@flink-app/oidc-plugin 2.0.0-alpha.87 → 2.0.0-alpha.89

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @flink-app/oidc-plugin
 
+## 2.0.0-alpha.89
+
+### Patch Changes
+
+-   Fix OIDC trace logs
+    -   @flink-app/flink@2.0.0-alpha.89
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.89
+
+## 2.0.0-alpha.88
+
+### Patch Changes
+
+-   5f3919e: fix(oidc-plugin): use discovered userinfo endpoint in buildProfile when no manual endpoint is configured
+    -   @flink-app/flink@2.0.0-alpha.88
+    -   @flink-app/jwt-auth-plugin@2.0.0-alpha.88
+
 ## 2.0.0-alpha.87
 
 ### Patch Changes

package/dist/providers/OidcProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OidcProvider.d.ts","sourceRoot":"","sources":["../../src/providers/OidcProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwD,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvG,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,WAAW,MAAM,wBAAwB,CAAC;AACjD,OAAO,YAAY,MAAM,yBAAyB,CAAC;AAKnD;;;;;;;;;;GAUG;AACH,qBAAa,YAAY;IACrB,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,MAAM,CAA+B;IAC7C,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,WAAW,CAAkB;gBAEzB,MAAM,EAAE,kBAAkB;IAItC;;;;;;;OAOG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAkEjC;;;;;OAKG;IACG,mBAAmB,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAiB1G;;;;;;;OAOG;IACG,oBAAoB,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAqC/H;;;;;;;;OAQG;IACG,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAajE;;;;;;;;;OASG;IACG,YAAY,CAAC,QAAQ,EAAE,YAAY,EAAE,eAAe,GAAE,OAAc,GAAG,OAAO,CAAC,WAAW,CAAC;IA2BjG;;;;OAIG;YACW,iBAAiB;IAU/B;;;;OAIG;IACH,iBAAiB,IAAI,GAAG;CAM3B"}
+{"version":3,"file":"OidcProvider.d.ts","sourceRoot":"","sources":["../../src/providers/OidcProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwD,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvG,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,WAAW,MAAM,wBAAwB,CAAC;AACjD,OAAO,YAAY,MAAM,yBAAyB,CAAC;AAKnD;;;;;;;;;;GAUG;AACH,qBAAa,YAAY;IACrB,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,MAAM,CAA+B;IAC7C,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,WAAW,CAAkB;gBAEzB,MAAM,EAAE,kBAAkB;IAItC;;;;;;;OAOG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAkEjC;;;;;OAKG;IACG,mBAAmB,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAiB1G;;;;;;;OAOG;IACG,oBAAoB,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAsC/H;;;;;;;;OAQG;IACG,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAajE;;;;;;;;;OASG;IACG,YAAY,CAAC,QAAQ,EAAE,YAAY,EAAE,eAAe,GAAE,OAAc,GAAG,OAAO,CAAC,WAAW,CAAC;IAiCjG;;;;OAIG;YACW,iBAAiB;IAU/B;;;;OAIG;IACH,iBAAiB,IAAI,GAAG;CAM3B"}

