@camstack/addon-auth 1.2.170 → 1.2.172

package/dist/oidc/auth-oidc.addon.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-hxTUn06g.js");
+const require_dist = require("../dist-xyaDmv1T.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_dist.__toESM(node_crypto);
 //#region ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
@@ -805,8 +805,7 @@ function findOidcProvider(config, id) {
 	return config.providers.find((p) => p.id === id) ?? null;
 }
 function connectionConfigured(row) {
-	const secret = typeof row.clientSecret === "string" ? row.clientSecret.trim() : "";
-	return row.clientId.trim() !== "" && secret !== "";
+	return row.clientId.trim() !== "";
 }
 function clientSecretView(clientSecret, secrets, connectionId) {
 	if (require_dist.isSecretMarker(clientSecret)) return require_dist.toSecretFieldView(clientSecret);
@@ -868,16 +867,6 @@ function updateOidcConnection(config, id, patch) {
 		clearClientSecret: patch.clearClientSecret === true
 	};
 }
-function deleteOidcConnection(config, id) {
-	if (!config.providers.some((p) => p.id === id)) return {
-		ok: false,
-		reason: "not-found"
-	};
-	return {
-		ok: true,
-		config: { providers: config.providers.filter((p) => p.id !== id) }
-	};
-}
 /** Map a wire `clientSecret` field into an update patch fragment. */
 function clientSecretPatchOf(value) {
 	if (value === void 0) return {};
@@ -898,7 +887,7 @@ var OidcProviderBodySchema = require_dist.object({
 	icon: require_dist.string(),
 	issuerUrl: require_dist.string(),
 	clientId: require_dist.string(),
-	clientSecret: require_dist.string().meta({ secret: true }),
+	clientSecret: require_dist.string().optional().meta({ secret: true }),
 	redirectUri: require_dist.string(),
 	scopes: require_dist.string(),
 	usernameClaim: usernameClaimSchema
@@ -918,6 +907,14 @@ function rowToProvider(id, data) {
 		id
 	};
 }
+/** The stored body of a row; an empty or non-text secret is left out. */
+function bodyOf(row) {
+	const { id: _id, clientSecret, ...rest } = row;
+	return typeof clientSecret === "string" && clientSecret !== "" ? {
+		...rest,
+		clientSecret
+	} : rest;
+}
 var OidcProviderStore = class OidcProviderStore {
 	kind;
 	constructor(kind) {
@@ -930,42 +927,60 @@ var OidcProviderStore = class OidcProviderStore {
 		const page = await this.kind.query({ limit: 1e3 });
 		const out = [];
 		for (const record of page.records) {
-			let data = record.data;
-			try {
-				const resolved = await this.kind.getResolved(record.id);
-				if (resolved !== null) data = resolved.data;
-			} catch (err) {
-				if (!(err instanceof require_dist.RecordSecretUnavailableError)) throw err;
-			}
-			const parsed = OidcProviderBodySchema.safeParse(data);
-			if (!parsed.success) continue;
-			out.push(rowToProvider(record.id, parsed.data));
+			const row = await this.getResolved(record.id);
+			if (row !== null) out.push(row);
 		}
 		return out;
 	}
-	async replaceAll(providers) {
-		const page = await this.kind.query({ limit: 1e3 });
-		const nextIds = new Set(providers.map((p) => p.id));
-		for (const row of page.records) if (!nextIds.has(row.id)) await this.kind.delete(row.id);
-		for (const row of providers) {
-			const { id, displayName, icon, issuerUrl, clientId, clientSecret, redirectUri, scopes, usernameClaim } = row;
-			const body = {
-				displayName,
-				icon,
-				issuerUrl,
-				clientId,
-				clientSecret,
-				redirectUri,
-				scopes,
-				usernameClaim
+	/** One row with its secret resolved for the runtime token call; null when absent. */
+	async getResolved(id) {
+		let record;
+		try {
+			record = await this.kind.getResolved(id);
+		} catch (err) {
+			if (!(err instanceof require_dist.RecordSecretUnavailableError)) throw err;
+			const stored = await this.kind.get(id);
+			if (stored === null) return null;
+			const { clientSecret: _unreadable, ...rest } = stored.data;
+			record = {
+				...stored,
+				data: rest
 			};
-			const parsed = oidcProviderEntryKind.schema.safeParse(body);
-			if (!parsed.success) throw new Error(`invalid OIDC provider '${id}': ${parsed.error.message}`);
-			await this.kind.put({
-				id,
-				data: parsed.data
-			});
 		}
+		if (record === null) return null;
+		const parsed = OidcProviderBodySchema.safeParse(record.data);
+		return parsed.success ? rowToProvider(id, parsed.data) : null;
+	}
+	/**
+	* Insert ONE new row (`ifRev: 0`: an existing id is refused). A plaintext
+	* `clientSecret` is stored by the records facade under the row's own ref.
