@owlmeans/oidc 0.1.18-rc.50 → 0.1.18-rc.52

package/README.md

@@ -12,7 +12,7 @@ Shared OIDC protocol abstractions — guard/gate aliases, models, and immutable
 ## Installation
 
 ```bash
-bun add @owlmeans/oidc@^0.1.18-rc.50
+bun add @owlmeans/oidc@^0.1.18-rc.52
 ```
 
 ## Usage
@@ -95,7 +95,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.44
+npx @owlmeans/agent-skills@^0.1.18-rc.46
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/oidc",
-  "version": "0.1.18-rc.50",
-  "generatedAt": "2026-09-30T09:41:02.827Z",
+  "version": "0.1.18-rc.52",
+  "generatedAt": "2026-10-03T11:19:50.782Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/oidc/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: oidc
-description: How to use @owlmeans/oidc — the OIDC names both sides share — the OIDC_GATE alias, the guard, the requested-scope contract, provider descriptors, the dispatcher entrypoints and the error query params. Auto-invoked when importing OIDC types or constants, wiring OIDC into a protocol gate, or declaring an identity provider in configuration.
+description: How to use @owlmeans/oidc — the OIDC names both sides share — the OIDC_GATE alias, the guard, the requested-scope contract, provider descriptors, the dispatcher entrypoints, the organizations scope and switch protocols, and the error query params. Auto-invoked when importing OIDC types or constants, wiring OIDC into a protocol gate, or declaring an identity provider in configuration.
 user-invocable: false
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/oidc
 
 **Layer:** Core
-**Install:** `"@owlmeans/oidc": "^0.1.18-rc.50"` in `dependencies`
+**Install:** `"@owlmeans/oidc": "^0.1.18-rc.52"` in `dependencies`
 
 The shared half of the OIDC stack: no transport, no library. It owns the names, the shapes and the
 guard that the server relying party (`@owlmeans/server-oidc-rp`), the browser relying party
@@ -23,13 +23,16 @@ guard that the server relying party (`@owlmeans/server-oidc-rp`), the browser re
 | `OIDC_GUARD_CACHE` | A resource-alias constant nothing reads — the guard has no cache lookup, so registering a resource under it changes no behaviour |
 | `makeOidcGuard(opts?)` / `appendOidcGuard(context, opts?)` | The wrapped-token guard, and its registration. The target-specific packages wrap these |
 | `withOidcGuard(protocolTree, coguards?)` | Returns a decorated immutable protocol tree, prepending `OIDC_GUARD` to selected guarded declarations (default `DEFAULT_GUARD`) |
-| `oidcProtocols` | Shared dispatcher declarations: `DISPATCHER_OIDC_INIT` (`POST /authenticate/oidc/init`) and `DISPATCHER_OIDC` (`POST /authenticate/oidc/process`) |
-| `DISPATCHER_OIDC_INIT`, `DISPATCHER_OIDC` | Their aliases |
+| `oidcProtocols` | Shared declarations: the sign-in pair `init` (`POST /authenticate/oidc/init`) and `authenticate` (`POST /authenticate/oidc/process`), and the organization switch `organizations` (`GET /authenticate/oidc/organizations`) and `organization` (`POST /authenticate/oidc/organization`, body `{ entitySlug }`), both guarded by `OIDC_GUARD` |
+| `DISPATCHER_OIDC_INIT`, `DISPATCHER_OIDC`, `DISPATCHER_OIDC_ORGANIZATIONS`, `DISPATCHER_OIDC_ORGANIZATION` | Their aliases |
 | `OIDC_WRAPPED_TOKEN`, `WRAPPED_OIDC` | The authorization-header scheme for an OIDC-wrapped token, and the service alias that refreshes one |
 | `OIDC_CLIENT_AUTH`, `GOOGLE_CLIENT_AUTH` | Authentication plugin types — the generic OIDC one and the Google one |
 | `GOOGLE_SERVICE` | Provider service value for Google (`'google'`) |
 | `OIDC_RP_BASE_SCOPES` / `OIDC_RP_BASE_SCOPE` | The scopes every OwlMeans RP requests, as array / space-delimited string |
 | `EMAIL_SCOPE`, `PERMISSIONS_SCOPE`, `PERMISSIONS_CLAIM` | The standard email scope; the integrated-IAM grant scope and the claim it produces |
+| `ORGANIZATIONS_SCOPE`, `ORGANIZATIONS_CLAIM` | `'organizations'` — the tenanted-client scope and the claim carrying `OidcOrganizationClaim[]` |
+| `ORGANIZATION_REFUSAL`, `ORGANIZATION_OWNER_REFUSAL` | `AuthForbidden` reasons: not one of the subject's organizations; the action needs its owner |
+| `IAM_API_METADATA` | `'owlmeans_iam_api'` — the discovery-document field naming the provider's runtime IAM API |
 | `OIDC_CODE_QUERY`, `OIDC_ERROR_QUERY`, `OIDC_ERROR_DESCRIPTION_QUERY` | Redirect-URI params an authorization server sets on success and on failure |
 | `INTERACTION`, `INTERACTION_PATH`, `INTERACTION_UID` | Interaction screen alias, path, and the uid path param the path must declare |
 | `PROVIDER_INTERACTION`, `OIDC_AUTHEN_MODULE`, `OIDC_FLOW` | The provider-side interaction alias, the IAM authentication entrypoint alias, and the flow name |
@@ -39,10 +42,14 @@ guard that the server relying party (`@owlmeans/server-oidc-rp`), the browser re
 | `OidcSharedConfig` / `WithSharedConfig` | `cfg.oidc`: `providers`, `restrictedProviders`, `clientCookie.interaction` |
 | `OidcIamConfig` | `{ iamMode?: 'keycloak' \| 'integrated' }` — the IAM-mode seam, kept here to avoid a cycle with `@owlmeans/iam` |
 | `OidcGuard`, `OidcGuardOptions` | The guard service type, and `{ coguards, cache?, tokenService? }` — only `coguards` (its **first** entry, default `DEFAULT_GUARD`) and `tokenService` are read; `cache` is declared and never used |
-| `OIDCAuthInitParams`, `OIDCClientAuthPayload`, `OIDCTokenUpdate`, `CommonTokenSetParams` | The dispatcher wire shapes |
-| `OIDCAuthInitParamsSchema`, `OIDCClientAuthPayloadSchema`, `OIDCTokenUpdateSchema`, `ProviderProfileDetailsSchema` | Their AJV schemas |
+| `OIDCAuthInitParams`, `OIDCClientAuthPayload`, `OIDCTokenUpdate`, `CommonTokenSetParams` | The dispatcher wire shapes; init's `entitySlug?` is the organization the person asks to act in |
+| `OIDCAuthInitParamsSchema`, `OIDCClientAuthPayloadSchema`, `OIDCTokenUpdateSchema`, `ProviderProfileDetailsSchema`, `OidcOrganizationSwitchSchema` | Their AJV schemas — closed (the server's AJV strips an undeclared field silently, so every field a caller sends is declared), except `OIDCClientAuthPayloadSchema`, which admits any further string param of the provider's redirect |
+| `OidcOrganizationClaim` | `{ entitySlug, entityKey, title?, owner, groups?, home? }` — one organization of the subject as the provider claims it; `entityKey` is the frozen IAM key and never leaves a server |
+| `OidcPermissionSetClaim` | `PermissionSet` + `entitySlug?` — a set bound to that organization |
+| `OidcOrganizationItem`, `OidcOrganizationList`, `OidcOrganizationSwitch` | The switch's wire shapes: `{ entitySlug, title?, owner, groups?, home?, acting }` items (no key), the `{ items }` list, the `{ entitySlug }` body |
+| `WrappedOIDCUpdate` | `AuthToken` + `entity?: ResolvedEntity` — what `WrappedOIDCService.update` answers |
 | `ProviderProfileDetails`, `OidcUserDetails`, `OidcProviderSettings` | What an identity provider reports about a subject |
-| `WrappedOIDCService` | The `AuthorizationService` that keeps a wrapped token fresh |
+| `WrappedOIDCService` | The `AuthorizationService` that keeps a wrapped token fresh; `update` answers a `WrappedOIDCUpdate` |
 
 ## Usage
 
@@ -61,8 +68,7 @@ protocol(
 
 The verification itself happens in `@owlmeans/server-oidc-rp` (server) and `@owlmeans/web-oidc-rp`
 (browser); this package gives both sides one name to refer to. `OIDC_GATE` is for OIDC/UMA-style
-authorization. A product that authenticates over OIDC but authorizes against its own identity
-resources declares its own gate alias instead.
+authorization only (`server-oidc-rp` → Rules).
 
 ## Scope names are a cross-package contract
 
@@ -77,6 +83,28 @@ server for, and two sides read it from here:
 Never hardcode a scope string on either side. Adding one to `OIDC_RP_BASE_SCOPES` must widen every
 client allowlist derived from it in the same change.
 
