@axiom-lattice/auth-oidc 0.0.0-stage → 0.2.0

package/dist/index.js

@@ -0,0 +1,743 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  OIDC_STATE_COOKIE: () => OIDC_STATE_COOKIE,
+  OIDC_STATE_PATH: () => OIDC_STATE_PATH,
+  OidcAuthProvider: () => OidcAuthProvider,
+  assertSafeEndpointSyntax: () => assertSafeEndpointSyntax,
+  assertSafeOidcEndpoint: () => assertSafeOidcEndpoint,
+  assertTenantSpecificAzureIssuer: () => assertTenantSpecificAzureIssuer,
+  clearStateCookie: () => clearStateCookie,
+  isLinkLocalOrMetadataAddress: () => isLinkLocalOrMetadataAddress,
+  loadOpenidClient: () => loadOpenidClient,
+  oidcDescriptor: () => oidcDescriptor,
+  parseAllowedPrivateHosts: () => parseAllowedPrivateHosts,
+  principalFromClaims: () => principalFromClaims,
+  probeOidcProvider: () => probeOidcProvider,
+  readCookie: () => readCookie,
+  readOidcConfig: () => readOidcConfig,
+  serializeCookie: () => serializeCookie,
+  signStateCookie: () => signStateCookie,
+  stateCookie: () => stateCookie,
+  verifyStateCookie: () => verifyStateCookie
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/endpointSafety.ts
+var import_promises = require("dns/promises");
+var import_node_net = require("net");
+function hostAddress(hostname) {
+  return hostname.replace(/^\[/, "").replace(/\]$/, "");
+}
+function normalizeHostEntry(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed) return void 0;
+  let host = trimmed;
+  if (trimmed.includes("://")) {
+    try {
+      host = new URL(trimmed).hostname;
+    } catch {
+      return void 0;
+    }
+  }
+  return hostAddress(host).toLowerCase().replace(/\.$/, "");
+}
+function parseAllowedPrivateHosts(value) {
+  if (!value) return [];
+  const hosts = /* @__PURE__ */ new Set();
+  for (const entry of value.split(",")) {
+    const host = normalizeHostEntry(entry);
+    if (host) hosts.add(host);
+  }
+  return [...hosts];
+}
+function isAllowedPrivateHost(hostname, options) {
+  const host = normalizeHostEntry(hostname);
+  if (!host) return false;
+  return (options.allowedPrivateHosts ?? []).some(
+    (entry) => normalizeHostEntry(entry) === host
+  );
+}
+function isLocalHostname(hostname) {
+  const host = hostAddress(hostname);
+  return host === "localhost" || host === "127.0.0.1" || host === "::1";
+}
+function isPrivateIPv4(ip) {
+  const parts = ip.split(".").map(Number);
+  if (parts.length !== 4 || parts.some((n) => !Number.isInteger(n) || n < 0 || n > 255)) {
+    return true;
+  }
+  const [a, b, c] = parts;
+  return a === 0 || a === 10 || a === 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 192 && b === 0 && c === 0 || a === 192 && b === 0 && c === 2 || a === 198 && b === 51 && c === 100 || a === 203 && b === 0 && c === 113 || a === 100 && b >= 64 && b <= 127 || a === 198 && (b === 18 || b === 19) || a >= 224;
+}
+var IPV6_8_BITS = 8;
+var IPV6_GROUPS = 8;
+function ipv6Bytes(ip) {
+  let value = ip.toLowerCase();
+  const zone = value.indexOf("%");
+  if (zone !== -1) value = value.slice(0, zone);
+  const lastColon = value.lastIndexOf(":");
+  if (lastColon !== -1 && value.slice(lastColon + 1).includes(".")) {
+    const ipv4 = value.slice(lastColon + 1).split(".").map(Number);
+    if (ipv4.length !== 4 || ipv4.some((n) => !Number.isInteger(n) || n < 0 || n > 255)) {
+      return null;
+    }
+    const high = (ipv4[0] << 8 | ipv4[1]).toString(16);
+    const low = (ipv4[2] << 8 | ipv4[3]).toString(16);
+    value = `${value.slice(0, lastColon + 1)}${high}:${low}`;
+  }
+  const halves = value.split("::");
+  if (halves.length > 2) return null;
+  const head = halves[0] ? halves[0].split(":") : [];
+  const tail = halves.length === 2 && halves[1] ? halves[1].split(":") : [];
+  let groups;
+  if (halves.length === 2) {
