feathers-ucan 0.1.19 → 0.1.21

package/lib/index.cjs

@@ -1,2 +1,1021 @@
-var e=require("symbol-ucan"),t=require("@feathersjs/authentication");function n(e){return e&&"object"==typeof e&&"default"in e?e:{default:e}}var r=/*#__PURE__*/n(require("long-timeout"));function i(e){function t(e){if(Object(e)!==e)return Promise.reject(new TypeError(e+" is not an object."));var t=e.done;return Promise.resolve(e.value).then(function(e){return{value:e,done:t}})}return i=function(e){this.s=e,this.n=e.next},i.prototype={s:null,n:null,next:function(){return t(this.n.apply(this.s,arguments))},return:function(e){var n=this.s.return;return void 0===n?Promise.resolve({value:e,done:!0}):t(n.apply(this.s,arguments))},throw:function(e){var n=this.s.return;return void 0===n?Promise.reject(e):t(n.apply(this.s,arguments))}},new i(e)}function o(){return o=Object.assign?Object.assign.bind():function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},o.apply(this,arguments)}function a(e,t){e.prototype=Object.create(t.prototype),e.prototype.constructor=e,u(e,t)}function c(e){return c=Object.setPrototypeOf?Object.getPrototypeOf.bind():function(e){return e.__proto__||Object.getPrototypeOf(e)},c(e)}function u(e,t){return u=Object.setPrototypeOf?Object.setPrototypeOf.bind():function(e,t){return e.__proto__=t,e},u(e,t)}function s(e,t,n){return s=function(){if("undefined"==typeof Reflect||!Reflect.construct)return!1;if(Reflect.construct.sham)return!1;if("function"==typeof Proxy)return!0;try{return Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],function(){})),!0}catch(e){return!1}}()?Reflect.construct.bind():function(e,t,n){var r=[null];r.push.apply(r,t);var i=new(Function.bind.apply(e,r));return n&&u(i,n.prototype),i},s.apply(null,arguments)}function l(e){var t="function"==typeof Map?new Map:void 0;return l=function(e){if(null===e||!function(e){try{return-1!==Function.toString.call(e).indexOf("[native code]")}catch(t){return"function"==typeof e}}(e))return e;if("function"!=typeof e)throw new TypeError("Super expression must either be null or a function");if(void 0!==t){if(t.has(e))return t.get(e);t.set(e,n)}function n(){return s(e,arguments,c(this).constructor)}return n.prototype=Object.create(e.prototype,{constructor:{value:n,enumerable:!1,writable:!0,configurable:!0}}),u(n,e)},l(e)}function f(e,t){if(null==e)return{};var n,r,i={},o=Object.keys(e);for(r=0;r<o.length;r++)t.indexOf(n=o[r])>=0||(i[n]=e[n]);return i}function h(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function p(e,t){var n="undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(n)return(n=n.call(e)).next.bind(n);if(Array.isArray(e)||(n=function(e,t){if(e){if("string"==typeof e)return h(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n?Array.from(e):"Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?h(e,t):void 0}}(e))||t&&e&&"number"==typeof e.length){n&&(e=n);var r=0;return function(){return r>=e.length?{done:!0}:{done:!1,value:e[r++]}}}throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}var v=/*#__PURE__*/function(e){function t(t){return e.call(this,t)||this}return a(t,e),t}(/*#__PURE__*/l(Error)),d=/(\S+)\s+(\S+)/,y=/*#__PURE__*/function(t){function n(){for(var e,n=arguments.length,r=new Array(n),i=0;i<n;i++)r[i]=arguments[i];return(e=t.call.apply(t,[this].concat(r))||this).expirationTimers=new WeakMap,e}a(n,t);var i,c,u=n.prototype;return u.setAuthentication=function(e){e.verifyAccessToken=function(e){return{}},t.prototype.setAuthentication.call(this,e)},u.handleConnection=function(t,n,i){try{var o=this,a="logout"===t&&n.authentication&&i&&n.authentication.accessToken===i.accessToken,c=(i||{}).accessToken,u=function(){if(c&&"login"===t)return Promise.resolve(e.validateUcan(c).catch(function(e){console.log("Could not validate ucan in connection: ",e.message);var t={code:0,message:"Unknown Issue Validating Ucan"};throw e.message.indexOf("Expired.")>-1&&(t.code=1,t.message="Expired Ucan"),new Error(t.message)})).then(function(e){var t=1e3*(e||{payload:{exp:0}}).payload.exp-Date.now(),i=r.default.setTimeout(function(){return o.app.emit("disconnect",n)},t);r.default.clearTimeout(o.expirationTimers.get(n)),o.expirationTimers.set(n,i),n.authentication={strategy:o.name,accessToken:c}});("disconnect"===t||a)&&(delete n[o.configuration.entity],delete n.authentication,r.default.clearTimeout(o.expirationTimers.get(n)),o.expirationTimers.delete(n))}();return Promise.resolve(u&&u.then?u.then(function(){}):void 0)}catch(e){return Promise.reject(e)}},u.verifyConfiguration=function(){for(var e=["entity","entityId","service","header","schemes","audience"],t=0,n=Object.keys(this.configuration);t<n.length;t++){var r=n[t];if(!e.includes(r))throw new Error("Invalid ucanStrategy option 'authentication."+this.name+"."+r+"'. Did you mean to set it in 'authentication.jwtOptions'?")}if("string"!=typeof this.configuration.header)throw new Error("The 'header' option for the "+this.name+" strategy must be a string")},u.getEntityQuery=function(e){return Promise.resolve({})},u.getEntity=function(t,n){try{var r=this,i=r.entityService,a=r.configuration.entity;if(null===i)throw new v("Could not find entity service");return Promise.resolve(r.getEntityQuery(n)).then(function(r){var c=Object.assign({},e._unset(n,"provider"),{query:r});return Promise.resolve(i.get(t,c)).then(function(e){var r;return n.provider?i.get(t,o({},n,((r={})[a]=e,r))):e})})}catch(e){return Promise.reject(e)}},u.getEntityId=function(e,t){try{var n=t.query,r=t.loginId;if(r)return Promise.resolve(r);var i,a,c=this.configuration,u=c.service,s=c.core_path,l=void 0===s?"core":s,f=((i={query:o({},n,{$limit:1})})[l]=o({skipJoins:!0},t[l]),i);return Promise.resolve(null==(a=this.app)?void 0:a.service(u).find(o({},f,{skipJoins:!0,skip_hooks:!0,admin_pass:!0}))).then(function(e){if(e.total)return e.data[0]._id;throw new v("Could not find login associated with this ucan")})}catch(e){return Promise.reject(e)}},u.authenticate=function(t,n){try{var r=this,i=t.accessToken,a=t.loginId,c=t.ucan,u=r.configuration,s=u.entity,l=u.core_path;if(!i){if(!c)throw new v("Error generating ucan");i=e.ucanToken(c)}return Promise.resolve(e.validateUcan(i).catch(function(e){console.log("Could not validate ucan during authentication: ",e.message);var t={code:0,message:"Unknown Issue Validating Ucan"};throw e.message.indexOf("Expired.")>-1&&(t.code=1,t.message="Expired Ucan"),new Error(t.message)})).then(function(t){function c(){var e;return o({},f,((e={})[s]=u,e))}var u,f={accessToken:i,authentication:{strategy:"jwt",accessToken:i}};if(null===s)return f;var h=e._get(n,[l,s]),p=function(){if(!h)return Promise.resolve(r.getEntityId(f,o({},n,{loginId:a,query:{did:null==t?void 0:t.payload.aud}}))).then(function(e){return Promise.resolve(r.getEntity(e,n)).then(function(e){u=e})});u=h}();return p&&p.then?p.then(c):c()})}catch(e){return Promise.reject(e)}},u.parse=function(e){try{var t=this.configuration,n=t.schemes,r=e.headers&&e.headers[t.header.toLowerCase()];if(!r||"string"!=typeof r)return Promise.resolve(null);var i=r.match(d)||[],o=i[1],a=i[2],c=o&&n.some(function(e){return new RegExp(e,"i").test(o)});return Promise.resolve(o&&!c?null:{strategy:this.name,accessToken:c?a:r})}catch(e){return Promise.reject(e)}},i=n,(c=[{key:"configuration",get:function(){var e,n=(null==(e=this.authentication)?void 0:e.configuration)||{service:void 0,entity:void 0,entityId:void 0};return o({service:n.service,entity:n.entity,entityId:n.entityId,header:"Authorization",schemes:["Bearer","JWT"]},t.prototype.configuration)}}])&&function(e,t){for(var n=0;n<t.length;n++){var r=t[n];r.enumerable=r.enumerable||!1,r.configurable=!0,"value"in r&&(r.writable=!0),Object.defineProperty(e,"symbol"==typeof(i=function(e,t){if("object"!=typeof e||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,"string");if("object"!