240 lines
12 KiB
Plaintext
240 lines
12 KiB
Plaintext
page wrnexusidentity {
|
|
seo {
|
|
title = "@wrnexus/identity"
|
|
description = "Portable identity records, claims, and account linking."
|
|
}
|
|
|
|
view {
|
|
<div class="docs-shell">
|
|
<a href="#main" class="skip-link">Skip to content</a>
|
|
<header class="topbar">
|
|
<a class="brand" href="/"><span>W</span> WRNexusJS</a>
|
|
<nav aria-label="Primary"><a href="/getting-started">Get started</a><a href="/packages">Packages</a><a href="https://component.wrnexusjs.dev/">Components</a><a href="/language">Language</a><a href="/architecture">Architecture</a></nav>
|
|
<div class="topbar-actions"><a class="preview-pill" href="/access">Private preview · v0.8.7</a><button data-wire-theme-toggle class="theme-button" aria-label="Toggle color theme" title="Toggle color theme">◐</button></div>
|
|
</header>
|
|
<div class="mobile-doc-nav"><details><summary>Browse documentation</summary><nav><a href="/getting-started">Get started</a><a href="/packages">Packages</a><a href="https://component.wrnexusjs.dev/">Components</a><a href="/language">Language</a><a href="/architecture">Architecture</a><a href="/tutorial">Tutorial</a><a href="/guides/project-structure">Guides</a><a href="/examples">Examples</a><a href="/search">Search</a></nav></details></div>
|
|
<main class="portal-main docs-layout">
|
|
<article id="main" class="documentation prose standalone package-document"><nav class="breadcrumbs" aria-label="Breadcrumb"><a href="/">Home</a><span>/</span><a href="/packages">Packages</a><span>/</span><span aria-current="page">@wrnexus/identity</span></nav><section class="doc-intro"><span class="eyebrow">Security · Package reference</span><h1>@wrnexus/identity</h1><p>Portable identity records, claims, and account linking.</p><div class="doc-meta"><span>v0.8.7</span><span>Private registry</span><span>Security</span></div><section id="access" class="access-callout"><h2>Install the package</h2><p>After WorkRoot approves private registry access, install the release-aligned package:</p><pre><code>bun add @wrnexus/identity@0.8.7</code><button type="button" class="copy-button" aria-label="Copy installation command">Copy</button></pre><p><a href="/access">Request preview access</a>. Never put registry tokens in source control.</p></section></section><section id="guide"><p>Enterprise identity and governance for WRNexusJS: OIDC discovery, signed SAML adapter flows, LDAP/Active Directory synchronization adapters, SCIM provisioning, scoped API keys, service accounts, approval workflows, consent history, retention, subject export/deletion and audit.</p>
|
|
<p>The package complements <code>@wrnexus/auth</code> (passkeys, MFA, devices, sessions, OAuth and audited impersonation) and <code>@wrnexus/authz</code> (RBAC, ABAC and policy decisions). Protocol-specific SAML and directory parsing is supplied through adapters so applications can select a maintained vendor SDK without weakening framework validation, replay protection or governance auditing.</p></section><section id="api" class="api"><h2>Complete TypeScript API</h2><p>Generated from the exact installed package declarations.</p><pre data-language="typescript"><code>interface OidcMetadata {
|
|
issuer: string;
|
|
authorization_endpoint: string;
|
|
token_endpoint: string;
|
|
userinfo_endpoint?: string;
|
|
jwks_uri: string;
|
|
scopes_supported?: string[];
|
|
}
|
|
declare function discoverOidc(issuer: string, options?: {
|
|
fetch?: typeof fetch;
|
|
}): Promise<OidcMetadata>;
|
|
declare function oidcAuthorizationUrl(metadata: OidcMetadata, input: {
|
|
clientId: string;
|
|
redirectUri: string;
