@opengroundplan/core 0.1.1

package/templates/layers/auth-oidc/files/node/src/auth/auth.config.ts

@@ -0,0 +1,64 @@
+/**
+ * The only place OIDC configuration is read. Defaults live in `defaults`;
+ * nothing downstream touches process.env.
+ */
+
+const defaults = {
+  scopes: '{{ oidcScopes }}',
+  roleClaim: '{{ oidcRoleClaim }}',
+  /** Signature algorithms accepted from the provider. `none` and HS* are never allowed. */
+  algorithms: 'RS256',
+  /** Tolerance for clock drift between this service and the provider, in seconds. */
+  clockToleranceSeconds: 5,
+  /** How long a fetched JWKS is reused before the next miss triggers a refetch. */
+  jwksCacheSeconds: 600,
+  discoveryTimeoutMs: 5000,
+} as const;
+
+export interface AuthConfig {
+  issuer: string;
+  audience: string;
+  scopes: string;
+  roleClaim: string;
+  algorithms: string[];
+  clockToleranceSeconds: number;
+  jwksCacheSeconds: number;
+  discoveryTimeoutMs: number;
+}
+
+function required(name: string): string {
+  const value = process.env[name];
+  if (!value) throw new Error(`Missing required environment variable ${name}`);
+  return value;
+}
+
+function str(name: string, fallback: string): string {
+  return process.env[name] || fallback;
+}
+
+function int(name: string, fallback: number): number {
+  const raw = process.env[name];
+  if (!raw) return fallback;
+  const parsed = Number(raw);
+  if (!Number.isInteger(parsed)) throw new Error(`${name} must be an integer, got "${raw}"`);
+  return parsed;
+}
+
+let cached: AuthConfig | undefined;
+
+export function authConfig(): AuthConfig {
+  cached ??= {
+    issuer: required('OIDC_ISSUER'),
+    audience: required('OIDC_AUDIENCE'),
+    scopes: str('OIDC_SCOPES', defaults.scopes),
+    roleClaim: str('OIDC_ROLE_CLAIM', defaults.roleClaim),
+    algorithms: str('OIDC_ALGORITHMS', defaults.algorithms)
+      .split(',')
+      .map((value) => value.trim())
+      .filter(Boolean),
+    clockToleranceSeconds: int('OIDC_CLOCK_TOLERANCE_SECONDS', defaults.clockToleranceSeconds),
+    jwksCacheSeconds: int('OIDC_JWKS_CACHE_SECONDS', defaults.jwksCacheSeconds),
+    discoveryTimeoutMs: int('OIDC_DISCOVERY_TIMEOUT_MS', defaults.discoveryTimeoutMs),
+  };
+  return cached;
+}

package/templates/layers/auth-oidc/files/node/src/auth/auth.decorators.ts

@@ -0,0 +1,19 @@
+import { SetMetadata, createParamDecorator, type ExecutionContext } from '@nestjs/common';
+import type { AuthenticatedUser } from './jwt-verifier';
+
+export const IS_PUBLIC_KEY = 'auth:public';
+export const ROLES_KEY = 'auth:roles';
+export const SCOPES_KEY = 'auth:scopes';
+
+/** Opt a route out of authentication — the guard is global by default. */
+export const Public = () => SetMetadata(IS_PUBLIC_KEY, true);
+
+/** Caller must hold at least one of these roles. */
+export const Roles = (...roles: string[]) => SetMetadata(ROLES_KEY, roles);
+
+/** Caller's access token must carry all of these scopes. */
+export const Scopes = (...scopes: string[]) => SetMetadata(SCOPES_KEY, scopes);
+
+export const CurrentUser = createParamDecorator((_data: unknown, context: ExecutionContext) => {
+  return context.switchToHttp().getRequest<{ user?: AuthenticatedUser }>().user;
+});

