@opensas/oidc-sveltekit-adapter 0.0.0-stage → 0.0.2

package/COPYING.LESSER

@@ -0,0 +1,165 @@
+                   GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+
+  This version of the GNU Lesser General Public License incorporates
+the terms and conditions of version 3 of the GNU General Public
+License, supplemented by the additional permissions listed below.
+
+  0. Additional Definitions.
+
+  As used herein, "this License" refers to version 3 of the GNU Lesser
+General Public License, and the "GNU GPL" refers to version 3 of the GNU
+General Public License.
+
+  "The Library" refers to a covered work governed by this License,
+other than an Application or a Combined Work as defined below.
+
+  An "Application" is any work that makes use of an interface provided
+by the Library, but which is not otherwise based on the Library.
+Defining a subclass of a class defined by the Library is deemed a mode
+of using an interface provided by the Library.
+
+  A "Combined Work" is a work produced by combining or linking an
+Application with the Library.  The particular version of the Library
+with which the Combined Work was made is also called the "Linked
+Version".
+
+  The "Minimal Corresponding Source" for a Combined Work means the
+Corresponding Source for the Combined Work, excluding any source code
+for portions of the Combined Work that, considered in isolation, are
+based on the Application, and not on the Linked Version.
+
+  The "Corresponding Application Code" for a Combined Work means the
+object code and/or source code for the Application, including any data
+and utility programs needed for reproducing the Combined Work from the
+Application, but excluding the System Libraries of the Combined Work.
+
+  1. Exception to Section 3 of the GNU GPL.
+
+  You may convey a covered work under sections 3 and 4 of this License
+without being bound by section 3 of the GNU GPL.
+
+  2. Conveying Modified Versions.
+
+  If you modify a copy of the Library, and, in your modifications, a
+facility refers to a function or data to be supplied by an Application
+that uses the facility (other than as an argument passed when the
+facility is invoked), then you may convey a copy of the modified
+version:
+
+   a) under this License, provided that you make a good faith effort to
+   ensure that, in the event an Application does not supply the
+   function or data, the facility still operates, and performs
+   whatever part of its purpose remains meaningful, or
+
+   b) under the GNU GPL, with none of the additional permissions of
+   this License applicable to that copy.
+
+  3. Object Code Incorporating Material from Library Header Files.
+
+  The object code form of an Application may incorporate material from
+a header file that is part of the Library.  You may convey such object
+code under terms of your choice, provided that, if the incorporated
+material is not limited to numerical parameters, data structure
+layouts and accessors, or small macros, inline functions and templates
+(ten or fewer lines in length), you do both of the following:
+
+   a) Give prominent notice with each copy of the object code that the
+   Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the object code with a copy of the GNU GPL and this license
+   document.
+
+  4. Combined Works.
+
+  You may convey a Combined Work under terms of your choice that,
+taken together, effectively do not restrict modification of the
+portions of the Library contained in the Combined Work and reverse
+engineering for debugging such modifications, if you also do each of
+the following:
+
+   a) Give prominent notice with each copy of the Combined Work that
+   the Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the Combined Work with a copy of the GNU GPL and this license
+   document.
+
+   c) For a Combined Work that displays copyright notices during
+   execution, include the copyright notice for the Library among
+   these notices, as well as a reference directing the user to the
+   copies of the GNU GPL and this license document.
+
+   d) Do one of the following:
+
+       0) Convey the Minimal Corresponding Source under the terms of this
+       License, and the Corresponding Application Code in a form
+       suitable for, and under terms that permit, the user to
+       recombine or relink the Application with a modified version of
+       the Linked Version to produce a modified Combined Work, in the
+       manner specified by section 6 of the GNU GPL for conveying
+       Corresponding Source.
+
+       1) Use a suitable shared library mechanism for linking with the
+       Library.  A suitable mechanism is one that (a) uses at run time
+       a copy of the Library already present on the user's computer
+       system, and (b) will operate properly with a modified version
+       of the Library that is interface-compatible with the Linked
+       Version.
+
+   e) Provide Installation Information, but only if you would otherwise
+   be required to provide such information under section 6 of the
+   GNU GPL, and only to the extent that such information is
+   necessary to install and execute a modified version of the
+   Combined Work produced by recombining or relinking the
+   Application with a modified version of the Linked Version. (If
+   you use option 4d0, the Installation Information must accompany
+   the Minimal Corresponding Source and Corresponding Application
+   Code. If you use option 4d1, you must provide the Installation
+   Information in the manner specified by section 6 of the GNU GPL
+   for conveying Corresponding Source.)
+
+  5. Combined Libraries.
+
+  You may place library facilities that are a work based on the
+Library side by side in a single library together with other library
+facilities that are not Applications and are not covered by this
+License, and convey such a combined library under terms of your
+choice, if you do both of the following:
+
+   a) Accompany the combined library with a copy of the same work based
+   on the Library, uncombined with any other library facilities,
+   conveyed under the terms of this License.
+
+   b) Give prominent notice with the combined library that part of it
+   is a work based on the Library, and explaining where to find the
+   accompanying uncombined form of the same work.
+
+  6. Revised Versions of the GNU Lesser General Public License.
+
+  The Free Software Foundation may publish revised and/or new versions
+of the GNU Lesser General Public License from time to time. Such new
+versions will be similar in spirit to the present version, but may
+differ in detail to address new problems or concerns.
+
+  Each version is given a distinguishing version number. If the
+Library as you received it specifies that a certain numbered version
+of the GNU Lesser General Public License "or any later version"
+applies to it, you have the option of following the terms and
+conditions either of that published version or of any later version
+published by the Free Software Foundation. If the Library as you
+received it does not specify a version number of the GNU Lesser
+General Public License, you may choose any version of the GNU Lesser
+General Public License ever published by the Free Software Foundation.
+
+  If the Library as you received it specifies that a proxy can decide
+whether future versions of the GNU Lesser General Public License shall
+apply, that proxy's public statement of acceptance of any version is
+permanent authorization for you to choose that version for the
+Library.

