@owlmeans/server-oidc-provider 0.1.18-rc.49 → 0.1.18-rc.50

package/README.md

@@ -14,7 +14,7 @@ Embedded OIDC identity provider — wraps the `oidc-provider` library as an OwlM
 ## Installation
 
 ```bash
-bun add @owlmeans/server-oidc-provider@^0.1.18-rc.49
+bun add @owlmeans/server-oidc-provider@^0.1.18-rc.50
 ```
 
 ## Usage
@@ -72,7 +72,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.48
+npx @owlmeans/agent-skills@^0.1.18-rc.49
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-oidc-provider",
-  "version": "0.1.18-rc.49",
-  "generatedAt": "2026-10-05T08:32:19.130Z",
+  "version": "0.1.18-rc.50",
+  "generatedAt": "2026-10-05T21:03:06.408Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-oidc-provider/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/server-oidc-provider
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-oidc-provider": "^0.1.18-rc.49"` in `dependencies`
+**Install:** `"@owlmeans/server-oidc-provider": "^0.1.18-rc.50"` in `dependencies`
 **Runtime deps:** `oidc-provider@9.11.1` (exact), `jose@6.2.5` (exact), `@types/oidc-provider@9.5.0`
 
 Use this only when your service **is** the identity provider. For consuming someone else's issuer,

package/build/iam.d.ts

@@ -1,4 +1,4 @@
-import type { OidcClientMetadata, OidcRegisteredClient } from './types.js';
+import type { ToClientMetadata } from './types.js';
 /** Convert an OidcRegisteredClient to the oidc-provider ClientMetadata shape. */
-export declare const toClientMetadata: (client: OidcRegisteredClient) => OidcClientMetadata;
+export declare const toClientMetadata: ToClientMetadata;
 //# sourceMappingURL=iam.d.ts.map

package/build/iam.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"iam.d.ts","sourceRoot":"","sources":["../src/iam.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAE1E,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,WAAY,oBAAoB,KAAG,kBAS9D,CAAA"}
+{"version":3,"file":"iam.d.ts","sourceRoot":"","sources":["../src/iam.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAA4C,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAE5F,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,EAAE,gBAS7B,CAAA"}

package/build/iam.js.map

@@ -1 +1 @@
-{"version":3,"file":"iam.js","sourceRoot":"","sources":["../src/iam.ts"],"names":[],"mappings":"AAGA,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAA4B,EAAsB,EAAE,CAAC,CAAC;IACrF,SAAS,EAAE,MAAM,CAAC,QAAQ;IAC1B,aAAa,EAAE,MAAM,CAAC,MAAM;IAC5B,aAAa,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;IACxC,WAAW,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC;IACzE,cAAc,EAAE,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,CAAmB;IACpE,0BAA0B,EAAE,qBAAqB;IACjD,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,+BAA+B;IACtD,WAAW,EAAE,MAAM,CAAC,QAAQ;CAC7B,CAAC,CAAA"}
+{"version":3,"file":"iam.js","sourceRoot":"","sources":["../src/iam.ts"],"names":[],"mappings":"AAGA,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAqB,CAAC,MAA4B,EAAsB,EAAE,CAAC,CAAC;IACvG,SAAS,EAAE,MAAM,CAAC,QAAQ;IAC1B,aAAa,EAAE,MAAM,CAAC,MAAM;IAC5B,aAAa,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;IACxC,WAAW,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC;IACzE,cAAc,EAAE,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,CAAmB;IACpE,0BAA0B,EAAE,qBAAqB;IACjD,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,+BAA+B;IACtD,WAAW,EAAE,MAAM,CAAC,QAAQ;CAC7B,CAAC,CAAA"}

package/build/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAOnD,eAAO,MAAM,4BAA4B,SAAS,MAAM,8BAqBvD,CAAA"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAOnD,eAAO,MAAM,4BAA4B,SAAS,MAAM,SAAoB,MAAM,KAAmB,UAqBpG,CAAA"}

package/build/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClF,OAAO,EAAE,aAAa,IAAI,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAEjE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAG3C,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,GAAG,GAAW,SAAS,EAAE,IAAI,GAAG,aAAa,EAAE,EAAE;IAC5F,MAAM,UAAU,GAAe;QAC7B,IAAI,EAAE,cAAc,CAAC,OAAO;QAC5B,KAAK,EAAE,eAAe,CAAC,OAAO;QAC9B,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACjB,MAAM,OAAO,GAAG,aAAa,CAAkB,GAAyB,CAAY,CAAA;YACpF,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAY,GAAG,CAAC,CAAA;YAClD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAsB,IAAI,CAAC,CAAA;YAE9D,MAAM,MAAM,GAAG,sBAAsB,GAAG,IAAI,IAAI,EAAE,CAAA;YAClD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;gBAC3D,MAAM,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;gBACpC,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;oBAC5B,GAAG,CAAC,GAAG,CAAC,OAAO,GAAG,EAAE,CAAA;gBACtB,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;YACtC,CAAC;QACH,CAAC;KACF,CAAA;IAED,OAAO,UAAU,CAAA;AACnB,CAAC,CAAA"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClF,OAAO,EAAE,aAAa,IAAI,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAEjE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAG3C,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,GAAG,GAAW,SAAS,EAAE,IAAI,GAAW,aAAa,EAAc,EAAE;IAChH,MAAM,UAAU,GAAe;QAC7B,IAAI,EAAE,cAAc,CAAC,OAAO;QAC5B,KAAK,EAAE,eAAe,CAAC,OAAO;QAC9B,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACjB,MAAM,OAAO,GAAG,aAAa,CAAkB,GAAyB,CAAY,CAAA;YACpF,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAY,GAAG,CAAC,CAAA;YAClD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAsB,IAAI,CAAC,CAAA;YAE9D,MAAM,MAAM,GAAG,sBAAsB,GAAG,IAAI,IAAI,EAAE,CAAA;YAClD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;gBAC3D,MAAM,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;gBACpC,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;oBAC5B,GAAG,CAAC,GAAG,CAAC,OAAO,GAAG,EAAE,CAAA;gBACtB,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;YACtC,CAAC;QACH,CAAC;KACF,CAAA;IAED,OAAO,UAAU,CAAA;AACnB,CAAC,CAAA"}

package/build/service.js

@@ -5,7 +5,7 @@ import Provider from 'oidc-provider';
 import { logger } from '@owlmeans/log';
 import { PARAM, SEP } from '@owlmeans/route';
 import { makeSecurityHelper } from '@owlmeans/config';
-import { combineConfig } from './utils/config.js';
+import { oidcConfigOf } from './utils/config.js';
 import { makeInteractionPolicy } from './utils/policy.js';
 const log = logger('server-oidc-provider');
 /** An OIDC error the provider answers with a 4xx — the client's mistake, not the provider's. */
@@ -45,7 +45,7 @@ export const createOidcProviderService = (alias = DEFAULT_ALIAS) => {
             const url = helper.makeUrl(serviceRoute, cfg.basePath ?? DEFAULT_PATH, { base: true });
             const unsecure = context.cfg.security?.unsecure === false ? false : !url.startsWith('https');
             const oidc = new Provider(url, {
-                ...await combineConfig(context, unsecure),
+                ...await oidcConfigOf(context).combineConfig(unsecure),
                 adapter: cfg.adapterService != null
                     ? name => context.service(cfg.adapterService).instance(name)
                     : undefined,

