@venizia/ignis 0.4.3 → 0.4.5

package/dist/components/auth/authenticate/services/service/signer.service.js

@@ -1,138 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-var ServiceAssertionSignerService_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ServiceAssertionSignerService = void 0;
-const metadata_1 = require("../../../../../base/metadata");
-const ignis_kernel_1 = require("@venizia/ignis-kernel");
-const core_1 = require("@venizia/ignis-helpers/core");
-const common_1 = require("@venizia/ignis-helpers/common");
-const promises_1 = require("node:fs/promises");
-const ignis_kernel_2 = require("@venizia/ignis-kernel");
-const jose_loader_1 = require("../jose-loader");
-/**
- * Mints the outgoing assertion, and publishes the public half for callees to verify against.
- *
- * Only a service that CALLS OUT needs this. `isEnabled()` is false when the application configured
- * no keys, and the component then mounts no certs route.
- */
-let ServiceAssertionSignerService = ServiceAssertionSignerService_1 = class ServiceAssertionSignerService extends ignis_kernel_1.BaseService {
-    constructor(options) {
-        super({ scope: ServiceAssertionSignerService_1.name });
-        this.options = options;
-        this.requestIdGenerator = new core_1.RequestIdGenerator({
-            scope: ServiceAssertionSignerService_1.name,
-        });
-    }
-    isEnabled() {
-        return Boolean(this.options.keys);
-    }
-    /** `<name>_<rest path without its slash>`, so a rotated mount changes the kid rather than colliding. */
-    getKeyId() {
-        const restPath = this.options.rest?.path ?? ignis_kernel_1.ServiceAssertion.DEFAULT_REST_PATH;
-        return this.options.keys?.kid ?? `${this.options.name}_${restPath.replace(/^\//, '')}`;
-    }
-    /**
-     * One assertion, bound to this exact call.
-     *
-     * `path` must be the percent-ENCODED pathname - `new URL(target).pathname`. The verifier compares
-     * against the same shape, and a decoded path here would fail every route carrying a space or a
-     * non-ASCII slug.
-     */
-    async sign(opts) {
-        const { method, path, audience } = opts;
-        this.assertEnabled();
-        const { SignJWT } = await jose_loader_1.JoseLoader.load();
-        const now = Math.floor(Date.now() / 1000);
-        const lifetime = this.options.signLifetimeSeconds ?? ignis_kernel_1.ServiceAssertion.DEFAULT_SIGN_LIFETIME_SECONDS;
-        return new SignJWT({ htm: method.toUpperCase(), htu: path })
-            .setProtectedHeader({
-            alg: ignis_kernel_1.ServiceAssertion.ALGORITHM,
-            kid: this.getKeyId(),
-            typ: ignis_kernel_1.ServiceAssertion.TYP,
-        })
-            .setIssuer(this.options.name)
-            .setSubject(this.options.name)
-            .setAudience(audience)
-            .setJti(this.requestIdGenerator.nextId())
-            .setIssuedAt(now)
-            .setExpirationTime(now + lifetime)
-            .sign(await this.resolvePrivateKey());
-    }
-    /**
-     * The document `/svc-certs` serves, built from the PUBLIC key only.
-     *
-     * `importSPKI` refuses a private PEM outright, which is what makes the private half unreachable
-     * from here by construction rather than by care. The JWK format is deliberately NOT accepted for
-     * this path: `importJWK` imports whatever it is handed, and a private JWK marked `"ext": true`
-     * round-trips its `d` straight into this document. See `JWKSIssuerTokenService.assertPublicJWK`.
-     */
-    async getPublicJWKS() {
-        if (this.jwks) {
-            return this.jwks;
-        }
-        this.assertEnabled();
-        const { exportJWK, importSPKI } = await jose_loader_1.JoseLoader.load();
-        const raw = await this.readKey({ source: this.options.keys.public });
-        const publicKey = await importSPKI(raw, ignis_kernel_1.ServiceAssertion.ALGORITHM);
-        const jwk = await exportJWK(publicKey);
-        if (jwk.d !== undefined) {
-            throw (0, core_1.getError)({
-                statusCode: common_1.HTTP.ResultCodes.RS_5.InternalServerError,
-                message: `[${ServiceAssertionSignerService_1.name}] The public key material carries a private exponent | this key would be published at the certs endpoint`,
-            });
-        }
-        this.jwks = {
-            keys: [{ ...jwk, kid: this.getKeyId(), alg: ignis_kernel_1.ServiceAssertion.ALGORITHM, use: 'sig' }],
-        };
-        return this.jwks;
-    }
-    async resolvePrivateKey() {
-        if (this.privateKey) {
-            return this.privateKey;
-        }
-        const { importPKCS8 } = await jose_loader_1.JoseLoader.load();
-        const raw = await this.readKey({ source: this.options.keys.private });
-        this.privateKey = await importPKCS8(raw, ignis_kernel_1.ServiceAssertion.ALGORITHM);
-        return this.privateKey;
-    }
-    async readKey(opts) {
-        const { format, driver } = this.options.keys;
-        if (format !== ignis_kernel_2.JWKSKeyFormats.PEM) {
-            throw (0, core_1.getError)({
-                statusCode: common_1.HTTP.ResultCodes.RS_5.InternalServerError,
-                message: `[${ServiceAssertionSignerService_1.name}] Only the '${ignis_kernel_2.JWKSKeyFormats.PEM}' key format is supported | got: ${format}`,
-            });
-        }
-        if (driver === ignis_kernel_2.JWKSKeyDrivers.FILE) {
-            return (0, promises_1.readFile)(opts.source, 'utf-8');
-        }
-        return opts.source;
-    }
-    assertEnabled() {
-        if (this.options.keys) {
-            return;
-        }
-        throw (0, core_1.getError)({
-            statusCode: common_1.HTTP.ResultCodes.RS_5.InternalServerError,
-            message: `[${ServiceAssertionSignerService_1.name}] This service has no signing keys | it can verify assertions but not mint them`,
-        });
-    }
-};
-exports.ServiceAssertionSignerService = ServiceAssertionSignerService;
-exports.ServiceAssertionSignerService = ServiceAssertionSignerService = ServiceAssertionSignerService_1 = __decorate([
-    __param(0, (0, metadata_1.inject)({ key: ignis_kernel_1.AuthenticateBindingKeys.SERVICE_OPTIONS })),
-    __metadata("design:paramtypes", [Object])
-], ServiceAssertionSignerService);
-//# sourceMappingURL=signer.service.js.map

