@venizia/ignis 0.4.3 → 0.4.5

package/dist/esm/components/auth/authenticate/services/service/signer.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/service/signer.service.ts"],"names":[],"mappings":"AACA,OAAO,EAA2B,WAAW,EAAoB,MAAM,uBAAuB,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAGjE,OAAO,KAAK,EAAa,GAAG,EAAE,MAAM,MAAM,CAAC;AAK3C;;;;;GAKG;AACH,qBAAa,6BAA8B,SAAQ,WAAW;IAU1D,OAAO,CAAC,QAAQ,CAAC,OAAO;IAT1B,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAEhC;IAEH,OAAO,CAAC,UAAU,CAAC,CAAY;IAC/B,OAAO,CAAC,IAAI,CAAC,CAAkB;gBAIZ,OAAO,EAAE,mBAAmB;IAK/C,SAAS,IAAI,OAAO;IAIpB,wGAAwG;IACxG,QAAQ,IAAI,MAAM;IAKlB;;;;;;OAMG;IACG,IAAI,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAyBrF;;;;;;;OAOG;IACG,aAAa,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,CAAC;YA0BjC,iBAAiB;YAWjB,OAAO;IAiBrB,OAAO,CAAC,aAAa;CAUtB"}

package/dist/esm/components/auth/authenticate/services/service/signer.service.js

@@ -0,0 +1,135 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var ServiceAssertionSignerService_1;
+import { inject } from '../../../../../base/metadata/index.js';
+import { AuthenticateBindingKeys, BaseService, ServiceAssertion } from '@venizia/ignis-kernel';
+import { getError, RequestIdGenerator } from '@venizia/ignis-helpers/core';
+import { HTTP } from '@venizia/ignis-helpers/common';
+import { readFile } from 'node:fs/promises';
+import { JWKSKeyDrivers, JWKSKeyFormats } from '@venizia/ignis-kernel';
+import { JoseLoader } from '../jose-loader.js';
+/**
+ * Mints the outgoing assertion, and publishes the public half for callees to verify against.
+ *
+ * Only a service that CALLS OUT needs this. `isEnabled()` is false when the application configured
+ * no keys, and the component then mounts no certs route.
+ */
+let ServiceAssertionSignerService = ServiceAssertionSignerService_1 = class ServiceAssertionSignerService extends BaseService {
+    constructor(options) {
+        super({ scope: ServiceAssertionSignerService_1.name });
+        this.options = options;
+        this.requestIdGenerator = new RequestIdGenerator({
+            scope: ServiceAssertionSignerService_1.name,
+        });
+    }
+    isEnabled() {
+        return Boolean(this.options.keys);
+    }
+    /** `<name>_<rest path without its slash>`, so a rotated mount changes the kid rather than colliding. */
+    getKeyId() {
+        const restPath = this.options.rest?.path ?? ServiceAssertion.DEFAULT_REST_PATH;
+        return this.options.keys?.kid ?? `${this.options.name}_${restPath.replace(/^\//, '')}`;
+    }
+    /**
+     * One assertion, bound to this exact call.
+     *
+     * `path` must be the percent-ENCODED pathname - `new URL(target).pathname`. The verifier compares
+     * against the same shape, and a decoded path here would fail every route carrying a space or a
+     * non-ASCII slug.
+     */
+    async sign(opts) {
+        const { method, path, audience } = opts;
+        this.assertEnabled();
+        const { SignJWT } = await JoseLoader.load();
+        const now = Math.floor(Date.now() / 1000);
+        const lifetime = this.options.signLifetimeSeconds ?? ServiceAssertion.DEFAULT_SIGN_LIFETIME_SECONDS;
+        return new SignJWT({ htm: method.toUpperCase(), htu: path })
+            .setProtectedHeader({
+            alg: ServiceAssertion.ALGORITHM,
+            kid: this.getKeyId(),
+            typ: ServiceAssertion.TYP,
+        })
+            .setIssuer(this.options.name)
+            .setSubject(this.options.name)
+            .setAudience(audience)
+            .setJti(this.requestIdGenerator.nextId())
+            .setIssuedAt(now)
+            .setExpirationTime(now + lifetime)
+            .sign(await this.resolvePrivateKey());
+    }
+    /**
+     * The document `/svc-certs` serves, built from the PUBLIC key only.
+     *
+     * `importSPKI` refuses a private PEM outright, which is what makes the private half unreachable
+     * from here by construction rather than by care. The JWK format is deliberately NOT accepted for
+     * this path: `importJWK` imports whatever it is handed, and a private JWK marked `"ext": true`
+     * round-trips its `d` straight into this document. See `JWKSIssuerTokenService.assertPublicJWK`.
+     */
+    async getPublicJWKS() {
+        if (this.jwks) {
+            return this.jwks;
+        }
+        this.assertEnabled();
+        const { exportJWK, importSPKI } = await JoseLoader.load();
+        const raw = await this.readKey({ source: this.options.keys.public });
+        const publicKey = await importSPKI(raw, ServiceAssertion.ALGORITHM);
+        const jwk = await exportJWK(publicKey);
+        if (jwk.d !== undefined) {
+            throw getError({
+                statusCode: HTTP.ResultCodes.RS_5.InternalServerError,
+                message: `[${ServiceAssertionSignerService_1.name}] The public key material carries a private exponent | this key would be published at the certs endpoint`,
+            });
+        }
+        this.jwks = {
+            keys: [{ ...jwk, kid: this.getKeyId(), alg: ServiceAssertion.ALGORITHM, use: 'sig' }],
+        };
+        return this.jwks;
+    }
+    async resolvePrivateKey() {
+        if (this.privateKey) {
+            return this.privateKey;
+        }
+        const { importPKCS8 } = await JoseLoader.load();
+        const raw = await this.readKey({ source: this.options.keys.private });
+        this.privateKey = await importPKCS8(raw, ServiceAssertion.ALGORITHM);
+        return this.privateKey;
+    }
+    async readKey(opts) {
+        const { format, driver } = this.options.keys;
+        if (format !== JWKSKeyFormats.PEM) {
+            throw getError({
+                statusCode: HTTP.ResultCodes.RS_5.InternalServerError,
+                message: `[${ServiceAssertionSignerService_1.name}] Only the '${JWKSKeyFormats.PEM}' key format is supported | got: ${format}`,
+            });
+        }
+        if (driver === JWKSKeyDrivers.FILE) {
+            return readFile(opts.source, 'utf-8');
+        }
+        return opts.source;
+    }
+    assertEnabled() {
+        if (this.options.keys) {
+            return;
+        }
+        throw getError({
+            statusCode: HTTP.ResultCodes.RS_5.InternalServerError,
+            message: `[${ServiceAssertionSignerService_1.name}] This service has no signing keys | it can verify assertions but not mint them`,
+        });
+    }
+};
+ServiceAssertionSignerService = ServiceAssertionSignerService_1 = __decorate([
+    __param(0, inject({ key: AuthenticateBindingKeys.SERVICE_OPTIONS })),
+    __metadata("design:paramtypes", [Object])
+], ServiceAssertionSignerService);
+export { ServiceAssertionSignerService };
+//# sourceMappingURL=signer.service.js.map