package/build/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAG3E,OAAO,QAAQ,MAAM,eAAe,CAAA;AAEpC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAGtC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AAEzD,MAAM,GAAG,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAA;AAE1C,gGAAgG;AAChG,MAAM,aAAa,GAAG,CAAC,KAAc,EAAW,EAAE;IAChD,MAAM,MAAM,GAAI,KAAqC,EAAE,MAAM,CAAA;IAC7D,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAA;AACpE,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,mBAAmB,GAAG,CAAC,MAAc,EAAE,IAAY,EAAE,GAAmC,EAAE,KAAY,EAAQ,EAAE;IACpH,MAAM,KAAK,GAAG,GAAG,EAAE,IAEN,CAAA;IACb,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAG,KAA6B,CAAC,KAAK,EAAE,KAAK,EAAE,CAAA;IACnH,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE,IAAI,CAAC,CAAA;IACnD,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAA;IACxC,CAAC;IACD,IAAI,KAAK,IAAI,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,KAAK,CAAC,2BAA2B,EAAE;YACrC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC;YAC/C,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;gBACxB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC/G,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAA;AAED,IAAI,gBAAgB,GAAyB,SAAS,CAAA;AACtD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,KAAK,GAAW,aAAa,EAAuB,EAAE;IAC9F,MAAM,OAAO,GAAwB,aAAa,CAAsB,KAAK,EAAE;QAC7E,MAAM,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,EAAE,KAAK,CAAC,CAAA;YAC7E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA;YAE5B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAe,CAAA;YAC/F,MAAM,MAAM,GAAG,kBAAkB,CAAkB,OAAO,CAAC,CAAA;YAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,QAAQ,IAAI,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YACtF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;YAE5F,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE;gBAC7B,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC;gBAEzC,OAAO,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI;oBACjC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAqB,GAAG,CAAC,cAAe,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBACjF,CAAC,CAAC,SAAS;gBAEb,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE;oBACrC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAChC,GAAG,CAAC,cAAc,IAAI,oBAAoB,CAC3C,CAAA;oBAED,MAAM,QAAQ,GAAI,IAAsD,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ;2BAC1F,KAA2C,EAAE,QAAQ,CAAA;oBAE3D,OAAO,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;gBACvD,CAAC;gBAED,YAAY,EAAE;oBACZ,MAAM,EAAE,qBAAqB,EAAE;oBAC/B,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE;wBAC5B,iFAAiF;wBACjF,wEAAwE;wBACxE,uFAAuF;wBACvF,uFAAuF;wBACvF,sFAAsF;wBACtF,cAAc;wBACd,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAmB,WAAW,CAAC,CAAA;wBAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC;6BACjC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,GAAG,KAAK,GAAG,eAAe,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;6BAC3E,IAAI,CAAC,GAAG,CAAC,CAAA;wBAEZ,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAA;oBAC9C,CAAC;iBACF;aACF,CAAC,CAAA;YAEF,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,WAAW,IAAI,QAAQ,CAAA;YACxC,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,YAAY,CAAC,CAAA;YAEjD;;;;;;;;;;eAUG;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAa,EAAE,GAAmB,EAAE,IAAgB,EAAE,EAAE;gBAC5E,mFAAmF;gBACnF,uFAAuF;gBACvF,yFAAyF;gBACzF,oFAAoF;gBACpF,6DAA6D;gBAC7D,GAAG,CAAC,SAAS,CAAC,4BAA4B,EAAE,aAAa,CAAC,CAAA;gBAE1D,oFAAoF;gBACpF,8BAA8B;gBAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAA;gBACpD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;oBAClE,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC,CAAA;gBAC9F,CAAC;gBAED,IAAI,EAAE,CAAA;YACR,CAAC,CAAC,CAAA;YAEF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;YAErC,0FAA0F;YAC1F,6FAA6F;YAC7F,IAAI,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;YACjG,IAAI,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;YACnG,IAAI,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;YAEvG,gBAAgB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAA;QACxC,CAAC;QAED,QAAQ,EAAE,GAAG,EAAE;YACb,OAAO,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,gBAAiB,CAAC,CAAA;QAC3D,CAAC;QAED,cAAc,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE;YACzB,OAAO,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,CAAA;QAC9D,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,GAAM,EAAE,KAAK,GAAW,aAAa,EAClC,EAAE;IACL,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAA;IAChD,MAAM,OAAO,GAAG,GAAQ,CAAA;IAExB,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAEhC,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAG3E,OAAO,QAAQ,MAAM,eAAe,CAAA;AAEpC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAGtC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AAEzD,MAAM,GAAG,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAA;AAE1C,gGAAgG;AAChG,MAAM,aAAa,GAAG,CAAC,KAAc,EAAW,EAAE;IAChD,MAAM,MAAM,GAAI,KAAqC,EAAE,MAAM,CAAA;IAC7D,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAA;AACpE,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,mBAAmB,GAAG,CAAC,MAAc,EAAE,IAAY,EAAE,GAAmC,EAAE,KAAY,EAAQ,EAAE;IACpH,MAAM,KAAK,GAAG,GAAG,EAAE,IAEN,CAAA;IACb,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAG,KAA6B,CAAC,KAAK,EAAE,KAAK,EAAE,CAAA;IACnH,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE,IAAI,CAAC,CAAA;IACnD,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAA;IACxC,CAAC;IACD,IAAI,KAAK,IAAI,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,KAAK,CAAC,2BAA2B,EAAE;YACrC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC;YAC/C,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;gBACxB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC/G,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAA;AAED,IAAI,gBAAgB,GAAyB,SAAS,CAAA;AACtD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,KAAK,GAAW,aAAa,EAAuB,EAAE;IAC9F,MAAM,OAAO,GAAwB,aAAa,CAAsB,KAAK,EAAE;QAC7E,MAAM,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,EAAE,KAAK,CAAC,CAAA;YAC7E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA;YAE5B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAe,CAAA;YAC/F,MAAM,MAAM,GAAG,kBAAkB,CAAkB,OAAO,CAAC,CAAA;YAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,QAAQ,IAAI,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YACtF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;YAE5F,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE;gBAC7B,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC;gBAEtD,OAAO,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI;oBACjC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAqB,GAAG,CAAC,cAAe,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBACjF,CAAC,CAAC,SAAS;gBAEb,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE;oBACrC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAChC,GAAG,CAAC,cAAc,IAAI,oBAAoB,CAC3C,CAAA;oBAED,MAAM,QAAQ,GAAI,IAAsD,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ;2BAC1F,KAA2C,EAAE,QAAQ,CAAA;oBAE3D,OAAO,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;gBACvD,CAAC;gBAED,YAAY,EAAE;oBACZ,MAAM,EAAE,qBAAqB,EAAE;oBAC/B,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE;wBAC5B,iFAAiF;wBACjF,wEAAwE;wBACxE,uFAAuF;wBACvF,uFAAuF;wBACvF,sFAAsF;wBACtF,cAAc;wBACd,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAmB,WAAW,CAAC,CAAA;wBAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC;6BACjC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,GAAG,KAAK,GAAG,eAAe,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;6BAC3E,IAAI,CAAC,GAAG,CAAC,CAAA;wBAEZ,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAA;oBAC9C,CAAC;iBACF;aACF,CAAC,CAAA;YAEF,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,WAAW,IAAI,QAAQ,CAAA;YACxC,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,YAAY,CAAC,CAAA;YAEjD;;;;;;;;;;eAUG;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAa,EAAE,GAAmB,EAAE,IAAgB,EAAE,EAAE;gBAC5E,mFAAmF;gBACnF,uFAAuF;gBACvF,yFAAyF;gBACzF,oFAAoF;gBACpF,6DAA6D;gBAC7D,GAAG,CAAC,SAAS,CAAC,4BAA4B,EAAE,aAAa,CAAC,CAAA;gBAE1D,oFAAoF;gBACpF,8BAA8B;gBAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAA;gBACpD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;oBAClE,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC,CAAA;gBAC9F,CAAC;gBAED,IAAI,EAAE,CAAA;YACR,CAAC,CAAC,CAAA;YAEF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;YAErC,0FAA0F;YAC1F,6FAA6F;YAC7F,IAAI,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;YACjG,IAAI,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;YACnG,IAAI,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;YAEvG,gBAAgB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAA;QACxC,CAAC;QAED,QAAQ,EAAE,GAAG,EAAE;YACb,OAAO,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,gBAAiB,CAAC,CAAA;QAC3D,CAAC;QAED,cAAc,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE;YACzB,OAAO,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,CAAA;QAC9D,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,GAAM,EAAE,KAAK,GAAW,aAAa,EAClC,EAAE;IACL,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAA;IAChD,MAAM,OAAO,GAAG,GAAQ,CAAA;IAExB,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAEhC,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/types.d.ts

