@flink-app/oidc-plugin 1.0.0 → 2.0.0-alpha.101

package/dist/providers/OidcProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OidcProvider.d.ts","sourceRoot":"","sources":["../../src/providers/OidcProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwC,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,WAAW,MAAM,wBAAwB,CAAC;AACjD,OAAO,YAAY,MAAM,yBAAyB,CAAC;AAInD;;;;;;;;;;GAUG;AACH,qBAAa,YAAY;IACrB,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,MAAM,CAA+B;IAC7C,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,WAAW,CAAkB;gBAEzB,MAAM,EAAE,kBAAkB;IAItC;;;;;;;OAOG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA+CjC;;;;;OAKG;IACG,mBAAmB,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAiB1G;;;;;;;OAOG;IACG,oBAAoB,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAqC/H;;;;;;;;OAQG;IACG,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAajE;;;;;;;;;OASG;IACG,YAAY,CAAC,QAAQ,EAAE,YAAY,EAAE,eAAe,GAAE,OAAc,GAAG,OAAO,CAAC,WAAW,CAAC;IA2BjG;;;;OAIG;YACW,iBAAiB;IAU/B;;;;OAIG;IACH,iBAAiB,IAAI,GAAG;CAM3B"}
+{"version":3,"file":"OidcProvider.d.ts","sourceRoot":"","sources":["../../src/providers/OidcProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwD,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvG,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,WAAW,MAAM,wBAAwB,CAAC;AACjD,OAAO,YAAY,MAAM,yBAAyB,CAAC;AAKnD;;;;;;;;;;GAUG;AACH,qBAAa,YAAY;IACrB,SAAgB,MAAM,EAAE,kBAAkB,CAAC;IAC3C,OAAO,CAAC,MAAM,CAA+B;IAC7C,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,WAAW,CAAkB;gBAEzB,MAAM,EAAE,kBAAkB;IAItC;;;;;;;OAOG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAsEjC;;;;;OAKG;IACG,mBAAmB,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAiB1G;;;;;;;OAOG;IACG,oBAAoB,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAoD/H;;;;;;;;OAQG;IACG,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAsBjE;;;;;;;;;OASG;IACG,YAAY,CAAC,QAAQ,EAAE,YAAY,EAAE,eAAe,GAAE,OAAc,GAAG,OAAO,CAAC,WAAW,CAAC;IAgCjG;;;;OAIG;YACW,iBAAiB;IAU/B;;;;OAIG;IACH,iBAAiB,IAAI,GAAG;CAM3B"}

