@crombolo/server 0.13.2 → 0.14.1

package/src/config.ts

@@ -7,6 +7,7 @@ import type { AssistantConfig } from './assistant.ts'
 import type { ServerBundle } from './bundles.ts'
 import type { EmailPort } from './email.ts'
 import type { GitConfig } from './git-routes.ts'
+import { checkIdentityProviders, type IdentityProvider } from './identity-providers.ts'
 import type { MediaStore } from './media-store.ts'
 import type { SchemaStore } from './schema-store.ts'
 
@@ -232,6 +233,14 @@ export interface CromboloConfig {
   memberSessionMinutes: number
   /** Failed sign-ins that lock a member out; Umbraco's default is 5. 0 never locks out. */
   maxFailedPasswordAttempts: number
+  /**
+   * Identity providers members may sign in with on the site: `entra()`,
+   * `awsIdentityCenter()`, `oidc()`. Separate from the backoffice's, so staff
+   * and members can sign in through different ones.
+   */
+  memberIdentityProviders: readonly IdentityProvider[]
+  /** Identity providers backoffice users may sign in with. `allowLocalLogin: false` makes them the only way in. */
+  backofficeIdentityProviders: readonly IdentityProvider[]
   /**
    * Redirects the site declares itself, built with `redirect()`. They are synced
    * into the database at boot, so the backoffice lists them beside the tracked
@@ -502,6 +511,9 @@ export function loadConfig(
     maxFailedPasswordAttempts: Number(
       Bun.env.CROMBOLO_MAX_FAILED_PASSWORD_ATTEMPTS ?? DEFAULTS.maxFailedPasswordAttempts,
     ),
+    // No environment variable: a provider is a preset, which is code.
+    memberIdentityProviders: [],
+    backofficeIdentityProviders: [],
     redirects: [],
     trackRedirects: Bun.env.CROMBOLO_TRACK_REDIRECTS !== 'false',
     applyBundleContentOnInstall: Bun.env.CROMBOLO_APPLY_BUNDLE_CONTENT !== 'false',
@@ -529,6 +541,8 @@ export function loadConfig(
     assistant: undefined,
   }
   const merged: CromboloConfig = { ...fromEnv, ...stripUndefined(overrides) }
+  checkIdentityProviders(merged.memberIdentityProviders, 'member')
+  checkIdentityProviders(merged.backofficeIdentityProviders, 'backoffice')
   // Field by field, so a site setting its title suffix keeps the environment's switches.
   merged.seo = { ...fromEnv.seo, ...stripUndefined(overrides.seo ?? {}) }
   merged.deliveryApi = {
@@ -618,4 +632,4 @@ export function describeDatabase(
   }
 }
 
-export const VERSION = '0.13.2'
+export const VERSION = '0.14.1'

package/src/delivery-members.ts

@@ -39,7 +39,7 @@ const tokenError = (error: string, description: string, status = 400) =>
     { error, error_description: description },
     {
       status,
-      headers: status === 401 ? { 'www-authenticate': 'Basic realm="Umbraco"' } : undefined,
+      headers: status === 401 ? { 'www-authenticate': 'Basic realm="Crombolo"' } : undefined,
     },
   )
 
@@ -83,7 +83,7 @@ export interface DeliveryMemberSecurity {
 export function createDeliveryMemberSecurity(options: {
   db: Db
   settings: DeliveryApiSettings
-  members: Pick<MemberAuth, 'resolve' | 'signOutCookie'>
+  members: Pick<MemberAuth, 'resolve' | 'signOutCookie' | 'externalSignInUrl'>
 }): DeliveryMemberSecurity {
   const { db, settings } = options
   const tokens = new DeliveryMemberTokenRepository(db)
@@ -175,6 +175,15 @@ export function createDeliveryMemberSecurity(options: {
 
     const signedIn = await options.members.resolve(request)
     if (!signedIn) {
+      // `identity_provider` names a member provider, as Umbraco's
+      // `UmbracoMembers.{id}` scheme or by its id: straight there, then back here.
