@crowi/plugin-api 1.0.0-alpha.5 → 1.0.0-alpha.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.mts +228 -27
- package/dist/index.d.ts +228 -27
- package/dist/index.js +125 -0
- package/dist/index.js.map +1 -1
- package/dist/index.mjs +113 -0
- package/dist/index.mjs.map +1 -1
- package/package.json +5 -4
package/dist/index.d.mts
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import { z } from 'zod/v3';
|
|
2
2
|
import { Readable } from 'node:stream';
|
|
3
|
+
import { Configuration } from 'openid-client';
|
|
3
4
|
import { Context } from 'hono';
|
|
4
5
|
|
|
5
6
|
/**
|
|
@@ -463,8 +464,8 @@ interface AuthProfile {
|
|
|
463
464
|
extra?: Record<string, unknown>;
|
|
464
465
|
}
|
|
465
466
|
/**
|
|
466
|
-
* Result of `verify` — either a normalised profile
|
|
467
|
-
* error reason the login UI surfaces.
|
|
467
|
+
* Result of `verify` / `fetchProfile` — either a normalised profile
|
|
468
|
+
* (success) or an error reason the login UI surfaces.
|
|
468
469
|
*/
|
|
469
470
|
type AuthVerifyResult = {
|
|
470
471
|
ok: true;
|
|
@@ -473,38 +474,166 @@ type AuthVerifyResult = {
|
|
|
473
474
|
ok: false;
|
|
474
475
|
reason: string;
|
|
475
476
|
};
|
|
477
|
+
/** One field to render on a `credential` driver's sign-in form. */
|
|
478
|
+
interface CredentialField {
|
|
479
|
+
/** Form field name, e.g. `'username'` / `'password'`. */
|
|
480
|
+
name: string;
|
|
481
|
+
/** Human-readable label rendered next to the field. */
|
|
482
|
+
label: string;
|
|
483
|
+
/** Input type. Defaults to `'text'` when omitted. */
|
|
484
|
+
type?: 'text' | 'email' | 'password';
|
|
485
|
+
required?: boolean;
|
|
486
|
+
}
|
|
476
487
|
/**
|
|
477
|
-
*
|
|
478
|
-
*
|
|
479
|
-
* (`Sign in with Google`). Clicking redirects through the plugin's
|
|
480
|
-
* registered routes (`/api/plugins/<name>/oauth/start`); the
|
|
481
|
-
* provider redirects back to `/api/plugins/<name>/oauth/callback`,
|
|
482
|
-
* which the plugin's contract handles.
|
|
483
|
-
*
|
|
484
|
-
* `verify` is the bridge: given whatever the plugin pulled out of the
|
|
485
|
-
* callback (token / code / SAML response), produce a normalised
|
|
486
|
-
* `AuthProfile` or a failure reason.
|
|
488
|
+
* Direct-credential auth: the user submits credentials to Crowi itself
|
|
489
|
+
* (LDAP, local password). No redirect, no external IdP round-trip.
|
|
487
490
|
*/
|
|
488
|
-
interface
|
|
489
|
-
|
|
490
|
-
|
|
491
|
-
|
|
492
|
-
|
|
493
|
-
|
|
491
|
+
interface CredentialAuthDriver {
|
|
492
|
+
kind: 'credential';
|
|
493
|
+
/** Usually omitted — credential drivers render as the sign-in form. */
|
|
494
|
+
buttonLabel?: string;
|
|
495
|
+
/** Fields to render on the sign-in form (e.g. [username, password]). */
|
|
496
|
+
fields: CredentialField[];
|
|
497
|
+
verify(credentials: Record<string, string>): Promise<AuthVerifyResult>;
|
|
498
|
+
}
|
|
499
|
+
/**
|
|
500
|
+
* OAuth 2.0 / OIDC client credentials, read lazily at request time (see
|
|
501
|
+
* `getClientConfig()` below) rather than captured at registration.
|
|
502
|
+
*/
|
|
503
|
+
interface OAuthClientConfig {
|
|
504
|
+
clientId: string;
|
|
505
|
+
clientSecret: string;
|
|
506
|
+
}
|
|
507
|
+
/** Token response from an OAuth 2.0 / OIDC token endpoint. */
|
|
508
|
+
interface OAuthTokens {
|
|
509
|
+
accessToken: string;
|
|
510
|
+
tokenType?: string;
|
|
511
|
+
expiresIn?: number;
|
|
512
|
+
refreshToken?: string;
|
|
513
|
+
scope?: string;
|
|
514
|
+
/** Present for an OIDC token response — the raw, still-unverified id_token JWT. */
|
|
515
|
+
idToken?: string;
|
|
516
|
+
}
|
|
517
|
+
/**
|
|
518
|
+
* Redirect/federated auth: the browser bounces to an external IdP using
|
|
519
|
+
* the plain OAuth 2.0 authorization-code flow (no id_token).
|
|
520
|
+
*/
|
|
521
|
+
interface OAuth2AuthDriver {
|
|
522
|
+
kind: 'oauth2';
|
|
494
523
|
buttonLabel: string;
|
|
495
|
-
/** Optional icon URL for the login button. */
|
|
496
524
|
iconUrl?: string;
|
|
497
|
-
|
|
498
|
-
|
|
499
|
-
|
|
500
|
-
|
|
501
|
-
|
|
502
|
-
|
|
503
|
-
|
|
525
|
+
authorizeUrl: string;
|
|
526
|
+
tokenUrl: string;
|
|
527
|
+
scopes: string[];
|
|
528
|
+
/** Declare when the IdP supports PKCE (S256). */
|
|
529
|
+
pkce?: boolean;
|
|
530
|
+
/**
|
|
531
|
+
* Lazy accessor, evaluated per request — NOT captured at registration.
|
|
532
|
+
* Returns null while the plugin is unconfigured; core then hides the
|
|
533
|
+
* provider from the provider list (enablement) and rejects `/start`.
|
|
534
|
+
* Lazy evaluation is also what makes admin config changes take effect
|
|
535
|
+
* without re-registering the driver.
|
|
536
|
+
*/
|
|
537
|
+
getClientConfig(): OAuthClientConfig | null;
|
|
538
|
+
/**
|
|
539
|
+
* Exchange completed; fetch the provider profile and map it. Returns
|
|
540
|
+
* `AuthVerifyResult` so the driver can REJECT after a successful
|
|
541
|
+
* exchange (e.g. an org-membership gate) — a successful exchange does
|
|
542
|
+
* not by itself guarantee a successful sign-in.
|
|
543
|
+
*/
|
|
544
|
+
fetchProfile(tokens: OAuthTokens): Promise<AuthVerifyResult>;
|
|
504
545
|
}
|
|
546
|
+
/** OIDC = OAuth 2.0 + standardised discovery + id_token claims. */
|
|
547
|
+
interface OidcAuthDriver {
|
|
548
|
+
kind: 'oidc';
|
|
549
|
+
buttonLabel: string;
|
|
550
|
+
iconUrl?: string;
|
|
551
|
+
/** `…/.well-known/openid-configuration` */
|
|
552
|
+
discoveryUrl: string;
|
|
553
|
+
/** Default `['openid', 'email', 'profile']`. */
|
|
554
|
+
scopes: string[];
|
|
555
|
+
/** OIDC always uses PKCE. */
|
|
556
|
+
pkce: true;
|
|
557
|
+
/** Same lazy contract as `OAuth2AuthDriver.getClientConfig()`. */
|
|
558
|
+
getClientConfig(): OAuthClientConfig | null;
|
|
559
|
+
/**
|
|
560
|
+
* Resolve (and cache) the `openid-client` `Configuration` for this
|
|
561
|
+
* driver's current credentials. Returns `null` without performing any
|
|
562
|
+
* network I/O while `getClientConfig()` is unconfigured. See the
|
|
563
|
+
* discovery-cache doc comment below for the caching contract.
|
|
564
|
+
*/
|
|
565
|
+
getConfiguration(): Promise<Configuration | null>;
|
|
566
|
+
/**
|
|
567
|
+
* Optional policy gate, called after core validates the id_token and
|
|
568
|
+
* before `mapClaims` — the OIDC analogue of `fetchProfile`'s
|
|
569
|
+
* rejection (e.g. a Google Workspace `hd` domain restriction).
|
|
570
|
+
*/
|
|
571
|
+
authorize?(claims: Record<string, unknown>): Promise<{
|
|
572
|
+
ok: true;
|
|
573
|
+
} | {
|
|
574
|
+
ok: false;
|
|
575
|
+
reason: string;
|
|
576
|
+
}>;
|
|
577
|
+
/** Optional claim → AuthProfile override; default maps sub/email/name. */
|
|
578
|
+
mapClaims?(claims: Record<string, unknown>): Partial<AuthProfile>;
|
|
579
|
+
}
|
|
580
|
+
/**
|
|
581
|
+
* `'saml'` is reserved (RFC-0014 §9) for a future `SamlAuthDriver` — it is
|
|
582
|
+
* a valid `AuthDriverKind` so downstream code can already discriminate on
|
|
583
|
+
* it, but no `SamlAuthDriver` interface exists yet and `AuthDriver` below
|
|
584
|
+
* does not include it as a member. SAML's required attributes and
|
|
585
|
+
* callback shape are still undecided; adding a member type ahead of that
|
|
586
|
+
* design would let a plugin construct a value with no real runtime.
|
|
587
|
+
*/
|
|
588
|
+
type AuthDriverKind = 'credential' | 'oauth2' | 'oidc' | 'saml';
|
|
589
|
+
/**
|
|
590
|
+
* Auth provider driver. The login screen asks core for the list of
|
|
591
|
+
* registered drivers and renders one button per `oauth2`/`oidc` driver
|
|
592
|
+
* (`Sign in with Google`) or one sign-in form per `credential` driver.
|
|
593
|
+
* See RFC-0014 §3 for the full design rationale.
|
|
594
|
+
*/
|
|
595
|
+
type AuthDriver = CredentialAuthDriver | OAuth2AuthDriver | OidcAuthDriver;
|
|
505
596
|
interface AuthRegistry {
|
|
506
597
|
register(driverName: string, driver: AuthDriver): void;
|
|
507
598
|
}
|
|
599
|
+
interface CreateOAuth2DriverOptions {
|
|
600
|
+
buttonLabel: string;
|
|
601
|
+
iconUrl?: string;
|
|
602
|
+
authorizeUrl: string;
|
|
603
|
+
tokenUrl: string;
|
|
604
|
+
/** Defaults to `[]` when omitted. */
|
|
605
|
+
scopes?: string[];
|
|
606
|
+
pkce?: boolean;
|
|
607
|
+
getClientConfig(): OAuthClientConfig | null;
|
|
608
|
+
fetchProfile(tokens: OAuthTokens): Promise<AuthVerifyResult>;
|
|
609
|
+
}
|
|
610
|
+
/**
|
|
611
|
+
* Build a plain OAuth 2.0 authorization-code driver. Synchronous, I/O-free
|
|
612
|
+
* — see the module doc comment above.
|
|
613
|
+
*/
|
|
614
|
+
declare function createOAuth2Driver(options: CreateOAuth2DriverOptions): OAuth2AuthDriver;
|
|
615
|
+
interface CreateOidcDriverOptions {
|
|
616
|
+
buttonLabel: string;
|
|
617
|
+
iconUrl?: string;
|
|
618
|
+
discoveryUrl: string;
|
|
619
|
+
/** Defaults to `['openid', 'email', 'profile']` when omitted. */
|
|
620
|
+
scopes?: string[];
|
|
621
|
+
getClientConfig(): OAuthClientConfig | null;
|
|
622
|
+
authorize?(claims: Record<string, unknown>): Promise<{
|
|
623
|
+
ok: true;
|
|
624
|
+
} | {
|
|
625
|
+
ok: false;
|
|
626
|
+
reason: string;
|
|
627
|
+
}>;
|
|
628
|
+
mapClaims?(claims: Record<string, unknown>): Partial<AuthProfile>;
|
|
629
|
+
}
|
|
630
|
+
/**
|
|
631
|
+
* Build an OIDC driver. Synchronous, I/O-free at call time — see the
|
|
632
|
+
* module doc comment above. `getConfiguration()` on the returned driver
|
|
633
|
+
* is the only entry point that performs discovery, and only on first use
|
|
634
|
+
* (see `resolveOidcConfiguration` below).