+	*/
+	async create(row) {
+		const body = bodyOf(row);
+		const parsed = OidcProviderBodySchema.safeParse(body);
+		if (!parsed.success) throw new Error(`invalid OIDC provider '${row.id}': ${parsed.error.message}`);
+		await this.kind.put({
+			id: row.id,
+			data: parsed.data
+		}, { ifRev: 0 });
+		return this.requireRow(row.id);
+	}
+	/**
+	* Merge a partial into ONE row. `clientSecret`: a plaintext sets it, `undefined`
+	* keeps the stored one, `null` clears it.
+	*/
+	async update(id, partial) {
+		await this.kind.patch(id, partial);
+		return this.requireRow(id);
+	}
+	/** Delete one provider record; no other row (nor its secrets) is touched. */
+	async remove(id) {
+		await this.kind.delete(id);
+	}
+	async requireRow(id) {
+		const row = await this.getResolved(id);
+		if (row === null) throw new Error(`OIDC provider '${id}' is not readable after the write`);
+		return row;
 	}
 };
 //#endregion
@@ -1070,7 +1085,7 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 		super({ ...DEFAULT_CONFIG });
 	}
 	async onConfigChanged() {
-		this.activeProviders = await this.loadPersistedProviders();
+		if (this.providerStore !== null) this.activeProviders = await this.providerStore.listResolved();
 		this.rebuildInstances();
 	}
 	async onInitialize() {
@@ -1078,16 +1093,7 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 		if (records === void 0) throw new Error("auth-oidc: ctx.records is required (hub-only addon)");
 		await records.declare({ "oidc-provider": oidcProviderEntryKind });
 		this.providerStore = OidcProviderStore.of(records);
-		this.activeProviders = await this.loadPersistedProviders();
-		if ((await this.providerStore.listResolved()).length === 0 && this.config.providers.length > 0) try {
-			await this.providerStore.replaceAll(this.config.providers);
-			this.activeProviders = await this.loadPersistedProviders();
-		} catch (err) {
-			const msg = err instanceof Error ? err.message : String(err);
-			if (!msg.startsWith("records/foreign-marker:")) throw err;
-			this.ctx.logger.warn("OIDC: deferred config→records copy (a secret marker is bound to another row)", { meta: { error: msg } });
-			this.activeProviders = [...this.config.providers];
-		}
+		this.activeProviders = await this.providerStore.listResolved();
 		this.rebuildInstances();
 		const authProvider = {
 			validateCredentials: async () => null,
@@ -1173,7 +1179,10 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 			createConnection: async (input) => {
 				const result = createOidcConnection(this.providersConfig(), input);
 				if (!result.ok) throw new Error(result.reason === "duplicate-id" ? `An OIDC connection with id "${input.id}" already exists` : `Invalid connection id "${input.id}" — use a lowercase slug`);
-				await this.persistProviders(result.config.providers);
+				const row = result.config.providers.find((p) => p.id === result.id);
+				if (row === void 0) throw new Error(`Invalid connection id "${input.id}"`);
+				const stored = await this.requireStore().create(row);
+				this.activeProviders = [...this.activeProviders, stored];
 				this.rebuildInstances();
 				return { id: result.id };
 			},
@@ -1190,26 +1199,21 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 					...input.usernameClaim !== void 0 ? { usernameClaim: input.usernameClaim } : {}