+      const named = q('identity_provider').replace(/^UmbracoMembers\./i, '')
+      if (named) {
+        const external = options.members.externalSignInUrl(named, `${url.pathname}${url.search}`)
+        if (!external)
+          return local('invalid_request', "The specified 'identity_provider' is not configured.")
+        return new Response(null, { status: 302, headers: { location: external } })
+      }
       if (!code.loginPage)
         return local(
           'login_required',

package/src/external-sign-in.ts

@@ -0,0 +1,270 @@
+/**
+ * Signing in through an external identity provider (story 031), for members on
+ * the site and users in the backoffice alike: the browser leaves for the
+ * provider and comes back to a callback, which verifies who signed in, finds or
+ * links or creates their account, makes their groups follow the provider, and
+ * ends exactly as a password sign-in does. docs/operations.md.
+ *
+ *   GET {base}/{provider}?returnUrl=…   leave for the provider
+ *   GET {base}/{provider}/callback      come back from it
+ */
+import {
+  OidcClient,
+  OidcError,
+  type OidcIdentity,
+  readCookie,
+  readFlowState,
+  serializeCookie,
+  signFlowState,
+} from '@crombolo/auth'
+import { localReturnUrl } from '@crombolo/core'
+import {
+  type Db,
+  type ExternalLoginAudience,
+  ExternalLoginRepository,
+  ensureKeyValue,
+  externalLoginProvider,
+} from '@crombolo/data'
+import type { IdentityProvider } from './identity-providers.ts'
+
+/** A member or user, as far as signing in is concerned. */
+export interface ExternalAccount {
+  key: string
+  email: string
+  /** Member group names, or user group aliases. */
+  groups: readonly string[]
+}
+
+/** What a first sign-in through a provider comes to. Pure. */
+export type SignInDecision =
+  | { kind: 'signIn'; ownerKey: string }
+  | { kind: 'link'; ownerKey: string }
+  | { kind: 'create' }
+  | { kind: 'refuse'; reason: string }
+
+/**
+ * Who a provider's sign-in is, given who is already linked to it and who has
+ * its email. An account already linked signs in. Otherwise an account with the
+ * same email is linked only when the provider allows it and vouches for the
+ * email; it is never merged otherwise. Nobody at all is created, when allowed.
+ */
+export function decideSignIn(input: {
+  linked: string | undefined
+  sameEmail: string | undefined
+  identity: Pick<OidcIdentity, 'email' | 'emailVerified'>
+  provider: Pick<IdentityProvider, 'autoCreate' | 'linkByEmail' | 'emailsVerified'> & {
+    name: string
+  }
+}): SignInDecision {
+  const { linked, sameEmail, identity, provider } = input
+  if (linked) return { kind: 'signIn', ownerKey: linked }
+  if (!identity.email)
+    return { kind: 'refuse', reason: `${provider.name} did not say what your email address is.` }
+  if (sameEmail) {
+    const verified = identity.emailVerified || provider.emailsVerified
+    if (provider.linkByEmail && verified) return { kind: 'link', ownerKey: sameEmail }
+    return {
+      kind: 'refuse',
+      reason:
+        'An account with this email address already exists. Sign in the way you usually do, or ask for the two to be linked.',
+    }
+  }
+  if (!provider.autoCreate)
+    return { kind: 'refuse', reason: `No account here is linked to your ${provider.name} sign-in.` }
+  return { kind: 'create' }
+}
+
+/**
+ * An account's groups once the provider's claim is applied: the groups the
+ * mapping manages are made to match the claim, and every other group is kept.
+ * Pure.