|
|
635
|
+
*/
|
|
636
|
+
declare function createOidcDriver(options: CreateOidcDriverOptions): OidcAuthDriver;
|
|
508
637
|
|
|
509
638
|
/**
|
|
510
639
|
* Notification payload — the runtime-neutral shape passed to every
|
|
@@ -1323,6 +1452,52 @@ interface PluginRouterScope {
|
|
|
1323
1452
|
route(method: PluginRouteMethod, path: string, handler: PluginRouteHandler, opts?: PluginRouteOptions): void;
|
|
1324
1453
|
}
|
|
1325
1454
|
|
|
1455
|
+
/**
|
|
1456
|
+
* Declares that, when a specific driver from a specific registry is
|
|
1457
|
+
* selected (`crowi.config.json:<registry>.driver === driver`), this
|
|
1458
|
+
* plugin's own config becomes required to actually work at runtime —
|
|
1459
|
+
* even though the `configSchema` field itself is optional / defaults to
|
|
1460
|
+
* `''` so `configSchema.parse()` alone can't detect "present but
|
|
1461
|
+
* unusable" (see `@crowi/plugin-storage-aws-s3`'s `bucket` and
|
|
1462
|
+
* `@crowi/plugin-search-elasticsearch` / `@crowi/plugin-search-opensearch`'s
|
|
1463
|
+
* `url`, both `z.string().default('')`).
|
|
1464
|
+
*
|
|
1465
|
+
* This is metadata only — it never carries an actual config value.
|
|
1466
|
+
* `registry` / `driver` / every name in `requiredConfigFields` must be
|
|
1467
|
+
* non-empty. The runtime (`PluginManager.getReadinessIssues()`) reads
|
|
1468
|
+
* this once per admin readiness check, cross-references it against the
|
|
1469
|
+
* currently selected driver and the plugin's current config namespace,
|
|
1470
|
+
* and reports which declared fields are still empty — never the values
|
|
1471
|
+
* themselves. See RFC-none / feature-plugin-config-readiness.
|
|
1472
|
+
*/
|
|
1473
|
+
interface PluginReadinessDeclaration {
|
|
1474
|
+
/** Which driver registry this declaration is scoped to. */
|
|
1475
|
+
registry: 'storage' | 'search' | 'mail';
|
|
1476
|
+
/** The driver name (as registered via `registry.register(name, …)`) this declaration applies to. */
|
|
1477
|
+
driver: string;
|
|
1478
|
+
/** `configSchema` field names that must be non-empty for `driver` to actually work once selected. */
|
|
1479
|
+
requiredConfigFields: string[];
|
|
1480
|
+
}
|
|
1481
|
+
/**
|
|
1482
|
+
* One all-or-nothing group of `configSchema` fields — see
|
|
1483
|
+
* `CrowiPlugin.configAtomicGroups`.
|
|
1484
|
+
*/
|
|
1485
|
+
interface PluginConfigAtomicGroup {
|
|
1486
|
+
/**
|
|
1487
|
+
* Stable identifier, part of the physical storage key
|
|
1488
|
+
* (`plugin:<plugin>:__atomic:<name>`). Renaming it orphans the stored
|
|
1489
|
+
* document, so treat it like a migration.
|
|
1490
|
+
*/
|
|
1491
|
+
name: string;
|
|
1492
|
+
/** The `configSchema` field names stored together. Non-empty, no duplicates, and each field may belong to only one group. */
|
|
1493
|
+
keys: readonly string[];
|
|
1494
|
+
/**
|
|
1495
|
+
* Encrypt the whole stored group at rest. Set this when ANY member is
|
|
1496
|
+
* secret: the group is one value, so it is either all encrypted or all
|
|
1497
|
+
* not — there is no per-field choice left once they share a document.
|
|
1498
|
+
*/
|
|
1499
|
+
sensitive?: boolean;
|
|
1500
|
+
}
|
|
1326
1501
|
/**
|
|
1327
1502
|
* The contract every Crowi plugin satisfies. Plugins export their
|
|
1328
1503
|
* `CrowiPlugin` object as the package's default export; the runtime
|
|
@@ -1412,6 +1587,24 @@ interface CrowiPlugin {
|
|
|
1412
1587
|
* the field that calls the plugin's contributed REST endpoint.
|
|
1413
1588
|
*/
|
|
1414
1589
|
configSchema?: z.ZodObject<Record<string, z.ZodTypeAny>>;
|
|
1590
|
+
/**
|
|
1591
|
+
* RFC-0014 phase 4 — `configSchema` fields that must never be visible
|
|
1592
|
+
* to anyone in a half-written state, declared as groups that are stored
|
|
1593
|
+
* as ONE Config document instead of one row per field.
|
|
1594
|
+
*
|
|
1595
|
+
* The motivating case is an OAuth client id + secret. Written as
|
|
1596
|
+
* separate rows, a failure between them leaves the instance advertising
|
|
1597
|
+
* a new client id paired with the previous secret — a configuration
|
|
1598
|
+
* that never existed and cannot authenticate, visible to every replica
|
|
1599
|
+
* until an operator notices. As a single document there is no
|
|
1600
|
+
* in-between: readers see the whole previous pair or the whole new one.
|
|
1601
|
+
*
|
|
1602
|
+
* This is a STORAGE contract, not a general escape hatch for making
|
|
1603
|
+
* arbitrary keys atomic — the fields still appear to the plugin (and to
|
|
1604
|
+
* the admin form) as ordinary flat config, and are only reassembled at
|
|
1605
|
+
* the persistence boundary.
|
|
1606
|
+
*/
|
|
1607
|
+
configAtomicGroups?: readonly PluginConfigAtomicGroup[];
|
|
1415
1608
|
/**
|
|
1416
1609
|
* Per-Page metadata schema. When set, every Page document has a
|
|
1417
1610
|
* `metadata['<plugin-name>']` slot whose shape matches this schema,
|
|
@@ -1457,6 +1650,14 @@ interface CrowiPlugin {
|
|
|
1457
1650
|
label?: string;
|
|
1458
1651
|
description?: string;
|
|
1459
1652
|
}>>;
|
|
1653
|
+
/**
|
|
1654
|
+
* Declares which of this plugin's own `configSchema` fields must be
|
|
1655
|
+
* non-empty for a specific driver selection to actually work at
|
|
1656
|
+
* runtime (see {@link PluginReadinessDeclaration}). Optional — a
|
|
1657
|
+
* plugin with no readiness declaration is never surfaced by the
|
|
1658
|
+
* admin readiness check, same as before this field existed.
|
|
1659
|
+
*/
|
|
1660
|
+
readiness?: PluginReadinessDeclaration;
|
|
1460
1661
|
/** Storage driver registration. Called once at boot. */
|
|
1461
1662
|
registerStorage?: (registry: StorageRegistry, ctx: PluginContext) => void;
|
|
1462
1663
|
/** Search backend registration. Called once at boot. */
|
|
@@ -1729,4 +1930,4 @@ type SanitizeSvgResult = {
|
|
|
1729
1930
|
*/
|
|
1730
1931
|
declare function sanitizeSvg(input: string, policy: SanitizeSvgPolicy): SanitizeSvgResult;
|
|
1731
1932
|
|
|
1732
|
-
export { ACTION_FIELD_MARKER, type AdmissionControlConfig, type AppInfo, type AuthContext, type AuthDriver, type AuthProfile, type AuthRegistry, type AuthVerifyResult, type CacheEntry, type CacheKey, type CacheStorage, type CodeBlockInfo, type CodeBlockRenderer, type CrowiPlugin, type EmailMessage, type EmbedFragment, type EmbedInput, type EmbedRenderer, type EventBus, type InlineExpansion, type MailSender, type MailSenderRegistry, type NodeRenderer, type NotificationPayload, type NotifierDriver, type NotifierRegistry, type PageMetadataAccessor, type PluginContext, type PluginEvents, type PluginLogger, type PluginRouteHandler, type PluginRouteMethod, type PluginRouteOptions, type PluginRouterScope, type RenderActor, type RenderContext, type RenderError, type RenderPhase, type RenderResult, type RendererRegistry, type Reservation, SENSITIVE_FIELD_MARKER, type SanitizeSvgPolicy, type SanitizeSvgResult, type ScopedCacheStorage, type SearchDriver, type SearchHit, type SearchHits, type SearchPageType, type SearchQuery, type SearchQueryGrants, type SearchQueryViewer, type SearchRegistry, type SearchableDoc, type StateCell, type StorageDriver, type StoragePutMeta, type StoragePutResult, type StorageRegistry, type StructuredRenderPayload, type UrlInlineExpansionRule, escapeHtml, extractSvgDimensions, getActionAnnotation, isSensitiveField, sanitizeSvg };
|
|
1933
|
+
export { ACTION_FIELD_MARKER, type AdmissionControlConfig, type AppInfo, type AuthContext, type AuthDriver, type AuthDriverKind, type AuthProfile, type AuthRegistry, type AuthVerifyResult, type CacheEntry, type CacheKey, type CacheStorage, type CodeBlockInfo, type CodeBlockRenderer, type CreateOAuth2DriverOptions, type CreateOidcDriverOptions, type CredentialAuthDriver, type CredentialField, type CrowiPlugin, type EmailMessage, type EmbedFragment, type EmbedInput, type EmbedRenderer, type EventBus, type InlineExpansion, type MailSender, type MailSenderRegistry, type NodeRenderer, type NotificationPayload, type NotifierDriver, type NotifierRegistry, type OAuth2AuthDriver, type OAuthClientConfig, type OAuthTokens, type OidcAuthDriver, type PageMetadataAccessor, type PluginConfigAtomicGroup, type PluginContext, type PluginEvents, type PluginLogger, type PluginReadinessDeclaration, type PluginRouteHandler, type PluginRouteMethod, type PluginRouteOptions, type PluginRouterScope, type RenderActor, type RenderContext, type RenderError, type RenderPhase, type RenderResult, type RendererRegistry, type Reservation, SENSITIVE_FIELD_MARKER, type SanitizeSvgPolicy, type SanitizeSvgResult, type ScopedCacheStorage, type SearchDriver, type SearchHit, type SearchHits, type SearchPageType, type SearchQuery, type SearchQueryGrants, type SearchQueryViewer, type SearchRegistry, type SearchableDoc, type StateCell, type StorageDriver, type StoragePutMeta, type StoragePutResult, type StorageRegistry, type StructuredRenderPayload, type UrlInlineExpansionRule, createOAuth2Driver, createOidcDriver, escapeHtml, extractSvgDimensions, getActionAnnotation, isSensitiveField, sanitizeSvg };
|
package/dist/index.d.ts
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import { z } from 'zod/v3';
|
|
2
2
|
import { Readable } from 'node:stream';
|
|
3
|
+
import { Configuration } from 'openid-client';
|
|
3
4
|
import { Context } from 'hono';
|
|
4
5
|
|
|
5
6
|
/**
|
|
@@ -463,8 +464,8 @@ interface AuthProfile {
|
|
|
463
464
|
extra?: Record<string, unknown>;
|
|
464
465
|
}
|
|
465
466
|
/**
|
|
466
|
-
* Result of `verify` — either a normalised profile
|
|
467
|
-
* error reason the login UI surfaces.
|
|
467
|
+
* Result of `verify` / `fetchProfile` — either a normalised profile
|
|
468
|
+
* (success) or an error reason the login UI surfaces.
|
|
468
469
|
*/
|
|
469
470
|
type AuthVerifyResult = {
|
|
470
471
|
ok: true;
|
|
@@ -473,38 +474,166 @@ type AuthVerifyResult = {
|
|
|
473
474
|
ok: false;
|
|
474
475
|
reason: string;
|
|
475
476
|
};
|
|
477
|
+
/** One field to render on a `credential` driver's sign-in form. */
|
|
478
|
+
interface CredentialField {
|
|
479
|
+
/** Form field name, e.g. `'username'` / `'password'`. */
|
|
480
|
+
name: string;
|
|
481
|
+
/** Human-readable label rendered next to the field. */
|
|
482
|
+
label: string;
|
|
483
|
+
/** Input type. Defaults to `'text'` when omitted. */
|
|
484
|
+
type?: 'text' | 'email' | 'password';
|
|
485
|
+
required?: boolean;
|
|
486
|
+
}
|
|
476
487
|
/**
|
|
477
|
-
*
|
|
478
|
-
*
|
|
479
|
-
* (`Sign in with Google`). Clicking redirects through the plugin's
|
|
480
|
-
* registered routes (`/api/plugins/<name>/oauth/start`); the
|
|
481
|
-
* provider redirects back to `/api/plugins/<name>/oauth/callback`,
|
|
482
|
-
* which the plugin's contract handles.
