@eduwork/dsh-oidc 0.2.4 → 0.3.0-dev.2

package/lib/profile.js

@@ -1,10 +1,9 @@
+import { serviceProtocolAllowed } from './transport.js'
 import { readFileSync } from 'node:fs'
 
 export const PROFILE_SCHEMA_VERSION = 'dsh-oidc/v1alpha1'
-export const DEFAULT_CREDENTIAL_REF = 'EDUWORK_API_KEY'
 const MAX_PROFILE_BYTES = 512 * 1024
 const idPattern = /^[a-z][a-z0-9-]{0,63}$/
-const credentialPattern = /^[A-Za-z_][A-Za-z0-9_]*$/
 const colorPattern = /^#[0-9a-fA-F]{6}$/
 const allowedModalities = new Set(['text', 'image'])
 const allowedThinkingLevels = new Set(['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'])
@@ -15,10 +14,9 @@ const allowedThinkingFormats = new Set([
 ])
 const allowedRootKeys = new Set([
   'schemaVersion', 'id', 'displayName', 'organization', 'nativeInstitutionID',
-  'allowInsecureDevelopment', 'insecureDevelopmentOrigin', 'brand', 'oidc', 'keyBinding', 'provider',
+  'allowInsecureDevelopment', 'insecureDevelopmentOrigin', 'brand', 'oidc', 'auth', 'provider',
 ])
 const allowedOidcKeys = new Set(['issuer', 'clientId', 'scopes'])
-const allowedKeyBindingKeys = new Set(['type', 'baseURL', 'credentialRef'])
 const allowedBrandKeys = new Set([
   'productName', 'organizationName', 'mark', 'logoURL', 'primaryColor',
   'loginTitle', 'loginDescription', 'supportURL',
@@ -55,41 +53,22 @@ function text(value, label, max = 2048) {
   return value
 }
 
-function isLoopback(hostname) {
-  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]'
-}
-
-function insecureDevelopmentOrigin(value, label) {
-  const raw = text(value, label)
-  const parsed = new URL(raw)
-  if (parsed.protocol !== 'http:' || parsed.username || parsed.password || parsed.search || parsed.hash || (parsed.pathname !== '/' && parsed.pathname !== '')) {
-    throw new Error(`${label} must be an exact HTTP origin without credentials, path, query, or fragment`)
-  }
-  return raw.replace(/\/+$/, '')
-}
-
-function endpointProtocolAllowed(parsed, allowInsecure, allowedInsecureOrigin) {
-  return parsed.protocol === 'https:' || (allowInsecure && parsed.protocol === 'http:' && (
-    isLoopback(parsed.hostname) || parsed.origin === allowedInsecureOrigin
-  ))
-}
-
-function issuerURL(value, label, allowInsecure = false, allowedInsecureOrigin) {
+function issuerURL(value, label, allowInsecure = false) {
   const raw = text(value, label)
   const parsed = new URL(raw)
-  const permitted = endpointProtocolAllowed(parsed, allowInsecure, allowedInsecureOrigin)
+  const permitted = serviceProtocolAllowed(parsed, allowInsecure)
   if (!permitted || parsed.username || parsed.password || parsed.search || parsed.hash) {
-    throw new Error(`${label} must be an HTTPS issuer URL without credentials, query, or fragment${allowInsecure ? ' (loopback or the exact allowlisted HTTP origin is allowed in development)' : ''}`)
+    throw new Error(`${label} must be an HTTPS issuer URL without credentials, query, or fragment${allowInsecure ? ' (HTTP is allowed with allowInsecureDevelopment=true)' : '; set allowInsecureDevelopment=true to allow HTTP'}`)
   }
   return raw
 }
 
