@flink-app/oidc-plugin 2.0.0-alpha.117 → 2.0.0-alpha.118

package/CHANGELOG.md

@@ -1,5 +1,52 @@
 # @flink-app/oidc-plugin
 
+## 2.0.0-alpha.118
+
+### Minor Changes
+
+-   581497b: **Security:** add `allowedRedirectUris` to restrict the `?redirectUri=` query parameter on `/oidc/:provider/initiate`.
+
+    The `redirectUri` decides where the host's JWT is delivered once the OIDC flow completes, and anyone can craft an initiate link. Until now every value was accepted, so a crafted link could turn a legitimate login into token exfiltration — the user authenticates at the real IdP and the plugin then redirects to the attacker's URL with `#token=...`.
+
+    `allowedRedirectUris` takes a list of exact URIs, bare origins (`https://app.example.com` covers every path below it, `myapp://cb` covers a native scheme) or a predicate. Relative paths and the provider's own `callbackUrl` are always accepted. A mismatch answers `400` with the new `OidcErrorCodes.INVALID_REDIRECT_URI` and no session is created. The same check is applied to a `redirectUrl` returned by `onAuthSuccess` / `onAuthError` when it differs from the session's, so echoing an attacker-supplied value back cannot bypass the list by accident.
+
+    Non-breaking: when the option is omitted the behaviour is unchanged (every `redirectUri` accepted) and the plugin logs a warning at startup. Set it on every deployment — a future major will make it required.
+
+    Also: OIDC error codes are now propagated to the `code` field of `400` responses from the initiate and callback handlers (previously always `badRequest`).
+
+-   52d9152: Add `providerCacheTtlSec` and `ctx.plugins.oidc.invalidateProvider()` so provider config can change without a restart.
+
+    `ProviderRegistry` cached every resolved provider for the life of the process and never re-ran `providerLoader` for a name it had seen, so for hosts that keep provider config in a database, editing an issuer, client id, client secret, scope or discovery URL only took effect after restarting every instance. `clearCache()` existed on the registry but was not reachable through `ctx.plugins.oidc`.
+
+    -   `providerCacheTtlSec` (default `0` = cache forever, unchanged): seconds a resolved provider is reused before its config is loaded and discovery is run again. Reloading is lazy, on the next request for that provider. If the reload fails, the previously cached instance keeps being used and the next attempt happens after another TTL — a discovery hiccup does not break logins that would otherwise work. If the loader returns `null` the cached instance is dropped and the request fails with `provider_not_configured`. Applies to static providers too, whose discovery metadata was otherwise never refreshed.
+    -   `ctx.plugins.oidc.invalidateProvider(providerName?)`: drops cached instance(s) immediately on the instance it runs on — call it from the handler that saves IdP config; other instances converge within the TTL.
+
+    Both absent → exactly the previous behaviour. Non-breaking.
+
+-   37c5251: Allow `onAuthSuccess` to complete the login without a `token`.
+
+    Until now `onAuthSuccess` had to return a JWT and the plugin alone decided how it reached the client (`#token=` fragment, `?token=` query, or `{user, token}` JSON). Applications that want an HttpOnly cookie session, a one-time code the client exchanges over POST, or their own login envelope had to rebuild initiate/callback on top of `OidcProvider`.
+
+    `AuthSuccessCallbackResponse` is now a union of three shapes:
+
+    -   `{ user, token, redirectUrl? }` — unchanged default; the plugin delivers the token per `tokenDelivery`
+    -   `{ user, redirectUrl }` — the plugin redirects there verbatim, attaching nothing (e.g. the URL carries a short-lived one-time code). Still subject to `allowedRedirectUris`; `?response_type=json` answers `400 invalid_response_type` for this shape since there is no token for the body
+    -   `{ user, response }` — the application returns the whole `FlinkResponse` (redirect + `Set-Cookie`, a custom JSON envelope, anything a handler may return)
+
+    `onAuthError` takes the same `response` escape hatch, which wins over `redirectUrl`.
+
+    The `storeTokens` connection upsert now runs for all three shapes (it only needs `user._id`), and returning none of `token`, `redirectUrl` or `response` still fails with `jwt_generation_failed`.
+
+    Existing code is unaffected — the token shape is part of the union and behaves exactly as before.
+
+    Docs: a "Completing the login yourself" section in the README and skill, plus an explicit note that `oidc_connections` rows are only written when `storeTokens: true`, so in auth-only mode `getConnection`/`getConnections` cannot serve as the application's identity link.
+
+### Patch Changes
+
+-   1767278: Docs: bring the README in line with the current behaviour — `tokenDelivery` gets an options-table row and its own section (it was only documented in passing), the "returns the token as a URL fragment" statements are qualified with "by default", the React Native example uses query delivery (iOS strips the fragment) and points at `allowedRedirectUris` for custom schemes, and the `onAuthSuccess` / `onAuthError` signatures now show `redirectUri`, `metadata`, the three success shapes and the `response` escape hatch.
+    -   @flink-app/flink@2.0.0-alpha.118
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.118
+
 ## 2.0.0-alpha.117
 
