@owlmeans/server-oidc-rp 0.1.0

package/build/utils/wrapped.js

@@ -0,0 +1,3 @@
+import { WRAPPED_OIDC } from '@owlmeans/oidc';
+export const wrapper = (context) => context.service(WRAPPED_OIDC);
+//# sourceMappingURL=wrapped.js.map

package/build/utils/wrapped.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrapped.js","sourceRoot":"","sources":["../../src/utils/wrapped.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAG7C,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAsB,EAAE,CAC9D,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA"}

package/build/wrapper.d.ts

@@ -0,0 +1,3 @@
+import type { WrappedOIDCService } from '@owlmeans/oidc';
+export declare const makeOidcWrappingService: () => WrappedOIDCService;
+//# sourceMappingURL=wrapper.d.ts.map

package/build/wrapper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrapper.d.ts","sourceRoot":"","sources":["../src/wrapper.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAmB,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAWzE,eAAO,MAAM,uBAAuB,QAAO,kBA4E1C,CAAA"}

package/build/wrapper.js

@@ -0,0 +1,75 @@
+import { AuthenFailed, AuthorizationError, AuthRole } from '@owlmeans/auth';
+import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope';
+import { createService } from '@owlmeans/context';
+import { OIDC_WRAPPED_TOKEN, WRAPPED_OIDC } from '@owlmeans/oidc';
+import { cache, managedId } from './utils/cache.js';
+import { authService, OIDC_AUTH_LIFTETIME, OIDC_WRAP_FRESHNESS } from './consts.js';
+import days from 'dayjs';
+import { TRUSTED } from '@owlmeans/config';
+import { AUTH_SRV_KEY } from '@owlmeans/server-auth';
+import { trust } from '@owlmeans/auth-common/utils';
+export const makeOidcWrappingService = () => {
+    const service = createService(WRAPPED_OIDC, {
+        update: async (token, thr) => {
+            const ctx = service.assertCtx();
+            token = typeof token === 'string' ? token : token?.token;
+            if (token == null) {
+                throw new AuthorizationError('token');
+            }
+            const [, authentication] = token.split(' ');
+            const envelope = makeEnvelopeModel(authentication, EnvelopeKind.Token);
+            const user = envelope.message();
+            try {
+                const record = await cache(ctx).get(managedId(user.token));
+                if (record == null || record.payload == null) {
+                    throw new AuthorizationError('record');
+                }
+                if (record.validated != null && days(record.validated)
+                    .add(OIDC_WRAP_FRESHNESS, 'milliseconds').isAfter()) {
+                    return { token };
+                }
+                record.validated = new Date();
+                const [update] = await ctx.module(authService.auth.update)
+                    .call({ body: { token, tokenSet: record.payload } });
+                const updateEnvelope = makeEnvelopeModel(update.token, EnvelopeKind.Token);
+                const authManager = await trust(ctx, TRUSTED, AUTH_SRV_KEY);
+                if (!await updateEnvelope.verify(authManager.key)) {
+                    throw new AuthenFailed();
+                }
+                const updatedAuth = updateEnvelope.message();
+                const updatedUser = {
+                    ...user,
+                    role: updatedAuth.role ?? AuthRole.Guest,
+                    userId: updatedAuth.userId ?? user.userId,
+                    profileId: updatedAuth.profileId,
+                    entityId: updatedAuth.entityId ?? user.entityId,
+                    createdAt: new Date()
+                };
+                if (updatedAuth.challenge !== user.token) {
+                    await cache(ctx).delete(record);
+                    updatedUser.token = updatedAuth.challenge;
+                    record.id = managedId(updatedUser.token);
+                }
+                const trusted = await trust(ctx, TRUSTED, ctx.cfg.alias ?? ctx.cfg.service);
+                const authorization = await makeEnvelopeModel(OIDC_WRAPPED_TOKEN)
+                    .send(updatedUser, null).sign(trusted.key, EnvelopeKind.Token);
+                record.payload = update.tokenSet;
+                await cache(ctx).save(record, { ttl: OIDC_AUTH_LIFTETIME / 1000 });
+                return { token: `${OIDC_WRAPPED_TOKEN.toUpperCase()} ${authorization}` };
+            }
+            catch (err) {
+                console.error(err);
+                await cache(ctx).delete(managedId(user.token));
+                if (thr) {
+                    if (err instanceof AuthorizationError) {
+                        throw err;
+                    }
+                    throw new AuthorizationError('unknown');
+                }
+            }
+            return null;
+        }
+    });
+    return service;
+};
+//# sourceMappingURL=wrapper.js.map

