@code-rag/core 0.1.0

package/dist/auth/oidc-provider.js

@@ -0,0 +1,358 @@
+import { ok, err } from 'neverthrow';
+import { createVerify } from 'node:crypto';
+import { AuthError } from './types.js';
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/** Decode a Base64-URL string (no padding) to a standard Base64 string. */
+function base64UrlToBase64(input) {
+    let base64 = input.replace(/-/g, '+').replace(/_/g, '/');
+    const pad = base64.length % 4;
+    if (pad === 2)
+        base64 += '==';
+    else if (pad === 3)
+        base64 += '=';
+    return base64;
+}
+/** Decode a Base64-URL string to a Buffer. */
+function base64UrlToBuffer(input) {
+    return Buffer.from(base64UrlToBase64(input), 'base64');
+}
+/** Parse a JSON string safely, returning `undefined` on failure. */
+function safeJsonParse(raw) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+}
+// ---------------------------------------------------------------------------
+// OIDCProvider
+// ---------------------------------------------------------------------------
+/**
+ * OIDC-based `AuthProvider` that validates JWT access/id-tokens using the
+ * provider's published JWKS.
+ *
+ * Supports Azure AD, Okta, Google Workspace and any standards-compliant
+ * OpenID Connect provider.
+ */
+export class OIDCProvider {
+    name = 'oidc';
+    config;
+    discovery;
+    jwks;
+    /** Users whose info has been fetched (in-memory cache). */
+    userCache = new Map();
+    /**
+     * Pluggable `fetch` function — defaults to the global `fetch`.  Tests can
+     * inject a stub without monkey-patching globals.
+     */
+    fetchFn;
+    constructor(config, fetchFn) {
+        this.config = config;
+        this.fetchFn = fetchFn ?? globalThis.fetch;
+    }
+    // -----------------------------------------------------------------------
+    // Initialization
+    // -----------------------------------------------------------------------
+    /**
+     * Discovers OIDC endpoints from `.well-known/openid-configuration` and
+     * fetches the JWKS.
+     */
+    async initialize() {
+        const discoveryUrl = `${this.config.issuerUrl.replace(/\/$/, '')}/.well-known/openid-configuration`;
+        try {
+            const discResponse = await this.fetchFn(discoveryUrl);
+            if (!discResponse.ok) {
+                return err(new AuthError(`OIDC discovery failed: HTTP ${String(discResponse.status)}`));
+            }
+            this.discovery = (await discResponse.json());
+            const jwksResponse = await this.fetchFn(this.discovery.jwks_uri);
+            if (!jwksResponse.ok) {
+                return err(new AuthError(`JWKS fetch failed: HTTP ${String(jwksResponse.status)}`));
+            }
+            this.jwks = (await jwksResponse.json());
+            return ok(undefined);
+        }
+        catch (cause) {
+            const message = cause instanceof Error ? cause.message : 'Unknown error';
+            return err(new AuthError(`OIDC initialization error: ${message}`));
+        }
+    }
+    // -----------------------------------------------------------------------
+    // AuthProvider implementation
+    // -----------------------------------------------------------------------
+    async authenticate(token) {
+        return this.validateToken(token);
+    }
+    async getUserRoles(userId) {
+        const user = this.userCache.get(userId);
+        if (user) {
+            return ok(user.roles);
+        }
+        return ok(['viewer']);
+    }
+    async getUserRepos(userId) {
+        const user = this.userCache.get(userId);
+        if (user) {
+            return ok(user.allowedRepos);
+        }
+        return ok([]);
+    }
+    // -----------------------------------------------------------------------
+    // Token validation
+    // -----------------------------------------------------------------------
+    /**
+     * Validates a JWT (signature, expiry, audience, issuer) and returns the
+     * decoded `AuthToken`.
