@venizia/ignis-kernel 0.2.0-2 → 0.2.0-3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cjs/base/auth/authenticate/common/constants.d.ts +26 -0
- package/dist/cjs/base/auth/authenticate/common/constants.d.ts.map +1 -1
- package/dist/cjs/base/auth/authenticate/common/constants.js +28 -2
- package/dist/cjs/base/auth/authenticate/common/constants.js.map +1 -1
- package/dist/cjs/base/auth/authenticate/common/errors.d.ts +40 -1
- package/dist/cjs/base/auth/authenticate/common/errors.d.ts.map +1 -1
- package/dist/cjs/base/auth/authenticate/common/errors.js +41 -1
- package/dist/cjs/base/auth/authenticate/common/errors.js.map +1 -1
- package/dist/cjs/base/auth/authenticate/common/keys.d.ts +2 -0
- package/dist/cjs/base/auth/authenticate/common/keys.d.ts.map +1 -1
- package/dist/cjs/base/auth/authenticate/common/keys.js +2 -0
- package/dist/cjs/base/auth/authenticate/common/keys.js.map +1 -1
- package/dist/cjs/base/auth/authenticate/common/types.d.ts +81 -1
- package/dist/cjs/base/auth/authenticate/common/types.d.ts.map +1 -1
- package/dist/esm/base/auth/authenticate/common/constants.d.ts +26 -0
- package/dist/esm/base/auth/authenticate/common/constants.d.ts.map +1 -1
- package/dist/esm/base/auth/authenticate/common/constants.js +26 -1
- package/dist/esm/base/auth/authenticate/common/constants.js.map +1 -1
- package/dist/esm/base/auth/authenticate/common/errors.d.ts +40 -1
- package/dist/esm/base/auth/authenticate/common/errors.d.ts.map +1 -1
- package/dist/esm/base/auth/authenticate/common/errors.js +41 -1
- package/dist/esm/base/auth/authenticate/common/errors.js.map +1 -1
- package/dist/esm/base/auth/authenticate/common/keys.d.ts +2 -0
- package/dist/esm/base/auth/authenticate/common/keys.d.ts.map +1 -1
- package/dist/esm/base/auth/authenticate/common/keys.js +2 -0
- package/dist/esm/base/auth/authenticate/common/keys.js.map +1 -1
- package/dist/esm/base/auth/authenticate/common/types.d.ts +81 -1
- package/dist/esm/base/auth/authenticate/common/types.d.ts.map +1 -1
- package/package.json +2 -2
|
@@ -2,6 +2,7 @@ import type { TConstValue } from '@venizia/ignis-helpers/common';
|
|
|
2
2
|
export declare class AuthenticateStrategy {
|
|
3
3
|
static readonly BASIC = "basic";
|
|
4
4
|
static readonly JWT = "jwt";
|
|
5
|
+
static readonly SERVICE = "service";
|
|
5
6
|
/** The strategies the FRAMEWORK ships. An application registers its own beyond these. */
|
|
6
7
|
static readonly SCHEME_SET: Set<string>;
|
|
7
8
|
static isValid(input: string): boolean;
|
|
@@ -17,6 +18,7 @@ export type TJOSEStandard = TConstValue<typeof JOSEStandards>;
|
|
|
17
18
|
export declare class Authentication {
|
|
18
19
|
static readonly STRATEGY_BASIC = "basic";
|
|
19
20
|
static readonly STRATEGY_JWT = "jwt";
|
|
21
|
+
static readonly STRATEGY_SERVICE = "service";
|
|
20
22
|
static readonly TYPE_BASIC = "Basic";
|
|
21
23
|
static readonly TYPE_BEARER = "Bearer";
|
|
22
24
|
static readonly AUTHENTICATION_STRATEGY = "authentication.strategy";
|
|
@@ -57,4 +59,28 @@ export declare class JWKSKeyFormats {
|
|
|
57
59
|
static isValid(input: string): boolean;
|
|
58
60
|
}
|
|
59
61
|
export type TJWKSKeyFormat = TConstValue<typeof JWKSKeyFormats>;
|
|
62
|
+
/**
|
|
63
|
+
* Wire-level constants of the service assertion. Fixed rather than configurable: both ends of a
|
|
64
|
+
* call must agree on them, and a knob here would let two services disagree silently.
|
|
65
|
+
*/
|
|
66
|
+
export declare class ServiceAssertion {
|
|
67
|
+
/** Its own header, so the end user's token keeps `Authorization` on the same request. */
|
|
68
|
+
static readonly HEADER = "x-service-assertion";
|
|
69
|
+
/** The JWS `typ`. What stops a user token being replayed as an assertion when one JWKS serves both. */
|
|
70
|
+
static readonly TYP = "svc+jwt";
|
|
71
|
+
static readonly ALGORITHM = "EdDSA";
|
|
72
|
+
static readonly DEFAULT_REST_PATH = "/svc-certs";
|
|
73
|
+
/** How long a minted assertion stays valid. */
|
|
74
|
+
static readonly DEFAULT_SIGN_LIFETIME_SECONDS = 60;
|
|
75
|
+
/** The oldest assertion a callee accepts, measured from `iat`. Its own decision, not the caller's. */
|
|
76
|
+
static readonly DEFAULT_ACCEPT_MAX_AGE_SECONDS = 60;
|
|
77
|
+
static readonly DEFAULT_CLOCK_TOLERANCE_SECONDS = 5;
|
|
78
|
+
/** Resolves the accepted age for one caller: its own override, then the service default. */
|
|
79
|
+
static resolveAcceptMaxAge(opts: {
|
|
80
|
+
callerOverride?: number;
|
|
81
|
+
serviceDefault?: number;
|
|
82
|
+
}): number;
|
|
83
|
+
static readonly DEFAULT_JWKS_CACHE_MAX_AGE_MS: number;
|
|
84
|
+
static readonly DEFAULT_JWKS_COOLDOWN_MS: number;
|
|
85
|
+
}
|
|
60
86
|
//# sourceMappingURL=constants.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/constants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;
|
|
1
|
+
{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/constants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAC5B,MAAM,CAAC,QAAQ,CAAC,OAAO,aAAa;IAEpC,yFAAyF;IACzF,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAiD;IAE3E,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAID,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,oBAAoB,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAErF,qBAAa,aAAa;IACxB,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAC5B,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAE9B,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAkC;IAE5D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,aAAa,CAAC,CAAC;AAE9D,qBAAa,cAAc;IAEzB,MAAM,CAAC,QAAQ,CAAC,cAAc,WAA8B;IAC5D,MAAM,CAAC,QAAQ,CAAC,YAAY,SAA4B;IACxD,MAAM,CAAC,QAAQ,CAAC,gBAAgB,aAAgC;IAGhE,MAAM,CAAC,QAAQ,CAAC,UAAU,WAAW;IACrC,MAAM,CAAC,QAAQ,CAAC,WAAW,YAAY;IAEvC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,6BAA6B;IACpE,MAAM,CAAC,QAAQ,CAAC,mBAAmB,yBAAyB;IAE5D,MAAM,CAAC,QAAQ,CAAC,YAAY,uBAAuB;IACnD,MAAM,CAAC,QAAQ,CAAC,aAAa,mBAAmB;CACjD;AAED,qBAAa,wBAAwB;IACnC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,4BAA4B;IACnE,MAAM,CAAC,QAAQ,CAAC,iBAAiB,sBAAsB;IACvD,MAAM,CAAC,QAAQ,CAAC,kBAAkB,uBAAuB;CAC1D;AAED,qBAAa,mBAAmB;IAC9B,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAC5B,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAE5B,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAiC;IAE3D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,qBAAa,SAAS;IACpB,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,QAAQ,cAAc;IAEtC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAyC;IAEnE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,SAAS,CAAC,CAAC;AAEtD,qBAAa,cAAc;IACzB,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAE9B,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAmC;IAE7D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,cAAc,CAAC,CAAC;AAEhE,qBAAa,cAAc;IACzB,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAC5B,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAE5B,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAiC;IAE3D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,cAAc,CAAC,CAAC;AAEhE;;;GAGG;AACH,qBAAa,gBAAgB;IAC3B,yFAAyF;IACzF,MAAM,CAAC,QAAQ,CAAC,MAAM,yBAAyB;IAE/C,uGAAuG;IACvG,MAAM,CAAC,QAAQ,CAAC,GAAG,aAAa;IAEhC,MAAM,CAAC,QAAQ,CAAC,SAAS,WAAW;IAEpC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,gBAAgB;IACjD,+CAA+C;IAC/C,MAAM,CAAC,QAAQ,CAAC,6BAA6B,MAAM;IAEnD,sGAAsG;IACtG,MAAM,CAAC,QAAQ,CAAC,8BAA8B,MAAM;IACpD,MAAM,CAAC,QAAQ,CAAC,+BAA+B,KAAK;IAEpD,4FAA4F;IAC5F,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM;IAM9F,MAAM,CAAC,QAAQ,CAAC,6BAA6B,SAAkB;IAC/D,MAAM,CAAC,QAAQ,CAAC,wBAAwB,SAAa;CACtD"}
|
|
@@ -1,11 +1,12 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.JWKSKeyFormats = exports.JWKSKeyDrivers = exports.JWKSModes = exports.AuthenticationModes = exports.AuthenticationTokenTypes = exports.Authentication = exports.JOSEStandards = exports.AuthenticateStrategy = void 0;
|
|
3
|
+
exports.ServiceAssertion = exports.JWKSKeyFormats = exports.JWKSKeyDrivers = exports.JWKSModes = exports.AuthenticationModes = exports.AuthenticationTokenTypes = exports.Authentication = exports.JOSEStandards = exports.AuthenticateStrategy = void 0;
|
|
4
4
|
class AuthenticateStrategy {
|
|
5
5
|
static { this.BASIC = 'basic'; }
|
|
6
6
|
static { this.JWT = 'jwt'; }
|
|
7
|
+
static { this.SERVICE = 'service'; }
|
|
7
8
|
/** The strategies the FRAMEWORK ships. An application registers its own beyond these. */
|
|
8
|
-
static { this.SCHEME_SET = new Set([this.BASIC, this.JWT]); }
|
|
9
|
+
static { this.SCHEME_SET = new Set([this.BASIC, this.JWT, this.SERVICE]); }
|
|
9
10
|
static isValid(input) {
|
|
10
11
|
return this.SCHEME_SET.has(input);
|
|
11
12
|
}
|
|
@@ -24,6 +25,7 @@ class Authentication {
|
|
|
24
25
|
// Strategy
|
|
25
26
|
static { this.STRATEGY_BASIC = AuthenticateStrategy.BASIC; }
|
|
26
27
|
static { this.STRATEGY_JWT = AuthenticateStrategy.JWT; }
|
|
28
|
+
static { this.STRATEGY_SERVICE = AuthenticateStrategy.SERVICE; }
|
|
27
29
|
// Token type
|
|
28
30
|
static { this.TYPE_BASIC = 'Basic'; }
|
|
29
31
|
static { this.TYPE_BEARER = 'Bearer'; }
|
|
@@ -75,4 +77,28 @@ class JWKSKeyFormats {
|
|
|
75
77
|
}
|
|
76
78
|
}
|
|
77
79
|
exports.JWKSKeyFormats = JWKSKeyFormats;
|
|
80
|
+
/**
|
|
81
|
+
* Wire-level constants of the service assertion. Fixed rather than configurable: both ends of a
|
|
82
|
+
* call must agree on them, and a knob here would let two services disagree silently.
