@eduwork/dsh-oidc 0.3.0-dev.1 → 0.3.0-dev.2

package/CHANGELOG.en.md

@@ -4,6 +4,12 @@
 
 All notable changes are documented here. The format follows Keep a Changelog principles and the project uses Semantic Versioning with pre-1.0 qualifications described in `docs/compatibility.en.md`.
 
+## [0.3.0-dev.2] - 2026-09-21
+
+- Explicitly allow HTTP test services through the single `allowInsecureDevelopment` flag, disabled by default; HTTPS behavior is unchanged.
+- Accept the legacy `insecureDevelopmentOrigin` field without requiring a duplicate origin setting.
+- Align transport policy across OIDC, OIDC-LLM, LiteLLM and model requests, with documented examples and regression tests.
+
 ## [0.2.0] - 2026-09-11
 
 - Target DSH 0.1.5-rc.1 and keep enterprise identity, managed keys and model integration independent of institution services.

package/CHANGELOG.md

@@ -4,6 +4,12 @@
 
 所有重要变更均记录于此。格式遵循 Keep a Changelog 原则；项目使用语义化版本，并遵循[兼容性与发布策略](docs/compatibility.md)中对 1.0 之前版本的说明。
 
+## [0.3.0-dev.2] - 2026-09-21
+
+- 使用 `allowInsecureDevelopment` 单一开关显式允许 HTTP 测试服务，默认关闭；HTTPS 行为不变。
+- 兼容读取旧 `insecureDevelopmentOrigin` 字段，但不再要求重复配置地址。
+- 统一 OIDC、OIDC-LLM、LiteLLM 与模型请求的传输策略，并补齐配置示例和回归测试。
+
 ## [0.2.0] - 2026-09-11
 
 - 适配 DSH 0.1.5-rc.1，企业身份、托管 Key 和模型接入独立于机构专属服务。

package/docs/enterprise-profile.en.md

@@ -32,8 +32,8 @@ A remote administration system MAY distribute profile JSON only if the host auth
 | `id` | yes | Profile ID matching `^[a-z][a-z0-9-]{0,63}$`. |
 | `displayName` | yes | Human-readable integration name. |
 | `organization` | no | Organization label; defaults to `displayName`. |
-| `allowInsecureDevelopment` | no | Enables loopback HTTP for local development. Network HTTP additionally requires `insecureDevelopmentOrigin`. |
-| `insecureDevelopmentOrigin` | no | Exact non-TLS development origin. It is accepted only together with `allowInsecureDevelopment: true`, and every HTTP OIDC/gateway endpoint must use this exact origin. Never ship it in a production profile. |
+| `allowInsecureDevelopment` | Optional boolean; `false` (default) accepts HTTPS only, `true` also accepts HTTP service URLs. |
+| `insecureDevelopmentOrigin` | Deprecated; accepted in old files but ignored. Omit from new configurations. |
 | `brand` | no | Bounded presentational values. |
 | `oidc` | identity-only | OIDC public-client facts; cannot include auth or provider. |
 | `auth` | models | Full discovery URL; see the gateway guide for explicit protocol fields. |

package/docs/enterprise-profile.md

@@ -32,8 +32,8 @@ Profile 是受信任的部署配置，不是用户输入。即便如此，解析
 | `id` | 是 | 匹配 `^[a-z][a-z0-9-]{0,63}$` 的 Profile ID。 |
 | `displayName` | 是 | 面向用户的集成名称。 |
 | `organization` | 否 | 机构名称；默认使用 `displayName`。 |
-| `allowInsecureDevelopment` | 否 | 为本地开发启用 loopback HTTP。网络 HTTP 还必须配置 `insecureDevelopmentOrigin`。 |
-| `insecureDevelopmentOrigin` | 否 | 精确的非 TLS 开发 origin。只有与 `allowInsecureDevelopment: true` 一起使用时才有效，且所有 HTTP OIDC/网关 endpoint 必须使用该 origin。不得放入生产 Profile。 |
+| `allowInsecureDevelopment` | 可选布尔值，默认 `false` 仅接受 HTTPS；`true` 也接受 HTTP 服务地址。 |
+| `insecureDevelopmentOrigin` | 已废弃，仅兼容旧文件；不再参与校验，新配置无需填写。 |
 | `brand` | 否 | 有边界的展示配置。 |
 | `oidc` | 纯身份模式 | OIDC public client 信息，不得同时配置 auth 或 provider。 |
 | `auth` | 模型模式 | 完整发现地址，协议字段见网关指南。 |

