@owlmeans/server-oidc-provider 0.1.16-rc.0 → 0.1.16
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +3 -4
- package/agent-meta/manifest.json +4 -11
- package/agent-meta/skills/server-oidc-provider/SKILL.md +19 -1
- package/build/service.d.ts.map +1 -1
- package/build/service.js +13 -5
- package/build/service.js.map +1 -1
- package/package.json +9 -9
- package/src/service.ts +15 -6
- package/agent-meta/instructions/server-oidc-provider.instructions.md +0 -68
package/README.md
CHANGED
|
@@ -67,10 +67,9 @@ Returns middleware that mounts the OIDC authorize/token/userinfo/jwks endpoints
|
|
|
67
67
|
<!-- owlmeans:agent-guidance:start -->
|
|
68
68
|
## Agent guidance
|
|
69
69
|
|
|
70
|
-
This package ships embedded
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
(`.claude/skills/` and `.github/instructions/`):
|
|
70
|
+
This package ships embedded agent skills under `agent-meta/`. After installing your
|
|
71
|
+
`@owlmeans/*` packages, run the OwlMeans agent-skills installer to place them into
|
|
72
|
+
your project's skill store (`.agents/skills/`):
|
|
74
73
|
|
|
75
74
|
```sh
|
|
76
75
|
npx @owlmeans/agent-skills
|
package/agent-meta/manifest.json
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
|
-
"schemaVersion":
|
|
2
|
+
"schemaVersion": 2,
|
|
3
3
|
"package": "@owlmeans/server-oidc-provider",
|
|
4
|
-
"version": "0.1.16
|
|
5
|
-
"generatedAt": "2026-08-
|
|
4
|
+
"version": "0.1.16",
|
|
5
|
+
"generatedAt": "2026-08-14T10:14:48.857Z",
|
|
6
6
|
"canonicalRepo": "https://github.com/owlmeans/common",
|
|
7
7
|
"entries": [
|
|
8
8
|
{
|
|
@@ -10,14 +10,7 @@
|
|
|
10
10
|
"name": "server-oidc-provider",
|
|
11
11
|
"category": "package-specific",
|
|
12
12
|
"file": "skills/server-oidc-provider/SKILL.md",
|
|
13
|
-
"canonicalPath": ".
|
|
14
|
-
},
|
|
15
|
-
{
|
|
16
|
-
"kind": "instruction",
|
|
17
|
-
"name": "server-oidc-provider",
|
|
18
|
-
"category": "package-specific",
|
|
19
|
-
"file": "instructions/server-oidc-provider.instructions.md",
|
|
20
|
-
"canonicalPath": ".github/instructions/server-oidc-provider.instructions.md"
|
|
13
|
+
"canonicalPath": ".agents/skills/server-oidc-provider/SKILL.md"
|
|
21
14
|
}
|
|
22
15
|
]
|
|
23
16
|
}
|
|
@@ -8,7 +8,7 @@ user-invocable: false
|
|
|
8
8
|
# @owlmeans/server-oidc-provider
|
|
9
9
|
|
|
10
10
|
**Layer:** Server
|
|
11
|
-
**Install:** `"@owlmeans/server-oidc-provider": "^0.1.16
|
|
11
|
+
**Install:** `"@owlmeans/server-oidc-provider": "^0.1.16"` in `dependencies`
|
|
12
12
|
**Runtime deps:** `oidc-provider@9.8.4` (exact), `jose@6.2.3` (exact)
|
|
13
13
|
|
|
14
14
|
## Key Exports
|
|
@@ -31,6 +31,24 @@ appendOidcProviderService<C, T>(context)
|
|
|
31
31
|
|
|
32
32
|
The service mounts the oidc-provider Koa app onto Fastify via `api.server.use(base, oidc.callback())`. It wires `findAccount`, `interactions.url`, the JWKS, and optional adapter.
|
|
33
33
|
|
|
34
|
+
## Building the interaction URL (server context, frontend route)
|
|
35
|
+
|
|
36
|
+
`interactions.url` must return the fully-qualified address of the `INTERACTION` screen, which is a
|
|
37
|
+
**frontend** route resolved from a **server** context. `call()` does not exist there — it is attached
|
|
38
|
+
only by `@owlmeans/client-entrypoint` — so the URL is assembled the way `urlCall` does it in the
|
|
39
|
+
browser: resolve the route, substitute the `INTERACTION_UID` path param, then `makeSecurityHelper().makeUrl(route, path)`
|
|
40
|
+
so the frontend service's host and base are applied. Pass the entrypoint's own `getPath()` as the
|
|
41
|
+
path and let `makeUrl` supply the base — do not prepend it twice.
