@vantageos/cloud-identity 0.16.0 → 0.18.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +48 -6
- package/README.md +49 -0
- package/dist/authorize-flow.d.ts +13 -1
- package/dist/authorize-flow.d.ts.map +1 -1
- package/dist/authorize-flow.js +55 -6
- package/dist/authorize-flow.js.map +1 -1
- package/dist/claimed-org-id.d.ts +2 -0
- package/dist/claimed-org-id.d.ts.map +1 -0
- package/dist/claimed-org-id.js +20 -0
- package/dist/claimed-org-id.js.map +1 -0
- package/dist/index.d.ts +2 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +4 -0
- package/dist/index.js.map +1 -1
- package/dist/org-by-id.d.ts.map +1 -1
- package/dist/org-by-id.js +1 -15
- package/dist/org-by-id.js.map +1 -1
- package/dist/tenant-from-token.d.ts +56 -0
- package/dist/tenant-from-token.d.ts.map +1 -0
- package/dist/tenant-from-token.js +30 -0
- package/dist/tenant-from-token.js.map +1 -0
- package/package.json +6 -2
package/CHANGELOG.md
CHANGED
|
@@ -3,14 +3,49 @@
|
|
|
3
3
|
All notable changes to `@vantageos/cloud-identity` are documented here.
|
|
4
4
|
This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
5
5
|
|
|
6
|
-
## [
|
|
6
|
+
## [0.18.0]
|
|
7
7
|
|
|
8
|
-
###
|
|
8
|
+
### Added
|
|
9
9
|
|
|
10
|
-
- `
|
|
11
|
-
|
|
12
|
-
`
|
|
13
|
-
|
|
10
|
+
- `resolveTenantFromAccessToken(authorization, config, nowMs?)`
|
|
11
|
+
(`./tenant-from-token`): the session-to-tenant helper. From an
|
|
12
|
+
`Authorization` header it returns `{ ok: true, principal, orgId }` for a
|
|
13
|
+
VERIFIED access token, or a typed refusal. Built on `verifyMcpAccessToken`
|
|
14
|
+
(no second verifier): a forged, expired, wrong-audience or wrong-issuer
|
|
15
|
+
token never yields a tenant (`401` with the challenge, `503` when the key set
|
|
16
|
+
is unreachable). The org is the `org_id` claim of the verified token; a
|
|
17
|
+
verified token without a usable one is refused `no-verified-organisation`
|
|
18
|
+
(`403`). Lets a downstream server stop reading raw claims. New types
|
|
19
|
+
`ResolveTenantFromAccessTokenResult`, `TokenPrincipal`.
|
|
20
|
+
|
|
21
|
+
### Security
|
|
22
|
+
|
|
23
|
+
- Denial path: `resumeAuthorize` with `denied: true` now verifies the
|
|
24
|
+
`consentToken` exactly as the approve path does (same function, same
|
|
25
|
+
`consent-required` refusal) when consent is on. Before, a forged or missing
|
|
26
|
+
consent token on a denial was accepted. **Behaviour change for consumers:**
|
|
27
|
+
the denial POST must carry the picker's `consentToken`, as the approval POST
|
|
28
|
+
already must. With `requireConsent: false` nothing changes.
|
|
29
|
+
|
|
30
|
+
## [0.17.0]
|
|
31
|
+
|
|
32
|
+
### Added
|
|
33
|
+
|
|
34
|
+
- `OrgPickerModel.redirectOrigin`: the origin of the `redirect_uri` that was
|
|
35
|
+
validated against the registered client, for the consent page to display
|
|
36
|
+
(display-only).
|
|
37
|
+
- Person denial: `ResumeInput.denied: true`. After the signed state, the
|
|
38
|
+
client and the Clerk session all verify, `resumeAuthorize` returns
|
|
39
|
+
`redirect-to-client` with `error=access_denied` and the client's `state`
|
|
40
|
+
(no `iss`: the consumer appends RFC 9207 `iss` to every `redirect-to-client`
|
|
41
|
+
outcome, success and denial alike). A tampered or
|
|
42
|
+
expired state, an unknown client or a failed session stays a refusal;
|
|
43
|
+
`denied` together with `approved: true` is refused (`invalid-request`).
|
|
44
|
+
|
|
45
|
+
### Changed
|
|
46
|
+
|
|
47
|
+
- `prepublishOnly` now runs `npm run build` only; the test suite is not part
|
|
48
|
+
of the publish step.
|
|
14
49
|
|
|
15
50
|
## [0.16.0]
|
|
16
51
|
|
|
@@ -83,6 +118,13 @@ resource-server package is no longer needed.
|
|
|
83
118
|
- `IdentityRefusalReason` gains `bearer-missing`, `bearer-malformed`,
|
|
84
119
|
`token-invalid`, `jwks-unavailable`.
|
|
85
120
|
|
|
121
|
+
### Fixed
|
|
122
|
+
|
|
123
|
+
- `verifyMcpAccessToken` now validates `audience` as an absolute URL with no
|
|
124
|
+
fragment (RFC 8707 section 2), with the same validator as the `resource` of
|
|
125
|
+
`buildProtectedResourceMetadata`. A whitespace-only, non-URL or
|
|
126
|
+
fragment-bearing audience throws the config error instead of being accepted.
|
|
127
|
+
|
|
86
128
|
## [0.14.0]
|
|
87
129
|
|
|
88
130
|
**Additive: who may address whom, which rows a caller may see, and a caller's
|
package/README.md
CHANGED
|
@@ -331,6 +331,23 @@ const res = await exchangeAuthorizationCode(
|
|
|
331
331
|
`redirect-to-sign-in`, `org-picker` (an `OrgPickerModel` the consumer renders;
|
|
332
332
|
it lists only the user's own organisations), `redirect-to-client` (the URL
|
|
333
333
|
carrying the code and the client's `state`) or `refused`.
|
|
334
|
+
`OrgPickerModel.redirectOrigin` is the origin of the registered
|
|
335
|
+
`redirect_uri` the person will be sent to, for the consent page to display
|
|
336
|
+
(display-only; it grants nothing).
|
|
337
|
+
Denial: post `denied: true` (an explicit flag, never inferred from a missing
|
|
338
|
+
`approved`). Once the state, the client and the session verify,
|
|
339
|
+
`resumeAuthorize` returns `redirect-to-client` carrying `error=access_denied`
|
|
340
|
+
and the client's `state`. This package never adds `iss`: the RFC 9207 `iss`
|
|
341
|
+
is appended by the consumer (the authorization server that owns the issuer)
|
|
342
|
+
to every `redirect-to-client` outcome, success and denial alike. A tampered or expired state, an unknown client or a failed
|
|
343
|
+
session is a refusal, never a redirect; `denied` with `approved: true` is
|
|
344
|
+
refused as `invalid-request`. With consent on (the default), a denial must
|
|
345
|
+
also post the picker's `consentToken`, verified by the same function as an
|
|
346
|
+
approval (0.18.0): a missing, empty, forged or foreign token is refused as
|
|
347
|
+
`consent-required`, the same outcome the approve path returns, and a valid
|
|
348
|
+
one still redirects with `access_denied`. A denial is a claim in a POST body
|
|
349
|
+
like an approval; without the token it could be posted for a victim's
|
|
350
|
+
session. With `requireConsent: false` no token exists and none is required.