+ */
+export function syncedGroups(
+  current: readonly string[],
+  claimValues: readonly string[],
+  map: Readonly<Record<string, string>>,
+): string[] {
+  const managed = new Set(Object.values(map).map((g) => g.toLowerCase()))
+  const wanted = claimValues.flatMap((value) => (map[value] ? [map[value]] : []))
+  const kept = current.filter((group) => !managed.has(group.toLowerCase()))
+  const out: string[] = []
+  for (const group of [...kept, ...wanted])
+    if (!out.some((g) => g.toLowerCase() === group.toLowerCase())) out.push(group)
+  return out
+}
+
+/** What one audience — members or users — does at each step. */
+export interface ExternalSignInAudience {
+  audience: ExternalLoginAudience
+  providers: readonly IdentityProvider[]
+  /** Where the routes answer: `{base}/{provider}` and `{base}/{provider}/callback`. */
+  basePath: string
+  byKey(key: string): Promise<ExternalAccount | undefined>
+  byEmail(email: string): Promise<ExternalAccount | undefined>
+  create(
+    identity: OidcIdentity,
+    provider: IdentityProvider,
+    groups: string[],
+  ): Promise<ExternalAccount>
+  setGroups(account: ExternalAccount, groups: string[]): Promise<void>
+  /** Signs the account in: the cookies to set, or why it may not. */
+  signIn(
+    account: ExternalAccount,
+    request: Request,
+  ): Promise<{ cookies: string[] } | { refused: string }>
+  /** Where a sign-in goes back to when it fails, with the reason to show. */
+  failed(returnUrl: string, reason: string): string
+}
+
+export interface ExternalSignIn {
+  /** The provider URL to start a sign-in, for a link or button. */
+  startUrl(providerId: string, returnUrl?: string): string
+  handle(request: Request, pathname: string): Promise<Response | undefined>
+}
+
+const FLOW_KEY = 'crombolo/externalLoginKey'
+
+export function createExternalSignIn(
+  db: Db,
+  audience: ExternalSignInAudience,
+  options: {
+    applicationUrl: string
+    secureCookies: boolean
+    log?: (message: string) => void
+    /** The provider as a sign-in uses it, with an administrator's overrides on top (story 033). */
+    resolve?: (provider: IdentityProvider) => Promise<IdentityProvider>
+  },
+): ExternalSignIn {
+  const logins = new ExternalLoginRepository(db)
+  // One client per effective configuration, so discovery stays cached until a
+  // setting changes, and a changed one is used at once.
+  const clients = new Map<string, OidcClient>()
+  const clientFor = (provider: IdentityProvider) => {
+    const key = JSON.stringify(provider.oidc)
+    let client = clients.get(key)
+    if (!client) {
+      client = new OidcClient(provider.oidc)
+      clients.set(key, client)
+    }
+    return client
+  }
+  const byId = new Map(audience.providers.map((provider) => [provider.oidc.id, provider]))
+  let key: Promise<string> | undefined
+  const secret = () => {
+    key ??= ensureKeyValue(db, FLOW_KEY, () => crypto.randomUUID())
+    return key
+  }
+  const flowCookie = `crombolo-external-${audience.audience}`
+  const originOf = (request: Request) =>
+    (options.applicationUrl || new URL(request.url).origin).replace(/\/$/, '')
+  const callbackUrl = (request: Request, id: string) =>
+    `${originOf(request)}${audience.basePath}/${id}/callback`
+  const redirect = (location: string, cookies: string[] = []) => {
+    const headers = new Headers({ location })
+    for (const cookie of cookies) headers.append('set-cookie', cookie)
+    return new Response(null, { status: 302, headers })
+  }
+  // Lax (as every cookie here is), not Strict: the provider sends the browser
+  // back with a top-level GET, which a Strict cookie would not ride along on.
