tslocal 0.3.1 → 1.0.0

package/ts/src/client.ts

@@ -12,9 +12,11 @@ import { Transport, type TransportOptions } from "./transport.js";
 import {
   ServeConfigSchema,
   StatusSchema,
+  TokenResponseSchema,
   WhoIsResponseSchema,
   type ServeConfig,
   type Status,
+  type TokenResponse,
   type WhoIsResponse,
 } from "./types.js";
 
@@ -171,6 +173,21 @@ export class Client {
     return config;
   }
 
+  // --- ID Token ---
+
+  /**
+   * Get an OIDC ID token for the given audience.
+   *
+   * The token can be presented to any resource provider which offers
+   * OIDC Federation.
+   */
+  async idToken(aud: string): Promise<TokenResponse> {
+    const data = await this.get200(
+      `/localapi/v0/id-token?aud=${encodeURIComponent(aud)}`,
+    );
+    return TokenResponseSchema.parse(parseJSON(data.toString("utf-8")));
+  }
+
   /**
    * Set the serve configuration.
    *

package/ts/src/index.ts

@@ -15,6 +15,7 @@ export {
   ServeConfigSchema,
   StatusSchema,
   TailnetStatusSchema,
+  TokenResponseSchema,
   UserProfileSchema,
   WhoIsResponseSchema,
   type ClientVersion,
@@ -23,6 +24,16 @@ export {
   type ServeConfig,
   type Status,
   type TailnetStatus,
+  type TokenResponse,
   type UserProfile,
   type WhoIsResponse,
 } from "./types.js";
+
+import type { Node as NodeType } from "./types.js";
+export type Node = NodeType;
+export const Node = {
+  /** Reports whether the node has any ACL tags. */
+  isTagged(node: NodeType): boolean {
+    return node.Tags.length > 0;
+  },
+};

package/ts/src/types.ts

@@ -843,6 +843,34 @@ export const NodeSchema = z.object({
 });
 export type Node = z.infer<typeof NodeSchema>;
 
+/** TokenResponse is the response to a TokenRequest. */
+export const TokenResponseSchema = z.object({
+  /**
+   * IDToken is a JWT encoding the following standard claims:
+   * 
+   *   `sub` | the MagicDNS name of the node
+   *   `aud` | Audience from the request
+   *   `exp` | Token expiry
+   *   `iat` | Token issuance time
+   *   `iss` | Issuer
+   *   `jti` | Random token identifier
+   *   `nbf` | Not before time
+   * 
+   * It also encodes the following Tailscale specific claims:
+   * 
+   *   `key`       | the node public key
+   *   `addresses` | the Tailscale IPs of the node
+   *   `nid`       | the node ID
+   *   `node`      | the name of the node
+   *   `domain`    | the domain of the node, it has the same format as MapResponse.Domain.
+   *   `tags`      | an array of <domain:tag> on the node (like alice.github:tag:foo or example.com:tag:foo)
+   *   `user`      | user emailish (like alice.github:alice@github or example.com:bob@example.com), if not tagged
+   *   `uid`       | user ID, if not tagged
+   */
+  id_token: z.string().default(""),
+});
+export type TokenResponse = z.infer<typeof TokenResponseSchema>;
+
 /**
  * TCPPortHandler describes what to do when handling a TCP
  * connection.