@camstack/addon-auth 1.2.147 → 1.2.149

package/dist/oidc/auth-oidc.addon.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-DDdB_Mme.js");
+const require_dist = require("../dist-Bo_LXyeR.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_dist.__toESM(node_crypto);
 //#region ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
@@ -886,6 +886,90 @@ function clientSecretPatchOf(value) {
 	return { clientSecret: value };
 }
 //#endregion
+//#region src/oidc/oidc-provider-record-kinds.ts
+var OIDC_PROVIDER_KIND = "oidc-provider";
+var usernameClaimSchema = require_dist._enum([
+	"preferred_username",
+	"email",
+	"sub"
+]);
+var OidcProviderBodySchema = require_dist.object({
+	displayName: require_dist.string().min(1),
+	icon: require_dist.string(),
+	issuerUrl: require_dist.string(),
+	clientId: require_dist.string(),
+	clientSecret: require_dist.string().meta({ secret: true }),
+	redirectUri: require_dist.string(),
+	scopes: require_dist.string(),
+	usernameClaim: usernameClaimSchema
+});
+var oidcProviderEntryKind = require_dist.defineEntryKind(OIDC_PROVIDER_KIND, {
+	title: "OIDC providers",
+	nameField: "displayName",
+	schema: OidcProviderBodySchema,
+	writeTrigger: "an operator adds, edits or removes an OpenID Connect identity provider",
+	adoptsFrom: require_dist.settingsArrayAdoptsFrom("auth-oidc", "providers")
+});
+//#endregion
+//#region src/oidc/oidc-provider-store.ts
+function rowToProvider(id, data) {
+	return {
+		...DEFAULT_OIDC_PROVIDER,
+		...data,
+		id
+	};
+}
+var OidcProviderStore = class OidcProviderStore {
+	kind;
+	constructor(kind) {
+		this.kind = kind;
+	}
+	static of(records) {
+		return new OidcProviderStore(records.kind(oidcProviderEntryKind));
+	}
+	async listResolved() {
+		const page = await this.kind.query({ limit: 1e3 });
+		const out = [];
+		for (const record of page.records) {
+			let data = record.data;
+			try {
+				const resolved = await this.kind.getResolved(record.id);
+				if (resolved !== null) data = resolved.data;
+			} catch (err) {
+				if (!(err instanceof require_dist.RecordSecretUnavailableError)) throw err;
+			}
+			const parsed = OidcProviderBodySchema.safeParse(data);
+			if (!parsed.success) continue;
+			out.push(rowToProvider(record.id, parsed.data));
+		}
+		return out;
+	}
+	async replaceAll(providers) {
+		const page = await this.kind.query({ limit: 1e3 });
+		const nextIds = new Set(providers.map((p) => p.id));
+		for (const row of page.records) if (!nextIds.has(row.id)) await this.kind.delete(row.id);
+		for (const row of providers) {
+			const { id, displayName, icon, issuerUrl, clientId, clientSecret, redirectUri, scopes, usernameClaim } = row;
+			const body = {
+				displayName,
+				icon,
+				issuerUrl,
+				clientId,
+				clientSecret,
+				redirectUri,
+				scopes,
+				usernameClaim
+			};
+			const parsed = oidcProviderEntryKind.schema.safeParse(body);
+			if (!parsed.success) throw new Error(`invalid OIDC provider '${id}': ${parsed.error.message}`);
+			await this.kind.put({
+				id,
+				data: parsed.data
+			});
+		}
+	}
+};
+//#endregion
 //#region src/oidc/auth-oidc.addon.ts
 /**
 * Generic OpenID Connect (OIDC) authentication provider.