|
|
42
|
+
|
|
43
|
+
## Scopes are derived from `claims`
|
|
44
|
+
|
|
45
|
+
`oidc-provider` adds every key of the `claims` configuration to the supported-scope set
|
|
46
|
+
(`collectScopes`). Declaring `claims.email` therefore makes `email` a **static** scope, and static
|
|
47
|
+
scopes are checked against each client's own `scope` allowlist: a client that omits one fails the
|
|
48
|
+
whole authorization request with `invalid_scope`. Whatever provisions clients for this provider must
|
|
49
|
+
allow every scope the RP requests (`OIDC_RP_BASE_SCOPES`), and the account service must emit the
|
|
50
|
+
matching claims — a granted scope with no claim behind it is silently empty.
|
|
51
|
+
|
|
34
52
|
## oidc-provider v9 notes (important)
|
|
35
53
|
|
|
36
54
|
- **Provider is a Koa app instance.** `oidc.use()` callbacks where the work happens *after* `await next()` will **not** fire once a route is matched — Koa's downstream does not continue past matched routes in v9. Move post-response header work (e.g. CSP rewrites) to a **Fastify `onSend`/`preHandler` hook** scoped to the OIDC base path.
|
package/build/service.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAA0C,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAS9G,eAAO,MAAM,yBAAyB,GAAI,QAAO,MAAsB,KAAG,
|
|
1
|
+
{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAA0C,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAS9G,eAAO,MAAM,yBAAyB,GAAI,QAAO,MAAsB,KAAG,mBAoGzE,CAAA;AAED,eAAO,MAAM,yBAAyB,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,EAC9E,KAAK,CAAC,EAAE,QAAO,MAAsB,KACpC,CAOF,CAAA"}
|
package/build/service.js
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
import { assertContext, createService } from '@owlmeans/context';
|
|
2
2
|
import { DEFAULT_ALIAS, OIDC_ACCOUNT_SERVICE } from './consts.js';
|
|
3
|
-
import { DEFAULT_PATH, INTERACTION } from '@owlmeans/oidc';
|
|
3
|
+
import { DEFAULT_PATH, INTERACTION, INTERACTION_UID } from '@owlmeans/oidc';
|
|
4
4
|
import Provider from 'oidc-provider';
|
|
5
|
-
import { SEP } from '@owlmeans/route';
|
|
5
|
+
import { PARAM, SEP } from '@owlmeans/route';
|
|
6
6
|
import { makeSecurityHelper } from '@owlmeans/config';
|
|
7
7
|
import { combineConfig } from './utils/config.js';
|
|
8
8
|
let _initializedOidc = undefined;
|
|
@@ -28,9 +28,17 @@ export const createOidcProviderService = (alias = DEFAULT_ALIAS) => {
|
|
|
28
28
|
},
|
|
29
29
|
interactions: {
|
|
30
30
|
url: async (_, interaction) => {
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
31
|
+
// The interaction screen is a FRONTEND route, and this is a server context — the
|
|
32
|
+
// entrypoint registered here has no `call()` (that helper is attached by
|
|
33
|
+
// `@owlmeans/client-entrypoint` only). So the URL is assembled the way `urlCall` does
|
|
34
|
+
// it in the browser: resolve the route, substitute the path params, then qualify it
|
|
35
|
+
// with the frontend service's host.