-function exactURL(value, label, allowInsecure = false, allowedInsecureOrigin) {
+function exactURL(value, label, allowInsecure = false) {
   const raw = text(value, label)
   const parsed = new URL(raw)
-  const permitted = endpointProtocolAllowed(parsed, allowInsecure, allowedInsecureOrigin)
+  const permitted = serviceProtocolAllowed(parsed, allowInsecure)
   if (!permitted || parsed.username || parsed.password || parsed.hash || parsed.search) {
-    throw new Error(`${label} must be an absolute HTTPS URL without credentials, query, or fragment${allowInsecure ? ' (loopback or the exact allowlisted HTTP origin is allowed in development)' : ''}`)
+    throw new Error(`${label} must be an absolute HTTPS URL without credentials, query, or fragment${allowInsecure ? ' (HTTP is allowed with allowInsecureDevelopment=true)' : '; set allowInsecureDevelopment=true to allow HTTP'}`)
   }
   return raw.replace(/\/+$/, '')
 }
@@ -217,9 +196,6 @@ export function normalizeModels(models, providerID) {
   }))
 }
 
-export function legacyCredentialRefs(profile) {
-  return [...new Set([profile.id, profile.provider?.id].filter(Boolean).map(id => `${id.toUpperCase().replace(/[^A-Z0-9]/g, '_')}_API_KEY`))]
-}
 
