@hotfusion/modeller 0.0.13 → 0.0.15

package/dist/server.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -10,11 +43,24 @@ const koa_router_1 = __importDefault(require("koa-router"));
 const koa_session_1 = __importDefault(require("koa-session"));
 const bodyparser_1 = __importDefault(require("@koa/bodyparser"));
 const cors_1 = __importDefault(require("@koa/cors"));
+const koa_body_1 = require("koa-body");
 const eventemitter3_1 = require("eventemitter3");
 const jose_1 = require("jose");
+const openidClient = __importStar(require("openid-client"));
+const oidc_provider_1 = __importDefault(require("oidc-provider"));
 const socket_io_1 = require("socket.io");
 const keygen_js_1 = require("./utils/keygen.js");
 const koa_static_1 = __importDefault(require("koa-static"));
+const display_1 = require("./utils/display");
+const bundler_1 = require("./utils/bundler");
+const view_1 = require("./view");
+const core_1 = require("./core");
+const adapter_1 = require("./oidc/adapter");
+const client_1 = require("./oidc/client");
+const user_1 = require("./oidc/user");
+const federation_1 = require("./oidc/federation");
+const token_1 = require("./oidc/token");
+const utils_1 = require("./oidc/utils");
 class Utils {
     static trimPath(path) {
         return '/' + path.split('/').filter((x) => x).join('/');
@@ -25,12 +71,14 @@ class Server extends eventemitter3_1.EventEmitter {
     app;
     router;
     routes = [];
-    providers = [];
     config;
     io;
     registeredModels = [];
     extensions = [];
     extensionConfigs = new Map();
+    _oidcServers = [];
+    _oidcProviders = new Map();
+    _staticFolders = [];
     API_OPERATIONS = ['insert', 'update', 'delete', 'get', 'find', 'list'];
     OPERATION_METHODS = {
         insert: 'POST',
@@ -43,60 +91,54 @@ class Server extends eventemitter3_1.EventEmitter {
     constructor(port, config) {
         super();
         this.app = new koa_1.default();
+        this.app.proxy = true;
         this.router = new koa_router_1.default();
-        this.app.use((0, cors_1.default)());
-        this.app.use((0, bodyparser_1.default)());
-        this.app.keys = [config?.secret || keygen_js_1.KeyGen.getSystemSecret()];
-        this.app.use((0, koa_session_1.default)({
-            key: config?.secret || keygen_js_1.KeyGen.getSystemSecret(),
-            maxAge: 86400000,
-            autoCommit: true,
-            overwrite: false,
-            httpOnly: true,
-            signed: true,
-            rolling: false,
-            renew: false,
-            secure: process.env.NODE_ENV === 'production',
-        }, this.app));
         this.port = port;
         this.config = config;
+        this.app.on('error', (err, ctx) => {
+            if (ctx?.res?.headersSent)
+                return;
+            display_1.display.error('server', err?.message ?? String(err));
+        });
+        process.on('unhandledRejection', (reason) => {
+            const message = reason instanceof Error
+                ? reason.stack ?? reason.message
+                : typeof reason === 'string'
+                    ? reason
+                    : JSON.stringify(reason ?? 'Unknown rejection');
+            display_1.display.error('server', message);
+        });
     }
-    // ?? Register model ??????????????????????????????????????????????????????????
     registerModel(id, scope, model) {
         this.registeredModels.push({ id, scope, model });
         return this;
     }
-    // ?? Register extension ??????????????????????????????????????????????????????
     registerExtension(extension) {
         this.extensions.push(extension);
         return this;
     }
-    // ?? Setup extensions ??????????????????????????????????????????????????????
+    registerOIDC(adapter) {
+        this._oidcAdapterClass = adapter;
+        return this;
+    }
     async setupExtensions() {
-        console.log('[Server] Setting up extensions...');
         for (const ext of this.extensions) {
-            console.log(`[Server] Setting up extension: ${ext.id}`);
             const extConfig = this.extensionConfigs.get(ext.id) || {};
-            console.log(`[Server] Extension ${ext.id} config:`, extConfig);
             await ext.setup(this, extConfig);
-            console.log(`[Server] Extension ${ext.id} setup complete`);
         }
-        console.log('[Server] All extensions setup complete');
     }
-    // ?? Auto-mount API routes ?????????????????????????????????????????????????????????
-    mountModelRoutes() {
+    async mountModelRoutes() {
         for (const { id, scope, model } of this.registeredModels) {
-            this._mountModelRecursive(id, scope, model);
+            await this._mountModelRecursive(id, scope, model);
         }
     }
-    _mountModelRecursive(id, scope, model) {
+    async _mountModelRecursive(id, scope, model) {
         this._mountModel(id, scope, model);
         for (const ext of model.getExtensions?.() ?? []) {
-            this._mountModelRecursive(id, `${scope}/${ext.id}`, ext);
+            await this._mountModelRecursive(id, `${scope}/${ext.id}`, ext);
         }
     }
     _mountModel(id, scope, model) {
-        // ?? CRUD operations ???????????????????????????????????????????????????