package/dist/esm/components/auth/authenticate/services/service/signer.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.service.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/service/signer.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE/F,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,IAAI,EAAE,MAAM,+BAA+B,CAAC;AAErD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C;;;;;GAKG;AACH,IAAa,6BAA6B,qCAA1C,MAAa,6BAA8B,SAAQ,WAAW;IAQ5D,YAEE,OAA6C;QAE7C,KAAK,CAAC,EAAE,KAAK,EAAE,+BAA6B,CAAC,IAAI,EAAE,CAAC,CAAC;QAFpC,YAAO,GAAP,OAAO,CAAqB;QAT9B,uBAAkB,GAAG,IAAI,kBAAkB,CAAC;YAC3D,KAAK,EAAE,+BAA6B,CAAC,IAAI;SAC1C,CAAC,CAAC;IAUH,CAAC;IAED,SAAS;QACP,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,wGAAwG;IACxG,QAAQ;QACN,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,gBAAgB,CAAC,iBAAiB,CAAC;QAC/E,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;IACzF,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,IAAwD;QACjE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QAExC,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,QAAQ,GACZ,IAAI,CAAC,OAAO,CAAC,mBAAmB,IAAI,gBAAgB,CAAC,6BAA6B,CAAC;QAErF,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;aACzD,kBAAkB,CAAC;YAClB,GAAG,EAAE,gBAAgB,CAAC,SAAS;YAC/B,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE;YACpB,GAAG,EAAE,gBAAgB,CAAC,GAAG;SAC1B,CAAC;aACD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;aAC5B,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;aAC7B,WAAW,CAAC,QAAQ,CAAC;aACrB,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;aACxC,WAAW,CAAC,GAAG,CAAC;aAChB,iBAAiB,CAAC,GAAG,GAAG,QAAQ,CAAC;aACjC,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa;QACjB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;QAEvC,IAAI,GAAG,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,QAAQ,CAAC;gBACb,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,IAAI,+BAA6B,CAAC,IAAI,0GAA0G;aAC1J,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAI,GAAG;YACV,IAAI,EAAE,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;SACtF,CAAC;QAEF,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAwB;QAC5C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC;QAE9C,IAAI,MAAM,KAAK,cAAc,CAAC,GAAG,EAAE,CAAC;YAClC,MAAM,QAAQ,CAAC;gBACb,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,IAAI,+BAA6B,CAAC,IAAI,eAAe,cAAc,CAAC,GAAG,oCAAoC,MAAM,EAAE;aAC7H,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,KAAK,cAAc,CAAC,IAAI,EAAE,CAAC;YACnC,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,aAAa;QACnB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,CAAC;YACb,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,IAAI,+BAA6B,CAAC,IAAI,iFAAiF;SACjI,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAjIY,6BAA6B;IASrC,WAAA,MAAM,CAAC,EAAE,GAAG,EAAE,uBAAuB,CAAC,eAAe,EAAE,CAAC,CAAA;;GAThD,6BAA6B,CAiIzC","sourcesContent":["import { inject } from '@/base/metadata';\nimport { AuthenticateBindingKeys, BaseService, ServiceAssertion } from '@venizia/ignis-kernel';\nimport type { IServiceAuthOptions } from '@venizia/ignis-kernel';\nimport { getError, RequestIdGenerator } from '@venizia/ignis-helpers/core';\nimport { HTTP } from '@venizia/ignis-helpers/common';\nimport type { CryptoKey, JWK } from 'jose';\nimport { readFile } from 'node:fs/promises';\nimport { JWKSKeyDrivers, JWKSKeyFormats } from '@venizia/ignis-kernel';\nimport { JoseLoader } from '../jose-loader';\n\n/**\n * Mints the outgoing assertion, and publishes the public half for callees to verify against.\n *\n * Only a service that CALLS OUT needs this. `isEnabled()` is false when the application configured\n * no keys, and the component then mounts no certs route.\n */\nexport class ServiceAssertionSignerService extends BaseService {\n  private readonly requestIdGenerator = new RequestIdGenerator({\n    scope: ServiceAssertionSignerService.name,\n  });\n\n  private privateKey?: CryptoKey;\n  private jwks?: { keys: JWK[] };\n\n  constructor(\n    @inject({ key: AuthenticateBindingKeys.SERVICE_OPTIONS })\n    private readonly options: IServiceAuthOptions,\n  ) {\n    super({ scope: ServiceAssertionSignerService.name });\n  }\n\n  isEnabled(): boolean {\n    return Boolean(this.options.keys);\n  }\n\n  /** `<name>_<rest path without its slash>`, so a rotated mount changes the kid rather than colliding. */\n  getKeyId(): string {\n    const restPath = this.options.rest?.path ?? ServiceAssertion.DEFAULT_REST_PATH;\n    return this.options.keys?.kid ?? `${this.options.name}_${restPath.replace(/^\\//, '')}`;\n  }\n\n  /**\n   * One assertion, bound to this exact call.\n   *\n   * `path` must be the percent-ENCODED pathname - `new URL(target).pathname`. The verifier compares\n   * against the same shape, and a decoded path here would fail every route carrying a space or a\n   * non-ASCII slug.\n   */\n  async sign(opts: { method: string; path: string; audience: string }): Promise<string> {\n    const { method, path, audience } = opts;\n\n    this.assertEnabled();\n\n    const { SignJWT } = await JoseLoader.load();\n    const now = Math.floor(Date.now() / 1000);\n    const lifetime =\n      this.options.signLifetimeSeconds ?? ServiceAssertion.DEFAULT_SIGN_LIFETIME_SECONDS;\n\n    return new SignJWT({ htm: method.toUpperCase(), htu: path })\n      .setProtectedHeader({\n        alg: ServiceAssertion.ALGORITHM,\n        kid: this.getKeyId(),\n        typ: ServiceAssertion.TYP,\n      })\n      .setIssuer(this.options.name)\n      .setSubject(this.options.name)\n      .setAudience(audience)\n      .setJti(this.requestIdGenerator.nextId())\n      .setIssuedAt(now)\n      .setExpirationTime(now + lifetime)\n      .sign(await this.resolvePrivateKey());\n  }\n\n  /**\n   * The document `/svc-certs` serves, built from the PUBLIC key only.\n   *\n   * `importSPKI` refuses a private PEM outright, which is what makes the private half unreachable\n   * from here by construction rather than by care. The JWK format is deliberately NOT accepted for\n   * this path: `importJWK` imports whatever it is handed, and a private JWK marked `\"ext\": true`\n   * round-trips its `d` straight into this document. See `JWKSIssuerTokenService.assertPublicJWK`.\n   */\n  async getPublicJWKS(): Promise<{ keys: JWK[] }> {\n    if (this.jwks) {\n      return this.jwks;\n    }\n\n    this.assertEnabled();\n\n    const { exportJWK, importSPKI } = await JoseLoader.load();\n    const raw = await this.readKey({ source: this.options.keys!.public });\n    const publicKey = await importSPKI(raw, ServiceAssertion.ALGORITHM);\n    const jwk = await exportJWK(publicKey);\n\n    if (jwk.d !== undefined) {\n      throw getError({\n        statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n        message: `[${ServiceAssertionSignerService.name}] The public key material carries a private exponent | this key would be published at the certs endpoint`,\n      });\n    }\n\n    this.jwks = {\n      keys: [{ ...jwk, kid: this.getKeyId(), alg: ServiceAssertion.ALGORITHM, use: 'sig' }],\n    };\n\n    return this.jwks;\n  }\n\n  private async resolvePrivateKey(): Promise<CryptoKey> {\n    if (this.privateKey) {\n      return this.privateKey;\n    }\n\n    const { importPKCS8 } = await JoseLoader.load();\n    const raw = await this.readKey({ source: this.options.keys!.private });\n    this.privateKey = await importPKCS8(raw, ServiceAssertion.ALGORITHM);\n    return this.privateKey;\n  }\n\n  private async readKey(opts: { source: string }): Promise<string> {\n    const { format, driver } = this.options.keys!;\n\n    if (format !== JWKSKeyFormats.PEM) {\n      throw getError({\n        statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n        message: `[${ServiceAssertionSignerService.name}] Only the '${JWKSKeyFormats.PEM}' key format is supported | got: ${format}`,\n      });\n    }\n\n    if (driver === JWKSKeyDrivers.FILE) {\n      return readFile(opts.source, 'utf-8');\n    }\n\n    return opts.source;\n  }\n\n  private assertEnabled(): void {\n    if (this.options.keys) {\n      return;\n    }\n\n    throw getError({\n      statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n      message: `[${ServiceAssertionSignerService.name}] This service has no signing keys | it can verify assertions but not mint them`,\n    });\n  }\n}\n"]}

