@fluixi/oauth2 1.0.0-alpha.1

package/dist/dpop.d.ts

@@ -0,0 +1,72 @@
+/** A key a client holds, with the parts a proof and a binding check need. */
+export interface DpopKey {
+    /** The private half, used to sign. Never leaves this process. */
+    privateKey: CryptoKey;
+    /** The public half, embedded in every proof so a service can verify it. */
+    publicJwk: Record<string, unknown>;
+    /**
+     * The JWK thumbprint, RFC 7638.
+     *
+     * What a provider puts in a token's `cnf.jkt`, and therefore what a service compares a
+     * proof's key against.
+     */
+    thumbprint: string;
+    /** The signing algorithm, which a provider must list in `dpop_signing_alg_values_supported`. */
+    alg: string;
+}
+/**
+ * A key for this client.
+ *
+ * `ES256` by default: the keys are small, signing is fast, and every provider advertising
+ * DPoP support lists it. A proof is signed on every request, so the cost is paid often.
+ *
+ * `extractable: false` where the platform allows it, so the private half cannot be read
+ * out of the process even by code running in it. That is most of the value on a page: an
+ * attacker who can run script can use the key while they are there, and cannot take it
+ * away to use later.
+ */
+export declare function createDpopKey(alg?: string): Promise<DpopKey>;
+/** The thumbprint of a public JWK, for comparing against a token's `cnf.jkt`. */
+export declare function thumbprintOf(jwk: Record<string, unknown>): Promise<string>;
+export interface ProofOptions {
+    /** The HTTP method, uppercased into `htm`. */
+    method: string;
+    /**
+     * The URL, without query or fragment, into `htu`.
+     *
+     * Stripped because the spec says so and because a query string would make a proof
+     * unusable for the same endpoint called with different parameters.
+     */
+    url: string;
+    /**
+     * The access token this proof accompanies, hashed into `ath`.
+     *
+     * Present when calling a resource with a token, absent on the token request itself,
+     * where no token exists yet. It binds the proof to one token, so a proof captured
+     * alongside one cannot be reused with another.
+     */
+    accessToken?: string;
+    /** A nonce the provider demanded, into `nonce`. */
+    nonce?: string;
+}
+/**
+ * A proof for one request.
+ *
+ * Single use by construction: `jti` is fresh and `iat` is now, so a captured proof is
+ * worth nothing beyond the few seconds a service allows for clock skew. `htm` and `htu`
+ * bind it to one method and one endpoint, so it cannot be replayed elsewhere.
+ */
+export declare function proofFor(key: DpopKey, options: ProofOptions): Promise<string>;
+/** The nonce a provider asked for, from a response that refused the last proof. */
+export declare function nonceFrom(response: Response): string | null;
+/** Whether a refusal is a provider asking for a nonce rather than rejecting the proof. */
+export declare function wantsNonce(error: unknown, response?: Response): boolean;
+/**
+ * The key a token is bound to, from its `cnf.jkt` claim.
+ *
+ * Read without verifying the signature, because a service verifies the token separately
+ * and this only says which key to expect. A token with no `cnf` is not bound to one, and a
+ * service told to require binding should refuse it rather than accept it as unbound.
+ */
+export declare function boundKeyOf(claims: Record<string, unknown>): string | null;
+//# sourceMappingURL=dpop.d.ts.map

package/dist/dpop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dpop.d.ts","sourceRoot":"","sources":["../src/dpop.ts"],"names":[],"mappings":"AAkBA,6EAA6E;AAC7E,MAAM,WAAW,OAAO;IACtB,iEAAiE;IACjE,UAAU,EAAE,SAAS,CAAC;IACtB,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,gGAAgG;IAChG,GAAG,EAAE,MAAM,CAAC;CACb;AAcD;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CAAC,GAAG,SAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAWnE;AAED,iFAAiF;AACjF,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAGhF;AAED,MAAM,WAAW,YAAY;IAC3B,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAsCnF;AAED,mFAAmF;AACnF,wBAAgB,SAAS,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,GAAG,IAAI,CAE3D;AAED,0FAA0F;AAC1F,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAGvE;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAGzE"}

package/dist/dpop.js

@@ -0,0 +1,114 @@
+/**
+ * DPoP, RFC 9449: a token bound to a key the client holds.
+ *
+ * A bearer token is a password. Whoever has it can use it, so a copy taken from storage,
+ * a log or a proxy is as good as the original. DPoP changes that: the token carries the
+ * thumbprint of a public key, the client signs a fresh proof for every request with the
+ * private half, and a service checks that the proof matches the token. A stolen token is
+ * then worth nothing without the key, which never leaves the client.
+ *
+ * Two halves, and one without the other is worse than neither. A client that sends proofs
+ * to a service that does not check them has gained nothing while looking protected.
+ * `createDpopKey` and `proofFor` are the client half; `thumbprintOf` and the verifier's
+ * DPoP mode are the service half.
+ *
+ * The key is per client and never sent. Only its public half travels, inside each proof.
+ */
+import { OAuthError } from './types.js';
+/** `jose`, loaded only when a client actually uses DPoP. */
+async function loadJose() {
+    try {
+        return await import('jose');
+    }
+    catch {
+        throw new OAuthError('DPoP needs `jose`. Install it: npm i jose. It is an optional peer, so a client not using DPoP does not carry it.', 'jose_missing');
+    }
+}
+/**
+ * A key for this client.
+ *
+ * `ES256` by default: the keys are small, signing is fast, and every provider advertising
+ * DPoP support lists it. A proof is signed on every request, so the cost is paid often.
+ *
+ * `extractable: false` where the platform allows it, so the private half cannot be read
+ * out of the process even by code running in it. That is most of the value on a page: an
+ * attacker who can run script can use the key while they are there, and cannot take it
+ * away to use later.
+ */
+export async function createDpopKey(alg = 'ES256') {
+    const jose = await loadJose();
+    const { privateKey, publicKey } = await jose.generateKeyPair(alg, { extractable: false });
+    const publicJwk = { ...(await jose.exportJWK(publicKey)) };
+    return {
+        privateKey: privateKey,
+        publicJwk,
+        thumbprint: await jose.calculateJwkThumbprint(publicJwk, 'sha256'),
+        alg,
+    };
+}
+/** The thumbprint of a public JWK, for comparing against a token's `cnf.jkt`. */
+export async function thumbprintOf(jwk) {
+    const jose = await loadJose();
+    return jose.calculateJwkThumbprint(jwk, 'sha256');
+}
+/**
+ * A proof for one request.
+ *
+ * Single use by construction: `jti` is fresh and `iat` is now, so a captured proof is
+ * worth nothing beyond the few seconds a service allows for clock skew. `htm` and `htu`
+ * bind it to one method and one endpoint, so it cannot be replayed elsewhere.
+ */
+export async function proofFor(key, options) {
+    const jose = await loadJose();
+    // Query and fragment removed, per the spec.
+    const htu = (() => {
+        try {
+            const url = new URL(options.url);
+            url.search = '';
+            url.hash = '';
+            return url.toString();
+        }
+        catch {
+            return options.url;
+        }
+    })();
+    const claims = {
+        htm: options.method.toUpperCase(),
+        htu,
+        jti: crypto.randomUUID(),
+    };
+    if (options.accessToken) {
+        // `ath`: the base64url SHA-256 of the token, not the token itself.
+        const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(options.accessToken));
+        let binary = '';
+        for (const byte of new Uint8Array(digest))
+            binary += String.fromCharCode(byte);
+        claims.ath = btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+    }
+    if (options.nonce)
+        claims.nonce = options.nonce;
+    return new jose.SignJWT(claims)
+        .setProtectedHeader({ typ: 'dpop+jwt', alg: key.alg, jwk: key.publicJwk })
+        .setIssuedAt()
+        .sign(key.privateKey);
+}
+/** The nonce a provider asked for, from a response that refused the last proof. */
+export function nonceFrom(response) {
+    return response.headers.get('dpop-nonce');
+}
+/** Whether a refusal is a provider asking for a nonce rather than rejecting the proof. */
+export function wantsNonce(error, response) {
+    const code = typeof error === 'string' ? error : error?.error;
+    return code === 'use_dpop_nonce' || (!!response && !!nonceFrom(response));
+}
+/**
+ * The key a token is bound to, from its `cnf.jkt` claim.
+ *
+ * Read without verifying the signature, because a service verifies the token separately
+ * and this only says which key to expect. A token with no `cnf` is not bound to one, and a
+ * service told to require binding should refuse it rather than accept it as unbound.
