npm - @venizia/ignis - Versions diffs - 0.3.0 → 0.3.1 - Mend

@venizia/ignis 0.3.0 → 0.3.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (629) hide show

package/dist/components/auth/authenticate/services/bearer/jwks/abstract.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"abstract.service.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/abstract.service.ts"],"names":[],"mappings":";;;AACA,0DAAiE;AAEjE,iLAAiL;AACjL,MAAsB,wBAEpB,SAAQ,6CAA6B;IAFvC;;QAGY,gBAAW,GAAG,KAAK,CAAC;QACpB,gBAAW,GAAyB,IAAI,CAAC;IAgBrD,CAAC;IAdW,KAAK,CAAC,iBAAiB;QAC/B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;YACnD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,WAAW,CAAC;IACzB,CAAC;CAGF;AApBD,4DAoBC"}
1	+ {"version":3,"file":"abstract.service.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/abstract.service.ts"],"names":[],"mappings":";;;AACA,0DAAiE;AAEjE,iLAAiL;AACjL,MAAsB,wBAEpB,SAAQ,6CAA6B;IAFvC;;QAGY,gBAAW,GAAG,KAAK,CAAC;QACpB,gBAAW,GAAyB,IAAI,CAAC;IAgBrD,CAAC;IAdW,KAAK,CAAC,iBAAiB;QAC/B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;YACnD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,WAAW,CAAC;IACzB,CAAC;CAGF;AApBD,4DAoBC","sourcesContent":["import type { Env } from 'hono';\nimport { AbstractBearerTokenService } from '../abstract.service';\n\n/** Base for JWKS token services (Issuer + Verifier): lazy init where a rejected `initialize()` resets `initPromise`, so the next call retries instead of caching the failure. */\nexport abstract class AbstractJWKSTokenService<\n E extends Env = Env,\n> extends AbstractBearerTokenService<E> {\n protected initialized = false;\n protected initPromise: Promise<void> \| null = null;\n\n protected async ensureInitialized(): Promise<void> {\n if (this.initialized) {\n return;\n }\n\n this.initPromise ??= this.initialize().catch(error => {\n this.initPromise = null;\n throw error;\n });\n\n await this.initPromise;\n }\n\n protected abstract initialize(): Promise<void>;\n}\n"]}

package/dist/components/auth/authenticate/services/bearer/jwks/index.d.ts CHANGED Viewed

@@ -1,4 +1,3 @@
 export * from './abstract.service';
 export * from './issuer.service';
 export * from './verifier.service';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authenticate/services/bearer/jwks/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,mDAAiC;AACjC,qDAAmC"}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,mDAAiC;AACjC,qDAAmC","sourcesContent":["export * from './abstract.service';\nexport * from './issuer.service';\nexport * from './verifier.service';\n"]}

package/dist/components/auth/authenticate/services/bearer/jwks/issuer.service.d.ts CHANGED Viewed

@@ -60,4 +60,3 @@ export declare class JWKSIssuerTokenService<E extends Env = Env> extends Abstrac
         keys: JWK[];
     }>;
 }
-//# sourceMappingURL=issuer.service.d.ts.map

package/dist/components/auth/authenticate/services/bearer/jwks/issuer.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"issuer.service.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/issuer.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAA0F;AAC1F,sDAAuD;AACvD,wDAS+B;AAG/B,+CAA4C;AAC5C,mDAA+C;AAC/C,yDAA8D;AAE9D,IAAa,sBAAsB,8BAAnC,MAAa,sBAA4C,SAAQ,2CAA2B;IAK1F,YAEE,OAAqC;QAErC,KAAK,CAAC,EAAE,KAAK,EAAE,wBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC;QAFpC,YAAO,GAAP,OAAO,CAAoB;QAN7B,eAAU,GAAsC,IAAI,CAAC;QACrD,cAAS,GAAsC,IAAI,CAAC;QACpD,SAAI,GAA2B,IAAI,CAAC;QAQ5C,IAAI,CAAC,0BAA0B,CAAC;YAC9B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACrC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YAC3B,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;SACxB,CAAC,CAAC;IACL,CAAC;IAEkB,KAAK,CAAC,UAAU;QACjC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAEzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC;QAE3B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAU,CAAC,CAAC;QAEnD,8FAA8F;QAC9F,+FAA+F;QAC/F,uEAAuE;QACvE,IAAI,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QAEzC,SAAS,CAAC,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QACjC,SAAS,CAAC,GAAG,GAAG,SAAS,CAAC;QAC1B,SAAS,CAAC,GAAG,GAAG,KAAK,CAAC;QAEtB,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;QAElC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAExB,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;aACzB,IAAI,CACH,6DAA6D,EAC7D,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,OAAO,CAAC,GAAG,CACjB,CAAC;IACN,CAAC;IAES,KAAK,CAAC,iBAAiB,CAAC,IAA0C;QAC1E,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAEtB,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,6BAAc,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzB,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBACpC,IAAA,mBAAQ,EAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;oBAC/B,IAAA,mBAAQ,EAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC;iBAC/B,CAAC,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACvB,CAAC;YACD,KAAK,6BAAc,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzB,OAAO;oBACL,IAAI,EAAE,IAAI,CAAC,OAAO;oBAClB,GAAG,EAAE,IAAI,CAAC,MAAM;iBACjB,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,IAAA,eAAQ,EAAC;oBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;oBACrD,OAAO,EAAE,gDAAgD,IAAI,CAAC,MAAM,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACO,eAAe,CAAC,IAAkB;QAC1C,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAU,CAAC;QAExE,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC;QACjF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QAED,MAAM,IAAA,eAAQ,EAAC;YACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,6EAA6E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,4FAA4F;SACrM,CAAC,CAAC;IACL,CAAC;IAES,KAAK,CAAC,gBAAgB,CAAC,IAIhC;QACC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAEtC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,gDAAgD;aAC1D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YACb,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,+CAA+C;aACzD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAEvE,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,6BAAc,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACpD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBACjD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACvB,CAAC;YACD,KAAK,6BAAc,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG;wBACb,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAQ;wBACjC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAQ;qBAChC,CAAC;oBAEF,IAAI,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;oBAE1C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBACrD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBACnD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;gBACvB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM;yBACR,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;yBAC/B,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;oBACxD,MAAM,IAAA,eAAQ,EAAC;wBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;wBACrD,OAAO,EAAE,mDAAmD;qBAC7D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,IAAA,eAAQ,EAAC;oBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;oBACrD,OAAO,EAAE,gDAAgD,IAAI,CAAC,MAAM,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAEkB,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC7C,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAmB,KAAK,EAAE,IAAI,CAAC,SAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,IAIxB;QACC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAE5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;aAChD,kBAAkB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;aAC1E,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,GAAG,SAAS,CAAC;aAClC,YAAY,CAAC,GAAG,CAAC,CAAC;QAErB,OAAO,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC;IAEkB,aAAa;QAC9B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEkB,wBAAwB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACxC,CAAC;IAED,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,iFAAiF;aAC3F,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,IAAK,CAAC;IACpB,CAAC;CACF,CAAA;AAhOY,wDAAsB;iCAAtB,sBAAsB;IAM9B,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,YAAY,EAAE,CAAC,CAAA;;GAN7C,sBAAsB,CAgOlC"}
1	+ {"version":3,"file":"issuer.service.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/issuer.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAA0F;AAC1F,sDAAuD;AACvD,wDAS+B;AAG/B,+CAA4C;AAC5C,mDAA+C;AAC/C,yDAA8D;AAE9D,IAAa,sBAAsB,8BAAnC,MAAa,sBAA4C,SAAQ,2CAA2B;IAK1F,YAEE,OAAqC;QAErC,KAAK,CAAC,EAAE,KAAK,EAAE,wBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC;QAFpC,YAAO,GAAP,OAAO,CAAoB;QAN7B,eAAU,GAAsC,IAAI,CAAC;QACrD,cAAS,GAAsC,IAAI,CAAC;QACpD,SAAI,GAA2B,IAAI,CAAC;QAQ5C,IAAI,CAAC,0BAA0B,CAAC;YAC9B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACrC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YAC3B,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;SACxB,CAAC,CAAC;IACL,CAAC;IAEkB,KAAK,CAAC,UAAU;QACjC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAEzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC;QAE3B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAU,CAAC,CAAC;QAEnD,8FAA8F;QAC9F,+FAA+F;QAC/F,uEAAuE;QACvE,IAAI,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QAEzC,SAAS,CAAC,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QACjC,SAAS,CAAC,GAAG,GAAG,SAAS,CAAC;QAC1B,SAAS,CAAC,GAAG,GAAG,KAAK,CAAC;QAEtB,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;QAElC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAExB,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;aACzB,IAAI,CACH,6DAA6D,EAC7D,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,OAAO,CAAC,GAAG,CACjB,CAAC;IACN,CAAC;IAES,KAAK,CAAC,iBAAiB,CAAC,IAA0C;QAC1E,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAEtB,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,6BAAc,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzB,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBACpC,IAAA,mBAAQ,EAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;oBAC/B,IAAA,mBAAQ,EAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC;iBAC/B,CAAC,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACvB,CAAC;YACD,KAAK,6BAAc,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzB,OAAO;oBACL,IAAI,EAAE,IAAI,CAAC,OAAO;oBAClB,GAAG,EAAE,IAAI,CAAC,MAAM;iBACjB,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,IAAA,eAAQ,EAAC;oBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;oBACrD,OAAO,EAAE,gDAAgD,IAAI,CAAC,MAAM,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACO,eAAe,CAAC,IAAkB;QAC1C,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAU,CAAC;QAExE,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC;QACjF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QAED,MAAM,IAAA,eAAQ,EAAC;YACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,6EAA6E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,4FAA4F;SACrM,CAAC,CAAC;IACL,CAAC;IAES,KAAK,CAAC,gBAAgB,CAAC,IAIhC;QACC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAEtC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,gDAAgD;aAC1D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YACb,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,+CAA+C;aACzD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAEvE,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,6BAAc,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACpD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBACjD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACvB,CAAC;YACD,KAAK,6BAAc,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG;wBACb,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAQ;wBACjC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAQ;qBAChC,CAAC;oBAEF,IAAI,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;oBAE1C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBACrD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBACnD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;gBACvB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM;yBACR,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;yBAC/B,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;oBACxD,MAAM,IAAA,eAAQ,EAAC;wBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;wBACrD,OAAO,EAAE,mDAAmD;qBAC7D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,IAAA,eAAQ,EAAC;oBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;oBACrD,OAAO,EAAE,gDAAgD,IAAI,CAAC,MAAM,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAEkB,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC7C,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAmB,KAAK,EAAE,IAAI,CAAC,SAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,IAIxB;QACC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAE5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;aAChD,kBAAkB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;aAC1E,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,GAAG,SAAS,CAAC;aAClC,YAAY,CAAC,GAAG,CAAC,CAAC;QAErB,OAAO,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC;IAEkB,aAAa;QAC9B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEkB,wBAAwB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACxC,CAAC;IAED,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,iFAAiF;aAC3F,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,IAAK,CAAC;IACpB,CAAC;CACF,CAAA;AAhOY,wDAAsB;iCAAtB,sBAAsB;IAM9B,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,YAAY,EAAE,CAAC,CAAA;;GAN7C,sBAAsB,CAgOlC","sourcesContent":["import { HTTP, type TNullable, type ValueOrPromise } from '@venizia/ignis-helpers/common';\nimport { getError } from '@venizia/ignis-helpers/core';\nimport {\n AuthenticateBindingKeys,\n type IJWKSIssuerOptions,\n type IJWTIssueClaims,\n type IJWTTokenPayload,\n inject,\n JWKSKeyDrivers,\n JWKSKeyFormats,\n type TGetTokenExpiresFn,\n} from '@venizia/ignis-kernel';\nimport { type Env } from 'hono';\nimport type { CryptoKey, JWK } from 'jose';\nimport { readFile } from 'node:fs/promises';\nimport { JoseLoader } from '../../jose-loader';\nimport { AbstractJWKSTokenService } from './abstract.service';\n\nexport class JWKSIssuerTokenService<E extends Env = Env> extends AbstractJWKSTokenService<E> {\n protected privateKey: TNullable<CryptoKey \| Uint8Array> = null;\n protected publicKey: TNullable<CryptoKey \| Uint8Array> = null;\n protected jwks: { keys: JWK[] } \| null = null;\n\n constructor(\n @inject({ key: AuthenticateBindingKeys.JWKS_OPTIONS })\n protected options: IJWKSIssuerOptions,\n ) {\n super({ scope: JWKSIssuerTokenService.name });\n\n this.configurePayloadEncryption({\n aesAlgorithm: this.options.aesAlgorithm,\n applicationSecret: this.options.applicationSecret,\n fieldCodecs: this.options.fieldCodecs,\n cipher: this.options.cipher,\n sign: this.options.sign,\n });\n }\n\n protected override async initialize(): Promise<void> {\n const { keys, algorithm } = this.options;\n\n const raw = await this.resolveKeyContent({ keys });\n const built = await this.parseKeyMaterial({ raw, algorithm, keys });\n\n this.privateKey = built.priv;\n this.publicKey = built.pub;\n\n const { exportJWK } = await JoseLoader.load();\n const publicJWK = await exportJWK(this.publicKey!);\n\n // Belt and braces. `assertPublicJWK` already refused a private JWK on the way IN, but this is\n // the exact object an unauthenticated `/certs` serves - the last place to notice a signing key\n // about to be published, whatever route the material took to get here.\n this.assertPublicJWK({ jwk: publicJWK });\n\n publicJWK.kid = this.options.kid;\n publicJWK.alg = algorithm;\n publicJWK.use = 'sig';\n\n this.jwks = { keys: [publicJWK] };\n\n this.initialized = true;\n\n this.logger\n .for(this.initialize.name)\n .info(\n 'JWKS issuer initialized \| driver: %s \| format: %s \| kid: %s',\n keys.driver,\n keys.format,\n this.options.kid,\n );\n }\n\n protected async resolveKeyContent(opts: { keys: IJWKSIssuerOptions['keys'] }) {\n const { keys } = opts;\n\n switch (keys.driver) {\n case JWKSKeyDrivers.FILE: {\n const [priv, pub] = await Promise.all([\n readFile(keys.private, 'utf-8'),\n readFile(keys.public, 'utf-8'),\n ]);\n return { priv, pub };\n }\n case JWKSKeyDrivers.TEXT: {\n return {\n priv: keys.private,\n pub: keys.public,\n };\n }\n default: {\n throw getError({\n statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n message: `[JWKSIssuerTokenService] Unknown key driver: ${keys.driver}`,\n });\n }\n }\n }\n\n /*\n Refuses a JWK carrying private material where a PUBLIC key is expected.\n \n The `pem` format cannot reach this state - `importSPKI` rejects a private PEM outright. The\n * `jwk` format can: `importJWK` imports whatever it is handed, and a private JWK marked\n * `\"ext\": true` yields an EXTRACTABLE key, so `exportJWK` then carries `d` straight into the\n * document `/certs` serves without authentication. Measured on jose 6.2.3: with `ext: true` the\n * round trip returns `d`; without it, export throws. So the only thing standing between a\n * mis-pasted key and a published signing key was an optional flag on attacker-irrelevant input.\n \n Named members, not a blanket scan: `d` covers EC/OKP and RSA's private exponent, and the CRT\n * members are the rest of an RSA private key.\n */\n protected assertPublicJWK(opts: { jwk: JWK }): void {\n const PRIVATE_MEMBERS = ['d', 'p', 'q', 'dp', 'dq', 'qi', 'k'] as const;\n\n const present = PRIVATE_MEMBERS.filter(member => opts.jwk[member] !== undefined);\n if (present.length === 0) {\n return;\n }\n\n throw getError({\n statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n message: `[JWKSIssuerTokenService] The public key material carries PRIVATE members (${present.join(', ')}) \| this key would be published at the JWKS endpoint \| pass the public half in keys.public`,\n });\n }\n\n protected async parseKeyMaterial(opts: {\n raw: { priv: string; pub: string };\n algorithm: IJWKSIssuerOptions['algorithm'];\n keys: IJWKSIssuerOptions['keys'];\n }) {\n const { raw, algorithm, keys } = opts;\n\n if (!raw.priv) {\n throw getError({\n statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n message: '[JWKSIssuerTokenService] Invalid raw.priv key!',\n });\n }\n\n if (!raw.pub) {\n throw getError({\n statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n message: '[JWKSIssuerTokenService] Invalid raw.pub key!',\n });\n }\n\n const { importJWK, importPKCS8, importSPKI } = await JoseLoader.load();\n\n switch (keys.format) {\n case JWKSKeyFormats.PEM: {\n const priv = await importPKCS8(raw.priv, algorithm);\n const pub = await importSPKI(raw.pub, algorithm);\n return { priv, pub };\n }\n case JWKSKeyFormats.JWK: {\n try {\n const parsed = {\n priv: JSON.parse(raw.priv) as JWK,\n pub: JSON.parse(raw.pub) as JWK,\n };\n\n this.assertPublicJWK({ jwk: parsed.pub });\n\n const priv = await importJWK(parsed.priv, algorithm);\n const pub = await importJWK(parsed.pub, algorithm);\n return { priv, pub };\n } catch (error) {\n this.logger\n .for(this.parseKeyMaterial.name)\n .error('Invalid JWK key material \| Error: %s', error);\n throw getError({\n statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n message: '[JWKSIssuerTokenService] Invalid JWK key material',\n });\n }\n }\n default: {\n throw getError({\n statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n message: `[JWKSIssuerTokenService] Unknown key format: ${keys.format}`,\n });\n }\n }\n }\n\n protected override async doVerify(token: string): Promise<IJWTTokenPayload> {\n await this.ensureInitialized();\n const { jwtVerify } = await JoseLoader.load();\n const result = await jwtVerify<IJWTTokenPayload>(token, this.publicKey!, this.options.verify);\n return this.decryptPayload({ result });\n }\n\n override async getSigner(opts: {\n payload: IJWTTokenPayload;\n getTokenExpiresFn: TGetTokenExpiresFn;\n claims?: IJWTIssueClaims;\n }) {\n await this.ensureInitialized();\n const { SignJWT } = await JoseLoader.load();\n\n const now = Math.floor(Date.now() / 1000);\n const expiresIn = await opts.getTokenExpiresFn();\n\n const encryptedPayload = this.encryptPayload(opts.payload);\n\n const signer = new SignJWT({ ...encryptedPayload })\n .setProtectedHeader({ alg: this.options.algorithm, kid: this.options.kid })\n .setIssuedAt()\n .setExpirationTime(now + expiresIn)\n .setNotBefore(now);\n\n return this.applySignClaims({ signer, payload: encryptedPayload, claims: opts.claims });\n }\n\n protected override getSigningKey(): ValueOrPromise<Uint8Array \| CryptoKey> {\n if (!this.privateKey) {\n throw getError({ message: '[getSigningKey] Invalid privateKey!' });\n }\n\n return this.privateKey;\n }\n\n protected override getDefaultTokenExpiresFn(): TGetTokenExpiresFn {\n return this.options.getTokenExpiresFn;\n }\n\n getJWKS(): { keys: JWK[] } {\n if (!this.jwks) {\n throw getError({\n statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n message: '[JWKSIssuerTokenService] JWKS not initialized yet. Call getJWKSAsync() instead.',\n });\n }\n\n return this.jwks;\n }\n\n async getJWKSAsync(): Promise<{ keys: JWK[] }> {\n await this.ensureInitialized();\n return this.jwks!;\n }\n}\n"]}

