@idp.global/sdk 17.0.0 → 17.1.0

package/changelog.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 2026-09-13 - 17.1.0
+
+### Fixes
+
+- Update release tooling, require build and test preflight, and qualify account persistence against NoSQLDB 10.2.0.
+
+### Features
+
+- Add a subject-bound server UserInfo client with bounded transport and validated organization display claims.
+
 ## 2026-09-09 - 17.0.0
 
 ### Breaking Changes

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@idp.global/sdk',
-    version: '17.0.0',
+    version: '17.1.0',
     description: 'Reusable browser and server SDK for idp.global authentication.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxpQkFBaUI7SUFDdkIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLGdFQUFnRTtDQUM5RSxDQUFBIn0=

package/dist_ts_server/classes.oidc-userinfo-client.d.ts

@@ -0,0 +1,22 @@
+import * as plugins from './plugins.js';
+export interface IOidcUserInfoClientOptions {
+    issuer: string;
+    timeoutMs?: number;
+    maxResponseBytes?: number;
+}
+export interface IOidcUserInfoClientRequest {
+    token: string;
+    /** Subject already established by the application's verified OIDC login. */
+    subject: string;
+}
+export declare class OidcUserInfoError extends Error {
+    readonly code: 'invalid_request' | 'invalid_response' | 'unauthenticated' | 'unavailable';
+    constructor(code: 'invalid_request' | 'invalid_response' | 'unauthenticated' | 'unavailable');
+}
+/** Fetches display claims using a server-held token; results are never authorization grants. */
+export declare class OidcUserInfoClient {
+    #private;
+    constructor(optionsArg: IOidcUserInfoClientOptions);
+    getUserInfo(requestArg: IOidcUserInfoClientRequest): Promise<plugins.idpInterfaces.data.IUserInfoResponse>;
+    private validateResponse;
+}