package/README.md

@@ -1,3 +1,223 @@
-# Temporary Holding Version
+# oidc-sveltekit-adapter
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Proyecto _de uso interno_ que resuelve el login por **OpenID Connect** (ADFS, Keycloak) para las
+aplicaciones SvelteKit.
+
+npm: `@opensas/oidc-sveltekit-adapter` (todavía sin publicar).
+
+## Estado
+
+Etapas 1 y 2 terminadas: la API genérica (`createOidcProvider` y helpers, en `src/lib/oidc/`, sin
+SvelteKit) y `createOidcSvelteKitHandlers`, con la app de prueba (`src/routes/`) usando las dos, con
+unitarios y e2e contra el Keycloak de Docker. Quedan para después el diagnóstico del proveedor y la
+prueba con ADFS. El diseño
+completo (API, cookies, flujo) y el plan de trabajo están en
+[`docs/todos/oidc-sveltekit-adapter.md`](docs/todos/oidc-sveltekit-adapter.md).
+
+## Uso
+
+```bash
+pnpm add @opensas/oidc-sveltekit-adapter
+```
+
+Authorization Code Flow con PKCE, sobre `openid-client`. Dos formas de usarlo.
+
+### SvelteKit: `createOidcSvelteKitHandlers`
+
+El componente arma las rutas `<basePath>/login`, `/callback` y `/logout`, las cookies del login y
+los redirects. La app arma su sesión en `onLogin` y la borra en `onLogout`.
+
+```ts
+// src/lib/server/oidc.ts
+import { getUser } from '@opensas/oidc-sveltekit-adapter';
+import { createOidcSvelteKitHandlers } from '@opensas/oidc-sveltekit-adapter/sveltekit';
+
+import { AUTH_CLIENT_ID, AUTH_CLIENT_SECRET, AUTH_ISSUER } from '$env/static/private';
+
+export const oidc = createOidcSvelteKitHandlers({
+	issuer: AUTH_ISSUER, // el realm de Keycloak o https://<adfs>/adfs
+	clientId: AUTH_CLIENT_ID,
+	clientSecret: AUTH_CLIENT_SECRET, // sin él, client público (solo PKCE)
+	basePath: '/api/auth',
+	cookiePrefix: 'miapp',
+	sessionMaxAge: 8 * 3600,
+	onLogin: (tokens, { cookies }) => {
+		const user = getUser(tokens, { defaultDomain: 'ORGANIZACION' });
+		if (!user) return false; // sin usuario de red: 401
+		createSession(cookies, user); // la sesión es de la app
+	},
+	onLogout: ({ cookies }) => deleteSession(cookies),
+});
+```
+
+```ts
+// src/routes/api/auth/[...path]/+server.ts
+import { oidc } from '$lib/server/oidc';
+
+export const GET = oidc.handler;
+export const POST = oidc.handler;
+```
+
+```ts
+// src/hooks.server.ts: sin sesión, las navegaciones van al login (con returnTo)
+export const handle: Handle = ({ event, resolve }) => {
+	event.locals.user = getSession(event.cookies);
+	if (!event.locals.user) {
+		const login = oidc.loginRedirect(event);
+		if (login) redirect(303, login);
+	}
+	return resolve(event);
+};
+```
+
+El logout es un `POST` a `<basePath>/logout` (por ejemplo, un `<form method="POST">`).
+
+En el proveedor, el redirect URI del client es `<origin><basePath>/callback`
+(`http://localhost:5173/api/auth/callback`), y el post logout redirect URI, `<origin>/`.
+
+### Cualquier app Node: `createOidcProvider`
+
