@maronn-openid-connect/cli 0.4.0 → 0.7.0

package/dist/frameworks/web-standard/templates.js

@@ -1,5 +1,6 @@
 import { DEFAULT_FEATURES } from '../../features.js';
-import { authorizationCodeConformanceHelper, authorizeRouteTemplate, configTemplate, conformanceTestClientsBlock, consentDecisionConformanceBlock, consentWithdrawalConformanceBlock, consentRouteTemplate, customViewConformanceTestBlock, deviceAuthorizationConformanceBlock, deviceAuthorizationRouteTemplate, deviceVerificationRouteTemplate, discoveryRouteTemplate, endpointBehaviorConformanceBlock, featureDisabledDiscoveryConformanceTests, idTokenHintConformanceBlock, internalRedirectOriginConformanceBlock, introspectionConformanceBlock, introspectionRouteTemplate, jwksRouteTemplate, loginRouteTemplate, parRouteTemplate, parConformanceBlock, jarmConformanceBlock, jarmConfigTemplate, tokenExchangeConformanceBlock, idJagConformanceBlock, pkceDisabledConformanceBlock, persistentStorageConformanceBlock, requestObjectConformanceBeforeAll, requestObjectConformanceModuleSetup, resolversTemplate, onlineRefreshTokenConformanceBlock, onlineRefreshTokenConformanceStoreImport, reuseFlowConformanceTestBlock, revocationDisabledConformanceBlock, revocationRouteTemplate, scopesSupportedConformanceTest, storeTemplate, tokenEndpointAuthMethodsConformanceBlock, tokenRouteTemplate, transactionBindingConformanceBlock, userinfoRouteTemplate, viewsTemplate, } from '../hono/templates.js';
+import { authorizationCodeConformanceHelper, cibaConformanceBlock, backchannelAuthenticationRouteTemplate, cibaVerificationRouteTemplate, authorizeRouteTemplate, configTemplate, conformanceTestClientsBlock, consentDecisionConformanceBlock, consentWithdrawalConformanceBlock, consentRouteTemplate, customScopeConformanceBlock, customScopesTemplate, customViewConformanceTestBlock, deviceAuthorizationConformanceBlock, deviceAuthorizationRouteTemplate, deviceVerificationRouteTemplate, endSessionRouteTemplate, rpInitiatedLogoutConformanceBlock, discoveryRouteTemplate, endpointBehaviorConformanceBlock, featureDisabledDiscoveryConformanceTests, idTokenHintConformanceBlock, internalRedirectOriginConformanceBlock, introspectionConformanceBlock, introspectionRouteTemplate, jwksRouteTemplate, loginRouteTemplate, parRouteTemplate, parConformanceBlock, jarmConformanceBlock, jarmConfigTemplate, jwtIntrospectionResponseConformanceBlock, googleLoginConformanceBlock, googleLoginConformanceImportsBlock, GOOGLE_LOGIN_PACKAGE, tokenExchangeConformanceBlock, idJagConformanceBlock, pkceDisabledConformanceBlock, persistentStorageConformanceBlock, requestObjectConformanceBeforeAll, requestObjectConformanceModuleSetup, resolversTemplate, onlineRefreshTokenConformanceBlock, onlineRefreshTokenConformanceStoreImport, reuseFlowConformanceTestBlock, revocationDisabledConformanceBlock, revocationRouteTemplate, scopesSupportedConformanceTest, storeTemplate, tokenEndpointAuthMethodsConformanceBlock, tokenRouteTemplate, transactionBindingConformanceBlock, userinfoRouteTemplate, viewsTemplate, } from '../hono/templates.js';
+import { authorizePageTemplate, cibaPageTemplate, consentPageTemplate, devicePageTemplate, errorPageTemplate, loginPageTemplate, logoutPageTemplate, respondTemplate, } from '../hono/pages.js';
 function toWebRouteTemplate(content) {
     return content
         .replace("import { Hono } from 'hono';", "import { WebRouter } from '../web-router.js';")
@@ -379,14 +380,14 @@ export function webAppTemplate(corePkg, features = DEFAULT_FEATURES) {
         : '';
     const deviceImport = features.deviceAuthorizationGrant
         ? `import { deviceAuthorizationApp } from './routes/device-authorization.js';
-import { deviceApp } from './routes/device.js';\n`
+import { devicePage } from './pages/device.js';\n`
         : '';
     const deviceCors = features.deviceAuthorizationGrant
         ? `  app.use('/device_authorization', protectedCors);\n`
         : '';
     const deviceMount = features.deviceAuthorizationGrant
         ? `  app.route('/device_authorization', deviceAuthorizationApp);
-  app.route('/device', deviceApp);\n`
+  app.route('/device', devicePage);\n`
         : '';
     const deviceStorageContext = features.deviceAuthorizationGrant
         ? `    c.set('deviceAuthorizationStore', deviceAuthorizationStore);\n`
@@ -394,6 +395,78 @@ import { deviceApp } from './routes/device.js';\n`
     const deviceStoreImport = features.deviceAuthorizationGrant
         ? `  deviceAuthorizationStore,\n`
         : '';
+    const cibaImport = features.ciba
+        ? `import { backchannelAuthenticationApp } from './routes/backchannel-authentication.js';
+import { cibaPage } from './pages/ciba.js';\n`
+        : '';
+    const cibaCors = features.ciba
+        ? `  app.use('/backchannel_authentication', protectedCors);\n`
+        : '';
+    const cibaMount = features.ciba
+        ? `  app.route('/backchannel_authentication', backchannelAuthenticationApp);
+  app.route('/ciba', cibaPage);\n`
+        : '';
+    const cibaStorageContext = features.ciba
+        ? `    c.set('cibaAuthenticationRequestStore', cibaAuthenticationRequestStore);
