@camstack/addon-auth 1.2.136 → 1.2.139

package/dist/oidc/auth-oidc.addon.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-CaBcilKz.js");
+const require_dist = require("../dist-CiG_dP05.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_dist.__toESM(node_crypto);
 //#region ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
@@ -704,6 +704,186 @@ function createRemoteJWKSet(url, options) {
 	});
 }
 //#endregion
+//#region src/oidc/oidc-connection-schema.ts
+var DEFAULT_OIDC_ICON = "shield-check";
+var OIDC_CONNECTION_FORM_SCHEMA = { sections: [{
+	id: "identity",
+	title: "Identity",
+	fields: [{
+		type: "text",
+		key: "displayName",
+		label: "Display name",
+		description: "Shown on the login button.",
+		default: "OpenID Connect"
+	}, {
+		type: "icon",
+		key: "icon",
+		label: "Icon",
+		description: "Shown on the login button.",
+		default: DEFAULT_OIDC_ICON
+	}]
+}, {
+	id: "idp",
+	title: "Identity provider",
+	fields: [
+		{
+			type: "text",
+			key: "issuerUrl",
+			label: "Issuer URL",
+			description: "IdP base URL — discovery doc lives at <issuer>/.well-known/openid-configuration.",
+			default: ""
+		},
+		{
+			type: "text",
+			key: "clientId",
+			label: "Client ID",
+			default: ""
+		},
+		{
+			type: "password",
+			key: "clientSecret",
+			label: "Client Secret",
+			showToggle: true,
+			default: ""
+		},
+		{
+			type: "text",
+			key: "redirectUri",
+			label: "Redirect URI override",
+			description: "Optional — leave empty. Empty: a sign-in returns to the hub address it was started from (LAN, mesh or public, as listed on the Network page). Set: pins that one callback.",
+			default: ""
+		},
+		{
+			type: "text",
+			key: "scopes",
+			label: "Scopes",
+			description: "Space-separated.",
+			default: "openid profile email"
+		},
+		{
+			type: "select",
+			key: "usernameClaim",
+			label: "Username claim",
+			default: "preferred_username",
+			options: [
+				{
+					value: "preferred_username",
+					label: "preferred_username"
+				},
+				{
+					value: "email",
+					label: "email"
+				},
+				{
+					value: "sub",
+					label: "sub (user id)"
+				}
+			]
+		}
+	]
+}] };
+//#endregion
+//#region src/oidc/oidc-connections.ts
+/**
+* Pure helpers for OIDC connection rows in `config.providers`.
+*/
+var INSTANCE_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
+var DEFAULT_OIDC_PROVIDER = {
+	id: "default",
+	displayName: "OpenID Connect",
+	icon: "shield-check",
+	issuerUrl: "",
+	clientId: "",
+	clientSecret: "",
+	redirectUri: "",
+	scopes: "openid profile email",
+	usernameClaim: "preferred_username"
+};
+function findOidcProvider(config, id) {
+	return config.providers.find((p) => p.id === id) ?? null;
+}
+function connectionConfigured(row) {
+	const secret = typeof row.clientSecret === "string" ? row.clientSecret.trim() : "";
+	return row.clientId.trim() !== "" && secret !== "";
+}
+function clientSecretView(clientSecret, secrets, connectionId) {
+	if (require_dist.isSecretMarker(clientSecret)) return require_dist.toSecretFieldView(clientSecret);
+	const plain = typeof clientSecret === "string" ? clientSecret.trim() : "";
+	if (plain === "") return null;
+	if (secrets === void 0) return require_dist.toSecretFieldView(plain);
+	return {
+		$secret: secrets.ref(require_dist.globalSecretScope(), require_dist.arrayItemFieldPath("providers", connectionId, "clientSecret")),
+		v: 1,
+		set: true
+	};
+}
+function createOidcConnection(config, input) {
