@venizia/ignis 0.4.3 → 0.4.5

package/dist/esm/components/api-reference/ui/factory.js

@@ -0,0 +1,50 @@
+import { DocumentUITypes } from '../common/index.js';
+import { getError } from '@venizia/ignis-helpers/core';
+import { MemoryStorageHelper } from '@venizia/ignis-helpers';
+import { ScalarUIProvider } from './scalar.js';
+import { SwaggerUIProvider } from './swagger.js';
+export class UIProviderFactory extends MemoryStorageHelper {
+    static getInstance() {
+        if (!UIProviderFactory.instance) {
+            UIProviderFactory.instance = new UIProviderFactory();
+        }
+        return UIProviderFactory.instance;
+    }
+    // One lookup, not a `isBound` probe followed by a second `get` of the same key.
+    getProvider({ type }) {
+        const provider = this.get(type);
+        if (!provider) {
+            throw getError({
+                message: `[UIProviderFactory][getProvider] Unknown UI Provider | type: ${type} | available: ${this.keys().join(', ')}`,
+            });
+        }
+        return provider;
+    }
+    register(opts) {
+        if (this.isBound(opts.type)) {
+            this.logger
+                .for(this.register.name)
+                .warn('Skip registering BOUNDED Document UI | type: %s', opts.type);
+            return;
+        }
+        switch (opts.type) {
+            case DocumentUITypes.SWAGGER: {
+                this.set(opts.type, new SwaggerUIProvider());
+                return;
+            }
+            case DocumentUITypes.SCALAR: {
+                this.set(opts.type, new ScalarUIProvider());
+                return;
+            }
+            default: {
+                throw getError({
+                    message: `[register] Invalid document UI Type | uiType: ${opts.type} | valids: ${[...DocumentUITypes.SCHEME_SET]}`,
+                });
+            }
+        }
+    }
+    getRegisteredProviders() {
+        return this.keys();
+    }
+}
+//# sourceMappingURL=factory.js.map

package/dist/esm/components/api-reference/ui/factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.js","sourceRoot":"","sources":["../../../../../src/components/api-reference/ui/factory.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,MAAM,OAAO,iBAAkB,SAAQ,mBAErC;IAGA,MAAM,CAAC,WAAW;QAChB,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC;YAChC,iBAAiB,CAAC,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACvD,CAAC;QAED,OAAO,iBAAiB,CAAC,QAAQ,CAAC;IACpC,CAAC;IAED,gFAAgF;IAChF,WAAW,CAAC,EAAE,IAAI,EAAsB;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEhC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,gEAAgE,IAAI,iBAAiB,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACvH,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,QAAQ,CAAC,IAAsB;QAC7B,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;iBACvB,IAAI,CAAC,iDAAiD,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QAED,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,iBAAiB,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,KAAK,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC5B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,gBAAgB,EAAE,CAAC,CAAC;gBAC5C,OAAO;YACT,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,QAAQ,CAAC;oBACb,OAAO,EAAE,iDAAiD,IAAI,CAAC,IAAI,cAAc,CAAC,GAAG,eAAe,CAAC,UAAU,CAAC,EAAE;iBACnH,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,sBAAsB;QACpB,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;CACF","sourcesContent":["import type { IGetProviderParams, IUIProvider } from '../common';\nimport { DocumentUITypes } from '../common';\nimport { getError } from '@venizia/ignis-helpers/core';\nimport { MemoryStorageHelper } from '@venizia/ignis-helpers';\nimport { ScalarUIProvider } from './scalar';\nimport { SwaggerUIProvider } from './swagger';\n\nexport class UIProviderFactory extends MemoryStorageHelper<{\n  [key: string | symbol]: IUIProvider;\n}> {\n  private static instance: UIProviderFactory;\n\n  static getInstance() {\n    if (!UIProviderFactory.instance) {\n      UIProviderFactory.instance = new UIProviderFactory();\n    }\n\n    return UIProviderFactory.instance;\n  }\n\n  // One lookup, not a `isBound` probe followed by a second `get` of the same key.\n  getProvider({ type }: IGetProviderParams): IUIProvider {\n    const provider = this.get(type);\n\n    if (!provider) {\n      throw getError({\n        message: `[UIProviderFactory][getProvider] Unknown UI Provider | type: ${type} | available: ${this.keys().join(', ')}`,\n      });\n    }\n\n    return provider;\n  }\n\n  register(opts: { type: string }): void {\n    if (this.isBound(opts.type)) {\n      this.logger\n        .for(this.register.name)\n        .warn('Skip registering BOUNDED Document UI | type: %s', opts.type);\n      return;\n    }\n\n    switch (opts.type) {\n      case DocumentUITypes.SWAGGER: {\n        this.set(opts.type, new SwaggerUIProvider());\n        return;\n      }\n      case DocumentUITypes.SCALAR: {\n        this.set(opts.type, new ScalarUIProvider());\n        return;\n      }\n      default: {\n        throw getError({\n          message: `[register] Invalid document UI Type | uiType: ${opts.type} | valids: ${[...DocumentUITypes.SCHEME_SET]}`,\n        });\n      }\n    }\n  }\n\n  getRegisteredProviders() {\n    return this.keys();\n  }\n}\n"]}

package/dist/esm/components/api-reference/ui/index.d.ts

@@ -0,0 +1,4 @@
+export * from './swagger.js';
+export * from './scalar.js';
+export * from './factory.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/components/api-reference/ui/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/api-reference/ui/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC"}

package/dist/esm/components/api-reference/ui/index.js

@@ -0,0 +1,4 @@
+export * from './swagger.js';
+export * from './scalar.js';
+export * from './factory.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/components/api-reference/ui/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/api-reference/ui/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC","sourcesContent":["export * from './swagger';\nexport * from './scalar';\nexport * from './factory';\n"]}