         for (const operation of this.API_OPERATIONS) {
             const routePath = `/${id}/${scope}/${operation}`;
             const handler = async (ctx) => {
@@ -111,8 +153,7 @@ class Server extends eventemitter3_1.EventEmitter {
                         result = await model.update(key, data, { private: true });
                     }
                     else if (operation === 'delete') {
-                        const query = Object.keys(ctx.request.body ?? {}).length ? ctx.request.body : ctx.query;
-                        result = await model.delete(query);
+                        result = await model.delete(body);
                     }
                     else if (operation === 'get') {
                         result = await model.get(body, { private: true });
@@ -146,12 +187,11 @@ class Server extends eventemitter3_1.EventEmitter {
             else if (operation === 'list')
                 this.router.get(routePath, handler);
         }
-        // ?? Custom methods ????????????????????????????????????????????????????
         for (const method of model.getMethods?.() ?? []) {
             this.router.post(`/${id}/${scope}/${method}`, async (ctx) => {
                 const { _id, ...rest } = ctx.request.body ?? {};
                 try {
-                    const result = await model.call(method, { _id, ...rest });
+                    const result = await model.call(method, { _id, ...rest }, ctx);
                     ctx.status = 200;
                     ctx.body = { ok: true, entry: result };
                 }
@@ -161,21 +201,13 @@ class Server extends eventemitter3_1.EventEmitter {
                 }
             });
         }
-        // ?? Upload methods (multipart HTTP) ???????????????????????????????????
         for (const uploadId of model.getUploads?.() ?? []) {
             this.upload(`/${id}/${scope}/${uploadId}`, async (ctx, file, fields) => {
-                try {
-                    return await model.callUpload(uploadId, file, fields);
-                }
-                catch (err) {
-                    throw err;
-                }
+                return model.callUpload(uploadId, file, fields);
             });
         }
-        // ?? View routes ??????????????????????????????????????????????????????????????????????
         for (const view of model.getViews?.() ?? []) {
             const routePath = `/${id}/${scope}${view.path}`.replace(/\/$/, '') || '/';
-            console.log('[View] Mounting route:', routePath);
             this.router.get(routePath, async (ctx) => {
                 try {
                     ctx.type = 'text/html';
@@ -186,8 +218,8 @@ class Server extends eventemitter3_1.EventEmitter {
                     ctx.body = { ok: false, error: err?.message ?? err };
                 }
             });
+            display_1.display.addView(`http://localhost:${this.port}${routePath}`);
         }
-        // ?? Static folders ????????????????????????????????????????????????????
         for (const [urlPath, { path: folderPath }] of model.getFolders?.() ?? new Map()) {
             const staticMiddleware = (0, koa_static_1.default)(folderPath);
             this.app.use(async (ctx, next) => {
@@ -198,32 +230,529 @@ class Server extends eventemitter3_1.EventEmitter {
                 return next();
             });
         }
-        // ?? Stream methods (binary socket) ????????????????????????????????????
-        for (const streamId of model.getStreams?.() ?? []) {
-            // Streams are registered globally in _setupStream
-            // Store them for later reference
+    }
+    // ?? OIDC Setup ????????????????????????????????????????????????????????????
+    async _setupOIDC(oidcConfigRaw, mountPath) {
+        const secret = this.config?.secret || keygen_js_1.KeyGen.getSystemSecret();
+        const port = this.port;
+        const adapter = this._oidcAdapterClass ?? adapter_1.OIDCAdapter;
+        const baseUrl = process.env.BASE_URL ?? `http://localhost:${port}`;
+        const issuer = oidcConfigRaw?.issuer ?? baseUrl;
+        const scopes = oidcConfigRaw?.scopes ?? ['openid', 'email', 'profile', 'phone', 'address', 'offline_access'];
+        const claims = oidcConfigRaw?.claims ?? {
+            openid: ['sub'],
+            email: ['email', 'email_verified'],
+            phone: ['phone_number', 'phone_number_verified'],
+            profile: [
+                'name', 'family_name', 'given_name', 'middle_name',
+                'nickname', 'preferred_username', 'picture', 'website',
+                'gender', 'birthdate', 'zoneinfo', 'locale', 'updated_at',
+            ],
+            address: ['address'],
+        };
+        const ttl = {
+            AccessToken: 60 * 60,
+            AuthorizationCode: 10 * 60,
+            IdToken: 60 * 60,
+            RefreshToken: 14 * 24 * 60 * 60,
+            Session: 14 * 24 * 60 * 60,
+            Interaction: 60 * 60,
+            Grant: 14 * 24 * 60 * 60,
+            ...(oidcConfigRaw?.ttl ?? {}),
+        };
+        const users = oidcConfigRaw?.users ?? user_1.UserModel;
+        const clientModel = oidcConfigRaw?.clients ?? client_1.ClientModel;
+        const federationModel = oidcConfigRaw?.federation ?? federation_1.FederationModel;
+        const tokenModel = oidcConfigRaw?.tokens ?? token_1.TokenModel;
+        const federation = await federationModel.list({}, { count: 10000 }).catch(() => []);
+        const bundler = oidcConfigRaw?.view instanceof bundler_1.Bundler ? oidcConfigRaw.view : null;
+        const view = bundler ? new view_1.View(`/${mountPath}/interaction/:uid`, {}, bundler) : null;
+        if (bundler) {
+            bundler.build().then((result) => { if (view)
+                view.result = result; });
+            const fs = require('node:fs');
+            fs.watch(bundler.path, () => {
+                bundler.rebuild().then((result) => { if (view)
+                    view.result = result; });
+            });
+        }
+        const findAccount = users?.findAccount
+            ?? (async (_ctx, id) => {
+                const user = await users?.get({ _id: id }, { private: false });
+                if (!user)
+                    return undefined;
+                return {
+                    accountId: user._id.toString(),
+                    claims: async () => ({
+                        sub: user._id,
+                        email: user.email,
+                        email_verified: user.emailVerified ?? false,
+                        phone_number: user.phoneNumber,
+                        phone_number_verified: user.phoneVerified ?? false,
+                        name: user.name,
+                        given_name: user.givenName,
+                        family_name: user.familyName,
+                        middle_name: user.middleName,
+                        nickname: user.nickname,
+                        preferred_username: user.username,
+                        picture: user.picture,
+                        website: user.website,
+                        gender: user.gender,
+                        birthdate: user.birthdate,
+                        zoneinfo: user.zoneinfo,
+                        locale: user.locale,
+                        address: user.address,
+                        updated_at: user.updatedAt
+                            ? Math.floor(new Date(user.updatedAt).getTime() / 1000)
+                            : undefined,
+                    }),
+                };
+            });
+        const verifyUser = users?.verifyUser
+            ?? ((username, password) => users?.call('verify', { username, password }));
+        const findOrCreateFederatedUser = users?.findOrCreateFederatedUser
+            ?? (async (email) => {
+                let user = await users?.get({ email }).catch(() => null);
+                if (!user) {
+                    user = await users?.insert({
+                        username: email, email, password: Math.random().toString(36),
+                        isActive: true, roles: 'user', _sync: true,
+                    });
+                }
+                return user;
+            });
+        // ?? Resolve return_to from config ??
