@owlmeans/server-oidc-provider 0.1.18-rc.5 → 0.1.18-rc.51

package/README.md

@@ -14,7 +14,7 @@ Embedded OIDC identity provider — wraps the `oidc-provider` library as an OwlM
 ## Installation
 
 ```bash
-bun add @owlmeans/server-oidc-provider
+bun add @owlmeans/server-oidc-provider@^0.1.18-rc.51
 ```
 
 ## Usage
@@ -59,7 +59,7 @@ Returns middleware that mounts the OIDC authorize/token/userinfo/jwks endpoints
 
 ## Related Packages
 
-- [`@owlmeans/oidc`](../oidc) — shared protocol constants and module declarations
+- [`@owlmeans/oidc`](../oidc) — shared protocol constants and entrypoint declarations
 - [`@owlmeans/server-oidc-rp`](../server-oidc-rp) — relying-party counterpart for consuming external IdPs
 - [`@owlmeans/server-api`](../server-api) — the underlying server API the middleware mounts onto
 - [`@owlmeans/web-oidc-provider`](../web-oidc-provider) — browser UI for the provider's interaction screens
@@ -72,7 +72,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills
+npx @owlmeans/agent-skills@^0.1.18-rc.51
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-oidc-provider",
-  "version": "0.1.18-rc.0",
-  "generatedAt": "2026-08-16T22:20:50.512Z",
+  "version": "0.1.18-rc.51",
+  "generatedAt": "2026-10-06T11:45:57.677Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-oidc-provider/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: server-oidc-provider
-description: How to use @owlmeans/server-oidc-provider — embedded OIDC identity provider built on the oidc-provider library. Auto-invoked when serving OIDC endpoints from your own service.
+description: How to use @owlmeans/server-oidc-provider — the embedded OIDC identity provider on top of the oidc-provider library — service wiring, the account and adapter seams, the interaction URL, how scopes are derived from claims, the organizations claim, extra discovery fields, pairwise subjects, and the response headers an authorization endpoint has to correct. Auto-invoked when serving OIDC endpoints from your own service.
 user-invocable: false
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
@@ -8,66 +8,174 @@ user-invocable: false
 # @owlmeans/server-oidc-provider
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-oidc-provider": "^0.1.18-rc.0"` in `dependencies`
-**Runtime deps:** `oidc-provider@9.8.4` (exact), `jose@6.2.3` (exact)
+**Install:** `"@owlmeans/server-oidc-provider": "^0.1.18-rc.51"` in `dependencies`
+**Runtime deps:** `oidc-provider@9.11.1` (exact), `jose@6.2.5` (exact), `@types/oidc-provider@9.5.0`
+
+Use this only when your service **is** the identity provider. For consuming someone else's issuer,
+use `@owlmeans/server-oidc-rp`.
 
 ## Key Exports
 
 | Export | Description |
 |--------|-------------|
-| `createOidcProviderService(alias?)` | Factory for the embedded OIDC provider service |
-| `appendOidcProviderService<C,T>(ctx, alias?)` | Register the provider service on a context |
-| Constants | `DEFAULT_ALIAS`, `OIDC_ACCOUNT_SERVICE` |
-| Types | `OidcProviderService`, `OidcAccountService`, `OidcAdapterService`, `Config`, `Context` |
-
-## Usage
-
-Use this only when your service IS the identity provider (e.g. self-hosted Keycloak alternative). For consuming an external IdP, use `@owlmeans/server-oidc-rp`.
+| `createOidcProviderService(alias?)` | The provider service factory |
+| `appendOidcProviderService<C,T>(ctx, alias?)` | Registers it on a context |
+| `createOidcProviderMiddleware(webAlias?, oidcAlias?)` | Loading-stage middleware that mounts the provider on the API server exactly once. Register it, or nothing is ever mounted |
+| `OidcProviderService` | `instance()`, `update(api)`, `getInteraction(id)` and the live `oidc` provider |
+| `OidcAccountService` | The account seam: `loadById(ctx, id, { clientId? })` — what `findAccount` delegates to |
+| `OidcAdapterService` | The storage seam: `instance(name)` returns an `oidc-provider` `Adapter` |
+| `OIDC_ACCOUNT_SERVICE`, `DEFAULT_ALIAS` | The default account-service alias and the default provider alias |
+| `OidcConfig`, `OidcConfigAppend` | The `cfg.oidc` shape this package reads |
+| `OidcCustomConfiguration` | `oidc-provider`'s `Configuration` plus `sectorIdentifierUriValidate`, which the pinned typings omit — the type of `cfg.oidc.customConfiguration` |
+| `OidcAccountParams` | `{ clientId? }` — lets the account service scope its claims per client |
+| `toClientMetadata(client)` | Maps a stored `OidcRegisteredClient` to `oidc-provider` `ClientMetadata` |
+| `OidcRegisteredClient`, `OidcClientMetadata` | The stored-client shape `toClientMetadata` takes, and the `oidc-provider` metadata shape it returns, carrying `owlEntityId` |
+| `Config`, `Context` | `ServerConfig`/`ServerContext` with `cfg.oidc` and the `debug.oidc` / `debug.oidcServer` / `debug.oidcData` switches |
+
+## Wiring
 
 ```typescript
-import { appendOidcProviderService } from '@owlmeans/server-oidc-provider'
+import { appendOidcProviderService, createOidcProviderMiddleware } from '@owlmeans/server-oidc-provider'
+
 appendOidcProviderService<C, T>(context)
+context.registerMiddleware(createOidcProviderMiddleware())
 ```
 
-The service mounts the oidc-provider Koa app onto Fastify via `api.server.use(base, oidc.callback())`. It wires `findAccount`, `interactions.url`, the JWKS, and optional adapter.
+`cfg.oidc` supplies `clients` (`ClientMetadata[]`), `defaultKeys.RS256.pk` (a PKCS#8 PEM), and
+optionally `basePath` (default `oidc`), `authService` (whose registered route the issuer is built
+from — defaults to this service), `behindProxy`, `accountService`, `adapterService`,
+`discoveryUris` (below) and `customConfiguration` (merged over the defaults below). The shape also declares `frontBase`, which
+this package reads nowhere — setting it configures nothing.
+
+A client's `redirect_uris` and `post_logout_redirect_uris` may be written as `{{service-alias}}/path`
+and are expanded against that registered service's host. `discoveryUris` (field → URL) extends the
+discovery document through the same expansion, merged over `customConfiguration.discovery` — that
+is how a deployment advertises an endpoint another service serves, such as `IAM_API_METADATA`
+(`owlmeans_iam_api`, the runtime IAM API). A field the provider derives itself cannot be overridden
+this way. A client with no `client_secret` is refused
+unless a debug flag is on, in which case one is generated and printed.
 