|
|
483
|
-
*
|
|
484
|
-
* `verify` is the bridge: given whatever the plugin pulled out of the
|
|
485
|
-
* callback (token / code / SAML response), produce a normalised
|
|
486
|
-
* `AuthProfile` or a failure reason.
|
|
488
|
+
* Direct-credential auth: the user submits credentials to Crowi itself
|
|
489
|
+
* (LDAP, local password). No redirect, no external IdP round-trip.
|
|
487
490
|
*/
|
|
488
|
-
interface
|
|
489
|
-
|
|
490
|
-
|
|
491
|
-
|
|
492
|
-
|
|
493
|
-
|
|
491
|
+
interface CredentialAuthDriver {
|
|
492
|
+
kind: 'credential';
|
|
493
|
+
/** Usually omitted — credential drivers render as the sign-in form. */
|
|
494
|
+
buttonLabel?: string;
|
|
495
|
+
/** Fields to render on the sign-in form (e.g. [username, password]). */
|
|
496
|
+
fields: CredentialField[];
|
|
497
|
+
verify(credentials: Record<string, string>): Promise<AuthVerifyResult>;
|
|
498
|
+
}
|
|
499
|
+
/**
|
|
500
|
+
* OAuth 2.0 / OIDC client credentials, read lazily at request time (see
|
|
501
|
+
* `getClientConfig()` below) rather than captured at registration.
|
|
502
|
+
*/
|
|
503
|
+
interface OAuthClientConfig {
|
|
504
|
+
clientId: string;
|
|
505
|
+
clientSecret: string;
|
|
506
|
+
}
|
|
507
|
+
/** Token response from an OAuth 2.0 / OIDC token endpoint. */
|
|
508
|
+
interface OAuthTokens {
|
|
509
|
+
accessToken: string;
|
|
510
|
+
tokenType?: string;
|
|
511
|
+
expiresIn?: number;
|
|
512
|
+
refreshToken?: string;
|
|
513
|
+
scope?: string;
|
|
514
|
+
/** Present for an OIDC token response — the raw, still-unverified id_token JWT. */
|
|
515
|
+
idToken?: string;
|
|
516
|
+
}
|
|
517
|
+
/**
|
|
518
|
+
* Redirect/federated auth: the browser bounces to an external IdP using
|
|
519
|
+
* the plain OAuth 2.0 authorization-code flow (no id_token).
|
|
520
|
+
*/
|
|
521
|
+
interface OAuth2AuthDriver {
|
|
522
|
+
kind: 'oauth2';
|
|
494
523
|
buttonLabel: string;
|
|
495
|
-
/** Optional icon URL for the login button. */
|
|
496
524
|
iconUrl?: string;
|
|
497
|
-
|
|
498
|
-
|
|
499
|
-
|
|
500
|
-
|
|
501
|
-
|
|
502
|
-
|
|
503
|
-
|
|
525
|
+
authorizeUrl: string;
|
|
526
|
+
tokenUrl: string;
|
|
527
|
+
scopes: string[];
|
|
528
|
+
/** Declare when the IdP supports PKCE (S256). */
|
|
529
|
+
pkce?: boolean;
|
|
530
|
+
/**
|
|
531
|
+
* Lazy accessor, evaluated per request — NOT captured at registration.
|
|
532
|
+
* Returns null while the plugin is unconfigured; core then hides the
|
|
533
|
+
* provider from the provider list (enablement) and rejects `/start`.
|
|
534
|
+
* Lazy evaluation is also what makes admin config changes take effect
|
|
535
|
+
* without re-registering the driver.
|
|
536
|
+
*/
|
|
537
|
+
getClientConfig(): OAuthClientConfig | null;
|
|
538
|
+
/**
|
|
539
|
+
* Exchange completed; fetch the provider profile and map it. Returns
|
|
540
|
+
* `AuthVerifyResult` so the driver can REJECT after a successful
|
|
541
|
+
* exchange (e.g. an org-membership gate) — a successful exchange does
|
|
542
|
+
* not by itself guarantee a successful sign-in.
|
|
543
|
+
*/
|
|
544
|
+
fetchProfile(tokens: OAuthTokens): Promise<AuthVerifyResult>;
|
|
504
545
|
}
|
|
546
|
+
/** OIDC = OAuth 2.0 + standardised discovery + id_token claims. */
|
|
547
|
+
interface OidcAuthDriver {
|
|
548
|
+
kind: 'oidc';
|
|
549
|
+
buttonLabel: string;
|
|
550
|
+
iconUrl?: string;
|
|
551
|
+
/** `…/.well-known/openid-configuration` */
|
|
552
|
+
discoveryUrl: string;
|
|
553
|
+
/** Default `['openid', 'email', 'profile']`. */
|
|
554
|
+
scopes: string[];
|
|
555
|
+
/** OIDC always uses PKCE. */
|
|
556
|
+
pkce: true;
|
|
557
|
+
/** Same lazy contract as `OAuth2AuthDriver.getClientConfig()`. */
|
|
558
|
+
getClientConfig(): OAuthClientConfig | null;
|
|
559
|
+
/**
|
|
560
|
+
* Resolve (and cache) the `openid-client` `Configuration` for this
|
|
561
|
+
* driver's current credentials. Returns `null` without performing any
|
|
562
|
+
* network I/O while `getClientConfig()` is unconfigured. See the
|
|
563
|
+
* discovery-cache doc comment below for the caching contract.
|
|
564
|
+
*/
|
|
565
|
+
getConfiguration(): Promise<Configuration | null>;
|
|
566
|
+
/**
|
|
567
|
+
* Optional policy gate, called after core validates the id_token and
|
|
568
|
+
* before `mapClaims` — the OIDC analogue of `fetchProfile`'s
|
|
569
|
+
* rejection (e.g. a Google Workspace `hd` domain restriction).
|
|
570
|
+
*/
|
|
571
|
+
authorize?(claims: Record<string, unknown>): Promise<{
|
|
572
|
+
ok: true;
|
|
573
|
+
} | {
|
|
574
|
+
ok: false;
|
|
575
|
+
reason: string;
|
|
576
|
+
}>;
|
|
577
|
+
/** Optional claim → AuthProfile override; default maps sub/email/name. */
|
|
578
|
+
mapClaims?(claims: Record<string, unknown>): Partial<AuthProfile>;
|
|
579
|
+
}
|
|
580
|
+
/**
|
|
581
|
+
* `'saml'` is reserved (RFC-0014 §9) for a future `SamlAuthDriver` — it is
|
|
582
|
+
* a valid `AuthDriverKind` so downstream code can already discriminate on
|
|
583
|
+
* it, but no `SamlAuthDriver` interface exists yet and `AuthDriver` below
|
|
584
|
+
* does not include it as a member. SAML's required attributes and
|
|
585
|
+
* callback shape are still undecided; adding a member type ahead of that
|
|
586
|
+
* design would let a plugin construct a value with no real runtime.
|
|
587
|
+
*/
|
|
588
|
+
type AuthDriverKind = 'credential' | 'oauth2' | 'oidc' | 'saml';
|
|
589
|
+
/**
|
|
590
|
+
* Auth provider driver. The login screen asks core for the list of
|
|
591
|
+
* registered drivers and renders one button per `oauth2`/`oidc` driver
|
|
592
|
+
* (`Sign in with Google`) or one sign-in form per `credential` driver.
|
|
593
|
+
* See RFC-0014 §3 for the full design rationale.
|
|
594
|
+
*/
|
|
595
|
+
type AuthDriver = CredentialAuthDriver | OAuth2AuthDriver | OidcAuthDriver;
|
|
505
596
|
interface AuthRegistry {
|
|
506
597
|
register(driverName: string, driver: AuthDriver): void;
|
|
507
598
|
}
|
|
599
|
+
interface CreateOAuth2DriverOptions {
|
|
600
|
+
buttonLabel: string;
|
|
601
|
+
iconUrl?: string;
|
|
602
|
+
authorizeUrl: string;
|
|
603
|
+
tokenUrl: string;
|
|
604
|
+
/** Defaults to `[]` when omitted. */
|
|
605
|
+
scopes?: string[];
|
|
606
|
+
pkce?: boolean;
|
|
607
|
+
getClientConfig(): OAuthClientConfig | null;
|
|
608
|
+
fetchProfile(tokens: OAuthTokens): Promise<AuthVerifyResult>;
|
|
609
|
+
}
|
|
610
|
+
/**
|
|
611
|
+
* Build a plain OAuth 2.0 authorization-code driver. Synchronous, I/O-free
|
|
612
|
+
* — see the module doc comment above.
|
|
613
|
+
*/
|
|
614
|
+
declare function createOAuth2Driver(options: CreateOAuth2DriverOptions): OAuth2AuthDriver;
|
|
615
|
+
interface CreateOidcDriverOptions {
|
|
616
|
+
buttonLabel: string;
|
|
617
|
+
iconUrl?: string;
|
|
618
|
+
discoveryUrl: string;
|
|
619
|
+
/** Defaults to `['openid', 'email', 'profile']` when omitted. */
|
|
620
|
+
scopes?: string[];
|
|
621
|
+
getClientConfig(): OAuthClientConfig | null;
|
|
622
|
+
authorize?(claims: Record<string, unknown>): Promise<{
|
|
623
|
+
ok: true;
|
|
624
|
+
} | {
|
|
625
|
+
ok: false;
|
|
626
|
+
reason: string;
|
|
627
|
+
}>;
|
|
628
|
+
mapClaims?(claims: Record<string, unknown>): Partial<AuthProfile>;
|
|
629
|
+
}
|
|
630
|
+
/**
|
|
631
|
+
* Build an OIDC driver. Synchronous, I/O-free at call time — see the
|
|
632
|
+
* module doc comment above. `getConfiguration()` on the returned driver
|
|
633
|
+
* is the only entry point that performs discovery, and only on first use
|
|
634
|
+
* (see `resolveOidcConfiguration` below).
|
|
635
|
+
*/
|
|
636
|
+
declare function createOidcDriver(options: CreateOidcDriverOptions): OidcAuthDriver;
|
|
508
637
|
|
|
509
638
|
/**
|
|
510
639
|
* Notification payload — the runtime-neutral shape passed to every
|
|
@@ -1323,6 +1452,52 @@ interface PluginRouterScope {
|
|
|
1323
1452
|
route(method: PluginRouteMethod, path: string, handler: PluginRouteHandler, opts?: PluginRouteOptions): void;
|
|
1324
1453
|
}
|
|
1325
1454
|
|
|
1455
|
+
/**
|
|
1456
|
+
* Declares that, when a specific driver from a specific registry is
|
|
1457
|
+
* selected (`crowi.config.json:<registry>.driver === driver`), this
|
|
1458
|
+
* plugin's own config becomes required to actually work at runtime —
|
|
1459
|
+
* even though the `configSchema` field itself is optional / defaults to
|
|
1460
|
+
* `''` so `configSchema.parse()` alone can't detect "present but
|
|
1461
|
+
* unusable" (see `@crowi/plugin-storage-aws-s3`'s `bucket` and
|
|
1462
|
+
* `@crowi/plugin-search-elasticsearch` / `@crowi/plugin-search-opensearch`'s
|
|
1463
|
+
* `url`, both `z.string().default('')`).
|
|
1464
|
+
*
|
|
1465
|
+
* This is metadata only — it never carries an actual config value.
|
|
1466
|
+
* `registry` / `driver` / every name in `requiredConfigFields` must be
|
|
1467
|
+
* non-empty. The runtime (`PluginManager.getReadinessIssues()`) reads
|
|
1468
|
+
* this once per admin readiness check, cross-references it against the
|
|
1469
|
+
* currently selected driver and the plugin's current config namespace,
|
|
1470
|
+
* and reports which declared fields are still empty — never the values
|
|
1471
|
+
* themselves. See RFC-none / feature-plugin-config-readiness.
