@flytedesk/app-kit 0.5.0 → 0.6.0

package/dist/auth/testing/fake-idp.d.ts

@@ -0,0 +1,76 @@
+import type { IdpAppSwitcherEntry } from "../oidc-client.js";
+/**
+ * A fake flytedesk-id (OIDC provider) for e2e/integration harnesses, generalized out of
+ * media-planner's `apps/web/e2e/fake-idp.ts` (AK-10 follow-up, R-2/R-10) so every
+ * `@flytedesk/app-kit/auth` consumer gets ONE maintained fixture instead of each app
+ * hand-rolling its own. It serves the exact endpoints `./oidc-client.ts` calls —
+ * discovery, JWKS, `/auth` (authorize), `/token` (authorization_code + refresh, PKCE
+ * S256, Basic client auth), `/me` (userinfo), `/apps/:appId/authorization` (roles +
+ * permissions) and `/me/apps` (the "All flytedesk apps" switcher feed, `fetchMyApps`) —
+ * so a consumer's REAL login → callback → refresh chain runs UNMODIFIED against it. No
+ * bypass ever lands in production code: the consuming app simply points
+ * `FLYTEDESK_ID_ISSUER` at this server in its own e2e setup.
+ *
+ * Unlike the media-planner original, this fixture takes NO opinion on what identities or
+ * permission catalog exist — the caller supplies a map of named identities up front
+ * (`identities`) and picks which one the next `/auth` grants with `setNextIdentity` (in-
+ * process, for a Vitest-style harness) or the cross-process `/__set-identity` HTTP hook
+ * (for a Playwright spec driving a real browser against a real server process).
+ */
+export interface FakeIdpIdentity {
+    sub: string;
+    email: string;
+    name: string;
+    roles: Array<{
+        id: string;
+        key: string;
+        name: string;
+    }>;
+    /** UNPREFIXED permission keys — this fixture app-prefixes them on
+     *  `/apps/:appId/authorization`, exactly as real flytedesk-id does (the consuming
+     *  app's `flytedeskAuth` plugin strips the prefix back off). */
+    permissions: string[];
+    /** Fed to `/me/apps` for `fetchMyApps`/the design system's "All flytedesk apps"
+     *  switcher. Defaults to an empty list. */
+    apps?: IdpAppSwitcherEntry[];
+}
+export interface FakeIdpOptions {
+    clientId: string;
+    /** Defaults to `clientId` — distinct because real flytedesk-id keys the authorization
+     *  catalog on `appId`, not `clientId` (see `FlytedeskAuthOptions.appId`). */
+    appId?: string;
+    /** Every identity this fixture can grant, keyed by a caller-chosen name (e.g. role). */
+    identities: Record<string, FakeIdpIdentity>;
+    /** Which key in `identities` `/auth` grants until `setNextIdentity`/`/__set-identity`
+     *  says otherwise. */
+    defaultIdentityKey: string;
+}
+export declare class FakeIdp {
+    private server?;
+    private baseUrl;
+    private readonly clientId;
+    private readonly appId;
+    private readonly identities;
+    private nextIdentityKey;
+    private idpSessionLive;
+    private keys;
+    private publicJwk;
+    private readonly kid;
+    private readonly codes;
+    private readonly grants;
+    constructor(opts: FakeIdpOptions);
+    /** Pick the identity the NEXT `/auth` grants. */
+    setNextIdentity(key: string): void;
+    /** See `idpSessionLive`'s doc comment. */
+    setIdpSessionLive(live: boolean): void;
+    get url(): string;
+    start(port?: number): Promise<string>;
+    stop(): Promise<void>;
+    private json;
+    private readForm;
+    private bearer;
+    private signIdToken;
+    private issueGrant;
+    private handle;
+    private tokenGrant;
+}

package/dist/auth/testing/fake-idp.js

@@ -0,0 +1,255 @@
+import { createServer } from "node:http";
+import { createHash, randomBytes } from "node:crypto";
+import { generateKeyPair, exportJWK, SignJWT } from "jose";
+export class FakeIdp {
+    server;
+    baseUrl = "";
+    clientId;
+    appId;
+    identities;
+    nextIdentityKey;
+    // Whether this browser/client still holds a live flytedesk-id end-user session cookie
+    // — real oidc-provider's `prompt=none` handling (OIDC Core 3.1.2.1) answers straight
+    // from that cookie with no interaction at all: a fresh code if it's live,
+    // `error=login_required` back to redirect_uri if it's not. Defaults to true.
