@owlmeans/server-oidc-rp 0.1.0

package/src/consts.ts

@@ -0,0 +1,26 @@
+
+export const DEFAULT_ALIAS = 'oidc-client'
+
+export const DEF_OIDC_ACCOUNT_LINKING = 'oidc-consumer-account-linking'
+
+export const DEF_OIDC_PROVIDER_API = 'oidc-consumer-provider-api'
+
+export const authService = {
+  provider: {
+    list: 'external-auth:provider:list'
+  },
+  auth: {
+    update: 'external-auth:auth:update'
+  }
+}
+
+export const OIDC_TOKEN_STORE = 'oidc-token-store'
+/**
+ * @TODO Actually these ones should be constants and should be linked to
+ * configuration on OIDC provider side
+ */
+export const PROVIDER_CACHE_TTL = (5 * 60 - 1) * 1000
+
+export const OIDC_AUTH_LIFTETIME = 24 * 3600 * 1000
+
+export const OIDC_WRAP_FRESHNESS = (5 * 60 - 1) * 1000

package/src/gate.ts

@@ -0,0 +1,29 @@
+import { createLazyService } from '@owlmeans/context'
+import type { GateService } from '@owlmeans/module'
+import { OIDC_GATE } from '@owlmeans/oidc'
+import type { Config, Context } from './types.js'
+import { AuthForbidden } from '@owlmeans/auth'
+import { createGateModel } from './model/gate.js'
+
+export const makeOidcGate = (alias: string = OIDC_GATE): GateService => {
+  const service: GateService = createLazyService<GateService>(alias, {
+    assert: async (req, _, params) => {
+      await service.ready()
+      const ctx = service.assertCtx<Config, Context>()
+
+      if (req.auth == null) {
+        throw new AuthForbidden('auth')
+      }
+
+      const model = createGateModel(ctx)
+
+      const permissions = await model.loadPermissions(req.auth, params)
+
+      if (permissions.length < 1) {
+        throw new AuthForbidden('permission')
+      }
+    }
+  })
+
+  return service
+}

package/src/guard.ts

@@ -0,0 +1,25 @@
+import type { OidcGuardOptions } from '@owlmeans/oidc'
+import type { Config, Context } from './types.js'
+import type { CommonModule } from '@owlmeans/module'
+import { 
+  appendOidcGuard as appendBasicOidcGuard, 
+  setupOidcGuard as setupBasicOidcGuard, 
+  DISPATCHER_OIDC, DISPATCHER_OIDC_INIT 
+} from '@owlmeans/oidc'
+import { elevate } from '@owlmeans/server-module'
+import * as actions from './actions/index.js'
+
+export const appendOidcGuard = <C extends Config, T extends Context<C>>(
+  context: T, opts?: OidcGuardOptions
+) => {
+  const ctx = appendBasicOidcGuard<C, T>(context, opts)
+
+  return ctx
+}
+
+export const setupOidcGuard = (modules: CommonModule[], coguards?: string | string[]) => {
+  setupBasicOidcGuard(modules, coguards)
+
+  elevate(modules, DISPATCHER_OIDC_INIT, actions.init)
+  elevate(modules, DISPATCHER_OIDC, actions.authenticate)
+}

package/src/index.ts

@@ -0,0 +1,7 @@
+export type * from './types.js'
+export * from './consts.js'
+export * from './service.js'
+export * from './guard.js'
+export * from './gate.js'
+export * from './modules.js'
+export * from './wrapper.js'

package/src/model/consts.ts

@@ -0,0 +1,6 @@
+
+export enum ResponseMode {
+  Permissions = 'permissions',
+  Token = 'token',
+  Decision = 'decision',
+}

