@flink-app/oidc-plugin 0.14.3 → 2.0.0-alpha.100

package/CHANGELOG.md

@@ -1,5 +1,490 @@
 # @flink-app/oidc-plugin
 
+## 2.0.0-alpha.100
+
+### Patch Changes
+
+-   Updated dependencies [6e8166a]
+    -   @flink-app/flink@2.0.0-alpha.100
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.100
+
+## 2.0.0-alpha.99
+
+### Patch Changes
+
+-   Updated dependencies [ed9cd2c]
+    -   @flink-app/flink@2.0.0-alpha.99
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.99
+
+## 2.0.0-alpha.98
+
+### Patch Changes
+
+-   Updated dependencies [2f4a132]
+    -   @flink-app/flink@2.0.0-alpha.98
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.98
+
+## 2.0.0-alpha.97
+
+### Patch Changes
+
+-   Updated dependencies [eed6bc1]
+    -   @flink-app/flink@2.0.0-alpha.97
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.97
+
+## 2.0.0-alpha.96
+
+### Patch Changes
+
+-   Updated dependencies
+-   Updated dependencies [e431237]
+    -   @flink-app/flink@2.0.0-alpha.96
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.96
+
+## 2.0.0-alpha.95
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.95
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.95
+
+## 2.0.0-alpha.94
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.94
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.94
+
+## 2.0.0-alpha.93
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.93
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.93
+
+## 2.0.0-alpha.92
+
+### Patch Changes
+
+-   Updated dependencies [8d23d56]
+    -   @flink-app/flink@2.0.0-alpha.92
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.92
+
+## 2.0.0-alpha.91
+
+### Minor Changes
+
+-   1bdbc82: feat(oidc-plugin): add per-provider `useUserInfoEndpoint` config flag (default `true`) to disable UserInfo calls for IdPs where the endpoint is unreliable or redundant with ID token claims
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.91
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.91
+
+## 2.0.0-alpha.90
+
+### Patch Changes
+
+-   e18a37b: Add raw IdP response trace logs and prune redundant debug logs
+-   Updated dependencies [0d84b5f]
+    -   @flink-app/flink@2.0.0-alpha.90
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.90
+
+## 2.0.0-alpha.89
+
+### Patch Changes
+
+-   Fix OIDC trace logs
+    -   @flink-app/flink@2.0.0-alpha.89
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.89
+
+## 2.0.0-alpha.88
+
+### Patch Changes
+
+-   5f3919e: fix(oidc-plugin): use discovered userinfo endpoint in buildProfile when no manual endpoint is configured
+    -   @flink-app/flink@2.0.0-alpha.88
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.88
+
+## 2.0.0-alpha.87
+
+### Patch Changes
+
+-   Updated dependencies
+    -   @flink-app/flink@2.0.0-alpha.87
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.87
+
+## 2.0.0-alpha.86
+
+### Patch Changes
+
+-   4219f07: Add `tokenDelivery` option to control how the JWT is attached to the post-callback redirect URL. Defaults to `"fragment"` (unchanged — `#token=...` is still appended for browser flows where URL fragments are not sent to the server). Set to `"query"` for native mobile flows where iOS `ASWebAuthenticationSession` strips fragments from custom-scheme callbacks, or pass a function `({ redirectUrl, provider, metadata }) => "fragment" | "query"` to decide per-request when one app serves both web and native clients. The plugin makes no scheme-based assumptions — policy lives in the host app.
+    -   @flink-app/flink@2.0.0-alpha.86
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.86
+
+## 2.0.0-alpha.85
+
+### Patch Changes
+
+-   Updated dependencies [179c085]
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.85
+    -   @flink-app/flink@2.0.0-alpha.85
+
+## 2.0.0-alpha.84
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.84
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.84
+
+## 2.0.0-alpha.83
+
+### Patch Changes
+
+-   Updated dependencies
+    -   @flink-app/flink@2.0.0-alpha.83
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.83
+
+## 2.0.0-alpha.82
+
+### Patch Changes
+
+-   Add metadata passthrough support. Any query parameters prefixed with `meta.` on the initiate endpoint (e.g. `?meta.intent=admin&meta.source=mobile`) are collected, stripped of the prefix, stored in the session, and delivered to both `onAuthSuccess` and `onAuthError` callbacks as `metadata: Record<string, string>`. Empty object when no meta params are provided.
