@flink-app/oidc-plugin 2.0.0-alpha.114 → 2.0.0-alpha.115

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # @flink-app/oidc-plugin
 
+## 2.0.0-alpha.115
+
+### Patch Changes
+
+-   12fe6f5: fix: forward the RFC 9207 `iss` authorization response parameter to openid-client
+
+    IdPs that advertise `authorization_response_iss_parameter_supported` in their
+    discovery document (Google does) return an `iss` parameter on the authorization
+    redirect. The callback handler destructured only `code`, `state`, `error`,
+    `error_description` and `response_type` from the query, and `exchangeCodeForToken`
+    rebuilt the params object as `{ code, state }` — so `iss` was dropped before it
+    reached `client.callback()`.
+
+    openid-client then rejected every callback from such an IdP with
+    `RPError: iss missing from the response`, failing the login client-side before the
+    token endpoint was ever contacted. This made Google unusable as an OIDC provider.
+
+    `iss` is now read from the callback query and threaded through to openid-client,
+    which validates it against the discovered issuer (the mix-up attack defence RFC 9207
+    is there to provide).
+
+    The parameter is spread conditionally rather than always set, because openid-client
+    keys its check on `'iss' in params` — an explicit `iss: undefined` is read as a
+    mismatch and would break IdPs that do not send the parameter at all (Entra ID,
+    Okta, Auth0 and Keycloak do not advertise it by default).
+
+    -   @flink-app/flink@2.0.0-alpha.115
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.115
+
 ## 2.0.0-alpha.114
 
 ### Patch Changes

package/dist/handlers/CallbackOidc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CallbackOidc.d.ts","sourceRoot":"","sources":["../../src/handlers/CallbackOidc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAc,UAAU,EAAwC,MAAM,kBAAkB,CAAC;AAC5G,OAAO,eAAe,MAAM,4BAA4B,CAAC;AAOzD;;GAEG;AACH,UAAU,UAAU;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,eAAO,MAAM,KAAK,EAAE,UAGnB,CAAC;AAEF;;;;;;GAMG;AACH,QAAA,MAAM,YAAY,EAAE,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,eAAe,CA4QnE,CAAC;AAEF,eAAe,YAAY,CAAC"}
+{"version":3,"file":"CallbackOidc.d.ts","sourceRoot":"","sources":["../../src/handlers/CallbackOidc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAc,UAAU,EAAwC,MAAM,kBAAkB,CAAC;AAC5G,OAAO,eAAe,MAAM,4BAA4B,CAAC;AAOzD;;GAEG;AACH,UAAU,UAAU;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,eAAO,MAAM,KAAK,EAAE,UAGnB,CAAC;AAEF;;;;;;GAMG;AACH,QAAA,MAAM,YAAY,EAAE,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,eAAe,CA6QnE,CAAC;AAEF,eAAe,YAAY,CAAC"}

package/dist/handlers/CallbackOidc.js

@@ -38,7 +38,7 @@ exports.Route = {
  */
 const CallbackOidc = async ({ ctx, req }) => {
     const { provider } = req.params;
-    const { code, state, error: oidcError, error_description, response_type } = req.query;
+    const { code, state, iss, error: oidcError, error_description, response_type } = req.query;
     // Track session outside try/catch so redirectUri and metadata are available in error handling
     let sessionRedirectUri;
     let sessionMetadata = {};
@@ -119,6 +119,7 @@ const CallbackOidc = async ({ ctx, req }) => {
             codeVerifier: session.codeVerifier,
             state: session.state,
             nonce: session.nonce,
+            iss,
         });
         log_1.oidcLog.debug(`Callback: token exchange successful`, `sub="${tokenSet.claims.sub}"`, `iss="${tokenSet.claims.iss}"`, `email="${tokenSet.claims.email || "(none)"}"`, `hasRefreshToken=${!!tokenSet.refreshToken}`, `expiresIn=${tokenSet.expiresIn ?? "(none)"}s`);
         // Build user profile from ID token and (optionally) UserInfo

package/dist/providers/OidcProvider.d.ts

@@ -52,6 +52,7 @@ export declare class OidcProvider {
         codeVerifier: string;
         state: string;
         nonce: string;
+        iss?: string;
     }): Promise<OidcTokenSet>;
     /**
      * Get user profile from UserInfo endpoint