+    c.set('cibaLoginTransactionStore', cibaLoginTransactionStore);
+    c.set('cibaUserResolver', options.cibaUserResolver ?? (async (loginHint: string) => {
+      const claims = await stores.userStore.getClaims(loginHint);
+      return claims ? { subject: claims.sub } : null;
+    }));\n`
+        : '';
+    const cibaStoreImport = features.ciba
+        ? `  cibaAuthenticationRequestStore,
+  cibaLoginTransactionStore,\n`
+        : '';
+    const cibaOptionsField = features.ciba
+        ? `  /**
+   * EXPERIMENTAL (CIBA Core 1.0 §7.1): resolve a login_hint to the subject the
+   * authentication request is for. Defaults to treating the hint as a username
+   * of the configured user store. Return null when no user matches.
+   */
+  cibaUserResolver?: (
+    loginHint: string,
+  ) => Promise<{ subject: string } | null> | { subject: string } | null;
+`
+        : '';
+    const logoutImport = features.rpInitiatedLogout
+        ? `import { logoutPage } from './pages/logout.js';\n`
+        : '';
+    const logoutMount = features.rpInitiatedLogout
+        ? `  app.route('/logout', logoutPage);\n`
+        : '';
+    const googleLoginImport = features.googleLogin
+        ? `import {
+  getDefaultGoogleIdTokenVerifier,
+  type GoogleAccountResolver,
+  type GoogleIdTokenPayload,
+  type GoogleIdTokenVerifier,
+} from '${GOOGLE_LOGIN_PACKAGE}';\n`
+        : '';
+    const googleLoginStorageContext = features.googleLogin
+        ? `    c.set('googleLoginNonceStore', stores.googleLoginNonceStore);
+    c.set('googleIdTokenVerifier', options.googleIdTokenVerifier ?? getDefaultGoogleIdTokenVerifier());
+    c.set('googleAccountResolver', options.googleAccountResolver ?? {
+      resolveSubject: async (account: GoogleIdTokenPayload) =>
+        (await stores.userStore.linkGoogleAccount(account)).sub,
+    });\n`
+        : '';
+    const googleLoginOptionsFields = features.googleLogin
+        ? `  /**
+   * EXTENSION (google-login): verifier for the ID token Google posts to
+   * /login/google. Defaults to google-auth-library (OAuth2Client.verifyIdToken)
+   * with a process-wide certificate cache; inject a custom one for tests or a
+   * proxied environment.
+   */
+  googleIdTokenVerifier?: GoogleIdTokenVerifier;
+  /**
+   * EXTENSION (google-login): map a verified Google account to the OP subject.
+   * Defaults to just-in-time provisioning through the user store
+   * (userStore.linkGoogleAccount), keyed by the Google \`sub\`.
+   */
+  googleAccountResolver?: GoogleAccountResolver;
+`
+        : '';
     const refreshStorageContext = features.refreshToken
         ? `    c.set('refreshTokenResolver', storeResolvers.refreshTokenResolver);
     c.set('authenticationSessionResolver', storeResolvers.authenticationSessionResolver);\n`
@@ -406,13 +479,13 @@ import { deviceApp } from './routes/device.js';\n`
         ? `    c.set('revocationResolvers', storeResolvers.revocationResolvers);\n`
         : '';
     return `import { WebRouter, type WebMiddleware } from './web-router.js';
-import { authorizeApp } from './routes/authorize.js';
+import { authorizePage } from './pages/authorize.js';
 import { tokenApp } from './routes/token.js';
 import { userinfoApp } from './routes/userinfo.js';
-${introspectionImport}${revocationImport}${parImport}${deviceImport}import { jwksApp } from './routes/jwks.js';
+${introspectionImport}${revocationImport}${parImport}${deviceImport}${cibaImport}${logoutImport}import { jwksApp } from './routes/jwks.js';
 import { discoveryApp } from './routes/discovery.js';
-import { loginApp } from './routes/login.js';
-import { consentApp } from './routes/consent.js';
+import { loginPage } from './pages/login.js';
+import { consentPage } from './pages/consent.js';
 import {
   createInMemoryClientResolver,
   createProviderConfig,
@@ -423,10 +496,10 @@ import {
 } from './resolvers.js';
 import {
   defaultProviderStores,
-${parStoreImport}${deviceStoreImport}  type ProviderStores,
+${parStoreImport}${deviceStoreImport}${cibaStoreImport}  type ProviderStores,
 } from './store.js';
 import { createViews, type Views } from './views.js';
-import {
+${googleLoginImport}import {
   assertHasRs256Key,
   assertKeyStrength,
   assertKidStrategyConsistent,
@@ -459,7 +532,7 @@ export interface OidcProviderOptions {
   storage?: ProviderStores;
   acrResolver?: AcrResolver;
   jwksProvider?: () => Promise<JwkSet> | JwkSet;
-  corsOrigins?: CorsOrigins;
+${cibaOptionsField}${googleLoginOptionsFields}  corsOrigins?: CorsOrigins;
   /**
    * Custom UI for the login / consent / error pages.
    * Provide any subset; omitted pages fall back to the default views.
@@ -497,7 +570,7 @@ export function createApp(options: OidcProviderOptions): WebRouter {
   });
   app.use('/token', protectedCors);
   app.use('/userinfo', protectedCors);
-${introspectionCors}${revocationCors}${parCors}${deviceCors}  app.use('/.well-known/openid-configuration', publicCors);
+${introspectionCors}${revocationCors}${parCors}${deviceCors}${cibaCors}  app.use('/.well-known/openid-configuration', publicCors);
   app.use('/.well-known/jwks.json', publicCors);
 