+	const id = input.id.trim();
+	if (!INSTANCE_ID_PATTERN.test(id)) return {
+		ok: false,
+		reason: "invalid-id"
+	};
+	if (config.providers.some((p) => p.id === id)) return {
+		ok: false,
+		reason: "duplicate-id"
+	};
+	const row = {
+		...DEFAULT_OIDC_PROVIDER,
+		id,
+		displayName: input.displayName.trim() || DEFAULT_OIDC_PROVIDER.displayName
+	};
+	return {
+		ok: true,
+		id,
+		config: { providers: [...config.providers, row] }
+	};
+}
+function updateOidcConnection(config, id, patch) {
+	const idx = config.providers.findIndex((p) => p.id === id);
+	if (idx < 0) return {
+		ok: false,
+		reason: "not-found"
+	};
+	const prev = config.providers[idx];
+	if (prev === void 0) return {
+		ok: false,
+		reason: "not-found"
+	};
+	const next = {
+		...prev,
+		displayName: patch.displayName.trim() || prev.displayName,
+		...patch.icon !== void 0 ? { icon: patch.icon } : {},
+		...patch.issuerUrl !== void 0 ? { issuerUrl: patch.issuerUrl } : {},
+		...patch.clientId !== void 0 ? { clientId: patch.clientId } : {},
+		...patch.clientSecret !== void 0 ? { clientSecret: patch.clientSecret } : {},
+		...patch.redirectUri !== void 0 ? { redirectUri: patch.redirectUri } : {},
+		...patch.scopes !== void 0 ? { scopes: patch.scopes } : {},
+		...patch.usernameClaim !== void 0 ? { usernameClaim: patch.usernameClaim } : {}
+	};
+	return {
+		ok: true,
+		config: { providers: config.providers.map((p, i) => i === idx ? next : p) },
+		clearClientSecret: patch.clearClientSecret === true
+	};
+}
+function deleteOidcConnection(config, id) {
+	if (!config.providers.some((p) => p.id === id)) return {
+		ok: false,
+		reason: "not-found"
+	};
+	return {
+		ok: true,
+		config: { providers: config.providers.filter((p) => p.id !== id) }
+	};
+}
+/** Map a wire `clientSecret` field into an update patch fragment. */
+function clientSecretPatchOf(value) {
+	if (value === void 0) return {};
+	if (require_dist.isSecretClear(value)) return { clearClientSecret: true };
+	if (value === "") return {};
+	return { clientSecret: value };
+}
+//#endregion
 //#region src/oidc/request-origin.ts
 /** host[:port] — a DNS name, IPv4 or bracketed IPv6. No userinfo, path or spaces. */
 var AUTHORITY_RE = /^(?:[a-z0-9.-]+|\[[0-9a-f:.]+\])(?::\d{1,5})?$/i;
@@ -797,6 +977,8 @@ function pickRequestOrigin(headers, allowed) {
 *     `/<providerId>/callback` per configured provider. The handler
 *     reads `:providerId` from the route params, picks the matching
 *     config entry, and runs the OIDC flow against THAT IdP.
+*   - `oidc-connections` (singleton) — list / create / update / delete for
+*     IdP rows; Settings UI is DataTable + dialog (no editable-array).
 *
 * Each provider entry independently performs:
 *   - PKCE S256 + nonce
@@ -819,17 +1001,7 @@ function pickRequestOrigin(headers, allowed) {
 *   - Refresh token rotation (offline_access).
 *   - Persist state + nonce + PKCE across restart (multi-replica).
 */
-var DEFAULT_PROVIDER = {
-	id: "default",
-	displayName: "OpenID Connect",
-	icon: "shield-check",
-	issuerUrl: "",
-	clientId: "",
-	clientSecret: "",
-	redirectUri: "",
-	scopes: "openid profile email",
-	usernameClaim: "preferred_username"
-};
+var DEFAULT_PROVIDER = DEFAULT_OIDC_PROVIDER;
 var DEFAULT_CONFIG = { providers: [] };
 var STATE_TTL_MS = 5 * 6e4;
 /**
@@ -838,12 +1010,6 @@ var STATE_TTL_MS = 5 * 6e4;
 * so a junk value is refused here rather than carried into a signed bridge.