@@ -976,6 +1060,8 @@ function returnBaseOf(redirectUri, callbackPath) {
 var AuthOidcAddon = class extends require_dist.BaseAddon {
 	/** Per-provider runtime state, keyed by `provider.id`. */
 	instances = /* @__PURE__ */ new Map();
+	providerStore = null;
+	activeProviders = [];
 	/** Pending OAuth states across ALL providers. The pending entry
 	*  carries `providerId` so the /callback handler picks the right config. */
 	pendingStates = /* @__PURE__ */ new Map();
@@ -985,9 +1071,24 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 		super({ ...DEFAULT_CONFIG });
 	}
 	async onConfigChanged() {
+		this.activeProviders = await this.loadPersistedProviders();
 		this.rebuildInstances();
 	}
 	async onInitialize() {
+		const records = this.ctx.records;
+		if (records === void 0) throw new Error("auth-oidc: ctx.records is required (hub-only addon)");
+		await records.declare({ "oidc-provider": oidcProviderEntryKind });
+		this.providerStore = OidcProviderStore.of(records);
+		this.activeProviders = await this.loadPersistedProviders();
+		if ((await this.providerStore.listResolved()).length === 0 && this.config.providers.length > 0) try {
+			await this.providerStore.replaceAll(this.config.providers);
+			this.activeProviders = await this.loadPersistedProviders();
+		} catch (err) {
+			const msg = err instanceof Error ? err.message : String(err);
+			if (!msg.startsWith("records/foreign-marker:") && !msg.startsWith("records/adoption-pending:")) throw err;
+			this.ctx.logger.warn("OIDC: deferred config→records migrate (secret markers need adopt remap)", { meta: { error: msg } });
+			this.activeProviders = [...this.config.providers];
+		}
 		this.rebuildInstances();
 		const authProvider = {
 			validateCredentials: async () => null,
@@ -1045,7 +1146,7 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 			connectionFormSchema: async () => OIDC_CONNECTION_FORM_SCHEMA,
 			listConnections: async () => {
 				const secrets = this.ctx.secrets;
-				return this.config.providers.map((row) => {
+				return this.activeProviders.map((row) => {
 					const merged = {
 						...DEFAULT_PROVIDER,
 						...row
@@ -1071,15 +1172,15 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 				});
 			},
 			createConnection: async (input) => {
-				const result = createOidcConnection(this.config, input);
+				const result = createOidcConnection(this.providersConfig(), input);
 				if (!result.ok) throw new Error(result.reason === "duplicate-id" ? `An OIDC connection with id "${input.id}" already exists` : `Invalid connection id "${input.id}" — use a lowercase slug`);
-				await this.updateGlobalSettings(result.config);
+				await this.persistProviders(result.config.providers);
 				this.rebuildInstances();
 				return { id: result.id };
 			},
 			updateConnection: async (input) => {
 				const secretPatch = clientSecretPatchOf(input.clientSecret);
-				const result = updateOidcConnection(this.config, input.id, {
+				const result = updateOidcConnection(this.providersConfig(), input.id, {
 					displayName: input.displayName,
 					...input.icon !== void 0 ? { icon: input.icon } : {},
 					...input.issuerUrl !== void 0 ? { issuerUrl: input.issuerUrl } : {},
@@ -1095,20 +1196,21 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 						...p,
 						clientSecret: require_dist.SECRET_CLEAR
 					} : p);
-					await this.updateGlobalSettings({ providers: cleared });
-				} else await this.updateGlobalSettings(result.config);
+					await this.persistProviders(cleared);
+				} else await this.persistProviders(result.config.providers);
 				this.rebuildInstances();
 				return { ok: true };
 			},
 			deleteConnection: async (input) => {
-				if (findOidcProvider(this.config, input.id) === null) throw new Error(`Unknown OIDC connection "${input.id}"`);
