@owlmeans/mui-oidc-rp 0.1.3

package/build/service.js

@@ -0,0 +1,123 @@
+import { assertContext, createService, HOME } from '@owlmeans/context';
+import { DEFAULT_ALIAS } from './consts.js';
+import { UserManager } from 'oidc-client-ts';
+import { DEFAULT_ALIAS as FLOW_SERVICE } from '@owlmeans/client-flow';
+import { FlowStepMissconfigured, OidcAuthStep, STD_OIDC_FLOW, UnknownFlow } from '@owlmeans/flow';
+import { DISPATCHER_OIDC, DISPATCHER_OIDC_INIT, OIDC_CODE_QUERY } from '@owlmeans/oidc';
+import { AUTH_RESOURCE, USER_ID } from '@owlmeans/client-auth';
+import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope';
+export const makeOidcAuthService = (alias = DEFAULT_ALIAS) => {
+    const store = (context) => context.auth().store();
+    const storeKey = '_oidc-client-interaction';
+    const service = createService(alias, {
+        /**
+         * This method performs when the IdP returns authentication params.
+         */
+        dispatch: async (params) => {
+            /**
+             * 1. Check if there are parameters in the URL for the server side OIDC authentication (e.g. code)
+             * 2. Send paramters to finalize authentication (proxy request to the auth server?)
+             * 3. If the authentication successful set user state using authentication service
+             */
+            if (params[OIDC_CODE_QUERY] == null) {
+                return false;
+            }
+            const ctx = service.assertCtx();
+            params.authUrl = (await store(ctx).get(storeKey)).authUrl;
+            const [authToken] = await ctx.module(DISPATCHER_OIDC)
+                .call({ body: params });
+            if (authToken.token != null && authToken.token !== '') {
+                const authResource = ctx.resource(AUTH_RESOURCE);
+                await authResource.save({ id: USER_ID, token: authToken.token });
+                const [, authorization] = authToken.token.split(' ');
+                const envelope = makeEnvelopeModel(authorization, EnvelopeKind.Token);
+                ctx.auth().auth = envelope.message();
+                ctx.auth().token = authToken.token;
+                return true;
+            }
+            return false;
+        },
+        authenticate: async (flow, params) => {
+            /**
+             * 1. Kick of OIDC authentication if we receive some hints about who or for what organization we'd like to authenticate
+             * 2. Request OIDC authentication params from the server using these entity and profile id
+             * 3. The server should return an URL to redirect user to
+             * 4. Return this user to the component for the further processing (redirection)
+             */
+            const state = flow.state();
+            if (state.flow !== STD_OIDC_FLOW || state.step !== OidcAuthStep.Ephemeral) {
+                return null;
+            }
+            if (params.entity == null && state.entityId == null) {
+                return null;
+            }
+            params.entity ??= state.entityId;
+            const ctx = service.assertCtx();
+            let [redirectTo] = await ctx.module(DISPATCHER_OIDC_INIT)
+                .call({ body: params });
+            if (flow.payload().simplified === 'true') {
+                redirectTo += '&simplified=true';
+            }
+            const context = service.assertCtx();
+            await store(context).save({ id: storeKey, authUrl: redirectTo });
+            return redirectTo;
+        },
+        proceedToRedirectUrl: async (extras) => {
+            const context = assertContext(service.ctx);
+            const flow = context.service(FLOW_SERVICE);
+            const flowModel = await flow.state();
+            if (flowModel == null) {
+                throw new UnknownFlow('oidc.dispatch');
+            }
+            const authorityTransition = flowModel.next();
+            flowModel.transit(authorityTransition.transition, true, {
+                purpose: extras.purpose,
+                simplified: extras.simplified,
+            });
+            // @TODO I'm not sure that this dirty hack is a correct approach
+            if (extras.alias === HOME) {
+                const redirectTransition = flowModel.next();
+                flowModel.transit(redirectTransition.transition, true, {
+                    purpose: extras.purpose,
+                    simplified: extras.simplified
+                });
+            }
+            const redirectUrl = await flow.proceed({ params: { uid: extras.uid } }, true);
+            return redirectUrl;
+        },
+        /**
+         * This is client-side only OIDC implementation. It's under constructuion.
+         * We stoped on the try to redirect to OIDC provider, but it requires browser integrated
+         * cryptography under ssl/tls.
+         * @TODO Finish client-side only implementation one day
+         */
+        dispatchClientOnly: async () => {
+            const context = assertContext(service.ctx);
+            const flow = context.service(FLOW_SERVICE);
+            const flowModel = await flow.state();
+            if (flowModel == null) {
+                throw new UnknownFlow('oidc.dispatch');
+            }
+            const authorityTransition = flowModel.next();
+            flowModel.transit(authorityTransition.transition, true);
+            const authorityStep = flowModel.step();
+            if (authorityStep.module == null) {
+                throw new FlowStepMissconfigured(authorityStep.step);
+            }
+            const [authorityUrl] = await context.module(authorityStep.module).call();
+            const redirectTransition = flowModel.next();
+            flowModel.transit(redirectTransition.transition, true);
+            const redirectUrl = await flow.proceed(undefined, true);
+            // @TODO To proceed we need to provide client_id some way
+            const manager = new UserManager({
+                // client_id: context.cfg.oidc.consumer?.clientId ?? '',
+                client_id: '',
+                redirect_uri: redirectUrl,
+                authority: authorityUrl,
+            });
+            await manager.signinRedirect({ state: flowModel.serialize() });
+        }
+    });
+    return service;
+};
+//# sourceMappingURL=service.js.map