   app.use('*', async (c, next) => {
@@ -555,7 +628,7 @@ ${introspectionCors}${revocationCors}${parCors}${deviceCors}  app.use('/.well-kn
     c.set('authCodeResolver', storeResolvers.authorizationCodeResolver);
     c.set('accessTokenResolver', storeResolvers.accessTokenResolver);
     c.set('userClaimsResolver', storeResolvers.userClaimsResolver);
-${refreshStorageContext}${introspectionStorageContext}${revocationStorageContext}${parStorageContext}${deviceStorageContext}
+${refreshStorageContext}${introspectionStorageContext}${revocationStorageContext}${parStorageContext}${deviceStorageContext}${cibaStorageContext}${googleLoginStorageContext}
     if (options.acrResolver) {
       c.set('acrResolver', options.acrResolver);
     }
@@ -570,13 +643,15 @@ ${refreshStorageContext}${introspectionStorageContext}${revocationStorageContext
     await next();
   });
 
-  app.route('/authorize', authorizeApp);
+  // Browser-facing surfaces are mounted from pages/: every GET and POST of a
+  // screen lives there, and the logic they call is in routes/.
+  app.route('/authorize', authorizePage);
   app.route('/token', tokenApp);
   app.route('/userinfo', userinfoApp);
-${introspectionMount}${revocationMount}${parMount}${deviceMount}  app.route('/.well-known/jwks.json', jwksApp);
+${introspectionMount}${revocationMount}${parMount}${deviceMount}${cibaMount}${logoutMount}  app.route('/.well-known/jwks.json', jwksApp);
   app.route('/.well-known/openid-configuration', discoveryApp);
-  app.route('/login', loginApp);
-  app.route('/consent', consentApp);
+  app.route('/login', loginPage);
+  app.route('/consent', consentPage);
 
   return app;
 }
@@ -629,6 +704,10 @@ export function expressApplyTemplate(features = DEFAULT_FEATURES) {
         ? `  '/device_authorization',
   '/device',\n`
         : '';
+    const cibaEndpoints = features.ciba
+        ? `  '/backchannel_authentication',
+  '/ciba',\n`
+        : '';
     return `import type { Express } from 'express';
 import type { Request, Response, NextFunction } from 'express';
 import { createApp, type OidcProviderOptions } from './app.js';
@@ -640,7 +719,7 @@ const OIDC_ENDPOINTS = [
   '/authorize',
   '/token',
   '/userinfo',
-${introspectionEndpoint}${revocationEndpoint}${parEndpoint}${deviceEndpoints}  '/.well-known/jwks.json',
+${introspectionEndpoint}${revocationEndpoint}${parEndpoint}${deviceEndpoints}${cibaEndpoints}  '/.well-known/jwks.json',
   '/.well-known/openid-configuration',
   '/login',
   '/consent',
@@ -682,6 +761,15 @@ export function fastifyApplyTemplate(features = DEFAULT_FEATURES) {
   app.route({ method: ['POST'], url: '/device/login', handler: handle });
   app.route({ method: ['POST'], url: '/device/approve', handler: handle });\n`
         : '';
+    const cibaRoutes = features.ciba
+        ? `  app.route({ method: ['POST', 'OPTIONS'], url: '/backchannel_authentication', handler: handle });
+  app.route({ method: ['GET'], url: '/ciba', handler: handle });
+  app.route({ method: ['POST'], url: '/ciba/login', handler: handle });
+  app.route({ method: ['POST'], url: '/ciba/approve', handler: handle });\n`
+        : '';
+    const googleLoginRoute = features.googleLogin
+        ? `  app.route({ method: ['POST'], url: '/login/google', handler: handle });\n`
+        : '';
     return `import type { FastifyInstance } from 'fastify';
 import type { FastifyReply, FastifyRequest } from 'fastify';
 import { createApp, type OidcProviderOptions } from './app.js';
@@ -720,10 +808,10 @@ export async function applyOidc(app: FastifyInstance, options: ApplyOidcOptions)
   app.route({ method: ['GET', 'POST', 'OPTIONS'], url: '/authorize', handler: handle });
   app.route({ method: ['POST', 'OPTIONS'], url: '/token', handler: handle });
   app.route({ method: ['GET', 'POST', 'OPTIONS'], url: '/userinfo', handler: handle });
-${introspectionRoute}${revocationRoute}${parRoute}${deviceRoutes}  app.route({ method: ['GET', 'OPTIONS'], url: '/.well-known/jwks.json', handler: handle });
+${introspectionRoute}${revocationRoute}${parRoute}${deviceRoutes}${cibaRoutes}  app.route({ method: ['GET', 'OPTIONS'], url: '/.well-known/jwks.json', handler: handle });
   app.route({ method: ['GET', 'OPTIONS'], url: '/.well-known/openid-configuration', handler: handle });
   app.route({ method: ['GET', 'POST'], url: '/login', handler: handle });
-  app.route({ method: ['GET', 'POST'], url: '/consent', handler: handle });
+${googleLoginRoute}  app.route({ method: ['GET', 'POST'], url: '/consent', handler: handle });
 }
 