package/dist/providers/OidcProvider.js

@@ -122,6 +122,7 @@ class OidcProvider {
             });
             // Extract claims from ID token (already validated by openid-client)
             const claims = tokenSet.claims();
+            log_1.oidcLog.trace(`Provider "${this.config.issuer}": extracted claims from ID token`, claims);
             return {
                 accessToken: tokenSet.access_token,
                 idToken: tokenSet.id_token,
@@ -173,24 +174,29 @@ class OidcProvider {
     async buildProfile(tokenSet, includeUserInfo = true) {
         let claims = { ...tokenSet.claims };
         // Optionally fetch additional claims from UserInfo endpoint
-        if (includeUserInfo && this.config.userinfoEndpoint) {
+        // Check both manual config and discovered endpoint (via OIDC discovery)
+        const userinfoUrl = this.config.userinfoEndpoint || this.issuer?.metadata?.userinfo_endpoint;
+        if (includeUserInfo && userinfoUrl) {
             try {
                 const userinfo = await this.getUserInfo(tokenSet.accessToken);
                 // Merge UserInfo claims with ID token claims
                 claims = { ...claims, ...userinfo };
+                log_1.oidcLog.trace(`Provider "${this.config.issuer}": merged claims after UserInfo`, claims);
             }
             catch (error) {
                 // UserInfo is optional - continue with ID token claims only
-                log_1.oidcLog.warn(`Failed to fetch UserInfo from ${this.config.userinfoEndpoint}, using ID token claims only:`, error);
+                log_1.oidcLog.warn(`Failed to fetch UserInfo from ${userinfoUrl}, using ID token claims only:`, error);
             }
         }
         // Apply custom claim mapping if configured
         if (this.config.claimMapping) {
             const customClaims = (0, claims_mapper_1.extractCustomClaims)(claims, this.config.claimMapping);
             claims = { ...claims, ...customClaims };
+            log_1.oidcLog.trace(`Provider "${this.config.issuer}": applied custom claim mapping`, claims);
         }
         // Map to normalized profile
         const profile = (0, claims_mapper_1.mapClaimsToProfile)(claims);
+        log_1.oidcLog.trace(`Provider "${this.config.issuer}": built final profile`, profile);
         return profile;
     }
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flink-app/oidc-plugin",
-  "version": "2.0.0-alpha.87",
+  "version": "2.0.0-alpha.89",
   "description": "Flink plugin for OIDC authentication with generic IdP support",
   "author": "joel@frost.se",
   "license": "MIT",
@@ -11,10 +11,10 @@
   },
   "dependencies": {
     "openid-client": "^5.7.0",
-    "@flink-app/jwt-auth-plugin": "2.0.0-alpha.87"
+    "@flink-app/jwt-auth-plugin": "2.0.0-alpha.89"
   },
   "peerDependencies": {
-    "@flink-app/flink": ">=2.0.0-alpha.87",
+    "@flink-app/flink": ">=2.0.0-alpha.89",
     "mongodb": "^6.15.0"
   },
   "peerDependenciesMeta": {
@@ -27,9 +27,9 @@
     "@types/node": "22.13.10",
     "ts-node": "^10.9.2",
     "tsc-watch": "^4.2.9",
-    "@flink-app/test-utils": "2.0.0-alpha.87",
-    "@flink-app/jwt-auth-plugin": "2.0.0-alpha.87",
-    "@flink-app/flink": "2.0.0-alpha.87"
+    "@flink-app/flink": "2.0.0-alpha.89",
+    "@flink-app/test-utils": "2.0.0-alpha.89",
+    "@flink-app/jwt-auth-plugin": "2.0.0-alpha.89"
   },
   "scripts": {
     "test": "jasmine-ts --config=./spec/support/jasmine.json",

package/src/providers/OidcProvider.ts

@@ -151,6 +151,7 @@ export class OidcProvider {
 
             // Extract claims from ID token (already validated by openid-client)
             const claims = tokenSet.claims();
+            oidcLog.trace(`Provider "${this.config.issuer}": extracted claims from ID token`, claims);
 
             return {
                 accessToken: tokenSet.access_token!,
@@ -205,14 +206,18 @@ export class OidcProvider {
         let claims = { ...tokenSet.claims };
 
         // Optionally fetch additional claims from UserInfo endpoint
-        if (includeUserInfo && this.config.userinfoEndpoint) {
+        // Check both manual config and discovered endpoint (via OIDC discovery)
+        const userinfoUrl = this.config.userinfoEndpoint || this.issuer?.metadata?.userinfo_endpoint;
+
+        if (includeUserInfo && userinfoUrl) {
             try {
                 const userinfo = await this.getUserInfo(tokenSet.accessToken);
                 // Merge UserInfo claims with ID token claims
                 claims = { ...claims, ...userinfo };
+                oidcLog.trace(`Provider "${this.config.issuer}": merged claims after UserInfo`, claims);
             } catch (error) {
                 // UserInfo is optional - continue with ID token claims only
-                oidcLog.warn(`Failed to fetch UserInfo from ${this.config.userinfoEndpoint}, using ID token claims only:`, error);
+                oidcLog.warn(`Failed to fetch UserInfo from ${userinfoUrl}, using ID token claims only:`, error);
             }
         }
 
@@ -220,10 +225,12 @@ export class OidcProvider {
         if (this.config.claimMapping) {
             const customClaims = extractCustomClaims(claims, this.config.claimMapping);
             claims = { ...claims, ...customClaims };
+            oidcLog.trace(`Provider "${this.config.issuer}": applied custom claim mapping`, claims);
         }
 
         // Map to normalized profile
         const profile = mapClaimsToProfile(claims);
+        oidcLog.trace(`Provider "${this.config.issuer}": built final profile`, profile);
 
         return profile;
     }