+        const redirect = oidcConfigRaw?.redirect;
+        if (!redirect)
+            throw new Error(`[OIDC] registerOIDCServer('${mountPath}') requires a static redirect`);
+        let returnTo;
+        if (typeof redirect === 'string' && redirect.startsWith('http')) {
+            returnTo = redirect;
+        }
+        else {
+            const model = this.registeredModels.find(m => m.scope === redirect || m.id === redirect);
+            if (!model)
+                throw new Error(`[OIDC] redirect model '${redirect}' not found`);
+            const views = model.model.getViews?.();
+            if (!views?.length)
+                throw new Error(`[OIDC] redirect model '${redirect}' has no views`);
+            returnTo = `${baseUrl}/${model.id}/${model.scope}${views[0].path}`;
+        }
+        // ?? Seed default client ??????????????????????????????????????????
+        try {
+            const clientAdapter = new adapter('Client');
+            const defaultClient = {
+                client_id: `${mountPath}-default`,
+                client_secret: 'default-secret',
+                redirect_uris: [`${issuer}/${mountPath}/callback`],
+                return_to: returnTo,
+                grant_types: ['authorization_code', 'refresh_token'],
+                response_types: ['code'],
+                token_endpoint_auth_method: 'client_secret_basic',
+                scopes: ['openid', 'email', 'profile', 'offline_access'],
+                isActive: true,
+            };
+            await clientAdapter.upsert(defaultClient.client_id, defaultClient, 0);
+            display_1.display.log('oidc', `Clients seeded for /${mountPath}`);
         }
+        catch (err) {
+            display_1.display.error('oidc:seed', JSON.stringify(err));
+            throw err;
+        }
+        // ?? Build JWKS ????????????????????????????????????????????????
+        const { generateKeyPair, exportJWK } = await import('jose');
+        const fs = require('node:fs');
+        const path = require('node:path');
+        const JWKS_PATH = path.resolve(process.cwd(), './data/oidc.jwks.json');
+        let jwks;
+        if (process.env.OIDC_JWKS) {
+            jwks = JSON.parse(process.env.OIDC_JWKS);
+        }
+        else if (fs.existsSync(JWKS_PATH)) {
+            jwks = JSON.parse(fs.readFileSync(JWKS_PATH, 'utf-8'));
+        }
+        else {
+            const { privateKey } = await generateKeyPair('RS256', { extractable: true });
+            const jwk = await exportJWK(privateKey);
+            jwk.use = 'sig';
+            jwk.alg = 'RS256';
+            jwk.kid = `key-${Date.now()}`;
+            jwks = { keys: [jwk] };
+            fs.mkdirSync(path.dirname(JWKS_PATH), { recursive: true });
+            fs.writeFileSync(JWKS_PATH, JSON.stringify(jwks, null, 2), 'utf-8');
+        }
+        // ?? Create provider ???????????????????????????????????????????????????
+        const provider = new oidc_provider_1.default(issuer, {
+            adapter,
+            jwks,
+            findAccount,
+            scopes,
+            claims,
+            ttl,
+            features: {
+                devInteractions: { enabled: !view },
+                clientCredentials: { enabled: true },
+                introspection: { enabled: true },
+                revocation: { enabled: true },
+                rpInitiatedLogout: { enabled: true },
+            },
+            issueRefreshToken: async (ctx, client, code) => {
+                return client.grantTypeAllowed('refresh_token');
+            },
+            loadExistingGrant: async (ctx) => {
+                if (!ctx.oidc.session?.accountId)
+                    return undefined;
+                const grant = new ctx.oidc.provider.Grant({
+                    accountId: ctx.oidc.session.accountId,
+                    clientId: ctx.oidc.client.clientId,
+                });
+                grant.addOIDCScope('openid email profile offline_access');
+                await grant.save();
+                return grant;
+            },
+            extraClientMetadata: {
+                properties: ['return_to'],
+            },
+            pkce: { required: () => true },
+            interactions: {
+                url: (_ctx, interaction) => `/${mountPath}/interaction/${interaction.uid}`,
+            },
+            cookies: {
+                keys: [process.env.OIDC_COOKIE_SECRET ?? secret],
+                short: { secure: false, sameSite: 'lax' },
+                long: { secure: false, sameSite: 'lax' },
+            },
+        });
+        provider.proxy = true;
+        provider.on('server_error', (ctx, err) => {
+            display_1.display.error('oidc', err?.message ?? String(err));
+        });
+        // ?? Store local refresh token on grant.success — covers both email/password and federated ??
