@eduwork/dsh-oidc 0.3.0-dev.1 → 0.3.0

package/lib/desktop-oidc.js

@@ -6,7 +6,7 @@ import { callbackLanguage, callbackPage } from './callback-page.js'
 const MAX_FLOWS = 32
 const MAX_HISTORY = 128
 const error = (code, message) => Object.assign(new Error(message), { code })
-const safeCodes = new Set(['oidc_callback_invalid', 'oidc_authorization_rejected', 'oidc_token_invalid', 'oidc_id_token_invalid', 'oidc_userinfo_invalid', 'gateway_token_invalid', 'gateway_scope_changed', 'gateway_identity_changed', 'gateway_callback_issuer_missing', 'gateway_callback_issuer_invalid'])
+const safeCodes = new Set(['oidc_id_token_time_invalid', 'oidc_callback_invalid', 'oidc_authorization_rejected', 'oidc_token_invalid', 'oidc_id_token_invalid', 'oidc_userinfo_invalid', 'gateway_token_invalid', 'gateway_scope_changed', 'gateway_identity_changed', 'gateway_callback_issuer_missing', 'gateway_callback_issuer_invalid'])
 
 function reply(response, status, profile, outcome, language) {
   const page = callbackPage(profile, outcome, language)
@@ -138,7 +138,7 @@ export class DesktopOidcBackend extends WebOidcBackend {
       this.ctx.logger.warn('Desktop OIDC host credentials are unavailable')
     })
     await attempt.processing
-    const failedOutcome = ['gateway_callback_issuer_missing', 'gateway_callback_issuer_invalid'].includes(attempt.errorCode) ? 'issuer-invalid' : 'failed'
+    const failedOutcome = ['gateway_callback_issuer_missing', 'gateway_callback_issuer_invalid'].includes(attempt.errorCode) ? 'issuer-invalid' : attempt.errorCode === 'oidc_id_token_time_invalid' ? 'time-invalid' : 'failed'
     if (!response.destroyed) reply(response, attempt.state === 'completed' ? 200 : 400, profile,
       attempt.state === 'completed' ? 'completed' : failedOutcome, language)
     await this.closeCallback(attempt)

package/lib/gateway-backend.js

@@ -6,6 +6,7 @@ import { gatewayJSON, liteLLMToken, protocolError, readGatewayJSON, registerLite
 import { detectGatewayProtocol } from './gateway-protocol.js'
 import { oidcLlmIdentity, oidcLlmToken } from './oidc-llm-protocol.js'
 import { bufferResourceResponse, validateResourceRead } from './model-resource-transport.js'
+import { accessTokenNeedsRefresh } from './token-lifetime.js'
 
 const seconds = backend => Math.floor(backend.now() / 1000)
 const fingerprint = (profile, descriptor) => createHash('sha256').update(JSON.stringify({ auth: profile.auth, descriptor })).digest('hex')
@@ -266,7 +267,7 @@ function withGatewayAuth(Base) {
       const epoch = this.accountEpoch(profile)
       const session = await this.loadSession(profile)
       if (!session) return undefined
-      if (session.expiresAt > seconds(this) + 90) return session
+      if (!accessTokenNeedsRefresh(session, this.now)) return session
       try { return await this.refresh(profile, session) }
       catch (cause) {
         // Brief outages must not discard a still-valid access token; expired tokens stop.
@@ -314,14 +315,26 @@ function withGatewayAuth(Base) {
       return account(profile, session, true, 'access_token')
     }
 
-    async authorizedFetch(profileID, endpoint, init = {}) {
+    async authorizedFetch(profileID, endpoint, init = {}, authorization = {}) {
+      const retryUnauthorized = authorization.retryUnauthorized === true
+      if (retryUnauthorized && init.body != null && typeof init.body !== 'string') throw new TypeError('Authorization retry requires a buffered text request body')
       const profile = this.profile(profileID)
       if (!profile.auth) return super.authorizedFetch(profileID, endpoint, init)
       const epoch = this.accountEpoch(profile), descriptor = await this.discover(profile)
       const target = new URL(endpoint)
       // Host-only model and own-account routes, never key administration or arbitrary origins.
       const modelBase = new URL(`${descriptor.baseURL}/`)
-      if (target.username || target.password || target.hash || target.origin !== modelBase.origin || !(target.href === descriptor.userInfoEndpoint || target.pathname.startsWith(modelBase.pathname))) throw protocolError('oidc_authorized_origin_denied', 'Gateway token destination is not an authorized resource')
+      // Trusted Host services can grant one exact issuer POST route for their
+      // own request. This option is never accepted through a renderer RPC or
+      // persisted as a broader model-resource allowlist.
+      const servicePath = authorization.issuerServicePath
+      const issuerService = typeof servicePath === 'string'
+        && /^\/(?:[a-zA-Z0-9_-]+\/)*[a-zA-Z0-9_-]+$/.test(servicePath)
+        && (init.method ?? 'GET').toUpperCase() === 'POST'
+        && target.href === new URL(descriptor.issuer).origin + servicePath
+      const modelResource = target.origin === modelBase.origin
+        && (target.href === descriptor.userInfoEndpoint || target.pathname.startsWith(modelBase.pathname))
+      if (target.username || target.password || target.hash || !(modelResource || issuerService)) throw protocolError('oidc_authorized_origin_denied', 'Gateway token destination is not an authorized resource')
       const scope = await this.createGatewayScope(profileID)
       const lease = scope.open(init.signal ?? AbortSignal.timeout(20_000))
       let response
@@ -331,8 +344,9 @@ function withGatewayAuth(Base) {
         if (!session) throw protocolError('oidc_login_required', 'Gateway sign-in is required')
         const request = current => this.fetch(target.href, { ...init, headers: { ...Object.fromEntries(new Headers(init.headers)), authorization: `Bearer ${current.accessToken}` }, redirect: 'error', signal: lease.signal })
         response = await request(session)
-        // Retry only safe reads. A generation (including SSE) is never replayed here.
-        if (response.status === 401 && ['GET', 'HEAD'].includes((init.method ?? 'GET').toUpperCase())) {
+        // Reads recover automatically. Trusted Host services may explicitly opt
+        // in for replayable calls; model generation does not opt in.
+        if (response.status === 401 && (retryUnauthorized || ['GET', 'HEAD'].includes((init.method ?? 'GET').toUpperCase()))) {
           await response.body?.cancel()
           session = await this.refresh(profile, session)
           lease.assertCurrent()
@@ -379,6 +393,7 @@ function withGatewayAuth(Base) {
         this.updateProvider(next)
         this.profiles.set(profileID, next)
         result.models = models
+        if (models.some(model => model.type === 'unknown')) result.issues.push('model_types_unresolved')
       } catch (cause) {
         if (cause.code === 'oidc_login_cancelled' || cause.code === 'oidc_login_required') throw cause
         result.issues.push('models_unavailable')