 ### Patch Changes

package/README.md

@@ -106,6 +106,10 @@ const app = new FlinkApp<Context>({
                 },
             },
 
+            // Where the JWT may be delivered after login. ALWAYS set this —
+            // without it any ?redirectUri= passed to /initiate is accepted.
+            allowedRedirectUris: ["https://myapp.com"],
+
             // Callback after successful OIDC authentication (JIT provisioning)
             onAuthSuccess: async ({ profile, claims, provider }, ctx) => {
                 // Find user by OIDC subject + issuer (unique IdP identifier)
@@ -162,14 +166,17 @@ await app.start();
 | Option                      | Type       | Required | Default            | Description                                            |
 | --------------------------- | ---------- | -------- | ------------------ | ------------------------------------------------------ |
 | `providers`                 | `object`   | Yes      | -                  | OIDC provider configurations (at least one required)   |
+| `allowedRedirectUris`       | `string[]` \| `Function` | No | (all accepted) | Allow-list for `?redirectUri=` — **set this** (see [Redirect URI Allow-List](#redirect-uri-allow-list)) |
 | `storeTokens`               | `boolean`  | No       | `false`            | Store encrypted OIDC tokens for future API access      |
 | `onAuthSuccess`             | `Function` | Yes      | -                  | Callback after successful authentication (JIT)         |
 | `onAuthError`               | `Function` | No       | -                  | Callback on OIDC errors                                |
 | `providerLoader`            | `Function` | No       | -                  | Dynamic provider loading from database                 |
+| `providerCacheTtlSec`       | `number`   | No       | `0` (forever)      | Seconds a resolved provider is reused before its config and discovery are refreshed |
 | `sessionTTL`                | `number`   | No       | `600`              | Session TTL in seconds (default: 10 minutes)           |
 | `sessionsCollectionName`    | `string`   | No       | `"oidc_sessions"`  | MongoDB collection for sessions                        |
 | `connectionsCollectionName` | `string`   | No       | `"oidc_connections"` | MongoDB collection for connections                  |
 | `encryptionKey`             | `string`   | No       | (derived)          | Encryption key for tokens (32+ chars recommended)      |
+| `tokenDelivery`             | `"fragment"` \| `"query"` \| `Function` | No | `"fragment"` | How the JWT is attached on the post-callback redirect (see [Token Delivery](#token-delivery-fragment-vs-query)) |
 | `registerRoutes`            | `boolean`  | No       | `true`             | Auto-register OIDC routes                              |
 
