@owlmeans/server-oidc-rp 0.1.15 → 0.1.16

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (23) hide show
  1. package/README.md +3 -4
  2. package/agent-meta/manifest.json +4 -11
  3. package/agent-meta/skills/server-oidc-rp/SKILL.md +16 -1
  4. package/build/actions/init.d.ts.map +1 -1
  5. package/build/actions/init.js +2 -1
  6. package/build/actions/init.js.map +1 -1
  7. package/build/auth/plugins/oidc-client.d.ts.map +1 -1
  8. package/build/auth/plugins/oidc-client.js +2 -1
  9. package/build/auth/plugins/oidc-client.js.map +1 -1
  10. package/build/index.d.ts +1 -0
  11. package/build/index.d.ts.map +1 -1
  12. package/build/index.js +1 -0
  13. package/build/index.js.map +1 -1
  14. package/build/utils/scope.d.ts +11 -0
  15. package/build/utils/scope.d.ts.map +1 -0
  16. package/build/utils/scope.js +15 -0
  17. package/build/utils/scope.js.map +1 -0
  18. package/package.json +17 -17
  19. package/src/actions/init.ts +2 -1
  20. package/src/auth/plugins/oidc-client.ts +2 -1
  21. package/src/index.ts +1 -0
  22. package/src/utils/scope.ts +15 -0
  23. package/agent-meta/instructions/server-oidc-rp.instructions.md +0 -102
package/README.md CHANGED
@@ -107,10 +107,9 @@ const oidc = context.service<OidcClientService>(OIDC_SERVICE)
107
107
  <!-- owlmeans:agent-guidance:start -->
108
108
  ## Agent guidance
109
109
 
110
- This package ships embedded Claude Code skills and GitHub Copilot instructions under
111
- `agent-meta/`. After installing your `@owlmeans/*` packages, run the OwlMeans
112
- agent-skills installer to place them into your project's native locations
113
- (`.claude/skills/` and `.github/instructions/`):
110
+ This package ships embedded agent skills under `agent-meta/`. After installing your
111
+ `@owlmeans/*` packages, run the OwlMeans agent-skills installer to place them into
112
+ your project's skill store (`.agents/skills/`):
114
113
 
115
114
  ```sh
116
115
  npx @owlmeans/agent-skills
package/agent-meta/manifest.json CHANGED
@@ -1,8 +1,8 @@
1
1
  {
2
- "schemaVersion": 1,
2
+ "schemaVersion": 2,
3
3
  "package": "@owlmeans/server-oidc-rp",
4
- "version": "0.1.15",
5
- "generatedAt": "2026-08-07T17:06:32.907Z",
4
+ "version": "0.1.16",
5
+ "generatedAt": "2026-08-14T10:14:48.855Z",
6
6
  "canonicalRepo": "https://github.com/owlmeans/common",
7
7
  "entries": [
8
8
  {
@@ -10,14 +10,7 @@
10
10
  "name": "server-oidc-rp",
11
11
  "category": "package-specific",
12
12
  "file": "skills/server-oidc-rp/SKILL.md",
13
- "canonicalPath": ".claude/skills/server-oidc-rp/SKILL.md"
14
- },
15
- {
16
- "kind": "instruction",
17
- "name": "server-oidc-rp",
18
- "category": "package-specific",
19
- "file": "instructions/server-oidc-rp.instructions.md",
20
- "canonicalPath": ".github/instructions/server-oidc-rp.instructions.md"
13
+ "canonicalPath": ".agents/skills/server-oidc-rp/SKILL.md"
21
14
  }
22
15
  ]
23
16
  }
package/agent-meta/skills/server-oidc-rp/SKILL.md CHANGED
@@ -8,7 +8,7 @@ user-invocable: false
8
8
  # @owlmeans/server-oidc-rp
9
9
 
10
10
  **Layer:** Server
11
- **Install:** `"@owlmeans/server-oidc-rp": "^0.1.15"` in `dependencies`
11
+ **Install:** `"@owlmeans/server-oidc-rp": "^0.1.16"` in `dependencies`
12
12
 
13
13
  ## Key Exports
14
14
 
@@ -18,9 +18,24 @@ user-invocable: false
18
18
  | `makeOidcWrappingService()` | OIDC token service factory |
19
19
  | `makeOidcGate()` | OIDC gate factory (used by guards) |
20
20
  | `setupOidcGuard(modules, options?)` | Wire OIDC guard onto module declarations |
21
+ | `requestedScope(extraScopes?)` | The `scope` of an authorization request — base scopes + provider extras |
21
22
  | Constants | OIDC service / guard aliases |
22
23
  | `OidcRp` types | RP-side config and token shapes |
23
24
 
25
+ ## Requested scope
26
+
27
+ Every authorization request this package builds gets its `scope` from `requestedScope(cfg.extraScopes)`
28
+ — `OIDC_RP_BASE_SCOPES` (`@owlmeans/oidc`) plus the provider descriptor's `extraScopes`, deduplicated.