package/dist_ts_server/classes.oidc-userinfo-client.js

@@ -0,0 +1,154 @@
+import * as plugins from './plugins.js';
+export class OidcUserInfoError extends Error {
+    code;
+    constructor(code) {
+        super(`OIDC userinfo ${code.replace(/_/g, ' ')}.`);
+        this.code = code;
+        this.name = 'OidcUserInfoError';
+    }
+}
+const record = (valueArg) => valueArg !== null && typeof valueArg === 'object' && !Array.isArray(valueArg);
+const exactString = (valueArg, maximumArg = 512) => typeof valueArg === 'string' && valueArg.length > 0 && valueArg.length <= maximumArg
+    && valueArg.trim() === valueArg && !/[\u0000-\u001f\u007f]/.test(valueArg);
+const strings = (valueArg) => Array.isArray(valueArg) && valueArg.every((entryArg) => exactString(entryArg))
+    && new Set(valueArg).size === valueArg.length;
+/** Fetches display claims using a server-held token; results are never authorization grants. */
+export class OidcUserInfoClient {
+    #endpoint;
+    #timeoutMs;
+    #maxResponseBytes;
+    constructor(optionsArg) {
+        if (!optionsArg || !exactString(optionsArg.issuer, 2048))
+            throw new OidcUserInfoError('invalid_request');
+        let issuer;
+        try {
+            issuer = new URL(optionsArg.issuer);
+        }
+        catch {
+            throw new OidcUserInfoError('invalid_request');
+        }
+        const canonicalIssuer = issuer.origin + (issuer.pathname === '/' ? '' : issuer.pathname);
+        if (issuer.protocol !== 'https:' || issuer.username || issuer.password || issuer.search || issuer.hash
+            || issuer.pathname.includes('//') || issuer.pathname.endsWith('/') && issuer.pathname !== '/'
+            || canonicalIssuer !== optionsArg.issuer)
+            throw new OidcUserInfoError('invalid_request');
+        this.#timeoutMs = optionsArg.timeoutMs ?? 5000;
+        this.#maxResponseBytes = optionsArg.maxResponseBytes ?? 65536;
+        if (!Number.isSafeInteger(this.#timeoutMs) || this.#timeoutMs < 1 || this.#timeoutMs > 30000
+            || !Number.isSafeInteger(this.#maxResponseBytes) || this.#maxResponseBytes < 1 || this.#maxResponseBytes > 1048576) {
+            throw new OidcUserInfoError('invalid_request');
+        }
+        this.#endpoint = `${canonicalIssuer}/oauth/userinfo`;
+    }
+    async getUserInfo(requestArg) {
+        if (!requestArg || !exactString(requestArg.subject) || !exactString(requestArg.token, 16384)
+            || !/^[A-Za-z0-9\-._~+/]+=*$/.test(requestArg.token))
+            throw new OidcUserInfoError('invalid_request');
+        // Snapshot the principal and token before any asynchronous work.
+        const { token, subject } = requestArg;
+        const controller = new AbortController();
+        let timer;
+        const deadline = new Promise((_resolveArg, rejectArg) => {
+            timer = setTimeout(() => {
+                controller.abort();
+                rejectArg(new OidcUserInfoError('unavailable'));
+            }, this.#timeoutMs);
+        });
+        let reader;
+        try {
+            const response = await Promise.race([fetch(this.#endpoint, {
+                    method: 'GET', redirect: 'error', credentials: 'omit', cache: 'no-store', signal: controller.signal,
+                    headers: { authorization: `Bearer ${token}`, accept: 'application/json' },
+                }), deadline]);
+            if (response.status === 401 || response.status === 403)
+                throw new OidcUserInfoError('unauthenticated');
+            if (response.status !== 200)
+                throw new OidcUserInfoError('unavailable');
+            if (response.headers.get('content-type')?.split(';')[0].trim().toLowerCase() !== 'application/json'
+                || !response.headers.get('cache-control')?.toLowerCase().split(',').map((partArg) => partArg.trim()).includes('no-store')
+                || !response.body)
+                throw new OidcUserInfoError('invalid_response');
+            const contentLength = response.headers.get('content-length');
+            if (contentLength !== null && (!/^\d+$/.test(contentLength) || Number(contentLength) > this.#maxResponseBytes)) {
+                throw new OidcUserInfoError('invalid_response');
+            }
+            reader = response.body.getReader();
+            const chunks = [];
+            let size = 0;
+            while (true) {
+                const part = await Promise.race([reader.read(), deadline]);