+    -   @flink-app/flink@2.0.0-alpha.82
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.82
+
+## 2.0.0-alpha.81
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.81
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.81
+
+## 2.0.0-alpha.80
+
+### Patch Changes
+
+-   Add flink.oidc named logger with debug instrumentation across init, provider resolution, and auth flow
+    -   @flink-app/flink@2.0.0-alpha.80
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.80
+
+## 2.0.0-alpha.79
+
+### Patch Changes
+
+-   Expose redirectUri from session in onAuthSuccess and onAuthError callbacks, enabling multi-client redirect decisions
+    -   @flink-app/flink@2.0.0-alpha.79
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.79
+
+## 2.0.0-alpha.78
+
+### Patch Changes
+
+-   Fix optional chaining on providers in handlers after making providers optional
+    -   @flink-app/flink@2.0.0-alpha.78
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.78
+
+## 2.0.0-alpha.77
+
+### Minor Changes
+
+-   Make providers optional when providerLoader is configured, add TCtx generic for typed ctx in providerLoader and onAuthSuccess callbacks
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.77
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.77
+
+## 2.0.0-alpha.76
+
+### Patch Changes
+
+-   Updated dependencies
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.76
+    -   @flink-app/flink@2.0.0-alpha.76
+
+## 2.0.0-alpha.75
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.75
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.75
+
+## 2.0.0-alpha.74
+
+### Patch Changes
+
+-   Updated dependencies
+-   Updated dependencies
+    -   @flink-app/flink@2.0.0-alpha.74
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.74
+
+## 2.0.0-alpha.73
+
+### Patch Changes
+
+-   Updated dependencies
+    -   @flink-app/flink@2.0.0-alpha.73
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.73
+
+## 2.0.0-alpha.72
+
+### Patch Changes
+
+-   Updated dependencies
+    -   @flink-app/flink@2.0.0-alpha.72
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.72
+
+## 2.0.0-alpha.71
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.71
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.71
+
+## 2.0.0-alpha.70
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.70
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.70
+
+## 2.0.0-alpha.69
+
+### Minor Changes
+
+-   feat(oidc-plugin): support public clients with PKCE-only authentication (no client secret)
+
+    `clientSecret` is now optional in `OidcProviderConfig`. When omitted, the plugin configures `openid-client` with `token_endpoint_auth_method: "none"` for public client flows. Added `tokenEndpointAuthMethod` option for explicit control. Encryption key derivation skips providers without a secret, and `storeTokens: true` requires an explicit `encryptionKey` when no provider has a client secret.