package/dist/esm/components/auth/authenticate/services/service/verifier.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/service/verifier.service.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,WAAW,EAEZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAA2B,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAO1F;;;;;;;;GAQG;AACH,qBAAa,+BAAgC,SAAQ,WAAW;IAS5D,OAAO,CAAC,QAAQ,CAAC,OAAO;IAR1B,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAE5D,oEAAoE;IACpE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;gBAIxC,OAAO,EAAE,mBAAmB;IAK/C;;;OAGG;IACG,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAahG;;;;OAIG;IACH,OAAO,CAAC,UAAU;IAqBlB,OAAO,CAAC,aAAa;YAyCP,SAAS;IAwDvB,OAAO,CAAC,oBAAoB;CAoB7B"}

package/dist/esm/components/auth/authenticate/services/service/verifier.service.js

@@ -0,0 +1,163 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var ServiceAssertionVerifierService_1;
+import { inject } from '../../../../../base/metadata/index.js';
+import { AuthenticateBindingKeys, AuthenticationErrors, BaseService, ServiceAssertion, } from '@venizia/ignis-kernel';
+import { getError } from '@venizia/ignis-helpers/core';
+import { JoseLoader } from '../jose-loader.js';
+/**
+ * Verifies an incoming service assertion against the CALLER's own JWKS.
+ *
+ * What the assertion covers, and nothing else: the HTTP method and the percent-encoded path. It does
+ * NOT cover the query string, any header, or the body. Tenant selectors in particular are usually a
+ * header or a query parameter, so an assertion alone does not authenticate which tenant a call acts
+ * on - the caller allowlist and the application's own scoping have to do that. Stated because the
+ * gap is invisible from the call site.
+ */
+let ServiceAssertionVerifierService = ServiceAssertionVerifierService_1 = class ServiceAssertionVerifierService extends BaseService {
+    constructor(options) {
+        super({ scope: ServiceAssertionVerifierService_1.name });
+        this.options = options;
+        /** One remote key set per caller, kept because `createRemoteJWKSet` owns its own cache. */
+        this.keySets = new Map();
+        /** Per-caller accepted age, resolved once alongside its key set. */
+        this.acceptMaxAges = new Map();
+    }
+    /**
+     * @param path The percent-ENCODED pathname, from `new URL(context.req.url).pathname`. Never
+     * `context.req.path` - Hono decodes that one, and the caller signed the encoded form.
+     */
+    async verify(opts) {
+        const { token, method, path } = opts;
+        const jose = await JoseLoader.load();
+        const issuer = this.readIssuer({ token, jose });
+        const keySet = this.resolveKeySet({ issuer, jose });
+        const payload = await this.runVerify({ token, issuer, keySet, jose });
+        this.assertRequestBinding({ payload, method, path });
+        return { issuer };
+    }
+    /**
+     * Reads `iss` WITHOUT verifying, only to choose which key set checks the signature. The same value
+     * is then enforced as the expected issuer, so a forged `iss` buys nothing beyond selecting the key
+     * set that will reject it.
+     */
+    readIssuer(opts) {
+        let issuer;
+        try {
+            ({ iss: issuer } = opts.jose.decodeJwt(opts.token));
+        }
+        catch (error) {
+            this.logger.for(this.readIssuer.name).warn('Undecodable assertion | error: %s', error);
+            throw getError({ error: AuthenticationErrors.ASSERTION_INVALID });
+        }
+        // Typed, not merely present: a numeric `iss` would index the caller map by coercion.
+        if (typeof issuer !== 'string' || issuer.length === 0) {
+            this.logger
+                .for(this.readIssuer.name)
+                .warn('Undecodable assertion | iss is missing or not a string');
+            throw getError({ error: AuthenticationErrors.ASSERTION_INVALID });
+        }
+        return issuer;
+    }
+    resolveKeySet(opts) {
+        const { issuer, jose } = opts;
+        const cached = this.keySets.get(issuer);
+        if (cached) {
+            return cached;
+        }
+        const callers = this.options.callers ?? {};
+        // `Object.hasOwn`, never a truthiness check on the index: the map arrives as a plain object, so
+        // `iss: 'constructor'` would otherwise return `Function` - truthy - walk past this guard, and
+        // reach `new URL(<function>)` as an uncaught TypeError.
+        if (!Object.hasOwn(callers, issuer)) {
+            this.logger
+                .for(this.resolveKeySet.name)
+                .warn('Caller not on the allowlist | iss: %s', issuer);
+            throw getError({ error: AuthenticationErrors.CALLER_NOT_ALLOWED });
+        }
+        const entry = callers[issuer];
+        const jwksUrl = typeof entry === 'string' ? entry : entry.jwksUrl;
+        this.acceptMaxAges.set(issuer, ServiceAssertion.resolveAcceptMaxAge({
+            callerOverride: typeof entry === 'string' ? undefined : entry.acceptMaxAgeSeconds,
+            serviceDefault: this.options.acceptMaxAgeSeconds,
+        }));
+        const keySet = jose.createRemoteJWKSet(new URL(jwksUrl), {
+            cacheMaxAge: this.options.jwks?.cacheMaxAgeMs ?? ServiceAssertion.DEFAULT_JWKS_CACHE_MAX_AGE_MS,
+            cooldownDuration: this.options.jwks?.cooldownMs ?? ServiceAssertion.DEFAULT_JWKS_COOLDOWN_MS,
+        });
+        this.keySets.set(issuer, keySet);
+        return keySet;
+    }
+    async runVerify(opts) {
+        const { token, issuer, keySet, jose } = opts;
+        // Resolved when the key set was, so a per-caller override is already folded in.
+        const maxTokenAge = this.acceptMaxAges.get(issuer) ??
+            ServiceAssertion.resolveAcceptMaxAge({
+                serviceDefault: this.options.acceptMaxAgeSeconds,
+            });
+        const clockTolerance = this.options.clockToleranceSeconds ?? ServiceAssertion.DEFAULT_CLOCK_TOLERANCE_SECONDS;
+        try {
+            const { payload } = await jose.jwtVerify(token, keySet, {
+                algorithms: [ServiceAssertion.ALGORITHM],
+                typ: ServiceAssertion.TYP,
+                issuer,
+                audience: this.options.name,
+                // NOT redundant with `exp`, though it looks it. An honest caller stamps `exp = iat +
+                // lifetime`, so the two are numerically tied and jose reaches `exp` first - measured.
+                // `maxTokenAge` is the only bound that still holds when the CALLER is the attacker and picks
+                // its own `exp`, which is precisely the case it exists for. Do not delete it as dead config.
+                //
+                // And it is the CALLEE's number, never one the caller may request: a caller that could ask
+                // for a longer window would be choosing its own replay window, which is the whole thing this
+                // is here to deny.
+                //
+                // TWO NUMBERS, and they answer different questions. Measured at the defaults, 60 + 5:
+                //   - 65s is the ACCEPTANCE window on this machine's clock. Age 64 passes, 65 does not.
+                //   - 70s is the REPLAY window in wall-clock time, when the caller's clock runs the full
+                //     tolerance fast: we accept an `iat` up to 5s in our future, then keep accepting for
+                //     another 64. Measured: still accepted 69s after minting.
+                // The second is the one a threat model asks for. Widening `clockToleranceSeconds` widens it
+                // second for second, so it is a security knob, not an operational one.
+                maxTokenAge,
+                clockTolerance,
+                requiredClaims: ['htm', 'htu', 'jti'],
+            });
+            return payload;
+        }
+        catch (error) {
+            // One code out, the reason on `cause`: a wrong audience, clock skew and a rotated key are
+            // otherwise the same string to whoever is reading the log at 2am.
+            const reason = error?.cause ?? error;
+            this.logger.for(this.runVerify.name).warn('Rejected | iss: %s | reason: %s', issuer, reason);
+            throw getError({ error: AuthenticationErrors.ASSERTION_INVALID, cause: error });
+        }
+    }
+    assertRequestBinding(opts) {
+        const { payload, method, path } = opts;
+        const signed = `${payload.htm} ${payload.htu}`;
+        const actual = `${method.toUpperCase()} ${path}`;
+        if (signed === actual) {
+            return;
+        }
+        this.logger
+            .for(this.assertRequestBinding.name)
+            .warn('Request binding mismatch | signed: %s | actual: %s', signed, actual);
+        throw getError({ error: AuthenticationErrors.REQUEST_BINDING_MISMATCH });
+    }
+};
+ServiceAssertionVerifierService = ServiceAssertionVerifierService_1 = __decorate([
+    __param(0, inject({ key: AuthenticateBindingKeys.SERVICE_OPTIONS })),
+    __metadata("design:paramtypes", [Object])
+], ServiceAssertionVerifierService);
+export { ServiceAssertionVerifierService };
+//# sourceMappingURL=verifier.service.js.map