package/dist/components/auth/authenticate/services/bearer/jwks/verifier.service.d.ts CHANGED Viewed

@@ -15,4 +15,3 @@ export declare class JWKSVerifierTokenService<E extends Env = Env> extends Abstr
     protected getSigningKey(): never;
     protected getDefaultTokenExpiresFn(): never;
 }
-//# sourceMappingURL=verifier.service.d.ts.map

package/dist/components/auth/authenticate/services/bearer/jwks/verifier.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"verifier.service.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/verifier.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAAqD;AACrD,sDAAuD;AACvD,wDAM+B;AAG/B,mDAA+C;AAC/C,yDAA8D;AAE9D,IAAa,wBAAwB,gCAArC,MAAa,wBAA8C,SAAQ,2CAA2B;IAG5F,YAEE,OAAuC;QAEvC,KAAK,CAAC,EAAE,KAAK,EAAE,0BAAwB,CAAC,IAAI,EAAE,CAAC,CAAC;QAFtC,YAAO,GAAP,OAAO,CAAsB;QAJ/B,iBAAY,GAAiD,IAAI,CAAC;QAO1E,IAAI,CAAC,0BAA0B,CAAC;YAC9B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACrC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;SAC5B,CAAC,CAAC;IACL,CAAC;IAEkB,KAAK,CAAC,UAAU;QACjC,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,YAAY,GAAG,kBAAkB,CAAC,OAAO,EAAE;YAC9C,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,UAAU;YAClD,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,MAAM;SACpD,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAExB,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;aACzB,IAAI,CAAC,qCAAqC,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,CAAC;IAEkB,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC7C,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,SAAS,CAC5B,KAAK,EACL,IAAI,CAAC,YAAa,EAClB,IAAI,CAAC,OAAO,CAAC,MAAM,CACpB,CAAC;QACF,OAAO,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,KAGxB;QACC,MAAM,IAAA,eAAQ,EAAC;YACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,6DAA6D;SACvE,CAAC,CAAC;IACL,CAAC;IAEkB,aAAa;QAC9B,MAAM,IAAA,eAAQ,EAAC;YACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,6DAA6D;SACvE,CAAC,CAAC;IACL,CAAC;IAEkB,wBAAwB;QACzC,MAAM,IAAA,eAAQ,EAAC;YACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,8DAA8D;SACxE,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAjEY,4DAAwB;mCAAxB,wBAAwB;IAIhC,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,YAAY,EAAE,CAAC,CAAA;;GAJ7C,wBAAwB,CAiEpC"}
1	+ {"version":3,"file":"verifier.service.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/verifier.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAAqD;AACrD,sDAAuD;AACvD,wDAM+B;AAG/B,mDAA+C;AAC/C,yDAA8D;AAE9D,IAAa,wBAAwB,gCAArC,MAAa,wBAA8C,SAAQ,2CAA2B;IAG5F,YAEE,OAAuC;QAEvC,KAAK,CAAC,EAAE,KAAK,EAAE,0BAAwB,CAAC,IAAI,EAAE,CAAC,CAAC;QAFtC,YAAO,GAAP,OAAO,CAAsB;QAJ/B,iBAAY,GAAiD,IAAI,CAAC;QAO1E,IAAI,CAAC,0BAA0B,CAAC;YAC9B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACrC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;SAC5B,CAAC,CAAC;IACL,CAAC;IAEkB,KAAK,CAAC,UAAU;QACjC,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,YAAY,GAAG,kBAAkB,CAAC,OAAO,EAAE;YAC9C,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,UAAU;YAClD,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,MAAM;SACpD,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAExB,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;aACzB,IAAI,CAAC,qCAAqC,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,CAAC;IAEkB,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC7C,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,SAAS,CAC5B,KAAK,EACL,IAAI,CAAC,YAAa,EAClB,IAAI,CAAC,OAAO,CAAC,MAAM,CACpB,CAAC;QACF,OAAO,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,KAGxB;QACC,MAAM,IAAA,eAAQ,EAAC;YACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,6DAA6D;SACvE,CAAC,CAAC;IACL,CAAC;IAEkB,aAAa;QAC9B,MAAM,IAAA,eAAQ,EAAC;YACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,6DAA6D;SACvE,CAAC,CAAC;IACL,CAAC;IAEkB,wBAAwB;QACzC,MAAM,IAAA,eAAQ,EAAC;YACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,8DAA8D;SACxE,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAjEY,4DAAwB;mCAAxB,wBAAwB;IAIhC,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,YAAY,EAAE,CAAC,CAAA;;GAJ7C,wBAAwB,CAiEpC","sourcesContent":["import { HTTP } from '@venizia/ignis-helpers/common';\nimport { getError } from '@venizia/ignis-helpers/core';\nimport {\n AuthenticateBindingKeys,\n type IJWKSVerifierOptions,\n type IJWTTokenPayload,\n inject,\n type TGetTokenExpiresFn,\n} from '@venizia/ignis-kernel';\nimport { type Env } from 'hono';\nimport type { createRemoteJWKSet, SignJWT } from 'jose';\nimport { JoseLoader } from '../../jose-loader';\nimport { AbstractJWKSTokenService } from './abstract.service';\n\nexport class JWKSVerifierTokenService<E extends Env = Env> extends AbstractJWKSTokenService<E> {\n protected jwksVerifier: ReturnType<typeof createRemoteJWKSet> \| null = null;\n\n constructor(\n @inject({ key: AuthenticateBindingKeys.JWKS_OPTIONS })\n protected options: IJWKSVerifierOptions,\n ) {\n super({ scope: JWKSVerifierTokenService.name });\n this.configurePayloadEncryption({\n aesAlgorithm: this.options.aesAlgorithm,\n applicationSecret: this.options.applicationSecret,\n fieldCodecs: this.options.fieldCodecs,\n cipher: this.options.cipher,\n });\n }\n\n protected override async initialize(): Promise<void> {\n const { createRemoteJWKSet } = await JoseLoader.load();\n const jwksUrl = new URL(this.options.jwksUrl);\n this.jwksVerifier = createRemoteJWKSet(jwksUrl, {\n cacheMaxAge: this.options.cacheTtlMs ?? 43_200_000,\n cooldownDuration: this.options.cooldownMs ?? 30_000,\n });\n\n this.initialized = true;\n\n this.logger\n .for(this.initialize.name)\n .info('JWKS verifier initialized \| url: %s', this.options.jwksUrl);\n }\n\n protected override async doVerify(token: string): Promise<IJWTTokenPayload> {\n await this.ensureInitialized();\n const { jwtVerify } = await JoseLoader.load();\n const result = await jwtVerify<IJWTTokenPayload>(\n token,\n this.jwksVerifier!,\n this.options.verify,\n );\n return this.decryptPayload({ result });\n }\n\n override async getSigner(_opts: {\n payload: IJWTTokenPayload;\n getTokenExpiresFn: TGetTokenExpiresFn;\n }): Promise<SignJWT> {\n throw getError({\n statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n message: '[JWKSVerifierTokenService] Verifier mode cannot sign tokens',\n });\n }\n\n protected override getSigningKey(): never {\n throw getError({\n statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n message: '[JWKSVerifierTokenService] Verifier mode cannot sign tokens',\n });\n }\n\n protected override getDefaultTokenExpiresFn(): never {\n throw getError({\n statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n message: '[JWKSVerifierTokenService] Verifier mode has no token expiry',\n });\n }\n}\n"]}

package/dist/components/auth/authenticate/services/bearer/jws.service.d.ts CHANGED Viewed

@@ -16,4 +16,3 @@ export declare class JWSTokenService<E extends Env = Env> extends AbstractBearer
     protected getSigningKey(): ValueOrPromise<Uint8Array>;
     protected getDefaultTokenExpiresFn(): TGetTokenExpiresFn;
 }
-//# sourceMappingURL=jws.service.d.ts.map