|
|
state: string;
|
|
nonce: string;
|
|
codeChallenge: string;
|
|
scopes?: string[];
|
|
}): string;
|
|
interface EnterpriseIdentity {
|
|
externalId: string;
|
|
username: string;
|
|
displayName?: string;
|
|
email?: string;
|
|
groups: string[];
|
|
active: boolean;
|
|
attributes?: Record<string, unknown>;
|
|
}
|
|
interface SamlAssertion {
|
|
id: string;
|
|
issuer: string;
|
|
audience: string;
|
|
recipient: string;
|
|
expiresAt: number;
|
|
identity: EnterpriseIdentity;
|
|
}
|
|
interface SamlAdapter {
|
|
createLoginRequest(input: {
|
|
requestId: string;
|
|
callbackUrl: string;
|
|
relayState: string;
|
|
}): Promise<string> | string;
|
|
verifySignedResponse(response: string): Promise<SamlAssertion>;
|
|
}
|
|
interface ReplayStore {
|
|
consume(id: string, expiresAt: number): Promise<boolean>;
|
|
}
|
|
declare function memoryReplayStore(now?: () => number): ReplayStore;
|
|
declare function createSamlFederation(options: {
|
|
adapter: SamlAdapter;
|
|
issuer: string;
|
|
audience: string;
|
|
recipient: string;
|
|
replayStore?: ReplayStore;
|
|
now?: () => number;
|
|
}): {
|
|
login: (input: {
|
|
requestId: string;
|
|
callbackUrl: string;
|
|
relayState: string;
|
|
}) => Promise<string> | string;
|
|
callback(encodedResponse: string): Promise<EnterpriseIdentity>;
|
|
};
|
|
interface DirectoryAdapter {
|
|
kind: "ldap" | "active-directory";
|
|
search(input: {
|
|
baseDn: string;
|
|
filter: string;
|
|
attributes: string[];
|
|
signal?: AbortSignal;
|
|
}): Promise<EnterpriseIdentity[]>;
|
|
authenticate?(username: string, password: string, signal?: AbortSignal): Promise<EnterpriseIdentity | null>;
|
|
}
|
|
declare function syncDirectory(adapter: DirectoryAdapter, options: {
|
|
baseDn: string;
|
|
filter?: string;
|
|
attributes?: string[];
|
|
signal?: AbortSignal;
|
|
upsert: (identity: EnterpriseIdentity) => void | Promise<void>;
|
|
disableMissing?: (externalIds: string[]) => void | Promise<void>;
|
|
}): Promise<{
|
|
provider: "ldap" | "active-directory";
|
|
synchronized: number;
|
|
}>;
|
|
interface ScimUser extends EnterpriseIdentity {
|
|
id: string;
|
|
/** RFC 7643 field accepted at the HTTP boundary. */
|
|
userName?: string;
|
|
schemas?: string[];
|
|
}
|
|
interface ScimStore {
|
|
list(): Promise<ScimUser[]>;
|
|
get(id: string): Promise<ScimUser | null>;
|
|
create(user: Omit<ScimUser, "id">): Promise<ScimUser>;
|
|
update(id: string, user: Partial<ScimUser>): Promise<ScimUser | null>;
|
|
delete(id: string): Promise<boolean>;
|
|
}
|
|
declare function memoryScimStore(): ScimStore;
|
|
declare function createScimHandler(options: {
|
|
store: ScimStore;
|
|
bearerToken: string;
|
|
basePath?: string;
|
|
maxBodyBytes?: number;
|
|
}): (request: Request) => Promise<Response>;
|
|
interface MachineCredential {
|
|
id: string;
|
|
ownerId: string;
|
|
kind: "api-key" | "service-account";
|
|
name: string;
|
|
scopes: string[];
|
|
secretHash: string;
|
|
createdAt: number;
|
|
expiresAt?: number;
|
|
revokedAt?: number;
|
|
}
|
|
declare function createMachineIdentityManager(now?: () => number): {
|
|
issue(input: {
|
|
ownerId: string;
|
|
name: string;
|
|
scopes: string[];
|
|
kind?: MachineCredential["kind"];
|
|
expiresAt?: number;
|
|
}): Promise<{
|
|
secret: string;
|
|
credential: {
|
|
secretHash: string;
|
|
id: string;
|
|
ownerId: string;
|
|
kind: "api-key" | "service-account";
|
|
name: string;
|
|
scopes: string[];
|
|
createdAt: number;
|
|
expiresAt?: number;
|
|
revokedAt?: number;
|
|
};
|
|
}>;
|
|
authenticate(secret: string, requiredScope?: string): Promise<{
|
|
secretHash: string;
|
|
id: string;
|
|
ownerId: string;