package/dist/esm/components/auth/authenticate/services/service/verifier.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.service.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/service/verifier.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,WAAW,EACX,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAI5C;;;;;;;;GAQG;AACH,IAAa,+BAA+B,uCAA5C,MAAa,+BAAgC,SAAQ,WAAW;IAO9D,YAEE,OAA6C;QAE7C,KAAK,CAAC,EAAE,KAAK,EAAE,iCAA+B,CAAC,IAAI,EAAE,CAAC,CAAC;QAFtC,YAAO,GAAP,OAAO,CAAqB;QAR/C,2FAA2F;QAC1E,YAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;QAE5D,oEAAoE;QACnD,kBAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAO3D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,IAAqD;QAChE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAErC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtE,IAAI,CAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAErD,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACK,UAAU,CAAC,IAAoD;QACrE,IAAI,MAAe,CAAC;QAEpB,IAAI,CAAC;YACH,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;YACvF,MAAM,QAAQ,CAAC,EAAE,KAAK,EAAE,oBAAoB,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,qFAAqF;QACrF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;iBACzB,IAAI,CAAC,wDAAwD,CAAC,CAAC;YAClE,MAAM,QAAQ,CAAC,EAAE,KAAK,EAAE,oBAAoB,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,aAAa,CAAC,IAAqD;QACzE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QAE3C,gGAAgG;QAChG,8FAA8F;QAC9F,wDAAwD;QACxD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;iBAC5B,IAAI,CAAC,uCAAuC,EAAE,MAAM,CAAC,CAAC;YACzD,MAAM,QAAQ,CAAC,EAAE,KAAK,EAAE,oBAAoB,CAAC,kBAAkB,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;QAElE,IAAI,CAAC,aAAa,CAAC,GAAG,CACpB,MAAM,EACN,gBAAgB,CAAC,mBAAmB,CAAC;YACnC,cAAc,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB;YACjF,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB;SACjD,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE;YACvD,WAAW,EACT,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,IAAI,gBAAgB,CAAC,6BAA6B;YACpF,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,IAAI,gBAAgB,CAAC,wBAAwB;SAC7F,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAKvB;QACC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAE7C,gFAAgF;QAChF,MAAM,WAAW,GACf,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC;YAC9B,gBAAgB,CAAC,mBAAmB,CAAC;gBACnC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB;aACjD,CAAC,CAAC;QAEL,MAAM,cAAc,GAClB,IAAI,CAAC,OAAO,CAAC,qBAAqB,IAAI,gBAAgB,CAAC,+BAA+B,CAAC;QAEzF,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAA0B,KAAK,EAAE,MAAM,EAAE;gBAC/E,UAAU,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC;gBACxC,GAAG,EAAE,gBAAgB,CAAC,GAAG;gBACzB,MAAM;gBACN,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;gBAC3B,qFAAqF;gBACrF,sFAAsF;gBACtF,6FAA6F;gBAC7F,6FAA6F;gBAC7F,EAAE;gBACF,2FAA2F;gBAC3F,6FAA6F;gBAC7F,mBAAmB;gBACnB,EAAE;gBACF,sFAAsF;gBACtF,wFAAwF;gBACxF,yFAAyF;gBACzF,yFAAyF;gBACzF,8DAA8D;gBAC9D,4FAA4F;gBAC5F,uEAAuE;gBACvE,WAAW;gBACX,cAAc;gBACd,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;aACtC,CAAC,CAAC;YAEH,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0FAA0F;YAC1F,kEAAkE;YAClE,MAAM,MAAM,GAAI,KAA6B,EAAE,KAAK,IAAI,KAAK,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iCAAiC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAE7F,MAAM,QAAQ,CAAC,EAAE,KAAK,EAAE,oBAAoB,CAAC,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,IAI5B;QACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAEvC,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC;QAEjD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;aACnC,IAAI,CAAC,oDAAoD,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAE9E,MAAM,QAAQ,CAAC,EAAE,KAAK,EAAE,oBAAoB,CAAC,wBAAwB,EAAE,CAAC,CAAC;IAC3E,CAAC;CACF,CAAA;AA9KY,+BAA+B;IAQvC,WAAA,MAAM,CAAC,EAAE,GAAG,EAAE,uBAAuB,CAAC,eAAe,EAAE,CAAC,CAAA;;GARhD,+BAA+B,CA8K3C","sourcesContent":["import { inject } from '@/base/metadata';\nimport {\n  AuthenticateBindingKeys,\n  AuthenticationErrors,\n  BaseService,\n  ServiceAssertion,\n} from '@venizia/ignis-kernel';\nimport type { IServiceAssertionClaims, IServiceAuthOptions } from '@venizia/ignis-kernel';\nimport { getError } from '@venizia/ignis-helpers/core';\nimport type { createRemoteJWKSet } from 'jose';\nimport { JoseLoader } from '../jose-loader';\n\ntype TRemoteKeySet = ReturnType<typeof createRemoteJWKSet>;\n\n/**\n * Verifies an incoming service assertion against the CALLER's own JWKS.\n *\n * What the assertion covers, and nothing else: the HTTP method and the percent-encoded path. It does\n * NOT cover the query string, any header, or the body. Tenant selectors in particular are usually a\n * header or a query parameter, so an assertion alone does not authenticate which tenant a call acts\n * on - the caller allowlist and the application's own scoping have to do that. Stated because the\n * gap is invisible from the call site.\n */\nexport class ServiceAssertionVerifierService extends BaseService {\n  /** One remote key set per caller, kept because `createRemoteJWKSet` owns its own cache. */\n  private readonly keySets = new Map<string, TRemoteKeySet>();\n\n  /** Per-caller accepted age, resolved once alongside its key set. */\n  private readonly acceptMaxAges = new Map<string, number>();\n\n  constructor(\n    @inject({ key: AuthenticateBindingKeys.SERVICE_OPTIONS })\n    private readonly options: IServiceAuthOptions,\n  ) {\n    super({ scope: ServiceAssertionVerifierService.name });\n  }\n\n  /**\n   * @param path The percent-ENCODED pathname, from `new URL(context.req.url).pathname`. Never\n   * `context.req.path` - Hono decodes that one, and the caller signed the encoded form.