|
|
36
|
+
const entry = context.entrypoint(INTERACTION);
|
|
37
|
+
const route = await entry.route.resolve(context);
|
|
38
|
+
const path = entry.getPath().split(SEP)
|
|
39
|
+
.map(part => part === `${PARAM}${INTERACTION_UID}` ? interaction.uid : part)
|
|
40
|
+
.join(SEP);
|
|
41
|
+
return helper.makeUrl(route, path);
|
|
34
42
|
}
|
|
35
43
|
}
|
|
36
44
|
});
|
package/build/service.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;
|
|
1
|
+
{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAE3E,OAAO,QAAQ,MAAM,eAAe,CAAA;AAGpC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,IAAI,gBAAgB,GAAyB,SAAS,CAAA;AACtD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,QAAgB,aAAa,EAAuB,EAAE;IAC9F,MAAM,OAAO,GAAwB,aAAa,CAAsB,KAAK,EAAE;QAC7E,MAAM,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,EAAE,KAAK,CAAC,CAAA;YAC7E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA;YAE5B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAe,CAAA;YAC/F,MAAM,MAAM,GAAG,kBAAkB,CAAkB,OAAO,CAAC,CAAA;YAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,QAAQ,IAAI,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YACtF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;YAE5F,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE;gBAC7B,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC;gBAEzC,OAAO,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI;oBACjC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAqB,GAAG,CAAC,cAAe,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBACjF,CAAC,CAAC,SAAS;gBAEb,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE;oBACrC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAChC,GAAG,CAAC,cAAc,IAAI,oBAAoB,CAC3C,CAAA;oBAED,MAAM,QAAQ,GAAI,IAAsD,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ;2BAC1F,KAA2C,EAAE,QAAQ,CAAA;oBAE3D,OAAO,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;gBACvD,CAAC;gBAED,YAAY,EAAE;oBACZ,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE;wBAC5B,iFAAiF;wBACjF,yEAAyE;wBACzE,sFAAsF;wBACtF,oFAAoF;wBACpF,oCAAoC;wBACpC,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAmB,WAAW,CAAC,CAAA;wBAC/D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAkB,OAAO,CAAC,CAAA;wBACjE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC;6BACpC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,GAAG,KAAK,GAAG,eAAe,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;6BAC3E,IAAI,CAAC,GAAG,CAAC,CAAA;wBAEZ,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;oBACpC,CAAC;iBACF;aACF,CAAC,CAAA;YAEF,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,WAAW,IAAI,QAAQ,CAAA;YACxC,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,YAAY,CAAC,CAAA;YAEjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;YAErC,2FAA2F;YAC3F,iFAAiF;YACjF,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBAClC,OAAO,OAAO,CAAA;gBAChB,CAAC;gBACD,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAA;gBACtD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;oBAClE,KAAK,CAAC,MAAM,CAAC,yBAAyB,EAAE,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC,CAAA;gBAC7F,CAAC;gBACD,OAAO,OAAO,CAAA;YAChB,CAAC,CAAC,CAAA;YAEF,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;gBAEtD,IAAI,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE;oBAClC,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;oBACrC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;oBACzB,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAA;gBAC5C,CAAC,CAAC,CAAA;gBAEF,IAAI,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;oBACrC,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE,MAAM,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;oBAC5E,OAAO,CAAC,IAAI,CAAE,GAAG,CAAC,IAAY,CAAC,KAAK,CAAC,CAAA;oBACrC,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAA;gBAC7C,CAAC,CAAC,CAAA;gBAEF,IAAI,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;oBACvC,OAAO,CAAC,IAAI,CAAC,2BAA2B,EAAE,MAAM,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;oBAC/E,OAAO,CAAC,IAAI,CAAE,GAAG,CAAC,IAAY,CAAC,KAAK,CAAC,CAAA;oBACrC,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAA;gBAChD