=typeof r)return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(r.key))?i:String(i),r)}var i}(i.prototype,c),Object.defineProperty(i,"prototype",{writable:!1}),n}(t.AuthenticationBaseStrategy),g=["NotAuthenticated"],m=/*#__PURE__*/function(e){function t(t){return e.call(this,t)||this}return a(t,e),t}(/*#__PURE__*/l(Error)),P=/*#__PURE__*/function(t){function n(e,n,r){var i;void 0===n&&(n="authentication"),void 0===r&&(r={});var o=r.NotAuthenticated,a=f(r,g);return(i=t.call(this,e,n,a)||this).options=void 0,i.app=e,i.options={NotAuthenticated:o},i}return a(n,t),n.prototype.create=function(t,n){try{var r,i,a=this,c=(null==(r=a.options)?void 0:r.NotAuthenticated)||m,u=a.app.get("authentication"),s=u.entity,l=u.service,f=u.ucan_path,h=void 0===f?"ucan":f,p=(null==(i=n)?void 0:i.authStrategies)||a.configuration.authStrategies;if(n||(n={}),!p.length)throw new c("No authentication strategies allowed for creating a JWT (`authStrategies`)");return Promise.resolve(a.authenticate.apply(a,[t,n].concat(p)).catch(function(e){throw new Error(e.message)})).then(function(r){if(r.accessToken)return r;var i=t.did||e._get(r,[s,"did"]),c=t.ucan||e._get(r,[s,"ucan"]);if(!i)throw new Error("No did audience provided");if(!c)throw new Error("No ucan provided to authentication call");return Promise.resolve(e.validateUcan(c).catch(function(e){console.log("Could not validate ucan creating authentication: ",e.message);var t={code:0,message:"Unknown Issue Validating Ucan"};return e.message.indexOf("Expired.")>-1&&(t.code=1,t.message="Expired Ucan"),console.warn("Could not validate ucan creating authentication",c,t.message),null})).then(function(t){function i(){var t=e.ucanToken(c);return o({accessToken:t},r,{authentication:o({},r.authentication,{payload:t})})}var u=function(){if(!t){var i=e.parseUcan(c),u=a.app.get("authentication"),f=e.encodeKeyPair({secretKey:u.secret});return Promise.resolve(e.buildUcan({audience:i.payload.aud,issuer:f,lifetimeInSeconds:5184e3,capabilities:i.payload.att})).then(function(t){var i;return c=t,n.admin_pass=!0,Promise.resolve(a.app.service(l).patch(e._get(r,[s,"_id"]),(i={},i[h]=e.ucanToken(c),i),o({},n))).then(function(){})})}}();return u&&u.then?u.then(i):i()})})}catch(e){return Promise.reject(e)}},n}(t.AuthenticationService),_=/*#__PURE__*/function(){function e(e,t,n){var r;this.context=void 0,this.service=void 0,this.core=void 0,this.entity=void 0,this.service=e,this.context=t;var i=(t.app.get("authentication")||{entity:"login"}).entity||"login";this.entity=i;var a=(null==(r=t.params)?void 0:r.core)||{};a[i]||(a[i]=t.params[i]),this.core=o({},a,n)}var t=e.prototype;return t.get=function(e,t){void 0===t&&(t={});try{var n,r,i,a=this,c=a.context.app.get("authentication").core_path;return Promise.resolve(null==(n=a.context.app)?void 0:n.service(a.service).get(e,o({},t,((r={})[a.entity]=t[a.entity],r),((i={})[c]=a.core,i))))}catch(e){return Promise.reject(e)}},t.find=function(e){void 0===e&&(e={});try{var t,n,r,i=this,a=i.context.app.get("authentication").core_path;return Promise.resolve(null==(t=i.context.app)?void 0:t.service(i.service).find(o({},e,((n={})[i.entity]=e[i.entity],n.skip_hooks=!0,n.admin_pass=!0,n),((r={})[a]=i.core,r))))}catch(e){return Promise.reject(e)}},t.create=function(e,t){void 0===t&&(t={});try{var n,r,i,a=this,c=a.context.app.get("authentication").core_path;return Promise.resolve(null==(n=a.context.app)?void 0:n.service(a.service).create(e,o({},t,((r={})[a.entity]=t[a.entity],r),((i={})[c]=a.core,i))))}catch(e){return Promise.reject(e)}},t.patch=function(e,t,n){void 0===n&&(n={});try{var r,i,a,c=this,u=c.context.app.get("authentication").core_path;return Promise.resolve(null==(r=c.context.app)?void 0:r.service(c.service).patch(e,t,o({},n,((i={})[c.entity]=n[c.entity],i),((a={})[u]=c.core,a))))}catch(e){return Promise.reject(e)}},t.update=function(e,t,n){void 0===n&&(n={});try{var r,i,a,c=this,u=c.context.app.get("authentication").core_path;return Promise.resolve(null==(r=c.context.app)?void 0:r.service(c.service).update(e,t,o({},n,((i={})[c.entity]=n[c.entity],i),((a={})[u]=c.core,a))))}catch(e){return Promise.reject(e)}},t.remove=function(e,t){void 0===t&&(t={});try{var n,r,i,a=this,c=a.context.app.get("authentication").core_path;return Promise.resolve(null==(n=a.context.app)?void 0:n.service(a.service).remove(e,o({},t,((r={})[a.entity]=t[a.entity],r),((i={})[c]=a.core,i))))}catch(e){return Promise.reject(e)}},t._get=function(e,t){void 0===t&&(t={});try{var n,r,i,a=this,c=a.context.app.get("authentication").core_path;return Promise.resolve(null==(n=a.context.app)?void 0:n.service(a.service)._get(e,o({},t,((r={})[a.entity]=t[a.entity],r),((i={})[c]=a.core,i))))}catch(e){return Promise.reject(e)}},t._find=function(e){void 0===e&&(e={});try{var t,n,r,i=this,a=i.context.app.get("authentication").core_path;return Promise.resolve(null==(t=i.context.app)?void 0:t.service(i.service)._find(o({},e,((n={})[i.entity]=e[i.entity],n),((r={})[a]=i.core,r))))}catch(e){return Promise.reject(e)}},t._create=function(e,t){void 0===t&&(t={});try{var n,r,i,a=this,c=a.context.app.get("authentication").core_path;return Promise.resolve(null==(n=a.context.app)?void 0:n.service(a.service)._create(e,o({},t,((r={})[a.entity]=t[a.entity],r),((i={})[c]=a.core,i))))}catch(e){return Promise.reject(e)}},t._patch=function(e,t,n){void 0===n&&(n={});try{var r,i,a,c=this,u=c.context.app.get("authentication").core_path;return Promise.resolve(null==(r=c.context.app)?void 0:r.service(c.service)._patch(e,t,o({},n,((i={})[c.entity]=n[c.entity],i),((a={})[u]=c.core,a))))}catch(e){return Promise.reject(e)}},t._update=function(e,t,n){void 0===n&&(n={});try{var r,i,a,c=this,u=c.context.app.get("authentication").core_path;return Promise.resolve(null==(r=c.context.app)?void 0:r.service(c.service)._update(e,t,o({},n,((i={})[c.entity]=n[c.entity],i),((a={})[u]=c.core,a))))}catch(e){return Promise.reject(e)}},t._remove=function(e,t){void 0===t&&(t={});try{var n,r,i,a=this,c=a.context.app.get("authentication").core_path;return Promise.resolve(null==(n=a.context.app)?void 0:n.service(a.service)._remove(e,o({},t,((r={})[a.entity]=t[a.entity],r),((i={})[c]=a.core,i))))}catch(e){return Promise.reject(e)}},e}(),b="_exists",w=function(t){var n=t.app.get("existsPath")||b;return e._get(t.params,"core."+n+"."+t.path+"."+t.id)||void 0},x=function(e,t){try{var n=w(e),r=function(){if(!n&&e.id)return Promise.resolve(new _(e.path,e,{skipJoins:!1!==(null==t?void 0:t.skipJoins)}).get(e.id,o({exists_check:!0,admin_pass:!0,skip_hooks:!0},(null==t?void 0:t.params)||{}))).then(function(e){n=e})}();return Promise.resolve(r&&r.then?r.then(function(){return n}):n)}catch(e){return Promise.reject(e)}},j=function(t,n){var r=t.app.get("existsPath")||b;return t.params=e._set(t.params,"core."+r+"."+t.path+"."+((null==n?void 0:n._id)||t.id),n),t},k=["ucan"];function S(e,t){try{var n=e()}catch(e){return t(e)}return n&&n.then?n.then(void 0,t):n}function A(e,t,n){if(!e.s){if(n instanceof E){if(!n.s)return void(n.o=A.bind(null,e,t));1&t&&(t=n.s),n=n.v}if(n&&n.then)return void n.then(A.bind(null,e,t),A.bind(null,e,2));e.s=t,e.v=n;var r=e.o;r&&r(e)}}const E=/*#__PURE__*/function(){function e(){}return e.prototype.then=function(t,n){const r=new e,i=this.s;if(i){const e=1&i?t:n;if(e){try{A(r,1,e(this.v))}catch(e){A(r,2,e)}return r}return this}return this.o=function(e){try{const i=e.v;1&e.s?A(r,1,t?t(i):i):n?A(r,1,n(i)):A(r,2,i)}catch(e){A(r,2,e)}},r},e}();function T(e){return e instanceof E&&1&e.s}function O(e,t,n){var r,i,o=-1;return function a(c){try{for(;++o<e.length&&(!n||!n());)if((c=t(o))&&c.then){if(!T(c))return void c.then(a,i||(i=A.bind(null,r=new E,2)));c=c.v}r?A(r,1,c):r=c}catch(e){A(r||(r=new E),2,e)}}(),r}function U(e,t,n){var r=[];for(var i in e)r.push(i);return O(r,function(e){return t(r[e])},n)}var C="undefined"!=typeof Symbol?Symbol.iterator||(Symbol.iterator=Symbol("Symbol.iterator")):"@@iterator";function I(e,t){try{var n=e()}catch(e){return t(!0,e)}return n&&n.then?n.then(t.bind(null,!1),t.bind(null,!0)):t(!1,n)}var q=function(n){try{var r,i=n.app.get("authentication"),o=e._get(n,["auth",i.entity]);o&&(n=e._set(n,[i.core_path,i.entity],o));var a=S(function(){return Promise.resolve(t.authenticate("jwt")(n).catch(function(){return n})).then(function(e){n=e})},function(){return r=1,n});return Promise.resolve(a&&a.then?a.then(function(e){return r?e:n}):r?a:n)}catch(e){return Promise.reject(e)}},$=function(n){try{var r=n.app.get("authentication"),i=e._get(n,["auth",r.entity]);return i&&(n=e._set(n,[r.core_path,r.entity],i)),Promise.resolve(t.authenticate("jwt")(n))}catch(e){return Promise.reject(e)}},N=function(t,n,r){try{return Promise.resolve(S(function(){return Promise.resolve(e.verifyUcan(t,n)).then(function(i){var a=function(a){if((null==(a=i)||!a.ok)&&n.requiredCapabilities){var c=n.requiredCapabilities.map(function(e){return"*"!