@toa.io/extensions.exposition 1.0.0-alpha.5 → 1.0.0-alpha.51

package/components/identity.federation/source/authenticate.ts

@@ -1,27 +1,14 @@
 import { type Maybe } from '@toa.io/types'
-import { Err } from 'error-value'
 import { assertionsAsValues } from './lib/assertions-as-values.js'
-import {
-  validateIdToken
-} from './lib/jwt'
-import type { Request } from '@toa.io/core'
-import type { AuthenticateOutput, Context } from './types'
+import { validateIdToken } from './lib/jwt'
+import type { AuthenticateInput, AuthenticateOutput, Context } from './types'
 
-async function authenticate (input: string,
+async function authenticate ({ authority, credentials }: AuthenticateInput,
   context: Context): Promise<Maybe<AuthenticateOutput>> {
-  const { iss, sub } = await validateIdToken(input, context.configuration.trust)
+  const { iss, sub, aud } = await validateIdToken(credentials, context.configuration.trust)
+  const { id } = await context.local.ensure({ entity: { authority, iss, sub } })
 
-  const request: Request = { query: { criteria: `iss==${iss};sub==${sub}` } }
-
-  let id = (await context.local.observe(request))?.id
-
-  if (id === undefined) {
-    if (context.configuration.explicit_identity_creation === true) return Err('NOT_FOUND')
-
-    id = (await context.local.transit({ input: { iss, sub } })).id
-  }
-
-  return { identity: { id } }
+  return { identity: { id, claim: { iss, sub, aud } } }
 }
 
 // Exporting as a function returning assertion errors as values

package/components/identity.federation/source/{create.ts → incept.ts}

@@ -3,24 +3,25 @@ import { validateIdToken } from './lib/jwt'
 import type { Request } from '@toa.io/core'
 import type { Context, Entity } from './types'
 
-async function create (input: CreateInput, context: Context): Promise<CreateOutput> {
+async function incept (input: Input, context: Context): Promise<Output> {
   const { iss, sub } = await validateIdToken(input.credentials, context.configuration.trust)
 
-  const request: Request = {
-    input: { iss, sub } satisfies Omit<Entity, 'id'>,
-    query: { id: input.id }
-  }
+  const request: Request = { input: { authority: input.authority, iss, sub } satisfies Omit<Entity, 'id'> }
+
+  if (input.id !== undefined)
+    request.query = { id: input.id }
 
   return await context.local.transit(request)
 }
 
-interface CreateInput {
-  id: string
+interface Input {
+  authority: string
   credentials: string
+  id?: string
 }
 
-interface CreateOutput {
+interface Output {
   id: string
 }
 
-export const effect = assertionsAsValues(create)
+export const effect = assertionsAsValues(incept)

package/components/identity.federation/source/lib/jwt.test.ts

@@ -1,8 +1,54 @@
-/* eslint-disable max-len */
 /* eslint-disable @typescript-eslint/consistent-type-assertions */
-import { validateSignature, decodeJwt } from './jwt'
+import { validateSignature, decodeJwt, validateJwtPayload } from './jwt'
+import type { IdToken, JwtHeader, Trust } from '../types'
 
 describe('jwt', () => {
+  describe('validateJwtPayload', () => {
+    const jwtHeader: JwtHeader = { alg: 'HS256', kid: 'k1' }
+
+    const trusted: Trust[] = [{
+      iss: 'test-iss',
+      aud: ['test-aud1', 'test-aud2'],
+      secrets: { [jwtHeader.alg]: { [jwtHeader.kid!]: 'test-secrete' } }
+    }]
+
+    const validJwtPayload: IdToken = {
+      iss: trusted[0].iss,
+      sub: 'test-sub',
+      iat: Date.now() / 1000,
+      exp: Date.now() / 1000 + 2000,
+      aud: trusted[0].aud![1]
+    }
+
+    describe('aud', () => {
+      test('throws without it', () => {
+        const { aud, ...noAudPayload } = validJwtPayload
+
+        expect(() => validateJwtPayload(noAudPayload, trusted, jwtHeader)).toThrow('Payload is missing aud')
+      })
+
+      test('passes with a single string', () => {
+        expect(validJwtPayload.aud).toEqual(expect.any(String))
+        expect(() => validateJwtPayload(validJwtPayload, trusted, jwtHeader)).not.toThrow()
+      })
+
+      test('passes with an array', () => {
+        const arrayAudPayload = { ...validJwtPayload, aud: trusted[0].aud }
+
+        expect(arrayAudPayload.aud).toEqual(expect.any(Array))
+        expect(() => validateJwtPayload(arrayAudPayload, trusted, jwtHeader)).not.toThrow()
+      })
+
+      test('throws with an array that does not intersects', () => {
+        const arrayAudPayload = { ...validJwtPayload, aud: ['boo', 'foo'] }
+
+        expect(arrayAudPayload.aud).toEqual(expect.any(Array))
+        expect(() => validateJwtPayload(arrayAudPayload, trusted, jwtHeader))
+          .toThrow('Unknown audiences: boo, foo')
+      })
+    })
+  })
+
   test('decode', () => {
     const { header, payload } = decodeJwt('eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzb21lIjoicGF5bG9hZCJ9.4twFt5NiznN84AWoo1d7KO1T_yoc0Z6XOpOVswacPZg')
 