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.69
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.69
+
+## 2.0.0-alpha.68
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.68
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.68
+
+## 2.0.0-alpha.67
+
+### Patch Changes
+
+-   Updated dependencies [418cb54]
+-   Updated dependencies [70d574c]
+    -   @flink-app/flink@2.0.0-alpha.67
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.67
+
+## 2.0.0-alpha.66
+
+### Patch Changes
+
+-   Updated dependencies [5593d26]
+    -   @flink-app/flink@2.0.0-alpha.66
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.66
+
+## 2.0.0-alpha.65
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.65
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.65
+
+## 2.0.0-alpha.64
+
+### Patch Changes
+
+-   Updated dependencies [95b99ee]
+    -   @flink-app/flink@2.0.0-alpha.64
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.64
+
+## 2.0.0-alpha.63
+
+### Patch Changes
+
+-   Updated dependencies [810df2c]
+-   Updated dependencies [8dd0752]
+    -   @flink-app/flink@2.0.0-alpha.63
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.63
+
+## 2.0.0-alpha.62
+
+### Patch Changes
+
+-   Updated dependencies
+    -   @flink-app/flink@2.0.0-alpha.62
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.62
+
+## 2.0.0-alpha.61
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.61
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.61
+
+## 2.0.0-alpha.60
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.60
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.60
+
+## 2.0.0-alpha.59
+
+### Patch Changes
+
+-   Updated dependencies [dbc2119]
+    -   @flink-app/flink@2.0.0-alpha.59
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.59
+
+## 2.0.0-alpha.58
+
+### Patch Changes
+
+-   Updated dependencies
+    -   @flink-app/flink@2.0.0-alpha.58
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.58
+
+## 2.0.0-alpha.57
+
+### Patch Changes
+
+-   Updated dependencies [ef7f495]
+-   Updated dependencies [2d53aa4]
+-   Updated dependencies [b3cc5d1]
+-   Updated dependencies [d377fac]
+-   Updated dependencies [4ad44c0]
+-   Updated dependencies [90f80c7]
+-   Updated dependencies [f0887e7]
+-   Updated dependencies [68c46d3]
+-   Updated dependencies [4ad44c0]
+-   Updated dependencies
+    -   @flink-app/flink@2.0.0-alpha.57
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.57
+
+## 2.0.0-alpha.56
+
+### Patch Changes
+
+-   Zod 3.x compat
+-   Updated dependencies
+-   Updated dependencies [0203256]
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.56
+    -   @flink-app/flink@2.0.0-alpha.56
+
+## 2.0.0-alpha.55
+
+### Patch Changes
+
+-   Updated dependencies [3267206]
+-   Updated dependencies [497b7c2]
+-   Updated dependencies [3267206]
+    -   @flink-app/flink@2.0.0-alpha.55
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.55
+
+## 2.0.0-alpha.53
+
+### Patch Changes
+
+-   Updated dependencies [669c806]
+    -   @flink-app/flink@2.0.0-alpha.53
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.53
+
+## 2.0.0-alpha.52
+
+### Patch Changes
+
+-   Updated dependencies [fe9f8f2]
+    -   @flink-app/flink@2.0.0-alpha.52
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.52
+
+## 2.0.0-alpha.51
+
+### Patch Changes
+
+-   fix: add peerDependencies to all plugins and adapters
+
+    **Breaking Change Prevention:**
+
+    -   Added "@flink-app/flink": ">=2.0.0-alpha.0" as peerDependency to all plugins
+    -   Fixed oidc-plugin peerDependencies from "workspace:\*" to proper version ranges
+    -   Fixed oauth-plugin to include @flink-app/flink peerDependency
+
+    **JWT Auth Plugin Interface Fix:**
+
+    -   Removed redundant createToken declaration from JwtAuthPlugin interface
+    -   The method is already inherited from FlinkAuthPlugin, this fixes TypeScript type checking issues
+
+    **Why this matters:**
+
+    -   Ensures only one version of @flink-app/flink exists in node_modules
+    -   Prevents type conflicts when TypeScript resolves interfaces across packages
+    -   Follows standard plugin architecture best practices (same pattern as React, Webpack, etc.)