package/dist/esm/components/api-reference/ui/scalar.d.ts

@@ -0,0 +1,8 @@
+import type { Context, Next } from 'hono';
+import type { IUIConfig, IUIProvider } from '../common/index.js';
+import { BaseHelper } from '@venizia/ignis-helpers/core';
+export declare class ScalarUIProvider extends BaseHelper implements IUIProvider {
+    constructor();
+    render(context: Context, config: IUIConfig, next: Next): Promise<Response | void>;
+}
+//# sourceMappingURL=scalar.d.ts.map

package/dist/esm/components/api-reference/ui/scalar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scalar.d.ts","sourceRoot":"","sources":["../../../../../src/components/api-reference/ui/scalar.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,UAAU,EAAY,MAAM,6BAA6B,CAAC;AAEnE,qBAAa,gBAAiB,SAAQ,UAAW,YAAW,WAAW;;IAK/D,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;CAoBxF"}

package/dist/esm/components/api-reference/ui/scalar.js

@@ -0,0 +1,24 @@
+import { BaseHelper, getError } from '@venizia/ignis-helpers/core';
+export class ScalarUIProvider extends BaseHelper {
+    constructor() {
+        super({ scope: ScalarUIProvider.name });
+    }
+    async render(context, config, next) {
+        let scalarModule;
+        try {
+            scalarModule = await import('@scalar/hono-api-reference');
+        }
+        catch (error) {
+            this.logger
+                .for(this.render.name)
+                .error("Failed to load '@scalar/hono-api-reference' | Error: %s", error);
+            throw getError({
+                message: "[ScalarUIProvider][render] '@scalar/hono-api-reference' is required to render the Scalar UI. Please install it",
+            });
+        }
+        const { Scalar } = scalarModule;
+        const { title, url, ...customConfig } = config;
+        return Scalar({ url, pageTitle: title, ...customConfig })(context, next);
+    }
+}
+//# sourceMappingURL=scalar.js.map

package/dist/esm/components/api-reference/ui/scalar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scalar.js","sourceRoot":"","sources":["../../../../../src/components/api-reference/ui/scalar.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAEnE,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAC9C;QACE,KAAK,CAAC,EAAE,KAAK,EAAE,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAgB,EAAE,MAAiB,EAAE,IAAU;QAC1D,IAAI,YAAyD,CAAC;QAE9D,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;iBACrB,KAAK,CAAC,yDAAyD,EAAE,KAAK,CAAC,CAAC;YAE3E,MAAM,QAAQ,CAAC;gBACb,OAAO,EACL,gHAAgH;aACnH,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC;QAChC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,YAAY,EAAE,GAAG,MAAM,CAAC;QAC/C,OAAO,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3E,CAAC;CACF","sourcesContent":["import type { Context, Next } from 'hono';\nimport type { IUIConfig, IUIProvider } from '../common';\nimport { BaseHelper, getError } from '@venizia/ignis-helpers/core';\n\nexport class ScalarUIProvider extends BaseHelper implements IUIProvider {\n  constructor() {\n    super({ scope: ScalarUIProvider.name });\n  }\n\n  async render(context: Context, config: IUIConfig, next: Next): Promise<Response | void> {\n    let scalarModule: typeof import('@scalar/hono-api-reference');\n\n    try {\n      scalarModule = await import('@scalar/hono-api-reference');\n    } catch (error) {\n      this.logger\n        .for(this.render.name)\n        .error(\"Failed to load '@scalar/hono-api-reference' | Error: %s\", error);\n\n      throw getError({\n        message:\n          \"[ScalarUIProvider][render] '@scalar/hono-api-reference' is required to render the Scalar UI. Please install it\",\n      });\n    }\n\n    const { Scalar } = scalarModule;\n    const { title, url, ...customConfig } = config;\n    return Scalar({ url, pageTitle: title, ...customConfig })(context, next);\n  }\n}\n"]}

package/dist/esm/components/api-reference/ui/swagger.d.ts

@@ -0,0 +1,8 @@
+import type { Context, Next } from 'hono';
+import type { IUIConfig, IUIProvider } from '../common/index.js';
+import { BaseHelper } from '@venizia/ignis-helpers/core';
+export declare class SwaggerUIProvider extends BaseHelper implements IUIProvider {
+    constructor();
+    render(context: Context, config: IUIConfig, next: Next): Promise<Response | void>;
+}
+//# sourceMappingURL=swagger.d.ts.map

package/dist/esm/components/api-reference/ui/swagger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"swagger.d.ts","sourceRoot":"","sources":["../../../../../src/components/api-reference/ui/swagger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,UAAU,EAAY,MAAM,6BAA6B,CAAC;AAEnE,qBAAa,iBAAkB,SAAQ,UAAW,YAAW,WAAW;;IAKhE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;CAoBxF"}

package/dist/esm/components/api-reference/ui/swagger.js

@@ -0,0 +1,24 @@
+import { BaseHelper, getError } from '@venizia/ignis-helpers/core';
+export class SwaggerUIProvider extends BaseHelper {
+    constructor() {
+        super({ scope: SwaggerUIProvider.name });
+    }
+    async render(context, config, next) {
+        let swaggerModule;
+        try {
+            swaggerModule = await import('@hono/swagger-ui');
+        }
+        catch (error) {
+            this.logger
+                .for(this.render.name)
+                .error("Failed to load '@hono/swagger-ui' | Error: %s", error);
+            throw getError({
+                message: "[SwaggerUIProvider][render] '@hono/swagger-ui' is required to render the Swagger UI. Please install it",
+            });
+        }
+        const { swaggerUI } = swaggerModule;
+        const { title, url, ...customConfig } = config;
+        return swaggerUI({ title, url, ...customConfig })(context, next);
+    }
+}
+//# sourceMappingURL=swagger.js.map

