@better-forge/auth 0.0.0-stage → 0.1.1

package/dist/oidc.d.ts

@@ -0,0 +1,85 @@
+import { users } from './tables.js';
+import type { AuthOptions } from './context.js';
+import type { OidcConfig } from './oidcConfig.js';
+import type { SignInAudit } from './signInAudit.js';
+type User = typeof users.$inferSelect;
+export interface OidcFlowState {
+    state: string;
+    nonce: string;
+    codeVerifier: string;
+}
+/** An SSO confirmation must come from a sign-in at the provider no older than this (the ID token's auth_time). */
+export declare const OIDC_CONFIRMATION_MAX_AGE_SECONDS: number;
+/** Why an SSO sign-in was refused. The user only sees a generic message; the audit log gets the code and detail. */
+export type OidcDenialCode = 'discovery_failed' | 'flow_expired' | 'idp_error' | 'token_exchange_failed' | 'no_email_claim' | 'email_not_verified' | 'no_matching_account' | 'subject_mismatch' | 'confirmation_mismatch';
+export interface OidcDenial {
+    code: OidcDenialCode;
+    reason: string;
+    email?: string;
+}
+/** An account an SSO sign-in may create, bound to this identity. The application decides who qualifies and the role (see `resolveUnknownSsoUser`). */
+export interface SsoProvisioning {
+    email: string;
+    subject: string;
+    role: string;
+}
+/**
+ * The outcome for a set of validated ID token claims. `link` means the user was matched by email and the
+ * identity (issuer + subject) should now be bound to them, so later sign-ins no longer depend on the email.
+ * A denial for an unknown email carries `provision` when a sign-in may create an account instead.
+ */
+export type OidcDecision = {
+    user: User;
+    link: boolean;
+    subject: string;
+    denial?: undefined;
+    provision?: undefined;
+} | {
+    user: null;
+    denial: OidcDenial;
+    provision?: SsoProvisioning | undefined;
+};
+/**
+ * Whether the email claim may be trusted. `email_verified` is the standard claim; Microsoft Entra ID never
+ * sends it but offers the optional `xms_edov` claim (email domain owner verified) instead. An explicit
+ * `false` from either claim is never overridden by `allowUnverifiedEmail`.
+ */
+export declare function checkEmailVerified(claims: Record<string, unknown>, allowUnverifiedEmail: boolean): string | null;
+export interface OidcTestResult {
+    issuer: string;
+    testedAt: number;
+    claims: Record<string, unknown> | null;
+    /** `provision`: the sign-in would create an account. */
+    outcome: 'sign_in' | 'link' | 'provision' | 'deny';
+    user: string | null;
+    denial: OidcDenial | null;
+}
+export declare function createOidc(ctx: AuthOptions, signInAudit: SignInAudit): {
+    beginOidcLogin: (cfg: OidcConfig, options?: {
+        confirm?: boolean;
+    }) => Promise<{
+        url: string;
+        flow: OidcFlowState;
+    }>;
+    exchangeOidcCode: (cfg: OidcConfig, callbackUrl: URL, flow: OidcFlowState, maxAge?: number) => Promise<{
+        claims: Record<string, unknown>;
+        denial?: undefined;
+    } | {
+        claims?: undefined;
+        denial: OidcDenial;
+    }>;
+    evaluateOidcClaims: (cfg: OidcConfig, claims: Record<string, unknown>) => Promise<OidcDecision>;
+    linkOidcIdentity: (cfg: OidcConfig, user: User, subject: string) => Promise<void>;
+    provisionSsoUser: (cfg: OidcConfig, provision: SsoProvisioning) => Promise<User>;
+    auditOidcDenial: (cfg: OidcConfig, denial: OidcDenial) => Promise<void>;
+    testOidcDiscovery: (cfg: OidcConfig) => Promise<{
+        issuer: string;
+        authorizationEndpoint: string | null;
+    }>;
+    storeOidcTestResult: (adminUserId: number, result: OidcTestResult) => string;
+    readOidcTestResult: (id: string, adminUserId: number) => OidcTestResult | null;
+    runOidcTest: (cfg: OidcConfig, callbackUrl: URL, flow: OidcFlowState) => Promise<OidcTestResult>;
+};
+export type Oidc = ReturnType<typeof createOidc>;
+export {};
+//# sourceMappingURL=oidc.d.ts.map