|
|
334
351
|
A posted `orgId` is honoured only if the verified user's own membership list
|
|
335
352
|
contains it.
|
|
336
353
|
Consent is ON by default (`requireConsent` defaults to true). What it
|
|
@@ -895,6 +912,38 @@ if (!r.ok) return respond(r.status, "headers" in r ? r.headers : {});
|
|
|
895
912
|
the consumer fetches and caches the key set; no scope check is made on the
|
|
896
913
|
token (read `r.session.claims`).
|
|
897
914
|
|
|
915
|
+
### From a token to `{ principal, orgId }` (`/tenant-from-token`, 0.18.0)
|
|
916
|
+
|
|
917
|
+
A downstream server never reads a raw claim off a token. It hands the
|
|
918
|
+
`Authorization` header and the same config it gives `verifyMcpAccessToken`
|
|
919
|
+
to one function and gets the person and the organisation, or a typed refusal.
|
|
920
|
+
|
|
921
|
+
```ts
|
|
922
|
+
import { resolveTenantFromAccessToken } from "@vantageos/cloud-identity/tenant-from-token";
|
|
923
|
+
|
|
924
|
+
const t = await resolveTenantFromAccessToken(req.headers.authorization, resourceServerConfig);
|
|
925
|
+
if (!t.ok) return respond(t.status, "headers" in t ? t.headers : {}); // 401, 403 or 503
|
|
926
|
+
// t.orgId the organisation ID: scope every row with it
|
|
927
|
+
// t.principal.subject the verified `sub`
|
|
928
|
+
// t.principal.actorName "user:<sub>"
|
|
929
|
+
// t.principal.role the verified `org_role`, or null
|
|
930
|
+
```
|
|
931
|
+
|
|
932
|
+
- It is built on `verifyMcpAccessToken` and verifies nothing itself. A forged,
|
|
933
|
+
expired, wrong-audience or wrong-issuer token, a missing or malformed header,
|
|
934
|
+
and an unreachable key set are that function's answers, passed through
|
|
935
|
+
unchanged (`401` with the RFC 6750 challenge, or `503`). No organisation and
|
|
936
|
+
no principal is returned for a token that did not verify.
|
|
937
|
+
- The organisation is the verified token's `org_id` claim (also read under its
|
|
938
|
+
other spellings `organizationId` and `orgId`), and it must be shaped like an
|
|
939
|
+
organisation ID (`org_...`). A slug (`org_slug`) is a label: never read, and
|
|
940
|
+
it never rescues a missing ID.
|
|
941
|
+
- A verified token with no usable organisation ID is refused, never resolved
|
|
942
|
+
to an unscoped view: `RBAC_DENIED`, reason `no-verified-organisation`,
|
|
943
|
+
`status: 403`. The refusal carries `door` (from the config, default
|
|
944
|
+
`resolveTenantFromAccessToken`) and never the token.
|
|
945
|
+
- Types: `ResolveTenantFromAccessTokenResult`, `TokenPrincipal`.
|
|
946
|
+
|
|
898
947
|
## An organisation is its permanent ID (0.16.0)
|
|
899
948
|
|
|
900
949
|
A label (the slug an org can be renamed to) is display text. These functions
|
package/dist/authorize-flow.d.ts
CHANGED
|
@@ -108,6 +108,12 @@ export interface OrgPickerModel {
|
|
|
108
108
|
};
|
|
109
109
|
resource: string;
|
|
110
110
|
scope: string;
|
|
111
|
+
/**
|
|
112
|
+
* The origin of the `redirect_uri` that was validated against the registered
|
|
113
|
+
* client, so the consent page can show where the person will be sent.
|
|
114
|
+
* Display-only: it grants nothing and is never read back.
|
|
115
|
+
*/
|
|
116
|
+
redirectOrigin: string;
|
|
111
117
|
/** Only organisations the verified user is a member of. */
|
|
112
118
|
organizations: readonly {
|
|
113
119
|
id: string;
|
|
@@ -146,8 +152,14 @@ export interface ResumeInput {
|
|
|
146
152
|
orgId?: string;
|
|
147
153
|
/** The person's explicit approval, when `requireConsent` is on. */
|
|
148
154
|
approved?: boolean;
|
|
149
|
-
/** The `consentToken` of the picker the person was shown. Required with `approved: true` when consent is on. */
|
|
155
|
+
/** The `consentToken` of the picker the person was shown. Required with `approved: true` and with `denied: true` when consent is on. */
|
|
150
156
|
consentToken?: string;
|
|
157
|
+
/**
|
|
158
|
+
* The person explicitly refused. An explicit flag, never inferred from
|
|
159
|
+
* `approved` being absent. Honoured only after the state, the client and the
|
|
160
|
+
* session all verify; combined with `approved: true` it is refused.
|
|
161
|
+
*/
|
|
162
|
+
denied?: true;
|
|
151
163
|
}
|
|
152
164
|
/**
|
|
153
165
|
* Handles `GET /authorize`. Validates the request against the registered
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authorize-flow.d.ts","sourceRoot":"","sources":["../src/authorize-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,gBAAgB,EAUtB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,KAAK,0BAA0B,EAGhC,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;GAUG;AAMH,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE;AAED,0EAA0E;AAC1E,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,GACjD;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AAE/B;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,GAAG,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,eAAe;IAC9B,sFAAsF;IACtF,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,sDAAsD;IACtD,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+CAA+C;IAC/C,OAAO,EAAE,0BAA0B,CAAC;IACpC,yDAAyD;IACzD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAChE,8DAA8D;IAC9D,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAAC;IAC7E,SAAS,EAAE,sBAAsB,CAAC;IAClC,0BAA0B;IAC1B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAMD,MAAM,WAAW,cAAc;IAC7B,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,aAAa,EAAE,SAAS;QACtB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;KACd,EAAE,CAAC;IACJ,0EAA0E;IAC1E,eAAe,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAEnD,MAAM,WAAW,WAAW;IAC1B,8FAA8F;IAC9F,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,
|
|
1
|
+
{"version":3,"file":"authorize-flow.d.ts","sourceRoot":"","sources":["../src/authorize-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,gBAAgB,EAUtB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,KAAK,0BAA0B,EAGhC,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;GAUG;AAMH,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE;AAED,0EAA0E;AAC1E,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,GACjD;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AAE/B;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,GAAG,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,eAAe;IAC9B,sFAAsF;IACtF,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,sDAAsD;IACtD,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+CAA+C;IAC/C,OAAO,EAAE,0BAA0B,CAAC;IACpC,yDAAyD;IACzD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAChE,8DAA8D;IAC9D,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAAC;IAC7E,SAAS,EAAE,sBAAsB,CAAC;IAClC,0BAA0B;IAC1B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAMD,MAAM,WAAW,cAAc;IAC7B,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,aAAa,EAAE,SAAS;QACtB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;KACd,EAAE,CAAC;IACJ,0EAA0E;IAC1E,eAAe,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAEnD,MAAM,WAAW,WAAW;IAC1B,8FAA8F;IAC9F,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,wIAAwI;IACxI,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,MAAM,CAAC,EAAE,IAAI,CAAC;CACf;AAoRD;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,EACpD,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,gBAAgB,CAAC,CAuB3B;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,WAAW,EAClB,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,gBAAgB,CAAC,CAkF3B"}
|
package/dist/authorize-flow.js
CHANGED
|
@@ -111,12 +111,9 @@ async function bindAndIssue(req, stateBlob, session, clientName, choice, cfg, de
|
|
|
111
111
|
// `approved: true` is a CLAIM in a POST body. An attacker client can mint
|
|
112
112
|
// its own state and replay it with a victim's session; only a token the
|
|
113
113
|
// server issued to this user for this state proves the picker was shown.
