@flink-app/oidc-plugin 2.0.0-alpha.117 → 2.0.0-alpha.118

package/spec/plugin/OidcPlugin.spec.ts

@@ -5,6 +5,7 @@
  * For full integration tests, use the test-utils package in a demo app.
  */
 
+import { log } from "@flink-app/flink";
 import { oidcPlugin } from "../../src/OidcPlugin";
 import { createTestProviderConfig, createPublicClientProviderConfig } from "../helpers/test-helpers";
 
@@ -212,6 +213,18 @@ describe("OidcPlugin", () => {
             expect(plugin.ctx.options).toBeDefined();
         });
 
+        it("should expose allowedRedirectUris on the plugin context options", () => {
+            const plugin = oidcPlugin({
+                providers: {
+                    test: createTestProviderConfig(),
+                },
+                allowedRedirectUris: ["https://app.example.com"],
+                onAuthSuccess: async () => ({ user: {}, token: "", redirectUrl: "" }),
+            });
+
+            expect(plugin.ctx.options.allowedRedirectUris).toEqual(["https://app.example.com"]);
+        });
+
         it("should provide init function", () => {
             const plugin = oidcPlugin({
                 providers: {
@@ -224,4 +237,156 @@ describe("OidcPlugin", () => {
             expect(typeof plugin.init).toBe("function");
         });
     });
+
+    describe("providerCacheTtlSec option", () => {
+        it("should accept a non-negative number", () => {
+            expect(() => {
+                oidcPlugin({
+                    providers: { test: createTestProviderConfig() },
+                    providerCacheTtlSec: 300,
+                    onAuthSuccess: async () => ({ user: {}, token: "" }),
+                });
+            }).not.toThrow();
+
+            expect(() => {
+                oidcPlugin({
+                    providers: { test: createTestProviderConfig() },
+                    providerCacheTtlSec: 0,
+                    onAuthSuccess: async () => ({ user: {}, token: "" }),
+                });
+            }).not.toThrow();
+        });
+
+        it("should throw for a negative or non-numeric value", () => {
+            expect(() => {
+                oidcPlugin({
+                    providers: { test: createTestProviderConfig() },
+                    providerCacheTtlSec: -1,
+                    onAuthSuccess: async () => ({ user: {}, token: "" }),
+                });
+            }).toThrowError(/providerCacheTtlSec must be a non-negative number of seconds/);
+
+            expect(() => {
+                oidcPlugin({
+                    providers: { test: createTestProviderConfig() },
+                    providerCacheTtlSec: "300" as any,
+                    onAuthSuccess: async () => ({ user: {}, token: "" }),
+                });
+            }).toThrowError(/providerCacheTtlSec must be a non-negative number of seconds/);
+        });
+    });
+
+    describe("invalidateProvider", () => {
+        /**
+         * Minimal app/db doubles so init() can run without MongoDB
+         */
+        function createFakeApp() {
+            return {
+                ctx: {} as any,
+                addRepo: () => undefined,
+                addHandler: () => undefined,
+            };
+        }
+
+        const fakeDb = {
+            collection: () => ({ createIndex: async () => undefined }),
+        };
+
+        it("should be exposed on the plugin context", () => {
+            const plugin = oidcPlugin({
+                providers: { test: createTestProviderConfig() },
+                onAuthSuccess: async () => ({ user: {}, token: "" }),
+            });
+
+            expect(typeof plugin.ctx.invalidateProvider).toBe("function");
+        });
+