package/templates/layers/auth-oidc/files/node/src/auth/auth.guard.ts

@@ -0,0 +1,61 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Injectable,
+  ServiceUnavailableException,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { IS_PUBLIC_KEY, ROLES_KEY, SCOPES_KEY } from './auth.decorators';
+import { JwtVerifier, ProviderUnavailableError, type AuthenticatedUser } from './jwt-verifier';
+
+@Injectable()
+export class OidcAuthGuard implements CanActivate {
+  constructor(
+    private readonly verifier: JwtVerifier,
+    private readonly reflector: Reflector,
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    if (this.metadata<boolean>(IS_PUBLIC_KEY, context)) return true;
+
+    const request = context.switchToHttp().getRequest<{ headers: Record<string, string | undefined>; user?: AuthenticatedUser }>();
+    const token = bearerToken(request.headers.authorization);
+    if (!token) throw new UnauthorizedException('Missing bearer token');
+
+    let user: AuthenticatedUser;
+    try {
+      user = await this.verifier.verify(token);
+    } catch (error) {
+      // An outage must not be reported as a rejected caller.
+      if (error instanceof ProviderUnavailableError) {
+        throw new ServiceUnavailableException('Identity provider unavailable');
+      }
+      // Never leak why validation failed — it tells an attacker what to fix.
+      throw new UnauthorizedException('Invalid token');
+    }
+
+    const roles = this.metadata<string[]>(ROLES_KEY, context) ?? [];
+    if (roles.length && !roles.some((role) => user.roles.includes(role))) {
+      throw new ForbiddenException(`Requires one of: ${roles.join(', ')}`);
+    }
+
+    const scopes = this.metadata<string[]>(SCOPES_KEY, context) ?? [];
+    const missing = scopes.filter((scope) => !user.scopes.includes(scope));
+    if (missing.length) throw new ForbiddenException(`Missing scope(s): ${missing.join(', ')}`);
+
+    request.user = user;
+    return true;
+  }
+
+  /** Handler metadata wins over controller metadata. */
+  private metadata<T>(key: string, context: ExecutionContext): T | undefined {
+    return this.reflector.getAllAndOverride<T>(key, [context.getHandler(), context.getClass()]);
+  }
+}
+
+function bearerToken(header: string | undefined): string | undefined {
+  const [scheme, value] = header?.split(' ') ?? [];
+  return scheme?.toLowerCase() === 'bearer' && value ? value : undefined;
+}

package/templates/layers/auth-oidc/files/node/src/auth/auth.module.ts

@@ -0,0 +1,12 @@
+import { Global, Module } from '@nestjs/common';
+import { APP_GUARD } from '@nestjs/core';
+import { OidcAuthGuard } from './auth.guard';
+import { JwtVerifier } from './jwt-verifier';
+
+/** Deny by default: every route needs a valid token unless it is marked @Public(). */
+@Global()
+@Module({
+  providers: [JwtVerifier, { provide: APP_GUARD, useClass: OidcAuthGuard }],
+  exports: [JwtVerifier],
+})
+export class AuthModule {}