 async function toFastifyReply(reply: FastifyReply, response: Response): Promise<void> {
@@ -979,14 +1067,33 @@ function readEnv(name: string): string | undefined {
 }
 `;
 }
-export function nextJsRuntimeTemplate(corePkg) {
+export function nextJsRuntimeTemplate(corePkg, features = DEFAULT_FEATURES) {
+    const googleLoginConfigTypeImport = features.googleLogin ? 'type GoogleLoginConfig, ' : '';
+    const googleLoginRuntimeConfig = features.googleLogin
+        ? `
+      // EXTENSION (google-login): set GOOGLE_CLIENT_ID (the OAuth client ID from
+      // the Google Cloud console) to render the "Sign in with Google" button.
+      // Register <issuer>/login/google as an authorized redirect URI there.
+      // GOOGLE_HOSTED_DOMAIN optionally restricts sign-in to one Workspace domain.
+      googleLogin: readGoogleLoginConfig(),`
+        : '';
+    const googleLoginRuntimeReader = features.googleLogin
+        ? `
+function readGoogleLoginConfig(): GoogleLoginConfig | undefined {
+  const clientId = readEnv('GOOGLE_CLIENT_ID');
+  if (!clientId) return undefined;
+  const hostedDomain = readEnv('GOOGLE_HOSTED_DOMAIN');
+  return hostedDomain ? { clientId, hostedDomain } : { clientId };
+}
+`
+        : '';
     return `import {
   createCachedSigningKeyProvider,
   type AcrResolver,
   type SigningKey,
   type SigningKeyProvider,
 } from '${corePkg}';
-import { createInMemoryClientResolver, type RegisteredClient } from './config';
+import { createInMemoryClientResolver, ${googleLoginConfigTypeImport}type RegisteredClient } from './config';
 import { createOidcRouteHandlers } from './next';
 import { createNextJsProviderStores } from './storage-backend';
 import type { OidcProviderOptions } from './app';
@@ -1039,7 +1146,7 @@ export function createOidcProviderOptions(): OidcProviderOptions {
       // /oidc-error, which renders them via the App Router error boundary
       // (app/oidc-error/error.tsx) — consistent with login/consent being real
       // pages rather than HTML strings from the route handler.
-      authorizationErrorRedirectPath: '/oidc-error',
+      authorizationErrorRedirectPath: '/oidc-error',${googleLoginRuntimeConfig}
     },
     signingKeyProvider,
     clientResolver,
@@ -1120,7 +1227,7 @@ function readEnv(name: string): string | undefined {
   if (typeof process === 'undefined') return undefined;
   return process.env[name];
 }
-
+${googleLoginRuntimeReader}
 function createEphemeralRs256KeyProvider(): SigningKeyProvider {
   const keyPromise = generateSigningKey();
   return {
@@ -1222,13 +1329,70 @@ async function isBoundToThisBrowser(
   }
 `
         : '';
+    const googleLoginImports = features.googleLogin
+        ? `
+import Script from 'next/script';
+import { issueGoogleLoginNonce } from '${GOOGLE_LOGIN_PACKAGE}';
+import {
+  buildGoogleSignInAttributes,
+  GOOGLE_GSI_CLIENT_SCRIPT_URL,
+} from '${GOOGLE_LOGIN_PACKAGE}/sign-in';`
+        : '';
+    const loginPageStores = features.googleLogin
+        ? `const { transactionStore, googleLoginNonceStore } =
+  oidcProviderOptions.storage ?? defaultProviderStores;`
+        : `const transactionStore =
+  (oidcProviderOptions.storage ?? defaultProviderStores).transactionStore;`;
+    const googleSignInRender = features.googleLogin
+        ? `
+  // EXTENSION (google-login): the GIS configuration (g_id_onload attributes),
+  // built only when config.googleLogin is set. Each render issues a fresh nonce
+  // bound to this transaction; Google echoes it in the ID token, which is how
+  // login/google/route.ts finds the transaction. The JSX below owns the markup.
+  const googleLogin = oidcProviderOptions.config?.googleLogin;
+  const googleSignIn = googleLogin
+    ? buildGoogleSignInAttributes({
+        clientId: googleLogin.clientId,
+        // Must equal an authorized redirect URI of the Google OAuth client.
+        loginUri: new URL(
+          '/login/google',
+          oidcProviderOptions.config?.issuer ?? 'http://localhost:3000',
+        ).toString(),
+        nonce: await issueGoogleLoginNonce({
+          transactionId,
+          expiresAt: transaction.expiresAt,
+          store: googleLoginNonceStore,
+        }),
+        loginHint: transaction.loginHint,
+        hostedDomain:
+          typeof googleLogin.hostedDomain === 'string' ? googleLogin.hostedDomain : undefined,
+      })
+    : undefined;
+`
+        : '';
+    const googleSignInJsx = features.googleLogin
+        ? `
+      {/*
+        EXTENSION (google-login): the three elements GIS needs for redirect mode.
+        googleSignIn holds the g_id_onload attributes (data-ux_mode="redirect",
+        data-login_uri, data-nonce, ...) and spreads straight onto the element;
+        GIS replaces .g_id_signin with the button — style it through the GIS
+        button attributes (data-theme, data-size, data-text, ...).
+      */}
+      {googleSignIn ? (
+        <section aria-label="Sign in with Google">
+          <Script src={GOOGLE_GSI_CLIENT_SCRIPT_URL} strategy="afterInteractive" />
+          <div {...googleSignIn} />
+          <div className="g_id_signin" data-type="standard" />
+        </section>
+      ) : null}`
+        : '';
     return `${bindingImports}
 import { oidcProviderOptions } from '../_oidc-provider/runtime';
-${bindingStoreImport}
+${bindingStoreImport}${googleLoginImports}
 import { loginAction } from './actions';
 