|
|
114
|
-
|
|
115
|
-
const ok = typeof presented === "string" &&
|
|
116
|
-
expectedToken !== null &&
|
|
117
|
-
(await timingSafeEqual(utf8(presented), utf8(expectedToken)));
|
|
118
|
-
if (!ok)
|
|
114
|
+
if (!(await consentTokenMatches(choice.consentToken, expectedToken))) {
|
|
119
115
|
return refused("consent-required");
|
|
116
|
+
}
|
|
120
117
|
}
|
|
121
118
|
if (!picked || (consentRequired && choice.approved !== true)) {
|
|
122
119
|
return {
|
|
@@ -126,6 +123,7 @@ async function bindAndIssue(req, stateBlob, session, clientName, choice, cfg, de
|
|
|
126
123
|
client: { clientId: req.clientId, clientName },
|
|
127
124
|
resource: req.resource,
|
|
128
125
|
scope: req.scope,
|
|
126
|
+
redirectOrigin: new URL(req.redirectUri).origin,
|
|
129
127
|
organizations: memberships.map((m) => ({
|
|
130
128
|
id: m.organization.id,
|
|
131
129
|
slug: m.organization.slug,
|
|
@@ -157,8 +155,23 @@ async function bindAndIssue(req, stateBlob, session, clientName, choice, cfg, de
|
|
|
157
155
|
catch {
|
|
158
156
|
return refused("code-store-unavailable");
|
|
159
157
|
}
|
|
158
|
+
return clientRedirect(req, { code });
|
|
159
|
+
}
|
|
160
|
+
/**
|
|
161
|
+
* The one place the redirect to the client's registered `redirect_uri` is
|
|
162
|
+
* built: the success redirect (`code`) and the denial redirect (`error`) share
|
|
163
|
+
* it, so `state` is handled identically. The RFC 9207 `iss` is NOT added
|
|
164
|
+
* here: the consumer, which owns the issuer, appends it to every
|
|
165
|
+
* `redirect-to-client` outcome.
|
|
166
|
+
*/
|
|
167
|
+
function clientRedirect(req, result) {
|
|
160
168
|
const back = new URL(req.redirectUri);
|
|
161
|
-
|
|
169
|
+
if ("code" in result) {
|
|
170
|
+
back.searchParams.set("code", result.code);
|
|
171
|
+
}
|
|
172
|
+
else {
|
|
173
|
+
back.searchParams.set("error", result.error);
|
|
174
|
+
}
|
|
162
175
|
if (req.state !== null)
|
|
163
176
|
back.searchParams.set("state", req.state);
|
|
164
177
|
return { kind: "redirect-to-client", url: back.toString() };
|
|
@@ -174,6 +187,17 @@ async function consentTokenFor(secret, state, userId, orgIds) {
|
|
|
174
187
|
const set = [...orgIds].sort().join(",");
|
|
175
188
|
return signMac(`consent-v1\0${state}\0${userId}\0${set}`, secret);
|
|
176
189
|
}
|
|
190
|
+
/**
|
|
191
|
+
* The ONE consent-token check, shared by the approve path and the denial path:
|
|
192
|
+
* the presented value must be a string and must equal the token the server
|
|
193
|
+
* would have issued for this exact picker, compared in constant time. A missing,
|
|
194
|
+
* empty, forged or foreign token never matches.
|
|
195
|
+
*/
|
|
196
|
+
async function consentTokenMatches(presented, expected) {
|
|
197
|
+
return (typeof presented === "string" &&
|
|
198
|
+
expected !== null &&
|
|
199
|
+
(await timingSafeEqual(utf8(presented), utf8(expected))));
|
|
200
|
+
}
|
|
177
201
|
function randomCode() {
|
|
178
202
|
return toBase64Url(crypto.getRandomValues(new Uint8Array(32)));
|
|
179
203
|
}
|
|
@@ -257,6 +281,31 @@ export async function resumeAuthorize(input, cfg, deps) {
|
|
|
257
281
|
const verified = await verifyClerkSessionToken(input.sessionToken, cfg.session, nowOf(deps));
|
|
258
282
|
if (!verified.ok)
|
|
259
283
|
return { kind: "refused", refusal: verified.refusal };
|
|
284
|
+
if (input.denied === true) {
|
|
285
|
+
if (input.approved === true)
|
|
286
|
+
return refused("invalid-request");
|
|
287
|
+
// A denial is a CLAIM in a POST body exactly as an approval is: without a
|
|
288
|
+
// proof that this picker was shown to this verified user for this state, an
|
|
289
|
+
// attacker can post it for a victim's session. When consent is on it is
|
|
290
|
+
// verified with the same token, by the same function, as the approve path.
|
|
291
|
+
if (cfg.requireConsent !== false) {
|
|
292
|
+
let memberships;
|
|
293
|
+
try {
|
|
294
|
+
memberships = await deps.listMemberships(verified.session.userId);
|
|
295
|
+
}
|
|
296
|
+
catch {
|
|
297
|
+
return refused("membership-lookup-unavailable");
|
|
298
|
+
}
|
|
299
|
+
const expectedToken = await consentTokenFor(cfg.stateSecret, input.state, verified.session.userId, memberships.map((m) => m.organization.id));
|
|
300
|
+
if (!(await consentTokenMatches(input.consentToken, expectedToken))) {
|
|
301
|
+
return refused("consent-required");
|
|
302
|
+
}
|
|
303
|
+
}
|
|
304
|
+
// Everything above verified: the state, the client, the session and the
|
|
305
|
+
// consent proof. Only now is the person's refusal answered with the OAuth
|
|
306
|
+
// error redirect.
