@owlmeans/server-oidc-rp 0.1.0

package/build/actions/process.js

@@ -0,0 +1,80 @@
+import { handleBody } from '@owlmeans/server-api';
+import { OIDC_WRAPPED_TOKEN } from '@owlmeans/oidc';
+import { assertContext } from '@owlmeans/context';
+import Url from 'url';
+import { makeOidcAuthentication } from '../utils/auth.js';
+import { AuthenFailed, AuthManagerError, AuthRole } from '@owlmeans/auth';
+import { decodeJwt } from 'jose';
+import { cache, exchangeId, managedId } from '../utils/cache.js';
+import { trust } from '@owlmeans/auth-common/utils';
+import { TRUSTED } from '@owlmeans/config';
+import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope';
+import { OIDC_AUTH_LIFTETIME } from '../consts.js';
+import { wrapper } from '../utils/wrapped.js';
+/**
+ * Authentication method links together OIDC and OwlMeans auth.
+ * 1. We authenticate OIDC redirect back params with the classic OIDC client.
+ * 2. We temporary store on the server refresh token and OIDC token.
+ * 3. We supply the client with perked OwlMeans Auth token that in fact
+ * is the set of OIDC tokens (except refresh token - we keep it here?)
+ * 4. We used it in a centralized way to check permissions over OwlMeans Auth
+ * central service irrespectively is it OIDC or our custom permissions engine
+ * (this is useful to properly support paid accounts and bridge the underlying
+ * IAM system implemetation - abstract from it).
+ * 5. The method ends with production of OwlMeans authorization token.
+ *
+ * ! There is also token renewal mechanism that should be implemented nearby.
+ */
+export const authenticate = handleBody(async ({ authUrl, ...params }, ctx) => {
+    const context = assertContext(ctx);
+    const url = new Url.URL(authUrl);
+    const redirectUrl = url.searchParams.get('redirect_uri');
+    const [cfg, tokenSet, token] = await makeOidcAuthentication(context)({
+        challenge: redirectUrl + ':' + authUrl,
+        credential: new Url.URLSearchParams(params).toString()
+    });
+    console.log("\n\n ============ \n Config we got for real autentioncation", cfg);
+    if (tokenSet.id_token == null || tokenSet.access_token == null) {
+        throw new AuthenFailed();
+    }
+    if (cfg.service == null) {
+        throw new AuthManagerError('service');
+    }
+    await cache(context).delete(exchangeId(token));
+    console.log('List provided user permisssions', decodeJwt(tokenSet.access_token));
+    const id = decodeJwt(tokenSet.id_token);
+    console.log('token set', tokenSet, tokenSet.claims(), id);
+    let user = {
+        type: OIDC_WRAPPED_TOKEN,
+        token,
+        // @TODO Actually this is highly incorrect - we need to get profile details
+        // from the OwlMeans Auth intead ?
+        userId: id.sub,
+        // @TODO Actually we should check is it user or admin or even guest
+        // and set proper role
+        role: AuthRole.Guest,
+        // @TODO It's unclear if it's secure - but it's not used right now
+        scopes: [
+            ...(context.cfg.shortAlias != null ? [context.cfg.shortAlias] : []),
+            ...(context.cfg.alias != null ? [context.cfg.alias] : []),
+            context.cfg.service,
+            cfg.service,
+        ],
+        source: `${cfg.service}/${cfg.clientId}${'id' in cfg ? `/${cfg.id}` : ''}`,
+        // @TODO Actually this is highly incorrect - we need to get profile details
+        // from the OwlMeans Auth intead
+        // profileId: user?.userId,
+        entityId: cfg.entityId,
+        isUser: true,
+        createdAt: new Date(),
+    };
+    console.log('>>>>> ~~~~~ STORE RECORD WITH ID: ', managedId(token));
+    await cache(context).create({ id: managedId(token), payload: tokenSet, client: cfg.clientId }, { ttl: OIDC_AUTH_LIFTETIME / 1000 });
+    const trusted = await trust(context, TRUSTED, context.cfg.alias ?? context.cfg.service);
+    const authorization = await makeEnvelopeModel(OIDC_WRAPPED_TOKEN)
+        .send(user, null).sign(trusted.key, EnvelopeKind.Token);
+    let auth = { token: `${OIDC_WRAPPED_TOKEN.toUpperCase()} ${authorization}` };
+    auth = await wrapper(context).update(auth, true) ?? auth;
+    return auth;
+});
+//# sourceMappingURL=process.js.map

