@owlmeans/server-oidc-provider 0.1.18-rc.45 → 0.1.18-rc.46

package/README.md

@@ -14,7 +14,7 @@ Embedded OIDC identity provider — wraps the `oidc-provider` library as an OwlM
 ## Installation
 
 ```bash
-bun add @owlmeans/server-oidc-provider@^0.1.18-rc.45
+bun add @owlmeans/server-oidc-provider@^0.1.18-rc.46
 ```
 
 ## Usage
@@ -72,7 +72,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.44
+npx @owlmeans/agent-skills@^0.1.18-rc.45
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-oidc-provider",
-  "version": "0.1.18-rc.45",
-  "generatedAt": "2026-09-30T09:41:02.835Z",
+  "version": "0.1.18-rc.46",
+  "generatedAt": "2026-10-01T23:27:48.745Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-oidc-provider/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: server-oidc-provider
-description: How to use @owlmeans/server-oidc-provider — the embedded OIDC identity provider on top of the oidc-provider library — service wiring, the account and adapter seams, the interaction URL, how scopes are derived from claims, and the response headers an authorization endpoint has to correct. Auto-invoked when serving OIDC endpoints from your own service.
+description: How to use @owlmeans/server-oidc-provider — the embedded OIDC identity provider on top of the oidc-provider library — service wiring, the account and adapter seams, the interaction URL, how scopes are derived from claims, the organizations claim, extra discovery fields, pairwise subjects, and the response headers an authorization endpoint has to correct. Auto-invoked when serving OIDC endpoints from your own service.
 user-invocable: false
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/server-oidc-provider
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-oidc-provider": "^0.1.18-rc.45"` in `dependencies`
+**Install:** `"@owlmeans/server-oidc-provider": "^0.1.18-rc.46"` in `dependencies`
 **Runtime deps:** `oidc-provider@9.11.1` (exact), `jose@6.2.5` (exact), `@types/oidc-provider@9.5.0`
 
 Use this only when your service **is** the identity provider. For consuming someone else's issuer,
@@ -26,6 +26,7 @@ use `@owlmeans/server-oidc-rp`.
 | `OidcAdapterService` | The storage seam: `instance(name)` returns an `oidc-provider` `Adapter` |
 | `OIDC_ACCOUNT_SERVICE`, `DEFAULT_ALIAS` | The default account-service alias and the default provider alias |
 | `OidcConfig`, `OidcConfigAppend` | The `cfg.oidc` shape this package reads |
+| `OidcCustomConfiguration` | `oidc-provider`'s `Configuration` plus `sectorIdentifierUriValidate`, which the pinned typings omit — the type of `cfg.oidc.customConfiguration` |
 | `OidcAccountParams` | `{ clientId? }` — lets the account service scope its claims per client |
 | `toClientMetadata(client)` | Maps a stored `OidcRegisteredClient` to `oidc-provider` `ClientMetadata` |
 | `OidcRegisteredClient`, `OidcClientMetadata` | The stored-client shape `toClientMetadata` takes, and the `oidc-provider` metadata shape it returns, carrying `owlEntityId` |
@@ -42,12 +43,16 @@ context.registerMiddleware(createOidcProviderMiddleware())
 
 `cfg.oidc` supplies `clients` (`ClientMetadata[]`), `defaultKeys.RS256.pk` (a PKCS#8 PEM), and
 optionally `basePath` (default `oidc`), `authService` (whose registered route the issuer is built
-from — defaults to this service), `behindProxy`, `accountService`, `adapterService` and
-`customConfiguration` (merged over the defaults below). The shape also declares `frontBase`, which
+from — defaults to this service), `behindProxy`, `accountService`, `adapterService`,
+`discoveryUris` (below) and `customConfiguration` (merged over the defaults below). The shape also declares `frontBase`, which
 this package reads nowhere — setting it configures nothing.
 
 A client's `redirect_uris` and `post_logout_redirect_uris` may be written as `{{service-alias}}/path`
-and are expanded against that registered service's host. A client with no `client_secret` is refused
+and are expanded against that registered service's host. `discoveryUris` (field → URL) extends the
+discovery document through the same expansion, merged over `customConfiguration.discovery` — that
+is how a deployment advertises an endpoint another service serves, such as `IAM_API_METADATA`
+(`owlmeans_iam_api`, the runtime IAM API). A field the provider derives itself cannot be overridden
+this way. A client with no `client_secret` is refused
 unless a debug flag is on, in which case one is generated and printed.
 
 ## Building the interaction URL
@@ -70,9 +75,36 @@ client's own `scope` allowlist: a client that omits one fails the whole authoriz
 no claim behind it is silently empty.
 
