@flink-app/oidc-plugin 2.0.0-alpha.77 → 2.0.0-alpha.79

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @flink-app/oidc-plugin
 
+## 2.0.0-alpha.79
+
+### Patch Changes
+
+-   Expose redirectUri from session in onAuthSuccess and onAuthError callbacks, enabling multi-client redirect decisions
+    -   @flink-app/flink@2.0.0-alpha.79
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.79
+
+## 2.0.0-alpha.78
+
+### Patch Changes
+
+-   Fix optional chaining on providers in handlers after making providers optional
+    -   @flink-app/flink@2.0.0-alpha.78
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.78
+
 ## 2.0.0-alpha.77
 
 ### Minor Changes

package/dist/OidcPluginOptions.d.ts

@@ -158,6 +158,16 @@ export interface OidcPluginOptions<TCtx = any> {
          * Provider name (e.g., "acme", "contoso")
          */
         provider: string;
+        /**
+         * The redirectUri passed on the initiate request (stored in session)
+         * Use this to redirect back to the originating client application.
+         *
+         * Example:
+         * ```typescript
+         * return { user, token, redirectUrl: redirectUri || DEFAULT_REDIRECT_URL };
+         * ```
+         */
+        redirectUri: string;
         /**
          * OIDC tokens (only if storeTokens: true)
          * Includes accessToken, idToken, refreshToken
@@ -194,6 +204,12 @@ export interface OidcPluginOptions<TCtx = any> {
     onAuthError?: (params: {
         error: OidcError;
         provider: string;
+        /**
+         * The redirectUri from the initiate request (if available)
+         * May be undefined for errors that occur before session lookup
+         * (e.g., IdP returns an error before we can retrieve the session)
+         */
+        redirectUri?: string;
     }) => Promise<AuthErrorCallbackResponse>;
     /**
      * Dynamic provider loader callback

package/dist/OidcPluginOptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OidcPluginOptions.d.ts","sourceRoot":"","sources":["../src/OidcPluginOptions.ts"],"names":[],"mappings":"AAAA,OAAO,WAAW,MAAM,uBAAuB,CAAC;AAChD,OAAO,YAAY,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;GAEG;AACH,MAAM,WAAW,SAAS;IACtB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,OAAO,CAAC,EAAE,GAAG,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IACxC;;;OAGG;IACH,IAAI,EAAE,GAAG,CAAC;IAEV;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACtC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB,CAAC,IAAI,GAAG,GAAG;IACzC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAE/C;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;IACH,aAAa,EAAE,CACX,MAAM,EAAE;QACJ;;WAEG;QACH,OAAO,EAAE,WAAW,CAAC;QAErB;;;WAGG;QACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAE5B;;WAEG;QACH,QAAQ,EAAE,MAAM,CAAC;QAEjB;;;WAGG;QACH,MAAM,CAAC,EAAE,YAAY,CAAC;KACzB,EACD,GAAG,EAAE,IAAI,KACR,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,SAAS,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAErG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAEzF;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEhC;;;OAGG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAEnC;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC5B"}
+{"version":3,"file":"OidcPluginOptions.d.ts","sourceRoot":"","sources":["../src/OidcPluginOptions.ts"],"names":[],"mappings":"AAAA,OAAO,WAAW,MAAM,uBAAuB,CAAC;AAChD,OAAO,YAAY,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;GAEG;AACH,MAAM,WAAW,SAAS;IACtB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,OAAO,CAAC,EAAE,GAAG,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IACxC;;;OAGG;IACH,IAAI,EAAE,GAAG,CAAC;IAEV;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACtC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB,CAAC,IAAI,GAAG,GAAG;IACzC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAE/C;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;IACH,aAAa,EAAE,CACX,MAAM,EAAE;QACJ;;WAEG;QACH,OAAO,EAAE,WAAW,CAAC;QAErB;;;WAGG;QACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAE5B;;WAEG;QACH,QAAQ,EAAE,MAAM,CAAC;QAEjB;;;;;;;;WAQG;QACH,WAAW,EAAE,MAAM,CAAC;QAEpB;;;WAGG;QACH,MAAM,CAAC,EAAE,YAAY,CAAC;KACzB,EACD,GAAG,EAAE,IAAI,KACR,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE;QACnB,KAAK,EAAE,SAAS,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB;;;;WAIG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC;KACxB,KAAK,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAEzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAEzF;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEhC;;;OAGG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAEnC;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC5B"}