-const transactionStore =
-  (oidcProviderOptions.storage ?? defaultProviderStores).transactionStore;
+${loginPageStores}
 
 // Authorization redirects here with a per-request transaction_id, so the page
 // must always render dynamically (never statically cached).
@@ -1273,7 +1437,7 @@ export default async function LoginPage({ searchParams }: LoginPageProps) {
   }
 
   const transaction = await getAuthTransaction(transactionId, transactionStore);
-${bindingCheck}
+${bindingCheck}${googleSignInRender}
   const errorMessage =
     error === 'invalid_credentials'
       ? \`Invalid credentials\${remaining ? \`. Attempts remaining: \${remaining}\` : ''}\`
@@ -1299,7 +1463,7 @@ ${bindingCheck}
           <input type="password" id="password" name="password" required />
         </div>
         <button type="submit">Login</button>
-      </form>
+      </form>${googleSignInJsx}
     </main>
   );
 }
@@ -1481,7 +1645,28 @@ ${bindingCheck}  validateCsrfToken(transaction, csrfToken);
 }
 `;
 }
-export function nextJsConsentPageTemplate(corePkg, features = DEFAULT_FEATURES) {
+export function nextJsConsentPageTemplate(corePkg, features = DEFAULT_FEATURES, scopes = []) {
+    const customScopesDeclared = scopes.length > 0;
+    const customScopeImport = customScopesDeclared
+        ? `
+import { resolveGrantableScopes } from '../_oidc-provider/scopes';`
+        : '';
+    const consentPageScopes = customScopesDeclared
+        ? `  // The subject comes from the auth session that the login step stored for this
+  // transaction; without one there is nothing to apply the scope policy to, so
+  // the request is shown as-is and the Server Action stops on the same missing
+  // session.
+  const consentSession = await authSessionStore.get(transactionId);
+  const requestedScopes = transaction.scope.split(' ').filter(Boolean);
+  const scopes = consentSession
+    ? await resolveGrantableScopes(requestedScopes, consentSession.subject)
+    : requestedScopes;`
+        : `  const scopes = transaction.scope.split(' ').filter(Boolean);`;
+    const consentPageStores = customScopesDeclared
+        ? `
+const authSessionStore =
+  (oidcProviderOptions.storage ?? defaultProviderStores).authSessionStore;`
+        : '';
     const bindingImports = features.transactionBinding
         ? `import { cookies } from 'next/headers';
 import { getAuthTransaction, validateTransactionBinding } from '${corePkg}';`
@@ -1534,10 +1719,10 @@ async function isBoundToThisBrowser(
     return `${bindingImports}
 import { oidcProviderOptions } from '../_oidc-provider/runtime';
 ${bindingStoreImport}
-import { consentAction } from './actions';
+import { consentAction } from './actions';${customScopeImport}
 
 const transactionStore =
-  (oidcProviderOptions.storage ?? defaultProviderStores).transactionStore;
+  (oidcProviderOptions.storage ?? defaultProviderStores).transactionStore;${consentPageStores}
 
 export const dynamic = 'force-dynamic';
 
@@ -1564,7 +1749,7 @@ export default async function ConsentPage({ searchParams }: ConsentPageProps) {
   }
 
   const transaction = await getAuthTransaction(transactionId, transactionStore);
-${bindingCheck}  const scopes = transaction.scope.split(' ').filter(Boolean);
+${bindingCheck}${consentPageScopes}
 
   return (
     <main>
@@ -1600,7 +1785,23 @@ ${bindingCheck}  const scopes = transaction.scope.split(' ').filter(Boolean);
 }
 `;
 }
-export function nextJsConsentActionTemplate(corePkg, features = DEFAULT_FEATURES) {
+export function nextJsConsentActionTemplate(corePkg, features = DEFAULT_FEATURES, scopes = []) {
+    const customScopesDeclared = scopes.length > 0;
+    const customScopeImport = customScopesDeclared
+        ? `
+import { resolveGrantableScopes } from '../_oidc-provider/scopes';`
+        : '';
+    const consentGrantedScope = customScopesDeclared
+        ? `
+  // Apply the scope policy (resolveGrantableScopes in _oidc-provider/scopes.ts —
+  // the place to write per-user filtering). A dropped scope narrows the grant
+  // rather than failing the request: RFC 6749 §3.3 lets the authorization server
+  // issue a narrower scope, and the token response reports what was granted.
+  const grantedScope = await resolveGrantableScopes(
+    transaction.scope.split(' ').filter(Boolean),
+    session.subject,
+  );`
+        : `  const grantedScope = transaction.scope.split(' ').filter(Boolean);`;
     const bindingCookiesImport = features.transactionBinding
         ? `
 import { cookies } from 'next/headers';`
@@ -1653,7 +1854,7 @@ import {
 } from '${corePkg}';
 import { oidcProviderOptions } from '../_oidc-provider/runtime';
 import { createStoreResolvers } from '../_oidc-provider/resolvers';
-${bindingStoreImport}
+${bindingStoreImport}${customScopeImport}
 
 const providerStores = oidcProviderOptions.storage ?? defaultProviderStores;
 const { transactionStore, authCodeStore, authSessionStore } = providerStores;
@@ -1722,7 +1923,7 @@ ${clearBindingCookie}    redirect(denyUrl.toString());
   // transaction.scope は認可リクエスト検証時に applyOfflineAccessPolicy を通した後の値。
   // offline_access の可否（OIDC Core 1.0 §11 の prompt=consent と、クライアント登録
   // grant_types に refresh_token があるか）はそこで確定しているので再フィルタしない。
-  const grantedScope = transaction.scope.split(' ').filter(Boolean);
+${consentGrantedScope}
 
