@owlmeans/oidc 0.1.18-rc.45 → 0.1.18-rc.47
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +2 -2
- package/agent-meta/manifest.json +2 -2
- package/agent-meta/skills/oidc/SKILL.md +1 -1
- package/build/guard.d.ts.map +1 -1
- package/build/guard.js +12 -2
- package/build/guard.js.map +1 -1
- package/package.json +7 -7
- package/src/guard.ts +12 -3
- package/tests/guard.spec.d.ts +2 -0
- package/tests/guard.spec.d.ts.map +1 -0
- package/tests/guard.spec.js +32 -0
- package/tests/guard.spec.js.map +1 -0
- package/tests/guard.spec.ts +35 -0
- package/tsconfig.json +1 -0
package/README.md
CHANGED
|
@@ -12,7 +12,7 @@ Shared OIDC protocol abstractions — guard/gate aliases, models, and immutable
|
|
|
12
12
|
## Installation
|
|
13
13
|
|
|
14
14
|
```bash
|
|
15
|
-
bun add @owlmeans/oidc@^0.1.18-rc.
|
|
15
|
+
bun add @owlmeans/oidc@^0.1.18-rc.47
|
|
16
16
|
```
|
|
17
17
|
|
|
18
18
|
## Usage
|
|
@@ -95,7 +95,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
|
|
|
95
95
|
your project's skill store (`.agents/skills/`):
|
|
96
96
|
|
|
97
97
|
```sh
|
|
98
|
-
npx @owlmeans/agent-skills@^0.1.18-rc.
|
|
98
|
+
npx @owlmeans/agent-skills@^0.1.18-rc.40
|
|
99
99
|
```
|
|
100
100
|
|
|
101
101
|
The embedded files are version-matched to this package release. Do not edit them
|
package/agent-meta/manifest.json
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schemaVersion": 2,
|
|
3
3
|
"package": "@owlmeans/oidc",
|
|
4
|
-
"version": "0.1.18-rc.
|
|
5
|
-
"generatedAt": "2026-09-
|
|
4
|
+
"version": "0.1.18-rc.47",
|
|
5
|
+
"generatedAt": "2026-09-25T21:19:37.966Z",
|
|
6
6
|
"canonicalRepo": "https://github.com/owlmeans/common",
|
|
7
7
|
"entries": [
|
|
8
8
|
{
|
|
@@ -8,7 +8,7 @@ user-invocable: false
|
|
|
8
8
|
# @owlmeans/oidc
|
|
9
9
|
|
|
10
10
|
**Layer:** Core
|
|
11
|
-
**Install:** `"@owlmeans/oidc": "^0.1.18-rc.
|
|
11
|
+
**Install:** `"@owlmeans/oidc": "^0.1.18-rc.47"` in `dependencies`
|
|
12
12
|
|
|
13
13
|
The shared half of the OIDC stack: no transport, no library. It owns the names, the shapes and the
|
|
14
14
|
guard that the server relying party (`@owlmeans/server-oidc-rp`), the browser relying party
|
package/build/guard.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAsB,MAAM,YAAY,CAAA;AAGlG,OAAO,KAAK,EAAqC,cAAc,EAAgB,MAAM,sBAAsB,CAAA;AAQ3G,eAAO,MAAM,aAAa,UAAW,gBAAgB,KAAG,
|
|
1
|
+
{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAsB,MAAM,YAAY,CAAA;AAGlG,OAAO,KAAK,EAAqC,cAAc,EAAgB,MAAM,sBAAsB,CAAA;AAQ3G,eAAO,MAAM,aAAa,UAAW,gBAAgB,KAAG,SAqGvD,CAAA;AAED,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WAC3D,CAAC,SAAS,gBAAgB,MAKpC,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,GAAI,IAAI,SAAS,cAAc,QACjD,IAAI,aAAa,MAAM,GAAG,SAAS,MAAM,EAAE,KAChD,IAcF,CAAA"}
|
package/build/guard.js
CHANGED
|
@@ -47,9 +47,19 @@ export const makeOidcGuard = (opts) => {
|
|
|
47
47
|
return false;
|
|
48
48
|
}
|
|
49
49
|
const ctx = guard.assertCtx();
|
|
50
|
-
const envelope = makeEnvelopeModel(authorization, EnvelopeKind.Token);
|
|
51
50
|
const trusted = await trust(ctx, TRUSTED, ctx.cfg.alias ?? ctx.cfg.service);
|
|
52
|
-
|
|
51
|
+
// A token that cannot even be decoded is a credential this server does not accept — the
|
|
52
|
+
// same answer as one whose signature does not verify (401), never a server failure (500).