@@ -22,7 +68,7 @@ describe('jwt', () => {
       signature: '4twFt5NiznN84AWoo1d7KO1T_yoc0Z6XOpOVswacPZg',
       trusted: [
         {
-          issuer: 'test-issuer',
+          iss: 'test-issuer',
           secrets: {
             HS256: {
               k1: 'old-secret',
@@ -43,7 +89,7 @@ describe('jwt', () => {
       signature: 'signature',
       trusted: [
         {
-          issuer: 'test-issuer',
+          iss: 'test-issuer',
           secrets: {
             HS256: {
               theKey: 'secret'

package/components/identity.federation/source/lib/jwt.ts

@@ -1,7 +1,6 @@
 import crypto from 'node:crypto'
 import * as assert from 'node:assert'
-import { type JwtHeader, type IdToken } from '../types'
-import { type TrustConfiguration } from '../schemas'
+import type { JwtHeader, IdToken, Trust } from '../types'
 
 export function decodeJwt (token: string): {
   header: unknown
@@ -27,7 +26,7 @@ export function validateJwtHeader (header: unknown): asserts header is JwtHeader
 }
 
 export function validateJwtPayload (payload: unknown,
-  trusted: TrustConfiguration[] = [],
+  trusted: Trust[] = [],
   header: JwtHeader): asserts payload is IdToken {
   assert.ok(trusted.length > 0, 'No trusted issuers provided')
 
@@ -38,13 +37,22 @@ export function validateJwtPayload (payload: unknown,
   assert.ok('iss' in payload, 'Payload is missing iss')
   assert.ok(typeof payload.iss === 'string', 'Payload iss is not a string')
   assert.ok('aud' in payload, 'Payload is missing aud')
-  assert.ok(typeof payload.aud === 'string', 'Payload aud is not a string')
+  assert.ok(typeof payload.aud === 'string' ||
+    (Array.isArray(payload.aud) && payload.aud.every((e): e is string => typeof e === 'string')),
+  'Payload aud is not a string nor an array of strings')
 
-  const issuer = trusted.find((config) => config.issuer === payload.iss)
+  const issuer = trusted.find((config) => config.iss === payload.iss)
 
-  assert.ok(issuer !== undefined &&
-      (issuer.audience === undefined || issuer.audience.some((a) => a === payload.aud),
-      `Unknown issuer / audience: ${payload.iss} / ${payload.aud}`))
+  assert.ok(issuer, `Unknown issuer: ${payload.iss}`)
+
+  if (Array.isArray(issuer.aud)) {
+    const tokenAud = payload.aud
+
+    if (typeof tokenAud === 'string')
+      assert.ok(issuer.aud.some((a) => a === tokenAud), `Unknown audience: ${tokenAud}`)
+    else
+      assert.ok(issuer.aud.some((a) => tokenAud.includes(a)), `Unknown audiences: ${tokenAud.join(', ')}`)
+  }
 
   if (header.alg.startsWith('HS')) {
     const secrets = issuer.secrets
@@ -90,12 +98,12 @@ export async function validateSignature ({
   readonly payload: IdToken
   rawPayload: string
   signature: string
-  trusted?: TrustConfiguration[]
+  trusted?: Trust[]
 }): Promise<void> {
   if (alg.startsWith('HS')) {
     // symmetric algorithm, issuer is validated at this point
-    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion -- `kid` is validated
-    const secrets = trusted.find((c) => c.issuer === iss)!.secrets![alg]
+
+    const secrets = trusted.find((c) => c.iss === iss)!.secrets![alg]
     const secret = kid !== undefined ? secrets[kid] : Object.values(secrets)[0]
     const algorithm = alg.replace(/^HS(\d{3})$/, 'sha$1') // HS256 -> sha256
     const hmac = crypto.createHmac(algorithm, secret)
@@ -153,7 +161,7 @@ export async function validateSignature ({
 }
 