+     */
+    async validateToken(token) {
+        const parts = token.split('.');
+        if (parts.length !== 3) {
+            return err(new AuthError('Invalid JWT: expected 3 parts'));
+        }
+        const [headerB64, payloadB64, signatureB64] = parts;
+        // Decode header
+        const headerJson = base64UrlToBuffer(headerB64).toString('utf-8');
+        const header = safeJsonParse(headerJson);
+        if (!header) {
+            return err(new AuthError('Invalid JWT: malformed header'));
+        }
+        // Decode payload
+        const payloadJson = base64UrlToBuffer(payloadB64).toString('utf-8');
+        const payload = safeJsonParse(payloadJson);
+        if (!payload) {
+            return err(new AuthError('Invalid JWT: malformed payload'));
+        }
+        // Verify signature
+        const sigResult = this.verifySignature(`${headerB64}.${payloadB64}`, signatureB64, header);
+        if (sigResult.isErr()) {
+            return err(sigResult.error);
+        }
+        // Validate claims
+        const now = Math.floor(Date.now() / 1000);
+        const exp = typeof payload['exp'] === 'number' ? payload['exp'] : 0;
+        const iat = typeof payload['iat'] === 'number' ? payload['iat'] : 0;
+        if (exp <= now) {
+            return err(new AuthError('Token expired'));
+        }
+        const issuer = typeof payload['iss'] === 'string' ? payload['iss'] : '';
+        const expectedIssuer = this.discovery?.issuer ?? this.config.issuerUrl;
+        if (issuer !== expectedIssuer) {
+            return err(new AuthError(`Invalid issuer: expected ${expectedIssuer}, got ${issuer}`));
+        }
+        const audience = payload['aud'];
+        const audienceList = Array.isArray(audience) ? audience : [audience];
+        if (!audienceList.includes(this.config.audience)) {
+            return err(new AuthError(`Invalid audience: expected ${this.config.audience}`));
+        }
+        const sub = typeof payload['sub'] === 'string' ? payload['sub'] : '';
+        const email = typeof payload['email'] === 'string' ? payload['email'] : '';
+        const roles = this.mapRoles(payload);
+        const authToken = { userId: sub, email, roles, exp, iat };
+        return ok(authToken);
+    }
+    // -----------------------------------------------------------------------
+    // User info
+    // -----------------------------------------------------------------------
+    /**
+     * Fetches user info from the OIDC userinfo endpoint and caches it.
+     */
+    async getUserInfo(token) {
+        if (!this.discovery) {
+            return err(new AuthError('OIDC not initialized — call initialize() first'));
+        }
+        try {
+            const response = await this.fetchFn(this.discovery.userinfo_endpoint, {
+                headers: { Authorization: `Bearer ${token}` },
+            });
+            if (!response.ok) {
+                return err(new AuthError(`Userinfo request failed: HTTP ${String(response.status)}`));
+            }
+            const info = (await response.json());
+            const sub = typeof info['sub'] === 'string' ? info['sub'] : '';
+            const email = typeof info['email'] === 'string' ? info['email'] : '';
+            const name = typeof info['name'] === 'string' ? info['name'] : email;
+            const roles = this.mapRoles(info);
+            const user = {
+                id: sub,
+                email,
+                name,
+                roles,
+                allowedRepos: [],
+            };
+            this.userCache.set(sub, user);
+            return ok(user);
+        }
+        catch (cause) {
+            const message = cause instanceof Error ? cause.message : 'Unknown error';
+            return err(new AuthError(`Userinfo error: ${message}`));
+        }
+    }
+    // -----------------------------------------------------------------------
+    // Role mapping
+    // -----------------------------------------------------------------------
+    /**
+     * Maps OIDC claims / groups to CodeRAG roles.
+     *
+     * Checks `roles`, `groups` and `realm_access.roles` claims (covers Azure
+     * AD, Okta, Keycloak).  Falls back to `viewer` if no mapping matches.