,CAAC,CAAC,CAAA;YAEJ,CAAC;YAED,gBAAgB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAA;QACxC,CAAC;QAED,QAAQ,EAAE,GAAG,EAAE;YACb,OAAO,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,gBAAiB,CAAC,CAAA;QAC3D,CAAC;QAED,cAAc,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE;YACzB,OAAO,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,CAAA;QAC9D,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,GAAM,EAAE,QAAgB,aAAa,EAClC,EAAE;IACL,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAA;IAChD,MAAM,OAAO,GAAG,GAAQ,CAAA;IAExB,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAEhC,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@owlmeans/server-oidc-provider",
|
|
3
|
-
"version": "0.1.16
|
|
3
|
+
"version": "0.1.16",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"scripts": {
|
|
@@ -23,7 +23,7 @@
|
|
|
23
23
|
},
|
|
24
24
|
"devDependencies": {
|
|
25
25
|
"@owlmeans/dep-config": "workspace:*",
|
|
26
|
-
"@owlmeans/context": "^0.1.16
|
|
26
|
+
"@owlmeans/context": "^0.1.16",
|
|
27
27
|
"@types/bun": "^1.3.14",
|
|
28
28
|
"@types/node": "^26.1.0",
|
|
29
29
|
"@types/oidc-provider": "9.5.0",
|
|
@@ -35,13 +35,13 @@
|
|
|
35
35
|
},
|
|
36
36
|
"dependencies": {
|
|
37
37
|
"@noble/hashes": "^1.5.0",
|
|
38
|
-
"@owlmeans/
|
|
39
|
-
"@owlmeans/
|
|
40
|
-
"@owlmeans/
|
|
41
|
-
"@owlmeans/oidc": "^0.1.16
|
|
42
|
-
"@owlmeans/route": "^0.1.16
|
|
43
|
-
"@owlmeans/server-api": "^0.1.16
|
|
44
|
-
"@owlmeans/server-context": "^0.1.16
|
|
38
|
+
"@owlmeans/config": "^0.1.16",
|
|
39
|
+
"@owlmeans/context": "^0.1.16",
|
|
40
|
+
"@owlmeans/entrypoint": "^0.1.16",
|
|
41
|
+
"@owlmeans/oidc": "^0.1.16",
|
|
42
|
+
"@owlmeans/route": "^0.1.16",
|
|
43
|
+
"@owlmeans/server-api": "^0.1.16",
|
|
44
|
+
"@owlmeans/server-context": "^0.1.16",
|
|
45
45
|
"@scure/base": "^1.1.9",
|
|
46
46
|
"jose": "6.2.3",
|
|
47
47
|
"oidc-provider": "9.8.4"
|
package/src/service.ts
CHANGED
|
@@ -1,11 +1,11 @@
|
|
|
1
1
|
import { assertContext, createService } from '@owlmeans/context'
|
|
2
2
|
import { DEFAULT_ALIAS, OIDC_ACCOUNT_SERVICE } from './consts.js'
|
|
3
|
-
import { DEFAULT_PATH, INTERACTION } from '@owlmeans/oidc'
|
|
3
|
+
import { DEFAULT_PATH, INTERACTION, INTERACTION_UID } from '@owlmeans/oidc'
|
|
4
4
|
import type { Config, Context, OidcAccountService, OidcAdapterService, OidcProviderService } from './types.js'
|
|
5
5
|
import Provider from 'oidc-provider'
|
|
6
6
|
import type { BasicRoute } from '@owlmeans/route'
|
|
7
|
-
import type {
|
|
8
|
-
import { SEP } from '@owlmeans/route'
|
|
7
|
+
import type { CommonEntrypoint } from '@owlmeans/entrypoint'
|
|
8
|
+
import { PARAM, SEP } from '@owlmeans/route'
|
|
9
9
|
import { makeSecurityHelper } from '@owlmeans/config'
|
|
10
10
|
import { combineConfig } from './utils/config.js'
|
|
11
11
|
|
|
@@ -41,9 +41,18 @@ export const createOidcProviderService = (alias: string = DEFAULT_ALIAS): OidcPr
|
|
|
41
41
|
|
|
42
42
|
interactions: {
|
|
43
43
|
url: async (_, interaction) => {
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
44
|
+
// The interaction screen is a FRONTEND route, and this is a server context — the
|
|
45
|
+
// entrypoint registered here has no `call()` (that helper is attached by
|
|
46
|
+
// `@owlmeans/client-entrypoint` only). So the URL is assembled the way `urlCall` does
|
|
47
|
+
// it in the browser: resolve the route, substitute the path params, then qualify it
|
|
48
|
+
// with the frontend service's host.
|
|
49
|
+
const entry = context.entrypoint<CommonEntrypoint>(INTERACTION)
|
|
50
|
+
const route = await entry.route.resolve<Config, Context>(context)
|
|
51
|
+
const path = entry.getPath().split(SEP)
|
|
52
|
+
.map(part => part === `${PARAM}${INTERACTION_UID}` ? interaction.uid : part)
|
|
53
|
+
.join(SEP)
|
|
54
|
+
|
|
55
|
+
return helper.makeUrl(route, path)
|
|
47
56
|
}
|
|
48
57
|
}
|
|
49
58
|
})
|
|
@@ -1,68 +0,0 @@
|
|
|
1
|
-
---
|
|
2
|
-
description: "How to use @owlmeans/server-oidc-provider — embedded OIDC identity provider built on the oidc-provider library."