|
|
307
|
+
return clientRedirect(v.req, { error: "access_denied" });
|
|
308
|
+
}
|
|
260
309
|
return bindAndIssue(v.req, input.state, verified.session, found.client.clientName ?? null, { orgId: input.orgId, approved: input.approved, consentToken: input.consentToken }, cfg, deps);
|
|
261
310
|
}
|
|
262
311
|
//# sourceMappingURL=authorize-flow.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authorize-flow.js","sourceRoot":"","sources":["../src/authorize-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,iBAAiB,EACjB,WAAW,EACX,qBAAqB,EACrB,OAAO,EACP,QAAQ,EACR,OAAO,EACP,IAAI,EACJ,WAAW,EACX,UAAU,GACX,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAGL,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AA+K5B,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAEtC,MAAM,OAAO,GAAG,CAAC,MAAqC,EAAoB,EAAE,CAAC,CAAC;IAC5E,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC;CACzB,CAAC,CAAC;AAEH,SAAS,KAAK,CAAC,IAAmB;IAChC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,QAAQ,CAAC,GAAoB;IACpC,OAAO,CACL,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;QACnC,GAAG,CAAC,WAAW,CAAC,MAAM,IAAI,iBAAiB;QAC3C,GAAG,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAChC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,MAAoD,EACpD,MAAuB,EACvB,GAAoB;IAEpB,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC5E,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;IACxC,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAC5D,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,qBAAqB,IAAI,WAAW,CAAC;IAC3D,IAAI,CAAC,SAAS,IAAI,MAAM,KAAK,WAAW,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,QAAQ,CAAC,CAAC;IAC5E,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,GAAG,CAAC,eAAe,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,GAAG,EAAE;YACH,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW;YACX,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;YAC3B,aAAa,EAAE,SAAS;YACxB,QAAQ;YACR,KAAK;SACN;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,GAAqB,EACrB,GAAoB,EACpB,IAAmB;IAEnB,MAAM,OAAO,GAAiB;QAC5B,CAAC,EAAE,CAAC;QACJ,GAAG,EAAE,GAAG,CAAC,QAAQ;QACjB,EAAE,EAAE,GAAG,CAAC,WAAW;QACnB,EAAE,EAAE,GAAG,CAAC,KAAK;QACb,EAAE,EAAE,GAAG,CAAC,aAAa;QACrB,EAAE,EAAE,GAAG,CAAC,QAAQ;QAChB,EAAE,EAAE,GAAG,CAAC,KAAK;QACb,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,GAAG,IAAI;KACvD,CAAC;IACF,OAAO,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,cAAc,CAAC,GAAoB,EAAE,SAAiB;IAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACnC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtD,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,IAAmB,EACnB,QAAgB;IAEhB,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,GAAqB,EACrB,SAAiB,EACjB,OAA6B,EAC7B,UAAyB,EACzB,MAAqE,EACrE,GAAoB,EACpB,IAAmB;IAEnB,IAAI,WAA0C,CAAC;IAC/C,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAEhE,IAAI,MAAsC,CAAC;IAC3C,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,wEAAwE;QACxE,mDAAmD;QACnD,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClD,CAAC;SAAM,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,eAAe,GAAG,GAAG,CAAC,cAAc,KAAK,KAAK,CAAC;IACrD,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,aAAa,GAAG,eAAe;QACnC,CAAC,CAAC,MAAM,eAAe,CACnB,GAAG,CAAC,WAAW,EACf,SAAS,EACT,OAAO,CAAC,MAAM,EACd,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAC1C;QACH,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,eAAe,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC1D,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC;QACtC,MAAM,EAAE,GACN,OAAO,SAAS,KAAK,QAAQ;YAC7B,aAAa,KAAK,IAAI;YACtB,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,EAAE,CAAC;QAC7D,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,KAAK,EAAE;gBACL,KAAK,EAAE,SAAS;gBAChB,MAAM,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE;gBAC9C,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,aAAa,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACrC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE;oBACrB,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI;oBACzB,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI;oBACzB,IAAI,EAAE,CAAC,CAAC,IAAI;iBACb,CAAC,CAAC;gBACH,eAAe;gBACf,YAAY,EAAE,aAAa;aAC5B;SACF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,UAAU,CAAC,EAAE,CAAC;IACjD,MAAM,MAAM,GAA4B;QACtC,QAAQ,EAAE,MAAM,SAAS,CAAC,IAAI,CAAC;QAC/B,WAAW,EAAE,OAAO,CAAC,MAAM;QAC3B,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE;QAC7B,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI;QACjC,OAAO,EAAE,MAAM,CAAC,IAAI;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,GAAG,IAAI;KAC3D,CAAC;IACF,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpC,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI;QAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAClE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAC5B,MAAc,EACd,KAAa,EACb,MAAc,EACd,MAAyB;IAEzB,MAAM,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC,eAAe,KAAK,KAAK,MAAM,KAAK,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAoD,EACpD,YAAgC,EAChC,GAAoB,EACpB,IAAmB;IAEnB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC;IAClC,IAAI,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAEpC,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,YAAY;QAAE,OAAO,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,YAAY,EACZ,GAAG,CAAC,OAAO,EACX,KAAK,CAAC,IAAI,CAAC,CACZ,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,kBAAkB;YACnD,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE;YAChD,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AAC1G,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAkB,EAClB,GAAoB,EACpB,IAAmB;IAEnB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC3D,MAAM,GAAG,GACP,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1F,MAAM,CAAC,GAAG,GAAmC,CAAC;IAC9C,IACE,CAAC,CAAC;QACF,CAAC,CAAC,CAAC,KAAK,CAAC;QACT,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QACzB,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QACzB,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,EAC3C,CAAC;QACD,OAAO,OAAO,CAAC,eAAe,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC,eAAe,CAAC,CAAC;IAE1D,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,eAAe,CACvB;QACE,YAAY,EAAE,CAAC,CAAC,EAAE;QAClB,cAAc,EAAE,CAAC,CAAC,EAAE;QACpB,QAAQ,EAAE,CAAC,CAAC,EAAE;QACd,KAAK,EAAE,CAAC,CAAC,EAAE;QACX,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,EACD,KAAK,CAAC,MAAM,EACZ,GAAG,CACJ,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAEpC,IAAI,CAAC,KAAK,CAAC,YAAY;QAAE,OAAO,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,KAAK,CAAC,YAAY,EAClB,GAAG,CAAC,OAAO,EACX,KAAK,CAAC,IAAI,CAAC,CACZ,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAExE,OAAO,YAAY,CACjB,CAAC,CAAC,GAAG,EACL,KAAK,CAAC,KAAK,EACX,QAAQ,CAAC,OAAO,EAChB,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,EAC/B,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,EAClF,GAAG,EACH,IAAI,CACL,CAAC;AACJ,CAAC"}
|
|
1
|
+