package/build/actions/process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process.js","sourceRoot":"","sources":["../../src/actions/process.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,GAAG,MAAM,KAAK,CAAA;AACrB,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEzD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAChC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAE7C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,YAAY,GAAuB,UAAU,CAAC,KAAK,EAC9D,EAAE,OAAO,EAAE,GAAG,MAAM,EAAyB,EAC7C,GAAG,EACH,EAAE;IACF,MAAM,OAAO,GAAG,aAAa,CAAkB,GAAG,CAAC,CAAA;IAEnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAChC,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IAExD,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACnE,SAAS,EAAE,WAAW,GAAG,GAAG,GAAG,OAAO;QACtC,UAAU,EAAE,IAAI,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;KACpC,CAAC,CAAA;IAGrB,OAAO,CAAC,GAAG,CAAC,6DAA6D,EAAE,GAAG,CAAC,CAAA;IAE/E,IAAI,QAAQ,CAAC,QAAQ,IAAI,IAAI,IAAI,QAAQ,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;QAC/D,MAAM,IAAI,YAAY,EAAE,CAAA;IAC1B,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAA;IACvC,CAAC;IAED,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IAE9C,OAAO,CAAC,GAAG,CACT,iCAAiC,EACjC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,CACjC,CAAA;IAED,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACvC,OAAO,CAAC,GAAG,CACT,WAAW,EACX,QAAQ,EACR,QAAQ,CAAC,MAAM,EAAE,EACjB,EAAE,CACH,CAAA;IAED,IAAI,IAAI,GAAS;QACf,IAAI,EAAE,kBAAkB;QACxB,KAAK;QACL,2EAA2E;QAC3E,kCAAkC;QAClC,MAAM,EAAE,EAAE,CAAC,GAAa;QACxB,mEAAmE;QACnE,sBAAsB;QACtB,IAAI,EAAE,QAAQ,CAAC,KAAK;QACpB,kEAAkE;QAClE,MAAM,EAAE;YACN,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,OAAO;YACnB,GAAG,CAAC,OAAO;SACZ;QACD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1E,2EAA2E;QAC3E,gCAAgC;QAChC,2BAA2B;QAC3B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAA;IAED,OAAO,CAAC,GAAG,CAAC,oCAAoC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;IACnE,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CACzB,EAAE,EAAE,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,EACjE,EAAE,GAAG,EAAE,mBAAmB,GAAG,IAAI,EAAE,CACpC,CAAA;IAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACxG,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAO,kBAAkB,CAAC;SACpE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;IAEzD,IAAI,IAAI,GAAG,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,WAAW,EAAE,IAAI,aAAa,EAAE,EAAE,CAAA;IAE5E,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAA;IAExD,OAAO,IAAI,CAAA;AACb,CAAC,CAAC,CAAA"}

package/build/auth/consts.d.ts

@@ -0,0 +1,2 @@
+export declare const OIDC_ADMIN_CLIENT = "admin-cli";
+//# sourceMappingURL=consts.d.ts.map

package/build/auth/consts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../../src/auth/consts.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,iBAAiB,cAAc,CAAA"}

package/build/auth/consts.js

@@ -0,0 +1,2 @@
+export const OIDC_ADMIN_CLIENT = 'admin-cli';
+//# sourceMappingURL=consts.js.map

package/build/auth/consts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../../src/auth/consts.ts"],"names":[],"mappings":"AACA,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAA"}

package/build/auth/index.d.ts

@@ -0,0 +1,2 @@
+export * from './consts.js';
+//# sourceMappingURL=index.d.ts.map

package/build/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AACA,cAAc,aAAa,CAAA"}

package/build/auth/index.js

@@ -0,0 +1,2 @@
+export * from './consts.js';
+//# sourceMappingURL=index.js.map

package/build/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AACA,cAAc,aAAa,CAAA"}

package/build/auth/plugins/index.d.ts

@@ -0,0 +1,2 @@
+export declare const plugins: Record<string, <C extends import("@owlmeans/server-auth/manager").AppConfig, T extends import("@owlmeans/server-auth/manager").AppContext<C>>(context: T) => import("@owlmeans/server-auth/manager/plugins").AuthPlugin>;
+//# sourceMappingURL=index.d.ts.map

package/build/auth/plugins/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/plugins/index.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,OAAO,0NAAc,CAAA"}

package/build/auth/plugins/index.js

@@ -0,0 +1,6 @@
+import { plugins as authPlugins } from '@owlmeans/server-auth/manager';
+import { oidcClientPlugin } from './oidc-client.js';
+import { OIDC_CLIENT_AUTH } from '@owlmeans/oidc';
+authPlugins[OIDC_CLIENT_AUTH] = oidcClientPlugin;
+export const plugins = authPlugins;
+//# sourceMappingURL=index.js.map

package/build/auth/plugins/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/plugins/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,+BAA+B,CAAA;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEjD,WAAW,CAAC,gBAAgB,CAAC,GAAG,gBAAgE,CAAA;AAEhG,MAAM,CAAC,MAAM,OAAO,GAAG,WAAW,CAAA"}