package/docs/gateway-auth/README.md

@@ -32,7 +32,7 @@ LiteLLM 不需要实现 EduWork 的 Key Binding。普通 OIDC 的 Access Token
 }
 ```
 
-`discoveryUrl` 是完整地址，不由客户端猜路径。`expectedIssuer` 可省略，但部署方建议填写；LiteLLM 适配器始终要求 issuer、resource、认证端点与发现地址同源，且 resource 与 issuer 完整字符串一致。生产使用 HTTPS；实验只允许显式设置 `allowInsecureDevelopment: true` 后的 loopback HTTP。不允许通过 `insecureDevelopmentOrigin` 放宽此新协议到任意明文地址。
+`allowInsecureDevelopment` 是唯一的 HTTP 开关，放在企业对象中，与 `auth`/`oidc` 同级；默认 `false` 仅接受 HTTPS，改为 `true` 也接受 HTTP 服务地址。旧 `insecureDevelopmentOrigin` 已废弃并忽略。issuer 身份、资源同源关系及 OAuth/PKCE 校验仍按协议执行。`discoveryUrl` 填完整发现地址，`expectedIssuer` 可选，填写后必须与发现文档完全一致。
 
 `auth` 与 `oidc`、`keyBinding` 互斥；LiteLLM 配置不填写固定 `clientId`、secret、scope 或 `provider.baseURL`。模型 API 基址由已校验的 issuer 追加 `/v1`，保留部署路径前缀。可选 `provider` 支持唯一的 `id`、显示名、上下文/输出限制和经管理员核实的 `models` 能力；只能使用 `modelSource: "discovery"`。模型能否出现由当前账户的 `/v1/models` 决定，配置里的模型信息只是能力补充，不会绕过授权。
 

package/docs/gateway-auth/README_EN.md

@@ -32,7 +32,7 @@ In a build containing this feature, add this object to `organizations` in `confi
 }
 ```
 
-See the [complete Profile example](../../examples/litellm.enterprise-profile.example.json). `discoveryUrl` is the complete configured URL. `expectedIssuer` is optional but recommended. Native discovery requires issuer, resource and auth endpoints on the discovery origin; resource must exactly equal issuer. Production uses HTTPS. Explicit `allowInsecureDevelopment: true` permits loopback HTTP only; `insecureDevelopmentOrigin` does not relax this new protocol to arbitrary HTTP hosts.
+`allowInsecureDevelopment` is the only HTTP switch, at the profile root beside `auth`/`oidc`. Its default is `false` (HTTPS only); `true` also accepts HTTP service URLs. `insecureDevelopmentOrigin` is obsolete and ignored. Issuer identity, resource-origin validation and OAuth/PKCE checks still apply. `discoveryUrl` is the complete discovery URL; `expectedIssuer` is optional and pins the exact issuer when provided.
 
 `auth` is mutually exclusive with `oidc` and `keyBinding`. Do not supply a static `clientId`, secret, scopes or `provider.baseURL`. The adapter appends `/v1` to the validated issuer, preserving any deployment prefix. An optional `provider` may supply a distinct `id`, display name, context/output limits and reviewed per-model capabilities in `models`; only `modelSource: "discovery"` is supported. The current account's model list determines visibility. Local model metadata cannot grant access to an absent model.
 

package/docs/gateway-auth/experimental-oidc-llm.en.md

@@ -34,7 +34,7 @@ Only static public-client registration is implemented; no client secret is accep
 
 When discovery declares `authorization_response_iss_parameter_supported: true`, both successful and error authorization responses must include `iss` exactly matching the discovered `issuer`. A missing value produces `gateway_callback_issuer_missing`; repeated, empty or mismatched values produce `gateway_callback_issuer_invalid`. The client does not exchange the code. Ask the authentication service administrator to align discovery and callback behavior before starting a new sign-in. The desktop callback listener closes when the flow ends; refreshing an old callback URL cannot resume sign-in.
 
