@owlmeans/server-oidc-provider 0.1.18-rc.47 → 0.1.18-rc.48
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +2 -2
- package/agent-meta/manifest.json +2 -2
- package/agent-meta/skills/server-oidc-provider/SKILL.md +1 -1
- package/build/service.d.ts.map +1 -1
- package/build/service.js +33 -17
- package/build/service.js.map +1 -1
- package/build/utils/client.d.ts.map +1 -1
- package/build/utils/client.js +6 -5
- package/build/utils/client.js.map +1 -1
- package/package.json +6 -5
- package/src/service.ts +38 -21
- package/src/utils/client.ts +7 -6
package/README.md
CHANGED
|
@@ -14,7 +14,7 @@ Embedded OIDC identity provider — wraps the `oidc-provider` library as an OwlM
|
|
|
14
14
|
## Installation
|
|
15
15
|
|
|
16
16
|
```bash
|
|
17
|
-
bun add @owlmeans/server-oidc-provider@^0.1.18-rc.
|
|
17
|
+
bun add @owlmeans/server-oidc-provider@^0.1.18-rc.48
|
|
18
18
|
```
|
|
19
19
|
|
|
20
20
|
## Usage
|
|
@@ -72,7 +72,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
|
|
|
72
72
|
your project's skill store (`.agents/skills/`):
|
|
73
73
|
|
|
74
74
|
```sh
|
|
75
|
-
npx @owlmeans/agent-skills@^0.1.18-rc.
|
|
75
|
+
npx @owlmeans/agent-skills@^0.1.18-rc.47
|
|
76
76
|
```
|
|
77
77
|
|
|
78
78
|
The embedded files are version-matched to this package release. Do not edit them
|
package/agent-meta/manifest.json
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schemaVersion": 2,
|
|
3
3
|
"package": "@owlmeans/server-oidc-provider",
|
|
4
|
-
"version": "0.1.18-rc.
|
|
5
|
-
"generatedAt": "2026-10-
|
|
4
|
+
"version": "0.1.18-rc.48",
|
|
5
|
+
"generatedAt": "2026-10-03T20:05:07.604Z",
|
|
6
6
|
"canonicalRepo": "https://github.com/owlmeans/common",
|
|
7
7
|
"entries": [
|
|
8
8
|
{
|
|
@@ -8,7 +8,7 @@ user-invocable: false
|
|
|
8
8
|
# @owlmeans/server-oidc-provider
|
|
9
9
|
|
|
10
10
|
**Layer:** Server
|
|
11
|
-
**Install:** `"@owlmeans/server-oidc-provider": "^0.1.18-rc.
|
|
11
|
+
**Install:** `"@owlmeans/server-oidc-provider": "^0.1.18-rc.48"` in `dependencies`
|
|
12
12
|
**Runtime deps:** `oidc-provider@9.11.1` (exact), `jose@6.2.5` (exact), `@types/oidc-provider@9.5.0`
|
|
13
13
|
|
|
14
14
|
Use this only when your service **is** the identity provider. For consuming someone else's issuer,
|
package/build/service.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAA0C,mBAAmB,EAAE,MAAM,YAAY,CAAA;
|
|
1
|
+
{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAA0C,mBAAmB,EAAE,MAAM,YAAY,CAAA;AA2C9G,eAAO,MAAM,yBAAyB,WAAW,MAAM,KAAmB,mBAqGzE,CAAA;AAED,eAAO,MAAM,yBAAyB,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,OACzE,CAAC,UAAS,MAAM,KACpB,CAOF,CAAA"}
|
package/build/service.js
CHANGED
|
@@ -2,10 +2,38 @@ import { assertContext, createService } from '@owlmeans/context';
|
|
|
2
2
|
import { DEFAULT_ALIAS, OIDC_ACCOUNT_SERVICE } from './consts.js';
|
|
3
3
|
import { DEFAULT_PATH, INTERACTION, INTERACTION_UID } from '@owlmeans/oidc';
|
|
4
4
|
import Provider from 'oidc-provider';
|
|
5
|
+
import { logger } from '@owlmeans/log';
|
|
5
6
|
import { PARAM, SEP } from '@owlmeans/route';
|
|
6
7
|
import { makeSecurityHelper } from '@owlmeans/config';
|
|
7
8
|
import { combineConfig } from './utils/config.js';
|
|
8
9
|
import { makeInteractionPolicy } from './utils/policy.js';
|
|
10
|
+
const log = logger('server-oidc-provider');
|
|
11
|
+
/** An OIDC error the provider answers with a 4xx — the client's mistake, not the provider's. */
|
|
12
|
+
const isClientError = (error) => {
|
|
13
|
+
const status = error?.status;
|
|
14
|
+
return typeof status === 'number' && status >= 400 && status < 500;
|
|
15
|
+
};
|
|
16
|
+
/**
|
|
17
|
+
* One provider error. The state dump carries ids only — never a token, code or secret the
|
|
18
|
+
* request holds.