|
|
53
|
+
let envelope;
|
|
54
|
+
let verified = false;
|
|
55
|
+
try {
|
|
56
|
+
envelope = makeEnvelopeModel(authorization, EnvelopeKind.Token);
|
|
57
|
+
verified = await envelope.verify(trusted.key);
|
|
58
|
+
}
|
|
59
|
+
catch {
|
|
60
|
+
verified = false;
|
|
61
|
+
}
|
|
62
|
+
if (!verified) {
|
|
53
63
|
return false;
|
|
54
64
|
}
|
|
55
65
|
const token = extractAuthToken(req, OIDC_WRAPPED_TOKEN, false);
|
package/build/guard.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1E,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAE/E,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACnE,OAAO,EAAE,WAAW,EAAwB,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACtF,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAE9D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAuB,EAAa,EAAE;IAClE,2FAA2F;IAC3F,kFAAkF;IAClF,WAAW;IAEX,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,aAAa,CAAC,CAAA;IAEnG,MAAM,KAAK,GAAc,aAAa,CAAY,UAAU,EAAE;QAC5D,cAAc;QAEd,gBAAgB;QAChB,mDAAmD;QACnD,oCAAoC;QACpC,uBAAuB;QACvB,MAAM;QAEN,0DAA0D;QAC1D,6DAA6D;QAC7D,6BAA6B;QAC7B,oDAAoD;QACpD,sBAAsB;QACtB,KAAK;QAEL,aAAa,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACzB,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,CAAA;YAC7B,qDAAqD;YACrD,yEAAyE;YACzE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAe,IAAI,EAAE,YAAY,IAAI,OAAO,CAAC,CAAA;YACrE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;YAC3C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC/B,IAAI,IAAI,KAAK,kBAAkB,CAAC,WAAW,EAAE,EAAE,CAAC;oBAC9C,OAAO,KAAK,CAAA;gBACd,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;QAED,cAAc;QACd,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,CAAC,IAAI,IAAI;QAErE,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;YAC/D,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,CAAA;YAC7B,MAAM,
|
|
1
|
+
{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1E,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAE/E,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACnE,OAAO,EAAE,WAAW,EAAwB,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACtF,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAE9D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAuB,EAAa,EAAE;IAClE,2FAA2F;IAC3F,kFAAkF;IAClF,WAAW;IAEX,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,aAAa,CAAC,CAAA;IAEnG,MAAM,KAAK,GAAc,aAAa,CAAY,UAAU,EAAE;QAC5D,cAAc;QAEd,gBAAgB;QAChB,mDAAmD;QACnD,oCAAoC;QACpC,uBAAuB;QACvB,MAAM;QAEN,0DAA0D;QAC1D,6DAA6D;QAC7D,6BAA6B;QAC7B,oDAAoD;QACpD,sBAAsB;QACtB,KAAK;QAEL,aAAa,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACzB,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,CAAA;YAC7B,qDAAqD;YACrD,yEAAyE;YACzE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAe,IAAI,EAAE,YAAY,IAAI,OAAO,CAAC,CAAA;YACrE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;YAC3C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC/B,IAAI,IAAI,KAAK,kBAAkB,CAAC,WAAW,EAAE,EAAE,CAAC;oBAC9C,OAAO,KAAK,CAAA;gBACd,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;QAED,cAAc;QACd,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,CAAC,IAAI,IAAI;QAErE,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