==e.capability.can&&(e.capability.can.segments=["*"]),e});return r&&console.log("set new req capabilities",c,e.parseUcan(t)),Promise.resolve(e.verifyUcan(t,o({},n,{requiredCapabilities:c}))).then(function(e){i=e,r&&console.log("Second verification result:",i)})}}();return a&&a.then?a.then(function(){return i}):i})},function(e){return{ok:!1,err:[e.message]}}))}catch(e){return Promise.reject(e)}},K=function(t,n){try{var r={ok:!1,value:[]};return Promise.resolve(S(function(){var i,o=U(t,function(o){n&&console.log("or verify loop",t[o],e.parseUcan(t[o].ucan));var a=function(e){if(null==(e=r)||!e.ok){var a=t[o],c=a.ucan,u=f(a,k);return Promise.resolve(N(c,u,n)).then(function(e){r=e,n&&console.log("got in verify loop",r)})}i=1}();if(a&&a.then)return a.then(function(){})},function(){return i});return o&&o.then?o.then(function(){return r}):r},function(e){return{ok:!1,err:[e.message]}}))}catch(e){return Promise.reject(e)}},J=function(t,n,r){return function(i){try{var o,a=null==r?void 0:r.log,c=e._get(i.params,n.client_ucan),u=(null==r?void 0:r.audience)||e._get(i.params,n.ucan_aud);a&&console.log("verify against reqs",t);var s=(null==r?void 0:r.or)||[];return o=c&&("*"===s||s.includes(i.method))?function(e,n){return K((t||[]).map(function(t){return{ucan:e||c,audience:(null==n?void 0:n.aud)||u,requiredCapabilities:[t]}}),a)}:function(e,n){return N(e||c,{audience:(null==n?void 0:n.aud)||u,requiredCapabilities:t},a)},Promise.resolve(o()).then(function(t){var c,u;if(a&&console.log("first verify try",t),null!=(c=t)&&c.ok)return t;var s=((null==r?void 0:r.cap_subjects)||[]).filter(function(e){return!!e});a&&console.log("check cap_subjects",s);var l=function(){if(s){var c=(null==n?void 0:n.loginConfig)||i.app.get("authentication"),l=String(e._get(i.params,c.entity+"._id"||""));return Promise.resolve(new _(c.capability_service||"caps",i).find({query:{$limit:s.length,subject:{$in:s}},skip_hooks:!0,admin_pass:!0}).catch(function(e){return console.log("Error finding caps in ucan auth: "+e.message)})).then(function(n){var i;return a&&console.log("caps",n),function(){if(null!=n&&n.data)return function(e,t,n){if("function"==typeof e[C]){var r,i,o,a=e[C]();if(function e(c){try{for(;!((r=a.next()).done||n&&n());)if((c=t(r.value))&&c.then){if(!T(c))return void c.then(e,o||(o=A.bind(null,i=new E,2)));c=c.v}i?A(i,1,c):i=c}catch(e){A(i||(i=new E),2,e)}}(),a.return){var c=function(e){try{r.done||a.return()}catch(e){}return e};if(i&&i.then)return i.then(c,function(e){throw c(e)});c()}return i}if(!("length"in e))throw new TypeError("Object is not iterable");for(var u=[],s=0;s<e.length;s++)u.push(e[s]);return O(u,function(e){return t(u[e])},n)}(n.data,function(n){return U(n.caps||{},function(i){return a&&console.log("check cap",i,n.caps[i].logins,l),function(){if((n.caps[i].logins||[]).map(function(e){return String(e)}).includes(l)){var c=function(){var e;if(null!=r&&r.log&&console.log("tried v on cap",t),null!=(e=t)&&e.ok)return u=1,t},s=S(function(){var r=e.ucanToken(n.caps[i].ucan);a&&console.log("got ucan string",r);var c=function(){if(r)return Promise.resolve(o(r,{aud:n.did})).then(function(e){t=e,a&&console.log("tried v on cap",t)})}();if(c&&c.then)return c.then(function(){})},function(e){console.log("Error verifying ucan from cap: "+n._id+". Err:"+e.message)});return s&&s.then?s.then(c):c()}}()},function(){return i})},function(){return i})}()})}}();return l&&l.then?l.then(function(e){return u?e:t}):u?l:t})}catch(e){return Promise.reject(e)}}},R=function(t,n){var r=e.encodeKeyPair({secretKey:n.secret}).did();return Array.isArray(t)?t.map(function(t){return{capability:Array.isArray(t)?e.genCapability({with:{scheme:n.defaultScheme,hierPart:n.defaultHierPart},can:{namespace:t[0],segments:"string"==typeof t[1]?[t[1]]:t[1]}},n):e.genCapability(t,n),rootIssuer:r}}):[]},M=function(t,n){return function(r){try{var o=function(){var t,o;if(null!=(t=c)&&t.ok)return r.params.authenticated=!0,r.params.canU=!0,r;if(null!=n&&n.log&&console.log("checking special change",null==n?void 0:n.specialChange),null!=n&&n.specialChange){if("*"===n.specialChange)return r.params.canU=!0,r;if(Array.isArray(n.specialChange)&&["create","patch","update"].includes(r.method)){if(Array.isArray(r.data))throw new Error("No multi data allowed with special change");for(var u in r.data||{})if(["$set","$unset","$addToSet","$pull","$push"].includes(u)){for(var s in r.data[u]||{})if(!n.specialChange.includes(s)){var l=s.split(".");1===l.length?delete r.data[u][s]:n.specialChange.includes(l[0])||delete r.data[u][s]}}else n.specialChange.includes(u)||delete r.data[u];return r.params.canU=!0,r}}if(null!=(o=c)&&o.ok)return r.params.authenticated=!0,r.params.canU=!0,r;var f=function(e){var t;if(null!=(t=c)&&t.ok)return r.params.authenticated=!0,r.params.canU=!0,r;if(null!=n&&n.log&&console.error("Ucan capabilities requirements not met: ",c,r.type,r.path),null!=n&&n.noThrow)return r.params._no_throw_error={type:r.type,method:r.method,path:r.path},r;throw new Error("Missing proper capabilities for this action: "+r.type+": "+r.path+" - "+r.method)},h=(n||{loginPass:[[["*"],["nonExistentMethod"]]]}).loginPass,v=function(){if(null!=h&&h.length){var t,o=function(t){if(_interrupt2)return t;s&&(r=e._set(r,"data",u))},u={},s=!0,l=!1,f=!1,v=I(function(){return S(function(){var t,o,f=function(e){var t,n,r,o=2;for("undefined"!=typeof Symbol&&(n=Symbol.asyncIterator,r=Symbol.iterator);o--;){if(n&&null!=(t=e[n]))return t.call(e);if(r&&null!=(t=e[r]))return new i(t.call(e));n="@@asyncIterator",r="@@iterator"}throw new TypeError("Object is not async iterable")}(h),v=function(e,t,n){for(var r;;){var i=e();if(T(i)&&(i=i.v),!i)return o;if(i.then){r=0;break}var o=n();if(o&&o.then){if(!T(o)){r=1;break}o=o.s}if(t){var a=t();if(a&&a.then&&!T(a)){r=2;break}}}var c=new E,u=A.bind(null,c,2);return(0===r?i.then(l):1===r?o.then(s):a.then(f)).then(void 0,u),c;function s(r){o=r;do{if(t&&(a=t())&&a.then&&!T(a))return void a.then(f).then(void 0,u);if(!(i=e())||T(i)&&!i.v)return void A(c,1,o);if(i.then)return void i.then(l).then(void 0,u);T(o=n())&&(o=o.v)}while(!o||!o.then);o.then(s).then(void 0,u)}function l(e){e?(o=n())&&o.then?o.then(s).then(void 0,u):s(o):A(c,1,o)}function f(){(i=e())?i.then?i.then(l).then(void 0,u):l(i):A(c,1,o)}}(function(){function e(e){return!t&&(l=!(o=e).done)}return t?!!e(!t&&f.next()):Promise.resolve(!t&&f.next()).then(e)},function(){return!!(l=!1)},function(){var i=o.value,l=function(){if(s)return Promise.resolve(function(t){try{var i=[],o="*"===t[1],l=-1;o?l=0:(i=t[1].map(function(e){return e.split("/")[0]}),l=i.indexOf(r.method));var f=function(){if(l>-1)return Promise.resolve(x(r,{params:null==n?void 0:n.existingParams})).then(function(n){var i=!1,f=function(t,n){void 0===n&&(n="_id");var o=e._get(r.params,a.entity+"."+n);if(o&&t){var c=Array.isArray(o)?o.map(function(e){return String(e)}):[String(o)];if(Array.isArray(t))for(var u=0;u<c.length;u++){for(var s=String(c[u]),l=0;l<t.length;)String(t[l])===s?i=!0:l++;if(i)return}else if(c.includes(String(t)))return i=!0}};if(n){r=j(r,n);for(var h,v=p(t[0]||[]);!(h=v()).done;){var d=String(h.value).split("/");if(d[0].includes("*")){var y=d[0].split("*"),g=e._get(n,y[0]);if(g&&"object"==typeof g)if(Array.isArray(g))for(var m,P=p(g);!(m=P()).done&&(f(e._get(m.value,y[1]),d[1]||"_id"),!i););else for(var _ in g)if(f(e._get(g,_+"."+y[1]),d[1]||"_id"),i)break}else f(e._get(n,d[0]),d[1]||"_id")}}if(i)if(c.ok=!0,"*"===t[1]||["find","get","remove"].some(function(e){return t[1].includes(e)}))s=!1;else{var b=o?"*":t[1][l];if(b.split("/")[0]!==b)for(var w,x=p(b.split("/").slice(1).join("").split(",")||[]);!(w=x()).done;){var k=w.value,S=e._get(r.data,k);if(S)u=e._set(u,k,S);else for(var A=0,E=["$addToSet","$pull"];A<E.length;A++){var T=E[A],O=e._get(r.data,T+"."+k);O&&(u=e._set(u,T+"."+k,O))}}else s=!1}})}();return Promise.resolve(f&&f.then?f.then(function(){}):void 0)}catch(e){return Promise.reject(e)}}(i)).then(function(){});t=1}();return l&&l.then?l.then(function(){}):void 0});if(v&&v.then)return v.then(function(){})},function(e){f=!0,t=e})},function(e,n){function r(t){if(e)throw n;return n}var i=I(function(){var e=function(){if(l&&null!=_iterator.return)return Promise.resolve(_iterator.return()).then(function(){})}();if(e&&e.then)return e.then(function(){})},function(e,n){if(f)throw t;if(e)throw n;return n});return i&&i.then?i.then(r):r()});return v&&v.then?v.then(o):o(v)}}();return v&&v.then?v.then(f):f()},a=(null==n?void 0:n.loginConfig)||r.app.get("authentication"),c={ok:!1,value:[]},u=R(t,a),s=function(){if(u.length)return Promise.resolve(J(u,a,n)(r)).then(function(e){c=e});"*"!==t&&(c.ok=!0)}();return Promise.resolve(s&&s.then?s.then(o):o())}catch(e){return Promise.reject(e)}}},B=function(t,n){return function(r){try{var i,o=function(o){if(i)return o;function c(){return"*"!