@owlmeans/server-oidc-provider 0.1.18-rc.52 → 0.1.18-rc.54

package/README.md

@@ -14,7 +14,7 @@ Embedded OIDC identity provider — wraps the `oidc-provider` library as an OwlM
 ## Installation
 
 ```bash
-bun add @owlmeans/server-oidc-provider@^0.1.18-rc.52
+bun add @owlmeans/server-oidc-provider@^0.1.18-rc.54
 ```
 
 ## Usage
@@ -72,7 +72,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.52
+npx @owlmeans/agent-skills@^0.1.18-rc.56
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-oidc-provider",
-  "version": "0.1.18-rc.52",
-  "generatedAt": "2026-10-08T21:27:54.314Z",
+  "version": "0.1.18-rc.54",
+  "generatedAt": "2026-10-17T00:00:32.719Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-oidc-provider/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/server-oidc-provider
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-oidc-provider": "^0.1.18-rc.52"` in `dependencies`
+**Install:** `"@owlmeans/server-oidc-provider": "^0.1.18-rc.54"` in `dependencies`
 **Runtime deps:** `oidc-provider@9.11.1` (exact), `jose@6.2.5` (exact), `@types/oidc-provider@9.5.0`
 
 Use this only when your service **is** the identity provider. For consuming someone else's issuer,

package/build/utils/client.d.ts

@@ -0,0 +1,7 @@
+import type { ClientMetadata } from 'oidc-provider';
+import type { Context } from '../types.js';
+import type { SecurityHelper } from '@owlmeans/config';
+export declare const updateClient: (context: Context, client: ClientMetadata) => ClientMetadata;
+/** Expands a `{{service-alias}}/path` URI against that registered service; any other URI is kept. */
+export declare const makeUriUpdater: (context: Context, helper: SecurityHelper) => (uri: string) => string;
+//# sourceMappingURL=client.d.ts.map

package/build/utils/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/utils/client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,KAAK,EAAU,OAAO,EAAE,MAAM,aAAa,CAAA;AAElD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAMtD,eAAO,MAAM,YAAY,YAAa,OAAO,UAAU,cAAc,KAAG,cAkBvE,CAAA;AAED,qGAAqG;AACrG,eAAO,MAAM,cAAc,YAAa,OAAO,UAAU,cAAc,WAAW,MAAM,KAAG,MAS1F,CAAA"}

package/build/utils/client.js

@@ -0,0 +1,33 @@
+import { randomBytes } from '@noble/hashes/utils';
+import { hex } from '@scure/base';
+import { makeSecurityHelper } from '@owlmeans/config';
+import { SEP } from '@owlmeans/route';
+import { logger } from '@owlmeans/log';
+const log = logger('server-oidc-provider');
+export const updateClient = (context, client) => {
+    if (client.client_secret == null) {
+        if (!context.cfg.debug.all && !context.cfg.debug.oidc) {
+            throw new SyntaxError('Client secret is required');
+        }
+        client.client_secret = hex.encode(randomBytes(32));
+        // The secret itself is never written to a log.
+        log.warn('Exceptionally insecure: a client secret was generated for an OIDC client (debug only)', {
+            clientId: client.client_id,
+        });
+    }
+    const helper = makeSecurityHelper(context);
+    const updateUri = makeUriUpdater(context, helper);
+    client.redirect_uris = client.redirect_uris?.map(updateUri) ?? [];
+    client.post_logout_redirect_uris = client.post_logout_redirect_uris?.map(updateUri) ?? [];
+    return client;
+};
+/** Expands a `{{service-alias}}/path` URI against that registered service; any other URI is kept. */
+export const makeUriUpdater = (context, helper) => (uri) => {
+    if (uri.startsWith('{{')) {
+        const [host, ...parts] = uri.split(SEP);
+        const service = context.cfg.services[host.slice(2, -2)];
+        return helper.makeUrl(service, parts.join(SEP));
+    }
+    return uri;
+};
+//# sourceMappingURL=client.js.map

package/build/utils/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/utils/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAGjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAErD,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAEtC,MAAM,GAAG,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAA;AAE1C,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAgB,EAAE,MAAsB,EAAkB,EAAE;IACvF,IAAI,MAAM,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACtD,MAAM,IAAI,WAAW,CAAC,2BAA2B,CAAC,CAAA;QACpD,CAAC;QACD,MAAM,CAAC,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;QAClD,+CAA+C;QAC/C,GAAG,CAAC,IAAI,CAAC,uFAAuF,EAAE;YAChG,QAAQ,EAAE,MAAM,CAAC,SAAS;SAC3B,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAkB,OAAO,CAAC,CAAA;IAC3D,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACjD,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;IACjE,MAAM,CAAC,yBAAyB,GAAG,MAAM,CAAC,yBAAyB,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;IAEzF,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,qGAAqG;AACrG,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAgB,EAAE,MAAsB,EAAE,EAAE,CAAC,CAAC,GAAW,EAAU,EAAE;IAClG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAEvC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QACvD,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACjD,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-oidc-provider",
-  "version": "0.1.18-rc.52",
+  "version": "0.1.18-rc.54",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -39,9 +39,9 @@
     "@owlmeans/context": "^0.1.18-rc.34",
     "@owlmeans/entrypoint": "^0.1.18-rc.41",
     "@owlmeans/log": "^0.1.18-rc.3",
-    "@owlmeans/oidc": "^0.1.18-rc.57",
+    "@owlmeans/oidc": "^0.1.18-rc.59",
     "@owlmeans/route": "^0.1.18-rc.35",
-    "@owlmeans/server-api": "^0.1.18-rc.53",
+    "@owlmeans/server-api": "^0.1.18-rc.55",
     "@owlmeans/server-context": "^0.1.18-rc.44",
     "@scure/base": "^2.4.0",
     "jose": "6.2.12",