@undefineds.co/xpod 0.4.3 → 0.4.5

package/dist/components/context.jsonld

@@ -3141,6 +3141,86 @@
           }
         }
       },
+      "SessionBoundIdentityProviderFactory": {
+        "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory",
+        "@prefix": true,
+        "@context": {
+          "config": {
+            "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_config",
+            "@type": "@json"
+          },
+          "args_promptFactory": {
+            "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_promptFactory"
+          },
+          "args_adapterFactory": {
+            "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_adapterFactory"
+          },
+          "args_baseUrl": {
+            "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_baseUrl"
+          },
+          "args_oidcPath": {
+            "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_oidcPath"
+          },
+          "args_interactionRoute": {
+            "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_interactionRoute"
+          },
+          "args_clientCredentialsStore": {
+            "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_clientCredentialsStore"
+          },
+          "args_storage": {
+            "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_storage"
+          },
+          "args_jwkGenerator": {
+            "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_jwkGenerator"
+          },
+          "args_showStackTrace": {
+            "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_showStackTrace"
+          },
+          "args_errorHandler": {
+            "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_errorHandler"
+          },
+          "args_responseWriter": {
+            "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_responseWriter"
+          },
+          "g": {
+            "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_config",
+            "@type": "@json"
+          },
+          "promptFactory": {
+            "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_promptFactory"
+          },
+          "adapterFactory": {
+            "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_adapterFactory"
+          },
+          "baseUrl": {
+            "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_baseUrl"
+          },
+          "oidcPath": {
+            "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_oidcPath"
+          },
+          "interactionRoute": {
+            "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_interactionRoute"
+          },
+          "clientCredentialsStore": {
+            "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_clientCredentialsStore"
+          },
+          "storage": {
+            "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_storage"
+          },
+          "jwkGenerator": {
+            "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_jwkGenerator"
+          },
+          "showStackTrace": {
+            "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_showStackTrace"
+          },
+          "errorHandler": {
+            "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_errorHandler"
+          },
+          "responseWriter": {
+            "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_responseWriter"
+          }
+        }
+      },
       "ScopedPickWebIdHandler": {
         "@id": "undefineds:dist/identity/oidc/ScopedPickWebIdHandler.jsonld#ScopedPickWebIdHandler",
         "@prefix": true,

package/dist/http/InternalPodDataHttpHandler.d.ts

@@ -34,6 +34,8 @@ export declare class InternalPodDataHttpHandler extends HttpHandler {
     private readonly deploymentBaseUrl?;
     private readonly basePath;
     private readonly seenNonces;
+    private readonly eTagHandler;
+    private readonly conditionsParser;
     constructor(options: InternalPodDataHttpHandlerOptions);
     canHandle({ request }: HttpHandlerInput): Promise<void>;
     handle({ request, response }: HttpHandlerInput): Promise<void>;
@@ -44,6 +46,7 @@ export declare class InternalPodDataHttpHandler extends HttpHandler {
     private isAllowedAiConnectionResource;
     private delegate;
     private createRepresentation;
+    private writeETag;
     private createPatch;
     private pipeRepresentation;
     private writeNotFound;

package/dist/http/InternalPodDataHttpHandler.js

@@ -18,6 +18,8 @@ class InternalPodDataHttpHandler extends community_server_1.HttpHandler {
     constructor(options) {
         super();
         this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
+        this.eTagHandler = new community_server_1.BasicETagHandler();
+        this.conditionsParser = new community_server_1.BasicConditionsParser(this.eTagHandler);
         this.resourceStore = options.resourceStore;
         this.gatewayAdminProxyAuthSecret = options.gatewayAdminProxyAuthSecret ?? process.env.XPOD_GATEWAY_ADMIN_PROXY_AUTH_SECRET;
         this.patchBodyParser = options.patchBodyParser;
@@ -50,7 +52,7 @@ class InternalPodDataHttpHandler extends community_server_1.HttpHandler {
         }
         catch (error) {
             if (isHttpNotFound(error)) {
-                if (intent.method === 'GET') {
+                if (intent.method === 'GET' && !isGatewayAccessKeySecretResource(intent)) {
                     this.writeEmptyGraph(response);
                 }
                 else {
@@ -217,6 +219,7 @@ class InternalPodDataHttpHandler extends community_server_1.HttpHandler {
                 const representation = await this.resourceStore.getRepresentation(identifier, resourceReadPreferences(intent));
                 response.statusCode = 200;
                 response.setHeader('Content-Type', representation.metadata.contentType ?? 'text/turtle');
+                this.writeETag(representation, response);
                 await this.pipeRepresentation(representation, response);
                 return;
             }
@@ -224,12 +227,14 @@ class InternalPodDataHttpHandler extends community_server_1.HttpHandler {
                 const representation = await this.resourceStore.getRepresentation(identifier, resourceReadPreferences(intent));
                 response.statusCode = 200;
                 response.setHeader('Content-Type', representation.metadata.contentType ?? 'text/turtle');
+                this.writeETag(representation, response);
                 representation.data.destroy();
                 response.end();
                 return;
             }
             case 'PUT': {
-                await this.resourceStore.setRepresentation(identifier, this.createRepresentation(request, intent.resourceUrl));
+                const conditions = await this.conditionsParser.handleSafe(request);
+                await this.resourceStore.setRepresentation(identifier, this.createRepresentation(request, intent.resourceUrl), conditions);
                 response.statusCode = 204;
                 response.end();
                 return;
@@ -251,6 +256,12 @@ class InternalPodDataHttpHandler extends community_server_1.HttpHandler {
         const contentType = firstHeader(request.headers['content-type']) ?? 'text/turtle';
         return new community_server_1.BasicRepresentation(request, new community_server_1.RepresentationMetadata({ path: resourceUrl }, contentType));
     }
+    writeETag(representation, response) {
+        const eTag = this.eTagHandler.getETag(representation.metadata);
+        if (eTag) {
+            response.setHeader('ETag', eTag);
+        }
+    }
     async createPatch(request, resourceUrl) {
         if (!this.patchBodyParser) {
             throw new community_server_1.NotImplementedHttpError('Internal Pod data PATCH requires a PatchBodyParser.');