|
|
83
|
+
*/
|
|
84
|
+
class ServiceAssertion {
|
|
85
|
+
/** Its own header, so the end user's token keeps `Authorization` on the same request. */
|
|
86
|
+
static { this.HEADER = 'x-service-assertion'; }
|
|
87
|
+
/** The JWS `typ`. What stops a user token being replayed as an assertion when one JWKS serves both. */
|
|
88
|
+
static { this.TYP = 'svc+jwt'; }
|
|
89
|
+
static { this.ALGORITHM = 'EdDSA'; }
|
|
90
|
+
static { this.DEFAULT_REST_PATH = '/svc-certs'; }
|
|
91
|
+
/** How long a minted assertion stays valid. */
|
|
92
|
+
static { this.DEFAULT_SIGN_LIFETIME_SECONDS = 60; }
|
|
93
|
+
/** The oldest assertion a callee accepts, measured from `iat`. Its own decision, not the caller's. */
|
|
94
|
+
static { this.DEFAULT_ACCEPT_MAX_AGE_SECONDS = 60; }
|
|
95
|
+
static { this.DEFAULT_CLOCK_TOLERANCE_SECONDS = 5; }
|
|
96
|
+
/** Resolves the accepted age for one caller: its own override, then the service default. */
|
|
97
|
+
static resolveAcceptMaxAge(opts) {
|
|
98
|
+
return (opts.callerOverride ?? opts.serviceDefault ?? ServiceAssertion.DEFAULT_ACCEPT_MAX_AGE_SECONDS);
|
|
99
|
+
}
|
|
100
|
+
static { this.DEFAULT_JWKS_CACHE_MAX_AGE_MS = 10 * 60 * 1000; }
|
|
101
|
+
static { this.DEFAULT_JWKS_COOLDOWN_MS = 30 * 1000; }
|
|
102
|
+
}
|
|
103
|
+
exports.ServiceAssertion = ServiceAssertion;
|
|
78
104
|
//# sourceMappingURL=constants.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/constants.ts"],"names":[],"mappings":";;;AAEA,MAAa,oBAAoB;aACf,UAAK,GAAG,OAAO,CAAC;aAChB,QAAG,GAAG,KAAK,CAAC;
|
|
1
|
+
{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/constants.ts"],"names":[],"mappings":";;;AAEA,MAAa,oBAAoB;aACf,UAAK,GAAG,OAAO,CAAC;aAChB,QAAG,GAAG,KAAK,CAAC;aACZ,YAAO,GAAG,SAAS,CAAC;IAEpC,yFAAyF;aACzE,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3E,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAVH,oDAWC;AAMD,MAAa,aAAa;aACR,QAAG,GAAG,KAAK,CAAC;aACZ,SAAI,GAAG,MAAM,CAAC;aAEd,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AARH,sCASC;AAID,MAAa,cAAc;IACzB,WAAW;aACK,mBAAc,GAAG,oBAAoB,CAAC,KAAK,CAAC;aAC5C,iBAAY,GAAG,oBAAoB,CAAC,GAAG,CAAC;aACxC,qBAAgB,GAAG,oBAAoB,CAAC,OAAO,CAAC;IAEhE,aAAa;aACG,eAAU,GAAG,OAAO,CAAC;aACrB,gBAAW,GAAG,QAAQ,CAAC;aAEvB,4BAAuB,GAAG,yBAAyB,CAAC;aACpD,wBAAmB,GAAG,qBAAqB,CAAC;aAE5C,iBAAY,GAAG,mBAAmB,CAAC;aACnC,kBAAa,GAAG,eAAe,CAAC;;AAdlD,wCAeC;AAED,MAAa,wBAAwB;aACnB,4BAAuB,GAAG,wBAAwB,CAAC;aACnD,sBAAiB,GAAG,kBAAkB,CAAC;aACvC,uBAAkB,GAAG,mBAAmB,CAAC;;AAH3D,4DAIC;AAED,MAAa,mBAAmB;aACd,QAAG,GAAG,KAAK,CAAC;aACZ,QAAG,GAAG,KAAK,CAAC;aAEZ,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AARH,kDASC;AAID,MAAa,SAAS;aACJ,WAAM,GAAG,QAAQ,CAAC;aAClB,aAAQ,GAAG,UAAU,CAAC;aAEtB,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEnE,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AARH,8BASC;AAID,MAAa,cAAc;aACT,SAAI,GAAG,MAAM,CAAC;aACd,SAAI,GAAG,MAAM,CAAC;aAEd,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAE7D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AARH,wCASC;AAID,MAAa,cAAc;aACT,QAAG,GAAG,KAAK,CAAC;aACZ,QAAG,GAAG,KAAK,CAAC;aAEZ,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AARH,wCASC;AAID;;;GAGG;AACH,MAAa,gBAAgB;IAC3B,yFAAyF;aACzE,WAAM,GAAG,qBAAqB,CAAC;IAE/C,uGAAuG;aACvF,QAAG,GAAG,SAAS,CAAC;aAEhB,cAAS,GAAG,OAAO,CAAC;aAEpB,sBAAiB,GAAG,YAAY,CAAC;IACjD,+CAA+C;aAC/B,kCAA6B,GAAG,EAAE,CAAC;IAEnD,sGAAsG;aACtF,mCAA8B,GAAG,EAAE,CAAC;aACpC,oCAA+B,GAAG,CAAC,CAAC;IAEpD,4FAA4F;IAC5F,MAAM,CAAC,mBAAmB,CAAC,IAA0D;QACnF,OAAO,CACL,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,IAAI,gBAAgB,CAAC,8BAA8B,CAC9F,CAAC;IACJ,CAAC;aAEe,kCAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;aAC/C,6BAAwB,GAAG,EAAE,GAAG,IAAI,CAAC;;AAzBvD,4CA0BC"}
|
|
@@ -82,8 +82,47 @@ export declare const AuthenticationErrors: {
|
|
|
82
82
|
readonly statusCode: 401;
|
|
83
83
|
readonly category: "auth";
|
|
84
84
|
};
|
|
85
|
+
readonly ASSERTION_MISSING: {
|
|
86
|
+
readonly message: {
|
|
87
|
+
readonly text: "Missing service assertion";
|
|
88
|
+
readonly code: "core.authentication.service.assertion_missing";
|
|
89
|
+
};
|
|
90
|
+
readonly statusCode: 401;
|
|
91
|
+
readonly category: "auth";
|
|
92
|
+
};
|
|
93
|
+
readonly ASSERTION_INVALID: {
|
|
94
|
+
readonly message: {
|
|
95
|
+
readonly text: "Invalid service assertion";
|
|
96
|
+
readonly code: "core.authentication.service.assertion_invalid";
|
|
97
|
+
};
|
|
98
|
+
readonly statusCode: 401;
|
|
99
|
+
readonly category: "auth";
|
|
100
|
+
};
|
|
101
|
+
readonly CALLER_NOT_ALLOWED: {
|
|
102
|
+
readonly message: {
|
|
103
|
+
readonly text: "Service caller is not allowed";
|
|
104
|
+
readonly code: "core.authentication.service.caller_not_allowed";
|
|
105
|
+
};
|
|
106
|
+
readonly statusCode: 401;
|
|
107
|
+
readonly category: "auth";
|
|
108
|
+
};
|
|
109
|
+
readonly REQUEST_BINDING_MISMATCH: {
|
|
110
|
+
readonly message: {
|
|
111
|
+
readonly text: "Service assertion does not match this request";
|
|
112
|
+
readonly code: "core.authentication.service.request_binding_mismatch";
|
|
113
|
+
};
|
|
114
|
+
readonly statusCode: 401;
|
|
115
|
+
readonly category: "auth";
|
|
116
|
+
};
|
|
117
|
+
readonly PRINCIPAL_UNRESOLVED: {
|
|
118
|
+
readonly message: {
|
|
119
|
+
readonly text: "Service caller resolved to no principal";
|
|
120
|
+
readonly code: "core.authentication.service.principal_unresolved";
|
|
121
|
+
};
|
|
122
|
+
readonly statusCode: 401;
|
|
123
|
+
readonly category: "auth";
|
|
124
|
+
};
|
|
85
125
|
};
|
|
86
|
-
/** Registers these codes with the shared key registry so a consumer gets autocomplete on `messageCode`. Augments the `/core` subpath, not the root barrel - kernel never imports the bare package, so nothing else in this program would make the root specifier resolvable for the merge. */
|
|
87
126
|
declare module '@venizia/ignis-helpers/core' {
|
|
88
127
|
interface IErrorKeyRegistry extends TRegisterErrors<typeof AuthenticationErrors> {
|
|
89
128
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/errors.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/errors.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAoB,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAGrF,kJAAkJ;AAClJ,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA8B/B,iIAAiI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmF9E,CAAC;AAEtD,OAAO,QAAQ,6BAA6B,CAAC;IAC3C,UAAU,iBAAkB,SAAQ,eAAe,CAAC,OAAO,oBAAoB,CAAC;KAAG;CACpF"}
|
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.AuthenticationErrors = void 0;
|
|
4
|
-
const core_1 = require("@venizia/ignis-helpers/core");
|
|
5
4
|
const common_1 = require("@venizia/ignis-helpers/common");
|
|
5
|
+
const core_1 = require("@venizia/ignis-helpers/core");
|
|
6
6
|
/** Codes a client branches on for a failed authentication. A throw site may override `message` for detail; the code and status come from here. */
|
|
7
7
|
exports.AuthenticationErrors = {
|
|
8
8
|
HEADER_MISSING: {
|
|
@@ -77,5 +77,45 @@ exports.AuthenticationErrors = {
|
|
|
77
77
|
statusCode: common_1.HTTP.ResultCodes.RS_4.Unauthorized,
|
|
78
78
|
category: core_1.ErrorScopes.AUTH,
|
|
79
79
|
},
|
|
80
|
+
ASSERTION_MISSING: {
|
|
81
|
+
message: {
|
|
82
|
+
text: 'Missing service assertion',