{"version":3,"file":"authorize-flow.js","sourceRoot":"","sources":["../src/authorize-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,iBAAiB,EACjB,WAAW,EACX,qBAAqB,EACrB,OAAO,EACP,QAAQ,EACR,OAAO,EACP,IAAI,EACJ,WAAW,EACX,UAAU,GACX,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAGL,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AA2L5B,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAEtC,MAAM,OAAO,GAAG,CAAC,MAAqC,EAAoB,EAAE,CAAC,CAAC;IAC5E,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC;CACzB,CAAC,CAAC;AAEH,SAAS,KAAK,CAAC,IAAmB;IAChC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,QAAQ,CAAC,GAAoB;IACpC,OAAO,CACL,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;QACnC,GAAG,CAAC,WAAW,CAAC,MAAM,IAAI,iBAAiB;QAC3C,GAAG,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAChC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,MAAoD,EACpD,MAAuB,EACvB,GAAoB;IAEpB,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC5E,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;IACxC,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAC5D,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,qBAAqB,IAAI,WAAW,CAAC;IAC3D,IAAI,CAAC,SAAS,IAAI,MAAM,KAAK,WAAW,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,QAAQ,CAAC,CAAC;IAC5E,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,GAAG,CAAC,eAAe,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,GAAG,EAAE;YACH,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW;YACX,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;YAC3B,aAAa,EAAE,SAAS;YACxB,QAAQ;YACR,KAAK;SACN;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,GAAqB,EACrB,GAAoB,EACpB,IAAmB;IAEnB,MAAM,OAAO,GAAiB;QAC5B,CAAC,EAAE,CAAC;QACJ,GAAG,EAAE,GAAG,CAAC,QAAQ;QACjB,EAAE,EAAE,GAAG,CAAC,WAAW;QACnB,EAAE,EAAE,GAAG,CAAC,KAAK;QACb,EAAE,EAAE,GAAG,CAAC,aAAa;QACrB,EAAE,EAAE,GAAG,CAAC,QAAQ;QAChB,EAAE,EAAE,GAAG,CAAC,KAAK;QACb,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,GAAG,IAAI;KACvD,CAAC;IACF,OAAO,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,cAAc,CAAC,GAAoB,EAAE,SAAiB;IAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACnC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtD,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,IAAmB,EACnB,QAAgB;IAEhB,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,GAAqB,EACrB,SAAiB,EACjB,OAA6B,EAC7B,UAAyB,EACzB,MAAqE,EACrE,GAAoB,EACpB,IAAmB;IAEnB,IAAI,WAA0C,CAAC;IAC/C,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAEhE,IAAI,MAAsC,CAAC;IAC3C,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,wEAAwE;QACxE,mDAAmD;QACnD,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClD,CAAC;SAAM,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,eAAe,GAAG,GAAG,CAAC,cAAc,KAAK,KAAK,CAAC;IACrD,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,aAAa,GAAG,eAAe;QACnC,CAAC,CAAC,MAAM,eAAe,CACnB,GAAG,CAAC,WAAW,EACf,SAAS,EACT,OAAO,CAAC,MAAM,EACd,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAC1C;QACH,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,eAAe,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC1D,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,MAAM,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;YACrE,OAAO,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,EAAE,CAAC;QAC7D,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,KAAK,EAAE;gBACL,KAAK,EAAE,SAAS;gBAChB,MAAM,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE;gBAC9C,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,cAAc,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM;gBAC/C,aAAa,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACrC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE;oBACrB,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI;oBACzB,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI;oBACzB,IAAI,EAAE,CAAC,CAAC,IAAI;iBACb,CAAC,CAAC;gBACH,eAAe;gBACf,YAAY,EAAE,aAAa;aAC5B;SACF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,UAAU,CAAC,EAAE,CAAC;IACjD,MAAM,MAAM,GAA4B;QACtC,QAAQ,EAAE,MAAM,SAAS,CAAC,IAAI,CAAC;QAC/B,WAAW,EAAE,OAAO,CAAC,MAAM;QAC3B,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE;QAC7B,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI;QACjC,OAAO,EAAE,MAAM,CAAC,IAAI;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,GAAG,IAAI;KAC3D,CAAC;IACF,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,cAAc,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CACrB,GAAqB,EACrB,MAAqD;IAErD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;QACrB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI;QAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAClE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAC5B,MAAc,EACd,KAAa,EACb,MAAc,EACd,MAAyB;IAEzB,MAAM,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC,eAAe,KAAK,KAAK,MAAM,KAAK,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAChC,SAAkB,EAClB,QAAuB;IAEvB,OAAO,CACL,OAAO,SAAS,KAAK,QAAQ;QAC7B,QAAQ,KAAK,IAAI;QACjB,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAoD,EACpD,YAAgC,EAChC,GAAoB,EACpB,IAAmB;IAEnB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC;IAClC,IAAI,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAEpC,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,YAAY;QAAE,OAAO,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,YAAY,EACZ,GAAG,CAAC,OAAO,EACX,KAAK,CAAC,IAAI,CAAC,CACZ,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,kBAAkB;YACnD,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE;YAChD,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AAC1G,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAkB,EAClB,GAAoB,EACpB,IAAmB;IAEnB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC3D,MAAM,GAAG,GACP,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1F,MAAM,CAAC,GAAG,GAAmC,CAAC;IAC9C,IACE,CAAC,CAAC;QACF,CAAC,CAAC,CAAC,KAAK,CAAC;QACT,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QACzB,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QACzB,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,EAC3C,CAAC;QACD,OAAO,OAAO,CAAC,eAAe,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC,eAAe,CAAC,CAAC;IAE1D,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,eAAe,CACvB;QACE,YAAY,EAAE,CAAC,CAAC,EAAE;QAClB,cAAc,EAAE,CAAC,CAAC,EAAE;QACpB,QAAQ,EAAE,CAAC,CAAC,EAAE;QACd,KAAK,EAAE,CAAC,CAAC,EAAE;QACX,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,EACD,KAAK,CAAC,MAAM,EACZ,GAAG,CACJ,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAEpC,IAAI,CAAC,KAAK,CAAC,YAAY;QAAE,OAAO,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,KAAK,CAAC,YAAY,EAClB,GAAG,CAAC,OAAO,EACX,KAAK,CAAC,IAAI,CAAC,CACZ,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAExE,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC1B,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC/D,0EAA0E;QAC1E,4EAA4E;QAC5E,wEAAwE;QACxE,2EAA2E;QAC3E,IAAI,GAAG,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;YACjC,IAAI,WAA0C,CAAC;YAC/C,IAAI,CAAC;gBACH,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,OAAO,CAAC,+BAA+B,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,eAAe,CACzC,GAAG,CAAC,WAAW,EACf,KAAK,CAAC,KAAK,EACX,QAAQ,CAAC,OAAO,CAAC,MAAM,EACvB,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAC1C,CAAC;YACF,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,KAAK,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;gBACpE,OAAO,OAAO,CAAC,kBAAkB,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QACD,wEAAwE;QACxE,0EAA0E;QAC1E,kBAAkB;QAClB,OAAO,cAAc,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,YAAY,CACjB,CAAC,CAAC,GAAG,EACL,KAAK,CAAC,KAAK,EACX,QAAQ,CAAC,OAAO,EAChB,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,EAC/B,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,EAClF,GAAG,EACH,IAAI,CACL,CAAC;AACJ,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"claimed-org-id.d.ts","sourceRoot":"","sources":["../src/claimed-org-id.ts"],"names":[],"mappings":"AAUA,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,SAAS,CAQhF"}
|
|
@@ -0,0 +1,20 @@
|
|
|
1
|
+
import { resolveTenantIdOrAbsent } from "./org-guard.js";
|
|
2
|
+
/**
|
|
3
|
+
* The one reader of a verified credential's organisation ID claim, shared by
|
|
4
|
+
* `resolveOrgFromClaim` and `resolveTenantFromAccessToken`. Internal: not
|
|
5
|
+
* exported from the package.
