@owlmeans/server-oidc-provider 0.1.18-rc.41 → 0.1.18-rc.43

package/README.md

@@ -14,7 +14,7 @@ Embedded OIDC identity provider — wraps the `oidc-provider` library as an OwlM
 ## Installation
 
 ```bash
-bun add @owlmeans/server-oidc-provider@^0.1.18-rc.41
+bun add @owlmeans/server-oidc-provider@^0.1.18-rc.43
 ```
 
 ## Usage
@@ -72,7 +72,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.39
+npx @owlmeans/agent-skills@^0.1.18-rc.41
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-oidc-provider",
-  "version": "0.1.18-rc.41",
-  "generatedAt": "2026-09-24T14:00:35.072Z",
+  "version": "0.1.18-rc.43",
+  "generatedAt": "2026-09-28T02:06:37.889Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-oidc-provider/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/server-oidc-provider
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-oidc-provider": "^0.1.18-rc.41"` in `dependencies`
+**Install:** `"@owlmeans/server-oidc-provider": "^0.1.18-rc.43"` in `dependencies`
 **Runtime deps:** `oidc-provider@9.11.1` (exact), `jose@6.2.5` (exact), `@types/oidc-provider@9.5.0`
 
 Use this only when your service **is** the identity provider. For consuming someone else's issuer,
@@ -102,6 +102,25 @@ const key = await jose.importPKCS8(pkcs8Pem, 'RS256', { extractable: true })
 const jwk = await jose.exportJWK(key)
 ```
 
+## A refused account is a login, not a crash
+
+`loadById` answering `undefined` refuses an account (another organization's subject, a disabled or
+expired profile). The provider does not treat that as "not logged in": its `no_session` check reads
+the raw `session.accountId`, so the login prompt is skipped, `loadGrant` builds no grant for an
+unloaded account, and the consent prompt throws `TypeError … oidc.grant.getOIDCScopeEncountered` — the
+relying party gets `server_error` / "oops! something went wrong".
+
+The service therefore installs `makeInteractionPolicy()` (`src/utils/policy.ts`) as
+`interactions.policy`: the provider's default policy plus an `account_refused` check on the login
+prompt that requests a login whenever the session names an account the provider could not load. After
+that login the provider's resume step signs the stale session out and continues the interrupted
+request. A login that has just completed and is refused again (`oidc.result.login`) throws
+`access_denied` instead of prompting, so a refusal can never loop. A consumer's own
+`customConfiguration.interactions` is not merged — the service sets `policy` and `url` itself.
+`tests/policy.spec.ts` drives a real provider through the whole sequence, including the upstream
+crash as a canary: when a bump of `oidc-provider` makes that first test fail, the upstream fixed it
+and the check may go.
+
 ## Response headers the hardened defaults get wrong
 
 `@fastify/helmet` runs with its defaults on every OwlMeans server, and two of them break an

package/build/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAA0C,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAS9G,eAAO,MAAM,yBAAyB,WAAW,MAAM,KAAmB,mBAoHzE,CAAA;AAED,eAAO,MAAM,yBAAyB,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,OACzE,CAAC,UAAS,MAAM,KACpB,CAOF,CAAA"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAA0C,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAU9G,eAAO,MAAM,yBAAyB,WAAW,MAAM,KAAmB,mBAqHzE,CAAA;AAED,eAAO,MAAM,yBAAyB,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,OACzE,CAAC,UAAS,MAAM,KACpB,CAOF,CAAA"}

package/build/service.js

@@ -5,6 +5,7 @@ import Provider from 'oidc-provider';
 import { PARAM, SEP } from '@owlmeans/route';
 import { makeSecurityHelper } from '@owlmeans/config';
 import { combineConfig } from './utils/config.js';
+import { makeInteractionPolicy } from './utils/policy.js';
 let _initializedOidc = undefined;
 export const createOidcProviderService = (alias = DEFAULT_ALIAS) => {
     const service = createService(alias, {
@@ -27,6 +28,7 @@ export const createOidcProviderService = (alias = DEFAULT_ALIAS) => {
                     return accountSrv.loadById(context, id, { clientId });
                 },