package/build/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,aAAa,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACrE,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAEjG,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAEvF,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAA;AAE9D,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE1E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,QAAgB,aAAa,EAAmB,EAAE;IACpF,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,EAAmB,CAAA;IAC3E,MAAM,QAAQ,GAAG,0BAA0B,CAAA;IAE3C,MAAM,OAAO,GAAoB,aAAa,CAAkB,KAAK,EAAE;QACrE;;WAEG;QACH,QAAQ,EAAE,KAAK,EAAC,MAAM,EAAC,EAAE;YACvB;;;;eAIG;YACH,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,IAAI,EAAE,CAAC;gBACpC,OAAO,KAAK,CAAA;YACd,CAAC;YAED,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YAEhD,MAAM,CAAC,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAA;YAEzD,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,GAAG,CAAC,MAAM,CAAoB,eAAe,CAAC;iBACrE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;YAEzB,IAAI,SAAS,CAAC,KAAK,IAAI,IAAI,IAAI,SAAS,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;gBACtD,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAqB,aAAa,CAAC,CAAA;gBACpE,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAA;gBAEhE,MAAM,CAAC,EAAE,aAAa,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBACpD,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;gBAE3E,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;gBACpC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,CAAA;gBAElC,OAAO,IAAI,CAAA;YACb,CAAC;YAED,OAAO,KAAK,CAAA;QACd,CAAC;QAED,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;YACnC;;;;;eAKG;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAA;YAC1B,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,SAAS,EAAE,CAAC;gBAC1E,OAAO,IAAI,CAAA;YACb,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;gBACpD,OAAO,IAAI,CAAA;YACb,CAAC;YACD,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,QAAS,CAAA;YAEjC,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YAEhD,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,MAAM,CAAiB,oBAAoB,CAAC;iBACtE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;YAEzB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;gBACzC,UAAU,IAAI,kBAAkB,CAAA;YAClC,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YACpD,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAA;YAEhE,OAAO,UAAU,CAAA;QACnB,CAAC;QAED,oBAAoB,EAAE,KAAK,EAAC,MAAM,EAAC,EAAE;YACnC,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,CAAC,CAAA;YAEtE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAc,YAAY,CAAC,CAAA;YACvD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;YACpC,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,WAAW,CAAC,eAAe,CAAC,CAAA;YACxC,CAAC;YAED,MAAM,mBAAmB,GAAG,SAAS,CAAC,IAAI,EAAE,CAAA;YAC5C,SAAS,CAAC,OAAO,CAAC,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE;gBACtD,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC,CAAA;YAEF,gEAAgE;YAChE,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,kBAAkB,GAAG,SAAS,CAAC,IAAI,EAAE,CAAA;gBAC3C,SAAS,CAAC,OAAO,CAAC,kBAAkB,CAAC,UAAU,EAAE,IAAI,EAAE;oBACrD,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;YAE7E,OAAO,WAAW,CAAA;QACpB,CAAC;QAED;;;;;WAKG;QACH,kBAAkB,EAAE,KAAK,IAAI,EAAE;YAC7B,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,CAAC,CAAA;YAEtE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAc,YAAY,CAAC,CAAA;YAEvD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;YACpC,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,WAAW,CAAC,eAAe,CAAC,CAAA;YACxC,CAAC;YAED,MAAM,mBAAmB,GAAG,SAAS,CAAC,IAAI,EAAE,CAAA;YAC5C,SAAS,CAAC,OAAO,CAAC,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;YACvD,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,EAAE,CAAA;YACtC,IAAI,aAAa,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBACjC,MAAM,IAAI,sBAAsB,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;YACtD,CAAC;YACD,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAS,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAU,CAAA;YAExF,MAAM,kBAAkB,GAAG,SAAS,CAAC,IAAI,EAAE,CAAA;YAC3C,SAAS,CAAC,OAAO,CAAC,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;YAEtD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;YAEvD,yDAAyD;YACzD,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC;gBAC9B,wDAAwD;gBACxD,SAAS,EAAE,EAAE;gBACb,YAAY,EAAE,WAAW;gBACzB,SAAS,EAAE,YAAY;aACxB,CAAC,CAAA;YAEF,MAAM,OAAO,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;QAChE,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/types.d.ts