package/build/auth/plugins/oidc-client.d.ts

@@ -0,0 +1,50 @@
+import type { AuthPlugin } from '@owlmeans/server-auth/manager/plugins';
+import type { Config, Context } from '../../types.js';
+/**
+ * Actually the most of implementation desceibed here is a proprietary one and
+ * located within OwlMeans Auth service implmentation.
+ * We keep it here for easier code navigation and understanding of relying developers
+ * about what's going on but we can't show it.
+ *
+ * @See OwlMeans Auth {AccountLinkingService} interface implementation for more details
+ *
+ * We need to distinguish the following cases:
+ * 1. The user authenticates via owlmenas.org
+ *  1.1. The user authenticated in owlmeans.net via IAM product based account.
+ *     1.1.1. The user do it for the first time
+ *          * We create an account
+ *          * We create and link credentials from jwt to the account (i'm not sure if it's required)
+ *          * We create the profile
+ *          * We create and link credentials from jwt to the profile
+ *     1.1.2. The user do it not for the first time
+ *          * We found the linked profile by jwt
+ *  1.2. The user autehnticated in owlmeans.net via OwlMeans ID
+ *     1.2.1. The user do it for the first time
+ *          * Figure out if the user has OwlMeans ID linked to the authentication from jwt
+ *            (GET /admin/realms/{realm}/users/{id}/federated-identity)
+ *          * We create and link credentials from jwt to the profile
+ *     1.2.2. The user do it not for the first time
+ *          * We found the linked profile by credentials from jwt
+ * 2. The user authenticates via a custom identity provider
+ *  2.1. The user auhtneticated in his identity provier directly
+ *     2.1.1. The user do it for the first time
+ *          * We create a profile (we cant request info about his Owlmeans id)!
+ *          * We create and link credentials from jwt to the profile
+ *          * ! When the user will try to pay for something via this profile
+ *          *   we need to force him to link it to owlmeans.net profile / account.
+ *     2.1.2. The user do it not for the first time
+ *          * We found the linked profile by jwt
+ *  2.2. The user authenticated in his identity provider via OwlMeans ID
+ *     - This case actually shouldn't know anything about it until the profile is linked to the
+ *       owlmeans.net acccount.
+ *
+ *  Generailized
+ *  1. We try to get credentials
+ *  2. If there is no credentials we try to get more info abou the user
+ *  2.1. To do it we get admin client if it's presented for API access
+ *  2.2. If it's presented we get list of identity providers to figure out if there an owlmeans.net id
+ *  3. If there is no owlmeans.net account while the login is going through it - we create one
+ *  4. If there is no profile - we create one and link oidc credentials
+ */
+export declare const oidcClientPlugin: <C extends Config, T extends Context<C>>(context: T) => AuthPlugin;
+//# sourceMappingURL=oidc-client.d.ts.map

package/build/auth/plugins/oidc-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-client.d.ts","sourceRoot":"","sources":["../../../src/auth/plugins/oidc-client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAA;AACvE,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAqB,MAAM,gBAAgB,CAAA;AAgBxE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,KAAG,UAqLrF,CAAA"}