                 interactions: {
+                    policy: makeInteractionPolicy(),
                     url: async (_, interaction) => {
                         // The interaction screen is a FRONTEND route, and this is a server context — the
                         // entrypoint registered here has no `url()` (that helper is attached by

package/build/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAG3E,OAAO,QAAQ,MAAM,eAAe,CAAA;AAGpC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,IAAI,gBAAgB,GAAyB,SAAS,CAAA;AACtD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,KAAK,GAAW,aAAa,EAAuB,EAAE;IAC9F,MAAM,OAAO,GAAwB,aAAa,CAAsB,KAAK,EAAE;QAC7E,MAAM,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,EAAE,KAAK,CAAC,CAAA;YAC7E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA;YAE5B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAe,CAAA;YAC/F,MAAM,MAAM,GAAG,kBAAkB,CAAkB,OAAO,CAAC,CAAA;YAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,QAAQ,IAAI,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YACtF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;YAE5F,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE;gBAC7B,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC;gBAEzC,OAAO,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI;oBACjC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAqB,GAAG,CAAC,cAAe,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBACjF,CAAC,CAAC,SAAS;gBAEb,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE;oBACrC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAChC,GAAG,CAAC,cAAc,IAAI,oBAAoB,CAC3C,CAAA;oBAED,MAAM,QAAQ,GAAI,IAAsD,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ;2BAC1F,KAA2C,EAAE,QAAQ,CAAA;oBAE3D,OAAO,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;gBACvD,CAAC;gBAED,YAAY,EAAE;oBACZ,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE;wBAC5B,iFAAiF;wBACjF,wEAAwE;wBACxE,uFAAuF;wBACvF,uFAAuF;wBACvF,sFAAsF;wBACtF,cAAc;wBACd,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAmB,WAAW,CAAC,CAAA;wBAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC;6BACjC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,GAAG,KAAK,GAAG,eAAe,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;6BAC3E,IAAI,CAAC,GAAG,CAAC,CAAA;wBAEZ,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAA;oBAC9C,CAAC;iBACF;aACF,CAAC,CAAA;YAEF,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,WAAW,IAAI,QAAQ,CAAA;YACxC,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,YAAY,CAAC,CAAA;YAEjD;;;;;;;;;;eAUG;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAa,EAAE,GAAmB,EAAE,IAAgB,EAAE,EAAE;gBAC5E,mFAAmF;gBACnF,uFAAuF;gBACvF,yFAAyF;gBACzF,oFAAoF;gBACpF,6DAA6D;gBAC7D,GAAG,CAAC,SAAS,CAAC,4BAA4B,EAAE,aAAa,CAAC,CAAA;gBAE1D,oFAAoF;gBACpF,8BAA8B;gBAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAA;gBACpD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;oBAClE,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC,CAAA;gBAC9F,CAAC;gBAED,IAAI,EAAE,CAAA;YACR,CAAC,CAAC,CAAA;YAEF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;YAErC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;gBAEtD,IAAI,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE;oBAClC,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;oBACrC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;oBACzB,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAA;gBAC5C,CAAC,CAAC,CAAA;gBAEF,IAAI,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;oBACrC,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE,MAAM,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;oBAC5E,OAAO,CAAC,IAAI,CAAE,GAAG,CAAC,IAAY,CAAC,KAAK,CAAC,CAAA;oBACrC,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAA;gBAC7C,CAAC,CAAC,CAAA;gBAEF,IAAI,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;oBACvC,OAAO,CAAC,IAAI,CAAC,2BAA2B,EAAE,MAAM,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;oBAC/E,OAAO,CAAC,IAAI,CAAE,GAAG,CAAC,IAAY,CAAC,KAAK,CAAC,CAAA;oBACrC,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAA;gBAChD,CAAC,CAAC,CAAA;YAEJ,CAAC;YAED,gBAAgB