+                if (part.done)
+                    break;
+                size += part.value.byteLength;
+                if (size > this.#maxResponseBytes)
+                    throw new OidcUserInfoError('invalid_response');
+                chunks.push(part.value);
+            }
+            let value;
+            try {
+                value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks)));
+            }
+            catch {
+                throw new OidcUserInfoError('invalid_response');
+            }
+            return this.validateResponse(value, subject);
+        }
+        catch (errorArg) {
+            if (errorArg instanceof OidcUserInfoError)
+                throw errorArg;
+            // Transport errors can contain credentials, URLs or response bodies.
+            throw new OidcUserInfoError('unavailable');
+        }
+        finally {
+            clearTimeout(timer);
+            controller.abort();
+            if (reader)
+                void reader.cancel().catch(() => undefined);
+        }
+    }
+    validateResponse(valueArg, subjectArg) {
+        const invalid = () => new OidcUserInfoError('invalid_response');
+        if (!record(valueArg) || valueArg.sub !== subjectArg)
+            throw invalid();
+        const result = { sub: subjectArg };
+        for (const key of ['name', 'preferred_username', 'picture', 'email']) {
+            if (!Object.hasOwn(valueArg, key))
+                continue;
+            const value = valueArg[key];
+            if (typeof value !== 'string' || value.length > 4096)
+                throw invalid();
+            result[key] = value;
+        }
+        if (Object.hasOwn(valueArg, 'email_verified')) {
+            if (typeof valueArg.email_verified !== 'boolean')
+                throw invalid();
+            result.email_verified = valueArg.email_verified;
+        }
+        for (const key of ['roles', 'app_roles', 'app_permissions', 'app_scopes']) {
+            if (!Object.hasOwn(valueArg, key))
+                continue;
+            const value = valueArg[key];
+            if (!strings(value))
+                throw invalid();
+            result[key] = [...value];
+        }
+        if (Object.hasOwn(valueArg, 'organizations')) {
+            if (!Array.isArray(valueArg.organizations))
+                throw invalid();
+            const seen = new Set();
+            result.organizations = valueArg.organizations.map((organizationArg) => {
+                if (!record(organizationArg) || !exactString(organizationArg.id)
+                    || typeof organizationArg.name !== 'string' || organizationArg.name.length > 4096
+                    || !exactString(organizationArg.slug) || !strings(organizationArg.roles)
+                    || seen.has(organizationArg.id)
+                    || Object.keys(organizationArg).some((keyArg) => !['id', 'name', 'slug', 'roles'].includes(keyArg)))
+                    throw invalid();
+                seen.add(organizationArg.id);
+                return { id: organizationArg.id, name: organizationArg.name, slug: organizationArg.slug, roles: [...organizationArg.roles] };
+            });
+        }
+        // OIDC allows additional claims; only the documented, validated fields leave the SDK.
+        return result;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5vaWRjLXVzZXJpbmZvLWNsaWVudC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzX3NlcnZlci9jbGFzc2VzLm9pZGMtdXNlcmluZm8tY2xpZW50LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sY0FBYyxDQUFDO0FBY3hDLE1BQU0sT0FBTyxpQkFBa0IsU0FBUSxLQUFLO0lBQ2Q7SUFBNUIsWUFBNEIsSUFBZ0Y7UUFDMUcsS0FBSyxDQUFDLGlCQUFpQixJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUM7UUFEekIsU0FBSSxHQUFKLElBQUksQ0FBNEU7UUFFMUcsSUFBSSxDQUFDLElBQUksR0FBRyxtQkFBbUIsQ0FBQztJQUNsQyxDQUFDO0NBQ0Y7QUFFRCxNQUFNLE1BQU0sR0FBRyxDQUFDLFFBQWlCLEVBQXVDLEVBQUUsQ0FDeEUsUUFBUSxLQUFLLElBQUksSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBQ2hGLE1BQU0sV0FBVyxHQUFHLENBQUMsUUFBaUIsRUFBRSxVQUFVLEdBQUcsR0FBRyxFQUFzQixFQUFFLENBQzlFLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUMsSUFBSSxRQUFRLENBQUMsTUFBTSxJQUFJLFVBQVU7T0FDakYsUUFBUSxDQUFDLElBQUksRUFBRSxLQUFLLFFBQVEsSUFBSSxDQUFDLHVCQUF1QixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUM3RSxNQUFNLE9BQU8sR0FBRyxDQUFDLFFBQWlCLEVBQXdCLEVBQUUsQ0FDMUQsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsSUFBSSxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxXQUFXLENBQUMsUUFBUSxDQUFDLENBQUM7T0FDM0UsSUFBSSxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUMsSUFBSSxLQUFLLFFBQVEsQ0FBQyxNQUFNLENBQUM7QUFFaEQsZ0dBQWdHO0FBQ2hHLE1BQU0sT0FBTyxrQkFBa0I7SUFDcEIsU0FBUyxDQUFTO0lBQ2xCLFVBQVUsQ0FBUztJQUNuQixpQkFBaUIsQ0FBUztJQUVuQyxZQUFZLFVBQXNDO1FBQ2hELElBQUksQ0FBQyxVQUFVLElBQUksQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDLE1BQU0sRUFBRSxJQUFJLENBQUM7WUFBRSxNQUFNLElBQUksaUJBQWlCLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUN6RyxJQUFJLE1BQVcsQ0FBQztRQUNoQixJQUFJLENBQUM7WUFBQyxNQUFNLEdBQUcsSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQUMsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUFDLE1BQU0sSUFBSSxpQkFBaUIsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO1FBQUMsQ0FBQztRQUN0RyxNQUFNLGVBQWUsR0FBRyxNQUFNLENBQUMsTUFBTSxHQUFHLENBQUMsTUFBTSxDQUFDLFFBQVEsS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ3pGLElBQUksTUFBTSxDQUFDLFFBQVEsS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLFFBQVEsSUFBSSxNQUFNLENBQUMsUUFBUSxJQUFJLE1BQU0sQ0FBQyxNQUFNLElBQUksTUFBTSxDQUFDLElBQUk7ZUFDakcsTUFBTSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksTUFBTSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLElBQUksTUFBTSxDQUFDLFFBQVEsS0FBSyxHQUFHO2VBQzFGLGVBQWUsS0FBSyxVQUFVLENBQUMsTUFBTTtZQUFFLE1BQU0sSUFBSSxpQkFBaUIsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO1FBQzNGLElBQUksQ0FBQyxVQUFVLEdBQUcsVUFBVSxDQUFDLFNBQVMsSUFBSSxJQUFJLENBQUM7UUFDL0MsSUFBSSxDQUFDLGlCQUFpQixHQUFHLFVBQVUsQ0FBQyxnQkFBZ0IsSUFBSSxLQUFLLENBQUM7UUFDOUQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxJQUFJLElBQUksQ0FBQyxVQUFVLEdBQUcsQ0FBQyxJQUFJLElBQUksQ0FBQyxVQUFVLEdBQUcsS0FBSztlQUN2RixDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLGlCQUFpQixDQUFDLElBQUksSUFBSSxDQUFDLGlCQUFpQixHQUFHLENBQUMsSUFBSSxJQUFJLENBQUMsaUJBQWlCLEdBQUcsT0FBTyxFQUFFLENBQUM7WUFDckgsTUFBTSxJQUFJLGlCQUFpQixDQUFDLGlCQUFpQixDQUFDLENBQUM7UUFDakQsQ0FBQztRQUNELElBQUksQ0FBQyxTQUFTLEdBQUcsR0FBRyxlQUFlLGlCQUFpQixDQUFDO0lBQ3ZELENBQUM7SUFFTSxLQUFLLENBQUMsV0FBVyxDQUFDLFVBQXNDO1FBQzdELElBQUksQ0FBQyxVQUFVLElBQUksQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFDO2VBQ3ZGLENBQUMseUJBQXlCLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUM7WUFBRSxNQUFNLElBQUksaUJBQWlCLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUN2RyxpRUFBaUU7UUFDakUsTUFBTSxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsR0FBRyxVQUFVLENBQUM7UUFDdEMsTUFBTSxVQUFVLEdBQUcsSUFBSSxlQUFlLEVBQUUsQ0FBQztRQUN6QyxJQUFJLEtBQW9DLENBQUM7UUFDekMsTUFBTSxRQUFRLEdBQUcsSUFBSSxPQUFPLENBQVEsQ0FBQyxXQUFXLEVBQUUsU0FBUyxFQUFFLEVBQUU7WUFDN0QsS0FBSyxHQUFHLFVBQVUsQ0FBQyxHQUFHLEVBQUU7Z0JBQ3RCLFVBQVUsQ0FBQyxLQUFLLEVBQUUsQ0FBQztnQkFDbkIsU0FBUyxDQUFDLElBQUksaUJBQWlCLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQztZQUNsRCxDQUFDLEVBQUUsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQ3RCLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxNQUEyRCxDQUFDO1FBQ2hFLElBQUksQ0FBQztZQUNILE1BQU0sUUFBUSxHQUFHLE1BQU0sT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFO29CQUN6RCxNQUFNLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsV0FBVyxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFLE1BQU0sRUFBRSxVQUFVLENBQUMsTUFBTTtvQkFDbkcsT0FBTyxFQUFFLEVBQUUsYUFBYSxFQUFFLFVBQVUsS0FBSyxFQUFFLEVBQUUsTUFBTSxFQUFFLGtCQUFrQixFQUFFO2lCQUMxRSxDQUFDLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztZQUNmLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxHQUFHLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxHQUFHO2dCQUFFLE1BQU0sSUFBSSxpQkFBaUIsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO1lBQ3ZHLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxHQUFHO2dCQUFFLE1BQU0sSUFBSSxpQkFBaUIsQ0FBQyxhQUFhLENBQUMsQ0FBQztZQUN4RSxJQUFJLFFBQVEsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLGNBQWMsQ0FBQyxFQUFFLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxXQUFXLEVBQUUsS0FBSyxrQkFBa0I7bUJBQzlGLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsZUFBZSxDQUFDLEVBQUUsV0FBVyxFQUFFLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQzttQkFDdEgsQ0FBQyxRQUFRLENBQUMsSUFBSTtnQkFBRSxNQUFNLElBQUksaUJBQWlCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztZQUNyRSxNQUFNLGFBQWEsR0FBRyxRQUFRLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO1lBQzdELElBQUksYUFBYSxLQUFLLElBQUksSUFBSSxDQUFDLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsSUFBSSxNQUFNLENBQUMsYUFBYSxDQUFDLEdBQUcsSUFBSSxDQUFDLGlCQUFpQixDQUFDLEVBQUUsQ0FBQztnQkFDL0csTUFBTSxJQUFJLGlCQUFpQixDQUFDLGtCQUFrQixDQUFDLENBQUM7WUFDbEQsQ0FBQztZQUNELE1BQU0sR0FBRyxRQUFRLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1lBQ25DLE1BQU0sTUFBTSxHQUFpQixFQUFFLENBQUM7WUFDaEMsSUFBSSxJQUFJLEdBQUcsQ0FBQyxDQUFDO1lBQ2IsT0FBTyxJQUFJLEVBQUUsQ0FBQztnQkFDWixNQUFNLElBQUksR0FBRyxNQUFNLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztnQkFDM0QsSUFBSSxJQUFJLENBQUMsSUFBSTtvQkFBRSxNQUFNO2dCQUNyQixJQUFJLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUM7Z0JBQzlCLElBQUksSUFBSSxHQUFHLElBQUksQ0FBQyxpQkFBaUI7b0JBQUUsTUFBTSxJQUFJLGlCQUFpQixDQUFDLGtCQUFrQixDQUFDLENBQUM7Z0JBQ25GLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQzFCLENBQUM7WUFDRCxJQUFJLEtBQWMsQ0FBQztZQUNuQixJQUFJLENBQUM7Z0JBQUMsS0FBSyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxXQUFXLENBQUMsT0FBTyxFQUFFLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQUMsQ0FBQztZQUNwRyxNQUFNLENBQUM7Z0JBQUMsTUFBTSxJQUFJLGlCQUFpQixDQUFDLGtCQUFrQixDQUFDLENBQUM7WUFBQyxDQUFDO1lBQzFELE9BQU8sSUFBSSxDQUFDLGdCQUFnQixDQUFDLEtBQUssRUFBRSxPQUFPLENBQUMsQ0FBQztRQUMvQyxDQUFDO1FBQUMsT0FBTyxRQUFRLEVBQUUsQ0FBQztZQUNsQixJQUFJLFFBQVEsWUFBWSxpQkFBaUI7Z0JBQUUsTUFBTSxRQUFRLENBQUM7WUFDMUQscUVBQXFFO1lBQ3JFLE1BQU0sSUFBSSxpQkFBaUIsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUM3QyxDQUFDO2dCQUFTLENBQUM7WUFDVCxZQUFZLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDcEIsVUFBVSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQ25CLElBQUksTUFBTTtnQkFBRSxLQUFLLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDMUQsQ0FBQztJQUNILENBQUM7SUFFTyxnQkFBZ0IsQ0FBQyxRQUFpQixFQUFFLFVBQWtCO1FBQzVELE1BQU0sT0FBTyxHQUFHLEdBQUcsRUFBRSxDQUFDLElBQUksaUJBQWlCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztRQUNoRSxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxJQUFJLFFBQVEsQ0FBQyxHQUFHLEtBQUssVUFBVTtZQUFFLE1BQU0sT0FBTyxFQUFFLENBQUM7UUFDdEUsTUFBTSxNQUFNLEdBQWlELEVBQUUsR0FBRyxFQUFFLFVBQVUsRUFBRSxDQUFDO1FBQ2pGLEtBQUssTUFBTSxHQUFHLElBQUksQ0FBQyxNQUFNLEVBQUUsb0JBQW9CLEVBQUUsU0FBUyxFQUFFLE9BQU8sQ0FBVSxFQUFFLENBQUM7WUFDOUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFLEdBQUcsQ0FBQztnQkFBRSxTQUFTO1lBQzVDLE1BQU0sS0FBSyxHQUFHLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUM1QixJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsTUFBTSxHQUFHLElBQUk7Z0JBQUUsTUFBTSxPQUFPLEVBQUUsQ0FBQztZQUN0RSxNQUFNLENBQUMsR0FBRyxDQUFDLEdBQUcsS0FBSyxDQUFDO1FBQ3RCLENBQUM7UUFDRCxJQUFJLE1BQU0sQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFLGdCQUFnQixDQUFDLEVBQUUsQ0FBQztZQUM5QyxJQUFJLE9BQU8sUUFBUSxDQUFDLGNBQWMsS0FBSyxTQUFTO2dCQUFFLE1BQU0sT0FBTyxFQUFFLENBQUM7WUFDbEUsTUFBTSxDQUFDLGNBQWMsR0FBRyxRQUFRLENBQUMsY0FBYyxDQUFDO1FBQ2xELENBQUM7UUFDRCxLQUFLLE1BQU0sR0FBRyxJQUFJLENBQUMsT0FBTyxFQUFFLFdBQVcsRUFBRSxpQkFBaUIsRUFBRSxZQUFZLENBQVUsRUFBRSxDQUFDO1lBQ25GLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFFBQVEsRUFBRSxHQUFHLENBQUM7Z0JBQUUsU0FBUztZQUM1QyxNQUFNLEtBQUssR0FBRyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDNUIsSUFBSSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUM7Z0JBQUUsTUFBTSxPQUFPLEVBQUUsQ0FBQztZQUNyQyxNQUFNLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxHQUFHLEtBQUssQ0FBQyxDQUFDO1FBQzNCLENBQUM7UUFDRCxJQUFJLE1BQU0sQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFLGVBQWUsQ0FBQyxFQUFFLENBQUM7WUFDN0MsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLGFBQWEsQ0FBQztnQkFBRSxNQUFNLE9BQU8sRUFBRSxDQUFDO1lBQzVELE1BQU0sSUFBSSxHQUFHLElBQUksR0FBRyxFQUFVLENBQUM7WUFDL0IsTUFBTSxDQUFDLGFBQWEsR0FBRyxRQUFRLENBQUMsYUFBYSxDQUFDLEdBQUcsQ0FBQyxDQUFDLGVBQXdCLEVBQUUsRUFBRTtnQkFDN0UsSUFBSSxDQUFDLE1BQU0sQ0FBQyxlQUFlLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxlQUFlLENBQUMsRUFBRSxDQUFDO3VCQUMzRCxPQUFPLGVBQWUsQ0FBQyxJQUFJLEtBQUssUUFBUSxJQUFJLGVBQWUsQ0FBQyxJQUFJLENBQUMsTUFBTSxHQUFHLElBQUk7dUJBQzlFLENBQUMsV0FBVyxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxlQUFlLENBQUMsS0FBSyxDQUFDO3VCQUNyRSxJQUFJLENBQUMsR0FBRyxDQUFDLGVBQWUsQ0FBQyxFQUFFLENBQUM7dUJBQzVCLE1BQU0sQ0FBQyxJQUFJLENBQUMsZUFBZSxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBQUUsT0FBTyxDQUFDLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDO29CQUFFLE1BQU0sT0FBTyxFQUFFLENBQUM7Z0JBQ3ZILElBQUksQ0FBQyxHQUFHLENBQUMsZUFBZSxDQUFDLEVBQUUsQ0FBQyxDQUFDO2dCQUM3QixPQUFPLEVBQUUsRUFBRSxFQUFFLGVBQWUsQ0FBQyxFQUFFLEVBQUUsSUFBSSxFQUFFLGVBQWUsQ0FBQyxJQUFJLEVBQUUsSUFBSSxFQUFFLGVBQWUsQ0FBQyxJQUFJLEVBQUUsS0FBSyxFQUFFLENBQUMsR0FBRyxlQUFlLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUMvSCxDQUFDLENBQUMsQ0FBQztRQUNMLENBQUM7UUFDRCxzRkFBc0Y7UUFDdEYsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztDQUNGIn0=