package/build/wrapper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrapper.js","sourceRoot":"","sources":["../src/wrapper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAE3E,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACjE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAEnD,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACnF,OAAO,IAAI,MAAM,OAAO,CAAA;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AAEnD,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAuB,EAAE;IAC9D,MAAM,OAAO,GAAG,aAAa,CAAqB,YAAY,EAAE;QAC9D,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YAChD,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAA;YACxD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACvC,CAAC;YACD,MAAM,CAAE,AAAD,EAAG,cAAc,CAAE,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC7C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,cAAc,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAC5E,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YAE/B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;gBAC1D,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;oBAC7C,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;gBACxC,CAAC;gBAED,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;qBACnD,GAAG,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;oBACtD,OAAO,EAAE,KAAK,EAAE,CAAA;gBAClB,CAAC;gBAED,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAA;gBAE7B,MAAM,CAAE,MAAM,CAAE,GAAG,MAAM,GAAG,CAAC,MAAM,CAAgC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;qBACxF,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;gBAEtD,MAAM,cAAc,GAAG,iBAAiB,CAAkB,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;gBAC3F,MAAM,WAAW,GAAG,MAAM,KAAK,CAAkB,GAAG,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;gBAC5E,IAAI,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;oBAClD,MAAM,IAAI,YAAY,EAAE,CAAA;gBAC1B,CAAC;gBAED,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,EAAE,CAAA;gBAE5C,MAAM,WAAW,GAAS;oBACxB,GAAG,IAAI;oBACP,IAAI,EAAE,WAAW,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK;oBACxC,MAAM,EAAE,WAAW,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM;oBACzC,SAAS,EAAE,WAAW,CAAC,SAAS;oBAChC,QAAQ,EAAE,WAAW,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;oBAC/C,SAAS,EAAE,IAAI,IAAI,EAAE;iBACtB,CAAA;gBAED,IAAI,WAAW,CAAC,SAAS,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;oBACzC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;oBAC/B,WAAW,CAAC,KAAK,GAAG,WAAW,CAAC,SAAS,CAAA;oBACzC,MAAM,CAAC,EAAE,GAAG,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;gBAC1C,CAAC;gBAGD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;gBAC5F,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAO,kBAAkB,CAAC;qBACpE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;gBAEhE,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,QAA8B,CAAA;gBAEtD,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,mBAAmB,GAAG,IAAI,EAAE,CAAC,CAAA;gBAElE,OAAO,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,WAAW,EAAE,IAAI,aAAa,EAAE,EAAE,CAAA;YAC1E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAClB,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;gBAC9C,IAAI,GAAG,EAAE,CAAC;oBACR,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;wBACtC,MAAM,GAAG,CAAA;oBACX,CAAC;oBACD,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;gBACzC,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/package.json