|
|
1472
|
+
*/
|
|
1473
|
+
interface PluginReadinessDeclaration {
|
|
1474
|
+
/** Which driver registry this declaration is scoped to. */
|
|
1475
|
+
registry: 'storage' | 'search' | 'mail';
|
|
1476
|
+
/** The driver name (as registered via `registry.register(name, …)`) this declaration applies to. */
|
|
1477
|
+
driver: string;
|
|
1478
|
+
/** `configSchema` field names that must be non-empty for `driver` to actually work once selected. */
|
|
1479
|
+
requiredConfigFields: string[];
|
|
1480
|
+
}
|
|
1481
|
+
/**
|
|
1482
|
+
* One all-or-nothing group of `configSchema` fields — see
|
|
1483
|
+
* `CrowiPlugin.configAtomicGroups`.
|
|
1484
|
+
*/
|
|
1485
|
+
interface PluginConfigAtomicGroup {
|
|
1486
|
+
/**
|
|
1487
|
+
* Stable identifier, part of the physical storage key
|
|
1488
|
+
* (`plugin:<plugin>:__atomic:<name>`). Renaming it orphans the stored
|
|
1489
|
+
* document, so treat it like a migration.
|
|
1490
|
+
*/
|
|
1491
|
+
name: string;
|
|
1492
|
+
/** The `configSchema` field names stored together. Non-empty, no duplicates, and each field may belong to only one group. */
|
|
1493
|
+
keys: readonly string[];
|
|
1494
|
+
/**
|
|
1495
|
+
* Encrypt the whole stored group at rest. Set this when ANY member is
|
|
1496
|
+
* secret: the group is one value, so it is either all encrypted or all
|
|
1497
|
+
* not — there is no per-field choice left once they share a document.
|
|
1498
|
+
*/
|
|
1499
|
+
sensitive?: boolean;
|
|
1500
|
+
}
|
|
1326
1501
|
/**
|
|
1327
1502
|
* The contract every Crowi plugin satisfies. Plugins export their
|
|
1328
1503
|
* `CrowiPlugin` object as the package's default export; the runtime
|
|
@@ -1412,6 +1587,24 @@ interface CrowiPlugin {
|
|
|
1412
1587
|
* the field that calls the plugin's contributed REST endpoint.
|
|
1413
1588
|
*/
|
|
1414
1589
|
configSchema?: z.ZodObject<Record<string, z.ZodTypeAny>>;
|
|
1590
|
+
/**
|
|
1591
|
+
* RFC-0014 phase 4 — `configSchema` fields that must never be visible
|
|
1592
|
+
* to anyone in a half-written state, declared as groups that are stored
|
|
1593
|
+
* as ONE Config document instead of one row per field.
|
|
1594
|
+
*
|
|
1595
|
+
* The motivating case is an OAuth client id + secret. Written as
|
|
1596
|
+
* separate rows, a failure between them leaves the instance advertising
|
|
1597
|
+
* a new client id paired with the previous secret — a configuration
|
|
1598
|
+
* that never existed and cannot authenticate, visible to every replica
|
|
1599
|
+
* until an operator notices. As a single document there is no
|
|
1600
|
+
* in-between: readers see the whole previous pair or the whole new one.
|
|
1601
|
+
*
|
|
1602
|
+
* This is a STORAGE contract, not a general escape hatch for making
|
|
1603
|
+
* arbitrary keys atomic — the fields still appear to the plugin (and to
|
|
1604
|
+
* the admin form) as ordinary flat config, and are only reassembled at
|
|
1605
|
+
* the persistence boundary.
|
|
1606
|
+
*/
|
|
1607
|
+
configAtomicGroups?: readonly PluginConfigAtomicGroup[];
|
|
1415
1608
|
/**
|
|
1416
1609
|
* Per-Page metadata schema. When set, every Page document has a
|
|
1417
1610
|
* `metadata['<plugin-name>']` slot whose shape matches this schema,
|
|
@@ -1457,6 +1650,14 @@ interface CrowiPlugin {
|
|
|
1457
1650
|
label?: string;
|
|
1458
1651
|
description?: string;
|
|
1459
1652
|
}>>;
|
|
1653
|
+
/**
|
|
1654
|
+
* Declares which of this plugin's own `configSchema` fields must be
|
|
1655
|
+
* non-empty for a specific driver selection to actually work at
|
|
1656
|
+
* runtime (see {@link PluginReadinessDeclaration}). Optional — a
|
|
1657
|
+
* plugin with no readiness declaration is never surfaced by the
|
|
1658
|
+
* admin readiness check, same as before this field existed.
|
|
1659
|
+
*/
|
|
1660
|
+
readiness?: PluginReadinessDeclaration;
|
|
1460
1661
|
/** Storage driver registration. Called once at boot. */
|
|
1461
1662
|
registerStorage?: (registry: StorageRegistry, ctx: PluginContext) => void;
|
|
1462
1663
|
/** Search backend registration. Called once at boot. */
|
|
@@ -1729,4 +1930,4 @@ type SanitizeSvgResult = {
|
|
|
1729
1930
|
*/
|
|
1730
1931
|
declare function sanitizeSvg(input: string, policy: SanitizeSvgPolicy): SanitizeSvgResult;
|
|
1731
1932
|
|
|
1732
|
-
export { ACTION_FIELD_MARKER, type AdmissionControlConfig, type AppInfo, type AuthContext, type AuthDriver, type AuthProfile, type AuthRegistry, type AuthVerifyResult, type CacheEntry, type CacheKey, type CacheStorage, type CodeBlockInfo, type CodeBlockRenderer, type CrowiPlugin, type EmailMessage, type EmbedFragment, type EmbedInput, type EmbedRenderer, type EventBus, type InlineExpansion, type MailSender, type MailSenderRegistry, type NodeRenderer, type NotificationPayload, type NotifierDriver, type NotifierRegistry, type PageMetadataAccessor, type PluginContext, type PluginEvents, type PluginLogger, type PluginRouteHandler, type PluginRouteMethod, type PluginRouteOptions, type PluginRouterScope, type RenderActor, type RenderContext, type RenderError, type RenderPhase, type RenderResult, type RendererRegistry, type Reservation, SENSITIVE_FIELD_MARKER, type SanitizeSvgPolicy, type SanitizeSvgResult, type ScopedCacheStorage, type SearchDriver, type SearchHit, type SearchHits, type SearchPageType, type SearchQuery, type SearchQueryGrants, type SearchQueryViewer, type SearchRegistry, type SearchableDoc, type StateCell, type StorageDriver, type StoragePutMeta, type StoragePutResult, type StorageRegistry, type StructuredRenderPayload, type UrlInlineExpansionRule, escapeHtml, extractSvgDimensions, getActionAnnotation, isSensitiveField, sanitizeSvg };
|
|
1933
|
+
export { ACTION_FIELD_MARKER, type AdmissionControlConfig, type AppInfo, type AuthContext, type AuthDriver, type AuthDriverKind, type AuthProfile, type AuthRegistry, type AuthVerifyResult, type CacheEntry, type CacheKey, type CacheStorage, type CodeBlockInfo, type CodeBlockRenderer, type CreateOAuth2DriverOptions, type CreateOidcDriverOptions, type CredentialAuthDriver, type CredentialField, type CrowiPlugin, type EmailMessage, type EmbedFragment, type EmbedInput, type EmbedRenderer, type EventBus, type InlineExpansion, type MailSender, type MailSenderRegistry, type NodeRenderer, type NotificationPayload, type NotifierDriver, type NotifierRegistry, type OAuth2AuthDriver, type OAuthClientConfig, type OAuthTokens, type OidcAuthDriver, type PageMetadataAccessor, type PluginConfigAtomicGroup, type PluginContext, type PluginEvents, type PluginLogger, type PluginReadinessDeclaration, type PluginRouteHandler, type PluginRouteMethod, type PluginRouteOptions, type PluginRouterScope, type RenderActor, type RenderContext, type RenderError, type RenderPhase, type RenderResult, type RendererRegistry, type Reservation, SENSITIVE_FIELD_MARKER, type SanitizeSvgPolicy, type SanitizeSvgResult, type ScopedCacheStorage, type SearchDriver, type SearchHit, type SearchHits, type SearchPageType, type SearchQuery, type SearchQueryGrants, type SearchQueryViewer, type SearchRegistry, type SearchableDoc, type StateCell, type StorageDriver, type StoragePutMeta, type StoragePutResult, type StorageRegistry, type StructuredRenderPayload, type UrlInlineExpansionRule, createOAuth2Driver, createOidcDriver, escapeHtml, extractSvgDimensions, getActionAnnotation, isSensitiveField, sanitizeSvg };
|
package/dist/index.js
CHANGED
|
@@ -1,7 +1,9 @@
|
|
|
1
1
|
"use strict";
|
|
2
|
+
var __create = Object.create;
|
|
2
3
|
var __defProp = Object.defineProperty;
|
|
3
4
|
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
|
|
4
5
|
var __getOwnPropNames = Object.getOwnPropertyNames;
|
|
6
|
+
var __getProtoOf = Object.getPrototypeOf;
|
|
5
7
|
var __hasOwnProp = Object.prototype.hasOwnProperty;
|
|
6
8
|
var __export = (target, all) => {
|
|
7
9
|
for (var name in all)
|
|
@@ -15,6 +17,14 @@ var __copyProps = (to, from, except, desc) => {
|
|
|
15
17
|
}
|
|
16
18
|
return to;
|
|
17
19
|
};
|
|
20
|
+
var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
|
|
21
|
+
// If the importer is in node compatibility mode or this is not an ESM
|
|
22
|
+
// file that has been converted to a CommonJS file using a Babel-
|
|
23
|
+
// compatible transform (i.e. "__esModule" has not been set), then set
|
|
24
|
+
// "default" to the CommonJS "module.exports" for node compatibility.