package/dist/components/auth/authenticate/services/bearer/jws.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"jws.service.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/bearer/jws.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAA0E;AAC1E,sDAAuD;AACvD,wDAO+B;AAE/B,gDAA4C;AAC5C,yDAAgE;AAEhE,8EAA8E;AAC9E,IAAa,eAAe,uBAA5B,MAAa,eAAqC,SAAQ,6CAA6B;IAGrF,YAEY,OAAgC;QAE1C,KAAK,CAAC,EAAE,KAAK,EAAE,iBAAe,CAAC,IAAI,EAAE,CAAC,CAAC;QAF7B,YAAO,GAAP,OAAO,CAAyB;QAI1C,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;QAExF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,qCAAqC;aAC/C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,6CAA6C;aACvD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,0BAA0B,CAAC;YAC9B,YAAY;YACZ,iBAAiB;YACjB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpE,CAAC;IAEkB,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC7C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,YAAY,GAAG,MAAM,SAAS,CAClC,KAAK,EACL,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,OAAO,CAAC,MAAM,CACpB,CAAC;QACF,OAAO,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IACvD,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,IAIxB;QACC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;aAC5D,kBAAkB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,OAAO,EAAE,CAAC;aACpE,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,GAAG,SAAS,CAAC;aAClC,YAAY,CAAC,GAAG,CAAC,CAAC;QAErB,OAAO,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC;IAEkB,aAAa;QAC9B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAEkB,wBAAwB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACxC,CAAC;CACF,CAAA;AA5EY,0CAAe;0BAAf,eAAe;IAIvB,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,WAAW,EAAE,CAAC,CAAA;;GAJ5C,eAAe,CA4E3B"}
1	+ {"version":3,"file":"jws.service.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/bearer/jws.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAA0E;AAC1E,sDAAuD;AACvD,wDAO+B;AAE/B,gDAA4C;AAC5C,yDAAgE;AAEhE,8EAA8E;AAC9E,IAAa,eAAe,uBAA5B,MAAa,eAAqC,SAAQ,6CAA6B;IAGrF,YAEY,OAAgC;QAE1C,KAAK,CAAC,EAAE,KAAK,EAAE,iBAAe,CAAC,IAAI,EAAE,CAAC,CAAC;QAF7B,YAAO,GAAP,OAAO,CAAyB;QAI1C,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;QAExF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,qCAAqC;aAC/C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,6CAA6C;aACvD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,0BAA0B,CAAC;YAC9B,YAAY;YACZ,iBAAiB;YACjB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpE,CAAC;IAEkB,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC7C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,YAAY,GAAG,MAAM,SAAS,CAClC,KAAK,EACL,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,OAAO,CAAC,MAAM,CACpB,CAAC;QACF,OAAO,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IACvD,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,IAIxB;QACC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;aAC5D,kBAAkB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,OAAO,EAAE,CAAC;aACpE,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,GAAG,SAAS,CAAC;aAClC,YAAY,CAAC,GAAG,CAAC,CAAC;QAErB,OAAO,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC;IAEkB,aAAa;QAC9B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAEkB,wBAAwB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACxC,CAAC;CACF,CAAA;AA5EY,0CAAe;0BAAf,eAAe;IAIvB,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,WAAW,EAAE,CAAC,CAAA;;GAJ5C,eAAe,CA4E3B","sourcesContent":["import { HTTP, type ValueOrPromise } from '@venizia/ignis-helpers/common';\nimport { getError } from '@venizia/ignis-helpers/core';\nimport {\n AuthenticateBindingKeys,\n type IJWSTokenServiceOptions,\n type IJWTIssueClaims,\n type IJWTTokenPayload,\n inject,\n type TGetTokenExpiresFn,\n} from '@venizia/ignis-kernel';\nimport { type Env } from 'hono';\nimport { JoseLoader } from '../jose-loader';\nimport { AbstractBearerTokenService } from './abstract.service';\n\n/** Symmetric JWT (JWS) token service with optional AES-encrypted payloads. */\nexport class JWSTokenService<E extends Env = Env> extends AbstractBearerTokenService<E> {\n protected jwtSecret: Uint8Array;\n\n constructor(\n @inject({ key: AuthenticateBindingKeys.JWT_OPTIONS })\n protected options: IJWSTokenServiceOptions,\n ) {\n super({ scope: JWSTokenService.name });\n\n const { aesAlgorithm, jwtSecret, applicationSecret, getTokenExpiresFn } = options ?? {};\n\n if (!jwtSecret) {\n throw getError({\n statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n message: '[JWSTokenService] Invalid jwtSecret',\n });\n }\n\n if (!getTokenExpiresFn) {\n throw getError({\n statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n message: '[JWSTokenService] Invalid getTokenExpiresFn',\n });\n }\n\n this.configurePayloadEncryption({\n aesAlgorithm,\n applicationSecret,\n fieldCodecs: options.fieldCodecs,\n cipher: options.cipher,\n sign: options.sign,\n });\n this.jwtSecret = new TextEncoder().encode(this.options.jwtSecret);\n }\n\n protected override async doVerify(token: string): Promise<IJWTTokenPayload> {\n const { jwtVerify } = await JoseLoader.load();\n const decodedToken = await jwtVerify<IJWTTokenPayload>(\n token,\n this.jwtSecret,\n this.options.verify,\n );\n return this.decryptPayload({ result: decodedToken });\n }\n\n override async getSigner(opts: {\n payload: IJWTTokenPayload;\n getTokenExpiresFn: TGetTokenExpiresFn;\n claims?: IJWTIssueClaims;\n }) {\n const { SignJWT } = await JoseLoader.load();\n const now = Math.floor(Date.now() / 1000);\n const expiresIn = await opts.getTokenExpiresFn();\n\n const encryptedPayload = this.encryptPayload(opts.payload);\n\n const signer = new SignJWT(Object.assign({}, encryptedPayload))\n .setProtectedHeader({ alg: this.options.headerAlgorithm ?? 'HS256' })\n .setIssuedAt()\n .setExpirationTime(now + expiresIn)\n .setNotBefore(now);\n\n return this.applySignClaims({ signer, payload: encryptedPayload, claims: opts.claims });\n }\n\n protected override getSigningKey(): ValueOrPromise<Uint8Array> {\n if (!this.jwtSecret) {\n throw getError({ message: '[getSigningKey] Invalid jwtSecret!' });\n }\n\n return this.jwtSecret;\n }\n\n protected override getDefaultTokenExpiresFn(): TGetTokenExpiresFn {\n return this.options.getTokenExpiresFn;\n }\n}\n"]}

package/dist/components/auth/authenticate/services/index.d.ts CHANGED Viewed

@@ -1,4 +1,3 @@
 export * from './basic';
 export * from './bearer';
 export * from './service';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authenticate/services/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/services/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,2CAAyB;AACzB,4CAA0B"}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/services/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,2CAAyB;AACzB,4CAA0B","sourcesContent":["export * from './basic';\nexport * from './bearer';\nexport * from './service';\n"]}

package/dist/components/auth/authenticate/services/jose-loader.d.ts CHANGED Viewed

@@ -13,4 +13,3 @@ export declare class JoseLoader {
     static load(): Promise<TJoseModule>;
 }
 export {};
-//# sourceMappingURL=jose-loader.d.ts.map

package/dist/components/auth/authenticate/services/jose-loader.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"jose-loader.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/services/jose-loader.ts"],"names":[],"mappings":";;;AAEA;;;;;;;GAOG;AACH,MAAa,UAAU;aACN,aAAQ,GAA+B,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;aAC5D,WAAM,GAAgC,IAAI,CAAC;IAE1D,MAAM,CAAC,IAAI;QACT,wFAAwF;QACxF,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACnE,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC;YACzB,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,OAAO,UAAU,CAAC,MAAM,CAAC;IAC3B,CAAC;;AAXH,gCAYC"}
1	+ {"version":3,"file":"jose-loader.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/services/jose-loader.ts"],"names":[],"mappings":";;;AAEA;;;;;;;GAOG;AACH,MAAa,UAAU;aACN,aAAQ,GAA+B,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;aAC5D,WAAM,GAAgC,IAAI,CAAC;IAE1D,MAAM,CAAC,IAAI;QACT,wFAAwF;QACxF,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACnE,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC;YACzB,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,OAAO,UAAU,CAAC,MAAM,CAAC;IAC3B,CAAC;;AAXH,gCAYC","sourcesContent":["type TJoseModule = typeof import('jose');\n\n/*\n Loads `jose` for the auth services, once per process.\n \n `jose` is ESM-only and this package is CommonJS. A top-level `require('jose')` runs while the\n * application is still loading, and under Bun it fails with `require() async module ... is\n * unsupported` whenever the application imports `jose` itself. `import()` waits for that load\n * instead of racing it. A string literal, so a bundler still packs `jose` into a compiled binary.\n */\nexport class JoseLoader {\n private static importer: () => Promise<TJoseModule> = () => import('jose');\n private static module: Promise<TJoseModule> \| null = null;\n\n static load(): Promise<TJoseModule> {\n // A failed load is dropped, so the next call imports again instead of failing for good.\n JoseLoader.module ??= JoseLoader.importer().catch((error: unknown) => {\n JoseLoader.module = null;\n throw error;\n });\n return JoseLoader.module;\n }\n}\n"]}

package/dist/components/auth/authenticate/services/service/index.d.ts CHANGED Viewed

@@ -1,3 +1,2 @@
 export * from './signer.service';
 export * from './verifier.service';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authenticate/services/service/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/service/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,mDAAiC;AACjC,qDAAmC"}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/service/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,mDAAiC;AACjC,qDAAmC","sourcesContent":["export * from './signer.service';\nexport * from './verifier.service';\n"]}

package/dist/components/auth/authenticate/services/service/signer.service.d.ts CHANGED Viewed

@@ -43,4 +43,3 @@ export declare class ServiceAssertionSignerService extends BaseService {
     private readKey;
     private assertEnabled;
 }
-//# sourceMappingURL=signer.service.d.ts.map

package/dist/components/auth/authenticate/services/service/signer.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"signer.service.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/service/signer.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8CAAyC;AACzC,wDAA+F;AAE/F,sDAA2E;AAC3E,0DAAqD;AAErD,+CAA4C;AAC5C,wDAAuE;AACvE,gDAA4C;AAE5C;;;;;GAKG;AACH,IAAa,6BAA6B,qCAA1C,MAAa,6BAA8B,SAAQ,0BAAW;IAQ5D,YAEE,OAA6C;QAE7C,KAAK,CAAC,EAAE,KAAK,EAAE,+BAA6B,CAAC,IAAI,EAAE,CAAC,CAAC;QAFpC,YAAO,GAAP,OAAO,CAAqB;QAT9B,uBAAkB,GAAG,IAAI,yBAAkB,CAAC;YAC3D,KAAK,EAAE,+BAA6B,CAAC,IAAI;SAC1C,CAAC,CAAC;IAUH,CAAC;IAED,SAAS;QACP,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,wGAAwG;IACxG,QAAQ;QACN,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,+BAAgB,CAAC,iBAAiB,CAAC;QAC/E,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;IACzF,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,IAAwD;QACjE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QAExC,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,QAAQ,GACZ,IAAI,CAAC,OAAO,CAAC,mBAAmB,IAAI,+BAAgB,CAAC,6BAA6B,CAAC;QAErF,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;aACzD,kBAAkB,CAAC;YAClB,GAAG,EAAE,+BAAgB,CAAC,SAAS;YAC/B,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE;YACpB,GAAG,EAAE,+BAAgB,CAAC,GAAG;SAC1B,CAAC;aACD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;aAC5B,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;aAC7B,WAAW,CAAC,QAAQ,CAAC;aACrB,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;aACxC,WAAW,CAAC,GAAG,CAAC;aAChB,iBAAiB,CAAC,GAAG,GAAG,QAAQ,CAAC;aACjC,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa;QACjB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,+BAAgB,CAAC,SAAS,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;QAEvC,IAAI,GAAG,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,IAAI,+BAA6B,CAAC,IAAI,0GAA0G;aAC1J,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAI,GAAG;YACV,IAAI,EAAE,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,+BAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;SACtF,CAAC;QAEF,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,+BAAgB,CAAC,SAAS,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAwB;QAC5C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC;QAE9C,IAAI,MAAM,KAAK,6BAAc,CAAC,GAAG,EAAE,CAAC;YAClC,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,IAAI,+BAA6B,CAAC,IAAI,eAAe,6BAAc,CAAC,GAAG,oCAAoC,MAAM,EAAE;aAC7H,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,KAAK,6BAAc,CAAC,IAAI,EAAE,CAAC;YACnC,OAAO,IAAA,mBAAQ,EAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,aAAa;QACnB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,MAAM,IAAA,eAAQ,EAAC;YACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,IAAI,+BAA6B,CAAC,IAAI,iFAAiF;SACjI,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAjIY,sEAA6B;wCAA7B,6BAA6B;IASrC,WAAA,IAAA,iBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,eAAe,EAAE,CAAC,CAAA;;GAThD,6BAA6B,CAiIzC"}
1	+ {"version":3,"file":"signer.service.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/service/signer.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8CAAyC;AACzC,wDAA+F;AAE/F,sDAA2E;AAC3E,0DAAqD;AAErD,+CAA4C;AAC5C,wDAAuE;AACvE,gDAA4C;AAE5C;;;;;GAKG;AACH,IAAa,6BAA6B,qCAA1C,MAAa,6BAA8B,SAAQ,0BAAW;IAQ5D,YAEE,OAA6C;QAE7C,KAAK,CAAC,EAAE,KAAK,EAAE,+BAA6B,CAAC,IAAI,EAAE,CAAC,CAAC;QAFpC,YAAO,GAAP,OAAO,CAAqB;QAT9B,uBAAkB,GAAG,IAAI,yBAAkB,CAAC;YAC3D,KAAK,EAAE,+BAA6B,CAAC,IAAI;SAC1C,CAAC,CAAC;IAUH,CAAC;IAED,SAAS;QACP,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,wGAAwG;IACxG,QAAQ;QACN,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,+BAAgB,CAAC,iBAAiB,CAAC;QAC/E,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;IACzF,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,IAAwD;QACjE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QAExC,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,QAAQ,GACZ,IAAI,CAAC,OAAO,CAAC,mBAAmB,IAAI,+BAAgB,CAAC,6BAA6B,CAAC;QAErF,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;aACzD,kBAAkB,CAAC;YAClB,GAAG,EAAE,+BAAgB,CAAC,SAAS;YAC/B,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE;YACpB,GAAG,EAAE,+BAAgB,CAAC,GAAG;SAC1B,CAAC;aACD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;aAC5B,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;aAC7B,WAAW,CAAC,QAAQ,CAAC;aACrB,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;aACxC,WAAW,CAAC,GAAG,CAAC;aAChB,iBAAiB,CAAC,GAAG,GAAG,QAAQ,CAAC;aACjC,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa;QACjB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,+BAAgB,CAAC,SAAS,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;QAEvC,IAAI,GAAG,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,IAAI,+BAA6B,CAAC,IAAI,0GAA0G;aAC1J,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAI,GAAG;YACV,IAAI,EAAE,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,+BAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;SACtF,CAAC;QAEF,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,+BAAgB,CAAC,SAAS,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAwB;QAC5C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC;QAE9C,IAAI,MAAM,KAAK,6BAAc,CAAC,GAAG,EAAE,CAAC;YAClC,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,IAAI,+BAA6B,CAAC,IAAI,eAAe,6BAAc,CAAC,GAAG,oCAAoC,MAAM,EAAE;aAC7H,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,KAAK,6BAAc,CAAC,IAAI,EAAE,CAAC;YACnC,OAAO,IAAA,mBAAQ,EAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,aAAa;QACnB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,MAAM,IAAA,eAAQ,EAAC;YACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,IAAI,+BAA6B,CAAC,IAAI,iFAAiF;SACjI,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAjIY,sEAA6B;wCAA7B,6BAA6B;IASrC,WAAA,IAAA,iBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,eAAe,EAAE,CAAC,CAAA;;GAThD,6BAA6B,CAiIzC","sourcesContent":["import { inject } from '@/base/metadata';\nimport { AuthenticateBindingKeys, BaseService, ServiceAssertion } from '@venizia/ignis-kernel';\nimport type { IServiceAuthOptions } from '@venizia/ignis-kernel';\nimport { getError, RequestIdGenerator } from '@venizia/ignis-helpers/core';\nimport { HTTP } from '@venizia/ignis-helpers/common';\nimport type { CryptoKey, JWK } from 'jose';\nimport { readFile } from 'node:fs/promises';\nimport { JWKSKeyDrivers, JWKSKeyFormats } from '@venizia/ignis-kernel';\nimport { JoseLoader } from '../jose-loader';\n\n/*\n Mints the outgoing assertion, and publishes the public half for callees to verify against.\n \n Only a service that CALLS OUT needs this. `isEnabled()` is false when the application configured\n * no keys, and the component then mounts no certs route.\n /\nexport class ServiceAssertionSignerService extends BaseService {\n private readonly requestIdGenerator = new RequestIdGenerator({\n scope: ServiceAssertionSignerService.name,\n });\n\n private privateKey?: CryptoKey;\n private jwks?: { keys: JWK[] };\n\n constructor(\n @inject({ key: AuthenticateBindingKeys.SERVICE_OPTIONS })\n private readonly options: IServiceAuthOptions,\n ) {\n super({ scope: ServiceAssertionSignerService.name });\n }\n\n isEnabled(): boolean {\n return Boolean(this.options.keys);\n }\n\n /* `<name>_<rest path without its slash>`, so a rotated mount changes the kid rather than colliding. /\n getKeyId(): string {\n const restPath = this.options.rest?.path ?? ServiceAssertion.DEFAULT_REST_PATH;\n return this.options.keys?.kid ?? `${this.options.name}_${restPath.replace(/^\\//, '')}`;\n }\n\n /\n One assertion, bound to this exact call.\n \n `path` must be the percent-ENCODED pathname - `new URL(target).pathname`. The verifier compares\n * against the same shape, and a decoded path here would fail every route carrying a space or a\n * non-ASCII slug.\n /\n async sign(opts: { method: string; path: string; audience: string }): Promise<string> {\n const { method, path, audience } = opts;\n\n this.assertEnabled();\n\n const { SignJWT } = await JoseLoader.load();\n const now = Math.floor(Date.now() / 1000);\n const lifetime =\n this.options.signLifetimeSeconds ?? ServiceAssertion.DEFAULT_SIGN_LIFETIME_SECONDS;\n\n return new SignJWT({ htm: method.toUpperCase(), htu: path })\n .setProtectedHeader({\n alg: ServiceAssertion.ALGORITHM,\n kid: this.getKeyId(),\n typ: ServiceAssertion.TYP,\n })\n .setIssuer(this.options.name)\n .setSubject(this.options.name)\n .setAudience(audience)\n .setJti(this.requestIdGenerator.nextId())\n .setIssuedAt(now)\n .setExpirationTime(now + lifetime)\n .sign(await this.resolvePrivateKey());\n }\n\n /\n The document `/svc-certs` serves, built from the PUBLIC key only.\n \n `importSPKI` refuses a private PEM outright, which is what makes the private half unreachable\n * from here by construction rather than by care. The JWK format is deliberately NOT accepted for\n * this path: `importJWK` imports whatever it is handed, and a private JWK marked `\"ext\": true`\n * round-trips its `d` straight into this document. See `JWKSIssuerTokenService.assertPublicJWK`.\n */\n async getPublicJWKS(): Promise<{ keys: JWK[] }> {\n if (this.jwks) {\n return this.jwks;\n }\n\n this.assertEnabled();\n\n const { exportJWK, importSPKI } = await JoseLoader.load();\n const raw = await this.readKey({ source: this.options.keys!.public });\n const publicKey = await importSPKI(raw, ServiceAssertion.ALGORITHM);\n const jwk = await exportJWK(publicKey);\n\n if (jwk.d !== undefined) {\n throw getError({\n statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n message: `[${ServiceAssertionSignerService.name}] The public key material carries a private exponent \| this key would be published at the certs endpoint`,\n });\n }\n\n this.jwks = {\n keys: [{ ...jwk, kid: this.getKeyId(), alg: ServiceAssertion.ALGORITHM, use: 'sig' }],\n };\n\n return this.jwks;\n }\n\n private async resolvePrivateKey(): Promise<CryptoKey> {\n if (this.privateKey) {\n return this.privateKey;\n }\n\n const { importPKCS8 } = await JoseLoader.load();\n const raw = await this.readKey({ source: this.options.keys!.private });\n this.privateKey = await importPKCS8(raw, ServiceAssertion.ALGORITHM);\n return this.privateKey;\n }\n\n private async readKey(opts: { source: string }): Promise<string> {\n const { format, driver } = this.options.keys!;\n\n if (format !== JWKSKeyFormats.PEM) {\n throw getError({\n statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n message: `[${ServiceAssertionSignerService.name}] Only the '${JWKSKeyFormats.PEM}' key format is supported \| got: ${format}`,\n });\n }\n\n if (driver === JWKSKeyDrivers.FILE) {\n return readFile(opts.source, 'utf-8');\n }\n\n return opts.source;\n }\n\n private assertEnabled(): void {\n if (this.options.keys) {\n return;\n }\n\n throw getError({\n statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n message: `[${ServiceAssertionSignerService.name}] This service has no signing keys \| it can verify assertions but not mint them`,\n });\n }\n}\n"]}