 The defaults this package sets: `claims` covers `email` (`email`, `email_verified`), `profile` (the
-standard set) and `PERMISSIONS_SCOPE` → `PERMISSIONS_CLAIM`, which stays inert unless the account
-service actually emits it; `scopes` is `openid profile offline_access permissions`;
-`features.devInteractions` is off. Anything under `cfg.oidc.customConfiguration` merges over these.
+standard set), `PERMISSIONS_SCOPE` → `PERMISSIONS_CLAIM` and `ORGANIZATIONS_SCOPE` →
+`ORGANIZATIONS_CLAIM`, both inert unless the account service actually emits them; `scopes` is
+`openid profile offline_access permissions organizations`; `features.devInteractions` is off.
+Anything under `cfg.oidc.customConfiguration` merges over these.
+
+`organizations` is a static scope like any other: only a client whose allowlist names it may ask,
+and a client that does not ask gets no `organizations` claim at all — which is what keeps a
+pre-tenancy client's tokens exactly as they were.
+
+## Pairwise subjects
+
+The integrated IAM gives every client its own subject for one account. `subjectTypes`,
+`pairwiseIdentifier` and `sectorIdentifierUriValidate` pass through `customConfiguration`
+unchanged, and `tests/pairwise.spec.ts` drives the pinned provider through the whole design:
+
+- `subjectTypes: ['pairwise']`, `pairwiseIdentifier: (ctx, accountId, client) => <subject>`, and
+  `sectorIdentifierUriValidate: () => false`; each client carries `subject_type: 'pairwise'` and
+  one constant `sector_identifier_uri` (https, never fetched, so its host may serve nothing — it
+  only lets a client register redirect URIs on several hosts).
+- The session and the grant name the ACCOUNT; `findAccount` is only ever asked for the account
+  id. The id_token, userinfo and introspection all answer the pairwise subject, unchanged across a
+  refresh; another client of the same session gets another one.
+- **The account's `claims()` must return `sub` = the account id.** The provider applies
+  `pairwiseIdentifier` to whatever `sub` it is given (`helpers/claims.js`), and introspection to
+  `token.accountId` — an account service that returned the pairwise value itself would have it
+  transformed a second time, and the id_token would no longer match introspection.
+- With only `pairwise` supported it becomes every client's default `subject_type`; a client
+  declaring `public` is refused.
+- `sectorIdentifierUriValidate` is missing from `@types/oidc-provider` 9.5.0, which is why
+  `OidcCustomConfiguration` declares it; drop that field when the typings carry it.
 
 ## oidc-provider v9 configuration
 

package/build/types.d.ts

@@ -17,7 +17,14 @@ export interface OidcConfig extends OidcSharedConfig {
     basePath?: string;
     frontBase?: string;
     clients: ClientMetadata[];
-    customConfiguration?: Configuration;
+    /**
+     * Extra fields of the discovery document, field name → URL. A value may be written as
+     * `{{service-alias}}/path`, expanded against that registered service's host exactly as a
+     * client's redirect URIs are — which is how a deployment advertises an endpoint it serves on
+     * another service (`IAM_API_METADATA`).
+     */
+    discoveryUris?: Record<string, string>;
+    customConfiguration?: OidcCustomConfiguration;
     behindProxy?: boolean;
     defaultKeys: {
         RS256: {
@@ -28,6 +35,16 @@ export interface OidcConfig extends OidcSharedConfig {
     accountService?: string;
     adapterService?: string;
 }
+/**
+ * The provider configuration a deployment passes through, merged over this package's defaults.
+ *
+ * Adds what the pinned `@types/oidc-provider` omits but `oidc-provider` reads:
+ * `sectorIdentifierUriValidate` answering `false` keeps the provider from fetching a pairwise
+ * client's `sector_identifier_uri` — a constant sector whose host serves nothing.
+ */
+export interface OidcCustomConfiguration extends Configuration {
+    sectorIdentifierUriValidate?: (client: InstanceType<Provider['Client']>) => boolean;
+}
 export interface OidcAccountParams {
     /** The OIDC client requesting the account — lets the account service scope claims (e.g. permissions) per client. */
     clientId?: string;

package/build/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtE,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC3E,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAE3G,MAAM,WAAW,mBAAoB,SAAQ,kBAAkB;IAC7D,IAAI,EAAE,QAAQ,CAAA;IAEd,MAAM,EAAE,CAAC,GAAG,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAEzC,QAAQ,EAAE,MAAM,QAAQ,CAAA;IAExB,cAAc,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;CAC5D;AAED,MAAM,WAAW,gBAAgB,CAAC,KAAK,SAAS,gBAAgB,GAAG,gBAAgB;IACjF,IAAI,EAAE,UAAU,GAAG,KAAK,CAAA;CACzB;AAED,MAAM,WAAW,UAAW,SAAQ,gBAAgB;IAClD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,cAAc,EAAE,CAAA;IACzB,mBAAmB,CAAC,EAAE,aAAa,CAAA;IACnC,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,WAAW,EAAE;QACX,KAAK,EAAE;YACL,EAAE,EAAE,MAAM,CAAA;YACV,GAAG,CAAC,EAAE,MAAM,CAAA;SACb,CAAA;KACF,CAAA;IACD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,oHAAoH;IACpH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D,QAAQ,EAAE,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,iBAAiB,KAAK,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;CACnI;AAED,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;CACpC;AAED,MAAM,WAAW,MAAO,SAAQ,YAAY,EAAE,gBAAgB;IAC5D,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG;QAC7B,IAAI,CAAC,EAAE,OAAO,CAAA;QACd,UAAU,CAAC,EAAE,OAAO,CAAA;QACpB,QAAQ,CAAC,EAAE,OAAO,CAAA;KACnB,CAAA;CACF;AAED,MAAM,WAAW,OAAO,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,CAAE,SAAQ,aAAa,CAAC,CAAC,CAAC,EACxE,eAAe;CAAI"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtE,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC3E,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAE3G,MAAM,WAAW,mBAAoB,SAAQ,kBAAkB;IAC7D,IAAI,EAAE,QAAQ,CAAA;IAEd,MAAM,EAAE,CAAC,GAAG,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAEzC,QAAQ,EAAE,MAAM,QAAQ,CAAA;IAExB,cAAc,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;CAC5D;AAED,MAAM,WAAW,gBAAgB,CAAC,KAAK,SAAS,gBAAgB,GAAG,gBAAgB;IACjF,IAAI,EAAE,UAAU,GAAG,KAAK,CAAA;CACzB;AAED,MAAM,WAAW,UAAW,SAAQ,gBAAgB;IAClD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,cAAc,EAAE,CAAA;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACtC,mBAAmB,CAAC,EAAE,uBAAuB,CAAA;IAC7C,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,WAAW,EAAE;QACX,KAAK,EAAE;YACL,EAAE,EAAE,MAAM,CAAA;YACV,GAAG,CAAC,EAAE,MAAM,CAAA;SACb,CAAA;KACF,CAAA;IACD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAwB,SAAQ,aAAa;IAC5D,2BAA2B,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,OAAO,CAAA;CACpF;AAED,MAAM,WAAW,iBAAiB;IAChC,oHAAoH;IACpH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D,QAAQ,EAAE,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,iBAAiB,KAAK,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;CACnI;AAED,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;CACpC;AAED,MAAM,WAAW,MAAO,SAAQ,YAAY,EAAE,gBAAgB;IAC5D,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG;QAC7B,IAAI,CAAC,EAAE,OAAO,CAAA;QACd,UAAU,CAAC,EAAE,OAAO,CAAA;QACpB,QAAQ,CAAC,EAAE,OAAO,CAAA;KACnB,CAAA;CACF;AAED,MAAM,WAAW,OAAO,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,CAAE,SAAQ,aAAa,CAAC,CAAC,CAAC,EACxE,eAAe;CAAI"}

