@udibo/oauth2 0.2.0 → 0.3.1

package/esm/testing/contract/tenant.d.ts

@@ -1,7 +1,8 @@
 /**
  * Contract test suite for a Udibo tenant's authorization answers: what
- * introspection reports about a signed-in person, and what `POST /api/check`
- * and `POST /api/check/batch` answer.
+ * introspection reports about a signed-in person, what `GET /api/memberships`
+ * lists for them, and what `POST /api/check` and `POST /api/check/batch`
+ * answer.
  *
  * It runs against `createFakeTenant` from `@udibo/oauth2/testing` and against the
  * real identity service in Udibo's own repository, so the fake an app tests
@@ -50,7 +51,10 @@ export interface TenantContractFixture {
     addUser(permissions: string[]): Promise<string>;
     /** Adds an organization and returns its id. */
     addOrganization(): Promise<string>;
-    /** Makes a person a member holding `permissions` inside that organization. */
+    /**
+     * Makes a person a `member` of an organization, holding `permissions`
+     * inside it.
+     */
     addMember(organizationId: string, userId: string, permissions: string[]): Promise<void>;
     /** Ends a membership. */
     removeMember(organizationId: string, userId: string): Promise<void>;

package/esm/testing/contract/tenant.js

@@ -1,7 +1,8 @@
 /**
  * Contract test suite for a Udibo tenant's authorization answers: what
- * introspection reports about a signed-in person, and what `POST /api/check`
- * and `POST /api/check/batch` answer.
+ * introspection reports about a signed-in person, what `GET /api/memberships`
+ * lists for them, and what `POST /api/check` and `POST /api/check/batch`
+ * answer.
  *
  * It runs against `createFakeTenant` from `@udibo/oauth2/testing` and against the
  * real identity service in Udibo's own repository, so the fake an app tests
@@ -152,6 +153,26 @@ export function runTenantContractTests(options) {
                 assertEquals(sorted(claims.permissions), []);
             });
         });
+        describe("GET /api/memberships", () => {
+            it("lists the organizations the caller belongs to, and no others", async () => {
+                const { access_token } = await tenant.signIn(people.member);
+                const response = await send(new URL("/api/memberships", tenant.issuer), { headers: { authorization: `Bearer ${access_token}` } });
+                assertEquals(response.status, 200);
+                const body = await response.json();
+                assertEquals(body.memberships.map((membership) => membership.org_id).sort(), [organizations.home, organizations.other].sort());
+                for (const membership of body.memberships) {
+                    assertEquals(membership.roles, ["member"]);
+                    assert(membership.org_slug, "every membership names its slug");
+                    assert(membership.name, "every membership names its organization");
+                }
+                assertEquals(body.cursor, null);
+            });
+            it("refuses a caller with no bearer token", async () => {
+                const response = await send(new URL("/api/memberships", tenant.issuer));
+                await response.body?.cancel();
+                assertEquals(response.status, 401);
+            });
+        });
         describe("POST /api/check", () => {
             it("answers the credential's own organization when no resource is named", async () => {
                 const { access_token } = await tenant.signIn(people.member, organizations.home);

package/esm/testing/tenant.d.ts

@@ -32,10 +32,15 @@ export interface FakeTenantOrganization {
     id: string;
     /** The handle `org_slug` carries. Never an authorization key. */
     slug: string;
+    /** The display name `/api/memberships` reports. Defaults to the slug. */
+    name?: string;
 }
 /** A person's place in one organization. */
 export interface FakeTenantMembership {
-    /** The role slugs `org_roles` reports. */
+    /**
+     * The membership's roles, as `org_roles` and `/api/memberships` report
+     * them — `member`, `admin` or `owner` on a real tenant.
+     */
     roles?: string[];
     /** Permissions held inside this organization only. */
     permissions?: string[];
@@ -99,9 +104,10 @@ export interface FakeTenantOptions {
 /**
  * A stand-in for a Udibo tenant, for testing an app that signs in against one
  * without running the identity service. It answers the tenant's protocol
- * surface — discovery, authorize, token, introspection, UserInfo, JWKS — and
- * the two authorization questions, `POST /api/check` and
- * `POST /api/check/batch`, with the same shapes a real tenant uses.
+ * surface — discovery, authorize, token, introspection, UserInfo, JWKS — the
+ * caller's own `GET /api/memberships`, and the two authorization questions,
+ * `POST /api/check` and `POST /api/check/batch`, with the same shapes a real
+ * tenant uses.
  *
  * Nothing here is interactive: {@linkcode signInAs} decides who the next
  * authorization request authenticates, and there is no consent step. Serve

package/esm/testing/tenant.js

@@ -277,6 +277,22 @@ export async function createFakeTenant(options) {
         }
         return organization.id;
     };
+    const memberships = async (request) => {
+        const caller = await authenticated(request);
+        if (caller instanceof Response)
+            return caller;
+        return Response.json({
+            memberships: [...organizations.values()]
+                .filter((organization) => organization.members.has(caller.user.id))
+                .map((organization) => ({
+                org_id: organization.id,
+                org_slug: organization.slug,
+                name: organization.name ?? organization.slug,
+                roles: organization.members.get(caller.user.id).roles ?? [],
+            })),
+            cursor: null,
+        });
+    };
     const authorize = async (request) => {
         const chosen = signedIn;
         const requested = new URL(request.url).searchParams.get("organization");
@@ -327,6 +343,7 @@ export async function createFakeTenant(options) {
         [`GET ${PATHS.userinfo}`]: (r) => server.handleUserInfoRequest(r),
         [`POST ${PATHS.userinfo}`]: (r) => server.handleUserInfoRequest(r),
         [`GET ${PATHS.jwks}`]: (r) => server.handleJwksRequest(r),
+        "GET /api/memberships": memberships,
         "POST /api/check": check,
         "POST /api/check/batch": checkBatch,
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@udibo/oauth2",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "A flexible OAuth2 toolkit: framework-agnostic authorization & resource servers, a typed client, Hono adapters (including a backend-for-frontend), and React bindings.",
   "repository": {
     "type": "git",