@owlmeans/server-oidc-rp 0.1.11 → 0.1.15
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/agent-meta/instructions/server-oidc-rp.instructions.md +36 -2
- package/agent-meta/manifest.json +2 -2
- package/agent-meta/skills/server-oidc-rp/SKILL.md +1 -1
- package/build/service.d.ts.map +1 -1
- package/build/service.js +20 -8
- package/build/service.js.map +1 -1
- package/package.json +21 -22
- package/src/service.ts +23 -9
|
@@ -7,7 +7,7 @@ applyTo: "**/context.ts, **/modules.ts, **/*.ts, **/*.tsx"
|
|
|
7
7
|
# @owlmeans/server-oidc-rp
|
|
8
8
|
|
|
9
9
|
**Layer:** Server
|
|
10
|
-
**Install:** `"@owlmeans/server-oidc-rp": "^0.1.
|
|
10
|
+
**Install:** `"@owlmeans/server-oidc-rp": "^0.1.15"` in `dependencies`
|
|
11
11
|
|
|
12
12
|
## Key Exports
|
|
13
13
|
|
|
@@ -47,6 +47,40 @@ cfg.oidc.providers.push({
|
|
|
47
47
|
})
|
|
48
48
|
```
|
|
49
49
|
|
|
50
|
+
## Locating the provider: `discoveryUrl` vs `service` + `basePath`
|
|
51
|
+
|
|
52
|
+
`makeOidcClientService().getConfiguration()` resolves the provider URL in one of two ways:
|
|
53
|
+
|
|
54
|
+
```ts
|
|
55
|
+
// PREFERRED — one fully-qualified value, no knowledge of the provider's URL layout
|
|
56
|
+
cfg.oidc.providers.push({ discoveryUrl: process.env.OIDC_ISSUER_URL, clientId, secret, def: true })
|
|
57
|
+
|
|
58
|
+
// LEGACY — reassembled from a registered service host + base path
|
|
59
|
+
cfg.oidc.providers.push({ service: OIDC_PRODUCT, basePath: 'realms/my-org', clientId, secret })
|
|
60
|
+
```
|
|
61
|
+
|
|
62
|
+
- `basePath` and `service` are required **only** when `discoveryUrl` is absent. A `discoveryUrl`-only
|
|
63
|
+
provider is valid (this was not always true — the guards used to throw regardless).
|
|
64
|
+
- Prefer `discoveryUrl`. Reassembly forces the relying party to know the provider's URL layout and to
|
|
65
|
+
stay in sync with it; when the two disagree the RP silently talks to the wrong provider. Note that
|
|
66
|
+
`server-oidc-provider` builds its own issuer with `makeUrl(route, basePath, { base: true })` while
|
|
67
|
+
the RP fallback omits `{ base: true }` — so a service route carrying a `base` yields two different
|
|
68
|
+
URLs from the same config.
|
|
69
|
+
- **`discoveryUrl` must equal the provider's advertised `issuer` byte for byte.** `openid-client`
|
|
70
|
+
appends `/.well-known/openid-configuration` and then compares the returned `issuer` with the URL it
|
|
71
|
+
was given, failing discovery on any difference (trailing slash, scheme, host). Passing a URL that
|
|
72
|
+
already contains `/.well-known/` skips that check — use it only when the provider's issuer genuinely
|
|
73
|
+
cannot be known in advance.
|
|
74
|
+
- There is **no discovery cache**: every `getConfiguration()` performs a fresh HTTP round-trip, and
|
|
75
|
+
`getClient()` calls it per authorize/exchange/refresh/gate check.
|
|
76
|
+
|
|
77
|
+
## `redirect_uri` is the consumer's own dispatcher URL
|
|
78
|
+
|
|
79
|
+
`actions/init.ts` builds `redirect_uri` from `context.entrypoint(DISPATCHER).call()` — the app's own
|
|
80
|
+
frontend origin + `DISPATCHER_PATH`. It never involves the issuer, and `openid-client` v6 strips
|
|
81
|
+
`search`/`hash` on the token-exchange side (`stripParams`), so the authorize and exchange values
|
|
82
|
+
match by construction. Do not add query-stripping here.