+ */
+export function boundKeyOf(claims) {
+    const cnf = claims.cnf;
+    return typeof cnf?.jkt === 'string' ? cnf.jkt : null;
+}

package/dist/dpop.mjs

@@ -0,0 +1,86 @@
+import "./chunk-7P6ASYW6.mjs";
+
+// src/types.ts
+var OAuthError = class extends Error {
+  constructor(message, code, description) {
+    super(message);
+    this.code = code;
+    this.description = description;
+    this.name = "OAuthError";
+  }
+};
+
+// src/dpop.ts
+async function loadJose() {
+  try {
+    return await import("./browser-FDUOEUM2.mjs");
+  } catch {
+    throw new OAuthError(
+      "DPoP needs `jose`. Install it: npm i jose. It is an optional peer, so a client not using DPoP does not carry it.",
+      "jose_missing"
+    );
+  }
+}
+async function createDpopKey(alg = "ES256") {
+  const jose = await loadJose();
+  const { privateKey, publicKey } = await jose.generateKeyPair(alg, { extractable: false });
+  const publicJwk = { ...await jose.exportJWK(publicKey) };
+  return {
+    privateKey,
+    publicJwk,
+    thumbprint: await jose.calculateJwkThumbprint(publicJwk, "sha256"),
+    alg
+  };
+}
+async function thumbprintOf(jwk) {
+  const jose = await loadJose();
+  return jose.calculateJwkThumbprint(jwk, "sha256");
+}
+async function proofFor(key, options) {
+  const jose = await loadJose();
+  const htu = (() => {
+    try {
+      const url = new URL(options.url);
+      url.search = "";
+      url.hash = "";
+      return url.toString();
+    } catch {
+      return options.url;
+    }
+  })();
+  const claims = {
+    htm: options.method.toUpperCase(),
+    htu,
+    jti: crypto.randomUUID()
+  };
+  if (options.accessToken) {
+    const digest = await crypto.subtle.digest(
+      "SHA-256",
+      new TextEncoder().encode(options.accessToken)
+    );
+    let binary = "";
+    for (const byte of new Uint8Array(digest)) binary += String.fromCharCode(byte);
+    claims.ath = btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  }
+  if (options.nonce) claims.nonce = options.nonce;
+  return new jose.SignJWT(claims).setProtectedHeader({ typ: "dpop+jwt", alg: key.alg, jwk: key.publicJwk }).setIssuedAt().sign(key.privateKey);
+}
+function nonceFrom(response) {
+  return response.headers.get("dpop-nonce");
+}
+function wantsNonce(error, response) {
+  const code = typeof error === "string" ? error : error?.error;
+  return code === "use_dpop_nonce" || !!response && !!nonceFrom(response);
+}
+function boundKeyOf(claims) {
+  const cnf = claims.cnf;
+  return typeof cnf?.jkt === "string" ? cnf.jkt : null;
+}
+export {
+  boundKeyOf,
+  createDpopKey,
+  nonceFrom,
+  proofFor,
+  thumbprintOf,
+  wantsNonce
+};

package/dist/env-config.cjs

@@ -0,0 +1,366 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/env-config.ts
+var env_config_exports = {};
+__export(env_config_exports, {
+  authFromEnv: () => authFromEnv
+});
+module.exports = __toCommonJS(env_config_exports);
+
+// src/roles.ts
+var rolesFrom = {
+  /** Keycloak, realm roles. Where it puts them unless a client mapper is configured. */
+  keycloakRealm: (claims) => {
+    const realm = claims.realm_access;
+    return realm?.roles ?? [];
+  },
+  /** Keycloak, roles scoped to one client rather than the realm. */
+  keycloakClient: (clientId) => (claims) => {
+    const all = claims.resource_access;
+    return all?.[clientId]?.roles ?? [];
+  },
+  /** Okta, and anything else using a groups claim. Needs a groups claim on the token. */
+  groups: (claims) => Array.isArray(claims.groups) ? claims.groups : [],
+  /** Cognito, which namespaces the claim. */
+  cognito: (claims) => {
+    const groups = claims["cognito:groups"];
+    return Array.isArray(groups) ? groups : [];
+  },
+  /**
+   * Auth0, which requires a namespaced custom claim added by an action.
+   *
+   * `rolesFrom.namespaced('https://adafri.com/roles')`. Auth0 silently drops a custom claim
+   * that is not a URI, so an empty list here usually means the namespace, not the action.