package/dist/http/InternalPodDataHttpHandler.jsonld

@@ -114,6 +114,14 @@
           "@id": "undefineds:dist/http/InternalPodDataHttpHandler.jsonld#InternalPodDataHttpHandler__member_seenNonces",
           "memberFieldName": "seenNonces"
         },
+        {
+          "@id": "undefineds:dist/http/InternalPodDataHttpHandler.jsonld#InternalPodDataHttpHandler__member_eTagHandler",
+          "memberFieldName": "eTagHandler"
+        },
+        {
+          "@id": "undefineds:dist/http/InternalPodDataHttpHandler.jsonld#InternalPodDataHttpHandler__member_conditionsParser",
+          "memberFieldName": "conditionsParser"
+        },
         {
           "@id": "undefineds:dist/http/InternalPodDataHttpHandler.jsonld#InternalPodDataHttpHandler__member_constructor",
           "memberFieldName": "constructor"
@@ -154,6 +162,10 @@
           "@id": "undefineds:dist/http/InternalPodDataHttpHandler.jsonld#InternalPodDataHttpHandler__member_createRepresentation",
           "memberFieldName": "createRepresentation"
         },
+        {
+          "@id": "undefineds:dist/http/InternalPodDataHttpHandler.jsonld#InternalPodDataHttpHandler__member_writeETag",
+          "memberFieldName": "writeETag"
+        },
         {
           "@id": "undefineds:dist/http/InternalPodDataHttpHandler.jsonld#InternalPodDataHttpHandler__member_createPatch",
           "memberFieldName": "createPatch"

package/dist/identity/oidc/RememberedClientPromptFactory.d.ts

@@ -1,5 +1,5 @@
 import { PromptFactory } from '@solid/community-server';
-import { interactionPolicy } from 'oidc-provider';
+import type { interactionPolicy } from 'oidc-provider';
 import { RememberedClientGrantStore } from './RememberedClientGrantStore';
 /** Runs after the existing account and WebID checks, before any consent checks. */
 export declare class RememberedClientPromptFactory extends PromptFactory {

package/dist/identity/oidc/RememberedClientPromptFactory.js

@@ -2,7 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RememberedClientPromptFactory = void 0;
 const community_server_1 = require("@solid/community-server");
-const oidc_provider_1 = require("oidc-provider");
 const RememberedClientGrantStore_1 = require("./RememberedClientGrantStore");
 /** Runs after the existing account and WebID checks, before any consent checks. */
 class RememberedClientPromptFactory extends community_server_1.PromptFactory {
@@ -21,7 +20,11 @@ class RememberedClientPromptFactory extends community_server_1.PromptFactory {
             throw new community_server_1.InternalServerError('Missing ordered default login and consent policies.');
         }
         const remembered = new WeakSet();
-        policy.add(new oidc_provider_1.interactionPolicy.Prompt({ name: 'restore_remembered_client', requestable: false }, new oidc_provider_1.interactionPolicy.Check('restore_remembered_client', 'Restore previously remembered consent.', async (ctx) => {
+        // Bundled and external providers can have different class identities. Use
+        // the incoming policy's constructors so its instanceof checks accept both.
+        const PolicyPrompt = consent.constructor;
+        const PolicyCheck = native.constructor;
+        policy.add(new PolicyPrompt({ name: 'restore_remembered_client', requestable: false }, new PolicyCheck('restore_remembered_client', 'Restore previously remembered consent.', async (ctx) => {
             const { oidc } = ctx;
             const accountId = oidc.session?.accountId;
             const clientId = oidc.client?.clientId;

package/dist/identity/oidc/RememberedConsentHandler.js

@@ -23,7 +23,7 @@ class RememberedConsentHandler extends community_server_1.JsonInteractionHandler
             return await this.source.handleSafe(input);
         }
         catch (error) {
-            if (!(error instanceof community_server_1.FoundHttpError) || !interaction?.result?.consent ||
+            if (!community_server_1.FoundHttpError.isInstance(error) || !interaction?.result?.consent ||
                 interaction.result === previousResult) {
                 throw error;
             }