;YAC/D,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,CAAA;YAC7B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAE5F,wFAAwF;YACxF,0FAA0F;YAC1F,IAAI,QAAoD,CAAA;YACxD,IAAI,QAAQ,GAAG,KAAK,CAAA;YACpB,IAAI,CAAC;gBACH,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;gBACrE,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,GAAG,KAAK,CAAA;YAClB,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,CAAE,CAAA;YAE/D,IAAI,OAAO,GAAqB,IAAI,CAAA;YAEpC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,CAAA;YACtD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,kBAAkB,EAAE,CAAC;oBACpC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;oBAC7C,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,CAAA;gBACrD,CAAC;gBAED,MAAM,CAAC,CAAA;YACT,CAAC;YAED,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBAC5B,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC5C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;gBAErE,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;gBACxD,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,CAAA;gBAE9D,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;YACjC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,OAAO,CAAC,QAAS,CAAC,OAAO,EAAE,CAAC,CAAA;YAClC,CAAC;YAED,OAAO,IAAS,CAAA;QAClB,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,OAAU,EAAE,IAAuB,EACnC,EAAE;IACF,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;IAE5C,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,IAAU,EAAE,QAAqC,EAC3C,EAAE;IACR,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,aAAa,CAAC,CAAC,CAAA;IAC1F,MAAM,QAAQ,GAAG,CAAC,IAAoB,EAAkB,EAAE,CAAC,MAAM,CAAC,WAAW,CAC3E,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QACxC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QAC/D,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC1F,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACrB,CAAC;QAED,OAAO,CAAC,GAAG,EAAE,kBAAkB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;IACpF,CAAC,CAAC,CACH,CAAA;IAED,OAAO,QAAQ,CAAC,IAAI,CAAS,CAAA;AAC/B,CAAC,CAAA;AAED,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAsB,EAAE,CACvD,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;IAC9B,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;IAC/B,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE,CAAC,KAAK,EAAwB,CAAA"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@owlmeans/oidc",
|
|
3
|
-
"version": "0.1.18-rc.
|
|
3
|
+
"version": "0.1.18-rc.47",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"scripts": {
|
|
@@ -21,13 +21,13 @@
|
|
|
21
21
|
}
|
|
22
22
|
},
|
|
23
23
|
"dependencies": {
|
|
24
|
-
"@owlmeans/auth": "^0.1.18-rc.
|
|
25
|
-
"@owlmeans/auth-common": "^0.1.18-rc.
|
|
26
|
-
"@owlmeans/basic-envelope": "^0.1.18-rc.
|
|
27
|
-
"@owlmeans/config": "^0.1.18-rc.
|
|
24
|
+
"@owlmeans/auth": "^0.1.18-rc.36",
|
|
25
|
+
"@owlmeans/auth-common": "^0.1.18-rc.39",
|
|
26
|
+
"@owlmeans/basic-envelope": "^0.1.18-rc.38",
|
|
27
|
+
"@owlmeans/config": "^0.1.18-rc.38",
|
|
28
28
|
"@owlmeans/context": "^0.1.18-rc.32",
|
|
29
|
-
"@owlmeans/entrypoint": "^0.1.18-rc.
|
|
30
|
-
"@owlmeans/resource": "^0.1.18-rc.
