@owlmeans/oidc 0.1.18-rc.52 → 0.1.18-rc.53

package/README.md

@@ -12,7 +12,7 @@ Shared OIDC protocol abstractions — guard/gate aliases, models, and immutable
 ## Installation
 
 ```bash
-bun add @owlmeans/oidc@^0.1.18-rc.52
+bun add @owlmeans/oidc@^0.1.18-rc.53
 ```
 
 ## Usage
@@ -95,7 +95,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.46
+npx @owlmeans/agent-skills@^0.1.18-rc.47
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/oidc",
-  "version": "0.1.18-rc.52",
-  "generatedAt": "2026-10-03T11:19:50.782Z",
+  "version": "0.1.18-rc.53",
+  "generatedAt": "2026-10-03T20:05:07.594Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/oidc/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/oidc
 
 **Layer:** Core
-**Install:** `"@owlmeans/oidc": "^0.1.18-rc.52"` in `dependencies`
+**Install:** `"@owlmeans/oidc": "^0.1.18-rc.53"` in `dependencies`
 
 The shared half of the OIDC stack: no transport, no library. It owns the names, the shapes and the
 guard that the server relying party (`@owlmeans/server-oidc-rp`), the browser relying party

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/oidc",
-  "version": "0.1.18-rc.52",
+  "version": "0.1.18-rc.53",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -22,12 +22,12 @@
   },
   "dependencies": {
     "@owlmeans/auth": "^0.1.18-rc.38",
-    "@owlmeans/auth-common": "^0.1.18-rc.44",
-    "@owlmeans/basic-envelope": "^0.1.18-rc.43",
-    "@owlmeans/config": "^0.1.18-rc.41",
+    "@owlmeans/auth-common": "^0.1.18-rc.45",
+    "@owlmeans/basic-envelope": "^0.1.18-rc.44",
+    "@owlmeans/config": "^0.1.18-rc.42",
     "@owlmeans/context": "^0.1.18-rc.32",
     "@owlmeans/entrypoint": "^0.1.18-rc.39",
-    "@owlmeans/resource": "^0.1.18-rc.37",
+    "@owlmeans/resource": "^0.1.18-rc.38",
     "@owlmeans/route": "^0.1.18-rc.33"
   },
   "peerDependencies": {

package/tests/guard.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=guard.spec.d.ts.map

package/tests/guard.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.spec.d.ts","sourceRoot":"","sources":["guard.spec.ts"],"names":[],"mappings":""}

package/tests/guard.spec.js

@@ -0,0 +1,32 @@
+import { describe, expect, mock, test } from 'bun:test';
+/**
+ * A bearer that cannot be decoded is a credential the server does not accept — the guard answers
+ * "not authenticated" (the API layer's 401), exactly as for a signature that does not verify, and
+ * never throws the decoder's own error (which the API layer answers with 500).
+ */
+mock.module('@owlmeans/auth-common/utils', () => ({
+    trust: async () => ({ key: { verify: async () => false } }),
+    extractAuthToken: (req, type, strip = true) => {
+        const header = req.headers.authorization;
+        if (header == null || !header.toUpperCase().startsWith(type.toUpperCase()))
+            return null;
+        return strip ? header.split(' ')[1] : header;
+    },
+}));
+const { makeOidcGuard } = await import('../src/guard.js');
+const call = async (authorization) => {
+    const guard = makeOidcGuard();
+    guard.assertCtx = () => ({ cfg: { alias: 'app' } });
+    const res = { responseProvider: { header: () => undefined } };
+    return await guard.handle({ headers: { authorization } }, res);
+};
+describe('oidc guard', () => {
+    test('an undecodable wrapped token is unauthenticated, not a server error', async () => {
+        expect(await call('OIDC-WRAPPED-TOKEN bogus.token')).toBe(false);
+    });
+    test('garbage of every shape stays unauthenticated', async () => {
+        expect(await call('OIDC-WRAPPED-TOKEN %%%')).toBe(false);
+        expect(await call('OIDC-WRAPPED-TOKEN ')).toBe(false);
+    });
+});
+//# sourceMappingURL=guard.spec.js.map

package/tests/guard.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.spec.js","sourceRoot":"","sources":["guard.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAEvD;;;;GAIG;AACH,IAAI,CAAC,MAAM,CAAC,6BAA6B,EAAE,GAAG,EAAE,CAAC,CAAC;IAChD,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;IAC3D,gBAAgB,EAAE,CAAC,GAAwC,EAAE,IAAY,EAAE,KAAK,GAAG,IAAI,EAAE,EAAE;QACzF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAA;QACxC,IAAI,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,IAAI,CAAA;QACvF,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;IAC9C,CAAC;CACF,CAAC,CAAC,CAAA;AAEH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAA;AAEzD,MAAM,IAAI,GAAG,KAAK,EAAE,aAAqB,EAAE,EAAE;IAC3C,MAAM,KAAK,GAAG,aAAa,EAAS,CAAA;IACpC,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;IACnD,MAAM,GAAG,GAAG,EAAE,gBAAgB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,EAAE,CAAA;IAC7D,OAAO,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;AAChE,CAAC,CAAA;AAED,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,IAAI,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,CAAC,MAAM,IAAI,CAAC,gCAAgC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,CAAC,MAAM,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACxD,MAAM,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}