|
|
6
|
+
*/
|
|
7
|
+
const CLERK_ORG_ID_SHAPE = /^org_[A-Za-z0-9]+$/;
|
|
8
|
+
const ID_CLAIMS = ["org_id", "organizationId", "orgId"];
|
|
9
|
+
export function claimedOrgId(claims) {
|
|
10
|
+
for (const name of ID_CLAIMS) {
|
|
11
|
+
const value = claims[name];
|
|
12
|
+
if (typeof value !== "string" || !CLERK_ORG_ID_SHAPE.test(value))
|
|
13
|
+
continue;
|
|
14
|
+
const resolved = resolveTenantIdOrAbsent({ kind: "session", identity: { orgId: value } });
|
|
15
|
+
if (resolved.present)
|
|
16
|
+
return resolved.tenantId;
|
|
17
|
+
}
|
|
18
|
+
return undefined;
|
|
19
|
+
}
|
|
20
|
+
//# sourceMappingURL=claimed-org-id.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"claimed-org-id.js","sourceRoot":"","sources":["../src/claimed-org-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAEzD;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAChD,MAAM,SAAS,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,CAAU,CAAC;AAEjE,MAAM,UAAU,YAAY,CAAC,MAA+B;IAC1D,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QAC3E,MAAM,QAAQ,GAAG,uBAAuB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1F,IAAI,QAAQ,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC;IACjD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -43,4 +43,6 @@ export { buildProtectedResourceMetadata, unauthorizedChallenge, deriveClerkDisco
|
|
|
43
43
|
export type { ProtectedResourceMetadataConfig, ProtectedResourceMetadata, UnauthorizedChallengeConfig, UnauthorizedChallenge, ClerkDiscoveryUrls, McpResourceServerConfig, VerifyMcpAccessTokenResult, } from "./resource-server.js";
|
|
44
44
|
export { sameOrg, isFleetStamp, sameTenantStamp, resolveOrgFromClaim, resolveOrgIdForLabelBackfillOnly, findOperatorOrg, orgMappingRowSchema, } from "./org-by-id.js";
|
|
45
45
|
export type { OrgRef, OrgMappingRow, OrgMappingLookups, ResolvedOrg, ResolveOrgFromClaimOptions, ResolveOrgFromClaimResult, OrgIdAbsence, OrgIdAbsenceReason, OrgIdResolution, OperatorOrgLookups, FindOperatorOrgOptions, OperatorOrgResult, } from "./org-by-id.js";
|
|
46
|
+
export { resolveTenantFromAccessToken } from "./tenant-from-token.js";
|
|
47
|
+
export type { TokenPrincipal, ResolveTenantFromAccessTokenResult, } from "./tenant-from-token.js";
|
|
46
48
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,YAAY,EACV,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,mBAAmB,EACnB,6BAA6B,EAC7B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,YAAY,EACV,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,YAAY,EACV,QAAQ,EACR,SAAS,EACT,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAClE,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,QAAQ,EACR,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACjF,YAAY,EACV,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/E,YAAY,EACV,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAKjF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,cAAc,EACd,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,4BAA4B,EAC5B,SAAS,EACT,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,4BAA4B,EAC5B,2BAA2B,EAC3B,YAAY,EACZ,gBAAgB,EAChB,iCAAiC,EACjC,gCAAgC,EAChC,gBAAgB,EAChB,2BAA2B,EAC3B,cAAc,GACf,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAO9B,OAAO,EACL,OAAO,EACP,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,gCAAgC,EAChC,eAAe,EACf,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,MAAM,EACN,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,0BAA0B,EAC1B,yBAAyB,EACzB,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,YAAY,EACV,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,mBAAmB,EACnB,6BAA6B,EAC7B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,YAAY,EACV,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,YAAY,EACV,QAAQ,EACR,SAAS,EACT,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAClE,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,QAAQ,EACR,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACjF,YAAY,EACV,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/E,YAAY,EACV,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAKjF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,cAAc,EACd,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,4BAA4B,EAC5B,SAAS,EACT,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,4BAA4B,EAC5B,2BAA2B,EAC3B,YAAY,EACZ,gBAAgB,EAChB,iCAAiC,EACjC,gCAAgC,EAChC,gBAAgB,EAChB,2BAA2B,EAC3B,cAAc,GACf,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAO9B,OAAO,EACL,OAAO,EACP,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,gCAAgC,EAChC,eAAe,EACf,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,MAAM,EACN,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,0BAA0B,EAC1B,yBAAyB,EACzB,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAKxB,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtE,YAAY,EACV,cAAc,EACd,kCAAkC,GACnC,MAAM,wBAAwB,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -50,4 +50,8 @@ export { buildProtectedResourceMetadata, unauthorizedChallenge, deriveClerkDisco
|
|
|
50
50
|
// label-to-ID derivation is exported only as
|
|
51
51
|
// `resolveOrgIdForLabelBackfillOnly`, for a one-off backfill.
|
|
52
52
|
export { sameOrg, isFleetStamp, sameTenantStamp, resolveOrgFromClaim, resolveOrgIdForLabelBackfillOnly, findOperatorOrg, orgMappingRowSchema, } from "./org-by-id.js";
|
|
53
|
+
// 0.18.0 — Session to tenant: `{ principal, orgId }` from a verified access token,
|
|
54
|
+
// built on `verifyMcpAccessToken`, or a typed refusal. A downstream server never
|
|
55
|
+
// reads a raw claim.
|
|
56
|
+
export { resolveTenantFromAccessToken } from "./tenant-from-token.js";
|
|
53
57
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,0CAA0C;AAC1C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAU7B,gFAAgF;AAChF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAU1E,kFAAkF;AAClF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAWzB,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAY/B,+EAA+E;AAC/E,mEAAmE;AACnE,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAa7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAOhE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAQ7D,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AASlE,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAMjF,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAc/B,+EAA+E;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAM7D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAO/E,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjF,8EAA8E;AAC9E,oEAAoE;AACpE,8EAA8E;AAC9E,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,cAAc,EACd,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AA6B9B,6EAA6E;AAC7E,yEAAyE;AACzE,+EAA+E;AAC/E,+BAA+B;AAC/B,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAW9B,iFAAiF;AACjF,yEAAyE;AACzE,qEAAqE;AACrE,6CAA6C;AAC7C,8DAA8D;AAC9D,OAAO,EACL,OAAO,EACP,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,gCAAgC,EAChC,eAAe,EACf,mBAAmB,GACpB,MAAM,gBAAgB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,0CAA0C;AAC1C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAU7B,gFAAgF;AAChF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAU1E,kFAAkF;AAClF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAWzB,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAY/B,+EAA+E;AAC/E,mEAAmE;AACnE,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAa7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAOhE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAQ7D,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AASlE,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAMjF,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAc/B,+EAA+E;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAM7D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAO/E,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjF,8EAA8E;AAC9E,oEAAoE;AACpE,8EAA8E;AAC9E,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,cAAc,EACd,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AA6B9B,6EAA6E;AAC7E,yEAAyE;AACzE,+EAA+E;AAC/E,+BAA+B;AAC/B,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAW9B,iFAAiF;AACjF,yEAAyE;AACzE,qEAAqE;AACrE,6CAA6C;AAC7C,8DAA8D;AAC9D,OAAO,EACL,OAAO,EACP,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,gCAAgC,EAChC,eAAe,EACf,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAgBxB,mFAAmF;AACnF,iFAAiF;AACjF,qBAAqB;AACrB,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC"}
|