package/build/auth/plugins/oidc-client.js

@@ -0,0 +1,211 @@
+import { assertType } from '@owlmeans/server-auth/manager/plugins';
+import { DEFAULT_ALIAS } from '../../consts.js';
+import { OIDC_CLIENT_AUTH } from '@owlmeans/oidc';
+import { base64urlnopad as base64 } from '@scure/base';
+import { randomBytes } from '@noble/hashes/utils';
+import { sha256 } from '@noble/hashes/sha256';
+import { ALL_SCOPES, AuthenFailed, AuthenPayloadError, AuthManagerError, AuthRole } from '@owlmeans/auth';
+import { AUTHEN_TIMEFRAME } from '@owlmeans/server-auth';
+import { decodeJwt } from 'jose';
+import { KEY_OWL } from '@owlmeans/did';
+import { cache, verifierId } from '../../utils/cache.js';
+import { makeOidcAuthentication } from '../../utils/auth.js';
+// import { URL } from 'url'
+/**
+ * Actually the most of implementation desceibed here is a proprietary one and
+ * located within OwlMeans Auth service implmentation.
+ * We keep it here for easier code navigation and understanding of relying developers
+ * about what's going on but we can't show it.
+ *
+ * @See OwlMeans Auth {AccountLinkingService} interface implementation for more details
+ *
+ * We need to distinguish the following cases:
+ * 1. The user authenticates via owlmenas.org
+ *  1.1. The user authenticated in owlmeans.net via IAM product based account.
+ *     1.1.1. The user do it for the first time
+ *          * We create an account
+ *          * We create and link credentials from jwt to the account (i'm not sure if it's required)
+ *          * We create the profile
+ *          * We create and link credentials from jwt to the profile
+ *     1.1.2. The user do it not for the first time
+ *          * We found the linked profile by jwt
+ *  1.2. The user autehnticated in owlmeans.net via OwlMeans ID
+ *     1.2.1. The user do it for the first time
+ *          * Figure out if the user has OwlMeans ID linked to the authentication from jwt
+ *            (GET /admin/realms/{realm}/users/{id}/federated-identity)
+ *          * We create and link credentials from jwt to the profile
+ *     1.2.2. The user do it not for the first time
+ *          * We found the linked profile by credentials from jwt
+ * 2. The user authenticates via a custom identity provider
+ *  2.1. The user auhtneticated in his identity provier directly
+ *     2.1.1. The user do it for the first time
+ *          * We create a profile (we cant request info about his Owlmeans id)!
+ *          * We create and link credentials from jwt to the profile
+ *          * ! When the user will try to pay for something via this profile
+ *          *   we need to force him to link it to owlmeans.net profile / account.
+ *     2.1.2. The user do it not for the first time
+ *          * We found the linked profile by jwt
+ *  2.2. The user authenticated in his identity provider via OwlMeans ID
+ *     - This case actually shouldn't know anything about it until the profile is linked to the
+ *       owlmeans.net acccount.
+ *
+ *  Generailized
+ *  1. We try to get credentials
+ *  2. If there is no credentials we try to get more info abou the user
+ *  2.1. To do it we get admin client if it's presented for API access
+ *  2.2. If it's presented we get list of identity providers to figure out if there an owlmeans.net id
+ *  3. If there is no owlmeans.net account while the login is going through it - we create one
+ *  4. If there is no profile - we create one and link oidc credentials
+ */
+export const oidcClientPlugin = (context) => {
+    const authenticate = makeOidcAuthentication(context);
+    const plugin = {
+        type: OIDC_CLIENT_AUTH,
+        init: async (request) => {
+            assertType(request.type, plugin);
+            if (context.cfg.oidc.restrictedProviders === false) {
+                throw new AuthManagerError('oidc.internal');
+            }
+            // @TODO Actually think about how to make oidc service configurable
+            const oidc = context.service(DEFAULT_ALIAS);
+            let entityId = request.entityId ?? oidc.getDefault();
+            if (entityId == null) {
+                throw new AuthenPayloadError('client');
+            }
+            if (context.cfg.oidc.restrictedProviders === true && oidc.getDefault() !== entityId) {
+                throw new AuthenPayloadError('client');
+            }
+            if (Array.isArray(context.cfg.oidc.restrictedProviders)
+                && !context.cfg.oidc.restrictedProviders.includes(entityId)) {
+                throw new AuthenPayloadError('client');
+            }
+            const verifier = base64.encode(randomBytes(32));
+            const challenge = base64.encode(sha256(verifier));
+            console.log("\n\n We create verifierID (2): ", verifierId(challenge), verifier, " with client: ", entityId, "\n\n");
+            await cache(context).create({
+                id: verifierId(challenge),
+                verifier,
+                client: entityId
+            }, { ttl: AUTHEN_TIMEFRAME / 1000 });
+            if (request.source == null) {
+                throw new AuthenPayloadError('redirect-uri');
+            }
+            // const redirectUrl = new URL(request.source)
+            // for (let key of redirectUrl.searchParams.keys()) {
+            //   redirectUrl.searchParams.delete(key)
+            // }
+            const client = await oidc.getClient(entityId);
+            const cfg = client.getConfig();
+            const url = client.makeAuthUrl({
+                scope: `openid profile email ${cfg?.extraScopes ?? ''}`,
+                code_challenge: challenge,
+                code_challenge_method: 'S256',
+                redirect_uri: request.source,
+            });