+    const missing = IPV6_GROUPS - head.length - tail.length;
+    if (missing < 1) return null;
+    groups = [...head, ...Array(missing).fill("0"), ...tail];
+  } else {
+    groups = head;
+  }
+  if (groups.length !== IPV6_GROUPS) return null;
+  const bytes = [];
+  for (const group of groups) {
+    if (!/^[0-9a-f]{1,4}$/.test(group)) return null;
+    const part = Number.parseInt(group, 16);
+    bytes.push(part >> IPV6_8_BITS & 255, part & 255);
+  }
+  return bytes;
+}
+function hasPrefix(bytes, prefix) {
+  return prefix.every((value, index) => bytes[index] === value);
+}
+function isPrivateIPv6(ip) {
+  const bytes = ipv6Bytes(ip);
+  if (!bytes) return true;
+  if (bytes.every((value) => value === 0)) return true;
+  const loopback = bytes.slice(0, 15).every((value) => value === 0) && bytes[15] === 1;
+  if (loopback) return true;
+  if ((bytes[0] & 254) === 252) return true;
+  if (bytes[0] === 254 && (bytes[1] & 192) === 128) return true;
+  if (bytes[0] === 255) return true;
+  if (bytes[0] === 0 && bytes[1] === 0 && bytes[2] === 0 && bytes[3] === 0 && bytes[4] === 0 && bytes[5] === 0 && bytes[6] === 0 && bytes[7] === 0 && bytes[8] === 0 && bytes[9] === 0 && bytes[10] === 255 && bytes[11] === 255) {
+    return isPrivateIPv4(
+      `${bytes[12]}.${bytes[13]}.${bytes[14]}.${bytes[15]}`
+    );
+  }
+  if (hasPrefix(bytes, [0, 100, 255, 155, 0, 0, 0, 0, 0, 0, 0, 0])) {
+    return true;
+  }
+  if (hasPrefix(bytes, [0, 100, 255, 155, 0, 1])) return true;
+  if (hasPrefix(bytes, [32, 2])) return true;
+  if (hasPrefix(bytes, [32, 1, 0, 0])) return true;
+  if (hasPrefix(bytes, [32, 1, 13, 184])) return true;
+  if (hasPrefix(bytes, [32, 1, 0, 2, 0, 0])) return true;
+  if (hasPrefix(bytes, [1, 0, 0, 0, 0, 0, 0, 0])) return true;
+  return false;
+}
+function isPrivateAddress(ip) {
+  const version = (0, import_node_net.isIP)(ip);
+  if (version === 4) return isPrivateIPv4(ip);
+  if (version === 6) return isPrivateIPv6(ip);
+  return true;
+}
+function isLinkLocalOrMetadataAddress(address) {
+  const ip = hostAddress(address);
+  const version = (0, import_node_net.isIP)(ip);
+  if (version === 4) {
+    const parts = ip.split(".").map(Number);
+    if (parts.length !== 4 || parts.some((n) => !Number.isInteger(n) || n < 0 || n > 255)) {
+      return false;
+    }
+    return parts[0] === 0 || parts[0] === 169 && parts[1] === 254;
+  }
+  if (version !== 6) return false;
+  const bytes = ipv6Bytes(ip);
+  if (!bytes) return false;
+  if (bytes.every((value) => value === 0)) return true;
+  if (bytes[0] === 254 && (bytes[1] & 192) === 128) return true;
+  const ipv4Mapped = bytes.slice(0, 10).every((value) => value === 0) && bytes[10] === 255 && bytes[11] === 255;
+  if (ipv4Mapped) {
+    return isLinkLocalOrMetadataAddress(
+      `${bytes[12]}.${bytes[13]}.${bytes[14]}.${bytes[15]}`
+    );
+  }
+  return false;
+}
+function assertSafeEndpointSyntax(raw, options) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new Error("OIDC endpoint must be an absolute URL");
+  }
+  if (url.username || url.password) {
+    throw new Error("OIDC endpoint must not contain userinfo");
+  }
+  if (url.search || url.hash) {
+    throw new Error("OIDC endpoint must not contain query or fragment");
+  }
+  const host = hostAddress(url.hostname);
+  if (url.protocol !== "https:") {
+    const localMock = options.allowInsecure && url.protocol === "http:" && isLocalHostname(host);
+    if (!localMock) throw new Error("OIDC endpoint must use https");
+  }
+  if (isLocalHostname(host) && !options.allowInsecure) {
+    throw new Error("OIDC endpoint must not target localhost");
+  }
+  if ((0, import_node_net.isIP)(host) && isLinkLocalOrMetadataAddress(host)) {
+    throw new Error(