@@ -3,7 +3,6 @@ import type { OidcSharedConfig } from '@owlmeans/oidc';
 import type { ApiServer, ApiServerAppend } from '@owlmeans/server-api';
 import type { ServerConfig, ServerContext } from '@owlmeans/server-context';
 import type { Account, Adapter, ClientMetadata, Configuration, Interaction, Provider } from 'oidc-provider';
-import { toClientMetadata } from './iam.js';
 export interface OidcProviderService extends InitializedService {
     oidc: Provider;
     update: (api: ApiServer) => Promise<void>;
@@ -79,14 +78,18 @@ export interface OidcRegisteredClient {
     scope?: string;
 }
 /** Full oidc-provider ClientMetadata with our entity extension. */
-export type OidcClientMetadata = ClientMetadata & {
+export interface OidcClientMetadata extends ClientMetadata {
     entityId?: string;
     owlEntityId?: string;
-};
+}
+/** Converts a stored client record to oidc-provider ClientMetadata. */
+export interface ToClientMetadata {
+    (client: OidcRegisteredClient): OidcClientMetadata;
+}
 /** Extension seam for IAM integration into the OIDC provider — Phase 2 fills this */
 export interface OidcProviderIamExtension {
     /** Convert a stored client record to oidc-provider ClientMetadata */
-    toClientMetadata: typeof toClientMetadata;
+    toClientMetadata: ToClientMetadata;
     /** Type of a stored client record */
     OidcRegisteredClient: OidcRegisteredClient;
     /** Extended metadata type */

package/build/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtE,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC3E,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC3G,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAE3C,MAAM,WAAW,mBAAoB,SAAQ,kBAAkB;IAC7D,IAAI,EAAE,QAAQ,CAAA;IAEd,MAAM,EAAE,CAAC,GAAG,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAEzC,QAAQ,EAAE,MAAM,QAAQ,CAAA;IAExB,cAAc,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;CAC5D;AAED,MAAM,WAAW,gBAAgB,CAAC,KAAK,SAAS,gBAAgB,GAAG,gBAAgB;IACjF,IAAI,EAAE,UAAU,GAAG,KAAK,CAAA;CACzB;AAED,MAAM,WAAW,UAAW,SAAQ,gBAAgB;IAClD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,cAAc,EAAE,CAAA;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACtC,mBAAmB,CAAC,EAAE,uBAAuB,CAAA;IAC7C,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,WAAW,EAAE;QACX,KAAK,EAAE;YACL,EAAE,EAAE,MAAM,CAAA;YACV,GAAG,CAAC,EAAE,MAAM,CAAA;SACb,CAAA;KACF,CAAA;IACD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAwB,SAAQ,aAAa;IAC5D,2BAA2B,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,OAAO,CAAA;CACpF;AAED,MAAM,WAAW,iBAAiB;IAChC,oHAAoH;IACpH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D,QAAQ,EAAE,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,iBAAiB,KAAK,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;CACnI;AAED,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;CACpC;AAED,MAAM,WAAW,MAAO,SAAQ,YAAY,EAAE,gBAAgB;IAC5D,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG;QAC7B,IAAI,CAAC,EAAE,OAAO,CAAA;QACd,UAAU,CAAC,EAAE,OAAO,CAAA;QACpB,QAAQ,CAAC,EAAE,OAAO,CAAA;KACnB,CAAA;CACF;AAED,MAAM,WAAW,OAAO,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,CAAE,SAAQ,aAAa,CAAC,CAAC,CAAC,EACxE,eAAe;CAAI;AAEvB,wEAAwE;AACxE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,+BAA+B;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,mEAAmE;AACnE,MAAM,MAAM,kBAAkB,GAAG,cAAc,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAE7F,qFAAqF;AACrF,MAAM,WAAW,wBAAwB;IACvC,qEAAqE;IACrE,gBAAgB,EAAE,OAAO,gBAAgB,CAAA;IACzC,qCAAqC;IACrC,oBAAoB,EAAE,oBAAoB,CAAA;IAC1C,6BAA6B;IAC7B,kBAAkB,EAAE,kBAAkB,CAAA;CACvC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtE,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC3E,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAE3G,MAAM,WAAW,mBAAoB,SAAQ,kBAAkB;IAC7D,IAAI,EAAE,QAAQ,CAAA;IAEd,MAAM,EAAE,CAAC,GAAG,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAEzC,QAAQ,EAAE,MAAM,QAAQ,CAAA;IAExB,cAAc,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;CAC5D;AAED,MAAM,WAAW,gBAAgB,CAAC,KAAK,SAAS,gBAAgB,GAAG,gBAAgB;IACjF,IAAI,EAAE,UAAU,GAAG,KAAK,CAAA;CACzB;AAED,MAAM,WAAW,UAAW,SAAQ,gBAAgB;IAClD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,cAAc,EAAE,CAAA;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACtC,mBAAmB,CAAC,EAAE,uBAAuB,CAAA;IAC7C,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,WAAW,EAAE;QACX,KAAK,EAAE;YACL,EAAE,EAAE,MAAM,CAAA;YACV,GAAG,CAAC,EAAE,MAAM,CAAA;SACb,CAAA;KACF,CAAA;IACD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAwB,SAAQ,aAAa;IAC5D,2BAA2B,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,OAAO,CAAA;CACpF;AAED,MAAM,WAAW,iBAAiB;IAChC,oHAAoH;IACpH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D,QAAQ,EAAE,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,iBAAiB,KAAK,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;CACnI;AAED,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;CACpC;AAED,MAAM,WAAW,MAAO,SAAQ,YAAY,EAAE,gBAAgB;IAC5D,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG;QAC7B,IAAI,CAAC,EAAE,OAAO,CAAA;QACd,UAAU,CAAC,EAAE,OAAO,CAAA;QACpB,QAAQ,CAAC,EAAE,OAAO,CAAA;KACnB,CAAA;CACF;AAED,MAAM,WAAW,OAAO,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,CAAE,SAAQ,aAAa,CAAC,CAAC,CAAC,EACxE,eAAe;CAAI;AAEvB,wEAAwE;AACxE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,+BAA+B;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,mEAAmE;AACnE,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IAAG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE;AAEtG,uEAAuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,CAAC,MAAM,EAAE,oBAAoB,GAAG,kBAAkB,CAAA;CACnD;AAED,qFAAqF;AACrF,MAAM,WAAW,wBAAwB;IACvC,qEAAqE;IACrE,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,qCAAqC;IACrC,oBAAoB,EAAE,oBAAoB,CAAA;IAC1C,6BAA6B;IAC7B,kBAAkB,EAAE,kBAAkB,CAAA;CACvC"}