package/dist/oidc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AACnC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAEnD,KAAK,IAAI,GAAG,OAAO,KAAK,CAAC,YAAY,CAAA;AAErC,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,kHAAkH;AAClH,eAAO,MAAM,iCAAiC,QAAS,CAAA;AAEvD,oHAAoH;AACpH,MAAM,MAAM,cAAc,GACtB,kBAAkB,GAClB,cAAc,GACd,WAAW,GACX,uBAAuB,GACvB,gBAAgB,GAChB,oBAAoB,GACpB,qBAAqB,GACrB,kBAAkB,GAClB,uBAAuB,CAAA;AAE3B,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,cAAc,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,sJAAsJ;AACtJ,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GACzF;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,UAAU,CAAC;IAAC,SAAS,CAAC,EAAE,eAAe,GAAG,SAAS,CAAA;CAAE,CAAA;AAO/E;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAShH;AAKD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IACtC,wDAAwD;IACxD,OAAO,EAAE,SAAS,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAA;IAClD,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,MAAM,EAAE,UAAU,GAAG,IAAI,CAAA;CAC1B;AAID,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW;0BA4BhC,UAAU,YAAW;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,KAAQ,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,aAAa,CAAA;KAAE,CAAC;4BAwB3H,UAAU,eAAe,GAAG,QAAQ,aAAa,WAAW,MAAM,KACtE,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,SAAS,CAAA;KAAE,GAAG;QAAE,MAAM,CAAC,EAAE,SAAS,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC;8BAqBzE,UAAU,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC;4BA0CrE,UAAU,QAAQ,IAAI,WAAW,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;4BAavD,UAAU,aAAa,eAAe,KAAG,OAAO,CAAC,IAAI,CAAC;2BAmBvD,UAAU,UAAU,UAAU,KAAG,OAAO,CAAC,IAAI,CAAC;6BAc5C,UAAU,KAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;uCAQ1E,MAAM,UAAU,cAAc,KAAG,MAAM;6BASjD,MAAM,eAAe,MAAM,KAAG,cAAc,GAAG,IAAI;uBAMnD,UAAU,eAAe,GAAG,QAAQ,aAAa,KAAG,OAAO,CAAC,cAAc,CAAC;EAY5G;AAED,MAAM,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAA"}