+      "OIDC endpoint must not target a link-local or metadata address"
+    );
+  }
+  if ((0, import_node_net.isIP)(host) && isPrivateAddress(host)) {
+    if (!(options.allowInsecure && isLocalHostname(host)) && !isAllowedPrivateHost(host, options)) {
+      throw new Error("OIDC endpoint must not target a private address");
+    }
+  }
+  return url;
+}
+async function assertSafeOidcEndpoint(raw, options) {
+  const url = assertSafeEndpointSyntax(raw, options);
+  const host = hostAddress(url.hostname);
+  const allowlisted = isAllowedPrivateHost(host, options);
+  if (options.allowInsecure && isLocalHostname(host) || (0, import_node_net.isIP)(host)) {
+    return url;
+  }
+  const addresses = await (0, import_promises.lookup)(host, { all: true, verbatim: true });
+  if (addresses.length === 0) throw new Error("OIDC endpoint host did not resolve");
+  for (const { address } of addresses) {
+    if (isLinkLocalOrMetadataAddress(address)) {
+      throw new Error(
+        "OIDC endpoint host resolves to a link-local or metadata address"
+      );
+    }
+    if (isPrivateAddress(address) && !allowlisted) {
+      throw new Error("OIDC endpoint host resolves to a private address");
+    }
+  }
+  return url;
+}
+
+// src/config.ts
+function required(env, name) {
+  const value = env[name]?.trim();
+  if (!value) throw new Error(`${name} is required when OIDC_ENABLED=true`);
+  return value;
+}
+function boolean(value, fallback = false) {
+  if (value === void 0 || value.trim() === "") return fallback;
+  return value === "true";
+}
+function isLocalHost(hostname) {
+  const host = hostname.replace(/^\[/, "").replace(/\]$/, "");
+  return host === "localhost" || host === "127.0.0.1" || host === "::1";
+}
+function assertNoCredentialsQueryOrFragment(url, name) {
+  if (url.username || url.password) {
+    throw new Error(`${name} must not contain userinfo`);
+  }
+  if (url.search || url.hash) {
+    throw new Error(`${name} must not contain query or fragment`);
+  }
+}
+function assertTenantSpecificAzureIssuer(url, name = "OIDC_ISSUER") {
+  if (url.hostname.toLowerCase() !== "login.microsoftonline.com") return;
+  const firstSegment = url.pathname.split("/").filter(Boolean)[0]?.toLowerCase();
+  if (firstSegment === "common" || firstSegment === "organizations") {
+    throw new Error(
+      `${name} must be tenant-specific; login.microsoftonline.com/common and /organizations are not supported`
+    );
+  }
+}
+function parseIssuer(raw, allowInsecure) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new Error("OIDC_ISSUER must be an absolute URL");
+  }
+  assertNoCredentialsQueryOrFragment(url, "OIDC_ISSUER");
+  assertTenantSpecificAzureIssuer(url);
+  if (url.protocol !== "https:") {
+    if (!(allowInsecure && url.protocol === "http:" && isLocalHost(url.hostname))) {
+      throw new Error("OIDC_ISSUER must use https");
+    }
+  }
+  return url.toString().replace(/\/$/, "");
+}
+function parseRedirect(raw, nodeEnv) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new Error("OIDC redirect URLs must be absolute URLs");
+  }
+  assertNoCredentialsQueryOrFragment(url, "OIDC redirect URLs");
+  if (url.protocol !== "https:") {
+    const localAllowed = (nodeEnv === "test" || nodeEnv === "development") && url.protocol === "http:" && isLocalHost(url.hostname);
+    if (!localAllowed) {
+      throw new Error("OIDC redirect URLs must use https outside test/development");
+    }
+  }
+  return url.toString();
+}
+function readOidcConfig(env = process.env, options = {}) {
+  if (!boolean(env.OIDC_ENABLED)) return null;
+  const nodeEnv = options.nodeEnv ?? env.NODE_ENV ?? "production";
+  const allowInsecure = boolean(env.OIDC_ALLOW_INSECURE);
+  if (allowInsecure && nodeEnv !== "test" && nodeEnv !== "development") {