-## Building the interaction URL (server context, frontend route)
+## Building the interaction URL
 
 `interactions.url` must return the fully-qualified address of the `INTERACTION` screen, which is a
-**frontend** route resolved from a **server** context. `call()` does not exist there — it is attached
-only by `@owlmeans/client-entrypoint` — so the URL is assembled the way `urlCall` does it in the
-browser: resolve the route, substitute the `INTERACTION_UID` path param, then `makeSecurityHelper().makeUrl(route, path)`
-so the frontend service's host and base are applied. Pass the entrypoint's own `getPath()` as the
-path and let `makeUrl` supply the base — do not prepend it twice.
+**frontend** route resolved from a **server** context. `url()` does not exist there — that helper is
+attached only by `@owlmeans/client-entrypoint` — so the URL is assembled the way the browser's own
+`url()` does it: take the entrypoint's `path()`, substitute the `INTERACTION_UID` path param, then
+`makeSecurityHelper().makeUrl(entry.address(), path)`. `address()` is the address the entrypoint
+answers on — the frontend service's, not this one's — so the base comes from it and must not be
+prepended a second time.
 
 ## Scopes are derived from `claims`
 
-`oidc-provider` adds every key of the `claims` configuration to the supported-scope set
-(`collectScopes`). Declaring `claims.email` therefore makes `email` a **static** scope, and static
-scopes are checked against each client's own `scope` allowlist: a client that omits one fails the
-whole authorization request with `invalid_scope`. Whatever provisions clients for this provider must
-allow every scope the RP requests (`OIDC_RP_BASE_SCOPES`), and the account service must emit the
-matching claims — a granted scope with no claim behind it is silently empty.
-
-## oidc-provider v9 notes (important)
-
-- **Provider is a Koa app instance.** `oidc.use()` callbacks where the work happens *after* `await next()` will **not** fire once a route is matched — Koa's downstream does not continue past matched routes in v9. Move post-response header work (e.g. CSP rewrites) to a **Fastify `onSend`/`preHandler` hook** scoped to the OIDC base path.
-- **`enableHttpPostMethods`** defaults `false` — set it in the Provider config if your interaction UI POSTs to the authorization/end-session endpoints.
-- **DPoP is enabled by default.** Add `features: { dPoP: { enabled: false } }` if RP clients do not send DPoP proofs.
-- **Cookie `sameSite` defaults to `lax`** (was `none`). Adjust `cookies.*.sameSite` if the interaction UI is on a different subdomain.
-- **JWKS `kid` must be unique.** Every key in `jwks.keys` needs a distinct `kid`.
-- **Node 22+** required.
-
-## jose v6 notes
-
-`importPKCS8` now returns a **non-extractable `CryptoKey`** by default. Pass `{ extractable: true }` so `exportJWK` succeeds:
+`oidc-provider` adds every key of the `claims` configuration to the supported-scope set. Declaring
+`claims.email` therefore makes `email` a **static** scope, and static scopes are checked against each
+client's own `scope` allowlist: a client that omits one fails the whole authorization request with
+`invalid_scope`. Whatever provisions clients for this provider must allow every scope the RP requests
+(`OIDC_RP_BASE_SCOPES`), and the account service must emit the matching claims — a granted scope with
+no claim behind it is silently empty.
+
+The defaults this package sets: `claims` covers `email` (`email`, `email_verified`), `profile` (the
+standard set), `PERMISSIONS_SCOPE` → `PERMISSIONS_CLAIM` and `ORGANIZATIONS_SCOPE` →
+`ORGANIZATIONS_CLAIM`, both inert unless the account service actually emits them; `scopes` is
+`openid profile offline_access permissions organizations`; `features.devInteractions` is off.
+Anything under `cfg.oidc.customConfiguration` merges over these.
+
+`organizations` is a static scope like any other: only a client whose allowlist names it may ask,
+and a client that does not ask gets no `organizations` claim at all, so a single-organization
+client's tokens never carry one.
+
+## Pairwise subjects
+
+The integrated IAM gives every client its own subject for one account. `subjectTypes`,
+`pairwiseIdentifier` and `sectorIdentifierUriValidate` pass through `customConfiguration`
+unchanged, and `tests/pairwise.spec.ts` drives the pinned provider through the whole design:
+
+- `subjectTypes: ['pairwise']`, `pairwiseIdentifier: (ctx, accountId, client) => <subject>`, and
+  `sectorIdentifierUriValidate: () => false`; each client carries `subject_type: 'pairwise'` and
+  one constant `sector_identifier_uri` (https, never fetched, so its host may serve nothing — it
+  only lets a client register redirect URIs on several hosts).
+- The session and the grant name the ACCOUNT; `findAccount` is only ever asked for the account
+  id. The id_token, userinfo and introspection all answer the pairwise subject, unchanged across a
+  refresh; another client of the same session gets another one.
+- **The account's `claims()` must return `sub` = the account id.** The provider applies
+  `pairwiseIdentifier` to whatever `sub` it is given (`helpers/claims.js`), and introspection to
+  `token.accountId` — an account service that returned the pairwise value itself would have it
+  transformed a second time, and the id_token would no longer match introspection.
+- With only `pairwise` supported it becomes every client's default `subject_type`; a client
+  declaring `public` is refused.
+- `sectorIdentifierUriValidate` is missing from `@types/oidc-provider` 9.5.0, which is why
+  `OidcCustomConfiguration` declares it; drop that field when the typings carry it.
+
+## oidc-provider v9 configuration
+
+- **The provider is a Koa app**, and `Provider#use(fn)` splices `fn` **ahead of** the provider's own
+  router, so a middleware registered that way runs before routing and resumes after `await next()`.
+  The header corrections below are still mounted on the API server ahead of `oidc.callback()`, for
+  the reason given there.
+- **`enableHttpPostMethods` is `false`.** Set it only together with `cookies.long.sameSite: 'none'` —
+  the configuration check throws `TypeError: HTTP POST Method support requires that
+  cookies.long.sameSite is set to none` otherwise, at construction time.
+- **DPoP is enabled.** Pass `features: { dPoP: { enabled: false } }` when the clients send no DPoP
+  proofs.
+- **Cookie `sameSite` is `lax`** for both `cookies.long` and `cookies.short`. Revisit it when the
+  interaction UI lives on another subdomain.
+- **Every key in `jwks.keys` needs a distinct `kid`.**
+- There is no `provider.Account` getter — accounts come from the `findAccount` callback, which this
+  package points at `OidcAccountService`.
+- Outbound HTTP goes through the `fetch` configuration option, which mirrors the fetch API.
+
+## jose v6 key import
+
+`importPKCS8` returns a **non-extractable** `CryptoKey` for a private key. Pass `{ extractable: true }`
+so the JWKS export succeeds:
 
 ```typescript
 const key = await jose.importPKCS8(pkcs8Pem, 'RS256', { extractable: true })
 const jwk = await jose.exportJWK(key)
 ```
 