+  const flowCookieValue = (value: string, maxAgeSeconds: number) =>
+    serializeCookie({
+      name: flowCookie,
+      value,
+      secure: options.secureCookies,
+      maxAgeSeconds,
+      path: audience.basePath,
+    })
+
+  const start = async (request: Request, provider: IdentityProvider, client: OidcClient) => {
+    const returnUrl = localReturnUrl(new URL(request.url).searchParams.get('returnUrl')) ?? '/'
+    try {
+      const { url, flow } = await client.start(callbackUrl(request, provider.oidc.id), returnUrl)
+      return redirect(url, [flowCookieValue(await signFlowState(await secret(), flow), 600)])
+    } catch (error) {
+      options.log?.(`${provider.oidc.name} sign-in could not start: ${(error as Error).message}`)
+      return redirect(
+        audience.failed(returnUrl, `${provider.oidc.name} is not reachable right now.`),
+      )
+    }
+  }
+
+  const finish = async (request: Request, provider: IdentityProvider, client: OidcClient) => {
+    const clear = flowCookieValue('', 0)
+    const flow = await readFlowState(await secret(), readCookie(request, flowCookie))
+    if (!flow || flow.provider !== provider.oidc.id)
+      return redirect(
+        audience.failed('/', 'That sign-in took too long, or was not started here. Try again.'),
+        [clear],
+      )
+    const back = (reason: string) => redirect(audience.failed(flow.returnUrl, reason), [clear])
+    let identity: OidcIdentity
+    try {
+      identity = await client.finish(
+        new URL(request.url),
+        flow,
+        callbackUrl(request, provider.oidc.id),
+      )
+    } catch (error) {
+      if (!(error instanceof OidcError)) throw error
+      options.log?.(error.message)
+      return back(`Signing in with ${provider.oidc.name} did not work.`)
+    }
+
+    const loginProvider = externalLoginProvider(audience.audience, provider.oidc.id)
+    const linked = await logins.find(loginProvider, identity.subject)
+    // A link to an account that has since been deleted counts for nothing.
+    const linkedAccount = linked ? await audience.byKey(linked.ownerKey) : undefined
+    const sameEmail =
+      !linkedAccount && identity.email ? await audience.byEmail(identity.email) : undefined
+    const decision = decideSignIn({
+      linked: linkedAccount?.key,
+      sameEmail: sameEmail?.key,
+      identity,
+      provider: { ...provider, name: provider.oidc.name },
+    })
+    let account: ExternalAccount
+    switch (decision.kind) {
+      case 'refuse':
+        return back(decision.reason)
+      case 'signIn':
+        account = linkedAccount as ExternalAccount
+        break
+      case 'link':
+        account = sameEmail as ExternalAccount
+        await logins.link(account.key, loginProvider, identity.subject)
+        break
+      case 'create': {
+        const groups = syncedGroups(provider.defaultGroups, identity.groups, provider.groupMap)
+        account = await audience.create(identity, provider, groups)
+        await logins.link(account.key, loginProvider, identity.subject)
+        break
+      }
+    }
+    if (decision.kind !== 'create' && Object.keys(provider.groupMap).length > 0) {
+      const groups = syncedGroups(account.groups, identity.groups, provider.groupMap)
+      if (groups.join('\n') !== account.groups.join('\n')) await audience.setGroups(account, groups)
+    }
+    const signedIn = await audience.signIn(account, request)
+    if ('refused' in signedIn) return back(signedIn.refused)
+    return redirect(flow.returnUrl, [clear, ...signedIn.cookies])
+  }
+
+  return {
+    startUrl(providerId, returnUrl) {
+      const query = returnUrl ? `?returnUrl=${encodeURIComponent(returnUrl)}` : ''
+      return `${audience.basePath}/${providerId}${query}`
+    },
+    async handle(request, pathname) {
+      if (!pathname.startsWith(`${audience.basePath}/`)) return undefined
+      const [id, step, ...rest] = pathname.slice(audience.basePath.length + 1).split('/')
+      const declared = id ? byId.get(id) : undefined
+      if (!declared || rest.length > 0) return undefined
+      if (request.method !== 'GET') return new Response(null, { status: 405 })
+      const provider = options.resolve ? await options.resolve(declared) : declared
+      const client = clientFor(provider)
+      if (step === undefined || step === '') return start(request, provider, client)
+      if (step === 'callback') return finish(request, provider, client)
+      return undefined
+    },
+  }
+}

package/src/identity-provider-overrides.ts

@@ -0,0 +1,283 @@
+/**
+ * Settings an administrator changed for an identity provider the config
+ * declares (story 033): kept in `key_value`, one row per provider and audience,
+ * with the client secret sealed by `CROMBOLO_SECRET_KEY`. The config's preset is
+ * the provider; these are only the fields changed, put on top of it at every
+ * sign-in, so a change reaches every node with nothing to invalidate.