package/dist/oidc.js

@@ -0,0 +1,213 @@
+import { randomBytes, randomUUID } from 'node:crypto';
+import bcrypt from 'bcryptjs';
+import * as client from 'openid-client';
+import { and, eq, sql } from 'drizzle-orm';
+import { users } from './tables.js';
+import { ADMIN_ROLE } from './roles.js';
+/** An SSO confirmation must come from a sign-in at the provider no older than this (the ID token's auth_time). */
+export const OIDC_CONFIRMATION_MAX_AGE_SECONDS = 5 * 60;
+// Some providers send booleans as strings ("true").
+const isTrue = (value) => value === true || value === 'true';
+const isFalse = (value) => value === false || value === 'false';
+/**
+ * Whether the email claim may be trusted. `email_verified` is the standard claim; Microsoft Entra ID never
+ * sends it but offers the optional `xms_edov` claim (email domain owner verified) instead. An explicit
+ * `false` from either claim is never overridden by `allowUnverifiedEmail`.
+ */
+export function checkEmailVerified(claims, allowUnverifiedEmail) {
+    const standard = claims['email_verified'];
+    const entra = claims['xms_edov'];
+    if (isTrue(standard) || isTrue(entra))
+        return null;
+    if (isFalse(standard))
+        return 'The identity provider reports the email as unverified (email_verified is false).';
+    if (isFalse(entra))
+        return 'Microsoft Entra ID reports that the email domain is not verified (xms_edov is false).';
+    if (allowUnverifiedEmail && standard === undefined && entra === undefined)
+        return null;
+    return 'The ID token has neither an email_verified nor an xms_edov claim. For Microsoft Entra ID, add the xms_edov optional claim to the ID token. '
+        + 'For other providers, enable "Accept identity providers that omit email_verified" only if their email claim is trustworthy.';
+}
+const TEST_RESULT_TTL_MS = 10 * 60 * 1000;
+export function createOidc(ctx, signInAudit) {
+    const { db, audit } = ctx;
+    const hooks = ctx.hooks ?? {};
+    const { auditSignInDenial } = signInAudit;
+    let cached = null;
+    function runDiscovery(cfg) {
+        const issuer = new URL(cfg.issuer);
+        // The client library refuses plain http; allow it only for issuers configured that way (e.g. a local Keycloak).
+        const options = issuer.protocol === 'http:' ? { execute: [client.allowInsecureRequests] } : undefined;
+        return client.discovery(issuer, cfg.clientId, cfg.clientSecret || undefined, undefined, options);
+    }
+    function discover(cfg) {
+        const key = `${cfg.issuer}|${cfg.clientId}|${cfg.clientSecret}`;
+        if (cached?.key !== key) {
+            const config = runDiscovery(cfg);
+            config.catch(() => { if (cached?.key === key)
+                cached = null; });
+            cached = { key, config };
+        }
+        return cached.config;
+    }
+    /**
+     * Builds the provider redirect. `confirm` asks the provider to authenticate the user again (`prompt=login`)
+     * and to report when it did (`max_age`), so the callback can require a fresh `auth_time`.
+     */
+    async function beginOidcLogin(cfg, options = {}) {
+        const config = await discover(cfg);
+        const flow = {
+            state: client.randomState(),
+            nonce: client.randomNonce(),
+            codeVerifier: client.randomPKCECodeVerifier(),
+        };
+        const url = client.buildAuthorizationUrl(config, {
+            redirect_uri: cfg.redirectUri,
+            scope: cfg.scopes,
+            state: flow.state,
+            nonce: flow.nonce,
+            code_challenge: await client.calculatePKCECodeChallenge(flow.codeVerifier),
+            code_challenge_method: 'S256',
+            ...(options.confirm ? { prompt: 'login', max_age: String(OIDC_CONFIRMATION_MAX_AGE_SECONDS) } : {}),
+        });
+        return { url: url.href, flow };
+    }
+    /**
+     * Completes the code exchange and returns the validated ID token claims, or why that failed. With `maxAge`
+     * the ID token must carry an `auth_time` no older than that many seconds.
+     */
+    async function exchangeOidcCode(cfg, callbackUrl, flow, maxAge) {
+        const config = await discover(cfg);
+        try {
+            const tokens = await client.authorizationCodeGrant(config, callbackUrl, {
+                pkceCodeVerifier: flow.codeVerifier,
+                expectedState: flow.state,
+                expectedNonce: flow.nonce,
+                idTokenExpected: true,
+                ...(maxAge !== undefined ? { maxAge } : {}),
+            });
+            return { claims: tokens.claims() ?? {} };
+        }
+        catch (error) {
+            return { denial: describeExchangeError(error) };
+        }
+    }
+    /**
+     * Finds the local user for validated claims without changing anything. An identity already bound to a
+     * user wins; otherwise the verified email is matched, but never onto a user bound to another identity at
+     * the same provider, so an email address given to someone else cannot take over the account.
+     */
+    async function evaluateOidcClaims(cfg, claims) {
+        const subject = typeof claims['sub'] === 'string' ? claims['sub'] : '';
+        if (subject) {
+            const bound = (await db.select().from(users)
+                .where(and(eq(users.oidcIssuer, cfg.issuer), eq(users.oidcSubject, subject))))[0];
+            if (bound)
+                return { user: bound, link: false, subject };
+        }
+        const email = typeof claims['email'] === 'string' ? claims['email'].trim().toLowerCase() : '';
+        if (!email) {
+            return {
+                user: null,
+                denial: {
+                    code: 'no_email_claim',
+                    reason: `The ID token has no email claim. Request the "email" scope and, for Microsoft Entra ID, add the email optional claim. Claims received: ${Object.keys(claims).join(', ') || 'none'}.`,
+                },
+            };
+        }
+        const unverified = checkEmailVerified(claims, cfg.allowUnverifiedEmail);
+        if (unverified)
+            return { user: null, denial: { code: 'email_not_verified', reason: unverified, email } };
+        const user = (await db.select().from(users).where(sql `lower(${users.email}) = ${email}`))[0];
+        if (!user) {
+            const resolved = subject ? await hooks.resolveUnknownSsoUser?.({ email, subject, issuer: cfg.issuer }) : null;
+            // A role the application did not register, or admin, is never handed out by a sign-in: no account is created.
+            const provision = subject && resolved && ctx.roles.isValid(resolved.role) && resolved.role !== ADMIN_ROLE ? { email, subject, role: resolved.role } : undefined;
+            return { user: null, denial: { code: 'no_matching_account', reason: `No user has the email ${email}. Create the user first.`, email }, provision };
+        }
+        if (user.oidcSubject && user.oidcIssuer === cfg.issuer) {
+            return {
+                user: null,
+                denial: {
+                    code: 'subject_mismatch',
+                    reason: `${user.email} is linked to another identity at this provider (subject ${user.oidcSubject}; this sign-in: ${subject || 'none'}). `
+                        + 'The email address may have been given to someone else.',
+                    email,
+                },
+            };
+        }
+        return { user, link: true, subject };
+    }
+    /** Binds the provider identity to the user and records it; a binding to a previous issuer is replaced. */
+    async function linkOidcIdentity(cfg, user, subject) {
+        await db.update(users).set({ oidcIssuer: cfg.issuer, oidcSubject: subject }).where(eq(users.id, user.id));
+        await audit.write({ userId: user.id, userEmail: user.email }, 'update', 'user-security', user.id, user.email, { ssoLinked: { from: user.oidcIssuer, to: cfg.issuer }, subject });
+    }
+    /**
+     * Creates the account of a first SSO sign-in, already bound to the identity.
+     * Its password is random and never handed out: the account signs in through SSO only.
+     */
+    async function provisionSsoUser(cfg, provision) {
+        const passwordHash = await bcrypt.hash(randomBytes(32).toString('base64url'), 10);
+        const [user] = await db.insert(users).values({
+            email: provision.email,
+            passwordHash,
+            role: provision.role,
+            createdAt: Date.now(),
+            oidcIssuer: cfg.issuer,
+            oidcSubject: provision.subject,
+        }).returning();
+        await audit.write({ userId: user.id, userEmail: user.email }, 'create', 'user', user.id, user.email, { email: user.email, role: provision.role, createdBy: 'sso', issuer: cfg.issuer });
+        return user;
+    }
+    /** Records a refused SSO sign-in or confirmation as a 'sign_in' denial, with the issuer. */
+    async function auditOidcDenial(cfg, denial) {
+        await auditSignInDenial('sso', denial, { issuer: cfg.issuer });
+    }
+    function describeExchangeError(error) {
+        if (error instanceof client.AuthorizationResponseError) {
+            const description = error.error_description ? `: ${error.error_description}` : '';
+            return { code: 'idp_error', reason: `The identity provider returned ${error.error}${description}`.slice(0, 1000) };
+        }
+        const message = error instanceof Error ? error.message : String(error);
+        return { code: 'token_exchange_failed', reason: `Code exchange or ID token validation failed: ${message}`.slice(0, 1000) };
+    }
+    /** Runs OIDC discovery against the issuer without caching, to validate settings before saving them. */
+    async function testOidcDiscovery(cfg) {
+        const config = await runDiscovery(cfg);
+        const meta = config.serverMetadata();
+        return { issuer: meta.issuer, authorizationEndpoint: meta.authorization_endpoint ?? null };
+    }
+    const testResults = new Map();
+    function storeOidcTestResult(adminUserId, result) {
+        const now = Date.now();
+        for (const [id, entry] of testResults)
+            if (entry.expiresAt <= now)
+                testResults.delete(id);
+        const id = randomUUID();
+        testResults.set(id, { adminUserId, expiresAt: now + TEST_RESULT_TTL_MS, result });
+        return id;
+    }
+    /** Only the administrator who started the test can read its result. */
+    function readOidcTestResult(id, adminUserId) {
+        const entry = testResults.get(id);
+        if (!entry || entry.expiresAt <= Date.now() || entry.adminUserId !== adminUserId)
+            return null;
+        return entry.result;
+    }
+    async function runOidcTest(cfg, callbackUrl, flow) {
+        const base = { issuer: cfg.issuer, testedAt: Date.now() };
+        const exchanged = await exchangeOidcCode(cfg, callbackUrl, flow)
+            .catch((error) => ({ claims: undefined, denial: describeExchangeError(error) }));
+        if (exchanged.denial)
+            return { ...base, claims: null, outcome: 'deny', user: null, denial: exchanged.denial };
+        const decision = await evaluateOidcClaims(cfg, exchanged.claims);
+        if (decision.provision)
+            return { ...base, claims: exchanged.claims, outcome: 'provision', user: decision.provision.email, denial: null };
+        if (decision.denial)
+            return { ...base, claims: exchanged.claims, outcome: 'deny', user: null, denial: decision.denial };
+        return { ...base, claims: exchanged.claims, outcome: decision.link ? 'link' : 'sign_in', user: decision.user.email, denial: null };
+    }
+    return { beginOidcLogin, exchangeOidcCode, evaluateOidcClaims, linkOidcIdentity, provisionSsoUser, auditOidcDenial, testOidcDiscovery, storeOidcTestResult, readOidcTestResult, runOidcTest };
+}
+//# sourceMappingURL=oidc.js.map