+## A refused account is a login, not a crash
+
+`loadById` answering `undefined` refuses an account (another organization's subject, a disabled or
+expired profile). The provider does not treat that as "not logged in": its `no_session` check reads
+the raw `session.accountId`, so the login prompt is skipped, `loadGrant` builds no grant for an
+unloaded account, and the consent prompt throws `TypeError … oidc.grant.getOIDCScopeEncountered` — the
+relying party gets `server_error` / "oops! something went wrong".
+
+The service therefore installs `makeInteractionPolicy()` (`src/utils/policy.ts`) as
+`interactions.policy`: the provider's default policy plus an `account_refused` check on the login
+prompt that requests a login whenever the session names an account the provider could not load. After
+that login the provider's resume step signs the stale session out and continues the interrupted
+request. A login that has just completed and is refused again (`oidc.result.login`) throws
+`access_denied` instead of prompting, so a refusal can never loop. A consumer's own
+`customConfiguration.interactions` is not merged — the service sets `policy` and `url` itself.
+`tests/policy.spec.ts` drives a real provider through the whole sequence, including the upstream
+crash as a canary: when a bump of `oidc-provider` makes that first test fail, the upstream fixed it
+and the check may go.
+
+## Response headers the hardened defaults get wrong
+
+`@fastify/helmet` runs with its defaults on every OwlMeans server, and two of them break an
+authorization endpoint. Both are corrected by middleware this package mounts ahead of the provider.
+
+- **`Cross-Origin-Opener-Policy: same-origin`** puts the authorization document in a fresh browsing
+  context group, severing `window.opener` **permanently** — navigating back to the relying party
+  afterwards does not restore it. That kills popup-based login, which is how an app embedded in an
+  iframe must authenticate (see the `web-oidc-rp` skill). The provider sends `unsafe-none`.
+- **`form-action 'self'`** blocks the provider's own interaction form posting across origins, so it
+  is rewritten to `form-action *`.
+
+**Set these as middleware, never as a Fastify `onSend` hook.** `oidc.callback()` is a Koa handler
+mounted through Middie: it ends the response itself, outside Fastify's reply lifecycle, so `onSend`
+never fires for any route the provider answers and anything set there silently never reaches the
+wire — the header looks configured in code and is absent in production. Middleware registered before
+the provider writes to the raw response, where helmet has already put its defaults, so the override
+is what ships. Verify with `curl -D -` against the provider's
+`.well-known/openid-configuration` rather than by reading the code.
+
 ## Depends On
 
-- `@owlmeans/oidc`, `@owlmeans/server-api`, `@owlmeans/server-context`
-- `oidc-provider` v9, `jose` v6 (runtime — see [[oidc-versions]] for pinned versions and upgrade checklist)
+- `@owlmeans/oidc`, `@owlmeans/server-api`, `@owlmeans/server-context`, `@owlmeans/config`,
+  `@owlmeans/context`, `@owlmeans/entrypoint`, `@owlmeans/route`, `@noble/hashes`, `@scure/base`
+- `fastify` (peer) — the API server this package mounts the provider onto
+- `oidc-provider` v9, `jose` v6 — see [[oidc-versions]] for the pins and the upgrade checklist

package/build/iam.d.ts

@@ -1,31 +1,4 @@
-import type { ClientMetadata } from 'oidc-provider';
-/** A registered OIDC client stored in the provider's Client adapter. */
-export interface OidcRegisteredClient {
-    clientId: string;
-    secret: string;
-    /** The entity (realm) this client belongs to — used for identity scoping. */
-    entityId?: string;
-    /** Application display name */
-    name?: string;
-    redirectUris?: string[];
-    grantTypes?: string[];
-    responseTypes?: string[];
-    scope?: string;
-}
-/** Full oidc-provider ClientMetadata with our entity extension. */
-export type OidcClientMetadata = ClientMetadata & {
-    entityId?: string;
-    owlEntityId?: string;
-};
+import type { ToClientMetadata } from './types.js';
 /** Convert an OidcRegisteredClient to the oidc-provider ClientMetadata shape. */
-export declare const toClientMetadata: (client: OidcRegisteredClient) => OidcClientMetadata;
-/** Extension seam for IAM integration into the OIDC provider — Phase 2 fills this */
-export interface OidcProviderIamExtension {
-    /** Convert a stored client record to oidc-provider ClientMetadata */
-    toClientMetadata: typeof toClientMetadata;
-    /** Type of a stored client record */
-    OidcRegisteredClient: OidcRegisteredClient;
-    /** Extended metadata type */
-    OidcClientMetadata: OidcClientMetadata;
-}
+export declare const toClientMetadata: ToClientMetadata;
 //# sourceMappingURL=iam.d.ts.map