|
|
29
|
+
"@owlmeans/entrypoint": "^0.1.18-rc.37",
|
|
30
|
+
"@owlmeans/resource": "^0.1.18-rc.36",
|
|
31
31
|
"@owlmeans/route": "^0.1.18-rc.33"
|
|
32
32
|
},
|
|
33
33
|
"peerDependencies": {
|
package/src/guard.ts
CHANGED
|
@@ -59,10 +59,19 @@ export const makeOidcGuard = (opts?: OidcGuardOptions): OidcGuard => {
|
|
|
59
59
|
}
|
|
60
60
|
|
|
61
61
|
const ctx = guard.assertCtx()
|
|
62
|
-
const envelope = makeEnvelopeModel<Auth>(authorization, EnvelopeKind.Token)
|
|
63
62
|
const trusted = await trust<Config, Context>(ctx, TRUSTED, ctx.cfg.alias ?? ctx.cfg.service)
|
|
64
63
|
|
|
65
|
-
|
|
64
|
+
// A token that cannot even be decoded is a credential this server does not accept — the
|
|
65
|
+
// same answer as one whose signature does not verify (401), never a server failure (500).
|
|
66
|
+
let envelope: ReturnType<typeof makeEnvelopeModel<Auth>>
|
|
67
|
+
let verified = false
|
|
68
|
+
try {
|
|
69
|
+
envelope = makeEnvelopeModel<Auth>(authorization, EnvelopeKind.Token)
|
|
70
|
+
verified = await envelope.verify(trusted.key)
|
|
71
|
+
} catch {
|
|
72
|
+
verified = false
|
|
73
|
+
}
|
|
74
|
+
if (!verified) {
|
|
66
75
|
return false as T
|
|
67
76
|
}
|
|
68
77
|
|
|
@@ -94,7 +103,7 @@ export const makeOidcGuard = (opts?: OidcGuardOptions): OidcGuard => {
|
|
|
94
103
|
|
|
95
104
|
res.resolve(envelope.message())
|
|
96
105
|
} else {
|
|
97
|
-
res.resolve(envelope
|
|
106
|
+
res.resolve(envelope!.message())
|
|
98
107
|
}
|
|
99
108
|
|
|
100
109
|
return true as T
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"guard.spec.d.ts","sourceRoot":"","sources":["guard.spec.ts"],"names":[],"mappings":""}
|
|
@@ -0,0 +1,32 @@
|
|
|
1
|
+
import { describe, expect, mock, test } from 'bun:test';
|
|
2
|
+
/**
|
|
3
|
+
* A bearer that cannot be decoded is a credential the server does not accept — the guard answers
|
|
4
|
+
* "not authenticated" (the API layer's 401), exactly as for a signature that does not verify, and
|
|
5
|
+
* never throws the decoder's own error (which the API layer answers with 500).
|
|
6
|
+
*/
|
|
7
|
+
mock.module('@owlmeans/auth-common/utils', () => ({
|
|
8
|
+
trust: async () => ({ key: { verify: async () => false } }),
|
|
9
|
+
extractAuthToken: (req, type, strip = true) => {
|
|
10
|
+
const header = req.headers.authorization;
|
|
11
|
+
if (header == null || !header.toUpperCase().startsWith(type.toUpperCase()))
|
|
12
|
+
return null;
|
|
13
|
+
return strip ? header.split(' ')[1] : header;
|
|
14
|
+
},
|
|
15
|
+
}));
|
|
16
|
+
const { makeOidcGuard } = await import('../src/guard.js');
|
|
17
|
+
const call = async (authorization) => {
|
|
18
|
+
const guard = makeOidcGuard();
|
|
19
|
+
guard.assertCtx = () => ({ cfg: { alias: 'app' } });
|
|
20
|
+
const res = { responseProvider: { header: () => undefined } };
|
|
21
|
+
return await guard.handle({ headers: { authorization } }, res);
|
|
22
|
+
};
|
|
23
|
+
describe('oidc guard', () => {
|
|
24
|
+
test('an undecodable wrapped token is unauthenticated, not a server error', async () => {
|
|
25
|
+
expect(await call('OIDC-WRAPPED-TOKEN bogus.token')).toBe(false);
|
|
26
|
+
});
|
|
27
|
+
test('garbage of every shape stays unauthenticated', async () => {
|
|
28
|
+
expect(await call('OIDC-WRAPPED-TOKEN %%%')).toBe(false);