|
|
83
|
+
|
|
50
84
|
## Product-Viable Usage Notes
|
|
51
85
|
|
|
52
86
|
- Viable uses `makeOidcClientService()` to read provider descriptors from `cfg.oidc.providers`, including Google and internal admin providers.
|
|
@@ -54,7 +88,7 @@ cfg.oidc.providers.push({
|
|
|
54
88
|
- `setupAuthServiceModules(managerModules, AUTH_API)` exposes provider-list and token-update service modules protected by `GUARD_ED25519`.
|
|
55
89
|
- When a downstream app uses OIDC/Google only for login and maps users into `@owlmeans/server-auth-identity`, do not reintroduce `appendOidcGuard()`, `makeOidcGate()`, or `setupOidcGuard()` as product authorization. Use a product-specific `GateService` over local identity data.
|
|
56
90
|
|
|
57
|
-
## Integrated-IAM permissions claim
|
|
91
|
+
## Integrated-IAM permissions claim
|
|
58
92
|
|
|
59
93
|
- `extractPermissionSets(claim)` (exported) shape-validates a `permissions` token claim into
|
|
60
94
|
`PermissionSet[]`; non-conforming claims (e.g. anything Keycloak emits) return `undefined`.
|
package/agent-meta/manifest.json
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schemaVersion": 1,
|
|
3
3
|
"package": "@owlmeans/server-oidc-rp",
|
|
4
|
-
"version": "0.1.
|
|
5
|
-
"generatedAt": "2026-
|
|
4
|
+
"version": "0.1.15",
|
|
5
|
+
"generatedAt": "2026-08-07T17:06:32.907Z",
|
|
6
6
|
"canonicalRepo": "https://github.com/owlmeans/common",
|
|
7
7
|
"entries": [
|
|
8
8
|
{
|
package/build/service.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAA0C,iBAAiB,EAA0G,MAAM,YAAY,CAAA;AASnM,eAAO,MAAM,qBAAqB,GAAI,QAAO,MAAsB,KAAG,
|
|
1
|
+
{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAA0C,iBAAiB,EAA0G,MAAM,YAAY,CAAA;AASnM,eAAO,MAAM,qBAAqB,GAAI,QAAO,MAAsB,KAAG,iBA8PrE,CAAA"}
|
package/build/service.js
CHANGED
|
@@ -9,19 +9,31 @@ export const makeOidcClientService = (alias = DEFAULT_ALIAS) => {
|
|
|
9
9
|
const service = createService(alias, {
|
|
10
10
|
getConfiguration: async (clientId) => {
|
|
11
11
|
const context = assertContext(service.ctx, alias);
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
12
|
+
const cfg = await service.getConfig(clientId);
|
|
13
|
+
// `discoveryUrl` is the canonical, fully-qualified issuer locator: when it is present the
|
|
14
|
+
// provider URL is used verbatim and `service`/`basePath` are irrelevant. Those two are only
|
|
15
|
+
// required by the legacy fallback that reassembles the issuer from a registered service host
|
|
16
|
+
// plus a base path — a shape that forces the relying party to know the provider's URL layout
|
|
17
|
+
// (and to keep it in sync with however the provider itself builds its issuer).