package/lib/index.js

@@ -45,7 +45,7 @@ export class OidcAccountService extends TypertRemoteService {
     })
     const backendOptions = {
           authorizedOrigins: config.authorizedOrigins,
-          accountChanged: status => this.notifyAccount(status),
+          accountChanged: status => this.notifyAccount(status, { force: true }),
           updateProvider: profile => {
             const profiles = new Map(this.profiles)
             profiles.set(profile.id, profile)
@@ -98,18 +98,20 @@ export class OidcAccountService extends TypertRemoteService {
     return { opened: true }
   }
 
-  notifyAccount(status) {
-    if (this.accountStates.get(status.profileID) !== status.state) {
+  notifyAccount(status, { force = false } = {}) {
+    // A completed sign-in replaces authorization even when both sessions are
+    // "connected". Consumers must reset work blocked by the previous session.
+    if (force || this.accountStates.get(status.profileID) !== status.state) {
       this.accountStates.set(status.profileID, status.state)
-      this.ctx.emit('oidc/accounts-changed', { profileID: status.profileID, state: status.state })
+      this.ctx.emit('oidc/accounts-changed', { profileID: status.profileID, state: status.state, ...(force ? { authorizationChanged: true } : {}) })
     }
     return status
   }
   async status(profileID) { return this.notifyAccount(await this.callBackend('status', profileID)) }
   resources(profileID) { return this.callBackend('resources', profileID) }
   // Host-only capability: deliberately absent from Remote markers and Typert.
-  authorizedFetch(profileID, endpoint, init) {
-    return this.callBackend('authorizedFetch', profileID, endpoint, init)
+  authorizedFetch(profileID, endpoint, init, authorization) {
+    return this.callBackend('authorizedFetch', profileID, endpoint, init, authorization)
   }
   modelResourceFetch(profileID, relativePath, options) {
     return this.callBackend('modelResourceFetch', profileID, relativePath, options)

package/lib/litellm-protocol.js

@@ -1,3 +1,5 @@
+import { serviceProtocolAllowed } from './transport.js'
+import { accessTokenTiming } from './token-lifetime.js'
 // LiteLLM v1.101.0, native CLI auth contract 1. This is OAuth, not OIDC.
 // Protocol-specific wire fields stay here; tokens never cross the renderer RPC.
 const MAX_BYTES = 1024 * 1024
@@ -51,8 +53,7 @@ export async function gatewayJSON(fetcher, url, init = {}) {
 function trustedURL(value, profile, origin) {
   let url
   try { url = new URL(value) } catch { throw protocolError('gateway_discovery_invalid', 'Gateway metadata contains an invalid URL') }
-  const local = profile.allowInsecureDevelopment && url.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(url.hostname)
-  if (!nonempty(value, 2048) || (url.protocol !== 'https:' && !local) || url.username || url.password || url.search || url.hash || (origin && url.origin !== origin)) {
+  if (!nonempty(value, 2048) || !serviceProtocolAllowed(url, profile.allowInsecureDevelopment) || url.username || url.password || url.search || url.hash || (origin && url.origin !== origin)) {
     throw protocolError('gateway_discovery_invalid', 'Gateway metadata URL is outside the configured trust boundary')
   }
   return url
@@ -99,7 +100,7 @@ export function liteLLMToken(raw, now, previous) {
     throw protocolError('gateway_token_invalid', 'LiteLLM token response is incomplete or invalid')
   }
   if (previous && (raw.user_id !== previous.identity.sub || raw.team_id !== previous.teamID)) throw protocolError('gateway_identity_changed', 'Gateway authorization identity changed during refresh; sign in again')
-  return { accessToken: raw.access_token, refreshToken: raw.refresh_token, expiresAt: Math.floor(now() / 1000) + raw.expires_in, teamID: raw.team_id, identity: { sub: raw.user_id, name: previous?.identity?.name || raw.user_id } }
+  return { accessToken: raw.access_token, refreshToken: raw.refresh_token, ...accessTokenTiming(raw.expires_in, now), teamID: raw.team_id, identity: { sub: raw.user_id, name: previous?.identity?.name || raw.user_id } }
 }
 