package/dist/oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,MAAM,MAAM,UAAU,CAAA;AAC7B,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAEnC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAYvC,kHAAkH;AAClH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,GAAG,EAAE,CAAA;AAoCvD,oDAAoD;AACpD,MAAM,MAAM,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,MAAM,CAAA;AAErE,MAAM,OAAO,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,OAAO,CAAA;AAExE;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAA+B,EAAE,oBAA6B;IAC/F,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAA;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,CAAA;IAChC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAClD,IAAI,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,kFAAkF,CAAA;IAChH,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,uFAAuF,CAAA;IAClH,IAAI,oBAAoB,IAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACtF,OAAO,6IAA6I;UAChJ,4HAA4H,CAAA;AAClI,CAAC;AAeD,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEzC,MAAM,UAAU,UAAU,CAAC,GAAgB,EAAE,WAAwB;IACnE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,GAAG,CAAA;IACzB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE,CAAA;IAC7B,MAAM,EAAE,iBAAiB,EAAE,GAAG,WAAW,CAAA;IAEzC,IAAI,MAAM,GAAkE,IAAI,CAAA;IAEhF,SAAS,YAAY,CAAC,GAAe;QACnC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAClC,gHAAgH;QAChH,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;QACrG,OAAO,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,YAAY,IAAI,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;IAClG,CAAC;IAED,SAAS,QAAQ,CAAC,GAAe;QAC/B,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,YAAY,EAAE,CAAA;QAC/D,IAAI,MAAM,EAAE,GAAG,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;YAChC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,MAAM,EAAE,GAAG,KAAK,GAAG;gBAAE,MAAM,GAAG,IAAI,CAAA,CAAC,CAAC,CAAC,CAAA;YAC9D,MAAM,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;QAC1B,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAA;IACtB,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,cAAc,CAAC,GAAe,EAAE,UAAiC,EAAE;QAChF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAA;QAClC,MAAM,IAAI,GAAkB;YAC1B,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE;YAC3B,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE;YAC3B,YAAY,EAAE,MAAM,CAAC,sBAAsB,EAAE;SAC9C,CAAA;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,qBAAqB,CAAC,MAAM,EAAE;YAC/C,YAAY,EAAE,GAAG,CAAC,WAAW;YAC7B,KAAK,EAAE,GAAG,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,cAAc,EAAE,MAAM,MAAM,CAAC,0BAA0B,CAAC,IAAI,CAAC,YAAY,CAAC;YAC1E,qBAAqB,EAAE,MAAM;YAC7B,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpG,CAAC,CAAA;QACF,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,CAAA;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,gBAAgB,CAC7B,GAAe,EAAE,WAAgB,EAAE,IAAmB,EAAE,MAAe;QAEvE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,MAAM,EAAE,WAAW,EAAE;gBACtE,gBAAgB,EAAE,IAAI,CAAC,YAAY;gBACnC,aAAa,EAAE,IAAI,CAAC,KAAK;gBACzB,aAAa,EAAE,IAAI,CAAC,KAAK;gBACzB,eAAe,EAAE,IAAI;gBACrB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5C,CAAC,CAAA;YACF,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAA;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,MAAM,EAAE,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAA;QACjD,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,kBAAkB,CAAC,GAAe,EAAE,MAA+B;QAChF,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QACtE,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;iBACzC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACnF,IAAI,KAAK;gBAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;QACzD,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QAC7F,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;gBACL,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE;oBACN,IAAI,EAAE,gBAAgB;oBACtB,MAAM,EAAE,0IAA0I,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG;iBAC9L;aACF,CAAA;QACH,CAAC;QACD,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,oBAAoB,CAAC,CAAA;QACvE,IAAI,UAAU;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CAAA;QACxG,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAA,SAAS,KAAK,CAAC,KAAK,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5F,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,qBAAqB,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YAC7G,8GAA8G;YAC9G,MAAM,SAAS,GAAG,OAAO,IAAI,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;YAC/J,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,yBAAyB,KAAK,0BAA0B,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,CAAA;QACpJ,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,UAAU,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YACvD,OAAO;gBACL,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE;oBACN,IAAI,EAAE,kBAAkB;oBACxB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,4DAA4D,IAAI,CAAC,WAAW,mBAAmB,OAAO,IAAI,MAAM,KAAK;0BACtI,wDAAwD;oBAC5D,KAAK;iBACN;aACF,CAAA;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IACtC,CAAC;IAED,0GAA0G;IAC1G,KAAK,UAAU,gBAAgB,CAAC,GAAe,EAAE,IAAU,EAAE,OAAe;QAC1E,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;QACzG,MAAM,KAAK,CAAC,KAAK,CACf,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,EAC1C,QAAQ,EAAE,eAAe,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,EAC9C,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAClE,CAAA;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,gBAAgB,CAAC,GAAe,EAAE,SAA0B;QACzE,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,CAAA;QACjF,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;YAC3C,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,YAAY;YACZ,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,UAAU,EAAE,GAAG,CAAC,MAAM;YACtB,WAAW,EAAE,SAAS,CAAC,OAAO;SAC/B,CAAC,CAAC,SAAS,EAAE,CAAA;QACd,MAAM,KAAK,CAAC,KAAK,CACf,EAAE,MAAM,EAAE,IAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAK,CAAC,KAAK,EAAE,EAC5C,QAAQ,EAAE,MAAM,EAAE,IAAK,CAAC,EAAE,EAAE,IAAK,CAAC,KAAK,EACvC,EAAE,KAAK,EAAE,IAAK,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CACnF,CAAA;QACD,OAAO,IAAK,CAAA;IACd,CAAC;IAED,4FAA4F;IAC5F,KAAK,UAAU,eAAe,CAAC,GAAe,EAAE,MAAkB;QAChE,MAAM,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,SAAS,qBAAqB,CAAC,KAAc;QAC3C,IAAI,KAAK,YAAY,MAAM,CAAC,0BAA0B,EAAE,CAAC;YACvD,MAAM,WAAW,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;YACjF,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,kCAAkC,KAAK,CAAC,KAAK,GAAG,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAA;QACpH,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACtE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,gDAAgD,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAA;IAC5H,CAAC;IAED,uGAAuG;IACvG,KAAK,UAAU,iBAAiB,CAAC,GAAe;QAC9C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACtC,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,EAAE,CAAA;QACpC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,qBAAqB,EAAE,IAAI,CAAC,sBAAsB,IAAI,IAAI,EAAE,CAAA;IAC5F,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,EAA8E,CAAA;IAEzG,SAAS,mBAAmB,CAAC,WAAmB,EAAE,MAAsB;QACtE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,WAAW;YAAE,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;gBAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACzF,MAAM,EAAE,GAAG,UAAU,EAAE,CAAA;QACvB,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,GAAG,kBAAkB,EAAE,MAAM,EAAE,CAAC,CAAA;QACjF,OAAO,EAAE,CAAA;IACX,CAAC;IAED,uEAAuE;IACvE,SAAS,kBAAkB,CAAC,EAAU,EAAE,WAAmB;QACzD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACjC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW;YAAE,OAAO,IAAI,CAAA;QAC7F,OAAO,KAAK,CAAC,MAAM,CAAA;IACrB,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,GAAe,EAAE,WAAgB,EAAE,IAAmB;QAC/E,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAA;QACzD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC;aAC7D,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;QAC3F,IAAI,SAAS,CAAC,MAAM;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAA;QAC7G,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAA;QAChE,IAAI,QAAQ,CAAC,SAAS;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;QACxI,IAAI,QAAQ,CAAC,MAAM;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAA;QACvH,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IACpI,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,CAAA;AAC/L,CAAC"}