|
|
19
|
+
*/
|
|
20
|
+
const reportProviderError = (issuer, kind, ctx, error) => {
|
|
21
|
+
const state = ctx?.oidc;
|
|
22
|
+
const data = { kind, issuer, clientId: state?.client?.clientId, code: error.error, error };
|
|
23
|
+
if (isClientError(error)) {
|
|
24
|
+
log.warn('OIDC provider refused a request', data);
|
|
25
|
+
}
|
|
26
|
+
else {
|
|
27
|
+
log.error('OIDC provider error', data);
|
|
28
|
+
}
|
|
29
|
+
if (state != null && log.enabled('debug')) {
|
|
30
|
+
log.debug('OIDC provider error state', {
|
|
31
|
+
kind, fields: Object.getOwnPropertyNames(state),
|
|
32
|
+
grant: state.grant != null
|
|
33
|
+
? { grantId: state.grant.jti, accountId: state.grant.accountId, clientId: state.grant.clientId } : undefined,
|
|
34
|
+
});
|
|
35
|
+
}
|
|
36
|
+
};
|
|
9
37
|
let _initializedOidc = undefined;
|
|
10
38
|
export const createOidcProviderService = (alias = DEFAULT_ALIAS) => {
|
|
11
39
|
const service = createService(alias, {
|
|
@@ -73,23 +101,11 @@ export const createOidcProviderService = (alias = DEFAULT_ALIAS) => {
|
|
|
73
101
|
next();
|
|
74
102
|
});
|
|
75
103
|
api.server.use(base, oidc.callback());
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
});
|
|
82
|
-
oidc.on('server_error', (ctx, error) => {
|
|
83
|
-
console.warn('SERVER ERROR .......: ', Object.getOwnPropertyNames(ctx.oidc));
|
|
84
|
-
console.info(ctx.oidc.grant);
|
|
85
|
-
console.error('!!!! SERVER ERROR: ', error);
|
|
86
|
-
});
|
|
87
|
-
oidc.on('userinfo.error', (ctx, error) => {
|
|
88
|
-
console.warn('USER INFO ERROR .......: ', Object.getOwnPropertyNames(ctx.oidc));
|
|
89
|
-
console.info(ctx.oidc.grant);
|
|
90
|
-
console.error('!!!! USER INFO ERROR: ', error);
|
|
91
|
-
});
|
|
92
|
-
}
|
|
104
|
+
// Always attached: a provider error reaches the log — at `warn` when the client caused it
|
|
105
|
+
// (an OIDC 4xx such as `invalid_grant`), at `error` otherwise; the request state at `debug`.
