@flink-app/oidc-plugin 1.0.0 → 2.0.0-alpha.100

package/CHANGELOG.md

@@ -1,5 +1,563 @@
 # @flink-app/oidc-plugin
 
+## 2.0.0-alpha.100
+
+### Patch Changes
+
+-   Updated dependencies [6e8166a]
+    -   @flink-app/flink@2.0.0-alpha.100
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.100
+
+## 2.0.0-alpha.99
+
+### Patch Changes
+
+-   Updated dependencies [ed9cd2c]
+    -   @flink-app/flink@2.0.0-alpha.99
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.99
+
+## 2.0.0-alpha.98
+
+### Patch Changes
+
+-   Updated dependencies [2f4a132]
+    -   @flink-app/flink@2.0.0-alpha.98
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.98
+
+## 2.0.0-alpha.97
+
+### Patch Changes
+
+-   Updated dependencies [eed6bc1]
+    -   @flink-app/flink@2.0.0-alpha.97
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.97
+
+## 2.0.0-alpha.96
+
+### Patch Changes
+
+-   Updated dependencies
+-   Updated dependencies [e431237]
+    -   @flink-app/flink@2.0.0-alpha.96
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.96
+
+## 2.0.0-alpha.95
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.95
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.95
+
+## 2.0.0-alpha.94
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.94
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.94
+
+## 2.0.0-alpha.93
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.93
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.93
+
+## 2.0.0-alpha.92
+
+### Patch Changes
+
+-   Updated dependencies [8d23d56]
+    -   @flink-app/flink@2.0.0-alpha.92
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.92
+
+## 2.0.0-alpha.91
+
+### Minor Changes
+
+-   1bdbc82: feat(oidc-plugin): add per-provider `useUserInfoEndpoint` config flag (default `true`) to disable UserInfo calls for IdPs where the endpoint is unreliable or redundant with ID token claims
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.91
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.91
+
+## 2.0.0-alpha.90
+
+### Patch Changes
+
+-   e18a37b: Add raw IdP response trace logs and prune redundant debug logs
+-   Updated dependencies [0d84b5f]
+    -   @flink-app/flink@2.0.0-alpha.90
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.90
+
+## 2.0.0-alpha.89
+
+### Patch Changes
+
+-   Fix OIDC trace logs
+    -   @flink-app/flink@2.0.0-alpha.89
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.89
+
+## 2.0.0-alpha.88
+
+### Patch Changes
+
+-   5f3919e: fix(oidc-plugin): use discovered userinfo endpoint in buildProfile when no manual endpoint is configured
+    -   @flink-app/flink@2.0.0-alpha.88
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.88
+
+## 2.0.0-alpha.87
+
+### Patch Changes
+
+-   Updated dependencies
+    -   @flink-app/flink@2.0.0-alpha.87
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.87
+
+## 2.0.0-alpha.86
+
+### Patch Changes
+
+-   4219f07: Add `tokenDelivery` option to control how the JWT is attached to the post-callback redirect URL. Defaults to `"fragment"` (unchanged — `#token=...` is still appended for browser flows where URL fragments are not sent to the server). Set to `"query"` for native mobile flows where iOS `ASWebAuthenticationSession` strips fragments from custom-scheme callbacks, or pass a function `({ redirectUrl, provider, metadata }) => "fragment" | "query"` to decide per-request when one app serves both web and native clients. The plugin makes no scheme-based assumptions — policy lives in the host app.
+    -   @flink-app/flink@2.0.0-alpha.86
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.86
+
+## 2.0.0-alpha.85
+
+### Patch Changes
+
+-   Updated dependencies [179c085]
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.85
+    -   @flink-app/flink@2.0.0-alpha.85
+
+## 2.0.0-alpha.84
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.84
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.84
+
+## 2.0.0-alpha.83
+
+### Patch Changes
+
+-   Updated dependencies
+    -   @flink-app/flink@2.0.0-alpha.83
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.83
+
+## 2.0.0-alpha.82
+
+### Patch Changes
+
+-   Add metadata passthrough support. Any query parameters prefixed with `meta.` on the initiate endpoint (e.g. `?meta.intent=admin&meta.source=mobile`) are collected, stripped of the prefix, stored in the session, and delivered to both `onAuthSuccess` and `onAuthError` callbacks as `metadata: Record<string, string>`. Empty object when no meta params are provided.
+    -   @flink-app/flink@2.0.0-alpha.82
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.82
+
+## 2.0.0-alpha.81
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.81
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.81
+
+## 2.0.0-alpha.80
+
+### Patch Changes
+
+-   Add flink.oidc named logger with debug instrumentation across init, provider resolution, and auth flow
+    -   @flink-app/flink@2.0.0-alpha.80
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.80
+
+## 2.0.0-alpha.79
+
+### Patch Changes
+
+-   Expose redirectUri from session in onAuthSuccess and onAuthError callbacks, enabling multi-client redirect decisions