 ### Provider Configuration
@@ -227,22 +234,30 @@ claims only:
 
 #### onAuthSuccess
 
-Called when OIDC authentication succeeds. Must generate and return a JWT token.
+Called when OIDC authentication succeeds. Resolves the user and decides how the login completes.
 
 ```typescript
 onAuthSuccess: async (params: {
-  profile: OidcProfile;      // Normalized user profile
-  claims: Record<string, any>; // Raw OIDC claims
-  provider: string;           // Provider name
-  tokens?: OidcTokenSet;      // Only if storeTokens: true
-}, ctx: Context) => Promise<{
-  user: any;
-  token: string;  // JWT token from ctx.plugins.jwtAuth.createToken()
-  redirectUrl?: string;
-}>
+  profile: OidcProfile;         // Normalized user profile
+  claims: Record<string, any>;  // Raw OIDC claims
+  provider: string;             // Provider name
+  redirectUri: string;          // redirectUri from the initiate request (or the fallback)
+  metadata: Record<string, string>; // meta.* query params from initiate, prefix stripped
+  tokens?: OidcTokenSet;        // Only if storeTokens: true
+}, ctx: Context) =>
+  Promise<
+    // 1. Default — the plugin delivers the token per `tokenDelivery`
+    | { user: any; token: string; redirectUrl?: string }
+    // 2. The plugin redirects there verbatim, attaching nothing
+    | { user: any; redirectUrl: string }
+    // 3. Your app returns the whole response (Set-Cookie, custom envelope, ...)
+    | { user: any; response: FlinkResponse }
+  >
 ```
 
-**Important:** The `redirectUrl` should NOT include the token. The plugin automatically appends `#token=...` to the URL.
+**Important:** with shape 1 the `redirectUrl` should NOT include the token — the plugin
+appends it (`#token=...` by default). Shapes 2 and 3 are described in
+[Completing the Login Yourself](#completing-the-login-yourself).
 
 #### onAuthError
 
@@ -252,8 +267,11 @@ Called when OIDC authentication fails.
 onAuthError: async (params: {
   error: OidcError;
   provider: string;
+  redirectUri?: string;             // From the initiate request, if the session was found
+  metadata: Record<string, string>; // meta.* query params from initiate
 }) => Promise<{
   redirectUrl?: string;
+  response?: FlinkResponse;  // Takes precedence over redirectUrl
 }>
 ```
 
@@ -321,6 +339,27 @@ GET /oidc/acme/initiate?redirectUri=https://myapp.com/welcome
 
 - 302 redirect to IdP authorization URL
 
+#### Security: the `redirectUri` query parameter
+
+`redirectUri` decides where the JWT is delivered when the flow completes, and it is
+**attacker-controllable** — anyone can craft an initiate link. Without an allow-list a
+crafted link turns a legitimate login into token exfiltration: the user authenticates at
+the real IdP, and the plugin then redirects to the attacker's URL with `#token=eyJ...`.
+
+Set [`allowedRedirectUris`](#redirect-uri-allow-list) on every deployment.
+
+Prefer deriving the final redirect from `metadata` (the `meta.*` query params) rather
+than echoing `redirectUri` straight back from `onAuthSuccess`, so the allow-list is a
+second line of defence rather than the only one:
+
+```typescript
+onAuthSuccess: async ({ metadata }, ctx) => {
+    // ...
+    const redirectUrl = metadata.intent === "admin" ? "https://admin.myapp.com/auth" : "/dashboard";
+    return { user, token, redirectUrl };
+};
+```
+
 ### OIDC Callback
 
 ```
@@ -354,9 +393,39 @@ https://myapp.com/dashboard#token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
 }
 ```
 
+### Token Delivery (fragment vs query)
+
+By default the JWT is attached to the post-callback redirect as a **URL fragment**
+(`#token=...`) — fragments are never sent to the server, which keeps the token out of
+access logs and referrers.
+
+Native flows need the query form instead: iOS `ASWebAuthenticationSession` strips the
+fragment before handing the URL to the app, so a custom-scheme callback never sees it.
+
+```typescript
+// Static: "fragment" (default) | "query"
+oidcPlugin({ tokenDelivery: "query", ... });
+
+// Per request, when one backend serves both web and native clients
+oidcPlugin({
+    tokenDelivery: ({ redirectUrl, provider, metadata }) => (/^https?:/i.test(redirectUrl) ? "fragment" : "query"),
+    ...
+});
+```
+
+The function form receives the resolved `redirectUrl`, the `provider` name, and the
+`metadata` bag from the initiate request (`?meta.client=native`), so the app can route by
+URL scheme, by explicit intent, or any other signal. `?response_type=json` ignores the
+setting and returns `{user, token}` as JSON.
+
+To keep the token out of the URL altogether, see
+[Completing the Login Yourself](#completing-the-login-yourself).
+
 ### Extracting JWT Token in Frontend
 
-**IMPORTANT:** The plugin returns the JWT token as a **URL fragment** (`#token=...`), NOT as a query parameter (`?token=...`).
+**IMPORTANT:** By default the plugin returns the JWT token as a **URL fragment**
+(`#token=...`), NOT as a query parameter (`?token=...`) — read it accordingly unless you
+set [`tokenDelivery: "query"`](#token-delivery-fragment-vs-query).
 
