@flink-app/oidc-plugin 2.0.0-alpha.117 → 2.0.0-alpha.118

package/dist/OidcPluginOptions.d.ts

@@ -2,6 +2,8 @@ import OidcProfile from "./schemas/OidcProfile";
 import OidcTokenSet from "./schemas/OidcTokenSet";
 import { OidcProviderConfig } from "./OidcProviderConfig";
 import { TokenDeliveryMode } from "./utils/response-utils";
+import { AllowedRedirectUris } from "./utils/redirect-uri-utils";
+import { FlinkResponse } from "@flink-app/flink";
 /**
  * OIDC error information passed to onAuthError callback
  */
@@ -20,10 +22,10 @@ export interface OidcError {
     details?: any;
 }
 /**
- * Response from onAuthSuccess callback
- * Must include JWT token generated by the application via jwt-auth-plugin
+ * Default completion: the plugin delivers the JWT token generated by the application
+ * via jwt-auth-plugin, according to `tokenDelivery` (or as JSON for `?response_type=json`).
  */
-export interface AuthSuccessCallbackResponse {
+export interface AuthSuccessTokenResponse {
     /**
      * User object from your application
      * Should include _id field for connection storage
@@ -42,6 +44,54 @@ export interface AuthSuccessCallbackResponse {
      */
     redirectUrl?: string;
 }
+/**
+ * Verbatim redirect completion: the plugin redirects to `redirectUrl` exactly as given,
+ * without attaching any token. Use when the application has already handed the session
+ * over some other way — a one-time code it put in the URL, a server-side session keyed
+ * by something in the URL, and so on.
+ *
+ * The URL is still subject to the `allowedRedirectUris` check.
+ */
+export interface AuthSuccessRedirectResponse {
+    /**
+     * User object from your application
+     * Should include _id field for connection storage
+     */
+    user: any;
+    /**
+     * URL to redirect to, used exactly as given (no token is spliced in)
+     */
+    redirectUrl: string;
+    /**
+     * Must not be set — a token means the default token completion instead
+     */
+    token?: undefined;
+}
+/**
+ * Custom completion: the application owns the entire HTTP response — anything a Flink
+ * handler may return, e.g. a redirect plus a `Set-Cookie` header, or a login envelope
+ * its clients already parse.
+ */
+export interface AuthSuccessCustomResponse {
+    /**
+     * User object from your application
+     * Should include _id field for connection storage
+     */
+    user: any;
+    /**
+     * The response to send, returned as-is by the callback handler
+     */
+    response: FlinkResponse;
+}
+/**
+ * Response from onAuthSuccess callback
+ *
+ * Three shapes are supported:
+ * 1. `{ user, token, redirectUrl? }` — the plugin delivers the token (default)
+ * 2. `{ user, redirectUrl }` — the plugin redirects verbatim, no token attached
+ * 3. `{ user, response }` — the application builds the whole response
+ */
+export type AuthSuccessCallbackResponse = AuthSuccessTokenResponse | AuthSuccessRedirectResponse | AuthSuccessCustomResponse;
 /**
  * Response from onAuthError callback
  */
@@ -51,6 +101,12 @@ export interface AuthErrorCallbackResponse {
      * e.g., "/login?error=authentication_failed"
      */
     redirectUrl?: string;
+    /**
+     * Optional complete response to send instead, returned as-is by the callback handler.
+     * Takes precedence over `redirectUrl`. Use for error completions the plugin cannot
+     * express, e.g. clearing a session cookie alongside the redirect.
+     */
+    response?: FlinkResponse;
 }
 /**
  * Configuration options for OIDC Plugin with JWT integration
@@ -85,6 +141,40 @@ export interface OidcPluginOptions<TCtx = any> {
      * }
      */
     providers?: Record<string, OidcProviderConfig>;
+    /**
+     * Which `?redirectUri=` values the initiate endpoint accepts.
+     *
+     * The `redirectUri` decides where the JWT is delivered once the flow completes, and
+     * anyone can craft an initiate link — so without an allow-list a crafted link turns a
+     * legitimate login into token exfiltration. Set this on every deployment.
+     *
+     * Entries are matched as:
+     * - an exact URI (`https://app.example.com/login`), or
+     * - a bare origin (`https://app.example.com`, `myapp://cb`), which covers every path,
+     *   query and fragment below that origin.
+     *
+     * A predicate can be used for anything else.