+    throw new Error("OIDC_ALLOW_INSECURE is only allowed when NODE_ENV=test|development");
+  }
+  const issuer = parseIssuer(required(env, "OIDC_ISSUER"), allowInsecure);
+  const redirectUri = parseRedirect(required(env, "OIDC_REDIRECT_URI"), nodeEnv);
+  const postLoginRedirectUri = parseRedirect(
+    required(env, "OIDC_POST_LOGIN_REDIRECT_URI"),
+    nodeEnv
+  );
+  const jitProvisioning = boolean(env.OIDC_JIT_PROVISIONING);
+  const defaultTenantId = env.OIDC_DEFAULT_TENANT_ID?.trim() || void 0;
+  const stateSecret = (options.stateSecret ?? env.AUTH_TOKEN_SECRET ?? env.JWT_SECRET)?.trim();
+  if (!stateSecret) {
+    throw new Error("AUTH_TOKEN_SECRET or JWT_SECRET is required for OIDC state signing");
+  }
+  if (stateSecret.length < 16) {
+    throw new Error(
+      "AUTH_TOKEN_SECRET or JWT_SECRET must be at least 16 characters for OIDC state signing"
+    );
+  }
+  const allowedPrivateHosts = parseAllowedPrivateHosts(
+    env.OIDC_ALLOWED_PRIVATE_HOSTS
+  );
+  return {
+    issuer,
+    clientId: required(env, "OIDC_CLIENT_ID"),
+    clientSecret: required(env, "OIDC_CLIENT_SECRET"),
+    redirectUri,
+    postLoginRedirectUri,
+    scopes: env.OIDC_SCOPES?.trim() || "openid profile email",
+    displayName: env.OIDC_DISPLAY_NAME?.trim() || "Microsoft",
+    ...defaultTenantId ? { defaultTenantId } : {},
+    jitProvisioning,
+    autoLinkEmail: boolean(env.OIDC_AUTO_LINK_EMAIL),
+    allowInsecure,
+    insecureCookies: redirectUri.startsWith("http://"),
+    stateSecret,
+    ...allowedPrivateHosts.length ? { allowedPrivateHosts } : {}
+  };
+}
+function oidcDescriptor(config) {
+  return {
+    id: "oidc",
+    displayName: config.displayName,
+    interaction: "redirect",
+    surfaces: ["console"]
+  };
+}
+
+// src/stateCookie.ts
+var import_node_crypto = require("crypto");
+var OIDC_STATE_COOKIE = "axiom_oidc_state";
+var OIDC_STATE_PATH = "/api/auth/login";
+function isPayload(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const payload = value;
+  return typeof payload.state === "string" && typeof payload.codeVerifier === "string" && typeof payload.nonce === "string" && typeof payload.providerId === "string" && payload.providerId.length > 0 && typeof payload.exp === "number" && Number.isFinite(payload.exp);
+}
+function stateKey(secret) {
+  return (0, import_node_crypto.createHmac)("sha256", secret).update("axiom-oidc-state-v1").digest();
+}
+function signStateCookie(payload, secret) {
+  const encoded = Buffer.from(JSON.stringify(payload)).toString("base64url");
+  const signature = (0, import_node_crypto.createHmac)("sha256", stateKey(secret)).update(encoded).digest("base64url");
+  return `${encoded}.${signature}`;
+}
+function verifyStateCookie(value, secret, now = Date.now()) {
+  const [encoded, signature, extra] = value.split(".");
+  if (!encoded || !signature || extra !== void 0) return null;
+  const expected = (0, import_node_crypto.createHmac)("sha256", stateKey(secret)).update(encoded).digest();
+  let actual;
+  try {
+    actual = Buffer.from(signature, "base64url");
+  } catch {
+    return null;
+  }
+  if (actual.length !== expected.length || actual.toString("base64url") !== signature || !(0, import_node_crypto.timingSafeEqual)(actual, expected)) {
+    return null;
+  }
+  try {
+    const payload = JSON.parse(
+      Buffer.from(encoded, "base64url").toString("utf8")
+    );
+    if (!isPayload(payload) || payload.exp < now) return null;
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function stateCookie(value, options) {
+  return {
+    name: OIDC_STATE_COOKIE,
+    value,
+    options: {
+      httpOnly: true,
+      secure: options.secure,
+      sameSite: "lax",
+      path: OIDC_STATE_PATH,
+      maxAge: options.maxAge ?? 600