 ```javascript
 // ✅ CORRECT - Read from URL fragment (hash)
@@ -375,10 +444,81 @@ const params = new URLSearchParams(window.location.search);
 const token = params.get("token"); // This returns null!
 ```
 
+## Completing the Login Yourself
+
+Returning `{ user, token }` is the simple default: the plugin attaches the token per
+[`tokenDelivery`](#token-delivery-fragment-vs-query) (fragment, query or JSON). Two other shapes let the
+application complete the login itself when a token in the URL is not the session model it
+wants — an HttpOnly cookie, a one-time code, or a login envelope its clients already parse.
+
+### Verbatim redirect (one-time code)
+
+Return a `redirectUrl` and no `token`: the plugin redirects there **exactly as given** and
+attaches nothing. Keeps the bearer token out of browser history, referrers and the access
+logs of the redirect target.
+
+```typescript
+onAuthSuccess: async ({ profile, claims }, ctx) => {
+    const user = await findOrCreateUser(ctx, claims);
+
+    // Short-lived, single-use code the client exchanges for a real session
+    const code = generateCode();
+    await ctx.repos.loginCodeRepo.create({ code, userId: user._id, expiresAt: new Date(Date.now() + 60_000) });
+
+    return { user, redirectUrl: `https://app.example.com/auth/done?code=${code}` };
+};
+```
+
+The client then POSTs the code to one of your own routes, which answers with your normal
+login response. The URL is still subject to [`allowedRedirectUris`](#redirect-uri-allow-list).
+
+`?response_type=json` is not available for this shape — the request answers
+`400 invalid_response_type`, since there is no token to put in the JSON body.
+
+### Host-built response (cookie session, custom envelope)
+
+Return a `response` and the plugin sends it as-is — anything a Flink handler may return:
+
+```typescript
+// HttpOnly session cookie + redirect
+onAuthSuccess: async ({ profile, claims }, ctx) => {
+    const user = await findOrCreateUser(ctx, claims);
+    const session = await ctx.repos.sessionRepo.create({ userId: user._id });
+
+    return {
+        user,
+        response: {
+            redirect: { to: "https://app.example.com/dashboard" },
+            headers: { "Set-Cookie": `session=${session.id}; HttpOnly; Secure; SameSite=Lax; Path=/` },
+        },
+    };
+};
+
+// Custom login envelope for native clients
+onAuthSuccess: async ({ profile, claims }, ctx) => {
+    const user = await findOrCreateUser(ctx, claims);
+    const { accessToken, refreshToken } = await issueTokens(ctx, user);
+
+    return { user, response: { data: { accessToken, refreshToken, profile: user } } };
+};
+```
+
+`onAuthError` takes the same `response` escape hatch (it wins over `redirectUrl`), e.g. to
+clear a session cookie alongside the error redirect.
+
+**In all three shapes** the OIDC connection is still stored when `storeTokens: true` —
+it only needs `user._id`. Returning none of `token`, `redirectUrl` or `response` fails the
+login with `jwt_generation_failed`, as before.
+
 ## Context API
 
 The plugin exposes methods via `ctx.plugins.oidc`:
 
+> **Note:** `oidc_connections` rows are only written when `storeTokens: true`. In auth-only
+> mode (the default) `getConnection` / `getConnections` always return nothing, so they
+> cannot serve as the application's identity link — keep that link on your own user
+> document, as in [JIT with Email Matching](#jit-with-email-matching).
+
 ### getConnection
 
 Get stored OIDC connection for a user and provider.
@@ -421,6 +561,22 @@ Delete/unlink an OIDC connection.
 await ctx.plugins.oidc.deleteConnection(userId, "acme");
 ```
 