|
|
25
|
+
isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
|
|
26
|
+
mod
|
|
27
|
+
));
|
|
18
28
|
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
|
|
19
29
|
|
|
20
30
|
// src/index.ts
|
|
@@ -22,6 +32,8 @@ var index_exports = {};
|
|
|
22
32
|
__export(index_exports, {
|
|
23
33
|
ACTION_FIELD_MARKER: () => ACTION_FIELD_MARKER,
|
|
24
34
|
SENSITIVE_FIELD_MARKER: () => SENSITIVE_FIELD_MARKER,
|
|
35
|
+
createOAuth2Driver: () => createOAuth2Driver,
|
|
36
|
+
createOidcDriver: () => createOidcDriver,
|
|
25
37
|
escapeHtml: () => escapeHtml,
|
|
26
38
|
extractSvgDimensions: () => extractSvgDimensions,
|
|
27
39
|
getActionAnnotation: () => getActionAnnotation,
|
|
@@ -50,6 +62,117 @@ function escapeHtml(s) {
|
|
|
50
62
|
});
|
|
51
63
|
}
|
|
52
64
|
|
|
65
|
+
// src/registries/auth.ts
|
|
66
|
+
var import_node_crypto = require("crypto");
|
|
67
|
+
function assertNonEmptyString(value, label, factory) {
|
|
68
|
+
if (value.trim() === "") {
|
|
69
|
+
throw new TypeError(`${factory}: '${label}' must be a non-empty string.`);
|
|
70
|
+
}
|
|
71
|
+
}
|
|
72
|
+
function assertValidUrl(value, label, factory) {
|
|
73
|
+
try {
|
|
74
|
+
new URL(value);
|
|
75
|
+
} catch {
|
|
76
|
+
throw new TypeError(`${factory}: '${label}' must be a valid URL, got '${value}'.`);
|
|
77
|
+
}
|
|
78
|
+
}
|
|
79
|
+
function assertNonEmptyScopes(scopes, factory) {
|
|
80
|
+
for (const scope of scopes) {
|
|
81
|
+
assertNonEmptyString(scope, "scopes[]", factory);
|
|
82
|
+
}
|
|
83
|
+
}
|
|
84
|
+
function createOAuth2Driver(options) {
|
|
85
|
+
const FACTORY = "createOAuth2Driver";
|
|
86
|
+
assertNonEmptyString(options.buttonLabel, "buttonLabel", FACTORY);
|
|
87
|
+
assertValidUrl(options.authorizeUrl, "authorizeUrl", FACTORY);
|
|
88
|
+
assertValidUrl(options.tokenUrl, "tokenUrl", FACTORY);
|
|
89
|
+
const scopes = options.scopes ?? [];
|
|
90
|
+
assertNonEmptyScopes(scopes, FACTORY);
|
|
91
|
+
return {
|
|
92
|
+
kind: "oauth2",
|
|
93
|
+
buttonLabel: options.buttonLabel,
|
|
94
|
+
iconUrl: options.iconUrl,
|
|
95
|
+
authorizeUrl: options.authorizeUrl,
|
|
96
|
+
tokenUrl: options.tokenUrl,
|
|
97
|
+
scopes,
|
|
98
|
+
pkce: options.pkce,
|
|
99
|
+
getClientConfig: options.getClientConfig,
|
|
100
|
+
fetchProfile: options.fetchProfile
|
|
101
|
+
};
|
|
102
|
+
}
|
|
103
|
+
var DEFAULT_OIDC_SCOPES = ["openid", "email", "profile"];
|
|
104
|
+
function createOidcDriver(options) {
|
|
105
|
+
const FACTORY = "createOidcDriver";
|
|
106
|
+
assertNonEmptyString(options.buttonLabel, "buttonLabel", FACTORY);
|
|
107
|
+
assertValidUrl(options.discoveryUrl, "discoveryUrl", FACTORY);
|
|
108
|
+
const scopes = options.scopes ?? [...DEFAULT_OIDC_SCOPES];
|
|
109
|
+
assertNonEmptyScopes(scopes, FACTORY);
|
|
110
|
+
return {
|
|
111
|
+
kind: "oidc",
|
|
112
|
+
buttonLabel: options.buttonLabel,
|
|
113
|
+
iconUrl: options.iconUrl,
|
|
114
|
+
discoveryUrl: options.discoveryUrl,
|
|
115
|
+
scopes,
|
|
116
|
+
pkce: true,
|
|
117
|
+
getClientConfig: options.getClientConfig,
|
|
118
|
+
getConfiguration: () => resolveOidcConfiguration(options.discoveryUrl, options.getClientConfig),
|
|
119
|
+
authorize: options.authorize,
|
|
120
|
+
mapClaims: options.mapClaims
|
|
121
|
+
};
|
|
122
|
+
}
|
|
123
|
+
var DISCOVERY_CACHE_TTL_MS = 5 * 60 * 1e3;
|
|
124
|
+
var DISCOVERY_CACHE_MAX_ENTRIES = 64;
|
|
125
|
+
var discoveryCache = /* @__PURE__ */ new Map();
|
|
126
|
+
var inFlightDiscoveries = /* @__PURE__ */ new Map();
|
|
127
|
+
function discoveryCacheKey(discoveryUrl, clientId, clientSecret) {
|
|
128
|
+
const secretFingerprint = (0, import_node_crypto.createHash)("sha256").update(clientSecret).digest("hex");
|
|
129
|
+
return (0, import_node_crypto.createHash)("sha256").update(`${discoveryUrl}\0${clientId}\0${secretFingerprint}`).digest("hex");
|
|
130
|
+
}
|
|
131
|
+
function evictOldestDiscoveryCacheEntry() {
|
|
132
|
+
let oldestKey;
|
|
133
|
+
let oldestExpiresAt = Number.POSITIVE_INFINITY;
|
|
134
|
+
for (const [key, entry] of discoveryCache) {
|
|
135
|
+
if (entry.expiresAt < oldestExpiresAt) {
|
|
136
|
+
oldestExpiresAt = entry.expiresAt;
|
|
137
|
+
oldestKey = key;
|
|
138
|
+
}
|
|
139
|
+
}
|
|
140
|
+
if (oldestKey !== void 0) {
|
|
141
|
+
discoveryCache.delete(oldestKey);
|
|
142
|
+
}
|
|
143
|
+
}
|
|
144
|
+
function cacheDiscoveryResult(key, configuration) {
|
|
145
|
+
if (!discoveryCache.has(key) && discoveryCache.size >= DISCOVERY_CACHE_MAX_ENTRIES) {
|
|
146
|
+
evictOldestDiscoveryCacheEntry();
|
|
147
|
+
}
|
|
148
|
+
discoveryCache.set(key, { configuration, expiresAt: Date.now() + DISCOVERY_CACHE_TTL_MS });
|
|
149
|
+
}
|
|
150
|
+
async function resolveOidcConfiguration(discoveryUrl, getClientConfig) {
|
|
151
|
+
const clientConfig = getClientConfig();
|
|
152
|
+
if (clientConfig == null) return null;
|
|
153
|
+
const { clientId, clientSecret } = clientConfig;
|
|
154
|
+
const key = discoveryCacheKey(discoveryUrl, clientId, clientSecret);
|
|
155
|
+
const cached = discoveryCache.get(key);
|
|
156
|
+
if (cached !== void 0) {
|
|
157
|
+
if (cached.expiresAt > Date.now()) return cached.configuration;
|
|
158
|
+
discoveryCache.delete(key);
|
|
159
|
+
}
|
|
160
|
+
const inFlight = inFlightDiscoveries.get(key);
|
|
161
|
+
if (inFlight !== void 0) return inFlight;
|
|
162
|
+
const discoveryPromise = (async () => {
|
|
163
|
+
const { discovery } = await import("openid-client");
|
|
164
|
+
const configuration = await discovery(new URL(discoveryUrl), clientId, clientSecret);
|
|
165
|
+
cacheDiscoveryResult(key, configuration);
|
|
166
|
+
return configuration;
|
|
167
|
+
})();
|
|
168
|
+
inFlightDiscoveries.set(key, discoveryPromise);
|
|
169
|
+
try {
|
|
170
|
+
return await discoveryPromise;
|
|
171
|
+
} finally {
|
|
172
|
+
inFlightDiscoveries.delete(key);
|
|
173
|
+
}
|
|
174
|
+
}
|
|
175
|
+
|
|
53
176
|
// src/schema-markers.ts
|
|
54
177
|
var SENSITIVE_FIELD_MARKER = "@sensitive";
|
|
55
178
|
var ACTION_FIELD_MARKER = "@action";
|
|
@@ -273,6 +396,8 @@ function cssUnescape(css) {
|
|
|
273
396
|
0 && (module.exports = {
|
|
274
397
|
ACTION_FIELD_MARKER,
|
|
275
398
|
SENSITIVE_FIELD_MARKER,
|
|
399
|
+
createOAuth2Driver,
|
|
400
|
+
createOidcDriver,
|
|
276
401
|
escapeHtml,
|
|
277
402
|
extractSvgDimensions,
|
|
278
403
|
getActionAnnotation,
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"sources":["../src/index.ts","../src/html.ts","../src/schema-markers.ts","../../svg-sanitize/src/dimensions.ts","../../svg-sanitize/src/sanitize.ts"],"mappings":"
|
|
1
|
+