+        it("should not throw when called before init", () => {
+            const plugin = oidcPlugin({
+                providers: { test: createTestProviderConfig() },
+                onAuthSuccess: async () => ({ user: {}, token: "" }),
+            });
+
+            expect(() => plugin.ctx.invalidateProvider("test")).not.toThrow();
+        });
+
+        it("should clear the provider cache after init", async () => {
+            const plugin = oidcPlugin({
+                providers: { test: createTestProviderConfig() },
+                providerCacheTtlSec: 300,
+                onAuthSuccess: async () => ({ user: {}, token: "" }),
+            });
+
+            const app = createFakeApp();
+            await plugin.init!(app as any, fakeDb as any);
+
+            const registry = app.ctx.oidcProviderRegistry;
+            expect(registry).toBeDefined();
+
+            const clearCacheSpy = spyOn(registry, "clearCache");
+
+            plugin.ctx.invalidateProvider("test");
+            expect(clearCacheSpy).toHaveBeenCalledWith("test");
+
+            plugin.ctx.invalidateProvider();
+            expect(clearCacheSpy).toHaveBeenCalledWith(undefined);
+        });
+    });
+
+    describe("allowedRedirectUris option", () => {
+        function warnedAboutAllowList(warnSpy: jasmine.Spy): boolean {
+            return warnSpy.calls.allArgs().some((args: any[]) => args.some((arg) => typeof arg === "string" && arg.includes("allowedRedirectUris is not set")));
+        }
+
+        it("should warn once at startup when allowedRedirectUris is not set", () => {
+            const warnSpy = spyOn(log, "warn");
+
+            oidcPlugin({
+                providers: { test: createTestProviderConfig() },
+                onAuthSuccess: async () => ({ user: {}, token: "" }),
+            });
+
+            expect(warnedAboutAllowList(warnSpy)).toBe(true);
+        });
+
+        it("should not warn when allowedRedirectUris is set", () => {
+            const warnSpy = spyOn(log, "warn");
+
+            oidcPlugin({
+                providers: { test: createTestProviderConfig() },
+                allowedRedirectUris: ["https://app.example.com"],
+                onAuthSuccess: async () => ({ user: {}, token: "" }),
+            });
+
+            expect(warnedAboutAllowList(warnSpy)).toBe(false);
+        });
+
+        it("should accept a predicate", () => {
+            expect(() => {
+                oidcPlugin({
+                    providers: { test: createTestProviderConfig() },
+                    allowedRedirectUris: (uri) => uri.startsWith("https://app.example.com"),
+                    onAuthSuccess: async () => ({ user: {}, token: "" }),
+                });
+            }).not.toThrow();
+        });
+
+        it("should throw if allowedRedirectUris is not a string array or function", () => {
+            expect(() => {
+                oidcPlugin({
+                    providers: { test: createTestProviderConfig() },
+                    allowedRedirectUris: ["https://app.example.com", ""] as any,
+                    onAuthSuccess: async () => ({ user: {}, token: "" }),
+                });
+            }).toThrowError(/allowedRedirectUris must be an array of non-empty strings or a predicate function/);
+
+            expect(() => {
+                oidcPlugin({
+                    providers: { test: createTestProviderConfig() },
+                    allowedRedirectUris: "https://app.example.com" as any,
+                    onAuthSuccess: async () => ({ user: {}, token: "" }),
+                });
+            }).toThrowError(/allowedRedirectUris must be an array of non-empty strings or a predicate function/);
+        });
+    });
 });