package/build/utils/config/types.d.ts

@@ -0,0 +1,11 @@
+import type { OidcCustomConfiguration } from '../../types.js';
+/** The provider configuration one context's settings resolve to. */
+export interface OidcConfigUtils {
+    /**
+     * The deployment's configuration merged over this package's defaults: its clients with their
+     * `{{service-alias}}` URIs expanded (and, in debug only, a generated secret), the claims behind
+     * every scope, the discovery extras and the signing key.
+     */
+    combineConfig: (unsecure: boolean) => Promise<OidcCustomConfiguration>;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/utils/config/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/utils/config/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AAE7D,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,aAAa,EAAE,CAAC,QAAQ,EAAE,OAAO,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAA;CACvE"}

package/build/utils/config/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/utils/config/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/utils/config/types.ts"],"names":[],"mappings":""}

package/build/utils/config.d.ts

@@ -1,3 +1,6 @@
-import type { Context, OidcCustomConfiguration } from '../types.js';
-export declare const combineConfig: (context: Context, _unsecure: boolean) => Promise<OidcCustomConfiguration>;
+import type { Config, Context } from '../types.js';
+import type { OidcConfigUtils } from './config/types.js';
+export declare const makeOidcConfigUtils: (context: Context) => OidcConfigUtils;
+/** The configuration utils of a context — one per context. */
+export declare const oidcConfigOf: (target: Context<Config>) => OidcConfigUtils;
 //# sourceMappingURL=config.d.ts.map

package/build/utils/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAUnE,eAAO,MAAM,aAAa,YAAmB,OAAO,aAAa,OAAO,KAAG,OAAO,CAAC,uBAAuB,CAiDzG,CAAA"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAA2B,MAAM,aAAa,CAAA;AAQ3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAQxD,eAAO,MAAM,mBAAmB,YAAa,OAAO,KAAG,eAqFtD,CAAA;AAED,8DAA8D;AAC9D,eAAO,MAAM,YAAY,8CAA0C,CAAA"}

package/build/utils/config.js

@@ -1,55 +1,91 @@
-import { makeUriUpdater, updateClient } from './client.js';
+import { randomBytes } from '@noble/hashes/utils.js';
+import { hex } from '@scure/base';
 import { ORGANIZATIONS_CLAIM, ORGANIZATIONS_SCOPE, PERMISSIONS_CLAIM, PERMISSIONS_SCOPE } from '@owlmeans/oidc';
 import { makeSecurityHelper } from '@owlmeans/config';
+import { memoHelper } from '@owlmeans/context';
+import { SEP } from '@owlmeans/route';
+import { logger } from '@owlmeans/log';
 import * as jose from 'jose';
+const log = logger('server-oidc-provider');
 /** A claim list is an array, or (as the provider's types also allow) a record keyed by claim name. */
 const claimNamesOf = (claims) => claims == null ? [] : Array.isArray(claims) ? claims : Object.keys(claims);
-export const combineConfig = async (context, _unsecure) => {
-    const cfg = context.cfg.oidc;
-    const updateUri = makeUriUpdater(context, makeSecurityHelper(context));
-    const configuration = {
-        ...cfg.customConfiguration,
-        clients: [
-            ...cfg.clients,
-            ...(cfg.customConfiguration?.clients ?? [])
-        ].map(client => updateClient(context, client)),
-        claims: {
-            email: ['email', 'email_verified', ...claimNamesOf(cfg.customConfiguration?.claims?.email)],
-            profile: [
-                'username', 'family_name', 'given_name', 'locale', 'name', 'nickname', 'preferred_username',
-                ...claimNamesOf(cfg.customConfiguration?.claims?.profile)
-            ],
-            // Inert unless the account service actually emits the claim (integrated IAM mode)
-            [PERMISSIONS_SCOPE]: [PERMISSIONS_CLAIM],
-            // Inert likewise — and a static scope, so only a client whose allowlist names it may ask
-            [ORGANIZATIONS_SCOPE]: [ORGANIZATIONS_CLAIM],
-            ...cfg.customConfiguration?.claims,
-        },
-        scopes: [
-            'openid', 'profile', 'offline_access', PERMISSIONS_SCOPE, ORGANIZATIONS_SCOPE,
-            ...cfg.customConfiguration?.scopes ?? []
-        ],
-        discovery: {
-            ...cfg.customConfiguration?.discovery,
-            ...Object.fromEntries(Object.entries(cfg.discoveryUris ?? {}).map(([field, uri]) => [field, updateUri(uri)])),
-        },
-        features: {
-            ...cfg.customConfiguration?.features,
-            devInteractions: { enabled: false }
-            // devInteractions: {
-            //   enabled: (
-            //     (context.cfg.debug.all && context.cfg.debug.oidc !== false)
-            //     || context.cfg.debug.oidc
-            //   ) && unsecure,
-            //   ...cfg.customConfiguration?.features?.devInteractions,
-            // },
-        },
-        jwks: {
-            keys: [
-                await jose.exportJWK(await jose.importPKCS8(cfg.defaultKeys.RS256.pk, 'RS256', { extractable: true }))
-            ]
+export const makeOidcConfigUtils = (context) => {
+    /** Expands a `{{service-alias}}/path` URI against that registered service; any other URI is kept. */
+    const uriUpdater = (helper) => (uri) => {
+        if (uri.startsWith('{{')) {
+            const [host, ...parts] = uri.split(SEP);
+            const service = context.cfg.services[host.slice(2, -2)];
+            return helper.makeUrl(service, parts.join(SEP));
+        }
+        return uri;
+    };
+    const updateClient = (client) => {
+        if (client.client_secret == null) {
+            if (!context.cfg.debug.all && !context.cfg.debug.oidc) {
+                throw new SyntaxError('Client secret is required');
+            }
+            client.client_secret = hex.encode(randomBytes(32));
+            // The secret itself is never written to a log.
+            log.warn('Exceptionally insecure: a client secret was generated for an OIDC client (debug only)', {
+                clientId: client.client_id,
+            });
         }
+        const helper = makeSecurityHelper(context);
+        const updateUri = uriUpdater(helper);
+        client.redirect_uris = client.redirect_uris?.map(updateUri) ?? [];
+        client.post_logout_redirect_uris = client.post_logout_redirect_uris?.map(updateUri) ?? [];
+        return client;
+    };
+    const combineConfig = async (_unsecure) => {
+        const cfg = context.cfg.oidc;
+        const updateUri = uriUpdater(makeSecurityHelper(context));
+        const configuration = {
+            ...cfg.customConfiguration,
+            clients: [
+                ...cfg.clients,
+                ...(cfg.customConfiguration?.clients ?? [])
+            ].map(client => updateClient(client)),
+            claims: {
+                email: ['email', 'email_verified', ...claimNamesOf(cfg.customConfiguration?.claims?.email)],
+                profile: [
+                    'username', 'family_name', 'given_name', 'locale', 'name', 'nickname', 'preferred_username',
+                    ...claimNamesOf(cfg.customConfiguration?.claims?.profile)
+                ],
+                // Inert unless the account service actually emits the claim (integrated IAM mode)
+                [PERMISSIONS_SCOPE]: [PERMISSIONS_CLAIM],
+                // Inert likewise — and a static scope, so only a client whose allowlist names it may ask
+                [ORGANIZATIONS_SCOPE]: [ORGANIZATIONS_CLAIM],
+                ...cfg.customConfiguration?.claims,
+            },
+            scopes: [
+                'openid', 'profile', 'offline_access', PERMISSIONS_SCOPE, ORGANIZATIONS_SCOPE,
+                ...cfg.customConfiguration?.scopes ?? []
+            ],
+            discovery: {
+                ...cfg.customConfiguration?.discovery,
+                ...Object.fromEntries(Object.entries(cfg.discoveryUris ?? {}).map(([field, uri]) => [field, updateUri(uri)])),
+            },
+            features: {
+                ...cfg.customConfiguration?.features,
+                devInteractions: { enabled: false }
+                // devInteractions: {
+                //   enabled: (
+                //     (context.cfg.debug.all && context.cfg.debug.oidc !== false)
+                //     || context.cfg.debug.oidc
+                //   ) && unsecure,
+                //   ...cfg.customConfiguration?.features?.devInteractions,
+                // },
+            },
+            jwks: {
+                keys: [
+                    await jose.exportJWK(await jose.importPKCS8(cfg.defaultKeys.RS256.pk, 'RS256', { extractable: true }))
+                ]
+            }
+        };
+        return configuration;
     };
-    return configuration;
+    return { combineConfig };
 };
+/** The configuration utils of a context — one per context. */
+export const oidcConfigOf = memoHelper.oncePer(makeOidcConfigUtils);
 //# sourceMappingURL=config.js.map