package/dist/providers/OidcProvider.js

@@ -4,6 +4,7 @@ exports.OidcProvider = void 0;
 const openid_client_1 = require("openid-client");
 const claims_mapper_1 = require("../utils/claims-mapper");
 const error_utils_1 = require("../utils/error-utils");
+const log_1 = require("../log");
 /**
  * Generic OIDC Provider implementation using openid-client
  *
@@ -37,7 +38,10 @@ class OidcProvider {
         try {
             // Option 1: OIDC Discovery
             if (this.config.discoveryUrl) {
+                log_1.oidcLog.debug(`Provider "${this.config.issuer}": discovering from ${this.config.discoveryUrl}`);
                 this.issuer = await openid_client_1.Issuer.discover(this.config.discoveryUrl);
+                log_1.oidcLog.debug(`Provider "${this.config.issuer}": discovery complete`, `authorization_endpoint=${this.issuer.metadata.authorization_endpoint}`, `token_endpoint=${this.issuer.metadata.token_endpoint}`, `userinfo_endpoint=${this.issuer.metadata.userinfo_endpoint ?? "(none)"}`, `jwks_uri=${this.issuer.metadata.jwks_uri}`);
+                log_1.oidcLog.trace(`Provider "${this.config.issuer}": raw discovery metadata from ${this.config.discoveryUrl}`, this.issuer.metadata);
             }
             // Option 2: Manual configuration
             else {
@@ -54,12 +58,22 @@ class OidcProvider {
                 });
             }
             // Create OIDC client
-            this.client = new this.issuer.Client({
+            const clientMetadata = {
                 client_id: this.config.clientId,
-                client_secret: this.config.clientSecret,
                 redirect_uris: [this.config.callbackUrl],
                 response_types: ["code"],
-            });
+            };
+            if (this.config.clientSecret) {
+                clientMetadata.client_secret = this.config.clientSecret;
+                clientMetadata.token_endpoint_auth_method =
+                    this.config.tokenEndpointAuthMethod || "client_secret_basic";
+            }
+            else {
+                // Public client (PKCE-only) — openid-client requires this to skip client authentication
+                clientMetadata.token_endpoint_auth_method =
+                    this.config.tokenEndpointAuthMethod || "none";
+            }
+            this.client = new this.issuer.Client(clientMetadata);
             this.initialized = true;
         }
         catch (error) {
@@ -107,8 +121,13 @@ class OidcProvider {
                 state: params.state,
                 nonce: params.nonce,
             });
+            // Raw response from the token endpoint (includes access_token, id_token,
+            // refresh_token, token_type, expires_at, scope, and any non-standard fields
+            // returned by the IdP). Trace-level because it contains secrets.
+            log_1.oidcLog.trace(`Provider "${this.config.issuer}": raw token endpoint response`, { ...tokenSet });
             // Extract claims from ID token (already validated by openid-client)
             const claims = tokenSet.claims();
+            log_1.oidcLog.trace(`Provider "${this.config.issuer}": extracted claims from ID token`, claims);
             return {
                 accessToken: tokenSet.access_token,
                 idToken: tokenSet.id_token,
@@ -120,6 +139,15 @@ class OidcProvider {
             };
         }
         catch (error) {
+            // openid-client attaches the raw IdP error response on OPError.
+            log_1.oidcLog.trace(`Provider "${this.config.issuer}": raw token exchange error`, {
+                name: error.name,
+                message: error.message,
+                error: error.error,
+                error_description: error.error_description,
+                error_uri: error.error_uri,
+                response: error.response?.body ?? error.response,
+            });
             throw (0, error_utils_1.createOidcError)(error_utils_1.OidcErrorCodes.TOKEN_EXCHANGE_FAILED, `Token exchange failed: ${error.message}`, {
                 originalError: error.message,
                 errorCode: error.error,
@@ -139,9 +167,18 @@ class OidcProvider {
         await this.ensureInitialized();
         try {
             const userinfo = await this.client.userinfo(accessToken);
+            // Raw response from the UserInfo endpoint, before any mapping/merging.
+            log_1.oidcLog.trace(`Provider "${this.config.issuer}": raw UserInfo endpoint response`, userinfo);
             return userinfo;
         }
         catch (error) {
+            log_1.oidcLog.trace(`Provider "${this.config.issuer}": raw UserInfo error`, {
+                name: error.name,
+                message: error.message,
+                error: error.error,
+                error_description: error.error_description,
+                response: error.response?.body ?? error.response,
+            });
             throw (0, error_utils_1.createOidcError)(error_utils_1.OidcErrorCodes.USERINFO_FAILED, `UserInfo request failed: ${error.message}`, {
                 originalError: error.message,
             });
@@ -160,7 +197,9 @@ class OidcProvider {
     async buildProfile(tokenSet, includeUserInfo = true) {
         let claims = { ...tokenSet.claims };
         // Optionally fetch additional claims from UserInfo endpoint
-        if (includeUserInfo && this.config.userinfoEndpoint) {
+        // Check both manual config and discovered endpoint (via OIDC discovery)
+        const userinfoUrl = this.config.userinfoEndpoint || this.issuer?.metadata?.userinfo_endpoint;
+        if (includeUserInfo && userinfoUrl) {
             try {
                 const userinfo = await this.getUserInfo(tokenSet.accessToken);
                 // Merge UserInfo claims with ID token claims
@@ -168,16 +207,18 @@ class OidcProvider {
             }
             catch (error) {
                 // UserInfo is optional - continue with ID token claims only
-                console.warn("Failed to fetch UserInfo, using ID token claims only:", error);
+                log_1.oidcLog.warn(`Failed to fetch UserInfo from ${userinfoUrl}, using ID token claims only:`, error);
             }
         }
         // Apply custom claim mapping if configured
         if (this.config.claimMapping) {
             const customClaims = (0, claims_mapper_1.extractCustomClaims)(claims, this.config.claimMapping);
             claims = { ...claims, ...customClaims };
+            log_1.oidcLog.trace(`Provider "${this.config.issuer}": applied custom claim mapping`, claims);
         }
         // Map to normalized profile
         const profile = (0, claims_mapper_1.mapClaimsToProfile)(claims);
+        log_1.oidcLog.trace(`Provider "${this.config.issuer}": built final profile`, profile);
         return profile;
     }
     /**