|
|
kind: "api-key" | "service-account";
|
|
name: string;
|
|
scopes: string[];
|
|
createdAt: number;
|
|
expiresAt?: number;
|
|
revokedAt?: number;
|
|
} | null>;
|
|
revoke(id: string): boolean;
|
|
list(ownerId: string): {
|
|
secretHash: string;
|
|
id: string;
|
|
ownerId: string;
|
|
kind: "api-key" | "service-account";
|
|
name: string;
|
|
scopes: string[];
|
|
createdAt: number;
|
|
expiresAt?: number;
|
|
revokedAt?: number;
|
|
}[];
|
|
};
|
|
interface GovernanceEvent {
|
|
id: string;
|
|
type: string;
|
|
subjectId: string;
|
|
actorId?: string;
|
|
createdAt: number;
|
|
data?: Record<string, unknown>;
|
|
}
|
|
declare function createGovernance(options?: {
|
|
now?: () => number;
|
|
audit?: (event: GovernanceEvent) => void | Promise<void>;
|
|
exportSubject?: (subjectId: string) => unknown | Promise<unknown>;
|
|
deleteSubject?: (subjectId: string) => void | Promise<void>;
|
|
}): {
|
|
consent(subjectId: string, purpose: string, granted: boolean, version: string): Promise<{
|
|
granted: boolean;
|
|
version: string;
|
|
at: number;
|
|
}>;
|
|
consents(subjectId: string): {
|
|
[k: string]: {
|
|
granted: boolean;
|
|
version: string;
|
|
at: number;
|
|
};
|
|
};
|
|
request(subjectId: string, action: "export" | "delete"): Promise<{
|
|
id: `${string}-${string}-${string}-${string}-${string}`;
|
|
subjectId: string;
|
|
action: "export" | "delete";
|
|
status: "pending";
|
|
requestedAt: number;
|
|
}>;
|
|
decide(id: string, actorId: string, approved: boolean): Promise<{
|
|
decision: {
|
|
status: "approved" | "rejected";
|
|
decidedAt: number;
|
|
decidedBy: string;
|
|
id: string;
|
|
subjectId: string;
|
|
action: "export" | "delete";
|
|
requestedAt: number;
|
|
};
|
|
result: unknown;
|
|
}>;
|
|
enforceRetention(records: Array<{
|
|
subjectId: string;
|
|
createdAt: number;
|
|
}>, maxAgeMs: number, remove: (record: {
|
|
subjectId: string;
|
|
createdAt: number;
|
|
}) => void | Promise<void>): Promise<number>;
|
|
};
|
|
|
|
export { type DirectoryAdapter, type EnterpriseIdentity, type GovernanceEvent, type MachineCredential, type OidcMetadata, type ReplayStore, type SamlAdapter, type SamlAssertion, type ScimStore, type ScimUser, createGovernance, createMachineIdentityManager, createSamlFederation, createScimHandler, discoverOidc, memoryReplayStore, memoryScimStore, oidcAuthorizationUrl, syncDirectory };
|
|
</code></pre></section><section id="examples" class="examples"><h2>Examples</h2><p>Copy-ready examples from the installed package documentation.</p><div class="example-grid"><article class="example-card"><h3>Install @wrnexus/identity</h3><pre data-language="sh"><code>bun add @wrnexus/identity</code></pre></article><article class="example-card"><h3>Import @wrnexus/identity</h3><pre data-language="ts"><code>import * as identity from "@wrnexus/identity";</code></pre></article></div></section></article>
|
|
<aside class="on-this-page"><h2>On this page</h2><nav><a class="toc-level-2" href="#guide">Guide</a><a class="toc-level-2" href="#api">Complete API</a><a class="toc-level-2" href="#examples">Examples</a></nav></aside>
|
|
</main>
|
|
<footer><div class="footer-brand"><span class="footer-mark" aria-hidden="true">W</span><p><strong>WRNexusJS 0.8.7</strong><span>Complete API documentation generated from installed package declarations.</span></p></div><nav aria-label="Footer"><a href="/packages">All packages</a><a href="/getting-started">Get started</a><a href="/security">Security</a><a href="/support">Support</a><a href="/llms.txt">AI guide</a></nav><p class="footer-meta">Private Developer Preview · Bun-native</p></footer>
|
|
</div>
|
|
}
|
|
}
|