|
|
83
|
+
code: 'core.authentication.service.assertion_missing',
|
|
84
|
+
},
|
|
85
|
+
statusCode: common_1.HTTP.ResultCodes.RS_4.Unauthorized,
|
|
86
|
+
category: core_1.ErrorScopes.AUTH,
|
|
87
|
+
},
|
|
88
|
+
ASSERTION_INVALID: {
|
|
89
|
+
message: {
|
|
90
|
+
text: 'Invalid service assertion',
|
|
91
|
+
code: 'core.authentication.service.assertion_invalid',
|
|
92
|
+
},
|
|
93
|
+
statusCode: common_1.HTTP.ResultCodes.RS_4.Unauthorized,
|
|
94
|
+
category: core_1.ErrorScopes.AUTH,
|
|
95
|
+
},
|
|
96
|
+
CALLER_NOT_ALLOWED: {
|
|
97
|
+
message: {
|
|
98
|
+
text: 'Service caller is not allowed',
|
|
99
|
+
code: 'core.authentication.service.caller_not_allowed',
|
|
100
|
+
},
|
|
101
|
+
statusCode: common_1.HTTP.ResultCodes.RS_4.Unauthorized,
|
|
102
|
+
category: core_1.ErrorScopes.AUTH,
|
|
103
|
+
},
|
|
104
|
+
REQUEST_BINDING_MISMATCH: {
|
|
105
|
+
message: {
|
|
106
|
+
text: 'Service assertion does not match this request',
|
|
107
|
+
code: 'core.authentication.service.request_binding_mismatch',
|
|
108
|
+
},
|
|
109
|
+
statusCode: common_1.HTTP.ResultCodes.RS_4.Unauthorized,
|
|
110
|
+
category: core_1.ErrorScopes.AUTH,
|
|
111
|
+
},
|
|
112
|
+
PRINCIPAL_UNRESOLVED: {
|
|
113
|
+
message: {
|
|
114
|
+
text: 'Service caller resolved to no principal',
|
|
115
|
+
code: 'core.authentication.service.principal_unresolved',
|
|
116
|
+
},
|
|
117
|
+
statusCode: common_1.HTTP.ResultCodes.RS_4.Unauthorized,
|
|
118
|
+
category: core_1.ErrorScopes.AUTH,
|
|
119
|
+
},
|
|
80
120
|
};
|
|
81
121
|
//# sourceMappingURL=errors.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/errors.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/errors.ts"],"names":[],"mappings":";;;AAAA,0DAAqD;AAErD,sDAA0D;AAE1D,kJAAkJ;AACrI,QAAA,oBAAoB,GAAG;IAClC,cAAc,EAAE;QACd,OAAO,EAAE;YACP,IAAI,EAAE,8BAA8B;YACpC,IAAI,EAAE,oCAAoC;SAC3C;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,cAAc,EAAE;QACd,OAAO,EAAE;YACP,IAAI,EAAE,kCAAkC;YACxC,IAAI,EAAE,oCAAoC;SAC3C;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,gBAAgB,EAAE;QAChB,OAAO,EAAE;YACP,IAAI,EAAE,gCAAgC;YACtC,IAAI,EAAE,sCAAsC;SAC7C;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,aAAa,EAAE;QACb,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,mCAAmC,EAAE;QACrF,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,iIAAiI;IACjI,aAAa,EAAE;QACb,OAAO,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,mCAAmC,EAAE;QACxF,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,qBAAqB,EAAE;QACrB,OAAO,EAAE;YACP,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,2CAA2C;SAClD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,qBAAqB,EAAE;QACrB,OAAO,EAAE;YACP,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,2CAA2C;SAClD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,mBAAmB,EAAE;QACnB,OAAO,EAAE;YACP,IAAI,EAAE,8BAA8B;YACpC,IAAI,EAAE,yCAAyC;SAChD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,MAAM,EAAE;QACN,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,4BAA4B,EAAE;QAC9E,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,eAAe,EAAE;QACf,OAAO,EAAE;YACP,IAAI,EAAE,uCAAuC;YAC7C,IAAI,EAAE,qCAAqC;SAC5C;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,iBAAiB,EAAE;QACjB,OAAO,EAAE;YACP,IAAI,EAAE,2BAA2B;YACjC,IAAI,EAAE,+CAA+C;SACtD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,iBAAiB,EAAE;QACjB,OAAO,EAAE;YACP,IAAI,EAAE,2BAA2B;YACjC,IAAI,EAAE,+CAA+C;SACtD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,kBAAkB,EAAE;QAClB,OAAO,EAAE;YACP,IAAI,EAAE,+BAA+B;YACrC,IAAI,EAAE,gDAAgD;SACvD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,wBAAwB,EAAE;QACxB,OAAO,EAAE;YACP,IAAI,EAAE,+CAA+C;YACrD,IAAI,EAAE,sDAAsD;SAC7D;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,oBAAoB,EAAE;QACpB,OAAO,EAAE;YACP,IAAI,EAAE,yCAAyC;YAC/C,IAAI,EAAE,kDAAkD;SACzD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;CACkD,CAAC"}
|
|
@@ -3,5 +3,7 @@ export declare class AuthenticateBindingKeys {
|
|
|
3
3
|
static readonly JWT_OPTIONS = "@app/authenticate/jwt-options";
|
|
4
4
|
static readonly JWKS_OPTIONS = "@app/authenticate/jwks-options";
|
|
5
5
|
static readonly BASIC_OPTIONS = "@app/authenticate/basic-options";
|
|
6
|
+
static readonly SERVICE_OPTIONS = "@app/authenticate/service-options";
|
|
7
|
+
static readonly SERVICE_CERTS_PATH = "@app/authenticate/service-certs-path";
|
|
6
8
|
}
|
|
7
9
|
//# sourceMappingURL=keys.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/keys.ts"],"names":[],"mappings":"AAAA,qBAAa,uBAAuB;IAClC,MAAM,CAAC,QAAQ,CAAC,YAAY,oCAAoC;IAChE,MAAM,CAAC,QAAQ,CAAC,WAAW,mCAAmC;IAC9D,MAAM,CAAC,QAAQ,CAAC,YAAY,oCAAoC;IAChE,MAAM,CAAC,QAAQ,CAAC,aAAa,qCAAqC;
|
|
1
|
+
{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/keys.ts"],"names":[],"mappings":"AAAA,qBAAa,uBAAuB;IAClC,MAAM,CAAC,QAAQ,CAAC,YAAY,oCAAoC;IAChE,MAAM,CAAC,QAAQ,CAAC,WAAW,mCAAmC;IAC9D,MAAM,CAAC,QAAQ,CAAC,YAAY,oCAAoC;IAChE,MAAM,CAAC,QAAQ,CAAC,aAAa,qCAAqC;IAClE,MAAM,CAAC,QAAQ,CAAC,eAAe,uCAAuC;IACtE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,0CAA0C;CAC7E"}
|
|
@@ -6,6 +6,8 @@ class AuthenticateBindingKeys {
|
|
|
6
6
|
static { this.JWT_OPTIONS = '@app/authenticate/jwt-options'; }
|
|
7
7
|
static { this.JWKS_OPTIONS = '@app/authenticate/jwks-options'; }
|
|
8
8
|
static { this.BASIC_OPTIONS = '@app/authenticate/basic-options'; }
|
|
9
|
+
static { this.SERVICE_OPTIONS = '@app/authenticate/service-options'; }
|
|
10
|
+
static { this.SERVICE_CERTS_PATH = '@app/authenticate/service-certs-path'; }
|
|
9
11
|
}
|
|
10
12
|
exports.AuthenticateBindingKeys = AuthenticateBindingKeys;
|
|
11
13
|
//# sourceMappingURL=keys.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/keys.ts"],"names":[],"mappings":";;;AAAA,MAAa,uBAAuB;aAClB,iBAAY,GAAG,gCAAgC,CAAC;aAChD,gBAAW,GAAG,+BAA+B,CAAC;aAC9C,iBAAY,GAAG,gCAAgC,CAAC;aAChD,kBAAa,GAAG,iCAAiC,CAAC;;
|
|
1
|
+
{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/keys.ts"],"names":[],"mappings":";;;AAAA,MAAa,uBAAuB;aAClB,iBAAY,GAAG,gCAAgC,CAAC;aAChD,gBAAW,GAAG,+BAA+B,CAAC;aAC9C,iBAAY,GAAG,gCAAgC,CAAC;aAChD,kBAAa,GAAG,iCAAiC,CAAC;aAClD,oBAAe,GAAG,mCAAmC,CAAC;aACtD,uBAAkB,GAAG,sCAAsC,CAAC;;AAN9E,0DAOC"}
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
import type { TContext } from '../../../../base/controllers/common/types';
|
|
2
2
|
import type { IdType } from '../../../../base/models/common/types';
|
|
3
3
|
import type { TAnyObjectSchema } from '../../../../utilities/schema.utility';
|
|
4
|
-
import type { AnyObject, ValueOrPromise } from '@venizia/ignis-helpers/common';
|
|
4
|
+
import type { AnyObject, TNullable, ValueOrPromise } from '@venizia/ignis-helpers/common';
|
|
5
5
|
import type { AESAlgorithmType, IPayloadCipher } from '@venizia/ignis-helpers/core';
|
|
6
6
|
import type { Env } from 'hono';
|
|
7
7
|
import { type MiddlewareHandler } from 'hono';
|
|
@@ -163,6 +163,85 @@ export type TJWTTokenServiceOptions = {
|
|
|
163
163
|
standard: typeof JOSEStandards.JWKS;
|
|
164
164
|
options: TJWKSTokenServiceOptions;
|
|
165
165
|
};
|
|
166
|
+
/**
|
|
167
|
+
* The request binding, following RFC 9449's `htm`/`htu`. A captured assertion cannot be replayed
|
|
168
|
+
* against a different method or path.