{"version":3,"sources":["../src/index.ts","../src/html.ts","../src/registries/auth.ts","../src/schema-markers.ts","../../svg-sanitize/src/dimensions.ts","../../svg-sanitize/src/sanitize.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACaO,SAAS,WAAW,GAAmB;AAC5C,SAAO,EAAE,QAAQ,YAAY,CAAC,MAAM;AAClC,YAAQ,GAAG;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT;AACE,eAAO;AAAA,IACX;AAAA,EACF,CAAC;AACH;;;AC9BA,yBAA2B;AA2K3B,SAAS,qBAAqB,OAAe,OAAe,SAAuB;AACjF,MAAI,MAAM,KAAK,MAAM,IAAI;AACvB,UAAM,IAAI,UAAU,GAAG,OAAO,MAAM,KAAK,+BAA+B;AAAA,EAC1E;AACF;AAEA,SAAS,eAAe,OAAe,OAAe,SAAuB;AAC3E,MAAI;AACF,QAAI,IAAI,KAAK;AAAA,EACf,QAAQ;AACN,UAAM,IAAI,UAAU,GAAG,OAAO,MAAM,KAAK,+BAA+B,KAAK,IAAI;AAAA,EACnF;AACF;AAEA,SAAS,qBAAqB,QAAkB,SAAuB;AACrE,aAAW,SAAS,QAAQ;AAC1B,yBAAqB,OAAO,YAAY,OAAO;AAAA,EACjD;AACF;AAkBO,SAAS,mBAAmB,SAAsD;AACvF,QAAM,UAAU;AAChB,uBAAqB,QAAQ,aAAa,eAAe,OAAO;AAChE,iBAAe,QAAQ,cAAc,gBAAgB,OAAO;AAC5D,iBAAe,QAAQ,UAAU,YAAY,OAAO;AACpD,QAAM,SAAS,QAAQ,UAAU,CAAC;AAClC,uBAAqB,QAAQ,OAAO;AAEpC,SAAO;AAAA,IACL,MAAM;AAAA,IACN,aAAa,QAAQ;AAAA,IACrB,SAAS,QAAQ;AAAA,IACjB,cAAc,QAAQ;AAAA,IACtB,UAAU,QAAQ;AAAA,IAClB;AAAA,IACA,MAAM,QAAQ;AAAA,IACd,iBAAiB,QAAQ;AAAA,IACzB,cAAc,QAAQ;AAAA,EACxB;AACF;AAEA,IAAM,sBAAyC,CAAC,UAAU,SAAS,SAAS;AAmBrE,SAAS,iBAAiB,SAAkD;AACjF,QAAM,UAAU;AAChB,uBAAqB,QAAQ,aAAa,eAAe,OAAO;AAChE,iBAAe,QAAQ,cAAc,gBAAgB,OAAO;AAC5D,QAAM,SAAS,QAAQ,UAAU,CAAC,GAAG,mBAAmB;AACxD,uBAAqB,QAAQ,OAAO;AAEpC,SAAO;AAAA,IACL,MAAM;AAAA,IACN,aAAa,QAAQ;AAAA,IACrB,SAAS,QAAQ;AAAA,IACjB,cAAc,QAAQ;AAAA,IACtB;AAAA,IACA,MAAM;AAAA,IACN,iBAAiB,QAAQ;AAAA,IACzB,kBAAkB,MAAM,yBAAyB,QAAQ,cAAc,QAAQ,eAAe;AAAA,IAC9F,WAAW,QAAQ;AAAA,IACnB,WAAW,QAAQ;AAAA,EACrB;AACF;AAsBA,IAAM,yBAAyB,IAAI,KAAK;AACxC,IAAM,8BAA8B;AAOpC,IAAM,iBAAiB,oBAAI,IAAiC;AAC5D,IAAM,sBAAsB,oBAAI,IAAoC;AAEpE,SAAS,kBAAkB,cAAsB,UAAkB,cAA8B;AAC/F,QAAM,wBAAoB,+BAAW,QAAQ,EAAE,OAAO,YAAY,EAAE,OAAO,KAAK;AAChF,aAAO,+BAAW,QAAQ,EAAE,OAAO,GAAG,YAAY,KAAK,QAAQ,KAAK,iBAAiB,EAAE,EAAE,OAAO,KAAK;AACvG;AAEA,SAAS,iCAAuC;AAC9C,MAAI;AACJ,MAAI,kBAAkB,OAAO;AAC7B,aAAW,CAAC,KAAK,KAAK,KAAK,gBAAgB;AACzC,QAAI,MAAM,YAAY,iBAAiB;AACrC,wBAAkB,MAAM;AACxB,kBAAY;AAAA,IACd;AAAA,EACF;AACA,MAAI,cAAc,QAAW;AAC3B,mBAAe,OAAO,SAAS;AAAA,EACjC;AACF;AAEA,SAAS,qBAAqB,KAAa,eAAoC;AAC7E,MAAI,CAAC,eAAe,IAAI,GAAG,KAAK,eAAe,QAAQ,6BAA6B;AAClF,mCAA+B;AAAA,EACjC;AACA,iBAAe,IAAI,KAAK,EAAE,eAAe,WAAW,KAAK,IAAI,IAAI,uBAAuB,CAAC;AAC3F;AASA,eAAe,yBAAyB,cAAsB,iBAAgF;AAC5I,QAAM,eAAe,gBAAgB;AACrC,MAAI,gBAAgB,KAAM,QAAO;AAajC,QAAM,EAAE,UAAU,aAAa,IAAI;AAEnC,QAAM,MAAM,kBAAkB,cAAc,UAAU,YAAY;AAElE,QAAM,SAAS,eAAe,IAAI,GAAG;AACrC,MAAI,WAAW,QAAW;AACxB,QAAI,OAAO,YAAY,KAAK,IAAI,EAAG,QAAO,OAAO;AACjD,mBAAe,OAAO,GAAG;AAAA,EAC3B;AAEA,QAAM,WAAW,oBAAoB,IAAI,GAAG;AAC5C,MAAI,aAAa,OAAW,QAAO;AAEnC,QAAM,oBAAoB,YAAY;AACpC,UAAM,EAAE,UAAU,IAAI,MAAM,OAAO,eAAe;AAClD,UAAM,gBAAgB,MAAM,UAAU,IAAI,IAAI,YAAY,GAAG,UAAU,YAAY;AACnF,yBAAqB,KAAK,aAAa;AACvC,WAAO;AAAA,EACT,GAAG;AAEH,sBAAoB,IAAI,KAAK,gBAAgB;AAC7C,MAAI;AACF,WAAO,MAAM;AAAA,EACf,UAAE;AACA,wBAAoB,OAAO,GAAG;AAAA,EAChC;AACF;;;AC7VO,IAAM,yBAAyB;AAa/B,IAAM,sBAAsB;AAQ5B,SAAS,iBAAiB,OAA8B;AAC7D,QAAM,cAAc,MAAM;AAC1B,SAAO,OAAO,gBAAgB,YAAY,YAAY,UAAU,EAAE,WAAW,sBAAsB;AACrG;AA6BO,SAAS,oBAAoB,OAA8C;AAChF,QAAM,cAAc,MAAM;AAC1B,MAAI,OAAO,gBAAgB,SAAU,QAAO;AAC5C,QAAM,UAAU,YAAY,UAAU;AACtC,MAAI,CAAC,QAAQ,WAAW,mBAAmB,EAAG,QAAO;AAErD,QAAM,OAAO,QAAQ,MAAM,oBAAoB,MAAM,EAAE,UAAU;AAEjE,QAAM,QAAQ,KAAK,MAAM,mCAAmC;AAC5D,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,CAAC,EAAE,OAAO,QAAQ,IAAI,IAAI;AAChC,SAAO,EAAE,OAAO,QAA8C,KAAK;AACrE;;;AEzFA,oBAAyC;ADqBzC,IAAM,mBAAmB;AAElB,SAAS,qBAAqB,KAAuD;AAC1F,QAAM,QAAQ,uFAAuF,KAAK,GAAG;AAC7G,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,QAAQ,KAAK,MAAM,OAAO,MAAM,CAAC,CAAC,CAAC;AACzC,QAAM,SAAS,KAAK,MAAM,OAAO,MAAM,CAAC,CAAC,CAAC;AAC1C,MAAI,CAAC,OAAO,SAAS,KAAK,KAAK,CAAC,OAAO,SAAS,MAAM,EAAG,QAAO;AAChE,MAAI,SAAS,KAAK,UAAU,KAAK,QAAQ,oBAAoB,SAAS,iBAAkB,QAAO;AAC/F,SAAO,EAAE,OAAO,OAAO;AACzB;AC+CO,SAAS,YAAY,OAAe,QAA8C;AACvF,QAAM,MAAM,SAAS,KAAK;AAC1B,MAAI,CAAC,IAAK,QAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB;AAEtD,MAAI,IAAI,SAAS;AAKf,WAAO,EAAE,IAAI,OAAO,QAAQ,sBAAsB;EACpD;AACA,QAAM,OAAO,IAAI;AACjB,MAAI,CAAC,uBAAuB,IAAI,GAAG;AACjC,WAAO,EAAE,IAAI,OAAO,QAAQ,kBAAkB;EAChD;AAEA,sBAAoB,MAAM,QAAQ,IAAI;AAEtC,QAAM,aAAa,IAAI,4BAAc;AACrC,QAAM,aAAa,WAAW,kBAAkB,IAAI;AAOpD,QAAM,YAAY,SAAS,UAAU;AACrC,MAAI,CAAC,aAAa,CAAC,uBAAuB,UAAU,eAAe,GAAG;AACpE,WAAO,EAAE,IAAI,OAAO,QAAQ,uCAAuC;EACrE;AAEA,SAAO,EAAE,IAAI,MAAM,KAAK,WAAW;AACrC;AAEA,IAAM,oBAAoB;AAW1B,IAAM,oBAAoB;AAU1B,IAAM,sBAAsB;AAgB5B,SAAS,sBAAsB,IAAsB;AACnD,SAAO,GAAG,iBAAiB,qBAAqB,GAAG,UAAU;AAC/D;AAUA,SAAS,uBAAuB,IAA+C;AAC7E,SAAO,MAAM,QAAQ,GAAG,cAAc,SAAS,sBAAsB,EAAE;AACzE;AAWA,SAAS,SAAS,QAAgB;AAChC,MAAI;AACF,WAAO,IAAI,wBAAU,EAAE,SAAS,MAAM,OAAU,CAAC,EAAE,gBAAgB,QAAQ,eAAe;EAC5F,QAAQ;AACN,WAAO;EACT;AACF;AAWA,IAAM,mBAAmB,oBAAI,IAAI;EAC/B;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;AACF,CAAC;AAED,IAAM,8BAA8B;AACpC,IAAM,eAAe;AAErB,SAAS,oBAAoB,IAAa,QAA2B,QAAuB;AAC1F,qBAAmB,IAAI,QAAQ,MAAM;AAErC,MAAI,GAAG,cAAc,SAAS;AAG5B,OAAG,cAAc,kBAAkB,GAAG,eAAe,EAAE;AACvD;EACF;AAEA,aAAW,SAAS,MAAM,KAAK,GAAG,UAAU,GAAG;AAC7C,QAAI,MAAM,aAAa,6BAA6B;AAClD,SAAG,YAAY,KAAK;AACpB;IACF;AACA,QAAI,MAAM,aAAa,aAAc;AACrC,UAAM,UAAU;AAMhB,QAAI,CAAC,sBAAsB,OAAO,KAAK,CAAC,iBAAiB,IAAI,QAAQ,aAAa,QAAQ,QAAQ,GAAG;AACnG,SAAG,YAAY,OAAO;AACtB;IACF;AACA,wBAAoB,SAAS,QAAQ,KAAK;EAC5C;AACF;AAEA,SAAS,mBAAmB,IAAa,QAA2B,QAAuB;AACzF,aAAW,QAAQ,MAAM,KAAK,GAAG,UAAU,GAAG;AAC5C,UAAM,YAAY,KAAK,aAAa,KAAK;AACzC,QAAI,OAAO,KAAK,SAAS,GAAG;AAC1B,SAAG,oBAAoB,IAAI;AAC3B;IACF;AACA,QAAI,cAAc,SAAS;AACzB,SAAG,oBAAoB,IAAI;AAC3B;IACF;AACA,QAAI,cAAc,UAAU,KAAK,iBAAiB,mBAAmB;AAcnE,SAAG,oBAAoB,IAAI;AAC3B;IACF;AACA,QAAI,cAAc,QAAQ;AACxB,YAAM,iBAAiB,kBAAkB,KAAK,OAAO,MAAM;AAC3D,UAAI,mBAAmB,MAAM;AAC3B,WAAG,oBAAoB,IAAI;MAC7B,OAAO;AACL,aAAK,QAAQ;MACf;AACA;IACF;AACA,QAAI,8BAA8B,IAAI,SAAS,GAAG;AAChD,UAAI,CAAC,iBAAiB,KAAK,KAAK,GAAG;AACjC,WAAG,oBAAoB,IAAI;MAC7B;AACA;IACF;AACA,QAAI,KAAK,SAAS,WAAW,KAAK,KAAK,WAAW,QAAQ,GAAG;AAC3D,UAAI,CAAC,UAAU,CAAC,oCAAoC,IAAI,GAAG;AACzD,WAAG,oBAAoB,IAAI;MAC7B;IACF;EACF;AACF;AAoBA,SAAS,oCAAoC,MAAqB;AAChE,MAAI,KAAK,SAAS,QAAS,QAAO;AAClC,SAAO,KAAK,SAAS,iBAAiB,KAAK,UAAU;AACvD;AAQA,IAAM,gCAAgC,oBAAI,IAAI;EAC5C;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;AACF,CAAC;AAED,IAAM,mBAAmB;AAWzB,SAAS,iBAAiB,UAA2B;AAOnD,QAAM,UAAU,MAAM,KAAK,YAAY,QAAQ,EAAE,SAAS,gBAAgB,CAAC;AAC3E,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,SAAO,QAAQ,MAAM,CAAC,CAAC,EAAE,EAAE,MAAM,MAAM,OAAO,KAAK,EAAE,WAAW,GAAG,CAAC;AACtE;AAGA,SAAS,kBAAkB,UAAkB,QAA0C;AACrF,QAAM,QAAQ,SAAS,KAAK;AAC5B,MAAI,MAAM,WAAW,GAAG,EAAG,QAAO;AAClC,MAAI,gBAAgB,KAAK,KAAK,EAAG,QAAO;AACxC,MAAI,UAAU,KAAK,KAAK,EAAG,QAAO;AAClC,MAAI,MAAM,WAAW,IAAI,EAAG,QAAO;AACnC,MAAI,OAAO,iBAAiB,eAAe,KAAK,KAAK,EAAG,QAAO;AAC/D,SAAO;AACT;AA6CA,SAAS,kBAAkB,KAAqB;AAM9C,QAAM,kBAAkB,IAAI,QAAQ,qBAAqB,GAAG;AAC5D,MAAI,MAAM,YAAY,eAAe;AACrC,QAAM,IAAI,QAAQ,sBAAsB,EAAE;AAC1C,QAAM,IAAI,QAAQ,kBAAkB,CAAC,OAAO,QAAQ,WAAY,OAAO,KAAK,EAAE,WAAW,GAAG,IAAI,QAAQ,MAAO;AAC/G,SAAO;AACT;AAaA,SAAS,YAAY,KAAqB;AACxC,SAAO,IAAI,QAAQ,uDAAuD,CAAC,QAAQ,KAAyB,YAAgC;AAC1I,QAAI,QAAQ,QAAW;AACrB,YAAM,YAAY,OAAO,SAAS,KAAK,EAAE;AACzC,UAAI,cAAc,KAAK,YAAY,WAAa,aAAa,SAAU,aAAa,MAAS,QAAO;AACpG,aAAO,OAAO,cAAc,SAAS;IACvC;AACA,QAAI,YAAY,OAAW,QAAO;AAClC,WAAO;EACT,CAAC;AACH;","names":[]}
|
package/dist/index.mjs
CHANGED
|
@@ -18,6 +18,117 @@ function escapeHtml(s) {
|
|
|
18
18
|
});
|
|
19
19
|
}
|
|
20
20
|
|
|
21
|
+
// src/registries/auth.ts
|
|
22
|
+
import { createHash } from "crypto";
|
|
23