package/templates/layers/auth-oidc/files/node/src/auth/jwt-verifier.ts

@@ -0,0 +1,97 @@
+/**
+ * Bearer-token validation for a resource server. The JWKS URI comes from OIDC discovery,
+ * so key rotation and endpoint changes need no redeploy.
+ */
+import { Injectable } from '@nestjs/common';
+import { createRemoteJWKSet, jwtVerify, type JWTPayload } from 'jose';
+import { authConfig } from './auth.config';
+
+export interface AuthenticatedUser {
+  sub: string;
+  email?: string;
+  name?: string;
+  roles: string[];
+  scopes: string[];
+  claims: JWTPayload;
+}
+
+interface ProviderMetadata {
+  issuer: string;
+  jwks_uri: string;
+}
+
+/** Distinguishes "the provider is down" from "this caller's token is bad". */
+export class ProviderUnavailableError extends Error {}
+
+@Injectable()
+export class JwtVerifier {
+  private jwks?: ReturnType<typeof createRemoteJWKSet>;
+  private metadata?: Promise<ProviderMetadata>;
+
+  async verify(token: string): Promise<AuthenticatedUser> {
+    const config = authConfig();
+    const provider = await this.discover();
+
+    const { payload } = await jwtVerify(token, await this.keys(), {
+      issuer: provider.issuer,
+      audience: config.audience,
+      algorithms: config.algorithms,
+      clockTolerance: config.clockToleranceSeconds,
+    });
+
+    return {
+      sub: String(payload.sub),
+      email: typeof payload.email === 'string' ? payload.email : undefined,
+      name: typeof payload.name === 'string' ? payload.name : undefined,
+      roles: toList(payload[config.roleClaim]),
+      scopes: toList(payload.scope),
+      claims: payload,
+    };
+  }
+
+  private discover(): Promise<ProviderMetadata> {
+    if (this.metadata) return this.metadata;
+
+    const config = authConfig();
+    const pending = fetchMetadata(config.issuer, config.discoveryTimeoutMs).catch((error: unknown) => {
+      // Never cache a failed discovery, or the service stays broken until restart.
+      this.metadata = undefined;
+      throw error;
+    });
+
+    this.metadata = pending;
+    return pending;
+  }
+
+  private async keys() {
+    if (this.jwks) return this.jwks;
+
+    const config = authConfig();
+    this.jwks = createRemoteJWKSet(new URL((await this.discover()).jwks_uri), {
+      cacheMaxAge: config.jwksCacheSeconds * 1000,
+      timeoutDuration: config.discoveryTimeoutMs,
+    });
+    return this.jwks;
+  }
+}
+
+async function fetchMetadata(issuer: string, timeoutMs: number): Promise<ProviderMetadata> {
+  const base = issuer.endsWith('/') ? issuer : `${issuer}/`;
+  let response: Response;
+  try {
+    response = await fetch(new URL('.well-known/openid-configuration', base), {
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+  } catch (error) {
+    throw new ProviderUnavailableError(`OIDC discovery could not reach ${issuer}`, { cause: error });
+  }
+  if (!response.ok) {
+    throw new ProviderUnavailableError(`OIDC discovery returned ${response.status} for ${issuer}`);
+  }
+  return (await response.json()) as ProviderMetadata;
+}
+
+function toList(value: unknown): string[] {
+  if (Array.isArray(value)) return value.map(String);
+  return typeof value === 'string' ? value.split(' ').filter(Boolean) : [];
+}

package/templates/layers/auth-oidc/files/package.json

@@ -0,0 +1,6 @@
+{
+  "dependencies": {
+    "jose": "^6.2.3",
+    "openid-client": "^6.8.4"
+  }
+}

package/templates/layers/auth-oidc/files/pyproject.toml

@@ -0,0 +1,2 @@
+[project]
+dependencies = ["pyjwt>=2.13.0"]

package/templates/layers/auth-oidc/files/python/.env.oidc.example

@@ -0,0 +1,14 @@
+# OIDC — copy these into .env and fill them in.
+# Discovery reads every endpoint and signing key from OIDC_ISSUER/.well-known/openid-configuration.
+
+# Required
+OIDC_ISSUER=https://your-tenant.example-idp.com
+OIDC_AUDIENCE=
+
+# Optional — defaults live in app/auth/settings.py
+# OIDC_SCOPES={{ oidcScopes }}
+# OIDC_ROLE_CLAIM={{ oidcRoleClaim }}
+# OIDC_ALGORITHMS=RS256
+# OIDC_LEEWAY_SECONDS=5
+# OIDC_JWKS_CACHE_SECONDS=600
+# OIDC_DISCOVERY_TIMEOUT_SECONDS=5.0