-Production endpoints require HTTPS. An isolated experiment may reuse `allowInsecureDevelopment: true` and `insecureDevelopmentOrigin`, with a mandatory `expectedIssuer` pin. HTTP is restricted to loopback or that exact origin, never an entire private network. LiteLLM native retains its loopback-only exception.
+`allowInsecureDevelopment` is the only HTTP switch, at the profile root beside `auth`/`oidc`. Its default is `false` (HTTPS only); `true` also accepts HTTP service URLs. `insecureDevelopmentOrigin` is obsolete and ignored. Issuer identity, resource-origin validation and OAuth/PKCE checks still apply. `discoveryUrl` is the complete discovery URL; `expectedIssuer` is optional and pins the exact issuer when provided.
 
 ## Shared implementation and limits
 

package/docs/gateway-auth/experimental-oidc-llm.md

@@ -34,7 +34,7 @@
 
 发现声明 `authorization_response_iss_parameter_supported: true` 时，成功和错误授权回调都必须带 `iss`，且与发现中的 `issuer` 完全一致。缺失会报告 `gateway_callback_issuer_missing`；重复、空值或不匹配会报告 `gateway_callback_issuer_invalid`。客户端不会继续换取 Token，应由认证服务管理员核对发现声明与回调实现后重新发起登录。桌面回调监听在流程结束后关闭，刷新旧回调地址不能恢复登录。
 
-生产端点须为 HTTPS。独立实验环境可复用既有 `allowInsecureDevelopment: true` 和 `insecureDevelopmentOrigin`，但必须同时固定 `expectedIssuer`；HTTP 端点只允许 loopback 或该完整原点，不扩大到整个内网。此例外不改变 LiteLLM native 的 loopback 限制。
+`allowInsecureDevelopment` 是唯一的 HTTP 开关，放在企业对象中，与 `auth`/`oidc` 同级；默认 `false` 仅接受 HTTPS，改为 `true` 也接受 HTTP 服务地址。旧 `insecureDevelopmentOrigin` 已废弃并忽略。issuer 身份、资源同源关系及 OAuth/PKCE 校验仍按协议执行。`discoveryUrl` 填完整发现地址，`expectedIssuer` 可选，填写后必须与发现文档完全一致。
 
 ## 共享实现与边界
 

package/docs/gateway-auth/litellm-setup.en.md

@@ -67,7 +67,7 @@ Save, exit completely through the tray, and restart EduWork. Closing its window
 
 The model API base is the validated issuer with `/v1` appended, preserving any deployment prefix. Do not set `provider.baseURL`. LiteLLM dynamically registers a Client ID for this login: do not configure a static `clientId`, `client_secret`, or scope, or combine this profile with `oidc` or `keyBinding`.
 
-Production uses HTTPS. Explicit `allowInsecureDevelopment: true` on the organization entry, alongside `auth`, permits loopback HTTP for local development only, not arbitrary remote HTTP addresses. Keep passwords, Tokens, and upstream keys out of the client configuration.
+`allowInsecureDevelopment` is the only HTTP switch, at the profile root beside `auth`/`oidc`. Its default is `false` (HTTPS only); `true` also accepts HTTP service URLs. `insecureDevelopmentOrigin` is obsolete and ignored. Issuer identity, resource-origin validation and OAuth/PKCE checks still apply. `discoveryUrl` is the complete discovery URL; `expectedIssuer` is optional and pins the exact issuer when provided.
 