package/src/model/gate.ts

@@ -0,0 +1,129 @@
+import { AuthForbidden, AuthManagerError, AuthManagerUnsupported, AuthUnknown } from '@owlmeans/auth'
+import { authService, DEFAULT_ALIAS } from '../consts.js'
+import type { Config, Context, OidcClientService } from '../types.js'
+import { cache, managedId } from '../utils/cache.js'
+import type { GateModel, PermissionRequest, PermissionResponse } from './types.js'
+import { ResponseMode } from './consts.js'
+import type { ClientModule } from '@owlmeans/client-module'
+import type { OidcProviderDescriptor } from '@owlmeans/oidc'
+
+export const createGateModel = <C extends Config, T extends Context<C>>(ctx: T): GateModel => {
+  const model: GateModel = {
+    getClient: async user => {
+      const oidc = ctx.service<OidcClientService>(DEFAULT_ALIAS)
+      try {
+        return await oidc.getClient({
+          entityId: user.entityId,
+          clientId: oidc.entityToClientId({ entityId: user.entityId })
+        })
+      } catch (e) {
+        if (e instanceof AuthManagerError) {
+          const [providers] = await ctx.module<ClientModule<OidcProviderDescriptor[]>>(
+            authService.provider.list
+          ).call({
+            params: { service: ctx.cfg.alias ?? ctx.cfg.service },
+            query: { entityId: user.entityId }
+          })
+          if (providers.length < 1) {
+            throw new AuthUnknown()
+          }
+          oidc.registerTemporaryProvider(providers[0])
+
+          return model.getClient(user)
+        }
+        throw e
+      }
+    },
+
+    loadPermissions: async (user, permissions) => {
+      const record = await cache<C, T>(ctx).get(managedId(user.token))
+      if (record.payload == null) {
+        throw new AuthForbidden('record')
+      }
+
+      const client = await model.getClient(user)
+
+      const metadata = client.getMetadata()
+      const tokenEndpoint = metadata.token_endpoint
+
+      if (tokenEndpoint == null) {
+        throw new AuthManagerUnsupported('token-url')
+      }
+
+      const request = await model.makeRequest(
+        model.fixPermissions(permissions, user),
+        client
+      )
+
+      request.subject_token = record.payload.access_token
+
+      const response = await fetch(
+        tokenEndpoint,
+        await model.prepareRequest(client, request)
+      )
+
+      if (!response.ok) {
+        console.warn(await response.text())
+        return []
+      }
+
+      const proofs = await response.json() as PermissionResponse[]
+
+      return permissions.filter(permission => {
+        const [fixed] = model.fixPermissions([permission], user)
+        const [resource, scope] = fixed.split(':')
+        const proof = proofs.find(p => p.rsid === resource || p.rsname === resource)
+        return proof != null
+          && (scope == null || (proof.scopes?.includes(scope) ?? false))
+      })
+    },
+
+    fixPermissions: (permissions, user) => permissions.map(
+      perm => perm.replaceAll('{entity}', user.entityId ?? '-')
+    ),
+
+    prepareRequest: async (client, request) => {
+      let { permission, ..._request } = request
+      const params = new URLSearchParams(_request)
+      permission = Array.isArray(permission) ? permission : [permission]
+      permission.forEach(perm => params.append('permission', perm))
+      const body = params.toString()
+
+      const cfg = client.getConfig()
+
+      const headers = {
+        'Content-Type': 'application/x-www-form-urlencoded',
+        'Authorization': `Basic ${Buffer.from(`${client.getClientId()}:${cfg.secret}`).toString('base64')}`,
+        'Content-Length': `${body.length}`,
+      }
+
+      return { body, headers, method: 'POST' }
+    },
+
+    makeRequest: async (permissions, client) => {
+      const cfg = client.getConfig()
+      const clientId = client.getClientId()
+      const permission = {
+        grant_type: 'urn:ietf:params:oauth:grant-type:uma-ticket',
+        audience: clientId,
+        client_id: clientId,
+        secret: cfg.secret,
+        permission: permissions.reduce((output, permission) => {
+          const [resource, scope] = permission.split(':')
+          const idx = output.findIndex(perm => perm.startsWith(resource))
+          if (idx > -1) {
+            output[idx] += `, ${scope}`
+          } else {
+            output.push(`${resource}${scope ? `#${scope}` : ''}`)
+          }
+          return output
+        }, [] as string[]),
+        response_mode: ResponseMode.Permissions,
+      } satisfies PermissionRequest
+
+      return permission
+    }
+  }
+
+  return model
+}