+        provider.on('grant.success', async (ctx) => {
+            console.log('grant.success fired', ctx.oidc.entities?.RefreshToken?.jti);
+            try {
+                const refreshToken = ctx.oidc.entities?.RefreshToken;
+                const account = ctx.oidc.entities?.Account;
+                const params = ctx.oidc.params;
+                if (!refreshToken || !account?.accountId)
+                    return;
+                const existing = await tokenModel.find({
+                    accountId: account.accountId,
+                    provider: 'local',
+                    appId: params.client_id,
+                }).then((r) => r?.[0] ?? null).catch(() => null);
+                const data = {
+                    refreshToken: refreshToken.jti,
+                    scope: refreshToken.scope,
+                    expiresAt: new Date(Date.now() + ttl.RefreshToken * 1000).toISOString(),
+                };
+                if (existing) {
+                    await tokenModel.update({ _id: existing._id }, data);
+                }
+                else {
+                    await tokenModel.insert({
+                        _sync: true,
+                        accountId: account.accountId,
+                        provider: 'local',
+                        appId: params.client_id,
+                        ...data,
+                    });
+                }
+            }
+            catch (err) {
+                display_1.display.error('oidc:grant', err?.message ?? String(err));
+            }
+        });
+        // ?? PKCE store — keyed by code_challenge ??
+        const pkceStore = new Map();
+        // ?? Federation ??????????????????????????????????????????????????????
+        const federationClients = new Map();
+        for (const fed of federation) {
+            try {
+                const client = await openidClient.discovery(new URL(fed.issuer), fed.client_id, fed.client_secret);
+                federationClients.set(fed.name, { client, config: fed });
+                display_1.display.log('oidc', `Federation configured: ${fed.name}`);
+            }
+            catch (err) {
+                display_1.display.error('oidc', `Federation setup failed for ${fed.name}: ${err.message}`);
+            }
+        }
+        // ?? Interaction router ???????????????????????????????????????????????
+        const interactionRouter = new koa_router_1.default();
+        const body = (0, koa_body_1.koaBody)({ text: false, json: true, patchNode: true, patchKoa: true });
+        interactionRouter.use(async (ctx, next) => {
+            ctx.set('cache-control', 'no-store');
+            await next();
+        });
+        interactionRouter.get(`/${mountPath}/interaction/:uid`, async (ctx) => {
+            const details = await provider.interactionDetails(ctx.req, ctx.res);
+            ctx.type = 'text/html';
+            ctx.body = await view.render({ uid: details.uid, prompt: details.prompt.name, params: details.params });
+        });
+        interactionRouter.post(`/${mountPath}/interaction/:uid/confirm`, body, async (ctx) => {
+            const interactionDetails = await provider.interactionDetails(ctx.req, ctx.res);
+            const { prompt: { name, details }, params, session: { accountId } } = interactionDetails;
+            if (name !== 'consent') {
+                ctx.status = 400;
+                return;
+            }
+            let { grantId } = interactionDetails;
+            let grant;
+            if (grantId) {
+                grant = await provider.Grant.find(grantId);
+            }
+            else {
+                grant = new provider.Grant({ accountId, clientId: params.client_id });
+            }
+            if (details.missingOIDCScope)
+                grant.addOIDCScope(details.missingOIDCScope.join(' '));
+            if (details.missingOIDCClaims)
+                grant.addOIDCClaims(details.missingOIDCClaims);
+            if (details.missingResourceScopes) {
+                for (const [indicator, scopeStr] of Object.entries(details.missingResourceScopes))
+                    grant.addResourceScope(indicator, scopeStr.join(' '));
+            }
+            grantId = await grant.save();
+            const consent = {};
+            if (!interactionDetails.grantId)
+                consent.grantId = grantId;
+            await provider.interactionFinished(ctx.req, ctx.res, { consent }, { mergeWithLastSubmission: true });
+        });
+        interactionRouter.post(`/${mountPath}/interaction/:uid/login`, body, async (ctx) => {
+            let interactionName;
+            try {
+                const { prompt: { name } } = await provider.interactionDetails(ctx.req, ctx.res);
+                interactionName = name;
+            }
+            catch (err) {
+                ctx.redirect(`${issuer}/auth?client_id=${mountPath}-default&redirect_uri=${issuer}/${mountPath}/callback&response_type=code&scope=openid%20email%20profile%20offline_access`);
+                return;
+            }
+            if (!['login', 'consent'].includes(interactionName)) {
+                ctx.status = 400;
+                return;
+            }
+            const { email, password } = ctx.request.body ?? {};
+            if (!email || !password) {
+                ctx.status = 400;
+                ctx.body = { error: 'Email and password are required' };
+                return;
+            }
+            try {
+                const result = await verifyUser(email, password);
+                if (!result?.ok) {