+     *
+     * Always accepted regardless of the list:
+     * - relative paths (`/dashboard`) — they can only land on this app's own origin
+     * - the provider's own `callbackUrl` (the fallback when no `redirectUri` is passed)
+     *
+     * The same check is applied to a `redirectUrl` returned by `onAuthSuccess` /
+     * `onAuthError` when it differs from the one stored on the session, so echoing an
+     * attacker-supplied value back cannot bypass the list.
+     *
+     * Default: undefined — every redirectUri is accepted (logged as a warning at startup).
+     *
+     * Example:
+     * ```typescript
+     * allowedRedirectUris: [
+     *   "https://app.example.com",      // any path on this origin
+     *   "https://admin.example.com/auth-callback",
+     *   "myapp://oidc-callback"          // native app scheme
+     * ]
+     * ```
+     */
+    allowedRedirectUris?: AllowedRedirectUris;
     /**
      * Whether to store OIDC tokens for future API access
      * If false, tokens are discarded after authentication (auth-only mode)
@@ -107,6 +197,15 @@ export interface OidcPluginOptions<TCtx = any> {
      * 3. Generate JWT token using ctx.plugins.jwtAuth.createToken(payload, roles)
      * 4. Return user object, JWT token, and optional redirect URL
      *
+     * Applications that complete the login themselves can return one of two other shapes
+     * instead of a `token`:
+     * - `{ user, redirectUrl }` — the plugin redirects there verbatim, attaching nothing
+     *   (e.g. the URL carries a short-lived one-time code the client exchanges for a session)
+     * - `{ user, response }` — the application returns the whole HTTP response
+     *   (e.g. a redirect plus a `Set-Cookie` header)
+     *
+     * See {@link AuthSuccessCallbackResponse}.
+     *
      * @param params - OIDC profile, claims, provider name, and tokens (if storeTokens enabled)
      * @param ctx - Flink context with access to repos and plugins (including jwtAuth)
      * @returns User object, JWT token, and optional redirect URL
@@ -260,6 +359,27 @@ export interface OidcPluginOptions<TCtx = any> {
      * ```
      */
     providerLoader?: (providerName: string, ctx: TCtx) => Promise<OidcProviderConfig | null>;
+    /**
+     * Seconds a resolved provider (static or from `providerLoader`) is reused before its
+     * config is loaded and OIDC discovery is run again.
+     *
+     * Default: 0 — cache for the life of the process (unchanged behaviour).
+     *
+     * Set this when provider configs live in a database and can change at runtime:
+     * without a TTL, editing an issuer, client id, client secret, scope or discovery URL
+     * only takes effect after a restart of every instance.
+     *
+     * Reloading happens lazily on the next request for that provider. If the reload
+     * fails (IdP unreachable, database hiccup), the previously cached instance keeps
+     * being used and the next attempt happens after another TTL — a discovery hiccup
+     * does not break logins that would otherwise work.
+     *
+     * For an immediate update on the instance handling the change, call
+     * `ctx.plugins.oidc.invalidateProvider(name)`; other instances converge within the TTL.
+     *
+     * Example: `providerCacheTtlSec: 300` (5 minutes)
+     */
+    providerCacheTtlSec?: number;
     /**
      * Custom collection name for OIDC sessions
      * Default: 'oidc_sessions'

package/dist/OidcPluginOptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OidcPluginOptions.d.ts","sourceRoot":"","sources":["../src/OidcPluginOptions.ts"],"names":[],"mappings":"AAAA,OAAO,WAAW,MAAM,uBAAuB,CAAC;AAChD,OAAO,YAAY,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D;;GAEG;AACH,MAAM,WAAW,SAAS;IACtB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,OAAO,CAAC,EAAE,GAAG,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IACxC;;;OAGG;IACH,IAAI,EAAE,GAAG,CAAC;IAEV;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACtC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB,CAAC,IAAI,GAAG,GAAG;IACzC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAE/C;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;IACH,aAAa,EAAE,CACX,MAAM,EAAE;QACJ;;WAEG;QACH,OAAO,EAAE,WAAW,CAAC;QAErB;;;WAGG;QACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAE5B;;WAEG;QACH,QAAQ,EAAE,MAAM,CAAC;QAEjB;;;;;;;;WAQG;QACH,WAAW,EAAE,MAAM,CAAC;QAEpB;;;;;;;;WAQG;QACH,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAEjC;;;WAGG;QACH,MAAM,CAAC,EAAE,YAAY,CAAC;KACzB,EACD,GAAG,EAAE,IAAI,KACR,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE;QACnB,KAAK,EAAE,SAAS,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB;;;;WAIG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB;;;WAGG;QACH,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACpC,KAAK,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAEzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAEzF;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEhC;;;OAGG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAEnC;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,aAAa,CAAC,EACR,iBAAiB,GACjB,CAAC,CAAC,MAAM,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACpC,KAAK,iBAAiB,CAAC,CAAC;IAE/B;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC5B"}