@@ -0,0 +1,31 @@
+import type { InitializedService } from '@owlmeans/context';
+import type { AppConfig, AppContext } from '@owlmeans/web-client';
+import type { OIDCAuthInitParams, WithSharedConfig } from '@owlmeans/oidc';
+import type { OidcAuthPurposes } from './consts.js';
+import type { FlowModel, FlowPayload } from '@owlmeans/flow';
+import type { ResourceRecord } from '@owlmeans/resource';
+import type { AuthToken } from '@owlmeans/auth';
+export interface OidcAuthService extends InitializedService {
+    dispatch: (params: Record<string, string>) => Promise<boolean>;
+    authenticate: (flow: FlowModel, params: OIDCAuthInitParams) => Promise<string | null>;
+    proceedToRedirectUrl: (extras: OidcAuthRedirectExtras) => Promise<string>;
+    dispatchClientOnly: () => Promise<void>;
+}
+export interface OidcAuthRedirectExtras extends FlowPayload {
+    purpose: OidcAuthPurposes;
+    simplified?: string;
+    uid?: string;
+    alias?: string;
+}
+export interface OidcPostAuthPayload extends FlowPayload, AuthToken {
+    purpose: OidcAuthPurposes;
+    simplified?: string;
+}
+export interface Config extends AppConfig, WithSharedConfig {
+}
+export interface Context<C extends Config = Config> extends AppContext<C> {
+}
+export interface OidcInteraction extends ResourceRecord {
+    authUrl: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C,MAAM,WAAW,eAAgB,SAAQ,kBAAkB;IACzD,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAE9D,YAAY,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAGrF,oBAAoB,EAAE,CAAC,MAAM,EAAE,sBAAsB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IAGzE,kBAAkB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CACxC;AAED,MAAM,WAAW,sBAAuB,SAAQ,WAAW;IACzD,OAAO,EAAE,gBAAgB,CAAA;IACzB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,mBAAoB,SAAQ,WAAW,EAAG,SAAS;IAClE,OAAO,EAAE,gBAAgB,CAAA;IACzB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,MAAO,SAAQ,SAAS,EAAE,gBAAgB;CAAI;AAE/D,MAAM,WAAW,OAAO,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,CAAE,SAAQ,UAAU,CAAC,CAAC,CAAC;CAAI;AAE7E,MAAM,WAAW,eAAgB,SAAQ,cAAc;IACrD,OAAO,EAAE,MAAM,CAAA;CAChB"}