+                    ctx.status = 401;
+                    ctx.body = { error: result?.error ?? 'Invalid credentials' };
+                    return;
+                }
+                const accountId = result.user._id.toString();
+                const redirectTo = await provider.interactionResult(ctx.req, ctx.res, {
+                    login: { accountId },
+                });
+                ctx.body = { redirectTo };
+            }
+            catch (err) {
+                ctx.status = 400;
+                ctx.body = { error: err.message, code: err.code, details: err.details };
+            }
+        });
+        interactionRouter.post(`/${mountPath}/interaction/:uid/signup`, body, async (ctx) => {
+            let interactionName;
+            try {
+                const { prompt: { name } } = await provider.interactionDetails(ctx.req, ctx.res);
+                interactionName = name;
+            }
+            catch (err) {
+                ctx.redirect(`${issuer}/auth?client_id=${mountPath}-default&redirect_uri=${issuer}/${mountPath}/callback&response_type=code&scope=openid%20email%20profile%20offline_access`);
+                return;
+            }
+            if (!['login', 'consent'].includes(interactionName)) {
+                ctx.status = 400;
+                return;
+            }
+            const { email, password } = ctx.request.body ?? {};
+            const validation = await new core_1.Validator({
+                type: 'object',
+                properties: {
+                    email: { type: 'string' },
+                    password: { type: 'string' },
+                }
+            }).validate({ email, password });
+            if (validation) {
+                ctx.status = 400;
+                ctx.body = { error: 'Validation failed', details: validation };
+                return;
+            }
+            const existing = await users?.get({ email }).catch(() => null);
+            if (existing) {
+                ctx.status = 409;
+                ctx.body = { error: 'Email already registered' };
+                return;
+            }
+            const hashedPassword = await (0, utils_1.hashPassword)(password);
+            try {
+                const user = await users?.insert({
+                    email,
+                    password: hashedPassword,
+                    username: email.split('@').shift(),
+                    isActive: true,
+                    roles: 'user',
+                    emailVerified: false,
+                    failedLoginAttempts: 0,
+                });
+                const accountId = user._id.toString();
+                const redirectTo = await provider.interactionResult(ctx.req, ctx.res, {
+                    login: { accountId },
+                });
+                ctx.body = { redirectTo };
+            }
+            catch (err) {
+                ctx.status = 400;
+                ctx.body = { error: err.message, code: err.code, details: err.details };
+            }
+        });
+        interactionRouter.get(`/${mountPath}/interaction/:uid/abort`, async (ctx) => {
+            await provider.interactionFinished(ctx.req, ctx.res, {
+                error: 'access_denied', error_description: 'End-User aborted interaction',
+            }, { mergeWithLastSubmission: false });
+        });
+        for (const [name, { client: fedClient, config: fedConfig }] of federationClients) {
+            interactionRouter.post(`/${mountPath}/interaction/:uid/federated/${name}`, body, async (ctx) => {
+                const { prompt: { name: promptName } } = await provider.interactionDetails(ctx.req, ctx.res);
+                if (promptName !== 'login') {
+                    ctx.status = 400;
+                    return;
+                }
+                const code_verifier = openidClient.randomPKCECodeVerifier();
+                const BASE_URL = process.env.BASE_URL ?? `http://localhost:${port}`;
+                ctx.status = 303;
+                ctx.redirect(openidClient.buildAuthorizationUrl(fedClient, {
+                    redirect_uri: `${BASE_URL}/${mountPath}/interaction/callback/${name}`,
+                    scope: fedConfig.scopes,
+                    code_challenge: await openidClient.calculatePKCECodeChallenge(code_verifier),
+                    code_challenge_method: 'S256',
+                    state: ctx.params.uid,
+                    nonce: code_verifier,
+                    access_type: 'offline', // ask Google for refresh token
+                    prompt: 'consent', // force re-issue of refresh token
+                }));
+            });
+            interactionRouter.get(`/${mountPath}/interaction/callback/${name}`, async (ctx) => {
+                const uid = ctx.query.state;
+                // ?? Strip extra params Google appends (iss, authuser, prompt) that break oauth4webapi ??
+                const url = new URL(`http://localhost:${port}${ctx.path}`);
+                url.searchParams.set('code', ctx.query.code);
+                url.searchParams.set('state', ctx.query.state);
+                const tokens = await openidClient.authorizationCodeGrant(fedClient, url, { idTokenExpected: true, expectedState: uid });
+                const claims = tokens.claims();
+                if (!claims?.email)
+                    throw new Error('No email in federated token claims');
+                const user = await findOrCreateFederatedUser(claims.email);
+                // ?? Store upstream refresh token in TokenModel ??