+## Organizations of a tenanted client
+
+A client that asks for `ORGANIZATIONS_SCOPE` gets two claims from the integrated provider: the
+`organizations` claim (`OidcOrganizationClaim[]`) and the FULL `permissions` claim, in which a set
+bound to an organization carries `entitySlug`. A client that never asks gets the flattened claim of
+the one organization it acts in and no `organizations` claim — so the scope is what turns tenancy
+on, and a single-organization client never sees an `organizations` claim or a set carrying
+`entitySlug`.
+
+Only the relying party's server sees the claims; what the session keeps and what the browser token
+carries is governed by `server-oidc-rp` → "Organizations".
+
+The guard attaches `updated.entity` to the request whenever the wrapping service answers one. A
+relying party of a tenanted client has no organization registry of its own, so this is the only
+way `req.entity` gets set there; `attachEntity` (`@owlmeans/auth-common`) keeps it only while its
+`slug` is exactly the token's.
+
+The switch is two protocols guarded by `OIDC_GUARD` alone — they act on the session the wrapped
+token names, after the guard has validated it against the provider. There is no per-request
+organization selector: the server's AJV strips unknown query keys, and the session, not the
+request, decides which organization a request acts in.
+
 ## Provider descriptors
 
 `cfg.oidc.providers` is the list. `discoveryUrl` is the canonical form — the fully-qualified issuer,

package/build/consts.d.ts

@@ -14,6 +14,10 @@ export declare const OIDC_GUARD = "guard:oidc";
 export declare const OIDC_GUARD_CACHE = "resource:oidc-guard:cache";
 export declare const DISPATCHER_OIDC_INIT = "dispatcher:oidc:init";
 export declare const DISPATCHER_OIDC = "dispatcher:oidc:authenticate";
+/** Lists the organizations the session's subject belongs to. */
+export declare const DISPATCHER_OIDC_ORGANIZATIONS = "dispatcher:oidc:organizations";
+/** Switches the organization the session acts in. */
+export declare const DISPATCHER_OIDC_ORGANIZATION = "dispatcher:oidc:organization";
 export declare const OIDC_CODE_QUERY = "code";
 /**
  * Query params an authorization server sets on the redirect URI when the request failed
@@ -42,4 +46,18 @@ export declare const OIDC_RP_BASE_SCOPES: string[];
 export declare const OIDC_RP_BASE_SCOPE: string;
 /** Token/userinfo claim carrying the subject's PermissionSet[] for the requesting client. */
 export declare const PERMISSIONS_CLAIM = "permissions";
+/**
+ * OIDC scope of a tenanted client: the provider answers it with the subject's organizations and
+ * the full permission claim, bound sets included. A client that never asks for it gets the
+ * flattened claim of the one organization it acts in, exactly as before the scope existed.
+ */
+export declare const ORGANIZATIONS_SCOPE = "organizations";
+/** Token/userinfo claim carrying the subject's `OidcOrganizationClaim[]`. */
+export declare const ORGANIZATIONS_CLAIM = "organizations";
+/** `AuthForbidden` reason: the organization named is not one the subject belongs to. */
+export declare const ORGANIZATION_REFUSAL = "organization";
+/** `AuthForbidden` reason: the action needs the organization's owner. */
+export declare const ORGANIZATION_OWNER_REFUSAL = "organization:owner";
+/** Discovery-document field carrying the base URL of the provider's runtime IAM API. */
+export declare const IAM_API_METADATA = "owlmeans_iam_api";
 //# sourceMappingURL=consts.d.ts.map

package/build/consts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,YAAY,SAAS,CAAA;AAElC,eAAO,MAAM,aAAa,gBAAgB,CAAA;AAE1C,6FAA6F;AAC7F,eAAO,MAAM,eAAe,QAAQ,CAAA;AAEpC,eAAO,MAAM,gBAAgB,sBAA4C,CAAA;AAEzE,eAAO,MAAM,WAAW,qBAAqB,CAAA;AAE7C,eAAO,MAAM,SAAS,SAAS,CAAA;AAE/B,eAAO,MAAM,kBAAkB,oBAAoB,CAAA;AAEnD,eAAO,MAAM,oBAAoB,4BAA4B,CAAA;AAE7D,eAAO,MAAM,gBAAgB,gBAAgB,CAAA;AAE7C,eAAO,MAAM,kBAAkB,iBAAiB,CAAA;AAGhD,eAAO,MAAM,cAAc,WAAW,CAAA;AAEtC,eAAO,MAAM,UAAU,eAAe,CAAA;AAEtC,eAAO,MAAM,gBAAgB,8BAA8B,CAAA;AAE3D,eAAO,MAAM,oBAAoB,yBAAyB,CAAA;AAE1D,eAAO,MAAM,eAAe,iCAAiC,CAAA;AAE7D,eAAO,MAAM,eAAe,SAAS,CAAA;AAErC;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,UAAU,CAAA;AAEvC,eAAO,MAAM,4BAA4B,sBAAsB,CAAA;AAE/D,eAAO,MAAM,kBAAkB,uBAAuB,CAAA;AAEtD,eAAO,MAAM,YAAY,uBAAuB,CAAA;AAEhD,eAAO,MAAM,SAAS,cAAc,CAAA;AAEpC,+EAA+E;AAC/E,eAAO,MAAM,WAAW,UAAU,CAAA;AAElC,mFAAmF;AACnF,eAAO,MAAM,iBAAiB,gBAAgB,CAAA;AAE9C;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,UAAqC,CAAA;AAErE,4FAA4F;AAC5F,eAAO,MAAM,kBAAkB,QAAgC,CAAA;AAE/D,6FAA6F;AAC7F,eAAO,MAAM,iBAAiB,gBAAgB,CAAA"}
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,YAAY,SAAS,CAAA;AAElC,eAAO,MAAM,aAAa,gBAAgB,CAAA;AAE1C,6FAA6F;AAC7F,eAAO,MAAM,eAAe,QAAQ,CAAA;AAEpC,eAAO,MAAM,gBAAgB,sBAA4C,CAAA;AAEzE,eAAO,MAAM,WAAW,qBAAqB,CAAA;AAE7C,eAAO,MAAM,SAAS,SAAS,CAAA;AAE/B,eAAO,MAAM,kBAAkB,oBAAoB,CAAA;AAEnD,eAAO,MAAM,oBAAoB,4BAA4B,CAAA;AAE7D,eAAO,MAAM,gBAAgB,gBAAgB,CAAA;AAE7C,eAAO,MAAM,kBAAkB,iBAAiB,CAAA;AAGhD,eAAO,MAAM,cAAc,WAAW,CAAA;AAEtC,eAAO,MAAM,UAAU,eAAe,CAAA;AAEtC,eAAO,MAAM,gBAAgB,8BAA8B,CAAA;AAE3D,eAAO,MAAM,oBAAoB,yBAAyB,CAAA;AAE1D,eAAO,MAAM,eAAe,iCAAiC,CAAA;AAE7D,gEAAgE;AAChE,eAAO,MAAM,6BAA6B,kCAAkC,CAAA;AAE5E,qDAAqD;AACrD,eAAO,MAAM,4BAA4B,iCAAiC,CAAA;AAE1E,eAAO,MAAM,eAAe,SAAS,CAAA;AAErC;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,UAAU,CAAA;AAEvC,eAAO,MAAM,4BAA4B,sBAAsB,CAAA;AAE/D,eAAO,MAAM,kBAAkB,uBAAuB,CAAA;AAEtD,eAAO,MAAM,YAAY,uBAAuB,CAAA;AAEhD,eAAO,MAAM,SAAS,cAAc,CAAA;AAEpC,+EAA+E;AAC/E,eAAO,MAAM,WAAW,UAAU,CAAA;AAElC,mFAAmF;AACnF,eAAO,MAAM,iBAAiB,gBAAgB,CAAA;AAE9C;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,UAAqC,CAAA;AAErE,4FAA4F;AAC5F,eAAO,MAAM,kBAAkB,QAAgC,CAAA;AAE/D,6FAA6F;AAC7F,eAAO,MAAM,iBAAiB,gBAAgB,CAAA;AAE9C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,kBAAkB,CAAA;AAElD,6EAA6E;AAC7E,eAAO,MAAM,mBAAmB,kBAAkB,CAAA;AAElD,wFAAwF;AACxF,eAAO,MAAM,oBAAoB,iBAAiB,CAAA;AAElD,yEAAyE;AACzE,eAAO,MAAM,0BAA0B,uBAAuB,CAAA;AAE9D,wFAAwF;AACxF,eAAO,MAAM,gBAAgB,qBAAqB,CAAA"}