package/dist/providers/ProviderRegistry.d.ts

@@ -13,7 +13,8 @@ export declare class ProviderRegistry {
     private staticProviders;
     private providerInstances;
     private providerLoader?;
-    constructor(staticProviders: Record<string, OidcProviderConfig>, providerLoader?: (providerName: string) => Promise<OidcProviderConfig | null>);
+    private ctx;
+    constructor(staticProviders: Record<string, OidcProviderConfig>, providerLoader?: (providerName: string, ctx: any) => Promise<OidcProviderConfig | null>, ctx?: any);
     /**
      * Get provider instance by name
      *

package/dist/providers/ProviderRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProviderRegistry.d.ts","sourceRoot":"","sources":["../../src/providers/ProviderRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAG3D;;;;;;;;GAQG;AACH,qBAAa,gBAAgB;IACzB,OAAO,CAAC,eAAe,CAAqC;IAC5D,OAAO,CAAC,iBAAiB,CAAwC;IACjE,OAAO,CAAC,cAAc,CAAC,CAA+D;gBAGlF,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,EACnD,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAMjF;;;;;;;;;;;;;OAaG;IACG,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAgC9D;;;;;OAKG;IACH,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAI1C;;;;;;;OAOG;IACH,UAAU,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI;IAQvC;;;;OAIG;IACH,gBAAgB,IAAI,MAAM,EAAE;CAG/B"}
+{"version":3,"file":"ProviderRegistry.d.ts","sourceRoot":"","sources":["../../src/providers/ProviderRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAI3D;;;;;;;;GAQG;AACH,qBAAa,gBAAgB;IACzB,OAAO,CAAC,eAAe,CAAqC;IAC5D,OAAO,CAAC,iBAAiB,CAAwC;IACjE,OAAO,CAAC,cAAc,CAAC,CAAyE;IAChG,OAAO,CAAC,GAAG,CAAM;gBAGb,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,EACnD,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,EACvF,GAAG,CAAC,EAAE,GAAG;IAOb;;;;;;;;;;;;;OAaG;IACG,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IA+C9D;;;;;OAKG;IACH,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAI1C;;;;;;;OAOG;IACH,UAAU,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI;IAQvC;;;;OAIG;IACH,gBAAgB,IAAI,MAAM,EAAE;CAG/B"}