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAA;QACxC,CAAC;QAED,QAAQ,EAAE,GAAG,EAAE;YACb,OAAO,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,gBAAiB,CAAC,CAAA;QAC3D,CAAC;QAED,cAAc,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE;YACzB,OAAO,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,CAAA;QAC9D,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,GAAM,EAAE,KAAK,GAAW,aAAa,EAClC,EAAE;IACL,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAA;IAChD,MAAM,OAAO,GAAG,GAAQ,CAAA;IAExB,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAEhC,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAG3E,OAAO,QAAQ,MAAM,eAAe,CAAA;AAGpC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AAEzD,IAAI,gBAAgB,GAAyB,SAAS,CAAA;AACtD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,KAAK,GAAW,aAAa,EAAuB,EAAE;IAC9F,MAAM,OAAO,GAAwB,aAAa,CAAsB,KAAK,EAAE;QAC7E,MAAM,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,EAAE,KAAK,CAAC,CAAA;YAC7E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA;YAE5B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAe,CAAA;YAC/F,MAAM,MAAM,GAAG,kBAAkB,CAAkB,OAAO,CAAC,CAAA;YAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,QAAQ,IAAI,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YACtF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;YAE5F,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE;gBAC7B,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC;gBAEzC,OAAO,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI;oBACjC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAqB,GAAG,CAAC,cAAe,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBACjF,CAAC,CAAC,SAAS;gBAEb,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE;oBACrC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAChC,GAAG,CAAC,cAAc,IAAI,oBAAoB,CAC3C,CAAA;oBAED,MAAM,QAAQ,GAAI,IAAsD,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ;2BAC1F,KAA2C,EAAE,QAAQ,CAAA;oBAE3D,OAAO,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;gBACvD,CAAC;gBAED,YAAY,EAAE;oBACZ,MAAM,EAAE,qBAAqB,EAAE;oBAC/B,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE;wBAC5B,iFAAiF;wBACjF,wEAAwE;wBACxE,uFAAuF;wBACvF,uFAAuF;wBACvF,sFAAsF;wBACtF,cAAc;wBACd,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAmB,WAAW,CAAC,CAAA;wBAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC;6BACjC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,GAAG,KAAK,GAAG,eAAe,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;6BAC3E,IAAI,CAAC,GAAG,CAAC,CAAA;wBAEZ,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAA;oBAC9C,CAAC;iBACF;aACF,CAAC,CAAA;YAEF,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,WAAW,IAAI,QAAQ,CAAA;YACxC,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,YAAY,CAAC,CAAA;YAEjD;;;;;;;;;;eAUG;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAa,EAAE,GAAmB,EAAE,IAAgB,EAAE,EAAE;gBAC5E,mFAAmF;gBACnF,uFAAuF;gBACvF,yFAAyF;gBACzF,oFAAoF;gBACpF,6DAA6D;gBAC7D,GAAG,CAAC,SAAS,CAAC,4BAA4B,EAAE,aAAa,CAAC,CAAA;gBAE1D,oFAAoF;gBACpF,8BAA8B;gBAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAA;gBACpD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;oBAClE,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC,CAAA;gBAC9F,CAAC;gBAED,IAAI,EAAE,CAAA;YACR,CAAC,CAAC,CAAA;YAEF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;YAErC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;gBAEtD,IAAI,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE;oBAClC,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;oBACrC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;oBACzB,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAA;gBAC5C,CAAC,CAAC,CAAA;gBAEF,IAAI,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;oBACrC,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE,MAAM,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;oBAC5E,OAAO,CAAC,IAAI,CAAE,GAAG,CAAC,IAAY,CAAC,KAAK,CAAC,CAAA;oBACrC,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAA;gBAC7C,CAAC,CAAC,CAAA;gBAEF,IAAI,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;oBACvC,OAAO,CAAC,IAAI,CAAC,2BAA2B,EAAE,MAAM,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