+Desde `@opensas/oidc-sveltekit-adapter`, sin SvelteKit (`@sveltejs/kit` es una peer dependency
+opcional: solo la pide `/sveltekit`). Los tres pasos del flujo, sin cookies ni redirects: los arma la app. Ejemplo completo en la app de
+prueba (`src/routes/api/auth/`).
+
+```ts
+const oidc = createOidcProvider({
+	issuer,
+	clientId,
+	clientSecret,
+	callbackPath: '/api/auth/callback',
+});
+
+// GET /login: guardar pendingLogin (cookie HttpOnly) y redirigir a providerUrl
+const { providerUrl, pendingLogin } = await oidc.buildLoginUrl(requestUrl);
+
+// GET /callback: valida state, PKCE y el id_token; lanza OidcError si falla
+const tokens = await oidc.exchangeCode(requestUrl, pendingLogin);
+const user = getUser(tokens);
+
+// POST /logout: redirigir al logout del proveedor (undefined si no lo publica)
+const logoutUrl = await oidc.buildLogoutUrl(idToken, 'https://miapp/');
+```
+
+Helpers: `getUser`, `getDomainUser`, `getPermissions`, `isSameOrigin`, `isNavigation`, `OidcError`
+(con `code`: `PROVIDER_ERROR`, `NO_LOGIN_IN_PROGRESS`, `STATE_MISMATCH`, `TOKEN_EXCHANGE`,
+`INVALID_ID_TOKEN`, `DISCOVERY`, `LOGIN_REJECTED`).
+
+El paso a paso del flujo, con los mensajes HTTP, está en la app de prueba: `pnpm dev` y
+`/como-funciona`.
+
+## Proveedores probados
+
+El flujo se probó en la prueba de concepto (`keycloak-poc`), con la misma app y cambiando solo el
+`.env`. El componente se va a probar contra los mismos proveedores:
+
+| Proveedor | Versión                                                       | Notas                                              |
+| --------- | ------------------------------------------------------------- | -------------------------------------------------- |
+| Keycloak  | 26.8.1                                                        | En Docker (`start-dev`) y en Windows Server 2022   |
+| ADFS      | AD FS 2019 (farm behavior level 4), sobre Windows Server 2022 | Client confidencial y público (PKCE), con Kerberos |
+
+## Estructura
+
+Dos capas:
+
+- `src/lib/oidc/`: la capa genérica, para cualquier app Node. Sobre `openid-client`; no importa
+  nada de SvelteKit (lo controla ESLint).
+- La capa SvelteKit: los handlers de `/api/auth/login`, `/callback` y `/logout`, y
+  `createOidcSvelteKitHandlers` (etapa 2).
+
+`src/routes/` es la app de prueba, contra Keycloak en Docker.
+
+## Desarrollo
+
+Requisitos: las versiones de `mise.toml` (Node, pnpm), Docker y `openssl` (para Keycloak). pnpm lo
+instala corepack según `packageManager` de `package.json`.
+
+```bash
+pnpm install
+cp .env.example .env    # trae activo el bloque del Keycloak de Docker
+pnpm keycloak:start
+pnpm dev                # la app de prueba, en http://localhost:5173
+```
+
+### Tareas de pnpm
+
+Todas las de `package.json`. **Al agregar, cambiar o borrar una, actualizar esta lista.**
+
+App de prueba:
+
+```bash
+pnpm dev                # vite dev; confía en el certificado de Keycloak (NODE_EXTRA_CA_CERTS)