package/dist/providers/OidcProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OidcProvider.d.ts","sourceRoot":"","sources":["../../src/providers/OidcProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwD,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvG,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,WAAW,MAAM,wBAAwB,CAAC;AACjD,OAAO,YAAY,MAAM,yBAAyB,CAAC;AAKnD;;;;;;;;;;GAUG;AACH,qBAAa,YAAY;IACrB,SAAgB,MAAM,EAAE,kBAAkB,CAAC;IAC3C,OAAO,CAAC,MAAM,CAA+B;IAC7C,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,WAAW,CAAkB;gBAEzB,MAAM,EAAE,kBAAkB;IAItC;;;;;;;OAOG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAsEjC;;;;;OAKG;IACG,mBAAmB,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAiB1G;;;;;;;OAOG;IACG,oBAAoB,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAoD/H;;;;;;;;OAQG;IACG,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAsBjE;;;;;;;;;OASG;IACG,YAAY,CAAC,QAAQ,EAAE,YAAY,EAAE,eAAe,GAAE,OAAc,GAAG,OAAO,CAAC,WAAW,CAAC;IAgCjG;;;;OAIG;YACW,iBAAiB;IAU/B;;;;OAIG;IACH,iBAAiB,IAAI,GAAG;CAM3B"}
+{"version":3,"file":"OidcProvider.d.ts","sourceRoot":"","sources":["../../src/providers/OidcProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwD,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvG,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,WAAW,MAAM,wBAAwB,CAAC;AACjD,OAAO,YAAY,MAAM,yBAAyB,CAAC;AAKnD;;;;;;;;;;GAUG;AACH,qBAAa,YAAY;IACrB,SAAgB,MAAM,EAAE,kBAAkB,CAAC;IAC3C,OAAO,CAAC,MAAM,CAA+B;IAC7C,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,WAAW,CAAkB;gBAEzB,MAAM,EAAE,kBAAkB;IAItC;;;;;;;OAOG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAsEjC;;;;;OAKG;IACG,mBAAmB,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAiB1G;;;;;;;OAOG;IACG,oBAAoB,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IA4D7I;;;;;;;;OAQG;IACG,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAsBjE;;;;;;;;;OASG;IACG,YAAY,CAAC,QAAQ,EAAE,YAAY,EAAE,eAAe,GAAE,OAAc,GAAG,OAAO,CAAC,WAAW,CAAC;IAgCjG;;;;OAIG;YACW,iBAAiB;IAU/B;;;;OAIG;IACH,iBAAiB,IAAI,GAAG;CAM3B"}

package/dist/providers/OidcProvider.js

@@ -116,6 +116,14 @@ class OidcProvider {
             const tokenSet = await this.client.callback(this.config.callbackUrl, {
                 code: params.code,
                 state: params.state,
+                // RFC 9207: IdPs that advertise
+                // `authorization_response_iss_parameter_supported` (Google does)
+                // return `iss` on the authorization redirect, and openid-client
+                // rejects the callback with "iss missing from the response" unless
+                // it is forwarded here. Spread conditionally — openid-client keys
+                // its check on `'iss' in params`, so an explicit `iss: undefined`
+                // would be read as a mismatch and break IdPs that never send it.
+                ...(params.iss ? { iss: params.iss } : {}),
             }, {
                 code_verifier: params.codeVerifier,
                 state: params.state,

package/dist/schemas/CallbackRequest.d.ts

@@ -14,6 +14,12 @@ type CallbackRequest = Record<string, string | string[]> & {
      * Must match the state stored in the session
      */
     state?: string;
+    /**
+     * Issuer identifier returned on the authorization response (RFC 9207)
+     * Sent by IdPs advertising `authorization_response_iss_parameter_supported`
+     * Forwarded to openid-client, which validates it against the discovered issuer
+     */
+    iss?: string;
     /**
      * Error code from the IdP (if authorization failed)
      * e.g., "access_denied" if user cancelled

