@crvouga/mockingbird-service-oauth 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog — @crvouga/mockingbird-service-oauth
 
+## 0.2.0 (2026-09-24)
+
+### Features
+
+- open every live example in a modal window scoped to the example ([c27de26](https://github.com/crvouga/mockingbird/commit/c27de26b677ccb257c3d352090ce905e39f4e470))
+
+## 0.1.1 (2026-09-23)
+
+### Fixes and improvements
+
+- let browser clients finish sign-in and redeem codes cross-origin ([c9fe735](https://github.com/crvouga/mockingbird/commit/c9fe735b5c5417ba3c1f6a3bfe7086a61a60639e))
+
 ## 0.1.0 (2026-09-22)
 
 Initial release.

package/README.md

@@ -211,7 +211,7 @@ This is a ready-to-use local/test identity provider, **not a production authenti
 
 Vendor-hosted Google Identity Services/One Tap, native Apple AuthenticationServices, passkeys, MFA, CAPTCHA, password recovery, email delivery/relay forwarding, app-transfer migration, vendor risk engines, tokeninfo/introspection, logout, GitHub Apps installation/device flows, and Microsoft Graph/tenant administration are not implemented. Other configurable OIDC providers can use the generic profile, but their proprietary scopes and claims are not emulated. Scopes are limited to each profile plus explicitly configured additional scopes. Microsoft uses the configured mock issuer, not real Entra tenant routing. GitHub is the OAuth app login surface, not the full REST API.
 
-No implicit flow, dynamic client registration, wildcard redirect matching, cross-origin browser token CORS policy, persistent signing-key import, or distributed-session coordination is provided. Private-use redirect schemes work only when their complete URI is explicitly registered; executable/local schemes such as `javascript:`, `data:` and `file:` are rejected. Snapshot restore is for the same runtime/instance; signing keys are not serialized. The default backing store is in-memory and state disappears when the process exits. A secure browser context and Web Crypto, Fetch and standard Web APIs are required; Node 22+, Bun and modern browsers provide them.
+No implicit flow, dynamic client registration, wildcard redirect matching, persistent signing-key import, or distributed-session coordination is provided. Private-use redirect schemes work only when their complete URI is explicitly registered; executable/local schemes such as `javascript:`, `data:` and `file:` are rejected. Sign-in and consent pages extend CSP `form-action` with the transaction's redirect origin (or custom scheme) so browsers follow the redirect back to the client. Discovery, JWKS, token, userinfo and revoke answer `OPTIONS` preflights and reflect the request `Origin`, so browser (SPA + PKCE) clients can redeem codes directly; the interaction pages send no CORS headers. Snapshot restore is for the same runtime/instance; signing keys are not serialized. The default backing store is in-memory and state disappears when the process exits. A secure browser context and Web Crypto, Fetch and standard Web APIs are required; Node 22+, Bun and modern browsers provide them.
 
 References: [Google OpenID Connect](https://developers.google.com/identity/openid-connect/openid-connect), [Apple authorization request](https://developer.apple.com/documentation/signinwithapplerestapi/request-an-authorization-to-the-sign-in-with-apple-server.), and [OpenID Connect Core](https://openid.net/specs/openid-connect-core-1_0.html).
 

package/dist/{chunk-X6FYBOEA.js → chunk-PCHI2SDJ.js}

@@ -1384,7 +1384,7 @@ var restoreNamespace = (sqlite, namespace, snapshot) => {
 };
 
 // ../core/dist/version.js
-var PACKAGE_VERSION = true ? "0.1.0" : UNRELEASED_VERSION;
+var PACKAGE_VERSION = true ? "0.2.0" : UNRELEASED_VERSION;
 