package/dist/esm/components/api-reference/ui/swagger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"swagger.js","sourceRoot":"","sources":["../../../../../src/components/api-reference/ui/swagger.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAEnE,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C;QACE,KAAK,CAAC,EAAE,KAAK,EAAE,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAgB,EAAE,MAAiB,EAAE,IAAU;QAC1D,IAAI,aAAgD,CAAC;QAErD,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;iBACrB,KAAK,CAAC,+CAA+C,EAAE,KAAK,CAAC,CAAC;YAEjE,MAAM,QAAQ,CAAC;gBACb,OAAO,EACL,wGAAwG;aAC3G,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC;QACpC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,YAAY,EAAE,GAAG,MAAM,CAAC;QAC/C,OAAO,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC;CACF","sourcesContent":["import type { Context, Next } from 'hono';\nimport type { IUIConfig, IUIProvider } from '../common';\nimport { BaseHelper, getError } from '@venizia/ignis-helpers/core';\n\nexport class SwaggerUIProvider extends BaseHelper implements IUIProvider {\n  constructor() {\n    super({ scope: SwaggerUIProvider.name });\n  }\n\n  async render(context: Context, config: IUIConfig, next: Next): Promise<Response | void> {\n    let swaggerModule: typeof import('@hono/swagger-ui');\n\n    try {\n      swaggerModule = await import('@hono/swagger-ui');\n    } catch (error) {\n      this.logger\n        .for(this.render.name)\n        .error(\"Failed to load '@hono/swagger-ui' | Error: %s\", error);\n\n      throw getError({\n        message:\n          \"[SwaggerUIProvider][render] '@hono/swagger-ui' is required to render the Swagger UI. Please install it\",\n      });\n    }\n\n    const { swaggerUI } = swaggerModule;\n    const { title, url, ...customConfig } = config;\n    return swaggerUI({ title, url, ...customConfig })(context, next);\n  }\n}\n"]}

package/dist/esm/components/auth/authenticate/component.d.ts

@@ -0,0 +1,28 @@
+import type { BaseApplication } from '../../../base/applications/base.js';
+import { type ValueOrPromise } from '@venizia/ignis-helpers/common';
+import { BaseComponent } from '@venizia/ignis-kernel';
+export declare class AuthenticateComponent extends BaseComponent {
+    private application;
+    constructor(application: BaseApplication);
+    binding(): ValueOrPromise<void>;
+    /**
+     * Loads `jose` at boot when a configured service signs or verifies with it, so a missing or broken
+     * install fails the boot instead of answering every token check with a 401.
+     */
+    private preloadJose;
+    private defineJWSAuth;
+    private defineJWKSAuth;
+    /**
+     * Service-to-service authentication. Absent options mean no strategy is registered and no route is
+     * mounted, so an application that never sets them is byte-identical to today.
+     *
+     * The certs route is mounted only when SIGNING keys are present. Most services are called and
+     * never call; publishing a key set for a service that signs nothing advertises a capability it
+     * does not have.
+     */
+    private defineServiceAuth;
+    private defineBasicAuth;
+    private defineControllers;
+    defineOAuth2(): void;
+}
+//# sourceMappingURL=component.d.ts.map

package/dist/esm/components/auth/authenticate/component.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"component.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/component.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAGpE,OAAO,EAIL,aAAa,EAiBd,MAAM,uBAAuB,CAAC;AAgB/B,qBAAa,qBAAsB,SAAQ,aAAa;IAEA,OAAO,CAAC,WAAW;gBAAX,WAAW,EAAE,eAAe;IAajF,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC;IAyDxC;;;OAGG;YACW,WAAW;IAmBzB,OAAO,CAAC,aAAa;IAyBrB,OAAO,CAAC,cAAc;IAwEtB;;;;;;;OAOG;IACH,OAAO,CAAC,iBAAiB;IAwDzB,OAAO,CAAC,eAAe;IAwBvB,OAAO,CAAC,iBAAiB;IAoBzB,YAAY;CAGb"}

