@flink-app/oidc-plugin 2.0.0-alpha.90 → 2.0.0-alpha.91

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @flink-app/oidc-plugin
 
+## 2.0.0-alpha.91
+
+### Minor Changes
+
+-   1bdbc82: feat(oidc-plugin): add per-provider `useUserInfoEndpoint` config flag (default `true`) to disable UserInfo calls for IdPs where the endpoint is unreliable or redundant with ID token claims
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.91
+-   @flink-app/jwt-auth-plugin@2.0.0-alpha.91
+
 ## 2.0.0-alpha.90
 
 ### Patch Changes

package/README.md

@@ -203,6 +203,26 @@ await app.start();
 }
 ```
 
+#### Disabling the UserInfo endpoint
+
+By default, the plugin calls the UserInfo endpoint after token exchange to
+enrich the profile with additional claims. Some IdPs either don't expose
+extra claims beyond the ID token or return unreliable 5xx errors from
+UserInfo. In those cases, set `useUserInfoEndpoint: false` on the provider
+config to skip the UserInfo call entirely and build profiles from ID token
+claims only:
+
+```typescript
+{
+  issuer: "https://idp.acme.com",
+  clientId: "your-client-id",
+  clientSecret: "your-client-secret",
+  callbackUrl: "https://myapp.com/oidc/acme/callback",
+  discoveryUrl: "https://idp.acme.com/.well-known/openid-configuration",
+  useUserInfoEndpoint: false, // skip UserInfo; use ID token claims only
+}
+```
+
 ### Callback Functions
 
 #### onAuthSuccess
@@ -619,6 +639,7 @@ interface OidcProviderConfigDB {
     authorizationEndpoint?: string;
     tokenEndpoint?: string;
     userinfoEndpoint?: string;
+    useUserInfoEndpoint?: boolean; // default true
     jwksUri?: string;
     scope: string[];
     createdAt: Date;

package/dist/OidcProviderConfig.d.ts

@@ -84,5 +84,14 @@ export interface OidcProviderConfig {
      * e.g., { "department": "custom:department", "role": "custom:role" }
      */
     claimMapping?: Record<string, string>;
+    /**
+     * Whether to fetch additional claims from the UserInfo endpoint.
+     * Default: true
+     *
+     * Set to `false` for IdPs whose UserInfo endpoint is unreliable or
+     * returns no additional data beyond what's already in the ID token.
+     * When disabled, profiles are built from ID token claims only.
+     */
+    useUserInfoEndpoint?: boolean;
 }
 //# sourceMappingURL=OidcProviderConfig.d.ts.map

package/dist/OidcProviderConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OidcProviderConfig.d.ts","sourceRoot":"","sources":["../src/OidcProviderConfig.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IAC/B;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,qBAAqB,GAAG,oBAAoB,GAAG,MAAM,CAAC;IAEhF;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAEjB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IAEH;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC"}
+{"version":3,"file":"OidcProviderConfig.d.ts","sourceRoot":"","sources":["../src/OidcProviderConfig.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IAC/B;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,qBAAqB,GAAG,oBAAoB,GAAG,MAAM,CAAC;IAEhF;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAEjB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IAEH;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEtC;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;CACjC"}

package/dist/handlers/CallbackOidc.js

@@ -121,8 +121,8 @@ const CallbackOidc = async ({ ctx, req }) => {
             nonce: session.nonce,
         });
         log_1.oidcLog.debug(`Callback: token exchange successful`, `sub="${tokenSet.claims.sub}"`, `iss="${tokenSet.claims.iss}"`, `email="${tokenSet.claims.email || "(none)"}"`, `hasRefreshToken=${!!tokenSet.refreshToken}`, `expiresIn=${tokenSet.expiresIn ?? "(none)"}s`);
-        // Build user profile from ID token and UserInfo
-        const profile = await oidcProvider.buildProfile(tokenSet, true);
+        // Build user profile from ID token and (optionally) UserInfo
+        const profile = await oidcProvider.buildProfile(tokenSet, oidcProvider.config.useUserInfoEndpoint ?? true);
         log_1.oidcLog.debug(`Callback: profile built id="${profile.id}" email="${profile.email || "(none)"}" name="${profile.name || "(none)"}"`);
         // Call onAuthSuccess callback to create/link user and generate JWT token
         const authSuccessParams = {

package/dist/providers/OidcProvider.d.ts

@@ -14,7 +14,7 @@ import OidcTokenSet from "../schemas/OidcTokenSet";
  * - Claims mapping to profile
  */
 export declare class OidcProvider {
-    private config;
+    readonly config: OidcProviderConfig;
     private issuer;
     private client;
     private initialized;