+pnpm build              # vite build y después prepack
+pnpm preview            # sirve el build en el 4173, el que usan los e2e; mismo certificado que dev
+```
+
+Calidad:
+
+```bash
+pnpm verify             # ESLint con --fix, Prettier y svelte-check: correrlo antes de commitear
+pnpm lint               # solo ESLint, sin --fix
+pnpm format             # solo Prettier
+pnpm check              # solo svelte-check (check:watch, en modo watch)
+pnpm lint:clean         # borra las cachés de ESLint y Prettier
+```
+
+Tests. `pnpm test` usa el Keycloak de dev ya levantado (`pnpm keycloak:start`), como una base de
+fixture; `pnpm test:ci` levanta uno propio y lo borra al terminar:
+
+```bash
+pnpm test               # test:vite y test:play
+pnpm test:unit          # Vitest, solo los unitarios
+pnpm test:vite          # Vitest, todos los proyectos
+pnpm test:e2e           # Playwright, solo los e2e
+pnpm test:play          # Playwright, todos los proyectos
+pnpm test:ci            # como en GitLab: Keycloak desechable (puerto 3112), test:vite y test:play
+```
+
+Keycloak en Docker (`docker/keycloak/`, `https://localhost:3102`, realm `oidc-test`, admin
+`admin`/`admin`):
+
+```bash
+pnpm keycloak:start     # keycloak:cert y levanta el contenedor; importa el realm si no existe
+pnpm keycloak:stop      # lo frena, sin perder los datos
+pnpm keycloak:status    # estado y puertos del contenedor
+pnpm keycloak:logs      # los logs, en vivo
+pnpm keycloak:purge     # borra el contenedor y sus datos: el próximo start reimporta el realm
+pnpm keycloak:cert      # genera el certificado autofirmado, si no existe o vence en 30 días
+pnpm keycloak:init      # espera e importa el realm por la API de admin (el de CI; KEYCLOAK_URL)
+```
+
+Paquete y dependencias:
+
+```bash
+pnpm prepack            # arma dist/ y lo valida con publint
+pnpm up:safe            # dentro de los rangos, con 24 h de antigüedad mínima
+pnpm sv:sync-deps       # compara las mayores con las que trae hoy el scaffold de SvelteKit (sv)
+```
+
+VM de ADFS (`keycloak-poc`: `docs/adfs-paso-a-paso.md`):
+
+```bash
+pnpm vm:pack            # build de adapter-node con node_modules → build-vm/oidc-app.zip (.env.vm.example)
+```
+
+Runner de GitLab local (con `sudo`):
+
+```bash
+pnpm gitlab-runner:start
+pnpm gitlab-runner:stop
+pnpm gitlab-runner:status
+pnpm gitlab-runner:logs  # los logs del servicio, en vivo
+```
+
+`prepare` (`svelte-kit sync`) no se corre a mano: lo corre `pnpm install`.
+
+## Licencia
+
+[LGPL-3.0-or-later](COPYING.LESSER) (con el texto de la GPL-3.0 en [`COPYING`](COPYING)). Una app
+puede usar el paquete sin cambiar su licencia; los cambios al paquete se publican con la misma.
+
+## Versiones y commits
+
+SemVer. Commits y títulos de merge request en Conventional Commits, en español. `main` protegida:
+todo entra por merge request, con squash.