package/build/utils/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAC/G,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,sGAAsG;AACtG,MAAM,YAAY,GAAG,CAAC,MAA6E,EAAqB,EAAE,CACxH,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AAE5E,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,OAAgB,EAAE,SAAkB,EAAoC,EAAE;IAC5G,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA;IAC5B,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAA;IAEtE,MAAM,aAAa,GAA4B;QAC7C,GAAG,GAAG,CAAC,mBAAmB;QAC1B,OAAO,EAAE;YACP,GAAG,GAAG,CAAC,OAAO;YACd,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,IAAI,EAAE,CAAC;SAC5C,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,EAAE;YACN,KAAK,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YAC3F,OAAO,EAAE;gBACP,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB;gBAC3F,GAAG,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,EAAE,OAAO,CAAC;aAC1D;YACD,kFAAkF;YAClF,CAAC,iBAAiB,CAAC,EAAE,CAAC,iBAAiB,CAAC;YACxC,yFAAyF;YACzF,CAAC,mBAAmB,CAAC,EAAE,CAAC,mBAAmB,CAAC;YAC5C,GAAG,GAAG,CAAC,mBAAmB,EAAE,MAAM;SACnC;QACD,MAAM,EAAE;YACN,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB;YAC7E,GAAG,GAAG,CAAC,mBAAmB,EAAE,MAAM,IAAI,EAAE;SACzC;QACD,SAAS,EAAE;YACT,GAAG,GAAG,CAAC,mBAAmB,EAAE,SAAS;YACrC,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAC9G;QACD,QAAQ,EAAE;YACR,GAAG,GAAG,CAAC,mBAAmB,EAAE,QAAQ;YACpC,eAAe,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YACnC,qBAAqB;YACrB,eAAe;YACf,kEAAkE;YAClE,gCAAgC;YAChC,mBAAmB;YACnB,2DAA2D;YAC3D,KAAK;SACN;QACD,IAAI,EAAE;YACJ,IAAI,EAAE;gBACJ,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;aACvG;SACF;KACF,CAAA;IAED,OAAO,aAAa,CAAA;AACtB,CAAC,CAAA"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAGjC,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAC/G,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAErD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAG5B,MAAM,GAAG,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAA;AAE1C,sGAAsG;AACtG,MAAM,YAAY,GAAG,CAAC,MAA6E,EAAqB,EAAE,CACxH,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AAE5E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,OAAgB,EAAmB,EAAE;IACvE,qGAAqG;IACrG,MAAM,UAAU,GAAG,CAAC,MAAsB,EAA6B,EAAE,CAAC,CAAC,GAAW,EAAU,EAAE;QAChG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAEvC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;YACvD,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;QACjD,CAAC;QAED,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;IAED,MAAM,YAAY,GAAG,CAAC,MAAsB,EAAkB,EAAE;QAC9D,IAAI,MAAM,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBACtD,MAAM,IAAI,WAAW,CAAC,2BAA2B,CAAC,CAAA;YACpD,CAAC;YACD,MAAM,CAAC,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YAClD,+CAA+C;YAC/C,GAAG,CAAC,IAAI,CAAC,uFAAuF,EAAE;gBAChG,QAAQ,EAAE,MAAM,CAAC,SAAS;aAC3B,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,kBAAkB,CAAkB,OAAO,CAAC,CAAA;QAC3D,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;QACpC,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;QACjE,MAAM,CAAC,yBAAyB,GAAG,MAAM,CAAC,yBAAyB,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;QAEzF,OAAO,MAAM,CAAA;IACf,CAAC,CAAA;IAED,MAAM,aAAa,GAAG,KAAK,EAAE,SAAkB,EAAoC,EAAE;QACnF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA;QAC5B,MAAM,SAAS,GAAG,UAAU,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAA;QAEzD,MAAM,aAAa,GAA4B;YAC7C,GAAG,GAAG,CAAC,mBAAmB;YAC1B,OAAO,EAAE;gBACP,GAAG,GAAG,CAAC,OAAO;gBACd,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,IAAI,EAAE,CAAC;aAC5C,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YACrC,MAAM,EAAE;gBACN,KAAK,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;gBAC3F,OAAO,EAAE;oBACP,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB;oBAC3F,GAAG,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,EAAE,OAAO,CAAC;iBAC1D;gBACD,kFAAkF;gBAClF,CAAC,iBAAiB,CAAC,EAAE,CAAC,iBAAiB,CAAC;gBACxC,yFAAyF;gBACzF,CAAC,mBAAmB,CAAC,EAAE,CAAC,mBAAmB,CAAC;gBAC5C,GAAG,GAAG,CAAC,mBAAmB,EAAE,MAAM;aACnC;YACD,MAAM,EAAE;gBACN,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB;gBAC7E,GAAG,GAAG,CAAC,mBAAmB,EAAE,MAAM,IAAI,EAAE;aACzC;YACD,SAAS,EAAE;gBACT,GAAG,GAAG,CAAC,mBAAmB,EAAE,SAAS;gBACrC,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;aAC9G;YACD,QAAQ,EAAE;gBACR,GAAG,GAAG,CAAC,mBAAmB,EAAE,QAAQ;gBACpC,eAAe,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;gBACnC,qBAAqB;gBACrB,eAAe;gBACf,kEAAkE;gBAClE,gCAAgC;gBAChC,mBAAmB;gBACnB,2DAA2D;gBAC3D,KAAK;aACN;YACD,IAAI,EAAE;gBACJ,IAAI,EAAE;oBACJ,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;iBACvG;aACF;SACF,CAAA;QAED,OAAO,aAAa,CAAA;IACtB,CAAC,CAAA;IAED,OAAO,EAAE,aAAa,EAAE,CAAA;AAC1B,CAAC,CAAA;AAED,8DAA8D;AAC9D,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAA"}

package/build/utils/index.d.ts

@@ -1,3 +1,3 @@
 export * from './config.js';
-export * from './client.js';
+export type * from './config/types.js';
 //# sourceMappingURL=index.d.ts.map

package/build/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AACA,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,mBAAmB,mBAAmB,CAAA"}

package/build/utils/index.js

@@ -1,3 +1,2 @@
 export * from './config.js';
-export * from './client.js';
 //# sourceMappingURL=index.js.map