|
|
18
|
+
const discoveryUrl = cfg?.discoveryUrl != null && cfg.discoveryUrl !== ''
|
|
19
|
+
? cfg.discoveryUrl : null;
|
|
20
|
+
if (discoveryUrl == null) {
|
|
21
|
+
if (cfg?.basePath == null) {
|
|
22
|
+
throw new AuthManagerError('oidc.client.basepath');
|
|
23
|
+
}
|
|
24
|
+
if (cfg.service == null) {
|
|
25
|
+
throw new AuthManagerError('oidc.client.service');
|
|
26
|
+
}
|
|
18
27
|
}
|
|
19
|
-
if (typeof clientId === 'object' && clientId.clientId == null && cfg
|
|
28
|
+
if (typeof clientId === 'object' && clientId.clientId == null && cfg?.clientId == null) {
|
|
20
29
|
throw new AuthManagerError('oidc.client.client-id');
|
|
21
30
|
}
|
|
31
|
+
if (cfg == null) {
|
|
32
|
+
throw new AuthManagerError('oidc.client.config');
|
|
33
|
+
}
|
|
22
34
|
// @TODO Add support for any domain (not just registered services)
|
|
23
35
|
const security = makeSecurityHelper(context);
|
|
24
|
-
const url =
|
|
36
|
+
const url = discoveryUrl
|
|
25
37
|
?? security.makeUrl(context.cfg.services[cfg.service], cfg.basePath);
|
|
26
38
|
return await client.discovery(new URL(url), cfg.idOverride ?? (typeof clientId === 'string' ? clientId : clientId.clientId), cfg.secret, undefined, {
|
|
27
39
|
execute: [
|
package/build/service.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC5F,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAGhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,2CAA2C;AAE3C,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAgB,aAAa,EAAqB,EAAE;IACxF,MAAM,OAAO,GAAsB,aAAa,CAAoB,KAAK,EAAE;QACzE,gBAAgB,EAAE,KAAK,EAAC,QAAQ,EAAC,EAAE;YACjC,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,EAAE,KAAK,CAAC,CAAA;YAC7E,
|
|
1
|
+
{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC5F,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAGhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,2CAA2C;AAE3C,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAgB,aAAa,EAAqB,EAAE;IACxF,MAAM,OAAO,GAAsB,aAAa,CAAoB,KAAK,EAAE;QACzE,gBAAgB,EAAE,KAAK,EAAC,QAAQ,EAAC,EAAE;YACjC,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,EAAE,KAAK,CAAC,CAAA;YAC7E,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YAE7C,0FAA0F;YAC1F,4FAA4F;YAC5F,6FAA6F;YAC7F,6FAA6F;YAC7F,+EAA+E;YAC/E,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,IAAI,IAAI,GAAG,CAAC,YAAY,KAAK,EAAE;gBACvE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAA;YAE3B,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;gBACzB,IAAI,GAAG,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC;oBAC1B,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAA;gBACpD,CAAC;gBAED,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;oBACxB,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,CAAA;gBACnD,CAAC;YACH,CAAC;YAED,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,IAAI,IAAI,GAAG,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC;gBACvF,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,CAAC,CAAA;YACrD,CAAC;YAED,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;gBAChB,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAA;YAClD,CAAC;YAED,kEAAkE;YAClE,MAAM,QAAQ,GAAG,kBAAkB,CAAkB,OAAO,CAAC,CAAA;YAC7D,MAAM,GAAG,GAAG,YAAY;mBACnB,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAQ,CAAC,EAAE,GAAG,CAAC,QAAS,CAAC,CAAA;YAExE,OAAO,MAAM,MAAM,CAAC,SAAS,CAC3B,IAAI,GAAG,CAAC,GAAG,CAAQ,EACnB,GAAG,CAAC,UAAU,IAAI,CAChB,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAS,CAC7D,EACD,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE;gBACvB,OAAO,EAAE;oBACP,2CAA2C;oBAC3C,MAAM,CAAC,qBAAqB;iBAC7B;aACF,CAAC,CAAA;QACJ,CAAC;QAED,SAAS,EAAE,KAAK,EAAC,QAAQ,EAAC,EAAE;YAC1B,IAAI,MAAmC,CAAA;YACvC,IAAI,UAAU,GAAyB,IAAI,CAAA;YAC3C,IAAI,SAAiB,CAAA;YACrB,IAAI,QAAQ,YAAY,aAAa,EAAE,CAAC;gBACtC,UAAU,GAAG,QAAQ,CAAA;gBACrB,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC,cAAc,EAAE,CAAC,MAAM,CAAA;YACvD,CAAC;iBAAM,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACxC,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAA;YAC/B,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,QAA8B,CAAA;gBACvC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAA;YAC7B,CAAC;YACD,