();
     const key = `${authority}:${username}:${code}`;
     const lifetime = input.lifetime ?? context.configuration.lifetime;
-    if (identity !== undefined)
-        await context.local.ensure({
-            entity: {
-                authority,
-                username,
-                identity
-            }
-        });
     context.logs.debug('Issue OTP', { authority, username, identity, lifetime });
-    await context.stash.set(key, 1, 'EX', lifetime);
+    // the username is tied to the identity once `confirm` is given the code, not before
+    await context.stash.set(key, identity ?? SIGN_IN, 'EX', lifetime);
     return { code };
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaXNzdWUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zb3VyY2UvaXNzdWUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLGFBQWEsQ0FBQTtBQUd2QyxNQUFNLENBQUMsS0FBSyxVQUFVLE1BQU0sQ0FBQyxLQUFZLEVBQUUsT0FBZ0I7SUFDekQsTUFBTSxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsUUFBUSxFQUFFLEdBQUcsS0FBSyxDQUFBO0lBQy9DLE1BQU0sSUFBSSxHQUFHLFNBQVMsQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLENBQUMsUUFBUSxFQUFFLENBQUE7SUFDbEQsTUFBTSxHQUFHLEdBQUcsR0FBRyxTQUFTLElBQUksUUFBUSxJQUFJLElBQUksRUFBRSxDQUFBO0lBQzlDLE1BQU0sUUFBUSxHQUFHLEtBQUssQ0FBQyxRQUFRLElBQUksT0FBTyxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUE7SUFFakUsSUFBSSxRQUFRLEtBQUssU0FBUztRQUN4QixNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDO1lBQ3pCLE1BQU0sRUFBRTtnQkFDTixTQUFTO2dCQUNULFFBQVE7Z0JBQ1IsUUFBUTthQUNUO1NBQ0YsQ0FBQyxDQUFBO0lBRUosT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsV0FBVyxFQUFFLEVBQUUsU0FBUyxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQTtJQUU1RSxNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRSxDQUFDLEVBQUUsSUFBSSxFQUFFLFFBQVEsQ0FBQyxDQUFBO0lBRS9DLE9BQU8sRUFBRSxJQUFJLEVBQUUsQ0FBQTtBQUNqQixDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaXNzdWUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zb3VyY2UvaXNzdWUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLGFBQWEsQ0FBQTtBQUN2QyxPQUFPLEVBQUUsT0FBTyxFQUFFLE1BQU0sZ0JBQWdCLENBQUE7QUFHeEMsTUFBTSxDQUFDLEtBQUssVUFBVSxNQUFNLENBQUMsS0FBWSxFQUFFLE9BQWdCO0lBQ3pELE1BQU0sRUFBRSxTQUFTLEVBQUUsUUFBUSxFQUFFLFFBQVEsRUFBRSxHQUFHLEtBQUssQ0FBQTtJQUMvQyxNQUFNLElBQUksR0FBRyxTQUFTLENBQUMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxDQUFDLFFBQVEsRUFBRSxDQUFBO0lBQ2xELE1BQU0sR0FBRyxHQUFHLEdBQUcsU0FBUyxJQUFJLFFBQVEsSUFBSSxJQUFJLEVBQUUsQ0FBQTtJQUM5QyxNQUFNLFFBQVEsR0FBRyxLQUFLLENBQUMsUUFBUSxJQUFJLE9BQU8sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFBO0lBRWpFLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLFdBQVcsRUFBRSxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsUUFBUSxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUE7SUFFNUUsb0ZBQW9GO0lBQ3BGLE1BQU0sT0FBTyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsR0FBRyxFQUFFLFFBQVEsSUFBSSxPQUFPLEVBQUUsSUFBSSxFQUFFLFFBQVEsQ0FBQyxDQUFBO0lBRWpFLE9BQU8sRUFBRSxJQUFJLEVBQUUsQ0FBQTtBQUNqQixDQUFDIn0=

package/components/identity.otp/operations/lib/index.js

@@ -1,2 +1,2 @@
-export {};
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zb3VyY2UvbGliL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIifQ==
+export { redeem, SIGN_IN } from './redeem.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zb3VyY2UvbGliL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFBRSxNQUFNLEVBQUUsT0FBTyxFQUFFLE1BQU0sYUFBYSxDQUFBIn0=