package/build/utils/client.d.ts

@@ -1,4 +1,7 @@
 import type { ClientMetadata } from 'oidc-provider';
 import type { Context } from '../types.js';
+import type { SecurityHelper } from '@owlmeans/config';
 export declare const updateClient: (context: Context, client: ClientMetadata) => ClientMetadata;
+/** Expands a `{{service-alias}}/path` URI against that registered service; any other URI is kept. */
+export declare const makeUriUpdater: (context: Context, helper: SecurityHelper) => (uri: string) => string;
 //# sourceMappingURL=client.d.ts.map

package/build/utils/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/utils/client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,KAAK,EAAU,OAAO,EAAE,MAAM,aAAa,CAAA;AAKlD,eAAO,MAAM,YAAY,YAAa,OAAO,UAAU,cAAc,KAAG,cAoBvE,CAAA"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/utils/client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,KAAK,EAAU,OAAO,EAAE,MAAM,aAAa,CAAA;AAElD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAGtD,eAAO,MAAM,YAAY,YAAa,OAAO,UAAU,cAAc,KAAG,cAoBvE,CAAA;AAED,qGAAqG;AACrG,eAAO,MAAM,cAAc,YAAa,OAAO,UAAU,cAAc,WAAW,MAAM,KAAG,MAS1F,CAAA"}

package/build/utils/client.js

@@ -20,7 +20,8 @@ export const updateClient = (context, client) => {
     client.post_logout_redirect_uris = client.post_logout_redirect_uris?.map(updateUri) ?? [];
     return client;
 };
-const makeUriUpdater = (context, helper) => (uri) => {
+/** Expands a `{{service-alias}}/path` URI against that registered service; any other URI is kept. */
+export const makeUriUpdater = (context, helper) => (uri) => {
     if (uri.startsWith('{{')) {
         const [host, ...parts] = uri.split(SEP);
         const service = context.cfg.services[host.slice(2, -2)];

package/build/utils/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/utils/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAGjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAErD,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AAErC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAgB,EAAE,MAAsB,EAAkB,EAAE;IACvF,IAAI,MAAM,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACtD,MAAM,IAAI,WAAW,CAAC,2BAA2B,CAAC,CAAA;QACpD,CAAC;QACD,MAAM,CAAC,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;QAElD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClB,OAAO,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAA;QACtD,OAAO,CAAC,IAAI,CAAC,wEAAwE,EAAE,MAAM,CAAC,aAAa,CAAC,CAAA;QAC5G,OAAO,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAA;QACtD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpB,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAkB,OAAO,CAAC,CAAA;IAC3D,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACjD,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;IACjE,MAAM,CAAC,yBAAyB,GAAG,MAAM,CAAC,yBAAyB,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;IAEzF,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,OAAgB,EAAE,MAAsB,EAAE,EAAE,CAAC,CAAC,GAAW,EAAU,EAAE;IAC3F,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAEvC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QACvD,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACjD,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/utils/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAGjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAErD,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AAErC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAgB,EAAE,MAAsB,EAAkB,EAAE;IACvF,IAAI,MAAM,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACtD,MAAM,IAAI,WAAW,CAAC,2BAA2B,CAAC,CAAA;QACpD,CAAC;QACD,MAAM,CAAC,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;QAElD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClB,OAAO,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAA;QACtD,OAAO,CAAC,IAAI,CAAC,wEAAwE,EAAE,MAAM,CAAC,aAAa,CAAC,CAAA;QAC5G,OAAO,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAA;QACtD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpB,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAkB,OAAO,CAAC,CAAA;IAC3D,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACjD,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;IACjE,MAAM,CAAC,yBAAyB,GAAG,MAAM,CAAC,yBAAyB,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;IAEzF,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,qGAAqG;AACrG,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAgB,EAAE,MAAsB,EAAE,EAAE,CAAC,CAAC,GAAW,EAAU,EAAE;IAClG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAEvC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QACvD,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACjD,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA"}

package/build/utils/config.d.ts

@@ -1,4 +1,3 @@
-import type { Context } from '../types.js';
-import type { Configuration } from 'oidc-provider';
-export declare const combineConfig: (context: Context, _unsecure: boolean) => Promise<Configuration>;
+import type { Context, OidcCustomConfiguration } from '../types.js';
+export declare const combineConfig: (context: Context, _unsecure: boolean) => Promise<OidcCustomConfiguration>;
 //# sourceMappingURL=config.d.ts.map