@@ -0,0 +1,71 @@
+{
+  "name": "@owlmeans/server-oidc-rp",
+  "version": "0.1.0",
+  "type": "module",
+  "scripts": {
+    "build": "tsc -b",
+    "dev": "sleep 312 && nodemon -e ts,tsx,json --watch src --exec \"tsc -p ./tsconfig.json\"",
+    "watch": "tsc -b -w --preserveWatchOutput --pretty"
+  },
+  "main": "build/index.js",
+  "module": "build/index.js",
+  "types": "build/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./build/index.js",
+      "require": "./build/index.js",
+      "default": "./build/index.js",
+      "module": "./build/index.js",
+      "types": "./build/index.d.ts"
+    },
+    "./auth/plugins": {
+      "import": "./build/auth/plugins/index.js",
+      "require": "./build/auth/plugins/index.js",
+      "default": "./build/auth/plugins/index.js",
+      "module": "./build/auth/plugins/index.js",
+      "types": "./build/auth/plugins/index.d.ts"
+    },
+    "./auth": {
+      "import": "./build/auth/index.js",
+      "require": "./build/auth/index.js",
+      "default": "./build/auth/index.js",
+      "module": "./build/auth/index.js",
+      "types": "./build/auth/index.d.ts"
+    }
+  },
+  "devDependencies": {
+    "@types/node": "^22.7.8",
+    "nodemon": "^3.1.7",
+    "npm-check": "^6.0.1",
+    "typescript": "^5.6.3"
+  },
+  "dependencies": {
+    "@noble/hashes": "^1.5.0",
+    "@owlmeans/auth": "^0.1.0",
+    "@owlmeans/auth-common": "^0.1.0",
+    "@owlmeans/basic-envelope": "^0.1.0",
+    "@owlmeans/client-module": "^0.1.0",
+    "@owlmeans/config": "^0.1.0",
+    "@owlmeans/context": "^0.1.0",
+    "@owlmeans/did": "^0.1.0",
+    "@owlmeans/module": "^0.1.0",
+    "@owlmeans/oidc": "^0.1.0",
+    "@owlmeans/resource": "^0.1.0",
+    "@owlmeans/route": "^0.1.0",
+    "@owlmeans/server-api": "^0.1.0",
+    "@owlmeans/server-auth": "^0.1.0",
+    "@owlmeans/server-context": "^0.1.0",
+    "@owlmeans/server-module": "^0.1.0",
+    "@scure/base": "^1.1.9",
+    "dayjs": "^1.11.13",
+    "jose": "^5.9.6",
+    "openid-client": "^6.1.1"
+  },
+  "peerDependencies": {
+    "ajv": "*"
+  },
+  "private": false,
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/actions/index.ts

@@ -0,0 +1,3 @@
+
+export * from './process.js'
+export * from './init.js'

package/src/actions/init.ts

@@ -0,0 +1,90 @@
+import type { RefedModuleHandler } from '@owlmeans/server-module'
+import { handleBody } from '@owlmeans/server-api'
+import type { OIDCAuthInitParams, OidcProviderDescriptor } from '@owlmeans/oidc'
+import { AuthenPayloadError, AuthUnknown, DISPATCHER } from '@owlmeans/auth'
+import { assertContext } from '@owlmeans/context'
+import type { Config, Context, OidcClientAdapter, OidcClientService } from '../types.js'
+import type { ClientModule } from '@owlmeans/client-module'
+import { authService, DEFAULT_ALIAS } from '../consts.js'
+// import {  PROVIDER_CACHE_TTL } from '../consts.js'
+// import type { Client } from 'openid-client'
+
+import { base64urlnopad as base64 } from '@scure/base'
+import { randomBytes } from '@noble/hashes/utils'
+import { sha256 } from '@noble/hashes/sha256'
+import { cache, verifierId } from '../utils/cache.js'
+import { AUTHEN_TIMEFRAME } from '@owlmeans/server-auth'
+
+export const init: RefedModuleHandler = handleBody(async (body: OIDCAuthInitParams, ctx) => {
+  if (body.entity == null) {
+    throw new AuthenPayloadError('entity')
+  }
+
+  const entityId = body.entity
+
+  const context = assertContext<Config, Context>(ctx)
+  const oidc = context.service<OidcClientService>(DEFAULT_ALIAS)
+
+  let client: OidcClientAdapter
+  // if (!oidc.hasProvider({ entityId })) {
+  /**
+   * @TODO We need to move it to some remote resource.
+   * And make oidc service itself use such a resource to get required client.
+   */
+  const [providers] = await context.module<ClientModule<OidcProviderDescriptor[]>>(
+    authService.provider.list
+  ).call({
+    params: { service: context.cfg.alias ?? context.cfg.service },
+    query: { entityId }
+  })
+
+  if (providers.length < 1) {
+    throw new AuthUnknown()
+  }
+
+  console.log("\n\n ************* \n Providers we get from remote:", providers)
+
+  const provider = providers.find(p => p.def === true) ?? providers.shift()
+
+  console.log("\n\nProvider we choose:", provider)
+  console.log( "************* \n\n")
+
+  if (provider == null) {
+    throw new AuthUnknown()
+  }
+  oidc.registerTemporaryProvider(provider)
+  client = await oidc.getClient({ clientId: provider.clientId, entityId })
+  // Cache provider for a while - we dont actually need to clean it up
+  // setTimeout(() => provider && oidc.unregisterTemporaryProvider(provider), PROVIDER_CACHE_TTL)
+  // } else {
+  //   client = await oidc.getClient({
+  //     entityId, clientId: oidc.entityToClientId({ entityId })
+  //   })
+  // }
+
+  const verifier = base64.encode(randomBytes(32))
+  const challenge = base64.encode(sha256(verifier))
+
+  console.log("\n\n We create verifierID: ", verifierId(challenge), verifier, " with client: ", client.getClientId(), "\n\n")
+
+  await cache(context).create({
+    id: verifierId(challenge), 
+    verifier, 
+    client: client.getClientId(),
+    entityId,
+  }, { ttl: AUTHEN_TIMEFRAME / 1000 })
+
+  const [dispatcherUrl] = await context.module<ClientModule<string>>(DISPATCHER).call()
+
+  const cfg = client.getConfig()
+  const url = client.makeAuthUrl({
+    scope: `openid profile email ${cfg?.extraScopes ?? ''}`,
+    code_challenge: challenge,
+    code_challenge_method: 'S256',
+    redirect_uri: dispatcherUrl,
+  })
+
+  console.log('Url we got', url)
+
+  return url
+})