package/templates/layers/auth-oidc/files/python/app/auth/dependencies.py

@@ -0,0 +1,69 @@
+"""FastAPI dependencies that turn a validated token into an authenticated caller."""
+
+from typing import Annotated, Any, Callable
+
+import httpx
+import jwt
+from fastapi import Depends, HTTPException, status
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+
+from .settings import oidc_settings
+from .verifier import claim_list, verify_token
+
+# auto_error=False so a missing header produces our message, not the default one.
+bearer_scheme = HTTPBearer(auto_error=False, scheme_name="OpenID Connect")
+
+Credentials = Annotated[HTTPAuthorizationCredentials | None, Depends(bearer_scheme)]
+
+
+def unauthorized(detail: str) -> HTTPException:
+    return HTTPException(
+        status_code=status.HTTP_401_UNAUTHORIZED,
+        detail=detail,
+        headers={"WWW-Authenticate": "Bearer"},
+    )
+
+
+def current_user(credentials: Credentials) -> dict[str, Any]:
+    if credentials is None:
+        raise unauthorized("Missing bearer token")
+    try:
+        return verify_token(credentials.credentials)
+    except jwt.PyJWTError as error:
+        # Never echo the reason — it tells an attacker what to fix.
+        raise unauthorized("Invalid token") from error
+    except httpx.HTTPError as error:
+        # The provider is unreachable. That is an outage, not a rejected caller.
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="Identity provider unavailable",
+        ) from error
+
+
+CurrentUser = Annotated[dict[str, Any], Depends(current_user)]
+
+
+def require_roles(*roles: str) -> Callable[..., dict[str, Any]]:
+    """Caller must hold at least one of these roles."""
+    wanted = ", ".join(roles)
+
+    def guard(user: CurrentUser) -> dict[str, Any]:
+        granted = claim_list(user.get(oidc_settings().role_claim))
+        if not any(role in granted for role in roles):
+            raise HTTPException(status.HTTP_403_FORBIDDEN, f"Requires one of: {wanted}")
+        return user
+
+    return guard
+
+
+def require_scopes(*scopes: str) -> Callable[..., dict[str, Any]]:
+    """Caller's access token must carry all of these scopes."""
+
+    def guard(user: CurrentUser) -> dict[str, Any]:
+        granted = claim_list(user.get("scope"))
+        missing = ", ".join(scope for scope in scopes if scope not in granted)
+        if missing:
+            raise HTTPException(status.HTTP_403_FORBIDDEN, f"Missing scope(s): {missing}")
+        return user
+
+    return guard

package/templates/layers/auth-oidc/files/python/app/auth/settings.py

@@ -0,0 +1,32 @@
+"""The only place OIDC configuration is read. Every default lives here."""
+
+from functools import lru_cache
+
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+
+class OidcSettings(BaseSettings):
+    model_config = SettingsConfigDict(env_prefix="OIDC_", env_file=".env", extra="ignore")
+
+    issuer: str
+    audience: str
+
+    scopes: str = "{{ oidcScopes }}"
+    role_claim: str = "{{ oidcRoleClaim }}"
+
+    # Asymmetric only — a resource server must never trust an HMAC-signed token it did not issue.
+    algorithms: str = "RS256"
+
+    # Tolerance for clock drift between this service and the provider.
+    leeway_seconds: int = 5
+    jwks_cache_seconds: int = 600
+    discovery_timeout_seconds: float = 5.0
+
+    @property
+    def algorithm_list(self) -> list[str]:
+        return [value.strip() for value in self.algorithms.split(",") if value.strip()]
+
+
+@lru_cache(maxsize=1)
+def oidc_settings() -> OidcSettings:
+    return OidcSettings()

package/templates/layers/auth-oidc/files/python/app/auth/verifier.py

@@ -0,0 +1,57 @@
+"""Bearer-token validation. Endpoints and signing keys come from OIDC discovery,
+so provider key rotation needs no redeploy."""
+
+from functools import lru_cache
+from typing import Any
+
+import httpx
+import jwt
+from jwt import PyJWKClient
+
+from .settings import oidc_settings
+
+DISCOVERY_PATH = ".well-known/openid-configuration"
+
+
+@lru_cache(maxsize=1)
+def provider_metadata() -> dict[str, Any]:
+    settings = oidc_settings()
+    base = settings.issuer if settings.issuer.endswith("/") else settings.issuer + "/"
+    response = httpx.get(base + DISCOVERY_PATH, timeout=settings.discovery_timeout_seconds)
+    response.raise_for_status()
+    return response.json()
+
+
+@lru_cache(maxsize=1)
+def jwks_client() -> PyJWKClient:
+    settings = oidc_settings()
+    return PyJWKClient(
+        provider_metadata()["jwks_uri"],
+        cache_keys=True,
+        lifespan=settings.jwks_cache_seconds,
+        timeout=settings.discovery_timeout_seconds,
+    )
+
+
+def verify_token(token: str) -> dict[str, Any]:
+    """Raises jwt.PyJWTError when the token is not valid for this audience and issuer."""
+    settings = oidc_settings()
+    signing_key = jwks_client().get_signing_key_from_jwt(token).key
+    return jwt.decode(
+        token,
+        signing_key,
+        algorithms=settings.algorithm_list,
+        audience=settings.audience,
+        issuer=provider_metadata()["issuer"],
+        leeway=settings.leeway_seconds,
+        options={"require": ["exp", "iat", "sub"]},
+    )
+
+
+def claim_list(value: Any) -> list[str]:
+    """Roles and scopes arrive either as a list or as a space-delimited string."""
+    if isinstance(value, list):
+        return [str(item) for item in value]
+    if isinstance(value, str):
+        return value.split()
+    return []