 Developers integrating another client can use the [single Profile example](../../examples/litellm.enterprise-profile.example.json) and [desktop Host guide](../desktop-host.en.md) to reuse the same authorization and model modules. Desktop users do not need to assemble a Host themselves.
 

package/docs/gateway-auth/litellm-setup.md

@@ -67,7 +67,7 @@ curl --fail --silent --show-error https://gateway.example.org/.well-known/litell
 
 模型 API 地址由校验后的 issuer 追加 `/v1` 得到，保留部署路径前缀；不要另填 `provider.baseURL`。LiteLLM 会动态注册本次登录所需的 Client ID，无需手工填写固定 `clientId`、`client_secret` 或 scope，也不要同时配置 `oidc`、`keyBinding`。
 
-正式部署使用 HTTPS。本机开发只有在机构条目中显式设置 `allowInsecureDevelopment: true`（与 `auth` 同级）才允许 loopback HTTP，不能用它连接任意明文远程地址。密码、Token 和上游 Key 均不应写入客户端配置。
+`allowInsecureDevelopment` 是唯一的 HTTP 开关，放在企业对象中，与 `auth`/`oidc` 同级；默认 `false` 仅接受 HTTPS，改为 `true` 也接受 HTTP 服务地址。旧 `insecureDevelopmentOrigin` 已废弃并忽略。issuer 身份、资源同源关系及 OAuth/PKCE 校验仍按协议执行。`discoveryUrl` 填完整发现地址，`expectedIssuer` 可选，填写后必须与发现文档完全一致。
 
 其他客户端开发者可使用[单个 Profile 示例](../../examples/litellm.enterprise-profile.example.json)和[桌面宿主指南](../desktop-host.md)，复用同一授权与模型模块；桌面安装用户无需自行装配 Host。
 

package/examples/ecnu.enterprise-profile.example.json

@@ -72,5 +72,6 @@
       }
     ],
     "modelSource": "discovery"
-  }
+  },
+  "allowInsecureDevelopment": false
 }

package/examples/enterprise-profile.example.json

@@ -69,5 +69,6 @@
       }
     ],
     "modelSource": "discovery"
-  }
+  },
+  "allowInsecureDevelopment": false
 }

package/examples/identity-only.example.json

@@ -5,6 +5,11 @@
   "oidc": {
     "issuer": "https://identity.example.edu",
     "clientId": "replace-with-public-client-id",
-    "scopes": ["openid", "profile", "offline_access"]
-  }
+    "scopes": [
+      "openid",
+      "profile",
+      "offline_access"
+    ]
+  },
+  "allowInsecureDevelopment": false
 }

package/examples/litellm.enterprise-profile.example.json

@@ -5,5 +5,6 @@
   "auth": {
     "discoveryUrl": "https://gateway.example.org/.well-known/litellm-cli-auth",
     "expectedIssuer": "https://gateway.example.org"
-  }
+  },
+  "allowInsecureDevelopment": false
 }

package/examples/oidc-llm.enterprise-profile.example.json

@@ -8,5 +8,6 @@
     "experimentalOidcLlm": true,
     "clientId": "replace-with-public-client-id",
     "identityMode": "oidc"
-  }
+  },
+  "allowInsecureDevelopment": false
 }

package/examples/resources-discovery.example.json

@@ -13,5 +13,6 @@
     "id": "example-ai",
     "adapter": "openai-compatible",
     "modelSource": "discovery"
-  }
+  },
+  "allowInsecureDevelopment": false
 }

package/lib/litellm-protocol.js

@@ -1,3 +1,4 @@
+import { serviceProtocolAllowed } from './transport.js'
 // LiteLLM v1.101.0, native CLI auth contract 1. This is OAuth, not OIDC.
 // Protocol-specific wire fields stay here; tokens never cross the renderer RPC.
 const MAX_BYTES = 1024 * 1024
@@ -51,8 +52,7 @@ export async function gatewayJSON(fetcher, url, init = {}) {
 function trustedURL(value, profile, origin) {
   let url
   try { url = new URL(value) } catch { throw protocolError('gateway_discovery_invalid', 'Gateway metadata contains an invalid URL') }
-  const local = profile.allowInsecureDevelopment && url.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(url.hostname)
-  if (!nonempty(value, 2048) || (url.protocol !== 'https:' && !local) || url.username || url.password || url.search || url.hash || (origin && url.origin !== origin)) {
+  if (!nonempty(value, 2048) || !serviceProtocolAllowed(url, profile.allowInsecureDevelopment) || url.username || url.password || url.search || url.hash || (origin && url.origin !== origin)) {
     throw protocolError('gateway_discovery_invalid', 'Gateway metadata URL is outside the configured trust boundary')
   }
   return url

package/lib/oidc-llm-protocol.js

@@ -1,3 +1,4 @@
+import { serviceProtocolAllowed } from './transport.js'
 // Experimental draft 0.1. These wire rules are not a published standard.
 import { protocolError } from './litellm-protocol.js'
 