package/spec/providers/ProviderRegistry.spec.ts

@@ -6,6 +6,20 @@ import { ProviderRegistry } from "../../src/providers/ProviderRegistry";
 import { OidcProviderConfig } from "../../src/OidcProviderConfig";
 import { createTestProviderConfig } from "../helpers/test-helpers";
 
+/**
+ * Provider config with manual endpoints — initializing it performs no network calls,
+ * so the registry's caching behaviour can be tested offline.
+ */
+function createOfflineProviderConfig(overrides?: Partial<OidcProviderConfig>): OidcProviderConfig {
+    return createTestProviderConfig({
+        discoveryUrl: undefined,
+        authorizationEndpoint: "https://test-idp.example.com/authorize",
+        tokenEndpoint: "https://test-idp.example.com/token",
+        jwksUri: "https://test-idp.example.com/.well-known/jwks.json",
+        ...overrides,
+    });
+}
+
 describe("ProviderRegistry", () => {
     let staticProviders: Record<string, OidcProviderConfig>;
 
@@ -195,4 +209,132 @@ describe("ProviderRegistry", () => {
             expect(loader).toHaveBeenCalledTimes(2);
         });
     });
+
+    describe("provider cache TTL", () => {
+        it("should not re-run the loader while the entry is cached (no TTL)", async () => {
+            const loader = jasmine.createSpy("loader").and.callFake(async () => createOfflineProviderConfig());
+            const registry = new ProviderRegistry({}, loader, {});
+
+            await registry.getProvider("test");
+            await registry.getProvider("test");
+
+            expect(loader).toHaveBeenCalledTimes(1);
+        });
+
+        it("should not re-run the loader before the TTL has elapsed", async () => {
+            const loader = jasmine.createSpy("loader").and.callFake(async () => createOfflineProviderConfig());
+            const registry = new ProviderRegistry({}, loader, {}, 60);
+
+            await registry.getProvider("test");
+            await registry.getProvider("test");
+
+            expect(loader).toHaveBeenCalledTimes(1);
+        });
+
+        it("should re-run the loader and use the new config once the TTL has elapsed", async () => {
+            let clientId = "client-v1";
+            const loader = jasmine.createSpy("loader").and.callFake(async () => createOfflineProviderConfig({ clientId }));
+
+            // 0.02s TTL keeps the test fast without faking timers
+            const registry = new ProviderRegistry({}, loader, {}, 0.02);
+
+            const first = await registry.getProvider("test");
+            expect(first.config.clientId).toBe("client-v1");
+
+            clientId = "client-v2";
+            await new Promise((resolve) => setTimeout(resolve, 30));
+
+            const second = await registry.getProvider("test");
+
+            expect(loader).toHaveBeenCalledTimes(2);
+            expect(second).not.toBe(first);
+            expect(second.config.clientId).toBe("client-v2");
+        });
+
+        it("should re-run discovery for static providers once the TTL has elapsed", async () => {
+            const staticConfig = createOfflineProviderConfig();
+            const registry = new ProviderRegistry({ test: staticConfig }, undefined, {}, 0.02);
+
+            const first = await registry.getProvider("test");
+            await new Promise((resolve) => setTimeout(resolve, 30));