+    idpSessionLive = true;
+    keys;
+    publicJwk;
+    kid = "fake-idp-key";
+    codes = new Map();
+    grants = new Map();
+    constructor(opts) {
+        this.clientId = opts.clientId;
+        this.appId = opts.appId ?? opts.clientId;
+        this.identities = opts.identities;
+        if (!(opts.defaultIdentityKey in this.identities)) {
+            throw new Error(`FakeIdp: defaultIdentityKey "${opts.defaultIdentityKey}" is not in identities`);
+        }
+        this.nextIdentityKey = opts.defaultIdentityKey;
+    }
+    /** Pick the identity the NEXT `/auth` grants. */
+    setNextIdentity(key) {
+        if (!(key in this.identities)) {
+            throw new Error(`FakeIdp: no identity registered for "${key}"`);
+        }
+        this.nextIdentityKey = key;
+    }
+    /** See `idpSessionLive`'s doc comment. */
+    setIdpSessionLive(live) {
+        this.idpSessionLive = live;
+    }
+    get url() {
+        if (!this.baseUrl)
+            throw new Error("FakeIdp not started");
+        return this.baseUrl;
+    }
+    async start(port = 0) {
+        this.keys = await generateKeyPair("RS256", { extractable: true });
+        this.publicJwk = {
+            ...(await exportJWK(this.keys.publicKey)),
+            kid: this.kid,
+            use: "sig",
+            alg: "RS256",
+        };
+        this.server = createServer((req, res) => {
+            this.handle(req, res).catch((err) => {
+                res.writeHead(500, { "content-type": "application/json" });
+                res.end(JSON.stringify({ error: "fake_idp_error", detail: String(err) }));
+            });
+        });
+        await new Promise((resolve) => this.server.listen(port, "127.0.0.1", resolve));
+        const addr = this.server.address();
+        if (!addr || typeof addr === "string")
+            throw new Error("FakeIdp failed to bind a port");
+        this.baseUrl = `http://127.0.0.1:${addr.port}`;
+        return this.baseUrl;
+    }
+    async stop() {
+        if (this.server)
+            await new Promise((resolve) => this.server.close(() => resolve()));
+        this.server = undefined;
+    }
+    json(res, status, body) {
+        res.writeHead(status, { "content-type": "application/json" });
+        res.end(JSON.stringify(body));
+    }
+    async readForm(req) {
+        const chunks = [];
+        for await (const c of req)
+            chunks.push(c);
+        return new URLSearchParams(Buffer.concat(chunks).toString("utf8"));
+    }
+    bearer(req) {
+        const h = req.headers.authorization;
+        return h?.startsWith("Bearer ") ? h.slice(7) : null;
+    }
+    async signIdToken(identity) {
+        return new SignJWT({})
+            .setProtectedHeader({ alg: "RS256", kid: this.kid })
+            .setIssuer(this.baseUrl)
+            .setAudience(this.clientId)
+            .setSubject(identity.sub)
+            .setIssuedAt()
+            .setExpirationTime("15m")
+            .sign(this.keys.privateKey);
+    }
+    issueGrant(identity) {
+        const accessToken = `at-${randomBytes(24).toString("base64url")}`;
+        const refreshToken = `rt-${randomBytes(24).toString("base64url")}`;
+        this.grants.set(accessToken, { identity });
+        this.grants.set(refreshToken, { identity });
+        return { accessToken, refreshToken };
+    }
+    async handle(req, res) {
+        const u = new URL(req.url ?? "/", this.baseUrl);
+        const path = u.pathname;
+        if (req.method === "GET" && path === "/.well-known/openid-configuration") {
+            return this.json(res, 200, {
+                issuer: this.baseUrl,
+                authorization_endpoint: `${this.baseUrl}/auth`,
+                token_endpoint: `${this.baseUrl}/token`,
+                jwks_uri: `${this.baseUrl}/jwks`,
+                userinfo_endpoint: `${this.baseUrl}/me`,
+                revocation_endpoint: `${this.baseUrl}/revoke`,
+                response_types_supported: ["code"],
+                id_token_signing_alg_values_supported: ["RS256"],
+                code_challenge_methods_supported: ["S256"],
+            });
+        }
+        if (req.method === "GET" && path === "/jwks") {
+            return this.json(res, 200, { keys: [this.publicJwk] });
+        }
+        // Authorize: auto-grant the currently-selected identity, redirect back with a code —
+        // UNLESS this is a `prompt=none` silent request and idpSessionLive has been turned
+        // off, in which case real oidc-provider answers `error=login_required` with no
+        // interaction UI at all, and this fake mirrors that exactly.