package/dist/components/auth/authenticate/services/service/signer.service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"signer.service.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/service/signer.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8CAAyC;AACzC,wDAA+F;AAE/F,sDAA2E;AAC3E,0DAAqD;AAErD,+CAA4C;AAC5C,wDAAuE;AACvE,gDAA4C;AAE5C;;;;;GAKG;AACH,IAAa,6BAA6B,qCAA1C,MAAa,6BAA8B,SAAQ,0BAAW;IAQ5D,YAEE,OAA6C;QAE7C,KAAK,CAAC,EAAE,KAAK,EAAE,+BAA6B,CAAC,IAAI,EAAE,CAAC,CAAC;QAFpC,YAAO,GAAP,OAAO,CAAqB;QAT9B,uBAAkB,GAAG,IAAI,yBAAkB,CAAC;YAC3D,KAAK,EAAE,+BAA6B,CAAC,IAAI;SAC1C,CAAC,CAAC;IAUH,CAAC;IAED,SAAS;QACP,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,wGAAwG;IACxG,QAAQ;QACN,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,+BAAgB,CAAC,iBAAiB,CAAC;QAC/E,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;IACzF,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,IAAwD;QACjE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QAExC,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,QAAQ,GACZ,IAAI,CAAC,OAAO,CAAC,mBAAmB,IAAI,+BAAgB,CAAC,6BAA6B,CAAC;QAErF,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;aACzD,kBAAkB,CAAC;YAClB,GAAG,EAAE,+BAAgB,CAAC,SAAS;YAC/B,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE;YACpB,GAAG,EAAE,+BAAgB,CAAC,GAAG;SAC1B,CAAC;aACD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;aAC5B,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;aAC7B,WAAW,CAAC,QAAQ,CAAC;aACrB,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;aACxC,WAAW,CAAC,GAAG,CAAC;aAChB,iBAAiB,CAAC,GAAG,GAAG,QAAQ,CAAC;aACjC,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa;QACjB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,+BAAgB,CAAC,SAAS,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;QAEvC,IAAI,GAAG,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,IAAI,+BAA6B,CAAC,IAAI,0GAA0G;aAC1J,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAI,GAAG;YACV,IAAI,EAAE,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,+BAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;SACtF,CAAC;QAEF,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,+BAAgB,CAAC,SAAS,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAwB;QAC5C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC;QAE9C,IAAI,MAAM,KAAK,6BAAc,CAAC,GAAG,EAAE,CAAC;YAClC,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,IAAI,+BAA6B,CAAC,IAAI,eAAe,6BAAc,CAAC,GAAG,oCAAoC,MAAM,EAAE;aAC7H,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,KAAK,6BAAc,CAAC,IAAI,EAAE,CAAC;YACnC,OAAO,IAAA,mBAAQ,EAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,aAAa;QACnB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,MAAM,IAAA,eAAQ,EAAC;YACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,IAAI,+BAA6B,CAAC,IAAI,iFAAiF;SACjI,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAjIY,sEAA6B;wCAA7B,6BAA6B;IASrC,WAAA,IAAA,iBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,eAAe,EAAE,CAAC,CAAA;;GAThD,6BAA6B,CAiIzC","sourcesContent":["import { inject } from '@/base/metadata';\nimport { AuthenticateBindingKeys, BaseService, ServiceAssertion } from '@venizia/ignis-kernel';\nimport type { IServiceAuthOptions } from '@venizia/ignis-kernel';\nimport { getError, RequestIdGenerator } from '@venizia/ignis-helpers/core';\nimport { HTTP } from '@venizia/ignis-helpers/common';\nimport type { CryptoKey, JWK } from 'jose';\nimport { readFile } from 'node:fs/promises';\nimport { JWKSKeyDrivers, JWKSKeyFormats } from '@venizia/ignis-kernel';\nimport { JoseLoader } from '../jose-loader';\n\n/**\n * Mints the outgoing assertion, and publishes the public half for callees to verify against.\n *\n * Only a service that CALLS OUT needs this. `isEnabled()` is false when the application configured\n * no keys, and the component then mounts no certs route.\n */\nexport class ServiceAssertionSignerService extends BaseService {\n  private readonly requestIdGenerator = new RequestIdGenerator({\n    scope: ServiceAssertionSignerService.name,\n  });\n\n  private privateKey?: CryptoKey;\n  private jwks?: { keys: JWK[] };\n\n  constructor(\n    @inject({ key: AuthenticateBindingKeys.SERVICE_OPTIONS })\n    private readonly options: IServiceAuthOptions,\n  ) {\n    super({ scope: ServiceAssertionSignerService.name });\n  }\n\n  isEnabled(): boolean {\n    return Boolean(this.options.keys);\n  }\n\n  /** `<name>_<rest path without its slash>`, so a rotated mount changes the kid rather than colliding. */\n  getKeyId(): string {\n    const restPath = this.options.rest?.path ?? ServiceAssertion.DEFAULT_REST_PATH;\n    return this.options.keys?.kid ?? `${this.options.name}_${restPath.replace(/^\\//, '')}`;\n  }\n\n  /**\n   * One assertion, bound to this exact call.\n   *\n   * `path` must be the percent-ENCODED pathname - `new URL(target).pathname`. The verifier compares\n   * against the same shape, and a decoded path here would fail every route carrying a space or a\n   * non-ASCII slug.\n   */\n  async sign(opts: { method: string; path: string; audience: string }): Promise<string> {\n    const { method, path, audience } = opts;\n\n    this.assertEnabled();\n\n    const { SignJWT } = await JoseLoader.load();\n    const now = Math.floor(Date.now() / 1000);\n    const lifetime =\n      this.options.signLifetimeSeconds ?? ServiceAssertion.DEFAULT_SIGN_LIFETIME_SECONDS;\n\n    return new SignJWT({ htm: method.toUpperCase(), htu: path })\n      .setProtectedHeader({\n        alg: ServiceAssertion.ALGORITHM,\n        kid: this.getKeyId(),\n        typ: ServiceAssertion.TYP,\n      })\n      .setIssuer(this.options.name)\n      .setSubject(this.options.name)\n      .setAudience(audience)\n      .setJti(this.requestIdGenerator.nextId())\n      .setIssuedAt(now)\n      .setExpirationTime(now + lifetime)\n      .sign(await this.resolvePrivateKey());\n  }\n\n  /**\n   * The document `/svc-certs` serves, built from the PUBLIC key only.\n   *\n   * `importSPKI` refuses a private PEM outright, which is what makes the private half unreachable\n   * from here by construction rather than by care. The JWK format is deliberately NOT accepted for\n   * this path: `importJWK` imports whatever it is handed, and a private JWK marked `\"ext\": true`\n   * round-trips its `d` straight into this document. See `JWKSIssuerTokenService.assertPublicJWK`.\n   */\n  async getPublicJWKS(): Promise<{ keys: JWK[] }> {\n    if (this.jwks) {\n      return this.jwks;\n    }\n\n    this.assertEnabled();\n\n    const { exportJWK, importSPKI } = await JoseLoader.load();\n    const raw = await this.readKey({ source: this.options.keys!.public });\n    const publicKey = await importSPKI(raw, ServiceAssertion.ALGORITHM);\n    const jwk = await exportJWK(publicKey);\n\n    if (jwk.d !== undefined) {\n      throw getError({\n        statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n        message: `[${ServiceAssertionSignerService.name}] The public key material carries a private exponent | this key would be published at the certs endpoint`,\n      });\n    }\n\n    this.jwks = {\n      keys: [{ ...jwk, kid: this.getKeyId(), alg: ServiceAssertion.ALGORITHM, use: 'sig' }],\n    };\n\n    return this.jwks;\n  }\n\n  private async resolvePrivateKey(): Promise<CryptoKey> {\n    if (this.privateKey) {\n      return this.privateKey;\n    }\n\n    const { importPKCS8 } = await JoseLoader.load();\n    const raw = await this.readKey({ source: this.options.keys!.private });\n    this.privateKey = await importPKCS8(raw, ServiceAssertion.ALGORITHM);\n    return this.privateKey;\n  }\n\n  private async readKey(opts: { source: string }): Promise<string> {\n    const { format, driver } = this.options.keys!;\n\n    if (format !== JWKSKeyFormats.PEM) {\n      throw getError({\n        statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n        message: `[${ServiceAssertionSignerService.name}] Only the '${JWKSKeyFormats.PEM}' key format is supported | got: ${format}`,\n      });\n    }\n\n    if (driver === JWKSKeyDrivers.FILE) {\n      return readFile(opts.source, 'utf-8');\n    }\n\n    return opts.source;\n  }\n\n  private assertEnabled(): void {\n    if (this.options.keys) {\n      return;\n    }\n\n    throw getError({\n      statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n      message: `[${ServiceAssertionSignerService.name}] This service has no signing keys | it can verify assertions but not mint them`,\n    });\n  }\n}\n"]}