 				});
 				if (!result.ok) throw new Error(`Unknown OIDC connection "${input.id}"`);
-				if (result.clearClientSecret) {
-					const cleared = result.config.providers.map((p) => p.id === input.id ? {
-						...p,
-						clientSecret: require_dist.SECRET_CLEAR
-					} : p);
-					await this.persistProviders(cleared);
-				} else await this.persistProviders(result.config.providers);
+				const next = result.config.providers.find((p) => p.id === input.id);
+				if (next === void 0) throw new Error(`Unknown OIDC connection "${input.id}"`);
+				const { id: _id, clientSecret: _carried, ...fields } = next;
+				const stored = await this.requireStore().update(input.id, {
+					...fields,
+					...result.clearClientSecret ? { clientSecret: null } : secretPatch.clientSecret !== void 0 ? { clientSecret: secretPatch.clientSecret } : {}
+				});
+				this.activeProviders = this.activeProviders.map((p) => p.id === input.id ? stored : p);
 				this.rebuildInstances();
 				return { ok: true };
 			},
 			deleteConnection: async (input) => {
 				if (findOidcProvider(this.providersConfig(), input.id) === null) throw new Error(`Unknown OIDC connection "${input.id}"`);
-				const cleared = this.activeProviders.map((p) => p.id === input.id ? {
-					...p,
-					clientSecret: require_dist.SECRET_CLEAR
-				} : p);
-				await this.persistProviders(cleared);
-				const result = deleteOidcConnection(this.providersConfig(), input.id);
-				if (!result.ok) throw new Error(`Unknown OIDC connection "${input.id}"`);
-				await this.persistProviders(result.config.providers);
+				await this.requireStore().remove(input.id);
+				this.activeProviders = this.activeProviders.filter((p) => p.id !== input.id);
 				this.rebuildInstances();
 				return { ok: true };
 			}
@@ -1251,22 +1255,9 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 	providersConfig() {
 		return { providers: this.activeProviders };
 	}
-	async loadPersistedProviders() {
-		const store = this.providerStore;
-		if (store !== null) {
-			const fromRecords = await store.listResolved();
-			if (fromRecords.length > 0) return fromRecords;
-		}
-		return this.config.providers;
-	}
-	async persistProviders(providers) {
-		this.activeProviders = [...providers];
-		const store = this.providerStore;
-		if (store !== null) {
-			await store.replaceAll(providers);
-			return;
-		}
-		await this.updateGlobalSettings({ providers: [...providers] });
+	requireStore() {
+		if (this.providerStore === null) throw new Error("auth-oidc: the records store is not ready");
+		return this.providerStore;
 	}
 	rebuildInstances() {
 		this.instances.clear();
@@ -1444,7 +1435,7 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 		if (!inst) throw new Error(`OIDC: provider "${providerId}" no longer configured`);
 		const doc = await this.getDiscovery(providerId);
 		const clientSecret = inst.config.clientSecret;
-		if (typeof clientSecret !== "string" || clientSecret.length === 0) throw new Error(`OIDC: client secret for "${providerId}" is unavailable`);
+		if (typeof clientSecret !== "string") throw new Error(`OIDC: client secret for "${providerId}" is unavailable`);
 		const tokenRes = await fetch(doc.token_endpoint, {
 			method: "POST",
