@venizia/ignis 0.2.0-2 → 0.2.0-4

package/dist/components/auth/authenticate/strategies/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/strategies/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iGAAiG;AACjG,wDAAsC;AAEtC,mDAAiC;AACjC,iDAA+B;AAC/B,kDAAgC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/strategies/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iGAAiG;AACjG,wDAAsC;AAEtC,mDAAiC;AACjC,iDAA+B;AAC/B,kDAAgC;AAChC,qDAAmC"}

package/dist/components/auth/authenticate/strategies/service.strategy.d.ts

@@ -0,0 +1,19 @@
+import { BaseHelper } from '@venizia/ignis-helpers/core';
+import type { Env } from 'hono';
+import type { IAuthUser, IAuthenticationStrategy, IServiceAuthOptions, TContext } from '@venizia/ignis-kernel';
+import { ServiceAssertionVerifierService } from '../services/service/verifier.service';
+/**
+ * Proves the CALLING SERVICE, from a per-request Ed25519 assertion verified against that caller's
+ * own JWKS. No identity round trip and no shared password.
+ *
+ * It proves which service called, never which user. `resolvePrincipal` is where the application
+ * turns a caller name into one of its own principals.
+ */
+export declare class ServiceAuthenticationStrategy<E extends Env = Env> extends BaseHelper implements IAuthenticationStrategy<E> {
+    private readonly verifier;
+    private readonly options;
+    name: string;
+    constructor(verifier: ServiceAssertionVerifierService, options: IServiceAuthOptions<E>);
+    authenticate(context: TContext<E, string>): Promise<IAuthUser>;
+}
+//# sourceMappingURL=service.strategy.d.ts.map

package/dist/components/auth/authenticate/strategies/service.strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.strategy.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/strategies/service.strategy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAY,MAAM,6BAA6B,CAAC;AAEnE,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAShC,OAAO,KAAK,EACV,SAAS,EACT,uBAAuB,EACvB,mBAAmB,EACnB,QAAQ,EACT,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AAEvF;;;;;;GAMG;AACH,qBAAa,6BAA6B,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAC5D,SAAQ,UACR,YAAW,uBAAuB,CAAC,CAAC,CAAC;IAWnC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAEzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAX1B,IAAI,SAAmC;gBASpB,QAAQ,EAAE,+BAA+B,EAEzC,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAK5C,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;CA8BrE"}

package/dist/components/auth/authenticate/strategies/service.strategy.js

@@ -0,0 +1,73 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var ServiceAuthenticationStrategy_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceAuthenticationStrategy = void 0;
+const core_1 = require("@venizia/ignis-helpers/core");
+const ignis_inversion_1 = require("@venizia/ignis-inversion");
+const ignis_kernel_1 = require("@venizia/ignis-kernel");
+const verifier_service_1 = require("../services/service/verifier.service");
+/**
+ * Proves the CALLING SERVICE, from a per-request Ed25519 assertion verified against that caller's
+ * own JWKS. No identity round trip and no shared password.
+ *
+ * It proves which service called, never which user. `resolvePrincipal` is where the application
+ * turns a caller name into one of its own principals.
+ */
+let ServiceAuthenticationStrategy = ServiceAuthenticationStrategy_1 = class ServiceAuthenticationStrategy extends core_1.BaseHelper {
+    constructor(verifier, options) {
+        super({ scope: ServiceAuthenticationStrategy_1.name });
+        this.verifier = verifier;
+        this.options = options;
+        this.name = ignis_kernel_1.Authentication.STRATEGY_SERVICE;
+    }
+    async authenticate(context) {
+        const token = context.req.header(ignis_kernel_1.ServiceAssertion.HEADER);
+        if (!token) {
+            throw (0, core_1.getError)({ error: ignis_kernel_1.AuthenticationErrors.ASSERTION_MISSING });
+        }
+        // The raw url, NOT `context.req.path`: Hono hands that back percent-DECODED, so a route carrying
+        // a space or a non-ASCII slug would never match the encoded path the caller signed.
+        const { issuer } = await this.verifier.verify({
+            token,
+            method: context.req.method,
+            path: new URL(context.req.url).pathname,
+        });
+        const principal = await this.options.resolvePrincipal({ issuer, context });
+        // Validated rather than trusted. `executeAnyMode` calls `setCurrentUser` unconditionally, so an
+        // application returning a principal without a `userId` would authenticate the request and then
+        // fail at the first write, far from here. `executeAllMode` already refuses it; this closes the
+        // gap between the two modes.
+        if (!principal?.userId) {
+            this.logger
+                .for(this.authenticate.name)
+                .warn('resolvePrincipal returned no usable principal | iss: %s', issuer);
+            throw (0, core_1.getError)({ error: ignis_kernel_1.AuthenticationErrors.PRINCIPAL_UNRESOLVED });
+        }
+        // Which service called is audit-relevant even when the principal is shared across callers.
+        return { ...principal, callerService: issuer };
+    }
+};
+exports.ServiceAuthenticationStrategy = ServiceAuthenticationStrategy;
+exports.ServiceAuthenticationStrategy = ServiceAuthenticationStrategy = ServiceAuthenticationStrategy_1 = __decorate([
+    __param(0, (0, ignis_kernel_1.inject)({
+        key: ignis_inversion_1.BindingKeys.build({
+            namespace: ignis_kernel_1.BindingNamespaces.SERVICE,
+            key: verifier_service_1.ServiceAssertionVerifierService.name,
+        }),
+    })),
+    __param(1, (0, ignis_kernel_1.inject)({ key: ignis_kernel_1.AuthenticateBindingKeys.SERVICE_OPTIONS })),
+    __metadata("design:paramtypes", [verifier_service_1.ServiceAssertionVerifierService, Object])
+], ServiceAuthenticationStrategy);
+//# sourceMappingURL=service.strategy.js.map