+                if (tokens.refresh_token) {
+                    const existing = await tokenModel.find({
+                        accountId: user._id,
+                        provider: name,
+                        appId: fedConfig.client_id,
+                    }).then((r) => r?.[0] ?? null).catch(() => null);
+                    if (existing) {
+                        await tokenModel.update({ _id: existing._id }, { refreshToken: tokens.refresh_token });
+                    }
+                    else {
+                        await tokenModel.insert({
+                            _sync: true,
+                            accountId: user._id,
+                            provider: name,
+                            appId: fedConfig.client_id,
+                            refreshToken: tokens.refresh_token,
+                            scope: fedConfig.scopes,
+                            expiresAt: null,
+                        });
+                    }
+                }
+                await provider.interactionFinished(ctx.req, ctx.res, { login: { accountId: user._id } }, { mergeWithLastSubmission: false });
+            });
+        }
+        const interactionRoutes = interactionRouter.routes();
+        provider.use(async (ctx, next) => {
+            if (ctx.path.startsWith(`/${mountPath}/interaction`))
+                await interactionRoutes(ctx, next);
+            else
+                await next();
+        });
+        this.router.post(`/${mountPath}/token`, async (ctx) => {
+            const { code, code_verifier } = (ctx.request.body ?? {});
+            if (!code) {
+                ctx.status = 400;
+                ctx.body = { error: 'Missing code' };
+                return;
+            }
+            const tokenRes = await fetch(`${issuer}/token`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                body: new URLSearchParams({
+                    grant_type: 'authorization_code',
+                    code,
+                    redirect_uri: `${issuer}/${mountPath}/callback`,
+                    client_id: `${mountPath}-default`,
+                    client_secret: 'default-secret',
+                    ...(code_verifier ? { code_verifier } : {}),
+                }).toString(),
+            });
+            const tokens = await tokenRes.json();
+            ctx.body = {
+                access_token: tokens.access_token ?? '',
+                refresh_token: tokens.refresh_token ?? '',
+                id_token: tokens.id_token ?? '',
+                return_to: returnTo,
+            };
+        });
+        this.router.get(`/${mountPath}/callback`, async (ctx) => {
+            const { code } = ctx.query;
+            if (!code) {
+                ctx.status = 400;
+                ctx.body = { error: 'Missing code' };
+                return;
+            }
+            ctx.type = 'text/html';
+            ctx.body = `<!DOCTYPE html><html><body><script>
+                (async () => {
+                    const verifier = sessionStorage.getItem('pkce_verifier');
+                    sessionStorage.removeItem('pkce_verifier');
+                    const res  = await fetch('/${mountPath}/token', {
+                        method  : 'POST',
+                        headers : { 'Content-Type': 'application/json' },
+                        body    : JSON.stringify({ code: ${JSON.stringify(code)}, code_verifier: verifier }),
+                    });
+                    const data = await res.json();
+                    const target = new URL(data.return_to, window.location.origin);
+                    target.searchParams.set('access_token',  data.access_token  ?? '');
+                    target.searchParams.set('refresh_token', data.refresh_token ?? '');
+                    target.searchParams.set('id_token',      data.id_token      ?? '');
+                    window.location.href = target.toString();
+                })();
+            </script></body></html>`;
+        });
+        provider._hasView = !!view;
+        this._oidcProviders.set(mountPath, { provider, federation });
+        display_1.display.log('oidc', `Provider ready at ${issuer}`);
+        const { randomBytes, createHash } = require('node:crypto');
+        const _verifier = randomBytes(32).toString('base64url');
+        const _challenge = createHash('sha256').update(_verifier).digest('base64url');
+        pkceStore.set(_challenge, _verifier);
+        display_1.display.addOIDC(`${issuer}/auth?client_id=${mountPath}-default` +
+            `&redirect_uri=${issuer}/${mountPath}/callback` +
+            `&response_type=code` +
+            `&scope=openid%20email%20profile%20offline_access` +
+            `&code_challenge=${_challenge}` +
+            `&code_challenge_method=S256`);
     }
     // ?? OIDC Providers ?????????????????????????????????????????????????????
     authPath;
-    setOIDCProviders(path, providers) {
-        console.log('[Server] setOIDCProviders called with path:', path, 'providers:', providers?.map(p => p.id));
-        this.authPath = path;
-        if (this.config.domain)
-            path = `${this.config.domain}/${path}`;
-        path = path.split('/').filter((x) => x).join('/');
-        providers?.forEach?.((provider) => {
-            if (!this.providers.find(x => x.clientId === provider.clientId))
-                this.providers.push({ ...provider });
-        });
-        // Store OIDC config for extension
-        this.extensionConfigs.set('oidc', {
-            providers: providers || [],
-            authPath: path,
-        });
+    registerOIDCServer(path, config) {
+        this._oidcServers.push({ path: path.replace(/^\/+|\/+$/g, ''), config: config ?? {} });
         return this;
     }
-    // ?? Upload ????????????????????????????????????????????????????????????????
     upload(path, handler) {
         this.routes.push({
             method: 'post',
@@ -261,7 +790,6 @@ class Server extends eventemitter3_1.EventEmitter {
         });
         return this;
     }
-    // ?? Stream ????????????????????????????????????????????????????????????????