29
+ Both request sites (`actions/init.ts` for the browser-starts-server-finishes flow, and the
30
+ `oidc-client` auth plugin) call it; never write a scope literal at a call site, and never let the two
31
+ drift apart.
32
+
33
+ The provider's client registration must allow every scope this yields. A provider supports `email`
34
+ as soon as it declares `claims.email` — and then rejects the whole request with
35
+ `invalid_scope: requested scope is not allowed` if the client's own allowlist omits it, rather than
36
+ dropping the scope. A client provisioned by an older revision therefore stays broken until its
37
+ allowlist is backfilled.
38
+
24
39
  ## Subpath Exports
25
40
 
26
41
  - `./auth` — auth integration helpers
package/build/actions/init.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/actions/init.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAiBzE,eAAO,MAAM,IAAI,EAAE,sBAmFjB,CAAA"}
1
+ {"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/actions/init.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAkBzE,eAAO,MAAM,IAAI,EAAE,sBAmFjB,CAAA"}
package/build/actions/init.js CHANGED
@@ -8,6 +8,7 @@ import { base64urlnopad as base64 } from '@scure/base';
8
8
  import { randomBytes } from '@noble/hashes/utils';
9
9
  import { sha256 } from '@noble/hashes/sha2';
10
10
  import { cache, verifierId } from '../utils/cache.js';
11
+ import { requestedScope } from '../utils/scope.js';
11
12
  import { AUTHEN_TIMEFRAME } from '@owlmeans/server-auth';
12
13
  export const init = handleBody(async (body, ctx) => {
13
14
  if (body.entity == null) {
@@ -67,7 +68,7 @@ export const init = handleBody(async (body, ctx) => {
67
68
  const [dispatcherUrl] = await context.entrypoint(DISPATCHER).call();
68
69
  const cfg = client.getConfig();
69
70
  const url = client.makeAuthUrl({
70
- scope: `openid profile email ${cfg?.extraScopes ?? ''}`,
71
+ scope: requestedScope(cfg?.extraScopes),
71
72
  code_challenge: challenge,
72
73
  code_challenge_method: 'S256',
73
74
  redirect_uri: dispatcherUrl,
package/build/actions/init.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/actions/init.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEjD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAGjD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACzD,qDAAqD;AACrD,8CAA8C;AAE9C,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAExD,MAAM,CAAC,MAAM,IAAI,GAA2B,UAAU,CAAC,KAAK,EAAE,IAAwB,EAAE,GAAG,EAAE,EAAE;IAC7F,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IACxC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAA;IAE5B,MAAM,OAAO,GAAG,aAAa,CAAkB,GAAG,CAAC,CAAA;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;IAE9D,IAAI,MAAM,GAA6B,IAAI,CAAA;IAE3C,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;IACzC,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;IAChD,CAAC;IACD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,yCAAyC;QACzC;;;WAGG;QACH,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAC1C,WAAW,CAAC,QAAQ,CAAC,IAAI,CAC1B,CAAC,IAAI,CAAC;YACL,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE;YAC7D,KAAK,EAAE,EAAE,QAAQ,EAAE;SACpB,CAAC,CAAA;QAEF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,WAAW,EAAE,CAAA;QACzB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,qDAAqD,EAAE,SAAS,CAAC,CAAA;QAE7E,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,CAAA;QACzE,iFAAiF;QACjF,IAAI,QAAQ,IAAI,IAAI,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC1C,OAAO,QAAQ,CAAC,GAAG,CAAA;QACrB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAA;QAChD,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;QAEjC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,EAAE,CAAA;QACzB,CAAC;QACD,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,oEAAoE;IACpE,+FAA+F;IAC/F,WAAW;IACX,oCAAoC;IACpC,8DAA8D;IAC9D,OAAO;IACP,IAAI;IAEJ,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;IAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEjD,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAA;IAE3H,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAC1B,EAAE,EAAE,UAAU,CAAC,SAAS,CAAC;QACzB,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE;QAC5B,QAAQ;KACT,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;IAEpC,MAAM,CAAC,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAA2B,UAAU,CAAC,CAAC,IAAI,EAAE,CAAA;IAE7F,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;IAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC;QAC7B,KAAK,EAAE,wBAAwB,GAAG,EAAE,WAAW,IAAI,EAAE,EAAE;QACvD,cAAc,EAAE,SAAS;QACzB,qBAAqB,EAAE,MAAM;QAC7B,YAAY,EAAE,aAAa;KAC5B,CAAC,CAAA;IAEF,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAA;IAE9B,OAAO,GAAG,CAAA;AACZ,CAAC,CAAC,CAAA"}
1