package/build/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AACA,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-oidc-provider",
-  "version": "0.1.18-rc.49",
+  "version": "0.1.18-rc.50",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -23,7 +23,7 @@
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/context": "^0.1.18-rc.33",
+    "@owlmeans/context": "^0.1.18-rc.34",
     "@types/bun": "^1.4.2",
     "@types/node": "^26.6.4",
     "@types/oidc-provider": "9.12.1",
@@ -35,14 +35,14 @@
   },
   "dependencies": {
     "@noble/hashes": "^2.4.0",
-    "@owlmeans/config": "^0.1.18-rc.43",
-    "@owlmeans/context": "^0.1.18-rc.33",
-    "@owlmeans/entrypoint": "^0.1.18-rc.40",
-    "@owlmeans/log": "^0.1.18-rc.1",
-    "@owlmeans/oidc": "^0.1.18-rc.54",
-    "@owlmeans/route": "^0.1.18-rc.34",
-    "@owlmeans/server-api": "^0.1.18-rc.50",
-    "@owlmeans/server-context": "^0.1.18-rc.42",
+    "@owlmeans/config": "^0.1.18-rc.44",
+    "@owlmeans/context": "^0.1.18-rc.34",
+    "@owlmeans/entrypoint": "^0.1.18-rc.41",
+    "@owlmeans/log": "^0.1.18-rc.2",
+    "@owlmeans/oidc": "^0.1.18-rc.55",
+    "@owlmeans/route": "^0.1.18-rc.35",
+    "@owlmeans/server-api": "^0.1.18-rc.51",
+    "@owlmeans/server-context": "^0.1.18-rc.43",
     "@scure/base": "^2.4.0",
     "jose": "6.2.12",
     "oidc-provider": "9.12.2"

package/src/iam.ts

@@ -1,8 +1,8 @@
 import type { ResponseType } from 'oidc-provider'
-import type { OidcClientMetadata, OidcRegisteredClient } from './types.js'
+import type { OidcClientMetadata, OidcRegisteredClient, ToClientMetadata } from './types.js'
 
 /** Convert an OidcRegisteredClient to the oidc-provider ClientMetadata shape. */
-export const toClientMetadata = (client: OidcRegisteredClient): OidcClientMetadata => ({
+export const toClientMetadata: ToClientMetadata = (client: OidcRegisteredClient): OidcClientMetadata => ({
   client_id: client.clientId,
   client_secret: client.secret,
   redirect_uris: client.redirectUris ?? [],

package/src/middleware.ts

@@ -5,7 +5,7 @@ import type { ApiServer } from '@owlmeans/server-api'
 import { DEFAULT_ALIAS } from './consts.js'
 import type { Config, Context, OidcProviderService } from './types.js'
 
-export const createOidcProviderMiddleware = (web: string = WEB_ALIAS, oidc = DEFAULT_ALIAS) => {
+export const createOidcProviderMiddleware = (web: string = WEB_ALIAS, oidc: string = DEFAULT_ALIAS): Middleware => {
   const middleware: Middleware = {
     type: MiddlewareType.Context,
     stage: MiddlewareStage.Loading,

package/src/service.ts

@@ -10,7 +10,7 @@ import type { BasicRoute } from '@owlmeans/route'
 import type { CommonEntrypoint } from '@owlmeans/entrypoint'
 import { PARAM, SEP } from '@owlmeans/route'
 import { makeSecurityHelper } from '@owlmeans/config'
-import { combineConfig } from './utils/config.js'
+import { oidcConfigOf } from './utils/config.js'
 import { makeInteractionPolicy } from './utils/policy.js'
 
 const log = logger('server-oidc-provider')
@@ -57,7 +57,7 @@ export const createOidcProviderService = (alias: string = DEFAULT_ALIAS): OidcPr
       const unsecure = context.cfg.security?.unsecure === false ? false : !url.startsWith('https')
 
       const oidc = new Provider(url, {
-        ...await combineConfig(context, unsecure),
+        ...await oidcConfigOf(context).combineConfig(unsecure),
 
         adapter: cfg.adapterService != null
           ? name => context.service<OidcAdapterService>(cfg.adapterService!).instance(name)

package/src/types.ts

@@ -3,7 +3,6 @@ import type { OidcSharedConfig } from '@owlmeans/oidc'
 import type { ApiServer, ApiServerAppend } from '@owlmeans/server-api'
 import type { ServerConfig, ServerContext } from '@owlmeans/server-context'
 import type { Account, Adapter, ClientMetadata, Configuration, Interaction, Provider } from 'oidc-provider'
-import { toClientMetadata } from './iam.js'
 
 export interface OidcProviderService extends InitializedService {
   oidc: Provider
@@ -93,12 +92,17 @@ export interface OidcRegisteredClient {
 }
 
 /** Full oidc-provider ClientMetadata with our entity extension. */
-export type OidcClientMetadata = ClientMetadata & { entityId?: string; owlEntityId?: string }
+export interface OidcClientMetadata extends ClientMetadata { entityId?: string; owlEntityId?: string }
+
+/** Converts a stored client record to oidc-provider ClientMetadata. */
+export interface ToClientMetadata {
+  (client: OidcRegisteredClient): OidcClientMetadata
+}
 
 /** Extension seam for IAM integration into the OIDC provider — Phase 2 fills this */
 export interface OidcProviderIamExtension {
   /** Convert a stored client record to oidc-provider ClientMetadata */
-  toClientMetadata: typeof toClientMetadata
+  toClientMetadata: ToClientMetadata
   /** Type of a stored client record */
   OidcRegisteredClient: OidcRegisteredClient
   /** Extended metadata type */

package/src/utils/config/types.ts

@@ -0,0 +1,11 @@
+import type { OidcCustomConfiguration } from '../../types.js'
+
+/** The provider configuration one context's settings resolve to. */
+export interface OidcConfigUtils {
+  /**
+   * The deployment's configuration merged over this package's defaults: its clients with their
+   * `{{service-alias}}` URIs expanded (and, in debug only, a generated secret), the claims behind
+   * every scope, the discovery extras and the signing key.
+   */
+  combineConfig: (unsecure: boolean) => Promise<OidcCustomConfiguration>
+}

package/src/utils/config.ts

@@ -1,60 +1,108 @@
-import type { Context, OidcCustomConfiguration } from '../types.js'
-import { makeUriUpdater, updateClient } from './client.js'
+import { randomBytes } from '@noble/hashes/utils.js'
+import { hex } from '@scure/base'
+import type { ClientMetadata } from 'oidc-provider'
+import type { Config, Context, OidcCustomConfiguration } from '../types.js'
 import { ORGANIZATIONS_CLAIM, ORGANIZATIONS_SCOPE, PERMISSIONS_CLAIM, PERMISSIONS_SCOPE } from '@owlmeans/oidc'
 import { makeSecurityHelper } from '@owlmeans/config'
+import type { SecurityHelper } from '@owlmeans/config'
+import { memoHelper } from '@owlmeans/context'
+import { SEP } from '@owlmeans/route'
+import { logger } from '@owlmeans/log'
 import * as jose from 'jose'
+import type { OidcConfigUtils } from './config/types.js'
+
+const log = logger('server-oidc-provider')
 
 /** A claim list is an array, or (as the provider's types also allow) a record keyed by claim name. */
 const claimNamesOf = (claims: readonly string[] | Readonly<Record<string, null>> | null | undefined): readonly string[] =>
   claims == null ? [] : Array.isArray(claims) ? claims : Object.keys(claims)
 