   // OIDC Core 1.0 Section 3.1.3.1: TTL is configurable via ProviderConfig.
   const authCodeData = await createAuthorizationCode({
@@ -1756,8 +1957,12 @@ ${clearBindingCookieOnSuccess}  const successUrl = new URL(responseParams.redire
 }
 `;
 }
-export function webConformanceTestTemplate(corePkg, errorPageMode = 'html', features = DEFAULT_FEATURES, includeNodeAdapterContract = false, jarmConsentResponseMode = 'jwt') {
+export function webConformanceTestTemplate(corePkg, errorPageMode = 'html', features = DEFAULT_FEATURES, includeNodeAdapterContract = false, jarmConsentResponseMode = 'jwt', scopes = []) {
     const usesRedirect = errorPageMode === 'redirect';
+    const customScopeConformanceImport = scopes.length > 0
+        ? `
+import { RESTRICTED_SCOPE_SUBJECTS } from './scopes.js';`
+        : '';
     const createAppConfig = usesRedirect
         ? `
     config: { authorizationErrorRedirectPath: '/oidc-error' },`
@@ -1885,14 +2090,27 @@ import { tokenExchangeConfig } from './routes/token.js';`
         ? `
 import { idJagConfig } from './routes/token.js';`
         : '';
-    return `import { describe, it, expect, beforeAll } from 'vitest';
+    const rpInitiatedLogoutConformanceImports = features.rpInitiatedLogout
+        ? `
+import { rpInitiatedLogoutConfig } from './routes/logout.js';`
+        : '';
+    const cibaConformanceImports = features.ciba
+        ? `
+import { cibaAuthenticationRequestStore } from './store.js';`
+        : '';
+    const vitestNames = features.ciba
+        ? 'describe, it, expect, beforeAll, afterEach'
+        : 'describe, it, expect, beforeAll';
+    const googleLoginConformanceImports = googleLoginConformanceImportsBlock(features);
+    const googleLoginConfigTypeImport = features.googleLogin ? ', type GoogleLoginConfig' : '';
+    return `import { ${vitestNames} } from 'vitest';
 import type { SigningKeyProvider, SigningKey } from '${corePkg}';
 ${exportPublicJwkImport}import { createApp, validateSigningKeySet } from './app.js';
-import { createInMemoryClientResolver, type RegisteredClient } from './config.js';
+import { createInMemoryClientResolver, type RegisteredClient${googleLoginConfigTypeImport} } from './config.js';
 import { accessTokenStore, authSessionStore, consentStore, createJsonProviderStores,${onlineRefreshTokenConformanceStoreImport(features)} refreshTokenStore, transactionStore, type JsonStoreBackend } from './store.js';
 import { consentResolver } from './resolvers.js';
 import { defaultViews } from './views.js';
-import { renderView } from './views.js';${parConformanceImports}${tokenExchangeConformanceImports}${idJagConformanceImports}
+import { renderView } from './views.js';${parConformanceImports}${tokenExchangeConformanceImports}${idJagConformanceImports}${cibaConformanceImports}${rpInitiatedLogoutConformanceImports}${googleLoginConformanceImports}${customScopeConformanceImport}
 ${nodeAdapterImport}
 
 const REDIRECT_URI = 'http://localhost:3000/callback';
@@ -2068,7 +2286,7 @@ ${responseModesSupportedExpectation}
       });
     });
 