+    -   @flink-app/flink@2.0.0-alpha.79
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.79
+
+## 2.0.0-alpha.78
+
+### Patch Changes
+
+-   Fix optional chaining on providers in handlers after making providers optional
+    -   @flink-app/flink@2.0.0-alpha.78
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.78
+
+## 2.0.0-alpha.77
+
+### Minor Changes
+
+-   Make providers optional when providerLoader is configured, add TCtx generic for typed ctx in providerLoader and onAuthSuccess callbacks
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.77
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.77
+
+## 2.0.0-alpha.76
+
+### Patch Changes
+
+-   Updated dependencies
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.76
+    -   @flink-app/flink@2.0.0-alpha.76
+
+## 2.0.0-alpha.75
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.75
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.75
+
+## 2.0.0-alpha.74
+
+### Patch Changes
+
+-   Updated dependencies
+-   Updated dependencies
+    -   @flink-app/flink@2.0.0-alpha.74
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.74
+
+## 2.0.0-alpha.73
+
+### Patch Changes
+
+-   Updated dependencies
+    -   @flink-app/flink@2.0.0-alpha.73
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.73
+
+## 2.0.0-alpha.72
+
+### Patch Changes
+
+-   Updated dependencies
+    -   @flink-app/flink@2.0.0-alpha.72
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.72
+
+## 2.0.0-alpha.71
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.71
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.71
+
+## 2.0.0-alpha.70
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.70
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.70
+
+## 2.0.0-alpha.69
+
+### Minor Changes
+
+-   feat(oidc-plugin): support public clients with PKCE-only authentication (no client secret)
+
+    `clientSecret` is now optional in `OidcProviderConfig`. When omitted, the plugin configures `openid-client` with `token_endpoint_auth_method: "none"` for public client flows. Added `tokenEndpointAuthMethod` option for explicit control. Encryption key derivation skips providers without a secret, and `storeTokens: true` requires an explicit `encryptionKey` when no provider has a client secret.
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.69
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.69
+
+## 2.0.0-alpha.68
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.68
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.68
+
+## 2.0.0-alpha.67
+
+### Patch Changes
+
+-   Updated dependencies [418cb54]
+-   Updated dependencies [70d574c]
+    -   @flink-app/flink@2.0.0-alpha.67
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.67
+
+## 2.0.0-alpha.66
+
+### Patch Changes
+
+-   Updated dependencies [5593d26]
+    -   @flink-app/flink@2.0.0-alpha.66
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.66
+
+## 2.0.0-alpha.65
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.65
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.65
+
+## 2.0.0-alpha.64
+
+### Patch Changes
+
+-   Updated dependencies [95b99ee]
+    -   @flink-app/flink@2.0.0-alpha.64
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.64
+
+## 2.0.0-alpha.63
+
+### Patch Changes
+
+-   Updated dependencies [810df2c]
+-   Updated dependencies [8dd0752]
+    -   @flink-app/flink@2.0.0-alpha.63
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.63
+
+## 2.0.0-alpha.62
+
+### Patch Changes
+
+-   Updated dependencies
+    -   @flink-app/flink@2.0.0-alpha.62
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.62
+
+## 2.0.0-alpha.61
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.61
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.61
+
+## 2.0.0-alpha.60
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.60
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.60
+
+## 2.0.0-alpha.59
+
+### Patch Changes
+
+-   Updated dependencies [dbc2119]
+    -   @flink-app/flink@2.0.0-alpha.59
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.59
+
+## 2.0.0-alpha.58
+
+### Patch Changes
+
+-   Updated dependencies
+    -   @flink-app/flink@2.0.0-alpha.58
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.58
+
+## 2.0.0-alpha.57
+
+### Patch Changes
+
+-   Updated dependencies [ef7f495]
+-   Updated dependencies [2d53aa4]
+-   Updated dependencies [b3cc5d1]
+-   Updated dependencies [d377fac]
+-   Updated dependencies [4ad44c0]
+-   Updated dependencies [90f80c7]
+-   Updated dependencies [f0887e7]
+-   Updated dependencies [68c46d3]
+-   Updated dependencies [4ad44c0]
+-   Updated dependencies
+    -   @flink-app/flink@2.0.0-alpha.57
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.57
+
+## 2.0.0-alpha.56
+
+### Patch Changes
+
+-   Zod 3.x compat
+-   Updated dependencies
+-   Updated dependencies [0203256]
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.56
+    -   @flink-app/flink@2.0.0-alpha.56
+
+## 2.0.0-alpha.55
+
+### Patch Changes
+
+-   Updated dependencies [3267206]