+    }
+  };
+}
+function clearStateCookie(options) {
+  return {
+    name: OIDC_STATE_COOKIE,
+    value: "",
+    options: {
+      httpOnly: true,
+      secure: options.secure,
+      sameSite: "lax",
+      path: OIDC_STATE_PATH,
+      maxAge: 0
+    }
+  };
+}
+function serializeCookie(cookie) {
+  const parts = [`${cookie.name}=${encodeURIComponent(cookie.value)}`];
+  if (cookie.options.httpOnly) parts.push("HttpOnly");
+  if (cookie.options.secure) parts.push("Secure");
+  if (cookie.options.sameSite) {
+    parts.push(
+      `SameSite=${cookie.options.sameSite[0].toUpperCase()}${cookie.options.sameSite.slice(1)}`
+    );
+  }
+  if (cookie.options.path) parts.push(`Path=${cookie.options.path}`);
+  if (cookie.options.maxAge !== void 0) parts.push(`Max-Age=${cookie.options.maxAge}`);
+  return parts.join("; ");
+}
+function readCookie(header, name) {
+  if (!header) return void 0;
+  for (const part of header.split(";")) {
+    const [rawName, ...rest] = part.trim().split("=");
+    if (rawName === name) {
+      try {
+        return decodeURIComponent(rest.join("="));
+      } catch (error) {
+        if (error instanceof URIError) return void 0;
+        throw error;
+      }
+    }
+  }
+  return void 0;
+}
+
+// src/openidClient.ts
+async function loadOpenidClient() {
+  const mod = await import("openid-client");
+  return {
+    discovery: (issuer, clientId, clientSecret, options) => {
+      const execute = options.allowInsecure ? [mod.allowInsecureRequests] : void 0;
+      return mod.discovery(issuer, clientId, clientSecret, void 0, {
+        timeout: options.timeoutSeconds,
+        ...execute ? { execute } : {}
+      });
+    },
+    randomState: () => mod.randomState(),
+    randomPKCECodeVerifier: () => mod.randomPKCECodeVerifier(),
+    calculatePKCECodeChallenge: (verifier) => mod.calculatePKCECodeChallenge(verifier),
+    randomNonce: () => mod.randomNonce(),
+    buildAuthorizationUrl: (config, parameters) => mod.buildAuthorizationUrl(config, parameters),
+    authorizationCodeGrant: async (config, currentUrl, checks) => {
+      const tokens = await mod.authorizationCodeGrant(config, currentUrl, checks);
+      return {
+        claims: () => tokens.claims()
+      };
+    }
+  };
+}
+
+// src/probe.ts
+function requiredMetadataString(metadata, key) {
+  const value = metadata[key];
+  if (typeof value !== "string" || !value) {
+    throw new Error("OIDC discovery returned incomplete metadata");
+  }
+  return value;
+}
+async function probeOidcProvider(config) {
+  const client = config.client ?? await loadOpenidClient();
+  const validateEndpoint = config.validateEndpoint ?? assertSafeOidcEndpoint;
+  const safety = {
+    allowInsecure: config.allowInsecure,
+    allowedPrivateHosts: config.allowedPrivateHosts ?? []
+  };
+  await validateEndpoint(config.issuer, safety);
+  const discovered = await client.discovery(
+    new URL(config.issuer),
+    config.clientId,
+    config.clientSecret,
+    { timeoutSeconds: 5, allowInsecure: config.allowInsecure }
+  );
+  const metadata = discovered.serverMetadata();
+  const authorizationEndpoint = requiredMetadataString(
+    metadata,
+    "authorization_endpoint"
+  );
+  const tokenEndpoint = requiredMetadataString(metadata, "token_endpoint");
+  const jwksUri = requiredMetadataString(metadata, "jwks_uri");
+  const userinfoEndpoint = typeof metadata.userinfo_endpoint === "string" && metadata.userinfo_endpoint ? metadata.userinfo_endpoint : void 0;
+  for (const endpoint of [
+    authorizationEndpoint,
+    tokenEndpoint,
+    jwksUri,
+    ...userinfoEndpoint ? [userinfoEndpoint] : []
+  ]) {
+    await validateEndpoint(endpoint, safety);
+  }
