@owlmeans/oidc 0.1.18-rc.55 → 0.1.18-rc.56

package/README.md

@@ -12,7 +12,7 @@ Shared OIDC protocol abstractions — guard/gate aliases, models, and immutable
 ## Installation
 
 ```bash
-bun add @owlmeans/oidc@^0.1.18-rc.55
+bun add @owlmeans/oidc@^0.1.18-rc.56
 ```
 
 ## Usage
@@ -95,7 +95,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.49
+npx @owlmeans/agent-skills@^0.1.18-rc.51
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/oidc",
-  "version": "0.1.18-rc.55",
-  "generatedAt": "2026-10-05T21:03:06.392Z",
+  "version": "0.1.18-rc.56",
+  "generatedAt": "2026-10-06T11:45:57.664Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/oidc/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/oidc
 
 **Layer:** Core
-**Install:** `"@owlmeans/oidc": "^0.1.18-rc.55"` in `dependencies`
+**Install:** `"@owlmeans/oidc": "^0.1.18-rc.56"` in `dependencies`
 
 The shared half of the OIDC stack: no transport, no library. It owns the names, the shapes and the
 guard that the server relying party (`@owlmeans/server-oidc-rp`), the browser relying party

package/build/iam.d.ts

@@ -0,0 +1,6 @@
+/** IAM-mode extension for OIDC shared config — lets IAM_MODE flow through standard config.
+ *  Uses a string union to avoid a circular dep with @owlmeans/iam (which depends on @owlmeans/oidc). */
+export interface OidcIamConfig {
+    iamMode?: 'keycloak' | 'integrated';
+}
+//# sourceMappingURL=iam.d.ts.map

package/build/iam.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iam.d.ts","sourceRoot":"","sources":["../src/iam.ts"],"names":[],"mappings":"AAAA;wGACwG;AACxG,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,EAAE,UAAU,GAAG,YAAY,CAAA;CACpC"}

package/build/iam.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=iam.js.map

package/build/iam.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iam.js","sourceRoot":"","sources":["../src/iam.ts"],"names":[],"mappings":""}

package/build/models.d.ts

@@ -0,0 +1,8 @@
+import type { JSONSchemaType } from 'ajv';
+import type { OIDCAuthInitParams, OIDCClientAuthPayload, OidcOrganizationSwitch, OIDCTokenUpdate, ProviderProfileDetails } from './types.js';
+export declare const OIDCAuthInitParamsSchema: JSONSchemaType<OIDCAuthInitParams>;
+export declare const OIDCClientAuthPayloadSchema: JSONSchemaType<OIDCClientAuthPayload>;
+export declare const OidcOrganizationSwitchSchema: JSONSchemaType<OidcOrganizationSwitch>;
+export declare const OIDCTokenUpdateSchema: JSONSchemaType<OIDCTokenUpdate>;
+export declare const ProviderProfileDetailsSchema: JSONSchemaType<ProviderProfileDetails>;
+//# sourceMappingURL=models.d.ts.map

package/build/models.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../src/models.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,KAAK,CAAA;AACzC,OAAO,KAAK,EACV,kBAAkB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,eAAe,EAAE,sBAAsB,EAC3G,MAAM,YAAY,CAAA;AAKnB,eAAO,MAAM,wBAAwB,EAAE,cAAc,CAAC,kBAAkB,CASvE,CAAA;AAED,eAAO,MAAM,2BAA2B,EAAE,cAAc,CAAC,qBAAqB,CAQ7E,CAAA;AAED,eAAO,MAAM,4BAA4B,EAAE,cAAc,CAAC,sBAAsB,CAO/E,CAAA;AAED,eAAO,MAAM,qBAAqB,EAAE,cAAc,CAAC,eAAe,CAqBjE,CAAA;AAED,eAAO,MAAM,4BAA4B,EAAE,cAAc,CAAC,sBAAsB,CAe/E,CAAA"}