+ */
+import type { Db, ExternalLoginAudience } from '@crombolo/data'
+import { entraIssuer, type IdentityProvider } from './identity-providers.ts'
+import { openSecret, SECRET_KEY_VARIABLE, sealSecret, usableSecretKey } from './secrets.ts'
+
+/** The fields an override may change. */
+export interface ProviderOverrides {
+  name?: string
+  tenantId?: string
+  issuer?: string
+  clientId?: string
+  autoCreate?: boolean
+  linkByEmail?: boolean
+  emailsVerified?: boolean
+  groupMap?: Record<string, string>
+  defaultGroups?: string[]
+}
+
+/** What an administrator sends: the fields to change, and a client secret to set (`null` clears it). */
+export interface ProviderOverrideInput extends ProviderOverrides {
+  clientSecret?: string | null
+}
+
+interface Stored extends ProviderOverrides {
+  clientSecretSealed?: string
+}
+
+const OVERRIDABLE: readonly (keyof ProviderOverrides)[] = [
+  'name',
+  'tenantId',
+  'issuer',
+  'clientId',
+  'autoCreate',
+  'linkByEmail',
+  'emailsVerified',
+  'groupMap',
+  'defaultGroups',
+]
+
+const keyOf = (audience: ExternalLoginAudience, id: string) =>
+  `crombolo:identity-provider:${audience}:${id}`
+
+/** The provider the config declares, with an administrator's changes on top. Pure. */
+export function effectiveProvider(
+  code: IdentityProvider,
+  overrides: ProviderOverrides & { clientSecret?: string },
+): IdentityProvider {
+  const tenantId = overrides.tenantId ?? code.tenantId
+  const issuer =
+    overrides.issuer ??
+    (code.kind === 'entra' && overrides.tenantId
+      ? entraIssuer(overrides.tenantId)
+      : code.oidc.issuer)
+  return {
+    ...code,
+    ...(tenantId ? { tenantId } : {}),
+    oidc: {
+      ...code.oidc,
+      name: overrides.name ?? code.oidc.name,
+      issuer,
+      clientId: overrides.clientId ?? code.oidc.clientId,
+      clientSecret: overrides.clientSecret ?? code.oidc.clientSecret,
+    },
+    autoCreate: overrides.autoCreate ?? code.autoCreate,
+    linkByEmail: overrides.linkByEmail ?? code.linkByEmail,
+    emailsVerified: overrides.emailsVerified ?? code.emailsVerified,
+    groupMap: overrides.groupMap ?? code.groupMap,
+    defaultGroups: overrides.defaultGroups ?? code.defaultGroups,
+  }
+}
+
+export class IdentityProviderOverrides {
+  #db: Db
+  #secretKey: string | undefined
+
+  constructor(db: Db, secretKey: string | undefined) {
+    this.#db = db
+    this.#secretKey = usableSecretKey(secretKey)
+  }
+
+  async #read(audience: ExternalLoginAudience, id: string): Promise<Stored> {
+    const rows = await this.#db.query<{ value: string | null }>(
+      'SELECT value FROM key_value WHERE key = ?',
+      [keyOf(audience, id)],
+    )
+    try {
+      return rows[0]?.value ? (JSON.parse(rows[0].value) as Stored) : {}
+    } catch {
+      return {}
+    }
+  }
+
+  /** The fields changed, with whether a client secret is kept here; never the secret itself. */
+  async get(
+    audience: ExternalLoginAudience,
+    id: string,
+  ): Promise<{ overrides: ProviderOverrides; hasClientSecret: boolean }> {
+    const { clientSecretSealed, ...overrides } = await this.#read(audience, id)
+    return { overrides, hasClientSecret: Boolean(clientSecretSealed) }
+  }
+
+  /** A provider as a sign-in uses it: the config's, with the changes and a kept secret on top. */
+  async apply(audience: ExternalLoginAudience, code: IdentityProvider): Promise<IdentityProvider> {
+    const { clientSecretSealed, ...overrides } = await this.#read(audience, code.oidc.id)
+    if (Object.keys(overrides).length === 0 && !clientSecretSealed) return code