package/build/consts.js

@@ -16,6 +16,10 @@ export const OIDC_GUARD = 'guard:oidc';
 export const OIDC_GUARD_CACHE = 'resource:oidc-guard:cache';
 export const DISPATCHER_OIDC_INIT = 'dispatcher:oidc:init';
 export const DISPATCHER_OIDC = 'dispatcher:oidc:authenticate';
+/** Lists the organizations the session's subject belongs to. */
+export const DISPATCHER_OIDC_ORGANIZATIONS = 'dispatcher:oidc:organizations';
+/** Switches the organization the session acts in. */
+export const DISPATCHER_OIDC_ORGANIZATION = 'dispatcher:oidc:organization';
 export const OIDC_CODE_QUERY = 'code';
 /**
  * Query params an authorization server sets on the redirect URI when the request failed
@@ -44,4 +48,18 @@ export const OIDC_RP_BASE_SCOPES = ['openid', 'profile', EMAIL_SCOPE];
 export const OIDC_RP_BASE_SCOPE = OIDC_RP_BASE_SCOPES.join(' ');
 /** Token/userinfo claim carrying the subject's PermissionSet[] for the requesting client. */
 export const PERMISSIONS_CLAIM = 'permissions';
+/**
+ * OIDC scope of a tenanted client: the provider answers it with the subject's organizations and
+ * the full permission claim, bound sets included. A client that never asks for it gets the
+ * flattened claim of the one organization it acts in, exactly as before the scope existed.
+ */
+export const ORGANIZATIONS_SCOPE = 'organizations';
+/** Token/userinfo claim carrying the subject's `OidcOrganizationClaim[]`. */
+export const ORGANIZATIONS_CLAIM = 'organizations';
+/** `AuthForbidden` reason: the organization named is not one the subject belongs to. */
+export const ORGANIZATION_REFUSAL = 'organization';
+/** `AuthForbidden` reason: the action needs the organization's owner. */
+export const ORGANIZATION_OWNER_REFUSAL = 'organization:owner';
+/** Discovery-document field carrying the base URL of the provider's runtime IAM API. */
+export const IAM_API_METADATA = 'owlmeans_iam_api';
 //# sourceMappingURL=consts.js.map

package/build/consts.js.map

@@ -1 +1 @@
-{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAEvC,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAA;AAElC,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAA;AAE1C,6FAA6F;AAC7F,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAA;AAEpC,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,KAAK,GAAG,eAAe,EAAE,CAAA;AAEzE,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAA;AAE7C,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAA;AAE/B,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAAA;AAEnD,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAA;AAE7D,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAA;AAE7C,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAA;AAEhD,2GAA2G;AAC3G,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAA;AAEtC,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAA;AAEtC,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAA;AAE3D,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAA;AAE1D,MAAM,CAAC,MAAM,eAAe,GAAG,8BAA8B,CAAA;AAE7D,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAA;AAErC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAA;AAEvC,MAAM,CAAC,MAAM,4BAA4B,GAAG,mBAAmB,CAAA;AAE/D,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAA;AAEtD,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAA;AAEhD,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAA;AAEpC,+EAA+E;AAC/E,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAA;AAElC,mFAAmF;AACnF,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAA;AAE9C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAA;AAErE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAE/D,6FAA6F;AAC7F,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAA"}
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAEvC,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAA;AAElC,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAA;AAE1C,6FAA6F;AAC7F,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAA;AAEpC,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,KAAK,GAAG,eAAe,EAAE,CAAA;AAEzE,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAA;AAE7C,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAA;AAE/B,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAAA;AAEnD,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAA;AAE7D,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAA;AAE7C,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAA;AAEhD,2GAA2G;AAC3G,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAA;AAEtC,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAA;AAEtC,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAA;AAE3D,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAA;AAE1D,MAAM,CAAC,MAAM,eAAe,GAAG,8BAA8B,CAAA;AAE7D,gEAAgE;AAChE,MAAM,CAAC,MAAM,6BAA6B,GAAG,+BAA+B,CAAA;AAE5E,qDAAqD;AACrD,MAAM,CAAC,MAAM,4BAA4B,GAAG,8BAA8B,CAAA;AAE1E,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAA;AAErC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAA;AAEvC,MAAM,CAAC,MAAM,4BAA4B,GAAG,mBAAmB,CAAA;AAE/D,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAA;AAEtD,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAA;AAEhD,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAA;AAEpC,+EAA+E;AAC/E,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAA;AAElC,mFAAmF;AACnF,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAA;AAE9C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAA;AAErE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAE/D,6FAA6F;AAC7F,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAA;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAA;AAElD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAA;AAElD,wFAAwF;AACxF,MAAM,CAAC,MAAM,oBAAoB,GAAG,cAAc,CAAA;AAElD,yEAAyE;AACzE,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAA;AAE9D,wFAAwF;AACxF,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAA"}

package/build/entrypoints.d.ts

@@ -1,3 +1,5 @@
+import type { AuthToken } from '@owlmeans/auth';
+import type { OidcOrganizationList } from './types.js';
 /** Shared OIDC browser-to-server protocols, bound by the relying-party packages. */
 export declare const oidcProtocols: {
     init: import("@owlmeans/entrypoint").EntrypointProtocol<{
@@ -6,5 +8,9 @@ export declare const oidcProtocols: {
     authenticate: import("@owlmeans/entrypoint").EntrypointProtocol<{
         body: import("./types.js").OIDCClientAuthPayload;
     }, any>;
+    organizations: import("@owlmeans/entrypoint").EntrypointProtocol<{}, OidcOrganizationList>;
+    organization: import("@owlmeans/entrypoint").EntrypointProtocol<{
+        body: import("./types.js").OidcOrganizationSwitch;
+    }, AuthToken>;
 };
 //# sourceMappingURL=entrypoints.d.ts.map

package/build/entrypoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAKA,oFAAoF;AACpF,eAAO,MAAM,aAAa;IACxB,IAAI;;;IAIJ,YAAY;;;CAIb,CAAA"}
+{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAK/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEtD,oFAAoF;AACpF,eAAO,MAAM,aAAa;IACxB,IAAI;;;IAIJ,YAAY;;;IAOZ,aAAa;IAKb,YAAY;;;CAKb,CAAA"}

package/build/entrypoints.js

@@ -1,10 +1,15 @@
 import { contract, protocol, typed } from '@owlmeans/entrypoint';
 import { route, RouteMethod, backend } from '@owlmeans/route';
-import { DISPATCHER_OIDC, DISPATCHER_OIDC_INIT } from './consts.js';
-import { OIDCAuthInitParamsSchema, OIDCClientAuthPayloadSchema } from './models.js';
+import { DISPATCHER_OIDC, DISPATCHER_OIDC_INIT, DISPATCHER_OIDC_ORGANIZATION, DISPATCHER_OIDC_ORGANIZATIONS, OIDC_GUARD, } from './consts.js';
+import { OIDCAuthInitParamsSchema, OIDCClientAuthPayloadSchema, OidcOrganizationSwitchSchema } from './models.js';
 /** Shared OIDC browser-to-server protocols, bound by the relying-party packages. */
 export const oidcProtocols = {
     init: protocol(route(DISPATCHER_OIDC_INIT, '/authenticate/oidc/init', backend(null, RouteMethod.POST)), contract.request({ body: typed(OIDCAuthInitParamsSchema) }, typed())),
     authenticate: protocol(route(DISPATCHER_OIDC, '/authenticate/oidc/process', backend(null, RouteMethod.POST)), contract.request({ body: typed(OIDCClientAuthPayloadSchema) }, typed())),
+    // The organization switch acts on the session the wrapped token names, so only that token's own
+    // guard can reach it — and it runs after the guard has refreshed the session against the
+    // provider, so the list it answers from is the provider's current one.
+    organizations: protocol(route(DISPATCHER_OIDC_ORGANIZATIONS, '/authenticate/oidc/organizations', backend(null, RouteMethod.GET)), contract(typed()), { guards: OIDC_GUARD }),
+    organization: protocol(route(DISPATCHER_OIDC_ORGANIZATION, '/authenticate/oidc/organization', backend(null, RouteMethod.POST)), contract.request({ body: typed(OidcOrganizationSwitchSchema) }, typed()), { guards: OIDC_GUARD }),
 };
 //# sourceMappingURL=entrypoints.js.map

package/build/entrypoints.js.map

@@ -1 +1 @@
-{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAC7D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACnE,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AAEnF,oFAAoF;AACpF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,EAAE,QAAQ,CACZ,KAAK,CAAC,oBAAoB,EAAE,yBAAyB,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EACvF,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,wBAAwB,CAAC,EAAE,EAAE,KAAK,EAAO,CAAC,CAC1E;IACD,YAAY,EAAE,QAAQ,CACpB,KAAK,CAAC,eAAe,EAAE,4BAA4B,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EACrF,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,2BAA2B,CAAC,EAAE,EAAE,KAAK,EAAO,CAAC,CAC7E;CACF,CAAA"}
+{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAE7D,OAAO,EACL,eAAe,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,6BAA6B,EAAE,UAAU,GAC/G,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA;AAGjH,oFAAoF;AACpF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,EAAE,QAAQ,CACZ,KAAK,CAAC,oBAAoB,EAAE,yBAAyB,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EACvF,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,wBAAwB,CAAC,EAAE,EAAE,KAAK,EAAO,CAAC,CAC1E;IACD,YAAY,EAAE,QAAQ,CACpB,KAAK,CAAC,eAAe,EAAE,4BAA4B,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EACrF,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,2BAA2B,CAAC,EAAE,EAAE,KAAK,EAAO,CAAC,CAC7E;IACD,gGAAgG;IAChG,yFAAyF;IACzF,uEAAuE;IACvE,aAAa,EAAE,QAAQ,CACrB,KAAK,CAAC,6BAA6B,EAAE,kCAAkC,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,EACxG,QAAQ,CAAC,KAAK,EAAwB,CAAC,EACvC,EAAE,MAAM,EAAE,UAAU,EAAE,CACvB;IACD,YAAY,EAAE,QAAQ,CACpB,KAAK,CAAC,4BAA4B,EAAE,iCAAiC,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EACvG,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,4BAA4B,CAAC,EAAE,EAAE,KAAK,EAAa,CAAC,EACnF,EAAE,MAAM,EAAE,UAAU,EAAE,CACvB;CACF,CAAA"}

