@medusajs/auth-oidc 2.22.2 → 2.22.3-snapshot-20261103230838
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/AGENTS.md +2 -1
- package/dist/engine/engine.d.ts +11 -8
- package/dist/engine/engine.d.ts.map +1 -1
- package/dist/engine/engine.js +97 -48
- package/dist/engine/engine.js.map +1 -1
- package/package.json +6 -5
package/AGENTS.md
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# @medusajs/auth-oidc
|
|
2
2
|
|
|
3
|
-
Generic OpenID Connect Auth Module provider (since 2.19.0). Works with any spec-compliant IdP (Okta, Entra ID, Auth0, Keycloak, Google Workspace, ...) via discovery, PKCE (S256), nonce, and full ID-token validation, built on `openid-client`
|
|
3
|
+
Generic OpenID Connect Auth Module provider (since 2.19.0). Works with any spec-compliant IdP (Okta, Entra ID, Auth0, Keycloak, Google Workspace, ...) via discovery, PKCE (S256), nonce, and full ID-token validation, built on `openid-client` v6 (the code exchange calls `oauth4webapi` directly).
|
|
4
4
|
|
|
5
5
|
## Using this package
|
|
6
6
|
|
|
@@ -47,6 +47,7 @@ module.exports = defineConfig({
|
|
|
47
47
|
|
|
48
48
|
- `src/services/oidc.ts`: `OidcAuthService extends AbstractAuthModuleProvider`, `static identifier = "oidc"`. Implements `validateOptions`, `authenticate`, `validateCallback`; `register` throws `NOT_ALLOWED`. Overrides the `displayName` getter so each registration shows its own `display_name`.
|
|
49
49
|
- `src/engine/engine.ts`: `OidcEngine` (discovery, `buildAuthorizationUrl`, `exchangeCode`, `mapClaims`). Not exported from the package entry point.
|
|
50
|
+
- `exchangeCode` uses `oauth4webapi` instead of `openid-client`'s `authorizationCodeGrant`, which strips the query string from the token request's `redirect_uri` and breaks callback URLs that have one (e.g. the admin's `?auth_provider=...`).
|
|
50
51
|
- `src/utils/assert-secure-url.ts`: `issuer` and any endpoint override must be `https`; `http` is allowed only for `localhost`/`127.0.0.1`/`::1` outside production.
|
|
51
52
|
- `nonce` and `code_verifier` are stored in the auth state (`setState`) and replayed on callback.
|
|
52
53
|
- Injects an optional `cache` (`ICacheService`) to share discovery documents; without it, only the per-instance memoized client is used (discovery cache TTL 1 hour).
|
package/dist/engine/engine.d.ts
CHANGED
|
@@ -1,5 +1,7 @@
|
|
|
1
1
|
import { ICacheService } from "@medusajs/framework/types";
|
|
2
|
-
import {
|
|
2
|
+
import type { Configuration, ServerMetadata } from "openid-client" with {
|
|
3
|
+
"resolution-mode": "import"
|
|
4
|
+
};
|
|
3
5
|
import { OidcAuthorizationUrlResult, OidcBuildAuthorizationUrlInput, OidcEngineOptions, OidcExchangeCodeInput, OidcExchangeCodeResult, OidcMappedClaims } from "./types";
|
|
4
6
|
/**
|
|
5
7
|
* A reusable OIDC engine built on `openid-client`. It handles discovery,
|
|
@@ -13,14 +15,14 @@ export declare class OidcEngine {
|
|
|
13
15
|
protected readonly httpTimeoutMs_: number;
|
|
14
16
|
protected readonly cache_?: ICacheService;
|
|
15
17
|
/**
|
|
16
|
-
* The memoized OIDC client. `openid-client`
|
|
17
|
-
* `
|
|
18
|
+
* The memoized OIDC client configuration. `openid-client` caches the JWKS per
|
|
19
|
+
* `Configuration` instance, so building a fresh one on every call would refetch
|
|
18
20
|
* the JWKS over HTTP on every login callback. The client is built lazily and
|
|
19
21
|
* reused until the discovery cache entry expires; when all endpoints are
|
|
20
22
|
* configured explicitly (no discovery), it's cached indefinitely, since the
|
|
21
23
|
* engine's options are immutable per instance.