package/build/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,64 @@
+{
+  "name": "@owlmeans/mui-oidc-rp",
+  "version": "0.1.3",
+  "license": "MIT",
+  "type": "module",
+  "scripts": {
+    "build": "tsc -b",
+    "dev": "sleep 378 && nodemon -e ts,tsx,json --watch src --exec \"tsc -p ./tsconfig.json\"",
+    "watch": "tsc -b -w --preserveWatchOutput --pretty",
+    "test": "bun test ./tests"
+  },
+  "main": "build/index.js",
+  "module": "build/index.js",
+  "types": "build/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./build/index.js",
+      "require": "./build/index.js",
+      "default": "./build/index.js",
+      "module": "./build/index.js",
+      "types": "./build/index.d.ts"
+    },
+    "./auth/plugins": {
+      "import": "./build/auth/plugins/index.js",
+      "require": "./build/auth/plugins/index.js",
+      "default": "./build/auth/plugins/index.js",
+      "module": "./build/auth/plugins/index.js",
+      "types": "./build/auth/plugins/index.d.ts"
+    }
+  },
+  "dependencies": {
+    "@owlmeans/auth": "^0.1.3",
+    "@owlmeans/basic-envelope": "^0.1.3",
+    "@owlmeans/client": "^0.1.3",
+    "@owlmeans/client-auth": "^0.1.3",
+    "@owlmeans/client-flow": "^0.1.3",
+    "@owlmeans/client-i18n": "^0.1.3",
+    "@owlmeans/context": "^0.1.3",
+    "@owlmeans/flow": "^0.1.3",
+    "@owlmeans/entrypoint": "^0.1.3",
+    "@owlmeans/oidc": "^0.1.3",
+    "@owlmeans/resource": "^0.1.3",
+    "@owlmeans/web-client": "^0.1.3",
+    "@owlmeans/web-flow": "^0.1.3",
+    "oidc-client-ts": "3.5.0"
+  },
+  "peerDependencies": {
+    "@mui/material": "^7.*",
+    "react": "*",
+    "react-router": "^7.*"
+  },
+  "devDependencies": {
+    "@owlmeans/dep-config": "workspace:*",
+    "@owlmeans/test-auth": "^0.1.2",
+    "@types/bun": "^1.3.0",
+    "@types/react": "^19.2.7",
+    "nodemon": "^3.1.11",
+    "npm-check": "^6.0.1",
+    "typescript": "^6.0.2"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/auth/plugins/google-client.tsx

@@ -0,0 +1,94 @@
+
+import type { AuthenticationPlugin } from '@owlmeans/client-auth/manager/plugins'
+import { AuthenticationStage, CAUTHEN_AUTHEN_TYPED } from '@owlmeans/auth'
+import type { AuthCredentials } from '@owlmeans/auth'
+import { DEFAULT_ALIAS as AUTH_SERVICE } from '@owlmeans/client-auth'
+import type { AuthService } from '@owlmeans/auth-common'
+import { GOOGLE_CLIENT_AUTH } from '@owlmeans/oidc'
+import { useContext, useValue } from '@owlmeans/client'
+import { HOME } from '@owlmeans/web-client'
+import type { Module } from '@owlmeans/web-client'
+import LinearProgress from '@mui/material/LinearProgress'
+import { extractGoogleUrl, buildCallbackCredentials } from './helpers.js'
+
+export const googleClientPlugin: AuthenticationPlugin = {
+  type: GOOGLE_CLIENT_AUTH,
+
+  Implementation: Renderer => ({ type, stage, control }) => {
+    const context = useContext()
+    Renderer = Renderer ?? googleClientPlugin.Renderer
+
+    useValue(async cancel => {
+      switch (control.stage) {
+        case AuthenticationStage.Init: {
+          const hasState = await control.hasPersistentState()
+          if (cancel?.current) return
+
+          // Returning from Google redirect — restore state and authenticate
+          if (hasState) {
+            await control.restore()
+            await control.cleanUpState()
+
+            const url = new URL(window.location.href)
+            const code = url.searchParams.get('code')
+
+            if (code != null) {
+              const auth: AuthCredentials = buildCallbackCredentials(
+                url.searchParams.toString(),
+                type,
+                control.allowance?.challenge ?? '',
+              )
+
+              const token = await control.authenticate(auth)
+
+              if (token.token !== '') {
+                const authService = context.service<AuthService>(AUTH_SERVICE)
+                await authService.authenticate(token)
+              }
+
+              // Navigate to app root after successful authentication
+              const [homeUrl] = await context.module<Module<string>>(HOME).call({ full: true }) ?? []
+              window.location.href = homeUrl ?? window.location.origin
+
+              return
+            }
+          }
+
+          // Initial request — ask server for Google auth URL
+          const [source] = await context.module<Module<string>>(CAUTHEN_AUTHEN_TYPED).call({
+            full: true, params: { type }
+          }) ?? []
+          await control.requestAllowence({ type, source: source ?? '' })
+          break
+        }
+
+        case AuthenticationStage.Authenticate: {
+          if (cancel?.current) return
+
+          if (control.allowance?.challenge != null) {
+            // The server wraps challenge as "source:googleUrl" — extract the URL part
+            const [source] = await context.module<Module<string>>(CAUTHEN_AUTHEN_TYPED).call({
+              full: true, params: { type }
+            }) ?? []
+            const url = extractGoogleUrl(control.allowance.challenge, source ?? '')
+
+            // Persist control state before redirect
+            await control.persist()
+
+            // Redirect to Google
+            document.location.href = url
+          }
+          break
+        }
+      }
+    }, [type, stage])
+
+    if (Renderer == null) {
+      throw new SyntaxError('Renderer is not defined for Google plugin')
+    }
+
+    return <Renderer type={type} stage={stage} control={control} params={{}} />
+  },
+
+  Renderer: () => <LinearProgress />
+}