+### invalidateProvider
+
+Drop cached provider instance(s) so the next request re-runs `providerLoader` and OIDC discovery.
+Call it whenever provider configuration changes at runtime.
+
+```typescript
+// One provider
+ctx.plugins.oidc.invalidateProvider("acme");
+
+// All providers
+ctx.plugins.oidc.invalidateProvider();
+```
+
+Only affects the instance it runs on. For horizontally scaled apps, combine it with
+[`providerCacheTtlSec`](#provider-config-caching) so the other instances converge within the TTL.
+
 ## Token Storage
 
 ### Auth-Only Mode (Default)
@@ -444,6 +600,9 @@ oidcPlugin({
 - You don't need to call IdP APIs on behalf of users
 - You want to minimize stored credentials
 
+In this mode **no `oidc_connections` rows are written at all** — store the IdP
+subject/issuer on your own user document if you need to look users up by it later.
+
 ### Token Storage Mode
 
 Set `storeTokens: true` to store encrypted OIDC tokens for future API access.
@@ -623,6 +782,50 @@ oidcPlugin({
 })
 ```
 
+### Provider Config Caching
+
+**The loader result is cached.** By default a provider is resolved once and reused for the
+life of the process — editing an issuer, client id, client secret, scope or discovery URL
+in the database has no effect until every instance restarts.
+
+Set a TTL, and invalidate explicitly where the config is saved:
+
+```typescript
+oidcPlugin({
+    providerLoader: async (providerName, ctx) => {
+        /* ... load from db ... */
+    },
+
+    // Re-resolve config + re-run discovery at most every 5 minutes
+    providerCacheTtlSec: 300,
+
+    onAuthSuccess: async ({ profile, claims, provider }, ctx) => {
+        // ... JIT provisioning
+    },
+});
+```
+
+```typescript
+// src/handlers/admin/PutOidcProvider.ts — admin saves IdP settings
+const handler: PutHandler<Ctx, OidcProviderConfigDB, void> = async ({ ctx, req }) => {
+    await ctx.repos.oidcProviderRepo.updateById(req.params.id, req.body);
+
+    // Takes effect immediately on this instance; others converge within providerCacheTtlSec
+    ctx.plugins.oidc.invalidateProvider(req.body.name);
+
+    return { status: 204 };
+};
+```
+
+Reloading is lazy — it happens on the next request for that provider, not on a timer. If
+the reload fails (IdP unreachable, database hiccup) the previously cached instance keeps
+being used and the next attempt happens after another TTL, so a discovery hiccup does not
+break logins that would otherwise work. If the loader returns `null` (provider removed or
+disabled), the cached instance is dropped and the request fails with `provider_not_configured`.
+
+The TTL applies to static providers too: their discovery metadata (endpoints, JWKS URI) is
+otherwise fetched once at first use and never refreshed.
+
 ### Database Schema for Dynamic Providers
 
 ```typescript
@@ -649,6 +852,47 @@ interface OidcProviderConfigDB {
 
 ## Security
 
+### Redirect URI Allow-List
+
+`GET /oidc/:provider/initiate?redirectUri=...` decides where the JWT ends up after login.
+Restrict it to the URLs your own clients use:
+
+```typescript
+oidcPlugin({
+    // Exact URIs, bare origins, or a predicate
+    allowedRedirectUris: [
+        "https://app.example.com", // any path on this origin
+        "https://admin.example.com/auth-callback", // this exact URI only
+        "myapp://oidc-callback", // native app scheme
+    ],
+
+    // ...or a predicate for anything else
+    // allowedRedirectUris: (redirectUri, provider) => redirectUri.endsWith(".example.com/cb"),
+});
+```
+
+Matching rules:
+
+| Entry | Matches |
+| --- | --- |
+| `https://app.example.com` (no path) | Any path/query/fragment on that origin |
+| `https://app.example.com/login` (has path) | That exact URI only |
+| `myapp://cb` | `myapp://cb` and any path below it |
+
+Always accepted regardless of the list:
+
+- Relative paths (`/dashboard`) — they can only land on this app's own origin
+- The provider's own `callbackUrl` (the fallback when no `redirectUri` is passed)
+
+A `redirectUri` outside the list is rejected with `400 invalid_redirect_uri` and **no
+session is created**. The same check is applied to a `redirectUrl` returned by
+`onAuthSuccess` / `onAuthError` when it differs from the one stored on the session, so a
+host that echoes an attacker-supplied value back cannot bypass the list by accident.
+
+**If the option is omitted, every `redirectUri` is accepted** (unchanged legacy
+behaviour) and the plugin logs a warning at startup. A future major version will make
+the allow-list required.
+
 ### CSRF Protection
 