+{"version":3,"file":"OidcPluginOptions.d.ts","sourceRoot":"","sources":["../src/OidcPluginOptions.ts"],"names":[],"mappings":"AAAA,OAAO,WAAW,MAAM,uBAAuB,CAAC;AAChD,OAAO,YAAY,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD;;GAEG;AACH,MAAM,WAAW,SAAS;IACtB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,OAAO,CAAC,EAAE,GAAG,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACrC;;;OAGG;IACH,IAAI,EAAE,GAAG,CAAC;IAEV;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,2BAA2B;IACxC;;;OAGG;IACH,IAAI,EAAE,GAAG,CAAC;IAEV;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACtC;;;OAGG;IACH,IAAI,EAAE,GAAG,CAAC;IAEV;;OAEG;IACH,QAAQ,EAAE,aAAa,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,GAAG,2BAA2B,GAAG,yBAAyB,CAAC;AAE7H;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACtC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB,CAAC,IAAI,GAAG,GAAG;IACzC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAE1C;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyDG;IACH,aAAa,EAAE,CACX,MAAM,EAAE;QACJ;;WAEG;QACH,OAAO,EAAE,WAAW,CAAC;QAErB;;;WAGG;QACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAE5B;;WAEG;QACH,QAAQ,EAAE,MAAM,CAAC;QAEjB;;;;;;;;WAQG;QACH,WAAW,EAAE,MAAM,CAAC;QAEpB;;;;;;;;WAQG;QACH,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAEjC;;;WAGG;QACH,MAAM,CAAC,EAAE,YAAY,CAAC;KACzB,EACD,GAAG,EAAE,IAAI,KACR,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE;QACnB,KAAK,EAAE,SAAS,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB;;;;WAIG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB;;;WAGG;QACH,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACpC,KAAK,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAEzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAEzF;;;;;;;;;;;;;;;;;;;OAmBG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEhC;;;OAGG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAEnC;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,aAAa,CAAC,EACR,iBAAiB,GACjB,CAAC,CAAC,MAAM,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACpC,KAAK,iBAAiB,CAAC,CAAC;IAE/B;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC5B"}

package/dist/handlers/CallbackOidc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CallbackOidc.d.ts","sourceRoot":"","sources":["../../src/handlers/CallbackOidc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAc,UAAU,EAAwC,MAAM,kBAAkB,CAAC;AAC5G,OAAO,eAAe,MAAM,4BAA4B,CAAC;AAOzD;;GAEG;AACH,UAAU,UAAU;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,eAAO,MAAM,KAAK,EAAE,UAGnB,CAAC;AAEF;;;;;;GAMG;AACH,QAAA,MAAM,YAAY,EAAE,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,eAAe,CA6QnE,CAAC;AAEF,eAAe,YAAY,CAAC"}
+{"version":3,"file":"CallbackOidc.d.ts","sourceRoot":"","sources":["../../src/handlers/CallbackOidc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAc,UAAU,EAAwC,MAAM,kBAAkB,CAAC;AAC5G,OAAO,eAAe,MAAM,4BAA4B,CAAC;AAQzD;;GAEG;AACH,UAAU,UAAU;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,eAAO,MAAM,KAAK,EAAE,UAGnB,CAAC;AAEF;;;;;;GAMG;AACH,QAAA,MAAM,YAAY,EAAE,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,eAAe,CAqWnE,CAAC;AAEF,eAAe,YAAY,CAAC"}

package/dist/handlers/CallbackOidc.js

@@ -20,6 +20,7 @@ const state_utils_1 = require("../utils/state-utils");
 const response_utils_1 = require("../utils/response-utils");
 const encryption_utils_1 = require("../utils/encryption-utils");
 const error_utils_1 = require("../utils/error-utils");
+const redirect_uri_utils_1 = require("../utils/redirect-uri-utils");
 const log_1 = require("../log");
 /**
  * Route configuration
@@ -42,6 +43,21 @@ const CallbackOidc = async ({ ctx, req }) => {
     // Track session outside try/catch so redirectUri and metadata are available in error handling
     let sessionRedirectUri;
     let sessionMetadata = {};
+    /**
+     * Apply the `allowedRedirectUris` allow-list to a redirect target built by the host
+     * (the `redirectUrl` returned by onAuthSuccess / onAuthError), so a host that echoes
+     * back an attacker-supplied value cannot bypass the list by accident.