package/dist/components/auth/authenticate/services/service/verifier.service.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"verifier.service.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/service/verifier.service.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,WAAW,EAEZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAA2B,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAO1F;;;;;;;;GAQG;AACH,qBAAa,+BAAgC,SAAQ,WAAW;IAS5D,OAAO,CAAC,QAAQ,CAAC,OAAO;IAR1B,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAE5D,oEAAoE;IACpE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;gBAIxC,OAAO,EAAE,mBAAmB;IAK/C;;;OAGG;IACG,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAahG;;;;OAIG;IACH,OAAO,CAAC,UAAU;IAqBlB,OAAO,CAAC,aAAa;YAyCP,SAAS;IAwDvB,OAAO,CAAC,oBAAoB;CAoB7B"}

package/dist/components/auth/authenticate/services/service/verifier.service.js

@@ -1,166 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-var ServiceAssertionVerifierService_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ServiceAssertionVerifierService = void 0;
-const metadata_1 = require("../../../../../base/metadata");
-const ignis_kernel_1 = require("@venizia/ignis-kernel");
-const core_1 = require("@venizia/ignis-helpers/core");
-const jose_loader_1 = require("../jose-loader");
-/**
- * Verifies an incoming service assertion against the CALLER's own JWKS.
- *
- * What the assertion covers, and nothing else: the HTTP method and the percent-encoded path. It does
- * NOT cover the query string, any header, or the body. Tenant selectors in particular are usually a
- * header or a query parameter, so an assertion alone does not authenticate which tenant a call acts
- * on - the caller allowlist and the application's own scoping have to do that. Stated because the
- * gap is invisible from the call site.
- */
-let ServiceAssertionVerifierService = ServiceAssertionVerifierService_1 = class ServiceAssertionVerifierService extends ignis_kernel_1.BaseService {
-    constructor(options) {
-        super({ scope: ServiceAssertionVerifierService_1.name });
-        this.options = options;
-        /** One remote key set per caller, kept because `createRemoteJWKSet` owns its own cache. */
-        this.keySets = new Map();
-        /** Per-caller accepted age, resolved once alongside its key set. */
-        this.acceptMaxAges = new Map();
-    }
-    /**
-     * @param path The percent-ENCODED pathname, from `new URL(context.req.url).pathname`. Never
-     * `context.req.path` - Hono decodes that one, and the caller signed the encoded form.
-     */
-    async verify(opts) {
-        const { token, method, path } = opts;
-        const jose = await jose_loader_1.JoseLoader.load();
-        const issuer = this.readIssuer({ token, jose });
-        const keySet = this.resolveKeySet({ issuer, jose });
-        const payload = await this.runVerify({ token, issuer, keySet, jose });
-        this.assertRequestBinding({ payload, method, path });
-        return { issuer };
-    }
-    /**
-     * Reads `iss` WITHOUT verifying, only to choose which key set checks the signature. The same value
-     * is then enforced as the expected issuer, so a forged `iss` buys nothing beyond selecting the key
-     * set that will reject it.
-     */
-    readIssuer(opts) {
-        let issuer;
-        try {
-            ({ iss: issuer } = opts.jose.decodeJwt(opts.token));
-        }
-        catch (error) {
-            this.logger.for(this.readIssuer.name).warn('Undecodable assertion | error: %s', error);
-            throw (0, core_1.getError)({ error: ignis_kernel_1.AuthenticationErrors.ASSERTION_INVALID });
-        }
-        // Typed, not merely present: a numeric `iss` would index the caller map by coercion.
-        if (typeof issuer !== 'string' || issuer.length === 0) {
-            this.logger
-                .for(this.readIssuer.name)
-                .warn('Undecodable assertion | iss is missing or not a string');
-            throw (0, core_1.getError)({ error: ignis_kernel_1.AuthenticationErrors.ASSERTION_INVALID });
-        }
-        return issuer;
-    }
-    resolveKeySet(opts) {
-        const { issuer, jose } = opts;
-        const cached = this.keySets.get(issuer);
-        if (cached) {
-            return cached;
-        }
-        const callers = this.options.callers ?? {};
-        // `Object.hasOwn`, never a truthiness check on the index: the map arrives as a plain object, so
-        // `iss: 'constructor'` would otherwise return `Function` - truthy - walk past this guard, and
-        // reach `new URL(<function>)` as an uncaught TypeError.
-        if (!Object.hasOwn(callers, issuer)) {
-            this.logger
-                .for(this.resolveKeySet.name)
-                .warn('Caller not on the allowlist | iss: %s', issuer);
-            throw (0, core_1.getError)({ error: ignis_kernel_1.AuthenticationErrors.CALLER_NOT_ALLOWED });
-        }
-        const entry = callers[issuer];
-        const jwksUrl = typeof entry === 'string' ? entry : entry.jwksUrl;
-        this.acceptMaxAges.set(issuer, ignis_kernel_1.ServiceAssertion.resolveAcceptMaxAge({
-            callerOverride: typeof entry === 'string' ? undefined : entry.acceptMaxAgeSeconds,
-            serviceDefault: this.options.acceptMaxAgeSeconds,
-        }));
-        const keySet = jose.createRemoteJWKSet(new URL(jwksUrl), {
-            cacheMaxAge: this.options.jwks?.cacheMaxAgeMs ?? ignis_kernel_1.ServiceAssertion.DEFAULT_JWKS_CACHE_MAX_AGE_MS,
-            cooldownDuration: this.options.jwks?.cooldownMs ?? ignis_kernel_1.ServiceAssertion.DEFAULT_JWKS_COOLDOWN_MS,
-        });
-        this.keySets.set(issuer, keySet);
-        return keySet;
-    }
-    async runVerify(opts) {
-        const { token, issuer, keySet, jose } = opts;
-        // Resolved when the key set was, so a per-caller override is already folded in.
-        const maxTokenAge = this.acceptMaxAges.get(issuer) ??
-            ignis_kernel_1.ServiceAssertion.resolveAcceptMaxAge({
-                serviceDefault: this.options.acceptMaxAgeSeconds,
-            });
-        const clockTolerance = this.options.clockToleranceSeconds ?? ignis_kernel_1.ServiceAssertion.DEFAULT_CLOCK_TOLERANCE_SECONDS;
-        try {
-            const { payload } = await jose.jwtVerify(token, keySet, {
-                algorithms: [ignis_kernel_1.ServiceAssertion.ALGORITHM],
-                typ: ignis_kernel_1.ServiceAssertion.TYP,
-                issuer,
-                audience: this.options.name,
-                // NOT redundant with `exp`, though it looks it. An honest caller stamps `exp = iat +
-                // lifetime`, so the two are numerically tied and jose reaches `exp` first - measured.
-                // `maxTokenAge` is the only bound that still holds when the CALLER is the attacker and picks
-                // its own `exp`, which is precisely the case it exists for. Do not delete it as dead config.
-                //
-                // And it is the CALLEE's number, never one the caller may request: a caller that could ask
-                // for a longer window would be choosing its own replay window, which is the whole thing this
-                // is here to deny.
-                //
-                // TWO NUMBERS, and they answer different questions. Measured at the defaults, 60 + 5:
-                //   - 65s is the ACCEPTANCE window on this machine's clock. Age 64 passes, 65 does not.
-                //   - 70s is the REPLAY window in wall-clock time, when the caller's clock runs the full
-                //     tolerance fast: we accept an `iat` up to 5s in our future, then keep accepting for
-                //     another 64. Measured: still accepted 69s after minting.
-                // The second is the one a threat model asks for. Widening `clockToleranceSeconds` widens it
-                // second for second, so it is a security knob, not an operational one.
-                maxTokenAge,
-                clockTolerance,
-                requiredClaims: ['htm', 'htu', 'jti'],
-            });
-            return payload;
-        }
-        catch (error) {
-            // One code out, the reason on `cause`: a wrong audience, clock skew and a rotated key are
-            // otherwise the same string to whoever is reading the log at 2am.
-            const reason = error?.cause ?? error;
-            this.logger.for(this.runVerify.name).warn('Rejected | iss: %s | reason: %s', issuer, reason);
-            throw (0, core_1.getError)({ error: ignis_kernel_1.AuthenticationErrors.ASSERTION_INVALID, cause: error });
-        }
-    }
-    assertRequestBinding(opts) {
-        const { payload, method, path } = opts;
-        const signed = `${payload.htm} ${payload.htu}`;
-        const actual = `${method.toUpperCase()} ${path}`;
-        if (signed === actual) {
-            return;
-        }
-        this.logger
-            .for(this.assertRequestBinding.name)
-            .warn('Request binding mismatch | signed: %s | actual: %s', signed, actual);
-        throw (0, core_1.getError)({ error: ignis_kernel_1.AuthenticationErrors.REQUEST_BINDING_MISMATCH });
-    }
-};
-exports.ServiceAssertionVerifierService = ServiceAssertionVerifierService;
-exports.ServiceAssertionVerifierService = ServiceAssertionVerifierService = ServiceAssertionVerifierService_1 = __decorate([
-    __param(0, (0, metadata_1.inject)({ key: ignis_kernel_1.AuthenticateBindingKeys.SERVICE_OPTIONS })),
-    __metadata("design:paramtypes", [Object])
-], ServiceAssertionVerifierService);
-//# sourceMappingURL=verifier.service.js.map