package/build/utils/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAKlD,eAAO,MAAM,aAAa,YAAmB,OAAO,aAAa,OAAO,KAAG,OAAO,CAAC,aAAa,CA0C/F,CAAA"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAMnE,eAAO,MAAM,aAAa,YAAmB,OAAO,aAAa,OAAO,KAAG,OAAO,CAAC,uBAAuB,CAiDzG,CAAA"}

package/build/utils/config.js

@@ -1,8 +1,10 @@
-import { updateClient } from './client.js';
-import { PERMISSIONS_CLAIM, PERMISSIONS_SCOPE } from '@owlmeans/oidc';
+import { makeUriUpdater, updateClient } from './client.js';
+import { ORGANIZATIONS_CLAIM, ORGANIZATIONS_SCOPE, PERMISSIONS_CLAIM, PERMISSIONS_SCOPE } from '@owlmeans/oidc';
+import { makeSecurityHelper } from '@owlmeans/config';
 import * as jose from 'jose';
 export const combineConfig = async (context, _unsecure) => {
     const cfg = context.cfg.oidc;
+    const updateUri = makeUriUpdater(context, makeSecurityHelper(context));
     const configuration = {
         ...cfg.customConfiguration,
         clients: [
@@ -17,12 +19,18 @@ export const combineConfig = async (context, _unsecure) => {
             ],
             // Inert unless the account service actually emits the claim (integrated IAM mode)
             [PERMISSIONS_SCOPE]: [PERMISSIONS_CLAIM],
+            // Inert likewise — and a static scope, so only a client whose allowlist names it may ask
+            [ORGANIZATIONS_SCOPE]: [ORGANIZATIONS_CLAIM],
             ...cfg.customConfiguration?.claims,
         },
         scopes: [
-            'openid', 'profile', 'offline_access', PERMISSIONS_SCOPE,
+            'openid', 'profile', 'offline_access', PERMISSIONS_SCOPE, ORGANIZATIONS_SCOPE,
             ...cfg.customConfiguration?.scopes ?? []
         ],
+        discovery: {
+            ...cfg.customConfiguration?.discovery,
+            ...Object.fromEntries(Object.entries(cfg.discoveryUris ?? {}).map(([field, uri]) => [field, updateUri(uri)])),
+        },
         features: {
             ...cfg.customConfiguration?.features,
             devInteractions: { enabled: false }

package/build/utils/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACrE,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,OAAgB,EAAE,SAAkB,EAA0B,EAAE;IAClG,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA;IAE5B,MAAM,aAAa,GAAkB;QACnC,GAAG,GAAG,CAAC,mBAAmB;QAC1B,OAAO,EAAE;YACP,GAAG,GAAG,CAAC,OAAO;YACd,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,IAAI,EAAE,CAAC;SAC5C,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,EAAE;YACN,KAAK,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,GAAG,CAAC,mBAAmB,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;YACnF,OAAO,EAAE;gBACP,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB;gBAC3F,GAAG,GAAG,CAAC,mBAAmB,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE;aAClD;YACD,kFAAkF;YAClF,CAAC,iBAAiB,CAAC,EAAE,CAAC,iBAAiB,CAAC;YACxC,GAAG,GAAG,CAAC,mBAAmB,EAAE,MAAM;SACnC;QACD,MAAM,EAAE;YACN,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,iBAAiB;YACxD,GAAG,GAAG,CAAC,mBAAmB,EAAE,MAAM,IAAI,EAAE;SACzC;QACD,QAAQ,EAAE;YACR,GAAG,GAAG,CAAC,mBAAmB,EAAE,QAAQ;YACpC,eAAe,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YACnC,qBAAqB;YACrB,eAAe;YACf,kEAAkE;YAClE,gCAAgC;YAChC,mBAAmB;YACnB,2DAA2D;YAC3D,KAAK;SACN;QACD,IAAI,EAAE;YACJ,IAAI,EAAE;gBACJ,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;aACvG;SACF;KACF,CAAA;IAED,OAAO,aAAa,CAAA;AACtB,CAAC,CAAA"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAC/G,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,OAAgB,EAAE,SAAkB,EAAoC,EAAE;IAC5G,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA;IAC5B,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAA;IAEtE,MAAM,aAAa,GAA4B;QAC7C,GAAG,GAAG,CAAC,mBAAmB;QAC1B,OAAO,EAAE;YACP,GAAG,GAAG,CAAC,OAAO;YACd,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,IAAI,EAAE,CAAC;SAC5C,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,EAAE;YACN,KAAK,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,GAAG,CAAC,mBAAmB,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;YACnF,OAAO,EAAE;gBACP,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB;gBAC3F,GAAG,GAAG,CAAC,mBAAmB,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE;aAClD;YACD,kFAAkF;YAClF,CAAC,iBAAiB,CAAC,EAAE,CAAC,iBAAiB,CAAC;YACxC,yFAAyF;YACzF,CAAC,mBAAmB,CAAC,EAAE,CAAC,mBAAmB,CAAC;YAC5C,GAAG,GAAG,CAAC,mBAAmB,EAAE,MAAM;SACnC;QACD,MAAM,EAAE;YACN,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB;YAC7E,GAAG,GAAG,CAAC,mBAAmB,EAAE,MAAM,IAAI,EAAE;SACzC;QACD,SAAS,EAAE;YACT,GAAG,GAAG,CAAC,mBAAmB,EAAE,SAAS;YACrC,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAC9G;QACD,QAAQ,EAAE;YACR,GAAG,GAAG,CAAC,mBAAmB,EAAE,QAAQ;YACpC,eAAe,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YACnC,qBAAqB;YACrB,eAAe;YACf,kEAAkE;YAClE,gCAAgC;YAChC,mBAAmB;YACnB,2DAA2D;YAC3D,KAAK;SACN;QACD,IAAI,EAAE;YACJ,IAAI,EAAE;gBACJ,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;aACvG;SACF;KACF,CAAA;IAED,OAAO,aAAa,CAAA;AACtB,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-oidc-provider",
-  "version": "0.1.18-rc.45",
+  "version": "0.1.18-rc.46",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -35,13 +35,13 @@
   },
   "dependencies": {
     "@noble/hashes": "^1.5.0",
-    "@owlmeans/config": "^0.1.18-rc.39",
+    "@owlmeans/config": "^0.1.18-rc.40",
     "@owlmeans/context": "^0.1.18-rc.32",
-    "@owlmeans/entrypoint": "^0.1.18-rc.37",
-    "@owlmeans/oidc": "^0.1.18-rc.50",
+    "@owlmeans/entrypoint": "^0.1.18-rc.38",
+    "@owlmeans/oidc": "^0.1.18-rc.51",
     "@owlmeans/route": "^0.1.18-rc.33",
-    "@owlmeans/server-api": "^0.1.18-rc.46",
-    "@owlmeans/server-context": "^0.1.18-rc.38",
+    "@owlmeans/server-api": "^0.1.18-rc.47",
+    "@owlmeans/server-context": "^0.1.18-rc.39",
     "@scure/base": "^2.3.0",
     "jose": "6.2.5",
     "oidc-provider": "9.11.1"