-export const combineConfig = async (context: Context, _unsecure: boolean): Promise<OidcCustomConfiguration> => {
-  const cfg = context.cfg.oidc
-  const updateUri = makeUriUpdater(context, makeSecurityHelper(context))
-
-  const configuration: OidcCustomConfiguration = {
-    ...cfg.customConfiguration,
-    clients: [
-      ...cfg.clients,
-      ...(cfg.customConfiguration?.clients ?? [])
-    ].map(client => updateClient(context, client)),
-    claims: {
-      email: ['email', 'email_verified', ...claimNamesOf(cfg.customConfiguration?.claims?.email)],
-      profile: [
-        'username', 'family_name', 'given_name', 'locale', 'name', 'nickname', 'preferred_username',
-        ...claimNamesOf(cfg.customConfiguration?.claims?.profile)
+export const makeOidcConfigUtils = (context: Context): OidcConfigUtils => {
+  /** Expands a `{{service-alias}}/path` URI against that registered service; any other URI is kept. */
+  const uriUpdater = (helper: SecurityHelper): ((uri: string) => string) => (uri: string): string => {
+    if (uri.startsWith('{{')) {
+      const [host, ...parts] = uri.split(SEP)
+
+      const service = context.cfg.services[host.slice(2, -2)]
+      return helper.makeUrl(service, parts.join(SEP))
+    }
+
+    return uri
+  }
+
+  const updateClient = (client: ClientMetadata): ClientMetadata => {
+    if (client.client_secret == null) {
+      if (!context.cfg.debug.all && !context.cfg.debug.oidc) {
+        throw new SyntaxError('Client secret is required')
+      }
+      client.client_secret = hex.encode(randomBytes(32))
+      // The secret itself is never written to a log.
+      log.warn('Exceptionally insecure: a client secret was generated for an OIDC client (debug only)', {
+        clientId: client.client_id,
+      })
+    }
+
+    const helper = makeSecurityHelper<Config, Context>(context)
+    const updateUri = uriUpdater(helper)
+    client.redirect_uris = client.redirect_uris?.map(updateUri) ?? []
+    client.post_logout_redirect_uris = client.post_logout_redirect_uris?.map(updateUri) ?? []
+
+    return client
+  }
+
+  const combineConfig = async (_unsecure: boolean): Promise<OidcCustomConfiguration> => {
+    const cfg = context.cfg.oidc
+    const updateUri = uriUpdater(makeSecurityHelper(context))
+
+    const configuration: OidcCustomConfiguration = {
+      ...cfg.customConfiguration,
+      clients: [
+        ...cfg.clients,
+        ...(cfg.customConfiguration?.clients ?? [])
+      ].map(client => updateClient(client)),
+      claims: {
+        email: ['email', 'email_verified', ...claimNamesOf(cfg.customConfiguration?.claims?.email)],
+        profile: [
+          'username', 'family_name', 'given_name', 'locale', 'name', 'nickname', 'preferred_username',
+          ...claimNamesOf(cfg.customConfiguration?.claims?.profile)
+        ],
+        // Inert unless the account service actually emits the claim (integrated IAM mode)
+        [PERMISSIONS_SCOPE]: [PERMISSIONS_CLAIM],
+        // Inert likewise — and a static scope, so only a client whose allowlist names it may ask
+        [ORGANIZATIONS_SCOPE]: [ORGANIZATIONS_CLAIM],
+        ...cfg.customConfiguration?.claims,
+      },
+      scopes: [
+        'openid', 'profile', 'offline_access', PERMISSIONS_SCOPE, ORGANIZATIONS_SCOPE,
+        ...cfg.customConfiguration?.scopes ?? []
       ],
-      // Inert unless the account service actually emits the claim (integrated IAM mode)
-      [PERMISSIONS_SCOPE]: [PERMISSIONS_CLAIM],
-      // Inert likewise — and a static scope, so only a client whose allowlist names it may ask
-      [ORGANIZATIONS_SCOPE]: [ORGANIZATIONS_CLAIM],
-      ...cfg.customConfiguration?.claims,
-    },
-    scopes: [
-      'openid', 'profile', 'offline_access', PERMISSIONS_SCOPE, ORGANIZATIONS_SCOPE,
-      ...cfg.customConfiguration?.scopes ?? []
-    ],
-    discovery: {
-      ...cfg.customConfiguration?.discovery,
-      ...Object.fromEntries(Object.entries(cfg.discoveryUris ?? {}).map(([field, uri]) => [field, updateUri(uri)])),
-    },
-    features: {
-      ...cfg.customConfiguration?.features,
-      devInteractions: { enabled: false }
-      // devInteractions: {
-      //   enabled: (
-      //     (context.cfg.debug.all && context.cfg.debug.oidc !== false)
-      //     || context.cfg.debug.oidc
-      //   ) && unsecure,
-      //   ...cfg.customConfiguration?.features?.devInteractions,
-      // },
-    },
-    jwks: {
-      keys: [
-        await jose.exportJWK(await jose.importPKCS8(cfg.defaultKeys.RS256.pk, 'RS256', { extractable: true }))
-      ]
+      discovery: {
+        ...cfg.customConfiguration?.discovery,
+        ...Object.fromEntries(Object.entries(cfg.discoveryUris ?? {}).map(([field, uri]) => [field, updateUri(uri)])),
+      },
+      features: {
+        ...cfg.customConfiguration?.features,
+        devInteractions: { enabled: false }
+        // devInteractions: {
+        //   enabled: (
+        //     (context.cfg.debug.all && context.cfg.debug.oidc !== false)
+        //     || context.cfg.debug.oidc
+        //   ) && unsecure,
+        //   ...cfg.customConfiguration?.features?.devInteractions,
+        // },
+      },
+      jwks: {
+        keys: [
+          await jose.exportJWK(await jose.importPKCS8(cfg.defaultKeys.RS256.pk, 'RS256', { extractable: true }))
+        ]
+      }
     }
+
+    return configuration
   }
 
-  return configuration
+  return { combineConfig }
 }
+
+/** The configuration utils of a context — one per context. */
+export const oidcConfigOf = memoHelper.oncePer(makeOidcConfigUtils)

package/src/utils/index.ts

@@ -1,3 +1,2 @@
-
 export * from './config.js'
-export * from './client.js'
+export type * from './config/types.js'

package/tests/config.spec.ts

@@ -5,7 +5,7 @@ import type { BasicContext } from '@owlmeans/context'
 import {
   IAM_API_METADATA, ORGANIZATIONS_CLAIM, ORGANIZATIONS_SCOPE, PERMISSIONS_CLAIM, PERMISSIONS_SCOPE,
 } from '@owlmeans/oidc'
-import { combineConfig } from '../src/utils/config.js'
+import { makeOidcConfigUtils } from '../src/utils/config.js'
 import type { Config } from '../src/types.js'
 
 const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 })
@@ -35,7 +35,7 @@ const makeTestContext = (oidc: Partial<Config['oidc']> = {}) => {
 describe('combineConfig (jose v6 extractable key)', () => {
   it('produces a JWKS with an RS256 key', async () => {
     const context = makeTestContext()
-    const config = await combineConfig(context as any, true)
+    const config = await makeOidcConfigUtils(context as any).combineConfig(true)
 
     expect(config.jwks).toBeDefined()
     expect(Array.isArray(config.jwks?.keys)).toBe(true)
@@ -47,7 +47,7 @@ describe('combineConfig (jose v6 extractable key)', () => {
 
 describe('combineConfig — scopes and the claims behind them', () => {
   it('maps each integrated-IAM scope to its own claim', async () => {
-    const config = await combineConfig(makeTestContext() as any, true)
+    const config = await makeOidcConfigUtils(makeTestContext() as any).combineConfig(true)
 
     expect(config.claims?.[PERMISSIONS_SCOPE]).toEqual([PERMISSIONS_CLAIM])
     expect(config.claims?.[ORGANIZATIONS_SCOPE]).toEqual([ORGANIZATIONS_CLAIM])
@@ -58,19 +58,19 @@ describe('combineConfig — scopes and the claims behind them', () => {
 
 describe('combineConfig — the discovery document', () => {
   it('expands a service-relative field against the registered service', async () => {
-    const config = await combineConfig(makeTestContext({
+    const config = await makeOidcConfigUtils(makeTestContext({
       discoveryUris: { [IAM_API_METADATA]: '{{iam-api}}/iam/api/runtime' },
-    }) as any, true)
+    }) as any).combineConfig(true)
 
     expect((config.discovery as Record<string, unknown>)[IAM_API_METADATA])
       .toBe('https://iam.example.test/iam/api/runtime')
   })
 
