@anchrd/intel-api 0.16.0 → 0.16.1

package/dist/adapters/openid/openid.js

@@ -162,9 +162,20 @@ export function createOpenId(deps) {
     // one with a 404, which surfaced as a bare 500 on /auth/connect (#93). The fallback repeats the
     // operation once with the OAuth document; when both fail, the second error is thrown because it
     // belongs to the attempt that got further for the issuer that needed the fallback at all.
-    async function withAlgorithmFallback(run) {
+    async function withAlgorithmFallback(run, usable = () => true) {
         try {
-            return await run();
+            const first = await run();
+            // ⚠️ A THROW is not the only way the OIDC document can be the wrong one (#425). Cloudflare
+            // Access answers `/.well-known/openid-configuration` with **200** and a two-field stub —
+            // `issuer` and `jwks_uri`, nothing else — while the endpoints live only under RFC 8414's
+            // `oauth-authorization-server`. Discovery therefore SUCCEEDS, the fallback never runs, and
+            // the missing endpoint surfaces minutes later inside `buildAuthorizationUrl` as
+            // `authorization server metadata does not contain a valid "as.authorization_endpoint"` — a
+            // 500 on `/auth/connect` with nothing in it pointing at discovery.
+            //
+            // So the question is not "did it fail" but "is what came back usable". An answer that parses
+            // and carries nothing is the same situation as a 404, and it gets the same second attempt.
+            return usable(first) ? first : await run("oauth2");
         }
         catch {
             return await run("oauth2");
@@ -174,7 +185,14 @@ export function createOpenId(deps) {
         const key = `${issuer}#${clientId}`;
         let configuration = configurations.get(key);
         if (!configuration) {
-            configuration = withAlgorithmFallback((algorithm) => client.discovery(new URL(issuer), clientId, { token_endpoint_auth_method: "none" }, client.None(), { ...options(issuer), ...(algorithm ? { algorithm } : {}) }));
+            configuration = withAlgorithmFallback((algorithm) => client.discovery(new URL(issuer), clientId, { token_endpoint_auth_method: "none" }, client.None(), { ...options(issuer), ...(algorithm ? { algorithm } : {}) }), 
+            // The two endpoints every flow here needs. Asking for exactly them rather than for a long
+            // list keeps the check honest: a server that publishes these two is usable, and one that
+            // publishes neither is the stub case above, whatever else it carries.
+            (resolved) => {
+                const metadata = resolved.serverMetadata();
+                return Boolean(metadata.authorization_endpoint && metadata.token_endpoint);
+            });
             configurations.set(key, configuration);
             void configuration.catch(() => configurations.delete(key));
         }

package/dist/intel/intel.js

@@ -60,7 +60,16 @@ export function createIntel(deps) {
                 if (error instanceof IntelError) {
                     return context.redirect(`/tools?connectError=${encodeURIComponent(error.code)}`);
                 }
-                throw error;
+                // ⚠️ Everything else used to be rethrown, and the outer handler turned it into a bare 500
+                // with a generic body (#425). For an API that is the right answer; for a route a BROWSER is
+                // sent to it is a dead end — the reader gets JSON instead of a screen, and the Tools page
+                // never learns that the attempt happened at all, so it says "no access" about a sign-in
+                // that crashed.
+                //
+                // The trace still goes to the log, which is the operator's channel; what changes is that
+                // the reader is returned to a screen that can say "this broke" instead of "you may not".
+                reportUnexpectedError(error);
+                return context.redirect("/tools?connectError=portal_sign_in_failed");
             }
         });
         app.get("/auth/callback", async (context) => await browserAuth.callback(new URL(context.req.url), context.req.raw.headers));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anchrd/intel-api",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "type": "module",
   "license": "UNLICENSED",
   "repository": {