package/dist/providers/ProviderRegistry.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ProviderRegistry = void 0;
 const OidcProvider_1 = require("./OidcProvider");
 const error_utils_1 = require("../utils/error-utils");
+const log_1 = require("../log");
 /**
  * Provider registry for managing OIDC provider instances
  *
@@ -13,10 +14,11 @@ const error_utils_1 = require("../utils/error-utils");
  * - Lazy initialization
  */
 class ProviderRegistry {
-    constructor(staticProviders, providerLoader) {
+    constructor(staticProviders, providerLoader, ctx) {
         this.providerInstances = new Map();
         this.staticProviders = staticProviders;
         this.providerLoader = providerLoader;
+        this.ctx = ctx;
     }
     /**
      * Get provider instance by name
@@ -36,20 +38,26 @@ class ProviderRegistry {
         // Check cache first
         const cachedProvider = this.providerInstances.get(providerName);
         if (cachedProvider) {
+            log_1.oidcLog.debug(`Provider "${providerName}": using cached instance`);
             return cachedProvider;
         }
         // Try static configuration
         let config = this.staticProviders[providerName] || null;
+        let configSource = "static";
         // Try dynamic loader if not in static config
         if (!config && this.providerLoader) {
-            config = await this.providerLoader(providerName);
+            log_1.oidcLog.debug(`Provider "${providerName}": not in static config, invoking providerLoader`);
+            config = await this.providerLoader(providerName, this.ctx);
+            configSource = "dynamic";
         }
         if (!config) {
+            log_1.oidcLog.debug(`Provider "${providerName}": not found (static=[${Object.keys(this.staticProviders).join(", ")}], loader=${!!this.providerLoader})`);
             throw (0, error_utils_1.createOidcError)(error_utils_1.OidcErrorCodes.PROVIDER_NOT_CONFIGURED, `OIDC provider '${providerName}' is not configured`, {
                 providerName,
                 availableProviders: Object.keys(this.staticProviders),
             });
         }
+        log_1.oidcLog.debug(`Provider "${providerName}" resolved via ${configSource}:`, `issuer=${config.issuer}`, `clientId=${config.clientId}`, `clientSecret=${(0, log_1.maskSecret)(config.clientSecret)}`, `callbackUrl=${config.callbackUrl}`, config.discoveryUrl ? `discoveryUrl=${config.discoveryUrl}` : `authorizationEndpoint=${config.authorizationEndpoint}`, `scope=${(config.scope || ["openid", "email", "profile"]).join(" ")}`);
         // Create and initialize provider
         const provider = new OidcProvider_1.OidcProvider(config);
         await provider.initialize();

package/dist/schemas/CallbackRequest.d.ts

@@ -3,7 +3,7 @@
  *
  * GET /oidc/:provider/callback?code=...&state=...&response_type=json
  */
-export default interface CallbackRequest {
+type CallbackRequest = Record<string, string | string[]> & {
     /**
      * Authorization code from the IdP
      * Required for successful authentication
@@ -29,9 +29,6 @@ export default interface CallbackRequest {
      * - undefined: Redirect to redirectUri with token in URL fragment
      */
     response_type?: "json";
-    /**
-     * Index signature for Flink Query type compatibility
-     */
-    [key: string]: string | string[] | undefined;
-}
+};
+export default CallbackRequest;
 //# sourceMappingURL=CallbackRequest.d.ts.map

package/dist/schemas/CallbackRequest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CallbackRequest.d.ts","sourceRoot":"","sources":["../../src/schemas/CallbackRequest.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,OAAO,WAAW,eAAe;IACpC;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;CAChD"}
+{"version":3,"file":"CallbackRequest.d.ts","sourceRoot":"","sources":["../../src/schemas/CallbackRequest.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG;IACvD;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAE1B,CAAC;AAEF,eAAe,eAAe,CAAC"}

package/dist/schemas/InitiateRequest.d.ts

@@ -3,15 +3,12 @@
  *
  * GET /oidc/:provider/initiate?redirectUri=...
  */
-export default interface InitiateRequest {
+type InitiateRequest = Record<string, string | string[]> & {
     /**
      * Optional redirect URI after successful authentication
      * If not provided, uses the default callbackUrl from provider config
      */
     redirectUri?: string;
-    /**
-     * Index signature for Flink Query type compatibility
-     */
-    [key: string]: string | string[] | undefined;
-}
+};
+export default InitiateRequest;
 //# sourceMappingURL=InitiateRequest.d.ts.map

package/dist/schemas/InitiateRequest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"InitiateRequest.d.ts","sourceRoot":"","sources":["../../src/schemas/InitiateRequest.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,OAAO,WAAW,eAAe;IACpC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;CAChD"}
+{"version":3,"file":"InitiateRequest.d.ts","sourceRoot":"","sources":["../../src/schemas/InitiateRequest.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG;IACvD;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,eAAe,eAAe,CAAC"}