package/dist/oidcConfig.d.ts

@@ -0,0 +1,39 @@
+export declare const DEFAULT_OIDC_SCOPES = "openid email profile";
+export declare const DEFAULT_OIDC_BUTTON_LABEL = "Sign in with SSO";
+export interface OidcConfig {
+    issuer: string;
+    clientId: string;
+    clientSecret: string;
+    scopes: string;
+    redirectUri: string;
+    buttonLabel: string;
+    allowUnverifiedEmail: boolean;
+    disablePasswordLogin: boolean;
+}
+/** Raw, unvalidated OIDC settings from either source (environment or the database). */
+export interface OidcSettingsInput {
+    issuer?: string | undefined;
+    clientId?: string | undefined;
+    clientSecret?: string | undefined;
+    scopes?: string | undefined;
+    redirectUri?: string | undefined;
+    buttonLabel?: string | undefined;
+    allowUnverifiedEmail?: boolean | undefined;
+    disablePasswordLogin?: boolean | undefined;
+}
+export declare function isHttpUrl(value: string): boolean;
+/**
+ * Settings validation and the environment variables, for an application whose public address is `publicUrl(env)` and
+ * whose provider redirects back to `callbackPath`.
+ */
+export declare function createOidcConfigResolver(options: {
+    publicUrl: (env: NodeJS.ProcessEnv) => string;
+    callbackPath: string;
+}): {
+    defaultOidcRedirectUri: (env?: NodeJS.ProcessEnv) => string;
+    buildOidcConfig: (input: OidcSettingsInput, env?: NodeJS.ProcessEnv) => OidcConfig | null;
+    resolveOidcConfigFromEnv: (env?: NodeJS.ProcessEnv) => OidcConfig | null;
+};
+/** Password sign-in can only be turned off while OIDC is usable, so nobody is locked out by a typo. */
+export declare function passwordLoginEnabled(config: OidcConfig | null): boolean;
+//# sourceMappingURL=oidcConfig.d.ts.map