 function normalizeRetryPolicy(value) {
   const source = object(value, 'profile.provider.retryPolicy')
@@ -275,66 +251,59 @@ export function normalizeEnterpriseProfile(raw) {
   const id = text(source.id, 'profile.id', 64)
   if (!idPattern.test(id)) throw new Error('profile.id is invalid')
   const allowInsecureDevelopment = source.allowInsecureDevelopment === true
-  const allowedInsecureOrigin = source.insecureDevelopmentOrigin === undefined
-    ? undefined
-    : insecureDevelopmentOrigin(source.insecureDevelopmentOrigin, 'profile.insecureDevelopmentOrigin')
-  if (allowedInsecureOrigin !== undefined && !allowInsecureDevelopment) {
-    throw new Error('profile.insecureDevelopmentOrigin requires allowInsecureDevelopment=true')
-  }
-  const oidc = object(source.oidc, 'profile.oidc')
-  const identityOnly = source.keyBinding === undefined && source.provider === undefined
-  if (!identityOnly && (source.keyBinding === undefined || source.provider === undefined)) {
-    throw new Error('profile.keyBinding and profile.provider must either both be present or both be omitted')
+  if (source.allowInsecureDevelopment !== undefined && typeof source.allowInsecureDevelopment !== 'boolean') throw new Error('profile.allowInsecureDevelopment must be boolean')
+  // Accept the obsolete field in old files, but it no longer controls transport.
+  const gateway = source.auth !== undefined
+  if (gateway && source.oidc !== undefined) throw new Error('profile.auth cannot be combined with oidc')
+  let auth
+  if (gateway) {
+    const rawAuth = object(source.auth, 'profile.auth')
+    exactKeys(rawAuth, new Set(['discoveryUrl', 'expectedIssuer', 'experimentalOidcLlm', 'clientId', 'identityMode']), 'profile.auth')
+    const experimental = rawAuth.experimentalOidcLlm === true
+    if (rawAuth.experimentalOidcLlm !== undefined && typeof rawAuth.experimentalOidcLlm !== 'boolean') throw new Error('profile.auth.experimentalOidcLlm must be boolean')
+    if (!experimental && (rawAuth.clientId !== undefined || rawAuth.identityMode !== undefined)) throw new Error('profile.auth clientId and identityMode require experimentalOidcLlm=true')
+    if (experimental && !['oauth', 'oidc'].includes(rawAuth.identityMode)) throw new Error('profile.auth.identityMode must explicitly select oauth or oidc')
+    auth = Object.freeze({
+      discoveryUrl: issuerURL(rawAuth.discoveryUrl, 'profile.auth.discoveryUrl', allowInsecureDevelopment),
+      ...(rawAuth.expectedIssuer === undefined ? {} : { expectedIssuer: issuerURL(rawAuth.expectedIssuer, 'profile.auth.expectedIssuer', allowInsecureDevelopment) }),
+      ...(experimental ? { experimentalOidcLlm: true, clientId: text(rawAuth.clientId, 'profile.auth.clientId', 256), identityMode: rawAuth.identityMode } : {}),
+    })
+    if (source.provider?.baseURL !== undefined) throw new Error('profile.auth derives provider.baseURL from validated discovery')
+    if (source.provider?.modelSource !== undefined && source.provider.modelSource !== 'discovery') throw new Error('profile.auth requires discovery modelSource')
   }
-  const keyBinding = identityOnly ? {} : object(source.keyBinding, 'profile.keyBinding')
-  const provider = identityOnly ? {} : object(source.provider, 'profile.provider')
+  const oidc = gateway ? {} : object(source.oidc, 'profile.oidc')
+  const identityOnly = !gateway
+  if (identityOnly && source.provider !== undefined) throw new Error('OIDC identity profiles cannot configure model resources; use auth.discoveryUrl for Access Token model access')
+  const provider = gateway ? { id, adapter: 'openai-compatible', ...object(source.provider ?? {}, 'profile.provider'), modelSource: 'discovery' } : {}
   exactKeys(oidc, allowedOidcKeys, 'profile.oidc')
-  exactKeys(keyBinding, allowedKeyBindingKeys, 'profile.keyBinding')
   exactKeys(provider, allowedProviderKeys, 'profile.provider')
   const providerID = identityOnly ? id : text(provider.id, 'profile.provider.id', 64)
   if (!idPattern.test(providerID)) throw new Error('profile.provider.id is invalid')
-  let credentialRef = keyBinding.credentialRef === undefined
-    ? DEFAULT_CREDENTIAL_REF
-    : text(keyBinding.credentialRef, 'profile.keyBinding.credentialRef', 128)
-  if (!credentialPattern.test(credentialRef)) {
-    throw new Error('profile.keyBinding.credentialRef must be a valid DSH credential reference')
-  }
-  if (legacyCredentialRefs({ id, provider: { id: providerID } }).includes(credentialRef)) credentialRef = DEFAULT_CREDENTIAL_REF
   if (!identityOnly && provider.adapter !== 'openai-compatible') throw new Error(`unsupported provider adapter ${String(provider.adapter)}`)
-  const protocol = keyBinding.type ?? 'worker-user-center-v1'
-  if (!['worker-user-center-v1', 'eduwork-resources-v1'].includes(protocol)) throw new Error('profile.keyBinding.type is not supported')
-  const modelSource = provider.modelSource ?? 'profile'
-  if (!['profile', 'discovery'].includes(modelSource)) throw new Error('profile.provider.modelSource must be profile or discovery')
+  const modelSource = 'discovery'
   const scopes = oidc.scopes
-  if (!Array.isArray(scopes) || scopes.length < 2 || scopes.length > 64 || !scopes.includes('openid') || !scopes.includes('profile') || scopes.some(scope => typeof scope !== 'string' || scope.length > 128 || scope.trim() !== scope || scope === '' || /\s/.test(scope))) {
+  if (!gateway && (!Array.isArray(scopes) || scopes.length < 2 || scopes.length > 64 || !scopes.includes('openid') || !scopes.includes('profile') || scopes.some(scope => typeof scope !== 'string' || scope.length > 128 || scope.trim() !== scope || scope === '' || /\s/.test(scope)))) {
     throw new Error('profile.oidc.scopes must contain openid and profile; every scope must be a non-empty token')
   }
-  if (new Set(scopes).size !== scopes.length) throw new Error('profile.oidc.scopes contains duplicates')
+  if (!gateway && new Set(scopes).size !== scopes.length) throw new Error('profile.oidc.scopes contains duplicates')
   return Object.freeze({
     schemaVersion: PROFILE_SCHEMA_VERSION,
     id,
     displayName: text(source.displayName, 'profile.displayName', 120),
     organization: text(source.organization ?? source.displayName, 'profile.organization', 120),
     allowInsecureDevelopment,
-    ...(allowedInsecureOrigin === undefined ? {} : { insecureDevelopmentOrigin: allowedInsecureOrigin }),
     nativeInstitutionID: source.nativeInstitutionID === undefined ? id : text(source.nativeInstitutionID, 'profile.nativeInstitutionID', 64),
     brand: normalizeBrand(source.brand),
-    oidc: Object.freeze({
-      issuer: issuerURL(oidc.issuer, 'profile.oidc.issuer', allowInsecureDevelopment, allowedInsecureOrigin),
+    ...(gateway ? { auth } : { oidc: Object.freeze({
+      issuer: issuerURL(oidc.issuer, 'profile.oidc.issuer', allowInsecureDevelopment),
       clientId: text(oidc.clientId, 'profile.oidc.clientId', 256),
       scopes: Object.freeze([...scopes]),
-    }),
-    ...(identityOnly ? {} : { keyBinding: Object.freeze({
-      type: protocol,
-      baseURL: exactURL(keyBinding.baseURL, 'profile.keyBinding.baseURL', allowInsecureDevelopment, allowedInsecureOrigin),
-      providerId: providerID,
-      credentialRef,
-    }),
-    provider: Object.freeze({
+    }) }),
+    ...(identityOnly ? {} : { provider: Object.freeze({
       id: providerID,
       displayName: text(provider.displayName ?? source.displayName, 'profile.provider.displayName', 120),
       adapter: provider.adapter,
-      baseURL: exactURL(provider.baseURL, 'profile.provider.baseURL', allowInsecureDevelopment, allowedInsecureOrigin),
+      baseURL: '',
       reasoning: provider.reasoning === undefined
         ? 'high'
         : (() => {
@@ -385,12 +354,11 @@ export function loadEnterpriseProfiles(raw = {}, environment = process.env) {
 
