Plays the home instance in federated sign-in: it lets this instance's users sign in to other gerbeur instances with their account here.
The flow is OpenID Connect's authorization code with PKCE, in three steps.
- Another instance, the client, sends the user to the
/authorizepage with a request. The page shows who asks (describeClient) and, once the user consents, gets a code (createAuthorizationCode), which it carries back to the client's callback page. - The client trades the code for an identity token, server to server (exchangeCode): this user's name, email and avatar, signed with the instance key.
- While the user's grant lasts, the client hears of their changes: a new
name, email or avatar, and the end of their sessions after a password
change or reset. notifyClients queues the signed events in
federation_outbox, and outboxJob delivers them.
Only a local account signs in elsewhere: a user who came from another
instance signs in from there. routes/oauth.ts, routes/well-known.ts and
the routes that change a user call it.
Sends the outbox's events to each instance that has some, every instance at once so that one that doesn't answer delays none of the others.
Returns the instance clientId names, for the /authorize page's question
to user userId, and whether they already let it sign them in.
Trades a code for an identity token, for POST /api/oauth/tokens, which
the client calls server to server with the form params. A code works once,
within a minute, for the client and redirect it was made for, and with the
verifier whose hash the request carried (PKCE). The token, signed with the
instance key and addressed to the client, carries identityClaims
and the request's nonce.
Returns the instance's metadata, served at
/.well-known/openid-configuration.
Returns what this instance tells another of user: their name, email and
avatar, whose URL changes with each new one, so that a client fetches it
again only then.
Returns the instances user userId let their account sign in to, the most
recently used first, for the settings page.
Tells each instance user userId signed in to of event, or only those of
clientIds: update when their name, email or avatar changed, revoke
when their sessions there must end. The routes that change a user call it,
and for an update, event may be just the type: the claims are read now.
The events are queued in the outbox and their delivery starts at once,
after those queued before for the same instance (deliverTo).
Withdraws user userId's grant to the instance whose host is host: it
stops answering for them there, and is told to end their sessions.
Withdraws every grant, as each user would theirs, and drops the codes not
yet traded, so that no account here stays signed in elsewhere: main.ts
calls it at startup when FEDERATION.outgoing is off. Returns how many
grants it withdrew.
The instance's name in every token it signs and every token addressed to it: its public URL, which must be an origin for other instances to find its metadata.
Retries the outbox's failed events every minute.
The client's page a home instance sends the user back to, on the frontend. Its metadata announces it, and a home accepts no other.
Usage
import * as mod from "api/services/identity-provider-service.ts";