@flink-app/oidc-plugin 2.0.0-alpha.80 → 2.0.0-alpha.81

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @flink-app/oidc-plugin
 
+## 2.0.0-alpha.81
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.81
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.81
+
 ## 2.0.0-alpha.80
 
 ### Patch Changes

package/dist/handlers/CallbackOidc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CallbackOidc.d.ts","sourceRoot":"","sources":["../../src/handlers/CallbackOidc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAc,UAAU,EAAwC,MAAM,kBAAkB,CAAC;AAC5G,OAAO,eAAe,MAAM,4BAA4B,CAAC;AAOzD;;GAEG;AACH,UAAU,UAAU;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,eAAO,MAAM,KAAK,EAAE,UAGnB,CAAC;AAEF;;;;;;GAMG;AACH,QAAA,MAAM,YAAY,EAAE,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,eAAe,CA4PnE,CAAC;AAEF,eAAe,YAAY,CAAC"}
+{"version":3,"file":"CallbackOidc.d.ts","sourceRoot":"","sources":["../../src/handlers/CallbackOidc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAc,UAAU,EAAwC,MAAM,kBAAkB,CAAC;AAC5G,OAAO,eAAe,MAAM,4BAA4B,CAAC;AAOzD;;GAEG;AACH,UAAU,UAAU;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,eAAO,MAAM,KAAK,EAAE,UAGnB,CAAC;AAEF;;;;;;GAMG;AACH,QAAA,MAAM,YAAY,EAAE,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,eAAe,CA8PnE,CAAC;AAEF,eAAe,YAAY,CAAC"}

package/dist/handlers/CallbackOidc.js

@@ -182,6 +182,7 @@ const CallbackOidc = async ({ ctx, req }) => {
                 // Create or update OIDC connection
                 const existingConnection = await ctx.repos.oidcConnectionRepo.findByUserAndProvider(user._id, provider);
                 if (existingConnection) {
+                    log_1.oidcLog.debug(`Callback: updating existing connection for userId=${user._id} provider="${provider}"`);
                     await ctx.repos.oidcConnectionRepo.updateById(existingConnection._id, {
                         accessToken: encryptedAccessToken,
                         idToken: encryptedIdToken,
@@ -192,6 +193,7 @@ const CallbackOidc = async ({ ctx, req }) => {
                     });
                 }
                 else {
+                    log_1.oidcLog.debug(`Callback: creating new connection for userId=${user._id} provider="${provider}" subject="${tokenSet.claims.sub}"`);
                     await ctx.repos.oidcConnectionRepo.create({
                         userId: user._id,
                         provider,

package/dist/handlers/InitiateOidc.js

@@ -74,7 +74,7 @@ const InitiateOidc = async ({ ctx, req }) => {
             codeVerifier,
             nonce,
         });
-        log_1.oidcLog.debug(`Initiate: redirecting to IdP authorization URL`);
+        log_1.oidcLog.debug(`Initiate: redirecting to IdP authorization URL: ${authorizationUrl}`);
         // Redirect user to provider's authorization page
         return {
             status: 302,