package/components/identity.otp/operations/lib/redeem.js

@@ -0,0 +1,28 @@
+/**
+ * Spends a code that `accepts` takes and answers what it was issued with: `SIGN_IN`, or the
+ * identity the username is to be tied to. A code it does not take stays for the operation that
+ * does, and counts as a wrong one.
+ */
+export async function redeem({ authority, username, code, accepts }, context) {
+    const attempts = `${authority}:${username}:attempts`;
+    const attempt = await context.stash.incr(attempts);
+    if (attempt === 1)
+        await context.stash.expire(attempts, context.configuration.lifetime);
+    if (attempt > context.configuration.attempts) {
+        context.logs.debug('OTP attempts exceeded', { authority, username, attempt });
+        return ERR_TOO_MANY_ATTEMPTS;
+    }
+    const key = `${authority}:${username}:${code}`;
+    const issued = await context.stash.get(key);
+    // of two requests with one code, the one that deletes it is the one it is spent on
+    if (issued === null || !accepts(issued) || (await context.stash.del(key)) === 0) {
+        context.logs.debug('OTP code not found', { authority, username, attempt });
+        return ERR_EXPIRED;
+    }
+    await context.stash.del(attempts);
+    return issued;
+}
+export const SIGN_IN = '1';
+const ERR_EXPIRED = new Error('EXPIRED');
+const ERR_TOO_MANY_ATTEMPTS = new Error('TOO_MANY_ATTEMPTS');
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVkZWVtLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc291cmNlL2xpYi9yZWRlZW0udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBRUE7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxLQUFLLFVBQVUsTUFBTSxDQUMxQixFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBYyxFQUNsRCxPQUFnQjtJQUVoQixNQUFNLFFBQVEsR0FBRyxHQUFHLFNBQVMsSUFBSSxRQUFRLFdBQVcsQ0FBQTtJQUNwRCxNQUFNLE9BQU8sR0FBRyxNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFBO0lBRWxELElBQUksT0FBTyxLQUFLLENBQUM7UUFBRSxNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLFFBQVEsRUFBRSxPQUFPLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxDQUFBO0lBRXZGLElBQUksT0FBTyxHQUFHLE9BQU8sQ0FBQyxhQUFhLENBQUMsUUFBUSxFQUFFLENBQUM7UUFDN0MsT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsdUJBQXVCLEVBQUUsRUFBRSxTQUFTLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUE7UUFFN0UsT0FBTyxxQkFBcUIsQ0FBQTtJQUM5QixDQUFDO0lBRUQsTUFBTSxHQUFHLEdBQUcsR0FBRyxTQUFTLElBQUksUUFBUSxJQUFJLElBQUksRUFBRSxDQUFBO0lBQzlDLE1BQU0sTUFBTSxHQUFHLE1BQU0sT0FBTyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUE7SUFFM0MsbUZBQW1GO0lBQ25GLElBQUksTUFBTSxLQUFLLElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sT0FBTyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUNoRixPQUFPLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxvQkFBb0IsRUFBRSxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQTtRQUUxRSxPQUFPLFdBQVcsQ0FBQTtJQUNwQixDQUFDO0lBRUQsTUFBTSxPQUFPLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQTtJQUVqQyxPQUFPLE1BQU0sQ0FBQTtBQUNmLENBQUM7QUFFRCxNQUFNLENBQUMsTUFBTSxPQUFPLEdBQUcsR0FBRyxDQUFBO0FBRTFCLE1BQU0sV0FBVyxHQUFHLElBQUksS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFBO0FBRXhDLE1BQU0scUJBQXFCLEdBQUcsSUFBSSxLQUFLLENBQUMsbUJBQW1CLENBQUMsQ0FBQSJ9

package/components/identity.otp/source/authenticate.ts

@@ -1,3 +1,4 @@
+import { redeem, SIGN_IN } from './lib/index.ts'
 import type { Context } from './lib/index.ts'
 
 export async function effect(input: Input, context: Context): Promise<Output | Error> {
@@ -6,27 +7,21 @@ export async function effect(input: Input, context: Context): Promise<Output | E
 