|
|
106
|
+
oidc.on('grant.error', (ctx, error) => { reportProviderError(oidc.issuer, 'grant', ctx, error); });
|
|
107
|
+
oidc.on('server_error', (ctx, error) => { reportProviderError(oidc.issuer, 'server', ctx, error); });
|
|
108
|
+
oidc.on('userinfo.error', (ctx, error) => { reportProviderError(oidc.issuer, 'userinfo', ctx, error); });
|
|
93
109
|
_initializedOidc = service.oidc = oidc;
|
|
94
110
|
},
|
|
95
111
|
instance: () => {
|
package/build/service.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAG3E,OAAO,QAAQ,MAAM,eAAe,CAAA;
|
|
1
|
+
{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAG3E,OAAO,QAAQ,MAAM,eAAe,CAAA;AAEpC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAGtC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AAEzD,MAAM,GAAG,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAA;AAE1C,gGAAgG;AAChG,MAAM,aAAa,GAAG,CAAC,KAAc,EAAW,EAAE;IAChD,MAAM,MAAM,GAAI,KAAqC,EAAE,MAAM,CAAA;IAC7D,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAA;AACpE,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,mBAAmB,GAAG,CAAC,MAAc,EAAE,IAAY,EAAE,GAAmC,EAAE,KAAY,EAAQ,EAAE;IACpH,MAAM,KAAK,GAAG,GAAG,EAAE,IAEN,CAAA;IACb,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAG,KAA6B,CAAC,KAAK,EAAE,KAAK,EAAE,CAAA;IACnH,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE,IAAI,CAAC,CAAA;IACnD,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAA;IACxC,CAAC;IACD,IAAI,KAAK,IAAI,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,KAAK,CAAC,2BAA2B,EAAE;YACrC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC;YAC/C,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;gBACxB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC/G,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAA;AAED,IAAI,gBAAgB,GAAyB,SAAS,CAAA;AACtD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,KAAK,GAAW,aAAa,EAAuB,EAAE;IAC9F,MAAM,OAAO,GAAwB,aAAa,CAAsB,KAAK,EAAE;QAC7E,MAAM,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,EAAE,KAAK,CAAC,CAAA;YAC7E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA;YAE5B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAe,CAAA;YAC/F,MAAM,MAAM,GAAG,kBAAkB,CAAkB,OAAO,CAAC,CAAA;YAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,QAAQ,IAAI,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YACtF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;YAE5F,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE;gBAC7B,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC;gBAEzC,OAAO,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI;oBACjC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAqB,GAAG,CAAC,cAAe,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBACjF,CAAC,CAAC,SAAS;gBAEb,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE;oBACrC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAChC,GAAG,CAAC,cAAc,IAAI,oBAAoB,CAC3C,CAAA;oBAED,MAAM,QAAQ,GAAI,IAAsD,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ;2BAC1F,KAA2C,EAAE,QAAQ,CAAA;oBAE3D,OAAO,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;gBACvD,CAAC;gBAED,YAAY,EAAE;oBACZ,MAAM,EAAE,qBAAqB,EAAE;oBAC/B,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE;wBAC5B,iFAAiF;wBACjF,wEAAwE;wBACxE,uFAAuF;wBACvF,uFAAuF;wBACvF,sFAAsF;wBACtF,cAAc;wBACd,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAmB,WAAW,CAAC,CAAA;wBAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC;6BACjC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,GAAG,KAAK,GAAG,eAAe,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;6BAC3E,IAAI,CAAC,GAAG,CAAC,CAAA;wBAEZ,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAA;oBAC9C,CAAC;iBACF;aACF,CAAC,CAAA;YAEF,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,WAAW,IAAI,QAAQ,CAAA;YACxC,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,YAAY,CAAC,CAAA;YAEjD;;;;;;;;;;eAUG;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAa,EAAE,GAAmB,EAAE,IAAgB,EAAE,EAAE;gBAC5E,mFAAmF;gBACnF,uFAAuF;gBACvF,yFAAyF;gBACzF,oFAAoF;gBACpF,6DAA6D;gBAC7D,GAAG,CAAC,SAAS,CAAC,4BAA4B,EAAE,aAAa,CAAC,CAAA;gBAE1D,oFAAoF;gBACpF,8BAA8B;gBAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAA;gBACpD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;oBAClE,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC,CAAA;gBAC9F,CAAC;gBAED,IAAI,EAAE,CAAA;YACR,CAAC,CAAC,CAAA;YAEF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;YAErC,0FAA0F;YAC1F,6FAA6F;YAC7F,IAAI,