package/dist/handlers/CallbackOidc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CallbackOidc.d.ts","sourceRoot":"","sources":["../../src/handlers/CallbackOidc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAc,UAAU,EAAwC,MAAM,kBAAkB,CAAC;AAC5G,OAAO,eAAe,MAAM,4BAA4B,CAAC;AAMzD;;GAEG;AACH,UAAU,UAAU;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,eAAO,MAAM,KAAK,EAAE,UAGnB,CAAC;AAEF;;;;;;GAMG;AACH,QAAA,MAAM,YAAY,EAAE,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,eAAe,CAgNnE,CAAC;AAEF,eAAe,YAAY,CAAC"}
+{"version":3,"file":"CallbackOidc.d.ts","sourceRoot":"","sources":["../../src/handlers/CallbackOidc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAc,UAAU,EAAwC,MAAM,kBAAkB,CAAC;AAC5G,OAAO,eAAe,MAAM,4BAA4B,CAAC;AAMzD;;GAEG;AACH,UAAU,UAAU;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,eAAO,MAAM,KAAK,EAAE,UAGnB,CAAC;AAEF;;;;;;GAMG;AACH,QAAA,MAAM,YAAY,EAAE,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,eAAe,CAmOnE,CAAC;AAEF,eAAe,YAAY,CAAC"}

package/dist/handlers/CallbackOidc.js

@@ -38,6 +38,8 @@ exports.Route = {
 const CallbackOidc = async ({ ctx, req }) => {
     const { provider } = req.params;
     const { code, state, error: oidcError, error_description, response_type } = req.query;
+    // Track session outside try/catch so redirectUri is available in error handling
+    let sessionRedirectUri;
     try {
         // Validate provider and response_type
         (0, error_utils_1.validateProvider)(provider);
@@ -45,12 +47,21 @@ const CallbackOidc = async ({ ctx, req }) => {
         // Check for OIDC provider errors (e.g., user denied access)
         if (oidcError) {
             const error = (0, error_utils_1.handleProviderError)({ error: oidcError, error_description });
+            // Try to retrieve session redirectUri (state may be available even on IdP errors)
+            if (state) {
+                const errorSession = await ctx.repos.oidcSessionRepo.getByState(state);
+                sessionRedirectUri = errorSession?.redirectUri;
+                if (errorSession) {
+                    await ctx.repos.oidcSessionRepo.deleteBySessionId(errorSession.sessionId);
+                }
+            }
             // Call onAuthError callback if provided
             const { options } = ctx.plugins.oidc;
             if (options.onAuthError) {
                 const errorResult = await options.onAuthError({
                     error,
                     provider,
+                    redirectUri: sessionRedirectUri,
                 });
                 if (errorResult.redirectUrl) {
                     return {
@@ -80,6 +91,8 @@ const CallbackOidc = async ({ ctx, req }) => {
                 providedState: state.substring(0, 10) + "...",
             });
         }
+        // Track redirectUri for error handling
+        sessionRedirectUri = session.redirectUri;
         // Delete session immediately after validation (one-time use)
         await ctx.repos.oidcSessionRepo.deleteBySessionId(session.sessionId);
         // Get plugin options
@@ -104,6 +117,7 @@ const CallbackOidc = async ({ ctx, req }) => {
             profile,
             claims: tokenSet.claims,
             provider,
+            redirectUri: session.redirectUri,
             ...(options.storeTokens ? { tokens: tokenSet } : {}),
         };
         let authResult;
@@ -121,6 +135,7 @@ const CallbackOidc = async ({ ctx, req }) => {
                 const errorResult = await options.onAuthError({
                     error: oidcError,
                     provider,
+                    redirectUri: session.redirectUri,
                 });
                 if (errorResult.redirectUrl) {
                     return {
@@ -140,7 +155,7 @@ const CallbackOidc = async ({ ctx, req }) => {
         // Store OIDC connection if token storage is enabled
         if (options.storeTokens && user && user._id) {
             // Get encryption secret (use provider client secret or global encryption key)
-            const staticProviderConfig = options.providers[provider];
+            const staticProviderConfig = options.providers?.[provider];
             const encryptionSecret = options.encryptionKey || staticProviderConfig?.clientSecret;
             if (!encryptionSecret) {
                 flink_1.log.warn("No encryption secret available, tokens will not be stored");
@@ -196,6 +211,7 @@ const CallbackOidc = async ({ ctx, req }) => {
                     const errorResult = await options.onAuthError({
                         error,
                         provider,
+                        redirectUri: sessionRedirectUri,
                     });
                     if (errorResult.redirectUrl) {
                         return {