package/dist/components/auth/authenticate/services/service/verifier.service.d.ts CHANGED Viewed

@@ -37,4 +37,3 @@ export declare class ServiceAssertionVerifierService extends BaseService {
     private runVerify;
     private assertRequestBinding;
 }
-//# sourceMappingURL=verifier.service.d.ts.map

package/dist/components/auth/authenticate/services/service/verifier.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"verifier.service.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/service/verifier.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8CAAyC;AACzC,wDAK+B;AAE/B,sDAAuD;AAEvD,gDAA4C;AAI5C;;;;;;;;GAQG;AACH,IAAa,+BAA+B,uCAA5C,MAAa,+BAAgC,SAAQ,0BAAW;IAO9D,YAEE,OAA6C;QAE7C,KAAK,CAAC,EAAE,KAAK,EAAE,iCAA+B,CAAC,IAAI,EAAE,CAAC,CAAC;QAFtC,YAAO,GAAP,OAAO,CAAqB;QAR/C,2FAA2F;QAC1E,YAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;QAE5D,oEAAoE;QACnD,kBAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAO3D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,IAAqD;QAChE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAErC,MAAM,IAAI,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtE,IAAI,CAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAErD,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACK,UAAU,CAAC,IAAoD;QACrE,IAAI,MAAe,CAAC;QAEpB,IAAI,CAAC;YACH,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;YACvF,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,mCAAoB,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,qFAAqF;QACrF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;iBACzB,IAAI,CAAC,wDAAwD,CAAC,CAAC;YAClE,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,mCAAoB,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,aAAa,CAAC,IAAqD;QACzE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QAE3C,gGAAgG;QAChG,8FAA8F;QAC9F,wDAAwD;QACxD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;iBAC5B,IAAI,CAAC,uCAAuC,EAAE,MAAM,CAAC,CAAC;YACzD,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,mCAAoB,CAAC,kBAAkB,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;QAElE,IAAI,CAAC,aAAa,CAAC,GAAG,CACpB,MAAM,EACN,+BAAgB,CAAC,mBAAmB,CAAC;YACnC,cAAc,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB;YACjF,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB;SACjD,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE;YACvD,WAAW,EACT,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,IAAI,+BAAgB,CAAC,6BAA6B;YACpF,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,IAAI,+BAAgB,CAAC,wBAAwB;SAC7F,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAKvB;QACC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAE7C,gFAAgF;QAChF,MAAM,WAAW,GACf,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC;YAC9B,+BAAgB,CAAC,mBAAmB,CAAC;gBACnC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB;aACjD,CAAC,CAAC;QAEL,MAAM,cAAc,GAClB,IAAI,CAAC,OAAO,CAAC,qBAAqB,IAAI,+BAAgB,CAAC,+BAA+B,CAAC;QAEzF,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAA0B,KAAK,EAAE,MAAM,EAAE;gBAC/E,UAAU,EAAE,CAAC,+BAAgB,CAAC,SAAS,CAAC;gBACxC,GAAG,EAAE,+BAAgB,CAAC,GAAG;gBACzB,MAAM;gBACN,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;gBAC3B,qFAAqF;gBACrF,sFAAsF;gBACtF,6FAA6F;gBAC7F,6FAA6F;gBAC7F,EAAE;gBACF,2FAA2F;gBAC3F,6FAA6F;gBAC7F,mBAAmB;gBACnB,EAAE;gBACF,sFAAsF;gBACtF,wFAAwF;gBACxF,yFAAyF;gBACzF,yFAAyF;gBACzF,8DAA8D;gBAC9D,4FAA4F;gBAC5F,uEAAuE;gBACvE,WAAW;gBACX,cAAc;gBACd,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;aACtC,CAAC,CAAC;YAEH,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0FAA0F;YAC1F,kEAAkE;YAClE,MAAM,MAAM,GAAI,KAA6B,EAAE,KAAK,IAAI,KAAK,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iCAAiC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAE7F,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,mCAAoB,CAAC,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,IAI5B;QACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAEvC,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC;QAEjD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;aACnC,IAAI,CAAC,oDAAoD,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAE9E,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,mCAAoB,CAAC,wBAAwB,EAAE,CAAC,CAAC;IAC3E,CAAC;CACF,CAAA;AA9KY,0EAA+B;0CAA/B,+BAA+B;IAQvC,WAAA,IAAA,iBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,eAAe,EAAE,CAAC,CAAA;;GARhD,+BAA+B,CA8K3C"}
1	+ {"version":3,"file":"verifier.service.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/service/verifier.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8CAAyC;AACzC,wDAK+B;AAE/B,sDAAuD;AAEvD,gDAA4C;AAI5C;;;;;;;;GAQG;AACH,IAAa,+BAA+B,uCAA5C,MAAa,+BAAgC,SAAQ,0BAAW;IAO9D,YAEE,OAA6C;QAE7C,KAAK,CAAC,EAAE,KAAK,EAAE,iCAA+B,CAAC,IAAI,EAAE,CAAC,CAAC;QAFtC,YAAO,GAAP,OAAO,CAAqB;QAR/C,2FAA2F;QAC1E,YAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;QAE5D,oEAAoE;QACnD,kBAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAO3D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,IAAqD;QAChE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAErC,MAAM,IAAI,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtE,IAAI,CAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAErD,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACK,UAAU,CAAC,IAAoD;QACrE,IAAI,MAAe,CAAC;QAEpB,IAAI,CAAC;YACH,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;YACvF,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,mCAAoB,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,qFAAqF;QACrF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;iBACzB,IAAI,CAAC,wDAAwD,CAAC,CAAC;YAClE,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,mCAAoB,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,aAAa,CAAC,IAAqD;QACzE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QAE3C,gGAAgG;QAChG,8FAA8F;QAC9F,wDAAwD;QACxD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;iBAC5B,IAAI,CAAC,uCAAuC,EAAE,MAAM,CAAC,CAAC;YACzD,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,mCAAoB,CAAC,kBAAkB,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;QAElE,IAAI,CAAC,aAAa,CAAC,GAAG,CACpB,MAAM,EACN,+BAAgB,CAAC,mBAAmB,CAAC;YACnC,cAAc,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB;YACjF,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB;SACjD,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE;YACvD,WAAW,EACT,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,IAAI,+BAAgB,CAAC,6BAA6B;YACpF,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,IAAI,+BAAgB,CAAC,wBAAwB;SAC7F,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAKvB;QACC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAE7C,gFAAgF;QAChF,MAAM,WAAW,GACf,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC;YAC9B,+BAAgB,CAAC,mBAAmB,CAAC;gBACnC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB;aACjD,CAAC,CAAC;QAEL,MAAM,cAAc,GAClB,IAAI,CAAC,OAAO,CAAC,qBAAqB,IAAI,+BAAgB,CAAC,+BAA+B,CAAC;QAEzF,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAA0B,KAAK,EAAE,MAAM,EAAE;gBAC/E,UAAU,EAAE,CAAC,+BAAgB,CAAC,SAAS,CAAC;gBACxC,GAAG,EAAE,+BAAgB,CAAC,GAAG;gBACzB,MAAM;gBACN,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;gBAC3B,qFAAqF;gBACrF,sFAAsF;gBACtF,6FAA6F;gBAC7F,6FAA6F;gBAC7F,EAAE;gBACF,2FAA2F;gBAC3F,6FAA6F;gBAC7F,mBAAmB;gBACnB,EAAE;gBACF,sFAAsF;gBACtF,wFAAwF;gBACxF,yFAAyF;gBACzF,yFAAyF;gBACzF,8DAA8D;gBAC9D,4FAA4F;gBAC5F,uEAAuE;gBACvE,WAAW;gBACX,cAAc;gBACd,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;aACtC,CAAC,CAAC;YAEH,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0FAA0F;YAC1F,kEAAkE;YAClE,MAAM,MAAM,GAAI,KAA6B,EAAE,KAAK,IAAI,KAAK,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iCAAiC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAE7F,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,mCAAoB,CAAC,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,IAI5B;QACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAEvC,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC;QAEjD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;aACnC,IAAI,CAAC,oDAAoD,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAE9E,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,mCAAoB,CAAC,wBAAwB,EAAE,CAAC,CAAC;IAC3E,CAAC;CACF,CAAA;AA9KY,0EAA+B;0CAA/B,+BAA+B;IAQvC,WAAA,IAAA,iBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,eAAe,EAAE,CAAC,CAAA;;GARhD,+BAA+B,CA8K3C","sourcesContent":["import { inject } from '@/base/metadata';\nimport {\n AuthenticateBindingKeys,\n AuthenticationErrors,\n BaseService,\n ServiceAssertion,\n} from '@venizia/ignis-kernel';\nimport type { IServiceAssertionClaims, IServiceAuthOptions } from '@venizia/ignis-kernel';\nimport { getError } from '@venizia/ignis-helpers/core';\nimport type { createRemoteJWKSet } from 'jose';\nimport { JoseLoader } from '../jose-loader';\n\ntype TRemoteKeySet = ReturnType<typeof createRemoteJWKSet>;\n\n/*\n Verifies an incoming service assertion against the CALLER's own JWKS.\n \n What the assertion covers, and nothing else: the HTTP method and the percent-encoded path. It does\n * NOT cover the query string, any header, or the body. Tenant selectors in particular are usually a\n * header or a query parameter, so an assertion alone does not authenticate which tenant a call acts\n * on - the caller allowlist and the application's own scoping have to do that. Stated because the\n * gap is invisible from the call site.\n /\nexport class ServiceAssertionVerifierService extends BaseService {\n /* One remote key set per caller, kept because `createRemoteJWKSet` owns its own cache. /\n private readonly keySets = new Map<string, TRemoteKeySet>();\n\n /* Per-caller accepted age, resolved once alongside its key set. /\n private readonly acceptMaxAges = new Map<string, number>();\n\n constructor(\n @inject({ key: AuthenticateBindingKeys.SERVICE_OPTIONS })\n private readonly options: IServiceAuthOptions,\n ) {\n super({ scope: ServiceAssertionVerifierService.name });\n }\n\n /\n @param path The percent-ENCODED pathname, from `new URL(context.req.url).pathname`. Never\n * `context.req.path` - Hono decodes that one, and the caller signed the encoded form.\n /\n async verify(opts: { token: string; method: string; path: string }): Promise<{ issuer: string }> {\n const { token, method, path } = opts;\n\n const jose = await JoseLoader.load();\n const issuer = this.readIssuer({ token, jose });\n const keySet = this.resolveKeySet({ issuer, jose });\n const payload = await this.runVerify({ token, issuer, keySet, jose });\n\n this.assertRequestBinding({ payload, method, path });\n\n return { issuer };\n }\n\n /\n Reads `iss` WITHOUT verifying, only to choose which key set checks the signature. The same value\n * is then enforced as the expected issuer, so a forged `iss` buys nothing beyond selecting the key\n * set that will reject it.\n */\n private readIssuer(opts: { token: string; jose: typeof import('jose') }): string {\n let issuer: unknown;\n\n try {\n ({ iss: issuer } = opts.jose.decodeJwt(opts.token));\n } catch (error) {\n this.logger.for(this.readIssuer.name).warn('Undecodable assertion \| error: %s', error);\n throw getError({ error: AuthenticationErrors.ASSERTION_INVALID });\n }\n\n // Typed, not merely present: a numeric `iss` would index the caller map by coercion.\n if (typeof issuer !== 'string' \|\| issuer.length === 0) {\n this.logger\n .for(this.readIssuer.name)\n .warn('Undecodable assertion \| iss is missing or not a string');\n throw getError({ error: AuthenticationErrors.ASSERTION_INVALID });\n }\n\n return issuer;\n }\n\n private resolveKeySet(opts: { issuer: string; jose: typeof import('jose') }): TRemoteKeySet {\n const { issuer, jose } = opts;\n\n const cached = this.keySets.get(issuer);\n if (cached) {\n return cached;\n }\n\n const callers = this.options.callers ?? {};\n\n // `Object.hasOwn`, never a truthiness check on the index: the map arrives as a plain object, so\n // `iss: 'constructor'` would otherwise return `Function` - truthy - walk past this guard, and\n // reach `new URL(<function>)` as an uncaught TypeError.\n if (!Object.hasOwn(callers, issuer)) {\n this.logger\n .for(this.resolveKeySet.name)\n .warn('Caller not on the allowlist \| iss: %s', issuer);\n throw getError({ error: AuthenticationErrors.CALLER_NOT_ALLOWED });\n }\n\n const entry = callers[issuer];\n const jwksUrl = typeof entry === 'string' ? entry : entry.jwksUrl;\n\n this.acceptMaxAges.set(\n issuer,\n ServiceAssertion.resolveAcceptMaxAge({\n callerOverride: typeof entry === 'string' ? undefined : entry.acceptMaxAgeSeconds,\n serviceDefault: this.options.acceptMaxAgeSeconds,\n }),\n );\n\n const keySet = jose.createRemoteJWKSet(new URL(jwksUrl), {\n cacheMaxAge:\n this.options.jwks?.cacheMaxAgeMs ?? ServiceAssertion.DEFAULT_JWKS_CACHE_MAX_AGE_MS,\n cooldownDuration: this.options.jwks?.cooldownMs ?? ServiceAssertion.DEFAULT_JWKS_COOLDOWN_MS,\n });\n\n this.keySets.set(issuer, keySet);\n return keySet;\n }\n\n private async runVerify(opts: {\n token: string;\n issuer: string;\n keySet: TRemoteKeySet;\n jose: typeof import('jose');\n }): Promise<IServiceAssertionClaims> {\n const { token, issuer, keySet, jose } = opts;\n\n // Resolved when the key set was, so a per-caller override is already folded in.\n const maxTokenAge =\n this.acceptMaxAges.get(issuer) ??\n ServiceAssertion.resolveAcceptMaxAge({\n serviceDefault: this.options.acceptMaxAgeSeconds,\n });\n\n const clockTolerance =\n this.options.clockToleranceSeconds ?? ServiceAssertion.DEFAULT_CLOCK_TOLERANCE_SECONDS;\n\n try {\n const { payload } = await jose.jwtVerify<IServiceAssertionClaims>(token, keySet, {\n algorithms: [ServiceAssertion.ALGORITHM],\n typ: ServiceAssertion.TYP,\n issuer,\n audience: this.options.name,\n // NOT redundant with `exp`, though it looks it. An honest caller stamps `exp = iat +\n // lifetime`, so the two are numerically tied and jose reaches `exp` first - measured.\n // `maxTokenAge` is the only bound that still holds when the CALLER is the attacker and picks\n // its own `exp`, which is precisely the case it exists for. Do not delete it as dead config.\n //\n // And it is the CALLEE's number, never one the caller may request: a caller that could ask\n // for a longer window would be choosing its own replay window, which is the whole thing this\n // is here to deny.\n //\n // TWO NUMBERS, and they answer different questions. Measured at the defaults, 60 + 5:\n // - 65s is the ACCEPTANCE window on this machine's clock. Age 64 passes, 65 does not.\n // - 70s is the REPLAY window in wall-clock time, when the caller's clock runs the full\n // tolerance fast: we accept an `iat` up to 5s in our future, then keep accepting for\n // another 64. Measured: still accepted 69s after minting.\n // The second is the one a threat model asks for. Widening `clockToleranceSeconds` widens it\n // second for second, so it is a security knob, not an operational one.\n maxTokenAge,\n clockTolerance,\n requiredClaims: ['htm', 'htu', 'jti'],\n });\n\n return payload;\n } catch (error) {\n // One code out, the reason on `cause`: a wrong audience, clock skew and a rotated key are\n // otherwise the same string to whoever is reading the log at 2am.\n const reason = (error as { cause?: unknown })?.cause ?? error;\n this.logger.for(this.runVerify.name).warn('Rejected \| iss: %s \| reason: %s', issuer, reason);\n\n throw getError({ error: AuthenticationErrors.ASSERTION_INVALID, cause: error });\n }\n }\n\n private assertRequestBinding(opts: {\n payload: IServiceAssertionClaims;\n method: string;\n path: string;\n }): void {\n const { payload, method, path } = opts;\n\n const signed = `${payload.htm} ${payload.htu}`;\n const actual = `${method.toUpperCase()} ${path}`;\n\n if (signed === actual) {\n return;\n }\n\n this.logger\n .for(this.assertRequestBinding.name)\n .warn('Request binding mismatch \| signed: %s \| actual: %s', signed, actual);\n\n throw getError({ error: AuthenticationErrors.REQUEST_BINDING_MISMATCH });\n }\n}\n"]}

