@flink-app/oidc-plugin 2.0.0-alpha.116 → 2.0.0-alpha.118

package/dist/providers/ProviderRegistry.js

@@ -4,31 +4,39 @@ exports.ProviderRegistry = void 0;
 const OidcProvider_1 = require("./OidcProvider");
 const error_utils_1 = require("../utils/error-utils");
 const log_1 = require("../log");
+const flink_1 = require("@flink-app/flink");
 /**
  * Provider registry for managing OIDC provider instances
  *
  * Handles:
  * - Static provider configuration
  * - Dynamic provider loading from database
- * - Provider instance caching
+ * - Provider instance caching (optionally with a TTL)
  * - Lazy initialization
  */
 class ProviderRegistry {
-    constructor(staticProviders, providerLoader, ctx) {
+    constructor(staticProviders, providerLoader, ctx, providerCacheTtlSec = 0) {
         this.providerInstances = new Map();
         this.staticProviders = staticProviders;
         this.providerLoader = providerLoader;
         this.ctx = ctx;
+        this.providerCacheTtlSec = providerCacheTtlSec;
     }
     /**
      * Get provider instance by name
      *
      * Looks up provider in the following order:
-     * 1. Cached instance
+     * 1. Cached instance (unless it is older than `providerCacheTtlSec`)
      * 2. Static configuration
      * 3. Dynamic loader (if configured)
      *
-     * Providers are lazy-initialized on first use and cached.
+     * Providers are lazy-initialized on first use and cached. With a cache TTL
+     * configured, an expired entry is reloaded on the next request — the config is
+     * resolved again (re-running `providerLoader`) and discovery is re-run.
+     *
+     * If reloading an expired entry fails, the previous instance keeps being used: a
+     * transient discovery or database hiccup should not break logins that would
+     * otherwise work. The next reload attempt happens after another TTL.
      *
      * @param providerName - Provider identifier
      * @returns Initialized OIDC provider instance
@@ -36,34 +44,80 @@ class ProviderRegistry {
      */
     async getProvider(providerName) {
         // Check cache first
-        const cachedProvider = this.providerInstances.get(providerName);
-        if (cachedProvider) {
+        const cached = this.providerInstances.get(providerName);
+        if (cached && !this.isExpired(cached)) {
             log_1.oidcLog.debug(`Provider "${providerName}": using cached instance`);
-            return cachedProvider;
+            return cached.provider;
         }
-        // Try static configuration
-        let config = this.staticProviders[providerName] || null;
-        let configSource = "static";
-        // Try dynamic loader if not in static config
-        if (!config && this.providerLoader) {
-            log_1.oidcLog.debug(`Provider "${providerName}": not in static config, invoking providerLoader`);
-            config = await this.providerLoader(providerName, this.ctx);
-            configSource = "dynamic";
+        if (cached) {
+            log_1.oidcLog.debug(`Provider "${providerName}": cache entry older than ${this.providerCacheTtlSec}s, reloading`);
+        }
+        // Resolve config (static config first, then the dynamic loader)
+        let config;
+        try {
+            config = await this.resolveConfig(providerName);
+        }
+        catch (error) {
+            return this.keepCachedOnFailure(providerName, cached, "config could not be loaded", error);
         }
         if (!config) {
+            // Provider is genuinely gone (or never existed) — drop any cached instance
+            this.providerInstances.delete(providerName);
             log_1.oidcLog.debug(`Provider "${providerName}": not found (static=[${Object.keys(this.staticProviders).join(", ")}], loader=${!!this.providerLoader})`);
             throw (0, error_utils_1.createOidcError)(error_utils_1.OidcErrorCodes.PROVIDER_NOT_CONFIGURED, `OIDC provider '${providerName}' is not configured`, {
                 providerName,
                 availableProviders: Object.keys(this.staticProviders),
             });
         }
-        log_1.oidcLog.debug(`Provider "${providerName}" resolved via ${configSource}:`, `issuer=${config.issuer}`, `clientId=${config.clientId}`, `clientSecret=${(0, log_1.maskSecret)(config.clientSecret)}`, `callbackUrl=${config.callbackUrl}`, config.discoveryUrl ? `discoveryUrl=${config.discoveryUrl}` : `authorizationEndpoint=${config.authorizationEndpoint}`, `scope=${(config.scope || ["openid", "email", "profile"]).join(" ")}`);
+        log_1.oidcLog.debug(`Provider "${providerName}" resolved via ${providerName in this.staticProviders ? "static" : "dynamic"}:`, `issuer=${config.issuer}`, `clientId=${config.clientId}`, `clientSecret=${(0, log_1.maskSecret)(config.clientSecret)}`, `callbackUrl=${config.callbackUrl}`, config.discoveryUrl ? `discoveryUrl=${config.discoveryUrl}` : `authorizationEndpoint=${config.authorizationEndpoint}`, `scope=${(config.scope || ["openid", "email", "profile"]).join(" ")}`);
         // Create and initialize provider
-        const provider = new OidcProvider_1.OidcProvider(config);
-        await provider.initialize();
-        // Cache the instance
-        this.providerInstances.set(providerName, provider);
-        return provider;
+        try {
+            const provider = new OidcProvider_1.OidcProvider(config);
+            await provider.initialize();
+            // Cache the instance
+            this.providerInstances.set(providerName, { provider, loadedAt: Date.now() });
+            return provider;
+        }
+        catch (error) {
+            return this.keepCachedOnFailure(providerName, cached, "initialization failed", error);
+        }
+    }
+    /**
+     * Resolve provider config from static configuration or the dynamic loader
+     */
+    async resolveConfig(providerName) {
+        const staticConfig = this.staticProviders[providerName];
+        if (staticConfig) {
+            return staticConfig;
+        }
+        if (this.providerLoader) {
+            log_1.oidcLog.debug(`Provider "${providerName}": not in static config, invoking providerLoader`);
+            return await this.providerLoader(providerName, this.ctx);
+        }
+        return null;
+    }
+    /**
+     * Whether a cache entry has outlived the configured TTL.
+     * A TTL of 0 (the default) means entries are cached for the life of the process.
+     */
+    isExpired(cached) {
+        if (this.providerCacheTtlSec <= 0) {
+            return false;
+        }
+        return Date.now() - cached.loadedAt >= this.providerCacheTtlSec * 1000;
+    }
+    /**
+     * Keep serving a previously cached instance when a reload fails.
+     * Rethrows when there is nothing cached to fall back on.
+     */
+    keepCachedOnFailure(providerName, cached, reason, error) {
+        if (!cached) {
+            throw error;
+        }
+        flink_1.log.warn(`OIDC Plugin: reload of provider "${providerName}" failed (${reason}), keeping the previously cached instance: ${error.message}`);
+        // Restart the TTL window so a persistent failure is not retried on every request
+        cached.loadedAt = Date.now();
+        return cached.provider;
     }
     /**
      * Check if provider exists in static configuration or can be loaded dynamically
@@ -80,6 +134,8 @@ class ProviderRegistry {
      * Forces re-initialization of providers on next access.
      * Useful when provider configurations change.
      *
+     * Exposed to applications as `ctx.plugins.oidc.invalidateProvider()`.
+     *
      * @param providerName - Optional provider to clear (clears all if not specified)
      */
     clearCache(providerName) {