 export function tokenRequest(fetcher, descriptor, values) {

package/lib/model-types.js

@@ -0,0 +1,7 @@
+// Purpose is independent of input modalities: a vision LLM is still an LLM.
+// Unknown (including future server types) is never registered for conversation.
+export const MODEL_TYPES = Object.freeze(['llm', 'embedding', 'rerank', 'image', 'tts', 'unknown'])
+
+export function isLLM(model) {
+  return model.type === 'llm'
+}

package/lib/oidc-llm-protocol.js

@@ -1,3 +1,5 @@
+import { serviceProtocolAllowed } from './transport.js'
+import { accessTokenTiming } from './token-lifetime.js'
 // Experimental draft 0.1. These wire rules are not a published standard.
 import { protocolError } from './litellm-protocol.js'
 
@@ -10,9 +12,7 @@ const includes = (raw, key, values) => {
 function endpoint(value, profile, origin) {
   let url
   try { url = new URL(value) } catch { fail('oidc-llm metadata contains an invalid URL') }
-  const development = profile.allowInsecureDevelopment && url.protocol === 'http:'
-    && (['127.0.0.1', 'localhost', '[::1]'].includes(url.hostname) || url.origin === profile.insecureDevelopmentOrigin)
-  if (typeof value !== 'string' || value.length > 2048 || (url.protocol !== 'https:' && !development)
+  if (typeof value !== 'string' || value.length > 2048 || !serviceProtocolAllowed(url, profile.allowInsecureDevelopment)
     || url.username || url.password || url.search || url.hash || origin && url.origin !== origin) fail('oidc-llm URL is outside the configured trust boundary')
   return url
 }
@@ -31,9 +31,12 @@ export function detectOidcLlm(raw, profile) {
   const identityMode = profile.auth.identityMode
   includes(extension, 'identity_modes_supported', ['oauth', identityMode])
   includes(extension, 'client_registration_methods_supported', ['static'])
-  const scopes = identityMode === 'oidc'
+  const identityScopes = identityMode === 'oidc'
     ? ['openid', 'profile', 'offline_access', 'llm:models:read', 'llm:invoke']
     : ['llm:profile', 'llm:models:read', 'llm:invoke']
+  // Only request explicitly configured services; discovery is not consent to
+  // every capability advertised by the authorization server.
+  const scopes = [...new Set([...identityScopes, ...(profile.auth.additionalScopes ?? [])])]
   for (const [key, values] of Object.entries({
     response_types_supported: ['code'], grant_types_supported: ['authorization_code', 'refresh_token'],
     code_challenge_methods_supported: ['S256'], token_endpoint_auth_methods_supported: ['none'],
@@ -74,7 +77,7 @@ export function oidcLlmToken(raw, descriptor, now, previous) {
     throw protocolError('gateway_scope_changed', 'oidc-llm granted scopes do not match the requested authorization')
   }
   // No unapproved 15-minute ceiling: honor the actual advertised TTL.
-  return { accessToken: raw.access_token, refreshToken: raw.refresh_token, expiresAt: Math.floor(now() / 1000) + raw.expires_in, scopes, teamID: null }
+  return { accessToken: raw.access_token, refreshToken: raw.refresh_token, ...accessTokenTiming(raw.expires_in, now), scopes, teamID: null }
 }
 
 export function oidcLlmIdentity(raw) {

package/lib/oidc.js

@@ -1,10 +1,11 @@
+import { serviceProtocolAllowed } from './transport.js'
 import { createHash, createPublicKey, randomBytes, timingSafeEqual, verify as verifySignature } from 'node:crypto'
 import { emptyResources } from './resources.js'
+import { accessTokenNeedsRefresh, accessTokenTiming } from './token-lifetime.js'
 
 const FLOW_TTL_MS = 10 * 60 * 1000
 const MAX_PENDING_FLOWS = 32
 const CLOCK_SKEW_SECONDS = 60
-const ACCESS_REFRESH_SECONDS = 90
 const MAX_RESPONSE_BYTES = 1024 * 1024
 export const OIDC_CALLBACK_PATH = '/oauth/callback'
 
@@ -43,10 +44,6 @@ async function responseJSON(response, stage) {
   return value
 }
 