package/dist/oidcConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidcConfig.d.ts","sourceRoot":"","sources":["../src/oidcConfig.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,mBAAmB,yBAAyB,CAAA;AACzD,eAAO,MAAM,yBAAyB,qBAAqB,CAAA;AAE3D,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,oBAAoB,EAAE,OAAO,CAAA;IAC7B,oBAAoB,EAAE,OAAO,CAAA;CAC9B;AAED,uFAAuF;AACvF,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7B,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,oBAAoB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IAC1C,oBAAoB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;CAC3C;AAMD,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAOhD;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IAAE,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE;mCAElF,MAAM,CAAC,UAAU,KAAiB,MAAM;6BAM7C,iBAAiB,QAAO,MAAM,CAAC,UAAU,KAAiB,UAAU,GAAG,IAAI;qCAsBpE,MAAM,CAAC,UAAU,KAAiB,UAAU,GAAG,IAAI;EAiB3F;AAED,uGAAuG;AACvG,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAEvE"}

package/dist/oidcConfig.js

@@ -0,0 +1,72 @@
+export const DEFAULT_OIDC_SCOPES = 'openid email profile';
+export const DEFAULT_OIDC_BUTTON_LABEL = 'Sign in with SSO';
+function flag(value) {
+    return ['1', 'true', 'yes'].includes((value ?? '').trim().toLowerCase());
+}
+export function isHttpUrl(value) {
+    try {
+        const url = new URL(value);
+        return url.protocol === 'https:' || url.protocol === 'http:';
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Settings validation and the environment variables, for an application whose public address is `publicUrl(env)` and
+ * whose provider redirects back to `callbackPath`.
+ */
+export function createOidcConfigResolver(options) {
+    /** Callback URL derived from the public URL, or '' when that is not set. */
+    function defaultOidcRedirectUri(env = process.env) {
+        const publicUrl = options.publicUrl(env);
+        return publicUrl ? `${publicUrl}${options.callbackPath}` : '';
+    }
+    /** Validates raw settings and fills defaults. Returns null when they do not describe a usable setup. */
+    function buildOidcConfig(input, env = process.env) {
+        const issuer = (input.issuer ?? '').trim();
+        const clientId = (input.clientId ?? '').trim();
+        if (!issuer || !clientId || !isHttpUrl(issuer))
+            return null;
+        const redirectUri = (input.redirectUri ?? '').trim() || defaultOidcRedirectUri(env);
+        if (!redirectUri || !isHttpUrl(redirectUri))
+            return null;
+        return {
+            issuer,
+            clientId,
+            clientSecret: (input.clientSecret ?? '').trim(),
+            scopes: (input.scopes ?? '').trim() || DEFAULT_OIDC_SCOPES,
+            redirectUri,
+            buttonLabel: (input.buttonLabel ?? '').trim() || DEFAULT_OIDC_BUTTON_LABEL,
+            allowUnverifiedEmail: input.allowUnverifiedEmail === true,
+            disablePasswordLogin: input.disablePasswordLogin === true,
+        };
+    }
+    /**
+     * OIDC settings from environment variables, which override anything saved in the admin UI
+     * (for IaC deployments). Returns null when OIDC_ISSUER / OIDC_CLIENT_ID are not both set.
+     */
+    function resolveOidcConfigFromEnv(env = process.env) {
+        if (!(env['OIDC_ISSUER'] ?? '').trim() || !(env['OIDC_CLIENT_ID'] ?? '').trim())
+            return null;
+        const config = buildOidcConfig({
+            issuer: env['OIDC_ISSUER'],
+            clientId: env['OIDC_CLIENT_ID'],
+            clientSecret: env['OIDC_CLIENT_SECRET'],
+            scopes: env['OIDC_SCOPES'],
+            redirectUri: env['OIDC_REDIRECT_URI'],
+            buttonLabel: env['OIDC_BUTTON_LABEL'],
+            allowUnverifiedEmail: flag(env['OIDC_ALLOW_UNVERIFIED_EMAIL']),
+            disablePasswordLogin: flag(env['OIDC_DISABLE_PASSWORD_LOGIN']),
+        }, env);
+        if (!config)
+            console.warn('OIDC_* environment variables are set but incomplete or invalid (issuer, client id and a redirect URI or PUBLIC_URL are required) — OIDC sign-in is disabled');
+        return config;
+    }
+    return { defaultOidcRedirectUri, buildOidcConfig, resolveOidcConfigFromEnv };
+}
+/** Password sign-in can only be turned off while OIDC is usable, so nobody is locked out by a typo. */
+export function passwordLoginEnabled(config) {
+    return !(config && config.disablePasswordLogin);
+}
+//# sourceMappingURL=oidcConfig.js.map