package/dist/org-by-id.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"org-by-id.d.ts","sourceRoot":"","sources":["../src/org-by-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,eAAe,EAAW,MAAM,uBAAuB,CAAC;AAEtE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAMpD;;;;GAIG;AACH,MAAM,MAAM,MAAM,GAAG;IACnB,4BAA4B;IAC5B,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAmBF;;;;GAIG;AACH,wBAAgB,OAAO,CACrB,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC5B,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC3B,OAAO,CAGT;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAClC,OAAO,CAGT;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC5B,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAClC,OAAO,CAGT;AAMD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;;;;;iBAO9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,KAAK,MAAM,CAAC,CAAC,SAAS,OAAO,EAAE,EAAE,CAAC,IAAI,CACpC,GAAG,IAAI,EAAE,CAAC,KACP,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;AAE1D,yFAAyF;AACzF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC;IACjD,iHAAiH;IACjH,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC;CACrD,CAAC;AA2BF,uFAAuF;AACvF,MAAM,MAAM,WAAW,GAAG;IACxB,kFAAkF;IAClF,EAAE,EAAE,MAAM,CAAC;IACX,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,yBAAyB,GACjC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"org-by-id.d.ts","sourceRoot":"","sources":["../src/org-by-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,eAAe,EAAW,MAAM,uBAAuB,CAAC;AAEtE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAMpD;;;;GAIG;AACH,MAAM,MAAM,MAAM,GAAG;IACnB,4BAA4B;IAC5B,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAmBF;;;;GAIG;AACH,wBAAgB,OAAO,CACrB,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC5B,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC3B,OAAO,CAGT;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAClC,OAAO,CAGT;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC5B,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAClC,OAAO,CAGT;AAMD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;;;;;iBAO9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,KAAK,MAAM,CAAC,CAAC,SAAS,OAAO,EAAE,EAAE,CAAC,IAAI,CACpC,GAAG,IAAI,EAAE,CAAC,KACP,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;AAE1D,yFAAyF;AACzF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC;IACjD,iHAAiH;IACjH,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC;CACrD,CAAC;AA2BF,uFAAuF;AACvF,MAAM,MAAM,WAAW,GAAG;IACxB,kFAAkF;IAClF,EAAE,EAAE,MAAM,CAAC;IACX,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,yBAAyB,GACjC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAE5C;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,EAClD,OAAO,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,EAC7C,OAAO,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAAC,yBAAyB,CAAC,CA6CpC;AAMD,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,eAAe,GACf,YAAY,GACZ,gBAAgB,GAChB,eAAe,CAAC;AAEpB,+FAA+F;AAC/F,MAAM,MAAM,YAAY,GAAG;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAEjF,MAAM,MAAM,eAAe,GACvB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC;AAE9C;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gCAAgC,CACpD,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,OAAO,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,GAC5C,OAAO,CAAC,eAAe,CAAC,CAa1B;AAMD,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;OAGG;IACH,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,CAAC;AAI3B;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,kBAAkB,GAAG,IAAI,GAAG,SAAS,EAC9C,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CAwB5B"}
|
package/dist/org-by-id.js
CHANGED
|
@@ -16,7 +16,7 @@
|
|
|
16
16
|
*/
|
|
17
17
|
import { z } from "zod";
|
|
18
18
|
import { refusal } from "./identity-refusal.js";
|
|
19
|
-
import {
|
|
19
|
+
import { claimedOrgId } from "./claimed-org-id.js";
|
|
20
20
|
function nonEmpty(value) {
|
|
21
21
|
return typeof value === "string" && value.length > 0;
|
|
22
22
|
}
|
|
@@ -90,20 +90,6 @@ async function call(lookup, ...args) {
|
|
|
90
90
|
return { called: false };
|
|
91
91
|
}
|
|
92
92
|
}
|
|
93
|
-
const CLERK_ORG_ID_SHAPE = /^org_[A-Za-z0-9]+$/;
|
|
94
|
-
const ID_CLAIMS = ["org_id", "organizationId", "orgId"];
|
|
95
|
-
/** The first claim that is shaped like a Clerk org ID and resolves as a tenant. */
|
|
96
|
-
function claimedOrgId(claims) {
|
|
97
|
-
for (const name of ID_CLAIMS) {
|
|
98
|
-
const value = claims[name];
|
|
99
|
-
if (typeof value !== "string" || !CLERK_ORG_ID_SHAPE.test(value))
|
|
100
|
-
continue;
|
|
101
|
-
const resolved = resolveTenantIdOrAbsent({ kind: "session", identity: { orgId: value } });
|
|
102
|
-
if (resolved.present)
|
|
103
|
-
return resolved.tenantId;
|
|
104
|
-
}
|
|
105
|
-
return undefined;
|
|
106
|
-
}
|
|
107
93
|
/**
|
|
108
94
|
* Resolves a VERIFIED credential's claims to the stored mapping row of its
|
|
109
95
|
* organisation, or refuses. The claim's org ID selects the row; nothing the
|
package/dist/org-by-id.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"org-by-id.js","sourceRoot":"","sources":["../src/org-by-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAwB,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"org-by-id.js","sourceRoot":"","sources":["../src/org-by-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAwB,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAmBnD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,GAA8B;IACjD,OAAO,CACL,GAAG,KAAK,IAAI;QACZ,GAAG,KAAK,SAAS;QACjB,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC;YACxC,CAAC,GAAG,CAAC,KAAK,KAAK,IAAI,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CACnD,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,OAAO,CACrB,CAA4B,EAC5B,CAA4B;IAE5B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAgC,EAChC,QAAmC;IAEnC,IAAI,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AACjF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,CAA4B,EAC5B,CAA4B,EAC5B,QAAmC;IAEnC,IAAI,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACxE,OAAO,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACvB,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;CAC9B,CAAC,CAAC;AAeH,SAAS,MAAM,CAAC,GAA8B;IAC5C,OAAO,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AAKD,sEAAsE;AACtE,KAAK,UAAU,IAAI,CACjB,MAAgC,EAChC,GAAG,IAAO;IAEV,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;QAClC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AA0BD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAkD,EAClD,OAA6C,EAC7C,OAAoC;IAEpC,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,qBAAqB,CAAC;IACpD,MAAM,IAAI,GAAG,CACX,MAAqC,EACrC,MAAc,EACa,EAAE,CAAC,CAAC;QAC/B,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;KACtD,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,0BAA0B,EAAE,kDAAkD,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,GAAc,EAAE,EAAU,EAA6B,EAAE;QACvE,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,yBAAyB,EAAE,+CAA+C,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,GAAG,EAAE;gBACH,EAAE;gBACF,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;gBAC9C,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;aAC7B;SACF,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,4BAA4B,EAAE,qDAAqD,CAAC,CAAC;IAC1G,MAAM,UAAU,GAAG,IAAI,CACrB,2BAA2B,EAC3B,kEAAkE,CACnE,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,UAAU,CAAC;IACrC,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,uBAAuB,EAAE,iEAAiE,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK;QAAE,OAAO,OAAO,CAAC;IAChE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACpC,CAAC;AAoBD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAgC,EAChC,OAA6C;IAE7C,MAAM,MAAM,GAAG,CAAC,MAA0B,EAAmB,EAAE,CAAC,CAAC;QAC/D,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE;KAC3C,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACpF,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC;IAC5F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;AAClD,CAAC;AA0BD,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA8C,EAC9C,OAAgC;IAEhC,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,yBAAyB,CAAC;IACtD,MAAM,IAAI,GAAG,OAAO,EAAE,mBAAmB,CAAC;IAC1C,IAAI,OAAO,IAAI,KAAK,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAC9D,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAChC,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IACvD,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACjD,MAAM,SAAS,GAAgB,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACnD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YACtE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IAC3E,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IACzB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;AAC/E,CAAC"}
|
|
@@ -0,0 +1,56 @@
|
|
|
1
|
+
import { type IdentityRefusal } from "./identity-refusal.js";
|
|
2
|
+
import { type McpResourceServerConfig } from "./resource-server.js";
|
|
3
|
+
/**
|
|
4
|
+
* Session to tenant: the one answer to "which person, in which organisation, is
|
|
5
|
+
* behind this access token?" for a server that is an OAuth resource.
|
|
6
|
+
*
|
|
7
|
+
* A downstream server hands over the `Authorization` header and the same
|
|
8
|
+
* resource-server config it already uses to guard its routes. The token is
|
|
9
|
+
* verified by `verifyMcpAccessToken` (signature, issuer, audience, expiry), and
|
|
10
|
+
* only then is the claim record read. This module never verifies anything
|
|
11
|
+
* itself and never reads a claim off a token that was not verified: a
|
|
12
|
+
* downstream server never touches a raw claim.