+    -   Package managers now warn if incompatible versions are installed
+
+-   Updated dependencies
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.51
+    -   @flink-app/flink@2.0.0-alpha.51
+
+## 2.0.0-alpha.50
+
+### Patch Changes
+
+-   Updated dependencies
+    -   @flink-app/flink@2.0.0-alpha.50
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.50
+
+## 2.0.0-alpha.49
+
+### Patch Changes
+
+-   Typescript include fix
+-   Updated dependencies
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.49
+    -   @flink-app/flink@2.0.0-alpha.49
+
+## 2.0.0-alpha.48
+
+### Patch Changes
+
+-   Updated dependencies
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.48
+    -   @flink-app/flink@2.0.0-alpha.48
+
+## 1.0.0
+
+### Minor Changes
+
+-   Align minor version, from now all packages in monorepo will have same version
+
+### Patch Changes
+
+-   ee21c29: Normalize query parameters to predictable string types
+
+    Query parameters are now automatically normalized to `string | string[]` types before reaching handlers:
+
+    -   Single values: converted to strings (e.g., `?page=1` → `{ page: "1" }`)
+    -   Repeated parameters: converted to string arrays (e.g., `?tag=a&tag=b` → `{ tag: ["a", "b"] }`)
+    -   All types (numbers, booleans, etc.) from Express parser are converted to strings
+
+    **Breaking Change (Minor):**
+
+    -   `Query` type changed from `{ [x: string]: string | string[] | undefined }` to `Record<string, string | string[]>`
+    -   `Params` type changed from `Request["params"]` to explicit `Record<string, string>`
+    -   Removed `undefined` from query/param types since normalization ensures values are never undefined
+    -   Updated OAuth and OIDC plugin query type definitions to satisfy new Query constraint
+
+    This ensures predictable query and path parameter handling regardless of Express parser configuration. Handlers can reliably parse string values as needed using `Number()`, `parseInt()`, boolean comparisons, etc.
+
+-   Updated dependencies
+-   Updated dependencies [ee21c29]
+-   Updated dependencies [5c2ff97]
+    -   @flink-app/flink@1.0.0
+    -   @flink-app/jwt-auth-plugin@1.0.0
+
 ## 0.14.3
 
 ### Patch Changes

package/README.md

@@ -203,6 +203,26 @@ await app.start();
 }
 ```
 
+#### Disabling the UserInfo endpoint
+
+By default, the plugin calls the UserInfo endpoint after token exchange to
+enrich the profile with additional claims. Some IdPs either don't expose
+extra claims beyond the ID token or return unreliable 5xx errors from
+UserInfo. In those cases, set `useUserInfoEndpoint: false` on the provider
+config to skip the UserInfo call entirely and build profiles from ID token
+claims only:
+
+```typescript
+{
+  issuer: "https://idp.acme.com",
+  clientId: "your-client-id",
+  clientSecret: "your-client-secret",
+  callbackUrl: "https://myapp.com/oidc/acme/callback",
+  discoveryUrl: "https://idp.acme.com/.well-known/openid-configuration",
+  useUserInfoEndpoint: false, // skip UserInfo; use ID token claims only
+}
+```
+
 ### Callback Functions
 
 #### onAuthSuccess
@@ -500,7 +520,7 @@ onAuthSuccess: async ({ profile, claims }, ctx) => {
                 subject: claims.sub,
                 provider: "acme",
             });
-            await ctx.repos.userRepo.updateOne(user._id, {
+            await ctx.repos.userRepo.updateById(user._id, {
                 oidcConnections: user.oidcConnections,
             });
         } else {
@@ -552,7 +572,7 @@ onAuthSuccess: async ({ profile, claims }, ctx) => {
         });
     } else {
         // Update roles on each login
-        await ctx.repos.userRepo.updateOne(user._id, { roles });
+        await ctx.repos.userRepo.updateById(user._id, { roles });
     }
 
     const token = await ctx.plugins.jwtAuth.createToken({ userId: user._id }, roles);
@@ -619,6 +639,7 @@ interface OidcProviderConfigDB {
     authorizationEndpoint?: string;
     tokenEndpoint?: string;
     userinfoEndpoint?: string;
+    useUserInfoEndpoint?: boolean; // default true
     jwksUri?: string;
     scope: string[];
     createdAt: Date;

package/dist/OidcPlugin.d.ts

@@ -73,5 +73,5 @@ import { OidcPluginOptions } from "./OidcPluginOptions";