|
|
22
24
|
*/
|
|
23
|
-
protected clientPromise_?: Promise<
|
|
25
|
+
protected clientPromise_?: Promise<Configuration>;
|
|
24
26
|
protected clientExpiresAt_: number;
|
|
25
27
|
constructor(options: OidcEngineOptions, cache?: ICacheService);
|
|
26
28
|
/**
|
|
@@ -45,10 +47,11 @@ export declare class OidcEngine {
|
|
|
45
47
|
* and reassignable).
|
|
46
48
|
*/
|
|
47
49
|
mapClaims(claims: Record<string, unknown>): OidcMappedClaims;
|
|
48
|
-
protected getClient_(): Promise<
|
|
49
|
-
protected buildClient_(): Promise<
|
|
50
|
+
protected getClient_(): Promise<Configuration>;
|
|
51
|
+
protected buildClient_(): Promise<Configuration>;
|
|
52
|
+
protected allowsInsecureRequests_(metadata: ServerMetadata): boolean;
|
|
50
53
|
protected hasAllEndpointOverrides_(): boolean;
|
|
51
|
-
protected
|
|
52
|
-
protected discoverMetadata_(): Promise<
|
|
54
|
+
protected resolveServerMetadata_(): Promise<ServerMetadata>;
|
|
55
|
+
protected discoverMetadata_(): Promise<ServerMetadata>;
|
|
53
56
|
}
|
|
54
57
|
//# sourceMappingURL=engine.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/engine/engine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;
|
|
1
|
+
{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/engine/engine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AAKzD,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;IACjE,iBAAiB,EAAE,QAAQ;CAC5B,CAAA;AACD,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAE9B,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,EACjB,MAAM,SAAS,CAAA;AAwDhB;;;;;GAKG;AACH,qBAAa,UAAU;IACrB,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAA;IAC9C,SAAS,CAAC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IAC/C,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IACzC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAA;IAEzC;;;;;;;OAOG;IACH,SAAS,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAA;IACjD,SAAS,CAAC,gBAAgB,SAAI;gBAElB,OAAO,EAAE,iBAAiB,EAAE,KAAK,CAAC,EAAE,aAAa;IAsC7D;;;;;OAKG;IACG,qBAAqB,CACzB,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,0BAA0B,CAAC;IA6BtC;;;;;OAKG;IACG,YAAY,CAChB,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,sBAAsB,CAAC;IAuFlC;;;;;;OAMG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gBAAgB;cAgE5C,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC;cA4BpC,YAAY,IAAI,OAAO,CAAC,aAAa,CAAC;IA4BtD,SAAS,CAAC,uBAAuB,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO;IASpE,SAAS,CAAC,wBAAwB,IAAI,OAAO;cAQ7B,sBAAsB,IAAI,OAAO,CAAC,cAAc,CAAC;cAoBjD,iBAAiB,IAAI,OAAO,CAAC,cAAc,CAAC;CAyC7D"}
|
package/dist/engine/engine.js
CHANGED
|
@@ -2,7 +2,6 @@
|
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.OidcEngine = void 0;
|
|
4
4
|
const utils_1 = require("@medusajs/framework/utils");
|
|
5
|
-
const openid_client_1 = require("openid-client");
|
|
6
5
|
const utils_2 = require("../utils");
|
|
7
6
|
const DEFAULT_SCOPES = ["openid", "email", "profile"];
|
|
8
7
|
const DEFAULT_CLOCK_TOLERANCE_SECONDS = 5;
|
|
@@ -15,9 +14,26 @@ const DEFAULT_CLAIM_MAPPINGS = {
|
|
|
15
14
|
};
|
|
16
15
|
// Cache-module key prefix for cached discovery documents.