package/dist/schemas/OidcSession.d.ts

@@ -37,6 +37,11 @@ export default interface OidcSession {
      * Can be overridden by the client via query parameter
      */
     redirectUri: string;
+    /**
+     * Arbitrary metadata collected from meta.* query parameters on initiate
+     * Passed through to onAuthSuccess and onAuthError callbacks unchanged
+     */
+    metadata?: Record<string, string>;
     /**
      * Session creation timestamp
      * MongoDB TTL index will automatically delete expired sessions

package/dist/schemas/OidcSession.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OidcSession.d.ts","sourceRoot":"","sources":["../../src/schemas/OidcSession.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,OAAO,WAAW,WAAW;IAChC;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,SAAS,EAAE,IAAI,CAAC;CACnB"}
+{"version":3,"file":"OidcSession.d.ts","sourceRoot":"","sources":["../../src/schemas/OidcSession.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,OAAO,WAAW,WAAW;IAChC;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElC;;;OAGG;IACH,SAAS,EAAE,IAAI,CAAC;CACnB"}

package/dist/utils/response-utils.d.ts

@@ -1,18 +1,29 @@
+/**
+ * Controls how the JWT token is delivered back to the client on the
+ * post-callback redirect.
+ *
+ * - "fragment": appends `#token=...` to the redirectUrl. Best for web
+ *   browsers — URL fragments are not sent to the server in HTTP requests
+ *   and are only accessible to client-side JavaScript.
+ * - "query": appends `?token=...` (or `&token=...`). Required for native
+ *   mobile flows where the callback comes back via a custom URL scheme,
+ *   because iOS `ASWebAuthenticationSession` strips URL fragments before
+ *   delivering the URL to the app.
+ */
+export type TokenDeliveryMode = "fragment" | "query";
 /**
  * Format token response for the client
  *
  * Supports two response formats:
  * 1. JSON response (for API clients)
- * 2. Redirect with token in URL fragment (for web browsers)
- *
- * URL fragments are used for security - they are NOT sent to the server
- * in HTTP requests and are only accessible to client-side JavaScript.
+ * 2. Redirect with token in URL fragment or query (for web/native clients)
  *
  * @param token - JWT token for the application
  * @param user - User object
  * @param redirectUrl - URL to redirect to
  * @param responseType - "json" or undefined (redirect)
+ * @param tokenDelivery - How to attach the token on redirect. Defaults to "fragment".
  * @returns Flink response object
  */
-export declare function formatTokenResponse(token: string, user: any, redirectUrl: string, responseType?: "json"): any;
+export declare function formatTokenResponse(token: string, user: any, redirectUrl: string, responseType?: "json", tokenDelivery?: TokenDeliveryMode): any;
 //# sourceMappingURL=response-utils.d.ts.map

package/dist/utils/response-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"response-utils.d.ts","sourceRoot":"","sources":["../../src/utils/response-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,GAAG,CAwB7G"}
+{"version":3,"file":"response-utils.d.ts","sourceRoot":"","sources":["../../src/utils/response-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,OAAO,CAAC;AAErD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAC/B,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,GAAG,EACT,WAAW,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,EACrB,aAAa,GAAE,iBAA8B,GAC9C,GAAG,CAqBL"}