+    let clientSecret: string | undefined
+    if (clientSecretSealed && this.#secretKey) {
+      try {
+        clientSecret = openSecret(clientSecretSealed, this.#secretKey)
+      } catch {
+        clientSecret = undefined
+      }
+    }
+    return effectiveProvider(code, { ...overrides, clientSecret })
+  }
+
+  /** Changes some fields. An empty string or an empty value clears a field back to the config's. */
+  async update(
+    audience: ExternalLoginAudience,
+    id: string,
+    input: ProviderOverrideInput,
+  ): Promise<{ ok: true } | { ok: false; error: string }> {
+    const stored = await this.#read(audience, id)
+    for (const field of OVERRIDABLE) {
+      if (!(field in input)) continue
+      const value = input[field]
+      if (value === undefined || value === null || value === '') delete stored[field]
+      else (stored as Record<string, unknown>)[field] = value
+    }
+    if (input.clientSecret === null || input.clientSecret === '') delete stored.clientSecretSealed
+    else if (typeof input.clientSecret === 'string') {
+      if (!this.#secretKey)
+        return {
+          ok: false,
+          error: `Keeping a client secret here needs ${SECRET_KEY_VARIABLE} set on the server.`,
+        }
+      stored.clientSecretSealed = sealSecret(input.clientSecret, this.#secretKey)
+    }
+    await this.#write(audience, id, stored)
+    return { ok: true }
+  }
+
+  /** Puts a provider back to what the config says. */
+  async reset(audience: ExternalLoginAudience, id: string): Promise<void> {
+    await this.#db.exec('DELETE FROM key_value WHERE key = ?', [keyOf(audience, id)])
+  }
+
+  async #write(audience: ExternalLoginAudience, id: string, stored: Stored): Promise<void> {
+    const key = keyOf(audience, id)
+    const now = this.#db.dialect.now()
+    if (Object.keys(stored).length === 0) {
+      await this.#db.exec('DELETE FROM key_value WHERE key = ?', [key])
+      return
+    }
+    const value = JSON.stringify(stored)
+    const updated = await this.#db.query<{ key: string }>(
+      `UPDATE key_value SET value = ?, update_date = ${now} WHERE key = ? RETURNING key`,
+      [value, key],
+    )
+    if (updated.length === 0)
+      await this.#db.exec(`INSERT INTO key_value (key, value, update_date) VALUES (?, ?, ${now})`, [
+        key,
+        value,
+      ])
+  }
+}
+
+/** A provider as a bundle sees it: its effective settings and which of them were changed. */
+export interface BundleIdentityProvider {
+  audience: ExternalLoginAudience
+  id: string
+  kind: IdentityProvider['kind']
+  name: string
+  tenantId: string | null
+  issuer: string
+  clientId: string
+  /** Whether there is a client secret, from the config or kept here. Never the secret. */
+  hasClientSecret: boolean
+  autoCreate: boolean
+  linkByEmail: boolean
+  emailsVerified: boolean
+  groupMap: Record<string, string>
+  defaultGroups: string[]
+  /** The fields an administrator changed, `clientSecret` among them when one is kept here. */
+  overridden: string[]
+  /** The path to register with the provider as the redirect URL, after the site's address. */
+  callbackPath: string
+}
+
+/** The `identityProviders` bundle capability (story 033): edit, never declare. */
+export interface BundleIdentityProviders {
+  list(): Promise<BundleIdentityProvider[]>
+  update(
+    audience: ExternalLoginAudience,
+    id: string,
+    input: ProviderOverrideInput,
+  ): Promise<{ ok: true } | { ok: false; error: string }>
+  reset(audience: ExternalLoginAudience, id: string): Promise<boolean>
+  /** Whether the provider's discovery document answers, with what it says if not. */