 export function enterpriseProviderConfig(profiles) {
   return {
-    providers: Object.fromEntries([...profiles.values()].filter(profile => profile.provider?.models.length).map(profile => [profile.provider.id, {
+    providers: Object.fromEntries([...profiles.values()].filter(profile => profile.provider?.baseURL && profile.provider.models.length).map(profile => [profile.provider.id, {
       displayName: profile.provider.displayName,
-      apiKeyEnv: profile.keyBinding.credentialRef,
+      apiKeyEnv: `DSH_GATEWAY_${profile.id.toUpperCase().replace(/-/g, '_')}_ACCESS`,
       baseURL: profile.provider.baseURL,
       allowInsecureDevelopment: profile.allowInsecureDevelopment,
-      ...(profile.insecureDevelopmentOrigin === undefined ? {} : { insecureDevelopmentOrigin: profile.insecureDevelopmentOrigin }),
       reasoning: profile.provider.reasoning,
       ...(profile.provider.defaultContextWindow === undefined ? {} : { defaultContextWindow: profile.provider.defaultContextWindow }),
       ...(profile.provider.defaultMaxTokens === undefined ? {} : { defaultMaxTokens: profile.provider.defaultMaxTokens }),
@@ -418,7 +386,7 @@ export function publicProfile(profile) {
     displayName: profile.displayName,
     organization: profile.organization,
     brand: profile.brand,
-    credentialRef: profile.keyBinding?.credentialRef ?? '',
+    credentialRef: '',
     ...(profile.provider ? { provider: {
       id: profile.provider.id,
       displayName: profile.provider.displayName,

package/lib/provider/authorization-scope.js

@@ -0,0 +1,46 @@
+/** Keep prepared calls, credential resolution and streamed results in one authorization. */
+export class AuthorizationScopedAdapter {
+  constructor(inner, storage, createScope) {
+    this.inner = inner
+    this.storage = storage
+    this.createScope = createScope
+  }
+
+  providerInfo(provider) { return this.inner.providerInfo(provider) }
+  providerRetryPolicy(provider) { return this.inner.providerRetryPolicy(provider) }
+  imageRequestPricing(provider, model) { return this.inner.imageRequestPricing(provider, model) }
+  listModels(provider) { return this.inner.listModels(provider) }
+  resolveModel(provider, model, signal) { return this.inner.resolveModel(provider, model, signal) }
+
+  async prepareCall(provider, model, signal) {
+    const scope = await this.createScope(provider)
+    const prepared = await this.inner.prepareCall(provider, model, signal)
+    return { model: prepared.model, stream: options => this.streamPrepared(prepared, options, scope) }
+  }
+
+  async * streamPrepared(prepared, options, scope) {
+    if (!scope) { yield* prepared.stream(options); return }
+    const lease = scope.open(options.signal)
+    let iterator
+    try {
+      lease.assertCurrent()
+      iterator = prepared.stream({ ...options, signal: lease.signal })[Symbol.asyncIterator]()
+      for (;;) {
+        lease.assertCurrent()
+        const next = await this.storage.run(lease, () => iterator.next())
+        // Even a transport that buffers or ignores abort must not emit stale data.
+        lease.assertCurrent()
+        if (next.done) return
+        yield next.value
+      }
+    } finally {
+      try { await this.storage.run(lease, () => iterator?.return?.()) }
+      finally { lease.close() }
+    }
+  }
+
+  async * stream(options) {
+    const prepared = await this.prepareCall(options.provider, options.model, options.signal)
+    yield* prepared.stream(options)
+  }
+}