-function isLoopback(hostname) {
-  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]'
-}
-
 /** OIDC metadata endpoints may use origins distinct from the issuer over HTTPS. */
 function discoveredEndpoint(value, profile, label, optional = false) {
   if (optional && (value === undefined || value === '')) return ''
@@ -54,17 +51,8 @@ function discoveredEndpoint(value, profile, label, optional = false) {
   let endpoint
   try { endpoint = new URL(value) }
   catch (cause) { throw publicError('oidc_discovery_invalid', `OIDC ${label} is not an absolute URL`, cause) }
-  const issuerURL = new URL(profile.oidc.issuer)
-  const secure = endpoint.protocol === 'https:'
-  const localDevelopment = issuerURL.protocol === 'http:' && isLoopback(issuerURL.hostname)
-    && endpoint.protocol === 'http:' && isLoopback(endpoint.hostname)
-  const explicitlyAllowedDevelopment = profile.allowInsecureDevelopment === true
-    && typeof profile.insecureDevelopmentOrigin === 'string'
-    && issuerURL.origin === profile.insecureDevelopmentOrigin
-    && endpoint.protocol === 'http:'
-    && endpoint.origin === profile.insecureDevelopmentOrigin
-  if ((!secure && !localDevelopment && !explicitlyAllowedDevelopment) || endpoint.username || endpoint.password || endpoint.hash) {
-    throw publicError('oidc_discovery_invalid', `OIDC ${label} must be HTTPS, loopback HTTP, or the profile's exact development HTTP origin`)
+  if (!serviceProtocolAllowed(endpoint, profile.allowInsecureDevelopment) || endpoint.username || endpoint.password || endpoint.hash) {
+    throw publicError('oidc_discovery_invalid', `OIDC ${label} must be HTTPS; set allowInsecureDevelopment=true to allow HTTP`)
   }
   return endpoint.toString()
 }
@@ -237,7 +225,7 @@ export class WebOidcBackend {
     let response
     try {
       response = await this.fetch(discoveryURL(profile.oidc.issuer), {
-        headers: { accept: 'application/json' }, signal: AbortSignal.timeout(20_000),
+        headers: { accept: 'application/json' }, redirect: 'error', signal: AbortSignal.timeout(20_000),
       })
     } catch (cause) {
       throw publicError('oidc_discovery_failed', 'unable to read OIDC discovery metadata', cause)
@@ -340,7 +328,7 @@ export class WebOidcBackend {
     })
     const response = await this.fetch(discovery.tokenEndpoint, {
       method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
-      body, signal: AbortSignal.timeout(20_000),
+      body, redirect: 'error', signal: AbortSignal.timeout(20_000),
     })
     const token = await responseJSON(response, 'oidc_token_request_failed')
     if (typeof token.access_token !== 'string' || typeof token.id_token !== 'string' || token.token_type?.toLowerCase() !== 'bearer') {
@@ -348,6 +336,7 @@ export class WebOidcBackend {
     }
     const expiresIn = token.expires_in === undefined ? 3600 : Number(token.expires_in)
     if (!Number.isFinite(expiresIn) || expiresIn <= 0) throw publicError('oidc_token_invalid', 'OIDC token expiry is invalid')
+    const timing = accessTokenTiming(expiresIn, this.now)
     const claims = await this.verifyIDToken(profile, discovery, token.id_token, nonce, token.access_token)
     const userInfo = await this.userInfo(discovery.userInfoEndpoint, token.access_token)
     if (!equalText(userInfo.sub, claims.sub)) throw publicError('oidc_userinfo_invalid', 'OIDC UserInfo subject does not match ID Token')
@@ -358,7 +347,7 @@ export class WebOidcBackend {
       clientId: profile.oidc.clientId,
       accessToken: token.access_token,
       refreshToken: typeof token.refresh_token === 'string' ? token.refresh_token : '',
-      expiresAt: nowSeconds(this.now) + Math.max(60, expiresIn),
+      ...timing,
       identity: {
         sub: claims.sub,
         name: userName,
@@ -399,9 +388,12 @@ export class WebOidcBackend {
       throw publicError('oidc_id_token_invalid', 'OIDC ID Token identity claims are invalid')
     }
     if (!Number.isFinite(claims.exp) || !Number.isFinite(claims.iat)
-      || claims.exp < now - CLOCK_SKEW_SECONDS || claims.iat > now + CLOCK_SKEW_SECONDS
-      || (claims.nbf !== undefined && (!Number.isFinite(claims.nbf) || claims.nbf > now + CLOCK_SKEW_SECONDS))) {
-      throw publicError('oidc_id_token_invalid', 'OIDC ID Token time claims are invalid')
+      || (claims.nbf !== undefined && !Number.isFinite(claims.nbf))) {
+      throw publicError('oidc_id_token_invalid', 'OIDC ID Token time claims are malformed')
+    }
+    if (claims.exp < now - CLOCK_SKEW_SECONDS || claims.iat > now + CLOCK_SKEW_SECONDS
+      || (claims.nbf !== undefined && claims.nbf > now + CLOCK_SKEW_SECONDS)) {
+      throw publicError('oidc_id_token_time_invalid', 'OIDC ID Token time claims are invalid')
     }
     if (claims.at_hash !== undefined && (typeof claims.at_hash !== 'string' || !verifyAccessTokenHash(accessToken, claims.at_hash))) {
       throw publicError('oidc_id_token_invalid', 'OIDC ID Token access-token hash is invalid')
@@ -411,7 +403,7 @@ export class WebOidcBackend {
 