package/src/types.ts

@@ -23,7 +23,14 @@ export interface OidcConfig extends OidcSharedConfig {
   basePath?: string
   frontBase?: string
   clients: ClientMetadata[]
-  customConfiguration?: Configuration
+  /**
+   * Extra fields of the discovery document, field name → URL. A value may be written as
+   * `{{service-alias}}/path`, expanded against that registered service's host exactly as a
+   * client's redirect URIs are — which is how a deployment advertises an endpoint it serves on
+   * another service (`IAM_API_METADATA`).
+   */
+  discoveryUris?: Record<string, string>
+  customConfiguration?: OidcCustomConfiguration
   behindProxy?: boolean
   defaultKeys: {
     RS256: {
@@ -35,6 +42,17 @@ export interface OidcConfig extends OidcSharedConfig {
   adapterService?: string
 }
 
+/**
+ * The provider configuration a deployment passes through, merged over this package's defaults.
+ *
+ * Adds what the pinned `@types/oidc-provider` omits but `oidc-provider` reads:
+ * `sectorIdentifierUriValidate` answering `false` keeps the provider from fetching a pairwise
+ * client's `sector_identifier_uri` — a constant sector whose host serves nothing.
+ */
+export interface OidcCustomConfiguration extends Configuration {
+  sectorIdentifierUriValidate?: (client: InstanceType<Provider['Client']>) => boolean
+}
+
 export interface OidcAccountParams {
   /** The OIDC client requesting the account — lets the account service scope claims (e.g. permissions) per client. */
   clientId?: string

package/src/utils/client.ts

@@ -28,7 +28,8 @@ export const updateClient = (context: Context, client: ClientMetadata): ClientMe
   return client
 }
 
-const makeUriUpdater = (context: Context, helper: SecurityHelper) => (uri: string): string => {
+/** Expands a `{{service-alias}}/path` URI against that registered service; any other URI is kept. */
+export const makeUriUpdater = (context: Context, helper: SecurityHelper) => (uri: string): string => {
   if (uri.startsWith('{{')) {
     const [host, ...parts] = uri.split(SEP)
     

package/src/utils/config.ts

@@ -1,13 +1,14 @@
-import type { Context } from '../types.js'
-import type { Configuration } from 'oidc-provider'
-import { updateClient } from './client.js'
-import { PERMISSIONS_CLAIM, PERMISSIONS_SCOPE } from '@owlmeans/oidc'
+import type { Context, OidcCustomConfiguration } from '../types.js'
+import { makeUriUpdater, updateClient } from './client.js'
+import { ORGANIZATIONS_CLAIM, ORGANIZATIONS_SCOPE, PERMISSIONS_CLAIM, PERMISSIONS_SCOPE } from '@owlmeans/oidc'
+import { makeSecurityHelper } from '@owlmeans/config'
 import * as jose from 'jose'
 
-export const combineConfig = async (context: Context, _unsecure: boolean): Promise<Configuration> => {
+export const combineConfig = async (context: Context, _unsecure: boolean): Promise<OidcCustomConfiguration> => {
   const cfg = context.cfg.oidc
+  const updateUri = makeUriUpdater(context, makeSecurityHelper(context))
 
-  const configuration: Configuration = {
+  const configuration: OidcCustomConfiguration = {
     ...cfg.customConfiguration,
     clients: [
       ...cfg.clients,
@@ -21,12 +22,18 @@ export const combineConfig = async (context: Context, _unsecure: boolean): Promi
       ],
       // Inert unless the account service actually emits the claim (integrated IAM mode)
       [PERMISSIONS_SCOPE]: [PERMISSIONS_CLAIM],
+      // Inert likewise — and a static scope, so only a client whose allowlist names it may ask
+      [ORGANIZATIONS_SCOPE]: [ORGANIZATIONS_CLAIM],
       ...cfg.customConfiguration?.claims,
     },
     scopes: [
-      'openid', 'profile', 'offline_access', PERMISSIONS_SCOPE,
+      'openid', 'profile', 'offline_access', PERMISSIONS_SCOPE, ORGANIZATIONS_SCOPE,
       ...cfg.customConfiguration?.scopes ?? []
     ],
+    discovery: {
+      ...cfg.customConfiguration?.discovery,
+      ...Object.fromEntries(Object.entries(cfg.discoveryUris ?? {}).map(([field, uri]) => [field, updateUri(uri)])),
+    },
     features: {
       ...cfg.customConfiguration?.features,
       devInteractions: { enabled: false }