|
|
3
|
-
applyTo: "**/*.ts, **/*.tsx"
|
|
4
|
-
---
|
|
5
|
-
<!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
|
|
6
|
-
|
|
7
|
-
# @owlmeans/server-oidc-provider
|
|
8
|
-
|
|
9
|
-
**Layer:** Server
|
|
10
|
-
**Install:** `"@owlmeans/server-oidc-provider": "^0.1.16-rc.0"` in `dependencies`
|
|
11
|
-
|
|
12
|
-
## Key Exports
|
|
13
|
-
|
|
14
|
-
| Export | Description |
|
|
15
|
-
|--------|-------------|
|
|
16
|
-
| `makeOidcProviderService()` | Factory for the OIDC provider service |
|
|
17
|
-
| Middleware | OIDC endpoints |
|
|
18
|
-
| Constants | Endpoint paths, default scopes |
|
|
19
|
-
| `OidcProvider` types | Provider config shape |
|
|
20
|
-
|
|
21
|
-
## Usage
|
|
22
|
-
|
|
23
|
-
```typescript
|
|
24
|
-
import { makeOidcProviderService } from '@owlmeans/server-oidc-provider'
|
|
25
|
-
context.registerService(makeOidcProviderService())
|
|
26
|
-
```
|
|
27
|
-
|
|
28
|
-
For consuming an external IdP instead, use `@owlmeans/server-oidc-rp`.
|
|
29
|
-
|
|
30
|
-
## Permissions claim seam (integrated IAM)
|
|
31
|
-
|
|
32
|
-
- `findAccount` threads the requesting `clientId` into `OidcAccountService.loadById(ctx, id, { clientId })`
|
|
33
|
-
(`OidcAccountParams`) so the account service can scope claims per client.
|
|
34
|
-
- `combineConfig` registers the `permissions` scope and the `permissions → [permissions]` claim mapping
|
|
35
|
-
by default (consts from `@owlmeans/oidc`); this is inert unless the account service emits the claim.
|
|
36
|
-
- To mint the claim into the id_token set `customConfiguration.conformIdTokenClaims: false` and return
|
|
37
|
-
`permissions: PermissionSet[]` from the account's `claims()` when the scope includes `permissions`.
|
|
38
|
-
|
|
39
|
-
## `behindProxy` — set it explicitly behind a TLS-terminating proxy
|
|
40
|
-
|
|
41
|
-
`oidc.proxy = cfg.behindProxy ?? unsecure` (`service.ts`), where `unsecure` is true only when the
|
|
42
|
-
computed issuer is **not** https. So the default trusts `X-Forwarded-*` exactly when it shouldn't and
|
|
43
|
-
distrusts it when it must: behind an ingress that terminates TLS, the provider ignores
|
|
44
|
-
`X-Forwarded-Proto` and advertises **`http://`** `authorization_endpoint` / `token_endpoint` /
|
|
45
|
-
`jwks_uri` / `userinfo_endpoint` under an `https://` issuer, downgrading every relying party mid-flow
|
|
46
|
-
(a mismatch that is easy to miss because the `issuer` field itself looks correct).
|
|
47
|
-
|
|
48
|
-
**Any deployment behind a reverse proxy must set `cfg.oidc.behindProxy = true`.** It is the only
|
|
49
|
-
reverse-proxy knob in the package — there is no `trustProxy`. Trusting the header is a no-op when no
|
|
50
|
-
proxy sets it, so it is safe to enable wherever the pod is only reachable through the gateway.
|
|
51
|
-
|
|
52
|
-
Verify with the discovery document — every endpoint must share the issuer's scheme:
|
|
53
|
-
|
|
54
|
-
```bash
|
|
55
|
-
curl -s https://<host>/oidc/.well-known/openid-configuration | jq '{issuer, authorization_endpoint, token_endpoint}'
|
|
56
|
-
```
|
|
57
|
-
|
|
58
|
-
## Issuer construction — mind `{ base: true }`
|
|
59
|
-
|
|
60
|
-
The issuer is `makeUrl(services[cfg.authService ?? cfg.service], cfg.basePath ?? DEFAULT_PATH,
|
|
61
|
-
{ base: true })`. The `{ base: true }` **drops the service route's own `base` segment**; the
|
|
62
|
-
`server-oidc-rp` fallback path (`service` + `basePath`) does not pass it. Any code that needs to
|
|
63
|
-
reproduce this issuer (e.g. an IAM adapter reporting it to consumers) must use the identical call —
|
|
64
|
-
`openid-client` compares the two strings and fails discovery on any difference.
|
|
65
|
-
|
|
66
|
-
## Depends On
|
|
67
|
-
|
|
68
|
-
- `@owlmeans/oidc`, `@owlmeans/server-api`, `@owlmeans/server-context`, `oidc-provider`
|