+        if (req.method === "GET" && path === "/auth") {
+            const redirectUri = u.searchParams.get("redirect_uri");
+            const state = u.searchParams.get("state") ?? "";
+            const codeChallenge = u.searchParams.get("code_challenge") ?? "";
+            const prompt = u.searchParams.get("prompt");
+            if (!redirectUri)
+                return this.json(res, 400, { error: "missing redirect_uri" });
+            const loc = new URL(redirectUri);
+            if (prompt === "none" && !this.idpSessionLive) {
+                loc.searchParams.set("error", "login_required");
+                loc.searchParams.set("state", state);
+                res.writeHead(302, { location: loc.toString() });
+                return void res.end();
+            }
+            const code = `code-${randomBytes(18).toString("base64url")}`;
+            this.codes.set(code, { identity: this.identities[this.nextIdentityKey], codeChallenge });
+            loc.searchParams.set("code", code);
+            loc.searchParams.set("state", state);
+            res.writeHead(302, { location: loc.toString() });
+            return void res.end();
+        }
+        if (req.method === "POST" && path === "/token") {
+            const form = await this.readForm(req);
+            const grantType = form.get("grant_type");
+            if (grantType === "authorization_code") {
+                const code = form.get("code") ?? "";
+                const verifier = form.get("code_verifier") ?? "";
+                const entry = this.codes.get(code);
+                if (!entry)
+                    return this.json(res, 400, { error: "invalid_grant" });
+                this.codes.delete(code);
+                // PKCE S256: base64url(sha256(verifier)) must equal the stored challenge.
+                const challenge = createHash("sha256").update(verifier).digest("base64url");
+                if (entry.codeChallenge && challenge !== entry.codeChallenge) {
+                    return this.json(res, 400, { error: "invalid_grant", detail: "pkce_mismatch" });
+                }
+                const { accessToken, refreshToken } = this.issueGrant(entry.identity);
+                return this.json(res, 200, {
+                    access_token: accessToken,
+                    id_token: await this.signIdToken(entry.identity),
+                    refresh_token: refreshToken,
+                    token_type: "Bearer",
+                    expires_in: 900,
+                });
+            }
+            if (grantType === "refresh_token") {
+                const rt = form.get("refresh_token") ?? "";
+                const grant = this.grants.get(rt);
+                if (!grant)
+                    return this.json(res, 400, { error: "invalid_grant" });
+                // rotateRefreshToken: true — issue a fresh pair for the same identity.
+                const { accessToken, refreshToken } = this.issueGrant(grant.identity);
+                return this.json(res, 200, {
+                    access_token: accessToken,
+                    id_token: await this.signIdToken(grant.identity),
+                    refresh_token: refreshToken,
+                    token_type: "Bearer",
+                    expires_in: 900,
+                });
+            }
+            return this.json(res, 400, { error: "unsupported_grant_type" });
+        }
+        if (req.method === "GET" && path === "/me") {
+            const grant = this.tokenGrant(req);
+            if (!grant)
+                return this.json(res, 401, { error: "invalid_token" });
+            return this.json(res, 200, {
+                sub: grant.identity.sub,
+                email: grant.identity.email,
+                email_verified: true,
+                name: grant.identity.name,
+            });
+        }
+        if (req.method === "GET" && path === `/apps/${this.appId}/authorization`) {
+            const grant = this.tokenGrant(req);
+            if (!grant)
+                return this.json(res, 401, { error: "invalid_token" });
+            return this.json(res, 200, {
+                userId: grant.identity.sub,
+                appId: this.appId,
+                roles: grant.identity.roles,
+                // App-prefixed, exactly as real flytedesk-id returns (the consuming app's
+                // flytedeskAuth plugin strips it back off — see plugin.ts's loadAuthedUser).