package/dist/components/auth/authenticate/services/service/verifier.service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"verifier.service.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/service/verifier.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8CAAyC;AACzC,wDAK+B;AAE/B,sDAAuD;AAEvD,gDAA4C;AAI5C;;;;;;;;GAQG;AACH,IAAa,+BAA+B,uCAA5C,MAAa,+BAAgC,SAAQ,0BAAW;IAO9D,YAEE,OAA6C;QAE7C,KAAK,CAAC,EAAE,KAAK,EAAE,iCAA+B,CAAC,IAAI,EAAE,CAAC,CAAC;QAFtC,YAAO,GAAP,OAAO,CAAqB;QAR/C,2FAA2F;QAC1E,YAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;QAE5D,oEAAoE;QACnD,kBAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAO3D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,IAAqD;QAChE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAErC,MAAM,IAAI,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtE,IAAI,CAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAErD,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACK,UAAU,CAAC,IAAoD;QACrE,IAAI,MAAe,CAAC;QAEpB,IAAI,CAAC;YACH,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;YACvF,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,mCAAoB,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,qFAAqF;QACrF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;iBACzB,IAAI,CAAC,wDAAwD,CAAC,CAAC;YAClE,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,mCAAoB,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,aAAa,CAAC,IAAqD;QACzE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QAE3C,gGAAgG;QAChG,8FAA8F;QAC9F,wDAAwD;QACxD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;iBAC5B,IAAI,CAAC,uCAAuC,EAAE,MAAM,CAAC,CAAC;YACzD,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,mCAAoB,CAAC,kBAAkB,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;QAElE,IAAI,CAAC,aAAa,CAAC,GAAG,CACpB,MAAM,EACN,+BAAgB,CAAC,mBAAmB,CAAC;YACnC,cAAc,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB;YACjF,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB;SACjD,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE;YACvD,WAAW,EACT,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,IAAI,+BAAgB,CAAC,6BAA6B;YACpF,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,IAAI,+BAAgB,CAAC,wBAAwB;SAC7F,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAKvB;QACC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAE7C,gFAAgF;QAChF,MAAM,WAAW,GACf,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC;YAC9B,+BAAgB,CAAC,mBAAmB,CAAC;gBACnC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB;aACjD,CAAC,CAAC;QAEL,MAAM,cAAc,GAClB,IAAI,CAAC,OAAO,CAAC,qBAAqB,IAAI,+BAAgB,CAAC,+BAA+B,CAAC;QAEzF,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAA0B,KAAK,EAAE,MAAM,EAAE;gBAC/E,UAAU,EAAE,CAAC,+BAAgB,CAAC,SAAS,CAAC;gBACxC,GAAG,EAAE,+BAAgB,CAAC,GAAG;gBACzB,MAAM;gBACN,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;gBAC3B,qFAAqF;gBACrF,sFAAsF;gBACtF,6FAA6F;gBAC7F,6FAA6F;gBAC7F,EAAE;gBACF,2FAA2F;gBAC3F,6FAA6F;gBAC7F,mBAAmB;gBACnB,EAAE;gBACF,sFAAsF;gBACtF,wFAAwF;gBACxF,yFAAyF;gBACzF,yFAAyF;gBACzF,8DAA8D;gBAC9D,4FAA4F;gBAC5F,uEAAuE;gBACvE,WAAW;gBACX,cAAc;gBACd,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;aACtC,CAAC,CAAC;YAEH,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0FAA0F;YAC1F,kEAAkE;YAClE,MAAM,MAAM,GAAI,KAA6B,EAAE,KAAK,IAAI,KAAK,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iCAAiC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAE7F,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,mCAAoB,CAAC,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,IAI5B;QACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAEvC,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC;QAEjD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;aACnC,IAAI,CAAC,oDAAoD,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAE9E,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,mCAAoB,CAAC,wBAAwB,EAAE,CAAC,CAAC;IAC3E,CAAC;CACF,CAAA;AA9KY,0EAA+B;0CAA/B,+BAA+B;IAQvC,WAAA,IAAA,iBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,eAAe,EAAE,CAAC,CAAA;;GARhD,+BAA+B,CA8K3C","sourcesContent":["import { inject } from '@/base/metadata';\nimport {\n  AuthenticateBindingKeys,\n  AuthenticationErrors,\n  BaseService,\n  ServiceAssertion,\n} from '@venizia/ignis-kernel';\nimport type { IServiceAssertionClaims, IServiceAuthOptions } from '@venizia/ignis-kernel';\nimport { getError } from '@venizia/ignis-helpers/core';\nimport type { createRemoteJWKSet } from 'jose';\nimport { JoseLoader } from '../jose-loader';\n\ntype TRemoteKeySet = ReturnType<typeof createRemoteJWKSet>;\n\n/**\n * Verifies an incoming service assertion against the CALLER's own JWKS.\n *\n * What the assertion covers, and nothing else: the HTTP method and the percent-encoded path. It does\n * NOT cover the query string, any header, or the body. Tenant selectors in particular are usually a\n * header or a query parameter, so an assertion alone does not authenticate which tenant a call acts\n * on - the caller allowlist and the application's own scoping have to do that. Stated because the\n * gap is invisible from the call site.\n */\nexport class ServiceAssertionVerifierService extends BaseService {\n  /** One remote key set per caller, kept because `createRemoteJWKSet` owns its own cache. */\n  private readonly keySets = new Map<string, TRemoteKeySet>();\n\n  /** Per-caller accepted age, resolved once alongside its key set. */\n  private readonly acceptMaxAges = new Map<string, number>();\n\n  constructor(\n    @inject({ key: AuthenticateBindingKeys.SERVICE_OPTIONS })\n    private readonly options: IServiceAuthOptions,\n  ) {\n    super({ scope: ServiceAssertionVerifierService.name });\n  }\n\n  /**\n   * @param path The percent-ENCODED pathname, from `new URL(context.req.url).pathname`. Never\n   * `context.req.path` - Hono decodes that one, and the caller signed the encoded form.