 			headers: {
@@ -1456,7 +1447,7 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 				code,
 				redirect_uri: pending.redirectUri,
 				client_id: inst.config.clientId,
-				client_secret: clientSecret,
+				...clientSecret.length > 0 ? { client_secret: clientSecret } : {},
 				code_verifier: pending.codeVerifier
 			})
 		});

package/dist/oidc/auth-oidc.addon.mjs

@@ -1,4 +1,4 @@
-import { A as toSecretFieldView, C as SECRET_CLEAR, D as globalSecretScope, F as object, I as string, O as isSecretClear, S as RecordSecretUnavailableError, T as defineEntryKind, _ as requestMountPrefix, b as errMsg, c as authProviderCapability, d as loginMethodCapability, f as normalizeOrigin, g as pickRequestOrigin, h as parseAppPageLang, i as addonRoutesCapability, j as _enum, k as isSecretMarker, l as buildAddonRouteProvider, m as parseAppFlowRequest, n as APP_REFUSED_PATH, o as advertisedHubOrigins, p as oidcConnectionsCapability, r as SSO_STATE_COOKIE, s as appFlowLocation, t as APP_FLOW_DEFAULT_REDIRECT, u as claimedRequestOrigins, v as resolveIconKey, w as arrayItemFieldPath, x as BaseAddon } from "../dist-E4y3Hyed.mjs";
+import { A as _enum, C as arrayItemFieldPath, D as isSecretClear, E as globalSecretScope, F as string, O as isSecretMarker, P as object, S as RecordSecretUnavailableError, _ as requestMountPrefix, b as errMsg, c as authProviderCapability, d as loginMethodCapability, f as normalizeOrigin, g as pickRequestOrigin, h as parseAppPageLang, i as addonRoutesCapability, k as toSecretFieldView, l as buildAddonRouteProvider, m as parseAppFlowRequest, n as APP_REFUSED_PATH, o as advertisedHubOrigins, p as oidcConnectionsCapability, r as SSO_STATE_COOKIE, s as appFlowLocation, t as APP_FLOW_DEFAULT_REDIRECT, u as claimedRequestOrigins, v as resolveIconKey, w as defineEntryKind, x as BaseAddon } from "../dist-Dvcuof5S.mjs";
 import * as crypto$1 from "node:crypto";
 //#region ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
 var encoder = new TextEncoder(), decoder = new TextDecoder(), strictDecoder = new TextDecoder("utf-8", { fatal: !0 });
@@ -800,8 +800,7 @@ function findOidcProvider(config, id) {
 	return config.providers.find((p) => p.id === id) ?? null;
 }
 function connectionConfigured(row) {
-	const secret = typeof row.clientSecret === "string" ? row.clientSecret.trim() : "";
-	return row.clientId.trim() !== "" && secret !== "";
+	return row.clientId.trim() !== "";
 }
 function clientSecretView(clientSecret, secrets, connectionId) {
 	if (isSecretMarker(clientSecret)) return toSecretFieldView(clientSecret);
@@ -863,16 +862,6 @@ function updateOidcConnection(config, id, patch) {
 		clearClientSecret: patch.clearClientSecret === true
 	};
 }
-function deleteOidcConnection(config, id) {
-	if (!config.providers.some((p) => p.id === id)) return {
-		ok: false,
-		reason: "not-found"
-	};
-	return {
-		ok: true,
-		config: { providers: config.providers.filter((p) => p.id !== id) }
-	};
-}
 /** Map a wire `clientSecret` field into an update patch fragment. */
 function clientSecretPatchOf(value) {
 	if (value === void 0) return {};
@@ -893,7 +882,7 @@ var OidcProviderBodySchema = object({
 	icon: string(),
 	issuerUrl: string(),
 	clientId: string(),
-	clientSecret: string().meta({ secret: true }),