package/dist/identity/oidc/ScopedPickWebIdHandler.d.ts

@@ -26,6 +26,7 @@ export declare class ScopedPickWebIdHandler extends JsonInteractionHandler imple
     private readonly rememberedClientGrantStore?;
     constructor(options: ScopedPickWebIdHandlerOptions);
     getView({ accountId, oidcInteraction }: JsonInteractionHandlerInput): Promise<JsonRepresentation>;
+    private findResumeWebId;
     handle({ oidcInteraction, accountId, json }: JsonInteractionHandlerInput): Promise<never>;
     private clearSelectedWebId;
     private resolveScopedEntries;

package/dist/identity/oidc/ScopedPickWebIdHandler.js

@@ -34,14 +34,40 @@ class ScopedPickWebIdHandler extends community_server_1.JsonInteractionHandler {
         const description = (0, community_server_1.parseSchema)(inSchema);
         const target = await this.resolveTargetStorage(provider, oidcInteraction);
         const entries = await this.resolveScopedEntries(accountId, target);
+        const resumeWebId = await this.findResumeWebId(provider, oidcInteraction, entries);
         return {
             json: {
                 ...description,
                 webIds: entries.map((entry) => entry.webId),
                 entries,
+                ...(resumeWebId ? { resumeWebId } : {}),
             },
         };
     }
+    async findResumeWebId(provider, interaction, entries) {
+        if (interaction?.params.client_id !== RememberedClientGrantStore_1.XPOD_DESKTOP_CLIENT_ID || interaction.prompt?.name !== 'login' ||
+            interaction.params.max_age !== undefined) {
+            return undefined;
+        }
+        const reasons = interaction.prompt.reasons;
+        // Other login checks require user input; resubmitting the same WebID cannot
+        // satisfy them and would repeatedly return to the same login interaction.
+        if (!Array.isArray(reasons) || reasons.length !== 1 || reasons[0] !== 'no_session') {
+            return undefined;
+        }
+        const prompt = interaction.params.prompt;
+        if (prompt !== undefined && (typeof prompt !== 'string' || /(?:^|\s)(?:login|select_account)(?:\s|$)/u.test(prompt))) {
+            return undefined;
+        }
+        const webIds = [...new Set(entries.map((entry) => entry.webId))];
+        if (webIds.length !== 1) {
+            return undefined;
+        }
+        // This only offers a login choice. OIDC still evaluates consent prompts and
+        // missing scopes after the client submits that choice and resumes the flow.
+        const grant = await this.rememberedClientGrantStore?.find(provider, webIds[0], RememberedClientGrantStore_1.XPOD_DESKTOP_CLIENT_ID);
+        return grant ? webIds[0] : undefined;
+    }
     async handle({ oidcInteraction, accountId, json }) {
         (0, community_server_1.assertOidcInteraction)(oidcInteraction);
         (0, community_server_1.assertAccountId)(accountId);

package/dist/identity/oidc/ScopedPickWebIdHandler.jsonld

@@ -93,6 +93,10 @@
           "@id": "undefineds:dist/identity/oidc/ScopedPickWebIdHandler.jsonld#ScopedPickWebIdHandler__member_getView",
           "memberFieldName": "getView"
         },
+        {
+          "@id": "undefineds:dist/identity/oidc/ScopedPickWebIdHandler.jsonld#ScopedPickWebIdHandler__member_findResumeWebId",
+          "memberFieldName": "findResumeWebId"
+        },
         {
           "@id": "undefineds:dist/identity/oidc/ScopedPickWebIdHandler.jsonld#ScopedPickWebIdHandler__member_handle",
           "memberFieldName": "handle"

package/dist/identity/oidc/SessionBoundIdentityProviderFactory.d.ts

@@ -0,0 +1,10 @@
+import { IdentityProviderFactory, type IdentityProviderFactoryArgs } from '@solid/community-server';
+import type { Configuration } from 'oidc-provider';
+/** Retain the IdP session boundary while allowing Desktop to renew online access. */
+export declare class SessionBoundIdentityProviderFactory extends IdentityProviderFactory {
+    /**
+     * @param config - JSON config for the OIDC library @range {json}
+     * @param args - Remaining parameters required for the factory.
+     */
+    constructor(config: Configuration, args: IdentityProviderFactoryArgs);
+}

package/dist/identity/oidc/SessionBoundIdentityProviderFactory.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionBoundIdentityProviderFactory = void 0;
+const community_server_1 = require("@solid/community-server");
+const RememberedClientGrantStore_1 = require("./RememberedClientGrantStore");
+/** Retain the IdP session boundary while allowing Desktop to renew online access. */
+class SessionBoundIdentityProviderFactory extends community_server_1.IdentityProviderFactory {
+    /**
+     * @param config - JSON config for the OIDC library @range {json}
+     * @param args - Remaining parameters required for the factory.
+     */
+    constructor(config, args) {
+        super({
+            ...config,
+            issueRefreshToken: config.issueRefreshToken ?? (async (_ctx, client, code) => client.grantTypeAllowed('refresh_token') && (code.scopes.has('offline_access') ||
+                (client.clientId === RememberedClientGrantStore_1.XPOD_DESKTOP_CLIENT_ID && 'expiresWithSession' in code && code.expiresWithSession === true))),
+        }, args);
+    }
+}
+exports.SessionBoundIdentityProviderFactory = SessionBoundIdentityProviderFactory;
+//# sourceMappingURL=SessionBoundIdentityProviderFactory.js.map