IAAI,QAAQ,GAAG,MAAM,UAAU,EAAE,cAAc,EAAE,CAAA;YACjD,mCAAmC;YACnC,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,CAAC,CAAA;YACrD,CAAC;YAED,UAAU,KAAK,MAAM,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAA;YAErD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;YAC3C,IAAI,GAAG,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC;gBACxB,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAA;YAClD,CAAC;YAED,QAAQ,KAAK,MAAM,UAAU,CAAC,cAAc,EAAE,CAAA;YAE9C,iFAAiF;YACjF,OAAO;gBACL,WAAW,EAAE,GAAG,EAAE,CAAC,QAAQ;gBAE3B,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,IAAI,SAAS;gBAE9C,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG;gBAEpB,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE;gBAElF,oBAAoB,EAAE,KAAK,IAAI,EAAE,CAC/B,MAAM,CAAC,sBAAsB,CAAC,UAAU,CAA0B;gBAEpE,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;oBAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;oBAC3B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;wBAC9C,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;4BACnB,OAAM;wBACR,CAAC;wBAED,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;oBACrC,CAAC,CAAC,CAAA;oBAEF,MAAM,CAAC,eAAe,KAAK,IAAI,CAAA;oBAE/B,OAAO,MAAM,CAAC,sBAAsB,CAClC,UAAU,EAAE,MAAM,EAAE,MAAsC,CAClC,CAAA;gBAC5B,CAAC;gBAED,OAAO,EAAE,KAAK,EAAC,QAAQ,EAAC,EAAE;oBACxB,MAAM,YAAY,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAA;oBACrF,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;wBACzB,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAA;oBAC7C,CAAC;oBACD,OAAO,MAAM,CAAC,iBAAiB,CAAC,UAAU,EAAE,YAAY,CAAoC,CAAA;gBAC9F,CAAC;gBAED,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,GAAG,cAAc,EAAE,EAAE;oBACpD,MAAM,UAAU,GAAG,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa;wBAClE,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ;4BACzC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAA;oBACzB,OAAO,MAAM,CAAC,kBAAkB,CAAC,UAAU,EAAE,UAAoB,CAAuC,CAAA;gBAC1G,CAAC;aAE0B,CAAA;QAC/B,CAAC;QAED,SAAS,EAAE,KAAK,EAAC,QAAQ,EAAC,EAAE;YAC1B,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,EAAE,KAAK,CAAC,CAAA;YAE7E,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,IAAI,IAAI,QAAQ,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC1F,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,CAAC,CAAA;YACrD,CAAC;YAED,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;gBACjD,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBACjC,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAA;gBACvC,CAAC;gBACD,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,KAAK,CACnC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,IAAI,QAAQ,CAAC,GAA4B,CAAC,KAAK,KAAK,CACpF,CAAA;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;QAED,UAAU,EAAE,GAAG,EAAE;YACf,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,EAAE,KAAK,CAAC,CAAA;YAE7E,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAA;QAC7E,CAAC;QAED,WAAW,EAAE,GAAG,EAAE;YAChB,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,EAAE,KAAK,CAAC,CAAA;YAC7E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA;YAC5B,MAAM,kBAAkB,GAAG,GAAG,CAAC,kBAAkB,IAAI,qBAAqB,CAAA;YAC1E,IAAI,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC3C,OAAO,OAAO,CAAC,OAAO,CAAqB,kBAAkB,CAAC,CAAA;YAChE,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,cAAc,EAAE,GAAG,EAAE;YACnB,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,EAAE,KAAK,CAAC,CAAA;YAC7E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA;YAC5B,MAAM,qBAAqB,GAAG,GAAG,CAAC,qBAAqB,IAAI,wBAAwB,CAAA;YACnF,IAAI,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBAC9C,OAAO,OAAO,CAAC,OAAO,CAAwB,qBAAqB,CAAC,CAAA;YACtE,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,YAAY,EAAE,SAAS,CAAC,EAAE;YACxB,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,EAAE,KAAK,CAAC,CAAA;YAC7E,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC3D,CAAC;QAED,WAAW,EAAE,MAAM,CAAC,EAAE;YACpB,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YAChD,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;gBACnC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAA;YAC7B,CAAC;YAED,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAC5C,