-				await this.updateGlobalSettings({ providers: this.config.providers.map((p) => p.id === input.id ? {
+				if (findOidcProvider(this.providersConfig(), input.id) === null) throw new Error(`Unknown OIDC connection "${input.id}"`);
+				const cleared = this.activeProviders.map((p) => p.id === input.id ? {
 					...p,
 					clientSecret: require_dist.SECRET_CLEAR
-				} : p) });
-				const result = deleteOidcConnection(this.config, input.id);
+				} : p);
+				await this.persistProviders(cleared);
+				const result = deleteOidcConnection(this.providersConfig(), input.id);
 				if (!result.ok) throw new Error(`Unknown OIDC connection "${input.id}"`);
-				await this.updateGlobalSettings(result.config);
+				await this.persistProviders(result.config.providers);
 				this.rebuildInstances();
 				return { ok: true };
 			}
@@ -1147,9 +1249,29 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 			fields: []
 		}] });
 	}
+	providersConfig() {
+		return { providers: this.activeProviders };
+	}
+	async loadPersistedProviders() {
+		const store = this.providerStore;
+		if (store !== null) {
+			const fromRecords = await store.listResolved();
+			if (fromRecords.length > 0) return fromRecords;
+		}
+		return this.config.providers;
+	}
+	async persistProviders(providers) {
+		this.activeProviders = [...providers];
+		const store = this.providerStore;
+		if (store !== null) {
+			await store.replaceAll(providers);
+			return;
+		}
+		await this.updateGlobalSettings({ providers: [...providers] });
+	}
 	rebuildInstances() {
 		this.instances.clear();
-		const providers = this.config.providers ?? [];
+		const providers = this.activeProviders;
 		for (const raw of providers) {
 			const merged = {
 				...DEFAULT_PROVIDER,

package/dist/oidc/auth-oidc.addon.mjs

@@ -1,4 +1,4 @@
-import { C as arrayItemFieldPath, D as toSecretFieldView, E as isSecretMarker, S as SECRET_CLEAR, T as isSecretClear, _ as requestMountPrefix, b as errMsg, c as authProviderCapability, d as loginMethodCapability, f as normalizeOrigin, g as pickRequestOrigin, h as parseAppPageLang, i as addonRoutesCapability, l as buildAddonRouteProvider, m as parseAppFlowRequest, n as APP_REFUSED_PATH, o as advertisedHubOrigins, p as oidcConnectionsCapability, r as SSO_STATE_COOKIE, s as appFlowLocation, t as APP_FLOW_DEFAULT_REDIRECT, u as claimedRequestOrigins, v as resolveIconKey, w as globalSecretScope, x as BaseAddon } from "../dist-BGsjH-S3.mjs";
+import { A as settingsArrayAdoptsFrom, C as SECRET_CLEAR, D as globalSecretScope, I as object, L as string, M as _enum, O as isSecretClear, S as RecordSecretUnavailableError, T as defineEntryKind, _ as requestMountPrefix, b as errMsg, c as authProviderCapability, d as loginMethodCapability, f as normalizeOrigin, g as pickRequestOrigin, h as parseAppPageLang, i as addonRoutesCapability, j as toSecretFieldView, k as isSecretMarker, l as buildAddonRouteProvider, m as parseAppFlowRequest, n as APP_REFUSED_PATH, o as advertisedHubOrigins, p as oidcConnectionsCapability, r as SSO_STATE_COOKIE, s as appFlowLocation, t as APP_FLOW_DEFAULT_REDIRECT, u as claimedRequestOrigins, v as resolveIconKey, w as arrayItemFieldPath, x as BaseAddon } from "../dist-DqNfCE-z.mjs";
 import * as crypto$1 from "node:crypto";
 //#region ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
 var encoder = new TextEncoder(), decoder = new TextDecoder(), strictDecoder = new TextDecoder("utf-8", { fatal: !0 });
@@ -881,6 +881,90 @@ function clientSecretPatchOf(value) {
 	return { clientSecret: value };
 }
 //#endregion
+//#region src/oidc/oidc-provider-record-kinds.ts
+var OIDC_PROVIDER_KIND = "oidc-provider";
+var usernameClaimSchema = _enum([
+	"preferred_username",
+	"email",
+	"sub"
+]);
+var OidcProviderBodySchema = object({
+	displayName: string().min(1),
+	icon: string(),
+	issuerUrl: string(),
+	clientId: string(),
+	clientSecret: string().meta({ secret: true }),