package/build/models.js

@@ -0,0 +1,67 @@
+import { AuthTokenSchema, EntitySlugValueSchema, EntityValueSchema, IdValueSchema, ScopeValueSchema, TypeNameSchema, } from '@owlmeans/auth';
+export const OIDCAuthInitParamsSchema = {
+    type: 'object',
+    properties: {
+        entity: { ...EntityValueSchema, nullable: true },
+        profile: { ...IdValueSchema, nullable: true },
+        entitySlug: { ...EntitySlugValueSchema, nullable: true },
+    },
+    required: [],
+    additionalProperties: false,
+};
+export const OIDCClientAuthPayloadSchema = {
+    type: 'object',
+    properties: {
+        code: { type: 'string', minLength: 16, maxLength: 512 },
+        authUrl: { type: 'string', minLength: 0, maxLength: 1024, format: 'uri' },
+    },
+    additionalProperties: { type: 'string', minLength: 0, maxLength: 512 },
+    required: ['code', 'authUrl'],
+};
+export const OidcOrganizationSwitchSchema = {
+    type: 'object',
+    properties: {
+        entitySlug: { ...EntitySlugValueSchema },
+    },
+    required: ['entitySlug'],
+    additionalProperties: false,
+};
+export const OIDCTokenUpdateSchema = {
+    type: 'object',
+    properties: {
+        ...AuthTokenSchema.properties,
+        tokenSet: {
+            type: 'object',
+            properties: {
+                access_token: { type: 'string', nullable: true },
+                token_type: { type: 'string', nullable: true },
+                id_token: { type: 'string', nullable: true },
+                refresh_token: { type: 'string', nullable: true },
+                scope: { type: 'string', nullable: true },
+                expires_at: { type: 'number', nullable: true },
+                session_state: { type: 'string', nullable: true }
+            },
+            required: [],
+            additionalProperties: true,
+        }
+    },
+    required: ['token', 'tokenSet'],
+    additionalProperties: false
+};
+export const ProviderProfileDetailsSchema = {
+    type: 'object',
+    properties: {
+        type: { ...TypeNameSchema },
+        service: { ...ScopeValueSchema },
+        clientId: { ...ScopeValueSchema },
+        userId: { ...IdValueSchema },
+        profileId: { ...IdValueSchema, nullable: true },
+        username: { type: 'string', minLength: 1, maxLength: 255, nullable: true },
+        entityId: { ...EntityValueSchema, nullable: true },
+        did: { ...IdValueSchema, nullable: true },
+        isOwlMeansId: { type: 'boolean', nullable: true }
+    },
+    required: ['type', 'service', 'clientId', 'userId'],
+    additionalProperties: false
+};
+//# sourceMappingURL=models.js.map

package/build/models.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.js","sourceRoot":"","sources":["../src/models.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,eAAe,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,aAAa,EAAE,gBAAgB,EAAE,cAAc,GAC3G,MAAM,gBAAgB,CAAA;AAEvB,MAAM,CAAC,MAAM,wBAAwB,GAAuC;IAC1E,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,MAAM,EAAE,EAAE,GAAG,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE;QAChD,OAAO,EAAE,EAAE,GAAG,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC7C,UAAU,EAAE,EAAE,GAAG,qBAAqB,EAAE,QAAQ,EAAE,IAAI,EAAE;KACzD;IACD,QAAQ,EAAE,EAAE;IACZ,oBAAoB,EAAE,KAAK;CAC5B,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAA0C;IAChF,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE;QACvD,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;KAC1E;IACD,oBAAoB,EAAE,EAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAC;IACpE,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;CAC9B,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAA2C;IAClF,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,UAAU,EAAE,EAAE,GAAG,qBAAqB,EAAE;KACzC;IACD,QAAQ,EAAE,CAAC,YAAY,CAAC;IACxB,oBAAoB,EAAE,KAAK;CAC5B,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAoC;IACpE,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,GAAG,eAAe,CAAC,UAAU;QAC7B,QAAQ,EAAE;YACR,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAChD,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC9C,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC5C,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACjD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACzC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC9C,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;aAClD;YACD,QAAQ,EAAE,EAAE;YACZ,oBAAoB,EAAE,IAAI;SAC3B;KACF;IACD,QAAQ,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC;IAC/B,oBAAoB,EAAE,KAAK;CAC5B,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAA2C;IAClF,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,GAAG,cAAc,EAAE;QAC3B,OAAO,EAAE,EAAE,GAAG,gBAAgB,EAAE;QAChC,QAAQ,EAAE,EAAE,GAAG,gBAAgB,EAAE;QACjC,MAAM,EAAE,EAAE,GAAG,aAAa,EAAE;QAC5B,SAAS,EAAE,EAAC,GAAG,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC9C,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC1E,QAAQ,EAAE,EAAE,GAAG,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE;QAClD,GAAG,EAAE,EAAE,GAAG,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE;QACzC,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;KAClD;IACD,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC;IACnD,oBAAoB,EAAE,KAAK;CAC5B,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/oidc",
-  "version": "0.1.18-rc.55",
+  "version": "0.1.18-rc.56",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -22,8 +22,8 @@
   },
   "dependencies": {
     "@owlmeans/auth": "^0.1.18-rc.40",
-    "@owlmeans/auth-common": "^0.1.18-rc.47",
-    "@owlmeans/basic-envelope": "^0.1.18-rc.46",
+    "@owlmeans/auth-common": "^0.1.18-rc.48",
+    "@owlmeans/basic-envelope": "^0.1.18-rc.47",
     "@owlmeans/config": "^0.1.18-rc.44",
     "@owlmeans/context": "^0.1.18-rc.34",
     "@owlmeans/entrypoint": "^0.1.18-rc.41",