 export async function validateIdToken (token: string,
-  trusted?: TrustConfiguration[]): Promise<IdToken> {
+  trusted?: Trust[]): Promise<IdToken> {
   const { header, payload, rawHeader, rawPayload, signature } = decodeJwt(token)
 
   validateJwtHeader(header)

package/components/identity.federation/source/types/configuration.ts

@@ -0,0 +1,15 @@
+export interface Configuration {
+  trust?: Trust[]
+  principal?: Principal
+}
+
+export interface Trust {
+  iss: string
+  aud?: [string, ...string[]]
+  secrets?: Record<string, Record<string, string>>
+}
+
+interface Principal {
+  iss: string
+  sub: string
+}

package/components/identity.federation/source/{types.ts → types/context.ts}

@@ -1,10 +1,12 @@
 import { type Call, type Observation, type Query } from '@toa.io/types'
-import type { Schemas } from './schemas'
+import type { Entity } from './entity'
+import type { Configuration } from './configuration'
 
 export interface Context {
   local: {
-    observe: Observation<Entity & { id: string }>
+    observe: Observation<Entity>
     transit: Call<TransitOutput, TransitInput>
+    ensure: Call<EnsureOutput>
   }
   remote: {
     identity: {
@@ -13,12 +15,11 @@ export interface Context {
       }
     }
   }
-  configuration: Required<Schemas>['configuration']
+  configuration: Configuration
 }
 
-export type Entity = Required<Schemas>['entity']
-
 export interface TransitInput {
+  readonly authority: string
   readonly iss: string
   readonly sub: string
 }
@@ -27,6 +28,10 @@ export interface TransitOutput {
   id: string
 }
 
+export interface EnsureOutput {
+  id: string
+}
+
 interface IdentityTokensRevokeInput {
   query: Query
 }
@@ -43,14 +48,20 @@ export interface JwtHeader {
 export interface IdToken {
   iss: string
   sub: string
-  aud: string
+  aud: string | string[]
   exp: number
   iat: number
   nbf?: number
 }
 
+export interface AuthenticateInput {
+  authority: string
+  credentials: string
+}
+
 export interface AuthenticateOutput {
   identity: {
     id: string
+    claim: Pick<IdToken, 'iss' | 'sub' | 'aud'>
   }
 }

package/components/identity.federation/source/types/entity.ts

@@ -0,0 +1,6 @@
+export interface Entity {
+  id: string
+  authority: string
+  iss: string
+  sub: string
+}

package/components/identity.federation/source/types/index.ts

@@ -0,0 +1,3 @@
+export * from './configuration'
+export * from './context'
+export * from './entity'

package/components/identity.federation/tsconfig.json

@@ -1,9 +1,9 @@
 {
   "extends": "../../tsconfig.json",
   "compilerOptions": {
-    "outDir": "./operations",
+    "outDir": "./operations"
   },
   "include": [
     "source"
   ]
-}
+}

package/components/identity.roles/manifest.toa.yaml

@@ -1,18 +1,23 @@
 namespace: identity
 name: roles
-version: 0.0.0
 
 entity:
   schema:
     identity*: string
-    role*: string
+    role*: /^[a-zA-Z0-9]{0,32}(:[a-zA-Z0-9]{0,32}){0,8}$/
+    grantor: string
+  unique:
+    role: [identity, role]
 
 operations:
-  transit:
+  grant:
     query: false
     input:
-      identity*: string
-      role*: string
+      identity*: .
+      role*: .
+      grantor:
+        id: string
+        roles: [string]
   list:
     output: [string]
   principal:
@@ -21,12 +26,19 @@ operations:
 
 receivers:
   identity.basic.principal: principal
+  identity.federation.principal: principal
 
 exposition:
   isolated: true
   /:identity:
     auth:role: system:identity:roles
-    POST: transit
+    POST:
+      io:output: [id, grantor]
+      auth:rule:
+        delegate: grantor
+        role: system:identity:roles:delegation
+      endpoint: grant
     GET:
+      io:output: true # array of strings
       auth:id: identity
       endpoint: list

package/components/identity.roles/operations/grant.d.ts

@@ -0,0 +1,10 @@
+import type { Entity } from './lib/Entity';
+export declare function transition(input: Input, object: Entity): Promise<Entity | Error>;
+export interface Input {
+    identity: string;
+    role: string;
+    grantor?: {
+        id: string;
+        roles: string[];
+    };
+}