package/templates/layers/auth-oidc/files/python/docs/auth-oidc.md

@@ -0,0 +1,57 @@
+# Authentication — OpenID Connect
+
+{{ solutionName | title }} is an OAuth2 **resource server**. It does not log users in; it
+validates the bearer tokens an identity provider already issued. Signing keys come from the
+provider's JWKS, discovered from the issuer, so key rotation needs no redeploy.
+
+## Setup
+
+1. Register an **API / resource** in your identity provider and note its audience identifier.
+2. Copy `.env.oidc.example` into `.env` and fill in `OIDC_ISSUER` and `OIDC_AUDIENCE`.
+3. Install the runtime dependencies if the generator did not:
+
+   ```bash
+   pip install -r requirements-auth-oidc.txt
+   ```
+
+## Usage
+
+```python
+from fastapi import APIRouter, Depends
+
+from app.auth.dependencies import CurrentUser, require_roles, require_scopes
+
+router = APIRouter()
+
+
+@router.get("/health")
+def health() -> dict[str, bool]:
+    return {"ok": True}
+
+
+@router.get("/invoices", dependencies=[Depends(require_scopes("invoices:read"))])
+def list_invoices(user: CurrentUser) -> dict[str, str]:
+    return {"requested_by": user["sub"]}
+
+
+@router.delete("/invoices/{invoice_id}", dependencies=[Depends(require_roles("admin"))])
+def delete_invoice(invoice_id: str) -> dict[str, bool]:
+    return {"deleted": True}
+```
+
+Routes are **public unless** they declare `CurrentUser` or one of the guard dependencies. To
+deny by default, attach the guard at the router or app level instead:
+
+```python
+app.include_router(router, dependencies=[Depends(current_user)])
+```
+
+- `CurrentUser` injects the validated claims dict, or returns 401.
+- `require_roles(...)` requires **one of** the listed roles, read from the `{{ oidcRoleClaim }}` claim.
+- `require_scopes(...)` requires **all** listed scopes from the token's `scope` claim.
+
+## Configuration
+
+`app/auth/settings.py` is the single source. Every value has a typed default there and an
+`OIDC_`-prefixed environment override; no other module reads the environment. Only asymmetric
+algorithms are accepted (`RS256` by default).

package/templates/layers/auth-oidc/files/python/requirements-auth-oidc.txt

@@ -0,0 +1,4 @@
+# Added by the auth-oidc layer. Merge into your main manifest if you use one.
+PyJWT[crypto]>=2.10,<3
+pydantic-settings>=2.7,<3
+httpx>=0.28,<1

package/templates/layers/auth-oidc/files/typescript/.env.oidc.example

@@ -0,0 +1,21 @@
+# OIDC — copy these into .env.local and fill them in.
+# Discovery reads everything else from OIDC_ISSUER/.well-known/openid-configuration.
+
+# Required
+OIDC_ISSUER=https://your-tenant.example-idp.com
+OIDC_CLIENT_ID=
+OIDC_CLIENT_SECRET=
+APP_BASE_URL=http://localhost:3000
+# openssl rand -base64 32
+AUTH_SECRET=
+
+# Optional — defaults live in src/lib/auth/config.ts
+# OIDC_SCOPES={{ oidcScopes }}
+# OIDC_ROLE_CLAIM={{ oidcRoleClaim }}
+# OIDC_SESSION_TTL_MINUTES={{ oidcSessionTtlMinutes }}
+# OIDC_LOGIN_TTL_MINUTES=10
+# OIDC_CALLBACK_PATH=/api/auth/callback
+# OIDC_AFTER_LOGIN_PATH=/
+# OIDC_AFTER_LOGOUT_PATH=/
+# Dev only: allow a plaintext http issuer such as a local Keycloak.
+# OIDC_ALLOW_INSECURE_ISSUER=false