+            const second = await registry.getProvider("test");
+
+            expect(second).not.toBe(first);
+        });
+
+        it("should keep the previous instance when the reload fails", async () => {
+            let shouldFail = false;
+            const loader = jasmine.createSpy("loader").and.callFake(async () => {
+                if (shouldFail) {
+                    throw new Error("database unavailable");
+                }
+                return createOfflineProviderConfig();
+            });
+            const registry = new ProviderRegistry({}, loader, {}, 0.02);
+
+            const first = await registry.getProvider("test");
+
+            shouldFail = true;
+            await new Promise((resolve) => setTimeout(resolve, 30));
+
+            const second = await registry.getProvider("test");
+
+            expect(loader).toHaveBeenCalledTimes(2);
+            expect(second).toBe(first);
+        });
+
+        it("should throw when the first load fails and nothing is cached", async () => {
+            const loader = jasmine.createSpy("loader").and.callFake(async () => {
+                throw new Error("database unavailable");
+            });
+            const registry = new ProviderRegistry({}, loader, {}, 0.02);
+
+            await expectAsync(registry.getProvider("test")).toBeRejectedWithError(/database unavailable/);
+        });
+
+        it("should drop the cached instance when the provider is removed", async () => {
+            let exists = true;
+            const loader = jasmine.createSpy("loader").and.callFake(async () => (exists ? createOfflineProviderConfig() : null));
+            const registry = new ProviderRegistry({}, loader, {}, 0.02);
+
+            await registry.getProvider("test");
+
+            exists = false;
+            await new Promise((resolve) => setTimeout(resolve, 30));
+
+            try {
+                await registry.getProvider("test");
+                fail("Should have thrown error");
+            } catch (error: any) {
+                expect(error.code).toBe("provider_not_configured");
+            }
+        });
+    });
+
+    describe("clearCache forces a reload", () => {
+        it("should re-run the loader for a named provider", async () => {
+            const loader = jasmine.createSpy("loader").and.callFake(async () => createOfflineProviderConfig());
+            const registry = new ProviderRegistry({}, loader, {});
+
+            const first = await registry.getProvider("test");
+            registry.clearCache("test");
+            const second = await registry.getProvider("test");
+
+            expect(loader).toHaveBeenCalledTimes(2);
+            expect(second).not.toBe(first);
+        });
+
+        it("should re-run the loader for all providers", async () => {
+            const loader = jasmine.createSpy("loader").and.callFake(async () => createOfflineProviderConfig());
+            const registry = new ProviderRegistry({}, loader, {});
+
+            await registry.getProvider("a");
+            await registry.getProvider("b");
+            registry.clearCache();
+            await registry.getProvider("a");
+            await registry.getProvider("b");
+
+            expect(loader).toHaveBeenCalledTimes(4);
+        });
+    });
 });