+     */
+    mapRoles(claims) {
+        const mapping = this.config.roleMapping ?? {};
+        const claimValues = new Set();
+        // Collect candidate values from well-known claim names
+        for (const claimName of ['roles', 'groups']) {
+            const value = claims[claimName];
+            if (Array.isArray(value)) {
+                for (const v of value) {
+                    if (typeof v === 'string')
+                        claimValues.add(v);
+                }
+            }
+            if (typeof value === 'string')
+                claimValues.add(value);
+        }
+        // Keycloak: realm_access.roles
+        const realmAccess = claims['realm_access'];
+        if (realmAccess && typeof realmAccess === 'object' && !Array.isArray(realmAccess)) {
+            const ra = realmAccess;
+            const raRoles = ra['roles'];
+            if (Array.isArray(raRoles)) {
+                for (const v of raRoles) {
+                    if (typeof v === 'string')
+                        claimValues.add(v);
+                }
+            }
+        }
+        const roles = new Set();
+        for (const value of claimValues) {
+            const mapped = mapping[value];
+            if (mapped) {
+                roles.add(mapped);
+            }
+            // Also accept direct role names
+            if (value === 'admin' || value === 'developer' || value === 'viewer') {
+                roles.add(value);
+            }
+        }
+        if (roles.size === 0) {
+            return ['viewer'];
+        }
+        return [...roles];
+    }
+    // -----------------------------------------------------------------------
+    // Signature verification
+    // -----------------------------------------------------------------------
+    verifySignature(data, signatureB64Url, header) {
+        if (!this.jwks) {
+            return err(new AuthError('JWKS not loaded — call initialize() first'));
+        }
+        const alg = typeof header['alg'] === 'string' ? header['alg'] : '';
+        const kid = typeof header['kid'] === 'string' ? header['kid'] : undefined;
+        // Find matching key
+        let jwk;
+        if (kid) {
+            jwk = this.jwks.keys.find((k) => k.kid === kid);
+        }
+        if (!jwk) {
+            // Fallback: first sig key
+            jwk = this.jwks.keys.find((k) => k.use === 'sig' || k.use === undefined);
+        }
+        if (!jwk) {
+            return err(new AuthError('No suitable JWK found for token verification'));
+        }
+        // For RS256 with x5c certificate chain
+        if (alg === 'RS256' && jwk.x5c && jwk.x5c.length > 0) {
+            const cert = jwk.x5c[0];
+            if (!cert) {
+                return err(new AuthError('Empty x5c certificate chain'));
+            }
+            const pem = `-----BEGIN CERTIFICATE-----\n${cert}\n-----END CERTIFICATE-----`;
+            const signature = base64UrlToBuffer(signatureB64Url);
+            const verifier = createVerify('RSA-SHA256');
+            verifier.update(data);
+            const valid = verifier.verify(pem, signature);
+            if (!valid) {
+                return err(new AuthError('Invalid JWT signature'));
+            }
+            return ok(undefined);
+        }
+        // For RS256 with n/e (modulus/exponent)
+        if (alg === 'RS256' && jwk.n && jwk.e) {
+            const modulus = base64UrlToBuffer(jwk.n);
+            const exponent = base64UrlToBuffer(jwk.e);
+            const pem = rsaJwkToPem(modulus, exponent);
+            const signature = base64UrlToBuffer(signatureB64Url);
+            const verifier = createVerify('RSA-SHA256');
+            verifier.update(data);
+            const valid = verifier.verify(pem, signature);
+            if (!valid) {
+                return err(new AuthError('Invalid JWT signature'));
+            }
+            return ok(undefined);
+        }
+        return err(new AuthError(`Unsupported JWT algorithm or key type: ${alg}`));
+    }
+}
+// ---------------------------------------------------------------------------
+// RSA JWK → PEM conversion (DER encoding)
+// ---------------------------------------------------------------------------
+/**
+ * Converts RSA modulus + exponent to a PEM-encoded public key.
+ *
+ * This performs minimal ASN.1 DER encoding required for
+ * `crypto.createVerify` to consume the key.