+ {"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/actions/init.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEjD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAGjD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACzD,qDAAqD;AACrD,8CAA8C;AAE9C,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAExD,MAAM,CAAC,MAAM,IAAI,GAA2B,UAAU,CAAC,KAAK,EAAE,IAAwB,EAAE,GAAG,EAAE,EAAE;IAC7F,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IACxC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAA;IAE5B,MAAM,OAAO,GAAG,aAAa,CAAkB,GAAG,CAAC,CAAA;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;IAE9D,IAAI,MAAM,GAA6B,IAAI,CAAA;IAE3C,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;IACzC,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;IAChD,CAAC;IACD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,yCAAyC;QACzC;;;WAGG;QACH,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAC1C,WAAW,CAAC,QAAQ,CAAC,IAAI,CAC1B,CAAC,IAAI,CAAC;YACL,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE;YAC7D,KAAK,EAAE,EAAE,QAAQ,EAAE;SACpB,CAAC,CAAA;QAEF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,WAAW,EAAE,CAAA;QACzB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,qDAAqD,EAAE,SAAS,CAAC,CAAA;QAE7E,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,CAAA;QACzE,iFAAiF;QACjF,IAAI,QAAQ,IAAI,IAAI,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC1C,OAAO,QAAQ,CAAC,GAAG,CAAA;QACrB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAA;QAChD,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;QAEjC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,EAAE,CAAA;QACzB,CAAC;QACD,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,oEAAoE;IACpE,+FAA+F;IAC/F,WAAW;IACX,oCAAoC;IACpC,8DAA8D;IAC9D,OAAO;IACP,IAAI;IAEJ,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;IAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEjD,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAA;IAE3H,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAC1B,EAAE,EAAE,UAAU,CAAC,SAAS,CAAC;QACzB,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE;QAC5B,QAAQ;KACT,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;IAEpC,MAAM,CAAC,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAA2B,UAAU,CAAC,CAAC,IAAI,EAAE,CAAA;IAE7F,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;IAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC;QAC7B,KAAK,EAAE,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC;QACvC,cAAc,EAAE,SAAS;QACzB,qBAAqB,EAAE,MAAM;QAC7B,YAAY,EAAE,aAAa;KAC5B,CAAC,CAAA;IAEF,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAA;IAE9B,OAAO,GAAG,CAAA;AACZ,CAAC,CAAC,CAAA"}
package/build/auth/plugins/oidc-client.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"oidc-client.d.ts","sourceRoot":"","sources":["../../../src/auth/plugins/oidc-client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAA;AACvE,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAqB,MAAM,gBAAgB,CAAA;AAgBxE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,KAAG,UAqLrF,CAAA"}
1
+ {"version":3,"file":"oidc-client.d.ts","sourceRoot":"","sources":["../../../src/auth/plugins/oidc-client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAA;AACvE,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAqB,MAAM,gBAAgB,CAAA;AAiBxE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,KAAG,UAqLrF,CAAA"}
package/build/auth/plugins/oidc-client.js CHANGED
@@ -10,6 +10,7 @@ import { decodeJwt } from 'jose';
10
10
  import { KEY_OWL } from '@owlmeans/did';
11
11
  import { cache, verifierId } from '../../utils/cache.js';
12
12
  import { makeOidcAuthentication } from '../../utils/auth.js';
13
+ import { requestedScope } from '../../utils/scope.js';
13
14
  // import { URL } from 'url'
14
15
  /**
15
16
  * Actually the most of implementation desceibed here is a proprietary one and
@@ -97,7 +98,7 @@ export const oidcClientPlugin = (context) => {
97
98
  const client = await oidc.getClient(entityId);
98
99
  const cfg = client.getConfig();
99
100
  const url = client.makeAuthUrl({
100
- scope: `openid profile email ${cfg?.extraScopes ?? ''}`,
101
+ scope: requestedScope(cfg?.extraScopes),
101
102
  code_challenge: challenge,
102
103
  code_challenge_method: 'S256',
103
104
  redirect_uri: request.source,
package/build/auth/plugins/oidc-client.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"oidc-client.js","sourceRoot":"","sources":["../../../src/auth/plugins/oidc-client.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAA;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEjD,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzG,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAC5D,4BAA4B;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAyC,OAAU,EAAc,EAAE;IACjG,MAAM,YAAY,GAAG,sBAAsB,CAAO,OAAO,CAAC,CAAA;IAE1D,MAAM,MAAM,GAAe;QACzB,IAAI,EAAE,gBAAgB;QAEtB,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACpB,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAEhC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,KAAK,KAAK,EAAE,CAAC;gBACnD,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAA;YAC7C,CAAC;YAED,mEAAmE;YACnE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;YAC9D,IAAI,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAA;YAEpD,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YAED,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACpF,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC;mBAClD,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;YAEjD,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;YAEnH,MAAM,KAAK,CAAO,OAAO,CAAC,CAAC,MAAM,CAAC;gBAChC,EAAE,EAAE,UAAU,CAAC,SAAS,CAAC;gBACzB,QAAQ;gBACR,MAAM,EAAE,QAAQ;aACjB,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;YAEpC,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAA;YAC9C,CAAC;YAED,8CAA8C;YAE9C,qDAAqD;YACrD,yCAAyC;YACzC,IAAI;YAEJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;YAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC;gBAC7B,KAAK,EAAE,wBAAwB,GAAG,EAAE,WAAW,IAAI,EAAE,EAAE;gBACvD,cAAc,EAAE,SAAS;gBACzB,qBAAqB,EAAE,MAAM;gBAC7B,YAAY,EAAE,OAAO,CAAC,MAAM;aAC7B,CAAC,CAAA;YAEF,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAA;QAC3B,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;YAC9B,