package/dist/oidcConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidcConfig.js","sourceRoot":"","sources":["../src/oidcConfig.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAA;AACzD,MAAM,CAAC,MAAM,yBAAyB,GAAG,kBAAkB,CAAA;AAyB3D,SAAS,IAAI,CAAC,KAAyB;IACrC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;AAC1E,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QAC1B,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAA;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAgF;IACvH,4EAA4E;IAC5E,SAAS,sBAAsB,CAAC,MAAyB,OAAO,CAAC,GAAG;QAClE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QACxC,OAAO,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC/D,CAAC;IAED,wGAAwG;IACxG,SAAS,eAAe,CAAC,KAAwB,EAAE,MAAyB,OAAO,CAAC,GAAG;QACrF,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QAC1C,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QAC9C,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAA;QAC3D,MAAM,WAAW,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,sBAAsB,CAAC,GAAG,CAAC,CAAA;QACnF,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAA;QACxD,OAAO;YACL,MAAM;YACN,QAAQ;YACR,YAAY,EAAE,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YAC/C,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,mBAAmB;YAC1D,WAAW;YACX,WAAW,EAAE,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,yBAAyB;YAC1E,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,KAAK,IAAI;YACzD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,KAAK,IAAI;SAC1D,CAAA;IACH,CAAC;IAED;;;OAGG;IACH,SAAS,wBAAwB,CAAC,MAAyB,OAAO,CAAC,GAAG;QACpE,IAAI,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAA;QAC5F,MAAM,MAAM,GAAG,eAAe,CAAC;YAC7B,MAAM,EAAE,GAAG,CAAC,aAAa,CAAC;YAC1B,QAAQ,EAAE,GAAG,CAAC,gBAAgB,CAAC;YAC/B,YAAY,EAAE,GAAG,CAAC,oBAAoB,CAAC;YACvC,MAAM,EAAE,GAAG,CAAC,aAAa,CAAC;YAC1B,WAAW,EAAE,GAAG,CAAC,mBAAmB,CAAC;YACrC,WAAW,EAAE,GAAG,CAAC,mBAAmB,CAAC;YACrC,oBAAoB,EAAE,IAAI,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;YAC9D,oBAAoB,EAAE,IAAI,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;SAC/D,EAAE,GAAG,CAAC,CAAA;QACP,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,6JAA6J,CAAC,CAAA;QACxL,OAAO,MAAM,CAAA;IACf,CAAC;IAED,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,wBAAwB,EAAE,CAAA;AAC9E,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,oBAAoB,CAAC,MAAyB;IAC5D,OAAO,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,oBAAoB,CAAC,CAAA;AACjD,CAAC"}

package/dist/oidcSettings.d.ts

@@ -0,0 +1,15 @@
+import { oidcSettings } from './tables.js';
+import type { AuthOptions } from './context.js';
+import type { OidcConfig, createOidcConfigResolver } from './oidcConfig.js';
+export type OidcSettingsRow = typeof oidcSettings.$inferSelect;
+export declare function createOidcSettings(ctx: AuthOptions, resolver: ReturnType<typeof createOidcConfigResolver>): {
+    getOidcSettingsRow: () => Promise<OidcSettingsRow | null>;
+    oidcConfigFromRow: (row: OidcSettingsRow) => OidcConfig | null;
+    getOidcConfig: () => Promise<{
+        config: OidcConfig | null;
+        source: "env" | "database" | "none";
+    }>;
+    getOidcTestConfig: () => Promise<OidcConfig | null>;
+};
+export type OidcSettings = ReturnType<typeof createOidcSettings>;
+//# sourceMappingURL=oidcSettings.d.ts.map

package/dist/oidcSettings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidcSettings.d.ts","sourceRoot":"","sources":["../src/oidcSettings.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAE3E,MAAM,MAAM,eAAe,GAAG,OAAO,YAAY,CAAC,YAAY,CAAA;AAE9D,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,CAAC,OAAO,wBAAwB,CAAC;8BAInE,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;6BAIpC,eAAe,KAAG,UAAU,GAAG,IAAI;yBAwBnC,OAAO,CAAC;QAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,KAAK,GAAG,UAAU,GAAG,MAAM,CAAA;KAAE,CAAC;6BAUvE,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;EAQ/D;AAED,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAA"}