|
|
169
|
+
*
|
|
170
|
+
* `htu` is the percent-ENCODED pathname on both ends. Compare it against
|
|
171
|
+
* `new URL(context.req.url).pathname`, never `context.req.path` - Hono hands that one back DECODED,
|
|
172
|
+
* so any route carrying a space or a non-ASCII slug would never match what the caller signed.
|
|
173
|
+
*/
|
|
174
|
+
export interface IServiceAssertionClaims extends JWTPayload {
|
|
175
|
+
htm: string;
|
|
176
|
+
htu: string;
|
|
177
|
+
}
|
|
178
|
+
/**
|
|
179
|
+
* One entry in the caller allowlist: the JWKS url, or that url plus settings for this caller alone.
|
|
180
|
+
*/
|
|
181
|
+
export type TServiceCallerEntry = string | {
|
|
182
|
+
jwksUrl: string;
|
|
183
|
+
/** Widens the accepted age for THIS caller only. Falls back to the service-wide setting. */
|
|
184
|
+
acceptMaxAgeSeconds?: number;
|
|
185
|
+
};
|
|
186
|
+
/** Service-to-service authentication: an Ed25519 assertion per request, verified against the caller's JWKS. */
|
|
187
|
+
export interface IServiceAuthOptions<E extends Env = Env> {
|
|
188
|
+
/** What this service calls itself: the `iss` it stamps, and the `aud` it demands. */
|
|
189
|
+
name: string;
|
|
190
|
+
/**
|
|
191
|
+
* Present only on a service that CALLS OUT. Absent means verify-only, and no certs route is
|
|
192
|
+
* mounted - which is the common case, since most services are called and never call.
|
|
193
|
+
*/
|
|
194
|
+
keys?: {
|
|
195
|
+
driver: TJWKSKeyDriver;
|
|
196
|
+
format: TJWKSKeyFormat;
|
|
197
|
+
/** PEM or JWK by `format`; content for the `text` driver, a path for `file`. */
|
|
198
|
+
private: string;
|
|
199
|
+
public: string;
|
|
200
|
+
kid?: string;
|
|
201
|
+
};
|
|
202
|
+
/**
|
|
203
|
+
* Caller name to its JWKS url. THIS IS ALSO THE ALLOWLIST - a name absent from the map cannot
|
|
204
|
+
* call, and an empty map correctly allows nobody.
|
|
205
|
+
*
|
|
206
|
+
* The bare-string form is the common case. The object form exists to widen the accepted age for
|
|
207
|
+
* ONE caller: a nightly batch may legitimately need more slack than an interactive service, and
|
|
208
|
+
* granting it per caller keeps the concession named and visible in config.
|
|
209
|
+
*/
|
|
210
|
+
callers?: Record<string, TServiceCallerEntry>;
|
|
211
|
+
/** Where the certs route is mounted. Defaults to `ServiceAssertion.DEFAULT_REST_PATH`. */
|
|
212
|
+
rest?: {
|
|
213
|
+
path: string;
|
|
214
|
+
};
|
|
215
|
+
/**
|
|
216
|
+
* How long the assertions this service MINTS stay valid. Only meaningful where `keys` is set.
|
|
217
|
+
*/
|
|
218
|
+
signLifetimeSeconds?: number;
|
|
219
|
+
/**
|
|
220
|
+
* The oldest assertion this service ACCEPTS, measured from `iat`.
|
|
221
|
+
*
|
|
222
|
+
* Deliberately separate from `signLifetimeSeconds`, and deliberately not requestable by the
|
|
223
|
+
* caller. The caller already controls `exp` - it signs the token - so this is the only bound that
|
|
224
|
+
* survives a compromised caller. A per-caller override belongs in {@link callers}, never in the
|
|
225
|
+
* assertion.
|
|
226
|
+
*
|
|
227
|
+
* Composes with `clockToleranceSeconds`: the real acceptance window is the sum of the two.
|
|
228
|
+
*/
|
|
229
|
+
acceptMaxAgeSeconds?: number;
|
|
230
|
+
clockToleranceSeconds?: number;
|
|
231
|
+
jwks?: {
|
|
232
|
+
cacheMaxAgeMs?: number;
|
|
233
|
+
cooldownMs?: number;
|
|
234
|
+
};
|
|
235
|
+
/**
|
|
236
|
+
* WHO a verified assertion acts as. The framework has already proven the caller; this only maps a
|
|
237
|
+
* caller name onto an application principal. Return `null` to refuse a caller the allowlist
|
|
238
|
+
* admits but the application does not recognise.
|
|
239
|
+
*/
|
|
240
|
+
resolvePrincipal: (opts: {
|
|
241
|
+
issuer: string;
|
|
242
|
+
context: TContext<E, string>;
|
|
243
|
+
}) => ValueOrPromise<TNullable<IAuthUser>>;
|
|
244
|
+
}
|
|
166
245
|
export type TBasicTokenServiceOptions<E extends Env = Env> = {
|
|
167
246
|
/** Callback to verify basic auth credentials. Returns IAuthUser if valid, null otherwise. */
|
|
168
247
|
verifyCredentials: (opts: {
|
|
@@ -177,6 +256,7 @@ export interface IAuthenticateOptions {
|
|
|
177
256
|
restOptions?: TAuthenticationRestOptions;
|
|
178
257
|
jwtOptions?: TJWTTokenServiceOptions;
|
|
179
258
|
basicOptions?: TBasicTokenServiceOptions;
|
|
259
|
+
serviceOptions?: IServiceAuthOptions;
|
|
180
260
|
}
|
|
181
261
|
export interface IAuthUser {
|
|
182
262
|
userId: IdType;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC1F,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AACvC,OAAO,KAAK,EAAE,sBAAsB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACpG,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAEvF,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE;YACP,OAAO,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC;YACtC,QAAQ,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC;SACxC,CAAC;QACF,MAAM,CAAC,EAAE;YACP,OAAO,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC;YACtC,QAAQ,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC;SACxC,CAAC;QACF,cAAc,CAAC,EAAE;YACf,OAAO,EAAE;gBAAE,MAAM,CAAC,EAAE,gBAAgB,CAAA;aAAE,CAAC;YACvC,QAAQ,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC;SACxC,CAAC;QACF,YAAY,CAAC,EAAE;YACb,QAAQ,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC;SACxC,CAAC;QACF,kBAAkB,CAAC,EAAE;YACnB,QAAQ,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC;SACxC,CAAC;KACH,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,EAAE,GAAG,CAC1C;IAAE,iBAAiB,CAAC,EAAE,KAAK,GAAG,SAAS,CAAA;CAAE,GACzC;IACE,iBAAiB,EAAE,IAAI,CAAC;IACxB,cAAc,EAAE,yBAAyB,CAAC;CAC3C,CACJ,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,sOAAsO;IACtO,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE7B,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE3B,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,uFAAuF;IACvF,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAEjC,wHAAwH;IACxH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAEtB,kJAAkJ;IAClJ,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAE9B,2IAA2I;IAC3I,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,8HAA8H;AAC9H,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACnC,gHAAgH;IAChH,MAAM,CAAC,EAAE,cAAc,CAAC;IAExB,kFAAkF;IAClF,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAE3B,sGAAsG;IACtG,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAEzD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,SAAS,CAAC,MAAM,CAAC;IAC9B,SAAS,EAAE,cAAc,CAAC;IAC1B,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACxB,IAAI,EAAE;QACJ,MAAM,EAAE,cAAc,CAAC;QACvB,MAAM,EAAE,cAAc,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,GAAG,EAAE,MAAM,CAAC;IACZ,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACnC,gHAAgH;IAChH,MAAM,CAAC,EAAE,cAAc,CAAC;IAExB,kFAAkF;IAClF,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAE3B,sGAAsG;IACtG,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,OAAO,SAAS,CAAC,QAAQ,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACnC,gHAAgH;IAChH,MAAM,CAAC,EAAE,cAAc,CAAC;IAExB,kFAAkF;IAClF,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,MAAM,wBAAwB,GAAG,kBAAkB,GAAG,oBAAoB,CAAC;AAEjF,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,EAAE,OAAO,aAAa,CAAC,GAAG,CAAC;IAAC,OAAO,EAAE,uBAAuB,CAAA;CAAE,GACxE;IAAE,QAAQ,EAAE,OAAO,aAAa,CAAC,IAAI,CAAC;IAAC,OAAO,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAE/E;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAwB,SAAQ,UAAU;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B,MAAM,GACN;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEN,+GAA+G;AAC/G,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG;IACtD,qFAAqF;IACrF,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,IAAI,CAAC,EAAE;QACL,MAAM,EAAE,cAAc,CAAC;QACvB,MAAM,EAAE,cAAc,CAAC;QACvB,gFAAgF;QAChF,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;IAEF;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAE9C,0FAA0F;IAC1F,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAExB;;OAEG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;;;;;;OASG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAEvD;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;KAC9B,KAAK,cAAc,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;CAC5C;AAED,MAAM,MAAM,yBAAyB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,IAAI;IAC3D,6FAA6F;IAC7F,iBAAiB,EAAE,CAAC,IAAI,EAAE;QACxB,WAAW,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC;QACpD,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;KAC9B,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;CACjC,CAAC;AACF,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,EAAE,0BAA0B,CAAC;IACzC,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,YAAY,CAAC,EAAE,yBAAyB,CAAC;IACzC,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAiB,SAAQ,UAAU,EAAE,SAAS;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAE9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAkB,CAAC,CAAC,GAAG,OAAO;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,CAAC,CAAA;KAAE,GAAG,MAAM,CAAC;IACtC,WAAW,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,CAAC,CAAC;CACvC;AAED,MAAM,MAAM,kBAAkB,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;AAE9D,MAAM,WAAW,uBAAuB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAChE;AAED,MAAM,MAAM,eAAe,CAAC,QAAQ,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IAC/D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,CAAC,EAAE,SAAS,CAAC;CAClB,KAAK,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AAElC,MAAM,WAAW,YAAY,CAC3B,CAAC,SAAS,GAAG,GAAG,GAAG,EAEnB,IAAI,SAAS,cAAc,GAAG,cAAc,EAC5C,IAAI,GAAG,SAAS,EAEhB,IAAI,SAAS,cAAc,GAAG,cAAc,EAC5C,IAAI,GAAG,SAAS,EAEhB,IAAI,SAAS,sBAAsB,GAAG,sBAAsB,EAC5D,IAAI,GAAG,SAAS,EAEhB,IAAI,GAAG,SAAS,EAChB,IAAI,GAAG,SAAS,EAEhB,IAAI,GAAG,SAAS;IAEhB,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,kBAAkB,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD"}
|
|
@@ -2,6 +2,7 @@ import type { TConstValue } from '@venizia/ignis-helpers/common';
|
|
|
2
2
|
export declare class AuthenticateStrategy {
|
|
3
3
|
static readonly BASIC = "basic";
|
|
4
4
|
static readonly JWT = "jwt";
|
|
5
|
+
static readonly SERVICE = "service";
|
|
5
6
|
/** The strategies the FRAMEWORK ships. An application registers its own beyond these. */
|
|
6
7
|
static readonly SCHEME_SET: Set<string>;
|
|
7
8
|
static isValid(input: string): boolean;
|
|
@@ -17,6 +18,7 @@ export type TJOSEStandard = TConstValue<typeof JOSEStandards>;
|
|
|
17
18
|
export declare class Authentication {
|
|
18
19
|
static readonly STRATEGY_BASIC = "basic";
|
|
19
20
|
static readonly STRATEGY_JWT = "jwt";
|
|
21
|
+
static readonly STRATEGY_SERVICE = "service";
|
|
20
22
|
static readonly TYPE_BASIC = "Basic";
|
|
21
23
|
static readonly TYPE_BEARER = "Bearer";
|
|
22
24
|
static readonly AUTHENTICATION_STRATEGY = "authentication.strategy";
|
|
@@ -57,4 +59,28 @@ export declare class JWKSKeyFormats {
|
|
|
57
59
|
static isValid(input: string): boolean;
|
|
58
60
|
}
|
|
59
61
|
export type TJWKSKeyFormat = TConstValue<typeof JWKSKeyFormats>;
|
|
62
|
+
/**
|
|
63
|
+
* Wire-level constants of the service assertion. Fixed rather than configurable: both ends of a
|
|
64
|
+
* call must agree on them, and a knob here would let two services disagree silently.
|
|
65
|
+
*/
|
|
66
|
+
export declare class ServiceAssertion {
|
|
67
|
+
/** Its own header, so the end user's token keeps `Authorization` on the same request. */
|
|
68
|
+
static readonly HEADER = "x-service-assertion";
|
|
69
|
+
/** The JWS `typ`. What stops a user token being replayed as an assertion when one JWKS serves both. */
|
|
70
|
+
static readonly TYP = "svc+jwt";
|
|
71
|
+
static readonly ALGORITHM = "EdDSA";
|
|
72
|
+
static readonly DEFAULT_REST_PATH = "/svc-certs";
|
|
73
|
+
/** How long a minted assertion stays valid. */
|
|
74
|
+
static readonly DEFAULT_SIGN_LIFETIME_SECONDS = 60;
|
|
75
|
+
/** The oldest assertion a callee accepts, measured from `iat`. Its own decision, not the caller's. */
|
|
76
|
+
static readonly DEFAULT_ACCEPT_MAX_AGE_SECONDS = 60;
|
|
77
|
+
static readonly DEFAULT_CLOCK_TOLERANCE_SECONDS = 5;
|
|
78
|
+
/** Resolves the accepted age for one caller: its own override, then the service default. */
|
|
79
|
+
static resolveAcceptMaxAge(opts: {
|
|
80
|
+
callerOverride?: number;
|
|
81
|
+
serviceDefault?: number;
|
|
82
|
+
}): number;
|
|
83
|
+
static readonly DEFAULT_JWKS_CACHE_MAX_AGE_MS: number;
|
|
84
|
+
static readonly DEFAULT_JWKS_COOLDOWN_MS: number;
|
|
85
|
+
}
|
|
60
86
|
//# sourceMappingURL=constants.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/constants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;
|
|
1
|
+
{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/constants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAC5B,MAAM,CAAC,QAAQ,CAAC,OAAO,aAAa;IAEpC,yFAAyF;IACzF,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAiD;IAE3E,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAID,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,oBAAoB,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAErF,qBAAa,aAAa;IACxB,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAC5B,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAE9B,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAkC;IAE5D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,aAAa,CAAC,CAAC;AAE9D,qBAAa,cAAc;IAEzB,MAAM,CAAC,QAAQ,CAAC,cAAc,WAA8B;IAC5D,MAAM,CAAC,QAAQ,CAAC,YAAY,SAA4B;IACxD,MAAM,CAAC,QAAQ,CAAC,gBAAgB,aAAgC;IAGhE,MAAM,CAAC,QAAQ,CAAC,UAAU,WAAW;IACrC,MAAM,CAAC,QAAQ,CAAC,WAAW,YAAY;IAEvC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,6BAA6B;IACpE,MAAM,CAAC,QAAQ,CAAC,mBAAmB,yBAAyB;IAE5D,MAAM,CAAC,QAAQ,CAAC,YAAY,uBAAuB;IACnD,MAAM,CAAC,QAAQ,CAAC,aAAa,mBAAmB;CACjD;AAED,qBAAa,wBAAwB;IACnC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,4BAA4B;IACnE,MAAM,CAAC,QAAQ,CAAC,iBAAiB,sBAAsB;IACvD,MAAM,CAAC,QAAQ,CAAC,kBAAkB,uBAAuB;CAC1D;AAED,qBAAa,mBAAmB;IAC9B,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAC5B,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAE5B,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAiC;IAE3D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,qBAAa,SAAS;IACpB,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,QAAQ,cAAc;IAEtC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAyC;IAEnE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,SAAS,CAAC,CAAC;AAEtD,qBAAa,cAAc;IACzB,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAE9B,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAmC;IAE7D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,cAAc,CAAC,CAAC;AAEhE,qBAAa,cAAc;IACzB,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAC5B,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAE5B,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAiC;IAE3D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,cAAc,CAAC,CAAC;AAEhE;;;GAGG;AACH,qBAAa,gBAAgB;IAC3B,yFAAyF;IACzF,MAAM,CAAC,QAAQ,CAAC,MAAM,yBAAyB;IAE/C,uGAAuG;IACvG,MAAM,CAAC,QAAQ,CAAC,GAAG,aAAa;IAEhC,MAAM,CAAC,QAAQ,CAAC,SAAS,WAAW;IAEpC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,gBAAgB;IACjD,+CAA+C;IAC/C,MAAM,CAAC,QAAQ,CAAC,6BAA6B,MAAM;IAEnD,sGAAsG;IACtG,MAAM,CAAC,QAAQ,CAAC,8BAA8B,MAAM;IACpD,MAAM,CAAC,QAAQ,CAAC,+BAA+B,KAAK;IAEpD,4FAA4F;IAC5F,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM;IAM9F,MAAM,CAAC,QAAQ,CAAC,6BAA6B,SAAkB;IAC/D,MAAM,CAAC,QAAQ,CAAC,wBAAwB,SAAa;CACtD"}
|
|
@@ -1,8 +1,9 @@
|
|
|
1
1
|
export class AuthenticateStrategy {
|
|
2
2
|
static { this.BASIC = 'basic'; }
|
|
3
3
|
static { this.JWT = 'jwt'; }
|
|
4
|
+
static { this.SERVICE = 'service'; }
|
|
4
5
|
/** The strategies the FRAMEWORK ships. An application registers its own beyond these. */
|
|
5
|
-
static { this.SCHEME_SET = new Set([this.BASIC, this.JWT]); }
|
|
6
|
+
static { this.SCHEME_SET = new Set([this.BASIC, this.JWT, this.SERVICE]); }
|
|
6
7
|
static isValid(input) {
|
|
7
8
|
return this.SCHEME_SET.has(input);
|
|
8
9
|
}
|
|
@@ -19,6 +20,7 @@ export class Authentication {
|
|
|
19
20
|
// Strategy
|
|
20
21
|
static { this.STRATEGY_BASIC = AuthenticateStrategy.BASIC; }
|
|
21
22
|
static { this.STRATEGY_JWT = AuthenticateStrategy.JWT; }
|
|
23
|
+
static { this.STRATEGY_SERVICE = AuthenticateStrategy.SERVICE; }
|
|
22
24
|
// Token type
|
|
23
25
|
static { this.TYPE_BASIC = 'Basic'; }
|
|
24
26
|
static { this.TYPE_BEARER = 'Bearer'; }
|
|
@@ -64,4 +66,27 @@ export class JWKSKeyFormats {
|
|
|
64
66
|
return this.SCHEME_SET.has(input);
|
|
65
67
|
}
|
|
66
68
|
}
|
|
69
|
+
/**
|
|
70
|
+
* Wire-level constants of the service assertion. Fixed rather than configurable: both ends of a
|
|
71
|
+
* call must agree on them, and a knob here would let two services disagree silently.