package/build/iam.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"iam.d.ts","sourceRoot":"","sources":["../src/iam.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAgB,MAAM,eAAe,CAAA;AAEjE,wEAAwE;AACxE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,+BAA+B;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,mEAAmE;AACnE,MAAM,MAAM,kBAAkB,GAAG,cAAc,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAE7F,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,WAAY,oBAAoB,KAAG,kBAS9D,CAAA;AAEF,qFAAqF;AACrF,MAAM,WAAW,wBAAwB;IACvC,qEAAqE;IACrE,gBAAgB,EAAE,OAAO,gBAAgB,CAAA;IACzC,qCAAqC;IACrC,oBAAoB,EAAE,oBAAoB,CAAA;IAC1C,6BAA6B;IAC7B,kBAAkB,EAAE,kBAAkB,CAAA;CACvC"}
+{"version":3,"file":"iam.d.ts","sourceRoot":"","sources":["../src/iam.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAA4C,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAE5F,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,EAAE,gBAS7B,CAAA"}

package/build/iam.js.map

@@ -1 +1 @@
-{"version":3,"file":"iam.js","sourceRoot":"","sources":["../src/iam.ts"],"names":[],"mappings":"AAmBA,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAA4B,EAAsB,EAAE,CAAC,CAAC;IACrF,SAAS,EAAE,MAAM,CAAC,QAAQ;IAC1B,aAAa,EAAE,MAAM,CAAC,MAAM;IAC5B,aAAa,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;IACxC,WAAW,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC;IACzE,cAAc,EAAE,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,CAAmB;IACpE,0BAA0B,EAAE,qBAAqB;IACjD,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,+BAA+B;IACtD,WAAW,EAAE,MAAM,CAAC,QAAQ;CAC7B,CAAC,CAAA"}
+{"version":3,"file":"iam.js","sourceRoot":"","sources":["../src/iam.ts"],"names":[],"mappings":"AAGA,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAqB,CAAC,MAA4B,EAAsB,EAAE,CAAC,CAAC;IACvG,SAAS,EAAE,MAAM,CAAC,QAAQ;IAC1B,aAAa,EAAE,MAAM,CAAC,MAAM;IAC5B,aAAa,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;IACxC,WAAW,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC;IACzE,cAAc,EAAE,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,CAAmB;IACpE,0BAA0B,EAAE,qBAAqB;IACjD,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,+BAA+B;IACtD,WAAW,EAAE,MAAM,CAAC,QAAQ;CAC7B,CAAC,CAAA"}

package/build/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAOnD,eAAO,MAAM,4BAA4B,SAAS,MAAM,8BAqBvD,CAAA"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAOnD,eAAO,MAAM,4BAA4B,SAAS,MAAM,SAAoB,MAAM,KAAmB,UAqBpG,CAAA"}

package/build/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClF,OAAO,EAAE,aAAa,IAAI,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAEjE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAG3C,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,GAAG,GAAW,SAAS,EAAE,IAAI,GAAG,aAAa,EAAE,EAAE;IAC5F,MAAM,UAAU,GAAe;QAC7B,IAAI,EAAE,cAAc,CAAC,OAAO;QAC5B,KAAK,EAAE,eAAe,CAAC,OAAO;QAC9B,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACjB,MAAM,OAAO,GAAG,aAAa,CAAkB,GAAyB,CAAY,CAAA;YACpF,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAY,GAAG,CAAC,CAAA;YAClD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAsB,IAAI,CAAC,CAAA;YAE9D,MAAM,MAAM,GAAG,sBAAsB,GAAG,IAAI,IAAI,EAAE,CAAA;YAClD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;gBAC3D,MAAM,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;gBACpC,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;oBAC5B,GAAG,CAAC,GAAG,CAAC,OAAO,GAAG,EAAE,CAAA;gBACtB,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;YACtC,CAAC;QACH,CAAC;KACF,CAAA;IAED,OAAO,UAAU,CAAA;AACnB,CAAC,CAAA"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClF,OAAO,EAAE,aAAa,IAAI,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAEjE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAG3C,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,GAAG,GAAW,SAAS,EAAE,IAAI,GAAW,aAAa,EAAc,EAAE;IAChH,MAAM,UAAU,GAAe;QAC7B,IAAI,EAAE,cAAc,CAAC,OAAO;QAC5B,KAAK,EAAE,eAAe,CAAC,OAAO;QAC9B,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACjB,MAAM,OAAO,GAAG,aAAa,CAAkB,GAAyB,CAAY,CAAA;YACpF,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAY,GAAG,CAAC,CAAA;YAClD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAsB,IAAI,CAAC,CAAA;YAE9D,MAAM,MAAM,GAAG,sBAAsB,GAAG,IAAI,IAAI,EAAE,CAAA;YAClD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;gBAC3D,MAAM,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;gBACpC,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;oBAC5B,GAAG,CAAC,GAAG,CAAC,OAAO,GAAG,EAAE,CAAA;gBACtB,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;YACtC,CAAC;QACH,CAAC;KACF,CAAA;IAED,OAAO,UAAU,CAAA;AACnB,CAAC,CAAA"}

package/build/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAA0C,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAS9G,eAAO,MAAM,yBAAyB,WAAW,MAAM,KAAmB,mBAoGzE,CAAA;AAED,eAAO,MAAM,yBAAyB,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,OACzE,CAAC,UAAS,MAAM,KACpB,CAOF,CAAA"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAA0C,mBAAmB,EAAE,MAAM,YAAY,CAAA;AA2C9G,eAAO,MAAM,yBAAyB,WAAW,MAAM,KAAmB,mBAqGzE,CAAA;AAED,eAAO,MAAM,yBAAyB,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,OACzE,CAAC,UAAS,MAAM,KACpB,CAOF,CAAA"}