+     *
+     * The redirectUri stored on the session was already validated at initiate time, as is
+     * the provider's own callbackUrl — both are always accepted here.
+     */
+    const isRedirectAllowed = (url, callbackUrl) => {
+        const { options } = ctx.plugins.oidc;
+        return (0, redirect_uri_utils_1.isRedirectUriAllowed)(url, provider, options.allowedRedirectUris, [
+            callbackUrl || options.providers?.[provider]?.callbackUrl,
+            sessionRedirectUri,
+        ]);
+    };
     try {
         // Validate provider and response_type
         (0, error_utils_1.validateProvider)(provider);
@@ -69,15 +85,24 @@ const CallbackOidc = async ({ ctx, req }) => {
                     redirectUri: sessionRedirectUri,
                     metadata: sessionMetadata,
                 });
+                if (errorResult.response) {
+                    log_1.oidcLog.debug("Callback: responding with host-built error response");
+                    return errorResult.response;
+                }
                 if (errorResult.redirectUrl) {
-                    return {
-                        status: 302,
-                        headers: { Location: errorResult.redirectUrl },
-                        data: {},
-                    };
+                    if (!isRedirectAllowed(errorResult.redirectUrl)) {
+                        flink_1.log.error(`OIDC callback: onAuthError returned a redirectUrl that is not allowed, ignoring it: ${errorResult.redirectUrl}`);
+                    }
+                    else {
+                        return {
+                            status: 302,
+                            headers: { Location: errorResult.redirectUrl },
+                            data: {},
+                        };
+                    }
                 }
             }
-            return (0, flink_1.badRequest)(error.message);
+            return (0, flink_1.badRequest)(error.message, error.code);
         }
         // Validate required parameters
         if (!code || !state) {
@@ -152,19 +177,34 @@ const CallbackOidc = async ({ ctx, req }) => {
                     redirectUri: session.redirectUri,
                     metadata: sessionMetadata,
                 });
+                if (errorResult.response) {
+                    log_1.oidcLog.debug("Callback: responding with host-built error response");
+                    return errorResult.response;
+                }
                 if (errorResult.redirectUrl) {
-                    return {
-                        status: 302,
-                        headers: { Location: errorResult.redirectUrl },
-                        data: {},
-                    };
+                    if (!isRedirectAllowed(errorResult.redirectUrl)) {
+                        flink_1.log.error(`OIDC callback: onAuthError returned a redirectUrl that is not allowed, ignoring it: ${errorResult.redirectUrl}`);
+                    }
+                    else {
+                        return {
+                            status: 302,
+                            headers: { Location: errorResult.redirectUrl },
+                            data: {},
+                        };
+                    }
                 }
             }
             return (0, flink_1.internalServerError)("Authentication failed. Please try again.");
         }
-        // Extract user and JWT token from callback result
-        const { user, token, redirectUrl } = authResult;
-        if (!token) {
+        // Extract the completion the host asked for. Three shapes are supported:
+        // 1. `token`     — the plugin delivers it (fragment/query/JSON)
+        // 2. `redirectUrl` without a token — redirect there verbatim, attaching nothing
+        // 3. `response`  — the host owns the whole HTTP response (Set-Cookie, custom envelope, ...)