\n   */\n  async verify(opts: { token: string; method: string; path: string }): Promise<{ issuer: string }> {\n    const { token, method, path } = opts;\n\n    const jose = await JoseLoader.load();\n    const issuer = this.readIssuer({ token, jose });\n    const keySet = this.resolveKeySet({ issuer, jose });\n    const payload = await this.runVerify({ token, issuer, keySet, jose });\n\n    this.assertRequestBinding({ payload, method, path });\n\n    return { issuer };\n  }\n\n  /**\n   * Reads `iss` WITHOUT verifying, only to choose which key set checks the signature. The same value\n   * is then enforced as the expected issuer, so a forged `iss` buys nothing beyond selecting the key\n   * set that will reject it.\n   */\n  private readIssuer(opts: { token: string; jose: typeof import('jose') }): string {\n    let issuer: unknown;\n\n    try {\n      ({ iss: issuer } = opts.jose.decodeJwt(opts.token));\n    } catch (error) {\n      this.logger.for(this.readIssuer.name).warn('Undecodable assertion | error: %s', error);\n      throw getError({ error: AuthenticationErrors.ASSERTION_INVALID });\n    }\n\n    // Typed, not merely present: a numeric `iss` would index the caller map by coercion.\n    if (typeof issuer !== 'string' || issuer.length === 0) {\n      this.logger\n        .for(this.readIssuer.name)\n        .warn('Undecodable assertion | iss is missing or not a string');\n      throw getError({ error: AuthenticationErrors.ASSERTION_INVALID });\n    }\n\n    return issuer;\n  }\n\n  private resolveKeySet(opts: { issuer: string; jose: typeof import('jose') }): TRemoteKeySet {\n    const { issuer, jose } = opts;\n\n    const cached = this.keySets.get(issuer);\n    if (cached) {\n      return cached;\n    }\n\n    const callers = this.options.callers ?? {};\n\n    // `Object.hasOwn`, never a truthiness check on the index: the map arrives as a plain object, so\n    // `iss: 'constructor'` would otherwise return `Function` - truthy - walk past this guard, and\n    // reach `new URL(<function>)` as an uncaught TypeError.\n    if (!Object.hasOwn(callers, issuer)) {\n      this.logger\n        .for(this.resolveKeySet.name)\n        .warn('Caller not on the allowlist | iss: %s', issuer);\n      throw getError({ error: AuthenticationErrors.CALLER_NOT_ALLOWED });\n    }\n\n    const entry = callers[issuer];\n    const jwksUrl = typeof entry === 'string' ? entry : entry.jwksUrl;\n\n    this.acceptMaxAges.set(\n      issuer,\n      ServiceAssertion.resolveAcceptMaxAge({\n        callerOverride: typeof entry === 'string' ? undefined : entry.acceptMaxAgeSeconds,\n        serviceDefault: this.options.acceptMaxAgeSeconds,\n      }),\n    );\n\n    const keySet = jose.createRemoteJWKSet(new URL(jwksUrl), {\n      cacheMaxAge:\n        this.options.jwks?.cacheMaxAgeMs ?? ServiceAssertion.DEFAULT_JWKS_CACHE_MAX_AGE_MS,\n      cooldownDuration: this.options.jwks?.cooldownMs ?? ServiceAssertion.DEFAULT_JWKS_COOLDOWN_MS,\n    });\n\n    this.keySets.set(issuer, keySet);\n    return keySet;\n  }\n\n  private async runVerify(opts: {\n    token: string;\n    issuer: string;\n    keySet: TRemoteKeySet;\n    jose: typeof import('jose');\n  }): Promise<IServiceAssertionClaims> {\n    const { token, issuer, keySet, jose } = opts;\n\n    // Resolved when the key set was, so a per-caller override is already folded in.\n    const maxTokenAge =\n      this.acceptMaxAges.get(issuer) ??\n      ServiceAssertion.resolveAcceptMaxAge({\n        serviceDefault: this.options.acceptMaxAgeSeconds,\n      });\n\n    const clockTolerance =\n      this.options.clockToleranceSeconds ?? ServiceAssertion.DEFAULT_CLOCK_TOLERANCE_SECONDS;\n\n    try {\n      const { payload } = await jose.jwtVerify<IServiceAssertionClaims>(token, keySet, {\n        algorithms: [ServiceAssertion.ALGORITHM],\n        typ: ServiceAssertion.TYP,\n        issuer,\n        audience: this.options.name,\n        // NOT redundant with `exp`, though it looks it. An honest caller stamps `exp = iat +\n        // lifetime`, so the two are numerically tied and jose reaches `exp` first - measured.\n        // `maxTokenAge` is the only bound that still holds when the CALLER is the attacker and picks\n        // its own `exp`, which is precisely the case it exists for. Do not delete it as dead config.\n        //\n        // And it is the CALLEE's number, never one the caller may request: a caller that could ask\n        // for a longer window would be choosing its own replay window, which is the whole thing this\n        // is here to deny.\n        //\n        // TWO NUMBERS, and they answer different questions. Measured at the defaults, 60 + 5:\n        //   - 65s is the ACCEPTANCE window on this machine's clock. Age 64 passes, 65 does not.\n        //   - 70s is the REPLAY window in wall-clock time, when the caller's clock runs the full\n        //     tolerance fast: we accept an `iat` up to 5s in our future, then keep accepting for\n        //     another 64. Measured: still accepted 69s after minting.\n        // The second is the one a threat model asks for. Widening `clockToleranceSeconds` widens it\n        // second for second, so it is a security knob, not an operational one.\n        maxTokenAge,\n        clockTolerance,\n        requiredClaims: ['htm', 'htu', 'jti'],\n      });\n\n      return payload;\n    } catch (error) {\n      // One code out, the reason on `cause`: a wrong audience, clock skew and a rotated key are\n      // otherwise the same string to whoever is reading the log at 2am.\n      const reason = (error as { cause?: unknown })?.cause ?? error;\n      this.logger.for(this.runVerify.name).warn('Rejected | iss: %s | reason: %s', issuer, reason);\n\n      throw getError({ error: AuthenticationErrors.ASSERTION_INVALID, cause: error });\n    }\n  }\n\n  private assertRequestBinding(opts: {\n    payload: IServiceAssertionClaims;\n    method: string;\n    path: string;\n  }): void {\n    const { payload, method, path } = opts;\n\n    const signed = `${payload.htm} ${payload.htu}`;\n    const actual = `${method.toUpperCase()} ${path}`;\n\n    if (signed === actual) {\n      return;\n    }\n\n    this.logger\n      .for(this.assertRequestBinding.name)\n      .warn('Request binding mismatch | signed: %s | actual: %s', signed, actual);\n\n    throw getError({ error: AuthenticationErrors.REQUEST_BINDING_MISMATCH });\n  }\n}\n"]}