package/dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld

@@ -0,0 +1,172 @@
+{
+  "@context": [
+    "https://linkedsoftwaredependencies.org/bundles/npm/@undefineds.co/xpod/^0.0.0/components/context.jsonld",
+    "https://linkedsoftwaredependencies.org/bundles/npm/@solid/community-server/^8.0.0/components/context.jsonld"
+  ],
+  "@id": "npmd:@undefineds.co/xpod",
+  "components": [
+    {
+      "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory",
+      "@type": "Class",
+      "requireElement": "SessionBoundIdentityProviderFactory",
+      "extends": [
+        "css:dist/identity/configuration/IdentityProviderFactory.jsonld#IdentityProviderFactory"
+      ],
+      "comment": "Retain the IdP session boundary while allowing Desktop to renew online access.",
+      "parameters": [
+        {
+          "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_config",
+          "range": "rdf:JSON",
+          "comment": "JSON config for the OIDC library"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_promptFactory",
+          "range": "css:dist/identity/configuration/PromptFactory.jsonld#PromptFactory",
+          "comment": "Used to generate new prompt that are needed in addition to the defaults prompts."
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_adapterFactory",
+          "range": "css:dist/identity/storage/AdapterFactory.jsonld#AdapterFactory",
+          "comment": "Factory that creates the adapter used for OIDC data storage."
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_baseUrl",
+          "range": "xsd:string",
+          "comment": "Base URL of the server."
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_oidcPath",
+          "range": "xsd:string",
+          "comment": "Path for all requests targeting the OIDC library."
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_interactionRoute",
+          "range": "css:dist/identity/interaction/routing/InteractionRoute.jsonld#InteractionRoute",
+          "comment": "The route where requests should be redirected to in case of an OIDC interaction."
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_clientCredentialsStore",
+          "range": "ClientCredentials:Store",
+          "comment": "Store containing the generated client credentials with their associated WebID."
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_storage",
+          "range": {
+            "@type": "ParameterRangeGenericComponent",
+            "component": "css:dist/storage/keyvalue/KeyValueStorage.jsonld#KeyValueStorage",
+            "genericTypeInstances": [
+              "xsd:string",
+              {
+                "@type": "ParameterRangeArray",
+                "parameterRangeValue": "xsd:string"
+              }
+            ]
+          },
+          "comment": "Storage used to store cookie keys, so they can be re-used in case of multithreading."
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_jwkGenerator",
+          "range": "css:dist/identity/configuration/JwkGenerator.jsonld#JwkGenerator",
+          "comment": "Generates the JWK used for signing and decryption."
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_showStackTrace",
+          "range": "xsd:boolean",
+          "comment": "Extra information will be added to the error output if this is true."
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_errorHandler",
+          "range": "css:dist/http/output/error/ErrorHandler.jsonld#ErrorHandler",
+          "comment": "Used to convert errors thrown by the OIDC library."
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_responseWriter",
+          "range": "css:dist/http/output/ResponseWriter.jsonld#ResponseWriter",
+          "comment": "Used to write out errors thrown by the OIDC library."
+        }
+      ],
+      "memberFields": [
+        {
+          "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory__member_constructor",
+          "memberFieldName": "constructor"
+        }
+      ],
+      "constructorArguments": [
+        {
+          "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_config"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args__constructorArgument",
+          "fields": [
+            {
+              "keyRaw": "promptFactory",
+              "value": {
+                "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_promptFactory"
+              }
+            },
+            {
+              "keyRaw": "adapterFactory",
+              "value": {
+                "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_adapterFactory"
+              }
+            },
+            {
+              "keyRaw": "baseUrl",
+              "value": {
+                "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_baseUrl"
+              }
+            },
+            {
+              "keyRaw": "oidcPath",
+              "value": {
+                "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_oidcPath"
+              }
+            },
+            {
+              "keyRaw": "interactionRoute",
+              "value": {
+                "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_interactionRoute"
+              }
+            },
+            {
+              "keyRaw": "clientCredentialsStore",
+              "value": {
+                "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_clientCredentialsStore"
+              }
+            },
+            {
+              "keyRaw": "storage",
+              "value": {
+                "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_storage"
+              }
+            },
+            {
+              "keyRaw": "jwkGenerator",
+              "value": {
+                "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_jwkGenerator"
+              }
+            },
+            {
+              "keyRaw": "showStackTrace",
+              "value": {
+                "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_showStackTrace"
+              }
+            },
+            {
+              "keyRaw": "errorHandler",
+              "value": {
+                "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_errorHandler"
+              }
+            },
+            {
+              "keyRaw": "responseWriter",
+              "value": {
+                "@id": "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld#SessionBoundIdentityProviderFactory_args_responseWriter"
+              }
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}