+        const { user } = authResult;
+        const token = "token" in authResult ? authResult.token : undefined;
+        const redirectUrl = "redirectUrl" in authResult ? authResult.redirectUrl : undefined;
+        const hostResponse = "response" in authResult ? authResult.response : undefined;
+        if (!token && !redirectUrl && !hostResponse) {
             throw (0, error_utils_1.createOidcError)(error_utils_1.OidcErrorCodes.JWT_GENERATION_FAILED, "No authentication token returned from callback", { hasUser: !!user });
         }
         // Store OIDC connection if token storage is enabled
@@ -214,7 +254,35 @@ const CallbackOidc = async ({ ctx, req }) => {
                 }
             }
         }
+        // Shape 3: the host built the whole response — send it as-is
+        if (hostResponse) {
+            log_1.oidcLog.debug(`Callback: auth complete, responding with host-built response (status=${hostResponse.status ?? 200})`);
+            return hostResponse;
+        }
+        // Shape 2: verbatim redirect, nothing attached
+        if (!token) {
+            if (response_type === "json") {
+                throw (0, error_utils_1.createOidcError)(error_utils_1.OidcErrorCodes.INVALID_RESPONSE_TYPE, "The application completed the login without a token, so JSON mode is not available for this callback", { provider });
+            }
+            if (!isRedirectAllowed(redirectUrl, oidcProvider.config?.callbackUrl)) {
+                flink_1.log.error(`OIDC callback: onAuthSuccess returned a redirectUrl that is not allowed: ${redirectUrl}`);
+                throw (0, error_utils_1.createOidcError)(error_utils_1.OidcErrorCodes.INVALID_REDIRECT_URI, "The redirect URL is not allowed", { redirectUrl, provider });
+            }
+            log_1.oidcLog.debug(`Callback: auth complete, redirecting verbatim to "${redirectUrl}" (no token attached)`);
+            return {
+                status: 302,
+                headers: { Location: redirectUrl },
+                data: {},
+            };
+        }
+        // Shape 1: the plugin delivers the token
         const finalRedirectUrl = redirectUrl || session.redirectUri;
+        // Only the redirect response can leak the token to a foreign origin — the JSON
+        // response never uses finalRedirectUrl, so it is not subject to the allow-list.
+        if (response_type !== "json" && !isRedirectAllowed(finalRedirectUrl, oidcProvider.config?.callbackUrl)) {
+            flink_1.log.error(`OIDC callback: onAuthSuccess returned a redirectUrl that is not allowed: ${finalRedirectUrl}`);
+            throw (0, error_utils_1.createOidcError)(error_utils_1.OidcErrorCodes.INVALID_REDIRECT_URI, "The redirect URL is not allowed", { redirectUrl: finalRedirectUrl, provider });
+        }
         log_1.oidcLog.debug(`Callback: auth complete, responding via ${response_type === "json" ? "JSON" : `redirect to "${finalRedirectUrl}"`}`);
         // Resolve token delivery mode: literal, function, or default "fragment".
         // The plugin stays a dumb transport — the host app makes the policy decision.
@@ -243,19 +311,28 @@ const CallbackOidc = async ({ ctx, req }) => {
                         redirectUri: sessionRedirectUri,
                         metadata: sessionMetadata,
                     });
+                    if (errorResult.response) {
+                        log_1.oidcLog.debug("Callback: responding with host-built error response");
+                        return errorResult.response;
+                    }
                     if (errorResult.redirectUrl) {
-                        return {
-                            status: 302,
-                            headers: { Location: errorResult.redirectUrl },
-                            data: {},
-                        };
+                        if (!isRedirectAllowed(errorResult.redirectUrl)) {
+                            flink_1.log.error(`OIDC callback: onAuthError returned a redirectUrl that is not allowed, ignoring it: ${errorResult.redirectUrl}`);
+                        }
+                        else {
+                            return {
+                                status: 302,
+                                headers: { Location: errorResult.redirectUrl },
+                                data: {},
+                            };
+                        }
                     }
                 }
                 catch (callbackError) {