   if (code === undefined) return ERR_INVALID_CREDENTIALS
 
-  const attempts = `${authority}:${username}:attempts`
-  const attempt = await context.stash.incr(attempts)
-
-  if (attempt === 1) await context.stash.expire(attempts, context.configuration.lifetime)
-
-  if (attempt > context.configuration.attempts) {
-    context.logs.debug('OTP attempts exceeded', { authority, username, attempt })
-
-    return ERR_TOO_MANY_ATTEMPTS
-  }
-
-  const key = `${authority}:${username}:${code}`
-  const n = await context.stash.del(key)
-
-  if (n === 0) {
-    context.logs.debug('OTP code not found', { authority, username, attempt })
+  // a code issued with an identity signs in only where the username is that identity's own id:
+  // any other is for `confirm`, and would tie the username to an identity of someone else's choosing
+  const issued = await redeem(
+    {
+      authority,
+      username,
+      code,
+      accepts: (value) => value === SIGN_IN || value === username
+    },
+    context
+  )
 
-    return ERR_EXPIRED
-  }
+  if (issued instanceof Error) return issued
 
-  await context.stash.del(attempts)
+  if (issued === username) return { identity: { id: issued } }
 
   const entry = await context.local.ensure({
     entity: {
@@ -44,10 +39,6 @@ export async function effect(input: Input, context: Context): Promise<Output | E
 
 const ERR_INVALID_CREDENTIALS = new Error('INVALID_CREDENTIALS')
 
-const ERR_EXPIRED = new Error('EXPIRED')
-
-const ERR_TOO_MANY_ATTEMPTS = new Error('TOO_MANY_ATTEMPTS')
-
 const ERR_NOT_FOUND = new Error('NOT_FOUND')
 
 interface Input {

package/components/identity.otp/source/confirm.ts

@@ -0,0 +1,41 @@
+import { quote } from '@toa.io/generic'
+import { redeem } from './lib/index.ts'
+import type { Context } from './lib/index.ts'
+
+export async function effect(input: Input, context: Context): Promise<void | Error> {
+  const { authority, username, code, identity } = input
+
+  const issued = await redeem(
+    { authority, username, code, accepts: (value) => value === identity },
+    context
+  )
+
+  if (issued instanceof Error) return issued
+
+  const entry = await context.local.ensure({
+    query: { criteria: `authority==${quote(authority)};username==${quote(username)}` },
+    entity: { authority, username, identity }
+  })
+
+  const bound = entry.identity ?? entry.id // identity inception
+
+  if (bound !== identity) {
+    context.logs.debug('OTP username is tied to another identity', {
+      authority,
+      username
+    })
+
+    return ERR_EXISTS
+  }
+
+  return undefined
+}
+
+const ERR_EXISTS = new Error('EXISTS')
+
+interface Input {
+  authority: string
+  username: string
+  code: string
+  identity: string
+}

package/components/identity.otp/source/issue.ts

@@ -1,4 +1,5 @@
 import { randomInt } from 'node:crypto'
+import { SIGN_IN } from './lib/index.ts'
 import type { Context } from './lib/index.ts'
 
 export async function effect(input: Input, context: Context): Promise<Output> {
@@ -7,18 +8,10 @@ export async function effect(input: Input, context: Context): Promise<Output> {
   const key = `${authority}:${username}:${code}`
   const lifetime = input.lifetime ?? context.configuration.lifetime
 
-  if (identity !== undefined)
-    await context.local.ensure({
-      entity: {
-        authority,
-        username,
-        identity
-      }
-    })
-
   context.logs.debug('Issue OTP', { authority, username, identity, lifetime })
 
-  await context.stash.set(key, 1, 'EX', lifetime)
+  // the username is tied to the identity once `confirm` is given the code, not before
+  await context.stash.set(key, identity ?? SIGN_IN, 'EX', lifetime)
 
   return { code }
 }

package/components/identity.otp/source/lib/index.ts

@@ -1 +1,2 @@
 export type { Context } from './Context.ts'
+export { redeem, SIGN_IN } from './redeem.ts'

