@owlmeans/server-oidc-provider 0.1.11 → 0.1.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -7,7 +7,7 @@ applyTo: "**/*.ts, **/*.tsx"
|
|
|
7
7
|
# @owlmeans/server-oidc-provider
|
|
8
8
|
|
|
9
9
|
**Layer:** Server
|
|
10
|
-
**Install:** `"@owlmeans/server-oidc-provider": "^0.1.
|
|
10
|
+
**Install:** `"@owlmeans/server-oidc-provider": "^0.1.14"` in `dependencies`
|
|
11
11
|
|
|
12
12
|
## Key Exports
|
|
13
13
|
|
|
@@ -36,6 +36,33 @@ For consuming an external IdP instead, use `@owlmeans/server-oidc-rp`.
|
|
|
36
36
|
- To mint the claim into the id_token set `customConfiguration.conformIdTokenClaims: false` and return
|
|
37
37
|
`permissions: PermissionSet[]` from the account's `claims()` when the scope includes `permissions`.
|
|
38
38
|
|
|
39
|
+
## `behindProxy` — set it explicitly behind a TLS-terminating proxy
|
|
40
|
+
|
|
41
|
+
`oidc.proxy = cfg.behindProxy ?? unsecure` (`service.ts`), where `unsecure` is true only when the
|
|
42
|
+
computed issuer is **not** https. So the default trusts `X-Forwarded-*` exactly when it shouldn't and
|
|
43
|
+
distrusts it when it must: behind an ingress that terminates TLS, the provider ignores
|
|
44
|
+
`X-Forwarded-Proto` and advertises **`http://`** `authorization_endpoint` / `token_endpoint` /
|
|
45
|
+
`jwks_uri` / `userinfo_endpoint` under an `https://` issuer, downgrading every relying party mid-flow
|
|
46
|
+
(a mismatch that is easy to miss because the `issuer` field itself looks correct).
|
|
47
|
+
|
|
48
|
+
**Any deployment behind a reverse proxy must set `cfg.oidc.behindProxy = true`.** It is the only
|
|
49
|
+
reverse-proxy knob in the package — there is no `trustProxy`. Trusting the header is a no-op when no
|
|
50
|
+
proxy sets it, so it is safe to enable wherever the pod is only reachable through the gateway.
|
|
51
|
+
|
|
52
|
+
Verify with the discovery document — every endpoint must share the issuer's scheme:
|
|
53
|
+
|
|
54
|
+
```bash
|
|
55
|
+
curl -s https://<host>/oidc/.well-known/openid-configuration | jq '{issuer, authorization_endpoint, token_endpoint}'
|
|
56
|
+
```
|
|
57
|
+
|
|
58
|
+
## Issuer construction — mind `{ base: true }`
|
|
59
|
+
|
|
60
|
+
The issuer is `makeUrl(services[cfg.authService ?? cfg.service], cfg.basePath ?? DEFAULT_PATH,
|
|
61
|
+
{ base: true })`. The `{ base: true }` **drops the service route's own `base` segment**; the
|
|
62
|
+
`server-oidc-rp` fallback path (`service` + `basePath`) does not pass it. Any code that needs to
|
|
63
|
+
reproduce this issuer (e.g. an IAM adapter reporting it to consumers) must use the identical call —
|
|
64
|
+
`openid-client` compares the two strings and fails discovery on any difference.
|
|
65
|
+
|
|
39
66
|
## Depends On
|
|
40
67
|
|
|
41
68
|
- `@owlmeans/oidc`, `@owlmeans/server-api`, `@owlmeans/server-context`, `oidc-provider`
|
package/agent-meta/manifest.json
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schemaVersion": 1,
|
|
3
3
|
"package": "@owlmeans/server-oidc-provider",
|
|
4
|
-
"version": "0.1.
|
|
5
|
-
"generatedAt": "2026-
|
|
4
|
+
"version": "0.1.14",
|
|
5
|
+
"generatedAt": "2026-08-05T16:56:53.386Z",
|
|
6
6
|
"canonicalRepo": "https://github.com/owlmeans/common",
|
|
7
7
|
"entries": [
|
|
8
8
|
{
|
|
@@ -8,7 +8,7 @@ user-invocable: false
|
|
|
8
8
|
# @owlmeans/server-oidc-provider
|
|
9
9
|
|
|
10
10
|
**Layer:** Server
|
|
11
|
-
**Install:** `"@owlmeans/server-oidc-provider": "^0.1.
|
|
11
|
+
**Install:** `"@owlmeans/server-oidc-provider": "^0.1.14"` in `dependencies`
|
|
12
12
|
**Runtime deps:** `oidc-provider@9.8.4` (exact), `jose@6.2.3` (exact)
|
|
13
13
|
|
|
14
14
|
## Key Exports
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@owlmeans/server-oidc-provider",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.14",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"scripts": {
|
|
@@ -23,26 +23,25 @@
|
|
|
23
23
|
},
|
|
24
24
|
"devDependencies": {
|
|
25
25
|
"@owlmeans/dep-config": "workspace:*",
|
|
26
|
-
"@owlmeans/context": "^0.1.
|
|
27
|
-
"@types/bun": "^1.3.
|
|
28
|
-
"@types/node": "^
|
|
26
|
+
"@owlmeans/context": "^0.1.14",
|
|
27
|
+
"@types/bun": "^1.3.14",
|
|
28
|
+
"@types/node": "^26.1.0",
|
|
29
29
|
"@types/oidc-provider": "9.5.0",
|
|
30
|
-
"nodemon": "^3.1.
|
|
31
|
-
"
|
|
32
|
-
"typescript": "^6.0.2"
|
|
30
|
+
"nodemon": "^3.1.14",
|
|
31
|
+
"typescript": "^6.0.3"
|
|
33
32
|
},
|
|
34
33
|
"peerDependencies": {
|
|
35
34
|
"fastify": "*"
|
|
36
35
|
},
|
|
37
36
|
"dependencies": {
|
|
38
37
|
"@noble/hashes": "^1.5.0",
|
|
39
|
-
"@owlmeans/client-entrypoint": "^0.1.
|
|
40
|
-
"@owlmeans/config": "^0.1.
|
|
41
|
-
"@owlmeans/context": "^0.1.
|
|
42
|
-
"@owlmeans/oidc": "^0.1.
|
|
43
|
-
"@owlmeans/route": "^0.1.
|
|
44
|
-
"@owlmeans/server-api": "^0.1.
|
|
45
|
-
"@owlmeans/server-context": "^0.1.
|
|
38
|
+
"@owlmeans/client-entrypoint": "^0.1.14",
|
|
39
|
+
"@owlmeans/config": "^0.1.14",
|
|
40
|
+
"@owlmeans/context": "^0.1.14",
|
|
41
|
+
"@owlmeans/oidc": "^0.1.14",
|
|
42
|
+
"@owlmeans/route": "^0.1.14",
|
|
43
|
+
"@owlmeans/server-api": "^0.1.14",
|
|
44
|
+
"@owlmeans/server-context": "^0.1.14",
|
|
46
45
|
"@scure/base": "^1.1.9",
|
|
47
46
|
"jose": "6.2.3",
|
|
48
47
|
"oidc-provider": "9.8.4"
|