+	redirectUri: string(),
+	scopes: string(),
+	usernameClaim: usernameClaimSchema
+});
+var oidcProviderEntryKind = defineEntryKind(OIDC_PROVIDER_KIND, {
+	title: "OIDC providers",
+	nameField: "displayName",
+	schema: OidcProviderBodySchema,
+	writeTrigger: "an operator adds, edits or removes an OpenID Connect identity provider",
+	adoptsFrom: settingsArrayAdoptsFrom("auth-oidc", "providers")
+});
+//#endregion
+//#region src/oidc/oidc-provider-store.ts
+function rowToProvider(id, data) {
+	return {
+		...DEFAULT_OIDC_PROVIDER,
+		...data,
+		id
+	};
+}
+var OidcProviderStore = class OidcProviderStore {
+	kind;
+	constructor(kind) {
+		this.kind = kind;
+	}
+	static of(records) {
+		return new OidcProviderStore(records.kind(oidcProviderEntryKind));
+	}
+	async listResolved() {
+		const page = await this.kind.query({ limit: 1e3 });
+		const out = [];
+		for (const record of page.records) {
+			let data = record.data;
+			try {
+				const resolved = await this.kind.getResolved(record.id);
+				if (resolved !== null) data = resolved.data;
+			} catch (err) {
+				if (!(err instanceof RecordSecretUnavailableError)) throw err;
+			}
+			const parsed = OidcProviderBodySchema.safeParse(data);
+			if (!parsed.success) continue;
+			out.push(rowToProvider(record.id, parsed.data));
+		}
+		return out;
+	}
+	async replaceAll(providers) {
+		const page = await this.kind.query({ limit: 1e3 });
+		const nextIds = new Set(providers.map((p) => p.id));
+		for (const row of page.records) if (!nextIds.has(row.id)) await this.kind.delete(row.id);
+		for (const row of providers) {
+			const { id, displayName, icon, issuerUrl, clientId, clientSecret, redirectUri, scopes, usernameClaim } = row;
+			const body = {
+				displayName,
+				icon,
+				issuerUrl,
+				clientId,
+				clientSecret,
+				redirectUri,
+				scopes,
+				usernameClaim
+			};
+			const parsed = oidcProviderEntryKind.schema.safeParse(body);
+			if (!parsed.success) throw new Error(`invalid OIDC provider '${id}': ${parsed.error.message}`);
+			await this.kind.put({
+				id,
+				data: parsed.data
+			});
+		}
+	}
+};
+//#endregion
 //#region src/oidc/auth-oidc.addon.ts
 /**
 * Generic OpenID Connect (OIDC) authentication provider.
@@ -971,6 +1055,8 @@ function returnBaseOf(redirectUri, callbackPath) {
 var AuthOidcAddon = class extends BaseAddon {
 	/** Per-provider runtime state, keyed by `provider.id`. */
 	instances = /* @__PURE__ */ new Map();
+	providerStore = null;
+	activeProviders = [];
 	/** Pending OAuth states across ALL providers. The pending entry
 	*  carries `providerId` so the /callback handler picks the right config. */
 	pendingStates = /* @__PURE__ */ new Map();
@@ -980,9 +1066,24 @@ var AuthOidcAddon = class extends BaseAddon {
 		super({ ...DEFAULT_CONFIG });
 	}
 	async onConfigChanged() {
+		this.activeProviders = await this.loadPersistedProviders();
 		this.rebuildInstances();
 	}
 	async onInitialize() {
+		const records = this.ctx.records;
+		if (records === void 0) throw new Error("auth-oidc: ctx.records is required (hub-only addon)");
+		await records.declare({ "oidc-provider": oidcProviderEntryKind });
+		this.providerStore = OidcProviderStore.of(records);
+		this.activeProviders = await this.loadPersistedProviders();
+		if ((await this.providerStore.listResolved()).length === 0 && this.config.providers.length > 0) try {
+			await this.providerStore.replaceAll(this.config.providers);
+			this.activeProviders = await this.loadPersistedProviders();
+		} catch (err) {
+			const msg = err instanceof Error ? err.message : String(err);
+			if (!msg.startsWith("records/foreign-marker:") && !msg.startsWith("records/adoption-pending:")) throw err;
+			this.ctx.logger.warn("OIDC: deferred config→records migrate (secret markers need adopt remap)", { meta: { error: msg } });
+			this.activeProviders = [...this.config.providers];