+   */
+  namespaced: (claim) => (claims) => {
+    const value = claims[claim];
+    return Array.isArray(value) ? value : [];
+  },
+  /** The `scope` claim read as a role list, for a provider issuing no roles at all. */
+  scope: (claims) => typeof claims.scope === "string" ? claims.scope.split(" ") : []
+};
+
+// src/presets.ts
+var trim = (url) => url.replace(/\/+$/, "");
+var presets = {
+  /**
+   * Any OIDC provider publishing a discovery document.
+   *
+   * The agnostic path, and the one to reach for first. A provider not listed below almost
+   * certainly works through this.
+   */
+  oidc(options) {
+    return {
+      label: options.issuer,
+      client: { issuer: trim(options.issuer), scopes: options.scopes },
+      roles: options.roles ?? rolesFrom.scope,
+      verifier: (clientId) => ({
+        issuer: trim(options.issuer),
+        audience: options.audience ?? clientId,
+        ...options.audience === false ? { authorizedParty: clientId } : {}
+      }),
+      constraints: []
+    };
+  },
+  /**
+   * A plain OAuth2 server with no discovery document.
+   *
+   * Every endpoint is given, because there is nothing to ask. Token verification needs an
+   * issuer regardless, since a verifier will not accept a token without one.
+   */
+  oauth2(options) {
+    return {
+      label: options.issuer,
+      client: { endpoints: options.endpoints, scopes: options.scopes },
+      roles: options.roles ?? rolesFrom.scope,
+      verifier: (clientId) => ({
+        issuer: trim(options.issuer),
+        audience: options.audience ?? clientId,
+        ...options.audience === false ? { authorizedParty: clientId } : {}
+      }),
+      constraints: ["Publishes no discovery document, so every endpoint is configured by hand."]
+    };
+  },
+  /** Keycloak. A realm is its own issuer. */
+  keycloak(options) {
+    const issuer = `${trim(options.baseUrl)}/realms/${options.realm}`;
+    return {
+      label: "Keycloak",
+      client: {
+        issuer,
+        scopes: options.scopes ?? ["openid", "profile", "email"]
+      },
+      roles: rolesFrom.keycloakRealm,
+      // No `aud` on an access token until an audience mapper is configured, and the client is
+      // named in `azp` instead. So the check moves to `authorizedParty` rather than being
+      // dropped: `audience: false` alone would accept a token minted for any client of the
+      // realm, which is the check being skipped.
+      verifier: (clientId) => ({ issuer, audience: false, authorizedParty: clientId }),
+      constraints: [
+        "Puts no `aud` on an access token until a dedicated audience mapper is configured. Configure one and switch the verifier to `audience: clientId`.",
+        "Revokes the whole session when an authorization code is replayed, so a replay test has to run last."
+      ]
+    };
+  },
+  /**
+   * Auth0.
+   *
+   * `audience` is the field that decides what kind of token comes back. Without it Auth0
+   * issues an opaque token for its own userinfo endpoint and the JWT checks have nothing to
+   * work with.
+   */
+  auth0(options) {
+    const issuer = `https://${options.domain.replace(/^https?:\/\//, "").replace(/\/+$/, "")}/`;
+    return {
+      label: "Auth0",
+      client: {
+        issuer,
+        scopes: options.scopes ?? ["openid", "profile", "email", "offline_access"],
+        ...options.audience ? { extraParams: { audience: options.audience } } : {}
+      },
+      roles: options.rolesClaim ? rolesFrom.namespaced(options.rolesClaim) : rolesFrom.scope,
+      verifier: (clientId) => ({
+        issuer,
+        // The API identifier is the audience of an access token. Without one the token is
+        // opaque and there is nothing for a verifier to check.
+        audience: options.audience ?? false,
+        ...options.audience ? {} : { authorizedParty: clientId }
+      }),
+      constraints: [
+        "Issues an opaque access token unless `audience` names an API, so token verification needs it.",
+        "A refresh token needs three things together: `offline_access` in the scopes, an audience whose API has Allow Offline Access on, and Refresh Token Rotation enabled on the application. Any one missing and the scope is ignored silently.",
+        "Has no roles claim of its own. An action must add a namespaced one, and Auth0 drops a custom claim that is not a URI.",
+        "The issuer carries a trailing slash. A verifier pinned without it rejects every token."
+      ]
+    };
+  },
+  /**
+   * Okta.
+   *
+   * Two authorization servers that are not interchangeable: a custom one per application,
+   * and the org itself for Okta's own management API.