==t||null!=n&&n.specialChange?s?r:t?Promise.resolve(M(t,n)(r)):r:(r.params.authenticated=!!r.params[u],r)}var s=((null==n?void 0:n.adminPass)||[]).includes(r.method)&&(e._get(r.params,"admin_pass")||e._get(r.params,[a.core_path,"admin_pass"])),l=function(){if(!f&&!h)return Promise.resolve(s||null!=n&&n.specialChange?q(r):$(r)).then(function(e){r=e})}();return l&&l.then?l.then(c):c()},a=r.app.get("authentication"),c=a.core_path||"core",u=a.entity||"login",s=e._get(r.params,[c,u])||e._get(r.params,"login")||e._get(r.params.connect,u),l="string"==typeof s?s:null==s?void 0:s._id,f=!(!s||"string"!=typeof s&&!l),h=e._get(r.params,a.client_ucan||"client_ucan");null!=n&&n.log&&console.log("ucan auth","hasLogin",f,"loginId",l,"existingUcan",!!h,"core_path",c,"entity",u,"core",r.params[c],"params login",r.params.login,"required capabilities",t);var p=function(){if("$"===t||t&&"$"===t[r.method]){var e=function(e){return i=1,e};return f?e(r):Promise.resolve(q(r)).then(e)}}();return Promise.resolve(p&&p.then?p.then(o):o(p))}catch(e){return Promise.reject(e)}}};exports.AuthService=P,exports.CoreCall=_,exports.NotAuthError=m,exports.UcanStrategy=y,exports.allUcanAuth=function(t,n){return function(r){try{var i=r.app.get("authentication"),o=i.core_path||"core",a=i.entity||"login";if(!e._get(r.params,[o,a])){var c=e._get(r,["auth",a]);c&&(r=e._set(r,[o,a],c))}if("before"===r.type){var u=r.method;return Promise.resolve(t[u]||t.all?B(t[u]||t.all,n)(r):r)}return Promise.resolve(r)}catch(e){return Promise.reject(e)}}},exports.anyAuth="*",exports.bareAuth=$,exports.checkUcan=M,exports.existsPath=b,exports.getExists=w,exports.loadExists=x,exports.modelCapabilities=R,exports.noThrow="$",exports.noThrowAuth=q,exports.orVerifyLoop=K,exports.setExists=j,exports.ucanAuth=B,exports.updateUcan=function(){return function(t){try{var n=t.data,r=n.add,i=void 0===r?[]:r,a=n.remove,c=void 0===a?[]:a;if(!(null!=i&&i.length||null!=c&&c.length))throw new Error("No new capabilities passed");var u=t.app.get("authentication"),s=u.secret,l=u.ucan_aud,f=u.entity,h=u.ucan,p=e.encodeKeyPair({secretKey:s}).did(),v=e.stackAbilities([].concat(i,c));return Promise.resolve(e.verifyUcan(e._get(t.params,[f,h]),{audience:e._get(t.params,l),requiredCapabilities:v.map(function(e){return{capability:e,rootIssuer:p}})})).then(function(n){if(null==n||!n.ok)throw new Error("You don't have sufficient capabilities to grant those capabilities");var r=t.id,a=t.data.service||"logins",u=t.data.path||"ucan";return Promise.resolve(new _(a,t,{skipJoins:!0}).get(r)).then(function(n){var l=e.parseUcan(e._get(n,u)).payload,f=l.aud,h=l.att,p=l.prf,v=[].concat(h);return null!=c&&c.length&&(v=e.reduceAbilities(c,h)),null!=i&&i.length&&(v=e.stackAbilities([].concat(h,i))),Promise.resolve(e.buildUcan(o({issuer:e.encodeKeyPair({secretKey:s}),audience:f,lifetimeInSeconds:5184e3,proofs:p},t.data,{capabilities:v}))).then(function(n){var i=e.ucanToken(n);return Promise.resolve(e.validateUcan(i)).then(function(e){var n;if(!e)throw new Error("Invalid ucan generated when updating");return Promise.resolve(new _(a,t).patch(r,(n={},n[u]=i,n))).then(function(e){return t.result={raw:t.data,encoded:i,subject:e},t})})})})})}catch(e){return Promise.reject(e)}}},exports.verifyAgainstReqs=J;
+var symbolUcan = require('symbol-ucan');
+var authentication = require('@feathersjs/authentication');
+var lt = require('long-timeout');
+
+function _interopDefaultLegacy (e) { return e && typeof e === 'object' && 'default' in e ? e : { 'default': e }; }
+
+var lt__default = /*#__PURE__*/_interopDefaultLegacy(lt);
+
+class NotAuthError$1 extends Error {
+  constructor(message) {
+    super(message);
+  }
+}
+const SPLIT_HEADER = /(\S+)\s+(\S+)/;
+class UcanStrategy extends authentication.AuthenticationBaseStrategy {
+  constructor(...args) {
+    super(...args);
+    this.expirationTimers = new WeakMap();
+  }
+  setAuthentication(auth) {
+    // console.log('set authentication', auth);
+    auth.verifyAccessToken = accessToken => {
+      return {};
+    };
+    super.setAuthentication(auth);
+  }
+  get configuration() {
+    var _this$authentication;
+    const authConfig = ((_this$authentication = this.authentication) == null ? void 0 : _this$authentication.configuration) || {
+      service: undefined,
+      entity: undefined,
+      entityId: undefined
+    };
+    const config = super.configuration;
+    return {
+      service: authConfig.service,
+      entity: authConfig.entity,
+      entityId: authConfig.entityId,
+      header: 'Authorization',
+      schemes: ['Bearer', 'JWT'],
+      ...config
+    };
+  }
+  async handleConnection(event, connection, authResult) {
+    const isValidLogout = event === 'logout' && connection.authentication && authResult && connection.authentication.accessToken === authResult.accessToken;
+    const {
+      accessToken,
+      entity
+    } = authResult || {};
+    if (accessToken && event === 'login') {
+      const validUcan = await symbolUcan.validateUcan(accessToken).catch(err => {
+        console.log('Could not validate ucan in connection: ', err.message);
+        const errObj = {
+          code: 0,
+          message: 'Unknown Issue Validating Ucan'
+        };
+        if (err.message.indexOf('Expired.') > -1) {
+          errObj.code = 1;
+          errObj.message = 'Expired Ucan';
+        }
+        throw new Error(errObj.message);
+      });
+      const {
+        payload: {
+          exp
+        }
+      } = validUcan || {
+        payload: {
+          exp: 0
+        }
+      };
+      // The time (in ms) until the token expires
+      const duration = exp * 1000 - Date.now();
+      // This may have to be a `logout` event but right now we don't want
+      // the whole context object lingering around until the timer is gone
+      const timer = lt__default["default"].setTimeout(() => this.app.emit('disconnect', connection), duration);
+      lt__default["default"].clearTimeout(this.expirationTimers.get(connection));
+      this.expirationTimers.set(connection, timer);
+      connection.authentication = {
+        strategy: this.name,
+        accessToken
+      };
+    } else if (event === 'disconnect' || isValidLogout) {
+      const {
+        entity
+      } = this.configuration;
+      delete connection[entity];
+      delete connection.authentication;
+      lt__default["default"].clearTimeout(this.expirationTimers.get(connection));
+      this.expirationTimers.delete(connection);
+    }
+  }
+  verifyConfiguration() {
+    const allowedKeys = ['entity', 'entityId', 'service', 'header', 'schemes', 'audience'];
+    for (const key of Object.keys(this.configuration)) {
+      if (!allowedKeys.includes(key)) {
+        throw new Error(`Invalid ucanStrategy option 'authentication.${this.name}.${key}'. Did you mean to set it in 'authentication.jwtOptions'?`);
+      }
+    }
+    if (typeof this.configuration.header !== 'string') {
+      throw new Error(`The 'header' option for the ${this.name} strategy must be a string`);
+    }
+  }
+  // eslint-disable-next-line no-unused-vars
+  async getEntityQuery(_params) {
+    return {};
+  }
+  /**
+   * Return the entity for a given id
+   * @param id The id to use
+   * @param params Service call parameters
+   */
+  async getEntity(id, params) {
+    const entityService = this.entityService;
+    const {
+      entity
+    } = this.configuration;
+    if (entityService === null) {
+      throw new NotAuthError$1('Could not find entity service');
+    }
+    const query = await this.getEntityQuery(params);
+    const getParams = Object.assign({}, symbolUcan._unset(params, 'provider'), {
+      query
+    });
+    const result = await entityService.get(id, getParams);
+    if (!params.provider) {
+      return result;
+    }
+    return entityService.get(id, {
+      ...params,
+      [entity]: result
+    });
+  }
+  async getEntityId(authResult, _params) {
+    let {
+      query,
+      loginId
+    } = _params;
+    if (loginId) return loginId;else {
+      var _this$app;
+      const {
+        service,
+        core_path = 'core'
+      } = this.configuration;
+      const pms = {
+        query: {
+          ...query,
+          $limit: 1
+        },
+        [core_path]: {
+          skipJoins: true,
+          ..._params[core_path]
+        }
+      };
+      const entities = await ((_this$app = this.app) == null ? void 0 : _this$app.service(service).find({
+        ...pms,
+        skipJoins: true,