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,aAAa,CAAC,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,CAAA;YAErE,IAAI,QAAQ,CAAC,QAAQ,IAAI,IAAI,IAAI,QAAQ,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;gBAC/D,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;YAC9D,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAExC,IAAI,GAAG,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;gBACpB,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAA;YACnC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAA;YAClD,CAAC;YAED,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBACxB,MAAM,IAAI,gBAAgB,CAAC,cAAc,CAAC,CAAA;YAC5C,CAAC;YAED,IAAI,OAAO,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC;gBACzC,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,MAAM,EAAE,GAAG,CAAC,GAAG;aACiB,CAAC,CAAA;YAEnC,oEAAoE;YACpE,6CAA6C;YAC7C,oEAAoE;YACpE,sEAAsE;YACtE,IAAI,OAAwB,CAAA;YAC5B,IAAI,GAAG,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBACd,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;gBACvD,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,oBAAoB,EAAE,CAAA;gBAC1D,IAAI,WAAW,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;oBACrC,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAA;gBACzC,CAAC;gBACD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;gBAC9B,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;oBAChB,mEAAmE;oBACnE,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAA;gBAC7C,CAAC;gBACD,OAAO,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,CAAA;YACvE,CAAC;iBAAM,CAAC;gBACN,2EAA2E;gBAC3E,yCAAyC;gBACzC,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAA;YAC3C,CAAC;YAED;YACE,iBAAiB;YACjB,OAAO,IAAI,IAAI;gBACf,yDAAyD;mBACtD,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC,EACjG,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBACd,OAAO,CAAC,YAAY,KAAK,GAAG,CAAC,QAAQ,IAAI,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,GAAG,CAAC,eAAe,CAAA;gBAC7F,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;oBAChE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAA;gBAC9C,CAAC;gBACD,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAA;gBACpF,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;oBAC7B,oFAAoF;oBACpF,gFAAgF;oBAChF,MAAM,IAAI,gBAAgB,CAAC,YAAY,CAAC,CAAA;gBAC1C,CAAC;gBAGD,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;gBAElG,4DAA4D;gBAC5D,uCAAuC;gBACvC,IAAI,OAAO,IAAI,IAAI,IAAI,CACrB,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,GAAG,CAAC,eAAe;oBAChD,4CAA4C;oBAC5C,iEAAiE;oBACjE,wEAAwE;oBACxE,8DAA8D;oBAC9D,oEAAoE;oBACpE,kFAAkF;oBAClF,4EAA4E;oBAC5E,oFAAoF;oBACpF,uDAAuD;uBACpD,OAAO,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,CACrC,EAAE,CAAC;oBACF,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;oBACvB,OAAO,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC;wBAChC,GAAG,OAAO;wBACV,OAAO,EAAE,GAAG,CAAC,OAAO;wBACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;wBACtB,IAAI,EAAE,gBAAgB;qBACvB,EAAE;wBACD,QAAQ,EAAE,GAAG,CAAC,kBAA4B,IAAI,OAAO,CAAC,QAAQ;wBAC9D,kFAAkF;wBAClF,KAAK,EAAE,KAAK;qBACb,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YAEd,UAAU,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,CAAA;YAChC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAA;YAChC,UAAU,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;YAC/B,UAAU,CAAC,IAAI,GAAG,gBAAgB,CAAA;YAClC,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;YAClC,UAAU,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;YACxC,UAAU,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;YAEtC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAA;QACjC,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}
1
+ {"version":3,"file":"oidc-client.js","sourceRoot":"","sources":["../../../src/auth/plugins/oidc-client.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAA;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEjD,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzG,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,4BAA4B;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAyC,OAAU,EAAc,EAAE;IACjG,MAAM,YAAY,GAAG,sBAAsB,CAAO,OAAO,CAAC,CAAA;IAE1D,MAAM,MAAM,GAAe;QACzB,IAAI,EAAE,gBAAgB;QAEtB,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACpB,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAEhC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,KAAK,KAAK,EAAE,CAAC;gBACnD,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAA;YAC7C,CAAC;YAED,mEAAmE;YACnE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;YAC9D,IAAI,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAA;YAEpD,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YAED,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACpF,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC;mBAClD,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;YAEjD,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;YAEnH,MAAM,KAAK,CAAO,OAAO,CAAC,CAAC,MAAM,CAAC;gBAChC,EAAE,EAAE,UAAU,CAAC,SAAS,CAAC;gBACzB,QAAQ;gBACR,MAAM,EAAE,QAAQ;aACjB,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;YAEpC,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAA;YAC9C,CAAC;YAED,8CAA8C;YAE9C,qDAAqD;YACrD,yCAAyC;YACzC,IAAI;YAEJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;YAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC;gBAC7B,KAAK,EAAE,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC;gBACvC,cAAc,EAAE,SAAS;gBACzB,qBAAqB,EAAE,MAAM;gBAC7B,YAAY,EAAE,OAAO,CAAC,MAAM;aAC7B,CAAC,CAAA;YAEF,