package/build/guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAsB,MAAM,YAAY,CAAA;AAGlG,OAAO,KAAK,EAAqC,cAAc,EAAgB,MAAM,sBAAsB,CAAA;AAQ3G,eAAO,MAAM,aAAa,UAAW,gBAAgB,KAAG,SAqGvD,CAAA;AAED,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WAC3D,CAAC,SAAS,gBAAgB,MAKpC,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,GAAI,IAAI,SAAS,cAAc,QACjD,IAAI,aAAa,MAAM,GAAG,SAAS,MAAM,EAAE,KAChD,IAcF,CAAA"}
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAyC,MAAM,YAAY,CAAA;AAGrH,OAAO,KAAK,EAAqC,cAAc,EAAgB,MAAM,sBAAsB,CAAA;AAQ3G,eAAO,MAAM,aAAa,UAAW,gBAAgB,KAAG,SA4GvD,CAAA;AAED,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WAC3D,CAAC,SAAS,gBAAgB,MAKpC,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,GAAI,IAAI,SAAS,cAAc,QACjD,IAAI,aAAa,MAAM,GAAG,SAAS,MAAM,EAAE,KAChD,IAcF,CAAA"}

package/build/guard.js

@@ -77,6 +77,12 @@ export const makeOidcGuard = (opts) => {
             if (updated == null) {
                 return false;
             }
+            // The provider names the organization this session acts in, and a relying party of a
+            // tenanted client has no registry to resolve it from by slug. `attachEntity` keeps this one
+            // only while its slug is the token's, so a stale attachment can never stand in for it.
+            if (updated.entity != null) {
+                req.entity = updated.entity;
+            }
             if (updated.token !== token) {
                 const [, newAuth] = updated.token.split(' ');
                 const envelope = makeEnvelopeModel(newAuth, EnvelopeKind.Token);

package/build/guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1E,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAE/E,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACnE,OAAO,EAAE,WAAW,EAAwB,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACtF,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAE9D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAuB,EAAa,EAAE;IAClE,2FAA2F;IAC3F,kFAAkF;IAClF,WAAW;IAEX,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,aAAa,CAAC,CAAA;IAEnG,MAAM,KAAK,GAAc,aAAa,CAAY,UAAU,EAAE;QAC5D,cAAc;QAEd,gBAAgB;QAChB,mDAAmD;QACnD,oCAAoC;QACpC,uBAAuB;QACvB,MAAM;QAEN,0DAA0D;QAC1D,6DAA6D;QAC7D,6BAA6B;QAC7B,oDAAoD;QACpD,sBAAsB;QACtB,KAAK;QAEL,aAAa,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACzB,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,CAAA;YAC7B,qDAAqD;YACrD,yEAAyE;YACzE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAe,IAAI,EAAE,YAAY,IAAI,OAAO,CAAC,CAAA;YACrE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;YAC3C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC/B,IAAI,IAAI,KAAK,kBAAkB,CAAC,WAAW,EAAE,EAAE,CAAC;oBAC9C,OAAO,KAAK,CAAA;gBACd,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;QAED,cAAc;QACd,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,CAAC,IAAI,IAAI;QAErE,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;YAC/D,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,CAAA;YAC7B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAE5F,wFAAwF;YACxF,0FAA0F;YAC1F,IAAI,QAAoD,CAAA;YACxD,IAAI,QAAQ,GAAG,KAAK,CAAA;YACpB,IAAI,CAAC;gBACH,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;gBACrE,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,GAAG,KAAK,CAAA;YAClB,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,CAAE,CAAA;YAE/D,IAAI,OAAO,GAAqB,IAAI,CAAA;YAEpC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,CAAA;YACtD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,kBAAkB,EAAE,CAAC;oBACpC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;oBAC7C,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,CAAA;gBACrD,CAAC;gBAED,MAAM,CAAC,CAAA;YACT,CAAC;YAED,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBAC5B,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC5C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;gBAErE,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;gBACxD,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,CAAA;gBAE9D,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;YACjC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,OAAO,CAAC,QAAS,CAAC,OAAO,EAAE,CAAC,CAAA;YAClC,CAAC;YAED,OAAO,IAAS,CAAA;QAClB,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,OAAU,EAAE,IAAuB,EACnC,EAAE;IACF,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;IAE5C,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,IAAU,EAAE,QAAqC,EAC3C,EAAE;IACR,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,aAAa,CAAC,CAAC,CAAA;IAC1F,MAAM,QAAQ,GAAG,CAAC,IAAoB,EAAkB,EAAE,CAAC,MAAM,CAAC,WAAW,CAC3E,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QACxC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QAC/D,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC1F,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACrB,CAAC;QAED,OAAO,CAAC,GAAG,EAAE,kBAAkB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;IACpF,CAAC,CAAC,CACH,CAAA;IAED,OAAO,QAAQ,CAAC,IAAI,CAAS,CAAA;AAC/B,CAAC,CAAA;AAED,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAsB,EAAE,CACvD,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;IAC9B,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;IAC/B,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE,CAAC,KAAK,EAAwB,CAAA"}
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1E,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAE/E,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACnE,OAAO,EAAE,WAAW,EAAa,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAC3E,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAE9D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAuB,EAAa,EAAE;IAClE,2FAA2F;IAC3F,kFAAkF;IAClF,WAAW;IAEX,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,aAAa,CAAC,CAAA;IAEnG,MAAM,KAAK,GAAc,aAAa,CAAY,UAAU,EAAE;QAC5D,cAAc;QAEd,gBAAgB;QAChB,mDAAmD;QACnD,oCAAoC;QACpC,uBAAuB;QACvB,MAAM;QAEN,0DAA0D;QAC1D,6DAA6D;QAC7D,6BAA6B;QAC7B,oDAAoD;QACpD,sBAAsB;QACtB,KAAK;QAEL,aAAa,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACzB,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,CAAA;YAC7B,qDAAqD;YACrD,yEAAyE;YACzE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAe,IAAI,EAAE,YAAY,IAAI,OAAO,CAAC,CAAA;YACrE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;YAC3C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC/B,IAAI,IAAI,KAAK,kBAAkB,CAAC,WAAW,EAAE,EAAE,CAAC;oBAC9C,OAAO,KAAK,CAAA;gBACd,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;QAED,cAAc;QACd,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,CAAC,IAAI,IAAI;QAErE,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;YAC/D,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,CAAA;YAC7B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAE5F,wFAAwF;YACxF,0FAA0F;YAC1F,IAAI,QAAoD,CAAA;YACxD,IAAI,QAAQ,GAAG,KAAK,CAAA;YACpB,IAAI,CAAC;gBACH,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;gBACrE,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,GAAG,KAAK,CAAA;YAClB,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,CAAE,CAAA;YAE/D,IAAI,OAAO,GAA6B,IAAI,CAAA;YAE5C,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,CAAA;YACtD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,kBAAkB,EAAE,CAAC;oBACpC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;oBAC7C,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,CAAA;gBACrD,CAAC;gBAED,MAAM,CAAC,CAAA;YACT,CAAC;YAED,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,qFAAqF;YACrF,4FAA4F;YAC5F,uFAAuF;YACvF,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBAC3B,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;YAC7B,CAAC;YAED,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBAC5B,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC5C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;gBAErE,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;gBACxD,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,CAAA;gBAE9D,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;YACjC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,OAAO,CAAC,QAAS,CAAC,OAAO,EAAE,CAAC,CAAA;YAClC,CAAC;YAED,OAAO,IAAS,CAAA;QAClB,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,OAAU,EAAE,IAAuB,EACnC,EAAE;IACF,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;IAE5C,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,IAAU,EAAE,QAAqC,EAC3C,EAAE;IACR,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,aAAa,CAAC,CAAC,CAAA;IAC1F,MAAM,QAAQ,GAAG,CAAC,IAAoB,EAAkB,EAAE,CAAC,MAAM,CAAC,WAAW,CAC3E,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QACxC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QAC/D,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC1F,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACrB,CAAC;QAED,OAAO,CAAC,GAAG,EAAE,kBAAkB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;IACpF,CAAC,CAAC,CACH,CAAA;IAED,OAAO,QAAQ,CAAC,IAAI,CAAS,CAAA;AAC/B,CAAC,CAAA;AAED,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAsB,EAAE,CACvD,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;IAC9B,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;IAC/B,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE,CAAC,KAAK,EAAwB,CAAA"}