 The plugin uses cryptographically secure state parameters to prevent CSRF attacks:
@@ -748,18 +992,24 @@ function LoginPage() {
 
 ### React Native App
 
+Set [`tokenDelivery: "query"`](#token-delivery-fragment-vs-query) for native clients — iOS
+`ASWebAuthenticationSession` strips the URL fragment before handing the callback URL to the
+app, so `#token=...` never arrives.
+
 ```typescript
 import { openAuthSessionAsync } from "expo-auth-session";
 
 async function loginWithOidc() {
-    const result = await openAuthSessionAsync("https://api.myapp.com/oidc/acme/initiate", "myapp://oidc/callback");
+    const result = await openAuthSessionAsync(
+        "https://api.myapp.com/oidc/acme/initiate?redirectUri=myapp://oidc/callback",
+        "myapp://oidc/callback"
+    );
 
     if (result.type === "success") {
-        const url = result.url;
+        const urlObj = new URL(result.url);
 
-        // Extract token from URL fragment
-        const urlObj = new URL(url);
-        const token = new URLSearchParams(urlObj.hash.slice(1)).get("token");
+        // With tokenDelivery: "query" the token arrives as a query parameter
+        const token = urlObj.searchParams.get("token") || new URLSearchParams(urlObj.hash.slice(1)).get("token");
 
         if (token) {
             await AsyncStorage.setItem("jwt_token", token);
@@ -769,6 +1019,9 @@ async function loginWithOidc() {
 }
 ```
 
+Remember to add the custom scheme to [`allowedRedirectUris`](#redirect-uri-allow-list):
+`allowedRedirectUris: ["https://app.example.com", "myapp://oidc/callback"]`.
+
 ## Troubleshooting
 
 ### OIDC Discovery Failed
@@ -781,6 +1034,24 @@ async function loginWithOidc() {
 - Check IdP is accessible from your server
 - Try manual endpoint configuration instead
 
+### Invalid Redirect URI
+
+**Issue:** `invalid_redirect_uri` error (400)
+
+**Solution:**
+
+- The `redirectUri` is not covered by `allowedRedirectUris` — add its origin or exact URI
+- Remember that an entry *with* a path matches that exact URI only; use the bare origin to cover every path below it
+- Check schemes and ports match exactly (`https://app.example.com` does not cover `http://` or `:8443`)
+
+### JSON Mode Not Available
+
+**Issue:** `invalid_response_type` error (400) on `?response_type=json`
+
+**Solution:**
+
+- The application completed the login without a token (it returned `{ user, redirectUrl }`), so there is nothing to put in a JSON body — drop `response_type=json`, or return `{ user, response }` and build the JSON yourself
+
 ### Invalid State Parameter
 
