@toa.io/extensions.exposition 1.0.0-alpha.4 → 1.0.0-alpha.41

package/components/identity.federation/source/{create.ts → incept.ts}

@@ -3,24 +3,25 @@ import { validateIdToken } from './lib/jwt'
 import type { Request } from '@toa.io/core'
 import type { Context, Entity } from './types'
 
-async function create (input: CreateInput, context: Context): Promise<CreateOutput> {
+async function incept (input: Input, context: Context): Promise<Output> {
   const { iss, sub } = await validateIdToken(input.credentials, context.configuration.trust)
 
-  const request: Request = {
-    input: { iss, sub } satisfies Omit<Entity, 'id'>,
-    query: { id: input.id }
-  }
+  const request: Request = { input: { authority: input.authority, iss, sub } satisfies Omit<Entity, 'id'> }
+
+  if (input.id !== undefined)
+    request.query = { id: input.id }
 
   return await context.local.transit(request)
 }
 
-interface CreateInput {
-  id: string
+interface Input {
+  authority: string
   credentials: string
+  id?: string
 }
 
-interface CreateOutput {
+interface Output {
   id: string
 }
 
-export const effect = assertionsAsValues(create)
+export const effect = assertionsAsValues(incept)

package/components/identity.federation/source/lib/jwt.test.ts

@@ -22,7 +22,7 @@ describe('jwt', () => {
       signature: '4twFt5NiznN84AWoo1d7KO1T_yoc0Z6XOpOVswacPZg',
       trusted: [
         {
-          issuer: 'test-issuer',
+          iss: 'test-issuer',
           secrets: {
             HS256: {
               k1: 'old-secret',
@@ -43,7 +43,7 @@ describe('jwt', () => {
       signature: 'signature',
       trusted: [
         {
-          issuer: 'test-issuer',
+          iss: 'test-issuer',
           secrets: {
             HS256: {
               theKey: 'secret'

package/components/identity.federation/source/lib/jwt.ts

@@ -1,7 +1,6 @@
 import crypto from 'node:crypto'
 import * as assert from 'node:assert'
-import { type JwtHeader, type IdToken } from '../types'
-import { type TrustConfiguration } from '../schemas'
+import type { JwtHeader, IdToken, Trust } from '../types'
 
 export function decodeJwt (token: string): {
   header: unknown
@@ -27,7 +26,7 @@ export function validateJwtHeader (header: unknown): asserts header is JwtHeader
 }
 
 export function validateJwtPayload (payload: unknown,
-  trusted: TrustConfiguration[] = [],
+  trusted: Trust[] = [],
   header: JwtHeader): asserts payload is IdToken {
   assert.ok(trusted.length > 0, 'No trusted issuers provided')
 
@@ -40,10 +39,10 @@ export function validateJwtPayload (payload: unknown,
   assert.ok('aud' in payload, 'Payload is missing aud')
   assert.ok(typeof payload.aud === 'string', 'Payload aud is not a string')
 
-  const issuer = trusted.find((config) => config.issuer === payload.iss)
+  const issuer = trusted.find((config) => config.iss === payload.iss)
 
   assert.ok(issuer !== undefined &&
-      (issuer.audience === undefined || issuer.audience.some((a) => a === payload.aud),
+    (issuer.aud === undefined || issuer.aud.some((a) => a === payload.aud),
       `Unknown issuer / audience: ${payload.iss} / ${payload.aud}`))
 
   if (header.alg.startsWith('HS')) {
@@ -90,12 +89,12 @@ export async function validateSignature ({
   readonly payload: IdToken
   rawPayload: string
   signature: string
-  trusted?: TrustConfiguration[]
+  trusted?: Trust[]
 }): Promise<void> {
   if (alg.startsWith('HS')) {
     // symmetric algorithm, issuer is validated at this point
     // eslint-disable-next-line @typescript-eslint/no-non-null-assertion -- `kid` is validated
-    const secrets = trusted.find((c) => c.issuer === iss)!.secrets![alg]
+    const secrets = trusted.find((c) => c.iss === iss)!.secrets![alg]
     const secret = kid !== undefined ? secrets[kid] : Object.values(secrets)[0]
     const algorithm = alg.replace(/^HS(\d{3})$/, 'sha$1') // HS256 -> sha256
     const hmac = crypto.createHmac(algorithm, secret)
@@ -153,7 +152,7 @@ export async function validateSignature ({
 }
 