package/tests/config.spec.ts

@@ -2,24 +2,30 @@ import { describe, it, expect } from 'bun:test'
 import { generateKeyPairSync } from 'node:crypto'
 import { AppType, makeBasicContext } from '@owlmeans/context'
 import type { BasicContext } from '@owlmeans/context'
+import {
+  IAM_API_METADATA, ORGANIZATIONS_CLAIM, ORGANIZATIONS_SCOPE, PERMISSIONS_CLAIM, PERMISSIONS_SCOPE,
+} from '@owlmeans/oidc'
 import { combineConfig } from '../src/utils/config.js'
 import type { Config } from '../src/types.js'
 
 const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 })
 const TEST_PKCS8_PEM = privateKey.export({ type: 'pkcs8', format: 'pem' }).toString()
 
-const makeTestContext = () => {
+const makeTestContext = (oidc: Partial<Config['oidc']> = {}) => {
   const cfg: Config = {
     ready: false,
     service: 'server-oidc-provider-tests',
     type: AppType.Backend,
-    services: {},
+    services: {
+      'iam-api': { alias: 'iam-api', host: 'iam.example.test', type: AppType.Backend, service: 'iam-api' },
+    },
     debug: { all: false },
     oidc: {
       clients: [],
       defaultKeys: {
         RS256: { pk: TEST_PKCS8_PEM },
       },
+      ...oidc,
     },
   } as unknown as Config
 
@@ -38,3 +44,51 @@ describe('combineConfig (jose v6 extractable key)', () => {
     expect(keys[0].kty).toBe('RSA')
   })
 })
+
+describe('combineConfig — scopes and the claims behind them', () => {
+  it('maps each integrated-IAM scope to its own claim', async () => {
+    const config = await combineConfig(makeTestContext() as any, true)
+
+    expect(config.claims?.[PERMISSIONS_SCOPE]).toEqual([PERMISSIONS_CLAIM])
+    expect(config.claims?.[ORGANIZATIONS_SCOPE]).toEqual([ORGANIZATIONS_CLAIM])
+    expect(config.scopes).toContain(ORGANIZATIONS_SCOPE)
+    expect(config.scopes).toContain(PERMISSIONS_SCOPE)
+  })
+})
+
+describe('combineConfig — the discovery document', () => {
+  it('expands a service-relative field against the registered service', async () => {
+    const config = await combineConfig(makeTestContext({
+      discoveryUris: { [IAM_API_METADATA]: '{{iam-api}}/iam/api/runtime' },
+    }) as any, true)
+
+    expect((config.discovery as Record<string, unknown>)[IAM_API_METADATA])
+      .toBe('https://iam.example.test/iam/api/runtime')
+  })
+
+  it('keeps an absolute field and the custom discovery fields as given', async () => {
+    const config = await combineConfig(makeTestContext({
+      discoveryUris: { [IAM_API_METADATA]: 'https://elsewhere.example.test/runtime' },
+      customConfiguration: { discovery: { service_documentation: 'https://docs.example.test' } },
+    }) as any, true)
+
+    expect(config.discovery).toEqual({
+      service_documentation: 'https://docs.example.test',
+      [IAM_API_METADATA]: 'https://elsewhere.example.test/runtime',
+    })
+  })
+})
+
+describe('combineConfig — pairwise subjects pass through', () => {
+  it('keeps the subject options of the custom configuration', async () => {
+    const pairwiseIdentifier = async (_: unknown, accountId: string) => `pairwise:${accountId}`
+    const sectorIdentifierUriValidate = () => false
+    const config = await combineConfig(makeTestContext({
+      customConfiguration: { subjectTypes: ['pairwise'], pairwiseIdentifier, sectorIdentifierUriValidate },
+    }) as any, true)
+
+    expect(config.subjectTypes).toEqual(['pairwise'])
+    expect(config.pairwiseIdentifier).toBe(pairwiseIdentifier)
+    expect(config.sectorIdentifierUriValidate).toBe(sectorIdentifierUriValidate)
+  })
+})