;oBAC/E,OAAO,CAAC,IAAI,CAAE,GAAG,CAAC,IAAY,CAAC,KAAK,CAAC,CAAA;oBACrC,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAA;gBAChD,CAAC,CAAC,CAAA;YAEJ,CAAC;YAED,gBAAgB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAA;QACxC,CAAC;QAED,QAAQ,EAAE,GAAG,EAAE;YACb,OAAO,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,gBAAiB,CAAC,CAAA;QAC3D,CAAC;QAED,cAAc,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE;YACzB,OAAO,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,CAAA;QAC9D,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,GAAM,EAAE,KAAK,GAAW,aAAa,EAClC,EAAE;IACL,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAA;IAChD,MAAM,OAAO,GAAG,GAAQ,CAAA;IAExB,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAEhC,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/utils/policy.d.ts

@@ -0,0 +1,26 @@
+import { interactionPolicy } from 'oidc-provider';
+/** The `reason` of the login check this module adds to the provider's default policy. */
+export declare const ACCOUNT_REFUSED_REASON = "account_refused";
+/**
+ * The provider's default interaction policy plus one login check: a session whose account the
+ * application REFUSED to load is a session that identifies nobody, so the person logs in again.
+ *
+ * `findAccount` answering `undefined` is the seam's way of refusing (`OidcAccountService.loadById`),
+ * but the provider does not treat it as an absent login. Its own `no_session` check reads the raw
+ * `session.accountId`, which is still set, so the login prompt is skipped; `loadGrant` builds a
+ * grant only for a loaded account, so the consent prompt then dereferences a grant that was never
+ * created and the request ends as a `server_error` — "oops! something went wrong" on the relying
+ * party's callback, with a `TypeError` as its only trace. A refusal is routine (a subject that
+ * belongs to another organization, a disabled or expired profile), so it has to end in the login
+ * prompt, never in a crash.
+ *
+ * On the way back the provider's own resume step swaps the accounts: a login result naming an
+ * account other than the session's runs its logout confirmation first, dropping the stale session,
+ * and then continues the original request.
+ *
+ * A login that has JUST completed (`oidc.result.login`) and still names an account the application
+ * refuses is not asked again — that would loop between the login and the refusal for good — it is
+ * an `access_denied` the relying party can show.
+ */
+export declare const makeInteractionPolicy: () => interactionPolicy.DefaultPolicy;
+//# sourceMappingURL=policy.d.ts.map

package/build/utils/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/utils/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAEzD,yFAAyF;AACzF,eAAO,MAAM,sBAAsB,oBAAoB,CAAA;AAEvD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,qBAAqB,QAAO,iBAAiB,CAAC,aAqB1D,CAAA"}

package/build/utils/policy.js

@@ -0,0 +1,38 @@
+import { errors, interactionPolicy } from 'oidc-provider';
+/** The `reason` of the login check this module adds to the provider's default policy. */
+export const ACCOUNT_REFUSED_REASON = 'account_refused';
+/**
+ * The provider's default interaction policy plus one login check: a session whose account the
+ * application REFUSED to load is a session that identifies nobody, so the person logs in again.
+ *
+ * `findAccount` answering `undefined` is the seam's way of refusing (`OidcAccountService.loadById`),
+ * but the provider does not treat it as an absent login. Its own `no_session` check reads the raw
+ * `session.accountId`, which is still set, so the login prompt is skipped; `loadGrant` builds a
+ * grant only for a loaded account, so the consent prompt then dereferences a grant that was never
+ * created and the request ends as a `server_error` — "oops! something went wrong" on the relying
+ * party's callback, with a `TypeError` as its only trace. A refusal is routine (a subject that
+ * belongs to another organization, a disabled or expired profile), so it has to end in the login
+ * prompt, never in a crash.