package/dist/components/auth/authenticate/strategies/basic.strategy.d.ts CHANGED Viewed

@@ -10,4 +10,3 @@ export declare class BasicAuthenticationStrategy<E extends Env = Env> extends Ba
     constructor(service: BasicTokenService<E>);
     authenticate(context: TContext<E, string>): Promise<IAuthUser>;
 }
-//# sourceMappingURL=basic.strategy.d.ts.map

package/dist/components/auth/authenticate/strategies/basic.strategy.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"basic.strategy.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/strategies/basic.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,wDAA+C;AAC/C,wDAA0D;AAC1D,sDAAyD;AACzD,8DAAuD;AAEvD,wDAI+B;AAC/B,0CAAgD;AAEhD,iFAAiF;AACjF,IAAa,2BAA2B,mCAAxC,MAAa,2BACX,SAAQ,iBAAU;IAKlB,YAOE,OAAqC;QAErC,KAAK,CAAC,EAAE,KAAK,EAAE,6BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC;QAF3C,YAAO,GAAP,OAAO,CAAsB;QATvC,SAAI,GAAG,6BAAc,CAAC,cAAc,CAAC;IAYrC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAA4B;QAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,CAAC;CACF,CAAA;AAtBY,kEAA2B;sCAA3B,2BAA2B;IAOnC,WAAA,IAAA,qBAAM,EAAC;QACN,GAAG,EAAE,6BAAW,CAAC,KAAK,CAAC;YACrB,SAAS,EAAE,gCAAiB,CAAC,OAAO;YACpC,GAAG,EAAE,4BAAiB,CAAC,IAAI;SAC5B,CAAC;KACH,CAAC,CAAA;qCACe,4BAAiB;GAbzB,2BAA2B,CAsBvC"}
1	+ {"version":3,"file":"basic.strategy.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/strategies/basic.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,wDAA+C;AAC/C,wDAA0D;AAC1D,sDAAyD;AACzD,8DAAuD;AAEvD,wDAI+B;AAC/B,0CAAgD;AAEhD,iFAAiF;AACjF,IAAa,2BAA2B,mCAAxC,MAAa,2BACX,SAAQ,iBAAU;IAKlB,YAOE,OAAqC;QAErC,KAAK,CAAC,EAAE,KAAK,EAAE,6BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC;QAF3C,YAAO,GAAP,OAAO,CAAsB;QATvC,SAAI,GAAG,6BAAc,CAAC,cAAc,CAAC;IAYrC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAA4B;QAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,CAAC;CACF,CAAA;AAtBY,kEAA2B;sCAA3B,2BAA2B;IAOnC,WAAA,IAAA,qBAAM,EAAC;QACN,GAAG,EAAE,6BAAW,CAAC,KAAK,CAAC;YACrB,SAAS,EAAE,gCAAiB,CAAC,OAAO;YACpC,GAAG,EAAE,4BAAiB,CAAC,IAAI;SAC5B,CAAC;KACH,CAAC,CAAA;qCACe,4BAAiB;GAbzB,2BAA2B,CAsBvC","sourcesContent":["import { type TContext } from '@venizia/ignis-kernel';\nimport { inject } from '@venizia/ignis-kernel';\nimport { BindingNamespaces } from '@venizia/ignis-kernel';\nimport { BaseHelper } from '@venizia/ignis-helpers/core';\nimport { BindingKeys } from '@venizia/ignis-inversion';\nimport { type Env } from 'hono';\nimport {\n Authentication,\n type IAuthUser,\n type IAuthenticationStrategy,\n} from '@venizia/ignis-kernel';\nimport { BasicTokenService } from '../services';\n\n/** HTTP Basic Authentication strategy using Authorization header credentials. */\nexport class BasicAuthenticationStrategy<E extends Env = Env>\n extends BaseHelper\n implements IAuthenticationStrategy<E>\n{\n name = Authentication.STRATEGY_BASIC;\n\n constructor(\n @inject({\n key: BindingKeys.build({\n namespace: BindingNamespaces.SERVICE,\n key: BasicTokenService.name,\n }),\n })\n private service: BasicTokenService<E>,\n ) {\n super({ scope: BasicAuthenticationStrategy.name });\n }\n\n async authenticate(context: TContext<E, string>): Promise<IAuthUser> {\n const credentials = this.service.extractCredentials(context);\n return this.service.verify({ credentials, context });\n }\n}\n"]}

package/dist/components/auth/authenticate/strategies/index.d.ts CHANGED Viewed

@@ -3,4 +3,3 @@ export * from './basic.strategy';
 export * from './jws.strategy';
 export * from './jwks';
 export * from './service.strategy';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authenticate/strategies/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/strategies/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iGAAiG;AACjG,wDAAsC;AAEtC,mDAAiC;AACjC,iDAA+B;AAC/B,yCAAuB;AACvB,qDAAmC"}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/strategies/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iGAAiG;AACjG,wDAAsC;AAEtC,mDAAiC;AACjC,iDAA+B;AAC/B,yCAAuB;AACvB,qDAAmC","sourcesContent":["// `strategy-registry.ts` moved to the kernel - the strategies below register themselves into it.\nexport * from '@venizia/ignis-kernel';\n\nexport * from './basic.strategy';\nexport * from './jws.strategy';\nexport * from './jwks';\nexport * from './service.strategy';\n"]}

package/dist/components/auth/authenticate/strategies/jwks/index.d.ts CHANGED Viewed

@@ -1,3 +1,2 @@
 export * from './issuer';
 export * from './verifier';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authenticate/strategies/jwks/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/strategies/jwks/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB;AACzB,6CAA2B"}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/strategies/jwks/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB;AACzB,6CAA2B","sourcesContent":["export * from './issuer';\nexport * from './verifier';\n"]}

package/dist/components/auth/authenticate/strategies/jwks/issuer.d.ts CHANGED Viewed

@@ -10,4 +10,3 @@ export declare class JWKSIssuerAuthenticationStrategy<E extends Env = Env> exten
     constructor(service: JWKSIssuerTokenService<E>);
     authenticate(context: TContext<E, string>): Promise<IAuthUser>;
 }
-//# sourceMappingURL=issuer.d.ts.map

package/dist/components/auth/authenticate/strategies/jwks/issuer.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"issuer.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/strategies/jwks/issuer.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,wDAA+C;AAC/C,wDAA0D;AAC1D,sDAAyD;AACzD,8DAAuD;AAEvD,wDAK+B;AAC/B,6CAAwD;AAExD,IAAa,gCAAgC,wCAA7C,MAAa,gCACX,SAAQ,iBAAU;IAMlB,YAOE,OAA0C;QAE1C,KAAK,CAAC,EAAE,KAAK,EAAE,kCAAgC,CAAC,IAAI,EAAE,CAAC,CAAC;QAFhD,YAAO,GAAP,OAAO,CAA2B;QAV5C,SAAI,GAAG,6BAAc,CAAC,YAAY,CAAC;QACnC,aAAQ,GAAG,4BAAa,CAAC,IAAI,CAAC;IAY9B,CAAC;IAED,YAAY,CAAC,OAA4B;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;CACF,CAAA;AAvBY,4EAAgC;2CAAhC,gCAAgC;IAQxC,WAAA,IAAA,qBAAM,EAAC;QACN,GAAG,EAAE,6BAAW,CAAC,KAAK,CAAC;YACrB,SAAS,EAAE,gCAAiB,CAAC,OAAO;YACpC,GAAG,EAAE,iCAAsB,CAAC,IAAI;SACjC,CAAC;KACH,CAAC,CAAA;qCACe,iCAAsB;GAd9B,gCAAgC,CAuB5C"}
1	+ {"version":3,"file":"issuer.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/strategies/jwks/issuer.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,wDAA+C;AAC/C,wDAA0D;AAC1D,sDAAyD;AACzD,8DAAuD;AAEvD,wDAK+B;AAC/B,6CAAwD;AAExD,IAAa,gCAAgC,wCAA7C,MAAa,gCACX,SAAQ,iBAAU;IAMlB,YAOE,OAA0C;QAE1C,KAAK,CAAC,EAAE,KAAK,EAAE,kCAAgC,CAAC,IAAI,EAAE,CAAC,CAAC;QAFhD,YAAO,GAAP,OAAO,CAA2B;QAV5C,SAAI,GAAG,6BAAc,CAAC,YAAY,CAAC;QACnC,aAAQ,GAAG,4BAAa,CAAC,IAAI,CAAC;IAY9B,CAAC;IAED,YAAY,CAAC,OAA4B;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;CACF,CAAA;AAvBY,4EAAgC;2CAAhC,gCAAgC;IAQxC,WAAA,IAAA,qBAAM,EAAC;QACN,GAAG,EAAE,6BAAW,CAAC,KAAK,CAAC;YACrB,SAAS,EAAE,gCAAiB,CAAC,OAAO;YACpC,GAAG,EAAE,iCAAsB,CAAC,IAAI;SACjC,CAAC;KACH,CAAC,CAAA;qCACe,iCAAsB;GAd9B,gCAAgC,CAuB5C","sourcesContent":["import { type TContext } from '@venizia/ignis-kernel';\nimport { inject } from '@venizia/ignis-kernel';\nimport { BindingNamespaces } from '@venizia/ignis-kernel';\nimport { BaseHelper } from '@venizia/ignis-helpers/core';\nimport { BindingKeys } from '@venizia/ignis-inversion';\nimport { type Env } from 'hono';\nimport {\n Authentication,\n type IAuthUser,\n type IAuthenticationStrategy,\n JOSEStandards,\n} from '@venizia/ignis-kernel';\nimport { JWKSIssuerTokenService } from '../../services';\n\nexport class JWKSIssuerAuthenticationStrategy<E extends Env = Env>\n extends BaseHelper\n implements IAuthenticationStrategy<E>\n{\n name = Authentication.STRATEGY_JWT;\n standard = JOSEStandards.JWKS;\n\n constructor(\n @inject({\n key: BindingKeys.build({\n namespace: BindingNamespaces.SERVICE,\n key: JWKSIssuerTokenService.name,\n }),\n })\n private service: JWKSIssuerTokenService<E>,\n ) {\n super({ scope: JWKSIssuerAuthenticationStrategy.name });\n }\n\n authenticate(context: TContext<E, string>): Promise<IAuthUser> {\n const token = this.service.extractCredentials(context);\n return this.service.verify(token);\n }\n}\n"]}

package/dist/components/auth/authenticate/strategies/jwks/verifier.d.ts CHANGED Viewed