package/src/actions/process.ts

@@ -0,0 +1,113 @@
+import type { RefedModuleHandler } from '@owlmeans/server-module'
+import { handleBody } from '@owlmeans/server-api'
+import type { OIDCClientAuthPayload } from '@owlmeans/oidc'
+import { OIDC_WRAPPED_TOKEN } from '@owlmeans/oidc'
+import { assertContext } from '@owlmeans/context'
+import type { Config, Context } from '../types.js'
+import Url from 'url'
+import { makeOidcAuthentication } from '../utils/auth.js'
+import type { Auth, AuthCredentials } from '@owlmeans/auth'
+import { AuthenFailed, AuthManagerError, AuthRole } from '@owlmeans/auth'
+import { decodeJwt } from 'jose'
+import { cache, exchangeId, managedId } from '../utils/cache.js'
+import { trust } from '@owlmeans/auth-common/utils'
+import { TRUSTED } from '@owlmeans/config'
+import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
+import { OIDC_AUTH_LIFTETIME } from '../consts.js'
+import { wrapper } from '../utils/wrapped.js'
+
+/**
+ * Authentication method links together OIDC and OwlMeans auth.
+ * 1. We authenticate OIDC redirect back params with the classic OIDC client.
+ * 2. We temporary store on the server refresh token and OIDC token.
+ * 3. We supply the client with perked OwlMeans Auth token that in fact
+ * is the set of OIDC tokens (except refresh token - we keep it here?)
+ * 4. We used it in a centralized way to check permissions over OwlMeans Auth
+ * central service irrespectively is it OIDC or our custom permissions engine
+ * (this is useful to properly support paid accounts and bridge the underlying
+ * IAM system implemetation - abstract from it).
+ * 5. The method ends with production of OwlMeans authorization token.
+ * 
+ * ! There is also token renewal mechanism that should be implemented nearby.
+ */
+export const authenticate: RefedModuleHandler = handleBody(async (
+  { authUrl, ...params }: OIDCClientAuthPayload,
+  ctx
+) => {
+  const context = assertContext<Config, Context>(ctx)
+
+  const url = new Url.URL(authUrl)
+  const redirectUrl = url.searchParams.get('redirect_uri')
+
+  const [cfg, tokenSet, token] = await makeOidcAuthentication(context)({
+    challenge: redirectUrl + ':' + authUrl,
+    credential: new Url.URLSearchParams(params).toString()
+  } as AuthCredentials)
+
+
+  console.log("\n\n ============ \n Config we got for real autentioncation", cfg)
+
+  if (tokenSet.id_token == null || tokenSet.access_token == null) {
+    throw new AuthenFailed()
+  }
+
+  if (cfg.service == null) {
+    throw new AuthManagerError('service')
+  }
+
+  await cache(context).delete(exchangeId(token))
+
+  console.log(
+    'List provided user permisssions',
+    decodeJwt(tokenSet.access_token)
+  )
+
+  const id = decodeJwt(tokenSet.id_token)
+  console.log(
+    'token set',
+    tokenSet,
+    tokenSet.claims(),
+    id
+  )
+
+  let user: Auth = {
+    type: OIDC_WRAPPED_TOKEN,
+    token,
+    // @TODO Actually this is highly incorrect - we need to get profile details
+    // from the OwlMeans Auth intead ?
+    userId: id.sub as string,
+    // @TODO Actually we should check is it user or admin or even guest
+    // and set proper role
+    role: AuthRole.Guest,
+    // @TODO It's unclear if it's secure - but it's not used right now
+    scopes: [
+      ...(context.cfg.shortAlias != null ? [context.cfg.shortAlias] : []),
+      ...(context.cfg.alias != null ? [context.cfg.alias] : []),
+      context.cfg.service,
+      cfg.service,
+    ],
+    source: `${cfg.service}/${cfg.clientId}${'id' in cfg ? `/${cfg.id}` : ''}`,
+    // @TODO Actually this is highly incorrect - we need to get profile details
+    // from the OwlMeans Auth intead
+    // profileId: user?.userId,
+    entityId: cfg.entityId,
+    isUser: true,
+    createdAt: new Date(),
+  }
+
+  console.log('>>>>> ~~~~~ STORE RECORD WITH ID: ', managedId(token))
+  await cache(context).create(
+    { id: managedId(token), payload: tokenSet, client: cfg.clientId },
+    { ttl: OIDC_AUTH_LIFTETIME / 1000 }
+  )
+
+  const trusted = await trust<Config, Context>(context, TRUSTED, context.cfg.alias ?? context.cfg.service)
+  const authorization = await makeEnvelopeModel<Auth>(OIDC_WRAPPED_TOKEN)
+    .send(user, null).sign(trusted.key, EnvelopeKind.Token)
+
+  let auth = { token: `${OIDC_WRAPPED_TOKEN.toUpperCase()} ${authorization}` }
+
+  auth = await wrapper(context).update(auth, true) ?? auth
+
+  return auth
+})

package/src/auth/consts.ts

@@ -0,0 +1,2 @@
+
+export const OIDC_ADMIN_CLIENT = 'admin-cli'

package/src/auth/index.ts

@@ -0,0 +1,2 @@
+
+export * from './consts.js'

package/src/auth/plugins/index.ts

@@ -0,0 +1,8 @@
+
+import { plugins as authPlugins } from '@owlmeans/server-auth/manager'
+import { oidcClientPlugin } from './oidc-client.js'
+import { OIDC_CLIENT_AUTH } from '@owlmeans/oidc'
+
+authPlugins[OIDC_CLIENT_AUTH] = oidcClientPlugin as typeof authPlugins[keyof typeof authPlugins]
+
+export const plugins = authPlugins

package/src/auth/plugins/oidc-client.ts

@@ -0,0 +1,246 @@
+
+import type { AuthPlugin } from '@owlmeans/server-auth/manager/plugins'
+import type { Config, Context, OidcClientService } from '../../types.js'
+import { assertType } from '@owlmeans/server-auth/manager/plugins'
+import { DEFAULT_ALIAS } from '../../consts.js'
+import { OIDC_CLIENT_AUTH } from '@owlmeans/oidc'
+import type { OidcUserDetails, ProviderProfileDetails } from '@owlmeans/oidc'
+import { base64urlnopad as base64 } from '@scure/base'
+import { randomBytes } from '@noble/hashes/utils'
+import { sha256 } from '@noble/hashes/sha256'
+import { ALL_SCOPES, AuthenFailed, AuthenPayloadError, AuthManagerError, AuthRole } from '@owlmeans/auth'
+import { AUTHEN_TIMEFRAME } from '@owlmeans/server-auth'
+import { decodeJwt } from 'jose'
+import { KEY_OWL } from '@owlmeans/did'
+import { cache, verifierId } from '../../utils/cache.js'
+import { makeOidcAuthentication } from '../../utils/auth.js'
+// import { URL } from 'url'
+
+/**
+ * Actually the most of implementation desceibed here is a proprietary one and 
+ * located within OwlMeans Auth service implmentation.
+ * We keep it here for easier code navigation and understanding of relying developers
+ * about what's going on but we can't show it.
+ * 
+ * @See OwlMeans Auth {AccountLinkingService} interface implementation for more details
+ * 
+ * We need to distinguish the following cases:
+ * 1. The user authenticates via owlmenas.org
+ *  1.1. The user authenticated in owlmeans.net via IAM product based account.
+ *     1.1.1. The user do it for the first time
+ *          * We create an account
+ *          * We create and link credentials from jwt to the account (i'm not sure if it's required)
+ *          * We create the profile
+ *          * We create and link credentials from jwt to the profile
+ *     1.1.2. The user do it not for the first time
+ *          * We found the linked profile by jwt
+ *  1.2. The user autehnticated in owlmeans.net via OwlMeans ID
+ *     1.2.1. The user do it for the first time
+ *          * Figure out if the user has OwlMeans ID linked to the authentication from jwt
+ *            (GET /admin/realms/{realm}/users/{id}/federated-identity)
+ *          * We create and link credentials from jwt to the profile
+ *     1.2.2. The user do it not for the first time
+ *          * We found the linked profile by credentials from jwt
+ * 2. The user authenticates via a custom identity provider
+ *  2.1. The user auhtneticated in his identity provier directly
+ *     2.1.1. The user do it for the first time
+ *          * We create a profile (we cant request info about his Owlmeans id)!
+ *          * We create and link credentials from jwt to the profile
+ *          * ! When the user will try to pay for something via this profile
+ *          *   we need to force him to link it to owlmeans.net profile / account.
+ *     2.1.2. The user do it not for the first time
+ *          * We found the linked profile by jwt
+ *  2.2. The user authenticated in his identity provider via OwlMeans ID
+ *     - This case actually shouldn't know anything about it until the profile is linked to the 
+ *       owlmeans.net acccount.
+ *
+ *  Generailized