package/dist/index.d.ts

@@ -96,6 +96,7 @@ import { AutoDetectIdentityProviderHandler } from './identity/oidc/AutoDetectIde
 import { LoopbackClientIdAdapterFactory } from './identity/oidc/LoopbackClientIdAdapterFactory';
 import { RememberedClientGrantStore } from './identity/oidc/RememberedClientGrantStore';
 import { RememberedConsentHandler } from './identity/oidc/RememberedConsentHandler';
+import { SessionBoundIdentityProviderFactory } from './identity/oidc/SessionBoundIdentityProviderFactory';
 import { RememberedClientPromptFactory } from './identity/oidc/RememberedClientPromptFactory';
 import { ScopedPickWebIdHandler } from './identity/oidc/ScopedPickWebIdHandler';
 import { ConfiguredLoopbackDPoPWebIdExtractor } from './authentication/ConfiguredLoopbackDPoPWebIdExtractor';
@@ -122,5 +123,5 @@ export type { OwnedWebIdEntry, PodOwnershipResolver, PodOwnershipTarget, CssPodO
 export type { TunnelProvider, TunnelConfig, TunnelSetupOptions, TunnelStatus, } from './tunnel/TunnelProvider';
 export type { SubdomainRegistration, ConnectivityResult, SubdomainServiceOptions, } from './subdomain/SubdomainService';
 export { AppStaticAssetHandler } from './http/AppStaticAssetHandler';
-export { RepresentationPartialConvertingStore, MinioDataAccessor, SolidRdfDataAccessor, MixDataAccessor, ConfigurableLoggerFactory, SparqlUpdateResourceStore, SubgraphQueryEngine, SubgraphSparqlHttpHandler, InternalPodDataHttpHandler, QuotaAdminHttpHandler, ClusterIngressRouter, ClusterWebSocketConfigurator, EdgeNodeDirectDebugHttpHandler, EdgeNodeProxyHttpHandler, RouterHttpHandler, RouterHttpRoute, TracingHandler, EdgeNodeCertificateHttpHandler, TerminalHttpHandler, DeviceNotificationHub, DeviceNotificationResourceListener, DeviceNotificationWebSocketServer, DeviceNotificationTicketHandler, registerDeviceNotificationRuntime, ReservedSuffixIdentifierGenerator, DrizzleIndexedStorage, ValidatingIdentityProviderHttpHandler, PostgresKeyValueStorage, RedisKeyValueStorage, SqliteKeyValueStorage, BaseKeyValueStorage, DrizzleQuotaService, NoopQuotaService, HttpEntitlementProvider, NoopEntitlementProvider, PerAccountQuotaStrategy, TencentDnsProvider, EdgeNodeDnsCoordinator, Dns01CertificateProvisioner, SimpleEdgeNodeTunnelManager, NoopEdgeNodeTunnelManager, FrpTunnelManager, EdgeNodeHealthProbeService, EdgeNodeAgent, EdgeNodeAgentInitializer, EdgeNodeCertificateService, AcmeCertificateManager, EdgeNodeModeDetector, ClusterIdentifierStrategy, UsageTrackingStore, CenterNodeRegistrationService, PodRoutingHttpHandler, ReactAppViewHandler, QuintStore, SqliteQuintStore, PgQuintStore, RdfTermDictionary, RdfQuadIndex, Rdf3xIndex, RdfTextIndex, RdfVectorIndex, PostgresRdfTextIndex, PostgresRdfVectorIndex, SolidRdfEngine, LocalQleverNativeSparqlClient, QleverSparqlEngine, RdfQuerySparqlEngine, PostgresRdfEngine, VectorStore, SqliteVectorStore, PostgresVectorStore, VectorHttpHandler, ProviderRegistry, ProviderRegistryImpl, EmbeddingService, EmbeddingServiceImpl, CredentialReader, CredentialReaderImpl, CloudflareTunnelProvider, LocalTunnelProvider, NgrokTunnelProvider, SubdomainService, MultiDomainIdentifierStrategy, SubdomainPodIdentifierStrategy, DisabledOidcHandler, DisabledIdentityProviderHandler, AutoDetectOidcHandler, AutoDetectIdentityProviderHandler, LoopbackClientIdAdapterFactory, RememberedClientGrantStore, RememberedConsentHandler, RememberedClientPromptFactory, ScopedPickWebIdHandler, ConfiguredLoopbackDPoPWebIdExtractor, AccountStorageBindingsHandler, CssPodOwnershipResolver, UrlAwareRedisLocker, ProvisionPodCreator, ProvisionPodStore, ProvisionCodeCodec, LocalPodProvisioningService, SqliteSolidFsSyncJournal, RootedSolidFsSyncJournal, LocalRdfAuthorityRecoveryInitializer, ObservableResourceStore, RdfSearchReconciliationIntentSink, };
+export { RepresentationPartialConvertingStore, MinioDataAccessor, SolidRdfDataAccessor, MixDataAccessor, ConfigurableLoggerFactory, SparqlUpdateResourceStore, SubgraphQueryEngine, SubgraphSparqlHttpHandler, InternalPodDataHttpHandler, QuotaAdminHttpHandler, ClusterIngressRouter, ClusterWebSocketConfigurator, EdgeNodeDirectDebugHttpHandler, EdgeNodeProxyHttpHandler, RouterHttpHandler, RouterHttpRoute, TracingHandler, EdgeNodeCertificateHttpHandler, TerminalHttpHandler, DeviceNotificationHub, DeviceNotificationResourceListener, DeviceNotificationWebSocketServer, DeviceNotificationTicketHandler, registerDeviceNotificationRuntime, ReservedSuffixIdentifierGenerator, DrizzleIndexedStorage, ValidatingIdentityProviderHttpHandler, PostgresKeyValueStorage, RedisKeyValueStorage, SqliteKeyValueStorage, BaseKeyValueStorage, DrizzleQuotaService, NoopQuotaService, HttpEntitlementProvider, NoopEntitlementProvider, PerAccountQuotaStrategy, TencentDnsProvider, EdgeNodeDnsCoordinator, Dns01CertificateProvisioner, SimpleEdgeNodeTunnelManager, NoopEdgeNodeTunnelManager, FrpTunnelManager, EdgeNodeHealthProbeService, EdgeNodeAgent, EdgeNodeAgentInitializer, EdgeNodeCertificateService, AcmeCertificateManager, EdgeNodeModeDetector, ClusterIdentifierStrategy, UsageTrackingStore, CenterNodeRegistrationService, PodRoutingHttpHandler, ReactAppViewHandler, QuintStore, SqliteQuintStore, PgQuintStore, RdfTermDictionary, RdfQuadIndex, Rdf3xIndex, RdfTextIndex, RdfVectorIndex, PostgresRdfTextIndex, PostgresRdfVectorIndex, SolidRdfEngine, LocalQleverNativeSparqlClient, QleverSparqlEngine, RdfQuerySparqlEngine, PostgresRdfEngine, VectorStore, SqliteVectorStore, PostgresVectorStore, VectorHttpHandler, ProviderRegistry, ProviderRegistryImpl, EmbeddingService, EmbeddingServiceImpl, CredentialReader, CredentialReaderImpl, CloudflareTunnelProvider, LocalTunnelProvider, NgrokTunnelProvider, SubdomainService, MultiDomainIdentifierStrategy, SubdomainPodIdentifierStrategy, DisabledOidcHandler, DisabledIdentityProviderHandler, AutoDetectOidcHandler, AutoDetectIdentityProviderHandler, LoopbackClientIdAdapterFactory, RememberedClientGrantStore, RememberedConsentHandler, RememberedClientPromptFactory, SessionBoundIdentityProviderFactory, ScopedPickWebIdHandler, ConfiguredLoopbackDPoPWebIdExtractor, AccountStorageBindingsHandler, CssPodOwnershipResolver, UrlAwareRedisLocker, ProvisionPodCreator, ProvisionPodStore, ProvisionCodeCodec, LocalPodProvisioningService, SqliteSolidFsSyncJournal, RootedSolidFsSyncJournal, LocalRdfAuthorityRecoveryInitializer, ObservableResourceStore, RdfSearchReconciliationIntentSink, };
 export type { ResourceChangeEvent, ResourceChangeListener, ResourceChangeRecorder, } from './storage/ObservableResourceStore';