package/components/identity.roles/operations/grant.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.transition = void 0;
+const error_value_1 = require("error-value");
+async function transition(input, object) {
+    if (input.grantor === undefined)
+        return Object.assign(object, input);
+    if (!within('system:identity:roles', input.grantor.roles) &&
+        !within(input.role, input.grantor.roles))
+        return ERR_OUT_OF_SCOPE;
+    object.role = input.role;
+    object.identity = input.identity;
+    object.grantor = input.grantor.id;
+    return object;
+}
+exports.transition = transition;
+function within(role, scopes) {
+    return scopes.some((scope) => role === scope || role.startsWith(scope + ':'));
+}
+const ERR_OUT_OF_SCOPE = (0, error_value_1.Err)('OUT_OF_SCOPE');
+//# sourceMappingURL=grant.js.map

package/components/identity.roles/operations/grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant.js","sourceRoot":"","sources":["../source/grant.ts"],"names":[],"mappings":";;;AAAA,6CAAiC;AAG1B,KAAK,UAAU,UAAU,CAAE,KAAY,EAAE,MAAc;IAC5D,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAErC,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACvD,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACxC,OAAO,gBAAgB,CAAA;IAEzB,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA;IACxB,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;IAChC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAA;IAEjC,OAAO,MAAM,CAAA;AACf,CAAC;AAbD,gCAaC;AAED,SAAS,MAAM,CAAE,IAAY,EAAE,MAAgB;IAC7C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAA;AAC/E,CAAC;AAED,MAAM,gBAAgB,GAAG,IAAA,iBAAG,EAAC,cAAc,CAAC,CAAA"}

package/components/identity.roles/operations/lib/Entity.d.ts

@@ -0,0 +1,5 @@
+export interface Entity {
+    identity: string;
+    role: string;
+    grantor?: string;
+}

package/components/identity.roles/operations/lib/Entity.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=Entity.js.map

package/components/identity.roles/operations/lib/Entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Entity.js","sourceRoot":"","sources":["../../source/lib/Entity.ts"],"names":[],"mappings":""}

package/components/identity.roles/operations/list.d.ts

@@ -1,5 +1,2 @@
+import type { Entity } from './lib/Entity';
 export declare function observation(_: unknown, objects: Entity[]): string[];
-interface Entity {
-    role: string;
-}
-export {};

package/components/identity.roles/operations/list.js.map

@@ -1 +1 @@
-{"version":3,"file":"list.js","sourceRoot":"","sources":["../source/list.ts"],"names":[],"mappings":";;;AAAA,SAAgB,WAAW,CAAE,CAAU,EAAE,OAAiB;IACxD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAA;AACxC,CAAC;AAFD,kCAEC"}
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../source/list.ts"],"names":[],"mappings":";;;AAEA,SAAgB,WAAW,CAAE,CAAU,EAAE,OAAiB;IACxD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAA;AACxC,CAAC;AAFD,kCAEC"}

package/components/identity.roles/operations/principal.d.ts

@@ -1,15 +1,13 @@
-import { type Call } from '@toa.io/types';
+import type { Entity } from './lib/Entity';
+import type { Call } from '@toa.io/types';
+import type { Input as GrantInput } from './grant';
 export declare function effect(input: Identity, context: Context): Promise<void>;
 interface Identity {
     id: string;
 }
 export interface Context {
     local: {
-        transit: Call<void, TransitInput>;
+        grant: Call<Entity, GrantInput>;
     };
 }
-interface TransitInput {
-    identity: string;
-    role: string;
-}
 export {};

package/components/identity.roles/operations/principal.js

@@ -2,7 +2,12 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.effect = void 0;
 async function effect(input, context) {
-    await context.local.transit({ input: { identity: input.id, role: 'system' } });
+    await context.local.grant({
+        input: {
+            identity: input.id,
+            role: 'system'
+        }
+    });
 }
 exports.effect = effect;
 //# sourceMappingURL=principal.js.map

package/components/identity.roles/operations/principal.js.map

@@ -1 +1 @@
-{"version":3,"file":"principal.js","sourceRoot":"","sources":["../source/principal.ts"],"names":[],"mappings":";;;AAEO,KAAK,UAAU,MAAM,CAAE,KAAe,EAAE,OAAgB;IAC7D,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;AAChF,CAAC;AAFD,wBAEC"}
+{"version":3,"file":"principal.js","sourceRoot":"","sources":["../source/principal.ts"],"names":[],"mappings":";;;AAIO,KAAK,UAAU,MAAM,CAAE,KAAe,EAAE,OAAgB;IAC7D,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QACxB,KAAK,EAAE;YACL,QAAQ,EAAE,KAAK,CAAC,EAAE;YAClB,IAAI,EAAE,QAAQ;SACf;KACF,CAAC,CAAA;AACJ,CAAC;AAPD,wBAOC"}