package/dist_ts_server/index.d.ts

@@ -4,4 +4,5 @@ export * from './classes.account-doc.js';
 export * from './classes.account-store.js';
 export * from './classes.idp-global-server-client.js';
 export * from './classes.oidc-introspection-client.js';
+export * from './classes.oidc-userinfo-client.js';
 export * from './classes.password-hasher.js';

package/dist_ts_server/index.js

@@ -4,5 +4,6 @@ export * from './classes.account-doc.js';
 export * from './classes.account-store.js';
 export * from './classes.idp-global-server-client.js';
 export * from './classes.oidc-introspection-client.js';
+export * from './classes.oidc-userinfo-client.js';
 export * from './classes.password-hasher.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19zZXJ2ZXIvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYyxpQkFBaUIsQ0FBQztBQUNoQyxjQUFjLG1DQUFtQyxDQUFDO0FBQ2xELGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLHVDQUF1QyxDQUFDO0FBQ3RELGNBQWMsd0NBQXdDLENBQUM7QUFDdkQsY0FBYyw4QkFBOEIsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19zZXJ2ZXIvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYyxpQkFBaUIsQ0FBQztBQUNoQyxjQUFjLG1DQUFtQyxDQUFDO0FBQ2xELGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLHVDQUF1QyxDQUFDO0FBQ3RELGNBQWMsd0NBQXdDLENBQUM7QUFDdkQsY0FBYyxtQ0FBbUMsQ0FBQztBQUNsRCxjQUFjLDhCQUE4QixDQUFDIn0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@idp.global/sdk",
-  "version": "17.0.0",
+  "version": "17.1.0",
   "private": false,
   "description": "Reusable browser and server SDK for idp.global authentication.",
   "type": "module",
@@ -33,9 +33,9 @@
     "@git.zone/tsbuild": "^4.4.2",
     "@git.zone/tsdoc": "^2.2.0",
     "@git.zone/tsrun": "^2.0.6",
-    "@git.zone/tstest": "^5.0.0",
-    "@push.rocks/smartdb": "^7.0.1",
-    "@types/node": "26.4.1"
+    "@git.zone/tstest": "^6.0.0",
+    "@types/node": "26.4.1",
+    "@lossless.org/nosqldb": "10.2.0"
   },
   "files": [
     "ts/**/*",
@@ -67,7 +67,7 @@
   ],
   "scripts": {
     "test": "pnpm run build && tstest test/ --verbose --logfile --timeout 60",
-    "build": "tsbuild tsfolders --web --allowimplicitany",
+    "build": "tsbuild tsfolders --web",
     "buildDocs": "tsdoc"
   }
 }

package/readme.md

@@ -338,6 +338,41 @@ existing login and principal binding and make a fresh observation for each
 operation requiring live authority. The response contains no identity profile
 or email-based organization inference.
 
+### Server-held OIDC UserInfo
+
+Use `OidcUserInfoClient` to obtain current profile and organization picker data
+with an access token held by your application's server session:
+
+```typescript
+import { OidcUserInfoClient } from '@idp.global/sdk/server';
+
+const userInfoClient = new OidcUserInfoClient({ issuer: 'https://idp.global' });
+const claims = await userInfoClient.getUserInfo({
+  token: serverSession.accessToken,
+  subject: serverSession.idpSubject,
+});
+const ownerOrganizations = claims.organizations?.filter((organization) =>
+  organization.roles.includes('owner')) ?? [];
+```
+
+The expected subject must come from the verified OIDC login. Keep the token
+server-side; the SDK sends it only in the bearer header to the issuer's
+`/oauth/userinfo` endpoint, rejects redirects, and validates the returned subject
+and documented claims. Unknown top-level OIDC extension claims are omitted.
+The client retains no access token or claim cache. Calls have a five-second
+deadline, including body reads, and a 64 KiB response limit. Options allow a
+deadline up to 30 seconds and a response limit up to 1 MiB.
+
+Organization claims are display data within the token's original organization
+grant. Newly granted organizations require a new OIDC login; removed memberships
+or app connections disappear from subsequent responses. Authorize each protected
+operation separately with fresh `OidcIntrospectionClient` introspection. UserInfo
+does not turn a picker selection or an observed role into an authorization grant.
+
+`OidcUserInfoError.code` is `invalid_request`, `invalid_response`,
+`unauthenticated`, or `unavailable`. Provider 401/403 responses indicate that the
+server-held token is no longer accepted. Errors omit token and provider content.
+
 ### Server API Surface
 