+-   Updated dependencies [497b7c2]
+-   Updated dependencies [3267206]
+    -   @flink-app/flink@2.0.0-alpha.55
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.55
+
+## 2.0.0-alpha.53
+
+### Patch Changes
+
+-   Updated dependencies [669c806]
+    -   @flink-app/flink@2.0.0-alpha.53
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.53
+
+## 2.0.0-alpha.52
+
+### Patch Changes
+
+-   Updated dependencies [fe9f8f2]
+    -   @flink-app/flink@2.0.0-alpha.52
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.52
+
+## 2.0.0-alpha.51
+
+### Patch Changes
+
+-   fix: add peerDependencies to all plugins and adapters
+
+    **Breaking Change Prevention:**
+
+    -   Added "@flink-app/flink": ">=2.0.0-alpha.0" as peerDependency to all plugins
+    -   Fixed oidc-plugin peerDependencies from "workspace:\*" to proper version ranges
+    -   Fixed oauth-plugin to include @flink-app/flink peerDependency
+
+    **JWT Auth Plugin Interface Fix:**
+
+    -   Removed redundant createToken declaration from JwtAuthPlugin interface
+    -   The method is already inherited from FlinkAuthPlugin, this fixes TypeScript type checking issues
+
+    **Why this matters:**
+
+    -   Ensures only one version of @flink-app/flink exists in node_modules
+    -   Prevents type conflicts when TypeScript resolves interfaces across packages
+    -   Follows standard plugin architecture best practices (same pattern as React, Webpack, etc.)
+    -   Package managers now warn if incompatible versions are installed
+
+-   Updated dependencies
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.51
+    -   @flink-app/flink@2.0.0-alpha.51
+
+## 2.0.0-alpha.50
+
+### Patch Changes
+
+-   Updated dependencies
+    -   @flink-app/flink@2.0.0-alpha.50
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.50
+
+## 2.0.0-alpha.49
+
+### Patch Changes
+
+-   Typescript include fix
+-   Updated dependencies
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.49
+    -   @flink-app/flink@2.0.0-alpha.49
+
+## 2.0.0-alpha.48
+
+### Patch Changes
+
+-   Updated dependencies
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.48
+    -   @flink-app/flink@2.0.0-alpha.48
+
+## 1.0.0
+
+### Minor Changes
+
+-   Align minor version, from now all packages in monorepo will have same version
+
+### Patch Changes
+
+-   ee21c29: Normalize query parameters to predictable string types
+
+    Query parameters are now automatically normalized to `string | string[]` types before reaching handlers:
+
+    -   Single values: converted to strings (e.g., `?page=1` → `{ page: "1" }`)
+    -   Repeated parameters: converted to string arrays (e.g., `?tag=a&tag=b` → `{ tag: ["a", "b"] }`)
+    -   All types (numbers, booleans, etc.) from Express parser are converted to strings
+
+    **Breaking Change (Minor):**
+
+    -   `Query` type changed from `{ [x: string]: string | string[] | undefined }` to `Record<string, string | string[]>`
+    -   `Params` type changed from `Request["params"]` to explicit `Record<string, string>`
+    -   Removed `undefined` from query/param types since normalization ensures values are never undefined
+    -   Updated OAuth and OIDC plugin query type definitions to satisfy new Query constraint
+
+    This ensures predictable query and path parameter handling regardless of Express parser configuration. Handlers can reliably parse string values as needed using `Number()`, `parseInt()`, boolean comparisons, etc.
+
+-   Updated dependencies
+-   Updated dependencies [ee21c29]
+-   Updated dependencies [5c2ff97]
+    -   @flink-app/flink@1.0.0
+    -   @flink-app/jwt-auth-plugin@1.0.0
+
+## 0.14.3
+
+### Patch Changes
+
+-   Updated dependencies [52eba74]
+-   Updated dependencies [b37faa5]
+    -   @flink-app/flink@0.14.3
+    -   @flink-app/jwt-auth-plugin@0.14.1
+
+## 0.14.2
+
+### Patch Changes
+
+-   Updated dependencies [6d39832]
+    -   @flink-app/flink@0.14.2
+    -   @flink-app/jwt-auth-plugin@0.14.1
+
+## 0.14.1
+
+### Patch Changes
+
+-   fix: restore compatibility between core framework and plugins after 0.14.0 release
+
+## 1.0.0
+
+### Patch Changes
+
+-   Updated dependencies [7da5227]
+-   Updated dependencies [8ad040f]
+    -   @flink-app/flink@0.14.0
+    -   @flink-app/jwt-auth-plugin@0.13.1
+
+## 0.13.5
+
+### Patch Changes
+
+-   Updated dependencies
+    -   @flink-app/flink@0.13.5
+    -   @flink-app/jwt-auth-plugin@0.13.1
+
+## 0.13.4
+
+### Patch Changes
+
+-   Updated dependencies
+    -   @flink-app/flink@0.13.4
+    -   @flink-app/jwt-auth-plugin@0.13.1
+
+## 0.13.3
+
+### Patch Changes
+
+-   Updated dependencies
+    -   @flink-app/flink@0.13.3
+    -   @flink-app/jwt-auth-plugin@0.13.1
+
+## 0.13.2
+
+### Patch Changes
+
+-   Updated dependencies
+    -   @flink-app/flink@0.13.2
+    -   @flink-app/jwt-auth-plugin@0.13.1
+
+## 0.13.1
+
+### Patch Changes
+
+-   Fixed invalid types and improve typescript error message during schema compilation
+-   Updated dependencies
+    -   @flink-app/jwt-auth-plugin@0.13.1
+    -   @flink-app/flink@0.13.1
+
 ## 1.0.0
 