                     flink_1.log.error("onAuthError callback failed:", callbackError);
                 }
             }
-            return (0, flink_1.badRequest)(error.message);
+            return (0, flink_1.badRequest)(error.message, error.code);
         }
         // Handle provider errors
         const mappedError = (0, error_utils_1.handleProviderError)(error);

package/dist/handlers/InitiateOidc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"InitiateOidc.d.ts","sourceRoot":"","sources":["../../src/handlers/InitiateOidc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAc,UAAU,EAAmC,MAAM,kBAAkB,CAAC;AACvG,OAAO,eAAe,MAAM,4BAA4B,CAAC;AAMzD;;GAEG;AACH,UAAU,UAAU;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,eAAO,MAAM,KAAK,EAAE,UAGnB,CAAC;AAEF;;;;;GAKG;AACH,QAAA,MAAM,YAAY,EAAE,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,eAAe,CAkFnE,CAAC;AAEF,eAAe,YAAY,CAAC"}
+{"version":3,"file":"InitiateOidc.d.ts","sourceRoot":"","sources":["../../src/handlers/InitiateOidc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAc,UAAU,EAAmC,MAAM,kBAAkB,CAAC;AACvG,OAAO,eAAe,MAAM,4BAA4B,CAAC;AAOzD;;GAEG;AACH,UAAU,UAAU;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,eAAO,MAAM,KAAK,EAAE,UAGnB,CAAC;AAEF;;;;;GAKG;AACH,QAAA,MAAM,YAAY,EAAE,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,eAAe,CA4FnE,CAAC;AAEF,eAAe,YAAY,CAAC"}

package/dist/handlers/InitiateOidc.js

@@ -16,6 +16,7 @@ exports.Route = void 0;
 const flink_1 = require("@flink-app/flink");
 const state_utils_1 = require("../utils/state-utils");
 const error_utils_1 = require("../utils/error-utils");
+const redirect_uri_utils_1 = require("../utils/redirect-uri-utils");
 const openid_client_1 = require("openid-client");
 const log_1 = require("../log");
 /**
@@ -50,7 +51,15 @@ const InitiateOidc = async ({ ctx, req }) => {
         const { options } = ctx.plugins.oidc;
         // Determine redirect URI (use provided or default to callback URL)
         const staticProviderConfig = options.providers?.[provider];
-        const finalRedirectUri = redirectUri || staticProviderConfig?.callbackUrl || `${req.protocol}://${req.get("host")}/oidc/${provider}/callback`;
+        const callbackUrl = oidcProvider?.config?.callbackUrl || staticProviderConfig?.callbackUrl;
+        // The redirectUri decides where the JWT ends up, and the query param is
+        // attacker-controllable — validate it against the configured allow-list
+        // before anything is persisted.
+        if (redirectUri && !(0, redirect_uri_utils_1.isRedirectUriAllowed)(redirectUri, provider, options.allowedRedirectUris, [callbackUrl])) {
+            log_1.oidcLog.debug(`Initiate: rejected redirectUri="${redirectUri}" (not in allowedRedirectUris)`);
+            throw (0, error_utils_1.createOidcError)(error_utils_1.OidcErrorCodes.INVALID_REDIRECT_URI, "The provided redirectUri is not allowed", { redirectUri, provider });
+        }
+        const finalRedirectUri = redirectUri || callbackUrl || `${req.protocol}://${req.get("host")}/oidc/${provider}/callback`;
         // Collect meta.* query params as opaque metadata (prefix stripped)
         const metadata = {};
         for (const [key, value] of Object.entries(req.query)) {
@@ -58,7 +67,7 @@ const InitiateOidc = async ({ ctx, req }) => {
                 metadata[key.slice(5)] = value;
             }
         }
-        log_1.oidcLog.debug(`Initiate: resolved redirectUri="${finalRedirectUri}" (source: ${redirectUri ? "query param" : staticProviderConfig?.callbackUrl ? "provider config" : "auto-detected"})`);
+        log_1.oidcLog.debug(`Initiate: resolved redirectUri="${finalRedirectUri}" (source: ${redirectUri ? "query param" : callbackUrl ? "provider config" : "auto-detected"})`);
         // Generate cryptographically secure parameters
         const state = (0, state_utils_1.generateState)();
         const sessionId = (0, state_utils_1.generateSessionId)();
@@ -95,7 +104,7 @@ const InitiateOidc = async ({ ctx, req }) => {
     catch (error) {
         // Handle validation errors
         if (error.code && Object.values(error_utils_1.OidcErrorCodes).includes(error.code)) {
-            return (0, flink_1.badRequest)(error.message);
+            return (0, flink_1.badRequest)(error.message, error.code);
         }
         // Handle unexpected errors
         return (0, flink_1.internalServerError)(error.message || "Failed to initiate OIDC flow");

package/dist/index.d.ts

@@ -8,7 +8,7 @@
  * and optional token storage for API access.