+ *
+ * On the way back the provider's own resume step swaps the accounts: a login result naming an
+ * account other than the session's runs its logout confirmation first, dropping the stale session,
+ * and then continues the original request.
+ *
+ * A login that has JUST completed (`oidc.result.login`) and still names an account the application
+ * refuses is not asked again — that would loop between the login and the refusal for good — it is
+ * an `access_denied` the relying party can show.
+ */
+export const makeInteractionPolicy = () => {
+    const policy = interactionPolicy.base();
+    policy.get('login')?.checks.add(new interactionPolicy.Check(ACCOUNT_REFUSED_REASON, 'End-User account is not accepted, authentication is required', 'login_required', ({ oidc }) => {
+        if (oidc.session?.accountId == null || oidc.account != null) {
+            return interactionPolicy.Check.NO_NEED_TO_PROMPT;
+        }
+        if (oidc.result?.login != null) {
+            throw new errors.AccessDenied(undefined, 'the account that signed in is not accepted');
+        }
+        return interactionPolicy.Check.REQUEST_PROMPT;
+    }));
+    return policy;
+};
+//# sourceMappingURL=policy.js.map

package/build/utils/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/utils/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAEzD,yFAAyF;AACzF,MAAM,CAAC,MAAM,sBAAsB,GAAG,iBAAiB,CAAA;AAEvD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAoC,EAAE;IACzE,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,EAAE,CAAA;IAEvC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,KAAK,CACzD,sBAAsB,EACtB,8DAA8D,EAC9D,gBAAgB,EAChB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;QACX,IAAI,IAAI,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;YAC5D,OAAO,iBAAiB,CAAC,KAAK,CAAC,iBAAiB,CAAA;QAClD,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,4CAA4C,CAAC,CAAA;QACxF,CAAC;QAED,OAAO,iBAAiB,CAAC,KAAK,CAAC,cAAc,CAAA;IAC/C,CAAC,CACF,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-oidc-provider",
-  "version": "0.1.18-rc.41",
+  "version": "0.1.18-rc.43",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -38,9 +38,9 @@
     "@owlmeans/config": "^0.1.18-rc.38",
     "@owlmeans/context": "^0.1.18-rc.32",
     "@owlmeans/entrypoint": "^0.1.18-rc.37",
-    "@owlmeans/oidc": "^0.1.18-rc.46",
+    "@owlmeans/oidc": "^0.1.18-rc.48",
     "@owlmeans/route": "^0.1.18-rc.33",
-    "@owlmeans/server-api": "^0.1.18-rc.42",
+    "@owlmeans/server-api": "^0.1.18-rc.44",
     "@owlmeans/server-context": "^0.1.18-rc.37",
     "@scure/base": "^2.3.0",
     "jose": "6.2.5",

package/src/service.ts

@@ -9,6 +9,7 @@ import type { CommonEntrypoint } from '@owlmeans/entrypoint'
 import { PARAM, SEP } from '@owlmeans/route'
 import { makeSecurityHelper } from '@owlmeans/config'
 import { combineConfig } from './utils/config.js'
+import { makeInteractionPolicy } from './utils/policy.js'
 
 let _initializedOidc: Provider | undefined = undefined
 export const createOidcProviderService = (alias: string = DEFAULT_ALIAS): OidcProviderService => {
@@ -41,6 +42,7 @@ export const createOidcProviderService = (alias: string = DEFAULT_ALIAS): OidcPr
         },
 
         interactions: {
+          policy: makeInteractionPolicy(),
           url: async (_, interaction) => {
             // The interaction screen is a FRONTEND route, and this is a server context — the
             // entrypoint registered here has no `url()` (that helper is attached by

package/src/utils/policy.ts

@@ -0,0 +1,48 @@
+import { errors, interactionPolicy } from 'oidc-provider'
+
+/** The `reason` of the login check this module adds to the provider's default policy. */
+export const ACCOUNT_REFUSED_REASON = 'account_refused'
+
+/**
+ * The provider's default interaction policy plus one login check: a session whose account the
+ * application REFUSED to load is a session that identifies nobody, so the person logs in again.