 */
 var LINK_INTENT_PATTERN = /^[A-Za-z0-9_-]{16,128}$/;
-/**
-* An instance id appears in URLs and in the identity `oidc:<id>:<sub>`; a `:`
-* would make two identities read the same, so ids are slugs. A configured row
-* whose id is not one is skipped.
-*/
-var INSTANCE_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
 /** Bound on in-flight logins: `/start` is public, so a flood must not grow the map. */
 var MAX_PENDING_STATES = 1e3;
 /**
@@ -865,9 +1031,14 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 	/** Pending OAuth states across ALL providers. The pending entry
 	*  carries `providerId` so the /callback handler picks the right config. */
 	pendingStates = /* @__PURE__ */ new Map();
+	/** Keychain path for each IdP's client secret (D787 / D828 sibling). */
+	secretStatePaths = ["providers[id].clientSecret"];
 	constructor() {
 		super({ ...DEFAULT_CONFIG });
 	}
+	async onConfigChanged() {
+		this.rebuildInstances();
+	}
 	async onInitialize() {
 		this.rebuildInstances();
 		const authProvider = {
@@ -914,9 +1085,84 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 			{
 				capability: require_dist.loginMethodCapability,
 				provider: loginMethodProvider
+			},
+			{
+				capability: require_dist.oidcConnectionsCapability,
+				provider: this.connectionsProvider()
 			}
 		];
 	}
+	connectionsProvider() {
+		return {
+			connectionFormSchema: async () => OIDC_CONNECTION_FORM_SCHEMA,
+			listConnections: async () => {
+				const secrets = this.ctx.secrets;
+				return this.config.providers.map((row) => {
+					const merged = {
+						...DEFAULT_PROVIDER,
+						...row
+					};
+					return {
+						id: merged.id,
+						displayName: merged.displayName,
+						icon: require_dist.isDisplayIconKey(merged.icon) ? merged.icon : DEFAULT_OIDC_ICON,
+						issuerUrl: merged.issuerUrl,
+						clientId: merged.clientId,
+						configured: connectionConfigured(merged),
+						formValues: {
+							displayName: merged.displayName,
+							icon: merged.icon,
+							issuerUrl: merged.issuerUrl,
+							clientId: merged.clientId,
+							clientSecret: clientSecretView(merged.clientSecret, secrets, merged.id) ?? "",
+							redirectUri: merged.redirectUri,
+							scopes: merged.scopes,
+							usernameClaim: merged.usernameClaim
+						}
+					};
+				});
+			},
+			createConnection: async (input) => {
+				const result = createOidcConnection(this.config, input);
+				if (!result.ok) throw new Error(result.reason === "duplicate-id" ? `An OIDC connection with id "${input.id}" already exists` : `Invalid connection id "${input.id}" — use a lowercase slug`);
+				await this.updateGlobalSettings(result.config);
+				this.rebuildInstances();
+				return { id: result.id };
+			},
+			updateConnection: async (input) => {
+				const secretPatch = clientSecretPatchOf(input.clientSecret);
+				const result = updateOidcConnection(this.config, input.id, {
+					displayName: input.displayName,
+					...input.icon !== void 0 ? { icon: input.icon } : {},
+					...input.issuerUrl !== void 0 ? { issuerUrl: input.issuerUrl } : {},
+					...input.clientId !== void 0 ? { clientId: input.clientId } : {},
+					...secretPatch,
+					...input.redirectUri !== void 0 ? { redirectUri: input.redirectUri } : {},
+					...input.scopes !== void 0 ? { scopes: input.scopes } : {},
+					...input.usernameClaim !== void 0 ? { usernameClaim: input.usernameClaim } : {}
+				});
+				if (!result.ok) throw new Error(`Unknown OIDC connection "${input.id}"`);
+				if (result.clearClientSecret) {
+					const cleared = result.config.providers.map((p) => p.id === input.id ? {
+						...p,
+						clientSecret: require_dist.SECRET_CLEAR
+					} : p);
+					await this.updateGlobalSettings({ providers: cleared });
+				} else await this.updateGlobalSettings(result.config);
+				this.rebuildInstances();
+				return { ok: true };
+			},
+			deleteConnection: async (input) => {
+				if (findOidcProvider(this.config, input.id) === null) throw new Error(`Unknown OIDC connection "${input.id}"`);
+				const result = deleteOidcConnection(this.config, input.id);
+				if (!result.ok) throw new Error(`Unknown OIDC connection "${input.id}"`);
+				await this.updateGlobalSettings(result.config);
+				await this.clearSecrets([`providers[${input.id}].clientSecret`]);
+				this.rebuildInstances();
+				return { ok: true };
+			}
+		};
+	}
 	/**
 	* Build one `redirect` login-method per configured provider instance.