package/build/models.d.ts

@@ -1,7 +1,8 @@
 import type { JSONSchemaType } from 'ajv';
-import type { OIDCAuthInitParams, OIDCClientAuthPayload, OIDCTokenUpdate, ProviderProfileDetails } from './types.js';
+import type { OIDCAuthInitParams, OIDCClientAuthPayload, OidcOrganizationSwitch, OIDCTokenUpdate, ProviderProfileDetails } from './types.js';
 export declare const OIDCAuthInitParamsSchema: JSONSchemaType<OIDCAuthInitParams>;
 export declare const OIDCClientAuthPayloadSchema: JSONSchemaType<OIDCClientAuthPayload>;
+export declare const OidcOrganizationSwitchSchema: JSONSchemaType<OidcOrganizationSwitch>;
 export declare const OIDCTokenUpdateSchema: JSONSchemaType<OIDCTokenUpdate>;
 export declare const ProviderProfileDetailsSchema: JSONSchemaType<ProviderProfileDetails>;
 //# sourceMappingURL=models.d.ts.map

package/build/models.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../src/models.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,KAAK,CAAA;AACzC,OAAO,KAAK,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAGpH,eAAO,MAAM,wBAAwB,EAAE,cAAc,CAAC,kBAAkB,CAQvE,CAAA;AAED,eAAO,MAAM,2BAA2B,EAAE,cAAc,CAAC,qBAAqB,CAQ7E,CAAA;AAED,eAAO,MAAM,qBAAqB,EAAE,cAAc,CAAC,eAAe,CAqBjE,CAAA;AAED,eAAO,MAAM,4BAA4B,EAAE,cAAc,CAAC,sBAAsB,CAe/E,CAAA"}
+{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../src/models.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,KAAK,CAAA;AACzC,OAAO,KAAK,EACV,kBAAkB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,eAAe,EAAE,sBAAsB,EAC3G,MAAM,YAAY,CAAA;AAKnB,eAAO,MAAM,wBAAwB,EAAE,cAAc,CAAC,kBAAkB,CASvE,CAAA;AAED,eAAO,MAAM,2BAA2B,EAAE,cAAc,CAAC,qBAAqB,CAQ7E,CAAA;AAED,eAAO,MAAM,4BAA4B,EAAE,cAAc,CAAC,sBAAsB,CAO/E,CAAA;AAED,eAAO,MAAM,qBAAqB,EAAE,cAAc,CAAC,eAAe,CAqBjE,CAAA;AAED,eAAO,MAAM,4BAA4B,EAAE,cAAc,CAAC,sBAAsB,CAe/E,CAAA"}

package/build/models.js

@@ -1,9 +1,10 @@
-import { AuthTokenSchema, EntityValueSchema, IdValueSchema, ScopeValueSchema, TypeNameSchema } from '@owlmeans/auth';
+import { AuthTokenSchema, EntitySlugValueSchema, EntityValueSchema, IdValueSchema, ScopeValueSchema, TypeNameSchema, } from '@owlmeans/auth';
 export const OIDCAuthInitParamsSchema = {
     type: 'object',
     properties: {
         entity: { ...EntityValueSchema, nullable: true },
         profile: { ...IdValueSchema, nullable: true },
+        entitySlug: { ...EntitySlugValueSchema, nullable: true },
     },
     required: [],
     additionalProperties: false,
@@ -17,6 +18,14 @@ export const OIDCClientAuthPayloadSchema = {
     additionalProperties: { type: 'string', minLength: 0, maxLength: 512 },
     required: ['code', 'authUrl'],
 };
+export const OidcOrganizationSwitchSchema = {
+    type: 'object',
+    properties: {
+        entitySlug: { ...EntitySlugValueSchema },
+    },
+    required: ['entitySlug'],
+    additionalProperties: false,
+};
 export const OIDCTokenUpdateSchema = {
     type: 'object',
     properties: {

package/build/models.js.map

@@ -1 +1 @@
-{"version":3,"file":"models.js","sourceRoot":"","sources":["../src/models.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,aAAa,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEpH,MAAM,CAAC,MAAM,wBAAwB,GAAuC;IAC1E,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,MAAM,EAAE,EAAE,GAAG,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE;QAChD,OAAO,EAAE,EAAE,GAAG,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC9C;IACD,QAAQ,EAAE,EAAE;IACZ,oBAAoB,EAAE,KAAK;CAC5B,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAA0C;IAChF,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE;QACvD,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;KAC1E;IACD,oBAAoB,EAAE,EAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAC;IACpE,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;CAC9B,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAoC;IACpE,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,GAAG,eAAe,CAAC,UAAU;QAC7B,QAAQ,EAAE;YACR,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAChD,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC9C,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC5C,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACjD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACzC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC9C,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;aAClD;YACD,QAAQ,EAAE,EAAE;YACZ,oBAAoB,EAAE,IAAI;SAC3B;KACF;IACD,QAAQ,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC;IAC/B,oBAAoB,EAAE,KAAK;CAC5B,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAA2C;IAClF,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,GAAG,cAAc,EAAE;QAC3B,OAAO,EAAE,EAAE,GAAG,gBAAgB,EAAE;QAChC,QAAQ,EAAE,EAAE,GAAG,gBAAgB,EAAE;QACjC,MAAM,EAAE,EAAE,GAAG,aAAa,EAAE;QAC5B,SAAS,EAAE,EAAC,GAAG,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC9C,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC1E,QAAQ,EAAE,EAAE,GAAG,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE;QAClD,GAAG,EAAE,EAAE,GAAG,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE;QACzC,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;KAClD;IACD,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC;IACnD,oBAAoB,EAAE,KAAK;CAC5B,CAAA"}
+{"version":3,"file":"models.js","sourceRoot":"","sources":["../src/models.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,eAAe,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,aAAa,EAAE,gBAAgB,EAAE,cAAc,GAC3G,MAAM,gBAAgB,CAAA;AAEvB,MAAM,CAAC,MAAM,wBAAwB,GAAuC;IAC1E,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,MAAM,EAAE,EAAE,GAAG,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE;QAChD,OAAO,EAAE,EAAE,GAAG,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC7C,UAAU,EAAE,EAAE,GAAG,qBAAqB,EAAE,QAAQ,EAAE,IAAI,EAAE;KACzD;IACD,QAAQ,EAAE,EAAE;IACZ,oBAAoB,EAAE,KAAK;CAC5B,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAA0C;IAChF,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE;QACvD,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;KAC1E;IACD,oBAAoB,EAAE,EAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAC;IACpE,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;CAC9B,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAA2C;IAClF,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,UAAU,EAAE,EAAE,GAAG,qBAAqB,EAAE;KACzC;IACD,QAAQ,EAAE,CAAC,YAAY,CAAC;IACxB,oBAAoB,EAAE,KAAK;CAC5B,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAoC;IACpE,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,GAAG,eAAe,CAAC,UAAU;QAC7B,QAAQ,EAAE;YACR,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAChD,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC9C,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC5C,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACjD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACzC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC9C,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;aAClD;YACD,QAAQ,EAAE,EAAE;YACZ,oBAAoB,EAAE,IAAI;SAC3B;KACF;IACD,QAAQ,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC;IAC/B,oBAAoB,EAAE,KAAK;CAC5B,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAA2C;IAClF,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,GAAG,cAAc,EAAE;QAC3B,OAAO,EAAE,EAAE,GAAG,gBAAgB,EAAE;QAChC,QAAQ,EAAE,EAAE,GAAG,gBAAgB,EAAE;QACjC,MAAM,EAAE,EAAE,GAAG,aAAa,EAAE;QAC5B,SAAS,EAAE,EAAC,GAAG,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC9C,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC1E,QAAQ,EAAE,EAAE,GAAG,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE;QAClD,GAAG,EAAE,EAAE,GAAG,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE;QACzC,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;KAClD;IACD,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC;IACnD,oBAAoB,EAAE,KAAK;CAC5B,CAAA"}