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export * from './oidc/domain-user.ts';
+export * from './oidc/errors.ts';
+export { isNavigation, isSameOrigin } from './oidc/request.ts';
+export * from './oidc/permissions.ts';
+export * from './oidc/provider.ts';
+export type { Claims } from './oidc/types.ts';
+export * from './oidc/user.ts';

package/dist/index.js

@@ -0,0 +1,10 @@
+// La API pública, para cualquier app Node: el provider (buildLoginUrl, exchangeCode,
+// buildLogoutUrl) y helpers; las cookies, la sesión y los redirects los arma la app. La capa
+// SvelteKit (createOidcSvelteKitHandlers) va aparte, en '<paquete>/sveltekit': así este punto de
+// entrada no importa @sveltejs/kit.
+export * from "./oidc/domain-user.js";
+export * from "./oidc/errors.js";
+export { isNavigation, isSameOrigin } from "./oidc/request.js";
+export * from "./oidc/permissions.js";
+export * from "./oidc/provider.js";
+export * from "./oidc/user.js";

package/dist/oidc/domain-user.d.ts

@@ -0,0 +1,7 @@
+import type { Claims } from './types.ts';
+export declare const DOMAIN_USER_CLAIMS: readonly ["unique_name", "upn", "preferred_username", "email"];
+export declare const DOMAIN_CLAIM = "dominio";
+export type DomainUserOptions = {
+    defaultDomain?: string;
+};
+export declare function getDomainUser(idTokenClaims: Claims, accessTokenClaims: Claims | undefined, options?: DomainUserOptions): string | undefined;

package/dist/oidc/domain-user.js

@@ -0,0 +1,35 @@
+// Dónde manda cada proveedor el usuario de red, en orden: gana el primero con contenido. ADFS (sin
+// reglas de claims): unique_name ('ORGANIZACION\user1') y upn; Keycloak: preferred_username (con
+// LDAP, el userPrincipalName del AD). Verificado en la POC (keycloak-poc).
+export const DOMAIN_USER_CLAIMS = ['unique_name', 'upn', 'preferred_username', 'email'];
+// Mapper del client en Keycloak: el dominio de Windows del usuario. Solo en el access token.
+export const DOMAIN_CLAIM = 'dominio';
+const DOMAIN_SEPARATOR = '\\';
+const UPN_SEPARATOR = '@';
+// El usuario de red, 'DOMINIO\usuario', o undefined si ningún claim lo trae. Por cada claim de
+// DOMAIN_USER_CLAIMS mira primero el id_token (validado) y después el access token. Si el valor ya
+// trae el dominio queda tal cual; si es 'usuario@dominio.algo' (o solo 'usuario'), arma
+// '<dominio>\usuario' con el claim dominio o, si no está, con defaultDomain (sin él, undefined).
+export function getDomainUser(idTokenClaims, accessTokenClaims, options = {}) {
+    const value = DOMAIN_USER_CLAIMS.flatMap((claim) => [
+        stringClaim(idTokenClaims, claim),
+        stringClaim(accessTokenClaims, claim),
+    ]).find(Boolean);
+    if (!value)
+        return undefined;
+    if (value.includes(DOMAIN_SEPARATOR))
+        return value;
+    const [user] = value.split(UPN_SEPARATOR);
+    if (!user)
+        return undefined;
+    const domain = stringClaim(accessTokenClaims, DOMAIN_CLAIM) ??
+        stringClaim(idTokenClaims, DOMAIN_CLAIM) ??
+        options.defaultDomain;
+    if (!domain)
+        return undefined;
+    return `${domain}${DOMAIN_SEPARATOR}${user}`;
+}
+function stringClaim(claims, name) {
+    const value = claims?.[name];
+    return typeof value === 'string' && value !== '' ? value : undefined;
+}

package/dist/oidc/errors.d.ts

@@ -0,0 +1,14 @@
+export declare const OIDC_ERROR_CODES: readonly ["PROVIDER_ERROR", "NO_LOGIN_IN_PROGRESS", "STATE_MISMATCH", "TOKEN_EXCHANGE", "INVALID_ID_TOKEN", "DISCOVERY", "LOGIN_REJECTED"];
+export type OidcErrorCode = (typeof OIDC_ERROR_CODES)[number];
+export type ProviderErrorDetails = {
+    providerError?: string;
+    providerErrorDescription?: string;
+};
+export declare class OidcError extends Error {
+    readonly code: OidcErrorCode;
+    readonly providerError?: string;
+    readonly providerErrorDescription?: string;
+    constructor(code: OidcErrorCode, message: string, details?: ProviderErrorDetails & {
+        cause?: unknown;
+    });
+}