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;YACjG,IAAI,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;YACnG,IAAI,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;YAEvG,gBAAgB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAA;QACxC,CAAC;QAED,QAAQ,EAAE,GAAG,EAAE;YACb,OAAO,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,gBAAiB,CAAC,CAAA;QAC3D,CAAC;QAED,cAAc,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE;YACzB,OAAO,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,CAAA;QAC9D,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,GAAM,EAAE,KAAK,GAAW,aAAa,EAClC,EAAE;IACL,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAA;IAChD,MAAM,OAAO,GAAG,GAAQ,CAAA;IAExB,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAEhC,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/utils/client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,KAAK,EAAU,OAAO,EAAE,MAAM,aAAa,CAAA;AAElD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;
|
|
1
|
+
{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/utils/client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,KAAK,EAAU,OAAO,EAAE,MAAM,aAAa,CAAA;AAElD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAMtD,eAAO,MAAM,YAAY,YAAa,OAAO,UAAU,cAAc,KAAG,cAkBvE,CAAA;AAED,qGAAqG;AACrG,eAAO,MAAM,cAAc,YAAa,OAAO,UAAU,cAAc,WAAW,MAAM,KAAG,MAS1F,CAAA"}
|
package/build/utils/client.js
CHANGED
|
@@ -2,17 +2,18 @@ import { randomBytes } from '@noble/hashes/utils';
|
|
|
2
2
|
import { hex } from '@scure/base';
|
|
3
3
|
import { makeSecurityHelper } from '@owlmeans/config';
|
|
4
4
|
import { SEP } from '@owlmeans/route';
|
|
5
|
+
import { logger } from '@owlmeans/log';
|
|
6
|
+
const log = logger('server-oidc-provider');
|
|
5
7
|
export const updateClient = (context, client) => {
|
|
6
8
|
if (client.client_secret == null) {
|
|
7
9
|
if (!context.cfg.debug.all && !context.cfg.debug.oidc) {
|
|
8
10
|
throw new SyntaxError('Client secret is required');
|
|
9
11
|
}
|
|
10
12
|
client.client_secret = hex.encode(randomBytes(32));
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
console.info('\n');
|
|
13
|
+
// The secret itself is never written to a log.
|
|
14
|
+
log.warn('Exceptionally insecure: a client secret was generated for an OIDC client (debug only)', {
|
|
15
|
+
clientId: client.client_id,
|
|
16
|
+
});
|
|
16
17
|
}
|
|
17
18
|
const helper = makeSecurityHelper(context);
|
|
18
19
|
const updateUri = makeUriUpdater(context, helper);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/utils/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAGjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAErD,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;
|
|
1
|
+
{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/utils/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAGjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAErD,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAEtC,MAAM,GAAG,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAA;AAE1C,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAgB,EAAE,MAAsB,EAAkB,EAAE;IACvF,IAAI,MAAM,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACtD,MAAM,IAAI,WAAW,CAAC,2BAA2B,CAAC,CAAA;QACpD,CAAC;QACD,MAAM,CAAC,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;QAClD,+CAA+C;QAC/C,GAAG,CAAC,IAAI,CAAC,uFAAuF,EAAE;YAChG,QAAQ,EAAE,MAAM,CAAC,SAAS;SAC3B,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAkB,OAAO,CAAC,CAAA;IAC3D,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACjD,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;IACjE,MAAM,CAAC,yBAAyB,GAAG,MAAM,CAAC,yBAAyB,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;IAEzF,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,qGAAqG;AACrG,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAgB,EAAE,MAAsB,EAAE,EAAE,CAAC,CAAC,GAAW,EAAU,EAAE;IAClG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAEvC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QACvD,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACjD,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@owlmeans/server-oidc-provider",
|
|
3
|
-
"version": "0.1.18-rc.
|
|
3
|
+
"version": "0.1.18-rc.48",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"scripts": {
|
|
@@ -35,13 +35,14 @@
|
|
|
35
35
|
},
|
|
36
36
|
"dependencies": {
|
|
37
37
|
"@noble/hashes": "^1.5.0",
|
|
38
|
-
"@owlmeans/config": "^0.1.18-rc.