  * });
  * ```
  */
-export declare function oidcPlugin(options: OidcPluginOptions): FlinkPlugin;
+export declare function oidcPlugin<TCtx = any>(options: OidcPluginOptions<TCtx>): FlinkPlugin;
 //# sourceMappingURL=OidcPlugin.d.ts.map

package/dist/OidcPlugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OidcPlugin.d.ts","sourceRoot":"","sources":["../src/OidcPlugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,WAAW,EAAO,MAAM,kBAAkB,CAAC;AAE9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAWxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,WAAW,CA2MlE"}
+{"version":3,"file":"OidcPlugin.d.ts","sourceRoot":"","sources":["../src/OidcPlugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,WAAW,EAAO,MAAM,kBAAkB,CAAC;AAG9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAWxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AACH,wBAAgB,UAAU,CAAC,IAAI,GAAG,GAAG,EAAE,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,GAAG,WAAW,CA2OpF"}

package/dist/OidcPlugin.js

@@ -28,6 +28,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.oidcPlugin = oidcPlugin;
 const flink_1 = require("@flink-app/flink");
+const log_1 = require("./log");
 const OidcSessionRepo_1 = __importDefault(require("./repos/OidcSessionRepo"));
 const OidcConnectionRepo_1 = __importDefault(require("./repos/OidcConnectionRepo"));
 const encryption_utils_1 = require("./utils/encryption-utils");
@@ -109,13 +110,14 @@ const CallbackOidc = __importStar(require("./handlers/CallbackOidc"));
  */
 function oidcPlugin(options) {
     // Validation
-    if (!options.providers || Object.keys(options.providers).length === 0) {
-        throw new Error("OIDC Plugin: At least one provider must be configured");
+    const providers = options.providers || {};
+    if (Object.keys(providers).length === 0 && !options.providerLoader) {
+        throw new Error("OIDC Plugin: At least one provider must be configured, or providerLoader must be provided");
     }
     // Validate provider configurations
-    const configuredProviders = Object.keys(options.providers);
+    const configuredProviders = Object.keys(providers);
     for (const providerName of configuredProviders) {
-        const providerConfig = options.providers[providerName];
+        const providerConfig = providers[providerName];
         if (!providerConfig)
             continue;
         if (!providerConfig.issuer) {
@@ -124,9 +126,6 @@ function oidcPlugin(options) {
         if (!providerConfig.clientId) {
             throw new Error(`OIDC Plugin: ${providerName} clientId is required`);
         }
-        if (!providerConfig.clientSecret) {
-            throw new Error(`OIDC Plugin: ${providerName} clientSecret is required`);
-        }
         if (!providerConfig.callbackUrl) {
             throw new Error(`OIDC Plugin: ${providerName} callbackUrl is required`);
         }
@@ -137,6 +136,7 @@ function oidcPlugin(options) {
                     `(authorizationEndpoint, tokenEndpoint, jwksUri)`);
             }
         }
+        log_1.oidcLog.debug(`Provider "${providerName}" config:`, `issuer=${providerConfig.issuer}`, `clientId=${providerConfig.clientId}`, `clientSecret=${(0, log_1.maskSecret)(providerConfig.clientSecret)}`, `callbackUrl=${providerConfig.callbackUrl}`, providerConfig.discoveryUrl ? `discoveryUrl=${providerConfig.discoveryUrl}` : `authorizationEndpoint=${providerConfig.authorizationEndpoint} tokenEndpoint=${providerConfig.tokenEndpoint}`, `scope=${(providerConfig.scope || ["openid", "email", "profile"]).join(" ")}`, providerConfig.tokenEndpointAuthMethod ? `authMethod=${providerConfig.tokenEndpointAuthMethod}` : "");
     }
     if (!options.onAuthSuccess) {
         throw new Error("OIDC Plugin: onAuthSuccess callback is required");
@@ -144,19 +144,32 @@ function oidcPlugin(options) {
     // Determine encryption key
     let encryptionKey = options.encryptionKey;
     if (!encryptionKey) {
-        // Derive from first configured provider's client secret
-        const firstProvider = configuredProviders[0];
-        const firstProviderConfig = options.providers[firstProvider];
-        if (firstProviderConfig) {
-            encryptionKey = firstProviderConfig.clientSecret;