  */
 export { oidcPlugin } from "./OidcPlugin";
-export { OidcPluginOptions, OidcError, AuthSuccessCallbackResponse, AuthErrorCallbackResponse } from "./OidcPluginOptions";
+export { OidcPluginOptions, OidcError, AuthSuccessCallbackResponse, AuthSuccessTokenResponse, AuthSuccessRedirectResponse, AuthSuccessCustomResponse, AuthErrorCallbackResponse, } from "./OidcPluginOptions";
 export { OidcProviderConfig } from "./OidcProviderConfig";
 export { OidcPluginContext } from "./OidcPluginContext";
 export { default as OidcProfile } from "./schemas/OidcProfile";
@@ -23,5 +23,6 @@ export { generateState, generateSessionId, generateNonce, validateState } from "
 export { encryptToken, decryptToken, validateEncryptionSecret } from "./utils/encryption-utils";
 export { mapClaimsToProfile, extractCustomClaims } from "./utils/claims-mapper";
 export { formatTokenResponse, TokenDeliveryMode } from "./utils/response-utils";
+export { isRedirectUriAllowed, isRelativeRedirect, AllowedRedirectUris } from "./utils/redirect-uri-utils";
 export { createOidcError, validateProvider, handleProviderError, OidcErrorCodes } from "./utils/error-utils";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG1C,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,2BAA2B,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAC3H,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAGxD,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAGvE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAGhE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACrG,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAChG,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG1C,OAAO,EACH,iBAAiB,EACjB,SAAS,EACT,2BAA2B,EAC3B,wBAAwB,EACxB,2BAA2B,EAC3B,yBAAyB,EACzB,yBAAyB,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAGxD,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAGvE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAGhE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACrG,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAChG,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAC3G,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -9,7 +9,7 @@
  * and optional token storage for API access.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OidcErrorCodes = exports.handleProviderError = exports.validateProvider = exports.createOidcError = exports.formatTokenResponse = exports.extractCustomClaims = exports.mapClaimsToProfile = exports.validateEncryptionSecret = exports.decryptToken = exports.encryptToken = exports.validateState = exports.generateNonce = exports.generateSessionId = exports.generateState = exports.ProviderRegistry = exports.OidcProvider = exports.oidcPlugin = void 0;
+exports.OidcErrorCodes = exports.handleProviderError = exports.validateProvider = exports.createOidcError = exports.isRelativeRedirect = exports.isRedirectUriAllowed = exports.formatTokenResponse = exports.extractCustomClaims = exports.mapClaimsToProfile = exports.validateEncryptionSecret = exports.decryptToken = exports.encryptToken = exports.validateState = exports.generateNonce = exports.generateSessionId = exports.generateState = exports.ProviderRegistry = exports.OidcProvider = exports.oidcPlugin = void 0;
 // Main plugin factory
 var OidcPlugin_1 = require("./OidcPlugin");
 Object.defineProperty(exports, "oidcPlugin", { enumerable: true, get: function () { return OidcPlugin_1.oidcPlugin; } });
@@ -33,6 +33,9 @@ Object.defineProperty(exports, "mapClaimsToProfile", { enumerable: true, get: fu
 Object.defineProperty(exports, "extractCustomClaims", { enumerable: true, get: function () { return claims_mapper_1.extractCustomClaims; } });
 var response_utils_1 = require("./utils/response-utils");
 Object.defineProperty(exports, "formatTokenResponse", { enumerable: true, get: function () { return response_utils_1.formatTokenResponse; } });
+var redirect_uri_utils_1 = require("./utils/redirect-uri-utils");
+Object.defineProperty(exports, "isRedirectUriAllowed", { enumerable: true, get: function () { return redirect_uri_utils_1.isRedirectUriAllowed; } });
+Object.defineProperty(exports, "isRelativeRedirect", { enumerable: true, get: function () { return redirect_uri_utils_1.isRelativeRedirect; } });
 var error_utils_1 = require("./utils/error-utils");
 Object.defineProperty(exports, "createOidcError", { enumerable: true, get: function () { return error_utils_1.createOidcError; } });
 Object.defineProperty(exports, "validateProvider", { enumerable: true, get: function () { return error_utils_1.validateProvider; } });

package/dist/providers/ProviderRegistry.d.ts

@@ -6,7 +6,7 @@ import { OidcProviderConfig } from "../OidcProviderConfig";
  * Handles:
  * - Static provider configuration
  * - Dynamic provider loading from database
- * - Provider instance caching
+ * - Provider instance caching (optionally with a TTL)
  * - Lazy initialization
  */
 export declare class ProviderRegistry {
@@ -14,22 +14,43 @@ export declare class ProviderRegistry {
     private providerInstances;
     private providerLoader?;
     private ctx;
-    constructor(staticProviders: Record<string, OidcProviderConfig>, providerLoader?: (providerName: string, ctx: any) => Promise<OidcProviderConfig | null>, ctx?: any);
+    private providerCacheTtlSec;
+    constructor(staticProviders: Record<string, OidcProviderConfig>, providerLoader?: (providerName: string, ctx: any) => Promise<OidcProviderConfig | null>, ctx?: any, providerCacheTtlSec?: number);
     /**
      * Get provider instance by name
      *
      * Looks up provider in the following order:
-     * 1. Cached instance
+     * 1. Cached instance (unless it is older than `providerCacheTtlSec`)
      * 2. Static configuration
      * 3. Dynamic loader (if configured)
      *
-     * Providers are lazy-initialized on first use and cached.