+ *
+ * `findAccount` answering `undefined` is the seam's way of refusing (`OidcAccountService.loadById`),
+ * but the provider does not treat it as an absent login. Its own `no_session` check reads the raw
+ * `session.accountId`, which is still set, so the login prompt is skipped; `loadGrant` builds a
+ * grant only for a loaded account, so the consent prompt then dereferences a grant that was never
+ * created and the request ends as a `server_error` — "oops! something went wrong" on the relying
+ * party's callback, with a `TypeError` as its only trace. A refusal is routine (a subject that
+ * belongs to another organization, a disabled or expired profile), so it has to end in the login
+ * prompt, never in a crash.
+ *
+ * On the way back the provider's own resume step swaps the accounts: a login result naming an
+ * account other than the session's runs its logout confirmation first, dropping the stale session,
+ * and then continues the original request.
+ *
+ * A login that has JUST completed (`oidc.result.login`) and still names an account the application
+ * refuses is not asked again — that would loop between the login and the refusal for good — it is
+ * an `access_denied` the relying party can show.
+ */
+export const makeInteractionPolicy = (): interactionPolicy.DefaultPolicy => {
+  const policy = interactionPolicy.base()
+
+  policy.get('login')?.checks.add(new interactionPolicy.Check(
+    ACCOUNT_REFUSED_REASON,
+    'End-User account is not accepted, authentication is required',
+    'login_required',
+    ({ oidc }) => {
+      if (oidc.session?.accountId == null || oidc.account != null) {
+        return interactionPolicy.Check.NO_NEED_TO_PROMPT
+      }
+
+      if (oidc.result?.login != null) {
+        throw new errors.AccessDenied(undefined, 'the account that signed in is not accepted')
+      }
+
+      return interactionPolicy.Check.REQUEST_PROMPT
+    }
+  ))
+
+  return policy
+}

package/tests/policy.spec.ts

@@ -0,0 +1,216 @@
+import { describe, it, expect, afterEach } from 'bun:test'
+import { createServer } from 'node:http'
+import type { Server } from 'node:http'
+import type { AddressInfo } from 'node:net'
+import { createHmac } from 'node:crypto'
+import Provider, { errors, interactionPolicy } from 'oidc-provider'
+import type { Configuration } from 'oidc-provider'
+import { ACCOUNT_REFUSED_REASON, makeInteractionPolicy } from '../src/utils/policy.js'
+
+const KEYS = ['policy-spec-cookie-key']
+const CLIENT_ID = 'policy-spec-client'
+const REDIRECT_URI = 'https://rp.example.test/callback'
+const STRANGER = 'email-otp:someone-elses'
+const MEMBER = 'email-otp:this-organization'
+
+interface Running { provider: Provider, base: string }
+
+const running: Server[] = []
+
+afterEach(() => {
+  while (running.length > 0) running.pop()?.close()
+})
+
+/** A real provider served on a loopback port, whose `findAccount` refuses `STRANGER` alone. */
+const start = async (policy: Configuration['interactions']): Promise<Running> => {
+  const server = createServer()
+  await new Promise<void>(resolve => server.listen(0, '127.0.0.1', resolve))
+  running.push(server)
+  const base = `http://127.0.0.1:${(server.address() as AddressInfo).port}`
+
+  const provider = new Provider(base, {