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAA;QAC3B,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;YAC9B,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,aAAa,CAAC,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,CAAA;YAErE,IAAI,QAAQ,CAAC,QAAQ,IAAI,IAAI,IAAI,QAAQ,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;gBAC/D,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;YAC9D,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAExC,IAAI,GAAG,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;gBACpB,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAA;YACnC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAA;YAClD,CAAC;YAED,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBACxB,MAAM,IAAI,gBAAgB,CAAC,cAAc,CAAC,CAAA;YAC5C,CAAC;YAED,IAAI,OAAO,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC;gBACzC,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,MAAM,EAAE,GAAG,CAAC,GAAG;aACiB,CAAC,CAAA;YAEnC,oEAAoE;YACpE,6CAA6C;YAC7C,oEAAoE;YACpE,sEAAsE;YACtE,IAAI,OAAwB,CAAA;YAC5B,IAAI,GAAG,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBACd,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;gBACvD,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,oBAAoB,EAAE,CAAA;gBAC1D,IAAI,WAAW,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;oBACrC,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAA;gBACzC,CAAC;gBACD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;gBAC9B,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;oBAChB,mEAAmE;oBACnE,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAA;gBAC7C,CAAC;gBACD,OAAO,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,CAAA;YACvE,CAAC;iBAAM,CAAC;gBACN,2EAA2E;gBAC3E,yCAAyC;gBACzC,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAA;YAC3C,CAAC;YAED;YACE,iBAAiB;YACjB,OAAO,IAAI,IAAI;gBACf,yDAAyD;mBACtD,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC,EACjG,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBACd,OAAO,CAAC,YAAY,KAAK,GAAG,CAAC,QAAQ,IAAI,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,GAAG,CAAC,eAAe,CAAA;gBAC7F,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;oBAChE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAA;gBAC9C,CAAC;gBACD,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAA;gBACpF,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;oBAC7B,oFAAoF;oBACpF,gFAAgF;oBAChF,MAAM,IAAI,gBAAgB,CAAC,YAAY,CAAC,CAAA;gBAC1C,CAAC;gBAGD,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;gBAElG,4DAA4D;gBAC5D,uCAAuC;gBACvC,IAAI,OAAO,IAAI,IAAI,IAAI,CACrB,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,GAAG,CAAC,eAAe;oBAChD,4CAA4C;oBAC5C,iEAAiE;oBACjE,wEAAwE;oBACxE,8DAA8D;oBAC9D,oEAAoE;oBACpE,kFAAkF;oBAClF,4EAA4E;oBAC5E,oFAAoF;oBACpF,uDAAuD;uBACpD,OAAO,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,CACrC,EAAE,CAAC;oBACF,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;oBACvB,OAAO,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC;wBAChC,GAAG,OAAO;wBACV,OAAO,EAAE,GAAG,CAAC,OAAO;wBACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;wBACtB,IAAI,EAAE,gBAAgB;qBACvB,EAAE;wBACD,QAAQ,EAAE,GAAG,CAAC,kBAA4B,IAAI,OAAO,CAAC,QAAQ;wBAC9D,kFAAkF;wBAClF,KAAK,EAAE,KAAK;qBACb,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YAEd,UAAU,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,CAAA;YAChC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAA;YAChC,UAAU,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;YAC/B,UAAU,CAAC,IAAI,GAAG,gBAAgB,CAAA;YAClC,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;YAClC,UAAU,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;YACxC,UAAU,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;YAEtC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAA;QACjC,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}
package/build/index.d.ts CHANGED
@@ -7,4 +7,5 @@ export * from './modules.js';
7
7
  export * from './wrapper.js';
8
8
  export { createGateModel } from './model/gate.js';
9
9
  export { extractPermissionSets } from './utils/permissions.js';
10
+ export { requestedScope } from './utils/scope.js';
10
11
  //# sourceMappingURL=index.d.ts.map
package/build/index.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,oBAAoB,EACpB,YAAY,EACZ,sBAAsB,EACtB,eAAe,EACf,kBAAkB,EAClB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,EACZ,MAAM,EACN,OAAO,EACP,qBAAqB,EACrB,WAAW,EACX,kBAAkB,GACnB,MAAM,YAAY,CAAA;AACnB,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,oBAAoB,EACpB,YAAY,EACZ,sBAAsB,EACtB,eAAe,EACf,kBAAkB,EAClB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,EACZ,MAAM,EACN,OAAO,EACP,qBAAqB,EACrB,WAAW,EACX,kBAAkB,GACnB,MAAM,YAAY,CAAA;AACnB,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA"}
package/build/index.js CHANGED
@@ -6,4 +6,5 @@ export * from './modules.js';
6
6
  export * from './wrapper.js';
7
7
  export { createGateModel } from './model/gate.js';
8
8
  export { extractPermissionSets } from './utils/permissions.js';
9
+ export { requestedScope } from './utils/scope.js';
9
10
  //# sourceMappingURL=index.js.map
package/build/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAiBA,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAiBA,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA"}
package/build/utils/scope.d.ts ADDED
@@ -0,0 +1,11 @@
1
+ /**
2
+ * The `scope` an authorization request carries: the base scopes every OwlMeans relying party needs
3
+ * plus the provider-specific extras from `OidcProviderDescriptor.extraScopes`.