package/src/auth/plugins/helpers.ts

@@ -0,0 +1,39 @@
+/**
+ * Pure helpers extracted from the Google client plugin for unit-testability.
+ * These perform the URL/challenge processing logic that doesn't depend on React.
+ */
+
+import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
+import { AUTH_SCOPE, AuthRole } from '@owlmeans/auth'
+import type { AuthCredentials } from '@owlmeans/auth'
+
+/**
+ * Extract the Google auth URL from a signed challenge envelope message.
+ * The server wraps the challenge as "source:googleUrl" — this strips the source prefix.
+ * Also handles raw Google URLs (rolling deployment compatibility).
+ */
+export const extractGoogleUrl = (envelopeChallenge: string, sourcePrefix: string): string => {
+  const envelope = makeEnvelopeModel(envelopeChallenge, EnvelopeKind.Wrap)
+  const msg = envelope.message<string>(true)
+
+  if (msg.startsWith(sourcePrefix + ':')) {
+    return msg.slice(sourcePrefix.length + 1)
+  }
+  return msg
+}
+
+/**
+ * Build AuthCredentials from the Google callback URL query params.
+ */
+export const buildCallbackCredentials = (
+  queryString: string,
+  type: string,
+  challenge: string,
+): AuthCredentials => ({
+  type,
+  challenge,
+  credential: queryString,
+  role: AuthRole.User,
+  userId: 'code',
+  scopes: [AUTH_SCOPE],
+})

package/src/auth/plugins/index.ts

@@ -0,0 +1,10 @@
+
+import { plugins as authPlugins } from '@owlmeans/client-auth/manager'
+import { OIDC_CLIENT_AUTH, GOOGLE_CLIENT_AUTH } from '@owlmeans/oidc'
+import { oidcClientPlugin } from './oidc-client.js'
+import { googleClientPlugin } from './google-client.js'
+
+authPlugins[OIDC_CLIENT_AUTH] = oidcClientPlugin
+authPlugins[GOOGLE_CLIENT_AUTH] = googleClientPlugin
+
+export const plugins = authPlugins