   async userInfo(endpoint, accessToken) {
     const response = await this.fetch(endpoint, {
-      headers: { authorization: `Bearer ${accessToken}`, accept: 'application/json' }, signal: AbortSignal.timeout(20_000),
+      headers: { authorization: `Bearer ${accessToken}`, accept: 'application/json' }, redirect: 'error', signal: AbortSignal.timeout(20_000),
     })
     const result = await responseJSON(response, 'oidc_userinfo_failed')
     if (typeof result.sub !== 'string' || result.sub === '') throw publicError('oidc_userinfo_invalid', 'OIDC UserInfo has no subject')
@@ -471,13 +463,14 @@ export class WebOidcBackend {
     const epoch = this.accountEpoch(profile)
     const saved = await this.loadSession(profile)
     if (!saved) throw publicError('oidc_login_required', 'OIDC session is no longer available')
-    if (saved && saved.accessToken !== session.accessToken && saved.expiresAt > nowSeconds(this.now) + ACCESS_REFRESH_SECONDS) return saved
+    if (saved.accessToken !== session.accessToken && saved.expiresAt > nowSeconds(this.now)) return saved
+    session = saved
     if (!session.refreshToken) throw publicError('oidc_login_required', 'OIDC session cannot be refreshed')
     const discovery = await this.discover(profile)
     const response = await this.fetch(discovery.tokenEndpoint, {
       method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
       body: new URLSearchParams({ grant_type: 'refresh_token', client_id: profile.oidc.clientId, refresh_token: session.refreshToken }),
-      signal: AbortSignal.timeout(20_000),
+      redirect: 'error', signal: AbortSignal.timeout(20_000),
     })
     let token
     try { token = await responseJSON(response, 'oidc_refresh_failed') }
@@ -498,7 +491,7 @@ export class WebOidcBackend {
       ...session,
       accessToken: token.access_token,
       refreshToken: typeof token.refresh_token === 'string' ? token.refresh_token : session.refreshToken,
-      expiresAt: nowSeconds(this.now) + Math.max(60, expiresIn),
+      ...accessTokenTiming(expiresIn, this.now),
     }
     await this.saveSession(profile, next, epoch)
     return next
@@ -508,8 +501,9 @@ export class WebOidcBackend {
     const epoch = this.accountEpoch(profile)
     let session = await this.loadSession(profile)
     if (!session) return undefined
-    if (session.expiresAt <= nowSeconds(this.now) + ACCESS_REFRESH_SECONDS) {
+    if (accessTokenNeedsRefresh(session, this.now)) {
       if (!session.refreshToken) {
+        if (session.expiresAt > nowSeconds(this.now)) return session
         await this.clearCredentials(profile, epoch)
         this.accountChanged(account(profile, undefined, false))
         return undefined
@@ -607,7 +601,7 @@ export class WebOidcBackend {
           const token = session.refreshToken || session.accessToken
           await this.fetch(discovery.revocationEndpoint, {
             method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' },
-            body: new URLSearchParams({ token, client_id: profile.oidc.clientId }), signal: AbortSignal.timeout(10_000),
+            body: new URLSearchParams({ token, client_id: profile.oidc.clientId }), redirect: 'error', signal: AbortSignal.timeout(10_000),
           })
         }
       } catch (cause) { this.ctx.logger.warn(cause instanceof Error ? cause : new Error(String(cause))) }

package/lib/profile.js

@@ -1,3 +1,5 @@
+import { serviceProtocolAllowed } from './transport.js'
+import { MODEL_TYPES, isLLM } from './model-types.js'
 import { readFileSync } from 'node:fs'
 
 export const PROFILE_SCHEMA_VERSION = 'dsh-oidc/v1alpha1'
@@ -18,7 +20,7 @@ const allowedRootKeys = new Set([
 const allowedOidcKeys = new Set(['issuer', 'clientId', 'scopes'])
 const allowedBrandKeys = new Set([
   'productName', 'organizationName', 'mark', 'logoURL', 'primaryColor',
-  'loginTitle', 'loginDescription', 'supportURL',
+  'loginTitle', 'loginDescription', 'loginButtonLabel', 'supportURL', 'language',
 ])
 const allowedProviderKeys = new Set([
   'id', 'displayName', 'adapter', 'baseURL', 'reasoning', 'defaultContextWindow',
@@ -26,7 +28,7 @@ const allowedProviderKeys = new Set([
   'requestImageMaxBytes', 'streamIdleTimeoutMs', 'retryPolicy', 'compat', 'models', 'modelSource',
 ])
 const allowedModelKeys = new Set([
-  'id', 'name', 'input', 'contextWindow', 'maxTokens', 'reasoning',
+  'id', 'type', 'name', 'input', 'contextWindow', 'maxTokens', 'reasoning',
   'reasoningEfforts', 'defaultReasoningEffort', 'compat',
 ])
 const allowedCompatKeys = new Set([
@@ -52,41 +54,22 @@ function text(value, label, max = 2048) {
   return value
 }
 
-function isLoopback(hostname) {
-  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]'
-}
-
-function insecureDevelopmentOrigin(value, label) {
+function issuerURL(value, label, allowInsecure = false) {
   const raw = text(value, label)
   const parsed = new URL(raw)
-  if (parsed.protocol !== 'http:' || parsed.username || parsed.password || parsed.search || parsed.hash || (parsed.pathname !== '/' && parsed.pathname !== '')) {
-    throw new Error(`${label} must be an exact HTTP origin without credentials, path, query, or fragment`)
-  }
-  return raw.replace(/\/+$/, '')
-}
-
-function endpointProtocolAllowed(parsed, allowInsecure, allowedInsecureOrigin) {
-  return parsed.protocol === 'https:' || (allowInsecure && parsed.protocol === 'http:' && (
-    isLoopback(parsed.hostname) || parsed.origin === allowedInsecureOrigin
-  ))
-}
-
-function issuerURL(value, label, allowInsecure = false, allowedInsecureOrigin) {
-  const raw = text(value, label)
-  const parsed = new URL(raw)
-  const permitted = endpointProtocolAllowed(parsed, allowInsecure, allowedInsecureOrigin)
+  const permitted = serviceProtocolAllowed(parsed, allowInsecure)
   if (!permitted || parsed.username || parsed.password || parsed.search || parsed.hash) {
-    throw new Error(`${label} must be an HTTPS issuer URL without credentials, query, or fragment${allowInsecure ? ' (loopback or the exact allowlisted HTTP origin is allowed in development)' : ''}`)
+    throw new Error(`${label} must be an HTTPS issuer URL without credentials, query, or fragment${allowInsecure ? ' (HTTP is allowed with allowInsecureDevelopment=true)' : '; set allowInsecureDevelopment=true to allow HTTP'}`)
   }
   return raw
 }
 