+	clientSecret: string().optional().meta({ secret: true }),
 	redirectUri: string(),
 	scopes: string(),
 	usernameClaim: usernameClaimSchema
@@ -913,6 +902,14 @@ function rowToProvider(id, data) {
 		id
 	};
 }
+/** The stored body of a row; an empty or non-text secret is left out. */
+function bodyOf(row) {
+	const { id: _id, clientSecret, ...rest } = row;
+	return typeof clientSecret === "string" && clientSecret !== "" ? {
+		...rest,
+		clientSecret
+	} : rest;
+}
 var OidcProviderStore = class OidcProviderStore {
 	kind;
 	constructor(kind) {
@@ -925,42 +922,60 @@ var OidcProviderStore = class OidcProviderStore {
 		const page = await this.kind.query({ limit: 1e3 });
 		const out = [];
 		for (const record of page.records) {
-			let data = record.data;
-			try {
-				const resolved = await this.kind.getResolved(record.id);
-				if (resolved !== null) data = resolved.data;
-			} catch (err) {
-				if (!(err instanceof RecordSecretUnavailableError)) throw err;
-			}
-			const parsed = OidcProviderBodySchema.safeParse(data);
-			if (!parsed.success) continue;
-			out.push(rowToProvider(record.id, parsed.data));
+			const row = await this.getResolved(record.id);
+			if (row !== null) out.push(row);
 		}
 		return out;
 	}
-	async replaceAll(providers) {
-		const page = await this.kind.query({ limit: 1e3 });
-		const nextIds = new Set(providers.map((p) => p.id));
-		for (const row of page.records) if (!nextIds.has(row.id)) await this.kind.delete(row.id);
-		for (const row of providers) {
-			const { id, displayName, icon, issuerUrl, clientId, clientSecret, redirectUri, scopes, usernameClaim } = row;
-			const body = {
-				displayName,
-				icon,
-				issuerUrl,
-				clientId,
-				clientSecret,
-				redirectUri,
-				scopes,
-				usernameClaim
+	/** One row with its secret resolved for the runtime token call; null when absent. */
+	async getResolved(id) {
+		let record;
+		try {
+			record = await this.kind.getResolved(id);
+		} catch (err) {
+			if (!(err instanceof RecordSecretUnavailableError)) throw err;
+			const stored = await this.kind.get(id);
+			if (stored === null) return null;
+			const { clientSecret: _unreadable, ...rest } = stored.data;
+			record = {
+				...stored,
+				data: rest
 			};
-			const parsed = oidcProviderEntryKind.schema.safeParse(body);
-			if (!parsed.success) throw new Error(`invalid OIDC provider '${id}': ${parsed.error.message}`);
-			await this.kind.put({
-				id,
-				data: parsed.data
-			});
 		}
+		if (record === null) return null;
+		const parsed = OidcProviderBodySchema.safeParse(record.data);
+		return parsed.success ? rowToProvider(id, parsed.data) : null;
+	}
+	/**
+	* Insert ONE new row (`ifRev: 0`: an existing id is refused). A plaintext
+	* `clientSecret` is stored by the records facade under the row's own ref.
+	*/
+	async create(row) {
+		const body = bodyOf(row);
+		const parsed = OidcProviderBodySchema.safeParse(body);
+		if (!parsed.success) throw new Error(`invalid OIDC provider '${row.id}': ${parsed.error.message}`);
+		await this.kind.put({
+			id: row.id,
+			data: parsed.data
+		}, { ifRev: 0 });
+		return this.requireRow(row.id);
+	}
+	/**
+	* Merge a partial into ONE row. `clientSecret`: a plaintext sets it, `undefined`
+	* keeps the stored one, `null` clears it.