+            return { challenge: url };
+        },
+        authenticate: async (credential) => {
+            console.log('000000000000000');
+            const [cfg, tokenSet, exchangeToken] = await authenticate(credential);
+            if (tokenSet.id_token == null || tokenSet.access_token == null) {
+                throw new AuthenFailed();
+            }
+            const oidc = context.service(DEFAULT_ALIAS);
+            const jwt = decodeJwt(tokenSet.id_token);
+            if (jwt.sub == null) {
+                throw new AuthenFailed();
+            }
+            const store = oidc.accountLinking();
+            if (store == null) {
+                throw new AuthManagerError('oidc.account.store');
+            }
+            if (cfg.service == null) {
+                throw new AuthManagerError('oidc.service');
+            }
+            let profile = await store.getLinkedProfile({
+                type: OIDC_CLIENT_AUTH,
+                service: cfg.service,
+                clientId: cfg.clientId,
+                userId: jwt.sub
+            });
+            // @TODO It's likely the case when we are talking about owlmeans.net
+            // but some addtional checks need to be done.
+            // The problem is that we will make the sold identity providers also
+            // managable, so this condition isn't enough to cover described cases.
+            let details;
+            if (cfg.apiClientId != null) {
+                console.log(1);
+                const apiClient = await oidc.getClient(cfg.apiClientId);
+                const adminTokens = await apiClient.grantWithCredentials();
+                if (adminTokens.access_token == null) {
+                    throw new AuthManagerError('iam.admin');
+                }
+                const api = oidc.providerApi();
+                if (api == null) {
+                    // @TODO And what if don't? Probably we can still do something here
+                    throw new AuthManagerError('iam.admin.api');
+                }
+                details = await api.getUserDetails(adminTokens.access_token, jwt.sub);
+            }
+            else {
+                // @TODO We need to do something here if it's an external identity provider
+                // and we couldn't get any addiontal info
+                throw new AuthManagerError('implemented');
+            }
+            if (
+            // Create profile
+            profile == null
+                // Fix profile if it's not linked properly to OwlMeans Id
+                || (details.did != null && details.isOwlMeansId && !profile.profileId?.startsWith(KEY_OWL + ':'))) {
+                console.log(2);
+                details.isOwlMeansId ??= cfg.entityId != null && cfg.entityId === context.cfg.defaultEntityId;
+                if (details.isOwlMeansId && context.cfg.defaultEntityId == null) {
+                    throw new AuthManagerError('iam.governance');
+                }
+                details.entityId = details.isOwlMeansId ? context.cfg.defaultEntityId : cfg.entityId;
+                if (details.entityId == null) {
+                    // @TODO We doesn't support clients and entites that aren't bound to an organization
+                    // right now. Probably we should. Probably there are some cases when we have to.
+                    throw new AuthManagerError('iam.entity');
+                }
+                console.log('Supper attention ~%~: ', details.entityId, cfg.entityId, context.cfg.defaultEntityId);
+                // We relink existing profile only if it's not yet did bound
+                // and the orgnaization is owlmeans.net
+                if (profile == null || (details.entityId === context.cfg.defaultEntityId
+                    // @TODO Figure out more flexible solution. 
+                    // This check prevent a potenatilly vulnarability when a user can
+                    // connect its own idp to his arbitrary IAM system that is connected as 
+                    // idp to our IAM system, and create an internal idp link that
+                    // uses owlmeans did as user id of another user to link an arbitrary
+                    // profile to his or her owlmeans user account and take adavantage of cross login.
+                    // Probably such cross login accross owner like profiles should be prevented
+                    // without additional authentication. But for now, this check guaranty that it works
+                    // only with owlmeans.net idp that is managed by ours. 
+                    && details.entityId === cfg.entityId)) {
+                    console.log(3, details);
+                    profile = await store.linkProfile({
+                        ...details,
+                        service: cfg.service,
+                        clientId: cfg.clientId,
+                        type: OIDC_CLIENT_AUTH,
+                    }, {
+                        username: jwt.preferred_username ?? details.username,
+                        // @TODO It's important to keep it this way to make registration disabling working
+                        force: false
+                    });
+                }
+            }
+            console.log(4);
+            credential.scopes = [ALL_SCOPES];
+            credential.source = cfg.clientId;
+            credential.role = AuthRole.User;
+            credential.type = OIDC_CLIENT_AUTH;
+            credential.userId = profile.userId;
+            credential.profileId = profile.profileId;
+            credential.entityId = profile.entityId;
+            return { token: exchangeToken };
+        }
+    };
+    return plugin;
+};
+//# sourceMappingURL=oidc-client.js.map