package/src/auth/plugins/oidc-client.tsx

@@ -0,0 +1,118 @@
+
+import type { AuthenticationPlugin } from '@owlmeans/client-auth/manager/plugins'
+import { AUTH_SCOPE, AuthenticationStage, AuthManagerError, AuthRole } from '@owlmeans/auth'
+import type { AuthCredentials } from '@owlmeans/auth'
+import { OIDC_CLIENT_AUTH } from '@owlmeans/oidc'
+import { useEffect } from 'react'
+import LinearProgress from '@mui/material/LinearProgress'
+import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
+import type { Config, Context, OidcAuthService } from '../../types.js'
+import { useContext } from '@owlmeans/web-client'
+import { DEFAULT_ALIAS, OidcAuthPurposes } from '../../consts.js'
+import { OidcAuthStep, OidpAuthStep, UnknownFlowStep } from '@owlmeans/flow'
+import { useModule } from '@owlmeans/client'
+
+export const oidcClientPlugin: AuthenticationPlugin = {
+  type: OIDC_CLIENT_AUTH,
+
+  Implementation: Renderer => ({ type, stage, control }) => {
+    const context = useContext<Config, Context>()
+    Renderer = Renderer ?? oidcClientPlugin.Renderer
+    const module = useModule()
+
+    useEffect(() => {
+      let canceled = false
+
+      // @TODO extract somewhere else and make it more consequential
+      // This way it looks too messy
+      switch (control.stage) {
+        case AuthenticationStage.Init:
+          control.hasPersistentState().then(async hasState => {
+            if (canceled) {
+              return
+            }
+            // 3. Properly process additional paramters on sequential rendering to restore control state
+            if (hasState) {
+              await control.restore()
+              await control.cleanUpState()
+              const flow = await control.flow()
+              if (flow != null) {
+                const state = await flow.state()
+                if ([OidcAuthStep.PostAuthen, OidpAuthStep.PostAuth].includes(state?.step().step as OidcAuthStep)) {
+                  const url = new URL(window.location.href)
+
+                  const auth: AuthCredentials = {
+                    ...control.allowance,
+                    type,
+                    challenge: control.allowance?.challenge ?? '',
+                    credential: url.searchParams.toString(),
+                    role: AuthRole.User,
+                    userId: 'code',
+                    scopes: [AUTH_SCOPE]
+                  }
+
+                  const tokenized = await control.authenticate(auth)
+                  // @TODO Introduce some standard further flow in case this plugin/component 
+                  // is used without a callback
+                  if (tokenized.token !== '') {
+                    throw new AuthManagerError('callback')
+                  }
+                  return // @TODO Will it work here?
+                }
+              }
+              // return
+            }
+
+            // 1. Initialize OIDC server side authentication
+            const oidc = context.service<OidcAuthService>(DEFAULT_ALIAS)
+
+            // @TODO we need to provide an identity provider client as entityId here for flexibel usage
+            const flow = await control.flow()
+            const state = await flow?.state()
+            const _source = await oidc.proceedToRedirectUrl({
+              purpose: control.source as OidcAuthPurposes ?? OidcAuthPurposes.Unknown,
+              simplified: state?.payload().simplified as string,
+              uid: 'uid' in module.params ? `${module.params.uid}` : undefined,
+              alias: module.alias
+            })
+            const source = new URL(_source)
+            source.search = ''
+            await control.requestAllowence({ type, source: source.toString() })
+          })
+        case AuthenticationStage.Authenticate:
+          control.flow().then(async flow => {
+            if (canceled) {
+              return
+            }
+            const flowState = await flow?.state()
+            if (flowState == null) {
+              throw new UnknownFlowStep(AuthenticationStage.Authenticate)
+            }
+
+            if (control.allowance?.challenge != null) {
+              const envelope = makeEnvelopeModel(control.allowance?.challenge, EnvelopeKind.Wrap)
+              const challenge = envelope.message<string>(true)
+              const parts = challenge.split(':http')
+              // This thing includes url with flow state so the OIDC redirect it back a correct way
+              const url = 'http' + parts[1]
+
+              // 2. Include additional parameters (control state with allowance to flow state)
+              await control.persist()
+
+              document.location.href = url
+            }
+          })
+      }
+
+      return () => { canceled = true }
+    }, [type, stage])
+
+    if (Renderer == null) {
+      throw new SyntaxError('Renderer is not defined for OIDC plugin')
+    }
+
+    return <Renderer type={type} stage={stage} control={control} params={module.params} />
+  },
+
+  Renderer: () => <LinearProgress />
+}