+        skip_hooks: true,
+        admin_pass: true
+      }));
+      if (entities.total) return entities.data[0]._id;else throw new NotAuthError$1('Could not find login associated with this ucan');
+    }
+  }
+  async authenticate(authentication, params) {
+    let {
+      accessToken,
+      loginId,
+      ucan
+    } = authentication;
+    const {
+      entity,
+      core_path
+    } = this.configuration;
+    if (!accessToken) {
+      if (ucan) accessToken = symbolUcan.ucanToken(ucan);else throw new NotAuthError$1('Error generating ucan');
+      // } else throw new NotAuthenticated('No access token');
+    }
+    //
+    // await verifyUcan(accessToken, {audience: ucan_audience || params.ucan_aud, requiredCapabilities})
+    //      .catch(err => {
+    //          console.error('error verifying ucan', err);
+    //          throw new NotAuthenticated('Could not verify ucan: ' + err.message);
+    //      });
+    const decodedUcan = await symbolUcan.validateUcan(accessToken).catch(err => {
+      console.log('Could not validate ucan during authentication: ', err.message);
+      const errObj = {
+        code: 0,
+        message: 'Unknown Issue Validating Ucan'
+      };
+      if (err.message.indexOf('Expired.') > -1) {
+        errObj.code = 1;
+        errObj.message = 'Expired Ucan';
+      }
+      throw new Error(errObj.message);
+    });
+    const result = {
+      accessToken,
+      authentication: {
+        strategy: 'jwt',
+        accessToken
+      }
+    };
+    if (entity === null) {
+      return result;
+    }
+    let value;
+    const coreEntity = symbolUcan._get(params, [core_path, entity]);
+    if (!coreEntity) {
+      const entityId = await this.getEntityId(result, {
+        ...params,
+        loginId,
+        query: {
+          did: decodedUcan == null ? void 0 : decodedUcan.payload.aud
+        }
+      });
+      value = await this.getEntity(entityId, params);
+    } else value = coreEntity;
+    return {
+      ...result,
+      [entity]: value
+    };
+  }
+  async parse(req) {
+    const {
+      header,
+      schemes
+    } = this.configuration;
+    const headerValue = req.headers && req.headers[header.toLowerCase()];
+    if (!headerValue || typeof headerValue !== 'string') {
+      return null;
+    }
+    const [, scheme, schemeValue] = headerValue.match(SPLIT_HEADER) || [];
+    const hasScheme = scheme && schemes.some(current => new RegExp(current, 'i').test(scheme));
+    if (scheme && !hasScheme) {
+      return null;
+    }
+    return {
+      strategy: this.name,
+      accessToken: hasScheme ? schemeValue : headerValue
+    };
+  }
+}
+
+class NotAuthError extends Error {
+  constructor(message) {
+    super(message);
+  }
+}
+class AuthService extends authentication.AuthenticationService {
+  constructor(app, configKey = 'authentication', opts = {}) {
+    const {
+      NotAuthenticated,
+      ...rest
+    } = opts;
+    super(app, configKey, rest);
+    this.options = void 0;
+    this.app = app;
+    this.options = {
+      NotAuthenticated
+    };
+  }
+  async create(data, params) {
+    var _this$options, _params;
+    const NotAuth = ((_this$options = this.options) == null ? void 0 : _this$options.NotAuthenticated) || NotAuthError;
+    const {
+      entity,
+      service,
+      ucan_path = 'ucan'
+    } = this.app.get('authentication');
+    const authStrategies = ((_params = params) == null ? void 0 : _params.authStrategies) || this.configuration.authStrategies;
+    if (!params) params = {};
+    if (!authStrategies.length) {
+      throw new NotAuth('No authentication strategies allowed for creating a JWT (`authStrategies`)');
+    }
+    const authResult = await this.authenticate(data, params, ...authStrategies).catch(err => {
+      throw new Error(err.message);
+    });
+    if (authResult.accessToken) {
+      return authResult;
+    }
+    const did = data.did || symbolUcan._get(authResult, [entity, 'did']);
+    let ucan = data.ucan || symbolUcan._get(authResult, [entity, 'ucan']);
+    if (!did) throw new Error('No did audience provided');
+    if (!ucan) throw new Error('No ucan provided to authentication call');
+    // const {secret} = this.configuration;
+    const validatedUcan = await symbolUcan.validateUcan(ucan).catch(err => {
+      console.log('Could not validate ucan creating authentication: ', err.message);
+      const errObj = {
+        code: 0,
+        message: 'Unknown Issue Validating Ucan'
+      };
+      if (err.message.indexOf('Expired.') > -1) {
+        errObj.code = 1;
+        errObj.message = 'Expired Ucan';
+      }
+      console.warn('Could not validate ucan creating authentication', ucan, errObj.message);
+      return null;
+    });
+    if (!validatedUcan) {
+      const parsed = symbolUcan.parseUcan(ucan);
+      let {
+        secret
+      } = this.app.get('authentication');
+      const issuer = symbolUcan.encodeKeyPair({
+        secretKey: secret
+      });
+      ucan = await symbolUcan.buildUcan({
+        audience: parsed.payload.aud,
+        issuer,
+        lifetimeInSeconds: 60 * 60 * 24 * 60,
+        capabilities: parsed.payload.att
+      });
+      params.admin_pass = true;
+      await this.app.service(service).patch(symbolUcan._get(authResult, [entity, '_id']), {
+        [ucan_path]: symbolUcan.ucanToken(ucan)
+      }, {
+        ...params
+      });
+    }
+    const accessToken = symbolUcan.ucanToken(ucan);
+    return {
+      accessToken,
+      ...authResult,
+      authentication: {
+        ...authResult.authentication,
+        payload: accessToken
+      }
+    };
+  }
+}
+
+class CoreCall {
+  constructor(service, context, coreOptions) {
+    var _context$params;
+    this.context = void 0;
+    this.service = void 0;
+    this.core = void 0;
+    this.entity = void 0;
+    this.service = service;
+    this.context = context;
+    const entity = (context.app.get('authentication') || {
+      entity: 'login'
+    }).entity || 'login';
+    this.entity = entity;
+    const core = ((_context$params = context.params) == null ? void 0 : _context$params.core) || {};
+    if (!core[entity]) core[entity] = context.params[entity];
+    this.core = {
+      ...core,
+      ...coreOptions
+    };
+  }
+  async get(id, params = {}) {
+    var _this$context$app;
+    const {
+      core_path
+    } = this.context.app.get('authentication');
+    return (_this$context$app = this.context.app) == null ? void 0 : _this$context$app.service(this.service).get(id, {
+      ...params,
+      [this.entity]: params[this.entity],
+      ...{
+        [core_path]: this.core
+      }
+    });
+  }
+  async find(params = {}) {
+    var _this$context$app2;
+    const {
+      core_path
+    } = this.context.app.get('authentication');
+    return (_this$context$app2 = this.context.app) == null ? void 0 : _this$context$app2.service(this.service).find({
+      ...params,
+      [this.entity]: params[this.entity],
+      skip_hooks: true,
+      admin_pass: true,
+      ...{
+        [core_path]: this.core
+      }
+    });
+  }
+  async create(data, params = {}) {
+    var _this$context$app3;
+    const {
+      core_path
+    } = this.context.app.get('authentication');
+    return (_this$context$app3 = this.context.app) == null ? void 0 : _this$context$app3.service(this.service).create(data, {
+      ...params,
+      [this.entity]: params[this.entity],
+      ...{
+        [core_path]: this.core
+      }
+    });
+  }
+  async patch(id, data, params = {}) {
+    var _this$context$app4;
+    const {
+      core_path
+    } = this.context.app.get('authentication');
+    return (_this$context$app4 = this.context.app) == null ? void 0 : _this$context$app4.service(this.service).patch(id, data, {
+      ...params,
+      [this.entity]: params[this.entity],
+      ...{
+        [core_path]: this.core
+      }
+    });
+  }
+  async update(id, data, params = {}) {
+    var _this$context$app5;
+    const {
+      core_path
+    } = this.context.app.get('authentication');
+    return (_this$context$app5 = this.context.app) == null ? void 0 : _this$context$app5.service(this.service).update(id, data, {
+      ...params,
+      [this.entity]: params[this.entity],
+      ...{
+        [core_path]: this.core
+      }
+    });
+  }
+  async remove(id, params = {}) {
+    var _this$context$app6;
+    const {
+      core_path
+    } = this.context.app.get('authentication');