package/tests/guard.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=guard.spec.d.ts.map

package/tests/guard.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.spec.d.ts","sourceRoot":"","sources":["guard.spec.ts"],"names":[],"mappings":""}

package/tests/guard.spec.js

@@ -0,0 +1,32 @@
+import { describe, expect, mock, test } from 'bun:test';
+/**
+ * A bearer that cannot be decoded is a credential the server does not accept — the guard answers
+ * "not authenticated" (the API layer's 401), exactly as for a signature that does not verify, and
+ * never throws the decoder's own error (which the API layer answers with 500).
+ */
+mock.module('@owlmeans/auth-common/utils', () => ({
+    trust: async () => ({ key: { verify: async () => false } }),
+    extractAuthToken: (req, type, strip = true) => {
+        const header = req.headers.authorization;
+        if (header == null || !header.toUpperCase().startsWith(type.toUpperCase()))
+            return null;
+        return strip ? header.split(' ')[1] : header;
+    },
+}));
+const { makeOidcGuard } = await import('../src/guard.js');
+const call = async (authorization) => {
+    const guard = makeOidcGuard();
+    guard.assertCtx = () => ({ cfg: { alias: 'app' } });
+    const res = { responseProvider: { header: () => undefined } };
+    return await guard.handle({ headers: { authorization } }, res);
+};
+describe('oidc guard', () => {
+    test('an undecodable wrapped token is unauthenticated, not a server error', async () => {
+        expect(await call('OIDC-WRAPPED-TOKEN bogus.token')).toBe(false);
+    });
+    test('garbage of every shape stays unauthenticated', async () => {
+        expect(await call('OIDC-WRAPPED-TOKEN %%%')).toBe(false);
+        expect(await call('OIDC-WRAPPED-TOKEN ')).toBe(false);
+    });
+});
+//# sourceMappingURL=guard.spec.js.map

package/tests/guard.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.spec.js","sourceRoot":"","sources":["guard.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAEvD;;;;GAIG;AACH,IAAI,CAAC,MAAM,CAAC,6BAA6B,EAAE,GAAG,EAAE,CAAC,CAAC;IAChD,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;IAC3D,gBAAgB,EAAE,CAAC,GAAwC,EAAE,IAAY,EAAE,KAAK,GAAG,IAAI,EAAE,EAAE;QACzF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAA;QACxC,IAAI,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,IAAI,CAAA;QACvF,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;IAC9C,CAAC;CACF,CAAC,CAAC,CAAA;AAEH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAA;AAEzD,MAAM,IAAI,GAAG,KAAK,EAAE,aAAqB,EAAE,EAAE;IAC3C,MAAM,KAAK,GAAG,aAAa,EAAS,CAAA;IACpC,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;IACnD,MAAM,GAAG,GAAG,EAAE,gBAAgB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,EAAE,CAAA;IAC7D,OAAO,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;AAChE,CAAC,CAAA;AAED,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,IAAI,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,CAAC,MAAM,IAAI,CAAC,gCAAgC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,CAAC,MAAM,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACxD,MAAM,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}