 **Issue:** `invalid_state` error
@@ -833,11 +1104,19 @@ import {
     OidcConnection,
     OidcError,
     OidcPluginContext,
+    AllowedRedirectUris,
+    AuthSuccessCallbackResponse,
+    AuthSuccessTokenResponse,
+    AuthSuccessRedirectResponse,
+    AuthSuccessCustomResponse,
+    AuthErrorCallbackResponse,
 } from "@flink-app/oidc-plugin";
 ```
 
 ## Production Checklist
 
+- [ ] Set `allowedRedirectUris` to the URLs your clients actually use
+- [ ] Set `providerCacheTtlSec` if provider configs live in a database (otherwise edits need a restart)
 - [ ] Configure HTTPS for all OIDC callback URLs
 - [ ] Set OIDC credentials in secure environment variables
 - [ ] Configure JWT Auth Plugin with secure secret

package/dist/OidcPlugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OidcPlugin.d.ts","sourceRoot":"","sources":["../src/OidcPlugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,WAAW,EAAO,MAAM,kBAAkB,CAAC;AAG9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAWxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AACH,wBAAgB,UAAU,CAAC,IAAI,GAAG,GAAG,EAAE,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,GAAG,WAAW,CA2OpF"}
+{"version":3,"file":"OidcPlugin.d.ts","sourceRoot":"","sources":["../src/OidcPlugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,WAAW,EAAO,MAAM,kBAAkB,CAAC;AAG9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAWxD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AACH,wBAAgB,UAAU,CAAC,IAAI,GAAG,GAAG,EAAE,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,GAAG,WAAW,CAgRpF"}

package/dist/OidcPlugin.js

@@ -141,6 +141,25 @@ function oidcPlugin(options) {
     if (!options.onAuthSuccess) {
         throw new Error("OIDC Plugin: onAuthSuccess callback is required");
     }
+    // Redirect URI allow-list. Absent = every redirectUri is accepted (legacy behaviour),
+    // which lets a crafted initiate link deliver the app's JWT to any URL.
+    if (options.allowedRedirectUris === undefined) {
+        flink_1.log.warn("OIDC Plugin: allowedRedirectUris is not set — any redirectUri passed to /initiate is accepted. Set it to the URLs your clients use.");
+    }
+    else if (typeof options.allowedRedirectUris !== "function") {
+        if (!Array.isArray(options.allowedRedirectUris) || options.allowedRedirectUris.some((entry) => typeof entry !== "string" || !entry)) {
+            throw new Error("OIDC Plugin: allowedRedirectUris must be an array of non-empty strings or a predicate function");
+        }
+        log_1.oidcLog.debug(`Redirect URI allow-list: [${options.allowedRedirectUris.join(", ")}]`);
+    }
+    else {
+        log_1.oidcLog.debug("Redirect URI allow-list: predicate function");
+    }
+    // Provider cache TTL (0 = cache for the life of the process, unchanged behaviour)
+    const providerCacheTtlSec = options.providerCacheTtlSec ?? 0;
+    if (typeof providerCacheTtlSec !== "number" || !Number.isFinite(providerCacheTtlSec) || providerCacheTtlSec < 0) {
+        throw new Error("OIDC Plugin: providerCacheTtlSec must be a non-negative number of seconds");
+    }
     // Determine encryption key
     let encryptionKey = options.encryptionKey;
     if (!encryptionKey) {
@@ -187,7 +206,7 @@ function oidcPlugin(options) {
             // Initialize repositories
             const sessionsCollectionName = options.sessionsCollectionName || "oidc_sessions";
             const connectionsCollectionName = options.connectionsCollectionName || "oidc_connections";
-            log_1.oidcLog.debug(`Init: sessionsCollection=${sessionsCollectionName}`, `connectionsCollection=${connectionsCollectionName}`, `storeTokens=${!!options.storeTokens}`, `sessionTTL=${options.sessionTTL ?? 600}s`, `registerRoutes=${options.registerRoutes !== false}`, configuredProviders.length > 0 ? `staticProviders=[${configuredProviders.join(", ")}]` : "staticProviders=[] (dynamic only)", options.providerLoader ? "providerLoader=yes" : "providerLoader=no");
+            log_1.oidcLog.debug(`Init: sessionsCollection=${sessionsCollectionName}`, `connectionsCollection=${connectionsCollectionName}`, `storeTokens=${!!options.storeTokens}`, `sessionTTL=${options.sessionTTL ?? 600}s`, `providerCacheTtl=${providerCacheTtlSec > 0 ? `${providerCacheTtlSec}s` : "forever"}`, `registerRoutes=${options.registerRoutes !== false}`, configuredProviders.length > 0 ? `staticProviders=[${configuredProviders.join(", ")}]` : "staticProviders=[] (dynamic only)", options.providerLoader ? "providerLoader=yes" : "providerLoader=no");