package/spec/utils/redirect-uri-utils.spec.ts

@@ -0,0 +1,98 @@
+/**
+ * Tests for the redirectUri allow-list
+ */
+
+import { isRedirectUriAllowed, isRelativeRedirect } from "../../src/utils/redirect-uri-utils";
+
+describe("redirect-uri-utils", () => {
+    describe("isRelativeRedirect", () => {
+        it("should treat single-slash paths as relative", () => {
+            expect(isRelativeRedirect("/dashboard")).toBe(true);
+            expect(isRelativeRedirect("/login?error=x")).toBe(true);
+            expect(isRelativeRedirect("/")).toBe(true);
+        });
+
+        it("should not treat protocol-relative or backslash URLs as relative", () => {
+            expect(isRelativeRedirect("//evil.example/cb")).toBe(false);
+            expect(isRelativeRedirect("/\\evil.example/cb")).toBe(false);
+        });
+
+        it("should not treat absolute URLs as relative", () => {
+            expect(isRelativeRedirect("https://app.example.com/cb")).toBe(false);
+            expect(isRelativeRedirect("myapp://cb")).toBe(false);
+        });
+    });
+
+    describe("isRedirectUriAllowed", () => {
+        it("should allow anything when no allow-list is configured", () => {
+            expect(isRedirectUriAllowed("https://evil.example/cb", "acme", undefined)).toBe(true);
+        });
+
+        it("should match exact URIs", () => {
+            const allowed = ["https://app.example.com/login"];
+
+            expect(isRedirectUriAllowed("https://app.example.com/login", "acme", allowed)).toBe(true);
+            expect(isRedirectUriAllowed("https://app.example.com/login?next=1", "acme", allowed)).toBe(false);
+            expect(isRedirectUriAllowed("https://app.example.com/other", "acme", allowed)).toBe(false);
+        });
+
+        it("should match any path below an origin-only entry", () => {
+            const allowed = ["https://app.example.com"];
+
+            expect(isRedirectUriAllowed("https://app.example.com", "acme", allowed)).toBe(true);
+            expect(isRedirectUriAllowed("https://app.example.com/login?x=1", "acme", allowed)).toBe(true);
+            expect(isRedirectUriAllowed("https://app.example.com/a/b#frag", "acme", allowed)).toBe(true);
+        });
+
+        it("should treat a trailing slash entry as origin-only", () => {
+            expect(isRedirectUriAllowed("https://app.example.com/login", "acme", ["https://app.example.com/"])).toBe(true);
+        });
+
+        it("should not match a different origin, scheme or port", () => {
+            const allowed = ["https://app.example.com"];
+
+            expect(isRedirectUriAllowed("https://evil.example/cb", "acme", allowed)).toBe(false);
+            expect(isRedirectUriAllowed("http://app.example.com/cb", "acme", allowed)).toBe(false);
+            expect(isRedirectUriAllowed("https://app.example.com:8443/cb", "acme", allowed)).toBe(false);
+            expect(isRedirectUriAllowed("https://app.example.com.evil.example/cb", "acme", allowed)).toBe(false);
+        });
+
+        it("should support custom app schemes", () => {
+            const allowed = ["myapp://cb"];
+
+            expect(isRedirectUriAllowed("myapp://cb", "acme", allowed)).toBe(true);
+            expect(isRedirectUriAllowed("myapp://cb/done", "acme", allowed)).toBe(true);
+            expect(isRedirectUriAllowed("otherapp://cb", "acme", allowed)).toBe(false);
+        });
+
+        it("should support a predicate", () => {
+            const predicate = (redirectUri: string, provider: string) => provider === "acme" && redirectUri.endsWith(".example.com/cb");
+
+            expect(isRedirectUriAllowed("https://a.example.com/cb", "acme", predicate)).toBe(true);
+            expect(isRedirectUriAllowed("https://a.example.com/cb", "contoso", predicate)).toBe(false);
+            expect(isRedirectUriAllowed("https://evil.example/cb", "acme", predicate)).toBe(false);
+        });
+
+        it("should always allow relative paths", () => {
+            expect(isRedirectUriAllowed("/dashboard", "acme", [])).toBe(true);
+            expect(isRedirectUriAllowed("/dashboard", "acme", () => false)).toBe(true);
+            expect(isRedirectUriAllowed("//evil.example/cb", "acme", [])).toBe(false);
+        });
+
+        it("should always allow the always-allowed entries (e.g. provider callbackUrl)", () => {
+            const allowed: string[] = [];
+            const callbackUrl = "https://api.example.com/oidc/acme/callback";
+
+            expect(isRedirectUriAllowed(callbackUrl, "acme", allowed, [callbackUrl])).toBe(true);
+            expect(isRedirectUriAllowed("https://evil.example/cb", "acme", allowed, [callbackUrl])).toBe(false);
+        });
+
+        it("should reject an empty allow-list", () => {
+            expect(isRedirectUriAllowed("https://app.example.com/cb", "acme", [])).toBe(false);
+        });
+
+        it("should reject unparsable values", () => {
+            expect(isRedirectUriAllowed("not a url", "acme", ["https://app.example.com"])).toBe(false);
+        });
+    });
+});