package/components/identity.otp/source/lib/redeem.ts

@@ -0,0 +1,49 @@
+import type { Context } from './Context.ts'
+
+/**
+ * Spends a code that `accepts` takes and answers what it was issued with: `SIGN_IN`, or the
+ * identity the username is to be tied to. A code it does not take stays for the operation that
+ * does, and counts as a wrong one.
+ */
+export async function redeem(
+  { authority, username, code, accepts }: Redemption,
+  context: Context
+): Promise<string | Error> {
+  const attempts = `${authority}:${username}:attempts`
+  const attempt = await context.stash.incr(attempts)
+
+  if (attempt === 1) await context.stash.expire(attempts, context.configuration.lifetime)
+
+  if (attempt > context.configuration.attempts) {
+    context.logs.debug('OTP attempts exceeded', { authority, username, attempt })
+
+    return ERR_TOO_MANY_ATTEMPTS
+  }
+
+  const key = `${authority}:${username}:${code}`
+  const issued = await context.stash.get(key)
+
+  // of two requests with one code, the one that deletes it is the one it is spent on
+  if (issued === null || !accepts(issued) || (await context.stash.del(key)) === 0) {
+    context.logs.debug('OTP code not found', { authority, username, attempt })
+
+    return ERR_EXPIRED
+  }
+
+  await context.stash.del(attempts)
+
+  return issued
+}
+
+export const SIGN_IN = '1'
+
+const ERR_EXPIRED = new Error('EXPIRED')
+
+const ERR_TOO_MANY_ATTEMPTS = new Error('TOO_MANY_ATTEMPTS')
+
+interface Redemption {
+  authority: string
+  username: string
+  code: string
+  accepts: (issued: string) => boolean
+}

package/components/identity.otp/types/toa.d.ts

@@ -29,6 +29,13 @@ export type IssueInput = {
   lifetime?: number
 }
 
+export type ConfirmInput = {
+  authority: string
+  username: string
+  code: string
+  identity: string
+}
+
 export type AuthenticateInput = {
   authority: string
   credentials: string
@@ -42,6 +49,7 @@ export type AuthenticateOutput = {
 
 export interface Component {
   issue: (request: { input: IssueInput, entity?: Partial<Entity>, task?: boolean }) => Promise<unknown>
+  confirm: (request: { input: ConfirmInput, entity?: Partial<Entity>, task?: boolean }) => Promise<{} | null | undefined | CodedError<"EXPIRED" | "TOO_MANY_ATTEMPTS" | "EXISTS">>
   authenticate: (request: { input: AuthenticateInput, entity?: Partial<Entity>, task?: boolean }) => Promise<AuthenticateOutput | CodedError<"INVALID_CREDENTIALS" | "EXPIRED" | "TOO_MANY_ATTEMPTS" | "NOT_FOUND">>
   assign: (request: { input?: null, query?: Query<Entity>, task?: boolean }) => Promise<Entity>
   ensure: (request: { input?: null, query?: Query<Entity>, entity?: Partial<Entity>, task?: boolean }) => Promise<Entity>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@toa.io/extensions.exposition",
-  "version": "1.0.0-alpha.330",
+  "version": "1.0.0-alpha.331",
   "type": "module",
   "description": "Toa Exposition",
   "author": "temich <tema.gurtovoy@gmail.com>",
@@ -29,7 +29,7 @@
   ],
   "dependencies": {
     "@toa.io/core": "1.0.0-alpha.330",
-    "@toa.io/definitions": "1.0.0-alpha.330",
+    "@toa.io/definitions": "1.0.0-alpha.331",
     "@toa.io/generic": "1.0.0-alpha.330",
     "@toa.io/pointer": "1.0.0-alpha.330",
     "@toa.io/schemas": "1.0.0-alpha.330",
@@ -63,7 +63,7 @@
     "features:octets": "TSX_TSCONFIG_PATH=features/steps/tsconfig.json NODE_OPTIONS=--import=tsx cucumber-js features/octets.*"
   },
   "devDependencies": {
-    "@node-rs/bcrypt": "1.10.9",
+    "@node-rs/bcrypt": "2.0.0",
     "@simplewebauthn/server": "14.0.3",
     "@toa.io/agent": "*",
     "@toa.io/extensions.storages": "*",
@@ -74,5 +74,5 @@
     "lru-cache": "11.5.3",
     "paseto": "4.0.1"
   },
-  "gitHead": "8d5b161d026b24ee1974005e1f418bc2b782fd3b"
+  "gitHead": "e7020d160910ca4f0c2ff9040b3cbb4fca8ea41f"
 }