|
|
17
16
|
const DISCOVERY_CACHE_KEY_PREFIX = "oidc:discovery:";
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
17
|
+
let openIdClient;
|
|
18
|
+
let oauth;
|
|
19
|
+
// openid-client and oauth4webapi are ESM-only, so loading them eagerly breaks Jest suites that only load this provider
|
|
20
|
+
function loadOpenIdClient() {
|
|
21
|
+
openIdClient ??= require("openid-client");
|
|
22
|
+
return openIdClient;
|
|
23
|
+
}
|
|
24
|
+
function loadOAuth() {
|
|
25
|
+
oauth ??= require("oauth4webapi");
|
|
26
|
+
return oauth;
|
|
27
|
+
}
|
|
28
|
+
// openid-client throws generic messages ("something went wrong") with the actual reason as the cause,
|
|
29
|
+
// and OAuth error responses carry their details in `error` / `error_description`, not the message
|
|
30
|
+
function getErrorReason(error) {
|
|
31
|
+
const reason = error.cause instanceof Error ? error.cause.message : error.message;
|
|
32
|
+
const details = [error.error, error.error_description]
|
|
33
|
+
.filter((value) => typeof value === "string" && value)
|
|
34
|
+
.join(": ");
|
|
35
|
+
return details ? `${reason} (${details})` : reason;
|
|
36
|
+
}
|
|
21
37
|
/**
|
|
22
38
|
* A reusable OIDC engine built on `openid-client`. It handles discovery,
|
|
23
39
|
* building the authorization URL (PKCE + nonce), exchanging the authorization
|
|
@@ -62,12 +78,13 @@ class OidcEngine {
|
|
|
62
78
|
if (!input?.state) {
|
|
63
79
|
throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, "A 'state' value is required to build the authorization URL");
|
|
64
80
|
}
|
|
65
|
-
const client =
|
|
66
|
-
const
|
|
67
|
-
const
|
|
68
|
-
const
|
|
81
|
+
const client = loadOpenIdClient();
|
|
82
|
+
const config = await this.getClient_();
|
|
83
|
+
const codeVerifier = client.randomPKCECodeVerifier();
|
|
84
|
+
const codeChallenge = await client.calculatePKCECodeChallenge(codeVerifier);
|
|
85
|
+
const nonce = client.randomNonce();
|
|
69
86
|
const scopes = input.scopes ?? this.options_.scopes ?? DEFAULT_SCOPES;
|
|
70
|
-
const url = client.
|
|
87
|
+
const url = client.buildAuthorizationUrl(config, {
|
|
71
88
|
scope: scopes.join(" "),
|
|
72
89
|
redirect_uri: input.callbackUrl ?? this.options_.callback_url,
|
|
73
90
|
state: input.state,
|
|
@@ -75,7 +92,7 @@ class OidcEngine {
|
|
|
75
92
|
code_challenge: codeChallenge,
|
|
76
93
|
code_challenge_method: "S256",
|
|
77
94
|
});
|
|
78
|
-
return { url, nonce, codeVerifier };
|
|
95
|
+
return { url: url.href, nonce, codeVerifier };
|
|
79
96
|
}
|
|
80
97
|
/**
|
|
81
98
|
* Exchanges the authorization code for tokens and performs full ID-token
|
|
@@ -88,37 +105,47 @@ class OidcEngine {
|
|
|
88
105
|
if (!params.code) {
|
|
89
106
|
throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, "An authorization 'code' is required to exchange for tokens");
|
|
90
107
|
}
|
|
91
|
-
const
|
|
108
|
+
const oauth = loadOAuth();
|
|
109
|
+
const config = await this.getClient_();
|
|
110
|
+
const authorizationServer = config.serverMetadata();
|
|
111
|
+
const client = {
|
|
112
|
+
client_id: this.options_.client_id,
|
|
113
|
+
[oauth.clockTolerance]: this.options_.clock_tolerance_seconds ??
|
|
114
|
+
DEFAULT_CLOCK_TOLERANCE_SECONDS,
|
|
115
|
+
};
|
|
116
|
+
// openid-client's authorizationCodeGrant strips the query string from the
|
|
117
|
+
// redirect_uri it sends, which breaks callback URLs that have one (e.g. the admin's).
|
|
92
118
|
const redirectUri = input.callbackUrl ?? this.options_.callback_url;
|
|
93
|
-
let
|
|
119
|
+
let tokens;
|
|
120
|
+
let claims;
|
|
94
121
|
try {
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
state: input.state,
|
|
122
|
+
const callbackParams = oauth.validateAuthResponse(authorizationServer, client, new URLSearchParams(params), input.state);
|
|
123
|
+
const response = await oauth.authorizationCodeGrantRequest(authorizationServer, client, this.options_.client_secret
|
|
124
|
+
? oauth.ClientSecretPost(this.options_.client_secret)
|
|
125
|
+
: oauth.None(), callbackParams, redirectUri, input.codeVerifier, {
|
|
126
|
+
[oauth.allowInsecureRequests]: this.allowsInsecureRequests_(authorizationServer),
|
|
127
|
+
signal: AbortSignal.timeout(this.httpTimeoutMs_),
|
|
102
128
|
});
|
|
129
|
+
tokens = await oauth.processAuthorizationCodeResponse(authorizationServer, client, response, { expectedNonce: input.nonce, requireIdToken: true });
|
|
130
|
+
claims = oauth.getValidatedIdTokenClaims(tokens);
|
|
103
131
|
}
|
|
104
132
|
catch (error) {
|
|
105
|
-
throw new utils_1.MedusaError(utils_1.MedusaError.Types.UNAUTHORIZED, `Could not validate the identity provider's response: ${error
|
|
133
|
+
throw new utils_1.MedusaError(utils_1.MedusaError.Types.UNAUTHORIZED, `Could not validate the identity provider's response: ${getErrorReason(error)}`);
|
|
106
134
|
}
|
|
107
|
-
|
|
108
|
-
// `tokenSet.claims()` would throw an unhelpful TypeError.