-function exactURL(value, label, allowInsecure = false, allowedInsecureOrigin) {
+function exactURL(value, label, allowInsecure = false) {
   const raw = text(value, label)
   const parsed = new URL(raw)
-  const permitted = endpointProtocolAllowed(parsed, allowInsecure, allowedInsecureOrigin)
+  const permitted = serviceProtocolAllowed(parsed, allowInsecure)
   if (!permitted || parsed.username || parsed.password || parsed.hash || parsed.search) {
-    throw new Error(`${label} must be an absolute HTTPS URL without credentials, query, or fragment${allowInsecure ? ' (loopback or the exact allowlisted HTTP origin is allowed in development)' : ''}`)
+    throw new Error(`${label} must be an absolute HTTPS URL without credentials, query, or fragment${allowInsecure ? ' (HTTP is allowed with allowInsecureDevelopment=true)' : '; set allowInsecureDevelopment=true to allow HTTP'}`)
   }
   return raw.replace(/\/+$/, '')
 }
@@ -132,10 +115,14 @@ function normalizeBrand(value = {}) {
     }
     result.logoURL = logo.startsWith('https://') ? safeHTTPSResource(logo, 'brand.logoURL', 128 * 1024) : logo
   }
-  for (const key of ['loginTitle', 'loginDescription']) {
-    if (source[key] !== undefined) result[key] = text(source[key], `brand.${key}`, key === 'loginTitle' ? 120 : 500)
+  for (const [key, max] of Object.entries({ loginTitle: 120, loginDescription: 500, loginButtonLabel: 40 })) {
+    if (source[key] !== undefined) result[key] = text(source[key], `brand.${key}`, max)
   }
   if (source.supportURL !== undefined) result.supportURL = exactURL(source.supportURL, 'brand.supportURL')
+  if (source.language !== undefined) {
+    if (!['auto', 'zh-CN', 'en'].includes(source.language)) throw new Error('brand.language must be auto, zh-CN or en')
+    result.language = source.language
+  }
   return Object.freeze(result)
 }
 