\n   */\n  async verify(opts: { token: string; method: string; path: string }): Promise<{ issuer: string }> {\n    const { token, method, path } = opts;\n\n    const jose = await JoseLoader.load();\n    const issuer = this.readIssuer({ token, jose });\n    const keySet = this.resolveKeySet({ issuer, jose });\n    const payload = await this.runVerify({ token, issuer, keySet, jose });\n\n    this.assertRequestBinding({ payload, method, path });\n\n    return { issuer };\n  }\n\n  /**\n   * Reads `iss` WITHOUT verifying, only to choose which key set checks the signature. The same value\n   * is then enforced as the expected issuer, so a forged `iss` buys nothing beyond selecting the key\n   * set that will reject it.\n   */\n  private readIssuer(opts: { token: string; jose: typeof import('jose') }): string {\n    let issuer: unknown;\n\n    try {\n      ({ iss: issuer } = opts.jose.decodeJwt(opts.token));\n    } catch (error) {\n      this.logger.for(this.readIssuer.name).warn('Undecodable assertion | error: %s', error);\n      throw getError({ error: AuthenticationErrors.ASSERTION_INVALID });\n    }\n\n    // Typed, not merely present: a numeric `iss` would index the caller map by coercion.\n    if (typeof issuer !== 'string' || issuer.length === 0) {\n      this.logger\n        .for(this.readIssuer.name)\n        .warn('Undecodable assertion | iss is missing or not a string');\n      throw getError({ error: AuthenticationErrors.ASSERTION_INVALID });\n    }\n\n    return issuer;\n  }\n\n  private resolveKeySet(opts: { issuer: string; jose: typeof import('jose') }): TRemoteKeySet {\n    const { issuer, jose } = opts;\n\n    const cached = this.keySets.get(issuer);\n    if (cached) {\n      return cached;\n    }\n\n    const callers = this.options.callers ?? {};\n\n    // `Object.hasOwn`, never a truthiness check on the index: the map arrives as a plain object, so\n    // `iss: 'constructor'` would otherwise return `Function` - truthy - walk past this guard, and\n    // reach `new URL(<function>)` as an uncaught TypeError.\n    if (!Object.hasOwn(callers, issuer)) {\n      this.logger\n        .for(this.resolveKeySet.name)\n        .warn('Caller not on the allowlist | iss: %s', issuer);\n      throw getError({ error: AuthenticationErrors.CALLER_NOT_ALLOWED });\n    }\n\n    const entry = callers[issuer];\n    const jwksUrl = typeof entry === 'string' ? entry : entry.jwksUrl;\n\n    this.acceptMaxAges.set(\n      issuer,\n      ServiceAssertion.resolveAcceptMaxAge({\n        callerOverride: typeof entry === 'string' ? undefined : entry.acceptMaxAgeSeconds,\n        serviceDefault: this.options.acceptMaxAgeSeconds,\n      }),\n    );\n\n    const keySet = jose.createRemoteJWKSet(new URL(jwksUrl), {\n      cacheMaxAge:\n        this.options.jwks?.cacheMaxAgeMs ?? ServiceAssertion.DEFAULT_JWKS_CACHE_MAX_AGE_MS,\n      cooldownDuration: this.options.jwks?.cooldownMs ?? ServiceAssertion.DEFAULT_JWKS_COOLDOWN_MS,\n    });\n\n    this.keySets.set(issuer, keySet);\n    return keySet;\n  }\n\n  private async runVerify(opts: {\n    token: string;\n    issuer: string;\n    keySet: TRemoteKeySet;\n    jose: typeof import('jose');\n  }): Promise<IServiceAssertionClaims> {\n    const { token, issuer, keySet, jose } = opts;\n\n    // Resolved when the key set was, so a per-caller override is already folded in.\n    const maxTokenAge =\n      this.acceptMaxAges.get(issuer) ??\n      ServiceAssertion.resolveAcceptMaxAge({\n        serviceDefault: this.options.acceptMaxAgeSeconds,\n      });\n\n    const clockTolerance =\n      this.options.clockToleranceSeconds ?? ServiceAssertion.DEFAULT_CLOCK_TOLERANCE_SECONDS;\n\n    try {\n      const { payload } = await jose.jwtVerify<IServiceAssertionClaims>(token, keySet, {\n        algorithms: [ServiceAssertion.ALGORITHM],\n        typ: ServiceAssertion.TYP,\n        issuer,\n        audience: this.options.name,\n        // NOT redundant with `exp`, though it looks it. An honest caller stamps `exp = iat +\n        // lifetime`, so the two are numerically tied and jose reaches `exp` first - measured.\n        // `maxTokenAge` is the only bound that still holds when the CALLER is the attacker and picks\n        // its own `exp`, which is precisely the case it exists for. Do not delete it as dead config.\n        //\n        // And it is the CALLEE's number, never one the caller may request: a caller that could ask\n        // for a longer window would be choosing its own replay window, which is the whole thing this\n        // is here to deny.\n        //\n        // TWO NUMBERS, and they answer different questions. Measured at the defaults, 60 + 5:\n        //   - 65s is the ACCEPTANCE window on this machine's clock. Age 64 passes, 65 does not.\n        //   - 70s is the REPLAY window in wall-clock time, when the caller's clock runs the full\n        //     tolerance fast: we accept an `iat` up to 5s in our future, then keep accepting for\n        //     another 64. Measured: still accepted 69s after minting.\n        // The second is the one a threat model asks for. Widening `clockToleranceSeconds` widens it\n        // second for second, so it is a security knob, not an operational one.\n        maxTokenAge,\n        clockTolerance,\n        requiredClaims: ['htm', 'htu', 'jti'],\n      });\n\n      return payload;\n    } catch (error) {\n      // One code out, the reason on `cause`: a wrong audience, clock skew and a rotated key are\n      // otherwise the same string to whoever is reading the log at 2am.\n      const reason = (error as { cause?: unknown })?.cause ?? error;\n      this.logger.for(this.runVerify.name).warn('Rejected | iss: %s | reason: %s', issuer, reason);\n\n      throw getError({ error: AuthenticationErrors.ASSERTION_INVALID, cause: error });\n    }\n  }\n\n  private assertRequestBinding(opts: {\n    payload: IServiceAssertionClaims;\n    method: string;\n    path: string;\n  }): void {\n    const { payload, method, path } = opts;\n\n    const signed = `${payload.htm} ${payload.htu}`;\n    const actual = `${method.toUpperCase()} ${path}`;\n\n    if (signed === actual) {\n      return;\n    }\n\n    this.logger\n      .for(this.assertRequestBinding.name)\n      .warn('Request binding mismatch | signed: %s | actual: %s', signed, actual);\n\n    throw getError({ error: AuthenticationErrors.REQUEST_BINDING_MISMATCH });\n  }\n}\n"]}