+        // Derive from the first configured provider that has a client secret
+        const providerWithSecret = configuredProviders.find((name) => providers[name]?.clientSecret);
+        if (providerWithSecret) {
+            encryptionKey = providers[providerWithSecret].clientSecret;
             flink_1.log.warn("OIDC Plugin: No encryption key provided, deriving from client secret. " + "For better security, provide a dedicated encryptionKey in options.");
+            log_1.oidcLog.debug(`Encryption key derived from provider "${providerWithSecret}" clientSecret`);
         }
     }
-    if (!encryptionKey || encryptionKey.length < 32) {
-        throw new Error("OIDC Plugin: Encryption key must be at least 32 characters");
+    else {
+        log_1.oidcLog.debug(`Encryption key: ${(0, log_1.maskSecret)(encryptionKey)} (explicit)`);
+    }
+    // Encryption key is required when storing tokens
+    if (options.storeTokens) {
+        if (!encryptionKey || encryptionKey.length < 32) {
+            throw new Error("OIDC Plugin: Encryption key must be at least 32 characters. " +
+                "Provide an explicit encryptionKey when using storeTokens with public clients (no clientSecret).");
+        }
+        (0, encryption_utils_1.validateEncryptionSecret)(encryptionKey);
+    }
+    else if (encryptionKey) {
+        // Validate if provided, even when not storing tokens (used for getConnection/getConnections)
+        if (encryptionKey.length < 32) {
+            throw new Error("OIDC Plugin: Encryption key must be at least 32 characters");
+        }
+        (0, encryption_utils_1.validateEncryptionSecret)(encryptionKey);
     }
-    // Validate encryption key
-    (0, encryption_utils_1.validateEncryptionSecret)(encryptionKey);
     let flinkApp;
     let sessionRepo;
     let connectionRepo;
@@ -174,6 +187,7 @@ function oidcPlugin(options) {
             // Initialize repositories
             const sessionsCollectionName = options.sessionsCollectionName || "oidc_sessions";
             const connectionsCollectionName = options.connectionsCollectionName || "oidc_connections";
+            log_1.oidcLog.debug(`Init: sessionsCollection=${sessionsCollectionName}`, `connectionsCollection=${connectionsCollectionName}`, `storeTokens=${!!options.storeTokens}`, `sessionTTL=${options.sessionTTL ?? 600}s`, `registerRoutes=${options.registerRoutes !== false}`, configuredProviders.length > 0 ? `staticProviders=[${configuredProviders.join(", ")}]` : "staticProviders=[] (dynamic only)", options.providerLoader ? "providerLoader=yes" : "providerLoader=no");
             sessionRepo = new OidcSessionRepo_1.default(sessionsCollectionName, db);
             connectionRepo = new OidcConnectionRepo_1.default(connectionsCollectionName, db);
             flinkApp.addRepo("oidcSessionRepo", sessionRepo);
@@ -183,7 +197,7 @@ function oidcPlugin(options) {
             await db.collection(sessionsCollectionName).createIndex({ createdAt: 1 }, { expireAfterSeconds: sessionTTL });
             flink_1.log.info(`OIDC Plugin: Created TTL index on ${sessionsCollectionName} with ${sessionTTL}s expiration`);
             // Initialize provider registry
-            providerRegistry = new ProviderRegistry_1.ProviderRegistry(options.providers, options.providerLoader);
+            providerRegistry = new ProviderRegistry_1.ProviderRegistry(providers, options.providerLoader, flinkApp.ctx);
             // Store provider registry in app context for handlers to access
             flinkApp.ctx.oidcProviderRegistry = providerRegistry;
             // Register OIDC handlers
@@ -192,7 +206,7 @@ function oidcPlugin(options) {
                 flinkApp.addHandler(InitiateOidc);
                 flinkApp.addHandler(CallbackOidc);
             }
-            flink_1.log.info(`OIDC Plugin initialized with providers: ${configuredProviders.join(", ")}`);
+            flink_1.log.info(`OIDC Plugin initialized${configuredProviders.length > 0 ? ` with providers: ${configuredProviders.join(", ")}` : " with dynamic provider loader"}`);
         }
         catch (error) {
             flink_1.log.error("Failed to initialize OIDC Plugin:", error);