+  test(audience: ExternalLoginAudience, id: string): Promise<{ ok: boolean; message: string }>
+  /** The groups a mapping can name: user groups by alias, member groups by name. */
+  groups(audience: ExternalLoginAudience): Promise<Array<{ value: string; name: string }>>
+}
+
+export function createBundleIdentityProviders(options: {
+  overrides: IdentityProviderOverrides
+  members: readonly IdentityProvider[]
+  backoffice: readonly IdentityProvider[]
+  memberCallbackPath: string
+  backofficeCallbackPath: string
+  groups(audience: ExternalLoginAudience): Promise<Array<{ value: string; name: string }>>
+}): BundleIdentityProviders {
+  const declared = (audience: ExternalLoginAudience, id: string) =>
+    (audience === 'member' ? options.members : options.backoffice).find((p) => p.oidc.id === id)
+
+  const describe = async (
+    audience: ExternalLoginAudience,
+    code: IdentityProvider,
+  ): Promise<BundleIdentityProvider> => {
+    const effective = await options.overrides.apply(audience, code)
+    const { overrides, hasClientSecret } = await options.overrides.get(audience, code.oidc.id)
+    const base = audience === 'member' ? options.memberCallbackPath : options.backofficeCallbackPath
+    return {
+      audience,
+      id: code.oidc.id,
+      kind: code.kind,
+      name: effective.oidc.name,
+      tenantId: effective.tenantId ?? null,
+      issuer: effective.oidc.issuer,
+      clientId: effective.oidc.clientId,
+      hasClientSecret: Boolean(effective.oidc.clientSecret),
+      autoCreate: effective.autoCreate,
+      linkByEmail: effective.linkByEmail,
+      emailsVerified: effective.emailsVerified,
+      groupMap: { ...effective.groupMap },
+      defaultGroups: [...effective.defaultGroups],
+      overridden: [...Object.keys(overrides), ...(hasClientSecret ? ['clientSecret'] : [])],
+      callbackPath: `${base}/${code.oidc.id}/callback`,
+    }
+  }
+
+  return {
+    async list() {
+      return Promise.all([
+        ...options.members.map((p) => describe('member', p)),
+        ...options.backoffice.map((p) => describe('user', p)),
+      ])
+    },
+    async update(audience, id, input) {
+      if (!declared(audience, id))
+        return { ok: false, error: 'The config declares no such identity provider.' }
+      return options.overrides.update(audience, id, input)
+    },
+    async reset(audience, id) {
+      if (!declared(audience, id)) return false
+      await options.overrides.reset(audience, id)
+      return true
+    },
+    groups: (audience) => options.groups(audience),
+    async test(audience, id) {
+      const code = declared(audience, id)
+      if (!code) return { ok: false, message: 'The config declares no such identity provider.' }
+      const effective = await options.overrides.apply(audience, code)
+      const url = `${effective.oidc.issuer.replace(/\/$/, '')}/.well-known/openid-configuration`
+      try {
+        const response = await fetch(url, { headers: { accept: 'application/json' } })
+        if (!response.ok) return { ok: false, message: `${url} answered ${response.status}.` }
+        const document = (await response.json()) as { authorization_endpoint?: unknown }
+        return typeof document.authorization_endpoint === 'string'
+          ? { ok: true, message: `${effective.oidc.name} answered at ${effective.oidc.issuer}.` }
+          : { ok: false, message: `${url} is not an OpenID Connect discovery document.` }
+      } catch (error) {
+        return { ok: false, message: `${url} could not be reached: ${(error as Error).message}` }
+      }
+    },
+  }
+}