package/src/OidcPlugin.ts

@@ -135,6 +135,26 @@ export function oidcPlugin<TCtx = any>(options: OidcPluginOptions<TCtx>): FlinkP
         throw new Error("OIDC Plugin: onAuthSuccess callback is required");
     }
 
+    // Redirect URI allow-list. Absent = every redirectUri is accepted (legacy behaviour),
+    // which lets a crafted initiate link deliver the app's JWT to any URL.
+    if (options.allowedRedirectUris === undefined) {
+        log.warn("OIDC Plugin: allowedRedirectUris is not set — any redirectUri passed to /initiate is accepted. Set it to the URLs your clients use.");
+    } else if (typeof options.allowedRedirectUris !== "function") {
+        if (!Array.isArray(options.allowedRedirectUris) || options.allowedRedirectUris.some((entry) => typeof entry !== "string" || !entry)) {
+            throw new Error("OIDC Plugin: allowedRedirectUris must be an array of non-empty strings or a predicate function");
+        }
+        oidcLog.debug(`Redirect URI allow-list: [${options.allowedRedirectUris.join(", ")}]`);
+    } else {
+        oidcLog.debug("Redirect URI allow-list: predicate function");
+    }
+
+    // Provider cache TTL (0 = cache for the life of the process, unchanged behaviour)
+    const providerCacheTtlSec = options.providerCacheTtlSec ?? 0;
+
+    if (typeof providerCacheTtlSec !== "number" || !Number.isFinite(providerCacheTtlSec) || providerCacheTtlSec < 0) {
+        throw new Error("OIDC Plugin: providerCacheTtlSec must be a non-negative number of seconds");
+    }
+
     // Determine encryption key
     let encryptionKey = options.encryptionKey;
     if (!encryptionKey) {
@@ -195,6 +215,7 @@ export function oidcPlugin<TCtx = any>(options: OidcPluginOptions<TCtx>): FlinkP
                 `connectionsCollection=${connectionsCollectionName}`,
                 `storeTokens=${!!options.storeTokens}`,
                 `sessionTTL=${options.sessionTTL ?? 600}s`,
+                `providerCacheTtl=${providerCacheTtlSec > 0 ? `${providerCacheTtlSec}s` : "forever"}`,
                 `registerRoutes=${options.registerRoutes !== false}`,
                 configuredProviders.length > 0 ? `staticProviders=[${configuredProviders.join(", ")}]` : "staticProviders=[] (dynamic only)",
                 options.providerLoader ? "providerLoader=yes" : "providerLoader=no"
@@ -213,7 +234,7 @@ export function oidcPlugin<TCtx = any>(options: OidcPluginOptions<TCtx>): FlinkP
             log.info(`OIDC Plugin: Created TTL index on ${sessionsCollectionName} with ${sessionTTL}s expiration`);
 
             // Initialize provider registry
-            providerRegistry = new ProviderRegistry(providers, options.providerLoader, flinkApp.ctx);
+            providerRegistry = new ProviderRegistry(providers, options.providerLoader, flinkApp.ctx, providerCacheTtlSec);
 
             // Store provider registry in app context for handlers to access
             (flinkApp.ctx as any).oidcProviderRegistry = providerRegistry;
@@ -302,6 +323,21 @@ export function oidcPlugin<TCtx = any>(options: OidcPluginOptions<TCtx>): FlinkP
         log.info(`OIDC Plugin: Deleted ${provider} connection for user ${userId}`);
     }
 
+    /**
+     * Drop cached provider instance(s) so the next request re-runs providerLoader
+     * and OIDC discovery
+     */
+    function invalidateProvider(providerName?: string): void {
+        if (!providerRegistry) {
+            // Nothing is cached before init, so there is nothing to invalidate
+            oidcLog.debug("invalidateProvider called before plugin init, nothing to do");
+            return;
+        }
+
+        providerRegistry.clearCache(providerName);
+        log.info(`OIDC Plugin: invalidated provider cache for ${providerName ? `"${providerName}"` : "all providers"}`);
+    }
+
     /**
      * Plugin context exposed via ctx.plugins.oidc
      */
@@ -309,6 +345,7 @@ export function oidcPlugin<TCtx = any>(options: OidcPluginOptions<TCtx>): FlinkP
         getConnection,
         getConnections,
         deleteConnection,
+        invalidateProvider,
         options: Object.freeze({ ...options }),
     };
 

package/src/OidcPluginContext.ts

@@ -67,6 +67,24 @@ export interface OidcPluginContext {
          */
         deleteConnection: (userId: string, provider: string) => Promise<void>;
 
+        /**
+         * Drop cached provider instance(s) so the next request re-runs `providerLoader`
+         * and OIDC discovery for them.
+         *
+         * Call this when provider configuration changes at runtime, e.g. from the handler
+         * where an admin saves IdP settings. Only affects the instance it runs on — with
+         * `providerCacheTtlSec` set, other instances converge within the TTL.
+         *
+         * @param providerName - Provider to invalidate (all providers if omitted)
+         *
+         * Example:
+         * ```typescript
+         * await ctx.repos.oidcProviderRepo.updateById(id, { clientSecret });
+         * ctx.plugins.oidc.invalidateProvider(providerName);
+         * ```
+         */
+        invalidateProvider: (providerName?: string) => void;
+
         /**
          * Plugin configuration options (read-only)
          * Useful for checking plugin settings at runtime