+ *  1. We try to get credentials
+ *  2. If there is no credentials we try to get more info abou the user
+ *  2.1. To do it we get admin client if it's presented for API access
+ *  2.2. If it's presented we get list of identity providers to figure out if there an owlmeans.net id
+ *  3. If there is no owlmeans.net account while the login is going through it - we create one
+ *  4. If there is no profile - we create one and link oidc credentials
+ */
+export const oidcClientPlugin = <C extends Config, T extends Context<C>>(context: T): AuthPlugin => {
+  const authenticate = makeOidcAuthentication<C, T>(context)
+
+  const plugin: AuthPlugin = {
+    type: OIDC_CLIENT_AUTH,
+
+    init: async request => {
+      assertType(request.type, plugin)
+
+      if (context.cfg.oidc.restrictedProviders === false) {
+        throw new AuthManagerError('oidc.internal')
+      }
+      
+      // @TODO Actually think about how to make oidc service configurable
+      const oidc = context.service<OidcClientService>(DEFAULT_ALIAS)
+      let entityId = request.entityId ?? oidc.getDefault()
+
+      if (entityId == null) {
+        throw new AuthenPayloadError('client')
+      }
+
+      if (context.cfg.oidc.restrictedProviders === true && oidc.getDefault() !== entityId) {
+        throw new AuthenPayloadError('client')
+      }
+      if (Array.isArray(context.cfg.oidc.restrictedProviders)
+        && !context.cfg.oidc.restrictedProviders.includes(entityId)) {
+        throw new AuthenPayloadError('client')
+      }
+
+      const verifier = base64.encode(randomBytes(32))
+      const challenge = base64.encode(sha256(verifier))
+
+      console.log("\n\n We create verifierID (2): ", verifierId(challenge), verifier, " with client: ", entityId, "\n\n")
+
+      await cache<C, T>(context).create({
+        id: verifierId(challenge), 
+        verifier, 
+        client: entityId
+      }, { ttl: AUTHEN_TIMEFRAME / 1000 })
+
+      if (request.source == null) {
+        throw new AuthenPayloadError('redirect-uri')
+      }
+
+      // const redirectUrl = new URL(request.source)
+
+      // for (let key of redirectUrl.searchParams.keys()) {
+      //   redirectUrl.searchParams.delete(key)
+      // }
+
+      const client = await oidc.getClient(entityId)
+      const cfg = client.getConfig()
+      const url = client.makeAuthUrl({
+        scope: `openid profile email ${cfg?.extraScopes ?? ''}`,
+        code_challenge: challenge,
+        code_challenge_method: 'S256',
+        redirect_uri: request.source,
+      })
+
+      return { challenge: url }
+    },
+
+    authenticate: async credential => {
+      console.log('000000000000000')
+      const [cfg, tokenSet, exchangeToken] = await authenticate(credential)
+
+      if (tokenSet.id_token == null || tokenSet.access_token == null) {
+        throw new AuthenFailed()
+      }
+
+      const oidc = context.service<OidcClientService>(DEFAULT_ALIAS)
+      const jwt = decodeJwt(tokenSet.id_token)
+
+      if (jwt.sub == null) {
+        throw new AuthenFailed()
+      }
+
+      const store = oidc.accountLinking()
+      if (store == null) {
+        throw new AuthManagerError('oidc.account.store')
+      }
+
+      if (cfg.service == null) {
+        throw new AuthManagerError('oidc.service')
+      }
+
+      let profile = await store.getLinkedProfile({
+        type: OIDC_CLIENT_AUTH,
+        service: cfg.service,
+        clientId: cfg.clientId,
+        userId: jwt.sub
+      } satisfies ProviderProfileDetails)
+
+      // @TODO It's likely the case when we are talking about owlmeans.net
+      // but some addtional checks need to be done.
+      // The problem is that we will make the sold identity providers also