package/lib/provider/core.js

@@ -1,3 +1,4 @@
+import { serviceProtocolAllowed } from '../transport.js'
 const modalities = new Set(['text', 'image'])
 export const REASONING_EFFORT_ORDER = Object.freeze(['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'])
 const reasoningEfforts = new Set(REASONING_EFFORT_ORDER)
@@ -12,23 +13,11 @@ function nonEmpty(value, label) {
   return value.trim()
 }
 
-function exactDevelopmentOrigin(value, label) {
-  if (value === undefined) return undefined
+function endpointURL(value, label, allowInsecureDevelopment = false) {
   const raw = nonEmpty(value, label).replace(/\/+$/, '')
   const parsed = new URL(raw)
-  if (parsed.protocol !== 'http:' || parsed.username || parsed.password || parsed.hash || parsed.search || (parsed.pathname !== '/' && parsed.pathname !== '')) {
-    throw new Error(`${label} must be an exact HTTP origin`)
-  }
-  return raw
-}
-
-function endpointURL(value, label, allowInsecureDevelopment = false, insecureDevelopmentOrigin) {
-  const raw = nonEmpty(value, label).replace(/\/+$/, '')
-  const parsed = new URL(raw)
-  const loopback = ['localhost', '127.0.0.1', '[::1]'].includes(parsed.hostname)
-  const allowedOrigin = exactDevelopmentOrigin(insecureDevelopmentOrigin, `${label}.insecureDevelopmentOrigin`)
-  const permittedHTTP = parsed.protocol === 'http:' && (loopback || (allowInsecureDevelopment === true && parsed.origin === allowedOrigin))
-  if ((parsed.protocol !== 'https:' && !permittedHTTP) || parsed.username || parsed.password || parsed.hash || parsed.search) {
+  if (typeof allowInsecureDevelopment !== 'boolean') throw new Error(`${label}.allowInsecureDevelopment must be boolean`)
+  if (!serviceProtocolAllowed(parsed, allowInsecureDevelopment) || parsed.username || parsed.password || parsed.hash || parsed.search) {
     throw new Error(`${label} must be HTTPS or explicitly allowed development HTTP without credentials, query, or fragment`)
   }
   return raw
@@ -100,7 +89,7 @@ export function resolveEnterpriseProfiles(raw = {}) {
     const route = nonEmpty(provider, 'provider route')
     if (typeof source !== 'object' || source === null || Array.isArray(source)) throw new Error(`${route} config must be an object`)
     const displayName = nonEmpty(source.displayName ?? route, `${route}.displayName`)
-    const baseURL = endpointURL(source.baseURL, `${route}.baseURL`, source.allowInsecureDevelopment, source.insecureDevelopmentOrigin)
+    const baseURL = endpointURL(source.baseURL, `${route}.baseURL`, source.allowInsecureDevelopment)
     const credentialRef = nonEmpty(source.apiKeyEnv, `${route}.apiKeyEnv`)
     const contextWindow = positiveInteger(source.defaultContextWindow, 262144, `${route}.defaultContextWindow`)
     const maxTokens = positiveInteger(source.defaultMaxTokens, 32768, `${route}.defaultMaxTokens`)