package/dist/index.js

@@ -15,8 +15,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ClusterIdentifierStrategy = exports.EdgeNodeModeDetector = exports.AcmeCertificateManager = exports.EdgeNodeCertificateService = exports.EdgeNodeAgentInitializer = exports.EdgeNodeAgent = exports.EdgeNodeHealthProbeService = exports.FrpTunnelManager = exports.NoopEdgeNodeTunnelManager = exports.SimpleEdgeNodeTunnelManager = exports.Dns01CertificateProvisioner = exports.EdgeNodeDnsCoordinator = exports.TencentDnsProvider = exports.PerAccountQuotaStrategy = exports.NoopEntitlementProvider = exports.HttpEntitlementProvider = exports.NoopQuotaService = exports.DrizzleQuotaService = exports.BaseKeyValueStorage = exports.SqliteKeyValueStorage = exports.RedisKeyValueStorage = exports.PostgresKeyValueStorage = exports.ValidatingIdentityProviderHttpHandler = exports.DrizzleIndexedStorage = exports.ReservedSuffixIdentifierGenerator = exports.registerDeviceNotificationRuntime = exports.DeviceNotificationTicketHandler = exports.DeviceNotificationWebSocketServer = exports.DeviceNotificationResourceListener = exports.DeviceNotificationHub = exports.TerminalHttpHandler = exports.EdgeNodeCertificateHttpHandler = exports.TracingHandler = exports.RouterHttpRoute = exports.RouterHttpHandler = exports.EdgeNodeProxyHttpHandler = exports.EdgeNodeDirectDebugHttpHandler = exports.ClusterWebSocketConfigurator = exports.ClusterIngressRouter = exports.QuotaAdminHttpHandler = exports.InternalPodDataHttpHandler = exports.SubgraphSparqlHttpHandler = exports.SubgraphQueryEngine = exports.SparqlUpdateResourceStore = exports.ConfigurableLoggerFactory = exports.MixDataAccessor = exports.SolidRdfDataAccessor = exports.MinioDataAccessor = exports.RepresentationPartialConvertingStore = exports.AppStaticAssetHandler = void 0;
-exports.ProvisionPodStore = exports.ProvisionPodCreator = exports.UrlAwareRedisLocker = exports.CssPodOwnershipResolver = exports.AccountStorageBindingsHandler = exports.ConfiguredLoopbackDPoPWebIdExtractor = exports.ScopedPickWebIdHandler = exports.RememberedClientPromptFactory = exports.RememberedConsentHandler = exports.RememberedClientGrantStore = exports.LoopbackClientIdAdapterFactory = exports.AutoDetectIdentityProviderHandler = exports.AutoDetectOidcHandler = exports.DisabledIdentityProviderHandler = exports.DisabledOidcHandler = exports.SubdomainPodIdentifierStrategy = exports.MultiDomainIdentifierStrategy = exports.SubdomainService = exports.NgrokTunnelProvider = exports.LocalTunnelProvider = exports.CloudflareTunnelProvider = exports.CredentialReaderImpl = exports.CredentialReader = exports.EmbeddingServiceImpl = exports.EmbeddingService = exports.ProviderRegistryImpl = exports.ProviderRegistry = exports.VectorHttpHandler = exports.PostgresVectorStore = exports.SqliteVectorStore = exports.VectorStore = exports.PostgresRdfEngine = exports.RdfQuerySparqlEngine = exports.QleverSparqlEngine = exports.LocalQleverNativeSparqlClient = exports.SolidRdfEngine = exports.PostgresRdfVectorIndex = exports.PostgresRdfTextIndex = exports.RdfVectorIndex = exports.RdfTextIndex = exports.Rdf3xIndex = exports.RdfQuadIndex = exports.RdfTermDictionary = exports.PgQuintStore = exports.SqliteQuintStore = exports.QuintStore = exports.ReactAppViewHandler = exports.PodRoutingHttpHandler = exports.CenterNodeRegistrationService = exports.UsageTrackingStore = void 0;
-exports.RdfSearchReconciliationIntentSink = exports.ObservableResourceStore = exports.LocalRdfAuthorityRecoveryInitializer = exports.RootedSolidFsSyncJournal = exports.SqliteSolidFsSyncJournal = exports.LocalPodProvisioningService = exports.ProvisionCodeCodec = void 0;
+exports.ProvisionPodCreator = exports.UrlAwareRedisLocker = exports.CssPodOwnershipResolver = exports.AccountStorageBindingsHandler = exports.ConfiguredLoopbackDPoPWebIdExtractor = exports.ScopedPickWebIdHandler = exports.SessionBoundIdentityProviderFactory = exports.RememberedClientPromptFactory = exports.RememberedConsentHandler = exports.RememberedClientGrantStore = exports.LoopbackClientIdAdapterFactory = exports.AutoDetectIdentityProviderHandler = exports.AutoDetectOidcHandler = exports.DisabledIdentityProviderHandler = exports.DisabledOidcHandler = exports.SubdomainPodIdentifierStrategy = exports.MultiDomainIdentifierStrategy = exports.SubdomainService = exports.NgrokTunnelProvider = exports.LocalTunnelProvider = exports.CloudflareTunnelProvider = exports.CredentialReaderImpl = exports.CredentialReader = exports.EmbeddingServiceImpl = exports.EmbeddingService = exports.ProviderRegistryImpl = exports.ProviderRegistry = exports.VectorHttpHandler = exports.PostgresVectorStore = exports.SqliteVectorStore = exports.VectorStore = exports.PostgresRdfEngine = exports.RdfQuerySparqlEngine = exports.QleverSparqlEngine = exports.LocalQleverNativeSparqlClient = exports.SolidRdfEngine = exports.PostgresRdfVectorIndex = exports.PostgresRdfTextIndex = exports.RdfVectorIndex = exports.RdfTextIndex = exports.Rdf3xIndex = exports.RdfQuadIndex = exports.RdfTermDictionary = exports.PgQuintStore = exports.SqliteQuintStore = exports.QuintStore = exports.ReactAppViewHandler = exports.PodRoutingHttpHandler = exports.CenterNodeRegistrationService = exports.UsageTrackingStore = void 0;
+exports.RdfSearchReconciliationIntentSink = exports.ObservableResourceStore = exports.LocalRdfAuthorityRecoveryInitializer = exports.RootedSolidFsSyncJournal = exports.SqliteSolidFsSyncJournal = exports.LocalPodProvisioningService = exports.ProvisionCodeCodec = exports.ProvisionPodStore = void 0;
 require("./runtime/configure-drizzle-solid");
 const RepresentationPartialConvertingStore_1 = require("./storage/RepresentationPartialConvertingStore");
 Object.defineProperty(exports, "RepresentationPartialConvertingStore", { enumerable: true, get: function () { return RepresentationPartialConvertingStore_1.RepresentationPartialConvertingStore; } });
@@ -203,6 +203,8 @@ const RememberedClientGrantStore_1 = require("./identity/oidc/RememberedClientGr
 Object.defineProperty(exports, "RememberedClientGrantStore", { enumerable: true, get: function () { return RememberedClientGrantStore_1.RememberedClientGrantStore; } });
 const RememberedConsentHandler_1 = require("./identity/oidc/RememberedConsentHandler");
 Object.defineProperty(exports, "RememberedConsentHandler", { enumerable: true, get: function () { return RememberedConsentHandler_1.RememberedConsentHandler; } });
+const SessionBoundIdentityProviderFactory_1 = require("./identity/oidc/SessionBoundIdentityProviderFactory");
+Object.defineProperty(exports, "SessionBoundIdentityProviderFactory", { enumerable: true, get: function () { return SessionBoundIdentityProviderFactory_1.SessionBoundIdentityProviderFactory; } });
 const RememberedClientPromptFactory_1 = require("./identity/oidc/RememberedClientPromptFactory");
 Object.defineProperty(exports, "RememberedClientPromptFactory", { enumerable: true, get: function () { return RememberedClientPromptFactory_1.RememberedClientPromptFactory; } });
 const ScopedPickWebIdHandler_1 = require("./identity/oidc/ScopedPickWebIdHandler");