package/build/auth/plugins/oidc-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-client.js","sourceRoot":"","sources":["../../../src/auth/plugins/oidc-client.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAA;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEjD,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzG,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAC5D,4BAA4B;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAyC,OAAU,EAAc,EAAE;IACjG,MAAM,YAAY,GAAG,sBAAsB,CAAO,OAAO,CAAC,CAAA;IAE1D,MAAM,MAAM,GAAe;QACzB,IAAI,EAAE,gBAAgB;QAEtB,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACpB,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAEhC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,KAAK,KAAK,EAAE,CAAC;gBACnD,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAA;YAC7C,CAAC;YAED,mEAAmE;YACnE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;YAC9D,IAAI,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAA;YAEpD,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YAED,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACpF,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC;mBAClD,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;YAEjD,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;YAEnH,MAAM,KAAK,CAAO,OAAO,CAAC,CAAC,MAAM,CAAC;gBAChC,EAAE,EAAE,UAAU,CAAC,SAAS,CAAC;gBACzB,QAAQ;gBACR,MAAM,EAAE,QAAQ;aACjB,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;YAEpC,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAA;YAC9C,CAAC;YAED,8CAA8C;YAE9C,qDAAqD;YACrD,yCAAyC;YACzC,IAAI;YAEJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;YAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC;gBAC7B,KAAK,EAAE,wBAAwB,GAAG,EAAE,WAAW,IAAI,EAAE,EAAE;gBACvD,cAAc,EAAE,SAAS;gBACzB,qBAAqB,EAAE,MAAM;gBAC7B,YAAY,EAAE,OAAO,CAAC,MAAM;aAC7B,CAAC,CAAA;YAEF,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAA;QAC3B,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;YAC9B,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,aAAa,CAAC,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,CAAA;YAErE,IAAI,QAAQ,CAAC,QAAQ,IAAI,IAAI,IAAI,QAAQ,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;gBAC/D,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;YAC9D,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAExC,IAAI,GAAG,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;gBACpB,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAA;YACnC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAA;YAClD,CAAC;YAED,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBACxB,MAAM,IAAI,gBAAgB,CAAC,cAAc,CAAC,CAAA;YAC5C,CAAC;YAED,IAAI,OAAO,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC;gBACzC,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,MAAM,EAAE,GAAG,CAAC,GAAG;aACiB,CAAC,CAAA;YAEnC,oEAAoE;YACpE,6CAA6C;YAC7C,oEAAoE;YACpE,sEAAsE;YACtE,IAAI,OAAwB,CAAA;YAC5B,IAAI,GAAG,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBACd,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;gBACvD,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,oBAAoB,EAAE,CAAA;gBAC1D,IAAI,WAAW,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;oBACrC,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAA;gBACzC,CAAC;gBACD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;gBAC9B,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;oBAChB,mEAAmE;oBACnE,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAA;gBAC7C,CAAC;gBACD,OAAO,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,CAAA;YACvE,CAAC;iBAAM,CAAC;gBACN,2EAA2E;gBAC3E,yCAAyC;gBACzC,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAA;YAC3C,CAAC;YAED;YACE,iBAAiB;YACjB,OAAO,IAAI,IAAI;gBACf,yDAAyD;mBACtD,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC,EACjG,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBACd,OAAO,CAAC,YAAY,KAAK,GAAG,CAAC,QAAQ,IAAI,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,GAAG,CAAC,eAAe,CAAA;gBAC7F,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;oBAChE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAA;gBAC9C,CAAC;gBACD,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAA;gBACpF,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;oBAC7B,oFAAoF;oBACpF,gFAAgF;oBAChF,MAAM,IAAI,gBAAgB,CAAC,YAAY,CAAC,CAAA;gBAC1C,CAAC;gBAGD,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;gBAElG,4DAA4D;gBAC5D,uCAAuC;gBACvC,IAAI,OAAO,IAAI,IAAI,IAAI,CACrB,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,GAAG,CAAC,eAAe;oBAChD,4CAA4C;oBAC5C,iEAAiE;oBACjE,wEAAwE;oBACxE,8DAA8D;oBAC9D,oEAAoE;oBACpE,kFAAkF;oBAClF,4EAA4E;oBAC5E,oFAAoF;oBACpF,uDAAuD;uBACpD,OAAO,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,CACrC,EAAE,CAAC;oBACF,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;oBACvB,OAAO,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC;wBAChC,GAAG,OAAO;wBACV,OAAO,EAAE,GAAG,CAAC,OAAO;wBACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;wBACtB,IAAI,EAAE,gBAAgB;qBACvB,EAAE;wBACD,QAAQ,EAAE,GAAG,CAAC,kBAA4B,IAAI,OAAO,CAAC,QAAQ;wBAC9D,kFAAkF;wBAClF,KAAK,EAAE,KAAK;qBACb,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YAEd,UAAU,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,CAAA;YAChC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAA;YAChC,UAAU,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;YAC/B,UAAU,CAAC,IAAI,GAAG,gBAAgB,CAAA;YAClC,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;YAClC,UAAU,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;YACxC,UAAU,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;YAEtC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAA;QACjC,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}