package/templates/layers/auth-oidc/files/typescript/docs/auth-oidc.md

@@ -0,0 +1,69 @@
+# Authentication — OpenID Connect
+
+{{ solutionName | title }} signs users in with the OIDC Authorization Code flow plus PKCE.
+The session is an encrypted JWT in an HTTP-only cookie, so the app stays stateless and the
+browser never receives the ID token.
+
+## Setup
+
+1. Register a **web application** client with your identity provider.
+2. Add the redirect URI `APP_BASE_URL + /api/auth/callback`
+   (`http://localhost:3000/api/auth/callback` in development).
+3. Add the post-logout redirect URI `APP_BASE_URL`.
+4. Copy `.env.oidc.example` into `.env.local` and fill in the values.
+5. Install the runtime dependencies if the generator did not:
+
+   ```bash
+   npm install openid-client jose
+   ```
+
+## Routes
+
+| Route | Purpose |
+|---|---|
+| `GET /api/auth/login` | Starts the flow. Accepts `?returnTo=/relative/path`. |
+| `GET /api/auth/callback` | Validates state, nonce, PKCE, and the ID token, then sets the session. |
+| `GET /api/auth/logout` | Clears the session and calls the provider's end-session endpoint when it exists. |
+| `GET /api/auth/me` | Returns the current user as JSON, or 401. |
+
+## Protecting things
+
+Server Component or layout:
+
+```ts
+import { requireSession } from '@/lib/auth/guard';
+
+export default async function Page() {
+  const session = await requireSession('/dashboard');
+  return <p>Signed in as {session.email}</p>;
+}
+```
+
+Role check:
+
+```ts
+import { requireRoles } from '@/lib/auth/guard';
+
+await requireRoles('admin');
+```
+
+Read-only access, no redirect:
+
+```ts
+import { getSession } from '@/lib/auth/session';
+
+const session = await getSession(); // Session | null
+```
+
+## Configuration
+
+`src/lib/auth/config.ts` is the single source. Every value has a typed default there and an
+environment override; no other module reads `process.env`. Roles are read from the
+`{{ oidcRoleClaim }}` claim — change `OIDC_ROLE_CLAIM` if your provider uses a different one.
+
+## Notes
+
+- Discovery runs once per process and is memoized, so provider metadata is never hardcoded.
+- `AUTH_SECRET` encrypts the session cookie. Rotating it signs everyone out, which is the
+  intended emergency behaviour.
+- Set `OIDC_ALLOW_INSECURE_ISSUER=true` only against a local plaintext provider.

package/templates/layers/auth-oidc/files/typescript/src/app/api/auth/callback/route.ts

@@ -0,0 +1,43 @@
+import { NextResponse, type NextRequest } from 'next/server';
+import * as client from 'openid-client';
+import { oidcConfig } from '@/lib/auth/config';
+import { oidcClient } from '@/lib/auth/oidc';
+import { cookieOptions, sealSession, openTransaction, type Session } from '@/lib/auth/session';
+
+function roles(claims: Record<string, unknown>, claimName: string): string[] {
+  const value = claims[claimName];
+  if (Array.isArray(value)) return value.map(String);
+  return typeof value === 'string' ? value.split(' ').filter(Boolean) : [];
+}
+
+export async function GET(request: NextRequest) {
+  const config = oidcConfig();
+  const transaction = await openTransaction(request.cookies.get(config.transactionCookieName)?.value);
+
+  if (!transaction) {
+    // Expired or forged callback — start over rather than trusting the response.
+    return NextResponse.redirect(new URL(config.loginPath, config.appBaseUrl));
+  }
+
+  const configuration = await oidcClient();
+  const tokens = await client.authorizationCodeGrant(configuration, new URL(request.url), {
+    pkceCodeVerifier: transaction.verifier,
+    expectedState: transaction.state,
+    expectedNonce: transaction.nonce,
+    idTokenExpected: true,
+  });
+
+  const claims = tokens.claims() as unknown as Record<string, unknown>;
+  const session: Session = {
+    sub: String(claims.sub),
+    email: typeof claims.email === 'string' ? claims.email : undefined,
+    name: typeof claims.name === 'string' ? claims.name : undefined,
+    roles: roles(claims, config.roleClaim),
+    idToken: tokens.id_token,
+  };
+
+  const response = NextResponse.redirect(new URL(transaction.returnTo, config.appBaseUrl));
+  response.cookies.set(config.sessionCookieName, await sealSession(session), cookieOptions(config.sessionTtlMinutes));
+  response.cookies.delete(config.transactionCookieName);
+  return response;
+}