package/build/service.js

@@ -2,9 +2,38 @@ import { assertContext, createService } from '@owlmeans/context';
 import { DEFAULT_ALIAS, OIDC_ACCOUNT_SERVICE } from './consts.js';
 import { DEFAULT_PATH, INTERACTION, INTERACTION_UID } from '@owlmeans/oidc';
 import Provider from 'oidc-provider';
+import { logger } from '@owlmeans/log';
 import { PARAM, SEP } from '@owlmeans/route';
 import { makeSecurityHelper } from '@owlmeans/config';
-import { combineConfig } from './utils/config.js';
+import { oidcConfigOf } from './utils/config.js';
+import { makeInteractionPolicy } from './utils/policy.js';
+const log = logger('server-oidc-provider');
+/** An OIDC error the provider answers with a 4xx — the client's mistake, not the provider's. */
+const isClientError = (error) => {
+    const status = error?.status;
+    return typeof status === 'number' && status >= 400 && status < 500;
+};
+/**
+ * One provider error. The state dump carries ids only — never a token, code or secret the
+ * request holds.
+ */
+const reportProviderError = (issuer, kind, ctx, error) => {
+    const state = ctx?.oidc;
+    const data = { kind, issuer, clientId: state?.client?.clientId, code: error.error, error };
+    if (isClientError(error)) {
+        log.warn('OIDC provider refused a request', data);
+    }
+    else {
+        log.error('OIDC provider error', data);
+    }
+    if (state != null && log.enabled('debug')) {
+        log.debug('OIDC provider error state', {
+            kind, fields: Object.getOwnPropertyNames(state),
+            grant: state.grant != null
+                ? { grantId: state.grant.jti, accountId: state.grant.accountId, clientId: state.grant.clientId } : undefined,
+        });
+    }
+};
 let _initializedOidc = undefined;
 export const createOidcProviderService = (alias = DEFAULT_ALIAS) => {
     const service = createService(alias, {
@@ -16,7 +45,7 @@ export const createOidcProviderService = (alias = DEFAULT_ALIAS) => {
             const url = helper.makeUrl(serviceRoute, cfg.basePath ?? DEFAULT_PATH, { base: true });
             const unsecure = context.cfg.security?.unsecure === false ? false : !url.startsWith('https');
             const oidc = new Provider(url, {
-                ...await combineConfig(context, unsecure),
+                ...await oidcConfigOf(context).combineConfig(unsecure),
                 adapter: cfg.adapterService != null
                     ? name => context.service(cfg.adapterService).instance(name)
                     : undefined,
@@ -27,53 +56,56 @@ export const createOidcProviderService = (alias = DEFAULT_ALIAS) => {
                     return accountSrv.loadById(context, id, { clientId });
                 },
                 interactions: {
+                    policy: makeInteractionPolicy(),
                     url: async (_, interaction) => {
                         // The interaction screen is a FRONTEND route, and this is a server context — the
-                        // entrypoint registered here has no `call()` (that helper is attached by
-                        // `@owlmeans/client-entrypoint` only). So the URL is assembled the way `urlCall` does
-                        // it in the browser: resolve the route, substitute the path params, then qualify it
-                        // with the frontend service's host.
+                        // entrypoint registered here has no `url()` (that helper is attached by
+                        // `@owlmeans/client-entrypoint` only). So the URL is assembled the way `entrypointUrl`
+                        // does it in the browser: take the entrypoint's path, substitute the path params, then
+                        // qualify it with the address the entrypoint answers on — the FRONTEND service's, not
+                        // this one's.
                         const entry = context.entrypoint(INTERACTION);
-                        const route = await entry.route.resolve(context);
-                        const path = entry.getPath().split(SEP)
+                        const path = entry.path().split(SEP)
                             .map(part => part === `${PARAM}${INTERACTION_UID}` ? interaction.uid : part)
                             .join(SEP);
-                        return helper.makeUrl(route, path);
+                        return helper.makeUrl(entry.address(), path);
                     }
                 }
             });
             oidc.proxy = cfg.behindProxy ?? unsecure;
             const base = SEP + (cfg.basePath ?? DEFAULT_PATH);
-            api.server.use(base, oidc.callback());
-            // oidc-provider v9: provider.use() middleware no longer runs post-response after a matched
-            // route. CSP rewrite is handled at the Fastify layer via an onSend hook instead.
-            api.server.addHook('onSend', async (request, reply, payload) => {
-                if (!request.url.startsWith(base)) {
-                    return payload;
-                }
-                const csp = reply.getHeader('content-security-policy');
+            /**
+             * Response headers the hardened defaults get wrong for an authorization endpoint.
+             *
+             * This runs as middleware, ahead of the provider in the same chain, and writes to the raw
+             * response — deliberately, not as a Fastify `onSend` hook. `oidc.callback()` is a Koa
+             * handler mounted through Middie: it ends the response itself, outside Fastify's reply
+             * lifecycle, so `onSend` never fires for any route the provider answers and anything set
+             * there silently never reaches the wire. The security defaults are already on the raw
+             * response by this point (`@fastify/helmet` applies them in `onRequest`), so overriding
+             * them here is what actually takes effect.
+             */
+            api.server.use(base, (_req, res, next) => {
+                // `Cross-Origin-Opener-Policy: same-origin` puts this document in a fresh browsing
+                // context group, which severs `window.opener` **permanently** — navigating back to the
+                // relying party afterwards does not restore it. Popup-based login is the standard way an
+                // embedded application authenticates and the opener is its only channel home, so an
+                // authorization endpoint must not be the thing that cuts it.
+                res.setHeader('Cross-Origin-Opener-Policy', 'unsafe-none');
+                // The provider posts its own interaction forms across origins; `form-action 'self'`
+                // would block the submission.
+                const csp = res.getHeader('Content-Security-Policy');
                 if (typeof csp === 'string' && csp.includes("form-action 'self'")) {
-                    reply.header('Content-Security-Policy', csp.replace(/form-action 'self'/, 'form-action *'));
+                    res.setHeader('Content-Security-Policy', csp.replace(/form-action 'self'/, 'form-action *'));
                 }
-                return payload;
+                next();
             });
-            if (context.cfg.debug?.all || context.cfg.debug?.oidc) {
-                oidc.on('grant.error', (_, error) => {
-                    console.warn('GRANT ERROR .......: ');
-                    console.info(oidc.issuer);
-                    console.error('!!!! GRANT ERROR: ', error);
-                });
-                oidc.on('server_error', (ctx, error) => {
-                    console.warn('SERVER ERROR .......: ', Object.getOwnPropertyNames(ctx.oidc));
-                    console.info(ctx.oidc.grant);
-                    console.error('!!!! SERVER ERROR: ', error);
-                });
-                oidc.on('userinfo.error', (ctx, error) => {
-                    console.warn('USER INFO ERROR .......: ', Object.getOwnPropertyNames(ctx.oidc));
-                    console.info(ctx.oidc.grant);
-                    console.error('!!!! USER INFO ERROR: ', error);
-                });
-            }
+            api.server.use(base, oidc.callback());
+            // Always attached: a provider error reaches the log — at `warn` when the client caused it
+            // (an OIDC 4xx such as `invalid_grant`), at `error` otherwise; the request state at `debug`.
+            oidc.on('grant.error', (ctx, error) => { reportProviderError(oidc.issuer, 'grant', ctx, error); });
+            oidc.on('server_error', (ctx, error) => { reportProviderError(oidc.issuer, 'server', ctx, error); });
+            oidc.on('userinfo.error', (ctx, error) => { reportProviderError(oidc.issuer, 'userinfo', ctx, error); });
             _initializedOidc = service.oidc = oidc;
         },
         instance: () => {