package/dist/esm/components/auth/authenticate/strategies/basic.strategy.d.ts

@@ -0,0 +1,13 @@
+import { type TContext } from '@venizia/ignis-kernel';
+import { BaseHelper } from '@venizia/ignis-helpers/core';
+import { type Env } from 'hono';
+import { type IAuthUser, type IAuthenticationStrategy } from '@venizia/ignis-kernel';
+import { BasicTokenService } from '../services/index.js';
+/** HTTP Basic Authentication strategy using Authorization header credentials. */
+export declare class BasicAuthenticationStrategy<E extends Env = Env> extends BaseHelper implements IAuthenticationStrategy<E> {
+    private service;
+    name: string;
+    constructor(service: BasicTokenService<E>);
+    authenticate(context: TContext<E, string>): Promise<IAuthUser>;
+}
+//# sourceMappingURL=basic.strategy.d.ts.map

package/dist/esm/components/auth/authenticate/strategies/basic.strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"basic.strategy.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/strategies/basic.strategy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGtD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,uBAAuB,EAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,iFAAiF;AACjF,qBAAa,2BAA2B,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAC1D,SAAQ,UACR,YAAW,uBAAuB,CAAC,CAAC,CAAC;IAWnC,OAAO,CAAC,OAAO;IATjB,IAAI,SAAiC;gBAS3B,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAKjC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;CAIrE"}

package/dist/esm/components/auth/authenticate/strategies/basic.strategy.js

@@ -0,0 +1,42 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var BasicAuthenticationStrategy_1;
+import { inject } from '@venizia/ignis-kernel';
+import { BindingNamespaces } from '@venizia/ignis-kernel';
+import { BaseHelper } from '@venizia/ignis-helpers/core';
+import { BindingKeys } from '@venizia/ignis-inversion';
+import { Authentication, } from '@venizia/ignis-kernel';
+import { BasicTokenService } from '../services/index.js';
+/** HTTP Basic Authentication strategy using Authorization header credentials. */
+let BasicAuthenticationStrategy = BasicAuthenticationStrategy_1 = class BasicAuthenticationStrategy extends BaseHelper {
+    constructor(service) {
+        super({ scope: BasicAuthenticationStrategy_1.name });
+        this.service = service;
+        this.name = Authentication.STRATEGY_BASIC;
+    }
+    async authenticate(context) {
+        const credentials = this.service.extractCredentials(context);
+        return this.service.verify({ credentials, context });
+    }
+};
+BasicAuthenticationStrategy = BasicAuthenticationStrategy_1 = __decorate([
+    __param(0, inject({
+        key: BindingKeys.build({
+            namespace: BindingNamespaces.SERVICE,
+            key: BasicTokenService.name,
+        }),
+    })),
+    __metadata("design:paramtypes", [BasicTokenService])
+], BasicAuthenticationStrategy);
+export { BasicAuthenticationStrategy };
+//# sourceMappingURL=basic.strategy.js.map

package/dist/esm/components/auth/authenticate/strategies/basic.strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"basic.strategy.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/strategies/basic.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;AACA,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EACL,cAAc,GAGf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,iFAAiF;AACjF,IAAa,2BAA2B,mCAAxC,MAAa,2BACX,SAAQ,UAAU;IAKlB,YAOE,OAAqC;QAErC,KAAK,CAAC,EAAE,KAAK,EAAE,6BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC;QAF3C,YAAO,GAAP,OAAO,CAAsB;QATvC,SAAI,GAAG,cAAc,CAAC,cAAc,CAAC;IAYrC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAA4B;QAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,CAAC;CACF,CAAA;AAtBY,2BAA2B;IAOnC,WAAA,MAAM,CAAC;QACN,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC;YACrB,SAAS,EAAE,iBAAiB,CAAC,OAAO;YACpC,GAAG,EAAE,iBAAiB,CAAC,IAAI;SAC5B,CAAC;KACH,CAAC,CAAA;qCACe,iBAAiB;GAbzB,2BAA2B,CAsBvC","sourcesContent":["import { type TContext } from '@venizia/ignis-kernel';\nimport { inject } from '@venizia/ignis-kernel';\nimport { BindingNamespaces } from '@venizia/ignis-kernel';\nimport { BaseHelper } from '@venizia/ignis-helpers/core';\nimport { BindingKeys } from '@venizia/ignis-inversion';\nimport { type Env } from 'hono';\nimport {\n  Authentication,\n  type IAuthUser,\n  type IAuthenticationStrategy,\n} from '@venizia/ignis-kernel';\nimport { BasicTokenService } from '../services';\n\n/** HTTP Basic Authentication strategy using Authorization header credentials. */\nexport class BasicAuthenticationStrategy<E extends Env = Env>\n  extends BaseHelper\n  implements IAuthenticationStrategy<E>\n{\n  name = Authentication.STRATEGY_BASIC;\n\n  constructor(\n    @inject({\n      key: BindingKeys.build({\n        namespace: BindingNamespaces.SERVICE,\n        key: BasicTokenService.name,\n      }),\n    })\n    private service: BasicTokenService<E>,\n  ) {\n    super({ scope: BasicAuthenticationStrategy.name });\n  }\n\n  async authenticate(context: TContext<E, string>): Promise<IAuthUser> {\n    const credentials = this.service.extractCredentials(context);\n    return this.service.verify({ credentials, context });\n  }\n}\n"]}