@@ -10,9 +11,7 @@ const includes = (raw, key, values) => {
 function endpoint(value, profile, origin) {
   let url
   try { url = new URL(value) } catch { fail('oidc-llm metadata contains an invalid URL') }
-  const development = profile.allowInsecureDevelopment && url.protocol === 'http:'
-    && (['127.0.0.1', 'localhost', '[::1]'].includes(url.hostname) || url.origin === profile.insecureDevelopmentOrigin)
-  if (typeof value !== 'string' || value.length > 2048 || (url.protocol !== 'https:' && !development)
+  if (typeof value !== 'string' || value.length > 2048 || !serviceProtocolAllowed(url, profile.allowInsecureDevelopment)
     || url.username || url.password || url.search || url.hash || origin && url.origin !== origin) fail('oidc-llm URL is outside the configured trust boundary')
   return url
 }

package/lib/oidc.js

@@ -1,3 +1,4 @@
+import { serviceProtocolAllowed } from './transport.js'
 import { createHash, createPublicKey, randomBytes, timingSafeEqual, verify as verifySignature } from 'node:crypto'
 import { emptyResources } from './resources.js'
 
@@ -43,10 +44,6 @@ async function responseJSON(response, stage) {
   return value
 }
 
-function isLoopback(hostname) {
-  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]'
-}
-
 /** OIDC metadata endpoints may use origins distinct from the issuer over HTTPS. */
 function discoveredEndpoint(value, profile, label, optional = false) {
   if (optional && (value === undefined || value === '')) return ''
@@ -54,17 +51,8 @@ function discoveredEndpoint(value, profile, label, optional = false) {
   let endpoint
   try { endpoint = new URL(value) }
   catch (cause) { throw publicError('oidc_discovery_invalid', `OIDC ${label} is not an absolute URL`, cause) }
-  const issuerURL = new URL(profile.oidc.issuer)
-  const secure = endpoint.protocol === 'https:'
-  const localDevelopment = issuerURL.protocol === 'http:' && isLoopback(issuerURL.hostname)
-    && endpoint.protocol === 'http:' && isLoopback(endpoint.hostname)
-  const explicitlyAllowedDevelopment = profile.allowInsecureDevelopment === true
-    && typeof profile.insecureDevelopmentOrigin === 'string'
-    && issuerURL.origin === profile.insecureDevelopmentOrigin
-    && endpoint.protocol === 'http:'
-    && endpoint.origin === profile.insecureDevelopmentOrigin
-  if ((!secure && !localDevelopment && !explicitlyAllowedDevelopment) || endpoint.username || endpoint.password || endpoint.hash) {
-    throw publicError('oidc_discovery_invalid', `OIDC ${label} must be HTTPS, loopback HTTP, or the profile's exact development HTTP origin`)
+  if (!serviceProtocolAllowed(endpoint, profile.allowInsecureDevelopment) || endpoint.username || endpoint.password || endpoint.hash) {
+    throw publicError('oidc_discovery_invalid', `OIDC ${label} must be HTTPS; set allowInsecureDevelopment=true to allow HTTP`)
   }
   return endpoint.toString()
 }

package/lib/profile.js

@@ -1,3 +1,4 @@
+import { serviceProtocolAllowed } from './transport.js'
 import { readFileSync } from 'node:fs'
 
 export const PROFILE_SCHEMA_VERSION = 'dsh-oidc/v1alpha1'
@@ -52,41 +53,22 @@ function text(value, label, max = 2048) {
   return value
 }
 