package/tests/pairwise.spec.ts

@@ -0,0 +1,259 @@
+import { describe, it, expect, afterEach } from 'bun:test'
+import { createServer } from 'node:http'
+import type { Server } from 'node:http'
+import type { AddressInfo } from 'node:net'
+import { generateKeyPairSync } from 'node:crypto'
+import Provider from 'oidc-provider'
+import type { ClientMetadata, KoaContextWithOIDC } from 'oidc-provider'
+import { sha256 } from '@noble/hashes/sha2'
+import { base58 } from '@scure/base'
+import { AppType, makeBasicContext } from '@owlmeans/context'
+import { ORGANIZATIONS_CLAIM, ORGANIZATIONS_SCOPE, PERMISSIONS_CLAIM, PERMISSIONS_SCOPE } from '@owlmeans/oidc'
+import { combineConfig } from '../src/utils/config.js'
+import { makeInteractionPolicy } from '../src/utils/policy.js'
+import type { Config } from '../src/types.js'
+
+/**
+ * The subject design of the integrated IAM, driven through the pinned `oidc-provider`: the session
+ * and the grant name the ACCOUNT (its record id, which never leaves the provider), and every
+ * client sees its own pairwise subject for it — in the id_token, in userinfo and in introspection.
+ */
+
+const ACCOUNT = '0123456789abcdef01234567'
+const SECRET = 'pairwise-spec-secret'
+const PREVIEW = 'acme-preview'
+const PRODUCTION = 'acme-production'
+// A constant sector for every client: its host is never fetched, it only lets one client register
+// redirect URIs on several hosts. An unresolvable name proves the provider never fetches it.
+const SECTOR = 'https://sector.invalid/iam'
+
+/** The design's subject: the same on every row of one (account, app). */
+const profileIdOf = (service: string, accountId: string): string =>
+  `${service}:${base58.encode(sha256(new TextEncoder().encode(`${accountId}:${service}`))).slice(0, 22)}`
+
+const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 })
+const PK = privateKey.export({ type: 'pkcs8', format: 'pem' }).toString()
+
+const ORGANIZATIONS = [{ entitySlug: 'acme', entityKey: 'acme-key', owner: true, home: true }]
+const SETS = [{ scope: PREVIEW, permissions: { 'order--view': true }, entitySlug: 'acme' }]
+
+const running: Server[] = []
+afterEach(() => {
+  while (running.length > 0) running.pop()?.close()
+})
+
+const client = (clientId: string): ClientMetadata => ({
+  client_id: clientId,
+  client_secret: SECRET,
+  redirect_uris: [`https://${clientId}.example.test/callback`, `https://${clientId}.other.test/callback`],
+  response_types: ['code'],
+  grant_types: ['authorization_code', 'refresh_token'],
+  token_endpoint_auth_method: 'client_secret_basic',
+  scope: `openid email profile offline_access ${PERMISSIONS_SCOPE} ${ORGANIZATIONS_SCOPE}`,
+  subject_type: 'pairwise',
+  sector_identifier_uri: SECTOR,
+})
+
+/** A real provider configured the way `combineConfig` builds it, with the pairwise options passed through. */
+const start = async () => {
+  const server = createServer()
+  await new Promise<void>(resolve => server.listen(0, '127.0.0.1', resolve))
+  running.push(server)
+  const base = `http://127.0.0.1:${(server.address() as AddressInfo).port}`
+
+  const context = makeBasicContext({
+    ready: false, service: 'pairwise-spec', type: AppType.Backend, services: {}, debug: { all: false },
+    oidc: {
+      clients: [client(PREVIEW), client(PRODUCTION)],
+      defaultKeys: { RS256: { pk: PK } },
+      customConfiguration: {
+        subjectTypes: ['pairwise'],
+        pairwiseIdentifier: async (_ctx: KoaContextWithOIDC, accountId: string, owner: { clientId: string }) =>
+          profileIdOf(owner.clientId, accountId),
+        sectorIdentifierUriValidate: () => false,
+        conformIdTokenClaims: false,
+        features: { introspection: { enabled: true } },
+        cookies: { keys: ['pairwise-spec-cookie-key'] },
+      },
+    },
+  } as unknown as Config)
+
+  const loaded: string[] = []
+  const provider = new Provider(base, {
+    ...await combineConfig(context as any, true),
+    findAccount: async (_, id) => {
+      loaded.push(id)
+      return {
+        accountId: id,
+        claims: async () => ({
+          sub: id, email: 'person@example.test', [ORGANIZATIONS_CLAIM]: ORGANIZATIONS, [PERMISSIONS_CLAIM]: SETS,
+        }),
+      }
+    },
+    interactions: { policy: makeInteractionPolicy(), url: async (_, interaction) => `${base}/login/${interaction.uid}` },
+  })
+  server.on('request', provider.callback())
+
+  return { provider, base, loaded }
+}
+
+type Running = Awaited<ReturnType<typeof start>>
+
+const makeJar = () => {
+  const jar = new Map<string, string>()
+
+  return {
+    get: (name: string) => jar.get(name),
+    header: () => [...jar].map(([name, value]) => `${name}=${value}`).join('; '),
+    remember: (response: Response) => {
+      for (const line of response.headers.getSetCookie()) {
+        const [pair] = line.split(';')
+        const name = pair.slice(0, pair.indexOf('='))
+        const value = pair.slice(pair.indexOf('=') + 1)
+        if (value === '') jar.delete(name)
+        else jar.set(name, value)
+      }
+    },
+  }
+}
+
+const basic = (clientId: string) => `Basic ${Buffer.from(`${clientId}:${SECRET}`).toString('base64')}`
+
+const payloadOf = (jwt: string): Record<string, unknown> =>
+  JSON.parse(Buffer.from(jwt.split('.')[1], 'base64url').toString())
+
+/** Sign the account in to `clientId` the way the application's interaction handler does. */
+const signIn = async (env: Running, clientId: string, scope: string, jar = makeJar()) => {
+  const step = async (url: string, init: RequestInit = {}): Promise<Response> => {
+    const response = await fetch(url, { ...init, redirect: 'manual', headers: { ...init.headers, cookie: jar.header() } })
+    jar.remember(response)
+    return response
+  }
+  const redirectUri = `https://${clientId}.example.test/callback`
+
+  const asked = await step(`${env.base}/auth?${new URLSearchParams({