|
|
29
|
+
expect(await call('OIDC-WRAPPED-TOKEN ')).toBe(false);
|
|
30
|
+
});
|
|
31
|
+
});
|
|
32
|
+
//# sourceMappingURL=guard.spec.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"guard.spec.js","sourceRoot":"","sources":["guard.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAEvD;;;;GAIG;AACH,IAAI,CAAC,MAAM,CAAC,6BAA6B,EAAE,GAAG,EAAE,CAAC,CAAC;IAChD,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;IAC3D,gBAAgB,EAAE,CAAC,GAAwC,EAAE,IAAY,EAAE,KAAK,GAAG,IAAI,EAAE,EAAE;QACzF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAA;QACxC,IAAI,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,IAAI,CAAA;QACvF,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;IAC9C,CAAC;CACF,CAAC,CAAC,CAAA;AAEH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAA;AAEzD,MAAM,IAAI,GAAG,KAAK,EAAE,aAAqB,EAAE,EAAE;IAC3C,MAAM,KAAK,GAAG,aAAa,EAAS,CAAA;IACpC,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;IACnD,MAAM,GAAG,GAAG,EAAE,gBAAgB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,EAAE,CAAA;IAC7D,OAAO,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;AAChE,CAAC,CAAA;AAED,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,IAAI,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,CAAC,MAAM,IAAI,CAAC,gCAAgC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,CAAC,MAAM,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACxD,MAAM,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}
|
|
@@ -0,0 +1,35 @@
|
|
|
1
|
+
import { describe, expect, mock, test } from 'bun:test'
|
|
2
|
+
|
|
3
|
+
/**
|
|
4
|
+
* A bearer that cannot be decoded is a credential the server does not accept — the guard answers
|
|
5
|
+
* "not authenticated" (the API layer's 401), exactly as for a signature that does not verify, and
|
|
6
|
+
* never throws the decoder's own error (which the API layer answers with 500).
|
|
7
|
+
*/
|
|
8
|
+
mock.module('@owlmeans/auth-common/utils', () => ({
|
|
9
|
+
trust: async () => ({ key: { verify: async () => false } }),
|
|
10
|
+
extractAuthToken: (req: { headers: Record<string, string> }, type: string, strip = true) => {
|
|
11
|
+
const header = req.headers.authorization
|
|
12
|
+
if (header == null || !header.toUpperCase().startsWith(type.toUpperCase())) return null
|
|
13
|
+
return strip ? header.split(' ')[1] : header
|
|
14
|
+
},
|
|
15
|
+
}))
|
|
16
|
+
|
|
17
|
+
const { makeOidcGuard } = await import('../src/guard.js')
|
|
18
|
+
|
|
19
|
+
const call = async (authorization: string) => {
|
|
20
|
+
const guard = makeOidcGuard() as any
|
|
21
|
+
guard.assertCtx = () => ({ cfg: { alias: 'app' } })
|
|
22
|
+
const res = { responseProvider: { header: () => undefined } }
|
|
23
|
+
return await guard.handle({ headers: { authorization } }, res)
|
|
24
|
+
}
|
|
25
|
+
|
|
26
|
+
describe('oidc guard', () => {
|
|
27
|
+
test('an undecodable wrapped token is unauthenticated, not a server error', async () => {
|
|
28
|
+
expect(await call('OIDC-WRAPPED-TOKEN bogus.token')).toBe(false)
|
|
29
|
+
})
|
|
30
|
+
|
|
31
|
+
test('garbage of every shape stays unauthenticated', async () => {
|
|
32
|
+
expect(await call('OIDC-WRAPPED-TOKEN %%%')).toBe(false)
|
|
33
|
+
expect(await call('OIDC-WRAPPED-TOKEN ')).toBe(false)
|
|
34
|
+
})
|
|
35
|
+
})
|