|
|
109
|
-
if (!tokenSet.id_token) {
|
|
135
|
+
if (!tokens.id_token || !claims) {
|
|
110
136
|
throw new utils_1.MedusaError(utils_1.MedusaError.Types.UNAUTHORIZED, "The identity provider did not return an ID token; ensure the 'openid' scope is requested");
|
|
111
137
|
}
|
|
112
|
-
const claims = tokenSet.claims();
|
|
113
138
|
return {
|
|
114
139
|
claims: { ...claims },
|
|
115
140
|
tokens: {
|
|
116
|
-
id_token:
|
|
117
|
-
access_token:
|
|
118
|
-
refresh_token:
|
|
119
|
-
expires_at:
|
|
120
|
-
|
|
121
|
-
|
|
141
|
+
id_token: tokens.id_token,
|
|
142
|
+
access_token: tokens.access_token,
|
|
143
|
+
refresh_token: tokens.refresh_token,
|
|
144
|
+
expires_at: tokens.expires_in === undefined
|
|
145
|
+
? undefined
|
|
146
|
+
: Math.floor(Date.now() / 1000) + tokens.expires_in,
|
|
147
|
+
token_type: tokens.token_type,
|
|
148
|
+
scope: tokens.scope,
|
|
122
149
|
},
|
|
123
150
|
};
|
|
124
151
|
}
|
|
@@ -194,43 +221,51 @@ class OidcEngine {
|
|
|
194
221
|
}
|
|
195
222
|
}
|
|
196
223
|
async buildClient_() {
|
|
197
|
-
const
|
|
198
|
-
const
|
|
199
|
-
|
|
200
|
-
...(this.options_.client_secret
|
|
201
|
-
? { client_secret: this.options_.client_secret }
|
|
202
|
-
: {}),
|
|
224
|
+
const client = loadOpenIdClient();
|
|
225
|
+
const serverMetadata = await this.resolveServerMetadata_();
|
|
226
|
+
const config = new client.Configuration(serverMetadata, this.options_.client_id, {
|
|
203
227
|
redirect_uris: [this.options_.callback_url],
|
|
204
228
|
response_types: ["code"],
|
|
205
|
-
|
|
206
|
-
|
|
207
|
-
|
|
208
|
-
|
|
209
|
-
|
|
210
|
-
|
|
211
|
-
|
|
212
|
-
|
|
229
|
+
[client.clockTolerance]: this.options_.clock_tolerance_seconds ??
|
|
230
|
+
DEFAULT_CLOCK_TOLERANCE_SECONDS,
|
|
231
|
+
}, this.options_.client_secret
|
|
232
|
+
? client.ClientSecretPost(this.options_.client_secret)
|
|
233
|
+
: client.None());
|
|
234
|
+
config.timeout = this.httpTimeoutMs_ / 1000;
|
|
235
|
+
if (this.allowsInsecureRequests_(serverMetadata)) {
|
|
236
|
+
client.allowInsecureRequests(config);
|
|
237
|
+
}
|
|
238
|
+
return config;
|
|
239
|
+
}
|
|
240
|
+
// assertSecureUrl already limits http:// to localhost outside production
|
|
241
|
+
allowsInsecureRequests_(metadata) {
|
|
242
|
+
return [
|
|
243
|
+
metadata.issuer,
|
|
244
|
+
metadata.authorization_endpoint,
|
|
245
|
+
metadata.token_endpoint,
|
|
246
|
+
metadata.jwks_uri,
|
|
247
|
+
].some((url) => url?.startsWith("http:"));
|
|
213
248
|
}
|
|
214
249
|
hasAllEndpointOverrides_() {
|
|
215
250
|
return !!(this.options_.authorization_endpoint &&
|
|
216
251
|
this.options_.token_endpoint &&
|
|
217
252
|
this.options_.jwks_uri);
|
|
218
253
|
}
|
|
219
|
-
async
|
|
254
|
+
async resolveServerMetadata_() {
|
|
220
255
|
let base = { issuer: this.options_.issuer };
|
|
221
256
|
if (!this.hasAllEndpointOverrides_()) {
|
|
222
257
|
base = await this.discoverMetadata_();
|
|
223
258
|
}
|
|
224
259
|
// Explicit endpoint overrides take precedence over discovered values; the
|
|
225
260
|
// configured issuer always wins so it matches the validated `iss` claim.