+                permissions: grant.identity.permissions.map((p) => `${this.appId}:${p}`),
+            });
+        }
+        if (req.method === "GET" && path === "/me/apps") {
+            const grant = this.tokenGrant(req);
+            if (!grant)
+                return this.json(res, 401, { error: "invalid_token" });
+            return this.json(res, 200, { apps: grant.identity.apps ?? [] });
+        }
+        if (req.method === "POST" && path === "/revoke") {
+            const form = await this.readForm(req);
+            this.grants.delete(form.get("token") ?? "");
+            return this.json(res, 200, {});
+        }
+        // Test-control (out-of-band, not part of OIDC): pick the identity the next /auth
+        // grants. The in-process setNextIdentity() covers a Vitest-style harness; this HTTP
+        // hook lets a Playwright spec (a separate process from the server under test) choose
+        // the persona cross-process.
+        if (req.method === "POST" && path === "/__set-identity") {
+            const form = await this.readForm(req);
+            const key = form.get("key") ?? "";
+            if (!(key in this.identities)) {
+                return this.json(res, 400, { error: "unknown_identity", key });
+            }
+            this.setNextIdentity(key);
+            return this.json(res, 200, { key });
+        }
+        // Test-control: flip whether this fake IdP currently has a live end-user session
+        // (see idpSessionLive's doc comment) — same cross-process HTTP-hook pattern as
+        // /__set-identity.
+        if (req.method === "POST" && path === "/__set-idp-session") {
+            const form = await this.readForm(req);
+            const live = form.get("live");
+            if (live !== "true" && live !== "false") {
+                return this.json(res, 400, { error: "invalid_live", live });
+            }
+            this.setIdpSessionLive(live === "true");
+            return this.json(res, 200, { live: this.idpSessionLive });
+        }
+        return this.json(res, 404, { error: "not_found", path });
+    }
+    tokenGrant(req) {
+        const token = this.bearer(req);
+        return token ? (this.grants.get(token) ?? null) : null;
+    }
+}
+//# sourceMappingURL=fake-idp.js.map

package/dist/auth/testing/fake-idp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-idp.js","sourceRoot":"","sources":["../../../src/auth/testing/fake-idp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,OAAO,EAAY,MAAM,MAAM,CAAC;AAmDrE,MAAM,OAAO,OAAO;IACV,MAAM,CAAU;IAChB,OAAO,GAAG,EAAE,CAAC;IACJ,QAAQ,CAAS;IACjB,KAAK,CAAS;IACd,UAAU,CAAkC;IACrD,eAAe,CAAS;IAChC,sFAAsF;IACtF,qFAAqF;IACrF,0EAA0E;IAC1E,6EAA6E;IACrE,cAAc,GAAG,IAAI,CAAC;IACtB,IAAI,CAA+C;IACnD,SAAS,CAAO;IACP,GAAG,GAAG,cAAc,CAAC;IACrB,KAAK,GAAG,IAAI,GAAG,EAAgE,CAAC;IAChF,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAExD,YAAY,IAAoB;QAC9B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC;QACzC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,CAAC,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACb,gCAAgC,IAAI,CAAC,kBAAkB,wBAAwB,CAChF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,kBAAkB,CAAC;IACjD,CAAC;IAED,iDAAiD;IACjD,eAAe,CAAC,GAAW;QACzB,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,GAAG,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC;IAC7B,CAAC;IAED,0CAA0C;IAC1C,iBAAiB,CAAC,IAAa;QAC7B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED,IAAI,GAAG;QACL,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC;QAClB,IAAI,CAAC,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,SAAS,GAAG;YACf,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,OAAO;SACb,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACtC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAClC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5E,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,MAAO,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QACtF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAO,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACxF,IAAI,CAAC,OAAO,GAAG,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,MAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC3F,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;IAC1B,CAAC;IAEO,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;QAC7D,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,GAAoB;QACzC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,GAAG;YAAE,MAAM,CAAC,IAAI,CAAC,CAAW,CAAC,CAAC;QACpD,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,CAAC;IAEO,MAAM,CAAC,GAAoB;QACjC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACpC,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,QAAyB;QACjD,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC;aACnB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aACnD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;aACvB,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;aAC1B,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;aACxB,WAAW,EAAE;aACb,iBAAiB,CAAC,KAAK,CAAC;aACxB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;IAEO,UAAU,CAAC,QAAyB;QAC1C,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAClE,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,GAAoB,EAAE,GAAmB;QAC5D,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;QAExB