package/dist/components/auth/authenticate/strategies/basic.strategy.d.ts

@@ -1,13 +0,0 @@
-import { type TContext } from '@venizia/ignis-kernel';
-import { BaseHelper } from '@venizia/ignis-helpers/core';
-import { type Env } from 'hono';
-import { type IAuthUser, type IAuthenticationStrategy } from '@venizia/ignis-kernel';
-import { BasicTokenService } from '../services';
-/** HTTP Basic Authentication strategy using Authorization header credentials. */
-export declare class BasicAuthenticationStrategy<E extends Env = Env> extends BaseHelper implements IAuthenticationStrategy<E> {
-    private service;
-    name: string;
-    constructor(service: BasicTokenService<E>);
-    authenticate(context: TContext<E, string>): Promise<IAuthUser>;
-}
-//# sourceMappingURL=basic.strategy.d.ts.map

package/dist/components/auth/authenticate/strategies/basic.strategy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"basic.strategy.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/strategies/basic.strategy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGtD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,uBAAuB,EAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,iFAAiF;AACjF,qBAAa,2BAA2B,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAC1D,SAAQ,UACR,YAAW,uBAAuB,CAAC,CAAC,CAAC;IAWnC,OAAO,CAAC,OAAO;IATjB,IAAI,SAAiC;gBAS3B,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAKjC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;CAIrE"}

package/dist/components/auth/authenticate/strategies/basic.strategy.js

@@ -1,45 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-var BasicAuthenticationStrategy_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BasicAuthenticationStrategy = void 0;
-const ignis_kernel_1 = require("@venizia/ignis-kernel");
-const ignis_kernel_2 = require("@venizia/ignis-kernel");
-const core_1 = require("@venizia/ignis-helpers/core");
-const ignis_inversion_1 = require("@venizia/ignis-inversion");
-const ignis_kernel_3 = require("@venizia/ignis-kernel");
-const services_1 = require("../services");
-/** HTTP Basic Authentication strategy using Authorization header credentials. */
-let BasicAuthenticationStrategy = BasicAuthenticationStrategy_1 = class BasicAuthenticationStrategy extends core_1.BaseHelper {
-    constructor(service) {
-        super({ scope: BasicAuthenticationStrategy_1.name });
-        this.service = service;
-        this.name = ignis_kernel_3.Authentication.STRATEGY_BASIC;
-    }
-    async authenticate(context) {
-        const credentials = this.service.extractCredentials(context);
-        return this.service.verify({ credentials, context });
-    }
-};
-exports.BasicAuthenticationStrategy = BasicAuthenticationStrategy;
-exports.BasicAuthenticationStrategy = BasicAuthenticationStrategy = BasicAuthenticationStrategy_1 = __decorate([
-    __param(0, (0, ignis_kernel_1.inject)({
-        key: ignis_inversion_1.BindingKeys.build({
-            namespace: ignis_kernel_2.BindingNamespaces.SERVICE,
-            key: services_1.BasicTokenService.name,
-        }),
-    })),
-    __metadata("design:paramtypes", [services_1.BasicTokenService])
-], BasicAuthenticationStrategy);
-//# sourceMappingURL=basic.strategy.js.map