package/dist/oidc/errors.js

@@ -0,0 +1,27 @@
+export const OIDC_ERROR_CODES = [
+    // El proveedor volvió con ?error= (el usuario canceló, client mal configurado)
+    'PROVIDER_ERROR',
+    // Sin <prefix>_login: vencida, o el callback abierto a mano
+    'NO_LOGIN_IN_PROGRESS',
+    'STATE_MISMATCH',
+    // Falló el canje del code
+    'TOKEN_EXCHANGE',
+    // Firma, iss, aud, exp o nonce del id_token
+    'INVALID_ID_TOKEN',
+    // El proveedor no responde
+    'DISCOVERY',
+    // El login salió bien, pero la app no lo aceptó (por ejemplo, sin usuario de red)
+    'LOGIN_REJECTED',
+];
+export class OidcError extends Error {
+    code;
+    providerError;
+    providerErrorDescription;
+    constructor(code, message, details = {}) {
+        super(message, { cause: details.cause });
+        this.name = 'OidcError';
+        this.code = code;
+        this.providerError = details.providerError;
+        this.providerErrorDescription = details.providerErrorDescription;
+    }
+}

package/dist/oidc/permissions.d.ts

@@ -0,0 +1,3 @@
+import type { Claims } from './types.ts';
+export type Permissions = Record<string, string[]>;
+export declare function getPermissions(accessTokenClaims: Claims | undefined, clientId: string): Permissions;

package/dist/oidc/permissions.js

@@ -0,0 +1,32 @@
+const ROLE_SEPARATOR = ':';
+// Los roles del client en Keycloak ('Recurso:accion', en resource_access.<clientId>.roles, la unión
+// de los de todos los grupos del usuario) como permisos. Solo vienen en el access token. Los roles
+// que no tienen la forma 'Recurso:accion' se ignoran. Sin roles (ADFS sin reglas), {}.
+//
+// ['Provincia:alta', 'Provincia:consulta', 'Dato:consulta']
+// → { Dato: ['consulta'], Provincia: ['alta', 'consulta'] }
+export function getPermissions(accessTokenClaims, clientId) {
+    const permissions = {};
+    for (const role of clientRoles(accessTokenClaims, clientId)) {
+        const [resource, action, ...rest] = role.split(ROLE_SEPARATOR);
+        if (!resource || !action || rest.length > 0)
+            continue;
+        (permissions[resource] ??= new Set()).add(action);
+    }
+    // El orden de los roles en el token no es estable: recursos y acciones ordenados
+    return Object.fromEntries(Object.keys(permissions)
+        .toSorted()
+        .map((resource) => [resource, [...permissions[resource]].toSorted()]));
+}
+function clientRoles(claims, clientId) {
+    const resourceAccess = claims?.resource_access;
+    if (!isRecord(resourceAccess))
+        return [];
+    const client = resourceAccess[clientId];
+    if (!isRecord(client) || !Array.isArray(client.roles))
+        return [];
+    return client.roles.filter((role) => typeof role === 'string');
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}

package/dist/oidc/provider.d.ts

@@ -0,0 +1,33 @@
+import type { Claims } from './types.ts';
+export declare const DEFAULT_SCOPE = "openid profile email";
+export declare const RETURN_TO_PARAM = "returnTo";
+export type OidcProviderOptions = {
+    issuer: string;
+    clientId: string;
+    clientSecret?: string;
+    callbackPath: string;
+    scope?: string;
+    allowInsecureRequests?: boolean;
+};
+export type PendingLogin = {
+    codeVerifier: string;
+    state: string;
+    nonce: string;
+    returnTo: string;
+};
+export type Tokens = {
+    idToken: string;
+    accessToken: string;
+    refreshToken?: string;
+    idTokenClaims: Claims;
+    accessTokenClaims?: Claims;
+};
+export type OidcProvider = {
+    buildLoginUrl(loginUrl: URL): Promise<{
+        providerUrl: URL;
+        pendingLogin: PendingLogin;
+    }>;
+    exchangeCode(callbackUrl: URL, pendingLogin: PendingLogin | undefined): Promise<Tokens>;
+    buildLogoutUrl(idToken: string | undefined, postLogoutRedirectUri: string): Promise<URL | undefined>;
+};
+export declare function createOidcProvider(options: OidcProviderOptions): OidcProvider;