package/build/types.d.ts

@@ -1,7 +1,7 @@
-import type { AuthToken } from '@owlmeans/auth';
+import type { AuthToken, PermissionSet } from '@owlmeans/auth';
 import type { AuthorizationService } from '@owlmeans/auth-common';
 import type { BasicConfig, BasicContext } from '@owlmeans/context';
-import type { GuardService } from '@owlmeans/entrypoint';
+import type { GuardService, ResolvedEntity } from '@owlmeans/entrypoint';
 export interface Config extends BasicConfig {
 }
 export interface Context<C extends Config = Config> extends BasicContext<C> {
@@ -73,12 +73,62 @@ export interface OidcGuardOptions {
 export interface OIDCAuthInitParams {
     entity?: string;
     profile?: string;
+    /**
+     * The organization the person asked to act in after sign-in. Honoured only when the provider
+     * names it among the subject's organizations; otherwise the session starts in the home one.
+     */
+    entitySlug?: string;
+}
+/** One organization of the subject, as the provider claims it under `ORGANIZATIONS_SCOPE`. */
+export interface OidcOrganizationClaim {
+    entitySlug: string;
+    /**
+     * The organization's frozen IAM key — stable across renames, which is why a session remembers
+     * its acting organization by it. Server-side only: never copied into a browser token or into a
+     * response.
+     */
+    entityKey: string;
+    title?: string;
+    owner: boolean;
+    groups?: string[];
+    home?: boolean;
+}
+/**
+ * A permission set as the provider claims it. A set carrying `entitySlug` is bound to that
+ * organization and applies only while the session acts in it; one without applies everywhere.
+ */
+export interface OidcPermissionSetClaim extends PermissionSet {
+    entitySlug?: string;
+}
+/** One organization of the session, as the switch lists it — the key never leaves the server. */
+export interface OidcOrganizationItem {
+    entitySlug: string;
+    title?: string;
+    owner: boolean;
+    groups?: string[];
+    home?: boolean;
+    acting: boolean;
+}
+export interface OidcOrganizationList {
+    items: OidcOrganizationItem[];
+}
+export interface OidcOrganizationSwitch {
+    entitySlug: string;
 }
 export interface OIDCClientAuthPayload extends Record<string, string> {
     code: string;
     authUrl: string;
 }
+/**
+ * A refreshed wrapped token, plus the organization the session acts in when the provider names
+ * one. The guard attaches that entity to the request, because a relying party of a tenanted
+ * client has no resolver of its own that could find it by slug.
+ */
+export interface WrappedOIDCUpdate extends AuthToken {
+    entity?: ResolvedEntity;
+}
 export interface WrappedOIDCService extends AuthorizationService {
+    update: (token?: string | AuthToken, thr?: boolean) => Promise<WrappedOIDCUpdate | null>;
 }
 export interface OIDCTokenUpdate extends AuthToken {
     tokenSet: CommonTokenSetParams;

package/build/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExD,MAAM,WAAW,MAAO,SAAQ,WAAW;CAAI;AAC/C,MAAM,WAAW,OAAO,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,CAAE,SAAQ,YAAY,CAAC,CAAC,CAAC;CAAI;AAE/E,MAAM,WAAW,gBAAgB;IAC/B,YAAY,CAAC,EAAE;QACb,WAAW,CAAC,EAAE;YACZ,IAAI,CAAC,EAAE,MAAM,CAAA;YACb,GAAG,CAAC,EAAE,MAAM,CAAA;SACb,CAAA;KACF,CAAC;IACF,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAA;IAChC;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,GAAG,MAAM,EAAE,CAAA;CACzC;AAED,MAAM,WAAW,kBAAmB,SAAQ,sBAAsB;IAEhE,QAAQ,CAAC,EAAE,OAAO,CAAA;IAElB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,sBAAsB;IAErC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,GAAG,CAAC,EAAE,OAAO,CAAA;IACb;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,UAAU,GAAG,UAAU,CAAA;IAC3C;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,yFAAyF;IACzF,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iDAAiD;IACjD,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAGD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,gBAAgB,CAAA;CACvB;AAED,MAAM,WAAW,SAAU,SAAQ,YAAY;CAC9C;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAGD,MAAM,WAAW,qBAAsB,SAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IACnE,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;CAC/D;AAED,MAAM,WAAW,eAAgB,SAAQ,SAAS;IAChD,QAAQ,EAAE,oBAAoB,CAAA;CAC/B;AAED,MAAM,WAAW,oBAAqB,SAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACvF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAGD,MAAM,WAAW,sBAAuB,SAAQ,OAAO,CAAC,eAAe,CAAC;IACtE,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,GAAG,CAAC,EAAE,MAAM,CAAA;IASZ,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,mBAAmB,EAAE,OAAO,CAAA;CAC7B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAExE,MAAM,WAAW,MAAO,SAAQ,WAAW;CAAI;AAC/C,MAAM,WAAW,OAAO,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,CAAE,SAAQ,YAAY,CAAC,CAAC,CAAC;CAAI;AAE/E,MAAM,WAAW,gBAAgB;IAC/B,YAAY,CAAC,EAAE;QACb,WAAW,CAAC,EAAE;YACZ,IAAI,CAAC,EAAE,MAAM,CAAA;YACb,GAAG,CAAC,EAAE,MAAM,CAAA;SACb,CAAA;KACF,CAAC;IACF,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAA;IAChC;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,GAAG,MAAM,EAAE,CAAA;CACzC;AAED,MAAM,WAAW,kBAAmB,SAAQ,sBAAsB;IAEhE,QAAQ,CAAC,EAAE,OAAO,CAAA;IAElB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,sBAAsB;IAErC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,GAAG,CAAC,EAAE,OAAO,CAAA;IACb;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,UAAU,GAAG,UAAU,CAAA;IAC3C;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,yFAAyF;IACzF,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iDAAiD;IACjD,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAGD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,gBAAgB,CAAA;CACvB;AAED,MAAM,WAAW,SAAU,SAAQ,YAAY;CAC9C;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,8FAA8F;AAC9F,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAuB,SAAQ,aAAa;IAC3D,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,iGAAiG;AACjG,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,MAAM,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,oBAAoB,EAAE,CAAA;CAC9B;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAA;CACnB;AAGD,MAAM,WAAW,qBAAsB,SAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IACnE,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IAClD,MAAM,CAAC,EAAE,cAAc,CAAA;CACxB;AAED,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;IAC9D,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAA;CACzF;AAED,MAAM,WAAW,eAAgB,SAAQ,SAAS;IAChD,QAAQ,EAAE,oBAAoB,CAAA;CAC/B;AAED,MAAM,WAAW,oBAAqB,SAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACvF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAGD,MAAM,WAAW,sBAAuB,SAAQ,OAAO,CAAC,eAAe,CAAC;IACtE,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,GAAG,CAAC,EAAE,MAAM,CAAA;IASZ,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,mBAAmB,EAAE,OAAO,CAAA;CAC7B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/oidc",
-  "version": "0.1.18-rc.50",
+  "version": "0.1.18-rc.52",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -21,12 +21,12 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.36",
-    "@owlmeans/auth-common": "^0.1.18-rc.42",
-    "@owlmeans/basic-envelope": "^0.1.18-rc.41",
-    "@owlmeans/config": "^0.1.18-rc.39",
+    "@owlmeans/auth": "^0.1.18-rc.38",
+    "@owlmeans/auth-common": "^0.1.18-rc.44",
+    "@owlmeans/basic-envelope": "^0.1.18-rc.43",
+    "@owlmeans/config": "^0.1.18-rc.41",
     "@owlmeans/context": "^0.1.18-rc.32",
-    "@owlmeans/entrypoint": "^0.1.18-rc.37",
+    "@owlmeans/entrypoint": "^0.1.18-rc.39",
     "@owlmeans/resource": "^0.1.18-rc.37",
     "@owlmeans/route": "^0.1.18-rc.33"
   },

package/src/consts.ts

@@ -33,6 +33,12 @@ export const DISPATCHER_OIDC_INIT = 'dispatcher:oidc:init'
 
 export const DISPATCHER_OIDC = 'dispatcher:oidc:authenticate'
 
+/** Lists the organizations the session's subject belongs to. */
+export const DISPATCHER_OIDC_ORGANIZATIONS = 'dispatcher:oidc:organizations'
+
+/** Switches the organization the session acts in. */
+export const DISPATCHER_OIDC_ORGANIZATION = 'dispatcher:oidc:organization'
+
 export const OIDC_CODE_QUERY = 'code'
 
 /**
@@ -71,3 +77,22 @@ export const OIDC_RP_BASE_SCOPE = OIDC_RP_BASE_SCOPES.join(' ')
 