+	*/
+	async update(id, partial) {
+		await this.kind.patch(id, partial);
+		return this.requireRow(id);
+	}
+	/** Delete one provider record; no other row (nor its secrets) is touched. */
+	async remove(id) {
+		await this.kind.delete(id);
+	}
+	async requireRow(id) {
+		const row = await this.getResolved(id);
+		if (row === null) throw new Error(`OIDC provider '${id}' is not readable after the write`);
+		return row;
 	}
 };
 //#endregion
@@ -1065,7 +1080,7 @@ var AuthOidcAddon = class extends BaseAddon {
 		super({ ...DEFAULT_CONFIG });
 	}
 	async onConfigChanged() {
-		this.activeProviders = await this.loadPersistedProviders();
+		if (this.providerStore !== null) this.activeProviders = await this.providerStore.listResolved();
 		this.rebuildInstances();
 	}
 	async onInitialize() {
@@ -1073,16 +1088,7 @@ var AuthOidcAddon = class extends BaseAddon {
 		if (records === void 0) throw new Error("auth-oidc: ctx.records is required (hub-only addon)");
 		await records.declare({ "oidc-provider": oidcProviderEntryKind });
 		this.providerStore = OidcProviderStore.of(records);
-		this.activeProviders = await this.loadPersistedProviders();
-		if ((await this.providerStore.listResolved()).length === 0 && this.config.providers.length > 0) try {
-			await this.providerStore.replaceAll(this.config.providers);
-			this.activeProviders = await this.loadPersistedProviders();
-		} catch (err) {
-			const msg = err instanceof Error ? err.message : String(err);
-			if (!msg.startsWith("records/foreign-marker:")) throw err;
-			this.ctx.logger.warn("OIDC: deferred config→records copy (a secret marker is bound to another row)", { meta: { error: msg } });
-			this.activeProviders = [...this.config.providers];
-		}
+		this.activeProviders = await this.providerStore.listResolved();
 		this.rebuildInstances();
 		const authProvider = {
 			validateCredentials: async () => null,
@@ -1168,7 +1174,10 @@ var AuthOidcAddon = class extends BaseAddon {
 			createConnection: async (input) => {
 				const result = createOidcConnection(this.providersConfig(), input);
 				if (!result.ok) throw new Error(result.reason === "duplicate-id" ? `An OIDC connection with id "${input.id}" already exists` : `Invalid connection id "${input.id}" — use a lowercase slug`);
-				await this.persistProviders(result.config.providers);
+				const row = result.config.providers.find((p) => p.id === result.id);
+				if (row === void 0) throw new Error(`Invalid connection id "${input.id}"`);
+				const stored = await this.requireStore().create(row);
+				this.activeProviders = [...this.activeProviders, stored];
 				this.rebuildInstances();
 				return { id: result.id };
 			},
@@ -1185,26 +1194,21 @@ var AuthOidcAddon = class extends BaseAddon {
 					...input.usernameClaim !== void 0 ? { usernameClaim: input.usernameClaim } : {}
 				});
 				if (!result.ok) throw new Error(`Unknown OIDC connection "${input.id}"`);
-				if (result.clearClientSecret) {
-					const cleared = result.config.providers.map((p) => p.id === input.id ? {
-						...p,
-						clientSecret: SECRET_CLEAR
-					} : p);
-					await this.persistProviders(cleared);
-				} else await this.persistProviders(result.config.providers);
+				const next = result.config.providers.find((p) => p.id === input.id);
+				if (next === void 0) throw new Error(`Unknown OIDC connection "${input.id}"`);
+				const { id: _id, clientSecret: _carried, ...fields } = next;
+				const stored = await this.requireStore().update(input.id, {
+					...fields,
+					...result.clearClientSecret ? { clientSecret: null } : secretPatch.clientSecret !== void 0 ? { clientSecret: secretPatch.clientSecret } : {}
+				});
+				this.activeProviders = this.activeProviders.map((p) => p.id === input.id ? stored : p);
 				this.rebuildInstances();
 				return { ok: true };
 			},
 			deleteConnection: async (input) => {
 				if (findOidcProvider(this.providersConfig(), input.id) === null) throw new Error(`Unknown OIDC connection "${input.id}"`);
-				const cleared = this.activeProviders.map((p) => p.id === input.id ? {