+		}
 		this.rebuildInstances();
 		const authProvider = {
 			validateCredentials: async () => null,
@@ -1040,7 +1141,7 @@ var AuthOidcAddon = class extends BaseAddon {
 			connectionFormSchema: async () => OIDC_CONNECTION_FORM_SCHEMA,
 			listConnections: async () => {
 				const secrets = this.ctx.secrets;
-				return this.config.providers.map((row) => {
+				return this.activeProviders.map((row) => {
 					const merged = {
 						...DEFAULT_PROVIDER,
 						...row
@@ -1066,15 +1167,15 @@ var AuthOidcAddon = class extends BaseAddon {
 				});
 			},
 			createConnection: async (input) => {
-				const result = createOidcConnection(this.config, input);
+				const result = createOidcConnection(this.providersConfig(), input);
 				if (!result.ok) throw new Error(result.reason === "duplicate-id" ? `An OIDC connection with id "${input.id}" already exists` : `Invalid connection id "${input.id}" — use a lowercase slug`);
-				await this.updateGlobalSettings(result.config);
+				await this.persistProviders(result.config.providers);
 				this.rebuildInstances();
 				return { id: result.id };
 			},
 			updateConnection: async (input) => {
 				const secretPatch = clientSecretPatchOf(input.clientSecret);
-				const result = updateOidcConnection(this.config, input.id, {
+				const result = updateOidcConnection(this.providersConfig(), input.id, {
 					displayName: input.displayName,
 					...input.icon !== void 0 ? { icon: input.icon } : {},
 					...input.issuerUrl !== void 0 ? { issuerUrl: input.issuerUrl } : {},
@@ -1090,20 +1191,21 @@ var AuthOidcAddon = class extends BaseAddon {
 						...p,
 						clientSecret: SECRET_CLEAR
 					} : p);
-					await this.updateGlobalSettings({ providers: cleared });
-				} else await this.updateGlobalSettings(result.config);
+					await this.persistProviders(cleared);
+				} else await this.persistProviders(result.config.providers);
 				this.rebuildInstances();
 				return { ok: true };
 			},
 			deleteConnection: async (input) => {
-				if (findOidcProvider(this.config, input.id) === null) throw new Error(`Unknown OIDC connection "${input.id}"`);
-				await this.updateGlobalSettings({ providers: this.config.providers.map((p) => p.id === input.id ? {
+				if (findOidcProvider(this.providersConfig(), input.id) === null) throw new Error(`Unknown OIDC connection "${input.id}"`);
+				const cleared = this.activeProviders.map((p) => p.id === input.id ? {
 					...p,
 					clientSecret: SECRET_CLEAR
-				} : p) });
-				const result = deleteOidcConnection(this.config, input.id);
+				} : p);
+				await this.persistProviders(cleared);
+				const result = deleteOidcConnection(this.providersConfig(), input.id);
 				if (!result.ok) throw new Error(`Unknown OIDC connection "${input.id}"`);
-				await this.updateGlobalSettings(result.config);
+				await this.persistProviders(result.config.providers);
 				this.rebuildInstances();
 				return { ok: true };
 			}
@@ -1142,9 +1244,29 @@ var AuthOidcAddon = class extends BaseAddon {
 			fields: []
 		}] });
 	}
+	providersConfig() {
+		return { providers: this.activeProviders };
+	}
+	async loadPersistedProviders() {
+		const store = this.providerStore;
+		if (store !== null) {
+			const fromRecords = await store.listResolved();
+			if (fromRecords.length > 0) return fromRecords;
+		}
+		return this.config.providers;
+	}
+	async persistProviders(providers) {
+		this.activeProviders = [...providers];
+		const store = this.providerStore;
+		if (store !== null) {
+			await store.replaceAll(providers);
+			return;
+		}
+		await this.updateGlobalSettings({ providers: [...providers] });
+	}
 	rebuildInstances() {
 		this.instances.clear();
-		const providers = this.config.providers ?? [];
+		const providers = this.activeProviders;
 		for (const raw of providers) {
 			const merged = {
 				...DEFAULT_PROVIDER,