 // ../core/dist/webhooks.js
 var json2 = (status, body) => new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
@@ -2328,7 +2328,7 @@ function page(title, body, status = 200, action = "'self'", nonce = crypto.rando
     }
   );
 }
-function loginPage(transaction, client, accounts, base, signup = false, error = "") {
+function loginPage(transaction, client, accounts, base, action, signup = false, error = "") {
   const hidden = `<input type="hidden" name="transaction" value="${escapeHtml(transaction)}">`;
   const endpoint = escapeHtml(`${base}/interaction`);
   const intro = `<span class="eyebrow">Sign in</span><h1 id="title">${signup ? "Create your account" : "Choose an account"}</h1><p>${signup ? "Create an account to continue to" : "Choose an account to continue to"}<br><span class="app">${escapeHtml(client)}</span></p>${error ? `<div class="error" role="alert">${escapeHtml(error)}</div>` : ""}`;
@@ -2336,10 +2336,11 @@ function loginPage(transaction, client, accounts, base, signup = false, error =
   return page(
     signup ? "Create account" : "Choose an account",
     `${intro}${body}<div class="divider"></div><form method="post" action="${endpoint}">${hidden}<button class="secondary" name="action" value="deny">Cancel sign-in</button></form>`,
-    error ? 400 : 200
+    error ? 400 : 200,
+    action
   );
 }
-function consentPage(transaction, client, account, scopes2, base, privacy) {
+function consentPage(transaction, client, account, scopes2, base, action, privacy) {
   const labels = {
     openid: "Confirm your identity",
     email: "View your email address",
@@ -2354,7 +2355,9 @@ function consentPage(transaction, client, account, scopes2, base, privacy) {
       (s) => `<li><span class="check" aria-hidden="true">\u2713</span>${escapeHtml(labels[s] ?? s)}</li>`
     ).join(
       ""
-    )}</ul><p>You can cancel now without sharing anything.</p><form method="post" action="${escapeHtml(base)}/interaction"><input type="hidden" name="transaction" value="${escapeHtml(transaction)}">${privacyFields}<button class="primary" name="action" value="allow">Allow &amp; continue</button><button class="secondary" name="action" value="deny">Cancel</button></form>`
+    )}</ul><p>You can cancel now without sharing anything.</p><form method="post" action="${escapeHtml(base)}/interaction"><input type="hidden" name="transaction" value="${escapeHtml(transaction)}">${privacyFields}<button class="primary" name="action" value="allow">Allow &amp; continue</button><button class="secondary" name="action" value="deny">Cancel</button></form>`,
+    200,
+    action
   );
 }
 