 export async function validateIdToken (token: string,
-  trusted?: TrustConfiguration[]): Promise<IdToken> {
+  trusted?: Trust[]): Promise<IdToken> {
   const { header, payload, rawHeader, rawPayload, signature } = decodeJwt(token)
 
   validateJwtHeader(header)

package/components/identity.federation/source/types/configuration.ts

@@ -0,0 +1,15 @@
+export interface Configuration {
+  trust?: Trust[]
+  principal?: Principal
+}
+
+export interface Trust {
+  iss: string
+  aud?: [string, ...string[]]
+  secrets?: Record<string, Record<string, string>>
+}
+
+interface Principal {
+  iss: string
+  sub: string
+}

package/components/identity.federation/source/{types.ts → types/context.ts}

@@ -1,10 +1,12 @@
 import { type Call, type Observation, type Query } from '@toa.io/types'
-import type { Schemas } from './schemas'
+import type { Entity } from './entity'
+import type { Configuration } from './configuration'
 
 export interface Context {
   local: {
-    observe: Observation<Entity & { id: string }>
+    observe: Observation<Entity>
     transit: Call<TransitOutput, TransitInput>
+    ensure: Call<EnsureOutput>
   }
   remote: {
     identity: {
@@ -13,12 +15,11 @@ export interface Context {
       }
     }
   }
-  configuration: Required<Schemas>['configuration']
+  configuration: Configuration
 }
 
-export type Entity = Required<Schemas>['entity']
-
 export interface TransitInput {
+  readonly authority: string
   readonly iss: string
   readonly sub: string
 }
@@ -27,6 +28,10 @@ export interface TransitOutput {
   id: string
 }
 
+export interface EnsureOutput {
+  id: string
+}
+
 interface IdentityTokensRevokeInput {
   query: Query
 }
@@ -49,6 +54,11 @@ export interface IdToken {
   nbf?: number
 }
 
+export interface AuthenticateInput {
+  authority: string
+  credentials: string
+}
+
 export interface AuthenticateOutput {
   identity: {
     id: string

package/components/identity.federation/source/types/entity.ts

@@ -0,0 +1,6 @@
+export interface Entity {
+  id: string
+  authority: string
+  iss: string
+  sub: string
+}

package/components/identity.federation/source/types/index.ts

@@ -0,0 +1,3 @@
+export * from './configuration'
+export * from './context'
+export * from './entity'

package/components/identity.federation/tsconfig.json

@@ -1,9 +1,9 @@
 {
   "extends": "../../tsconfig.json",
   "compilerOptions": {
-    "outDir": "./operations",
+    "outDir": "./operations"
   },
   "include": [
     "source"
   ]
-}
+}

package/components/identity.roles/manifest.toa.yaml

@@ -1,18 +1,23 @@
 namespace: identity
 name: roles
-version: 0.0.0
 
 entity:
   schema:
     identity*: string
-    role*: string
+    role*: /^[a-zA-Z0-9]{1,32}(:[a-zA-Z0-9]{1,32}){0,8}$/
+    grantor: string
+  unique:
+    role: [identity, role]
 
 operations:
-  transit:
+  grant:
     query: false
     input:
-      identity*: string
-      role*: string
+      identity*: .
+      role*: .
+      grantor:
+        id: string
+        roles: [string]
   list:
     output: [string]
   principal:
@@ -21,12 +26,19 @@ operations:
 
 receivers:
   identity.basic.principal: principal
+  identity.federation.principal: principal
 
 exposition:
   isolated: true
   /:identity:
     auth:role: system:identity:roles
-    POST: transit
+    POST:
+      io:output: [id, grantor]
+      auth:rule:
+        delegate: grantor
+        role: system:identity:roles:delegation
+      endpoint: grant
     GET:
+      io:output: true # array of strings
       auth:id: identity
       endpoint: list

package/components/identity.roles/operations/grant.d.ts

@@ -0,0 +1,10 @@
+import type { Entity } from './lib/Entity';
+export declare function transition(input: Input, object: Entity): Promise<Entity | Error>;
+export interface Input {
+    identity: string;
+    role: string;
+    grantor?: {
+        id: string;
+        roles: string[];
+    };
+}