package/dist/runtime/component-parameter-keys.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.extractComponentParameterContext = extractComponentParameterContext;
 exports.normalizeComponentParameterKeys = normalizeComponentParameterKeys;
+const RDF_JSON = 'http://www.w3.org/1999/02/22-rdf-syntax-ns#JSON';
 function isObject(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
@@ -39,6 +40,10 @@ function normalizeComponentParameterKeys(document, componentContext) {
         if (!isObject(value)) {
             return;
         }
+        // JSON literals are opaque data, even if their payload resembles a component.
+        if ((value['@type'] === '@json' || value['@type'] === RDF_JSON) && '@value' in value) {
+            return;
+        }
         const type = value['@type'];
         if (typeof type === 'string') {
             const typeDefinition = componentContext[type];
@@ -61,7 +66,7 @@ function normalizeComponentParameterKeys(document, componentContext) {
                         continue;
                     }
                     if (!(normalized.key in value)) {
-                        value[normalized.key] = normalizeComponentValue(value[key], normalized.container);
+                        value[normalized.key] = normalizeComponentValue(value[key], normalized.container, normalized.type);
                     }
                     delete value[key];
                 }
@@ -87,9 +92,20 @@ function normalizedComponentKey(type, typeDefinition, typeContext, key) {
     return localName ? {
         key: `${type}:${localName}`,
         container: termDefinition['@container'],
+        type: termDefinition['@type'],
     } : undefined;
 }
-function normalizeComponentValue(value, container) {
+function normalizeComponentValue(value, container, type) {
+    if (type === '@json') {
+        if (isObject(value) && value['@type'] === RDF_JSON && '@value' in value) {
+            return value;
+        }
+        const literal = isObject(value) && value['@type'] === '@json' && '@value' in value
+            ? value['@value']
+            : value;
+        // The streaming RDF parser needs the lexical RDF JSON form for explicit literals.
+        return { '@type': RDF_JSON, '@value': JSON.stringify(literal) };
+    }
     if (container === '@list' &&
         Array.isArray(value) &&
         !(value.length === 1 && isObject(value[0]) && '@list' in value[0])) {

package/dist/storage/accessors/MixDataAccessor.js

@@ -457,7 +457,9 @@ class MixDataAccessor {
      * refreshed as query/index state.
      */
     async syncLocalRdfDocument(identifier, data, contentType, options) {
-        if (!this.isRdfDocumentIdentifier(identifier)) {
+        // CSS maps Turtle files such as profile/card$.ttl to extensionless URLs.
+        // Recovery already supplies the authority file's RDF content type.
+        if (!(0, RdfContentTypes_1.isRdfDocumentContentType)(contentType) && !this.isRdfDocumentIdentifier(identifier)) {
             throw new Error(`Cannot sync non RDF document into RDF index: ${identifier.path}`);
         }
         const source = data ?? await this.rdfFileDataAccessor.getData(identifier);
@@ -465,7 +467,9 @@ class MixDataAccessor {
         const text = await this.readStreamText(source);
         if (data) {
             await this.ensureRdfFileParentContainers(identifier);
-            await this.rdfFileDataAccessor.writeDocument(identifier, (0, community_server_1.guardStream)(stream_1.Readable.from([text])), this.createLocalRdfMetadata(identifier, new community_server_1.RepresentationMetadata(identifier)));
+            const localMetadata = this.createLocalRdfMetadata(identifier, new community_server_1.RepresentationMetadata(identifier));
+            localMetadata.contentType = localContentType;
+            await this.rdfFileDataAccessor.writeDocument(identifier, (0, community_server_1.guardStream)(stream_1.Readable.from([text])), localMetadata);
         }
         const quads = await this.parseLocalRdf(identifier, text, localContentType);
         await this.writeStructuredRdfIndex(identifier, quads, new community_server_1.RepresentationMetadata(identifier), {