package/build/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAE3E,OAAO,QAAQ,MAAM,eAAe,CAAA;AAGpC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,IAAI,gBAAgB,GAAyB,SAAS,CAAA;AACtD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,KAAK,GAAW,aAAa,EAAuB,EAAE;IAC9F,MAAM,OAAO,GAAwB,aAAa,CAAsB,KAAK,EAAE;QAC7E,MAAM,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,EAAE,KAAK,CAAC,CAAA;YAC7E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA;YAE5B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAe,CAAA;YAC/F,MAAM,MAAM,GAAG,kBAAkB,CAAkB,OAAO,CAAC,CAAA;YAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,QAAQ,IAAI,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YACtF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;YAE5F,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE;gBAC7B,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC;gBAEzC,OAAO,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI;oBACjC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAqB,GAAG,CAAC,cAAe,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBACjF,CAAC,CAAC,SAAS;gBAEb,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE;oBACrC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAChC,GAAG,CAAC,cAAc,IAAI,oBAAoB,CAC3C,CAAA;oBAED,MAAM,QAAQ,GAAI,IAAsD,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ;2BAC1F,KAA2C,EAAE,QAAQ,CAAA;oBAE3D,OAAO,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;gBACvD,CAAC;gBAED,YAAY,EAAE;oBACZ,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE;wBAC5B,iFAAiF;wBACjF,yEAAyE;wBACzE,sFAAsF;wBACtF,oFAAoF;wBACpF,oCAAoC;wBACpC,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAmB,WAAW,CAAC,CAAA;wBAC/D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAkB,OAAO,CAAC,CAAA;wBACjE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC;6BACpC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,GAAG,KAAK,GAAG,eAAe,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;6BAC3E,IAAI,CAAC,GAAG,CAAC,CAAA;wBAEZ,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;oBACpC,CAAC;iBACF;aACF,CAAC,CAAA;YAEF,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,WAAW,IAAI,QAAQ,CAAA;YACxC,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,YAAY,CAAC,CAAA;YAEjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;YAErC,2FAA2F;YAC3F,iFAAiF;YACjF,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBAClC,OAAO,OAAO,CAAA;gBAChB,CAAC;gBACD,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAA;gBACtD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;oBAClE,KAAK,CAAC,MAAM,CAAC,yBAAyB,EAAE,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC,CAAA;gBAC7F,CAAC;gBACD,OAAO,OAAO,CAAA;YAChB,CAAC,CAAC,CAAA;YAEF,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;gBAEtD,IAAI,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE;oBAClC,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;oBACrC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;oBACzB,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAA;gBAC5C,CAAC,CAAC,CAAA;gBAEF,IAAI,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;oBACrC,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE,MAAM,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;oBAC5E,OAAO,CAAC,IAAI,CAAE,GAAG,CAAC,IAAY,CAAC,KAAK,CAAC,CAAA;oBACrC,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAA;gBAC7C,CAAC,CAAC,CAAA;gBAEF,IAAI,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;oBACvC,OAAO,CAAC,IAAI,CAAC,2BAA2B,EAAE,MAAM,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;oBAC/E,OAAO,CAAC,IAAI,CAAE,GAAG,CAAC,IAAY,CAAC,KAAK,CAAC,CAAA;oBACrC,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAA;gBAChD,CAAC,CAAC,CAAA;YAEJ,CAAC;YAED,gBAAgB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAA;QACxC,CAAC;QAED,QAAQ,EAAE,GAAG,EAAE;YACb,OAAO,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,gBAAiB,CAAC,CAAA;QAC3D,CAAC;QAED,cAAc,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE;YACzB,OAAO,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,CAAA;QAC9D,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,GAAM,EAAE,KAAK,GAAW,aAAa,EAClC,EAAE;IACL,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAA;IAChD,MAAM,OAAO,GAAG,GAAQ,CAAA;IAExB,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAEhC,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAG3E,OAAO,QAAQ,MAAM,eAAe,CAAA;AAEpC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAGtC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AAEzD,MAAM,GAAG,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAA;AAE1C,gGAAgG;AAChG,MAAM,aAAa,GAAG,CAAC,KAAc,EAAW,EAAE;IAChD,MAAM,MAAM,GAAI,KAAqC,EAAE,MAAM,CAAA;IAC7D,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAA;AACpE,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,mBAAmB,GAAG,CAAC,MAAc,EAAE,IAAY,EAAE,GAAmC,EAAE,KAAY,EAAQ,EAAE;IACpH,MAAM,KAAK,GAAG,GAAG,EAAE,IAEN,CAAA;IACb,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAG,KAA6B,CAAC,KAAK,EAAE,KAAK,EAAE,CAAA;IACnH,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE,IAAI,CAAC,CAAA;IACnD,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAA;IACxC,CAAC;IACD,IAAI,KAAK,IAAI,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,KAAK,CAAC,2BAA2B,EAAE;YACrC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC;YAC/C,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;gBACxB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC/G,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAA;AAED,IAAI,gBAAgB,GAAyB,SAAS,CAAA;AACtD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,KAAK,GAAW,aAAa,EAAuB,EAAE;IAC9F,MAAM,OAAO,GAAwB,aAAa,CAAsB,KAAK,EAAE;QAC7E,MAAM,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YAClB,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,EAAE,KAAK,CAAC,CAAA;YAC7E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA;YAE5B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAe,CAAA;YAC/F,MAAM,MAAM,GAAG,kBAAkB,CAAkB,OAAO,CAAC,CAAA;YAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,QAAQ,IAAI,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YACtF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;YAE5F,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE;gBAC7B,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC;gBAEtD,OAAO,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI;oBACjC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAqB,GAAG,CAAC,cAAe,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBACjF,CAAC,CAAC,SAAS;gBAEb,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE;oBACrC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAChC,GAAG,CAAC,cAAc,IAAI,oBAAoB,CAC3C,CAAA;oBAED,MAAM,QAAQ,GAAI,IAAsD,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ;2BAC1F,KAA2C,EAAE,QAAQ,CAAA;oBAE3D,OAAO,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;gBACvD,CAAC;gBAED,YAAY,EAAE;oBACZ,MAAM,EAAE,qBAAqB,EAAE;oBAC/B,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE;wBAC5B,iFAAiF;wBACjF,wEAAwE;wBACxE,uFAAuF;wBACvF,uFAAuF;wBACvF,sFAAsF;wBACtF,cAAc;wBACd,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAmB,WAAW,CAAC,CAAA;wBAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC;6BACjC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,GAAG,KAAK,GAAG,eAAe,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;6BAC3E,IAAI,CAAC,GAAG,CAAC,CAAA;wBAEZ,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAA;oBAC9C,CAAC;iBACF;aACF,CAAC,CAAA;YAEF,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,WAAW,IAAI,QAAQ,CAAA;YACxC,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,YAAY,CAAC,CAAA;YAEjD;;;;;;;;;;eAUG;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAa,EAAE,GAAmB,EAAE,IAAgB,EAAE,EAAE;gBAC5E,mFAAmF;gBACnF,uFAAuF;gBACvF,yFAAyF;gBACzF,oFAAoF;gBACpF,6DAA6D;gBAC7D,GAAG,CAAC,SAAS,CAAC,4BAA4B,EAAE,aAAa,CAAC,CAAA;gBAE1D,oFAAoF;gBACpF,8BAA8B;gBAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAA;gBACpD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;oBAClE,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC,CAAA;gBAC9F,CAAC;gBAED,IAAI,EAAE,CAAA;YACR,CAAC,CAAC,CAAA;YAEF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;YAErC,0FAA0F;YAC1F,6FAA6F;YAC7F,IAAI,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;YACjG,IAAI,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;YACnG,IAAI,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;YAEvG,gBAAgB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAA;QACxC,CAAC;QAED,QAAQ,EAAE,GAAG,EAAE;YACb,OAAO,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,gBAAiB,CAAC,CAAA;QAC3D,CAAC;QAED,cAAc,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE;YACzB,OAAO,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,CAAA;QAC9D,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,GAAM,EAAE,KAAK,GAAW,aAAa,EAClC,EAAE;IACL,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAA;IAChD,MAAM,OAAO,GAAG,GAAQ,CAAA;IAExB,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAEhC,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/types.d.ts