package/lib/provider/index.js

@@ -1,3 +1,4 @@
+import { AsyncLocalStorage } from 'node:async_hooks'
 import { launchEnvironmentOf } from '@deepseek-ai/dsh-launch-environment'
 import { LlmError, assertUsableApiKey, resolveImageAttachmentAccess, resolveRetryPolicy } from '@deepseek-ai/dsh-llm'
 import { Config as PiAiConfig, PiAiAdapter } from '@deepseek-ai/dsh-llm-pi-ai'
@@ -10,6 +11,7 @@ import {
 } from './core.js'
 import { TransformingEnterpriseAdapter } from './transform-adapter.js'
 import { EnterpriseModelTransforms } from './transforms.js'
+import { AuthorizationScopedAdapter } from './authorization-scope.js'
 
 export const name = 'dsh-oidc-provider'
 export const inject = ['llm']
@@ -108,6 +110,7 @@ export function resolveEnterpriseImageAccess(ctx, attachments, ref) {
 }
 
 export function apply(ctx, rawConfig = {}) {
+  const callAuthorization = new AsyncLocalStorage()
   const transforms = new EnterpriseModelTransforms(ctx)
   let current = () => settingsBase(rawConfig)
   let profiles = profilesFrom(current())
@@ -121,7 +124,10 @@ export function apply(ctx, rawConfig = {}) {
       }
       const ref = profile.apiKeyEnv
       const credentials = ctx.get('credentials')
-      const hit = typeof rawConfig.resolveCredential === 'function'
+      const lease = callAuthorization.getStore()
+      const hit = lease
+        ? (await lease.resolveCredential(provider))?.value
+        : typeof rawConfig.resolveCredential === 'function'
         ? (await rawConfig.resolveCredential(provider))?.value
         : credentials === undefined
         ? launchEnvironmentOf(ctx).get(ref)?.value
@@ -133,9 +139,12 @@ export function apply(ctx, rawConfig = {}) {
     resolveImageAccess: (attachments, ref) => resolveEnterpriseImageAccess(ctx, attachments, ref),
   })
 
-  const adapter = new TransformingEnterpriseAdapter(baseAdapter, transforms, (provider, model) => (
+  const transforming = new TransformingEnterpriseAdapter(baseAdapter, transforms, (provider, model) => (
     profiles.get(provider)?.modelPolicies.get(model) ?? { reasoning: true, supportsReasoningEffort: true }
   ))
+  const adapter = typeof rawConfig.createAuthorizationScope === 'function'
+    ? new AuthorizationScopedAdapter(transforming, callAuthorization, rawConfig.createAuthorizationScope)
+    : transforming
   let registration
   let directory
   const replaceProfiles = next => {

package/lib/transport.js

@@ -0,0 +1,5 @@
+// One transport rule for configured and discovered service URLs.
+// Callback binding, issuer identity and protocol-specific origin checks are separate.
+export function serviceProtocolAllowed(url, allowInsecureDevelopment = false) {
+  return url.protocol === 'https:' || (allowInsecureDevelopment === true && url.protocol === 'http:')
+}

package/lib/typert-schemas.js

@@ -3,7 +3,7 @@ import { z } from 'zod'
 const pkg = '@eduwork/dsh-oidc'
 export const profileIdSchema = z.string().min(1).max(64)
 export const loginIdSchema = z.string().regex(/^[A-Za-z0-9_-]{32}$/)
-export const reconcileOptionsSchema = z.object({ allowProvision: z.boolean().optional() }).strict()
+export const reconcileOptionsSchema = z.object({}).strict()
 export const baseURLSchema = z.string().min(1).max(2048)
 export const modelCatalogModeSchema = z.enum(['discovery', 'manual'])
 export const configurationTargetSchema = z.enum(['config', 'examples'])

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@eduwork/dsh-oidc",
-  "version": "0.2.4",
-  "description": "Standards-based OIDC identity, enterprise API-key binding, declarative branding, and OpenAI-compatible model integration for DeepSeek Harness",
+  "version": "0.3.0-dev.2",
+  "description": "Standards-based OIDC identity, token-authorized model access, declarative branding, and OpenAI-compatible model integration for DeepSeek Harness",
   "keywords": [
     "deepseek-harness",
     "dsh",