+   */
+  okta(options) {
+    const host = `https://${options.domain.replace(/^https?:\/\//, "").replace(/\/+$/, "")}`;
+    const server = options.authorizationServer === void 0 ? "default" : options.authorizationServer;
+    const issuer = server === null ? host : `${host}/oauth2/${server}`;
+    return {
+      label: "Okta",
+      client: {
+        issuer,
+        scopes: options.scopes ?? ["openid", "profile", "email", "offline_access"],
+        dpop: options.dpop ?? true
+      },
+      roles: rolesFrom.groups,
+      verifier: (clientId) => ({
+        issuer,
+        // An access token from a custom server is minted for that server's audience, named in
+        // the console and `api://default` by default. It does not carry the client id.
+        audience: false,
+        authorizedParty: clientId
+      }),
+      constraints: [
+        "Two authorization servers: /oauth2/<name> for an application, the bare domain for the management API. They are not interchangeable.",
+        "Turns DPoP on by default for a new application, and an integrator org will not let you untick it.",
+        "Binds the refresh token to the DPoP key as well as the access token, so a refresh must be proved with the key that obtained it.",
+        "A public SPA cannot introspect at all. An API Services client with `private_key_jwt` has to ask instead.",
+        "Client credentials against the org server must use `private_key_jwt`, whatever the application is set to."
+      ]
+    };
+  },
+  /**
+   * Google.
+   *
+   * Refuses a public client outright, so server mode is the only option: the token endpoint
+   * checks for a client secret before it looks at PKCE.
+   */
+  google(options = {}) {
+    return {
+      label: "Google",
+      client: {
+        issuer: "https://accounts.google.com",
+        scopes: options.scopes ?? ["openid", "profile", "email"],
+        ...options.hostedDomain ? { extraParams: { hd: options.hostedDomain } } : {}
+      },
+      roles: rolesFrom.scope,
+      verifier: (clientId) => ({
+        // Names itself two ways, and a service pinned to one rejects tokens carrying the
+        // other. Discovery uses the first.
+        issuer: ["https://accounts.google.com", "accounts.google.com"],
+        audience: clientId
+      }),
+      constraints: [
+        "Refuses a public client: the token endpoint reports `client_secret is missing` before checking PKCE, so browser mode cannot work.",
+        "Publishes its issuer both with and without a scheme, so a verifier needs both spellings.",
+        "Issues a refresh token only on the first consent unless `prompt=consent` and `access_type=offline` are sent."
+      ]
+    };
+  },
+  /**
+   * Dex.
+   *
+   * Sends no CORS headers, on discovery or the token endpoint, so a browser cannot talk to it
+   * at all. Server mode only, and giving endpoints explicitly does not help: the token request
+   * is blocked too.
+   */
+  dex(options) {
+    const issuer = trim(options.baseUrl);
+    return {
+      label: "Dex",
+      client: {
+        issuer,
+        scopes: options.scopes ?? ["openid", "profile", "email", "offline_access"]
+      },
+      roles: rolesFrom.groups,
+      verifier: (clientId) => ({ issuer, audience: clientId }),
+      constraints: [
+        "Sends no CORS headers on discovery or the token endpoint, so browser mode cannot work. Naming the endpoints explicitly only moves the failure to the token request.",
+        "Has no admin interface. Users are static entries in its config file, and a password is a bcrypt hash.",
+        "Publishes no revocation endpoint."