+  const issuer = typeof metadata.issuer === "string" && metadata.issuer ? metadata.issuer : config.issuer;
+  const scopesSupported = Array.isArray(metadata.scopes_supported) ? metadata.scopes_supported.filter(
+    (scope) => typeof scope === "string"
+  ) : void 0;
+  return {
+    issuer,
+    authorizationEndpoint,
+    tokenEndpoint,
+    jwksUri,
+    ...userinfoEndpoint ? { userinfoEndpoint } : {},
+    ...scopesSupported ? { scopesSupported } : {}
+  };
+}
+
+// src/OidcAuthProvider.ts
+var import_protocols = require("@axiom-lattice/protocols");
+function stringClaim(claims, ...names) {
+  for (const name of names) {
+    const value = claims[name];
+    if (typeof value === "string" && value.trim()) return value;
+  }
+  return void 0;
+}
+function providerError(message, cause) {
+  const error = new import_protocols.AuthError("PROVIDER_ERROR", 502, message);
+  if (cause !== void 0) {
+    Object.defineProperty(error, "cause", {
+      value: cause,
+      enumerable: false,
+      configurable: true,
+      writable: true
+    });
+  }
+  return error;
+}
+function principalFromClaims(claims) {
+  const subject = stringClaim(claims, "oid", "sub");
+  if (!subject) {
+    throw new import_protocols.AuthError("PROVIDER_ERROR", 502, "OIDC ID token has no subject");
+  }
+  const emailClaim = stringClaim(claims, "email");
+  const rawEmail = emailClaim ?? stringClaim(claims, "preferred_username", "upn");
+  const email = rawEmail?.trim().toLowerCase();
+  const name = stringClaim(claims, "name");
+  const picture = stringClaim(claims, "picture");
+  return {
+    subject,
+    method: "oidc",
+    ...email ? { email } : {},
+    ...email ? { emailVerified: emailClaim !== void 0 && claims.email_verified === true } : {},
+    ...name ? { name } : {},
+    ...picture ? { picture } : {},
+    claims
+  };
+}
+var OidcAuthProvider = class {
+  constructor(options) {
+    this.options = options;
+    this.descriptor = oidcDescriptor(options.config);
+  }
+  async getClient() {
+    return this.options.client ?? await loadOpenidClient();
+  }
+  async getConfiguration(client) {
+    if (!this.configurationPromise) {
+      this.configurationPromise = (async () => {
+        try {
+          const validateEndpoint = this.options.validateEndpoint ?? assertSafeOidcEndpoint;
+          const safety = {
+            allowInsecure: this.options.config.allowInsecure,
+            allowedPrivateHosts: this.options.config.allowedPrivateHosts ?? []
+          };
+          await validateEndpoint(this.options.config.issuer, safety);
+          const discovered = await client.discovery(
+            new URL(this.options.config.issuer),
+            this.options.config.clientId,
+            this.options.config.clientSecret,
+            {
+              timeoutSeconds: 5,
+              allowInsecure: this.options.config.allowInsecure
+            }
+          );
+          const metadata = discovered.serverMetadata();
+          const { authorization_endpoint, token_endpoint, jwks_uri } = metadata;
+          if (typeof authorization_endpoint !== "string" || !authorization_endpoint || typeof token_endpoint !== "string" || !token_endpoint || typeof jwks_uri !== "string" || !jwks_uri) {
+            throw new Error("OIDC discovery returned incomplete metadata");
+          }
+          for (const endpoint of [
+            authorization_endpoint,
+            token_endpoint,
+            jwks_uri
+          ]) {
+            await validateEndpoint(endpoint, safety);
+          }
+          return discovered;
+        } catch (error) {
+          throw providerError("OIDC discovery failed", error);
+        }
+      })().catch((error) => {
+        this.configurationPromise = void 0;
+        throw error;
+      });
+    }
+    return this.configurationPromise;