package/src/model/types.ts

@@ -0,0 +1,31 @@
+import type { Auth } from '@owlmeans/auth'
+import type { OidcClientAdapter } from '../types.js'
+import type { ResponseMode } from './consts.js'
+
+export interface GateModel {
+  getClient: (user: Auth) => Promise<OidcClientAdapter>
+
+  loadPermissions: (user: Auth, permissions: string[]) => Promise<string[]>
+
+  fixPermissions: (permissions: string[], user: Auth) => string[]
+
+  prepareRequest: (client: OidcClientAdapter, request: PermissionRequest) => Promise<RequestInit>
+
+  makeRequest: (permissions: string[], client: OidcClientAdapter) => Promise<PermissionRequest>
+}
+
+export interface PermissionRequest {
+  grant_type: string
+  audience: string
+  client_id?: string
+  secret?: string
+  subject_token?: string
+  permission: string | string[]
+  response_mode: ResponseMode
+}
+
+export interface PermissionResponse {
+  rsid: string
+  rsname: string
+  scopes?: string[]
+}

package/src/models.ts

@@ -0,0 +1 @@
+

package/src/modules.ts

@@ -0,0 +1,30 @@
+import type { CommonModule } from '@owlmeans/module'
+import { module, guard, filter, body } from '@owlmeans/module'
+import { backend, route, RouteMethod, service } from '@owlmeans/route'
+import { authService } from './consts.js'
+import { elevate } from '@owlmeans/client-module'
+import { GUARD_ED25519 } from '@owlmeans/auth-common'
+import { OIDCTokenUpdateSchema } from '@owlmeans/oidc'
+
+export const setupAuthServiceModules = (
+  modules: CommonModule[],
+  serviceAlias: string,
+  prefix: string = 'oidc-api'
+) => {
+  modules.push(
+    module(
+      route(authService.provider.list, `/${prefix}/provider/:service`, service(serviceAlias)),
+      guard(GUARD_ED25519)
+    ),
+    module(
+      route(
+        authService.auth.update, `/${prefix}/auth/update`,
+        backend(service(serviceAlias), RouteMethod.POST)
+      ),
+      filter(body(OIDCTokenUpdateSchema), guard(GUARD_ED25519))
+    )
+  )
+
+  elevate(modules, authService.provider.list)
+  elevate(modules, authService.auth.update)
+}