package/dist/components/auth/authenticate/strategies/basic.strategy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"basic.strategy.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/strategies/basic.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,wDAA+C;AAC/C,wDAA0D;AAC1D,sDAAyD;AACzD,8DAAuD;AAEvD,wDAI+B;AAC/B,0CAAgD;AAEhD,iFAAiF;AACjF,IAAa,2BAA2B,mCAAxC,MAAa,2BACX,SAAQ,iBAAU;IAKlB,YAOE,OAAqC;QAErC,KAAK,CAAC,EAAE,KAAK,EAAE,6BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC;QAF3C,YAAO,GAAP,OAAO,CAAsB;QATvC,SAAI,GAAG,6BAAc,CAAC,cAAc,CAAC;IAYrC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAA4B;QAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,CAAC;CACF,CAAA;AAtBY,kEAA2B;sCAA3B,2BAA2B;IAOnC,WAAA,IAAA,qBAAM,EAAC;QACN,GAAG,EAAE,6BAAW,CAAC,KAAK,CAAC;YACrB,SAAS,EAAE,gCAAiB,CAAC,OAAO;YACpC,GAAG,EAAE,4BAAiB,CAAC,IAAI;SAC5B,CAAC;KACH,CAAC,CAAA;qCACe,4BAAiB;GAbzB,2BAA2B,CAsBvC","sourcesContent":["import { type TContext } from '@venizia/ignis-kernel';\nimport { inject } from '@venizia/ignis-kernel';\nimport { BindingNamespaces } from '@venizia/ignis-kernel';\nimport { BaseHelper } from '@venizia/ignis-helpers/core';\nimport { BindingKeys } from '@venizia/ignis-inversion';\nimport { type Env } from 'hono';\nimport {\n  Authentication,\n  type IAuthUser,\n  type IAuthenticationStrategy,\n} from '@venizia/ignis-kernel';\nimport { BasicTokenService } from '../services';\n\n/** HTTP Basic Authentication strategy using Authorization header credentials. */\nexport class BasicAuthenticationStrategy<E extends Env = Env>\n  extends BaseHelper\n  implements IAuthenticationStrategy<E>\n{\n  name = Authentication.STRATEGY_BASIC;\n\n  constructor(\n    @inject({\n      key: BindingKeys.build({\n        namespace: BindingNamespaces.SERVICE,\n        key: BasicTokenService.name,\n      }),\n    })\n    private service: BasicTokenService<E>,\n  ) {\n    super({ scope: BasicAuthenticationStrategy.name });\n  }\n\n  async authenticate(context: TContext<E, string>): Promise<IAuthUser> {\n    const credentials = this.service.extractCredentials(context);\n    return this.service.verify({ credentials, context });\n  }\n}\n"]}

package/dist/components/auth/authenticate/strategies/index.d.ts

@@ -1,6 +0,0 @@
-export * from '@venizia/ignis-kernel';
-export * from './basic.strategy';
-export * from './jws.strategy';
-export * from './jwks';
-export * from './service.strategy';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authenticate/strategies/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/strategies/index.ts"],"names":[],"mappings":"AACA,cAAc,uBAAuB,CAAC;AAEtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,QAAQ,CAAC;AACvB,cAAc,oBAAoB,CAAC"}

package/dist/components/auth/authenticate/strategies/index.js

@@ -1,23 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-// `strategy-registry.ts` moved to the kernel - the strategies below register themselves into it.
-__exportStar(require("@venizia/ignis-kernel"), exports);
-__exportStar(require("./basic.strategy"), exports);
-__exportStar(require("./jws.strategy"), exports);
-__exportStar(require("./jwks"), exports);
-__exportStar(require("./service.strategy"), exports);
-//# sourceMappingURL=index.js.map

package/dist/components/auth/authenticate/strategies/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/strategies/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iGAAiG;AACjG,wDAAsC;AAEtC,mDAAiC;AACjC,iDAA+B;AAC/B,yCAAuB;AACvB,qDAAmC","sourcesContent":["// `strategy-registry.ts` moved to the kernel - the strategies below register themselves into it.\nexport * from '@venizia/ignis-kernel';\n\nexport * from './basic.strategy';\nexport * from './jws.strategy';\nexport * from './jwks';\nexport * from './service.strategy';\n"]}

package/dist/components/auth/authenticate/strategies/jwks/index.d.ts

@@ -1,3 +0,0 @@
-export * from './issuer';
-export * from './verifier';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authenticate/strategies/jwks/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/strategies/jwks/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC"}

package/dist/components/auth/authenticate/strategies/jwks/index.js

@@ -1,19 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./issuer"), exports);
-__exportStar(require("./verifier"), exports);
-//# sourceMappingURL=index.js.map

package/dist/components/auth/authenticate/strategies/jwks/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/strategies/jwks/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB;AACzB,6CAA2B","sourcesContent":["export * from './issuer';\nexport * from './verifier';\n"]}

package/dist/components/auth/authenticate/strategies/jwks/issuer.d.ts

@@ -1,13 +0,0 @@
-import { type TContext } from '@venizia/ignis-kernel';
-import { BaseHelper } from '@venizia/ignis-helpers/core';
-import { type Env } from 'hono';
-import { type IAuthUser, type IAuthenticationStrategy } from '@venizia/ignis-kernel';
-import { JWKSIssuerTokenService } from '../../services';
-export declare class JWKSIssuerAuthenticationStrategy<E extends Env = Env> extends BaseHelper implements IAuthenticationStrategy<E> {
-    private service;
-    name: string;
-    standard: string;
-    constructor(service: JWKSIssuerTokenService<E>);
-    authenticate(context: TContext<E, string>): Promise<IAuthUser>;
-}
-//# sourceMappingURL=issuer.d.ts.map