package/dist/esm/components/auth/authenticate/strategies/index.d.ts

@@ -0,0 +1,6 @@
+export * from '@venizia/ignis-kernel';
+export * from './basic.strategy.js';
+export * from './jws.strategy.js';
+export * from './jwks/index.js';
+export * from './service.strategy.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/components/auth/authenticate/strategies/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/strategies/index.ts"],"names":[],"mappings":"AACA,cAAc,uBAAuB,CAAC;AAEtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,QAAQ,CAAC;AACvB,cAAc,oBAAoB,CAAC"}

package/dist/esm/components/auth/authenticate/strategies/index.js

@@ -0,0 +1,7 @@
+// `strategy-registry.ts` moved to the kernel - the strategies below register themselves into it.
+export * from '@venizia/ignis-kernel';
+export * from './basic.strategy.js';
+export * from './jws.strategy.js';
+export * from './jwks/index.js';
+export * from './service.strategy.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/components/auth/authenticate/strategies/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/strategies/index.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,cAAc,uBAAuB,CAAC;AAEtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,QAAQ,CAAC;AACvB,cAAc,oBAAoB,CAAC","sourcesContent":["// `strategy-registry.ts` moved to the kernel - the strategies below register themselves into it.\nexport * from '@venizia/ignis-kernel';\n\nexport * from './basic.strategy';\nexport * from './jws.strategy';\nexport * from './jwks';\nexport * from './service.strategy';\n"]}

package/dist/esm/components/auth/authenticate/strategies/jwks/index.d.ts

@@ -0,0 +1,3 @@
+export * from './issuer.js';
+export * from './verifier.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/components/auth/authenticate/strategies/jwks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/strategies/jwks/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC"}

package/dist/esm/components/auth/authenticate/strategies/jwks/index.js

@@ -0,0 +1,3 @@
+export * from './issuer.js';
+export * from './verifier.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/components/auth/authenticate/strategies/jwks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/strategies/jwks/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC","sourcesContent":["export * from './issuer';\nexport * from './verifier';\n"]}

package/dist/esm/components/auth/authenticate/strategies/jwks/issuer.d.ts

@@ -0,0 +1,13 @@
+import { type TContext } from '@venizia/ignis-kernel';
+import { BaseHelper } from '@venizia/ignis-helpers/core';
+import { type Env } from 'hono';
+import { type IAuthUser, type IAuthenticationStrategy } from '@venizia/ignis-kernel';
+import { JWKSIssuerTokenService } from '../../services/index.js';
+export declare class JWKSIssuerAuthenticationStrategy<E extends Env = Env> extends BaseHelper implements IAuthenticationStrategy<E> {
+    private service;
+    name: string;
+    standard: string;
+    constructor(service: JWKSIssuerTokenService<E>);
+    authenticate(context: TContext<E, string>): Promise<IAuthUser>;
+}
+//# sourceMappingURL=issuer.d.ts.map

package/dist/esm/components/auth/authenticate/strategies/jwks/issuer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issuer.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/strategies/jwks/issuer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGtD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,uBAAuB,EAE7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAExD,qBAAa,gCAAgC,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAC/D,SAAQ,UACR,YAAW,uBAAuB,CAAC,CAAC,CAAC;IAYnC,OAAO,CAAC,OAAO;IAVjB,IAAI,SAA+B;IACnC,QAAQ,SAAsB;gBASpB,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAK5C,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;CAI/D"}

package/dist/esm/components/auth/authenticate/strategies/jwks/issuer.js

@@ -0,0 +1,42 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var JWKSIssuerAuthenticationStrategy_1;
+import { inject } from '@venizia/ignis-kernel';
+import { BindingNamespaces } from '@venizia/ignis-kernel';
+import { BaseHelper } from '@venizia/ignis-helpers/core';
+import { BindingKeys } from '@venizia/ignis-inversion';
+import { Authentication, JOSEStandards, } from '@venizia/ignis-kernel';
+import { JWKSIssuerTokenService } from '../../services/index.js';
+let JWKSIssuerAuthenticationStrategy = JWKSIssuerAuthenticationStrategy_1 = class JWKSIssuerAuthenticationStrategy extends BaseHelper {
+    constructor(service) {
+        super({ scope: JWKSIssuerAuthenticationStrategy_1.name });
+        this.service = service;
+        this.name = Authentication.STRATEGY_JWT;
+        this.standard = JOSEStandards.JWKS;
+    }
+    authenticate(context) {
+        const token = this.service.extractCredentials(context);
+        return this.service.verify(token);
+    }
+};
+JWKSIssuerAuthenticationStrategy = JWKSIssuerAuthenticationStrategy_1 = __decorate([
+    __param(0, inject({
+        key: BindingKeys.build({
+            namespace: BindingNamespaces.SERVICE,
+            key: JWKSIssuerTokenService.name,
+        }),
+    })),
+    __metadata("design:paramtypes", [JWKSIssuerTokenService])
+], JWKSIssuerAuthenticationStrategy);
+export { JWKSIssuerAuthenticationStrategy };
+//# sourceMappingURL=issuer.js.map

package/dist/esm/components/auth/authenticate/strategies/jwks/issuer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issuer.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/strategies/jwks/issuer.ts"],"names":[],"mappings":";;;;;;;;;;;;;AACA,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EACL,cAAc,EAGd,aAAa,GACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAExD,IAAa,gCAAgC,wCAA7C,MAAa,gCACX,SAAQ,UAAU;IAMlB,YAOE,OAA0C;QAE1C,KAAK,CAAC,EAAE,KAAK,EAAE,kCAAgC,CAAC,IAAI,EAAE,CAAC,CAAC;QAFhD,YAAO,GAAP,OAAO,CAA2B;QAV5C,SAAI,GAAG,cAAc,CAAC,YAAY,CAAC;QACnC,aAAQ,GAAG,aAAa,CAAC,IAAI,CAAC;IAY9B,CAAC;IAED,YAAY,CAAC,OAA4B;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;CACF,CAAA;AAvBY,gCAAgC;IAQxC,WAAA,MAAM,CAAC;QACN,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC;YACrB,SAAS,EAAE,iBAAiB,CAAC,OAAO;YACpC,GAAG,EAAE,sBAAsB,CAAC,IAAI;SACjC,CAAC;KACH,CAAC,CAAA;qCACe,sBAAsB;GAd9B,gCAAgC,CAuB5C","sourcesContent":["import { type TContext } from '@venizia/ignis-kernel';\nimport { inject } from '@venizia/ignis-kernel';\nimport { BindingNamespaces } from '@venizia/ignis-kernel';\nimport { BaseHelper } from '@venizia/ignis-helpers/core';\nimport { BindingKeys } from '@venizia/ignis-inversion';\nimport { type Env } from 'hono';\nimport {\n  Authentication,\n  type IAuthUser,\n  type IAuthenticationStrategy,\n  JOSEStandards,\n} from '@venizia/ignis-kernel';\nimport { JWKSIssuerTokenService } from '../../services';\n\nexport class JWKSIssuerAuthenticationStrategy<E extends Env = Env>\n  extends BaseHelper\n  implements IAuthenticationStrategy<E>\n{\n  name = Authentication.STRATEGY_JWT;\n  standard = JOSEStandards.JWKS;\n\n  constructor(\n    @inject({\n      key: BindingKeys.build({\n        namespace: BindingNamespaces.SERVICE,\n        key: JWKSIssuerTokenService.name,\n      }),\n    })\n    private service: JWKSIssuerTokenService<E>,\n  ) {\n    super({ scope: JWKSIssuerAuthenticationStrategy.name });\n  }\n\n  authenticate(context: TContext<E, string>): Promise<IAuthUser> {\n    const token = this.service.extractCredentials(context);\n    return this.service.verify(token);\n  }\n}\n"]}