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC/B,OAAO,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAA;gBACrC,CAAC;gBACD,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CACjC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAA4B,CAAC,KAAK,KAAK,CACnE,CAAA;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;QAED,yBAAyB,EAAE,MAAM,CAAC,EAAE;YAClC,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YAChD,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;gBACnC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAA;YAC7B,CAAC;YACD,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAA8B,CAAA;YAC7D,IAAI,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAC3D,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,GAA4B,CAAC,KAAK,MAAM,CAAC,GAA0B,CAAC,CACrF,CAAC,CAAA;YACF,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;gBACrB,QAAQ,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,CAAA;gBAC1C,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC1B,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;gBAC/B,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;gBAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAA;YACzB,CAAC;YAED,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,gBAAgB,EAAE,MAAM,CAAC,EAAE;YACzB,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YAChD,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;gBACnC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAA;YAC7B,CAAC;YAED,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAC1C,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CACtC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAA4B,CAAC,KAAK,KAAK,CACnE,CACF,CAAA;YACD,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,CAAC,CAAA;YACrD,CAAC;YAED,OAAO,QAAQ,CAAC,QAAQ,CAAA;QAC1B,CAAC;QAED,2BAA2B,EAAE,MAAM,CAAC,EAAE;YACpC,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YAChD,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;gBACnC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAA;YAC7B,CAAC;YACD,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAA8B,CAAA;YAE7D,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAC7B,QAAQ,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAC7B,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;gBACrB,QAAQ,CAAC,GAA4B,CAAC,KAAK,MAAM,CAAC,GAA0B,CAAC,CAChF,CACF,CAAA;YACD,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;gBACZ,OAAM;YACR,CAAC;YACD,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;YAE/B,IAAI,EAAE,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;YAC1B,CAAC;QACH,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,aAAa,GAAG;IACpB,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU;CAC/D,CAAA;AAED,MAAM,WAAW,GAAG,MAAM,CAAC,gCAAgC,CAAC,CAAA"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@owlmeans/server-oidc-rp",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.15",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"scripts": {
|
|
@@ -37,30 +37,29 @@
|
|
|
37
37
|
},
|
|
38
38
|
"devDependencies": {
|
|
39
39
|
"@owlmeans/dep-config": "workspace:*",
|
|
40
|
-
"@owlmeans/test-auth": "^0.1.
|
|
41
|
-
"@types/bun": "^1.3.
|
|
42
|
-
"@types/node": "^
|
|
43
|
-
"nodemon": "^3.1.
|
|
44
|
-
"
|
|
45
|
-
"typescript": "^6.0.2"
|
|
40
|
+
"@owlmeans/test-auth": "^0.1.15",
|
|
41
|
+
"@types/bun": "^1.3.14",
|
|
42
|
+
"@types/node": "^26.1.0",
|
|
43
|
+
"nodemon": "^3.1.14",
|
|
44
|
+
"typescript": "^6.0.3"
|
|
46
45
|
},
|
|
47
46
|
"dependencies": {
|
|
48
47
|
"@noble/hashes": "^1.5.0",
|
|
49
|
-
"@owlmeans/auth": "^0.1.
|
|
50
|
-
"@owlmeans/auth-common": "^0.1.
|
|
51
|
-
"@owlmeans/basic-envelope": "^0.1.
|
|
52
|
-
"@owlmeans/client-entrypoint": "^0.1.
|
|
53
|
-
"@owlmeans/config": "^0.1.
|
|
54
|
-
"@owlmeans/context": "^0.1.
|
|
55
|
-
"@owlmeans/did": "^0.1.
|
|
56
|
-
"@owlmeans/entrypoint": "^0.1.
|
|
57
|
-
"@owlmeans/oidc": "^0.1.
|
|
58
|
-
"@owlmeans/resource": "^0.1.
|
|
59
|
-
"@owlmeans/route": "^0.1.
|
|
60
|
-
"@owlmeans/server-api": "^0.1.
|
|
61
|
-
"@owlmeans/server-auth": "^0.1.
|
|
62
|
-
"@owlmeans/server-context": "^0.1.
|
|
63
|
-
"@owlmeans/server-entrypoint": "^0.1.