+    return (_this$context$app6 = this.context.app) == null ? void 0 : _this$context$app6.service(this.service).remove(id, {
+      ...params,
+      [this.entity]: params[this.entity],
+      ...{
+        [core_path]: this.core
+      }
+    });
+  }
+  async _get(id, params = {}) {
+    var _this$context$app7;
+    const {
+      core_path
+    } = this.context.app.get('authentication');
+    return (_this$context$app7 = this.context.app) == null ? void 0 : _this$context$app7.service(this.service)._get(id, {
+      ...params,
+      [this.entity]: params[this.entity],
+      ...{
+        [core_path]: this.core
+      }
+    });
+  }
+  async _find(params = {}) {
+    var _this$context$app8;
+    const {
+      core_path
+    } = this.context.app.get('authentication');
+    return (_this$context$app8 = this.context.app) == null ? void 0 : _this$context$app8.service(this.service)._find({
+      ...params,
+      [this.entity]: params[this.entity],
+      ...{
+        [core_path]: this.core
+      }
+    });
+  }
+  async _create(data, params = {}) {
+    var _this$context$app9;
+    const {
+      core_path
+    } = this.context.app.get('authentication');
+    return (_this$context$app9 = this.context.app) == null ? void 0 : _this$context$app9.service(this.service)._create(data, {
+      ...params,
+      [this.entity]: params[this.entity],
+      ...{
+        [core_path]: this.core
+      }
+    });
+  }
+  async _patch(id, data, params = {}) {
+    var _this$context$app10;
+    const {
+      core_path
+    } = this.context.app.get('authentication');
+    return (_this$context$app10 = this.context.app) == null ? void 0 : _this$context$app10.service(this.service)._patch(id, data, {
+      ...params,
+      [this.entity]: params[this.entity],
+      ...{
+        [core_path]: this.core
+      }
+    });
+  }
+  async _update(id, data, params = {}) {
+    var _this$context$app11;
+    const {
+      core_path
+    } = this.context.app.get('authentication');
+    return (_this$context$app11 = this.context.app) == null ? void 0 : _this$context$app11.service(this.service)._update(id, data, {
+      ...params,
+      [this.entity]: params[this.entity],
+      ...{
+        [core_path]: this.core
+      }
+    });
+  }
+  async _remove(id, params = {}) {
+    var _this$context$app12;
+    const {
+      core_path
+    } = this.context.app.get('authentication');
+    return (_this$context$app12 = this.context.app) == null ? void 0 : _this$context$app12.service(this.service)._remove(id, {
+      ...params,
+      [this.entity]: params[this.entity],
+      ...{
+        [core_path]: this.core
+      }
+    });
+  }
+}
+
+const existsPath = '_exists';
+const getExists = context => {
+  const path = context.app.get('existsPath') || existsPath;
+  return symbolUcan._get(context.params, `core.${path}.${context.path}.${context.id}`) || undefined;
+};
+const loadExists = async (context, options) => {
+  let ex = getExists(context);
+  if (!ex && context.id) {
+    ex = await new CoreCall(context.path, context, {
+      skipJoins: (options == null ? void 0 : options.skipJoins) !== false
+    }).get(context.id, {
+      exists_check: true,
+      admin_pass: true,
+      skip_hooks: true,
+      ...((options == null ? void 0 : options.params) || {})
+    });
+  }
+  return ex;
+};
+const setExists = (context, val) => {
+  const path = context.app.get('existsPath') || existsPath;
+  context.params = symbolUcan._set(context.params, `core.${path}.${context.path}.${(val == null ? void 0 : val._id) || context.id}`, val);
+  return context;
+};
+
+const SUPERUSER = '*';
+const anyAuth = '*';
+const noThrow = '$';
+const noThrowAuth = async context => {
+  const config = context.app.get('authentication');
+  const entity = symbolUcan._get(context, ['auth', config.entity]);
+  if (entity) {
+    context = symbolUcan._set(context, [config.core_path, config.entity], entity);
+  }
+  try {
+    context = await authentication.authenticate('jwt')(context).catch(() => {
+      return context;
+    });
+  } catch (e) {
+    return context;
+  }
+  return context;
+};
+const bareAuth = async context => {
+  const config = context.app.get('authentication');
+  const entity = symbolUcan._get(context, ['auth', config.entity]);
+  if (entity) context = symbolUcan._set(context, [config.core_path, config.entity], entity);
+  return authentication.authenticate('jwt')(context);
+};
+const verifyOne = async (ucan, options, log) => {
+  try {
+    var _v;
+    let v = await symbolUcan.verifyUcan(ucan, options);
+    if (!((_v = v) != null && _v.ok) && options.requiredCapabilities) {
+      const newCapabilities = options.requiredCapabilities.map(a => {
+        if (a.capability.can !== SUPERUSER) a.capability.can.segments = ['*'];
+        return a;
+      });
+      if (log) console.log('set new req capabilities', newCapabilities, symbolUcan.parseUcan(ucan));
+      v = await symbolUcan.verifyUcan(ucan, {
+        ...options,
+        requiredCapabilities: newCapabilities
+      });
+      if (log) console.log('Second verification result:', v);
+    }
+    return v;
+  } catch (e) {
+    return {
+      ok: false,
+      err: [e.message]
+    };
+  }
+};
+const orVerifyLoop = async (arr, log) => {
+  let v = {
+    ok: false,
+    value: []
+  };
+  try {
+    for (const i in arr) {
+      var _v2;
+      if (log) console.log('or verify loop', arr[i], symbolUcan.parseUcan(arr[i].ucan));
+      if (!((_v2 = v) != null && _v2.ok)) {
+        const {
+          ucan,
+          ...options
+        } = arr[i];
+        v = await verifyOne(ucan, options, log);
+        if (log) console.log('got in verify loop', v);
+      } else break;
+    }
+    return v;
+  } catch (e) {
+    return {
+      ok: false,
+      err: [e.message]
+    };
+  }
+};
+const verifyAgainstReqs = (reqs, config, options) => {
+  return async context => {
+    var _v3;
+    const log = options == null ? void 0 : options.log;
+    const ucan = symbolUcan._get(context.params, config.client_ucan);
+    const audience = (options == null ? void 0 : options.audience) || symbolUcan._get(context.params, config.ucan_aud);
+    if (log) console.log('verify against reqs', reqs);
+    let vMethod;
+    const or = (options == null ? void 0 : options.or) || [];
+    if (ucan && (or === '*' || or.includes(context.method))) vMethod = (uc, methodOpts) => orVerifyLoop((reqs || []).map(a => {
+      return {
+        ucan: uc || ucan,
+        audience: (methodOpts == null ? void 0 : methodOpts.aud) || audience,
+        requiredCapabilities: [a]
+      };
+    }), log);else vMethod = (uc, methodOpts) => verifyOne(uc || ucan, {
+      audience: (methodOpts == null ? void 0 : methodOpts.aud) || audience,
+      requiredCapabilities: reqs
+    }, log);
+    let v = await vMethod();
+    if (log) console.log('first verify try', v);
+    if ((_v3 = v) != null && _v3.ok) return v;
+    const cs = ((options == null ? void 0 : options.cap_subjects) || []).filter(a => !!a);
+    if (log) console.log('check cap_subjects', cs);
+    if (cs) {
+      const configuration = (config == null ? void 0 : config.loginConfig) || context.app.get('authentication');
+      const loginCheckId = String(symbolUcan._get(context.params, `${configuration.entity}._id` || ''));
+      const caps = await new CoreCall(configuration.capability_service || 'caps', context).find({
+        query: {
+          $limit: cs.length,
+          subject: {
+            $in: cs
+          }
+        },
+        skip_hooks: true,
+        admin_pass: true
+      }).catch(err => console.log(`Error finding caps in ucan auth: ${err.message}`));
+      if (log) console.log('caps', caps);
+      if (caps != null && caps.data) {
+        for (const cap of caps.data) {
+          for (const k in cap.caps || {}) {
+            if (log) console.log('check cap', k, cap.caps[k].logins, loginCheckId);
+            if ((cap.caps[k].logins || []).map(a => String(a)).includes(loginCheckId)) {
+              var _v4;
+              try {
+                const ucanString = symbolUcan.ucanToken(cap.caps[k].ucan);
+                if (log) console.log('got ucan string', ucanString);
+                if (ucanString) {
+                  v = await vMethod(ucanString, {
+                    aud: cap.did
+                  });
+                  if (log) console.log('tried v on cap', v);
+                }
+              } catch (e) {
+                console.log(`Error verifying ucan from cap: ${cap._id}. Err:${e.message}`);