package/dist/components/auth/authenticate/strategies/jwks/issuer.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"issuer.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/strategies/jwks/issuer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGtD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,uBAAuB,EAE7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAExD,qBAAa,gCAAgC,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAC/D,SAAQ,UACR,YAAW,uBAAuB,CAAC,CAAC,CAAC;IAYnC,OAAO,CAAC,OAAO;IAVjB,IAAI,SAA+B;IACnC,QAAQ,SAAsB;gBASpB,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAK5C,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;CAI/D"}

package/dist/components/auth/authenticate/strategies/jwks/issuer.js

@@ -1,45 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-var JWKSIssuerAuthenticationStrategy_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.JWKSIssuerAuthenticationStrategy = void 0;
-const ignis_kernel_1 = require("@venizia/ignis-kernel");
-const ignis_kernel_2 = require("@venizia/ignis-kernel");
-const core_1 = require("@venizia/ignis-helpers/core");
-const ignis_inversion_1 = require("@venizia/ignis-inversion");
-const ignis_kernel_3 = require("@venizia/ignis-kernel");
-const services_1 = require("../../services");
-let JWKSIssuerAuthenticationStrategy = JWKSIssuerAuthenticationStrategy_1 = class JWKSIssuerAuthenticationStrategy extends core_1.BaseHelper {
-    constructor(service) {
-        super({ scope: JWKSIssuerAuthenticationStrategy_1.name });
-        this.service = service;
-        this.name = ignis_kernel_3.Authentication.STRATEGY_JWT;
-        this.standard = ignis_kernel_3.JOSEStandards.JWKS;
-    }
-    authenticate(context) {
-        const token = this.service.extractCredentials(context);
-        return this.service.verify(token);
-    }
-};
-exports.JWKSIssuerAuthenticationStrategy = JWKSIssuerAuthenticationStrategy;
-exports.JWKSIssuerAuthenticationStrategy = JWKSIssuerAuthenticationStrategy = JWKSIssuerAuthenticationStrategy_1 = __decorate([
-    __param(0, (0, ignis_kernel_1.inject)({
-        key: ignis_inversion_1.BindingKeys.build({
-            namespace: ignis_kernel_2.BindingNamespaces.SERVICE,
-            key: services_1.JWKSIssuerTokenService.name,
-        }),
-    })),
-    __metadata("design:paramtypes", [services_1.JWKSIssuerTokenService])
-], JWKSIssuerAuthenticationStrategy);
-//# sourceMappingURL=issuer.js.map

package/dist/components/auth/authenticate/strategies/jwks/issuer.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"issuer.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/strategies/jwks/issuer.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,wDAA+C;AAC/C,wDAA0D;AAC1D,sDAAyD;AACzD,8DAAuD;AAEvD,wDAK+B;AAC/B,6CAAwD;AAExD,IAAa,gCAAgC,wCAA7C,MAAa,gCACX,SAAQ,iBAAU;IAMlB,YAOE,OAA0C;QAE1C,KAAK,CAAC,EAAE,KAAK,EAAE,kCAAgC,CAAC,IAAI,EAAE,CAAC,CAAC;QAFhD,YAAO,GAAP,OAAO,CAA2B;QAV5C,SAAI,GAAG,6BAAc,CAAC,YAAY,CAAC;QACnC,aAAQ,GAAG,4BAAa,CAAC,IAAI,CAAC;IAY9B,CAAC;IAED,YAAY,CAAC,OAA4B;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;CACF,CAAA;AAvBY,4EAAgC;2CAAhC,gCAAgC;IAQxC,WAAA,IAAA,qBAAM,EAAC;QACN,GAAG,EAAE,6BAAW,CAAC,KAAK,CAAC;YACrB,SAAS,EAAE,gCAAiB,CAAC,OAAO;YACpC,GAAG,EAAE,iCAAsB,CAAC,IAAI;SACjC,CAAC;KACH,CAAC,CAAA;qCACe,iCAAsB;GAd9B,gCAAgC,CAuB5C","sourcesContent":["import { type TContext } from '@venizia/ignis-kernel';\nimport { inject } from '@venizia/ignis-kernel';\nimport { BindingNamespaces } from '@venizia/ignis-kernel';\nimport { BaseHelper } from '@venizia/ignis-helpers/core';\nimport { BindingKeys } from '@venizia/ignis-inversion';\nimport { type Env } from 'hono';\nimport {\n  Authentication,\n  type IAuthUser,\n  type IAuthenticationStrategy,\n  JOSEStandards,\n} from '@venizia/ignis-kernel';\nimport { JWKSIssuerTokenService } from '../../services';\n\nexport class JWKSIssuerAuthenticationStrategy<E extends Env = Env>\n  extends BaseHelper\n  implements IAuthenticationStrategy<E>\n{\n  name = Authentication.STRATEGY_JWT;\n  standard = JOSEStandards.JWKS;\n\n  constructor(\n    @inject({\n      key: BindingKeys.build({\n        namespace: BindingNamespaces.SERVICE,\n        key: JWKSIssuerTokenService.name,\n      }),\n    })\n    private service: JWKSIssuerTokenService<E>,\n  ) {\n    super({ scope: JWKSIssuerAuthenticationStrategy.name });\n  }\n\n  authenticate(context: TContext<E, string>): Promise<IAuthUser> {\n    const token = this.service.extractCredentials(context);\n    return this.service.verify(token);\n  }\n}\n"]}

package/dist/components/auth/authenticate/strategies/jwks/verifier.d.ts

@@ -1,13 +0,0 @@
-import { type TContext } from '@venizia/ignis-kernel';
-import { BaseHelper } from '@venizia/ignis-helpers/core';
-import { type Env } from 'hono';
-import { type IAuthUser, type IAuthenticationStrategy } from '@venizia/ignis-kernel';
-import { JWKSVerifierTokenService } from '../../services';
-export declare class JWKSVerifierAuthenticationStrategy<E extends Env = Env> extends BaseHelper implements IAuthenticationStrategy<E> {
-    private service;
-    name: string;
-    standard: string;
-    constructor(service: JWKSVerifierTokenService<E>);
-    authenticate(context: TContext<E, string>): Promise<IAuthUser>;
-}
-//# sourceMappingURL=verifier.d.ts.map

package/dist/components/auth/authenticate/strategies/jwks/verifier.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/strategies/jwks/verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGtD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,uBAAuB,EAE7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,qBAAa,kCAAkC,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CACjE,SAAQ,UACR,YAAW,uBAAuB,CAAC,CAAC,CAAC;IAYnC,OAAO,CAAC,OAAO;IAVjB,IAAI,SAA+B;IACnC,QAAQ,SAAsB;gBASpB,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAK9C,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;CAI/D"}