+ */
+function rsaJwkToPem(modulus, exponent) {
+    // Ensure positive integers (prepend 0x00 if high bit set)
+    const mod = modulus[0] >= 0x80 ? Buffer.concat([Buffer.from([0x00]), modulus]) : modulus;
+    const exp = exponent[0] >= 0x80 ? Buffer.concat([Buffer.from([0x00]), exponent]) : exponent;
+    const modLen = derLength(mod.length);
+    const expLen = derLength(exp.length);
+    // SEQUENCE { INTEGER modulus, INTEGER exponent }
+    const rsaPubKeyBody = Buffer.concat([
+        Buffer.from([0x02]), modLen, mod,
+        Buffer.from([0x02]), expLen, exp,
+    ]);
+    const rsaPubKeySeq = Buffer.concat([
+        Buffer.from([0x30]), derLength(rsaPubKeyBody.length), rsaPubKeyBody,
+    ]);
+    // BIT STRING wrapping
+    const bitString = Buffer.concat([
+        Buffer.from([0x03]),
+        derLength(rsaPubKeySeq.length + 1),
+        Buffer.from([0x00]), // unused bits
+        rsaPubKeySeq,
+    ]);
+    // Algorithm identifier for rsaEncryption (OID 1.2.840.113549.1.1.1)
+    const algorithmIdentifier = Buffer.from([
+        0x30, 0x0d,
+        0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01,
+        0x05, 0x00,
+    ]);
+    // Outer SEQUENCE { AlgorithmIdentifier, BIT STRING }
+    const outer = Buffer.concat([
+        Buffer.from([0x30]),
+        derLength(algorithmIdentifier.length + bitString.length),
+        algorithmIdentifier,
+        bitString,
+    ]);
+    const b64 = outer.toString('base64');
+    const lines = [];
+    for (let i = 0; i < b64.length; i += 64) {
+        lines.push(b64.slice(i, i + 64));
+    }
+    return `-----BEGIN PUBLIC KEY-----\n${lines.join('\n')}\n-----END PUBLIC KEY-----`;
+}
+/** DER length encoding. */
+function derLength(len) {
+    if (len < 0x80) {
+        return Buffer.from([len]);
+    }
+    if (len < 0x100) {
+        return Buffer.from([0x81, len]);
+    }
+    return Buffer.from([0x82, (len >> 8) & 0xff, len & 0xff]);
+}

package/dist/auth/oidc-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-provider.js","sourceRoot":"","sources":["../../src/auth/oidc-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAe,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAS3C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,2EAA2E;AAC3E,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,CAAC;QAAE,MAAM,IAAI,IAAI,CAAC;SACzB,IAAI,GAAG,KAAK,CAAC;QAAE,MAAM,IAAI,GAAG,CAAC;IAClC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8CAA8C;AAC9C,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED,oEAAoE;AACpE,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAmBD,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,OAAO,YAAY;IACd,IAAI,GAAG,MAAM,CAAC;IAEN,MAAM,CAAa;IAC5B,SAAS,CAAoC;IAC7C,IAAI,CAAmB;IAE/B,2DAA2D;IAC1C,SAAS,GAAG,IAAI,GAAG,EAAgB,CAAC;IAErD;;;OAGG;IACc,OAAO,CAAe;IAEvC,YAAY,MAAkB,EAAE,OAAsB;QACpD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC;IAC7C,CAAC;IAED,0EAA0E;IAC1E,iBAAiB;IACjB,0EAA0E;IAE1E;;;OAGG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,YAAY,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC;QAEpG,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACtD,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;gBACrB,OAAO,GAAG,CACR,IAAI,SAAS,CAAC,+BAA+B,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAC5E,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,SAAS,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAA0B,CAAC;YAEtE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACjE,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;gBACrB,OAAO,GAAG,CACR,IAAI,SAAS,CAAC,2BAA2B,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CACxE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAS,CAAC;YAEhD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YAC3D,OAAO,GAAG,CAAC,IAAI,SAAS,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,8BAA8B;IAC9B,0EAA0E;IAE1E,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAU,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IAED,0EAA0E;IAC1E,mBAAmB;IACnB,0EAA0E;IAE1E;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,GAAG,CAAC,IAAI,SAAS,CAAC,+BAA+B,CAAC,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAiC,CAAC;QAEhF,gBAAgB;QAChB,MAAM,UAAU,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,GAAG,CAAC,IAAI,SAAS,CAAC,+BAA+B,CAAC,CAAC,CAAC;QAC7D,CAAC;QAED,iBAAiB;QACjB,MAAM,WAAW,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC,CAAC;QAC9D,CAAC;QAED,mBAAmB;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CACpC,GAAG,SAAS,IAAI,UAAU,EAAE,EAC5B,YAAY,EACZ,MAAM,CACP,CAAC;QACF,IAAI,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;YACtB,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QAED,kBAAkB;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEpE,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;YACf,OAAO,GAAG,CAAC,IAAI,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QACvE,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;YAC9B,OAAO,GAAG,CAAC,IAAI,SAAS,CAAC,4BAA4B,cAAc,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACrE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO,GAAG,CACR,IAAI,SAAS,CACX,8BAA8B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CACrD,CACF,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,MAAM,KAAK,GAAG,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAErC,MAAM,SAAS,GAAc,