package/dist/esm/components/auth/authenticate/component.js

@@ -0,0 +1,271 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var AuthenticateComponent_1;
+import { getError } from '@venizia/ignis-helpers/core';
+import { Binding } from '@venizia/ignis-inversion';
+import { AuthenticateBindingKeys, Authentication, AuthenticationStrategyRegistry, BaseComponent, controller, CoreBindings, inject, JOSEStandards, JWKSKeyFormats, JWKSModes, ServiceAssertion, } from '@venizia/ignis-kernel';
+import { defineAuthController, JWKSController } from './controllers/index.js';
+import { ServiceCertsController } from './controllers/service-certs/index.js';
+import { BasicTokenService, JWKSIssuerTokenService, JWKSVerifierTokenService, JWSTokenService, } from './services/index.js';
+import { JoseLoader } from './services/jose-loader.js';
+import { ServiceAssertionSignerService } from './services/service/signer.service.js';
+import { ServiceAssertionVerifierService } from './services/service/verifier.service.js';
+import { ServiceAuthenticationStrategy } from './strategies/service.strategy.js';
+const DEFAULT_SECRET = 'unknown_secret';
+let AuthenticateComponent = AuthenticateComponent_1 = class AuthenticateComponent extends BaseComponent {
+    constructor(application) {
+        super({
+            scope: AuthenticateComponent_1.name,
+            initDefault: { enable: true, container: application },
+            bindings: {
+                [AuthenticateBindingKeys.REST_OPTIONS]: Binding.bind({
+                    key: AuthenticateBindingKeys.REST_OPTIONS,
+                }).toValue({ useAuthController: false }),
+            },
+        });
+        this.application = application;
+    }
+    binding() {
+        const jwtOptions = this.application.get({
+            key: AuthenticateBindingKeys.JWT_OPTIONS,
+            isOptional: true,
+        });
+        const basicOptions = this.application.get({
+            key: AuthenticateBindingKeys.BASIC_OPTIONS,
+            isOptional: true,
+        });
+        const restOptions = this.application.get({
+            key: AuthenticateBindingKeys.REST_OPTIONS,
+            isOptional: true,
+        });
+        const serviceOptions = this.application.get({
+            key: AuthenticateBindingKeys.SERVICE_OPTIONS,
+            isOptional: true,
+        });
+        // A service that only VERIFIES assertions needs neither jwt nor basic - and that application,
+        // an IGNIS app consuming no user tokens at all, is exactly what the service strategy is for.
+        if (!jwtOptions && !basicOptions && !serviceOptions) {
+            throw getError({
+                message: '[AuthenticateComponent] At least one of jwtOptions, basicOptions or serviceOptions must be provided',
+            });
+        }
+        const options = { restOptions, jwtOptions, basicOptions, serviceOptions };
+        if (jwtOptions) {
+            switch (jwtOptions.standard) {
+                case JOSEStandards.JWS: {
+                    this.defineJWSAuth({ options: jwtOptions.options });
+                    break;
+                }
+                case JOSEStandards.JWKS: {
+                    this.defineJWKSAuth({ options: jwtOptions.options });
+                    break;
+                }
+                default: {
+                    throw getError({
+                        message: `[AuthenticateComponent] Unknown JOSE standard: ${jwtOptions.standard}`,
+                    });
+                }
+            }
+        }
+        this.defineBasicAuth({ basicOptions });
+        this.defineServiceAuth({ serviceOptions });
+        this.defineControllers({ options });
+        this.defineOAuth2();
+        return this.preloadJose({ options });
+    }
+    /**
+     * Loads `jose` at boot when a configured service signs or verifies with it, so a missing or broken
+     * install fails the boot instead of answering every token check with a 401.
+     */
+    async preloadJose(opts) {
+        const { jwtOptions, serviceOptions } = opts.options;
+        if (!jwtOptions && !serviceOptions) {
+            return;
+        }
+        try {
+            await JoseLoader.load();
+        }
+        catch (error) {
+            const reason = error instanceof Error ? error.message : String(error);
+            this.logger.for(this.preloadJose.name).error("Failed to load 'jose' | Error: %s", reason);
+            throw getError({
+                message: `[AuthenticateComponent] Cannot load 'jose', which JWT and service authentication need. Please install it | Error: ${reason}`,
+                cause: error,
+            });
+        }
+    }
+    defineJWSAuth(opts) {
+        const { options: jwsOptions } = opts;
+        const { jwtSecret, getTokenExpiresFn } = jwsOptions;
+        if (!jwtSecret || jwtSecret === DEFAULT_SECRET) {
+            throw getError({
+                message: `[defineJWSAuth] Invalid jwtSecret | Provided: ${jwtSecret}`,
+            });
+        }
+        if (!getTokenExpiresFn) {
+            throw getError({
+                message: '[defineJWSAuth] getTokenExpiresFn is required',
+            });
+        }
+        this.application
+            .bind({ key: AuthenticateBindingKeys.JWT_OPTIONS })
+            .toValue(jwsOptions);
+        this.application.service(JWSTokenService);
+        this.logger.for(this.defineJWSAuth.name).info('JWS authentication configured');
+    }
+    defineJWKSAuth(opts) {
+        const { options: jwksOptions } = opts;
+        switch (jwksOptions.mode) {
+            case JWKSModes.ISSUER: {
+                const issuerOpts = jwksOptions;
+                if (!issuerOpts.keys?.private || !issuerOpts.keys?.public) {
+                    throw getError({
+                        message: '[defineJWKSAuth] keys.private and keys.public are required for issuer mode',
+                    });
+                }
+                if (!issuerOpts.keys?.format || !JWKSKeyFormats.isValid(issuerOpts.keys.format)) {
+                    throw getError({
+                        message: `[defineJWKSAuth] keys.format is required and must be one of: ${[...JWKSKeyFormats.SCHEME_SET].join(', ')}`,
+                    });
+                }
+                if (!issuerOpts.kid) {