     _streamHandler;
     _uploadTmp = '/tmp/hotfusion-uploads';
     stream(handler) {
@@ -298,6 +826,19 @@ class Server extends eventemitter3_1.EventEmitter {
             catch { }
             uploads.set(uploadId, { meta: fullMeta, totalChunks, received });
             socket.emit(`upload:started:${uploadId}`);
+            if (totalChunks === 0) {
+                uploads.delete(uploadId);
+                const emptyBuffer = Buffer.alloc(1, ' ');
+                Promise.resolve().then(async () => {
+                    try {
+                        const result = handler ? await handler(emptyBuffer, { ...fullMeta }) : { ok: true };
+                        socket.emit(`upload:complete:${uploadId}`, result);
+                    }
+                    catch (err) {
+                        socket.emit(`upload:error:${uploadId}`, err?.message ?? String(err));
+                    }
+                });
+            }
         });
         socket.on('upload:chunk', async ({ uploadId, index, data }) => {
             const upload = uploads.get(uploadId);
@@ -312,11 +853,13 @@ class Server extends eventemitter3_1.EventEmitter {
                 socket.emit(`upload:ack:${uploadId}:${index}`);
                 if (upload.received.size === upload.totalChunks) {
                     const chunks = [];
-                    for (let i = 0; i < upload.totalChunks; i++) {
+                    for (let i = 0; i < upload.totalChunks; i++)
                         chunks.push(await readFile(`${uploadTmp}/${uploadId}/${i}`));
-                    }
                     const buffer = Buffer.concat(chunks);
-                    await rm(`${uploadTmp}/${uploadId}`, { recursive: true, force: true });
+                    try {
+                        await rm(`${uploadTmp}/${uploadId}`, { recursive: true, force: true });
+                    }
+                    catch { }
                     uploads.delete(uploadId);
                     let meta = {};
                     if (this.listenerCount('uploaded') > 0) {
@@ -324,8 +867,13 @@ class Server extends eventemitter3_1.EventEmitter {
                         const results = await Promise.all(listeners.map(listener => new Promise(resolve => listener({ resolve, file: upload.meta, buffer }))));
                         meta = Object.assign({}, ...results);
                     }
-                    const result = handler ? await handler(buffer, { ...upload.meta, ...meta }) : { ok: true };
-                    socket.emit(`upload:complete:${uploadId}`, result);
+                    try {
+                        const result = handler ? await handler(buffer, { ...upload.meta, ...meta }) : { ok: true };
+                        socket.emit(`upload:complete:${uploadId}`, result);
+                    }
+                    catch (err) {
+                        socket.emit(`upload:error:${uploadId}`, err?.message ?? String(err));
+                    }
                 }
             }
             catch (err) {
@@ -333,7 +881,6 @@ class Server extends eventemitter3_1.EventEmitter {
             }
         });
     }
-    // ?? Socket subscriptions ????????????????????????????????????????????????????
     _setupSubscriptions(socket) {
         const socketSubs = new Map();
         const resolveModel = (id, scope) => {
@@ -384,19 +931,16 @@ class Server extends eventemitter3_1.EventEmitter {
             }
         });
         socket.on('disconnect', () => {
-            for (const { subscription, listener } of socketSubs.values()) {
+            for (const { subscription, listener } of socketSubs.values())
                 subscription.off('publish', listener);
-            }
             socketSubs.clear();
             this.registeredModels.forEach(m => m.model.emit('disconnect', socket));
         });
     }
-    // ?? Metadata endpoint ??????????????????????????????????????????????????????
     _setupMetadataRoute() {
         this.router.get('/@metadata', async (ctx) => {
             const buildMeta = (id, scope, model) => ({
-                id,
-                scope,
+                id, scope,
                 schema: model.getSchema?.(),
                 schemes: model.getSchemes?.(),
                 operations: this.API_OPERATIONS.map(op => ({
@@ -411,60 +955,94 @@ class Server extends eventemitter3_1.EventEmitter {
                     path: `/${id}/${scope}/${m}`,
                     url: `http://localhost:${this.port}/${id}/${scope}/${m}`,
                 })),
-                extensions: (model.getExtensions?.() ?? []).map((ext) => buildMeta(id, `${scope}/${ext.id}`, ext)),
+                extensions: (model.getExtensions?.() ?? []).map((ext) => buildMeta(id, `${scope}/${ext.id}`, ext))
             });
-            ctx.body = { api: this.registeredModels.map(m => buildMeta(m.id, m.scope, m.model)) };
+            ctx.body = {
+                api: this.registeredModels.map(m => buildMeta(m.id, m.scope, m.model)),
+                oidc: [...this._oidcProviders.entries()].map(([mountPath, { federation }]) => ({
+                    path: mountPath,
+                    federation: federation
+                        .filter((f) => f.isActive !== false)
+                        .map((f) => ({
+                        name: f.name,
+                        issuer: f.issuer,
+                        scopes: f.scopes,
+                        url: `/${mountPath}/interaction/:uid/federated/${f.name}`,
+                    })),
+                    endpoints: {
+                        signin: `/${mountPath}/interaction/:uid/login`,
+                        signup: `/${mountPath}/interaction/:uid/signup`,
+                        federate: `/${mountPath}/interaction/:uid/federated/:provider`,
+                    }
+                }))
+            };
         });
     }
-    // ?? Route helper (kept for backward compatibility) ??????????????????????????
     route(route) {
         route.path = Utils.trimPath(route.path);
         this.routes.push(route);
         return this;
     }
-    // ?? Start server ????????????????????????????????????????????????????????????