|
+
function assertNonEmptyString(value, label, factory) {
|
|
24
|
+
if (value.trim() === "") {
|
|
25
|
+
throw new TypeError(`${factory}: '${label}' must be a non-empty string.`);
|
|
26
|
+
}
|
|
27
|
+
}
|
|
28
|
+
function assertValidUrl(value, label, factory) {
|
|
29
|
+
try {
|
|
30
|
+
new URL(value);
|
|
31
|
+
} catch {
|
|
32
|
+
throw new TypeError(`${factory}: '${label}' must be a valid URL, got '${value}'.`);
|
|
33
|
+
}
|
|
34
|
+
}
|
|
35
|
+
function assertNonEmptyScopes(scopes, factory) {
|
|
36
|
+
for (const scope of scopes) {
|
|
37
|
+
assertNonEmptyString(scope, "scopes[]", factory);
|
|
38
|
+
}
|
|
39
|
+
}
|
|
40
|
+
function createOAuth2Driver(options) {
|
|
41
|
+
const FACTORY = "createOAuth2Driver";
|
|
42
|
+
assertNonEmptyString(options.buttonLabel, "buttonLabel", FACTORY);
|
|
43
|
+
assertValidUrl(options.authorizeUrl, "authorizeUrl", FACTORY);
|
|
44
|
+
assertValidUrl(options.tokenUrl, "tokenUrl", FACTORY);
|
|
45
|
+
const scopes = options.scopes ?? [];
|
|
46
|
+
assertNonEmptyScopes(scopes, FACTORY);
|
|
47
|
+
return {
|
|
48
|
+
kind: "oauth2",
|
|
49
|
+
buttonLabel: options.buttonLabel,
|
|
50
|
+
iconUrl: options.iconUrl,
|
|
51
|
+
authorizeUrl: options.authorizeUrl,
|
|
52
|
+
tokenUrl: options.tokenUrl,
|
|
53
|
+
scopes,
|
|
54
|
+
pkce: options.pkce,
|
|
55
|
+
getClientConfig: options.getClientConfig,
|
|
56
|
+
fetchProfile: options.fetchProfile
|
|
57
|
+
};
|
|
58
|
+
}
|
|
59
|
+
var DEFAULT_OIDC_SCOPES = ["openid", "email", "profile"];
|
|
60
|
+
function createOidcDriver(options) {
|
|
61
|
+
const FACTORY = "createOidcDriver";
|
|
62
|
+
assertNonEmptyString(options.buttonLabel, "buttonLabel", FACTORY);
|
|
63
|
+
assertValidUrl(options.discoveryUrl, "discoveryUrl", FACTORY);
|
|
64
|
+
const scopes = options.scopes ?? [...DEFAULT_OIDC_SCOPES];
|
|
65
|
+
assertNonEmptyScopes(scopes, FACTORY);
|
|
66
|
+
return {
|
|
67
|
+
kind: "oidc",
|
|
68
|
+
buttonLabel: options.buttonLabel,
|
|
69
|
+
iconUrl: options.iconUrl,
|
|
70
|
+
discoveryUrl: options.discoveryUrl,
|
|
71
|
+
scopes,
|
|
72
|
+
pkce: true,
|
|
73
|
+
getClientConfig: options.getClientConfig,
|
|
74
|
+
getConfiguration: () => resolveOidcConfiguration(options.discoveryUrl, options.getClientConfig),
|
|
75
|
+
authorize: options.authorize,
|
|
76
|
+
mapClaims: options.mapClaims
|
|
77
|
+
};
|
|
78
|
+
}
|
|
79
|
+
var DISCOVERY_CACHE_TTL_MS = 5 * 60 * 1e3;
|
|
80
|
+
var DISCOVERY_CACHE_MAX_ENTRIES = 64;
|
|
81
|
+
var discoveryCache = /* @__PURE__ */ new Map();
|
|
82
|
+
var inFlightDiscoveries = /* @__PURE__ */ new Map();
|
|
83
|
+
function discoveryCacheKey(discoveryUrl, clientId, clientSecret) {
|
|
84
|
+
const secretFingerprint = createHash("sha256").update(clientSecret).digest("hex");
|
|
85
|
+
return createHash("sha256").update(`${discoveryUrl}\0${clientId}\0${secretFingerprint}`).digest("hex");
|
|
86
|
+
}
|
|
87
|
+
function evictOldestDiscoveryCacheEntry() {
|
|
88
|
+
let oldestKey;
|
|
89
|
+
let oldestExpiresAt = Number.POSITIVE_INFINITY;
|
|
90
|
+
for (const [key, entry] of discoveryCache) {
|
|
91
|
+
if (entry.expiresAt < oldestExpiresAt) {
|
|
92
|
+
oldestExpiresAt = entry.expiresAt;
|
|
93
|
+
oldestKey = key;
|
|
94
|
+
}
|
|
95
|
+
}
|
|
96
|
+
if (oldestKey !== void 0) {
|
|
97
|
+
discoveryCache.delete(oldestKey);
|
|
98
|
+
}
|
|
99
|
+
}
|
|
100
|
+
function cacheDiscoveryResult(key, configuration) {
|
|
101
|
+
if (!discoveryCache.has(key) && discoveryCache.size >= DISCOVERY_CACHE_MAX_ENTRIES) {
|
|
102
|
+
evictOldestDiscoveryCacheEntry();
|
|
103
|
+
}
|
|
104
|
+
discoveryCache.set(key, { configuration, expiresAt: Date.now() + DISCOVERY_CACHE_TTL_MS });
|
|
105
|
+
}
|
|
106
|
+
async function resolveOidcConfiguration(discoveryUrl, getClientConfig) {
|
|
107
|
+
const clientConfig = getClientConfig();
|
|
108
|
+
if (clientConfig == null) return null;
|
|
109
|
+
const { clientId, clientSecret } = clientConfig;
|
|
110
|
+
const key = discoveryCacheKey(discoveryUrl, clientId, clientSecret);
|
|
111
|
+
const cached = discoveryCache.get(key);
|
|
112
|
+
if (cached !== void 0) {
|
|
113
|
+
if (cached.expiresAt > Date.now()) return cached.configuration;
|
|
114
|
+
discoveryCache.delete(key);
|
|
115
|
+
}
|
|
116
|
+
const inFlight = inFlightDiscoveries.get(key);
|
|
117
|
+
if (inFlight !== void 0) return inFlight;
|
|
118
|
+
const discoveryPromise = (async () => {
|
|
119
|
+
const { discovery } = await import("openid-client");
|
|
120
|
+
const configuration = await discovery(new URL(discoveryUrl), clientId, clientSecret);
|
|
121
|
+
cacheDiscoveryResult(key, configuration);
|
|
122
|
+
return configuration;
|
|
123
|
+
})();
|
|
124
|
+
inFlightDiscoveries.set(key, discoveryPromise);
|
|
125
|
+
try {
|
|
126
|
+
return await discoveryPromise;
|
|
127
|
+
} finally {
|
|
128
|
+
inFlightDiscoveries.delete(key);
|
|
129
|
+
}
|
|
130
|
+
}
|
|
131
|
+
|
|
21
132
|
// src/schema-markers.ts
|
|
22
133
|
var SENSITIVE_FIELD_MARKER = "@sensitive";
|
|
23
134
|
var ACTION_FIELD_MARKER = "@action";
|
|
@@ -240,6 +351,8 @@ function cssUnescape(css) {
|
|
|
240
351
|
export {
|
|
241
352
|
ACTION_FIELD_MARKER,
|
|
242
353
|
SENSITIVE_FIELD_MARKER,
|
|
354
|
+
createOAuth2Driver,
|
|
355
|
+
createOidcDriver,
|
|
243
356
|
escapeHtml,
|
|
244
357
|
extractSvgDimensions,
|
|
245
358
|
getActionAnnotation,
|
package/dist/index.mjs.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"sources":["../src/html.ts","../src/schema-markers.ts","../../svg-sanitize/src/dimensions.ts","../../svg-sanitize/src/sanitize.ts"],"mappings":";AAaO,SAAS,WAAW,GAAmB;AAC5C,SAAO,EAAE,QAAQ,YAAY,CAAC,MAAM;AAClC,YAAQ,GAAG;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT;AACE,eAAO;AAAA,IACX;AAAA,EACF,CAAC;AACH;;;
|
|
1
|
+
{"version":3,"sources":["../src/html.ts","../src/registries/auth.ts","../src/schema-markers.ts","../../svg-sanitize/src/dimensions.ts","../../svg-sanitize/src/sanitize.ts"],"mappings":";AAaO,SAAS,WAAW,GAAmB;AAC5C,SAAO,EAAE,QAAQ,YAAY,CAAC,MAAM;AAClC,YAAQ,GAAG;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT;AACE,eAAO;AAAA,IACX;AAAA,EACF,CAAC;AACH;;;AC9BA,SAAS,kBAAkB;AA2K3B,SAAS,qBAAqB,OAAe,OAAe,SAAuB;AACjF,MAAI,MAAM,KAAK,MAAM,IAAI;AACvB,UAAM,IAAI,UAAU,GAAG,OAAO,MAAM,KAAK,+BAA+B;AAAA,EAC1E;AACF;AAEA,SAAS,eAAe,OAAe,OAAe,SAAuB;AAC3E,MAAI;AACF,QAAI,IAAI,KAAK;AAAA,EACf,QAAQ;AACN,UAAM,IAAI,UAAU,GAAG,OAAO,MAAM,KAAK,+BAA+B,KAAK,IAAI;AAAA,EACnF;AACF;AAEA,SAAS,qBAAqB,QAAkB,SAAuB;AACrE,aAAW,SAAS,QAAQ;AAC1B,yBAAqB,OAAO,YAAY,OAAO;AAAA,EACjD;AACF;AAkBO,SAAS,mBAAmB,SAAsD;AACvF,QAAM,UAAU;AAChB,uBAAqB,QAAQ,aAAa,eAAe,OAAO;AAChE,iBAAe,QAAQ,cAAc,gBAAgB,OAAO;AAC5D,iBAAe,QAAQ,UAAU,YAAY,OAAO;AACpD,QAAM,SAAS,QAAQ,UAAU,CAAC;AAClC,uBAAqB,QAAQ,OAAO;AAEpC,SAAO;AAAA,IACL,MAAM;AAAA,IACN,aAAa,QAAQ;AAAA,IACrB,SAAS,QAAQ;AAAA,IACjB,cAAc,QAAQ;AAAA,IACtB,UAAU,QAAQ;AAAA,IAClB;AAAA,IACA,MAAM,QAAQ;AAAA,IACd,iBAAiB,QAAQ;AAAA,IACzB,cAAc,QAAQ;AAAA,EACxB;AACF;AAEA,IAAM,sBAAyC,CAAC,UAAU,SAAS,SAAS;AAmBrE,SAAS,iBAAiB,SAAkD;AACjF,QAAM,UAAU;AAChB,uBAAqB,QAAQ,aAAa,eAAe,OAAO;AAChE,iBAAe,QAAQ,cAAc,gBAAgB,OAAO;AAC5D,QAAM,SAAS,QAAQ,UAAU,CAAC,GAAG,mBAAmB;AACxD,uBAAqB,QAAQ,OAAO;AAEpC,SAAO;AAAA,IACL,MAAM;AAAA,IACN,aAAa,QAAQ;AAAA,IACrB,SAAS,QAAQ;AAAA,IACjB,cAAc,QAAQ;AAAA,IACtB;AAAA,IACA,MAAM;AAAA,IACN,iBAAiB,QAAQ;AAAA,IACzB,kBAAkB,MAAM,yBAAyB,QAAQ,cAAc,QAAQ,eAAe;AAAA,IAC9F,WAAW,QAAQ;AAAA,IACnB,WAAW,QAAQ;AAAA,EACrB;AACF;AAsBA,IAAM,yBAAyB,IAAI,KAAK;AACxC,IAAM,8BAA8B;AAOpC,IAAM,iBAAiB,oBAAI,IAAiC;AAC5D,IAAM,sBAAsB,oBAAI,IAAoC;AAEpE,SAAS,kBAAkB,cAAsB,UAAkB,cAA8B;AAC/F,QAAM,oBAAoB,WAAW,QAAQ,EAAE,OAAO,YAAY,EAAE,OAAO,KAAK;AAChF,SAAO,WAAW,QAAQ,EAAE,OAAO,GAAG,YAAY,KAAK,QAAQ,KAAK,iBAAiB,EAAE,EAAE,OAAO,KAAK;AACvG;AAEA,SAAS,iCAAuC;AAC9C,MAAI;AACJ,MAAI,kBAAkB,OAAO;AAC7B,aAAW,CAAC,KAAK,KAAK,KAAK,gBAAgB;AACzC,QAAI,MAAM,YAAY,iBAAiB;AACrC,wBAAkB,MAAM;AACxB,kBAAY;AAAA,IACd;AAAA,EACF;AACA,MAAI,cAAc,QAAW;AAC3B,mBAAe,OAAO,SAAS;AAAA,EACjC;AACF;AAEA,SAAS,qBAAqB,KAAa,eAAoC;AAC7E,MAAI,CAAC,eAAe,IAAI,GAAG,KAAK,eAAe,QAAQ,6BAA6B;AAClF,mCAA+B;AAAA,EACjC;AACA,iBAAe,IAAI,KAAK,EAAE,eAAe,WAAW,KAAK,IAAI,IAAI,uBAAuB,CAAC;AAC3F;AASA,eAAe,yBAAyB,cAAsB,iBAAgF;AAC5I,QAAM,eAAe,gBAAgB;AACrC,MAAI,gBAAgB,KAAM,QAAO;AAajC,QAAM,EAAE,UAAU,aAAa,IAAI;AAEnC,QAAM,MAAM,kBAAkB,cAAc,UAAU,YAAY;AAElE,QAAM,SAAS,eAAe,IAAI,GAAG;AACrC,MAAI,WAAW,QAAW;AACxB,QAAI,OAAO,YAAY,KAAK,IAAI,EAAG,QAAO,OAAO;AACjD,mBAAe,OAAO,GAAG;AAAA,EAC3B;AAEA,QAAM,WAAW,oBAAoB,IAAI,GAAG;AAC5C,MAAI,aAAa,OAAW,QAAO;AAEnC,QAAM,oBAAoB,YAAY;AACpC,UAAM,EAAE,UAAU,IAAI,MAAM,OAAO,eAAe;AAClD,UAAM,gBAAgB,MAAM,UAAU,IAAI,IAAI,YAAY,GAAG,UAAU,YAAY;AACnF,yBAAqB,KAAK,aAAa;AACvC,WAAO;AAAA,EACT,GAAG;AAEH,sBAAoB,IAAI,KAAK,gBAAgB;AAC7C,MAAI;AACF,WAAO,MAAM;AAAA,EACf,UAAE;AACA,wBAAoB,OAAO,GAAG;AAAA,EAChC;AACF;;;AC7VO,IAAM,yBAAyB;AAa/B,IAAM,sBAAsB;AAQ5B,SAAS,iBAAiB,OAA8B;AAC7D,QAAM,cAAc,MAAM;AAC1B,SAAO,OAAO,gBAAgB,YAAY,YAAY,UAAU,EAAE,WAAW,sBAAsB;AACrG;AA6BO,SAAS,oBAAoB,OAA8C;AAChF,QAAM,cAAc,MAAM;AAC1B,MAAI,OAAO,gBAAgB,SAAU,QAAO;AAC5C,QAAM,UAAU,YAAY,UAAU;AACtC,MAAI,CAAC,QAAQ,WAAW,mBAAmB,EAAG,QAAO;AAErD,QAAM,OAAO,QAAQ,MAAM,oBAAoB,MAAM,EAAE,UAAU;AAEjE,QAAM,QAAQ,KAAK,MAAM,mCAAmC;AAC5D,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,CAAC,EAAE,OAAO,QAAQ,IAAI,IAAI;AAChC,SAAO,EAAE,OAAO,QAA8C,KAAK;AACrE;;;AEzFA,SAAS,WAAW,qBAAqB;ADqBzC,IAAM,mBAAmB;AAElB,SAAS,qBAAqB,KAAuD;AAC1F,QAAM,QAAQ,uFAAuF,KAAK,GAAG;AAC7G,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,QAAQ,KAAK,MAAM,OAAO,MAAM,CAAC,CAAC,CAAC;AACzC,QAAM,SAAS,KAAK,MAAM,OAAO,MAAM,CAAC,CAAC,CAAC;AAC1C,MAAI,CAAC,OAAO,SAAS,KAAK,KAAK,CAAC,OAAO,SAAS,MAAM,EAAG,QAAO;AAChE,MAAI,SAAS,KAAK,UAAU,KAAK,QAAQ,oBAAoB,SAAS,iBAAkB,QAAO;AAC/F,SAAO,EAAE,OAAO,OAAO;AACzB;AC+CO,SAAS,YAAY,OAAe,QAA8C;AACvF,QAAM,MAAM,SAAS,KAAK;AAC1B,MAAI,CAAC,IAAK,QAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB;AAEtD,MAAI,IAAI,SAAS;AAKf,WAAO,EAAE,IAAI,OAAO,QAAQ,sBAAsB;EACpD;AACA,QAAM,OAAO,IAAI;AACjB,MAAI,CAAC,uBAAuB,IAAI,GAAG;AACjC,WAAO,EAAE,IAAI,OAAO,QAAQ,kBAAkB;EAChD;AAEA,sBAAoB,MAAM,QAAQ,IAAI;AAEtC,QAAM,aAAa,IAAI,cAAc;AACrC,QAAM,aAAa,WAAW,kBAAkB,IAAI;AAOpD,QAAM,YAAY,SAAS,UAAU;AACrC,MAAI,CAAC,aAAa,CAAC,uBAAuB,UAAU,eAAe,GAAG;AACpE,WAAO,EAAE,IAAI,OAAO,QAAQ,uCAAuC;EACrE;AAEA,SAAO,EAAE,IAAI,MAAM,KAAK,WAAW;AACrC;AAEA,IAAM,oBAAoB;AAW1B,IAAM,oBAAoB;AAU1B,IAAM,sBAAsB;AAgB5B,SAAS,sBAAsB,IAAsB;AACnD,SAAO,GAAG,iBAAiB,qBAAqB,GAAG,UAAU;AAC/D;AAUA,SAAS,uBAAuB,IAA+C;AAC7E,SAAO,MAAM,QAAQ,GAAG,cAAc,SAAS,sBAAsB,EAAE;AACzE;AAWA,SAAS,SAAS,QAAgB;AAChC,MAAI;AACF,WAAO,IAAI,UAAU,EAAE,SAAS,MAAM,OAAU,CAAC,EAAE,gBAAgB,QAAQ,eAAe;EAC5F,QAAQ;AACN,WAAO;EACT;AACF;AAWA,IAAM,mBAAmB,oBAAI,IAAI;EAC/B;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;AACF,CAAC;AAED,IAAM,8BAA8B;AACpC,IAAM,eAAe;AAErB,SAAS,oBAAoB,IAAa,QAA2B,QAAuB;AAC1F,qBAAmB,IAAI,QAAQ,MAAM;AAErC,MAAI,GAAG,cAAc,SAAS;AAG5B,OAAG,cAAc,kBAAkB,GAAG,eAAe,EAAE;AACvD;EACF;AAEA,aAAW,SAAS,MAAM,KAAK,GAAG,UAAU,GAAG;AAC7C,QAAI,MAAM,aAAa,6BAA6B;AAClD,SAAG,YAAY,KAAK;AACpB;IACF;AACA,QAAI,MAAM,aAAa,aAAc;AACrC,UAAM,UAAU;AAMhB,QAAI,CAAC,sBAAsB,OAAO,KAAK,CAAC,iBAAiB,IAAI,QAAQ,aAAa,QAAQ,QAAQ,GAAG;AACnG,SAAG,YAAY,OAAO;AACtB;IACF;AACA,wBAAoB,SAAS,QAAQ,KAAK;EAC5C;AACF;AAEA,SAAS,mBAAmB,IAAa,QAA2B,QAAuB;AACzF,aAAW,QAAQ,MAAM,KAAK,GAAG,UAAU,GAAG;AAC5C,UAAM,YAAY,KAAK,aAAa,KAAK;AACzC,QAAI,OAAO,KAAK,SAAS,GAAG;AAC1B,SAAG,oBAAoB,IAAI;AAC3B;IACF;AACA,QAAI,cAAc,SAAS;AACzB,SAAG,oBAAoB,IAAI;AAC3B;IACF;AACA,QAAI,cAAc,UAAU,KAAK,iBAAiB,mBAAmB;AAcnE,SAAG,oBAAoB,IAAI;AAC3B;IACF;AACA,QAAI,cAAc,QAAQ;AACxB,YAAM,iBAAiB,kBAAkB,KAAK,OAAO,MAAM;AAC3D,UAAI,mBAAmB,MAAM;AAC3B,WAAG,oBAAoB,IAAI;MAC7B,OAAO;AACL,aAAK,QAAQ;MACf;AACA;IACF;AACA,QAAI,8BAA8B,IAAI,SAAS,GAAG;AAChD,UAAI,CAAC,iBAAiB,KAAK,KAAK,GAAG;AACjC,WAAG,oBAAoB,IAAI;MAC7B;AACA;IACF;AACA,QAAI,KAAK,SAAS,WAAW,KAAK,KAAK,WAAW,QAAQ,GAAG;AAC3D,UAAI,CAAC,UAAU,CAAC,oCAAoC,IAAI,GAAG;AACzD,WAAG,oBAAoB,IAAI;MAC7B;IACF;EACF;AACF;AAoBA,SAAS,oCAAoC,MAAqB;AAChE,MAAI,KAAK,SAAS,QAAS,QAAO;AAClC,SAAO,KAAK,SAAS,iBAAiB,KAAK,UAAU;AACvD;AAQA,IAAM,gCAAgC,oBAAI,IAAI;EAC5C;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;AACF,CAAC;AAED,IAAM,mBAAmB;AAWzB,SAAS,iBAAiB,UAA2B;AAOnD,QAAM,UAAU,MAAM,KAAK,YAAY,QAAQ,EAAE,SAAS,gBAAgB,CAAC;AAC3E,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,SAAO,QAAQ,MAAM,CAAC,CAAC,EAAE,EAAE,MAAM,MAAM,OAAO,KAAK,EAAE,WAAW,GAAG,CAAC;AACtE;AAGA,SAAS,kBAAkB,UAAkB,QAA0C;AACrF,QAAM,QAAQ,SAAS,KAAK;AAC5B,MAAI,MAAM,WAAW,GAAG,EAAG,QAAO;AAClC,MAAI,gBAAgB,KAAK,KAAK,EAAG,QAAO;AACxC,MAAI,UAAU,KAAK,KAAK,EAAG,QAAO;AAClC,MAAI,MAAM,WAAW,IAAI,EAAG,QAAO;AACnC,MAAI,OAAO,iBAAiB,eAAe,KAAK,KAAK,EAAG,QAAO;AAC/D,SAAO;AACT;AA6CA,SAAS,kBAAkB,KAAqB;AAM9C,QAAM,kBAAkB,IAAI,QAAQ,qBAAqB,GAAG;AAC5D,MAAI,MAAM,YAAY,eAAe;AACrC,QAAM,IAAI,QAAQ,sBAAsB,EAAE;AAC1C,QAAM,IAAI,QAAQ,kBAAkB,CAAC,OAAO,QAAQ,WAAY,OAAO,KAAK,EAAE,WAAW,GAAG,IAAI,QAAQ,MAAO;AAC/G,SAAO;AACT;AAaA,SAAS,YAAY,KAAqB;AACxC,SAAO,IAAI,QAAQ,uDAAuD,CAAC,QAAQ,KAAyB,YAAgC;AAC1I,QAAI,QAAQ,QAAW;AACrB,YAAM,YAAY,OAAO,SAAS,KAAK,EAAE;AACzC,UAAI,cAAc,KAAK,YAAY,WAAa,aAAa,SAAU,aAAa,MAAS,QAAO;AACpG,aAAO,OAAO,cAAc,SAAS;IACvC;AACA,QAAI,YAAY,OAAW,QAAO;AAClC,WAAO;EACT,CAAC;AACH;","names":[]}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@crowi/plugin-api",
|
|
3
|
-
"version": "1.0.0-alpha.
|
|
3
|
+
"version": "1.0.0-alpha.7",
|
|
4
4
|
"description": "Type-only contract for Crowi 2.0 plugins. See docs/rfcs/0001-plugin-architecture.md.",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
@@ -25,13 +25,13 @@
|
|
|
25
25
|
"access": "public"
|
|
26
26
|
},
|
|
27
27
|
"peerDependencies": {
|
|
28
|
-
"hono": "^4.12.
|
|
28
|
+
"hono": "^4.12.34",
|
|
29
29
|
"zod": "^4"
|
|
30
30
|
},
|
|
31
31
|
"devDependencies": {
|
|
32
32
|
"@types/jest": "^29.5.14",
|
|
33
33
|
"@types/node": "^24",
|
|
34
|
-
"hono": "^4.12.
|
|
34
|
+
"hono": "^4.12.34",
|
|
35
35
|
"jest": "^29.7.0",
|
|
36
36
|
"ts-jest": "^29.3.4",
|
|
37
37
|
"tsup": "^8.3.5",
|
|
@@ -41,7 +41,8 @@
|
|
|
41
41
|
"@crowi/tsconfig": "0.1.0-alpha.0"
|
|
42
42
|
},
|
|
43
43
|
"dependencies": {
|
|
44
|
-
"@xmldom/xmldom": "^0.9.10"
|
|
44
|
+
"@xmldom/xmldom": "^0.9.10",
|
|
45
|
+
"openid-client": "^6.8.4"
|
|
45
46
|
},
|
|
46
47
|
"scripts": {
|
|
47
48
|
"build": "tsup",
|