package/dist/providers/OidcProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OidcProvider.d.ts","sourceRoot":"","sources":["../../src/providers/OidcProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwD,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvG,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,WAAW,MAAM,wBAAwB,CAAC;AACjD,OAAO,YAAY,MAAM,yBAAyB,CAAC;AAKnD;;;;;;;;;;GAUG;AACH,qBAAa,YAAY;IACrB,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,MAAM,CAA+B;IAC7C,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,WAAW,CAAkB;gBAEzB,MAAM,EAAE,kBAAkB;IAItC;;;;;;;OAOG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAsEjC;;;;;OAKG;IACG,mBAAmB,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAiB1G;;;;;;;OAOG;IACG,oBAAoB,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAoD/H;;;;;;;;OAQG;IACG,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAsBjE;;;;;;;;;OASG;IACG,YAAY,CAAC,QAAQ,EAAE,YAAY,EAAE,eAAe,GAAE,OAAc,GAAG,OAAO,CAAC,WAAW,CAAC;IAgCjG;;;;OAIG;YACW,iBAAiB;IAU/B;;;;OAIG;IACH,iBAAiB,IAAI,GAAG;CAM3B"}
+{"version":3,"file":"OidcProvider.d.ts","sourceRoot":"","sources":["../../src/providers/OidcProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwD,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvG,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,WAAW,MAAM,wBAAwB,CAAC;AACjD,OAAO,YAAY,MAAM,yBAAyB,CAAC;AAKnD;;;;;;;;;;GAUG;AACH,qBAAa,YAAY;IACrB,SAAgB,MAAM,EAAE,kBAAkB,CAAC;IAC3C,OAAO,CAAC,MAAM,CAA+B;IAC7C,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,WAAW,CAAkB;gBAEzB,MAAM,EAAE,kBAAkB;IAItC;;;;;;;OAOG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAsEjC;;;;;OAKG;IACG,mBAAmB,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAiB1G;;;;;;;OAOG;IACG,oBAAoB,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAoD/H;;;;;;;;OAQG;IACG,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAsBjE;;;;;;;;;OASG;IACG,YAAY,CAAC,QAAQ,EAAE,YAAY,EAAE,eAAe,GAAE,OAAc,GAAG,OAAO,CAAC,WAAW,CAAC;IAgCjG;;;;OAIG;YACW,iBAAiB;IAU/B;;;;OAIG;IACH,iBAAiB,IAAI,GAAG;CAM3B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flink-app/oidc-plugin",
-  "version": "2.0.0-alpha.90",
+  "version": "2.0.0-alpha.91",
   "description": "Flink plugin for OIDC authentication with generic IdP support",
   "author": "joel@frost.se",
   "license": "MIT",
@@ -11,10 +11,10 @@
   },
   "dependencies": {
     "openid-client": "^5.7.0",
-    "@flink-app/jwt-auth-plugin": "2.0.0-alpha.90"
+    "@flink-app/jwt-auth-plugin": "2.0.0-alpha.91"
   },
   "peerDependencies": {
-    "@flink-app/flink": ">=2.0.0-alpha.90",
+    "@flink-app/flink": ">=2.0.0-alpha.91",
     "mongodb": "^6.15.0"
   },
   "peerDependenciesMeta": {
@@ -27,9 +27,9 @@
     "@types/node": "22.13.10",
     "ts-node": "^10.9.2",
     "tsc-watch": "^4.2.9",
-    "@flink-app/flink": "2.0.0-alpha.90",
-    "@flink-app/jwt-auth-plugin": "2.0.0-alpha.90",
-    "@flink-app/test-utils": "2.0.0-alpha.90"
+    "@flink-app/jwt-auth-plugin": "2.0.0-alpha.91",
+    "@flink-app/test-utils": "2.0.0-alpha.91",
+    "@flink-app/flink": "2.0.0-alpha.91"
   },
   "scripts": {
     "test": "jasmine-ts --config=./spec/support/jasmine.json",

package/src/OidcProviderConfig.ts

@@ -96,4 +96,14 @@ export interface OidcProviderConfig {
      * e.g., { "department": "custom:department", "role": "custom:role" }
      */
     claimMapping?: Record<string, string>;
+
+    /**
+     * Whether to fetch additional claims from the UserInfo endpoint.
+     * Default: true
+     *
+     * Set to `false` for IdPs whose UserInfo endpoint is unreliable or
+     * returns no additional data beyond what's already in the ID token.
+     * When disabled, profiles are built from ID token claims only.
+     */
+    useUserInfoEndpoint?: boolean;
 }

package/src/handlers/CallbackOidc.ts

@@ -158,8 +158,8 @@ const CallbackOidc: GetHandler<any, any, PathParams, CallbackRequest> = async ({
             `expiresIn=${tokenSet.expiresIn ?? "(none)"}s`
         );
 
-        // Build user profile from ID token and UserInfo
-        const profile = await oidcProvider.buildProfile(tokenSet, true);
+        // Build user profile from ID token and (optionally) UserInfo
+        const profile = await oidcProvider.buildProfile(tokenSet, oidcProvider.config.useUserInfoEndpoint ?? true);
         oidcLog.debug(`Callback: profile built id="${profile.id}" email="${profile.email || "(none)"}" name="${profile.name || "(none)"}"`);
 
         // Call onAuthSuccess callback to create/link user and generate JWT token

package/src/providers/OidcProvider.ts

@@ -18,7 +18,7 @@ import { oidcLog } from "../log";
  * - Claims mapping to profile
  */
 export class OidcProvider {
-    private config: OidcProviderConfig;
+    public readonly config: OidcProviderConfig;
     private issuer: Issuer<Client> | null = null;
     private client: Client | null = null;
     private initialized: boolean = false;