4
+ *
5
+ * Deduplicated and trimmed — `extraScopes` is operator-supplied config, and a repeated or empty
6
+ * entry would otherwise reach the provider verbatim. Every consumer of this list must be
7
+ * registered with a provider whose client allows all of it: `oidc-provider` answers `invalid_scope`
8
+ * on a supported-but-not-allowed scope instead of dropping it.
9
+ */
10
+ export declare const requestedScope: (extraScopes?: string | null) => string;
11
+ //# sourceMappingURL=scope.d.ts.map
package/build/utils/scope.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/utils/scope.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GAAI,cAAc,MAAM,GAAG,IAAI,KAAG,MAGhD,CAAA"}
package/build/utils/scope.js ADDED
@@ -0,0 +1,15 @@
1
+ import { OIDC_RP_BASE_SCOPES } from '@owlmeans/oidc';
2
+ /**
3
+ * The `scope` an authorization request carries: the base scopes every OwlMeans relying party needs
4
+ * plus the provider-specific extras from `OidcProviderDescriptor.extraScopes`.
5
+ *
6
+ * Deduplicated and trimmed — `extraScopes` is operator-supplied config, and a repeated or empty
7
+ * entry would otherwise reach the provider verbatim. Every consumer of this list must be
8
+ * registered with a provider whose client allows all of it: `oidc-provider` answers `invalid_scope`
9
+ * on a supported-but-not-allowed scope instead of dropping it.
10
+ */
11
+ export const requestedScope = (extraScopes) => [...new Set([
12
+ ...OIDC_RP_BASE_SCOPES,
13
+ ...(extraScopes ?? '').split(' ').map(scope => scope.trim()).filter(scope => scope !== ''),
14
+ ])].join(' ');
15
+ //# sourceMappingURL=scope.js.map
package/build/utils/scope.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/utils/scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAEpD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,WAA2B,EAAU,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC;QACjF,GAAG,mBAAmB;QACtB,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC;KAC3F,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@owlmeans/server-oidc-rp",
3
- "version": "0.1.15",
3
+ "version": "0.1.16",
4
4
  "license": "MIT",
5
5
  "type": "module",
6
6
  "scripts": {
@@ -37,7 +37,7 @@
37
37
  },
38
38
  "devDependencies": {
39
39
  "@owlmeans/dep-config": "workspace:*",
40
- "@owlmeans/test-auth": "^0.1.15",
40
+ "@owlmeans/test-auth": "^0.1.16",
41
41
  "@types/bun": "^1.3.14",
42
42
  "@types/node": "^26.1.0",
43
43
  "nodemon": "^3.1.14",
@@ -45,21 +45,21 @@
45
45
  },
46
46
  "dependencies": {
47
47
  "@noble/hashes": "^1.5.0",
48
- "@owlmeans/auth": "^0.1.15",
49
- "@owlmeans/auth-common": "^0.1.15",
50
- "@owlmeans/basic-envelope": "^0.1.15",
51
- "@owlmeans/client-entrypoint": "^0.1.15",
52
- "@owlmeans/config": "^0.1.15",
53
- "@owlmeans/context": "^0.1.15",
54
- "@owlmeans/did": "^0.1.15",
55
- "@owlmeans/entrypoint": "^0.1.15",
56
- "@owlmeans/oidc": "^0.1.15",
57
- "@owlmeans/resource": "^0.1.15",
58
- "@owlmeans/route": "^0.1.15",
59
- "@owlmeans/server-api": "^0.1.15",
60
- "@owlmeans/server-auth": "^0.1.15",
61
- "@owlmeans/server-context": "^0.1.15",
62
- "@owlmeans/server-entrypoint": "^0.1.15",
48
+ "@owlmeans/auth": "^0.1.16",
49
+ "@owlmeans/auth-common": "^0.1.16",
50
+ "@owlmeans/basic-envelope": "^0.1.16",
51
+ "@owlmeans/client-entrypoint": "^0.1.16",
52
+ "@owlmeans/config": "^0.1.16",
53
+ "@owlmeans/context": "^0.1.16",
54
+ "@owlmeans/did": "^0.1.16",
55
+ "@owlmeans/entrypoint": "^0.1.16",
56
+ "@owlmeans/oidc": "^0.1.16",
57
+ "@owlmeans/resource": "^0.1.16",
58
+ "@owlmeans/route": "^0.1.16",