+              }
+              if (options != null && options.log) console.log('tried v on cap', v);
+              if ((_v4 = v) != null && _v4.ok) return v;
+            }
+          }
+        }
+      }
+    }
+    return v;
+  };
+};
+const modelCapabilities = (reqs, config) => {
+  const rootIssuer = symbolUcan.encodeKeyPair({
+    secretKey: config.secret
+  }).did();
+  if (!Array.isArray(reqs)) return [];
+  return reqs.map(a => {
+    return {
+      capability: Array.isArray(a) ? symbolUcan.genCapability({
+        with: {
+          scheme: config.defaultScheme,
+          hierPart: config.defaultHierPart
+        },
+        can: {
+          namespace: a[0],
+          segments: typeof a[1] === 'string' ? [a[1]] : a[1]
+        }
+      }, config) : symbolUcan.genCapability(a, config),
+      rootIssuer
+    };
+  });
+};
+const checkUcan = (requiredCapabilities, options) => {
+  return async context => {
+    var _v5;
+    const configuration = (options == null ? void 0 : options.loginConfig) || context.app.get('authentication');
+    let v = {
+      ok: false,
+      value: []
+    };
+    const reqs = modelCapabilities(requiredCapabilities, configuration);
+    if (reqs.length) {
+      v = await verifyAgainstReqs(reqs, configuration, options)(context);
+      /** if the anyAuth setting is used along with specialChange, a user could get through to this point despite not being authenticated, so this step does not allow a pass for anyAuth setting even though no requiredCapabilities are present - because it was intended to throw if not authenticated unless special change conditions are met */
+    } else if (requiredCapabilities !== '*') v.ok = true;
+    if ((_v5 = v) != null && _v5.ok) {
+      context.params.authenticated = true;
+      context.params.canU = true;
+      return context;
+    } else {
+      var _v6;
+      // if (!v?.ok) {
+      //     let hasSplitNamespace = false;
+      //     const reducedReqs: Array<RequiredCapability> = [];
+      //     reqs.forEach((req, i) => {
+      //         const splt = (_get<RequiredCapability, string>(req, 'capability.can.namespace') || '').split(':')
+      //         if (splt[1]) {
+      //             req = _set(req, 'capability.can.namespace', splt[0]);
+      //             hasSplitNamespace = true;
+      //         }
+      //         reducedReqs.push(req)
+      //     })
+      //     if (hasSplitNamespace) v = await verifyAgainstReqs(reqs, configuration as VerifyConfig, options)(context);
+      // }
+      if (options != null && options.log) console.log('checking special change', options == null ? void 0 : options.specialChange);
+      if (options != null && options.specialChange) {
+        if (options.specialChange === anyAuth) {
+          context.params.canU = true;
+          return context;
+        } else if (Array.isArray(options.specialChange)) {
+          if (['create', 'patch', 'update'].includes(context.method)) {
+            if (Array.isArray(context.data)) throw new Error('No multi data allowed with special change');
+            for (const k in context.data || {}) {
+              if (['$set', '$unset', '$addToSet', '$pull', '$push'].includes(k)) {
+                for (const sk in context.data[k] || {}) {
+                  if (!options.specialChange.includes(sk)) {
+                    const spl = sk.split('.');
+                    if (spl.length === 1) delete context.data[k][sk];else if (!options.specialChange.includes(spl[0])) delete context.data[k][sk];
+                  }
+                }
+              } else if (!options.specialChange.includes(k)) delete context.data[k];
+            }
+            context.params.canU = true;
+            return context;
+          }
+        }
+      }
+      if ((_v6 = v) != null && _v6.ok) {
+        context.params.authenticated = true;
+        context.params.canU = true;
+        return context;
+      } else {
+        var _v7;
+        //If creator pass enabled, check to see if the auth login is the creator of the record
+        const {
+          loginPass
+        } = options || {
+          loginPass: [[['*'], ['nonExistentMethod']]]
+        };
+        if (loginPass != null && loginPass.length) {
+          //object of scrubbed data object for pass that includes only limited access or full context.data object if no limits were present
+          let scrubbedData = {};
+          //scruData defaults to true - is only set to false
+          let scrubData = true;
+          const checkLoginPass = async lpass => {
+            let methodsOnly = [];
+            const allMethods = lpass[1] === '*';
+            let methodIdx = -1;
+            if (allMethods) methodIdx = 0;else {
+              //separate out any field specific methods e.g. patch/name,avatar
+              methodsOnly = lpass[1].map(a => a.split('/')[0]);
+              methodIdx = methodsOnly.indexOf(context.method);
+            }
+            /**ensure loginPass is allowed for this method*/
+            if (methodIdx > -1) {
+              /**retrieve existing record to check ids for login id*/
+              const existing = await loadExists(context, {
+                params: options == null ? void 0 : options.existingParams
+              });
+              let loginOk = false;
+              /** function for comparing record login id with context login*/
+              const checkLogin = (recordLoginPassId, loginIdPath = '_id') => {
+                const loginCheckId = symbolUcan._get(context.params, `${configuration.entity}.${loginIdPath}`);
+                /**Make sure both are present to avoid pass on undefined*/
+                if (loginCheckId && recordLoginPassId) {
+                  /** change login path result to array no matter what */
+                  const checkArr = Array.isArray(loginCheckId) ? loginCheckId.map(a => String(a)) : [String(loginCheckId)];
+                  if (Array.isArray(recordLoginPassId)) {
+                    /**loop through to see if there is a match present use for loops for performance instead of some*/
+                    for (let i = 0; i < checkArr.length; i++) {
+                      const checkId = String(checkArr[i]);
+                      for (let rl = 0; rl < recordLoginPassId.length;) {
+                        const rlId = String(recordLoginPassId[rl]);
+                        if (rlId === checkId) loginOk = true;else rl++;
+                      }
+                      if (loginOk) return;
+                    }
+                  } else if (checkArr.includes(String(recordLoginPassId))) {
+                    return loginOk = true;
+                  }
+                } else return;
+              };
+              if (existing) {
+                context = setExists(context, existing);
+                for (const passPath of lpass[0] || []) {
+                  const spl = String(passPath).split('/');
+                  if (spl[0].includes('*')) {
+                    const spl2 = spl[0].split('*');
+                    const obj = symbolUcan._get(existing, spl2[0]);
+                    if (obj && typeof obj === 'object') {
+                      if (Array.isArray(obj)) {
+                        /** IF array, iterate through array and check the sub-path */
+                        for (const o of obj) {
+                          checkLogin(symbolUcan._get(o, spl2[1]), spl[1] || '_id');
+                          if (loginOk) break;
+                        }
+                      } else {
+                        /** IF object, iterate through object and check the sub-path */
+                        for (const k in obj) {
+                          checkLogin(symbolUcan._get(obj, `${k}.${spl2[1]}`), spl[1] || '_id');
+                          if (loginOk) break;
+                        }
+                      }
+                    }
+                  } else checkLogin(symbolUcan._get(existing, spl[0]), spl[1] || '_id');
+                }
+              }
+              if (loginOk) {
+                v.ok = true;
+                /**loginPass is true - but check for granular field permissions such as patch/owner,color,status that imply limited permission*/
+                //TODO: possibly a throw option here. If loginPass is ok, it will go forward, but could send an empty or modified patch object
+                if (lpass[1] !== '*' && !['find', 'get', 'remove'].some(a => lpass[1].includes(a))) {