|
|
72
|
+
*/
|
|
73
|
+
export class ServiceAssertion {
|
|
74
|
+
/** Its own header, so the end user's token keeps `Authorization` on the same request. */
|
|
75
|
+
static { this.HEADER = 'x-service-assertion'; }
|
|
76
|
+
/** The JWS `typ`. What stops a user token being replayed as an assertion when one JWKS serves both. */
|
|
77
|
+
static { this.TYP = 'svc+jwt'; }
|
|
78
|
+
static { this.ALGORITHM = 'EdDSA'; }
|
|
79
|
+
static { this.DEFAULT_REST_PATH = '/svc-certs'; }
|
|
80
|
+
/** How long a minted assertion stays valid. */
|
|
81
|
+
static { this.DEFAULT_SIGN_LIFETIME_SECONDS = 60; }
|
|
82
|
+
/** The oldest assertion a callee accepts, measured from `iat`. Its own decision, not the caller's. */
|
|
83
|
+
static { this.DEFAULT_ACCEPT_MAX_AGE_SECONDS = 60; }
|
|
84
|
+
static { this.DEFAULT_CLOCK_TOLERANCE_SECONDS = 5; }
|
|
85
|
+
/** Resolves the accepted age for one caller: its own override, then the service default. */
|
|
86
|
+
static resolveAcceptMaxAge(opts) {
|
|
87
|
+
return (opts.callerOverride ?? opts.serviceDefault ?? ServiceAssertion.DEFAULT_ACCEPT_MAX_AGE_SECONDS);
|
|
88
|
+
}
|
|
89
|
+
static { this.DEFAULT_JWKS_CACHE_MAX_AGE_MS = 10 * 60 * 1000; }
|
|
90
|
+
static { this.DEFAULT_JWKS_COOLDOWN_MS = 30 * 1000; }
|
|
91
|
+
}
|
|
67
92
|
//# sourceMappingURL=constants.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/constants.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,oBAAoB;aACf,UAAK,GAAG,OAAO,CAAC;aAChB,QAAG,GAAG,KAAK,CAAC;
|
|
1
|
+
{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/constants.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,oBAAoB;aACf,UAAK,GAAG,OAAO,CAAC;aAChB,QAAG,GAAG,KAAK,CAAC;aACZ,YAAO,GAAG,SAAS,CAAC;IAEpC,yFAAyF;aACzE,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3E,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAOH,MAAM,OAAO,aAAa;aACR,QAAG,GAAG,KAAK,CAAC;aACZ,SAAI,GAAG,MAAM,CAAC;aAEd,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAKH,MAAM,OAAO,cAAc;IACzB,WAAW;aACK,mBAAc,GAAG,oBAAoB,CAAC,KAAK,CAAC;aAC5C,iBAAY,GAAG,oBAAoB,CAAC,GAAG,CAAC;aACxC,qBAAgB,GAAG,oBAAoB,CAAC,OAAO,CAAC;IAEhE,aAAa;aACG,eAAU,GAAG,OAAO,CAAC;aACrB,gBAAW,GAAG,QAAQ,CAAC;aAEvB,4BAAuB,GAAG,yBAAyB,CAAC;aACpD,wBAAmB,GAAG,qBAAqB,CAAC;aAE5C,iBAAY,GAAG,mBAAmB,CAAC;aACnC,kBAAa,GAAG,eAAe,CAAC;;AAGlD,MAAM,OAAO,wBAAwB;aACnB,4BAAuB,GAAG,wBAAwB,CAAC;aACnD,sBAAiB,GAAG,kBAAkB,CAAC;aACvC,uBAAkB,GAAG,mBAAmB,CAAC;;AAG3D,MAAM,OAAO,mBAAmB;aACd,QAAG,GAAG,KAAK,CAAC;aACZ,QAAG,GAAG,KAAK,CAAC;aAEZ,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAKH,MAAM,OAAO,SAAS;aACJ,WAAM,GAAG,QAAQ,CAAC;aAClB,aAAQ,GAAG,UAAU,CAAC;aAEtB,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEnE,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAKH,MAAM,OAAO,cAAc;aACT,SAAI,GAAG,MAAM,CAAC;aACd,SAAI,GAAG,MAAM,CAAC;aAEd,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAE7D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAKH,MAAM,OAAO,cAAc;aACT,QAAG,GAAG,KAAK,CAAC;aACZ,QAAG,GAAG,KAAK,CAAC;aAEZ,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAKH;;;GAGG;AACH,MAAM,OAAO,gBAAgB;IAC3B,yFAAyF;aACzE,WAAM,GAAG,qBAAqB,CAAC;IAE/C,uGAAuG;aACvF,QAAG,GAAG,SAAS,CAAC;aAEhB,cAAS,GAAG,OAAO,CAAC;aAEpB,sBAAiB,GAAG,YAAY,CAAC;IACjD,+CAA+C;aAC/B,kCAA6B,GAAG,EAAE,CAAC;IAEnD,sGAAsG;aACtF,mCAA8B,GAAG,EAAE,CAAC;aACpC,oCAA+B,GAAG,CAAC,CAAC;IAEpD,4FAA4F;IAC5F,MAAM,CAAC,mBAAmB,CAAC,IAA0D;QACnF,OAAO,CACL,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,IAAI,gBAAgB,CAAC,8BAA8B,CAC9F,CAAC;IACJ,CAAC;aAEe,kCAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;aAC/C,6BAAwB,GAAG,EAAE,GAAG,IAAI,CAAC"}
|
|
@@ -82,8 +82,47 @@ export declare const AuthenticationErrors: {
|
|
|
82
82
|
readonly statusCode: 401;
|
|
83
83
|
readonly category: "auth";
|
|
84
84
|
};
|
|
85
|
+
readonly ASSERTION_MISSING: {
|
|
86
|
+
readonly message: {
|
|
87
|
+
readonly text: "Missing service assertion";
|
|
88
|
+
readonly code: "core.authentication.service.assertion_missing";
|
|
89
|
+
};
|
|
90
|
+
readonly statusCode: 401;
|
|
91
|
+
readonly category: "auth";
|
|
92
|
+
};
|
|
93
|
+
readonly ASSERTION_INVALID: {
|
|
94
|
+
readonly message: {
|
|
95
|
+
readonly text: "Invalid service assertion";
|
|
96
|
+
readonly code: "core.authentication.service.assertion_invalid";
|
|
97
|
+
};
|
|
98
|
+
readonly statusCode: 401;
|
|
99
|
+
readonly category: "auth";
|
|
100
|
+
};
|
|
101
|
+
readonly CALLER_NOT_ALLOWED: {
|
|
102
|
+
readonly message: {
|
|
103
|
+
readonly text: "Service caller is not allowed";
|
|
104
|
+
readonly code: "core.authentication.service.caller_not_allowed";
|
|
105
|
+
};
|
|
106
|
+
readonly statusCode: 401;
|
|
107
|
+
readonly category: "auth";
|
|
108
|
+
};
|
|
109
|
+
readonly REQUEST_BINDING_MISMATCH: {
|
|
110
|
+
readonly message: {
|
|
111
|
+
readonly text: "Service assertion does not match this request";
|
|
112
|
+
readonly code: "core.authentication.service.request_binding_mismatch";
|
|
113
|
+
};
|
|
114
|
+
readonly statusCode: 401;
|
|
115
|
+
readonly category: "auth";
|
|
116
|
+
};
|
|
117
|
+
readonly PRINCIPAL_UNRESOLVED: {
|
|
118
|
+
readonly message: {
|
|
119
|
+
readonly text: "Service caller resolved to no principal";
|
|
120
|
+
readonly code: "core.authentication.service.principal_unresolved";
|
|
121
|
+
};
|
|
122
|
+
readonly statusCode: 401;
|
|
123
|
+
readonly category: "auth";
|
|
124
|
+
};
|
|
85
125
|
};
|
|
86
|
-
/** Registers these codes with the shared key registry so a consumer gets autocomplete on `messageCode`. Augments the `/core` subpath, not the root barrel - kernel never imports the bare package, so nothing else in this program would make the root specifier resolvable for the merge. */
|
|
87
126
|
declare module '@venizia/ignis-helpers/core' {
|
|
88
127
|
interface IErrorKeyRegistry extends TRegisterErrors<typeof AuthenticationErrors> {
|
|
89
128
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/errors.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/errors.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAoB,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAGrF,kJAAkJ;AAClJ,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA8B/B,iIAAiI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmF9E,CAAC;AAEtD,OAAO,QAAQ,6BAA6B,CAAC;IAC3C,UAAU,iBAAkB,SAAQ,eAAe,CAAC,OAAO,oBAAoB,CAAC;KAAG;CACpF"}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
|
-
import { ErrorScopes } from '@venizia/ignis-helpers/core';
|
|
2
1
|
import { HTTP } from '@venizia/ignis-helpers/common';
|
|
2
|
+
import { ErrorScopes } from '@venizia/ignis-helpers/core';
|
|
3
3
|
/** Codes a client branches on for a failed authentication. A throw site may override `message` for detail; the code and status come from here. */
|
|
4
4
|
export const AuthenticationErrors = {
|
|
5
5
|
HEADER_MISSING: {
|
|
@@ -74,5 +74,45 @@ export const AuthenticationErrors = {
|
|
|
74
74
|
statusCode: HTTP.ResultCodes.RS_4.Unauthorized,
|
|
75
75
|
category: ErrorScopes.AUTH,
|
|
76
76
|
},
|
|
77
|
+
ASSERTION_MISSING: {
|
|
78
|
+
message: {
|
|
79
|
+
text: 'Missing service assertion',
|
|
80
|
+
code: 'core.authentication.service.assertion_missing',
|
|
81
|
+
},
|
|
82
|
+
statusCode: HTTP.ResultCodes.RS_4.Unauthorized,
|
|
83
|
+
category: ErrorScopes.AUTH,
|
|
84
|
+
},
|
|
85
|
+
ASSERTION_INVALID: {
|
|
86
|
+
message: {
|
|
87
|
+
text: 'Invalid service assertion',
|
|
88
|
+
code: 'core.authentication.service.assertion_invalid',
|
|
89
|
+
},
|
|
90
|
+
statusCode: HTTP.ResultCodes.RS_4.Unauthorized,
|
|
91
|
+
category: ErrorScopes.AUTH,
|
|
92
|
+
},
|
|
93
|
+
CALLER_NOT_ALLOWED: {
|
|
94
|
+
message: {
|
|
95
|
+
text: 'Service caller is not allowed',
|
|
96
|
+
code: 'core.authentication.service.caller_not_allowed',
|
|
97
|
+
},
|
|
98
|
+
statusCode: HTTP.ResultCodes.RS_4.Unauthorized,