package/src/service.ts

@@ -0,0 +1,251 @@
+import { DEF_OIDC_ACCOUNT_LINKING, DEF_OIDC_PROVIDER_API, DEFAULT_ALIAS } from './consts.js'
+import { assertContext, createService } from '@owlmeans/context'
+import type { AccountLinkingService, Config, Context, OidcClientService, ProviderApiService, OidcClientAdapter } from './types.js'
+import { AuthManagerError } from '@owlmeans/auth'
+import { makeSecurityHelper } from '@owlmeans/config'
+import * as client from 'openid-client'
+import type { OidcProviderConfig } from '@owlmeans/oidc'
+import { Configuration } from 'openid-client'
+// import { URL as SrvURL } from 'node:url'
+
+export const makeOidcClientService = (alias: string = DEFAULT_ALIAS): OidcClientService => {
+  const service: OidcClientService = createService<OidcClientService>(alias, {
+    getConfiguration: async clientId => {
+      const context = assertContext<Config, Context>(service.ctx as Context, alias)
+      let cfg = await service.getConfig(clientId)
+
+      if (cfg?.basePath == null) {
+        throw new AuthManagerError('oidc.client.basepath')
+      }
+
+      if (cfg.service == null) {
+        throw new AuthManagerError('oidc.client.service')
+      }
+
+      if (typeof clientId === 'object' && clientId.clientId == null) {
+        throw new AuthManagerError('oidc.client.client-id')
+      }
+
+      // @TODO Add support for any domain (not just registered services)
+      const security = makeSecurityHelper<Config, Context>(context)
+      const url = cfg.discoveryUrl
+        ?? security.makeUrl(context.cfg.services[cfg.service], cfg.basePath)
+
+      return await client.discovery(
+        new URL(url) as URL,
+        cfg.idOverride ?? (
+          typeof clientId === 'string' ? clientId : clientId.clientId!
+        ),
+        cfg.secret, undefined, {
+        execute: [
+          // @TODO Properly handle it with the config
+          client.allowInsecureRequests
+        ]
+      })
+    },
+
+    getClient: async clientId => {
+      let params: string | OidcProviderConfig
+      let descriptor: Configuration | null = null
+      let _clientId: string
+      if (clientId instanceof Configuration) {
+        descriptor = clientId
+        _clientId = params = clientId.serverMetadata().issuer
+      } else if (typeof clientId === 'string') {
+        _clientId = params = clientId
+      } else {
+        params = clientId as OidcProviderConfig
+        _clientId = params.clientId
+      }
+      let metadata = await descriptor?.serverMetadata()
+      // @TODO Do not forget to delete it
+      if (_clientId == null) {
+        throw new AuthManagerError('oidc.client.client-id')
+      }
+
+      descriptor ??= await service.getConfiguration(params)
+
+      const cfg = await service.getConfig(params)
+      if (cfg?.secret == null) {
+        throw new AuthManagerError('oidc.client.secert')
+      }
+
+      metadata ??= await descriptor.serverMetadata()
+
+      // return new issuer.Client({ client_id: _clientId, client_secret: cfg?.secret })
+      return {
+        getMetadata: () => metadata,
+
+        getClientId: () => cfg.idOverride ?? _clientId,
+
+        getConfig: () => cfg,
+
+        makeAuthUrl: params => client.buildAuthorizationUrl(descriptor, params).toString(),
+
+        // grantWithCredentials: async () => client.clientCredentialsGrant(descriptor, { grant_type: 'client_credentials' }),
+        grantWithCredentials: async () => client.clientCredentialsGrant(descriptor),
+
+        grantWithCode: async (url, checks, params) => {
+          const urlObj = new URL(url)
+          Object.entries(params).forEach(([key, value]) => {
+            if (key === 'flow') {
+              return
+            }
+
+            urlObj.searchParams.set(key, value)
+          })
+
+          checks.idTokenExpected ??= true
+
+          return await client.authorizationCodeGrant(
+            descriptor, urlObj, checks
+          )
+        },
+
+        refresh: async tokenSet => {
+          const refreshToken = typeof tokenSet === 'string' ? tokenSet : tokenSet.refresh_token
+          if (refreshToken == null) {
+            throw new AuthManagerError('refresh-token')
+          }
+          return await client.refreshTokenGrant(descriptor, refreshToken)
+        },
+
+        introspect: async (tokenSet, type = 'access_token') =>
+          await client.tokenIntrospection(descriptor, tokenSet[type] as string),
+
+      } satisfies OidcClientAdapter
+    },
+
+    getConfig: async clientId => {
+      const context = assertContext<Config, Context>(service.ctx as Context, alias)
+
+      if (typeof clientId === 'object' && clientId.clientId == null) {
+        throw new AuthManagerError('oidc.client.client-id')
+      }
+
+      return context.cfg.oidc.providers?.find(consumer => {
+        if (typeof clientId === 'string') {
+          return consumer.clientId === clientId
+        }
+        return Object.entries(clientId).every(
+          ([key, value]) => consumer[key as keyof typeof consumer] === value
+        )
+      })
+    },
+
+    getDefault: () => {
+      const context = assertContext<Config, Context>(service.ctx as Context, alias)
+
+      return context.cfg.oidc.providers?.find(consumer => consumer.def)?.clientId
+    },
+
+    providerApi: () => {
+      const context = assertContext<Config, Context>(service.ctx as Context, alias)
+      const cfg = context.cfg.oidc
+      const providerApiService = cfg.providerApiService ?? DEF_OIDC_PROVIDER_API
+      if (context.hasService(providerApiService)) {
+        return context.service<ProviderApiService>(providerApiService)
+      }
+      return null
+    },
+
+    accountLinking: () => {
+      const context = assertContext<Config, Context>(service.ctx as Context, alias)
+      const cfg = context.cfg.oidc
+      const accountLinkingService = cfg.accountLinkingService ?? DEF_OIDC_ACCOUNT_LINKING
+      if (context.hasService(accountLinkingService)) {
+        return context.service<AccountLinkingService>(accountLinkingService)
+      }
+      return null
+    },
+
+    hasProvider: params => {
+      const ctx = service.assertCtx<Config, Context>()
+      if (ctx.cfg.oidc.providers == null) {
+        ctx.cfg.oidc.providers = []
+      }
+
+      return ctx.cfg.oidc.providers.some(provider => {
+        if (typeof params === 'string') {
+          return provider.clientId === params
+        }
+        return Object.entries(params).every(
+          ([key, value]) => provider[key as keyof typeof provider] === value
+        )
+      })
+    },
+
+    registerTemporaryProvider: config => {
+      const ctx = service.assertCtx<Config, Context>()
+      if (ctx.cfg.oidc.providers == null) {
+        ctx.cfg.oidc.providers = []
+      }
+      const providers = ctx.cfg.oidc.providers as TemporaryConfig[]
+      let provider = providers.find(provider => matchCriteria.every(
+        key => provider[key as keyof typeof provider] === config[key as keyof typeof config]
+      ))
+      if (provider == null) {
+        provider = { ...config, [_configFlag]: 0 }
+        providers.push(provider)
+      } else {
+        Object.assign(provider, config)
+        provider[_configFlag] ??= 0
+        provider[_configFlag]++
+      }
+
+      return provider
+    },
+
+    entityToClientId: params => {
+      const ctx = service.assertCtx<Config, Context>()
+      if (ctx.cfg.oidc.providers == null) {
+        ctx.cfg.oidc.providers = []
+      }
+
+      const provider = ctx.cfg.oidc.providers.find(
+        provider => Object.entries(params).every(
+          ([key, value]) => provider[key as keyof typeof provider] === value
+        )
+      )
+      if (provider == null) {
+        throw new AuthManagerError('oidc.client.entity-id')
+      }
+
+      return provider.clientId
+    },
+
+    unregisterTemporaryProvider: params => {
+      const ctx = service.assertCtx<Config, Context>()
+      if (ctx.cfg.oidc.providers == null) {
+        ctx.cfg.oidc.providers = []
+      }
+      const providers = ctx.cfg.oidc.providers as TemporaryConfig[]
+
+      const idx = providers.findIndex(
+        provider => matchCriteria.every(
+          key => !(key in params) ||
+            provider[key as keyof typeof provider] === params[key as keyof typeof params]
+        )
+      )
+      if (idx < 0) {
+        return
+      }
+      const provider = providers[idx]
+
+      if (--provider[_configFlag] < 1) {
+        providers.splice(idx, 1)
+      }
+    }
+  })
+
+  return service
+}
+
+const matchCriteria = [
+  'clientId', 'service', 'targetService', 'basePath', 'entityId'
+]
+
+const _configFlag = Symbol('temporary-oidc-proivder-config')
+interface TemporaryConfig extends OidcProviderConfig {
+  [_configFlag]: number
+}