package/components/identity.roles/operations/grant.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.transition = void 0;
+const error_value_1 = require("error-value");
+async function transition(input, object) {
+    if (input.grantor === undefined)
+        return Object.assign(object, input);
+    if (!within('system:identity:roles', input.grantor.roles) &&
+        !within(input.role, input.grantor.roles))
+        return ERR_OUT_OF_SCOPE;
+    object.role = input.role;
+    object.identity = input.identity;
+    object.grantor = input.grantor.id;
+    return object;
+}
+exports.transition = transition;
+function within(role, scopes) {
+    return scopes.some((scope) => role === scope || role.startsWith(scope + ':'));
+}
+const ERR_OUT_OF_SCOPE = (0, error_value_1.Err)('OUT_OF_SCOPE');
+//# sourceMappingURL=grant.js.map

package/components/identity.roles/operations/grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant.js","sourceRoot":"","sources":["../source/grant.ts"],"names":[],"mappings":";;;AAAA,6CAAiC;AAG1B,KAAK,UAAU,UAAU,CAAE,KAAY,EAAE,MAAc;IAC5D,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAErC,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACvD,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACxC,OAAO,gBAAgB,CAAA;IAEzB,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA;IACxB,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;IAChC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAA;IAEjC,OAAO,MAAM,CAAA;AACf,CAAC;AAbD,gCAaC;AAED,SAAS,MAAM,CAAE,IAAY,EAAE,MAAgB;IAC7C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAA;AAC/E,CAAC;AAED,MAAM,gBAAgB,GAAG,IAAA,iBAAG,EAAC,cAAc,CAAC,CAAA"}

package/components/identity.roles/operations/lib/Entity.d.ts

@@ -0,0 +1,5 @@
+export interface Entity {
+    identity: string;
+    role: string;
+    grantor?: string;
+}

package/components/identity.roles/operations/lib/Entity.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=Entity.js.map

package/components/identity.roles/operations/lib/Entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Entity.js","sourceRoot":"","sources":["../../source/lib/Entity.ts"],"names":[],"mappings":""}

package/components/identity.roles/operations/list.d.ts

@@ -1,5 +1,2 @@
+import type { Entity } from './lib/Entity';
 export declare function observation(_: unknown, objects: Entity[]): string[];
-interface Entity {
-    role: string;
-}
-export {};

package/components/identity.roles/operations/list.js.map

@@ -1 +1 @@
-{"version":3,"file":"list.js","sourceRoot":"","sources":["../source/list.ts"],"names":[],"mappings":";;;AAAA,SAAgB,WAAW,CAAE,CAAU,EAAE,OAAiB;IACxD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAA;AACxC,CAAC;AAFD,kCAEC"}
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../source/list.ts"],"names":[],"mappings":";;;AAEA,SAAgB,WAAW,CAAE,CAAU,EAAE,OAAiB;IACxD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAA;AACxC,CAAC;AAFD,kCAEC"}

package/components/identity.roles/operations/principal.d.ts

@@ -1,15 +1,13 @@
-import { type Call } from '@toa.io/types';
+import type { Entity } from './lib/Entity';
+import type { Call } from '@toa.io/types';
+import type { Input as GrantInput } from './grant';
 export declare function effect(input: Identity, context: Context): Promise<void>;
 interface Identity {
     id: string;
 }
 export interface Context {
     local: {
-        transit: Call<void, TransitInput>;
+        grant: Call<Entity, GrantInput>;
     };
 }
-interface TransitInput {
-    identity: string;
-    role: string;
-}
 export {};

package/components/identity.roles/operations/principal.js

@@ -2,7 +2,12 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.effect = void 0;
 async function effect(input, context) {
-    await context.local.transit({ input: { identity: input.id, role: 'system' } });
+    await context.local.grant({
+        input: {
+            identity: input.id,
+            role: 'system'
+        }
+    });
 }
 exports.effect = effect;
 //# sourceMappingURL=principal.js.map

package/components/identity.roles/operations/principal.js.map

@@ -1 +1 @@
-{"version":3,"file":"principal.js","sourceRoot":"","sources":["../source/principal.ts"],"names":[],"mappings":";;;AAEO,KAAK,UAAU,MAAM,CAAE,KAAe,EAAE,OAAgB;IAC7D,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;AAChF,CAAC;AAFD,wBAEC"}
+{"version":3,"file":"principal.js","sourceRoot":"","sources":["../source/principal.ts"],"names":[],"mappings":";;;AAIO,KAAK,UAAU,MAAM,CAAE,KAAe,EAAE,OAAgB;IAC7D,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QACxB,KAAK,EAAE;YACL,QAAQ,EAAE,KAAK,CAAC,EAAE;YAClB,IAAI,EAAE,QAAQ;SACf;KACF,CAAC,CAAA;AACJ,CAAC;AAPD,wBAOC"}