+    clients: [{
+      client_id: CLIENT_ID,
+      client_secret: 'policy-spec-secret',
+      redirect_uris: [REDIRECT_URI],
+      response_types: ['code'],
+      grant_types: ['authorization_code'],
+    }],
+    cookies: { keys: KEYS },
+    features: { devInteractions: { enabled: false } },
+    findAccount: async (_, id) => id === STRANGER
+      ? undefined
+      : { accountId: id, claims: async () => ({ sub: id }) },
+    interactions: {
+      ...policy,
+      url: async (_, interaction) => `${base}/login/${interaction.uid}`,
+    },
+  })
+
+  server.on('request', provider.callback())
+
+  return { provider, base }
+}
+
+/** Koa's signed-cookie signature: the first key's HMAC-SHA1, base64 with the URL-safe alphabet. */
+const sign = (pair: string): string => createHmac('sha1', KEYS[0]).update(pair).digest('base64')
+  .replace(/[/+=]/g, c => ({ '/': '_', '+': '-', '=': '' })[c] as string)
+
+/** A provider session that already names `accountId`, as a browser cookie header. */
+const sessionCookie = async (provider: Provider, accountId: string): Promise<string> => {
+  const session = Object.assign(new provider.Session(), { accountId })
+  await session.save(600)
+  const pair = `_session=${session.jti}`
+
+  return `${pair}; _session.sig=${sign(pair)}`
+}
+
+const AUTHORIZATION = new URLSearchParams({
+  client_id: CLIENT_ID,
+  redirect_uri: REDIRECT_URI,
+  response_type: 'code',
+  scope: 'openid',
+})
+
+// The provider is asked for a redirect, never followed: the interesting part is where it points.
+const authorize = async ({ base }: Running, cookie: string): Promise<Response> =>
+  fetch(`${base}/auth?${AUTHORIZATION}`, { redirect: 'manual', headers: { cookie } })
+
+/** The cookies a browser would hold between requests to the provider. */
+const makeJar = (initial = '') => {
+  const jar = new Map<string, string>(
+    initial === '' ? [] : initial.split('; ').map(pair => [pair.slice(0, pair.indexOf('=')), pair.slice(pair.indexOf('=') + 1)])
+  )
+
+  return {
+    header: () => [...jar].map(([name, value]) => `${name}=${value}`).join('; '),
+    remember: (response: Response) => {
+      for (const line of response.headers.getSetCookie()) {
+        const [pair] = line.split(';')
+        const name = pair.slice(0, pair.indexOf('='))
+        const value = pair.slice(pair.indexOf('=') + 1)
+        if (value === '') jar.delete(name)
+        else jar.set(name, value)
+      }
+    },
+  }
+}
+
+const locationOf = (response: Response): URL => new URL(response.headers.get('location') ?? 'about:blank')
+
+/** The interaction a redirect to the (test) login screen points at. */
+const interactionOf = (env: Running, response: Response) =>
+  env.provider.Interaction.find(locationOf(response).pathname.split('/').pop() ?? '')
+
+
+describe('login policy for a session whose account the application refused', () => {
+  it('crashes the authorization request with the provider default policy', async () => {
+    const env = await start(undefined)
+    const response = await authorize(env, await sessionCookie(env.provider, STRANGER))
+
+    // The provider's own answer to the crash: an error page, never a login. (Behind the
+    // application's error rendering the relying party receives `error=server_error`.)