@@ -180,6 +167,8 @@ export function normalizeModels(models, providerID) {
     const model = object(raw, label)
     exactKeys(model, allowedModelKeys, label)
     const id = text(model.id, `${label}.id`, 256)
+    const type = model.type === undefined ? 'unknown' : model.type
+    if (!MODEL_TYPES.includes(type)) throw new Error(`${label}.type must be one of ${MODEL_TYPES.join(', ')}`)
     if (seen.has(id)) throw new Error(`${providerID} repeats model ${id}`)
     seen.add(id)
     const input = model.input ?? ['text']
@@ -202,6 +191,7 @@ export function normalizeModels(models, providerID) {
     }
     return Object.freeze({
       id,
+      type,
       name: model.name === undefined ? id : text(model.name, `${providerID}.${id}.name`, 256),
       input: Object.freeze([...new Set(input)]),
       ...(model.contextWindow === undefined ? {} : { contextWindow: positiveInteger(model.contextWindow, `${providerID}.${id}.contextWindow`) }),
@@ -269,28 +259,29 @@ export function normalizeEnterpriseProfile(raw) {
   const id = text(source.id, 'profile.id', 64)
   if (!idPattern.test(id)) throw new Error('profile.id is invalid')
   const allowInsecureDevelopment = source.allowInsecureDevelopment === true
-  const allowedInsecureOrigin = source.insecureDevelopmentOrigin === undefined
-    ? undefined
-    : insecureDevelopmentOrigin(source.insecureDevelopmentOrigin, 'profile.insecureDevelopmentOrigin')
-  if (allowedInsecureOrigin !== undefined && !allowInsecureDevelopment) {
-    throw new Error('profile.insecureDevelopmentOrigin requires allowInsecureDevelopment=true')
-  }
+  if (source.allowInsecureDevelopment !== undefined && typeof source.allowInsecureDevelopment !== 'boolean') throw new Error('profile.allowInsecureDevelopment must be boolean')
+  // Accept the obsolete field in old files, but it no longer controls transport.
   const gateway = source.auth !== undefined
   if (gateway && source.oidc !== undefined) throw new Error('profile.auth cannot be combined with oidc')
   let auth
   if (gateway) {
     const rawAuth = object(source.auth, 'profile.auth')
-    exactKeys(rawAuth, new Set(['discoveryUrl', 'expectedIssuer', 'experimentalOidcLlm', 'clientId', 'identityMode']), 'profile.auth')
+    exactKeys(rawAuth, new Set(['discoveryUrl', 'expectedIssuer', 'experimentalOidcLlm', 'clientId', 'identityMode', 'additionalScopes']), 'profile.auth')
     const experimental = rawAuth.experimentalOidcLlm === true
     if (rawAuth.experimentalOidcLlm !== undefined && typeof rawAuth.experimentalOidcLlm !== 'boolean') throw new Error('profile.auth.experimentalOidcLlm must be boolean')
-    if (!experimental && (rawAuth.clientId !== undefined || rawAuth.identityMode !== undefined)) throw new Error('profile.auth clientId and identityMode require experimentalOidcLlm=true')
+    if (!experimental && (rawAuth.clientId !== undefined || rawAuth.identityMode !== undefined || rawAuth.additionalScopes !== undefined)) throw new Error('profile.auth clientId, identityMode and additionalScopes require experimentalOidcLlm=true')
     if (experimental && !['oauth', 'oidc'].includes(rawAuth.identityMode)) throw new Error('profile.auth.identityMode must explicitly select oauth or oidc')
-    if (experimental && allowedInsecureOrigin && !rawAuth.expectedIssuer) throw new Error('development oidc-llm requires expectedIssuer')
-    const developmentOrigin = experimental ? allowedInsecureOrigin : undefined
+    if (rawAuth.additionalScopes !== undefined && (!Array.isArray(rawAuth.additionalScopes)
+      || rawAuth.additionalScopes.length > 64
+      || rawAuth.additionalScopes.some(scope => typeof scope !== 'string' || scope.length > 128 || !/^[\x21\x23-\x5b\x5d-\x7e]+$/.test(scope))
+      || new Set(rawAuth.additionalScopes).size !== rawAuth.additionalScopes.length)) {
+      throw new Error('profile.auth.additionalScopes must contain at most 64 unique OAuth scope tokens, each at most 128 characters')
+    }
     auth = Object.freeze({
-      discoveryUrl: issuerURL(rawAuth.discoveryUrl, 'profile.auth.discoveryUrl', allowInsecureDevelopment, developmentOrigin),
-      ...(rawAuth.expectedIssuer === undefined ? {} : { expectedIssuer: issuerURL(rawAuth.expectedIssuer, 'profile.auth.expectedIssuer', allowInsecureDevelopment, developmentOrigin) }),
+      discoveryUrl: issuerURL(rawAuth.discoveryUrl, 'profile.auth.discoveryUrl', allowInsecureDevelopment),
+      ...(rawAuth.expectedIssuer === undefined ? {} : { expectedIssuer: issuerURL(rawAuth.expectedIssuer, 'profile.auth.expectedIssuer', allowInsecureDevelopment) }),
       ...(experimental ? { experimentalOidcLlm: true, clientId: text(rawAuth.clientId, 'profile.auth.clientId', 256), identityMode: rawAuth.identityMode } : {}),
+      ...(rawAuth.additionalScopes === undefined ? {} : { additionalScopes: Object.freeze([...rawAuth.additionalScopes]) }),
     })
     if (source.provider?.baseURL !== undefined) throw new Error('profile.auth derives provider.baseURL from validated discovery')
     if (source.provider?.modelSource !== undefined && source.provider.modelSource !== 'discovery') throw new Error('profile.auth requires discovery modelSource')
@@ -316,11 +307,10 @@ export function normalizeEnterpriseProfile(raw) {
     displayName: text(source.displayName, 'profile.displayName', 120),
     organization: text(source.organization ?? source.displayName, 'profile.organization', 120),
     allowInsecureDevelopment,
-    ...(allowedInsecureOrigin === undefined ? {} : { insecureDevelopmentOrigin: allowedInsecureOrigin }),
     nativeInstitutionID: source.nativeInstitutionID === undefined ? id : text(source.nativeInstitutionID, 'profile.nativeInstitutionID', 64),
     brand: normalizeBrand(source.brand),
     ...(gateway ? { auth } : { oidc: Object.freeze({
-      issuer: issuerURL(oidc.issuer, 'profile.oidc.issuer', allowInsecureDevelopment, allowedInsecureOrigin),
+      issuer: issuerURL(oidc.issuer, 'profile.oidc.issuer', allowInsecureDevelopment),
       clientId: text(oidc.clientId, 'profile.oidc.clientId', 256),
       scopes: Object.freeze([...scopes]),
     }) }),
@@ -379,12 +369,11 @@ export function loadEnterpriseProfiles(raw = {}, environment = process.env) {
 
 export function enterpriseProviderConfig(profiles) {
   return {
-    providers: Object.fromEntries([...profiles.values()].filter(profile => profile.provider?.baseURL && profile.provider.models.length).map(profile => [profile.provider.id, {
+    providers: Object.fromEntries([...profiles.values()].filter(profile => profile.provider?.baseURL && profile.provider.models.some(isLLM)).map(profile => [profile.provider.id, {
       displayName: profile.provider.displayName,
       apiKeyEnv: `DSH_GATEWAY_${profile.id.toUpperCase().replace(/-/g, '_')}_ACCESS`,
       baseURL: profile.provider.baseURL,
       allowInsecureDevelopment: profile.allowInsecureDevelopment,
-      ...(profile.insecureDevelopmentOrigin === undefined ? {} : { insecureDevelopmentOrigin: profile.insecureDevelopmentOrigin }),
       reasoning: profile.provider.reasoning,
       ...(profile.provider.defaultContextWindow === undefined ? {} : { defaultContextWindow: profile.provider.defaultContextWindow }),
       ...(profile.provider.defaultMaxTokens === undefined ? {} : { defaultMaxTokens: profile.provider.defaultMaxTokens }),
@@ -394,7 +383,7 @@ export function enterpriseProviderConfig(profiles) {
       ...(profile.provider.streamIdleTimeoutMs === undefined ? {} : { streamIdleTimeoutMs: profile.provider.streamIdleTimeoutMs }),
       ...(profile.provider.retryPolicy === undefined ? {} : { retryPolicy: structuredClone(profile.provider.retryPolicy) }),
       ...(profile.provider.compat === undefined ? {} : { compat: { ...profile.provider.compat } }),
-      models: profile.provider.models.map(model => ({
+      models: profile.provider.models.filter(isLLM).map(({ type, ...model }) => ({
         ...model,
         input: [...model.input],
         ...(model.reasoningEfforts && typeof model.reasoningEfforts === 'object'
@@ -416,7 +405,7 @@ export function publicProfile(profile) {
     ...(profile.provider ? { provider: {
       id: profile.provider.id,
       displayName: profile.provider.displayName,
-      models: profile.provider.models.map(model => ({ id: model.id, name: model.name, input: model.input })),
+      models: profile.provider.models.filter(isLLM).map(model => ({ id: model.id, name: model.name, input: model.input })),
     } } : {}),
   }
 }