59
+ "@owlmeans/server-api": "^0.1.16",
60
+ "@owlmeans/server-auth": "^0.1.16",
61
+ "@owlmeans/server-context": "^0.1.16",
62
+ "@owlmeans/server-entrypoint": "^0.1.16",
63
63
  "@scure/base": "^1.1.9",
64
64
  "dayjs": "^1.11.13",
65
65
  "jose": "6.2.3",
package/src/actions/init.ts CHANGED
@@ -13,6 +13,7 @@ import { base64urlnopad as base64 } from '@scure/base'
13
13
  import { randomBytes } from '@noble/hashes/utils'
14
14
  import { sha256 } from '@noble/hashes/sha2'
15
15
  import { cache, verifierId } from '../utils/cache.js'
16
+ import { requestedScope } from '../utils/scope.js'
16
17
  import { AUTHEN_TIMEFRAME } from '@owlmeans/server-auth'
17
18
 
18
19
  export const init: RefedEntrypointHandler = handleBody(async (body: OIDCAuthInitParams, ctx) => {
@@ -89,7 +90,7 @@ export const init: RefedEntrypointHandler = handleBody(async (body: OIDCAuthInit
89
90
 
90
91
  const cfg = client.getConfig()
91
92
  const url = client.makeAuthUrl({
92
- scope: `openid profile email ${cfg?.extraScopes ?? ''}`,
93
+ scope: requestedScope(cfg?.extraScopes),
93
94
  code_challenge: challenge,
94
95
  code_challenge_method: 'S256',
95
96
  redirect_uri: dispatcherUrl,
package/src/auth/plugins/oidc-client.ts CHANGED
@@ -14,6 +14,7 @@ import { decodeJwt } from 'jose'
14
14
  import { KEY_OWL } from '@owlmeans/did'
15
15
  import { cache, verifierId } from '../../utils/cache.js'
16
16
  import { makeOidcAuthentication } from '../../utils/auth.js'
17
+ import { requestedScope } from '../../utils/scope.js'
17
18
  // import { URL } from 'url'
18
19
 
19
20
  /**
@@ -115,7 +116,7 @@ export const oidcClientPlugin = <C extends Config, T extends Context<C>>(context
115
116
  const client = await oidc.getClient(entityId)
116
117
  const cfg = client.getConfig()
117
118
  const url = client.makeAuthUrl({
118
- scope: `openid profile email ${cfg?.extraScopes ?? ''}`,
119
+ scope: requestedScope(cfg?.extraScopes),
119
120
  code_challenge: challenge,
120
121
  code_challenge_method: 'S256',
121
122
  redirect_uri: request.source,
package/src/index.ts CHANGED
@@ -23,3 +23,4 @@ export * from './modules.js'
23
23
  export * from './wrapper.js'
24
24
  export { createGateModel } from './model/gate.js'
25
25
  export { extractPermissionSets } from './utils/permissions.js'
26
+ export { requestedScope } from './utils/scope.js'
package/src/utils/scope.ts ADDED
@@ -0,0 +1,15 @@
1
+ import { OIDC_RP_BASE_SCOPES } from '@owlmeans/oidc'
2
+
3
+ /**
4
+ * The `scope` an authorization request carries: the base scopes every OwlMeans relying party needs
5
+ * plus the provider-specific extras from `OidcProviderDescriptor.extraScopes`.
6
+ *
7
+ * Deduplicated and trimmed — `extraScopes` is operator-supplied config, and a repeated or empty
8
+ * entry would otherwise reach the provider verbatim. Every consumer of this list must be
9
+ * registered with a provider whose client allows all of it: `oidc-provider` answers `invalid_scope`
10
+ * on a supported-but-not-allowed scope instead of dropping it.
11
+ */
12
+ export const requestedScope = (extraScopes?: string | null): string => [...new Set([
13
+ ...OIDC_RP_BASE_SCOPES,
14
+ ...(extraScopes ?? '').split(' ').map(scope => scope.trim()).filter(scope => scope !== ''),
15
+ ])].join(' ')
package/agent-meta/instructions/server-oidc-rp.instructions.md DELETED
@@ -1,102 +0,0 @@
1
- ---
2
- description: "How to use @owlmeans/server-oidc-rp — OIDC relying party. appendOidcGuard(), makeOidcWrappingService(), makeOidcGate(), setupOidcGuard() to wire OIDC into a server context."