package/dist/handlers/InitiateOidc.js

@@ -47,7 +47,7 @@ const InitiateOidc = async ({ ctx, req }) => {
         // Get plugin options
         const { options } = ctx.plugins.oidc;
         // Determine redirect URI (use provided or default to callback URL)
-        const staticProviderConfig = options.providers[provider];
+        const staticProviderConfig = options.providers?.[provider];
         const finalRedirectUri = redirectUri || staticProviderConfig?.callbackUrl || `${req.protocol}://${req.get("host")}/oidc/${provider}/callback`;
         // Generate cryptographically secure parameters
         const state = (0, state_utils_1.generateState)();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flink-app/oidc-plugin",
-  "version": "2.0.0-alpha.77",
+  "version": "2.0.0-alpha.79",
   "description": "Flink plugin for OIDC authentication with generic IdP support",
   "author": "joel@frost.se",
   "license": "MIT",
@@ -11,10 +11,10 @@
   },
   "dependencies": {
     "openid-client": "^5.7.0",
-    "@flink-app/jwt-auth-plugin": "2.0.0-alpha.77"
+    "@flink-app/jwt-auth-plugin": "2.0.0-alpha.79"
   },
   "peerDependencies": {
-    "@flink-app/flink": ">=2.0.0-alpha.77",
+    "@flink-app/flink": ">=2.0.0-alpha.79",
     "mongodb": "^6.15.0"
   },
   "peerDependenciesMeta": {
@@ -27,9 +27,9 @@
     "@types/node": "22.13.10",
     "ts-node": "^10.9.2",
     "tsc-watch": "^4.2.9",
-    "@flink-app/flink": "2.0.0-alpha.77",
-    "@flink-app/test-utils": "2.0.0-alpha.77",
-    "@flink-app/jwt-auth-plugin": "2.0.0-alpha.77"
+    "@flink-app/jwt-auth-plugin": "2.0.0-alpha.79",
+    "@flink-app/test-utils": "2.0.0-alpha.79",
+    "@flink-app/flink": "2.0.0-alpha.79"
   },
   "scripts": {
     "test": "jasmine-ts --config=./spec/support/jasmine.json",

package/src/OidcPluginOptions.ts

@@ -172,6 +172,17 @@ export interface OidcPluginOptions<TCtx = any> {
              */
             provider: string;
 
+            /**
+             * The redirectUri passed on the initiate request (stored in session)
+             * Use this to redirect back to the originating client application.
+             *
+             * Example:
+             * ```typescript
+             * return { user, token, redirectUrl: redirectUri || DEFAULT_REDIRECT_URL };
+             * ```
+             */
+            redirectUri: string;
+
             /**
              * OIDC tokens (only if storeTokens: true)
              * Includes accessToken, idToken, refreshToken
@@ -208,7 +219,16 @@ export interface OidcPluginOptions<TCtx = any> {
      * }
      * ```
      */
-    onAuthError?: (params: { error: OidcError; provider: string }) => Promise<AuthErrorCallbackResponse>;
+    onAuthError?: (params: {
+        error: OidcError;
+        provider: string;
+        /**
+         * The redirectUri from the initiate request (if available)
+         * May be undefined for errors that occur before session lookup
+         * (e.g., IdP returns an error before we can retrieve the session)
+         */
+        redirectUri?: string;
+    }) => Promise<AuthErrorCallbackResponse>;
 