@@ -10,4 +10,3 @@ export declare class JWKSVerifierAuthenticationStrategy<E extends Env = Env> ext
     constructor(service: JWKSVerifierTokenService<E>);
     authenticate(context: TContext<E, string>): Promise<IAuthUser>;
 }
-//# sourceMappingURL=verifier.d.ts.map

package/dist/components/auth/authenticate/strategies/jwks/verifier.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/strategies/jwks/verifier.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,wDAA+C;AAC/C,wDAA0D;AAC1D,sDAAyD;AACzD,8DAAuD;AAEvD,wDAK+B;AAC/B,6CAA0D;AAE1D,IAAa,kCAAkC,0CAA/C,MAAa,kCACX,SAAQ,iBAAU;IAMlB,YAOE,OAA4C;QAE5C,KAAK,CAAC,EAAE,KAAK,EAAE,oCAAkC,CAAC,IAAI,EAAE,CAAC,CAAC;QAFlD,YAAO,GAAP,OAAO,CAA6B;QAV9C,SAAI,GAAG,6BAAc,CAAC,YAAY,CAAC;QACnC,aAAQ,GAAG,4BAAa,CAAC,IAAI,CAAC;IAY9B,CAAC;IAED,YAAY,CAAC,OAA4B;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;CACF,CAAA;AAvBY,gFAAkC;6CAAlC,kCAAkC;IAQ1C,WAAA,IAAA,qBAAM,EAAC;QACN,GAAG,EAAE,6BAAW,CAAC,KAAK,CAAC;YACrB,SAAS,EAAE,gCAAiB,CAAC,OAAO;YACpC,GAAG,EAAE,mCAAwB,CAAC,IAAI;SACnC,CAAC;KACH,CAAC,CAAA;qCACe,mCAAwB;GAdhC,kCAAkC,CAuB9C"}
1	+ {"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/strategies/jwks/verifier.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,wDAA+C;AAC/C,wDAA0D;AAC1D,sDAAyD;AACzD,8DAAuD;AAEvD,wDAK+B;AAC/B,6CAA0D;AAE1D,IAAa,kCAAkC,0CAA/C,MAAa,kCACX,SAAQ,iBAAU;IAMlB,YAOE,OAA4C;QAE5C,KAAK,CAAC,EAAE,KAAK,EAAE,oCAAkC,CAAC,IAAI,EAAE,CAAC,CAAC;QAFlD,YAAO,GAAP,OAAO,CAA6B;QAV9C,SAAI,GAAG,6BAAc,CAAC,YAAY,CAAC;QACnC,aAAQ,GAAG,4BAAa,CAAC,IAAI,CAAC;IAY9B,CAAC;IAED,YAAY,CAAC,OAA4B;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;CACF,CAAA;AAvBY,gFAAkC;6CAAlC,kCAAkC;IAQ1C,WAAA,IAAA,qBAAM,EAAC;QACN,GAAG,EAAE,6BAAW,CAAC,KAAK,CAAC;YACrB,SAAS,EAAE,gCAAiB,CAAC,OAAO;YACpC,GAAG,EAAE,mCAAwB,CAAC,IAAI;SACnC,CAAC;KACH,CAAC,CAAA;qCACe,mCAAwB;GAdhC,kCAAkC,CAuB9C","sourcesContent":["import { type TContext } from '@venizia/ignis-kernel';\nimport { inject } from '@venizia/ignis-kernel';\nimport { BindingNamespaces } from '@venizia/ignis-kernel';\nimport { BaseHelper } from '@venizia/ignis-helpers/core';\nimport { BindingKeys } from '@venizia/ignis-inversion';\nimport { type Env } from 'hono';\nimport {\n Authentication,\n type IAuthUser,\n type IAuthenticationStrategy,\n JOSEStandards,\n} from '@venizia/ignis-kernel';\nimport { JWKSVerifierTokenService } from '../../services';\n\nexport class JWKSVerifierAuthenticationStrategy<E extends Env = Env>\n extends BaseHelper\n implements IAuthenticationStrategy<E>\n{\n name = Authentication.STRATEGY_JWT;\n standard = JOSEStandards.JWKS;\n\n constructor(\n @inject({\n key: BindingKeys.build({\n namespace: BindingNamespaces.SERVICE,\n key: JWKSVerifierTokenService.name,\n }),\n })\n private service: JWKSVerifierTokenService<E>,\n ) {\n super({ scope: JWKSVerifierAuthenticationStrategy.name });\n }\n\n authenticate(context: TContext<E, string>): Promise<IAuthUser> {\n const token = this.service.extractCredentials(context);\n return this.service.verify(token);\n }\n}\n"]}

package/dist/components/auth/authenticate/strategies/jws.strategy.d.ts CHANGED Viewed

@@ -10,4 +10,3 @@ export declare class JWSAuthenticationStrategy<E extends Env = Env> extends Base
     constructor(service: JWSTokenService<E>);
     authenticate(context: TContext<E, string>): Promise<IAuthUser>;
 }
-//# sourceMappingURL=jws.strategy.d.ts.map

package/dist/components/auth/authenticate/strategies/jws.strategy.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"jws.strategy.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/strategies/jws.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,wDAA+C;AAC/C,wDAA0D;AAC1D,sDAAyD;AACzD,8DAAuD;AAEvD,wDAK+B;AAC/B,0CAA8C;AAE9C,IAAa,yBAAyB,iCAAtC,MAAa,yBACX,SAAQ,iBAAU;IAMlB,YAOE,OAAmC;QAEnC,KAAK,CAAC,EAAE,KAAK,EAAE,2BAAyB,CAAC,IAAI,EAAE,CAAC,CAAC;QAFzC,YAAO,GAAP,OAAO,CAAoB;QAVrC,SAAI,GAAG,6BAAc,CAAC,YAAY,CAAC;QACnC,aAAQ,GAAG,4BAAa,CAAC,GAAG,CAAC;IAY7B,CAAC;IAED,YAAY,CAAC,OAA4B;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;CACF,CAAA;AAvBY,8DAAyB;oCAAzB,yBAAyB;IAQjC,WAAA,IAAA,qBAAM,EAAC;QACN,GAAG,EAAE,6BAAW,CAAC,KAAK,CAAC;YACrB,SAAS,EAAE,gCAAiB,CAAC,OAAO;YACpC,GAAG,EAAE,0BAAe,CAAC,IAAI;SAC1B,CAAC;KACH,CAAC,CAAA;qCACe,0BAAe;GAdvB,yBAAyB,CAuBrC"}
1	+ {"version":3,"file":"jws.strategy.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/strategies/jws.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,wDAA+C;AAC/C,wDAA0D;AAC1D,sDAAyD;AACzD,8DAAuD;AAEvD,wDAK+B;AAC/B,0CAA8C;AAE9C,IAAa,yBAAyB,iCAAtC,MAAa,yBACX,SAAQ,iBAAU;IAMlB,YAOE,OAAmC;QAEnC,KAAK,CAAC,EAAE,KAAK,EAAE,2BAAyB,CAAC,IAAI,EAAE,CAAC,CAAC;QAFzC,YAAO,GAAP,OAAO,CAAoB;QAVrC,SAAI,GAAG,6BAAc,CAAC,YAAY,CAAC;QACnC,aAAQ,GAAG,4BAAa,CAAC,GAAG,CAAC;IAY7B,CAAC;IAED,YAAY,CAAC,OAA4B;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;CACF,CAAA;AAvBY,8DAAyB;oCAAzB,yBAAyB;IAQjC,WAAA,IAAA,qBAAM,EAAC;QACN,GAAG,EAAE,6BAAW,CAAC,KAAK,CAAC;YACrB,SAAS,EAAE,gCAAiB,CAAC,OAAO;YACpC,GAAG,EAAE,0BAAe,CAAC,IAAI;SAC1B,CAAC;KACH,CAAC,CAAA;qCACe,0BAAe;GAdvB,yBAAyB,CAuBrC","sourcesContent":["import { type TContext } from '@venizia/ignis-kernel';\nimport { inject } from '@venizia/ignis-kernel';\nimport { BindingNamespaces } from '@venizia/ignis-kernel';\nimport { BaseHelper } from '@venizia/ignis-helpers/core';\nimport { BindingKeys } from '@venizia/ignis-inversion';\nimport { type Env } from 'hono';\nimport {\n Authentication,\n type IAuthUser,\n type IAuthenticationStrategy,\n JOSEStandards,\n} from '@venizia/ignis-kernel';\nimport { JWSTokenService } from '../services';\n\nexport class JWSAuthenticationStrategy<E extends Env = Env>\n extends BaseHelper\n implements IAuthenticationStrategy<E>\n{\n name = Authentication.STRATEGY_JWT;\n standard = JOSEStandards.JWS;\n\n constructor(\n @inject({\n key: BindingKeys.build({\n namespace: BindingNamespaces.SERVICE,\n key: JWSTokenService.name,\n }),\n })\n private service: JWSTokenService<E>,\n ) {\n super({ scope: JWSAuthenticationStrategy.name });\n }\n\n authenticate(context: TContext<E, string>): Promise<IAuthUser> {\n const token = this.service.extractCredentials(context);\n return this.service.verify(token);\n }\n}\n"]}

package/dist/components/auth/authenticate/strategies/service.strategy.d.ts CHANGED Viewed

@@ -16,4 +16,3 @@ export declare class ServiceAuthenticationStrategy<E extends Env = Env> extends
     constructor(verifier: ServiceAssertionVerifierService, options: IServiceAuthOptions<E>);
     authenticate(context: TContext<E, string>): Promise<IAuthUser>;
 }
-//# sourceMappingURL=service.strategy.d.ts.map

package/dist/components/auth/authenticate/strategies/service.strategy.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service.strategy.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/strategies/service.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAmE;AACnE,8DAAuD;AAEvD,wDAO+B;AAO/B,2EAAuF;AAEvF;;;;;;GAMG;AACH,IAAa,6BAA6B,qCAA1C,MAAa,6BACX,SAAQ,iBAAU;IAKlB,YAOE,QAA0D,EAE1D,OAAgD;QAEhD,KAAK,CAAC,EAAE,KAAK,EAAE,+BAA6B,CAAC,IAAI,EAAE,CAAC,CAAC;QAJpC,aAAQ,GAAR,QAAQ,CAAiC;QAEzC,YAAO,GAAP,OAAO,CAAwB;QAXlD,SAAI,GAAG,6BAAc,CAAC,gBAAgB,CAAC;IAcvC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAA4B;QAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,+BAAgB,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,mCAAoB,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,iGAAiG;QACjG,oFAAoF;QACpF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC5C,KAAK;YACL,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;YAC1B,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ;SACxC,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE3E,gGAAgG;QAChG,+FAA+F;QAC/F,+FAA+F;QAC/F,6BAA6B;QAC7B,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;iBAC3B,IAAI,CAAC,yDAAyD,EAAE,MAAM,CAAC,CAAC;YAC3E,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,mCAAoB,CAAC,oBAAoB,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,2FAA2F;QAC3F,OAAO,EAAE,GAAG,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AAlDY,sEAA6B;wCAA7B,6BAA6B;IAOrC,WAAA,IAAA,qBAAM,EAAC;QACN,GAAG,EAAE,6BAAW,CAAC,KAAK,CAAC;YACrB,SAAS,EAAE,gCAAiB,CAAC,OAAO;YACpC,GAAG,EAAE,kDAA+B,CAAC,IAAI;SAC1C,CAAC;KACH,CAAC,CAAA;IAED,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,eAAe,EAAE,CAAC,CAAA;qCAD9B,kDAA+B;GAbjD,6BAA6B,CAkDzC"}
1	+ {"version":3,"file":"service.strategy.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/strategies/service.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAmE;AACnE,8DAAuD;AAEvD,wDAO+B;AAO/B,2EAAuF;AAEvF;;;;;;GAMG;AACH,IAAa,6BAA6B,qCAA1C,MAAa,6BACX,SAAQ,iBAAU;IAKlB,YAOE,QAA0D,EAE1D,OAAgD;QAEhD,KAAK,CAAC,EAAE,KAAK,EAAE,+BAA6B,CAAC,IAAI,EAAE,CAAC,CAAC;QAJpC,aAAQ,GAAR,QAAQ,CAAiC;QAEzC,YAAO,GAAP,OAAO,CAAwB;QAXlD,SAAI,GAAG,6BAAc,CAAC,gBAAgB,CAAC;IAcvC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAA4B;QAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,+BAAgB,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,mCAAoB,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,iGAAiG;QACjG,oFAAoF;QACpF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC5C,KAAK;YACL,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;YAC1B,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ;SACxC,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE3E,gGAAgG;QAChG,+FAA+F;QAC/F,+FAA+F;QAC/F,6BAA6B;QAC7B,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;iBAC3B,IAAI,CAAC,yDAAyD,EAAE,MAAM,CAAC,CAAC;YAC3E,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,mCAAoB,CAAC,oBAAoB,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,2FAA2F;QAC3F,OAAO,EAAE,GAAG,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AAlDY,sEAA6B;wCAA7B,6BAA6B;IAOrC,WAAA,IAAA,qBAAM,EAAC;QACN,GAAG,EAAE,6BAAW,CAAC,KAAK,CAAC;YACrB,SAAS,EAAE,gCAAiB,CAAC,OAAO;YACpC,GAAG,EAAE,kDAA+B,CAAC,IAAI;SAC1C,CAAC;KACH,CAAC,CAAA;IAED,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,eAAe,EAAE,CAAC,CAAA;qCAD9B,kDAA+B;GAbjD,6BAA6B,CAkDzC","sourcesContent":["import { BaseHelper, getError } from '@venizia/ignis-helpers/core';\nimport { BindingKeys } from '@venizia/ignis-inversion';\nimport type { Env } from 'hono';\nimport {\n AuthenticateBindingKeys,\n Authentication,\n AuthenticationErrors,\n BindingNamespaces,\n ServiceAssertion,\n inject,\n} from '@venizia/ignis-kernel';\nimport type {\n IAuthUser,\n IAuthenticationStrategy,\n IServiceAuthOptions,\n TContext,\n} from '@venizia/ignis-kernel';\nimport { ServiceAssertionVerifierService } from '../services/service/verifier.service';\n\n/*\n Proves the CALLING SERVICE, from a per-request Ed25519 assertion verified against that caller's\n * own JWKS. No identity round trip and no shared password.\n \n It proves which service called, never which user. `resolvePrincipal` is where the application\n * turns a caller name into one of its own principals.\n */\nexport class ServiceAuthenticationStrategy<E extends Env = Env>\n extends BaseHelper\n implements IAuthenticationStrategy<E>\n{\n name = Authentication.STRATEGY_SERVICE;\n\n constructor(\n @inject({\n key: BindingKeys.build({\n namespace: BindingNamespaces.SERVICE,\n key: ServiceAssertionVerifierService.name,\n }),\n })\n private readonly verifier: ServiceAssertionVerifierService,\n @inject({ key: AuthenticateBindingKeys.SERVICE_OPTIONS })\n private readonly options: IServiceAuthOptions<E>,\n ) {\n super({ scope: ServiceAuthenticationStrategy.name });\n }\n\n async authenticate(context: TContext<E, string>): Promise<IAuthUser> {\n const token = context.req.header(ServiceAssertion.HEADER);\n if (!token) {\n throw getError({ error: AuthenticationErrors.ASSERTION_MISSING });\n }\n\n // The raw url, NOT `context.req.path`: Hono hands that back percent-DECODED, so a route carrying\n // a space or a non-ASCII slug would never match the encoded path the caller signed.\n const { issuer } = await this.verifier.verify({\n token,\n method: context.req.method,\n path: new URL(context.req.url).pathname,\n });\n\n const principal = await this.options.resolvePrincipal({ issuer, context });\n\n // Validated rather than trusted. `executeAnyMode` calls `setCurrentUser` unconditionally, so an\n // application returning a principal without a `userId` would authenticate the request and then\n // fail at the first write, far from here. `executeAllMode` already refuses it; this closes the\n // gap between the two modes.\n if (!principal?.userId) {\n this.logger\n .for(this.authenticate.name)\n .warn('resolvePrincipal returned no usable principal \| iss: %s', issuer);\n throw getError({ error: AuthenticationErrors.PRINCIPAL_UNRESOLVED });\n }\n\n // Which service called is audit-relevant even when the principal is shared across callers.\n return { ...principal, callerService: issuer };\n }\n}\n"]}