package/dist/components/auth/authenticate/strategies/service.strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.strategy.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/strategies/service.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAmE;AACnE,8DAAuD;AAEvD,wDAO+B;AAO/B,2EAAuF;AAEvF;;;;;;GAMG;AACH,IAAa,6BAA6B,qCAA1C,MAAa,6BACX,SAAQ,iBAAU;IAKlB,YAOE,QAA0D,EAE1D,OAAgD;QAEhD,KAAK,CAAC,EAAE,KAAK,EAAE,+BAA6B,CAAC,IAAI,EAAE,CAAC,CAAC;QAJpC,aAAQ,GAAR,QAAQ,CAAiC;QAEzC,YAAO,GAAP,OAAO,CAAwB;QAXlD,SAAI,GAAG,6BAAc,CAAC,gBAAgB,CAAC;IAcvC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAA4B;QAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,+BAAgB,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,mCAAoB,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,iGAAiG;QACjG,oFAAoF;QACpF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC5C,KAAK;YACL,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;YAC1B,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ;SACxC,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE3E,gGAAgG;QAChG,+FAA+F;QAC/F,+FAA+F;QAC/F,6BAA6B;QAC7B,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;iBAC3B,IAAI,CAAC,yDAAyD,EAAE,MAAM,CAAC,CAAC;YAC3E,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,mCAAoB,CAAC,oBAAoB,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,2FAA2F;QAC3F,OAAO,EAAE,GAAG,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AAlDY,sEAA6B;wCAA7B,6BAA6B;IAOrC,WAAA,IAAA,qBAAM,EAAC;QACN,GAAG,EAAE,6BAAW,CAAC,KAAK,CAAC;YACrB,SAAS,EAAE,gCAAiB,CAAC,OAAO;YACpC,GAAG,EAAE,kDAA+B,CAAC,IAAI;SAC1C,CAAC;KACH,CAAC,CAAA;IAED,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,eAAe,EAAE,CAAC,CAAA;qCAD9B,kDAA+B;GAbjD,6BAA6B,CAkDzC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@venizia/ignis",
-  "version": "0.2.0-2",
+  "version": "0.2.0-4",
   "description": "High-performance TypeScript server infrastructure combining LoopBack 4 enterprise architecture (decorator-based DI, repository pattern, component system) with Hono speed (~140k req/s). Features auto-generated OpenAPI docs, Drizzle ORM type-safe SQL, JWT/Basic authentication, Casbin authorization, convention-based bootstrapping, and pluggable components for health checks, Swagger UI, mail, Socket.IO, and static assets. Built for Bun and Node.js.",
   "keywords": [
     "access-control",
@@ -198,12 +198,12 @@
     "prepublishOnly": "bun run rebuild"
   },
   "dependencies": {
-    "@venizia/ignis-boot": "^0.2.0-1",
-    "@venizia/ignis-connectors": "^0.2.0-2",
+    "@venizia/ignis-boot": "^0.2.0-3",
+    "@venizia/ignis-connectors": "^0.2.0-4",
     "@venizia/ignis-filter": "^0.2.0-1",
-    "@venizia/ignis-helpers": "^0.2.0-2",
+    "@venizia/ignis-helpers": "^0.2.0-4",
     "@venizia/ignis-inversion": "^0.2.0-0",
-    "@venizia/ignis-kernel": "^0.2.0-2",
+    "@venizia/ignis-kernel": "^0.2.0-4",
     "lodash": "^4.18.1",
     "reflect-metadata": "^0.2.2",
     "zod": "^4.4.3"