             sessionRepo = new OidcSessionRepo_1.default(sessionsCollectionName, db);
             connectionRepo = new OidcConnectionRepo_1.default(connectionsCollectionName, db);
             flinkApp.addRepo("oidcSessionRepo", sessionRepo);
@@ -197,7 +216,7 @@ function oidcPlugin(options) {
             await db.collection(sessionsCollectionName).createIndex({ createdAt: 1 }, { expireAfterSeconds: sessionTTL });
             flink_1.log.info(`OIDC Plugin: Created TTL index on ${sessionsCollectionName} with ${sessionTTL}s expiration`);
             // Initialize provider registry
-            providerRegistry = new ProviderRegistry_1.ProviderRegistry(providers, options.providerLoader, flinkApp.ctx);
+            providerRegistry = new ProviderRegistry_1.ProviderRegistry(providers, options.providerLoader, flinkApp.ctx, providerCacheTtlSec);
             // Store provider registry in app context for handlers to access
             flinkApp.ctx.oidcProviderRegistry = providerRegistry;
             // Register OIDC handlers
@@ -268,6 +287,19 @@ function oidcPlugin(options) {
         await connectionRepo.deleteByUserAndProvider(userId, provider);
         flink_1.log.info(`OIDC Plugin: Deleted ${provider} connection for user ${userId}`);
     }
+    /**
+     * Drop cached provider instance(s) so the next request re-runs providerLoader
+     * and OIDC discovery
+     */
+    function invalidateProvider(providerName) {
+        if (!providerRegistry) {
+            // Nothing is cached before init, so there is nothing to invalidate
+            log_1.oidcLog.debug("invalidateProvider called before plugin init, nothing to do");
+            return;
+        }
+        providerRegistry.clearCache(providerName);
+        flink_1.log.info(`OIDC Plugin: invalidated provider cache for ${providerName ? `"${providerName}"` : "all providers"}`);
+    }
     /**
      * Plugin context exposed via ctx.plugins.oidc
      */
@@ -275,6 +307,7 @@ function oidcPlugin(options) {
         getConnection,
         getConnections,
         deleteConnection,
+        invalidateProvider,
         options: Object.freeze({ ...options }),
     };
     return {

package/dist/OidcPluginContext.d.ts

@@ -63,6 +63,23 @@ export interface OidcPluginContext {
          * ```
          */
         deleteConnection: (userId: string, provider: string) => Promise<void>;
+        /**
+         * Drop cached provider instance(s) so the next request re-runs `providerLoader`
+         * and OIDC discovery for them.
+         *
+         * Call this when provider configuration changes at runtime, e.g. from the handler
+         * where an admin saves IdP settings. Only affects the instance it runs on — with
+         * `providerCacheTtlSec` set, other instances converge within the TTL.
+         *
+         * @param providerName - Provider to invalidate (all providers if omitted)
+         *
+         * Example:
+         * ```typescript
+         * await ctx.repos.oidcProviderRepo.updateById(id, { clientSecret });
+         * ctx.plugins.oidc.invalidateProvider(providerName);
+         * ```
+         */
+        invalidateProvider: (providerName?: string) => void;
         /**
          * Plugin configuration options (read-only)
          * Useful for checking plugin settings at runtime

package/dist/OidcPluginContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OidcPluginContext.d.ts","sourceRoot":"","sources":["../src/OidcPluginContext.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAC9B,IAAI,EAAE;QACF;;;;;;;;;;;;;;;;;;;;WAoBG;QACH,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;QAEpF;;;;;;;;;;;;;;;;WAgBG;QACH,cAAc,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;QAE9D;;;;;;;;;;;;;;WAcG;QACH,gBAAgB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAEtE;;;WAGG;QACH,OAAO,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;KACxC,CAAC;CACL"}
+{"version":3,"file":"OidcPluginContext.d.ts","sourceRoot":"","sources":["../src/OidcPluginContext.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAC9B,IAAI,EAAE;QACF;;;;;;;;;;;;;;;;;;;;WAoBG;QACH,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;QAEpF;;;;;;;;;;;;;;;;WAgBG;QACH,cAAc,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;QAE9D;;;;;;;;;;;;;;WAcG;QACH,gBAAgB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAEtE;;;;;;;;;;;;;;;WAeG;QACH,kBAAkB,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;QAEpD;;;WAGG;QACH,OAAO,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;KACxC,CAAC;CACL"}