@volter/twin-xidentity 0.1.0 → 0.1.2

package/src/xidentity-store.ts

@@ -41,6 +41,13 @@ export const RESOURCE_TYPES = [
   'refresh_token',
   'grant',
   'rate_window',
+  // OAuth 1.0a (xidentity-oauth1.ts): an App registered through the twin door, a request token
+  // in flight between the three legs, an issued access token, and the (app, user) grant that lets
+  // GET oauth/authenticate skip a screen already approved.
+  'oauth1_app',
+  'oauth1_request_token',
+  'oauth1_token',
+  'oauth1_grant',
 ] as const;
 export type ResourceType = (typeof RESOURCE_TYPES)[number];
 
@@ -174,7 +181,7 @@ export const mintRefreshToken = (root: string | undefined, at: number, subject:
 // ── the authorize screen's handle: DETERMINISTIC, because it is SERVED (R9) ─────────────────────
 /** FNV-1a over the seed, widened by re-hashing with a round counter until `n` hex chars exist
  *  (the resend exemplar's `stableHex`). Pure: no clock, no entropy, no host state. */
-function stableHex(seed: string, n: number): string {
+export function stableHex(seed: string, n: number): string {
   let out = '';
   for (let round = 0; out.length < n; round += 1) {
     let h = 0x811c9dc5;

package/src/xidentity-twin.ts

@@ -59,6 +59,7 @@ import { applyTwinWriteAtomic, type TwinResource } from '@volter/world-core';
 import { consentPageHtml, errorPageHtml, xIdentityConsentState } from './xidentity-consent-ui.ts';
 import { formatScopeParam, parseScopeParam } from './xidentity-scopes.ts';
 import { normalizeChallengeMethod, pkceVerifies } from './xidentity-pkce.ts';
+import { OAUTH1_ENDPOINTS, OAUTH1_WRITE_PATHS, routeOAuth1, scopesOfAccessLevel, verifyUserContext } from './xidentity-oauth1.ts';
 import {
   authRequestIdFor,
   ensureSeed,
@@ -688,8 +689,11 @@ function enumMessage(param: string, bad: string[], allowed: readonly string[]):
 async function usersMe(req: XIdentityRequest, query: URLSearchParams): Promise<XResponse> {
   const root = req.root;
   const header = req.headers?.authorization ?? '';
-  const bearer = /^bearer\s+(.+)$/i.exec(header)?.[1]?.trim();
-  if (!bearer) return unauthorizedProblem();
+  // Two schemes, as the OpenAPI's security for this operation lists them: an OAuth 2.0 user bearer
+  // (OAuth2UserToken) or OAuth 1.0a User Context (UserToken), verified in xidentity-oauth1.ts.
+  const oauth1 = /^oauth\s/i.test(header);
+  const bearer = oauth1 ? undefined : /^bearer\s+(.+)$/i.exec(header)?.[1]?.trim();
+  if (!bearer && !oauth1) return unauthorizedProblem();
 
   // Parameter validation happens BEFORE rate accounting: a 400 is not a spent request.
   // EXTRAPOLATION on the ordering (`xidentity.rate.what_counts`, todo).
@@ -708,17 +712,29 @@ async function usersMe(req: XIdentityRequest, query: URLSearchParams): Promise<X
   // `xidentity.users_me.expansion_hydration` (todo) owns the honest gap.
 
   const evaluate = (resources: readonly TwinResource[], spend: boolean) => {
-    const tokenRow = resources.find((row) => row.type === 'access_token' && row.id === bearer) as Row | undefined;
-    if (!tokenRow || tokenRow.revoked === true
-      || (typeof tokenRow.expiresAt === 'number' && nowSeconds(req.occurredAt) >= tokenRow.expiresAt)) {
-      return { response: unauthorizedProblem() };
+    let sub: string;
+    let held: string[];
+    if (oauth1) {
+      // A signed request with an access token this pack issued and has not revoked; anything else
+      // (unknown consumer, bad signature, revoked token) is the same about:blank 401 a bad bearer gets.
+      const who = verifyUserContext(req, resources);
+      if (!who) return { response: unauthorizedProblem() };
+      sub = String(who.token.userId);
+      held = scopesOfAccessLevel(who.token.accessLevel);
+    } else {
+      const tokenRow = resources.find((row) => row.type === 'access_token' && row.id === bearer) as Row | undefined;
+      if (!tokenRow || tokenRow.revoked === true
+        || (typeof tokenRow.expiresAt === 'number' && nowSeconds(req.occurredAt) >= tokenRow.expiresAt)) {
+        return { response: unauthorizedProblem() };
+      }
+      sub = String(tokenRow.sub);
+      held = parseScopeParam(String(tokenRow.scope));
     }
-    const held = parseScopeParam(String(tokenRow.scope));
     const missing = USERS_ME_REQUIRED_SCOPES.filter((scope) => !held.includes(scope));
     if (missing.length > 0) {
       return { response: forbiddenProblem(`The access token does not carry the scope(s) required by this endpoint: ${missing.join(', ')}.`) };
     }
-    const account = resources.find((row) => row.type === 'account' && row.id === String(tokenRow.sub)) as Row | undefined;
+    const account = resources.find((row) => row.type === 'account' && row.id === sub) as Row | undefined;
     if (!account) return { response: unauthorizedProblem() };
     const now = nowSeconds(req.occurredAt);
     const windowId = `users_me:${account.id}`;
@@ -779,6 +795,7 @@ export function xIdentityTwinSnapshot(): { implementedEndpoints: string[]; resou
       'POST /2/oauth2/token',
       'POST /2/oauth2/revoke',
       'GET /2/users/me',
+      ...OAUTH1_ENDPOINTS,
     ],
     resourceTypes: STORE_RESOURCE_TYPES,
     grantTypes: ['authorization_code', 'refresh_token'],
@@ -921,7 +938,8 @@ async function routeXIdentityTwinRequest(req: XIdentityRequest): Promise<XRespon
   // D3: a read-only twin cannot mint credentials or settle consent. GET /2/users/me stays served
   // (a read), with rate accounting suspended. The refusal is an OAuth error body, so a client sees
   // a protocol error rather than an HTML surprise.
-  const writes = path.startsWith('/_twin/') || path === '/2/oauth2/token' || path === '/2/oauth2/revoke';
+  const writes = path.startsWith('/_twin/') || path === '/2/oauth2/token' || path === '/2/oauth2/revoke' || OAUTH1_WRITE_PATHS.has(path)
+    || (method === 'POST' && path === '/oauth/authorize');
   if (req.readOnly && writes) {
     return oauthError('temporarily_unavailable', 'this twin was started read-only; omit readOnly to accept writes', 405);
   }
@@ -930,6 +948,9 @@ async function routeXIdentityTwinRequest(req: XIdentityRequest): Promise<XRespon
   // a world with clients, personas and a signed-in session — exactly what a browser at x.com has.
   if (!req.readOnly) await ensureSeed({ root: req.root, ...(req.occurredAt ? { occurredAt: req.occurredAt } : {}), ...((req.callbackOrigin ?? req.origin) ? { origin: req.callbackOrigin ?? req.origin } : {}) });
 
+  const oauth1 = await routeOAuth1(req, method, path);
+  if (oauth1) return oauth1;
+
   const control = await twinControl(req, path, form);
   if (control) return control;