 /** Token/userinfo claim carrying the subject's PermissionSet[] for the requesting client. */
 export const PERMISSIONS_CLAIM = 'permissions'
+
+/**
+ * OIDC scope of a tenanted client: the provider answers it with the subject's organizations and
+ * the full permission claim, bound sets included. A client that never asks for it gets the
+ * flattened claim of the one organization it acts in, exactly as before the scope existed.
+ */
+export const ORGANIZATIONS_SCOPE = 'organizations'
+
+/** Token/userinfo claim carrying the subject's `OidcOrganizationClaim[]`. */
+export const ORGANIZATIONS_CLAIM = 'organizations'
+
+/** `AuthForbidden` reason: the organization named is not one the subject belongs to. */
+export const ORGANIZATION_REFUSAL = 'organization'
+
+/** `AuthForbidden` reason: the action needs the organization's owner. */
+export const ORGANIZATION_OWNER_REFUSAL = 'organization:owner'
+
+/** Discovery-document field carrying the base URL of the provider's runtime IAM API. */
+export const IAM_API_METADATA = 'owlmeans_iam_api'

package/src/entrypoints.ts

@@ -1,7 +1,11 @@
 import { contract, protocol, typed } from '@owlmeans/entrypoint'
 import { route, RouteMethod, backend } from '@owlmeans/route'
-import { DISPATCHER_OIDC, DISPATCHER_OIDC_INIT } from './consts.js'
-import { OIDCAuthInitParamsSchema, OIDCClientAuthPayloadSchema } from './models.js'
+import type { AuthToken } from '@owlmeans/auth'
+import {
+  DISPATCHER_OIDC, DISPATCHER_OIDC_INIT, DISPATCHER_OIDC_ORGANIZATION, DISPATCHER_OIDC_ORGANIZATIONS, OIDC_GUARD,
+} from './consts.js'
+import { OIDCAuthInitParamsSchema, OIDCClientAuthPayloadSchema, OidcOrganizationSwitchSchema } from './models.js'
+import type { OidcOrganizationList } from './types.js'
 
 /** Shared OIDC browser-to-server protocols, bound by the relying-party packages. */
 export const oidcProtocols = {
@@ -13,4 +17,17 @@ export const oidcProtocols = {
     route(DISPATCHER_OIDC, '/authenticate/oidc/process', backend(null, RouteMethod.POST)),
     contract.request({ body: typed(OIDCClientAuthPayloadSchema) }, typed<any>()),
   ),
+  // The organization switch acts on the session the wrapped token names, so only that token's own
+  // guard can reach it — and it runs after the guard has refreshed the session against the
+  // provider, so the list it answers from is the provider's current one.
+  organizations: protocol(
+    route(DISPATCHER_OIDC_ORGANIZATIONS, '/authenticate/oidc/organizations', backend(null, RouteMethod.GET)),
+    contract(typed<OidcOrganizationList>()),
+    { guards: OIDC_GUARD },
+  ),
+  organization: protocol(
+    route(DISPATCHER_OIDC_ORGANIZATION, '/authenticate/oidc/organization', backend(null, RouteMethod.POST)),
+    contract.request({ body: typed(OidcOrganizationSwitchSchema) }, typed<AuthToken>()),
+    { guards: OIDC_GUARD },
+  ),
 }

package/src/guard.ts

@@ -1,10 +1,10 @@
 import { createService } from '@owlmeans/context'
-import type { Config, Context, OidcGuard, OidcGuardOptions, WrappedOIDCService } from './types.js'
+import type { Config, Context, OidcGuard, OidcGuardOptions, WrappedOIDCService, WrappedOIDCUpdate } from './types.js'
 import { OIDC_GUARD, OIDC_WRAPPED_TOKEN, WRAPPED_OIDC } from './consts.js'
 import { decorateEntrypoint, isEntrypointProtocol } from '@owlmeans/entrypoint'
 import type { AbstractRequest, AbstractResponse, EntrypointTree, GuardService } from '@owlmeans/entrypoint'
 import { DEFAULT_GUARD, TOKEN_UPDATE } from '@owlmeans/auth-common'
-import { AUTH_HEADER, type Auth, AuthToken, AuthorizationError } from '@owlmeans/auth'
+import { AUTH_HEADER, type Auth, AuthorizationError } from '@owlmeans/auth'
 import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
 import { trust } from '@owlmeans/auth-common/utils'
 import { TRUSTED } from '@owlmeans/config'
@@ -77,7 +77,7 @@ export const makeOidcGuard = (opts?: OidcGuardOptions): OidcGuard => {
 
       const token = extractAuthToken(req, OIDC_WRAPPED_TOKEN, false)!
 
-      let updated: AuthToken | null = null
+      let updated: WrappedOIDCUpdate | null = null
 
       try {
         updated = await wrapper(ctx).update({ token }, true)
@@ -94,6 +94,13 @@ export const makeOidcGuard = (opts?: OidcGuardOptions): OidcGuard => {
         return false as T
       }
 
+      // The provider names the organization this session acts in, and a relying party of a
+      // tenanted client has no registry to resolve it from by slug. `attachEntity` keeps this one
+      // only while its slug is the token's, so a stale attachment can never stand in for it.
+      if (updated.entity != null) {
+        req.entity = updated.entity
+      }
+
       if (updated.token !== token) {
         const [, newAuth] = updated.token.split(' ')
         const envelope = makeEnvelopeModel<Auth>(newAuth, EnvelopeKind.Token)

package/src/models.ts

@@ -1,12 +1,17 @@
 import type { JSONSchemaType } from 'ajv'
-import type { OIDCAuthInitParams, OIDCClientAuthPayload, OIDCTokenUpdate, ProviderProfileDetails } from './types.js'
-import { AuthTokenSchema, EntityValueSchema, IdValueSchema, ScopeValueSchema, TypeNameSchema } from '@owlmeans/auth'
+import type {
+  OIDCAuthInitParams, OIDCClientAuthPayload, OidcOrganizationSwitch, OIDCTokenUpdate, ProviderProfileDetails,
+} from './types.js'
+import {
+  AuthTokenSchema, EntitySlugValueSchema, EntityValueSchema, IdValueSchema, ScopeValueSchema, TypeNameSchema,
+} from '@owlmeans/auth'
 
 export const OIDCAuthInitParamsSchema: JSONSchemaType<OIDCAuthInitParams> = {
   type: 'object',
   properties: {
     entity: { ...EntityValueSchema, nullable: true },
     profile: { ...IdValueSchema, nullable: true },
+    entitySlug: { ...EntitySlugValueSchema, nullable: true },
   },
   required: [],
   additionalProperties: false,
@@ -22,6 +27,15 @@ export const OIDCClientAuthPayloadSchema: JSONSchemaType<OIDCClientAuthPayload>
   required: ['code', 'authUrl'],
 }
 
+export const OidcOrganizationSwitchSchema: JSONSchemaType<OidcOrganizationSwitch> = {
+  type: 'object',
+  properties: {
+    entitySlug: { ...EntitySlugValueSchema },
+  },
+  required: ['entitySlug'],
+  additionalProperties: false,
+}
+
 export const OIDCTokenUpdateSchema: JSONSchemaType<OIDCTokenUpdate> = {
   type: 'object',
   properties: {

package/src/types.ts

@@ -1,7 +1,7 @@
-import type { AuthToken } from '@owlmeans/auth'
+import type { AuthToken, PermissionSet } from '@owlmeans/auth'
 import type { AuthorizationService } from '@owlmeans/auth-common'
 import type { BasicConfig, BasicContext } from '@owlmeans/context'
-import type { GuardService } from '@owlmeans/entrypoint'
+import type { GuardService, ResolvedEntity } from '@owlmeans/entrypoint'
 
 export interface Config extends BasicConfig { }
 export interface Context<C extends Config = Config> extends BasicContext<C> { }
@@ -84,6 +84,52 @@ export interface OidcGuardOptions {
 export interface OIDCAuthInitParams {
   entity?: string
   profile?: string
+  /**
+   * The organization the person asked to act in after sign-in. Honoured only when the provider
+   * names it among the subject's organizations; otherwise the session starts in the home one.
+   */
+  entitySlug?: string
+}
+
+/** One organization of the subject, as the provider claims it under `ORGANIZATIONS_SCOPE`. */
+export interface OidcOrganizationClaim {
+  entitySlug: string
+  /**
+   * The organization's frozen IAM key — stable across renames, which is why a session remembers
+   * its acting organization by it. Server-side only: never copied into a browser token or into a
+   * response.
+   */
+  entityKey: string
+  title?: string
+  owner: boolean
+  groups?: string[]
+  home?: boolean
+}
+
+/**
+ * A permission set as the provider claims it. A set carrying `entitySlug` is bound to that
+ * organization and applies only while the session acts in it; one without applies everywhere.
+ */
+export interface OidcPermissionSetClaim extends PermissionSet {
+  entitySlug?: string
+}
+
+/** One organization of the session, as the switch lists it — the key never leaves the server. */
+export interface OidcOrganizationItem {
+  entitySlug: string
+  title?: string
+  owner: boolean
+  groups?: string[]
+  home?: boolean
+  acting: boolean
+}
+
+export interface OidcOrganizationList {
+  items: OidcOrganizationItem[]
+}
+
+export interface OidcOrganizationSwitch {
+  entitySlug: string
 }
 
 // @TODO replace arbitarary Record params with specific possible params for OIDC
@@ -92,7 +138,17 @@ export interface OIDCClientAuthPayload extends Record<string, string> {
   authUrl: string
 }
 