package/src/types.ts

@@ -0,0 +1,64 @@
+import type { InitializedService } from '@owlmeans/context'
+import type { AuthorizationCodeGrantChecks, Configuration, IntrospectionResponse, ServerMetadata, TokenEndpointResponse, TokenEndpointResponseHelpers } from 'openid-client'
+import type { ServerConfig, ServerContext } from '@owlmeans/server-context'
+import type { OidcProviderConfig, OidcSharedConfig, WithSharedConfig, ProviderProfileDetails, OidcUserDetails, OidcProviderSettings } from '@owlmeans/oidc'
+import type { AuthCredentials, AuthPayload, Profile } from '@owlmeans/auth'
+
+export type OidcClientDescriptor = Configuration 
+export type TokenSet = TokenEndpointResponse & TokenEndpointResponseHelpers
+export type TokenSetParameters = TokenEndpointResponse
+
+export interface OidcClientService extends InitializedService {
+  getConfiguration: (clientId: string | Partial<OidcProviderConfig>) => Promise<OidcClientDescriptor>
+  getClient: (clientId: string | OidcClientDescriptor | Partial<OidcProviderConfig>) => Promise<OidcClientAdapter>
+  getConfig: (clientId: string | Partial<OidcProviderConfig>) => Promise<OidcProviderConfig | undefined>
+  getDefault: () => string | undefined
+
+  registerTemporaryProvider: (config: OidcProviderConfig) => OidcProviderConfig
+  unregisterTemporaryProvider: (params: Partial<OidcProviderConfig>) => void
+  hasProvider: (params: Partial<OidcProviderConfig>) => boolean
+  entityToClientId: (params: Partial<OidcProviderConfig>) => string
+
+  providerApi: () => ProviderApiService | null
+  accountLinking: () => AccountLinkingService | null
+}
+
+export interface OidcClientAdapter {
+  getMetadata: () => ServerMetadata
+  getClientId: () => string
+  getConfig: () => OidcProviderConfig
+  makeAuthUrl: (params: Record<string, string>) => string
+  grantWithCredentials: () => Promise<TokenSet>
+  grantWithCode: (currentUrl: string, checks: AuthorizationCodeGrantChecks, params: Record<string, string>) => Promise<TokenSet>
+  refresh: (tokenSet: TokenSetParameters | string) => Promise<TokenSetParameters>
+  introspect: (tokenSet: TokenSetParameters, type?: string) => Promise<IntrospectionResponse>
+}
+
+export interface OidcRpConfig extends OidcSharedConfig {
+  accountLinkingService?: string
+  providerApiService?: string
+}
+
+export interface Config extends ServerConfig, WithSharedConfig {
+  oidc: OidcRpConfig
+}
+
+export interface Context<C extends Config = Config> extends ServerContext<C> { }
+
+export interface AccountLinkingService extends InitializedService {
+  getLinkedProfile: (details: ProviderProfileDetails) => Promise<AuthPayload | null>
+  linkProfile: (details: ProviderProfileDetails, meta: AccountMeta) => Promise<AuthPayload>
+  linkCredentials: (details: ProviderProfileDetails) => Promise<AuthPayload>
+  getOwnerProfiles: (entityId: string) => Promise<Profile[]>
+  getOwnerCredentials: (userId: string, entityId?: string, type?: string) => Promise<AuthCredentials | undefined>
+}
+
+export interface AccountMeta {
+  username: string
+  force?: boolean
+}
+
+export interface ProviderApiService extends InitializedService {
+  getUserDetails: (token: string, userId: string) => Promise<OidcUserDetails>
+  getSettings: (token: string, realm: string) => Promise<OidcProviderSettings>
+}