package/dist/components/auth/authorize/adapters/base-filtered.d.ts CHANGED Viewed

@@ -28,4 +28,3 @@ export declare abstract class BaseFilteredAdapter<TFilter = ICasbinPolicyFilter>
         lines: string[];
     }): Promise<void>;
 }
-//# sourceMappingURL=base-filtered.d.ts.map

package/dist/components/auth/authorize/adapters/base-filtered.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"base-filtered.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/base-filtered.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAC7C,sDAAyD;AAGzD,8DAA0D;AAC1D,2CAAsD;AAGtD,0LAA0L;AAC1L,MAAsB,mBACpB,SAAQ,iBAAU;IAKlB,YAAY,IAAwD;QAClE,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;IAED,IAAc,SAAS;QACrB,OAAO,mCAAuB,CAAC,OAAO,CAAC;YACrC,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,MAAM,EAAE,qBAAqB;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,2LAA2L;IACjL,KAAK,CAAC,KAAK,CAAO,IAAwB;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5D,OAAO,IAAA,0BAAc,EAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1C,CAAC;IAKD,UAAU;QACR,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,UAAU,KAAmB,CAAC;IACpC,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,SAAS,KAAmB,CAAC;IACnC,KAAK,CAAC,YAAY,KAAmB,CAAC;IACtC,KAAK,CAAC,oBAAoB,KAAmB,CAAC;IAE9C,+FAA+F;IACrF,KAAK,CAAC,SAAS,CAAC,IAAuC;QAC/D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,4BAAY,CAAC,IAAI,EAAE,CAAC;QAC7C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;CACF;AA/CD,kDA+CC"}
1	+ {"version":3,"file":"base-filtered.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/base-filtered.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAC7C,sDAAyD;AAGzD,8DAA0D;AAC1D,2CAAsD;AAGtD,0LAA0L;AAC1L,MAAsB,mBACpB,SAAQ,iBAAU;IAKlB,YAAY,IAAwD;QAClE,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;IAED,IAAc,SAAS;QACrB,OAAO,mCAAuB,CAAC,OAAO,CAAC;YACrC,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,MAAM,EAAE,qBAAqB;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,2LAA2L;IACjL,KAAK,CAAC,KAAK,CAAO,IAAwB;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5D,OAAO,IAAA,0BAAc,EAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1C,CAAC;IAKD,UAAU;QACR,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,UAAU,KAAmB,CAAC;IACpC,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,SAAS,KAAmB,CAAC;IACnC,KAAK,CAAC,YAAY,KAAmB,CAAC;IACtC,KAAK,CAAC,oBAAoB,KAAmB,CAAC;IAE9C,+FAA+F;IACrF,KAAK,CAAC,SAAS,CAAC,IAAuC;QAC/D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,4BAAY,CAAC,IAAI,EAAE,CAAC;QAC7C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;CACF;AA/CD,kDA+CC","sourcesContent":["import { readResultRows } from '@/utilities';\nimport { BaseHelper } from '@venizia/ignis-helpers/core';\nimport { type FilteredAdapter, type Model } from 'casbin';\nimport type { SQL } from 'drizzle-orm';\nimport { CasbinModule } from '../enforcers/casbin-module';\nimport { PolicyConnectorResolver } from './connector';\nimport type { ICasbinPolicyFilter, ICasbinPolicySource, TCasbinPolicyConnector } from './common';\n\n/** Read-only base for casbin FilteredAdapters backed by a datasource - owns connector plumbing and no-op write methods; subclasses implement {@link loadFilteredPolicy} per principal. /\nexport abstract class BaseFilteredAdapter<TFilter = ICasbinPolicyFilter>\n extends BaseHelper\n implements FilteredAdapter\n{\n protected readonly dataSource: ICasbinPolicySource;\n\n constructor(opts: { scope: string; dataSource: ICasbinPolicySource }) {\n super({ scope: opts.scope });\n this.dataSource = opts.dataSource;\n }\n\n protected get connector(): TCasbinPolicyConnector {\n return PolicyConnectorResolver.resolve({\n source: this.dataSource,\n caller: 'BaseFilteredAdapter',\n });\n }\n\n /* Runs a raw statement and returns its rows. Drizzle's `execute()` shape differs per driver (node-postgres `{ rows }`, postgres-js the row list itself) - never read `.rows` directly. /\n protected async query<TRow>(opts: { statement: SQL }): Promise<TRow[]> {\n const result = await this.connector.execute(opts.statement);\n return readResultRows<TRow>({ result });\n }\n\n /* Load ONLY the policies matching `filter` into `model` (the store is read for one principal). /\n abstract loadFilteredPolicy(model: Model, filter: TFilter): Promise<void>;\n\n isFiltered(): boolean {\n return true;\n }\n\n // Read-only adapter - write methods are intentional no-ops.\n async loadPolicy(): Promise<void> {}\n async savePolicy(): Promise<boolean> {\n return true;\n }\n async addPolicy(): Promise<void> {}\n async removePolicy(): Promise<void> {}\n async removeFilteredPolicy(): Promise<void> {}\n\n /* Parse + load casbin policy lines into a model. Shared by subclasses' loadFilteredPolicy. */\n protected async loadLines(opts: { model: Model; lines: string[] }): Promise<void> {\n const { Helper } = await CasbinModule.load();\n for (const line of opts.lines) {\n Helper.loadPolicyLine(line, opts.model);\n }\n }\n}\n"]}

package/dist/components/auth/authorize/adapters/common/index.d.ts CHANGED Viewed

	@@ -1,2 +1 @@
1 1	export * from './types';
2	- //# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authorize/adapters/common/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/common/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB"}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/common/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB","sourcesContent":["export * from './types';\n"]}

package/dist/components/auth/authorize/adapters/common/types.d.ts CHANGED Viewed

@@ -46,4 +46,3 @@ export interface IScopedCasbinEntities {
         columnName: string;
     };
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/components/auth/authorize/adapters/common/types.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/common/types.ts"],"names":[],"mappings":""}
1	+ {"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authorize/adapters/common/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { IdType } from '@/base';\nimport type { AnyType } from '@venizia/ignis-helpers/common';\nimport type { PgDatabase, PgQueryResultHKT } from 'drizzle-orm/pg-core';\n\n/** Filter passed to loadFilteredPolicy: which principal's policies to load. /\nexport interface ICasbinPolicyFilter {\n principal: { type: string; id: IdType };\n}\n\n/* Drizzle connector for policy queries, typed on the shared `PgDatabase` base so postgres-js fits too. Declared here rather than imported from `@/connectors/postgres`: components depend on a minimal local contract, never a connector class. /\nexport type TCasbinPolicyConnector = PgDatabase<PgQueryResultHKT, Record<string, AnyType>>;\n\n/* Minimal source the adapters depend on - any drizzle-backed datasource satisfies it. /\nexport interface ICasbinPolicySource {\n /* Preferred: lazily wires the driver on first read and survives pool rotation, mirroring repositories. /\n getConnector?(): TCasbinPolicyConnector;\n\n /* Back-compat: a pre-wired connector. Prefer getConnector on a real datasource. /\n connector?: TCasbinPolicyConnector;\n}\n\n/* Maps a logical table onto its physical name + schema. /\nexport interface IScopedCasbinTable {\n tableName: string;\n schemaName?: string;\n}\n\n/* All physical mapping the ScopedCasbinAdapter needs. App provides this; framework stays decoupled. /\nexport interface IScopedCasbinEntities {\n policyDefinition: IScopedCasbinTable & {\n metadata?: { columnName: string };\n };\n\n /* Permission catalog (id, code, ...). /\n permission: IScopedCasbinTable;\n\n /* Principal type labels used as casbin name prefixes. /\n principals: { user: string; role: string };\n\n /* Domain type labels (e.g. ['Merchant', 'Organizer']). /\n domainTypes: string[];\n\n /* Soft-delete handling for both tables. */\n softDelete?: { use: false } \| { use: true; columnName: string };\n}\n"]}

package/dist/components/auth/authorize/adapters/connector.d.ts CHANGED Viewed

@@ -7,4 +7,3 @@ export declare class PolicyConnectorResolver {
         caller: string;
     }): TCasbinPolicyConnector;
 }
-//# sourceMappingURL=connector.d.ts.map

package/dist/components/auth/authorize/adapters/connector.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"connector.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/connector.ts"],"names":[],"mappings":";;;AAAA,sDAAuD;AAGvD,iGAAiG;AACjG,MAAa,uBAAuB;IAClC,2DAA2D;IAC3D,MAAM,CAAC,OAAO,CAAC,IAAqD;QAClE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,EAAE,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC;QAE7D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,IAAI,MAAM,gJAAgJ;aACpK,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAdD,0DAcC"}
1	+ {"version":3,"file":"connector.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/connector.ts"],"names":[],"mappings":";;;AAAA,sDAAuD;AAGvD,iGAAiG;AACjG,MAAa,uBAAuB;IAClC,2DAA2D;IAC3D,MAAM,CAAC,OAAO,CAAC,IAAqD;QAClE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,EAAE,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC;QAE7D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,IAAI,MAAM,gJAAgJ;aACpK,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAdD,0DAcC","sourcesContent":["import { getError } from '@venizia/ignis-helpers/core';\nimport type { ICasbinPolicySource, TCasbinPolicyConnector } from './common';\n\n/** Connector-resolution logic shared by every adapter/loader reading the casbin policy store. /\nexport class PolicyConnectorResolver {\n /* Resolve the wired connector off a policy datasource. */\n static resolve(opts: { source: ICasbinPolicySource; caller: string }): TCasbinPolicyConnector {\n const { source, caller } = opts;\n const resolved = source.getConnector?.() ?? source.connector;\n\n if (!resolved) {\n throw getError({\n message: `[${caller}] datasource exposes neither a getConnector() accessor nor a wired connector - pass a datasource whose getConnector() lazily wires the driver.`,\n });\n }\n\n return resolved;\n }\n}\n"]}

package/dist/components/auth/authorize/adapters/custom-grant-expander.d.ts CHANGED Viewed