-					...p,
-					clientSecret: SECRET_CLEAR
-				} : p);
-				await this.persistProviders(cleared);
-				const result = deleteOidcConnection(this.providersConfig(), input.id);
-				if (!result.ok) throw new Error(`Unknown OIDC connection "${input.id}"`);
-				await this.persistProviders(result.config.providers);
+				await this.requireStore().remove(input.id);
+				this.activeProviders = this.activeProviders.filter((p) => p.id !== input.id);
 				this.rebuildInstances();
 				return { ok: true };
 			}
@@ -1246,22 +1250,9 @@ var AuthOidcAddon = class extends BaseAddon {
 	providersConfig() {
 		return { providers: this.activeProviders };
 	}
-	async loadPersistedProviders() {
-		const store = this.providerStore;
-		if (store !== null) {
-			const fromRecords = await store.listResolved();
-			if (fromRecords.length > 0) return fromRecords;
-		}
-		return this.config.providers;
-	}
-	async persistProviders(providers) {
-		this.activeProviders = [...providers];
-		const store = this.providerStore;
-		if (store !== null) {
-			await store.replaceAll(providers);
-			return;
-		}
-		await this.updateGlobalSettings({ providers: [...providers] });
+	requireStore() {
+		if (this.providerStore === null) throw new Error("auth-oidc: the records store is not ready");
+		return this.providerStore;
 	}
 	rebuildInstances() {
 		this.instances.clear();
@@ -1439,7 +1430,7 @@ var AuthOidcAddon = class extends BaseAddon {
 		if (!inst) throw new Error(`OIDC: provider "${providerId}" no longer configured`);
 		const doc = await this.getDiscovery(providerId);
 		const clientSecret = inst.config.clientSecret;
-		if (typeof clientSecret !== "string" || clientSecret.length === 0) throw new Error(`OIDC: client secret for "${providerId}" is unavailable`);
+		if (typeof clientSecret !== "string") throw new Error(`OIDC: client secret for "${providerId}" is unavailable`);
 		const tokenRes = await fetch(doc.token_endpoint, {
 			method: "POST",
 			headers: {
@@ -1451,7 +1442,7 @@ var AuthOidcAddon = class extends BaseAddon {
 				code,
 				redirect_uri: pending.redirectUri,
 				client_id: inst.config.clientId,
-				client_secret: clientSecret,
+				...clientSecret.length > 0 ? { client_secret: clientSecret } : {},
 				code_verifier: pending.codeVerifier
 			})
 		});

package/dist/webauthn/_stub.js

@@ -1,6 +1,6 @@
 import { n as e, r as t, t as n } from "./_virtual_mf___mfe_internal__addon_auth_webauthn_widgets__loadShare__react__loadShare__.js-BIIa6vDX.mjs";
 import { n as r, t as i } from "./_virtual_mf___mfe_internal__addon_auth_webauthn_widgets__loadShare___mf_0_tanstack_mf_1_react_mf_2_query__loadShare__.js-CQ-aEQ9b.mjs";
-import { n as a, t as o } from "./_virtual_mf___mfe_internal__addon_auth_webauthn_widgets__loadShare___mf_0_camstack_mf_1_ui_mf_2_library__loadShare__.js-CjbhzhqS.mjs";
+import { n as a, t as o } from "./_virtual_mf___mfe_internal__addon_auth_webauthn_widgets__loadShare___mf_0_camstack_mf_1_ui_mf_2_library__loadShare__.js-CQJ6wKXR.mjs";
 import { n as s, r as c, t as l } from "./_virtual_mf___mfe_internal__addon_auth_webauthn_widgets__loadShare__react_mf_1_jsx_mf_2_runtime__loadShare__.js-BL2etuqg.mjs";
 //#region ../../node_modules/lucide-react/dist/esm/shared/src/utils/mergeClasses.js
 var u = (...e) => e.filter((e, t, n) => !!e && e.trim() !== "" && n.indexOf(e) === t).join(" ").trim(), d = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase(), f = (e) => e.replace(/^([A-Z])|[\s-_]+(\w)/g, (e, t, n) => n ? n.toUpperCase() : t.toLowerCase()), p = (e) => {

package/dist/webauthn/{_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-Dbb4FfU4.mjs → _virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-U5-CdChb.mjs}

@@ -18,7 +18,7 @@ var e = {
 	},
 	"@camstack/types": {
 		name: "@camstack/types",
-		version: "1.2.428",
+		version: "1.2.452",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",
@@ -33,7 +33,7 @@ var e = {
 	},
 	"@camstack/ui-library": {
 		name: "@camstack/ui-library",
-		version: "1.2.337",
+		version: "1.2.357",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",