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QACrE,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;IAED,0EAA0E;IAC1E,YAAY;IACZ,0EAA0E;IAE1E;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,GAAG,CAAC,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE;gBACpE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;aAC9C,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,GAAG,CAAC,IAAI,SAAS,CAAC,iCAAiC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YACxF,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;YAChE,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACrE,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAElC,MAAM,IAAI,GAAS;gBACjB,EAAE,EAAE,GAAG;gBACP,KAAK;gBACL,IAAI;gBACJ,KAAK;gBACL,YAAY,EAAE,EAAE;aACjB,CAAC;YAEF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC9B,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACzE,OAAO,GAAG,CAAC,IAAI,SAAS,CAAC,mBAAmB,OAAO,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,eAAe;IACf,0EAA0E;IAE1E;;;;;OAKG;IACH,QAAQ,CAAC,MAAyC;QAChD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;QAC9C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QAEtC,uDAAuD;QACvD,KAAK,MAAM,SAAS,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;YAChC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;oBACtB,IAAI,OAAO,CAAC,KAAK,QAAQ;wBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAChD,CAAC;YACH,CAAC;YACD,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxD,CAAC;QAED,+BAA+B;QAC/B,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;QAC3C,IAAI,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAClF,MAAM,EAAE,GAAG,WAAsC,CAAC;YAClD,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;YAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,IAAI,OAAO,CAAC,KAAK,QAAQ;wBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAChD,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAQ,CAAC;QAC9B,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,MAAM,EAAE,CAAC;gBACX,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC;YACD,gCAAgC;YAChC,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACrE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC;QACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,0EAA0E;IAC1E,yBAAyB;IACzB,0EAA0E;IAElE,eAAe,CACrB,IAAY,EACZ,eAAuB,EACvB,MAAyC;QAEzC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,GAAG,CAAC,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE1E,oBAAoB;QACpB,IAAI,GAAoB,CAAC;QACzB,IAAI,GAAG,EAAE,CAAC;YACR,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,0BAA0B;YAC1B,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,CAC9C,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,GAAG,CAAC,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC,CAAC;QAC5E,CAAC;QAED,uCAAuC;QACvC,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,GAAG,CAAC,IAAI,SAAS,CAAC,6BAA6B,CAAC,CAAC,CAAC;YAC3D,CAAC;YACD,MAAM,GAAG,GAAG,gCAAgC,IAAI,6BAA6B,CAAC;YAC9E,MAAM,SAAS,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;YAErD,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;YAC5C,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACtB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,GAAG,CAAC,IAAI,SAAS,CAAC,uBAAuB,CAAC,CAAC,CAAC;YACrD,CAAC;YACD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC;QAED,wCAAwC;QACxC,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC3C,MAAM,SAAS,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;YAErD,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;YAC5C,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACtB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,GAAG,CAAC,IAAI,SAAS,CAAC,uBAAuB,CAAC,CAAC,CAAC;YACrD,CAAC;YACD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC;QAED,OAAO,GAAG,CAAC,IAAI,SAAS,CAAC,0CAA0C,GAAG,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC;CACF;AAED,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAS,WAAW,CAAC,OAAe,EAAE,QAAgB;IACpD,0DAA0D;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAE,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1F,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAE,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAE7F,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAErC,iDAAiD;IACjD,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG;QAChC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG;KACjC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,aAAa;KACpE,CAAC,CAAC;IAEH,sBAAsB;IACtB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QACnB,SAAS,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,cAAc;QACnC,YAAY;KACb,CAAC,CAAC;IAEH,oEAAoE;IACpE,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC;QACtC,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;QAChE,IAAI,EAAE,IAAI;KACX,CAAC,CAAC;IAEH,qDAAqD;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QACnB,SAAS,CAAC,mBAAmB,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QACxD,mBAAmB;QACnB,SAAS;KACV,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,+BAA+B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC;AACrF,CAAC;AAED,2BAA2B;AAC3B,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;QACf,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,GAAG,GAAG,KAAK,EAAE,CAAC;QAChB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;AAC5D,CAAC"}

package/dist/auth/oidc-provider.test.d.ts

@@ -0,0 +1 @@
+export {};