 	* `startUrl` is the addon's public `/start` route for that instance;
@@ -941,92 +1187,9 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 	globalSettingsSchema() {
 		return this.schema({ sections: [{
 			id: "oidc",
-			title: "OIDC Providers",
-			description: "Configure one or more IdPs (Google, Microsoft, Okta, Keycloak, …). Each entry produces an independent login button. The redirect URI shown on the IdP-side must include the provider id in the path: `<origin>/addon/auth-oidc/<id>/callback`.",
-			columns: 1,
-			fields: [this.field({
-				type: "editable-array",
-				key: "providers",
-				label: "Providers",
-				description: "Each row is a distinct OIDC IdP. Click + to add.",
-				default: [],
-				itemFields: [
-					{
-						type: "text",
-						key: "id",
-						label: "Instance id",
-						description: "URL-friendly slug — appears in the redirect URI as /addon/auth-oidc/<id>/callback. Stable; renaming breaks any IdP-side registrations.",
-						default: ""
-					},
-					{
-						type: "text",
-						key: "displayName",
-						label: "Display name",
-						description: "Shown on the login button.",
-						default: "OpenID Connect"
-					},
-					{
-						type: "icon",
-						key: "icon",
-						label: "Icon",
-						description: "Shown on the login button.",
-						default: DEFAULT_PROVIDER.icon
-					},
-					{
-						type: "text",
-						key: "issuerUrl",
-						label: "Issuer URL",
-						description: "IdP base URL — discovery doc lives at <issuer>/.well-known/openid-configuration.",
-						default: ""
-					},
-					{
-						type: "text",
-						key: "clientId",
-						label: "Client ID",
-						default: ""
-					},
-					{
-						type: "password",
-						key: "clientSecret",
-						label: "Client Secret",
-						default: ""
-					},
-					{
-						type: "text",
-						key: "redirectUri",
-						label: "Redirect URI override",
-						description: "Optional — leave empty. Empty: a sign-in returns to the hub address it was started from (LAN, mesh or public, as listed on the Network page), so register one callback per address you sign in from at the IdP. Set: it PINS that one callback — every sign-in returns to its address, wherever it started.",
-						default: ""
-					},
-					{
-						type: "text",
-						key: "scopes",
-						label: "Scopes",
-						description: "Space-separated.",
-						default: "openid profile email"
-					},
-					{
-						type: "select",
-						key: "usernameClaim",
-						label: "Username claim",
-						default: "preferred_username",
-						options: [
-							{
-								value: "preferred_username",
-								label: "preferred_username"
-							},
-							{
-								value: "email",
-								label: "email"
-							},
-							{
-								value: "sub",
-								label: "sub (user id)"
-							}
-						]
-					}
-				]
-			})]
+			title: "OpenID Connect",
+			description: "Manage IdP connections in this page’s Settings table (Add / Edit). Each connection’s redirect URI is `<origin>/addon/auth-oidc/<id>/callback`. Credentials stay in the CamStack keychain.",
+			fields: []
 		}] });
 	}
 	rebuildInstances() {