@@ -2571,6 +2574,11 @@ var fail = (error, description, status = 400) => json4({ error, error_descriptio
 var scopes = (value) => new Set(value.split(/\s+/).filter(Boolean));
 var validEmail = (s) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(s) && s.length <= 254;
 var WEB_SCHEMES = /* @__PURE__ */ new Set(["http:", "https:"]);
+var formTarget = (redirectUri) => {
+  const u = new URL(redirectUri);
+  return WEB_SCHEMES.has(u.protocol) ? u.origin : u.protocol;
+};
+var formAction = (redirectUri) => `'self' ${formTarget(redirectUri)}`;
 var FORBIDDEN_REDIRECT_SCHEMES = /* @__PURE__ */ new Set(["blob:", "data:", "file:", "javascript:", "vbscript:"]);
 var safeRedirect = (s) => {
   try {
@@ -2842,6 +2850,38 @@ var OAuthAPI = class {
     const issuer = this.issuer(request);
     const mount = new URL(issuer).pathname.replace(/\/$/, "");
     const path = mount && url.pathname.startsWith(`${mount}/`) ? url.pathname.slice(mount.length) : url.pathname;
+    const paths = this.paths();
+    const cors = [
+      "/.well-known/openid-configuration",
+      paths.jwks,
+      "/jwks",
+      paths.token,
+      "/token",
+      paths.userinfo,
+      "/userinfo",
+      "/oauth2/v3/userinfo",
+      "/user/emails",
+      paths.revoke,
+      "/revoke"
+    ].includes(path);
+    if (!cors) return this.route(request, url, issuer, path);
+    const origin = request.headers.get("origin");
+    const response = request.method === "OPTIONS" ? new Response(null, {
+      status: 204,
+      headers: {
+        "access-control-allow-methods": "GET, POST, OPTIONS",
+        "access-control-allow-headers": request.headers.get("access-control-request-headers") ?? "authorization, content-type",
+        "access-control-max-age": "600"
+      }
+    }) : await this.route(request, url, issuer, path);
+    if (origin) {
+      response.headers.set("access-control-allow-origin", origin);
+      response.headers.set("access-control-expose-headers", "www-authenticate");
+      response.headers.append("vary", "Origin");
+    }
+    return response;
+  }
+  async route(request, url, issuer, path) {
     const paths = this.paths();
     if (request.method === "GET" && path === "/.well-known/openid-configuration" && this.provider !== "github")
       return json4({
@@ -3107,7 +3147,7 @@ var OAuthAPI = class {
       accounts.sort(
         (a, b) => Number(b.email === hint || b.id === hint) - Number(a.email === hint || a.id === hint)
       );
-    return loginPage(id, client.name, accounts, issuer);
+    return loginPage(id, client.name, accounts, issuer, formAction(auth.redirectUri));
   }
   consent(id, client, account, auth, issuer) {
     const existing = this.identities.get(this.identityKey(client, account.id));
@@ -3119,6 +3159,7 @@ var OAuthAPI = class {
       account,
       allowed,
       issuer,
+      formAction(auth.redirectUri),
       this.provider === "apple" && scopes(auth.scope).has("email") && !existing ? {
         hideEmail: account.privateEmail ?? (this.behavior.config.apple?.emailMode === "hide" || (this.behavior.config.apple?.emailMode ?? "choose") === "choose" && auth.decisions.hideEmail),
         choice: (this.behavior.config.apple?.emailMode ?? "choose") === "choose"
@@ -3141,7 +3182,14 @@ var OAuthAPI = class {
       );
     const accounts = () => this.accounts.list({ order: "oldest", where: (a) => !a.disabled }).map((a) => a.value);
     if (request.method === "GET")
-      return loginPage(id, client.name, accounts(), issuer, p.get("screen") === "signup");
+      return loginPage(
+        id,
+        client.name,
+        accounts(),
+        issuer,
+        formAction(auth.redirectUri),
+        p.get("screen") === "signup"
+      );
     const action = p.get("action");
     if (action === "deny") {
       this.transactions.delete(id);
@@ -3158,6 +3206,7 @@ var OAuthAPI = class {
           client.name,
           [],
           issuer,
+          formAction(auth.redirectUri),
           true,
           "Enter a full name and a valid email address."
         );
@@ -3167,6 +3216,7 @@ var OAuthAPI = class {
           client.name,
           [],
           issuer,
+          formAction(auth.redirectUri),
           true,
           "This email already has an account. Go back to choose it."
         );
@@ -3179,7 +3229,15 @@ var OAuthAPI = class {
     if (action === "select") {
       const account = this.accounts.get(p.get("account") ?? "");
       if (!account || account.disabled)
-        return loginPage(id, client.name, accounts(), issuer, false, "Choose an available account.");
+        return loginPage(
+          id,
+          client.name,
+          accounts(),
+          issuer,
+          formAction(auth.redirectUri),
+          false,
+          "Choose an available account."
+        );
       auth.accountId = account.id;
       auth.authTime = this.now();
       this.transactions.update(id, auth);
@@ -3283,7 +3341,7 @@ var OAuthAPI = class {
           ""
         )}<button class="primary">Continue</button></form><script nonce="${nonce}">document.getElementById('callback').submit()</script>`,
         200,
-        WEB_SCHEMES.has(redirect.protocol) ? redirect.origin : redirect.protocol,
+        formTarget(auth.redirectUri),
         nonce
       );
       return result;
@@ -3507,4 +3565,4 @@ export {
   createMultiRuntime,
   OAuthAPI
 };
-//# sourceMappingURL=chunk-X6FYBOEA.js.map
+//# sourceMappingURL=chunk-PCHI2SDJ.js.map