|
|
38
|
+
"@owlmeans/config": "^0.1.18-rc.42",
|
|
39
39
|
"@owlmeans/context": "^0.1.18-rc.32",
|
|
40
40
|
"@owlmeans/entrypoint": "^0.1.18-rc.39",
|
|
41
|
-
"@owlmeans/
|
|
41
|
+
"@owlmeans/log": "^0.1.18-rc.0",
|
|
42
|
+
"@owlmeans/oidc": "^0.1.18-rc.53",
|
|
42
43
|
"@owlmeans/route": "^0.1.18-rc.33",
|
|
43
|
-
"@owlmeans/server-api": "^0.1.18-rc.
|
|
44
|
-
"@owlmeans/server-context": "^0.1.18-rc.
|
|
44
|
+
"@owlmeans/server-api": "^0.1.18-rc.49",
|
|
45
|
+
"@owlmeans/server-context": "^0.1.18-rc.41",
|
|
45
46
|
"@scure/base": "^2.3.0",
|
|
46
47
|
"jose": "6.2.5",
|
|
47
48
|
"oidc-provider": "9.11.1"
|
package/src/service.ts
CHANGED
|
@@ -4,6 +4,8 @@ import { DEFAULT_PATH, INTERACTION, INTERACTION_UID } from '@owlmeans/oidc'
|
|
|
4
4
|
import type { ServerResponse } from 'node:http'
|
|
5
5
|
import type { Config, Context, OidcAccountService, OidcAdapterService, OidcProviderService } from './types.js'
|
|
6
6
|
import Provider from 'oidc-provider'
|
|
7
|
+
import type { KoaContextWithOIDC } from 'oidc-provider'
|
|
8
|
+
import { logger } from '@owlmeans/log'
|
|
7
9
|
import type { BasicRoute } from '@owlmeans/route'
|
|
8
10
|
import type { CommonEntrypoint } from '@owlmeans/entrypoint'
|
|
9
11
|
import { PARAM, SEP } from '@owlmeans/route'
|
|
@@ -11,6 +13,37 @@ import { makeSecurityHelper } from '@owlmeans/config'
|
|
|
11
13
|
import { combineConfig } from './utils/config.js'
|
|
12
14
|
import { makeInteractionPolicy } from './utils/policy.js'
|
|
13
15
|
|
|
16
|
+
const log = logger('server-oidc-provider')
|
|
17
|
+
|
|
18
|
+
/** An OIDC error the provider answers with a 4xx — the client's mistake, not the provider's. */
|
|
19
|
+
const isClientError = (error: unknown): boolean => {
|
|
20
|
+
const status = (error as { status?: unknown } | null)?.status
|
|
21
|
+
return typeof status === 'number' && status >= 400 && status < 500
|
|
22
|
+
}
|
|
23
|
+
|
|
24
|
+
/**
|
|
25
|
+
* One provider error. The state dump carries ids only — never a token, code or secret the
|
|
26
|
+
* request holds.