-${scopesSupportedConformanceTest(features)}
+${scopesSupportedConformanceTest(features, scopes)}
     // OIDC Core 1.0 §2 / §3.1.3.6 + Discovery 1.0 §3: claims_supported advertises
     // the claims the OP can supply, including the ID Token protocol claims
     // (auth_time/nonce/acr/amr/azp/at_hash). The full list is pinned so dropping
@@ -2303,15 +2521,18 @@ ${nonRedirectErrorTest}
       });
     });
   });
-${transactionBindingConformanceBlock(features)}${customViewConformanceTestBlock()}${internalRedirectOriginConformanceBlock()}${endpointBehaviorConformanceBlock(features)}${idTokenHintConformanceBlock()}${consentWithdrawalConformanceBlock(features)}${reuseFlowConformanceTestBlock(features)}${onlineRefreshTokenConformanceBlock(features)}${revocationDisabledConformanceBlock(features)}${tokenEndpointAuthMethodsConformanceBlock()}${pkceDisabledConformanceBlock(features)}${parConformanceBlock(features)}${tokenExchangeConformanceBlock(features)}${idJagConformanceBlock(features)}${deviceAuthorizationConformanceBlock(features)}${jarmConformanceBlock(features, jarmConsentResponseMode)}${consentDecisionConformanceBlock()}});
+${transactionBindingConformanceBlock(features)}${customViewConformanceTestBlock()}${internalRedirectOriginConformanceBlock()}${endpointBehaviorConformanceBlock(features)}${idTokenHintConformanceBlock()}${consentWithdrawalConformanceBlock(features)}${reuseFlowConformanceTestBlock(features, errorPageMode)}${onlineRefreshTokenConformanceBlock(features)}${revocationDisabledConformanceBlock(features)}${tokenEndpointAuthMethodsConformanceBlock()}${pkceDisabledConformanceBlock(features)}${parConformanceBlock(features)}${tokenExchangeConformanceBlock(features)}${idJagConformanceBlock(features)}${deviceAuthorizationConformanceBlock(features)}${cibaConformanceBlock(features)}${jarmConformanceBlock(features, jarmConsentResponseMode)}${jwtIntrospectionResponseConformanceBlock(features)}${rpInitiatedLogoutConformanceBlock(features)}${googleLoginConformanceBlock(features)}${consentDecisionConformanceBlock()}${customScopeConformanceBlock(scopes)}});
 `;
 }
-function webCoreGeneratedFiles(corePkg, errorPageMode = 'html', features = DEFAULT_FEATURES, includeNodeAdapterContract = false, jarmConsentResponseMode = 'jwt') {
+function webCoreGeneratedFiles(corePkg, errorPageMode = 'html', features = DEFAULT_FEATURES, includeNodeAdapterContract = false, jarmConsentResponseMode = 'jwt', scopes = []) {
     const consentFeatures = jarmConsentResponseMode === 'plain' ? { ...features, jarm: false } : features;
     return [
         { path: 'app.ts', content: webAppTemplate(corePkg, features) },
         { path: 'web-router.ts', content: webRouterTemplate() },
         { path: 'config.ts', content: configTemplate(corePkg, features) },
+        ...(scopes.length > 0
+            ? [{ path: 'scopes.ts', content: customScopesTemplate(scopes, features) }]
+            : []),
         {
             path: 'store.ts',
             content: storeTemplate(corePkg, features),
@@ -2321,11 +2542,23 @@ function webCoreGeneratedFiles(corePkg, errorPageMode = 'html', features = DEFAU
             content: resolversTemplate(corePkg, features).replace('through Hono context', 'through the generated request context'),
         },
         { path: 'views.ts', content: viewsTemplate(features) },
-        { path: 'routes/authorize.ts', content: toWebRouteTemplate(authorizeRouteTemplate(corePkg, features)) },
+        { path: 'pages/respond.ts', content: respondTemplate() },
+        { path: 'pages/errors.ts', content: errorPageTemplate() },
+        { path: 'pages/authorize.ts', content: toWebRouteTemplate(authorizePageTemplate()) },
+        { path: 'pages/login.ts', content: toWebRouteTemplate(loginPageTemplate(features)) },
+        { path: 'pages/consent.ts', content: toWebRouteTemplate(consentPageTemplate()) },
+        ...(features.deviceAuthorizationGrant
+            ? [{ path: 'pages/device.ts', content: toWebRouteTemplate(devicePageTemplate()) }]
+            : []),
+        ...(features.ciba ? [{ path: 'pages/ciba.ts', content: toWebRouteTemplate(cibaPageTemplate()) }] : []),
+        ...(features.rpInitiatedLogout
+            ? [{ path: 'pages/logout.ts', content: toWebRouteTemplate(logoutPageTemplate()) }]
+            : []),
+        { path: 'routes/authorize.ts', content: toWebRouteTemplate(authorizeRouteTemplate(corePkg, features, scopes)) },
         { path: 'routes/token.ts', content: toWebRouteTemplate(tokenRouteTemplate(corePkg, features)) },
         { path: 'routes/userinfo.ts', content: toWebRouteTemplate(userinfoRouteTemplate(corePkg)) },
         ...(features.introspection
-            ? [{ path: 'routes/introspection.ts', content: toWebRouteTemplate(introspectionRouteTemplate(corePkg)) }]
+            ? [{ path: 'routes/introspection.ts', content: toWebRouteTemplate(introspectionRouteTemplate(corePkg, features)) }]
             : []),
         ...(features.revocation
             ? [{ path: 'routes/revocation.ts', content: toWebRouteTemplate(revocationRouteTemplate(corePkg)) }]
@@ -2337,39 +2570,54 @@ function webCoreGeneratedFiles(corePkg, errorPageMode = 'html', features = DEFAU
             ? [
                 {
                     path: 'routes/device-authorization.ts',
-                    content: toWebRouteTemplate(deviceAuthorizationRouteTemplate(corePkg, features)),
+                    content: toWebRouteTemplate(deviceAuthorizationRouteTemplate(corePkg, features, scopes)),
                 },
                 {
                     path: 'routes/device.ts',
-                    content: toWebRouteTemplate(deviceVerificationRouteTemplate(corePkg)),
+                    content: toWebRouteTemplate(deviceVerificationRouteTemplate(corePkg, scopes)),
+                },
+            ]
+            : []),
+        ...(features.ciba
+            ? [