package/src/utils/auth.ts

@@ -0,0 +1,67 @@
+import type { AuthCredentials } from '@owlmeans/auth'
+import { AuthenFailed, AuthenPayloadError } from '@owlmeans/auth'
+import type { Config, Context, OidcClientService, TokenSet } from '../types.js'
+import type { OidcProviderConfig } from '@owlmeans/oidc'
+import type { } from 'openid-client'
+import Url from 'url'
+import { cache, exchangeId, verifierId } from './cache.js'
+import { DEFAULT_ALIAS } from '../consts.js'
+import { base64 } from '@scure/base'
+import { randomBytes } from '@noble/hashes/utils'
+import { AUTHEN_TIMEFRAME } from '@owlmeans/server-auth'
+
+export const makeOidcAuthentication = <C extends Config, T extends Context<C>>(context: T) =>
+  async (credential: AuthCredentials): Promise<[OidcProviderConfig, TokenSet, string]> => {
+    console.log('Challenge we got: ', credential.challenge)
+    const challengeParts = credential.challenge.split(':http')
+    // This is ex. source - url we were going to return user to after all it happens
+    const redirectUrl = challengeParts[0]
+    // This is the auth service url with all necessary parameters that
+    // we sent user to for authentication.
+    const challengeUrl = new Url.URL('http' + challengeParts[1])
+    const challenge = challengeUrl.searchParams.get('code_challenge')
+    if (challenge == null) {
+      throw new AuthenPayloadError('code_challenge')
+    }
+
+    console.log("\n\nWe are picking verifier by id: ", verifierId(challenge))
+    const verification = await cache<C, T>(context).pick(verifierId(challenge))
+    console.log("Verification we get: ", verification, "\n\n")
+    if (verification.verifier == null) {
+      throw new AuthenFailed()
+    }
+    if (verification.client == null) {
+      throw new AuthenFailed()
+    }
+
+    const oidc = context.service<OidcClientService>(DEFAULT_ALIAS)
+    console.log(">>>>>>>> client we are trying to extract: ", verification)
+    const cfg = await oidc.getConfig({
+      clientId: verification.client,
+      ...(verification.entityId != null ? { entityId: verification.entityId } : {})
+    })
+    if (cfg == null) {
+      throw new AuthenFailed()
+    }
+
+    const client = await oidc.getClient(cfg)
+    const tokenSet = await client.grantWithCode(
+      redirectUrl,
+      { pkceCodeVerifier: verification.verifier },
+      {
+        ...Object.fromEntries(new Url.URLSearchParams(credential.credential).entries()),
+      }
+    )
+
+    // const params = client.callbackParams('/?' + credential.credential)
+
+    // const tokenSet = await client.callback(redirectUrl, params, { code_verifier: verification.verifier })
+
+    const exchangeToken = base64.encode(randomBytes(32))
+    await cache<C, T>(context).create(
+      { id: exchangeId(exchangeToken), payload: tokenSet },
+      { ttl: AUTHEN_TIMEFRAME / 1000 }
+    )
+
+    return [cfg, tokenSet, exchangeToken]
+  }