   it('keeps an absolute field and the custom discovery fields as given', async () => {
-    const config = await combineConfig(makeTestContext({
+    const config = await makeOidcConfigUtils(makeTestContext({
       discoveryUris: { [IAM_API_METADATA]: 'https://elsewhere.example.test/runtime' },
       customConfiguration: { discovery: { service_documentation: 'https://docs.example.test' } },
-    }) as any, true)
+    }) as any).combineConfig(true)
 
     expect(config.discovery).toEqual({
       service_documentation: 'https://docs.example.test',
@@ -83,9 +83,9 @@ describe('combineConfig — pairwise subjects pass through', () => {
   it('keeps the subject options of the custom configuration', async () => {
     const pairwiseIdentifier = async (_: unknown, accountId: string) => `pairwise:${accountId}`
     const sectorIdentifierUriValidate = () => false
-    const config = await combineConfig(makeTestContext({
+    const config = await makeOidcConfigUtils(makeTestContext({
       customConfiguration: { subjectTypes: ['pairwise'], pairwiseIdentifier, sectorIdentifierUriValidate },
-    }) as any, true)
+    }) as any).combineConfig(true)
 
     expect(config.subjectTypes).toEqual(['pairwise'])
     expect(config.pairwiseIdentifier).toBe(pairwiseIdentifier)

package/tests/pairwise.spec.ts

@@ -9,7 +9,7 @@ import { sha256 } from '@noble/hashes/sha2.js'
 import { base58 } from '@scure/base'
 import { AppType, makeBasicContext } from '@owlmeans/context'
 import { ORGANIZATIONS_CLAIM, ORGANIZATIONS_SCOPE, PERMISSIONS_CLAIM, PERMISSIONS_SCOPE } from '@owlmeans/oidc'
-import { combineConfig } from '../src/utils/config.js'
+import { makeOidcConfigUtils } from '../src/utils/config.js'
 import { makeInteractionPolicy } from '../src/utils/policy.js'
 import type { Config } from '../src/types.js'
 
@@ -80,7 +80,7 @@ const start = async () => {
 
   const loaded: string[] = []
   const provider = new Provider(base, {
-    ...await combineConfig(context as any, true),
+    ...await makeOidcConfigUtils(context as any).combineConfig(true),
     findAccount: async (_, id) => {
       loaded.push(id)
       return {

package/build/utils/client.d.ts

@@ -1,7 +0,0 @@
-import type { ClientMetadata } from 'oidc-provider';
-import type { Context } from '../types.js';
-import type { SecurityHelper } from '@owlmeans/config';
-export declare const updateClient: (context: Context, client: ClientMetadata) => ClientMetadata;
-/** Expands a `{{service-alias}}/path` URI against that registered service; any other URI is kept. */
-export declare const makeUriUpdater: (context: Context, helper: SecurityHelper) => (uri: string) => string;
-//# sourceMappingURL=client.d.ts.map

package/build/utils/client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/utils/client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,KAAK,EAAU,OAAO,EAAE,MAAM,aAAa,CAAA;AAElD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAMtD,eAAO,MAAM,YAAY,YAAa,OAAO,UAAU,cAAc,KAAG,cAkBvE,CAAA;AAED,qGAAqG;AACrG,eAAO,MAAM,cAAc,YAAa,OAAO,UAAU,cAAc,WAAW,MAAM,KAAG,MAS1F,CAAA"}

package/build/utils/client.js

@@ -1,33 +0,0 @@
-import { randomBytes } from '@noble/hashes/utils.js';
-import { hex } from '@scure/base';
-import { makeSecurityHelper } from '@owlmeans/config';
-import { SEP } from '@owlmeans/route';
-import { logger } from '@owlmeans/log';
-const log = logger('server-oidc-provider');
-export const updateClient = (context, client) => {
-    if (client.client_secret == null) {
-        if (!context.cfg.debug.all && !context.cfg.debug.oidc) {
-            throw new SyntaxError('Client secret is required');
-        }
-        client.client_secret = hex.encode(randomBytes(32));
-        // The secret itself is never written to a log.
-        log.warn('Exceptionally insecure: a client secret was generated for an OIDC client (debug only)', {
-            clientId: client.client_id,
-        });
-    }
-    const helper = makeSecurityHelper(context);
-    const updateUri = makeUriUpdater(context, helper);
-    client.redirect_uris = client.redirect_uris?.map(updateUri) ?? [];
-    client.post_logout_redirect_uris = client.post_logout_redirect_uris?.map(updateUri) ?? [];
-    return client;
-};
-/** Expands a `{{service-alias}}/path` URI against that registered service; any other URI is kept. */
-export const makeUriUpdater = (context, helper) => (uri) => {
-    if (uri.startsWith('{{')) {
-        const [host, ...parts] = uri.split(SEP);
-        const service = context.cfg.services[host.slice(2, -2)];
-        return helper.makeUrl(service, parts.join(SEP));
-    }
-    return uri;
-};
-//# sourceMappingURL=client.js.map

package/build/utils/client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/utils/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAGjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAErD,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAEtC,MAAM,GAAG,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAA;AAE1C,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAgB,EAAE,MAAsB,EAAkB,EAAE;IACvF,IAAI,MAAM,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACtD,MAAM,IAAI,WAAW,CAAC,2BAA2B,CAAC,CAAA;QACpD,CAAC;QACD,MAAM,CAAC,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;QAClD,+CAA+C;QAC/C,GAAG,CAAC,IAAI,CAAC,uFAAuF,EAAE;YAChG,QAAQ,EAAE,MAAM,CAAC,SAAS;SAC3B,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAkB,OAAO,CAAC,CAAA;IAC3D,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACjD,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;IACjE,MAAM,CAAC,yBAAyB,GAAG,MAAM,CAAC,yBAAyB,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;IAEzF,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,qGAAqG;AACrG,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAgB,EAAE,MAAsB,EAAE,EAAE,CAAC,CAAC,GAAW,EAAU,EAAE;IAClG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAEvC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QACvD,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACjD,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA"}

package/src/utils/client.ts

@@ -1,42 +0,0 @@
-import { randomBytes } from '@noble/hashes/utils.js'
-import { hex } from '@scure/base'
-import type { ClientMetadata } from 'oidc-provider'
-import type { Config, Context } from '../types.js'
-import { makeSecurityHelper } from '@owlmeans/config'
-import type { SecurityHelper } from '@owlmeans/config'
-import { SEP } from '@owlmeans/route'
-import { logger } from '@owlmeans/log'
-
-const log = logger('server-oidc-provider')
-
-export const updateClient = (context: Context, client: ClientMetadata): ClientMetadata => {
-  if (client.client_secret == null) {
-    if (!context.cfg.debug.all && !context.cfg.debug.oidc) {
-      throw new SyntaxError('Client secret is required')
-    }
-    client.client_secret = hex.encode(randomBytes(32))
-    // The secret itself is never written to a log.
-    log.warn('Exceptionally insecure: a client secret was generated for an OIDC client (debug only)', {
-      clientId: client.client_id,
-    })
-  }
-
-  const helper = makeSecurityHelper<Config, Context>(context)
-  const updateUri = makeUriUpdater(context, helper)
-  client.redirect_uris = client.redirect_uris?.map(updateUri) ?? []
-  client.post_logout_redirect_uris = client.post_logout_redirect_uris?.map(updateUri) ?? []
-  
-  return client
-}
-
-/** Expands a `{{service-alias}}/path` URI against that registered service; any other URI is kept. */
-export const makeUriUpdater = (context: Context, helper: SecurityHelper) => (uri: string): string => {
-  if (uri.startsWith('{{')) {
-    const [host, ...parts] = uri.split(SEP)
-    
-    const service = context.cfg.services[host.slice(2, -2)]
-    return helper.makeUrl(service, parts.join(SEP))
-  }
-
-  return uri
-}