package/build/auth/plugins/types.d.ts

@@ -0,0 +1 @@
+//# sourceMappingURL=types.d.ts.map

package/build/auth/plugins/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/auth/plugins/types.ts"],"names":[],"mappings":""}

package/build/auth/plugins/types.js

@@ -0,0 +1,2 @@
+"use strict";
+//# sourceMappingURL=types.js.map

package/build/auth/plugins/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/auth/plugins/types.ts"],"names":[],"mappings":""}

package/build/consts.d.ts

@@ -0,0 +1,20 @@
+export declare const DEFAULT_ALIAS = "oidc-client";
+export declare const DEF_OIDC_ACCOUNT_LINKING = "oidc-consumer-account-linking";
+export declare const DEF_OIDC_PROVIDER_API = "oidc-consumer-provider-api";
+export declare const authService: {
+    provider: {
+        list: string;
+    };
+    auth: {
+        update: string;
+    };
+};
+export declare const OIDC_TOKEN_STORE = "oidc-token-store";
+/**
+ * @TODO Actually these ones should be constants and should be linked to
+ * configuration on OIDC provider side
+ */
+export declare const PROVIDER_CACHE_TTL: number;
+export declare const OIDC_AUTH_LIFTETIME: number;
+export declare const OIDC_WRAP_FRESHNESS: number;
+//# sourceMappingURL=consts.d.ts.map

package/build/consts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,aAAa,gBAAgB,CAAA;AAE1C,eAAO,MAAM,wBAAwB,kCAAkC,CAAA;AAEvE,eAAO,MAAM,qBAAqB,+BAA+B,CAAA;AAEjE,eAAO,MAAM,WAAW;;;;;;;CAOvB,CAAA;AAED,eAAO,MAAM,gBAAgB,qBAAqB,CAAA;AAClD;;;GAGG;AACH,eAAO,MAAM,kBAAkB,QAAsB,CAAA;AAErD,eAAO,MAAM,mBAAmB,QAAmB,CAAA;AAEnD,eAAO,MAAM,mBAAmB,QAAsB,CAAA"}

package/build/consts.js

@@ -0,0 +1,20 @@
+export const DEFAULT_ALIAS = 'oidc-client';
+export const DEF_OIDC_ACCOUNT_LINKING = 'oidc-consumer-account-linking';
+export const DEF_OIDC_PROVIDER_API = 'oidc-consumer-provider-api';
+export const authService = {
+    provider: {
+        list: 'external-auth:provider:list'
+    },
+    auth: {
+        update: 'external-auth:auth:update'
+    }
+};
+export const OIDC_TOKEN_STORE = 'oidc-token-store';
+/**
+ * @TODO Actually these ones should be constants and should be linked to
+ * configuration on OIDC provider side
+ */
+export const PROVIDER_CACHE_TTL = (5 * 60 - 1) * 1000;
+export const OIDC_AUTH_LIFTETIME = 24 * 3600 * 1000;
+export const OIDC_WRAP_FRESHNESS = (5 * 60 - 1) * 1000;
+//# sourceMappingURL=consts.js.map

package/build/consts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAA;AAE1C,MAAM,CAAC,MAAM,wBAAwB,GAAG,+BAA+B,CAAA;AAEvE,MAAM,CAAC,MAAM,qBAAqB,GAAG,4BAA4B,CAAA;AAEjE,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,QAAQ,EAAE;QACR,IAAI,EAAE,6BAA6B;KACpC;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,2BAA2B;KACpC;CACF,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAA;AAClD;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,IAAI,CAAA;AAErD,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAEnD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,IAAI,CAAA"}

package/build/gate.d.ts

@@ -0,0 +1,3 @@
+import type { GateService } from '@owlmeans/module';
+export declare const makeOidcGate: (alias?: string) => GateService;
+//# sourceMappingURL=gate.d.ts.map

package/build/gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAMnD,eAAO,MAAM,YAAY,WAAW,MAAM,KAAe,WAqBxD,CAAA"}

package/build/gate.js

@@ -0,0 +1,22 @@
+import { createLazyService } from '@owlmeans/context';
+import { OIDC_GATE } from '@owlmeans/oidc';
+import { AuthForbidden } from '@owlmeans/auth';
+import { createGateModel } from './model/gate.js';
+export const makeOidcGate = (alias = OIDC_GATE) => {
+    const service = createLazyService(alias, {
+        assert: async (req, _, params) => {
+            await service.ready();
+            const ctx = service.assertCtx();
+            if (req.auth == null) {
+                throw new AuthForbidden('auth');
+            }
+            const model = createGateModel(ctx);
+            const permissions = await model.loadPermissions(req.auth, params);
+            if (permissions.length < 1) {
+                throw new AuthForbidden('permission');
+            }
+        }
+    });
+    return service;
+};
+//# sourceMappingURL=gate.js.map

package/build/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAErD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1C,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAEjD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,QAAgB,SAAS,EAAe,EAAE;IACrE,MAAM,OAAO,GAAgB,iBAAiB,CAAc,KAAK,EAAE;QACjE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE;YAC/B,MAAM,OAAO,CAAC,KAAK,EAAE,CAAA;YACrB,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YAEhD,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,CAAA;YACjC,CAAC;YAED,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;YAElC,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAEjE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,aAAa,CAAC,YAAY,CAAC,CAAA;YACvC,CAAC;QACH,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/guard.d.ts