-function isLoopback(hostname) {
-  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]'
-}
-
-function insecureDevelopmentOrigin(value, label) {
+function issuerURL(value, label, allowInsecure = false) {
   const raw = text(value, label)
   const parsed = new URL(raw)
-  if (parsed.protocol !== 'http:' || parsed.username || parsed.password || parsed.search || parsed.hash || (parsed.pathname !== '/' && parsed.pathname !== '')) {
-    throw new Error(`${label} must be an exact HTTP origin without credentials, path, query, or fragment`)
-  }
-  return raw.replace(/\/+$/, '')
-}
-
-function endpointProtocolAllowed(parsed, allowInsecure, allowedInsecureOrigin) {
-  return parsed.protocol === 'https:' || (allowInsecure && parsed.protocol === 'http:' && (
-    isLoopback(parsed.hostname) || parsed.origin === allowedInsecureOrigin
-  ))
-}
-
-function issuerURL(value, label, allowInsecure = false, allowedInsecureOrigin) {
-  const raw = text(value, label)
-  const parsed = new URL(raw)
-  const permitted = endpointProtocolAllowed(parsed, allowInsecure, allowedInsecureOrigin)
+  const permitted = serviceProtocolAllowed(parsed, allowInsecure)
   if (!permitted || parsed.username || parsed.password || parsed.search || parsed.hash) {
-    throw new Error(`${label} must be an HTTPS issuer URL without credentials, query, or fragment${allowInsecure ? ' (loopback or the exact allowlisted HTTP origin is allowed in development)' : ''}`)
+    throw new Error(`${label} must be an HTTPS issuer URL without credentials, query, or fragment${allowInsecure ? ' (HTTP is allowed with allowInsecureDevelopment=true)' : '; set allowInsecureDevelopment=true to allow HTTP'}`)
   }
   return raw
 }
 