@@ -17,7 +17,14 @@ export interface OidcConfig extends OidcSharedConfig {
     basePath?: string;
     frontBase?: string;
     clients: ClientMetadata[];
-    customConfiguration?: Configuration;
+    /**
+     * Extra fields of the discovery document, field name → URL. A value may be written as
+     * `{{service-alias}}/path`, expanded against that registered service's host exactly as a
+     * client's redirect URIs are — which is how a deployment advertises an endpoint it serves on
+     * another service (`IAM_API_METADATA`).
+     */
+    discoveryUris?: Record<string, string>;
+    customConfiguration?: OidcCustomConfiguration;
     behindProxy?: boolean;
     defaultKeys: {
         RS256: {
@@ -28,6 +35,16 @@ export interface OidcConfig extends OidcSharedConfig {
     accountService?: string;
     adapterService?: string;
 }
+/**
+ * The provider configuration a deployment passes through, merged over this package's defaults.
+ *
+ * Adds what the pinned `@types/oidc-provider` omits but `oidc-provider` reads:
+ * `sectorIdentifierUriValidate` answering `false` keeps the provider from fetching a pairwise
+ * client's `sector_identifier_uri` — a constant sector whose host serves nothing.
+ */
+export interface OidcCustomConfiguration extends Configuration {
+    sectorIdentifierUriValidate?: (client: InstanceType<Provider['Client']>) => boolean;
+}
 export interface OidcAccountParams {
     /** The OIDC client requesting the account — lets the account service scope claims (e.g. permissions) per client. */
     clientId?: string;
@@ -47,4 +64,35 @@ export interface Config extends ServerConfig, OidcConfigAppend {
 }
 export interface Context<C extends Config = Config> extends ServerContext<C>, ApiServerAppend {
 }
+/** A registered OIDC client stored in the provider's Client adapter. */
+export interface OidcRegisteredClient {
+    clientId: string;
+    secret: string;
+    /** The entity (realm) this client belongs to — used for identity scoping. */
+    entityId?: string;
+    /** Application display name */
+    name?: string;
+    redirectUris?: string[];
+    grantTypes?: string[];
+    responseTypes?: string[];
+    scope?: string;
+}
+/** Full oidc-provider ClientMetadata with our entity extension. */
+export interface OidcClientMetadata extends ClientMetadata {
+    entityId?: string;
+    owlEntityId?: string;
+}
+/** Converts a stored client record to oidc-provider ClientMetadata. */
+export interface ToClientMetadata {
+    (client: OidcRegisteredClient): OidcClientMetadata;
+}
+/** Extension seam for IAM integration into the OIDC provider — Phase 2 fills this */
+export interface OidcProviderIamExtension {
+    /** Convert a stored client record to oidc-provider ClientMetadata */
+    toClientMetadata: ToClientMetadata;
+    /** Type of a stored client record */
+    OidcRegisteredClient: OidcRegisteredClient;
+    /** Extended metadata type */
+    OidcClientMetadata: OidcClientMetadata;
+}
 //# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtE,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC3E,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAE3G,MAAM,WAAW,mBAAoB,SAAQ,kBAAkB;IAC7D,IAAI,EAAE,QAAQ,CAAA;IAEd,MAAM,EAAE,CAAC,GAAG,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAEzC,QAAQ,EAAE,MAAM,QAAQ,CAAA;IAExB,cAAc,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;CAC5D;AAED,MAAM,WAAW,gBAAgB,CAAC,KAAK,SAAS,gBAAgB,GAAG,gBAAgB;IACjF,IAAI,EAAE,UAAU,GAAG,KAAK,CAAA;CACzB;AAED,MAAM,WAAW,UAAW,SAAQ,gBAAgB;IAClD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,cAAc,EAAE,CAAA;IACzB,mBAAmB,CAAC,EAAE,aAAa,CAAA;IACnC,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,WAAW,EAAE;QACX,KAAK,EAAE;YACL,EAAE,EAAE,MAAM,CAAA;YACV,GAAG,CAAC,EAAE,MAAM,CAAA;SACb,CAAA;KACF,CAAA;IACD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,oHAAoH;IACpH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D,QAAQ,EAAE,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,iBAAiB,KAAK,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;CACnI;AAED,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;CACpC;AAED,MAAM,WAAW,MAAO,SAAQ,YAAY,EAAE,gBAAgB;IAC5D,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG;QAC7B,IAAI,CAAC,EAAE,OAAO,CAAA;QACd,UAAU,CAAC,EAAE,OAAO,CAAA;QACpB,QAAQ,CAAC,EAAE,OAAO,CAAA;KACnB,CAAA;CACF;AAED,MAAM,WAAW,OAAO,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,CAAE,SAAQ,aAAa,CAAC,CAAC,CAAC,EACxE,eAAe;CAAI"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtE,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC3E,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAE3G,MAAM,WAAW,mBAAoB,SAAQ,kBAAkB;IAC7D,IAAI,EAAE,QAAQ,CAAA;IAEd,MAAM,EAAE,CAAC,GAAG,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAEzC,QAAQ,EAAE,MAAM,QAAQ,CAAA;IAExB,cAAc,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;CAC5D;AAED,MAAM,WAAW,gBAAgB,CAAC,KAAK,SAAS,gBAAgB,GAAG,gBAAgB;IACjF,IAAI,EAAE,UAAU,GAAG,KAAK,CAAA;CACzB;AAED,MAAM,WAAW,UAAW,SAAQ,gBAAgB;IAClD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,cAAc,EAAE,CAAA;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACtC,mBAAmB,CAAC,EAAE,uBAAuB,CAAA;IAC7C,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,WAAW,EAAE;QACX,KAAK,EAAE;YACL,EAAE,EAAE,MAAM,CAAA;YACV,GAAG,CAAC,EAAE,MAAM,CAAA;SACb,CAAA;KACF,CAAA;IACD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAwB,SAAQ,aAAa;IAC5D,2BAA2B,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,OAAO,CAAA;CACpF;AAED,MAAM,WAAW,iBAAiB;IAChC,oHAAoH;IACpH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D,QAAQ,EAAE,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,iBAAiB,KAAK,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;CACnI;AAED,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;CACpC;AAED,MAAM,WAAW,MAAO,SAAQ,YAAY,EAAE,gBAAgB;IAC5D,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG;QAC7B,IAAI,CAAC,EAAE,OAAO,CAAA;QACd,UAAU,CAAC,EAAE,OAAO,CAAA;QACpB,QAAQ,CAAC,EAAE,OAAO,CAAA;KACnB,CAAA;CACF;AAED,MAAM,WAAW,OAAO,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,CAAE,SAAQ,aAAa,CAAC,CAAC,CAAC,EACxE,eAAe;CAAI;AAEvB,wEAAwE;AACxE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,+BAA+B;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,mEAAmE;AACnE,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IAAG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE;AAEtG,uEAAuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,CAAC,MAAM,EAAE,oBAAoB,GAAG,kBAAkB,CAAA;CACnD;AAED,qFAAqF;AACrF,MAAM,WAAW,wBAAwB;IACvC,qEAAqE;IACrE,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,qCAAqC;IACrC,oBAAoB,EAAE,oBAAoB,CAAA;IAC1C,6BAA6B;IAC7B,kBAAkB,EAAE,kBAAkB,CAAA;CACvC"}