+                    throw getError({ message: '[defineJWKSAuth] kid is required for issuer mode' });
+                }
+                if (!issuerOpts.getTokenExpiresFn) {
+                    throw getError({
+                        message: '[defineJWKSAuth] getTokenExpiresFn is required for issuer mode',
+                    });
+                }
+                this.application
+                    .bind({ key: AuthenticateBindingKeys.JWKS_OPTIONS })
+                    .toValue(issuerOpts);
+                this.application.service(JWKSIssuerTokenService);
+                // Path depends on a runtime option, so @controller can't be applied statically — decorate here instead.
+                Reflect.decorate([controller({ path: issuerOpts?.rest?.path ?? '/certs' })], JWKSController);
+                this.application.controller(JWKSController);
+                this.logger
+                    .for(this.defineJWKSAuth.name)
+                    .info('JWKS issuer configured with /certs endpoint');
+                break;
+            }
+            case JWKSModes.VERIFIER: {
+                const verifierOpts = jwksOptions;
+                if (!verifierOpts.jwksUrl) {
+                    throw getError({ message: '[defineJWKSAuth] jwksUrl is required for verifier mode' });
+                }
+                this.application
+                    .bind({ key: AuthenticateBindingKeys.JWKS_OPTIONS })
+                    .toValue(verifierOpts);
+                this.application.service(JWKSVerifierTokenService);
+                this.logger.for(this.defineJWKSAuth.name).info('JWKS verifier configured');
+                break;
+            }
+            default: {
+                // Same exhaustive-switch-narrows-to-never situation as the JOSE standard default above.
+                throw getError({
+                    message: `[defineJWKSAuth] Invalid JWKS mode: ${jwksOptions.mode}`,
+                });
+            }
+        }
+    }
+    /**
+     * Service-to-service authentication. Absent options mean no strategy is registered and no route is
+     * mounted, so an application that never sets them is byte-identical to today.
+     *
+     * The certs route is mounted only when SIGNING keys are present. Most services are called and
+     * never call; publishing a key set for a service that signs nothing advertises a capability it
+     * does not have.
+     */
+    defineServiceAuth(opts) {
+        const { serviceOptions } = opts;
+        if (!serviceOptions) {
+            this.logger
+                .for(this.defineServiceAuth.name)
+                .debug('serviceOptions not provided, skipping service authentication');
+            return;
+        }
+        if (!serviceOptions.name) {
+            throw getError({
+                message: '[defineServiceAuth] name is required | it is the issuer this service stamps and the audience it demands',
+            });
+        }
+        if (!serviceOptions.resolvePrincipal) {
+            throw getError({
+                message: '[defineServiceAuth] resolvePrincipal is required | the framework proves WHICH SERVICE called, the application decides who that acts as',
+            });
+        }
+        this.application.service(ServiceAssertionVerifierService);
+        if (serviceOptions.keys) {
+            this.application.service(ServiceAssertionSignerService);
+            const restPath = serviceOptions.rest?.path ?? ServiceAssertion.DEFAULT_REST_PATH;
+            this.application
+                .bind({ key: AuthenticateBindingKeys.SERVICE_CERTS_PATH })
+                .toValue(restPath);
+            // Path depends on a runtime option, so @controller cannot be applied statically.
+            Reflect.decorate([controller({ path: restPath })], ServiceCertsController);
+            this.application.controller(ServiceCertsController);
+        }
+        AuthenticationStrategyRegistry.getInstance().register({
+            container: this.application,
+            strategies: [
+                { name: Authentication.STRATEGY_SERVICE, strategy: ServiceAuthenticationStrategy },
+            ],
+        });
+        this.logger
+            .for(this.defineServiceAuth.name)
+            .info('Service authentication configured | name: %s | signs: %s | callers: %s', serviceOptions.name, Boolean(serviceOptions.keys), Object.keys(serviceOptions.callers ?? {}).join(', ') || 'none');
+    }
+    defineBasicAuth(opts) {
+        const { basicOptions } = opts;
+        if (!basicOptions) {
+            this.logger
+                .for(this.defineBasicAuth.name)
+                .debug('basicOptions not provided, skipping Basic configuration');
+            return;
+        }
+        if (!basicOptions.verifyCredentials) {
+            throw getError({
+                message: '[defineBasicAuth] verifyCredentials function is required',
+            });
+        }
+        this.application
+            .bind({ key: AuthenticateBindingKeys.BASIC_OPTIONS })
+            .toValue(basicOptions);
+        this.application.service(BasicTokenService);
+        this.logger.for(this.defineBasicAuth.name).info('Basic authentication configured');
+    }
+    defineControllers(opts) {
+        const { restOptions, jwtOptions } = opts.options;
+        if (!restOptions?.useAuthController) {
+            this.logger.for(this.defineControllers.name).debug('Auth controller disabled');
+            return;
+        }
+        if (!jwtOptions) {
+            throw getError({
+                message: '[defineControllers] Auth controller requires jwtOptions to be configured',
+            });
+        }
+        const AuthController = defineAuthController(restOptions.controllerOpts);
+        this.application.controller(AuthController);
+        this.logger.for(this.defineControllers.name).info('Auth controller registered');
+    }
+    defineOAuth2() {
+        // TODO Implement OAuth2
+    }
+};
+AuthenticateComponent = AuthenticateComponent_1 = __decorate([
+    __param(0, inject({ key: CoreBindings.APPLICATION_INSTANCE })),
+    __metadata("design:paramtypes", [Function])
+], AuthenticateComponent);
+export { AuthenticateComponent };
+//# sourceMappingURL=component.js.map