|
|
27
|
+
*/
|
|
28
|
+
const reportProviderError = (issuer: string, kind: string, ctx: KoaContextWithOIDC | undefined, error: Error): void => {
|
|
29
|
+
const state = ctx?.oidc as unknown as {
|
|
30
|
+
client?: { clientId?: string }, grant?: { jti?: string, accountId?: string, clientId?: string }
|
|
31
|
+
} | undefined
|
|
32
|
+
const data = { kind, issuer, clientId: state?.client?.clientId, code: (error as { error?: unknown }).error, error }
|
|
33
|
+
if (isClientError(error)) {
|
|
34
|
+
log.warn('OIDC provider refused a request', data)
|
|
35
|
+
} else {
|
|
36
|
+
log.error('OIDC provider error', data)
|
|
37
|
+
}
|
|
38
|
+
if (state != null && log.enabled('debug')) {
|
|
39
|
+
log.debug('OIDC provider error state', {
|
|
40
|
+
kind, fields: Object.getOwnPropertyNames(state),
|
|
41
|
+
grant: state.grant != null
|
|
42
|
+
? { grantId: state.grant.jti, accountId: state.grant.accountId, clientId: state.grant.clientId } : undefined,
|
|
43
|
+
})
|
|
44
|
+
}
|
|
45
|
+
}
|
|
46
|
+
|
|
14
47
|
let _initializedOidc: Provider | undefined = undefined
|
|
15
48
|
export const createOidcProviderService = (alias: string = DEFAULT_ALIAS): OidcProviderService => {
|
|
16
49
|
const service: OidcProviderService = createService<OidcProviderService>(alias, {
|
|
@@ -94,27 +127,11 @@ export const createOidcProviderService = (alias: string = DEFAULT_ALIAS): OidcPr
|
|
|
94
127
|
|
|
95
128
|
api.server.use(base, oidc.callback())
|
|
96
129
|
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
console.error('!!!! GRANT ERROR: ', error)
|
|
103
|
-
})
|
|
104
|
-
|
|
105
|
-
oidc.on('server_error', (ctx, error) => {
|
|
106
|
-
console.warn('SERVER ERROR .......: ', Object.getOwnPropertyNames(ctx.oidc))
|
|
107
|
-
console.info((ctx.oidc as any).grant)
|
|
108
|
-
console.error('!!!! SERVER ERROR: ', error)
|
|
109
|
-
})
|
|
110
|
-
|
|
111
|
-
oidc.on('userinfo.error', (ctx, error) => {
|
|
112
|
-
console.warn('USER INFO ERROR .......: ', Object.getOwnPropertyNames(ctx.oidc))
|
|
113
|
-
console.info((ctx.oidc as any).grant)
|
|
114
|
-
console.error('!!!! USER INFO ERROR: ', error)
|
|
115
|
-
})
|
|
116
|
-
|
|
117
|
-
}
|
|
130
|
+
// Always attached: a provider error reaches the log — at `warn` when the client caused it
|
|
131
|
+
// (an OIDC 4xx such as `invalid_grant`), at `error` otherwise; the request state at `debug`.
|
|
132
|
+
oidc.on('grant.error', (ctx, error) => { reportProviderError(oidc.issuer, 'grant', ctx, error) })
|
|
133
|
+
oidc.on('server_error', (ctx, error) => { reportProviderError(oidc.issuer, 'server', ctx, error) })
|
|
134
|
+
oidc.on('userinfo.error', (ctx, error) => { reportProviderError(oidc.issuer, 'userinfo', ctx, error) })
|
|
118
135
|
|
|
119
136
|
_initializedOidc = service.oidc = oidc
|
|
120
137
|
},
|
package/src/utils/client.ts
CHANGED
|
@@ -5,6 +5,9 @@ import type { Config, Context } from '../types.js'
|
|
|
5
5
|
import { makeSecurityHelper } from '@owlmeans/config'
|
|
6
6
|
import type { SecurityHelper } from '@owlmeans/config'
|
|
7
7
|
import { SEP } from '@owlmeans/route'
|
|
8
|
+
import { logger } from '@owlmeans/log'
|
|
9
|
+
|
|
10
|
+
const log = logger('server-oidc-provider')
|
|
8
11
|
|
|
9
12
|
export const updateClient = (context: Context, client: ClientMetadata): ClientMetadata => {
|
|
10
13
|
if (client.client_secret == null) {
|
|
@@ -12,12 +15,10 @@ export const updateClient = (context: Context, client: ClientMetadata): ClientMe
|
|
|
12
15
|
throw new SyntaxError('Client secret is required')
|
|
13
16
|
}
|
|
14
17
|
client.client_secret = hex.encode(randomBytes(32))
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
console.info('~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~')
|
|
20
|
-
console.info('\n')
|
|
18
|
+
// The secret itself is never written to a log.
|
|
19
|
+
log.warn('Exceptionally insecure: a client secret was generated for an OIDC client (debug only)', {
|
|
20
|
+
clientId: client.client_id,
|
|
21
|
+
})
|
|
21
22
|
}
|
|
22
23
|
|
|
23
24
|
const helper = makeSecurityHelper<Config, Context>(context)
|