package/dist/providers/OidcProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OidcProvider.d.ts","sourceRoot":"","sources":["../../src/providers/OidcProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwD,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvG,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,WAAW,MAAM,wBAAwB,CAAC;AACjD,OAAO,YAAY,MAAM,yBAAyB,CAAC;AAInD;;;;;;;;;;GAUG;AACH,qBAAa,YAAY;IACrB,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,MAAM,CAA+B;IAC7C,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,WAAW,CAAkB;gBAEzB,MAAM,EAAE,kBAAkB;IAItC;;;;;;;OAOG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA0DjC;;;;;OAKG;IACG,mBAAmB,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAiB1G;;;;;;;OAOG;IACG,oBAAoB,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAqC/H;;;;;;;;OAQG;IACG,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAajE;;;;;;;;;OASG;IACG,YAAY,CAAC,QAAQ,EAAE,YAAY,EAAE,eAAe,GAAE,OAAc,GAAG,OAAO,CAAC,WAAW,CAAC;IA2BjG;;;;OAIG;YACW,iBAAiB;IAU/B;;;;OAIG;IACH,iBAAiB,IAAI,GAAG;CAM3B"}
+{"version":3,"file":"OidcProvider.d.ts","sourceRoot":"","sources":["../../src/providers/OidcProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwD,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvG,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,WAAW,MAAM,wBAAwB,CAAC;AACjD,OAAO,YAAY,MAAM,yBAAyB,CAAC;AAKnD;;;;;;;;;;GAUG;AACH,qBAAa,YAAY;IACrB,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,MAAM,CAA+B;IAC7C,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,WAAW,CAAkB;gBAEzB,MAAM,EAAE,kBAAkB;IAItC;;;;;;;OAOG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAkEjC;;;;;OAKG;IACG,mBAAmB,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAiB1G;;;;;;;OAOG;IACG,oBAAoB,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAqC/H;;;;;;;;OAQG;IACG,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAajE;;;;;;;;;OASG;IACG,YAAY,CAAC,QAAQ,EAAE,YAAY,EAAE,eAAe,GAAE,OAAc,GAAG,OAAO,CAAC,WAAW,CAAC;IA2BjG;;;;OAIG;YACW,iBAAiB;IAU/B;;;;OAIG;IACH,iBAAiB,IAAI,GAAG;CAM3B"}

package/dist/providers/OidcProvider.js

@@ -4,6 +4,7 @@ exports.OidcProvider = void 0;
 const openid_client_1 = require("openid-client");
 const claims_mapper_1 = require("../utils/claims-mapper");
 const error_utils_1 = require("../utils/error-utils");
+const log_1 = require("../log");
 /**
  * Generic OIDC Provider implementation using openid-client
  *
@@ -37,7 +38,9 @@ class OidcProvider {
         try {
             // Option 1: OIDC Discovery
             if (this.config.discoveryUrl) {
+                log_1.oidcLog.debug(`Provider "${this.config.issuer}": discovering from ${this.config.discoveryUrl}`);
                 this.issuer = await openid_client_1.Issuer.discover(this.config.discoveryUrl);
+                log_1.oidcLog.debug(`Provider "${this.config.issuer}": discovery complete`, `authorization_endpoint=${this.issuer.metadata.authorization_endpoint}`, `token_endpoint=${this.issuer.metadata.token_endpoint}`, `userinfo_endpoint=${this.issuer.metadata.userinfo_endpoint ?? "(none)"}`, `jwks_uri=${this.issuer.metadata.jwks_uri}`);
             }
             // Option 2: Manual configuration
             else {
@@ -178,7 +181,7 @@ class OidcProvider {
             }
             catch (error) {
                 // UserInfo is optional - continue with ID token claims only
-                console.warn("Failed to fetch UserInfo, using ID token claims only:", error);
+                log_1.oidcLog.warn(`Failed to fetch UserInfo from ${this.config.userinfoEndpoint}, using ID token claims only:`, error);
             }
         }
         // Apply custom claim mapping if configured

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flink-app/oidc-plugin",
-  "version": "2.0.0-alpha.80",
+  "version": "2.0.0-alpha.81",
   "description": "Flink plugin for OIDC authentication with generic IdP support",
   "author": "joel@frost.se",
   "license": "MIT",
@@ -11,10 +11,10 @@
   },
   "dependencies": {
     "openid-client": "^5.7.0",
-    "@flink-app/jwt-auth-plugin": "2.0.0-alpha.80"
+    "@flink-app/jwt-auth-plugin": "2.0.0-alpha.81"
   },
   "peerDependencies": {
-    "@flink-app/flink": ">=2.0.0-alpha.80",
+    "@flink-app/flink": ">=2.0.0-alpha.81",
     "mongodb": "^6.15.0"
   },
   "peerDependenciesMeta": {
@@ -27,9 +27,9 @@
     "@types/node": "22.13.10",
     "ts-node": "^10.9.2",
     "tsc-watch": "^4.2.9",
-    "@flink-app/jwt-auth-plugin": "2.0.0-alpha.80",
-    "@flink-app/test-utils": "2.0.0-alpha.80",
-    "@flink-app/flink": "2.0.0-alpha.80"
+    "@flink-app/flink": "2.0.0-alpha.81",
+    "@flink-app/jwt-auth-plugin": "2.0.0-alpha.81",
+    "@flink-app/test-utils": "2.0.0-alpha.81"
   },
   "scripts": {
     "test": "jasmine-ts --config=./spec/support/jasmine.json",

