@aooth/idp 0.1.8

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 aoothjs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,40 @@
+# @aooth/idp
+
+Framework-agnostic OAuth2 / OIDC federated-login core for [aoothjs](https://github.com/moostjs/aoothjs).
+
+This is the **phase 2** layer of the [External IdP RFC](../../IDP.md): the portable
+pieces that have no framework dependency — provider clients, PKCE/state primitives,
+ID-token verification, and the account-resolution algorithm. The moost wiring
+(`OAuthController`, the provider-login workflow, DI binding) lives in `@aooth/auth-moost`
+(phase 3).
+
+## What's here
+
+- **`IdentityProvider`** — the provider abstraction (`authorizationUrl` / `exchange`).
+- **`OidcProvider`** — generic OpenID Connect: discovery, remote JWKS, and the full
+  OIDC Core 3.1.3.7 ID-token validation (pinned algs, `iss`/`aud`/`azp`, `exp`/`iat`/`nbf`
+  with clock skew, `nonce`, `at_hash`). Fails **closed** on JWKS/discovery errors.
+- **`GoogleProvider`** — `OidcProvider` pinned to Google's issuer + `RS256`.
+- **`FakeIdentityProvider`** — deterministic, network-free, for unit + e2e tests.
+- **`OAuthProviderRegistry`** — holds the providers + `FederatedPolicy` + shared
+  signing/verification config; resolves `:provider`; builds the fixed `redirect_uri`.
+- **PKCE / state** — `createPkcePair`, `generateNonce`, and `signState`/`verifyState`
+  (a compact HS256 JWT binding random + provider + redirect + optional verifier/nonce).
+- **`FederatedLoginService`** — `resolveUser(profile)` (known → email-match → new) and
+  `linkIdentity` (interactive-link completion with the cross-user guard).
+
+## Install
+
+```bash
+pnpm add @aooth/idp @aooth/user @aooth/auth
+```
+
+`@aooth/idp` depends on the concrete `UserService` (`@aooth/user`) and the shared
+`Clock` (`@aooth/auth`), and uses [`jose`](https://github.com/panva/jose) for all
+JWT/JWKS work.
+
+## Security
+
+Account matching by email is account-takeover sensitive — the default
+`FederatedPolicy.emailMatch` is `require-interactive-link` (never silently merge).
+See [IDP.md §4 / §7](../../IDP.md) for the full posture.