 | API | Description |
@@ -347,6 +382,8 @@ or email-based organization inference.
 | `IdpGlobalServerClient` | Typed-socket client for idp.global password login, JWT refresh, `whoIs` lookup, backend JWT validation fetches, and JWT key/blocklist pushes. |
 | `OidcIntrospectionClient` | Confidential server client for an exact live organization authority observation. |
 | `OidcIntrospectionError` | Sanitized introspection failure with a stable error code. |
+| `OidcUserInfoClient` | Subject-bound profile and organization display claims using a server-held OIDC token. |
+| `OidcUserInfoError` | Sanitized UserInfo failure with a stable error code. |
 | `IdpMfaRequiredError` | Password-login error carrying the MFA challenge token and available factor methods. |
 | `defaultIdpGlobalBaseUrl` | Default hosted server origin: `https://app.idp.global`. |
 | `PasswordHasher` | Static `hashPassword()` and `verifyPassword()` helpers using `scrypt:v1`. |
@@ -361,6 +398,8 @@ The server export includes these TypeScript types:
 | --- | --- |
 | `IOidcIntrospectionClientOptions` | Exact HTTPS issuer, confidential client credentials, and optional deadline/response limits. |
 | `IOidcIntrospectionClientRequest` | Server-held access token, exact subject, and canonical organization ID. |
+| `IOidcUserInfoClientOptions` | Exact HTTPS issuer and optional deadline/response limits. |
+| `IOidcUserInfoClientRequest` | Server-held access token and the subject established by verified OIDC login. |
 | `TIdpAccountAuthSource` | `'local' | 'idp.global'` |
 | `TIdpAccountRole` | `'admin' | 'user'` |
 | `TIdpAccountStatus` | `'active' | 'disabled'` |

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@idp.global/sdk',
-  version: '17.0.0',
+  version: '17.1.0',
   description: 'Reusable browser and server SDK for idp.global authentication.'
 }