+  }
+  async begin() {
+    try {
+      const client = await this.getClient();
+      const config = await this.getConfiguration(client);
+      const state = client.randomState();
+      const codeVerifier = client.randomPKCECodeVerifier();
+      const codeChallenge = await client.calculatePKCECodeChallenge(codeVerifier);
+      const nonce = client.randomNonce();
+      const url = client.buildAuthorizationUrl(config, {
+        redirect_uri: this.options.config.redirectUri,
+        response_type: "code",
+        scope: this.options.config.scopes,
+        state,
+        nonce,
+        code_challenge: codeChallenge,
+        code_challenge_method: "S256"
+      });
+      const now = this.options.now?.() ?? Date.now();
+      const cookieValue = signStateCookie(
+        {
+          state,
+          codeVerifier,
+          nonce,
+          providerId: this.options.providerId,
+          exp: now + 6e5
+        },
+        this.options.config.stateSecret
+      );
+      return {
+        kind: "redirect",
+        url: url.href,
+        cookies: [
+          stateCookie(cookieValue, { secure: !this.options.config.insecureCookies })
+        ]
+      };
+    } catch (error) {
+      if (error instanceof import_protocols.AuthError) throw error;
+      throw providerError("OIDC authorization request failed", error);
+    }
+  }
+  async callback(ctx) {
+    try {
+      const rawCookie = ctx.cookies?.[OIDC_STATE_COOKIE];
+      if (!rawCookie) {
+        throw new import_protocols.AuthError("INVALID_STATE", 400, "OIDC state cookie is missing");
+      }
+      const now = this.options.now?.() ?? Date.now();
+      const stored = verifyStateCookie(
+        rawCookie,
+        this.options.config.stateSecret,
+        now
+      );
+      if (!stored) {
+        throw new import_protocols.AuthError(
+          "INVALID_STATE",
+          400,
+          "OIDC state cookie is invalid or expired"
+        );
+      }
+      if (stored.providerId !== this.options.providerId) {
+        throw new import_protocols.AuthError(
+          "INVALID_STATE",
+          400,
+          "OIDC state provider does not match"
+        );
+      }
+      if (ctx.params?.state !== stored.state) {
+        throw new import_protocols.AuthError("INVALID_STATE", 400, "OIDC state does not match");
+      }
+      const client = await this.getClient();
+      const config = await this.getConfiguration(client);
+      const currentUrl = new URL(this.options.config.redirectUri);
+      for (const [key, value] of Object.entries(ctx.params ?? {})) {
+        currentUrl.searchParams.set(key, value);
+      }
+      const tokens = await client.authorizationCodeGrant(config, currentUrl, {
+        pkceCodeVerifier: stored.codeVerifier,
+        expectedState: stored.state,
+        expectedNonce: stored.nonce
+      });
+      const claims = tokens.claims();
+      if (!claims) {
+        throw new import_protocols.AuthError("PROVIDER_ERROR", 502, "OIDC ID token is missing");
+      }
+      return principalFromClaims(claims);
+    } catch (error) {
+      if (error instanceof import_protocols.AuthError) throw error;
+      throw providerError("OIDC token exchange failed", error);
+    }
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  OIDC_STATE_COOKIE,
+  OIDC_STATE_PATH,
+  OidcAuthProvider,
+  assertSafeEndpointSyntax,
+  assertSafeOidcEndpoint,
+  assertTenantSpecificAzureIssuer,
+  clearStateCookie,
+  isLinkLocalOrMetadataAddress,
+  loadOpenidClient,
+  oidcDescriptor,
+  parseAllowedPrivateHosts,
+  principalFromClaims,
+  probeOidcProvider,
+  readCookie,
+  readOidcConfig,
+  serializeCookie,
+  signStateCookie,
+  stateCookie,
+  verifyStateCookie
+});
+//# sourceMappingURL=index.js.map