+    folder(urlPath, folderPath) {
+        const fs = require('node:fs');
+        if (!fs.existsSync(folderPath))
+            throw new Error(`[Server] folder() path does not exist: ${folderPath}`);
+        this._staticFolders.push(urlPath);
+        const staticMiddleware = (0, koa_static_1.default)(folderPath);
+        this.app.use(async (ctx, next) => {
+            if (ctx.path.startsWith(urlPath)) {
+                ctx.path = ctx.path.slice(urlPath.length) || '/';
+                return staticMiddleware(ctx, next);
+            }
+            return next();
+        });
+        return this;
+    }
     async start() {
-        console.log('[Server] Start called');
-        // Wait a bit then start the server setup
-        await new Promise(resolve => setTimeout(resolve, 100));
-        console.log('[Server] Setting up app');
-        // Error handling middleware
+        this.app.use((0, cors_1.default)());
+        this.app.keys = [this.config?.secret || keygen_js_1.KeyGen.getSystemSecret()];
+        for (const { path: oidcPath, config: oidcConfig } of this._oidcServers) {
+            await this._setupOIDC(oidcConfig, oidcPath);
+        }
+        this.app.use((0, bodyparser_1.default)({ enableTypes: ['json'], parsedMethods: ['POST', 'PUT', 'PATCH', 'DELETE'] }));
+        this.app.use((0, koa_session_1.default)({
+            key: this.config?.secret || keygen_js_1.KeyGen.getSystemSecret(),
+            maxAge: 86400000,
+            autoCommit: true,
+            overwrite: false,
+            httpOnly: true,
+            signed: true,
+            rolling: false,
+            renew: false,
+            secure: process.env.NODE_ENV === 'production',
+        }, this.app));
         this.app.use(async (ctx, next) => {
             try {
                 await next();
             }
             catch (err) {
+                if (ctx.res.headersSent)
+                    return;
                 ctx.status = err.status || 500;
-                ctx.body = {
-                    error: err.message || 'Internal error',
-                    status: err.status
-                };
+                ctx.body = { error: err.message || 'Internal error', status: err.status };
             }
         });
-        // Mount auto-generated model routes
-        this.mountModelRoutes();
-        // Setup extensions FIRST (before any routes)
-        console.log('[Server] Before setupExtensions');
+        await this.mountModelRoutes();
         await this.setupExtensions();
-        console.log('[Server] After setupExtensions');
-        // Mount metadata endpoint
         this._setupMetadataRoute();
-        // Mount manually registered routes
         for (let i = 0; i < this.routes.length; i++) {
-            let { method, path, callback } = this.routes[i] || {};
+            const { method, path, callback } = this.routes[i] || {};
             if (method && path && callback) {
                 const handler = async (ctx, next) => {
-                    let flags = {
-                        protected: this.routes?.[i]?.protected || false
-                    };
+                    const flags = { protected: this.routes?.[i]?.protected || false };
                     try {
                         if (flags.protected) {
-                            let TOKEN = ctx.headers.authorization;
+                            const TOKEN = ctx.headers.authorization;
                             if (!TOKEN)
                                 ctx.throw(401, 'Unauthorized');
                             ctx.token = (await (0, jose_1.jwtVerify)(TOKEN.split(' ').pop(), new TextEncoder().encode(Array.isArray(this.app?.keys) ? this.app.keys[0] : undefined))).payload;
                         }
-                        let body = await callback(ctx, next);
+                        const body = await callback(ctx, next);
                         if (!ctx.body) {
                             ctx.status = 200;
                             ctx.body = body;
@@ -472,9 +1050,7 @@ class Server extends eventemitter3_1.EventEmitter {
                     }
                     catch (err) {
                         ctx.status = 500;
-                        ctx.body = {
-                            error: err.message || err.code || err.details || 'Internal error',
-                        };
+                        ctx.body = { error: err.message || err.code || err.details || 'Internal error' };
                     }
                 };
                 if (method === 'get')
@@ -491,21 +1067,54 @@ class Server extends eventemitter3_1.EventEmitter {
         }
         this.app.use(this.router.routes());
         this.app.use(this.router.allowedMethods());
-        const server = this.app.listen(this.port, '0.0.0.0', () => {
-            this.emit("mounted", this);
-        });
-        this.io = new socket_io_1.Server(server, {
-            cors: { origin: "*", methods: ["GET", "POST"] },
+        const httpServer = this.app.listen(this.port, '0.0.0.0', async () => {
+            await display_1.display.run(this.port, async () => {
+                this.emit('mounted', this);
+            });
         });
-        this.io.use((socket, next) => {
-            next();
+        // ?? Mount OIDC providers on raw Node server — intercepts before Koa ??????
+        if (this._oidcProviders.size > 0) {
+            const providers = this._oidcProviders;
+            const staticFolders = this._staticFolders;
+            const originalEmit = httpServer.emit.bind(httpServer);
+            httpServer.emit = function (event, ...args) {
+                if (event === 'request') {
+                    const [req, res] = args;
+                    const url = req.url ?? '';
+                    const isStatic = staticFolders.some(p => url === p || url.startsWith(p + '/') || url.startsWith(p + '?'));
+                    if (isStatic)
+                        return originalEmit(event, ...args);
+                    for (const [mountPath, { provider }] of providers) {
+                        const hasView = provider._hasView;
+                        const oidcPaths = [
+                            '/auth', '/.well-known', '/token', '/me', '/jwks',
+                            '/session', '/token/introspection', '/token/revocation',
+                            '/request',
+                            `/${mountPath}/interaction`,
+                            ...(!hasView ? ['/interaction'] : []),
+                        ];
+                        if (oidcPaths.some((p) => url === p || url.startsWith(p + '?') || url.startsWith(p + '/'))) {
+                            if (url === `/${mountPath}/callback` || url.startsWith(`/${mountPath}/callback?`) ||
+                                url === `/${mountPath}/token` || url.startsWith(`/${mountPath}/token?`)) {
+                                return originalEmit(event, ...args);
+                            }
+                            provider.callback()(req, res);
+                            return true;
+                        }
+                    }
+                }
+                return originalEmit(event, ...args);
+            };
+        }
+        this.io = new socket_io_1.Server(httpServer, {
+            cors: { origin: '*', methods: ['GET', 'POST'] },
         });
-        this.io.on("connection", (socket) => {
+        this.io.use((socket, next) => { next(); });
+        this.io.on('connection', (socket) => {
             this._setupStream(socket);
             this._setupSubscriptions(socket);
             this.emit('connection', { socket });
         });
-        console.log('[Server] Start complete, listening on port', this.port);
         return this;
     }
 }