package/dist/esm/components/auth/authenticate/strategies/jwks/verifier.d.ts

@@ -0,0 +1,13 @@
+import { type TContext } from '@venizia/ignis-kernel';
+import { BaseHelper } from '@venizia/ignis-helpers/core';
+import { type Env } from 'hono';
+import { type IAuthUser, type IAuthenticationStrategy } from '@venizia/ignis-kernel';
+import { JWKSVerifierTokenService } from '../../services/index.js';
+export declare class JWKSVerifierAuthenticationStrategy<E extends Env = Env> extends BaseHelper implements IAuthenticationStrategy<E> {
+    private service;
+    name: string;
+    standard: string;
+    constructor(service: JWKSVerifierTokenService<E>);
+    authenticate(context: TContext<E, string>): Promise<IAuthUser>;
+}
+//# sourceMappingURL=verifier.d.ts.map

package/dist/esm/components/auth/authenticate/strategies/jwks/verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/strategies/jwks/verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGtD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,uBAAuB,EAE7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,qBAAa,kCAAkC,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CACjE,SAAQ,UACR,YAAW,uBAAuB,CAAC,CAAC,CAAC;IAYnC,OAAO,CAAC,OAAO;IAVjB,IAAI,SAA+B;IACnC,QAAQ,SAAsB;gBASpB,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAK9C,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;CAI/D"}

package/dist/esm/components/auth/authenticate/strategies/jwks/verifier.js

@@ -0,0 +1,42 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var JWKSVerifierAuthenticationStrategy_1;
+import { inject } from '@venizia/ignis-kernel';
+import { BindingNamespaces } from '@venizia/ignis-kernel';
+import { BaseHelper } from '@venizia/ignis-helpers/core';
+import { BindingKeys } from '@venizia/ignis-inversion';
+import { Authentication, JOSEStandards, } from '@venizia/ignis-kernel';
+import { JWKSVerifierTokenService } from '../../services/index.js';
+let JWKSVerifierAuthenticationStrategy = JWKSVerifierAuthenticationStrategy_1 = class JWKSVerifierAuthenticationStrategy extends BaseHelper {
+    constructor(service) {
+        super({ scope: JWKSVerifierAuthenticationStrategy_1.name });
+        this.service = service;
+        this.name = Authentication.STRATEGY_JWT;
+        this.standard = JOSEStandards.JWKS;
+    }
+    authenticate(context) {
+        const token = this.service.extractCredentials(context);
+        return this.service.verify(token);
+    }
+};
+JWKSVerifierAuthenticationStrategy = JWKSVerifierAuthenticationStrategy_1 = __decorate([
+    __param(0, inject({
+        key: BindingKeys.build({
+            namespace: BindingNamespaces.SERVICE,
+            key: JWKSVerifierTokenService.name,
+        }),
+    })),
+    __metadata("design:paramtypes", [JWKSVerifierTokenService])
+], JWKSVerifierAuthenticationStrategy);
+export { JWKSVerifierAuthenticationStrategy };
+//# sourceMappingURL=verifier.js.map

package/dist/esm/components/auth/authenticate/strategies/jwks/verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/strategies/jwks/verifier.ts"],"names":[],"mappings":";;;;;;;;;;;;;AACA,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EACL,cAAc,EAGd,aAAa,GACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,IAAa,kCAAkC,0CAA/C,MAAa,kCACX,SAAQ,UAAU;IAMlB,YAOE,OAA4C;QAE5C,KAAK,CAAC,EAAE,KAAK,EAAE,oCAAkC,CAAC,IAAI,EAAE,CAAC,CAAC;QAFlD,YAAO,GAAP,OAAO,CAA6B;QAV9C,SAAI,GAAG,cAAc,CAAC,YAAY,CAAC;QACnC,aAAQ,GAAG,aAAa,CAAC,IAAI,CAAC;IAY9B,CAAC;IAED,YAAY,CAAC,OAA4B;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;CACF,CAAA;AAvBY,kCAAkC;IAQ1C,WAAA,MAAM,CAAC;QACN,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC;YACrB,SAAS,EAAE,iBAAiB,CAAC,OAAO;YACpC,GAAG,EAAE,wBAAwB,CAAC,IAAI;SACnC,CAAC;KACH,CAAC,CAAA;qCACe,wBAAwB;GAdhC,kCAAkC,CAuB9C","sourcesContent":["import { type TContext } from '@venizia/ignis-kernel';\nimport { inject } from '@venizia/ignis-kernel';\nimport { BindingNamespaces } from '@venizia/ignis-kernel';\nimport { BaseHelper } from '@venizia/ignis-helpers/core';\nimport { BindingKeys } from '@venizia/ignis-inversion';\nimport { type Env } from 'hono';\nimport {\n  Authentication,\n  type IAuthUser,\n  type IAuthenticationStrategy,\n  JOSEStandards,\n} from '@venizia/ignis-kernel';\nimport { JWKSVerifierTokenService } from '../../services';\n\nexport class JWKSVerifierAuthenticationStrategy<E extends Env = Env>\n  extends BaseHelper\n  implements IAuthenticationStrategy<E>\n{\n  name = Authentication.STRATEGY_JWT;\n  standard = JOSEStandards.JWKS;\n\n  constructor(\n    @inject({\n      key: BindingKeys.build({\n        namespace: BindingNamespaces.SERVICE,\n        key: JWKSVerifierTokenService.name,\n      }),\n    })\n    private service: JWKSVerifierTokenService<E>,\n  ) {\n    super({ scope: JWKSVerifierAuthenticationStrategy.name });\n  }\n\n  authenticate(context: TContext<E, string>): Promise<IAuthUser> {\n    const token = this.service.extractCredentials(context);\n    return this.service.verify(token);\n  }\n}\n"]}