+      ]
+    };
+  }
+};
+
+// src/env-config.ts
+var SECRETISH = /(SECRET|PASSWORD|PRIVATE_KEY|CREDENTIALS?)($|_)/;
+var scopeList = (value) => value ? value.split(/[\s,]+/).filter(Boolean) : void 0;
+var flag = (value) => value === void 0 ? void 0 : /^(true|1|on|yes)$/i.test(value.trim());
+function authFromEnv(source, options = {}) {
+  const clientPrefix = options.clientPrefix ?? "VITE_";
+  const specific = `${clientPrefix}${(options.prefix ?? "AUTH").toUpperCase()}`;
+  const general = `${clientPrefix}AUTH`;
+  const read = (suffix) => {
+    const found = source[`${specific}_${suffix}`] ?? source[`${general}_${suffix}`];
+    return found === void 0 || found === "" ? void 0 : found;
+  };
+  if (clientPrefix) {
+    const exposed = Object.keys(source).filter(
+      (name2) => name2.startsWith(clientPrefix) && SECRETISH.test(name2.slice(clientPrefix.length))
+    );
+    if (exposed.length) {
+      throw new Error(
+        `[fluixi/oauth2] ${exposed.join(", ")} ${exposed.length > 1 ? "are" : "is"} prefixed \`${clientPrefix}\`, which inlines the value into the browser bundle. Drop the prefix and read it on the server: \`credentialsFromEnv\` looks for the unprefixed name.`
+      );
+    }
+  }
+  const name = options.provider ?? read("PROVIDER") ?? "oidc";
+  if (!(name in presets)) {
+    throw new Error(
+      `[fluixi/oauth2] ${specific}_PROVIDER is "${name}", which is not a preset. Use one of ${Object.keys(presets).join(", ")}, or \`oidc\` with an issuer for anything else.`
+    );
+  }
+  const clientId = read("CLIENT_ID");
+  if (!clientId) {
+    throw new Error(
+      `[fluixi/oauth2] no client id. Set ${specific}_CLIENT_ID (or ${general}_CLIENT_ID).`
+    );
+  }
+  const scopes = scopeList(read("SCOPES"));
+  const audience = read("AUDIENCE");
+  const rolesClaim = read("ROLES_CLAIM");
+  const require2 = (suffix) => {
+    const found = read(suffix);
+    if (!found) {
+      throw new Error(
+        `[fluixi/oauth2] the ${name} preset needs ${specific}_${suffix}, which is not set.`
+      );
+    }
+    return found;
+  };
+  let provider;
+  switch (name) {
+    case "keycloak":
+      provider = presets.keycloak({
+        baseUrl: require2("BASE_URL"),
+        realm: require2("REALM"),
+        scopes
+      });
+      break;
+    case "auth0":
+      provider = presets.auth0({
+        domain: require2("DOMAIN"),
+        audience,
+        scopes,
+        rolesClaim
+      });
+      break;
+    case "okta": {
+      const server = read("AUTH_SERVER");
+      provider = presets.okta({
+        domain: require2("DOMAIN"),
+        // `org` names the org server, which the preset takes as null.
+        authorizationServer: server === "org" ? null : server,
+        scopes,
+        dpop: flag(read("DPOP"))
+      });
+      break;
+    }
+    case "google":
+      provider = presets.google({ scopes, hostedDomain: read("HOSTED_DOMAIN") });
+      break;
+    case "dex":
+      provider = presets.dex({ baseUrl: require2("BASE_URL"), scopes });
+      break;
+    case "oauth2":
+      provider = presets.oauth2({
+        issuer: require2("ISSUER"),
+        endpoints: {
+          authorization: require2("AUTHORIZATION_ENDPOINT"),
+          token: require2("TOKEN_ENDPOINT"),
+          userinfo: read("USERINFO_ENDPOINT"),
+          revocation: read("REVOCATION_ENDPOINT"),
+          introspection: read("INTROSPECTION_ENDPOINT")
+        },
+        scopes,
+        audience: audience ?? (flag(read("NO_AUDIENCE")) ? false : void 0),
+        roles: options.roles
+      });
+      break;
+    default:
+      provider = presets.oidc({
+        issuer: require2("ISSUER"),
+        scopes,
+        // A provider putting no `aud` on an access token. Keycloak without a mapper is the
+        // common case, and the preset moves the check to `azp` rather than dropping it.
+        audience: audience ?? (flag(read("NO_AUDIENCE")) ? false : void 0),
+        roles: options.roles
+      });
+  }
+  const dpop = flag(read("DPOP"));
+  if (dpop !== void 0) provider = { ...provider, client: { ...provider.client, dpop } };
+  if (options.roles) provider = { ...provider, roles: options.roles };
+  const tokens = options.tokens ?? (read("TOKENS") ?? "browser");
+  if (tokens !== "browser" && tokens !== "server") {
+    throw new Error(
+      `[fluixi/oauth2] ${specific}_TOKENS is "${tokens}". It is \`browser\` or \`server\`.`
+    );
+  }
+  const redirectUri = read("REDIRECT_URI");
+  return {
+    provider,
+    providerName: name,
+    clientId,
+    tokens,
+    redirectUri,
+    scopes,
+    client: { ...provider.client, clientId, tokens, ...redirectUri ? { redirectUri } : {} }
+  };
+}