package/src/components/dispatcher.tsx

@@ -0,0 +1,61 @@
+
+import { DispatcherHOC } from '@owlmeans/client-auth'
+import { useSearchParams } from 'react-router'
+import { useEffect } from 'react'
+import { useContext } from '@owlmeans/web-client'
+import { useI18nLib } from '@owlmeans/client-i18n'
+import { AUTH_QUERY } from '@owlmeans/auth'
+import { useFlow } from '@owlmeans/web-flow'
+import { OidcAuthService } from '../types.js'
+import { DEFAULT_ALIAS } from '../consts.js'
+
+export const Dispatcher = DispatcherHOC(({ provideToken, navigate }) => {
+  const [query] = useSearchParams()
+  const context = useContext()
+  const client = useFlow()
+
+  const t = useI18nLib('auth', 'dispatcher')
+
+  useEffect(() => {
+    if (client == null) {
+      return
+    }
+    const token = query.get(AUTH_QUERY)
+    const params: Record<string, string> = {}
+    query.forEach((value, key) => {
+      if (key !== AUTH_QUERY) {
+        params[key] = value
+      }
+    })
+
+    if (token != null) {
+      // This is required for compatibility with a standard OwlMeans Auth flow.
+      provideToken({ token }, params)
+    } else {
+      const oidc = context.service<OidcAuthService>(DEFAULT_ALIAS)
+      oidc.dispatch(params).then(async dispatched => {
+        if (dispatched) {
+          return await navigate()
+        }
+        if (client == null) {
+          return
+        }
+        const redirect = await oidc.authenticate(client.flow(), params)
+        if (redirect != null && redirect !== '') {
+          document.location.href = redirect
+          return
+        }
+        const authzToken = await context.auth().authenticated()
+        if (authzToken == null) {
+          provideToken({ token: '' }, undefined)
+        } else {
+          await navigate()
+        }
+      })
+    }
+  }, [client])
+
+  return query.has(AUTH_QUERY)
+    ? <div>{t('loading')}</div>
+    : undefined
+})

package/src/components/index.ts

@@ -0,0 +1,2 @@
+
+export * from './dispatcher.js'

package/src/consts.ts

@@ -0,0 +1,8 @@
+
+export const DEFAULT_ALIAS = 'oidc-rp'
+
+export enum OidcAuthPurposes {
+  Unknown = 'unknown',
+  Subscribe = 'subscribe',
+  Login = 'login'
+}

package/src/guard.ts

@@ -0,0 +1,34 @@
+import { DISPATCHER } from '@owlmeans/auth'
+import { handler } from '@owlmeans/client'
+import type { CommonEntrypoint } from '@owlmeans/entrypoint'
+import type { OidcGuardOptions } from '@owlmeans/oidc'
+import {
+  appendOidcGuard as appendBasicOidcGuard,
+  DISPATCHER_OIDC, DISPATCHER_OIDC_INIT,
+  setupOidcGuard as setupBasicOidcGuard
+} from '@owlmeans/oidc'
+import type { ParametrisedProps } from '@owlmeans/web-client'
+import { elevate, parametriseDispatcher } from '@owlmeans/web-client'
+import { Dispatcher } from './components/dispatcher.js'
+import { makeOidcAuthService } from './service.js'
+import type { Config, Context } from './types.js'
+
+export const appendOidcGuard = <C extends Config, T extends Context<C>>(
+  context: T, opts?: OidcGuardOptions
+) => {
+  context.registerService(makeOidcAuthService())
+
+  const ctx = appendBasicOidcGuard<C, T>(context, opts)
+
+  return ctx
+}
+
+export const setupOidcGuard = (modules: CommonEntrypoint[], coguards?: string | string[], extras?: Partial<ParametrisedProps>) => {
+  const DispatcherCom = extras ? parametriseDispatcher(extras, Dispatcher) : Dispatcher
+
+  setupBasicOidcGuard(modules, coguards)
+
+  elevate(modules, DISPATCHER_OIDC_INIT)
+  elevate(modules, DISPATCHER_OIDC)
+  elevate(modules, DISPATCHER, handler(DispatcherCom), { force: true })
+}

package/src/index.ts

@@ -0,0 +1,6 @@
+
+export type * from './types.js'
+export * from './consts.js'
+export * from './service.js'
+export * from './guard.js'
+export * from './components/index.js'