package/dist/oidcSettings.js

@@ -0,0 +1,51 @@
+import { eq } from 'drizzle-orm';
+import { oidcSettings } from './tables.js';
+export function createOidcSettings(ctx, resolver) {
+    const { db, secretBox } = ctx;
+    const { buildOidcConfig, resolveOidcConfigFromEnv } = resolver;
+    async function getOidcSettingsRow() {
+        return (await db.select().from(oidcSettings).where(eq(oidcSettings.id, 1)))[0] ?? null;
+    }
+    function oidcConfigFromRow(row) {
+        return buildOidcConfig({
+            issuer: row.issuer,
+            clientId: row.clientId,
+            clientSecret: row.clientSecret ? secretBox.decrypt(row.clientSecret) : '',
+            scopes: row.scopes,
+            redirectUri: row.redirectUri,
+            buttonLabel: row.buttonLabel,
+            allowUnverifiedEmail: !!row.allowUnverifiedEmail,
+            disablePasswordLogin: !!row.disablePasswordLogin,
+        });
+    }
+    /** OIDC_FORCE_PASSWORD_LOGIN=true is the break-glass switch when the IdP is down and password sign-in was disabled. */
+    function withPasswordOverride(config) {
+        return ['1', 'true', 'yes'].includes((process.env['OIDC_FORCE_PASSWORD_LOGIN'] ?? '').trim().toLowerCase())
+            ? { ...config, disablePasswordLogin: false }
+            : config;
+    }
+    /**
+     * The OIDC configuration in effect: environment variables win (deployment-managed), otherwise the
+     * settings saved in the admin UI when enabled. Read per request, so saving takes effect without a restart.
+     */
+    async function getOidcConfig() {
+        const fromEnv = resolveOidcConfigFromEnv();
+        if (fromEnv)
+            return { config: withPasswordOverride(fromEnv), source: 'env' };
+        const row = await getOidcSettingsRow();
+        if (!row?.enabled)
+            return { config: null, source: 'none' };
+        const config = oidcConfigFromRow(row);
+        return { config: config && withPasswordOverride(config), source: config ? 'database' : 'none' };
+    }
+    /** Settings a test sign-in runs against: the environment, or the saved settings even while SSO is switched off. */
+    async function getOidcTestConfig() {
+        const fromEnv = resolveOidcConfigFromEnv();
+        if (fromEnv)
+            return fromEnv;
+        const row = await getOidcSettingsRow();
+        return row ? oidcConfigFromRow(row) : null;
+    }
+    return { getOidcSettingsRow, oidcConfigFromRow, getOidcConfig, getOidcTestConfig };
+}
+//# sourceMappingURL=oidcSettings.js.map

package/dist/oidcSettings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidcSettings.js","sourceRoot":"","sources":["../src/oidcSettings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAM1C,MAAM,UAAU,kBAAkB,CAAC,GAAgB,EAAE,QAAqD;IACxG,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,GAAG,CAAA;IAC7B,MAAM,EAAE,eAAe,EAAE,wBAAwB,EAAE,GAAG,QAAQ,CAAA;IAE9D,KAAK,UAAU,kBAAkB;QAC/B,OAAO,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;IACxF,CAAC;IAED,SAAS,iBAAiB,CAAC,GAAoB;QAC7C,OAAO,eAAe,CAAC;YACrB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE;YACzE,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,oBAAoB,EAAE,CAAC,CAAC,GAAG,CAAC,oBAAoB;YAChD,oBAAoB,EAAE,CAAC,CAAC,GAAG,CAAC,oBAAoB;SACjD,CAAC,CAAA;IACJ,CAAC;IAED,uHAAuH;IACvH,SAAS,oBAAoB,CAAC,MAAkB;QAC9C,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACzG,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE;YAC5C,CAAC,CAAC,MAAM,CAAA;IACZ,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,aAAa;QAC1B,MAAM,OAAO,GAAG,wBAAwB,EAAE,CAAA;QAC1C,IAAI,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;QAC5E,MAAM,GAAG,GAAG,MAAM,kBAAkB,EAAE,CAAA;QACtC,IAAI,CAAC,GAAG,EAAE,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;QAC1D,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;QACrC,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,oBAAoB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAA;IACjG,CAAC;IAED,mHAAmH;IACnH,KAAK,UAAU,iBAAiB;QAC9B,MAAM,OAAO,GAAG,wBAAwB,EAAE,CAAA;QAC1C,IAAI,OAAO;YAAE,OAAO,OAAO,CAAA;QAC3B,MAAM,GAAG,GAAG,MAAM,kBAAkB,EAAE,CAAA;QACtC,OAAO,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC5C,CAAC;IAED,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,aAAa,EAAE,iBAAiB,EAAE,CAAA;AACpF,CAAC"}

package/dist/oidcSettingsRoutes.d.ts

@@ -0,0 +1,19 @@
+import type { FastifyInstance, FastifyReply } from 'fastify';
+import type { AuthOptions } from './context.js';
+import type { IdentityConfirmation } from './identityConfirmation.js';
+import type { Oidc } from './oidc.js';
+import type { OidcSettings } from './oidcSettings.js';
+import type { OidcConfig, createOidcConfigResolver } from './oidcConfig.js';
+export declare function createOidcSettingsRoutes(ctx: AuthOptions, parts: {
+    identityConfirmation: IdentityConfirmation;
+    oidc: Oidc;
+    oidcSettings: OidcSettings;
+    resolver: ReturnType<typeof createOidcConfigResolver>;
+    startOidcFlow: (app: FastifyInstance, reply: FastifyReply, cfg: OidcConfig, extra: {
+        purpose?: 'oidc-flow' | 'oidc-test' | 'oidc-confirm';
+        adminUserId?: number;
+    }) => Promise<unknown>;
+}): {
+    oidcSettingsRoutes: (app: FastifyInstance) => Promise<void>;
+};
+//# sourceMappingURL=oidcSettingsRoutes.d.ts.map

package/dist/oidcSettingsRoutes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidcSettingsRoutes.d.ts","sourceRoot":"","sources":["../src/oidcSettingsRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAG5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,KAAK,EAAE,YAAY,EAAmB,MAAM,mBAAmB,CAAA;AACtE,OAAO,KAAK,EAAE,UAAU,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAgB3E,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE;IAChE,oBAAoB,EAAE,oBAAoB,CAAA;IAC1C,IAAI,EAAE,IAAI,CAAA;IACV,YAAY,EAAE,YAAY,CAAA;IAC1B,QAAQ,EAAE,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAA;IACrD,aAAa,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE;QAAE,OAAO,CAAC,EAAE,WAAW,GAAG,WAAW,GAAG,cAAc,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CACvL;8BAqCwC,eAAe;EAkGvD"}