 ### Minor Changes

package/README.md

@@ -203,6 +203,26 @@ await app.start();
 }
 ```
 
+#### Disabling the UserInfo endpoint
+
+By default, the plugin calls the UserInfo endpoint after token exchange to
+enrich the profile with additional claims. Some IdPs either don't expose
+extra claims beyond the ID token or return unreliable 5xx errors from
+UserInfo. In those cases, set `useUserInfoEndpoint: false` on the provider
+config to skip the UserInfo call entirely and build profiles from ID token
+claims only:
+
+```typescript
+{
+  issuer: "https://idp.acme.com",
+  clientId: "your-client-id",
+  clientSecret: "your-client-secret",
+  callbackUrl: "https://myapp.com/oidc/acme/callback",
+  discoveryUrl: "https://idp.acme.com/.well-known/openid-configuration",
+  useUserInfoEndpoint: false, // skip UserInfo; use ID token claims only
+}
+```
+
 ### Callback Functions
 
 #### onAuthSuccess
@@ -500,7 +520,7 @@ onAuthSuccess: async ({ profile, claims }, ctx) => {
                 subject: claims.sub,
                 provider: "acme",
             });
-            await ctx.repos.userRepo.updateOne(user._id, {
+            await ctx.repos.userRepo.updateById(user._id, {
                 oidcConnections: user.oidcConnections,
             });
         } else {
@@ -552,7 +572,7 @@ onAuthSuccess: async ({ profile, claims }, ctx) => {
         });
     } else {
         // Update roles on each login
-        await ctx.repos.userRepo.updateOne(user._id, { roles });
+        await ctx.repos.userRepo.updateById(user._id, { roles });
     }
 
     const token = await ctx.plugins.jwtAuth.createToken({ userId: user._id }, roles);
@@ -619,6 +639,7 @@ interface OidcProviderConfigDB {
     authorizationEndpoint?: string;
     tokenEndpoint?: string;
     userinfoEndpoint?: string;
+    useUserInfoEndpoint?: boolean; // default true
     jwksUri?: string;
     scope: string[];
     createdAt: Date;

package/dist/OidcPlugin.d.ts

@@ -73,5 +73,5 @@ import { OidcPluginOptions } from "./OidcPluginOptions";
  * });
  * ```
  */
-export declare function oidcPlugin(options: OidcPluginOptions): FlinkPlugin;
+export declare function oidcPlugin<TCtx = any>(options: OidcPluginOptions<TCtx>): FlinkPlugin;
 //# sourceMappingURL=OidcPlugin.d.ts.map

package/dist/OidcPlugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OidcPlugin.d.ts","sourceRoot":"","sources":["../src/OidcPlugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,WAAW,EAAO,MAAM,kBAAkB,CAAC;AAE9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAWxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,WAAW,CA2MlE"}
+{"version":3,"file":"OidcPlugin.d.ts","sourceRoot":"","sources":["../src/OidcPlugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,WAAW,EAAO,MAAM,kBAAkB,CAAC;AAG9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAWxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AACH,wBAAgB,UAAU,CAAC,IAAI,GAAG,GAAG,EAAE,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,GAAG,WAAW,CA2OpF"}