3
- applyTo: "**/context.ts, **/modules.ts, **/*.ts, **/*.tsx"
4
- ---
5
- <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
6
-
7
- # @owlmeans/server-oidc-rp
8
-
9
- **Layer:** Server
10
- **Install:** `"@owlmeans/server-oidc-rp": "^0.1.15"` in `dependencies`
11
-
12
- ## Key Exports
13
-
14
- | Export | Description |
15
- |--------|-------------|
16
- | `appendOidcGuard<C, T>(context)` | Add OIDC auth guard to context |
17
- | `makeOidcWrappingService()` | OIDC token service factory |
18
- | `makeOidcGate()` | OIDC gate factory (used by guards) |
19
- | `setupOidcGuard(modules, options?)` | Wire OIDC guard onto modules |
20
- | Constants | OIDC service / guard aliases |
21
- | `OidcRp` types | RP-side config and token shapes |
22
-
23
- ## Subpath Exports
24
-
25
- - `./auth`, `./auth/plugins`
26
-
27
- ## Usage
28
-
29
- ```typescript
30
- // context.ts
31
- import { appendOidcGuard, makeOidcWrappingService, makeOidcGate } from '@owlmeans/server-oidc-rp'
32
- context.registerService(makeOidcWrappingService())
33
- context.registerService(makeOidcGate())
34
- appendOidcGuard<C, T>(context)
35
-
36
- // modules.ts
37
- import { setupOidcGuard } from '@owlmeans/server-oidc-rp'
38
- setupOidcGuard(appModules)
39
-
40
- // config.ts
41
- cfg.oidc.providers.push({
42
- clientId: OIDC_ADMIN_CLIENT,
43
- basePath: 'realms/master',
44
- service: OIDC_PRODUCT,
45
- secret: '/etc/master-secret/oidc-admin-secret',
46
- internal: true
47
- })
48
- ```
49
-
50
- ## Locating the provider: `discoveryUrl` vs `service` + `basePath`
51
-
52
- `makeOidcClientService().getConfiguration()` resolves the provider URL in one of two ways:
53
-
54
- ```ts
55
- // PREFERRED — one fully-qualified value, no knowledge of the provider's URL layout
56
- cfg.oidc.providers.push({ discoveryUrl: process.env.OIDC_ISSUER_URL, clientId, secret, def: true })
57
-
58
- // LEGACY — reassembled from a registered service host + base path
59
- cfg.oidc.providers.push({ service: OIDC_PRODUCT, basePath: 'realms/my-org', clientId, secret })
60
- ```
61
-
62
- - `basePath` and `service` are required **only** when `discoveryUrl` is absent. A `discoveryUrl`-only
63
- provider is valid (this was not always true — the guards used to throw regardless).
64
- - Prefer `discoveryUrl`. Reassembly forces the relying party to know the provider's URL layout and to
65
- stay in sync with it; when the two disagree the RP silently talks to the wrong provider. Note that
66
- `server-oidc-provider` builds its own issuer with `makeUrl(route, basePath, { base: true })` while
67
- the RP fallback omits `{ base: true }` — so a service route carrying a `base` yields two different
68
- URLs from the same config.
69
- - **`discoveryUrl` must equal the provider's advertised `issuer` byte for byte.** `openid-client`
70
- appends `/.well-known/openid-configuration` and then compares the returned `issuer` with the URL it
71
- was given, failing discovery on any difference (trailing slash, scheme, host). Passing a URL that
72
- already contains `/.well-known/` skips that check — use it only when the provider's issuer genuinely
73
- cannot be known in advance.
74
- - There is **no discovery cache**: every `getConfiguration()` performs a fresh HTTP round-trip, and
75
- `getClient()` calls it per authorize/exchange/refresh/gate check.
76
-
77
- ## `redirect_uri` is the consumer's own dispatcher URL
78
-
79
- `actions/init.ts` builds `redirect_uri` from `context.entrypoint(DISPATCHER).call()` — the app's own
80
- frontend origin + `DISPATCHER_PATH`. It never involves the issuer, and `openid-client` v6 strips
81
- `search`/`hash` on the token-exchange side (`stripParams`), so the authorize and exchange values
82
- match by construction. Do not add query-stripping here.
83
-
84
- ## Product-Viable Usage Notes
85
-
86
- - Viable uses `makeOidcClientService()` to read provider descriptors from `cfg.oidc.providers`, including Google and internal admin providers.
87
- - `findProvider(predicate)`, `hasProvider(params)`, and `entityToClientId(params)` are the preferred provider lookup helpers; avoid scanning config ad hoc in downstream code.
88
- - `setupAuthServiceModules(managerModules, AUTH_API)` exposes provider-list and token-update service modules protected by `GUARD_ED25519`.
89
- - When a downstream app uses OIDC/Google only for login and maps users into `@owlmeans/server-auth-identity`, do not reintroduce `appendOidcGuard()`, `makeOidcGate()`, or `setupOidcGuard()` as product authorization. Use a product-specific `GateService` over local identity data.
90
-
91
- ## Integrated-IAM permissions claim
92
-
93
- - `extractPermissionSets(claim)` (exported) shape-validates a `permissions` token claim into
94
- `PermissionSet[]`; non-conforming claims (e.g. anything Keycloak emits) return `undefined`.
95
- - `authenticate` (actions/process.ts) maps a conforming id_token `permissions` claim into
96
- `Auth.permissions` + `permissioned: true`; the wrapping service re-extracts it on token refresh.
97
- - `createGateModel` is exported for `@owlmeans/server-iam`, whose `makeIamGate` asserts claims first
98
- and falls back to this UMA2 model — registered under the same `OIDC_GATE` alias by `appendIam()`.
99
-
100
- ## Depends On
101
-
102
- - `@owlmeans/oidc`, `@owlmeans/server-auth`, `@owlmeans/server-context`, `@owlmeans/server-entrypoint`, `@owlmeans/auth-common`, `@owlmeans/basic-keys`