package/lib/provider/authorization-scope.js

@@ -9,6 +9,10 @@ export class AuthorizationScopedAdapter {
   providerInfo(provider) { return this.inner.providerInfo(provider) }
   providerRetryPolicy(provider) { return this.inner.providerRetryPolicy(provider) }
   imageRequestPricing(provider, model) { return this.inner.imageRequestPricing(provider, model) }
+  imageRequestTarget(provider, model, image) {
+    return this.inner.imageRequestTarget?.(provider, model, image)
+      ?? { width: image.width, height: image.height, maxBytes: image.bytes }
+  }
   listModels(provider) { return this.inner.listModels(provider) }
   resolveModel(provider, model, signal) { return this.inner.resolveModel(provider, model, signal) }
 

package/lib/provider/core.js

@@ -1,3 +1,4 @@
+import { serviceProtocolAllowed } from '../transport.js'
 const modalities = new Set(['text', 'image'])
 export const REASONING_EFFORT_ORDER = Object.freeze(['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'])
 const reasoningEfforts = new Set(REASONING_EFFORT_ORDER)
@@ -12,23 +13,11 @@ function nonEmpty(value, label) {
   return value.trim()
 }
 
-function exactDevelopmentOrigin(value, label) {
-  if (value === undefined) return undefined
+function endpointURL(value, label, allowInsecureDevelopment = false) {
   const raw = nonEmpty(value, label).replace(/\/+$/, '')
   const parsed = new URL(raw)
-  if (parsed.protocol !== 'http:' || parsed.username || parsed.password || parsed.hash || parsed.search || (parsed.pathname !== '/' && parsed.pathname !== '')) {
-    throw new Error(`${label} must be an exact HTTP origin`)
-  }
-  return raw
-}
-
-function endpointURL(value, label, allowInsecureDevelopment = false, insecureDevelopmentOrigin) {
-  const raw = nonEmpty(value, label).replace(/\/+$/, '')
-  const parsed = new URL(raw)
-  const loopback = ['localhost', '127.0.0.1', '[::1]'].includes(parsed.hostname)
-  const allowedOrigin = exactDevelopmentOrigin(insecureDevelopmentOrigin, `${label}.insecureDevelopmentOrigin`)
-  const permittedHTTP = parsed.protocol === 'http:' && (loopback || (allowInsecureDevelopment === true && parsed.origin === allowedOrigin))
-  if ((parsed.protocol !== 'https:' && !permittedHTTP) || parsed.username || parsed.password || parsed.hash || parsed.search) {
+  if (typeof allowInsecureDevelopment !== 'boolean') throw new Error(`${label}.allowInsecureDevelopment must be boolean`)
+  if (!serviceProtocolAllowed(parsed, allowInsecureDevelopment) || parsed.username || parsed.password || parsed.hash || parsed.search) {
     throw new Error(`${label} must be HTTPS or explicitly allowed development HTTP without credentials, query, or fragment`)
   }
   return raw
@@ -100,7 +89,7 @@ export function resolveEnterpriseProfiles(raw = {}) {
     const route = nonEmpty(provider, 'provider route')
     if (typeof source !== 'object' || source === null || Array.isArray(source)) throw new Error(`${route} config must be an object`)
     const displayName = nonEmpty(source.displayName ?? route, `${route}.displayName`)
-    const baseURL = endpointURL(source.baseURL, `${route}.baseURL`, source.allowInsecureDevelopment, source.insecureDevelopmentOrigin)
+    const baseURL = endpointURL(source.baseURL, `${route}.baseURL`, source.allowInsecureDevelopment)
     const credentialRef = nonEmpty(source.apiKeyEnv, `${route}.apiKeyEnv`)
     const contextWindow = positiveInteger(source.defaultContextWindow, 262144, `${route}.defaultContextWindow`)
     const maxTokens = positiveInteger(source.defaultMaxTokens, 32768, `${route}.defaultMaxTokens`)
@@ -185,16 +174,16 @@ export function resolveEnterpriseProfiles(raw = {}) {
   })
 }
 
-export function configurableEntries(profiles) {
+export function configurableEntries(profiles, settingsNs = ENTERPRISE_SETTINGS_NAMESPACE) {
   return [...profiles.values()].map(profile => ({
     provider: profile.provider,
     displayName: profile.displayName,
-    settingsNs: ENTERPRISE_SETTINGS_NAMESPACE,
+    settingsNs,
     settingsPath: ['providers', profile.provider],
     declared: true,
   }))
 }
 
 export function settingsBase(rawConfig) {
-  return { providers: rawConfig.providers ?? {} }
+  return { providers: typeof rawConfig.providers?.get === 'function' ? rawConfig.providers.get() : rawConfig.providers ?? {} }
 }