+      // managable, so this condition isn't enough to cover described cases.
+      let details: OidcUserDetails
+      if (cfg.apiClientId != null) {
+        console.log(1)
+        const apiClient = await oidc.getClient(cfg.apiClientId)
+        const adminTokens = await apiClient.grantWithCredentials()
+        if (adminTokens.access_token == null) {
+          throw new AuthManagerError('iam.admin')
+        }
+        const api = oidc.providerApi()
+        if (api == null) {
+          // @TODO And what if don't? Probably we can still do something here
+          throw new AuthManagerError('iam.admin.api')
+        }
+        details = await api.getUserDetails(adminTokens.access_token, jwt.sub)
+      } else {
+        // @TODO We need to do something here if it's an external identity provider
+        // and we couldn't get any addiontal info
+        throw new AuthManagerError('implemented')
+      }
+
+      if (
+        // Create profile
+        profile == null
+        // Fix profile if it's not linked properly to OwlMeans Id
+        || (details.did != null && details.isOwlMeansId && !profile.profileId?.startsWith(KEY_OWL + ':'))
+      ) {
+        console.log(2)
+        details.isOwlMeansId ??= cfg.entityId != null && cfg.entityId === context.cfg.defaultEntityId
+        if (details.isOwlMeansId && context.cfg.defaultEntityId == null) {
+          throw new AuthManagerError('iam.governance')
+        }
+        details.entityId = details.isOwlMeansId ? context.cfg.defaultEntityId : cfg.entityId
+        if (details.entityId == null) {
+          // @TODO We doesn't support clients and entites that aren't bound to an organization
+          // right now. Probably we should. Probably there are some cases when we have to.
+          throw new AuthManagerError('iam.entity')
+        }
+
+
+        console.log('Supper attention ~%~: ', details.entityId, cfg.entityId, context.cfg.defaultEntityId)
+
+        // We relink existing profile only if it's not yet did bound
+        // and the orgnaization is owlmeans.net
+        if (profile == null || (
+          details.entityId === context.cfg.defaultEntityId
+          // @TODO Figure out more flexible solution. 
+          // This check prevent a potenatilly vulnarability when a user can
+          // connect its own idp to his arbitrary IAM system that is connected as 
+          // idp to our IAM system, and create an internal idp link that
+          // uses owlmeans did as user id of another user to link an arbitrary
+          // profile to his or her owlmeans user account and take adavantage of cross login.
+          // Probably such cross login accross owner like profiles should be prevented
+          // without additional authentication. But for now, this check guaranty that it works
+          // only with owlmeans.net idp that is managed by ours. 
+          && details.entityId === cfg.entityId
+        )) {
+          console.log(3, details)
+          profile = await store.linkProfile({
+            ...details,
+            service: cfg.service,
+            clientId: cfg.clientId,
+            type: OIDC_CLIENT_AUTH,
+          }, { 
+            username: jwt.preferred_username as string ?? details.username, 
+            // @TODO It's important to keep it this way to make registration disabling working
+            force: false 
+          })
+        }
+      }
+      console.log(4)
+
+      credential.scopes = [ALL_SCOPES]
+      credential.source = cfg.clientId
+      credential.role = AuthRole.User
+      credential.type = OIDC_CLIENT_AUTH
+      credential.userId = profile.userId
+      credential.profileId = profile.profileId
+      credential.entityId = profile.entityId
+
+      return { token: exchangeToken }
+    }
+  }
+
+  return plugin
+}