+                {
+                    path: 'routes/backchannel-authentication.ts',
+                    content: toWebRouteTemplate(backchannelAuthenticationRouteTemplate(corePkg, features, scopes)),
+                },
+                {
+                    path: 'routes/ciba-verification.ts',
+                    content: toWebRouteTemplate(cibaVerificationRouteTemplate(corePkg, scopes)),
                 },
             ]
             : []),
+        ...(features.rpInitiatedLogout
+            ? [{ path: 'routes/logout.ts', content: toWebRouteTemplate(endSessionRouteTemplate(corePkg)) }]
+            : []),
         ...(features.jarm
             ? [{ path: 'routes/jarm.ts', content: jarmConfigTemplate() }]
             : []),
         { path: 'routes/jwks.ts', content: toWebRouteTemplate(jwksRouteTemplate(corePkg)) },
-        { path: 'routes/discovery.ts', content: toWebRouteTemplate(discoveryRouteTemplate(corePkg, features)) },
+        { path: 'routes/discovery.ts', content: toWebRouteTemplate(discoveryRouteTemplate(corePkg, features, scopes)) },
         { path: 'routes/login.ts', content: toWebRouteTemplate(loginRouteTemplate(corePkg, features)) },
-        { path: 'routes/consent.ts', content: toWebRouteTemplate(consentRouteTemplate(corePkg, consentFeatures)) },
+        { path: 'routes/consent.ts', content: toWebRouteTemplate(consentRouteTemplate(corePkg, consentFeatures, scopes)) },
         {
             path: 'conformance.test.ts',
-            content: webConformanceTestTemplate(corePkg, errorPageMode, features, includeNodeAdapterContract, jarmConsentResponseMode),
+            content: webConformanceTestTemplate(corePkg, errorPageMode, features, includeNodeAdapterContract, jarmConsentResponseMode, scopes),
         },
     ];
 }
 function toNextJsModuleImports(content) {
     return content.replaceAll(/(from\s+['"](?:\.{1,2}\/[^'"]+))\.js(['"])/g, '$1$2');
 }
-export function webGeneratedFiles(corePkg, applyTemplate, features = DEFAULT_FEATURES) {
+export function webGeneratedFiles(corePkg, applyTemplate, features = DEFAULT_FEATURES, scopes = []) {
     return [
-        ...webCoreGeneratedFiles(corePkg, 'html', features, true),
+        ...webCoreGeneratedFiles(corePkg, 'html', features, true, 'jwt', scopes),
         { path: 'apply.ts', content: applyTemplate },
         { path: 'node-adapter.ts', content: nodeAdapterTemplate() },
     ];
 }
-export function nextJsGeneratedFiles(corePkg, features = DEFAULT_FEATURES) {
-    const internalFiles = webCoreGeneratedFiles(corePkg, 'redirect', features, false, 'plain').map((file) => ({
+export function nextJsGeneratedFiles(corePkg, features = DEFAULT_FEATURES, scopes = []) {
+    const internalFiles = webCoreGeneratedFiles(corePkg, 'redirect', features, false, 'plain', scopes).map((file) => ({
         path: `_oidc-provider/${file.path}`,
         content: toNextJsModuleImports(file.content),
     }));
@@ -2377,7 +2625,7 @@ export function nextJsGeneratedFiles(corePkg, features = DEFAULT_FEATURES) {
         ...internalFiles,
         { path: '_oidc-provider/next.ts', content: nextJsRouteHandlerTemplate() },
         { path: '_oidc-provider/storage-backend.ts', content: nextJsStorageBackendTemplate() },
-        { path: '_oidc-provider/runtime.ts', content: nextJsRuntimeTemplate(corePkg) },
+        { path: '_oidc-provider/runtime.ts', content: nextJsRuntimeTemplate(corePkg, features) },
         {
             path: 'authorize/route.ts',
             content: nextJsEndpointRouteTemplate('../_oidc-provider/runtime', [
@@ -2442,6 +2690,26 @@ export function nextJsGeneratedFiles(corePkg, features = DEFAULT_FEATURES) {
                 },
             ]
             : []),
+        ...(features.ciba
+            ? [
+                {
+                    path: 'backchannel_authentication/route.ts',
+                    content: nextJsEndpointRouteTemplate('../_oidc-provider/runtime', ['POST', 'OPTIONS']),
+                },
+                {
+                    path: 'ciba/route.ts',
+                    content: nextJsEndpointRouteTemplate('../_oidc-provider/runtime', ['GET']),
+                },
+                {
+                    path: 'ciba/login/route.ts',
+                    content: nextJsEndpointRouteTemplate('../../_oidc-provider/runtime', ['POST']),
+                },
+                {
+                    path: 'ciba/approve/route.ts',
+                    content: nextJsEndpointRouteTemplate('../../_oidc-provider/runtime', ['POST']),
+                },
+            ]
+            : []),
         {
             path: '.well-known/jwks.json/route.ts',
             content: nextJsEndpointRouteTemplate('../../_oidc-provider/runtime', [
@@ -2458,8 +2726,16 @@ export function nextJsGeneratedFiles(corePkg, features = DEFAULT_FEATURES) {
         },
         { path: 'login/page.tsx', content: nextJsLoginPageTemplate(corePkg, features) },
         { path: 'login/actions.ts', content: nextJsLoginActionTemplate(corePkg, features) },
-        { path: 'consent/page.tsx', content: nextJsConsentPageTemplate(corePkg, features) },
-        { path: 'consent/actions.ts', content: nextJsConsentActionTemplate(corePkg, features) },
+        ...(features.googleLogin
+            ? [
+                {
+                    path: 'login/google/route.ts',
+                    content: nextJsEndpointRouteTemplate('../../_oidc-provider/runtime', ['POST']),
+                },
+            ]
+            : []),
+        { path: 'consent/page.tsx', content: nextJsConsentPageTemplate(corePkg, features, scopes) },
+        { path: 'consent/actions.ts', content: nextJsConsentActionTemplate(corePkg, features, scopes) },
         { path: 'oidc-error/page.tsx', content: nextJsAuthorizationErrorPageTemplate() },
         { path: 'oidc-error/error.tsx', content: nextJsAuthorizationErrorBoundaryTemplate() },
     ];