package/dist/utils/response-utils.js

@@ -6,18 +6,16 @@ exports.formatTokenResponse = formatTokenResponse;
  *
  * Supports two response formats:
  * 1. JSON response (for API clients)
- * 2. Redirect with token in URL fragment (for web browsers)
- *
- * URL fragments are used for security - they are NOT sent to the server
- * in HTTP requests and are only accessible to client-side JavaScript.
+ * 2. Redirect with token in URL fragment or query (for web/native clients)
  *
  * @param token - JWT token for the application
  * @param user - User object
  * @param redirectUrl - URL to redirect to
  * @param responseType - "json" or undefined (redirect)
+ * @param tokenDelivery - How to attach the token on redirect. Defaults to "fragment".
  * @returns Flink response object
  */
-function formatTokenResponse(token, user, redirectUrl, responseType) {
+function formatTokenResponse(token, user, redirectUrl, responseType, tokenDelivery = "fragment") {
     // JSON response for API clients
     if (responseType === "json") {
         return {
@@ -27,11 +25,8 @@ function formatTokenResponse(token, user, redirectUrl, responseType) {
             },
         };
     }
-    // Redirect response for web browsers
-    // Token is in URL fragment (#token=...) for security
-    const separator = redirectUrl.includes("#") ? "&" : "#";
-    const tokenFragment = `token=${encodeURIComponent(token)}`;
-    const finalUrl = `${redirectUrl}${separator}${tokenFragment}`;
+    const tokenParam = `token=${encodeURIComponent(token)}`;
+    const finalUrl = appendToken(redirectUrl, tokenParam, tokenDelivery);
     return {
         status: 302,
         headers: {
@@ -40,3 +35,29 @@ function formatTokenResponse(token, user, redirectUrl, responseType) {
         data: {},
     };
 }
+/**
+ * Append a token parameter to a URL using the specified delivery mode.
+ *
+ * For "query" mode, any existing `#fragment` on the URL is preserved: the
+ * query parameter is spliced in *before* the fragment so the final URL is
+ * still well-formed.
+ *
+ * For "fragment" mode, a second token on an existing fragment is joined
+ * with `&` (same as the old behavior).
+ */
+function appendToken(redirectUrl, tokenParam, mode) {
+    if (mode === "query") {
+        const hashIdx = redirectUrl.indexOf("#");
+        if (hashIdx >= 0) {
+            const base = redirectUrl.slice(0, hashIdx);
+            const frag = redirectUrl.slice(hashIdx);
+            const sep = base.includes("?") ? "&" : "?";
+            return `${base}${sep}${tokenParam}${frag}`;
+        }
+        const sep = redirectUrl.includes("?") ? "&" : "?";
+        return `${redirectUrl}${sep}${tokenParam}`;
+    }
+    // fragment (default)
+    const sep = redirectUrl.includes("#") ? "&" : "#";
+    return `${redirectUrl}${sep}${tokenParam}`;
+}

package/examples/multi-provider.ts

@@ -86,7 +86,7 @@ async function start() {
                                 provider,
                             });
 
-                            await ctx.repos.userRepo.updateOne(user._id, {
+                            await ctx.repos.userRepo.updateById(user._id, {
                                 oidcConnections: user.oidcConnections,
                             });
                         } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flink-app/oidc-plugin",
-  "version": "1.0.0",
+  "version": "2.0.0-alpha.101",
   "description": "Flink plugin for OIDC authentication with generic IdP support",
   "author": "joel@frost.se",
   "license": "MIT",
@@ -10,19 +10,16 @@
     "access": "public"
   },
   "dependencies": {
-    "openid-client": "^5.7.0"
+    "openid-client": "^5.7.0",
+    "@flink-app/jwt-auth-plugin": "2.0.0-alpha.101"
   },
   "peerDependencies": {
-    "mongodb": "^6.15.0",
-    "@flink-app/flink": "0.13.0",
-    "@flink-app/jwt-auth-plugin": "0.13.0"
+    "@flink-app/flink": ">=2.0.0-alpha.101",
+    "mongodb": "^6.15.0"
   },
   "peerDependenciesMeta": {
     "@flink-app/flink": {
       "optional": false
-    },
-    "@flink-app/jwt-auth-plugin": {
-      "optional": false
     }
   },
   "devDependencies": {
@@ -30,9 +27,9 @@
     "@types/node": "22.13.10",
     "ts-node": "^10.9.2",
     "tsc-watch": "^4.2.9",
-    "@flink-app/flink": "0.13.0",
-    "@flink-app/jwt-auth-plugin": "0.13.0",
-    "@flink-app/test-utils": "0.13.0"
+    "@flink-app/test-utils": "2.0.0-alpha.101",
+    "@flink-app/flink": "2.0.0-alpha.101",
+    "@flink-app/jwt-auth-plugin": "2.0.0-alpha.101"
   },
   "scripts": {
     "test": "jasmine-ts --config=./spec/support/jasmine.json",

package/spec/helpers/test-helpers.ts

@@ -39,6 +39,20 @@ export function createTestProviderConfig(overrides?: Partial<OidcProviderConfig>
     };
 }
 