+                  const currentMethod = allMethods ? '*' : lpass[1][methodIdx];
+                  const splitMethod = currentMethod.split('/')[0];
+                  //check if current method contains a split '/' signaling limited permission check
+                  if (splitMethod !== currentMethod) {
+                    //get an array of the allowed fields
+                    const fields = currentMethod.split('/').slice(1).join('').split(',') || [];
+                    for (const field of fields) {
+                      const topLevel = symbolUcan._get(context.data, field);
+                      if (topLevel) scrubbedData = symbolUcan._set(scrubbedData, field, topLevel);else {
+                        for (const operator of ['$addToSet', '$pull']) {
+                          const operatorLevel = symbolUcan._get(context.data, `${operator}.${field}`);
+                          if (operatorLevel) scrubbedData = symbolUcan._set(scrubbedData, `${operator}.${field}`, operatorLevel);
+                        }
+                      }
+                    }
+                  } else scrubData = false;
+                } else scrubData = false;
+              }
+            }
+          };
+          for await (const lpass of loginPass) {
+            if (scrubData) await checkLoginPass(lpass);else break;
+          }
+          if (scrubData) context = symbolUcan._set(context, 'data', scrubbedData);
+        }
+        if ((_v7 = v) != null && _v7.ok) {
+          context.params.authenticated = true;
+          context.params.canU = true;
+          return context;
+        } else {
+          if (options != null && options.log) console.error('Ucan capabilities requirements not met: ', v, context.type, context.path);
+          if (!(options != null && options.noThrow)) throw new Error('Missing proper capabilities for this action: ' + context.type + ': ' + context.path + ' - ' + context.method);else {
+            context.params._no_throw_error = {
+              type: context.type,
+              method: context.method,
+              path: context.path
+            };
+            return context;
+          }
+        }
+      }
+    }
+  };
+};
+const ucanAuth = (requiredCapabilities, options) => {
+  return async context => {
+    const configuration = context.app.get('authentication');
+    const core_path = configuration.core_path || 'core';
+    const entity = configuration.entity || 'login';
+    const existingLogin = symbolUcan._get(context.params, [core_path, entity]) || symbolUcan._get(context.params, 'login') || symbolUcan._get(context.params.connection, entity);
+    if (existingLogin) context.params[entity] = existingLogin;
+    const loginId = typeof existingLogin === 'string' ? existingLogin : existingLogin == null ? void 0 : existingLogin._id;
+    const hasLogin = !!(existingLogin && (typeof existingLogin === 'string' || !!loginId));
+    const existingUcan = symbolUcan._get(context.params, configuration.client_ucan || 'client_ucan');
+    if (options != null && options.log) console.log('ucan auth', 'hasLogin', hasLogin, 'loginId', loginId, 'existingUcan', !!existingUcan, 'core_path', core_path, 'entity', entity, 'core', context.params[core_path], 'params login', context.params.login, 'required capabilities', requiredCapabilities);
+    //Below for passing through auth with no required capabilities
+    if (requiredCapabilities === noThrow || requiredCapabilities && requiredCapabilities[context.method] === noThrow) return hasLogin ? context : await noThrowAuth(context);
+    const adminPass = ((options == null ? void 0 : options.adminPass) || []).includes(context.method) && (symbolUcan._get(context.params, 'admin_pass') || symbolUcan._get(context.params, [configuration.core_path, 'admin_pass']));
+    // If no login is present and no client UCAN is provided, perform authentication. Otherwise, reuse existing state/ucan.
+    if (!hasLogin && !existingUcan) context = adminPass || options != null && options.specialChange ? await noThrowAuth(context) : await bareAuth(context);
+    if (requiredCapabilities === anyAuth && !(options != null && options.specialChange)) {
+      context.params.authenticated = !!context.params[entity];
+      return context;
+    }
+    if (adminPass) return context;
+    if (!requiredCapabilities) return context;
+    return await checkUcan(requiredCapabilities, options)(context);
+  };
+};
+const allUcanAuth = (methods, options) => {
+  return async context => {
+    const config = context.app.get('authentication');
+    // if a login is already present in params[core_path][entity], don't overwrite it
+    const corePath = config.core_path || 'core';
+    const entityKey = config.entity || 'login';
+    const existingLogin = symbolUcan._get(context.params, [corePath, entityKey]);
+    if (!existingLogin) {
+      const entity = symbolUcan._get(context, ['auth', entityKey]);
+      if (entity) context = symbolUcan._set(context, [corePath, entityKey], entity);
+    }
+    if (context.type === 'before') {
+      const {
+        method
+      } = context;
+      if (methods[method] || methods['all']) {
+        return await ucanAuth(methods[method] || methods['all'], options)(context);
+      } else return context;
+    } else return context;
+  };
+};
+
+const updateUcan = () => {
+  return async context => {
+    const {
+      add = [],
+      remove = []
+    } = context.data;
+    //ensure capabilities were passed
+    if (!(add != null && add.length) && !(remove != null && remove.length)) throw new Error('No new capabilities passed');
+    //check ability to edit the affected capabilities
+    const {
+      secret,
+      ucan_aud,
+      entity,
+      ucan
+    } = context.app.get('authentication');
+    const rootIssuer = symbolUcan.encodeKeyPair({
+      secretKey: secret
+    }).did();
+    const checkAbilities = symbolUcan.stackAbilities([...add, ...remove]);
+    const canEdit = await symbolUcan.verifyUcan(symbolUcan._get(context.params, [entity, ucan]), {
+      audience: symbolUcan._get(context.params, ucan_aud),
+      requiredCapabilities: checkAbilities.map(a => {
+        return {
+          //TODO: possibly READ shouldn't have the ability to allow others to READ
+          capability: a,
+          rootIssuer
+        };
+      })
+    });
+    if (!(canEdit != null && canEdit.ok)) throw new Error('You don\'t have sufficient capabilities to grant those capabilities');
+    //prep edited ucan
+    const subjectId = context.id;
+    const service = context.data.service || 'logins';
+    const path = context.data.path || 'ucan';
+    const subject = await new CoreCall(service, context, {
+      skipJoins: true
+    }).get(subjectId);
+    const decoded = symbolUcan.parseUcan(symbolUcan._get(subject, path));
+    const {
+      aud,
+      att,
+      fct,
+      nbf,
+      prf
+    } = decoded.payload;
+    let capabilities = [...att];
+    if (remove != null && remove.length) capabilities = symbolUcan.reduceAbilities(remove, att);
+    if (add != null && add.length) capabilities = symbolUcan.stackAbilities([...att, ...add]);
+    const raw = await symbolUcan.buildUcan({
+      issuer: symbolUcan.encodeKeyPair({
+        secretKey: secret
+      }),
+      audience: aud,
+      lifetimeInSeconds: 60 * 60 * 24 * 60,
+      proofs: prf,
+      ...context.data,
+      capabilities
+    });
+    const encoded = symbolUcan.ucanToken(raw);
+    const isValid = await symbolUcan.validateUcan(encoded);
+    if (!isValid) throw new Error('Invalid ucan generated when updating');
+    const patched = await new CoreCall(service, context).patch(subjectId, {
+      [path]: encoded
+    });
+    context.result = {
+      raw: context.data,
+      encoded,
+      subject: patched
+    };
+    return context;
+  };
+};
+
+exports.AuthService = AuthService;
+exports.CoreCall = CoreCall;
+exports.NotAuthError = NotAuthError;
+exports.UcanStrategy = UcanStrategy;
+exports.allUcanAuth = allUcanAuth;
+exports.anyAuth = anyAuth;
+exports.bareAuth = bareAuth;
+exports.checkUcan = checkUcan;
+exports.existsPath = existsPath;
+exports.getExists = getExists;
+exports.loadExists = loadExists;
+exports.modelCapabilities = modelCapabilities;
+exports.noThrow = noThrow;
+exports.noThrowAuth = noThrowAuth;
+exports.orVerifyLoop = orVerifyLoop;
+exports.setExists = setExists;
+exports.ucanAuth = ucanAuth;
+exports.updateUcan = updateUcan;
+exports.verifyAgainstReqs = verifyAgainstReqs;
 //# sourceMappingURL=index.cjs.map