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,mCAAmC,EAAE,CAAC;YACzE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACzB,MAAM,EAAE,IAAI,CAAC,OAAO;gBACpB,sBAAsB,EAAE,GAAG,IAAI,CAAC,OAAO,OAAO;gBAC9C,cAAc,EAAE,GAAG,IAAI,CAAC,OAAO,QAAQ;gBACvC,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,OAAO;gBAChC,iBAAiB,EAAE,GAAG,IAAI,CAAC,OAAO,KAAK;gBACvC,mBAAmB,EAAE,GAAG,IAAI,CAAC,OAAO,SAAS;gBAC7C,wBAAwB,EAAE,CAAC,MAAM,CAAC;gBAClC,qCAAqC,EAAE,CAAC,OAAO,CAAC;gBAChD,gCAAgC,EAAE,CAAC,MAAM,CAAC;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,qFAAqF;QACrF,mFAAmF;QACnF,+EAA+E;QAC/E,6DAA6D;QAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAChD,MAAM,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;YACjE,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,CAAC,WAAW;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YAEhF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;YACjC,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;gBAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;gBAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;gBACjD,OAAO,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;YACxB,CAAC;YAED,MAAM,IAAI,GAAG,QAAQ,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAE,EAAE,aAAa,EAAE,CAAC,CAAC;YAC1F,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACnC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACjD,OAAO,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACzC,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;gBACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;gBACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACnC,IAAI,CAAC,KAAK;oBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;gBACnE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACxB,0EAA0E;gBAC1E,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAC5E,IAAI,KAAK,CAAC,aAAa,IAAI,SAAS,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;oBAC7D,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;gBAClF,CAAC;gBACD,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACtE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBACzB,YAAY,EAAE,WAAW;oBACzB,QAAQ,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC;oBAChD,aAAa,EAAE,YAAY;oBAC3B,UAAU,EAAE,QAAQ;oBACpB,UAAU,EAAE,GAAG;iBAChB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;gBAClC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;gBAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAClC,IAAI,CAAC,KAAK;oBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;gBACnE,uEAAuE;gBACvE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACtE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBACzB,YAAY,EAAE,WAAW;oBACzB,QAAQ,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC;oBAChD,aAAa,EAAE,YAAY;oBAC3B,UAAU,EAAE,QAAQ;oBACpB,UAAU,EAAE,GAAG;iBAChB,CAAC,CAAC;YACL,CAAC;YACD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACzB,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG;gBACvB,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;gBAC3B,cAAc,EAAE,IAAI;gBACpB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,gBAAgB,EAAE,CAAC;YACzE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACzB,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG;gBAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;gBAC3B,0EAA0E;gBAC1E,6EAA6E;gBAC7E,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;aACzE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACjC,CAAC;QAED,iFAAiF;QACjF,oFAAoF;QACpF,qFAAqF;QACrF,6BAA6B;QAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACtC,CAAC;QAED,iFAAiF;QACjF,+EAA+E;QAC/E,mBAAmB;QACnB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC9B,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBACxC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;YACxC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAEO,UAAU,CAAC,GAAoB;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,CAAC;CACF"}

package/dist/auth/testing/index.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Test-only fixtures for `@flytedesk/app-kit/auth` consumers — a separate subpath
+ * export so this never ships to a production bundle by accident. See fake-idp.ts.
+ */
+export { FakeIdp, type FakeIdpIdentity, type FakeIdpOptions } from "./fake-idp.js";

package/dist/auth/testing/index.js

@@ -0,0 +1,6 @@
+/**
+ * Test-only fixtures for `@flytedesk/app-kit/auth` consumers — a separate subpath
+ * export so this never ships to a production bundle by accident. See fake-idp.ts.
+ */
+export { FakeIdp } from "./fake-idp.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/testing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/testing/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,OAAO,EAA6C,MAAM,eAAe,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flytedesk/app-kit",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Shared platform kit for flytedesk apps: flytedesk-id auth (BFF/OIDC client) and a Postgres-native trace/audit layer.",
   "type": "module",
   "license": "UNLICENSED",
@@ -37,6 +37,10 @@
       "types": "./dist/auth/index.d.ts",
       "import": "./dist/auth/index.js"
     },
+    "./auth/testing": {
+      "types": "./dist/auth/testing/index.d.ts",
+      "import": "./dist/auth/testing/index.js"
+    },
     "./trace": {
       "types": "./dist/trace/index.d.ts",
       "import": "./dist/trace/index.js"