+/**
+ * Create a test OIDC provider configuration for a public client (no clientSecret)
+ */
+export function createPublicClientProviderConfig(overrides?: Partial<OidcProviderConfig>): OidcProviderConfig {
+    return {
+        issuer: "https://test-idp.example.com",
+        clientId: "test-public-client-id",
+        callbackUrl: "http://localhost:3000/oidc/test/callback",
+        discoveryUrl: "https://test-idp.example.com/.well-known/openid-configuration",
+        scope: ["openid", "email", "profile"],
+        ...overrides,
+    };
+}
+
 /**
  * Create a mock OIDC token set
  */

package/spec/plugin/OidcPlugin.spec.ts

@@ -6,18 +6,45 @@
  */
 
 import { oidcPlugin } from "../../src/OidcPlugin";
-import { createTestProviderConfig } from "../helpers/test-helpers";
+import { createTestProviderConfig, createPublicClientProviderConfig } from "../helpers/test-helpers";
 
 describe("OidcPlugin", () => {
 
     describe("configuration validation", () => {
-        it("should throw error if no providers configured", () => {
+        it("should throw error if no providers and no providerLoader configured", () => {
             expect(() => {
                 oidcPlugin({
                     providers: {},
                     onAuthSuccess: async () => ({ user: {}, token: "", redirectUrl: "" }),
                 });
-            }).toThrowError(/At least one provider must be configured/);
+            }).toThrowError(/At least one provider must be configured, or providerLoader must be provided/);
+        });
+
+        it("should throw error if providers omitted and no providerLoader configured", () => {
+            expect(() => {
+                oidcPlugin({
+                    onAuthSuccess: async () => ({ user: {}, token: "", redirectUrl: "" }),
+                });
+            }).toThrowError(/At least one provider must be configured, or providerLoader must be provided/);
+        });
+
+        it("should accept empty providers when providerLoader is configured", () => {
+            expect(() => {
+                oidcPlugin({
+                    providers: {},
+                    providerLoader: async () => null,
+                    onAuthSuccess: async () => ({ user: {}, token: "", redirectUrl: "" }),
+                });
+            }).not.toThrow();
+        });
+
+        it("should accept omitted providers when providerLoader is configured", () => {
+            expect(() => {
+                oidcPlugin({
+                    providerLoader: async () => null,
+                    onAuthSuccess: async () => ({ user: {}, token: "", redirectUrl: "" }),
+                });
+            }).not.toThrow();
         });
 
         it("should throw error if onAuthSuccess is missing", () => {
@@ -72,6 +99,80 @@ describe("OidcPlugin", () => {
         });
     });
 