|
|
99
|
+
category: ErrorScopes.AUTH,
|
|
100
|
+
},
|
|
101
|
+
REQUEST_BINDING_MISMATCH: {
|
|
102
|
+
message: {
|
|
103
|
+
text: 'Service assertion does not match this request',
|
|
104
|
+
code: 'core.authentication.service.request_binding_mismatch',
|
|
105
|
+
},
|
|
106
|
+
statusCode: HTTP.ResultCodes.RS_4.Unauthorized,
|
|
107
|
+
category: ErrorScopes.AUTH,
|
|
108
|
+
},
|
|
109
|
+
PRINCIPAL_UNRESOLVED: {
|
|
110
|
+
message: {
|
|
111
|
+
text: 'Service caller resolved to no principal',
|
|
112
|
+
code: 'core.authentication.service.principal_unresolved',
|
|
113
|
+
},
|
|
114
|
+
statusCode: HTTP.ResultCodes.RS_4.Unauthorized,
|
|
115
|
+
category: ErrorScopes.AUTH,
|
|
116
|
+
},
|
|
77
117
|
};
|
|
78
118
|
//# sourceMappingURL=errors.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/errors.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,+BAA+B,CAAC;AAErD,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAE1D,kJAAkJ;AAClJ,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,cAAc,EAAE;QACd,OAAO,EAAE;YACP,IAAI,EAAE,8BAA8B;YACpC,IAAI,EAAE,oCAAoC;SAC3C;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,cAAc,EAAE;QACd,OAAO,EAAE;YACP,IAAI,EAAE,kCAAkC;YACxC,IAAI,EAAE,oCAAoC;SAC3C;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,gBAAgB,EAAE;QAChB,OAAO,EAAE;YACP,IAAI,EAAE,gCAAgC;YACtC,IAAI,EAAE,sCAAsC;SAC7C;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,aAAa,EAAE;QACb,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,mCAAmC,EAAE;QACrF,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,iIAAiI;IACjI,aAAa,EAAE;QACb,OAAO,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,mCAAmC,EAAE;QACxF,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,qBAAqB,EAAE;QACrB,OAAO,EAAE;YACP,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,2CAA2C;SAClD;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,qBAAqB,EAAE;QACrB,OAAO,EAAE;YACP,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,2CAA2C;SAClD;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,mBAAmB,EAAE;QACnB,OAAO,EAAE;YACP,IAAI,EAAE,8BAA8B;YACpC,IAAI,EAAE,yCAAyC;SAChD;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,MAAM,EAAE;QACN,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,4BAA4B,EAAE;QAC9E,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,eAAe,EAAE;QACf,OAAO,EAAE;YACP,IAAI,EAAE,uCAAuC;YAC7C,IAAI,EAAE,qCAAqC;SAC5C;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,iBAAiB,EAAE;QACjB,OAAO,EAAE;YACP,IAAI,EAAE,2BAA2B;YACjC,IAAI,EAAE,+CAA+C;SACtD;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,iBAAiB,EAAE;QACjB,OAAO,EAAE;YACP,IAAI,EAAE,2BAA2B;YACjC,IAAI,EAAE,+CAA+C;SACtD;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,kBAAkB,EAAE;QAClB,OAAO,EAAE;YACP,IAAI,EAAE,+BAA+B;YACrC,IAAI,EAAE,gDAAgD;SACvD;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,wBAAwB,EAAE;QACxB,OAAO,EAAE;YACP,IAAI,EAAE,+CAA+C;YACrD,IAAI,EAAE,sDAAsD;SAC7D;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,oBAAoB,EAAE;QACpB,OAAO,EAAE;YACP,IAAI,EAAE,yCAAyC;YAC/C,IAAI,EAAE,kDAAkD;SACzD;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;CACkD,CAAC"}
|
|
@@ -3,5 +3,7 @@ export declare class AuthenticateBindingKeys {
|
|
|
3
3
|
static readonly JWT_OPTIONS = "@app/authenticate/jwt-options";
|
|
4
4
|
static readonly JWKS_OPTIONS = "@app/authenticate/jwks-options";
|
|
5
5
|
static readonly BASIC_OPTIONS = "@app/authenticate/basic-options";
|
|
6
|
+
static readonly SERVICE_OPTIONS = "@app/authenticate/service-options";
|
|
7
|
+
static readonly SERVICE_CERTS_PATH = "@app/authenticate/service-certs-path";
|
|
6
8
|
}
|
|
7
9
|
//# sourceMappingURL=keys.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/keys.ts"],"names":[],"mappings":"AAAA,qBAAa,uBAAuB;IAClC,MAAM,CAAC,QAAQ,CAAC,YAAY,oCAAoC;IAChE,MAAM,CAAC,QAAQ,CAAC,WAAW,mCAAmC;IAC9D,MAAM,CAAC,QAAQ,CAAC,YAAY,oCAAoC;IAChE,MAAM,CAAC,QAAQ,CAAC,aAAa,qCAAqC;
|
|
1
|
+
{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/keys.ts"],"names":[],"mappings":"AAAA,qBAAa,uBAAuB;IAClC,MAAM,CAAC,QAAQ,CAAC,YAAY,oCAAoC;IAChE,MAAM,CAAC,QAAQ,CAAC,WAAW,mCAAmC;IAC9D,MAAM,CAAC,QAAQ,CAAC,YAAY,oCAAoC;IAChE,MAAM,CAAC,QAAQ,CAAC,aAAa,qCAAqC;IAClE,MAAM,CAAC,QAAQ,CAAC,eAAe,uCAAuC;IACtE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,0CAA0C;CAC7E"}
|
|
@@ -3,5 +3,7 @@ export class AuthenticateBindingKeys {
|
|
|
3
3
|
static { this.JWT_OPTIONS = '@app/authenticate/jwt-options'; }
|
|
4
4
|
static { this.JWKS_OPTIONS = '@app/authenticate/jwks-options'; }
|
|
5
5
|
static { this.BASIC_OPTIONS = '@app/authenticate/basic-options'; }
|
|
6
|
+
static { this.SERVICE_OPTIONS = '@app/authenticate/service-options'; }
|
|
7
|
+
static { this.SERVICE_CERTS_PATH = '@app/authenticate/service-certs-path'; }
|
|
6
8
|
}
|
|
7
9
|
//# sourceMappingURL=keys.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/keys.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,uBAAuB;aAClB,iBAAY,GAAG,gCAAgC,CAAC;aAChD,gBAAW,GAAG,+BAA+B,CAAC;aAC9C,iBAAY,GAAG,gCAAgC,CAAC;aAChD,kBAAa,GAAG,iCAAiC,CAAC"}
|
|
1
|
+
{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/keys.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,uBAAuB;aAClB,iBAAY,GAAG,gCAAgC,CAAC;aAChD,gBAAW,GAAG,+BAA+B,CAAC;aAC9C,iBAAY,GAAG,gCAAgC,CAAC;aAChD,kBAAa,GAAG,iCAAiC,CAAC;aAClD,oBAAe,GAAG,mCAAmC,CAAC;aACtD,uBAAkB,GAAG,sCAAsC,CAAC"}
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
import type { TContext } from '../../../../base/controllers/common/types.js';
|
|
2
2
|
import type { IdType } from '../../../../base/models/common/types.js';
|
|
3
3
|
import type { TAnyObjectSchema } from '../../../../utilities/schema.utility.js';
|
|
4
|
-
import type { AnyObject, ValueOrPromise } from '@venizia/ignis-helpers/common';
|
|
4
|
+
import type { AnyObject, TNullable, ValueOrPromise } from '@venizia/ignis-helpers/common';
|
|
5
5
|
import type { AESAlgorithmType, IPayloadCipher } from '@venizia/ignis-helpers/core';
|
|
6
6
|
import type { Env } from 'hono';
|
|
7
7
|
import { type MiddlewareHandler } from 'hono';
|
|
@@ -163,6 +163,85 @@ export type TJWTTokenServiceOptions = {
|
|
|
163
163
|
standard: typeof JOSEStandards.JWKS;
|
|
164
164
|
options: TJWKSTokenServiceOptions;
|
|
165
165
|
};
|
|
166
|
+
/**
|
|
167
|
+
* The request binding, following RFC 9449's `htm`/`htu`. A captured assertion cannot be replayed
|
|
168
|
+
* against a different method or path.
|
|
169
|
+
*
|
|
170
|
+
* `htu` is the percent-ENCODED pathname on both ends. Compare it against
|
|
171
|
+
* `new URL(context.req.url).pathname`, never `context.req.path` - Hono hands that one back DECODED,
|
|
172
|
+
* so any route carrying a space or a non-ASCII slug would never match what the caller signed.
|
|
173
|
+
*/
|
|
174
|
+
export interface IServiceAssertionClaims extends JWTPayload {
|
|
175
|
+
htm: string;
|
|
176
|
+
htu: string;
|
|
177
|
+
}
|
|
178
|
+
/**
|
|
179
|
+
* One entry in the caller allowlist: the JWKS url, or that url plus settings for this caller alone.
|
|
180
|
+
*/
|
|
181
|
+
export type TServiceCallerEntry = string | {
|
|
182
|
+
jwksUrl: string;
|
|
183
|
+
/** Widens the accepted age for THIS caller only. Falls back to the service-wide setting. */
|
|
184
|
+
acceptMaxAgeSeconds?: number;
|
|
185
|
+
};
|
|
186
|
+
/** Service-to-service authentication: an Ed25519 assertion per request, verified against the caller's JWKS. */
|
|
187
|
+
export interface IServiceAuthOptions<E extends Env = Env> {
|
|
188
|
+
/** What this service calls itself: the `iss` it stamps, and the `aud` it demands. */
|
|
189
|
+
name: string;
|
|
190
|
+
/**
|
|
191
|
+
* Present only on a service that CALLS OUT. Absent means verify-only, and no certs route is
|
|
192
|
+
* mounted - which is the common case, since most services are called and never call.