     /**
      * Dynamic provider loader callback

package/src/handlers/CallbackOidc.ts

@@ -48,6 +48,9 @@ const CallbackOidc: GetHandler<any, any, PathParams, CallbackRequest> = async ({
     const { provider } = req.params;
     const { code, state, error: oidcError, error_description, response_type } = req.query;
 
+    // Track session outside try/catch so redirectUri is available in error handling
+    let sessionRedirectUri: string | undefined;
+
     try {
         // Validate provider and response_type
         validateProvider(provider);
@@ -57,12 +60,22 @@ const CallbackOidc: GetHandler<any, any, PathParams, CallbackRequest> = async ({
         if (oidcError) {
             const error = handleProviderError({ error: oidcError, error_description });
 
+            // Try to retrieve session redirectUri (state may be available even on IdP errors)
+            if (state) {
+                const errorSession = await ctx.repos.oidcSessionRepo.getByState(state);
+                sessionRedirectUri = errorSession?.redirectUri;
+                if (errorSession) {
+                    await ctx.repos.oidcSessionRepo.deleteBySessionId(errorSession.sessionId);
+                }
+            }
+
             // Call onAuthError callback if provided
             const { options } = ctx.plugins.oidc;
             if (options.onAuthError) {
                 const errorResult = await options.onAuthError({
                     error,
                     provider,
+                    redirectUri: sessionRedirectUri,
                 });
 
                 if (errorResult.redirectUrl) {
@@ -99,6 +112,9 @@ const CallbackOidc: GetHandler<any, any, PathParams, CallbackRequest> = async ({
             });
         }
 
+        // Track redirectUri for error handling
+        sessionRedirectUri = session.redirectUri;
+
         // Delete session immediately after validation (one-time use)
         await ctx.repos.oidcSessionRepo.deleteBySessionId(session.sessionId);
 
@@ -129,6 +145,7 @@ const CallbackOidc: GetHandler<any, any, PathParams, CallbackRequest> = async ({
             profile,
             claims: tokenSet.claims,
             provider,
+            redirectUri: session.redirectUri,
             ...(options.storeTokens ? { tokens: tokenSet } : {}),
         };
 
@@ -148,6 +165,7 @@ const CallbackOidc: GetHandler<any, any, PathParams, CallbackRequest> = async ({
                 const errorResult = await options.onAuthError({
                     error: oidcError,
                     provider,
+                    redirectUri: session.redirectUri,
                 });
 
                 if (errorResult.redirectUrl) {
@@ -172,7 +190,7 @@ const CallbackOidc: GetHandler<any, any, PathParams, CallbackRequest> = async ({
         // Store OIDC connection if token storage is enabled
         if (options.storeTokens && user && user._id) {
             // Get encryption secret (use provider client secret or global encryption key)
-            const staticProviderConfig = options.providers[provider];
+            const staticProviderConfig = options.providers?.[provider];
             const encryptionSecret = options.encryptionKey || staticProviderConfig?.clientSecret;
 
             if (!encryptionSecret) {
@@ -231,6 +249,7 @@ const CallbackOidc: GetHandler<any, any, PathParams, CallbackRequest> = async ({
                     const errorResult = await options.onAuthError({
                         error,
                         provider,
+                        redirectUri: sessionRedirectUri,
                     });
 
                     if (errorResult.redirectUrl) {

package/src/handlers/InitiateOidc.ts

@@ -61,7 +61,7 @@ const InitiateOidc: GetHandler<any, any, PathParams, InitiateRequest> = async ({
         const { options } = ctx.plugins.oidc;
 
         // Determine redirect URI (use provided or default to callback URL)
-        const staticProviderConfig = options.providers[provider];
+        const staticProviderConfig = options.providers?.[provider];
         const finalRedirectUri = redirectUri || staticProviderConfig?.callbackUrl || `${req.protocol}://${req.get("host")}/oidc/${provider}/callback`;
 
         // Generate cryptographically secure parameters