|
|
13
|
+
*
|
|
14
|
+
* The organisation comes from the verified token's `org_id` claim (the ID, e.g.
|
|
15
|
+
* `org_2abc...`). `organizationId` and `orgId` are accepted as the same claim
|
|
16
|
+
* under their other spellings. A slug (`org_slug`) is a label: it is never read
|
|
17
|
+
* and never rescues a missing ID. A verified token that carries no usable
|
|
18
|
+
* organisation ID is refused (`no-verified-organisation`, HTTP 403): the answer
|
|
19
|
+
* is never an unscoped or master view.
|
|
20
|
+
*/
|
|
21
|
+
/** The person behind a verified access token. */
|
|
22
|
+
export type TokenPrincipal = {
|
|
23
|
+
/** The verified subject (`sub`). */
|
|
24
|
+
subject: string;
|
|
25
|
+
/** How the person is recorded as "who did it": `user:<subject>`. */
|
|
26
|
+
actorName: string;
|
|
27
|
+
/** The verified `org_role` claim, or null when the token carries none. */
|
|
28
|
+
role: string | null;
|
|
29
|
+
};
|
|
30
|
+
export type ResolveTenantFromAccessTokenResult = {
|
|
31
|
+
ok: true;
|
|
32
|
+
principal: TokenPrincipal;
|
|
33
|
+
orgId: string;
|
|
34
|
+
} | {
|
|
35
|
+
ok: false;
|
|
36
|
+
status: 401;
|
|
37
|
+
refusal: IdentityRefusal;
|
|
38
|
+
headers: {
|
|
39
|
+
"WWW-Authenticate": string;
|
|
40
|
+
};
|
|
41
|
+
} | {
|
|
42
|
+
ok: false;
|
|
43
|
+
status: 503;
|
|
44
|
+
refusal: IdentityRefusal;
|
|
45
|
+
} | {
|
|
46
|
+
ok: false;
|
|
47
|
+
status: 403;
|
|
48
|
+
refusal: IdentityRefusal;
|
|
49
|
+
};
|
|
50
|
+
/**
|
|
51
|
+
* Resolves `{ principal, orgId }` from an `Authorization` header, or fails with
|
|
52
|
+
* a typed refusal. Never returns an org for a token that did not verify; never
|
|
53
|
+
* returns undefined in silence. `nowMs` is injectable for tests.
|
|
54
|
+
*/
|
|
55
|
+
export declare function resolveTenantFromAccessToken(authorization: string | undefined, config: McpResourceServerConfig, nowMs?: number): Promise<ResolveTenantFromAccessTokenResult>;
|
|
56
|
+
//# sourceMappingURL=tenant-from-token.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"tenant-from-token.d.ts","sourceRoot":"","sources":["../src/tenant-from-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGtE,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;GAiBG;AAEH,iDAAiD;AACjD,MAAM,MAAM,cAAc,GAAG;IAC3B,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAC1C;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAEtD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,GAAG,CAAC;IACZ,OAAO,EAAE,eAAe,CAAC;IACzB,OAAO,EAAE;QAAE,kBAAkB,EAAE,MAAM,CAAA;KAAE,CAAC;CACzC,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,GAEpD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAEzD;;;;GAIG;AACH,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,MAAM,EAAE,uBAAuB,EAC/B,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC,kCAAkC,CAAC,CAwB7C"}
|
|
@@ -0,0 +1,30 @@
|
|
|
1
|
+
import { refusal } from "./identity-refusal.js";
|
|
2
|
+
import { claimedOrgId } from "./claimed-org-id.js";
|
|
3
|
+
import { personActorName } from "./person-principal.js";
|
|
4
|
+
import { verifyMcpAccessToken, } from "./resource-server.js";
|
|
5
|
+
/**
|
|
6
|
+
* Resolves `{ principal, orgId }` from an `Authorization` header, or fails with
|
|
7
|
+
* a typed refusal. Never returns an org for a token that did not verify; never
|
|
8
|
+
* returns undefined in silence. `nowMs` is injectable for tests.
|
|
9
|
+
*/
|
|
10
|
+
export async function resolveTenantFromAccessToken(authorization, config, nowMs = Date.now()) {
|
|
11
|
+
const verified = await verifyMcpAccessToken(authorization, config, nowMs);
|
|
12
|
+
if (!verified.ok)
|
|
13
|
+
return verified;
|
|
14
|
+
const { userId, claims } = verified.session;
|
|
15
|
+
const orgId = claimedOrgId({ ...claims });
|
|
16
|
+
if (orgId === undefined) {
|
|
17
|
+
return {
|
|
18
|
+
ok: false,
|
|
19
|
+
status: 403,
|
|
20
|
+
refusal: refusal("RBAC_DENIED", "no-verified-organisation", config.door ?? "resolveTenantFromAccessToken", "The access token verified but carries no organisation ID."),
|
|
21
|
+
};
|
|
22
|
+
}
|
|
23
|
+
const role = typeof claims.org_role === "string" && claims.org_role.length > 0 ? claims.org_role : null;
|
|
24
|
+
return {
|
|
25
|
+
ok: true,
|
|
26
|
+
orgId,
|
|
27
|
+
principal: { subject: userId, actorName: personActorName(userId), role },
|
|
28
|
+
};
|
|
29
|
+
}
|
|
30
|
+
//# sourceMappingURL=tenant-from-token.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"tenant-from-token.js","sourceRoot":"","sources":["../src/tenant-from-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAwB,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EACL,oBAAoB,GAErB,MAAM,sBAAsB,CAAC;AA4C9B;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,aAAiC,EACjC,MAA+B,EAC/B,QAAgB,IAAI,CAAC,GAAG,EAAE;IAE1B,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC1E,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAElC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC5C,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,OAAO,CACd,aAAa,EACb,0BAA0B,EAC1B,MAAM,CAAC,IAAI,IAAI,8BAA8B,EAC7C,2DAA2D,CAC5D;SACF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACxG,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK;QACL,SAAS,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE;KACzE,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@vantageos/cloud-identity",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.18.0",
|
|
4
4
|
"description": "Framework-agnostic identity + scope-filter primitives for VantagePeers Cloud (multi-tenant MCP).",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "./dist/index.js",
|
|
@@ -89,6 +89,10 @@
|
|
|
89
89
|
"./org-by-id": {
|
|
90
90
|
"types": "./dist/org-by-id.d.ts",
|
|
91
91
|
"import": "./dist/org-by-id.js"
|
|
92
|
+
},
|
|
93
|
+
"./tenant-from-token": {
|
|
94
|
+
"types": "./dist/tenant-from-token.d.ts",
|
|
95
|
+
"import": "./dist/tenant-from-token.js"
|
|
92
96
|
}
|
|
93
97
|
},
|
|
94
98
|
"files": [
|
|
@@ -102,7 +106,7 @@
|
|
|
102
106
|
"test": "vitest run",
|
|
103
107
|
"test:watch": "vitest",
|
|
104
108
|
"lint": "tsc --noEmit",
|
|
105
|
-
"prepublishOnly": "npm run build
|
|
109
|
+
"prepublishOnly": "npm run build"
|
|
106
110
|
},
|
|
107
111
|
"keywords": [
|
|
108
112
|
"vantagepeers",
|