+/**
+ * A refreshed wrapped token, plus the organization the session acts in when the provider names
+ * one. The guard attaches that entity to the request, because a relying party of a tenanted
+ * client has no resolver of its own that could find it by slug.
+ */
+export interface WrappedOIDCUpdate extends AuthToken {
+  entity?: ResolvedEntity
+}
+
 export interface WrappedOIDCService extends AuthorizationService {
+  update: (token?: string | AuthToken, thr?: boolean) => Promise<WrappedOIDCUpdate | null>
 }
 
 export interface OIDCTokenUpdate extends AuthToken {

package/tests/entrypoints.spec.ts

@@ -0,0 +1,29 @@
+import { describe, expect, test } from 'bun:test'
+import { RouteMethod } from '@owlmeans/route'
+import { oidcProtocols } from '../src/entrypoints.js'
+import { DISPATCHER_OIDC_ORGANIZATION, DISPATCHER_OIDC_ORGANIZATIONS, OIDC_GUARD } from '../src/consts.js'
+import { OidcOrganizationSwitchSchema } from '../src/models.js'
+
+describe('oidcProtocols — organization switch', () => {
+  test('lists organizations on GET, behind the wrapped-token guard alone', () => {
+    const { organizations } = oidcProtocols
+    expect(organizations.alias).toBe(DISPATCHER_OIDC_ORGANIZATIONS)
+    expect(organizations.route.route.path).toBe('/authenticate/oidc/organizations')
+    expect(organizations.route.route.method).toBe(RouteMethod.GET)
+    expect(organizations.guards).toEqual([OIDC_GUARD])
+  })
+
+  test('switches on POST with a closed slug body, behind the same guard', () => {
+    const { organization } = oidcProtocols
+    expect(organization.alias).toBe(DISPATCHER_OIDC_ORGANIZATION)
+    expect(organization.route.route.path).toBe('/authenticate/oidc/organization')
+    expect(organization.route.route.method).toBe(RouteMethod.POST)
+    expect(organization.guards).toEqual([OIDC_GUARD])
+    expect(organization.contract?.requestSchemas.body).toEqual(OidcOrganizationSwitchSchema)
+  })
+
+  test('the sign-in pair stays unguarded', () => {
+    expect(oidcProtocols.init.guards).toEqual([])
+    expect(oidcProtocols.authenticate.guards).toEqual([])
+  })
+})

package/tests/guard.spec.ts

@@ -1,4 +1,12 @@
 import { describe, expect, mock, test } from 'bun:test'
+import { AuthRole } from '@owlmeans/auth'
+import type { Auth } from '@owlmeans/auth'
+import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
+import type { AbstractRequest, ResolvedEntity } from '@owlmeans/entrypoint'
+import type { WrappedOIDCUpdate } from '../src/types.js'
+
+/** Whether the trusted key accepts a signature — off for the undecodable-token cases. */
+let accept = false
 
 /**
  * A bearer that cannot be decoded is a credential the server does not accept — the guard answers
@@ -6,7 +14,7 @@ import { describe, expect, mock, test } from 'bun:test'
  * never throws the decoder's own error (which the API layer answers with 500).
  */
 mock.module('@owlmeans/auth-common/utils', () => ({
-  trust: async () => ({ key: { verify: async () => false } }),
+  trust: async () => ({ key: { verify: async () => accept } }),
   extractAuthToken: (req: { headers: Record<string, string> }, type: string, strip = true) => {
     const header = req.headers.authorization
     if (header == null || !header.toUpperCase().startsWith(type.toUpperCase())) return null
@@ -15,21 +23,69 @@ mock.module('@owlmeans/auth-common/utils', () => ({
 }))
 
 const { makeOidcGuard } = await import('../src/guard.js')
+const { OIDC_WRAPPED_TOKEN, WRAPPED_OIDC } = await import('../src/consts.js')
 
-const call = async (authorization: string) => {
+const call = async (authorization: string, update?: (token: string) => WrappedOIDCUpdate) => {
   const guard = makeOidcGuard() as any
-  guard.assertCtx = () => ({ cfg: { alias: 'app' } })
-  const res = { responseProvider: { header: () => undefined } }
-  return await guard.handle({ headers: { authorization } }, res)
+  guard.assertCtx = () => ({
+    cfg: { alias: 'app' },
+    hasService: (alias: string) => alias === WRAPPED_OIDC && update != null,
+    service: () => ({ update: async ({ token }: { token: string }) => update!(token) }),
+  })
+  const req = { headers: { authorization } } as unknown as AbstractRequest
+  const res = { responseProvider: { header: () => undefined }, resolve: () => undefined }
+  return { outcome: await guard.handle(req, res), req }
+}
+
+const wrapped = async (auth: Partial<Auth>): Promise<string> => {
+  const envelope = makeEnvelopeModel<Auth>(OIDC_WRAPPED_TOKEN).send({
+    type: OIDC_WRAPPED_TOKEN, token: 'session', userId: 'sub', role: AuthRole.Guest, scopes: [],
+    isUser: true, createdAt: new Date(), ...auth,
+  } as Auth, null)
+  const token = await envelope.sign({ sign: async () => 'signature' } as never, EnvelopeKind.Token)
+
+  return `${OIDC_WRAPPED_TOKEN.toUpperCase()} ${token}`
 }
 
 describe('oidc guard', () => {
   test('an undecodable wrapped token is unauthenticated, not a server error', async () => {
-    expect(await call('OIDC-WRAPPED-TOKEN bogus.token')).toBe(false)
+    accept = false
+    expect((await call('OIDC-WRAPPED-TOKEN bogus.token')).outcome).toBe(false)
   })
 
   test('garbage of every shape stays unauthenticated', async () => {
-    expect(await call('OIDC-WRAPPED-TOKEN %%%')).toBe(false)
-    expect(await call('OIDC-WRAPPED-TOKEN ')).toBe(false)
+    accept = false
+    expect((await call('OIDC-WRAPPED-TOKEN %%%')).outcome).toBe(false)
+    expect((await call('OIDC-WRAPPED-TOKEN ')).outcome).toBe(false)
+  })
+})
+
+describe('oidc guard — the acting organization', () => {
+  const acme: ResolvedEntity = { id: 'iam-key-acme', slug: 'acme', iamKey: 'iam-key-acme' }
+
+  test('attaches the entity the wrapper resolved', async () => {
+    accept = true
+    const authorization = await wrapped({ entitySlug: 'acme' })
+    const { outcome, req } = await call(authorization, token => ({ token, entity: acme }))
+
+    expect(outcome).toBe(true)
+    expect(req.entity).toEqual(acme)
+  })
+
+  test('attaches nothing when the wrapper names no organization', async () => {
+    accept = true
+    const authorization = await wrapped({ entitySlug: 'acme' })
+    const { outcome, req } = await call(authorization, token => ({ token }))
+
+    expect(outcome).toBe(true)
+    expect(req.entity).toBeUndefined()
+  })
+
+  test('without a wrapping service there is nothing to attach', async () => {
+    accept = true
+    const { outcome, req } = await call(await wrapped({ entitySlug: 'acme' }))
+
+    expect(outcome).toBe(true)
+    expect(req.entity).toBeUndefined()
   })
 })

package/tests/models.spec.ts

@@ -0,0 +1,42 @@
+import { describe, expect, test } from 'bun:test'
+import Ajv from 'ajv'
+import { OIDCAuthInitParamsSchema, OidcOrganizationSwitchSchema } from '../src/models.js'
+
+const strict = new Ajv()
+// The server's own options: a closed schema STRIPS what it does not declare instead of failing,
+// so an undeclared field would vanish without an error ever reaching the caller.
+const server = new Ajv({ removeAdditional: true, useDefaults: true, coerceTypes: true, allErrors: true, strict: false })
+
+describe('OIDCAuthInitParamsSchema', () => {
+  const validate = strict.compile(OIDCAuthInitParamsSchema)
+
+  test('accepts the requested organization next to the provider entity', () => {
+    expect(validate({ entity: 'acme-client', entitySlug: 'acme-team' })).toBe(true)
+    expect(validate({ entitySlug: 'acme-team' })).toBe(true)
+    expect(validate({})).toBe(true)
+  })
+
+  test('refuses a slug too short to name an organization', () => {
+    expect(validate({ entitySlug: 'ab' })).toBe(false)
+  })
+
+  test('stays closed to anything it does not declare', () => {
+    expect(validate({ entitySlug: 'acme-team', entityId: '0123456789abcdef01234567' })).toBe(false)
+  })
+
+  test('the server keeps the requested slug rather than stripping it', () => {
+    const body: Record<string, unknown> = { entity: 'acme-client', entitySlug: 'acme-team', stray: 'x' }
+    expect(server.compile(OIDCAuthInitParamsSchema)(body)).toBe(true)
+    expect(body).toEqual({ entity: 'acme-client', entitySlug: 'acme-team' })
+  })
+})
+
+describe('OidcOrganizationSwitchSchema', () => {
+  const validate = strict.compile(OidcOrganizationSwitchSchema)
+
+  test('names the organization by slug and nothing else', () => {
+    expect(validate({ entitySlug: 'acme-team' })).toBe(true)
+    expect(validate({})).toBe(false)
+    expect(validate({ entitySlug: 'acme-team', entityKey: 'frozen-key' })).toBe(false)
+  })
+})