package/dist/utils/error-utils.d.ts

@@ -10,6 +10,7 @@ export declare const OidcErrorCodes: {
     readonly MISSING_STATE: "missing_state";
     readonly INVALID_STATE: "invalid_state";
     readonly INVALID_RESPONSE_TYPE: "invalid_response_type";
+    readonly INVALID_REDIRECT_URI: "invalid_redirect_uri";
     readonly SESSION_NOT_FOUND: "session_not_found";
     readonly SESSION_EXPIRED: "session_expired";
     readonly TOKEN_EXCHANGE_FAILED: "token_exchange_failed";

package/dist/utils/error-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error-utils.d.ts","sourceRoot":"","sources":["../../src/utils/error-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD;;GAEG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;CAoCjB,CAAC;AAEX;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,SAAS,CAgBvF;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CASvD;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAMhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,GAAG,GAAG,SAAS,CAsDzD"}
+{"version":3,"file":"error-utils.d.ts","sourceRoot":"","sources":["../../src/utils/error-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD;;GAEG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;CAqCjB,CAAC;AAEX;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,SAAS,CAgBvF;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CASvD;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAMhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,GAAG,GAAG,SAAS,CAsDzD"}

package/dist/utils/error-utils.js

@@ -18,6 +18,7 @@ exports.OidcErrorCodes = {
     MISSING_STATE: "missing_state",
     INVALID_STATE: "invalid_state",
     INVALID_RESPONSE_TYPE: "invalid_response_type",
+    INVALID_REDIRECT_URI: "invalid_redirect_uri",
     // Session errors
     SESSION_NOT_FOUND: "session_not_found",
     SESSION_EXPIRED: "session_expired",