package/src/handlers/CallbackOidc.ts

@@ -231,6 +231,7 @@ const CallbackOidc: GetHandler<any, any, PathParams, CallbackRequest> = async ({
                 const existingConnection = await ctx.repos.oidcConnectionRepo.findByUserAndProvider(user._id, provider);
 
                 if (existingConnection) {
+                    oidcLog.debug(`Callback: updating existing connection for userId=${user._id} provider="${provider}"`);
                     await ctx.repos.oidcConnectionRepo.updateById(existingConnection._id!, {
                         accessToken: encryptedAccessToken,
                         idToken: encryptedIdToken,
@@ -240,6 +241,7 @@ const CallbackOidc: GetHandler<any, any, PathParams, CallbackRequest> = async ({
                         updatedAt: new Date(),
                     });
                 } else {
+                    oidcLog.debug(`Callback: creating new connection for userId=${user._id} provider="${provider}" subject="${tokenSet.claims.sub}"`);
                     await ctx.repos.oidcConnectionRepo.create({
                         userId: user._id,
                         provider,

package/src/handlers/InitiateOidc.ts

@@ -95,7 +95,7 @@ const InitiateOidc: GetHandler<any, any, PathParams, InitiateRequest> = async ({
             nonce,
         });
 
-        oidcLog.debug(`Initiate: redirecting to IdP authorization URL`);
+        oidcLog.debug(`Initiate: redirecting to IdP authorization URL: ${authorizationUrl}`);
 
         // Redirect user to provider's authorization page
         return {

package/src/providers/OidcProvider.ts

@@ -4,6 +4,7 @@ import OidcProfile from "../schemas/OidcProfile";
 import OidcTokenSet from "../schemas/OidcTokenSet";
 import { mapClaimsToProfile, extractCustomClaims } from "../utils/claims-mapper";
 import { createOidcError, OidcErrorCodes } from "../utils/error-utils";
+import { oidcLog } from "../log";
 
 /**
  * Generic OIDC Provider implementation using openid-client
@@ -42,7 +43,15 @@ export class OidcProvider {
         try {
             // Option 1: OIDC Discovery
             if (this.config.discoveryUrl) {
+                oidcLog.debug(`Provider "${this.config.issuer}": discovering from ${this.config.discoveryUrl}`);
                 this.issuer = await Issuer.discover(this.config.discoveryUrl);
+                oidcLog.debug(
+                    `Provider "${this.config.issuer}": discovery complete`,
+                    `authorization_endpoint=${this.issuer.metadata.authorization_endpoint}`,
+                    `token_endpoint=${this.issuer.metadata.token_endpoint}`,
+                    `userinfo_endpoint=${this.issuer.metadata.userinfo_endpoint ?? "(none)"}`,
+                    `jwks_uri=${this.issuer.metadata.jwks_uri}`
+                );
             }
             // Option 2: Manual configuration
             else {
@@ -203,7 +212,7 @@ export class OidcProvider {
                 claims = { ...claims, ...userinfo };
             } catch (error) {
                 // UserInfo is optional - continue with ID token claims only
-                console.warn("Failed to fetch UserInfo, using ID token claims only:", error);
+                oidcLog.warn(`Failed to fetch UserInfo from ${this.config.userinfoEndpoint}, using ID token claims only:`, error);
             }
         }