|
|
48
|
+
"@owlmeans/auth": "^0.1.15",
|
|
49
|
+
"@owlmeans/auth-common": "^0.1.15",
|
|
50
|
+
"@owlmeans/basic-envelope": "^0.1.15",
|
|
51
|
+
"@owlmeans/client-entrypoint": "^0.1.15",
|
|
52
|
+
"@owlmeans/config": "^0.1.15",
|
|
53
|
+
"@owlmeans/context": "^0.1.15",
|
|
54
|
+
"@owlmeans/did": "^0.1.15",
|
|
55
|
+
"@owlmeans/entrypoint": "^0.1.15",
|
|
56
|
+
"@owlmeans/oidc": "^0.1.15",
|
|
57
|
+
"@owlmeans/resource": "^0.1.15",
|
|
58
|
+
"@owlmeans/route": "^0.1.15",
|
|
59
|
+
"@owlmeans/server-api": "^0.1.15",
|
|
60
|
+
"@owlmeans/server-auth": "^0.1.15",
|
|
61
|
+
"@owlmeans/server-context": "^0.1.15",
|
|
62
|
+
"@owlmeans/server-entrypoint": "^0.1.15",
|
|
64
63
|
"@scure/base": "^1.1.9",
|
|
65
64
|
"dayjs": "^1.11.13",
|
|
66
65
|
"jose": "6.2.3",
|
package/src/service.ts
CHANGED
|
@@ -13,24 +13,38 @@ export const makeOidcClientService = (alias: string = DEFAULT_ALIAS): OidcClient
|
|
|
13
13
|
const service: OidcClientService = createService<OidcClientService>(alias, {
|
|
14
14
|
getConfiguration: async clientId => {
|
|
15
15
|
const context = assertContext<Config, Context>(service.ctx as Context, alias)
|
|
16
|
-
|
|
16
|
+
const cfg = await service.getConfig(clientId)
|
|
17
|
+
|
|
18
|
+
// `discoveryUrl` is the canonical, fully-qualified issuer locator: when it is present the
|
|
19
|
+
// provider URL is used verbatim and `service`/`basePath` are irrelevant. Those two are only
|
|
20
|
+
// required by the legacy fallback that reassembles the issuer from a registered service host
|
|
21
|
+
// plus a base path — a shape that forces the relying party to know the provider's URL layout
|
|
22
|
+
// (and to keep it in sync with however the provider itself builds its issuer).
|
|
23
|
+
const discoveryUrl = cfg?.discoveryUrl != null && cfg.discoveryUrl !== ''
|
|
24
|
+
? cfg.discoveryUrl : null
|
|
25
|
+
|
|
26
|
+
if (discoveryUrl == null) {
|
|
27
|
+
if (cfg?.basePath == null) {
|
|
28
|
+
throw new AuthManagerError('oidc.client.basepath')
|
|
29
|
+
}
|
|
17
30
|
|
|
18
|
-
|
|
19
|
-
|
|
31
|
+
if (cfg.service == null) {
|
|
32
|
+
throw new AuthManagerError('oidc.client.service')
|
|
33
|
+
}
|
|
20
34
|
}
|
|
21
35
|
|
|
22
|
-
if (
|
|
23
|
-
throw new AuthManagerError('oidc.client.
|
|
36
|
+
if (typeof clientId === 'object' && clientId.clientId == null && cfg?.clientId == null) {
|
|
37
|
+
throw new AuthManagerError('oidc.client.client-id')
|
|
24
38
|
}
|
|
25
39
|
|
|
26
|
-
if (
|
|
27
|
-
throw new AuthManagerError('oidc.client.
|
|
40
|
+
if (cfg == null) {
|
|
41
|
+
throw new AuthManagerError('oidc.client.config')
|
|
28
42
|
}
|
|
29
43
|
|
|
30
44
|
// @TODO Add support for any domain (not just registered services)
|
|
31
45
|
const security = makeSecurityHelper<Config, Context>(context)
|
|
32
|
-
const url =
|
|
33
|
-
?? security.makeUrl(context.cfg.services[cfg.service], cfg.basePath)
|
|
46
|
+
const url = discoveryUrl
|
|
47
|
+
?? security.makeUrl(context.cfg.services[cfg.service!], cfg.basePath!)
|
|
34
48
|
|
|
35
49
|
return await client.discovery(
|
|
36
50
|
new URL(url) as URL,
|