+     * Providers are lazy-initialized on first use and cached. With a cache TTL
+     * configured, an expired entry is reloaded on the next request — the config is
+     * resolved again (re-running `providerLoader`) and discovery is re-run.
+     *
+     * If reloading an expired entry fails, the previous instance keeps being used: a
+     * transient discovery or database hiccup should not break logins that would
+     * otherwise work. The next reload attempt happens after another TTL.
      *
      * @param providerName - Provider identifier
      * @returns Initialized OIDC provider instance
      * @throws Error if provider not found or initialization fails
      */
     getProvider(providerName: string): Promise<OidcProvider>;
+    /**
+     * Resolve provider config from static configuration or the dynamic loader
+     */
+    private resolveConfig;
+    /**
+     * Whether a cache entry has outlived the configured TTL.
+     * A TTL of 0 (the default) means entries are cached for the life of the process.
+     */
+    private isExpired;
+    /**
+     * Keep serving a previously cached instance when a reload fails.
+     * Rethrows when there is nothing cached to fall back on.
+     */
+    private keepCachedOnFailure;
     /**
      * Check if provider exists in static configuration or can be loaded dynamically
      *
@@ -43,6 +64,8 @@ export declare class ProviderRegistry {
      * Forces re-initialization of providers on next access.
      * Useful when provider configurations change.
      *
+     * Exposed to applications as `ctx.plugins.oidc.invalidateProvider()`.
+     *
      * @param providerName - Optional provider to clear (clears all if not specified)
      */
     clearCache(providerName?: string): void;

package/dist/providers/ProviderRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProviderRegistry.d.ts","sourceRoot":"","sources":["../../src/providers/ProviderRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAI3D;;;;;;;;GAQG;AACH,qBAAa,gBAAgB;IACzB,OAAO,CAAC,eAAe,CAAqC;IAC5D,OAAO,CAAC,iBAAiB,CAAwC;IACjE,OAAO,CAAC,cAAc,CAAC,CAAyE;IAChG,OAAO,CAAC,GAAG,CAAM;gBAGb,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,EACnD,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,EACvF,GAAG,CAAC,EAAE,GAAG;IAOb;;;;;;;;;;;;;OAaG;IACG,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IA+C9D;;;;;OAKG;IACH,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAI1C;;;;;;;OAOG;IACH,UAAU,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI;IAQvC;;;;OAIG;IACH,gBAAgB,IAAI,MAAM,EAAE;CAG/B"}
+{"version":3,"file":"ProviderRegistry.d.ts","sourceRoot":"","sources":["../../src/providers/ProviderRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAa3D;;;;;;;;GAQG;AACH,qBAAa,gBAAgB;IACzB,OAAO,CAAC,eAAe,CAAqC;IAC5D,OAAO,CAAC,iBAAiB,CAA0C;IACnE,OAAO,CAAC,cAAc,CAAC,CAAyE;IAChG,OAAO,CAAC,GAAG,CAAM;IACjB,OAAO,CAAC,mBAAmB,CAAS;gBAGhC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,EACnD,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,EACvF,GAAG,CAAC,EAAE,GAAG,EACT,mBAAmB,GAAE,MAAU;IAQnC;;;;;;;;;;;;;;;;;;;OAmBG;IACG,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAsD9D;;OAEG;YACW,aAAa;IAc3B;;;OAGG;IACH,OAAO,CAAC,SAAS;IAQjB;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAa3B;;;;;OAKG;IACH,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAI1C;;;;;;;;;OASG;IACH,UAAU,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI;IAQvC;;;;OAIG;IACH,gBAAgB,IAAI,MAAM,EAAE;CAG/B"}