|
|
226
|
-
return
|
|
261
|
+
return {
|
|
227
262
|
...base,
|
|
228
263
|
issuer: this.options_.issuer,
|
|
229
264
|
authorization_endpoint: this.options_.authorization_endpoint ?? base.authorization_endpoint,
|
|
230
265
|
token_endpoint: this.options_.token_endpoint ?? base.token_endpoint,
|
|
231
266
|
jwks_uri: this.options_.jwks_uri ?? base.jwks_uri,
|
|
232
267
|
end_session_endpoint: this.options_.end_session_endpoint ?? base.end_session_endpoint,
|
|
233
|
-
}
|
|
268
|
+
};
|
|
234
269
|
}
|
|
235
270
|
async discoverMetadata_() {
|
|
236
271
|
const key = `${DISCOVERY_CACHE_KEY_PREFIX}${this.options_.issuer}`;
|
|
@@ -238,7 +273,21 @@ class OidcEngine {
|
|
|
238
273
|
if (cached) {
|
|
239
274
|
return cached;
|
|
240
275
|
}
|
|
241
|
-
const
|
|
276
|
+
const client = loadOpenIdClient();
|
|
277
|
+
let config;
|
|
278
|
+
try {
|
|
279
|
+
config = await client.discovery(new URL(this.options_.issuer), this.options_.client_id, undefined, undefined, {
|
|
280
|
+
timeout: this.httpTimeoutMs_ / 1000,
|
|
281
|
+
execute: this.options_.issuer.startsWith("http:")
|
|
282
|
+
? [client.allowInsecureRequests]
|
|
283
|
+
: [],
|
|
284
|
+
});
|
|
285
|
+
}
|
|
286
|
+
catch (error) {
|
|
287
|
+
throw new utils_1.MedusaError(utils_1.MedusaError.Types.UNEXPECTED_STATE, `Could not discover the identity provider's configuration: ${getErrorReason(error)}`);
|
|
288
|
+
}
|
|
289
|
+
// The spread drops the non-enumerable helper methods so the result is cacheable.
|
|
290
|
+
const metadata = { ...config.serverMetadata() };
|
|
242
291
|
await this.cache_?.set(key, metadata, Math.floor(this.discoveryCacheTtlMs_ / 1000));
|
|
243
292
|
return metadata;
|
|
244
293
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/engine/engine.ts"],"names":[],"mappings":";;;AACA,qDAAkE;
|
|
1
|
+
{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/engine/engine.ts"],"names":[],"mappings":";;;AACA,qDAAkE;AAgBlE,oCAA0C;AAE1C,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;AACrD,MAAM,+BAA+B,GAAG,CAAC,CAAA;AACzC,MAAM,8BAA8B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA,CAAC,SAAS;AAC/D,MAAM,uBAAuB,GAAG,MAAM,CAAA;AAEtC,MAAM,sBAAsB,GAAsB;IAChD,SAAS,EAAE,KAAK;IAChB,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;CACb,CAAA;AAED,0DAA0D;AAC1D,MAAM,0BAA0B,GAAG,iBAAiB,CAAA;AAUpD,IAAI,YAAsC,CAAA;AAC1C,IAAI,KAAwB,CAAA;AAE5B,uHAAuH;AACvH,SAAS,gBAAgB;IACvB,YAAY,KAAK,OAAO,CAAC,eAAe,CAAiB,CAAA;IACzD,OAAO,YAAY,CAAA;AACrB,CAAC;AAED,SAAS,SAAS;IAChB,KAAK,KAAK,OAAO,CAAC,cAAc,CAAU,CAAA;IAC1C,OAAO,KAAK,CAAA;AACd,CAAC;AAED,sGAAsG;AACtG,kGAAkG;AAClG,SAAS,cAAc,CAAC,KAKvB;IACC,MAAM,MAAM,GACV,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAA;IACpE,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,iBAAiB,CAAC;SACnD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC;SACrD,IAAI,CAAC,IAAI,CAAC,CAAA;IAEb,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,KAAK,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAA;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAa,UAAU;IAiBrB,YAAY,OAA0B,EAAE,KAAqB;QAFnD,qBAAgB,GAAG,CAAC,CAAA;QAG5B,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;YACrB,MAAM,IAAI,mBAAW,CACnB,mBAAW,CAAC,KAAK,CAAC,YAAY,EAC9B,yCAAyC,CAC1C,CAAA;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,mBAAW,CACnB,mBAAW,CAAC,KAAK,CAAC,YAAY,EAC9B,2CAA2C,CAC5C,CAAA;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,MAAM,IAAI,mBAAW,CACnB,mBAAW,CAAC,KAAK,CAAC,YAAY,EAC9B,8CAA8C,CAC/C,CAAA;QACH,CAAC;QAED,IAAA,uBAAe,EAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI;YACzB,CAAC,wBAAwB,EAAE,OAAO,CAAC,sBAAsB,CAAC;YAC1D,CAAC,gBAAgB,EAAE,OAAO,CAAC,cAAc,CAAC;YAC1C,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC;SACtB,EAAE,CAAC;YACX,IAAI,KAAK,EAAE,CAAC;gBACV,IAAA,uBAAe,EAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAC7B,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;QACvB,IAAI,CAAC,oBAAoB;YACvB,OAAO,CAAC,sBAAsB,IAAI,8BAA8B,CAAA;QAClE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,eAAe,IAAI,uBAAuB,CAAA;QACxE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACrB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,qBAAqB,CACzB,KAAqC;QAErC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,mBAAW,CACnB,mBAAW,CAAC,KAAK,CAAC,YAAY,EAC9B,4DAA4D,CAC7D,CAAA;QACH,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAA;QACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAA;QAEtC,MAAM,YAAY,GAAG,MAAM,CAAC,sBAAsB,EAAE,CAAA;QACpD,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,YAAY,CAAC,CAAA;QAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAA;QAElC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,cAAc,CAAA;QAErE,MAAM,GAAG,GAAG,MAAM,CAAC,qBAAqB,CAAC,MAAM,EAAE;YAC/C,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACvB,YAAY,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY;YAC7D,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK;YACL,cAAc,EAAE,aAAa;YAC7B,qBAAqB,EAAE,MAAM;SAC9B,CAAC,CAAA;QAEF,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,CAAA;IAC/C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAChB,KAA4B;QAE5B,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,IAAI,EAAE,CAAA;QAElC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,mBAAW,CACnB,mBAAW,CAAC,KAAK,CAAC,YAAY,EAC9B,4DAA4D,CAC7D,CAAA;QACH,CAAC;QAED,MAAM,KAAK,GAAG,SAAS,EAAE,CAAA;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAA;QACtC,MAAM,mBAAmB,GAAG,MAAM,CAAC,cAAc,EAAE,CAAA;QACnD,MAAM,MAAM,GAAG;YACb,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;YAClC,CAAC,KAAK,CAAC,cAAc,CAAC,EACpB,IAAI,CAAC,QAAQ,CAAC,uBAAuB;gBACrC,+BAA+B;SAClC,CAAA;QAED,0EAA0E;QAC1E,sFAAsF;QACtF,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAA;QAEnE,IAAI,MAA6B,CAAA;QACjC,IAAI,MAA2C,CAAA;QAC/C,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,KAAK,CAAC,oBAAoB,CAC/C,mBAAmB,EACnB,MAAM,EACN,IAAI,eAAe,CAAC,MAAM,CAAC,EAC3B,KAAK,CAAC,KAAK,CACZ,CAAA;YACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,6BAA6B,CACxD,mBAAmB,EACnB,MAAM,EACN,IAAI,CAAC,QAAQ,CAAC,aAAa;gBACzB,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;gBACrD,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,EAChB,cAAc,EACd,WAAW,EACX,KAAK,CAAC,YAAY,EAClB;gBACE,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAC3B,IAAI,CAAC,uBAAuB,CAAC,mBAAmB,CAAC;gBACnD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;aACjD,CACF,CAAA;YACD,MAAM,GAAG,MAAM,KAAK,CAAC,gCAAgC,CACnD,mBAAmB,EACnB,MAAM,EACN,QAAQ,EACR,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CACrD,CAAA;YACD,MAAM,GAAG,KAAK,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAA;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,mBAAW,CACnB,mBAAW,CAAC,KAAK,CAAC,YAAY,EAC9B,wDAAwD,cAAc,CACpE,KAAK,CACN,EAAE,CACJ,CAAA;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,IAAI,mBAAW,CACnB,mBAAW,CAAC,KAAK,CAAC,YAAY,EAC9B,0FAA0F,CAC3F,CAAA;QACH,CAAC;QAED,OAAO;YACL,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE;YACrB,MAAM,EAAE;gBACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,UAAU,EACR,MAAM,CAAC,UAAU,KAAK,SAAS;oBAC7B,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU;gBACvD,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB;SACF,CAAA;IACH,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,MAA+B;QACvC,MAAM,QAAQ,GAAsB;YAClC,GAAG,sBAAsB;YACzB,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc;SAChC,CAAA;QAED,MAAM,aAAa,GAAG,QAAQ,CAAC,SAAS,IAAI,KAAK,CAAA;QACjD,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC,CAAA;QAE3C,IACE,aAAa,KAAK,SAAS;YAC3B,aAAa,KAAK,IAAI;YACtB,aAAa,KAAK,EAAE,EACpB,CAAC;YACD,MAAM,IAAI,mBAAW,CACnB,mBAAW,CAAC,KAAK,CAAC,YAAY,EAC9B,oDAAoD,aAAa,mCAAmC,CACrG,CAAA;QACH,CAAC;QAED,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,IAAI,OAAO,CAAA;QAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,CAAA;QAEhC,MAAM,oBAAoB,GAAG,IAAI,CAAC,QAAQ,CAAC,sBAAsB,IAAI,IAAI,CAAA;QACzE,IAAI,oBAAoB,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YAC3D,MAAM,IAAI,mBAAW,CACnB,mBAAW,CAAC,KAAK,CAAC,YAAY,EAC9B,gEAAgE,CACjE,CAAA;QACH,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC;YAChD,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACxE,MAAM,CAAC,WAAW,EAAE,CACrB,CAAA;YACD,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ;gBACvB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE;gBACpC,CAAC,CAAC,SAAS,CAAA;YAEf,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,mBAAW,CACnB,mBAAW,CAAC,KAAK,CAAC,YAAY,EAC9B,oEAAoE,CACrE,CAAA;YACH,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAA4B,EAAE,CAAA;QAChD,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1D,IAAI,KAAK,KAAK,WAAW,IAAI,CAAC,SAAS,EAAE,CAAC;gBACxC,SAAQ;YACV,CAAC;YACD,IAAI,IAAA,iBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;gBACjC,YAAY,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAA;YACzC,CAAC;QACH,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,aAAa,CAAC;YAC/B,YAAY;SACb,CAAA;IACH,CAAC;IAES,KAAK,CAAC,UAAU;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAEtB,IACE,IAAI,CAAC,cAAc;YACnB,CAAC,IAAI,CAAC,wBAAwB,EAAE,IAAI,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAChE,CAAC;YACD,OAAO,IAAI,CAAC,cAAc,CAAA;QAC5B,CAAC;QAED,wEAAwE;QACxE,iDAAiD;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,CAAA;QACnC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAA;QAC7B,IAAI,CAAC,gBAAgB,GAAG,GAAG,GAAG,IAAI,CAAC,oBAAoB,CAAA;QAEvD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAA;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qDAAqD;YACrD,IAAI,IAAI,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;gBACpC,IAAI,CAAC,cAAc,GAAG,SAAS,CAAA;gBAC/B,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAA;YAC3B,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAES,KAAK,CAAC,YAAY;QAC1B,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAA;QACjC,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAA;QAE1D,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,aAAa,CACrC,cAAc,EACd,IAAI,CAAC,QAAQ,CAAC,SAAS,EACvB;YACE,aAAa,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC3C,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,CAAC,MAAM,CAAC,cAAc,CAAC,EACrB,IAAI,CAAC,QAAQ,CAAC,uBAAuB;gBACrC,+BAA+B;SAClC,EACD,IAAI,CAAC,QAAQ,CAAC,aAAa;YACzB,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;YACtD,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAClB,CAAA;QAED,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,cAAc,GAAG,IAAI,CAAA;QAC3C,IAAI,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAA;QACtC,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAED,yEAAyE;IAC/D,uBAAuB,CAAC,QAAwB;QACxD,OAAO;YACL,QAAQ,CAAC,MAAM;YACf,QAAQ,CAAC,sBAAsB;YAC/B,QAAQ,CAAC,cAAc;YACvB,QAAQ,CAAC,QAAQ;SAClB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAA;IAC3C,CAAC;IAES,wBAAwB;QAChC,OAAO,CAAC,CAAC,CACP,IAAI,CAAC,QAAQ,CAAC,sBAAsB;YACpC,IAAI,CAAC,QAAQ,CAAC,cAAc;YAC5B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CACvB,CAAA;IACH,CAAC;IAES,KAAK,CAAC,sBAAsB;QACpC,IAAI,IAAI,GAAmB,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAA;QAC3D,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC;YACrC,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAA;QACvC,CAAC;QAED,0EAA0E;QAC1E,yEAAyE;QACzE,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;YAC5B,sBAAsB,EACpB,IAAI,CAAC,QAAQ,CAAC,sBAAsB,IAAI,IAAI,CAAC,sBAAsB;YACrE,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc;YACnE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;YACjD,oBAAoB,EAClB,IAAI,CAAC,QAAQ,CAAC,oBAAoB,IAAI,IAAI,CAAC,oBAAoB;SAClE,CAAA;IACH,CAAC;IAES,KAAK,CAAC,iBAAiB;QAC/B,MAAM,GAAG,GAAG,GAAG,0BAA0B,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAA;QAElE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG,CAAiB,GAAG,CAAC,CAAA;QAC1D,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAA;QACf,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAA;QACjC,IAAI,MAAqB,CAAA;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAC7B,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC7B,IAAI,CAAC,QAAQ,CAAC,SAAS,EACvB,SAAS,EACT,SAAS,EACT;gBACE,OAAO,EAAE,IAAI,CAAC,cAAc,GAAG,IAAI;gBACnC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;oBAC/C,CAAC,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC;oBAChC,CAAC,CAAC,EAAE;aACP,CACF,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,mBAAW,CACnB,mBAAW,CAAC,KAAK,CAAC,gBAAgB,EAClC,6DAA6D,cAAc,CACzE,KAAK,CACN,EAAE,CACJ,CAAA;QACH,CAAC;QACD,iFAAiF;QACjF,MAAM,QAAQ,GAAG,EAAE,GAAG,MAAM,CAAC,cAAc,EAAE,EAAE,CAAA;QAC/C,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG,CACpB,GAAG,EACH,QAAQ,EACR,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAC7C,CAAA;QAED,OAAO,QAAQ,CAAA;IACjB,CAAC;CACF;AAxYD,gCAwYC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@medusajs/auth-oidc",
|
|
3
|
-
"version": "2.22.
|
|
3
|
+
"version": "2.22.3-snapshot-20261103230838",
|
|
4
4
|
"description": "Generic OpenID Connect (OIDC) authentication provider for Medusa",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"repository": {
|
|
@@ -28,18 +28,19 @@
|
|
|
28
28
|
"license": "SEE LICENSE IN LICENSE",
|
|
29
29
|
"scripts": {
|
|
30
30
|
"test": "../../../../node_modules/.bin/jest --passWithNoTests src",
|
|
31
|
-
"test:integration": "../../../../node_modules/.bin/jest --passWithNoTests --forceExit --
|
|
31
|
+
"test:integration": "../../../../node_modules/.bin/jest --passWithNoTests --forceExit --testPathPatterns=\"integration-tests/__tests__/.*\\.spec\\.ts\"",
|
|
32
32
|
"build": "yarn run -T rimraf dist && yarn run -T tsc --build",
|
|
33
33
|
"watch": "yarn run -T tsc --watch"
|
|
34
34
|
},
|
|
35
35
|
"dependencies": {
|
|
36
|
-
"
|
|
36
|
+
"oauth4webapi": "^3.8.8",
|
|
37
|
+
"openid-client": "^6.8.8"
|
|
37
38
|
},
|
|
38
39
|
"devDependencies": {
|
|
39
|
-
"@medusajs/framework": "2.22.
|
|
40
|
+
"@medusajs/framework": "2.22.3-snapshot-20261103230838"
|
|
40
41
|
},
|
|
41
42
|
"peerDependencies": {
|
|
42
|
-
"@medusajs/framework": "2.22.
|
|
43
|
+
"@medusajs/framework": "2.22.3-snapshot-20261103230838"
|
|
43
44
|
},
|
|
44
45
|
"keywords": [
|
|
45
46
|
"medusa-provider",
|