package/dist/esm/components/auth/authenticate/component.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"component.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/component.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,8BAA8B,EAC9B,aAAa,EACb,UAAU,EACV,YAAY,EAKZ,MAAM,EAEN,aAAa,EACb,cAAc,EACd,SAAS,EACT,gBAAgB,GAKjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,+BAA+B,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAE9E,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAExC,IAAa,qBAAqB,6BAAlC,MAAa,qBAAsB,SAAQ,aAAa;IACtD,YAC8D,WAA4B;QAExF,KAAK,CAAC;YACJ,KAAK,EAAE,uBAAqB,CAAC,IAAI;YACjC,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE;YACrD,QAAQ,EAAE;gBACR,CAAC,uBAAuB,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,IAAI,CAA6B;oBAC/E,GAAG,EAAE,uBAAuB,CAAC,YAAY;iBAC1C,CAAC,CAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;aACzC;SACF,CAAC,CAAC;QAVyD,gBAAW,GAAX,WAAW,CAAiB;IAW1F,CAAC;IAEQ,OAAO;QACd,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAA0B;YAC/D,GAAG,EAAE,uBAAuB,CAAC,WAAW;YACxC,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAA4B;YACnE,GAAG,EAAE,uBAAuB,CAAC,aAAa;YAC1C,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAA6B;YACnE,GAAG,EAAE,uBAAuB,CAAC,YAAY;YACzC,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAsB;YAC/D,GAAG,EAAE,uBAAuB,CAAC,eAAe;YAC5C,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QAEH,8FAA8F;QAC9F,6FAA6F;QAC7F,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY,IAAI,CAAC,cAAc,EAAE,CAAC;YACpD,MAAM,QAAQ,CAAC;gBACb,OAAO,EACL,qGAAqG;aACxG,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAyB,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC;QAEhG,IAAI,UAAU,EAAE,CAAC;YACf,QAAQ,UAAU,CAAC,QAAQ,EAAE,CAAC;gBAC5B,KAAK,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;oBACvB,IAAI,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;oBACpD,MAAM;gBACR,CAAC;gBACD,KAAK,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;oBACxB,IAAI,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;oBACrD,MAAM;gBACR,CAAC;gBACD,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,QAAQ,CAAC;wBACb,OAAO,EAAE,kDAAmD,UAAkB,CAAC,QAAQ,EAAE;qBAC1F,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,iBAAiB,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;QAE3C,IAAI,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAEpC,IAAI,CAAC,YAAY,EAAE,CAAC;QAEpB,OAAO,IAAI,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACvC,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,WAAW,CAAC,IAAuC;QAC/D,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QACpD,IAAI,CAAC,UAAU,IAAI,CAAC,cAAc,EAAE,CAAC;YACnC,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,mCAAmC,EAAE,MAAM,CAAC,CAAC;YAE1F,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,qHAAqH,MAAM,EAAE;gBACtI,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,IAA0C;QAC9D,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;QAErC,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,GAAG,UAAU,CAAC;QAEpD,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;YAC/C,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,iDAAiD,SAAS,EAAE;aACtE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,+CAA+C;aACzD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW;aACb,IAAI,CAA0B,EAAE,GAAG,EAAE,uBAAuB,CAAC,WAAW,EAAE,CAAC;aAC3E,OAAO,CAAC,UAAU,CAAC,CAAC;QACvB,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAE1C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACjF,CAAC;IAEO,cAAc,CAAC,IAA2C;QAChE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;QAEtC,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;gBACtB,MAAM,UAAU,GAAG,WAAW,CAAC;gBAE/B,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;oBAC1D,MAAM,QAAQ,CAAC;wBACb,OAAO,EAAE,4EAA4E;qBACtF,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAChF,MAAM,QAAQ,CAAC;wBACb,OAAO,EAAE,gEAAgE,CAAC,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;qBACrH,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC;oBACpB,MAAM,QAAQ,CAAC,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC,CAAC;gBAClF,CAAC;gBAED,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC;oBAClC,MAAM,QAAQ,CAAC;wBACb,OAAO,EAAE,gEAAgE;qBAC1E,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,WAAW;qBACb,IAAI,CAAqB,EAAE,GAAG,EAAE,uBAAuB,CAAC,YAAY,EAAE,CAAC;qBACvE,OAAO,CAAC,UAAU,CAAC,CAAC;gBACvB,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;gBAEjD,wGAAwG;gBACxG,OAAO,CAAC,QAAQ,CACd,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAC,EAC1D,cAAc,CACf,CAAC;gBACF,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;gBAE5C,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;qBAC7B,IAAI,CAAC,6CAA6C,CAAC,CAAC;gBACvD,MAAM;YACR,CAAC;YAED,KAAK,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACxB,MAAM,YAAY,GAAG,WAAW,CAAC;gBAEjC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;oBAC1B,MAAM,QAAQ,CAAC,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC,CAAC;gBACxF,CAAC;gBAED,IAAI,CAAC,WAAW;qBACb,IAAI,CAAuB,EAAE,GAAG,EAAE,uBAAuB,CAAC,YAAY,EAAE,CAAC;qBACzE,OAAO,CAAC,YAAY,CAAC,CAAC;gBACzB,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;gBAEnD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;gBAC3E,MAAM;YACR,CAAC;YAED,OAAO,CAAC,CAAC,CAAC;gBACR,wFAAwF;gBACxF,MAAM,QAAQ,CAAC;oBACb,OAAO,EAAE,uCAAwC,WAAkC,CAAC,IAAI,EAAE;iBAC3F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,iBAAiB,CAAC,IAA8C;QACtE,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;QAEhC,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;iBAChC,KAAK,CAAC,8DAA8D,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,QAAQ,CAAC;gBACb,OAAO,EACL,yGAAyG;aAC5G,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,gBAAgB,EAAE,CAAC;YACrC,MAAM,QAAQ,CAAC;gBACb,OAAO,EACL,wIAAwI;aAC3I,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;QAE1D,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;YAExD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,IAAI,gBAAgB,CAAC,iBAAiB,CAAC;YACjF,IAAI,CAAC,WAAW;iBACb,IAAI,CAAS,EAAE,GAAG,EAAE,uBAAuB,CAAC,kBAAkB,EAAE,CAAC;iBACjE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAErB,iFAAiF;YACjF,OAAO,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;YAC3E,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;QACtD,CAAC;QAED,8BAA8B,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;YACpD,SAAS,EAAE,IAAI,CAAC,WAAW;YAC3B,UAAU,EAAE;gBACV,EAAE,IAAI,EAAE,cAAc,CAAC,gBAAgB,EAAE,QAAQ,EAAE,6BAA6B,EAAE;aACnF;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;aAChC,IAAI,CACH,wEAAwE,EACxE,cAAc,CAAC,IAAI,EACnB,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,EAC5B,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAC/D,CAAC;IACN,CAAC;IAEO,eAAe