+    expect(response.status).toBe(500)
+    expect(await response.text()).toContain('server_error')
+  })
+
+  it('sends it back to the login interaction', async () => {
+    const env = await start({ policy: makeInteractionPolicy() })
+    const response = await authorize(env, await sessionCookie(env.provider, STRANGER))
+
+    expect(response.status).toBe(303)
+    expect(locationOf(response).href.startsWith(`${env.base}/login/`)).toBe(true)
+
+    const interaction = await interactionOf(env, response)
+    expect(interaction?.prompt.name).toBe('login')
+    expect(interaction?.prompt.reasons).toContain(ACCOUNT_REFUSED_REASON)
+  })
+
+  it('still asks a visitor with no session to log in', async () => {
+    const env = await start({ policy: makeInteractionPolicy() })
+    const response = await authorize(env, '')
+
+    expect(response.status).toBe(303)
+    const interaction = await interactionOf(env, response)
+    expect(interaction?.prompt.name).toBe('login')
+    expect(interaction?.prompt.reasons).not.toContain(ACCOUNT_REFUSED_REASON)
+  })
+})
+
+describe('the login that follows a refused session', () => {
+  it('replaces the stale session and completes the original request', async () => {
+    const env = await start({ policy: makeInteractionPolicy() })
+    const jar = makeJar(await sessionCookie(env.provider, STRANGER))
+    const step = async (url: string, init: RequestInit = {}): Promise<Response> => {
+      const response = await fetch(url, {
+        ...init, redirect: 'manual', headers: { ...init.headers, cookie: jar.header() },
+      })
+      jar.remember(response)
+
+      return response
+    }
+
+    // 1. The refused session is asked to log in.
+    const asked = await step(`${env.base}/auth?${AUTHORIZATION}`)
+    const interaction = await interactionOf(env, asked)
+    expect(interaction?.prompt.name).toBe('login')
+
+    // 2. The login screen finishes as the application's interaction handler does.
+    const grant = new env.provider.Grant({ accountId: MEMBER, clientId: CLIENT_ID })
+    grant.addOIDCScope('openid')
+    interaction!.result = { login: { accountId: MEMBER }, consent: { grantId: await grant.save() } }
+    await interaction!.save(600)
+
+    // 3. Resuming names an account other than the session's, so the provider signs the old one out…
+    const resumed = await step(interaction!.returnTo)
+    expect(resumed.status).toBe(200)
+    const form = await resumed.text()
+    const action = /action="([^"]+)"/.exec(form)?.[1]
+    const xsrf = /name="xsrf" value="([^"]+)"/.exec(form)?.[1]
+    expect(action).toContain('/session/end/confirm')
+    expect(xsrf).toBeDefined()
+
+    const signedOut = await step(action!, {
+      method: 'POST',
+      headers: { 'content-type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams({ xsrf: xsrf!, logout: 'yes' }),
+    })
+    expect(signedOut.status).toBe(303)
+
+    // 4. …and continues the request it interrupted, ending at the relying party with a code.
+    const done = await step(signedOut.headers.get('location')!)
+    expect(done.status).toBe(303)
+    const callback = locationOf(done)
+    expect(callback.origin + callback.pathname).toBe(REDIRECT_URI)
+    expect(callback.searchParams.get('code')).not.toBeNull()
+    expect(callback.searchParams.get('error')).toBeNull()
+  })
+})
+
+describe('the account_refused check', () => {
+  const check = makeInteractionPolicy().get('login')?.checks.get(ACCOUNT_REFUSED_REASON)
+  const run = (oidc: Record<string, unknown>) => check!.check({ oidc } as never)
+
+  it('is registered on the login prompt', () => {
+    expect(check).toBeDefined()
+    expect(check?.error).toBe('login_required')
+  })
+
+  it('leaves a loaded account alone', async () => {
+    expect(await run({ session: { accountId: 'a' }, account: { accountId: 'a' } }))
+      .toBe(interactionPolicy.Check.NO_NEED_TO_PROMPT)
+  })
+
+  it('leaves a request with no session account to the provider own check', async () => {
+    expect(await run({ session: {} })).toBe(interactionPolicy.Check.NO_NEED_TO_PROMPT)
+  })
+
+  it('asks a refused session to log in', async () => {
+    expect(await run({ session: { accountId: 'a' } })).toBe(interactionPolicy.Check.REQUEST_PROMPT)
+  })
+
+  it('denies, not loops, when the login that just completed is refused too', () => {
+    expect(() => run({ session: { accountId: 'a' }, result: { login: { accountId: 'a' } } }))
+      .toThrow(errors.AccessDenied)
+  })
+})