@@ -49,4 +49,3 @@ export declare class CustomGrantExpander extends BaseHelper {
     /** Resolve `(subject, method)` pairs to catalogued operations. One query for the whole extraction. */
     private queryOperationCatalog;
 }
-//# sourceMappingURL=custom-grant-expander.d.ts.map

package/dist/components/auth/authorize/adapters/custom-grant-expander.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"custom-grant-expander.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/custom-grant-expander.ts"],"names":[],"mappings":";;;AACA,2CAA6C;AAC7C,sDAAyD;AACzD,wDAM+B;AAC/B,6CAA4C;AAC5C,2CAAsD;AAGtD,MAAM,cAAc,GAAG,QAAQ,CAAC;AAWhC;;;;GAIG;AACH,MAAa,mBAAoB,SAAQ,iBAAU;IAKjD,YAAY,IAGX;QACC,KAAK,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC7C,CAAC;IAED,yFAAyF;IACzF,eAAe,CAAC,IAKf;QACC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;QAEjE,IAAI,cAAc,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1C,OAAO,qIAAqI,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QAC1L,CAAC;QAED,IAAI,cAAc,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9B,OAAO,8GAA8G,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QACnK,CAAC;QAED,IAAI,CAAC,cAAc,IAAI,MAAM,EAAE,CAAC;YAC9B,OAAO,+DAA+D,mCAAoB,CAAC,MAAM,+CAA+C,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QAC9L,CAAC;QAED,IAAI,GAAG,CAAC,YAAY,KAAK,6CAA8B,CAAC,oBAAoB,EAAE,CAAC;YAC7E,OAAO,0FAA0F,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QAC/I,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4NAA4N;IAC5N,KAAK,CAAC,kBAAkB,CAAC,IAGxB;QACC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YAC5B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QACvC,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,KAAK,GAA+C,EAAE,CAAC;QAE7D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAC/C,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAChE,CAAC;QAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACvD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QACzF,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAClC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,2BAAY,CAAC,WAAW,EAAE,CAAC,sBAAsB,CAAC;gBAC3E,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,OAAO,EAAE,GAAG,CAAC,aAAa;gBAC1B,OAAO;aACR,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,UAAU,CAAC,IAAI,CACb,oEAAoE,GAAG,CAAC,SAAS,gBAAgB,GAAG,CAAC,aAAa,eAAe,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtJ,CAAC;YACJ,CAAC;YAED,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,aAAa,IAAI,EAAE,EAAE,CAAE,CAAC;gBAEvD,KAAK,CAAC,IAAI,CACR,GAAG,0CAA2B,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAChJ,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC/B,CAAC;IAED,uGAAuG;IAC/F,cAAc,CAAC,IAA2D;QAChF,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QACvB,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,IAAI,cAAc,CAAC;QAClD,OAAO,IAAA,iBAAG,EAAA,GAAG,iBAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,iBAAG,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,4LAA4L;IACpL,gBAAgB,CAAC,IAAuB;QAC9C,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAC3B,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;YACb,OAAO,iBAAG,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QAED,OAAO,IAAA,iBAAG,EAAA,QAAQ,iBAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,iBAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;IACnF,CAAC;IAED,sGAAsG;IAC9F,KAAK,CAAC,qBAAqB,CAAC,IAEnC;QACC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACvB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,mCAAuB,CAAC,OAAO,CAAC;YAChD,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,MAAM,EAAE,mBAAmB,CAAC,IAAI;SACjC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,IAAA,iBAAG,EAAA;;aAEjC,eAAe;0DAC8B,iBAAG,CAAC,IAAI,CAC1D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAA,iBAAG,EAAA,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,EAC9D,IAAA,iBAAG,EAAA,IAAI,CACR;mCAC4B,6CAA8B,CAAC,oBAAoB,GAAG,IAAI,CAAC,gBAAgB,CACpG,EAAE,KAAK,EAAE,YAAY,EAAE,CACxB;KACJ,CAAC,CAAC;QAEH,OAAO,IAAA,0BAAc,EAAoE;YACvF,MAAM;SACP,CAAC,CAAC;IACL,CAAC;CACF;AAlJD,kDAkJC"}
1	+ {"version":3,"file":"custom-grant-expander.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/custom-grant-expander.ts"],"names":[],"mappings":";;;AACA,2CAA6C;AAC7C,sDAAyD;AACzD,wDAM+B;AAC/B,6CAA4C;AAC5C,2CAAsD;AAGtD,MAAM,cAAc,GAAG,QAAQ,CAAC;AAWhC;;;;GAIG;AACH,MAAa,mBAAoB,SAAQ,iBAAU;IAKjD,YAAY,IAGX;QACC,KAAK,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC7C,CAAC;IAED,yFAAyF;IACzF,eAAe,CAAC,IAKf;QACC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;QAEjE,IAAI,cAAc,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1C,OAAO,qIAAqI,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QAC1L,CAAC;QAED,IAAI,cAAc,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9B,OAAO,8GAA8G,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QACnK,CAAC;QAED,IAAI,CAAC,cAAc,IAAI,MAAM,EAAE,CAAC;YAC9B,OAAO,+DAA+D,mCAAoB,CAAC,MAAM,+CAA+C,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QAC9L,CAAC;QAED,IAAI,GAAG,CAAC,YAAY,KAAK,6CAA8B,CAAC,oBAAoB,EAAE,CAAC;YAC7E,OAAO,0FAA0F,GAAG,CAAC,SAAS,cAAc,GAAG,CAAC,UAAU,EAAE,CAAC;QAC/I,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4NAA4N;IAC5N,KAAK,CAAC,kBAAkB,CAAC,IAGxB;QACC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YAC5B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QACvC,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,KAAK,GAA+C,EAAE,CAAC;QAE7D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAC/C,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAChE,CAAC;QAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,GAAG,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACvD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QACzF,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAClC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,2BAAY,CAAC,WAAW,EAAE,CAAC,sBAAsB,CAAC;gBAC3E,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,OAAO,EAAE,GAAG,CAAC,aAAa;gBAC1B,OAAO;aACR,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,UAAU,CAAC,IAAI,CACb,oEAAoE,GAAG,CAAC,SAAS,gBAAgB,GAAG,CAAC,aAAa,eAAe,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtJ,CAAC;YACJ,CAAC;YAED,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,aAAa,IAAI,EAAE,EAAE,CAAE,CAAC;gBAEvD,KAAK,CAAC,IAAI,CACR,GAAG,0CAA2B,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAChJ,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC/B,CAAC;IAED,uGAAuG;IAC/F,cAAc,CAAC,IAA2D;QAChF,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QACvB,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,IAAI,cAAc,CAAC;QAClD,OAAO,IAAA,iBAAG,EAAA,GAAG,iBAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,iBAAG,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,4LAA4L;IACpL,gBAAgB,CAAC,IAAuB;QAC9C,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAC3B,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;YACb,OAAO,iBAAG,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QAED,OAAO,IAAA,iBAAG,EAAA,QAAQ,iBAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,iBAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;IACnF,CAAC;IAED,sGAAsG;IAC9F,KAAK,CAAC,qBAAqB,CAAC,IAEnC;QACC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACvB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,mCAAuB,CAAC,OAAO,CAAC;YAChD,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,MAAM,EAAE,mBAAmB,CAAC,IAAI;SACjC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,IAAA,iBAAG,EAAA;;aAEjC,eAAe;0DAC8B,iBAAG,CAAC,IAAI,CAC1D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAA,iBAAG,EAAA,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,EAC9D,IAAA,iBAAG,EAAA,IAAI,CACR;mCAC4B,6CAA8B,CAAC,oBAAoB,GAAG,IAAI,CAAC,gBAAgB,CACpG,EAAE,KAAK,EAAE,YAAY,EAAE,CACxB;KACJ,CAAC,CAAC;QAEH,OAAO,IAAA,0BAAc,EAAoE;YACvF,MAAM;SACP,CAAC,CAAC;IACL,CAAC;CACF;AAlJD,kDAkJC","sourcesContent":["import type { IdType } from '@/base';\nimport { readResultRows } from '@/utilities';\nimport { BaseHelper } from '@venizia/ignis-helpers/core';\nimport {\n AuthorizationActions,\n AuthorizationPermissionBuilder,\n AuthorizationPolicyVariants,\n GrantBuilder,\n type TCustomGrantMetadata,\n} from '@venizia/ignis-kernel';\nimport { sql, type SQL } from 'drizzle-orm';\nimport { PolicyConnectorResolver } from './connector';\nimport type { ICasbinPolicySource, IScopedCasbinEntities } from './common';\n\nconst DEFAULT_SCHEMA = 'public';\n\n/** A custom row that survived {@link CustomGrantExpander.rejectCustomRow}, ready for op-to-catalog resolution. /\nexport type TCustomGrantRow = {\n subjectId: IdType;\n objectSubject: string;\n ops: string[];\n domain: string;\n effect: string;\n};\n\n/\n Expands \"custom\" operation-subset grants (`metadata.ops`) into one casbin line per catalogued\n * operation. Isolated from the filtered-policy loader on purpose: it owns its own SQL\n * (`queryOperationCatalog`) and error vocabulary, and never reaches back into ScopedCasbinAdapter.\n /\nexport class CustomGrantExpander extends BaseHelper {\n protected readonly dataSource: ICasbinPolicySource;\n protected readonly permission: IScopedCasbinEntities['permission'];\n protected readonly softDelete: IScopedCasbinEntities['softDelete'];\n\n constructor(opts: {\n dataSource: ICasbinPolicySource;\n entities: Pick<IScopedCasbinEntities, 'permission' \| 'softDelete'>;\n }) {\n super({ scope: CustomGrantExpander.name });\n this.dataSource = opts.dataSource;\n this.permission = opts.entities.permission;\n this.softDelete = opts.entities.softDelete;\n }\n\n /* Why a custom-looking grant row cannot be honoured, or null when it is well formed. /\n rejectCustomRow(opts: {\n row: { subjectId: IdType; objectCode: string; objectMethod: string };\n parsed: TCustomGrantMetadata \| null;\n isCustomAction: boolean;\n metadataColumnName?: string;\n }): string \| null {\n const { row, parsed, isCustomAction, metadataColumnName } = opts;\n\n if (isCustomAction && !metadataColumnName) {\n return `Skipping custom grant - entities.policyDefinition.metadata.columnName is not mapped, so metadata.ops cannot be read \| subject id: ${row.subjectId} \| object: ${row.objectCode}`;\n }\n\n if (isCustomAction && !parsed) {\n return `Skipping custom grant - metadata.ops is missing, empty, or not an array of non-empty strings \| subject id: ${row.subjectId} \| object: ${row.objectCode}`;\n }\n\n if (!isCustomAction && parsed) {\n return `Skipping grant - metadata.ops is present but action is not \"${AuthorizationActions.CUSTOM}\", so the intent is ambiguous \| subject id: ${row.subjectId} \| object: ${row.objectCode}`;\n }\n\n if (row.objectMethod !== AuthorizationPermissionBuilder.RESOURCE_NODE_METHOD) {\n return `Skipping custom grant - the target must be a subject-level resource node \| subject id: ${row.subjectId} \| object: ${row.objectCode}`;\n }\n\n return null;\n }\n\n /* Resolve every custom row's ops in one catalog query, then emit one line per resolved operation. Unresolvable ops come back as `rejections` rather than being logged here - the caller owns the logger the tests swap. /\n async expandCustomGrants(opts: {\n subjectType: string;\n customRows: TCustomGrantRow[];\n }): Promise<{ lines: string[]; rejections: string[] }> {\n if (!opts.customRows.length) {\n return { lines: [], rejections: [] };\n }\n\n const seen = new Set<string>();\n const pairs: Array<{ subject: string; method: string }> = [];\n\n const candidates = opts.customRows.flatMap(row =>\n row.ops.map(op => ({ subject: row.objectSubject, method: op })),\n );\n\n for (const candidate of candidates) {\n const key = `${candidate.subject}.${candidate.method}`;\n if (seen.has(key)) {\n continue;\n }\n\n seen.add(key);\n pairs.push(candidate);\n }\n\n const catalog = await this.queryOperationCatalog({ pairs });\n const byKey = new Map(catalog.map(entry => [`${entry.subject}.${entry.method}`, entry]));\n const lines: string[] = [];\n const rejections: string[] = [];\n\n for (const row of opts.customRows) {\n const { valid, unknown } = GrantBuilder.getInstance().validateCustomGrantOps({\n ops: row.ops,\n subject: row.objectSubject,\n catalog,\n });\n\n if (unknown.length) {\n rejections.push(\n `Skipping unresolvable operations in a custom grant \| subject id: ${row.subjectId} \| resource: ${row.objectSubject} \| unknown: ${unknown.join(', ')}`,\n );\n }\n\n for (const op of valid) {\n const entry = byKey.get(`${row.objectSubject}.${op}`)!;\n\n lines.push(\n `${AuthorizationPolicyVariants.GRANT.rule}, ${opts.subjectType}_${row.subjectId}, ${row.domain}, ${entry.code}, ${entry.action}, ${row.effect}`,\n );\n }\n }\n\n return { lines, rejections };\n }\n\n /* Schema-qualified table reference (`\"<schema>\".\"<table>\"`) for use after FROM/JOIN with an alias. /\n private qualifiedTable(opts: { table: { schemaName?: string; tableName: string } }): SQL {\n const { table } = opts;\n const schema = table.schemaName ?? DEFAULT_SCHEMA;\n return sql`${sql.identifier(schema)}.${sql.identifier(table.tableName)}`;\n }\n\n /* `AND <alias>.<col> IS NULL` when soft-delete is on, else empty. The alias is emitted raw to match the unquoted FROM alias - quoting folds it to a different case and breaks the join. /\n private softDeleteClause(opts: { alias: string }): SQL {\n const sd = this.softDelete;\n if (!sd?.use) {\n return sql.empty();\n }\n\n return sql` AND ${sql.raw(opts.alias)}.${sql.identifier(sd.columnName)} IS NULL`;\n }\n\n /* Resolve `(subject, method)` pairs to catalogued operations. One query for the whole extraction. */\n private async queryOperationCatalog(opts: {\n pairs: Array<{ subject: string; method: string }>;\n }): Promise<Array<{ subject: string; method: string; code: string; action: string }>> {\n if (!opts.pairs.length) {\n return [];\n }\n\n const permissionTable = this.qualifiedTable({ table: this.permission });\n const connector = PolicyConnectorResolver.resolve({\n source: this.dataSource,\n caller: CustomGrantExpander.name,\n });\n\n const result = await connector.execute(sql`\n SELECT permission.subject, permission.method, permission.code, permission.action\n FROM ${permissionTable} permission\n WHERE (permission.subject, permission.method) IN (${sql.join(\n opts.pairs.map(pair => sql`(${pair.subject}, ${pair.method})`),\n sql`, `,\n )})\n AND permission.method <> ${AuthorizationPermissionBuilder.RESOURCE_NODE_METHOD}${this.softDeleteClause(\n { alias: 'permission' },\n )}\n `);\n\n return readResultRows<{ subject: string; method: string; code: string; action: string }>({\n result,\n });\n }\n}\n"]}

package/dist/components/auth/authorize/adapters/index.d.ts CHANGED Viewed

@@ -3,4 +3,3 @@ export * from './common';
 export * from './connector';
 export * from './custom-grant-expander';
 export * from './scoped-casbin';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authorize/adapters/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kDAAgC;AAChC,2CAAyB;AACzB,8CAA4B;AAC5B,0DAAwC;AACxC,kDAAgC"}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authorize/adapters/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kDAAgC;AAChC,2CAAyB;AACzB,8CAA4B;AAC5B,0DAAwC;AACxC,kDAAgC","sourcesContent":["export * from './base-filtered';\nexport * from './common';\nexport * from './connector';\nexport * from './custom-grant-expander';\nexport * from './scoped-casbin';\n"]}

package/dist/components/auth/authorize/adapters/scoped-casbin/adapter.d.ts CHANGED Viewed

@@ -90,4 +90,3 @@ export declare class ScopedCasbinAdapter extends BaseFilteredAdapter<IScopedCasb
     /** The two code-fixed structural trees only (`g4` resource, `g5` action) - constant regardless of tenant count. Domain edges (`g3`) grow with the domain count, so they are principal-scoped in {@link queryPrincipalPolicies} instead. */
     protected queryEdgePolicies(): Promise<string[]>;
 }
-//# sourceMappingURL=adapter.d.ts.map