+    describe("public client (PKCE-only) support", () => {
+        it("should accept provider without clientSecret when encryptionKey is provided", () => {
+            expect(() => {
+                oidcPlugin({
+                    providers: {
+                        test: createPublicClientProviderConfig(),
+                    },
+                    encryptionKey: "valid-encryption-key-at-least-32-chars-long",
+                    onAuthSuccess: async () => ({ user: {}, token: "", redirectUrl: "" }),
+                });
+            }).not.toThrow();
+        });
+
+        it("should accept provider without clientSecret when storeTokens is false", () => {
+            expect(() => {
+                oidcPlugin({
+                    providers: {
+                        test: createPublicClientProviderConfig(),
+                    },
+                    storeTokens: false,
+                    onAuthSuccess: async () => ({ user: {}, token: "", redirectUrl: "" }),
+                });
+            }).not.toThrow();
+        });
+
+        it("should accept provider without clientSecret when storeTokens is not set (defaults to false)", () => {
+            expect(() => {
+                oidcPlugin({
+                    providers: {
+                        test: createPublicClientProviderConfig(),
+                    },
+                    onAuthSuccess: async () => ({ user: {}, token: "", redirectUrl: "" }),
+                });
+            }).not.toThrow();
+        });
+
+        it("should throw when storeTokens is true, no encryptionKey, and no provider has clientSecret", () => {
+            expect(() => {
+                oidcPlugin({
+                    providers: {
+                        test: createPublicClientProviderConfig(),
+                    },
+                    storeTokens: true,
+                    onAuthSuccess: async () => ({ user: {}, token: "", redirectUrl: "" }),
+                });
+            }).toThrowError(/Encryption key must be at least 32 characters/);
+        });
+
+        it("should derive encryption key from provider with clientSecret when mixed with public clients", () => {
+            expect(() => {
+                oidcPlugin({
+                    providers: {
+                        publicProvider: createPublicClientProviderConfig(),
+                        confidentialProvider: createTestProviderConfig(),
+                    },
+                    onAuthSuccess: async () => ({ user: {}, token: "", redirectUrl: "" }),
+                });
+            }).not.toThrow();
+        });
+
+        it("should accept storeTokens with explicit encryptionKey for public clients", () => {
+            expect(() => {
+                oidcPlugin({
+                    providers: {
+                        test: createPublicClientProviderConfig(),
+                    },
+                    storeTokens: true,
+                    encryptionKey: "valid-encryption-key-at-least-32-chars-long",
+                    onAuthSuccess: async () => ({ user: {}, token: "", redirectUrl: "" }),
+                });
+            }).not.toThrow();
+        });
+    });
+
     describe("plugin structure", () => {
         it("should return plugin with correct ID", () => {
             const plugin = oidcPlugin({

package/spec/providers/ProviderRegistry.spec.ts

@@ -29,7 +29,7 @@ describe("ProviderRegistry", () => {
         });
 
         it("should create registry with provider loader", () => {
-            const loader = async (name: string) => null;
+            const loader = async (name: string, ctx: any) => null;
             const registry = new ProviderRegistry(staticProviders, loader);
             expect(registry).toBeDefined();
         });
@@ -49,7 +49,7 @@ describe("ProviderRegistry", () => {
         });
 
         it("should return true if provider loader is configured", () => {
-            const loader = async (name: string) => null;
+            const loader = async (name: string, ctx: any) => null;
             const registry = new ProviderRegistry(staticProviders, loader);
             // hasProvider returns true if loader exists, even for unknown providers
             expect(registry.hasProvider("unknown")).toBe(true);
@@ -87,7 +87,8 @@ describe("ProviderRegistry", () => {
             });
 
             const loader = jasmine.createSpy("loader").and.returnValue(Promise.resolve(dynamicConfig));
-            const registry = new ProviderRegistry(staticProviders, loader);
+            const mockCtx = { repos: {} };
+            const registry = new ProviderRegistry(staticProviders, loader, mockCtx);
 
             // Note: This will attempt real OIDC discovery, which will fail in tests
             // We're primarily testing that the loader is called
@@ -95,13 +96,13 @@ describe("ProviderRegistry", () => {
                 await registry.getProvider("okta");
             } catch (error) {
                 // Discovery will fail, but loader should have been called
-                expect(loader).toHaveBeenCalledWith("okta");
+                expect(loader).toHaveBeenCalledWith("okta", mockCtx);
             }
         });
 
         it("should prioritize static config over loader", async () => {
             const loader = jasmine.createSpy("loader").and.returnValue(Promise.resolve(null));
-            const registry = new ProviderRegistry(staticProviders, loader);
+            const registry = new ProviderRegistry(staticProviders, loader, {});
 
             // Note: This will attempt real OIDC discovery
             try {
@@ -113,7 +114,7 @@ describe("ProviderRegistry", () => {
         });
 
         it("should throw error if loader returns null", async () => {
-            const loader = async (name: string) => null;
+            const loader = async (name: string, ctx: any) => null;
             const registry = new ProviderRegistry({}, loader);
 
             try {
@@ -169,7 +170,7 @@ describe("ProviderRegistry", () => {
                     })
                 )
             );
-            const registry = new ProviderRegistry({}, loader);
+            const registry = new ProviderRegistry({}, loader, {});
 
             // First call - will attempt to initialize (and fail on discovery)
             try {