-function exactURL(value, label, allowInsecure = false, allowedInsecureOrigin) {
+function exactURL(value, label, allowInsecure = false) {
   const raw = text(value, label)
   const parsed = new URL(raw)
-  const permitted = endpointProtocolAllowed(parsed, allowInsecure, allowedInsecureOrigin)
+  const permitted = serviceProtocolAllowed(parsed, allowInsecure)
   if (!permitted || parsed.username || parsed.password || parsed.hash || parsed.search) {
-    throw new Error(`${label} must be an absolute HTTPS URL without credentials, query, or fragment${allowInsecure ? ' (loopback or the exact allowlisted HTTP origin is allowed in development)' : ''}`)
+    throw new Error(`${label} must be an absolute HTTPS URL without credentials, query, or fragment${allowInsecure ? ' (HTTP is allowed with allowInsecureDevelopment=true)' : '; set allowInsecureDevelopment=true to allow HTTP'}`)
   }
   return raw.replace(/\/+$/, '')
 }
@@ -269,12 +251,8 @@ export function normalizeEnterpriseProfile(raw) {
   const id = text(source.id, 'profile.id', 64)
   if (!idPattern.test(id)) throw new Error('profile.id is invalid')
   const allowInsecureDevelopment = source.allowInsecureDevelopment === true
-  const allowedInsecureOrigin = source.insecureDevelopmentOrigin === undefined
-    ? undefined
-    : insecureDevelopmentOrigin(source.insecureDevelopmentOrigin, 'profile.insecureDevelopmentOrigin')
-  if (allowedInsecureOrigin !== undefined && !allowInsecureDevelopment) {
-    throw new Error('profile.insecureDevelopmentOrigin requires allowInsecureDevelopment=true')
-  }
+  if (source.allowInsecureDevelopment !== undefined && typeof source.allowInsecureDevelopment !== 'boolean') throw new Error('profile.allowInsecureDevelopment must be boolean')
+  // Accept the obsolete field in old files, but it no longer controls transport.
   const gateway = source.auth !== undefined
   if (gateway && source.oidc !== undefined) throw new Error('profile.auth cannot be combined with oidc')
   let auth
@@ -285,11 +263,9 @@ export function normalizeEnterpriseProfile(raw) {
     if (rawAuth.experimentalOidcLlm !== undefined && typeof rawAuth.experimentalOidcLlm !== 'boolean') throw new Error('profile.auth.experimentalOidcLlm must be boolean')
     if (!experimental && (rawAuth.clientId !== undefined || rawAuth.identityMode !== undefined)) throw new Error('profile.auth clientId and identityMode require experimentalOidcLlm=true')
     if (experimental && !['oauth', 'oidc'].includes(rawAuth.identityMode)) throw new Error('profile.auth.identityMode must explicitly select oauth or oidc')
-    if (experimental && allowedInsecureOrigin && !rawAuth.expectedIssuer) throw new Error('development oidc-llm requires expectedIssuer')
-    const developmentOrigin = experimental ? allowedInsecureOrigin : undefined
     auth = Object.freeze({
-      discoveryUrl: issuerURL(rawAuth.discoveryUrl, 'profile.auth.discoveryUrl', allowInsecureDevelopment, developmentOrigin),
-      ...(rawAuth.expectedIssuer === undefined ? {} : { expectedIssuer: issuerURL(rawAuth.expectedIssuer, 'profile.auth.expectedIssuer', allowInsecureDevelopment, developmentOrigin) }),
+      discoveryUrl: issuerURL(rawAuth.discoveryUrl, 'profile.auth.discoveryUrl', allowInsecureDevelopment),
+      ...(rawAuth.expectedIssuer === undefined ? {} : { expectedIssuer: issuerURL(rawAuth.expectedIssuer, 'profile.auth.expectedIssuer', allowInsecureDevelopment) }),
       ...(experimental ? { experimentalOidcLlm: true, clientId: text(rawAuth.clientId, 'profile.auth.clientId', 256), identityMode: rawAuth.identityMode } : {}),
     })
     if (source.provider?.baseURL !== undefined) throw new Error('profile.auth derives provider.baseURL from validated discovery')
@@ -316,11 +292,10 @@ export function normalizeEnterpriseProfile(raw) {
     displayName: text(source.displayName, 'profile.displayName', 120),
     organization: text(source.organization ?? source.displayName, 'profile.organization', 120),
     allowInsecureDevelopment,
-    ...(allowedInsecureOrigin === undefined ? {} : { insecureDevelopmentOrigin: allowedInsecureOrigin }),
     nativeInstitutionID: source.nativeInstitutionID === undefined ? id : text(source.nativeInstitutionID, 'profile.nativeInstitutionID', 64),
     brand: normalizeBrand(source.brand),
     ...(gateway ? { auth } : { oidc: Object.freeze({
-      issuer: issuerURL(oidc.issuer, 'profile.oidc.issuer', allowInsecureDevelopment, allowedInsecureOrigin),
+      issuer: issuerURL(oidc.issuer, 'profile.oidc.issuer', allowInsecureDevelopment),
       clientId: text(oidc.clientId, 'profile.oidc.clientId', 256),
       scopes: Object.freeze([...scopes]),
     }) }),
@@ -384,7 +359,6 @@ export function enterpriseProviderConfig(profiles) {
       apiKeyEnv: `DSH_GATEWAY_${profile.id.toUpperCase().replace(/-/g, '_')}_ACCESS`,
       baseURL: profile.provider.baseURL,
       allowInsecureDevelopment: profile.allowInsecureDevelopment,
-      ...(profile.insecureDevelopmentOrigin === undefined ? {} : { insecureDevelopmentOrigin: profile.insecureDevelopmentOrigin }),
       reasoning: profile.provider.reasoning,
       ...(profile.provider.defaultContextWindow === undefined ? {} : { defaultContextWindow: profile.provider.defaultContextWindow }),
       ...(profile.provider.defaultMaxTokens === undefined ? {} : { defaultMaxTokens: profile.provider.defaultMaxTokens }),

package/lib/provider/core.js

@@ -1,3 +1,4 @@
+import { serviceProtocolAllowed } from '../transport.js'
 const modalities = new Set(['text', 'image'])
 export const REASONING_EFFORT_ORDER = Object.freeze(['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'])
 const reasoningEfforts = new Set(REASONING_EFFORT_ORDER)
@@ -12,23 +13,11 @@ function nonEmpty(value, label) {
   return value.trim()
 }
 