|
|
193
|
+
*/
|
|
194
|
+
keys?: {
|
|
195
|
+
driver: TJWKSKeyDriver;
|
|
196
|
+
format: TJWKSKeyFormat;
|
|
197
|
+
/** PEM or JWK by `format`; content for the `text` driver, a path for `file`. */
|
|
198
|
+
private: string;
|
|
199
|
+
public: string;
|
|
200
|
+
kid?: string;
|
|
201
|
+
};
|
|
202
|
+
/**
|
|
203
|
+
* Caller name to its JWKS url. THIS IS ALSO THE ALLOWLIST - a name absent from the map cannot
|
|
204
|
+
* call, and an empty map correctly allows nobody.
|
|
205
|
+
*
|
|
206
|
+
* The bare-string form is the common case. The object form exists to widen the accepted age for
|
|
207
|
+
* ONE caller: a nightly batch may legitimately need more slack than an interactive service, and
|
|
208
|
+
* granting it per caller keeps the concession named and visible in config.
|
|
209
|
+
*/
|
|
210
|
+
callers?: Record<string, TServiceCallerEntry>;
|
|
211
|
+
/** Where the certs route is mounted. Defaults to `ServiceAssertion.DEFAULT_REST_PATH`. */
|
|
212
|
+
rest?: {
|
|
213
|
+
path: string;
|
|
214
|
+
};
|
|
215
|
+
/**
|
|
216
|
+
* How long the assertions this service MINTS stay valid. Only meaningful where `keys` is set.
|
|
217
|
+
*/
|
|
218
|
+
signLifetimeSeconds?: number;
|
|
219
|
+
/**
|
|
220
|
+
* The oldest assertion this service ACCEPTS, measured from `iat`.
|
|
221
|
+
*
|
|
222
|
+
* Deliberately separate from `signLifetimeSeconds`, and deliberately not requestable by the
|
|
223
|
+
* caller. The caller already controls `exp` - it signs the token - so this is the only bound that
|
|
224
|
+
* survives a compromised caller. A per-caller override belongs in {@link callers}, never in the
|
|
225
|
+
* assertion.
|
|
226
|
+
*
|
|
227
|
+
* Composes with `clockToleranceSeconds`: the real acceptance window is the sum of the two.
|
|
228
|
+
*/
|
|
229
|
+
acceptMaxAgeSeconds?: number;
|
|
230
|
+
clockToleranceSeconds?: number;
|
|
231
|
+
jwks?: {
|
|
232
|
+
cacheMaxAgeMs?: number;
|
|
233
|
+
cooldownMs?: number;
|
|
234
|
+
};
|
|
235
|
+
/**
|
|
236
|
+
* WHO a verified assertion acts as. The framework has already proven the caller; this only maps a
|
|
237
|
+
* caller name onto an application principal. Return `null` to refuse a caller the allowlist
|
|
238
|
+
* admits but the application does not recognise.
|
|
239
|
+
*/
|
|
240
|
+
resolvePrincipal: (opts: {
|
|
241
|
+
issuer: string;
|
|
242
|
+
context: TContext<E, string>;
|
|
243
|
+
}) => ValueOrPromise<TNullable<IAuthUser>>;
|
|
244
|
+
}
|
|
166
245
|
export type TBasicTokenServiceOptions<E extends Env = Env> = {
|
|
167
246
|
/** Callback to verify basic auth credentials. Returns IAuthUser if valid, null otherwise. */
|
|
168
247
|
verifyCredentials: (opts: {
|
|
@@ -177,6 +256,7 @@ export interface IAuthenticateOptions {
|
|
|
177
256
|
restOptions?: TAuthenticationRestOptions;
|
|
178
257
|
jwtOptions?: TJWTTokenServiceOptions;
|
|
179
258
|
basicOptions?: TBasicTokenServiceOptions;
|
|
259
|
+
serviceOptions?: IServiceAuthOptions;
|
|
180
260
|
}
|
|
181
261
|
export interface IAuthUser {
|
|
182
262
|
userId: IdType;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC1F,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AACvC,OAAO,KAAK,EAAE,sBAAsB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACpG,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAEvF,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE;YACP,OAAO,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC;YACtC,QAAQ,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC;SACxC,CAAC;QACF,MAAM,CAAC,EAAE;YACP,OAAO,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC;YACtC,QAAQ,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC;SACxC,CAAC;QACF,cAAc,CAAC,EAAE;YACf,OAAO,EAAE;gBAAE,MAAM,CAAC,EAAE,gBAAgB,CAAA;aAAE,CAAC;YACvC,QAAQ,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC;SACxC,CAAC;QACF,YAAY,CAAC,EAAE;YACb,QAAQ,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC;SACxC,CAAC;QACF,kBAAkB,CAAC,EAAE;YACnB,QAAQ,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC;SACxC,CAAC;KACH,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,EAAE,GAAG,CAC1C;IAAE,iBAAiB,CAAC,EAAE,KAAK,GAAG,SAAS,CAAA;CAAE,GACzC;IACE,iBAAiB,EAAE,IAAI,CAAC;IACxB,cAAc,EAAE,yBAAyB,CAAC;CAC3C,CACJ,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,sOAAsO;IACtO,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE7B,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE3B,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,uFAAuF;IACvF,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAEjC,wHAAwH;IACxH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAEtB,kJAAkJ;IAClJ,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAE9B,2IAA2I;IAC3I,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,8HAA8H;AAC9H,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACnC,gHAAgH;IAChH,MAAM,CAAC,EAAE,cAAc,CAAC;IAExB,kFAAkF;IAClF,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAE3B,sGAAsG;IACtG,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAEzD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,SAAS,CAAC,MAAM,CAAC;IAC9B,SAAS,EAAE,cAAc,CAAC;IAC1B,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACxB,IAAI,EAAE;QACJ,MAAM,EAAE,cAAc,CAAC;QACvB,MAAM,EAAE,cAAc,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,GAAG,EAAE,MAAM,CAAC;IACZ,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACnC,gHAAgH;IAChH,MAAM,CAAC,EAAE,cAAc,CAAC;IAExB,kFAAkF;IAClF,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAE3B,sGAAsG;IACtG,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,OAAO,SAAS,CAAC,QAAQ,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACnC,gHAAgH;IAChH,MAAM,CAAC,EAAE,cAAc,CAAC;IAExB,kFAAkF;IAClF,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,MAAM,wBAAwB,GAAG,kBAAkB,GAAG,oBAAoB,CAAC;AAEjF,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,EAAE,OAAO,aAAa,CAAC,GAAG,CAAC;IAAC,OAAO,EAAE,uBAAuB,CAAA;CAAE,GACxE;IAAE,QAAQ,EAAE,OAAO,aAAa,CAAC,IAAI,CAAC;IAAC,OAAO,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAE/E;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAwB,SAAQ,UAAU;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B,MAAM,GACN;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEN,+GAA+G;AAC/G,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG;IACtD,qFAAqF;IACrF,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,IAAI,CAAC,EAAE;QACL,MAAM,EAAE,cAAc,CAAC;QACvB,MAAM,EAAE,cAAc,CAAC;QACvB,gFAAgF;QAChF,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;IAEF;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAE9C,0FAA0F;IAC1F,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAExB;;OAEG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;;;;;;OASG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAEvD;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;KAC9B,KAAK,cAAc,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;CAC5C;AAED,MAAM,MAAM,yBAAyB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,IAAI;IAC3D,6FAA6F;IAC7F,iBAAiB,EAAE,CAAC,IAAI,EAAE;QACxB,WAAW,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC;QACpD,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;KAC9B,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;CACjC,CAAC;AACF,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,EAAE,0BAA0B,CAAC;IACzC,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,YAAY,CAAC,EAAE,yBAAyB,CAAC;IACzC,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAiB,SAAQ,UAAU,EAAE,SAAS;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAE9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAkB,CAAC,CAAC,GAAG,OAAO;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,CAAC,CAAA;KAAE,GAAG,MAAM,CAAC;IACtC,WAAW,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,CAAC,CAAC;CACvC;AAED,MAAM,MAAM,kBAAkB,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;AAE9D,MAAM,WAAW,uBAAuB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAChE;AAED,MAAM,MAAM,eAAe,CAAC,QAAQ,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IAC/D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,CAAC,EAAE,SAAS,CAAC;CAClB,KAAK,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AAElC,MAAM,WAAW,YAAY,CAC3B,CAAC,SAAS,GAAG,GAAG,GAAG,EAEnB,IAAI,SAAS,cAAc,GAAG,cAAc,EAC5C,IAAI,GAAG,SAAS,EAEhB,IAAI,SAAS,cAAc,GAAG,cAAc,EAC5C,IAAI,GAAG,SAAS,EAEhB,IAAI,SAAS,sBAAsB,GAAG,sBAAsB,EAC5D,IAAI,GAAG,SAAS,EAEhB,IAAI,GAAG,SAAS,EAChB,IAAI,GAAG,SAAS,EAEhB,IAAI,GAAG,SAAS;IAEhB,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,kBAAkB,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@venizia/ignis-kernel",
|
|
3
|
-
"version": "0.2.0-
|
|
3
|
+
"version": "0.2.0-3",
|
|
4
4
|
"description": "Browser-pure kernel of the IGNIS framework: dependency injection, lifecycle, REST controllers, repository and datasource abstractions, and the authentication and authorization seams. No node builtin and no server-only peer, so the same kernel serves a Bun server and a browser Worker.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"authentication",
|
|
@@ -80,7 +80,7 @@
|
|
|
80
80
|
},
|
|
81
81
|
"dependencies": {
|
|
82
82
|
"@venizia/ignis-filter": "^0.2.0-1",
|
|
83
|
-
"@venizia/ignis-helpers": "^0.2.0-
|
|
83
|
+
"@venizia/ignis-helpers": "^0.2.0-3",
|
|
84
84
|
"@venizia/ignis-inversion": "^0.2.0-0",
|
|
85
85
|
"lodash": "^4.18.1",
|
|
86
86
|
"reflect-metadata": "^0.2.2",
|