,CAAC,IAAkD;QACxE,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;QAE9B,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;iBAC9B,KAAK,CAAC,yDAAyD,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,iBAAiB,EAAE,CAAC;YACpC,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,0DAA0D;aACpE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW;aACb,IAAI,CAA4B,EAAE,GAAG,EAAE,uBAAuB,CAAC,aAAa,EAAE,CAAC;aAC/E,OAAO,CAAC,YAAY,CAAC,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAE5C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACrF,CAAC;IAEO,iBAAiB,CAAC,IAAuC;QAC/D,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAEjD,IAAI,CAAC,WAAW,EAAE,iBAAiB,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC/E,OAAO;QACT,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,QAAQ,CAAC;gBACb,OAAO,EAAE,0EAA0E;aACpF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAG,oBAAoB,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;QACxE,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;QAE5C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAClF,CAAC;IAED,YAAY;QACV,wBAAwB;IAC1B,CAAC;CACF,CAAA;AA/SY,qBAAqB;IAE7B,WAAA,MAAM,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,oBAAoB,EAAE,CAAC,CAAA;;GAF1C,qBAAqB,CA+SjC","sourcesContent":["import type { BaseApplication } from '@/base/applications/base';\nimport { type ValueOrPromise } from '@venizia/ignis-helpers/common';\nimport { getError } from '@venizia/ignis-helpers/core';\nimport { Binding } from '@venizia/ignis-inversion';\nimport {\n  AuthenticateBindingKeys,\n  Authentication,\n  AuthenticationStrategyRegistry,\n  BaseComponent,\n  controller,\n  CoreBindings,\n  type IAuthenticateOptions,\n  type IJWKSIssuerOptions,\n  type IJWKSVerifierOptions,\n  type IJWSTokenServiceOptions,\n  inject,\n  type IServiceAuthOptions,\n  JOSEStandards,\n  JWKSKeyFormats,\n  JWKSModes,\n  ServiceAssertion,\n  type TAuthenticationRestOptions,\n  type TBasicTokenServiceOptions,\n  type TJWKSTokenServiceOptions,\n  type TJWTTokenServiceOptions,\n} from '@venizia/ignis-kernel';\nimport { defineAuthController, JWKSController } from './controllers';\nimport { ServiceCertsController } from './controllers/service-certs';\nimport {\n  BasicTokenService,\n  JWKSIssuerTokenService,\n  JWKSVerifierTokenService,\n  JWSTokenService,\n} from './services';\nimport { JoseLoader } from './services/jose-loader';\nimport { ServiceAssertionSignerService } from './services/service/signer.service';\nimport { ServiceAssertionVerifierService } from './services/service/verifier.service';\nimport { ServiceAuthenticationStrategy } from './strategies/service.strategy';\n\nconst DEFAULT_SECRET = 'unknown_secret';\n\nexport class AuthenticateComponent extends BaseComponent {\n  constructor(\n    @inject({ key: CoreBindings.APPLICATION_INSTANCE }) private application: BaseApplication,\n  ) {\n    super({\n      scope: AuthenticateComponent.name,\n      initDefault: { enable: true, container: application },\n      bindings: {\n        [AuthenticateBindingKeys.REST_OPTIONS]: Binding.bind<TAuthenticationRestOptions>({\n          key: AuthenticateBindingKeys.REST_OPTIONS,\n        }).toValue({ useAuthController: false }),\n      },\n    });\n  }\n\n  override binding(): ValueOrPromise<void> {\n    const jwtOptions = this.application.get<TJWTTokenServiceOptions>({\n      key: AuthenticateBindingKeys.JWT_OPTIONS,\n      isOptional: true,\n    });\n    const basicOptions = this.application.get<TBasicTokenServiceOptions>({\n      key: AuthenticateBindingKeys.BASIC_OPTIONS,\n      isOptional: true,\n    });\n    const restOptions = this.application.get<TAuthenticationRestOptions>({\n      key: AuthenticateBindingKeys.REST_OPTIONS,\n      isOptional: true,\n    });\n    const serviceOptions = this.application.get<IServiceAuthOptions>({\n      key: AuthenticateBindingKeys.SERVICE_OPTIONS,\n      isOptional: true,\n    });\n\n    // A service that only VERIFIES assertions needs neither jwt nor basic - and that application,\n    // an IGNIS app consuming no user tokens at all, is exactly what the service strategy is for.\n    if (!jwtOptions && !basicOptions && !serviceOptions) {\n      throw getError({\n        message:\n          '[AuthenticateComponent] At least one of jwtOptions, basicOptions or serviceOptions must be provided',\n      });\n    }\n\n    const options: IAuthenticateOptions = { restOptions, jwtOptions, basicOptions, serviceOptions };\n\n    if (jwtOptions) {\n      switch (jwtOptions.standard) {\n        case JOSEStandards.JWS: {\n          this.defineJWSAuth({ options: jwtOptions.options });\n          break;\n        }\n        case JOSEStandards.JWKS: {\n          this.defineJWKSAuth({ options: jwtOptions.options });\n          break;\n        }\n        default: {\n          throw getError({\n            message: `[AuthenticateComponent] Unknown JOSE standard: ${(jwtOptions as any).standard}`,\n          });\n        }\n      }\n    }\n\n    this.defineBasicAuth({ basicOptions });\n    this.defineServiceAuth({ serviceOptions });\n\n    this.defineControllers({ options });\n\n    this.defineOAuth2();\n\n    return this.preloadJose({ options });\n  }\n\n  /**\n   * Loads `jose` at boot when a configured service signs or verifies with it, so a missing or broken\n   * install fails the boot instead of answering every token check with a 401.\n   */\n  private async preloadJose(opts: { options: IAuthenticateOptions }): Promise<void> {\n    const { jwtOptions, serviceOptions } = opts.options;\n    if (!jwtOptions && !serviceOptions) {\n      return;\n    }\n\n    try {\n      await JoseLoader.load();\n    } catch (error) {\n      const reason = error instanceof Error ? error.message : String(error);\n      this.logger.for(this.preloadJose.name).error(\"Failed to load 'jose' | Error: %s\", reason);\n\n      throw getError({\n        message: `[AuthenticateComponent] Cannot load 'jose', which JWT and service authentication need. Please install it | Error: ${reason}`,\n        cause: error,\n      });\n    }\n  }\n\n  private defineJWSAuth(opts: { options: IJWSTokenServiceOptions }): void {\n    const { options: jwsOptions } = opts;\n\n    const { jwtSecret, getTokenExpiresFn } = jwsOptions;\n\n    if (!jwtSecret || jwtSecret === DEFAULT_SECRET) {\n      throw getError({\n        message: `[defineJWSAuth] Invalid jwtSecret | Provided: ${jwtSecret}`,\n      });\n    }\n\n    if (!getTokenExpiresFn) {\n      throw getError({\n        message: '[defineJWSAuth] getTokenExpiresFn is required',\n      });\n    }\n\n    this.application\n      .bind<IJWSTokenServiceOptions>({ key: AuthenticateBindingKeys.JWT_OPTIONS })\n      .toValue(jwsOptions);\n    this.application.service(JWSTokenService);\n\n    this.logger.for(this.defineJWSAuth.name).info('JWS authentication configured');\n  }\n\n  private defineJWKSAuth(opts: { options: TJWKSTokenServiceOptions }): void {\n    const { options: jwksOptions } = opts;\n\n    switch (jwksOptions.mode) {\n      case JWKSModes.ISSUER: {\n        const issuerOpts = jwksOptions;\n\n        if (!issuerOpts.keys?.private || !issuerOpts.keys?.public) {\n          throw getError({\n            message: '[defineJWKSAuth] keys.private and keys.public are required for issuer mode',\n          });\n        }\n\n        if (!issuerOpts.keys?.format || !JWKSKeyFormats.isValid(issuerOpts.keys.format)) {\n          throw getError({\n            message: `[defineJWKSAuth] keys.format is required and must be one of: ${[...JWKSKeyFormats.SCHEME_SET].join(', ')}`,\n          });\n        }\n\n        if (!issuerOpts.kid) {\n          throw getError({ message: '[defineJWKSAuth] kid is required for issuer mode' });\n        }\n\n        if (!issuerOpts.getTokenExpiresFn) {\n          throw getError({\n            message: '[defineJWKSAuth] getTokenExpiresFn is required for issuer mode',\n          });\n        }\n\n        this.application\n          .bind<IJWKSIssuerOptions>({ key: AuthenticateBindingKeys.JWKS_OPTIONS })\n          .toValue(issuerOpts);\n        this.application.service(JWKSIssuerTokenService);\n\n        // Path depends on a runtime option, so @controller can't be applied statically — decorate here instead.\n        Reflect.decorate(\n          [controller({ path: issuerOpts?.rest?.path ?? '/certs' })],\n          JWKSController,\n        );\n        this.application.controller(JWKSController);\n\n        this.logger\n          .for(this.defineJWKSAuth.name)\n          .info('JWKS issuer configured with /certs endpoint');\n        break;\n      }\n\n      case JWKSModes.VERIFIER: {\n        const verifierOpts = jwksOptions;\n\n        if (!verifierOpts.jwksUrl) {\n          throw getError({ message: '[defineJWKSAuth] jwksUrl is required for verifier mode' });\n        }\n\n        this.application\n          .bind<IJWKSVerifierOptions>({ key: AuthenticateBindingKeys.JWKS_OPTIONS })\n          .toValue(verifierOpts);\n        this.application.service(JWKSVerifierTokenService);\n\n        this.logger.for(this.defineJWKSAuth.name).info('JWKS verifier configured');\n        break;\n      }\n\n      default: {\n        // Same exhaustive-switch-narrows-to-never situation as the JOSE standard default above.\n        throw getError({\n          message: `[defineJWKSAuth] Invalid JWKS mode: ${(jwksOptions as { mode?: unknown }).mode}`,\n        });\n      }\n    }\n  }\n\n  /**\n   * Service-to-service authentication. Absent options mean no strategy is registered and no route is\n   * mounted, so an application that never sets them is byte-identical to today.\n   *\n   * The certs route is mounted only when SIGNING keys are present. Most services are called and\n   * never call; publishing a key set for a service that signs nothing advertises a capability it\n   * does not have.\n   */\n  private defineServiceAuth(opts: { serviceOptions?: IServiceAuthOptions }): void {\n    const { serviceOptions } = opts;\n\n    if (!serviceOptions) {\n      this.logger\n        .for(this.defineServiceAuth.name)\n        .debug('serviceOptions not provided, skipping service authentication');\n      return;\n    }\n\n    if (!serviceOptions.name) {\n      throw getError({\n        message:\n          '[defineServiceAuth] name is required | it is the issuer this service stamps and the audience it demands',\n      });\n    }\n\n    if (!serviceOptions.resolvePrincipal) {\n      throw getError({\n        message:\n          '[defineServiceAuth] resolvePrincipal is required | the framework proves WHICH SERVICE called, the application decides who that acts as',\n      });\n    }\n\n    this.application.service(ServiceAssertionVerifierService);\n\n    if (serviceOptions.keys) {\n      this.application.service(ServiceAssertionSignerService);\n\n      const restPath = serviceOptions.rest?.path ?? ServiceAssertion.DEFAULT_REST_PATH;\n      this.application\n        .bind<string>({ key: AuthenticateBindingKeys.SERVICE_CERTS_PATH })\n        .toValue(restPath);\n\n      // Path depends on a runtime option, so @controller cannot be applied statically.\n      Reflect.decorate([controller({ path: restPath })], ServiceCertsController);\n      this.application.controller(ServiceCertsController);\n    }\n\n    AuthenticationStrategyRegistry.getInstance().register({\n      container: this.application,\n      strategies: [\n        { name: Authentication.STRATEGY_SERVICE, strategy: ServiceAuthenticationStrategy },\n      ],\n    });\n\n    this.logger\n      .for(this.defineServiceAuth.name)\n      .info(\n        'Service authentication configured | name: %s | signs: %s | callers: %s',\n        serviceOptions.name,\n        Boolean(serviceOptions.keys),\n        Object.keys(serviceOptions.callers ?? {}).join(', ') || 'none',\n      );\n  }\n\n  private defineBasicAuth(opts: { basicOptions?: TBasicTokenServiceOptions }): void {\n    const { basicOptions } = opts;\n\n    if (!basicOptions) {\n      this.logger\n        .for(this.defineBasicAuth.name)\n        .debug('basicOptions not provided, skipping Basic configuration');\n      return;\n    }\n\n    if (!basicOptions.verifyCredentials) {\n      throw getError({\n        message: '[defineBasicAuth] verifyCredentials function is required',\n      });\n    }\n\n    this.application\n      .bind<TBasicTokenServiceOptions>({ key: AuthenticateBindingKeys.BASIC_OPTIONS })\n      .toValue(basicOptions);\n    this.application.service(BasicTokenService);\n\n    this.logger.for(this.defineBasicAuth.name).info('Basic authentication configured');\n  }\n\n  private defineControllers(opts: { options: IAuthenticateOptions }): void {\n    const { restOptions, jwtOptions } = opts.options;\n\n    if (!restOptions?.useAuthController) {\n      this.logger.for(this.defineControllers.name).debug('Auth controller disabled');\n      return;\n    }\n\n    if (!jwtOptions) {\n      throw getError({\n        message: '[defineControllers] Auth controller requires jwtOptions to be configured',\n      });\n    }\n\n    const AuthController = defineAuthController(restOptions.controllerOpts);\n    this.application.controller(AuthController);\n\n    this.logger.for(this.defineControllers.name).info('Auth controller registered');\n  }\n\n  defineOAuth2() {\n    // TODO Implement OAuth2\n  }\n}\n"]}