package/dist/schemas/CallbackRequest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CallbackRequest.d.ts","sourceRoot":"","sources":["../../src/schemas/CallbackRequest.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG;IACvD;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAE1B,CAAC;AAEF,eAAe,eAAe,CAAC"}
+{"version":3,"file":"CallbackRequest.d.ts","sourceRoot":"","sources":["../../src/schemas/CallbackRequest.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG;IACvD;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAE1B,CAAC;AAEF,eAAe,eAAe,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flink-app/oidc-plugin",
-  "version": "2.0.0-alpha.114",
+  "version": "2.0.0-alpha.115",
   "description": "Flink plugin for OIDC authentication with generic IdP support",
   "author": "joel@frost.se",
   "license": "MIT",
@@ -11,10 +11,10 @@
   },
   "dependencies": {
     "openid-client": "^5.7.0",
-    "@flink-app/jwt-auth-plugin": "2.0.0-alpha.114"
+    "@flink-app/jwt-auth-plugin": "2.0.0-alpha.115"
   },
   "peerDependencies": {
-    "@flink-app/flink": ">=2.0.0-alpha.114",
+    "@flink-app/flink": ">=2.0.0-alpha.115",
     "mongodb": "^6.15.0"
   },
   "peerDependenciesMeta": {
@@ -27,9 +27,9 @@
     "@types/node": "22.13.10",
     "ts-node": "^10.9.2",
     "tsc-watch": "^4.2.9",
-    "@flink-app/flink": "2.0.0-alpha.114",
-    "@flink-app/jwt-auth-plugin": "2.0.0-alpha.114",
-    "@flink-app/test-utils": "2.0.0-alpha.114"
+    "@flink-app/flink": "2.0.0-alpha.115",
+    "@flink-app/jwt-auth-plugin": "2.0.0-alpha.115",
+    "@flink-app/test-utils": "2.0.0-alpha.115"
   },
   "scripts": {
     "test": "jasmine-ts --config=./spec/support/jasmine.json",

package/src/handlers/CallbackOidc.ts

@@ -47,7 +47,7 @@ export const Route: RouteProps = {
  */
 const CallbackOidc: GetHandler<any, any, PathParams, CallbackRequest> = async ({ ctx, req }) => {
     const { provider } = req.params;
-    const { code, state, error: oidcError, error_description, response_type } = req.query;
+    const { code, state, iss, error: oidcError, error_description, response_type } = req.query;
 
     // Track session outside try/catch so redirectUri and metadata are available in error handling
     let sessionRedirectUri: string | undefined;
@@ -147,6 +147,7 @@ const CallbackOidc: GetHandler<any, any, PathParams, CallbackRequest> = async ({
             codeVerifier: session.codeVerifier,
             state: session.state,
             nonce: session.nonce,
+            iss,
         });
 
         oidcLog.debug(

package/src/providers/OidcProvider.ts

@@ -136,7 +136,7 @@ export class OidcProvider {
      * @param params - Token exchange parameters
      * @returns Token set with access token, ID token, and claims
      */
-    async exchangeCodeForToken(params: { code: string; codeVerifier: string; state: string; nonce: string }): Promise<OidcTokenSet> {
+    async exchangeCodeForToken(params: { code: string; codeVerifier: string; state: string; nonce: string; iss?: string }): Promise<OidcTokenSet> {
         await this.ensureInitialized();
 
         try {
@@ -145,6 +145,14 @@ export class OidcProvider {
                 {
                     code: params.code,
                     state: params.state,
+                    // RFC 9207: IdPs that advertise
+                    // `authorization_response_iss_parameter_supported` (Google does)
+                    // return `iss` on the authorization redirect, and openid-client
+                    // rejects the callback with "iss missing from the response" unless
+                    // it is forwarded here. Spread conditionally — openid-client keys
+                    // its check on `'iss' in params`, so an explicit `iss: undefined`
+                    // would be read as a mismatch and break IdPs that never send it.
+                    ...(params.iss ? { iss: params.iss } : {}),
                 },
                 {
                     code_verifier: params.codeVerifier,

package/src/schemas/CallbackRequest.ts

@@ -16,6 +16,13 @@ type CallbackRequest = Record<string, string | string[]> & {
      */
     state?: string;
 
+    /**
+     * Issuer identifier returned on the authorization response (RFC 9207)
+     * Sent by IdPs advertising `authorization_response_iss_parameter_supported`
+     * Forwarded to openid-client, which validates it against the discovered issuer
+     */
+    iss?: string;
+
     /**
      * Error code from the IdP (if authorization failed)
      * e.g., "access_denied" if user cancelled