package/ts_server/classes.oidc-userinfo-client.ts

@@ -0,0 +1,143 @@
+import * as plugins from './plugins.js';
+
+export interface IOidcUserInfoClientOptions {
+  issuer: string;
+  timeoutMs?: number;
+  maxResponseBytes?: number;
+}
+
+export interface IOidcUserInfoClientRequest {
+  token: string;
+  /** Subject already established by the application's verified OIDC login. */
+  subject: string;
+}
+
+export class OidcUserInfoError extends Error {
+  constructor(public readonly code: 'invalid_request' | 'invalid_response' | 'unauthenticated' | 'unavailable') {
+    super(`OIDC userinfo ${code.replace(/_/g, ' ')}.`);
+    this.name = 'OidcUserInfoError';
+  }
+}
+
+const record = (valueArg: unknown): valueArg is Record<string, unknown> =>
+  valueArg !== null && typeof valueArg === 'object' && !Array.isArray(valueArg);
+const exactString = (valueArg: unknown, maximumArg = 512): valueArg is string =>
+  typeof valueArg === 'string' && valueArg.length > 0 && valueArg.length <= maximumArg
+  && valueArg.trim() === valueArg && !/[\u0000-\u001f\u007f]/.test(valueArg);
+const strings = (valueArg: unknown): valueArg is string[] =>
+  Array.isArray(valueArg) && valueArg.every((entryArg) => exactString(entryArg))
+  && new Set(valueArg).size === valueArg.length;
+
+/** Fetches display claims using a server-held token; results are never authorization grants. */
+export class OidcUserInfoClient {
+  readonly #endpoint: string;
+  readonly #timeoutMs: number;
+  readonly #maxResponseBytes: number;
+
+  constructor(optionsArg: IOidcUserInfoClientOptions) {
+    if (!optionsArg || !exactString(optionsArg.issuer, 2048)) throw new OidcUserInfoError('invalid_request');
+    let issuer: URL;
+    try { issuer = new URL(optionsArg.issuer); } catch { throw new OidcUserInfoError('invalid_request'); }
+    const canonicalIssuer = issuer.origin + (issuer.pathname === '/' ? '' : issuer.pathname);
+    if (issuer.protocol !== 'https:' || issuer.username || issuer.password || issuer.search || issuer.hash
+      || issuer.pathname.includes('//') || issuer.pathname.endsWith('/') && issuer.pathname !== '/'
+      || canonicalIssuer !== optionsArg.issuer) throw new OidcUserInfoError('invalid_request');
+    this.#timeoutMs = optionsArg.timeoutMs ?? 5000;
+    this.#maxResponseBytes = optionsArg.maxResponseBytes ?? 65536;
+    if (!Number.isSafeInteger(this.#timeoutMs) || this.#timeoutMs < 1 || this.#timeoutMs > 30000
+      || !Number.isSafeInteger(this.#maxResponseBytes) || this.#maxResponseBytes < 1 || this.#maxResponseBytes > 1048576) {
+      throw new OidcUserInfoError('invalid_request');
+    }
+    this.#endpoint = `${canonicalIssuer}/oauth/userinfo`;
+  }
+
+  public async getUserInfo(requestArg: IOidcUserInfoClientRequest): Promise<plugins.idpInterfaces.data.IUserInfoResponse> {
+    if (!requestArg || !exactString(requestArg.subject) || !exactString(requestArg.token, 16384)
+      || !/^[A-Za-z0-9\-._~+/]+=*$/.test(requestArg.token)) throw new OidcUserInfoError('invalid_request');
+    // Snapshot the principal and token before any asynchronous work.
+    const { token, subject } = requestArg;
+    const controller = new AbortController();
+    let timer: ReturnType<typeof setTimeout>;
+    const deadline = new Promise<never>((_resolveArg, rejectArg) => {
+      timer = setTimeout(() => {
+        controller.abort();
+        rejectArg(new OidcUserInfoError('unavailable'));
+      }, this.#timeoutMs);
+    });
+    let reader: ReadableStreamDefaultReader<Uint8Array> | undefined;
+    try {
+      const response = await Promise.race([fetch(this.#endpoint, {
+        method: 'GET', redirect: 'error', credentials: 'omit', cache: 'no-store', signal: controller.signal,
+        headers: { authorization: `Bearer ${token}`, accept: 'application/json' },
+      }), deadline]);
+      if (response.status === 401 || response.status === 403) throw new OidcUserInfoError('unauthenticated');
+      if (response.status !== 200) throw new OidcUserInfoError('unavailable');
+      if (response.headers.get('content-type')?.split(';')[0].trim().toLowerCase() !== 'application/json'
+        || !response.headers.get('cache-control')?.toLowerCase().split(',').map((partArg) => partArg.trim()).includes('no-store')
+        || !response.body) throw new OidcUserInfoError('invalid_response');
+      const contentLength = response.headers.get('content-length');
+      if (contentLength !== null && (!/^\d+$/.test(contentLength) || Number(contentLength) > this.#maxResponseBytes)) {
+        throw new OidcUserInfoError('invalid_response');
+      }
+      reader = response.body.getReader();
+      const chunks: Uint8Array[] = [];
+      let size = 0;
+      while (true) {
+        const part = await Promise.race([reader.read(), deadline]);
+        if (part.done) break;
+        size += part.value.byteLength;
+        if (size > this.#maxResponseBytes) throw new OidcUserInfoError('invalid_response');
+        chunks.push(part.value);
+      }
+      let value: unknown;
+      try { value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks))); }
+      catch { throw new OidcUserInfoError('invalid_response'); }
+      return this.validateResponse(value, subject);
+    } catch (errorArg) {
+      if (errorArg instanceof OidcUserInfoError) throw errorArg;
+      // Transport errors can contain credentials, URLs or response bodies.
+      throw new OidcUserInfoError('unavailable');
+    } finally {
+      clearTimeout(timer);
+      controller.abort();
+      if (reader) void reader.cancel().catch(() => undefined);
+    }
+  }
+
+  private validateResponse(valueArg: unknown, subjectArg: string): plugins.idpInterfaces.data.IUserInfoResponse {
+    const invalid = () => new OidcUserInfoError('invalid_response');
+    if (!record(valueArg) || valueArg.sub !== subjectArg) throw invalid();
+    const result: plugins.idpInterfaces.data.IUserInfoResponse = { sub: subjectArg };
+    for (const key of ['name', 'preferred_username', 'picture', 'email'] as const) {
+      if (!Object.hasOwn(valueArg, key)) continue;
+      const value = valueArg[key];
+      if (typeof value !== 'string' || value.length > 4096) throw invalid();
+      result[key] = value;
+    }
+    if (Object.hasOwn(valueArg, 'email_verified')) {
+      if (typeof valueArg.email_verified !== 'boolean') throw invalid();
+      result.email_verified = valueArg.email_verified;
+    }
+    for (const key of ['roles', 'app_roles', 'app_permissions', 'app_scopes'] as const) {
+      if (!Object.hasOwn(valueArg, key)) continue;
+      const value = valueArg[key];
+      if (!strings(value)) throw invalid();
+      result[key] = [...value];
+    }
+    if (Object.hasOwn(valueArg, 'organizations')) {
+      if (!Array.isArray(valueArg.organizations)) throw invalid();
+      const seen = new Set<string>();
+      result.organizations = valueArg.organizations.map((organizationArg: unknown) => {
+        if (!record(organizationArg) || !exactString(organizationArg.id)
+          || typeof organizationArg.name !== 'string' || organizationArg.name.length > 4096
+          || !exactString(organizationArg.slug) || !strings(organizationArg.roles)
+          || seen.has(organizationArg.id)
+          || Object.keys(organizationArg).some((keyArg) => !['id', 'name', 'slug', 'roles'].includes(keyArg))) throw invalid();
+        seen.add(organizationArg.id);
+        return { id: organizationArg.id, name: organizationArg.name, slug: organizationArg.slug, roles: [...organizationArg.roles] };
+      });
+    }
+    // OIDC allows additional claims; only the documented, validated fields leave the SDK.
+    return result;
+  }
+}

package/ts_server/index.ts

@@ -4,4 +4,5 @@ export * from './classes.account-doc.js';
 export * from './classes.account-store.js';
 export * from './classes.idp-global-server-client.js';
 export * from './classes.oidc-introspection-client.js';
+export * from './classes.oidc-userinfo-client.js';
 export * from './classes.password-hasher.js';