package/dist/utils/redirect-uri-utils.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Redirect URI allow-list utilities
+ *
+ * The `?redirectUri=` query parameter on `/oidc/:provider/initiate` decides where the
+ * host's JWT is delivered once the OIDC flow completes. It is attacker-controllable —
+ * anyone can craft an initiate link — so deployments should restrict it to the URLs
+ * their own clients use via the `allowedRedirectUris` plugin option.
+ */
+/**
+ * Allow-list for the `redirectUri` query parameter.
+ *
+ * Either a list of entries or a predicate:
+ * - An entry that is a bare origin (`https://app.example.com`, `myapp://cb`) matches any
+ *   path/query/fragment below that origin.
+ * - An entry with a path (`https://app.example.com/login`) matches that exact URI only.
+ * - A predicate receives the requested redirectUri and the provider name.
+ */
+export type AllowedRedirectUris = string[] | ((redirectUri: string, provider: string) => boolean);
+/**
+ * Whether a redirect target is a relative path on the plugin's own origin.
+ *
+ * `/dashboard` and `/login?error=x` are relative. `//evil.example` (protocol-relative)
+ * and `/\evil.example` are NOT — browsers resolve both of those to another origin.
+ */
+export declare function isRelativeRedirect(redirectUri: string): boolean;
+/**
+ * Check whether a redirect URI is allowed.
+ *
+ * @param redirectUri - The redirect target to check
+ * @param provider - Provider name (passed to the predicate form)
+ * @param allowedRedirectUris - The `allowedRedirectUris` plugin option. Undefined means
+ *   no allow-list is configured and every URI is accepted (legacy behaviour).
+ * @param alwaysAllowed - Entries that bypass the allow-list, e.g. the provider's own
+ *   `callbackUrl` and the redirectUri already validated at initiate time.
+ * @returns true if the redirect may be performed
+ */
+export declare function isRedirectUriAllowed(redirectUri: string, provider: string, allowedRedirectUris?: AllowedRedirectUris, alwaysAllowed?: (string | undefined)[]): boolean;
+//# sourceMappingURL=redirect-uri-utils.d.ts.map

package/dist/utils/redirect-uri-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-uri-utils.d.ts","sourceRoot":"","sources":["../../src/utils/redirect-uri-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC;AAElG;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAE/D;AAiDD;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAChC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,mBAAmB,CAAC,EAAE,mBAAmB,EACzC,aAAa,GAAE,CAAC,MAAM,GAAG,SAAS,CAAC,EAAO,GAC3C,OAAO,CAsBT"}