@@ -0,0 +1,6 @@
+import type { OidcGuardOptions } from '@owlmeans/oidc';
+import type { Config, Context } from './types.js';
+import type { CommonModule } from '@owlmeans/module';
+export declare const appendOidcGuard: <C extends Config, T extends Context<C>>(context: T, opts?: OidcGuardOptions) => T;
+export declare const setupOidcGuard: (modules: CommonModule[], coguards?: string | string[]) => void;
+//# sourceMappingURL=guard.d.ts.map

package/build/guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AASpD,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WAC3D,CAAC,SAAS,gBAAgB,MAKpC,CAAA;AAED,eAAO,MAAM,cAAc,YAAa,YAAY,EAAE,aAAa,MAAM,GAAG,MAAM,EAAE,SAKnF,CAAA"}

package/build/guard.js

@@ -0,0 +1,13 @@
+import { appendOidcGuard as appendBasicOidcGuard, setupOidcGuard as setupBasicOidcGuard, DISPATCHER_OIDC, DISPATCHER_OIDC_INIT } from '@owlmeans/oidc';
+import { elevate } from '@owlmeans/server-module';
+import * as actions from './actions/index.js';
+export const appendOidcGuard = (context, opts) => {
+    const ctx = appendBasicOidcGuard(context, opts);
+    return ctx;
+};
+export const setupOidcGuard = (modules, coguards) => {
+    setupBasicOidcGuard(modules, coguards);
+    elevate(modules, DISPATCHER_OIDC_INIT, actions.init);
+    elevate(modules, DISPATCHER_OIDC, actions.authenticate);
+};
+//# sourceMappingURL=guard.js.map

package/build/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,eAAe,IAAI,oBAAoB,EACvC,cAAc,IAAI,mBAAmB,EACrC,eAAe,EAAE,oBAAoB,EACtC,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAA;AACjD,OAAO,KAAK,OAAO,MAAM,oBAAoB,CAAA;AAE7C,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,OAAU,EAAE,IAAuB,EACnC,EAAE;IACF,MAAM,GAAG,GAAG,oBAAoB,CAAO,OAAO,EAAE,IAAI,CAAC,CAAA;IAErD,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAuB,EAAE,QAA4B,EAAE,EAAE;IACtF,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IAEtC,OAAO,CAAC,OAAO,EAAE,oBAAoB,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IACpD,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;AACzD,CAAC,CAAA"}

package/build/index.d.ts

@@ -0,0 +1,8 @@
+export type * from './types.js';
+export * from './consts.js';
+export * from './service.js';
+export * from './guard.js';
+export * from './gate.js';
+export * from './modules.js';
+export * from './wrapper.js';
+//# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA"}

package/build/index.js

@@ -0,0 +1,7 @@
+export * from './consts.js';
+export * from './service.js';
+export * from './guard.js';
+export * from './gate.js';
+export * from './modules.js';
+export * from './wrapper.js';
+//# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA"}

package/build/model/consts.d.ts

@@ -0,0 +1,6 @@
+export declare enum ResponseMode {
+    Permissions = "permissions",
+    Token = "token",
+    Decision = "decision"
+}
+//# sourceMappingURL=consts.d.ts.map

package/build/model/consts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../../src/model/consts.ts"],"names":[],"mappings":"AACA,oBAAY,YAAY;IACtB,WAAW,gBAAgB;IAC3B,KAAK,UAAU;IACf,QAAQ,aAAa;CACtB"}

package/build/model/consts.js

@@ -0,0 +1,7 @@
+export var ResponseMode;
+(function (ResponseMode) {
+    ResponseMode["Permissions"] = "permissions";
+    ResponseMode["Token"] = "token";
+    ResponseMode["Decision"] = "decision";
+})(ResponseMode || (ResponseMode = {}));
+//# sourceMappingURL=consts.js.map

package/build/model/consts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../../src/model/consts.ts"],"names":[],"mappings":"AACA,MAAM,CAAN,IAAY,YAIX;AAJD,WAAY,YAAY;IACtB,2CAA2B,CAAA;IAC3B,+BAAe,CAAA;IACf,qCAAqB,CAAA;AACvB,CAAC,EAJW,YAAY,KAAZ,YAAY,QAIvB"}

package/build/model/gate.d.ts

@@ -0,0 +1,4 @@
+import type { Config, Context } from '../types.js';
+import type { GateModel } from './types.js';
+export declare const createGateModel: <C extends Config, T extends Context<C>>(ctx: T) => GateModel;
+//# sourceMappingURL=gate.d.ts.map

package/build/model/gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/model/gate.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAqB,MAAM,aAAa,CAAA;AAErE,OAAO,KAAK,EAAE,SAAS,EAAyC,MAAM,YAAY,CAAA;AAKlF,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAG,SAuHhF,CAAA"}