package/build/utils/client.d.ts

@@ -1,4 +1,7 @@
 import type { ClientMetadata } from 'oidc-provider';
 import type { Context } from '../types.js';
+import type { SecurityHelper } from '@owlmeans/config';
 export declare const updateClient: (context: Context, client: ClientMetadata) => ClientMetadata;
+/** Expands a `{{service-alias}}/path` URI against that registered service; any other URI is kept. */
+export declare const makeUriUpdater: (context: Context, helper: SecurityHelper) => (uri: string) => string;
 //# sourceMappingURL=client.d.ts.map

package/build/utils/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/utils/client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,KAAK,EAAU,OAAO,EAAE,MAAM,aAAa,CAAA;AAKlD,eAAO,MAAM,YAAY,YAAa,OAAO,UAAU,cAAc,KAAG,cAoBvE,CAAA"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/utils/client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,KAAK,EAAU,OAAO,EAAE,MAAM,aAAa,CAAA;AAElD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAMtD,eAAO,MAAM,YAAY,YAAa,OAAO,UAAU,cAAc,KAAG,cAkBvE,CAAA;AAED,qGAAqG;AACrG,eAAO,MAAM,cAAc,YAAa,OAAO,UAAU,cAAc,WAAW,MAAM,KAAG,MAS1F,CAAA"}