-function exactDevelopmentOrigin(value, label) {
-  if (value === undefined) return undefined
+function endpointURL(value, label, allowInsecureDevelopment = false) {
   const raw = nonEmpty(value, label).replace(/\/+$/, '')
   const parsed = new URL(raw)
-  if (parsed.protocol !== 'http:' || parsed.username || parsed.password || parsed.hash || parsed.search || (parsed.pathname !== '/' && parsed.pathname !== '')) {
-    throw new Error(`${label} must be an exact HTTP origin`)
-  }
-  return raw
-}
-
-function endpointURL(value, label, allowInsecureDevelopment = false, insecureDevelopmentOrigin) {
-  const raw = nonEmpty(value, label).replace(/\/+$/, '')
-  const parsed = new URL(raw)
-  const loopback = ['localhost', '127.0.0.1', '[::1]'].includes(parsed.hostname)
-  const allowedOrigin = exactDevelopmentOrigin(insecureDevelopmentOrigin, `${label}.insecureDevelopmentOrigin`)
-  const permittedHTTP = parsed.protocol === 'http:' && (loopback || (allowInsecureDevelopment === true && parsed.origin === allowedOrigin))
-  if ((parsed.protocol !== 'https:' && !permittedHTTP) || parsed.username || parsed.password || parsed.hash || parsed.search) {
+  if (typeof allowInsecureDevelopment !== 'boolean') throw new Error(`${label}.allowInsecureDevelopment must be boolean`)
+  if (!serviceProtocolAllowed(parsed, allowInsecureDevelopment) || parsed.username || parsed.password || parsed.hash || parsed.search) {
     throw new Error(`${label} must be HTTPS or explicitly allowed development HTTP without credentials, query, or fragment`)
   }
   return raw
@@ -100,7 +89,7 @@ export function resolveEnterpriseProfiles(raw = {}) {
     const route = nonEmpty(provider, 'provider route')
     if (typeof source !== 'object' || source === null || Array.isArray(source)) throw new Error(`${route} config must be an object`)
     const displayName = nonEmpty(source.displayName ?? route, `${route}.displayName`)
-    const baseURL = endpointURL(source.baseURL, `${route}.baseURL`, source.allowInsecureDevelopment, source.insecureDevelopmentOrigin)
+    const baseURL = endpointURL(source.baseURL, `${route}.baseURL`, source.allowInsecureDevelopment)
     const credentialRef = nonEmpty(source.apiKeyEnv, `${route}.apiKeyEnv`)
     const contextWindow = positiveInteger(source.defaultContextWindow, 262144, `${route}.defaultContextWindow`)
     const maxTokens = positiveInteger(source.defaultMaxTokens, 32768, `${route}.defaultMaxTokens`)

package/lib/transport.js

@@ -0,0 +1,5 @@
+// One transport rule for configured and discovered service URLs.
+// Callback binding, issuer identity and protocol-specific origin checks are separate.
+export function serviceProtocolAllowed(url, allowInsecureDevelopment = false) {
+  return url.protocol === 'https:' || (allowInsecureDevelopment === true && url.protocol === 'http:')
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eduwork/dsh-oidc",
-  "version": "0.3.0-dev.1",
+  "version": "0.3.0-dev.2",
   "description": "Standards-based OIDC identity, token-authorized model access, declarative branding, and OpenAI-compatible model integration for DeepSeek Harness",
   "keywords": [
     "deepseek-harness",

package/schema/enterprise-profile.v1alpha1.schema.json

@@ -53,13 +53,12 @@
     },
     "allowInsecureDevelopment": {
       "type": "boolean",
-      "default": false
+      "default": false,
+      "description": "false (default): HTTPS only. true: allow HTTP service URLs too. Does not change issuer or OAuth validation."
     },
     "insecureDevelopmentOrigin": {
-      "type": "string",
-      "minLength": 8,
-      "maxLength": 2048,
-      "pattern": "^http://"
+      "deprecated": true,
+      "description": "Accepted for older configuration files; ignored. Use allowInsecureDevelopment only."
     },
     "brand": {
       "$ref": "#/$defs/brand"