package/dist/utils/redirect-uri-utils.js

@@ -0,0 +1,92 @@
+"use strict";
+/**
+ * Redirect URI allow-list utilities
+ *
+ * The `?redirectUri=` query parameter on `/oidc/:provider/initiate` decides where the
+ * host's JWT is delivered once the OIDC flow completes. It is attacker-controllable —
+ * anyone can craft an initiate link — so deployments should restrict it to the URLs
+ * their own clients use via the `allowedRedirectUris` plugin option.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isRelativeRedirect = isRelativeRedirect;
+exports.isRedirectUriAllowed = isRedirectUriAllowed;
+/**
+ * Whether a redirect target is a relative path on the plugin's own origin.
+ *
+ * `/dashboard` and `/login?error=x` are relative. `//evil.example` (protocol-relative)
+ * and `/\evil.example` are NOT — browsers resolve both of those to another origin.
+ */
+function isRelativeRedirect(redirectUri) {
+    return /^\/(?![/\\])/.test(redirectUri);
+}
+function parseUrl(value) {
+    try {
+        return new URL(value);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Origin of a URL, including custom schemes.
+ * `URL.origin` is the string "null" for non-special schemes (e.g. `myapp://cb`),
+ * so fall back to scheme + host for those.
+ */
+function originOf(url) {
+    return url.origin && url.origin !== "null" ? url.origin : `${url.protocol}//${url.host}`;
+}
+/**
+ * Whether an allow-list entry names a bare origin (no path, query or fragment)
+ * and therefore matches every URI below that origin.
+ */
+function isOriginOnlyEntry(url) {
+    return (url.pathname === "" || url.pathname === "/") && !url.search && !url.hash;
+}
+/**
+ * Match a redirect URI against a single allow-list entry.
+ * Exact string match always wins; origin-only entries additionally match by origin.
+ */
+function matchesEntry(redirectUri, entry) {
+    if (redirectUri === entry) {
+        return true;
+    }
+    const entryUrl = parseUrl(entry);
+    if (!entryUrl || !isOriginOnlyEntry(entryUrl)) {
+        return false;
+    }
+    const targetUrl = parseUrl(redirectUri);
+    if (!targetUrl) {
+        return false;
+    }
+    return originOf(targetUrl) === originOf(entryUrl);
+}
+/**
+ * Check whether a redirect URI is allowed.
+ *
+ * @param redirectUri - The redirect target to check
+ * @param provider - Provider name (passed to the predicate form)
+ * @param allowedRedirectUris - The `allowedRedirectUris` plugin option. Undefined means
+ *   no allow-list is configured and every URI is accepted (legacy behaviour).
+ * @param alwaysAllowed - Entries that bypass the allow-list, e.g. the provider's own
+ *   `callbackUrl` and the redirectUri already validated at initiate time.
+ * @returns true if the redirect may be performed
+ */
+function isRedirectUriAllowed(redirectUri, provider, allowedRedirectUris, alwaysAllowed = []) {
+    // No allow-list configured: unchanged (permissive) behaviour
+    if (allowedRedirectUris === undefined) {
+        return true;
+    }
+    // Relative paths can only land on the plugin's own origin
+    if (isRelativeRedirect(redirectUri)) {
+        return true;
+    }
+    for (const entry of alwaysAllowed) {
+        if (entry && matchesEntry(redirectUri, entry)) {
+            return true;
+        }
+    }
+    if (typeof allowedRedirectUris === "function") {
+        return allowedRedirectUris(redirectUri, provider);
+    }
+    return allowedRedirectUris.some((entry) => matchesEntry(redirectUri, entry));
+}

package/examples/basic-oidc.ts

@@ -69,6 +69,10 @@ async function start() {
                     },
                 },
 
+                // Restrict where the JWT may be delivered after login.
+                // Without this, any ?redirectUri= passed to /initiate is accepted.
+                allowedRedirectUris: ["http://localhost:3000"],
+
                 // Step 3: Implement JIT user provisioning
                 onAuthSuccess: async ({ profile, claims, provider }, ctx) => {
                     console.log("OIDC authentication successful");

package/examples/multi-provider.ts

@@ -64,6 +64,10 @@ async function start() {
                     },
                 },
 
+                // Restrict where the JWT may be delivered after login.
+                // Without this, any ?redirectUri= passed to /initiate is accepted.
+                allowedRedirectUris: ["https://myapp.com", "myapp://oidc-callback"],
+
                 onAuthSuccess: async ({ profile, claims, provider }, ctx) => {
                     // Try to find existing user by OIDC connection
                     let user = await ctx.repos.userRepo.getOne({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flink-app/oidc-plugin",
-  "version": "2.0.0-alpha.116",
+  "version": "2.0.0-alpha.118",
   "description": "Flink plugin for OIDC authentication with generic IdP support",
   "author": "joel@frost.se",
   "license": "MIT",
@@ -11,10 +11,10 @@
   },
   "dependencies": {
     "openid-client": "^5.7.0",
-    "@flink-app/jwt-auth-plugin": "2.0.0-alpha.116"
+    "@flink-app/jwt-auth-plugin": "2.0.0-alpha.118"
   },
   "peerDependencies": {
-    "@flink-app/flink": ">=2.0.0-alpha.116",
+    "@flink-app/flink": ">=2.0.0-alpha.118",
     "mongodb": "^6.15.0"
   },
   "peerDependenciesMeta": {
@@ -27,9 +27,9 @@
     "@types/node": "22.13.10",
     "ts-node": "^10.9.2",
     "tsc-watch": "^4.2.9",
-    "@flink-app/jwt-auth-plugin": "2.0.0-alpha.116",
-    "@flink-app/flink": "2.0.0-alpha.116",
-    "@flink-app/test-utils": "2.0.0-alpha.116"
+    "@flink-app/flink": "2.0.0-alpha.118",
+    "@flink-app/jwt-auth-plugin": "2.0.0-alpha.118",
+    "@flink-app/test-utils": "2.0.0-alpha.118"
   },
   "scripts": {
     "test": "jasmine-ts --config=./spec/support/jasmine.json",