+    client_id: clientId, redirect_uri: redirectUri, response_type: 'code', scope, prompt: 'consent',
+  })}`)
+  const location = new URL(asked.headers.get('location') ?? 'about:blank')
+  if (location.pathname.startsWith('/login/')) {
+    const interaction = await env.provider.Interaction.find(location.pathname.split('/').pop()!)
+    const grant = new env.provider.Grant({ accountId: ACCOUNT, clientId })
+    grant.addOIDCScope(scope)
+    interaction!.result = { login: { accountId: ACCOUNT }, consent: { grantId: await grant.save() } }
+    await interaction!.save(600)
+    const done = await step(interaction!.returnTo)
+    location.href = done.headers.get('location') ?? 'about:blank'
+  }
+  const code = location.searchParams.get('code')
+  expect(code).not.toBeNull()
+
+  const tokens = await fetch(`${env.base}/token`, {
+    method: 'POST',
+    headers: { authorization: basic(clientId), 'content-type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams({ grant_type: 'authorization_code', code: code!, redirect_uri: redirectUri }),
+  }).then(r => r.json()) as Record<string, string>
+
+  return { tokens, jar }
+}
+
+const userinfo = async (env: Running, accessToken: string) =>
+  await fetch(`${env.base}/me`, { headers: { authorization: `Bearer ${accessToken}` } })
+    .then(r => r.json()) as Record<string, unknown>
+
+const introspect = async (env: Running, clientId: string, token: string) =>
+  await fetch(`${env.base}/token/introspection`, {
+    method: 'POST',
+    headers: { authorization: basic(clientId), 'content-type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams({ token }),
+  }).then(r => r.json()) as Record<string, unknown>
+
+const SCOPE = `openid email offline_access ${PERMISSIONS_SCOPE} ${ORGANIZATIONS_SCOPE}`
+
+describe('pairwise subjects over the pinned oidc-provider', () => {
+  it('one subject per client in the id_token, userinfo and introspection', async () => {
+    const env = await start()
+    const { tokens } = await signIn(env, PREVIEW, SCOPE)
+    const subject = profileIdOf(PREVIEW, ACCOUNT)
+
+    expect(subject).not.toBe(ACCOUNT)
+    expect(payloadOf(tokens.id_token).sub).toBe(subject)
+    expect((await userinfo(env, tokens.access_token)).sub).toBe(subject)
+    const introspected = await introspect(env, PREVIEW, tokens.access_token)
+    expect(introspected.active).toBe(true)
+    expect(introspected.sub).toBe(subject)
+  })
+
+  it('keeps the subject across a refresh', async () => {
+    const env = await start()
+    const { tokens } = await signIn(env, PREVIEW, SCOPE)
+    expect(tokens.refresh_token).toBeDefined()
+
+    const refreshed = await fetch(`${env.base}/token`, {
+      method: 'POST',
+      headers: { authorization: basic(PREVIEW), 'content-type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams({ grant_type: 'refresh_token', refresh_token: tokens.refresh_token }),
+    }).then(r => r.json()) as Record<string, string>
+
+    expect(payloadOf(refreshed.id_token).sub).toBe(profileIdOf(PREVIEW, ACCOUNT))
+  })
+
+  it('the session and the account service see the account id, never the subject', async () => {
+    const env = await start()
+    const { jar } = await signIn(env, PREVIEW, SCOPE)
+
+    const session = await env.provider.Session.find(jar.get('_session')!)
+    expect(session?.accountId).toBe(ACCOUNT)
+    expect(env.loaded.length).toBeGreaterThan(0)
+    expect(new Set(env.loaded)).toEqual(new Set([ACCOUNT]))
+  })
+
+  it('another client of the same account gets another subject from the same session', async () => {
+    const env = await start()
+    const preview = await signIn(env, PREVIEW, SCOPE)
+    const production = await signIn(env, PRODUCTION, SCOPE, preview.jar)
+
+    const subject = profileIdOf(PRODUCTION, ACCOUNT)
+    expect(payloadOf(production.tokens.id_token).sub).toBe(subject)
+    expect(subject).not.toBe(profileIdOf(PREVIEW, ACCOUNT))
+    expect((await introspect(env, PRODUCTION, production.tokens.access_token)).sub).toBe(subject)
+  })
+})
+
+describe('the organizations scope', () => {
+  it('carries the organizations claim and the full permission claim when granted', async () => {
+    const env = await start()
+    const { tokens } = await signIn(env, PREVIEW, SCOPE)
+    const claims = payloadOf(tokens.id_token)
+
+    expect(claims[ORGANIZATIONS_CLAIM]).toEqual(ORGANIZATIONS)
+    expect(claims[PERMISSIONS_CLAIM]).toEqual(SETS)
+    expect((await userinfo(env, tokens.access_token))[ORGANIZATIONS_CLAIM]).toEqual(ORGANIZATIONS)
+  })
+
+  it('emits no organizations claim to a client that did not ask for the scope', async () => {
+    const env = await start()
+    const { tokens } = await signIn(env, PREVIEW, `openid email ${PERMISSIONS_SCOPE}`)
+    const claims = payloadOf(tokens.id_token)
+
+    expect(claims[ORGANIZATIONS_CLAIM]).toBeUndefined()
+    expect(claims[PERMISSIONS_CLAIM]).toEqual(SETS)
+    expect((await userinfo(env, tokens.access_token))[ORGANIZATIONS_CLAIM]).toBeUndefined()
+  })
+})
+
+describe('client metadata under pairwise-only subjects', () => {
+  const providerWith = (metadata: Partial<ClientMetadata>) => new Provider('http://127.0.0.1:1', {
+    subjectTypes: ['pairwise'],
+    pairwiseIdentifier: async (_ctx, accountId, owner) => profileIdOf(owner.clientId, accountId),
+    clients: [{ client_id: PREVIEW, client_secret: SECRET, redirect_uris: ['https://a.example.test/cb'], ...metadata }],
+  })
+
+  it('makes pairwise the default subject type', async () => {
+    expect((await providerWith({}).Client.find(PREVIEW))?.subjectType).toBe('pairwise')
+  })
+
+  it('refuses a client that declares a public subject', async () => {
+    const failure = await providerWith({ subject_type: 'public' }).Client.find(PREVIEW).catch((error: unknown) => error)
+    expect(String(failure)).toContain('invalid_client_metadata')
+  })
+})