@owlmeans/server-oidc-rp 0.1.18-rc.2 → 0.1.18-rc.21

package/README.md

@@ -6,15 +6,15 @@ Server-side OIDC relying party — registers the OIDC guard, wrapping service, g
 
 - `appendOidcGuard(context)` — registers the OIDC guard service
 - `makeOidcWrappingService()` / `makeOidcGate()` — token wrapping service and gate factory
-- `setupOidcGuard(modules, coguards?, extras?)` — attaches the OIDC guard to module declarations
-- `setupAuthServiceModules(...)` — wires external auth modules
+- `oidcEntrypoints` — local bindings for the shared OIDC protocol pair
+- `makeAuthServiceEntrypoints(...)` — returns external-auth protocol declarations
 - `makeOidcClientService()` / `OidcClientService` — IdP-side client (e.g., Keycloak admin)
 - Subpath `./auth` — admin-client constants like `OIDC_ADMIN_CLIENT`
 
 ## Installation
 
 ```bash
-bun add @owlmeans/server-oidc-rp
+bun add @owlmeans/server-oidc-rp@^0.1.18-rc.17
 ```
 
 ## Usage
@@ -32,13 +32,17 @@ context.registerService(makeOidcClientService())
 appendOidcGuard<C, T>(context)
 ```
 
-Wire onto modules in `modules.ts`:
+Decorate shared declarations immutably, then bind OIDC in `entrypoints.ts`:
 
 ```typescript
-import { setupOidcGuard, setupAuthServiceModules } from '@owlmeans/server-oidc-rp'
-
-setupOidcGuard(appModules)
-setupAuthServiceModules(appModules)
+import { withOidcGuard } from '@owlmeans/oidc'
+import { oidcEntrypoints } from '@owlmeans/server-oidc-rp'
+
+const configuredProtocols = withOidcGuard(protocols)
+const appEntrypoints = [
+  // Bind application protocols against configuredProtocols here.
+  ...oidcEntrypoints,
+]
 ```
 
 Configure providers in `config.ts`:
@@ -75,10 +79,11 @@ const oidc = context.service<OidcClientService>(OIDC_SERVICE)
 - `makeOidcGate(alias?)` — gate factory
 - `makeOidcClientService(alias?)` — IdP-side client (used to call OIDC admin API)
 
-### Module wiring
+### Entrypoint wiring
 
-- `setupOidcGuard(modules, coguards?, extras?)` — attach guard to module declarations
-- `setupAuthServiceModules(modules, ...)` — register external auth modules
+- `withOidcGuard(protocols, coguards?)` (`@owlmeans/oidc`) — return a decorated immutable protocol tree
+- `oidcEntrypoints` — local bindings for the shared OIDC init and authenticate protocols
+- `makeAuthServiceEntrypoints(serviceAlias, prefix?)` — return external auth protocol declarations
 
 ### Constants
 
@@ -94,15 +99,15 @@ const oidc = context.service<OidcClientService>(OIDC_SERVICE)
 
 - `makeOidcClientService()` reads provider descriptors from `cfg.oidc.providers`, including Google and internal admin providers.
 - Use `findProvider(predicate)`, `hasProvider(params)`, and `entityToClientId(params)` for provider lookup rather than ad hoc config scans.
-- `setupAuthServiceModules(managerModules, AUTH_API)` wires provider-list and token-update endpoints protected by `GUARD_ED25519`.
-- If OIDC/Google is only the login provider and local identity records hold authorization, do not re-add `appendOidcGuard()`, `makeOidcGate()`, or `setupOidcGuard()` as product authorization. Use a product-specific `GateService` over local profile scopes.
+- `makeAuthServiceEntrypoints(AUTH_API)` declares provider-list and token-update endpoints protected by `GUARD_ED25519`; bind them in the service that serves the routes.
+- If OIDC/Google is only the login provider and local identity records hold authorization, do not re-add `appendOidcGuard()` or `makeOidcGate()` as product authorization. Use a product-specific `GateService` over local profile scopes.
 
 ## Related Packages
 
 - [`@owlmeans/oidc`](../oidc) — shared `OIDC_GATE`, `OIDC_GUARD`, types
 - [`@owlmeans/server-auth`](../server-auth) — works alongside the OIDC guard for token verification
 - [`@owlmeans/server-context`](../server-context) — base context where services are registered
-- [`@owlmeans/auth-common`](../auth-common) — `DEFAULT_GUARD` co-attached via `setupOidcGuard`
+- [`@owlmeans/auth-common`](../auth-common) — `DEFAULT_GUARD`, which `withOidcGuard()` decorates
 
 <!-- owlmeans:agent-guidance:start -->
 ## Agent guidance
@@ -112,7 +117,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills
+npx @owlmeans/agent-skills@^0.1.18-rc.15
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-oidc-rp",
-  "version": "0.1.18-rc.0",
-  "generatedAt": "2026-08-16T22:20:50.509Z",
+  "version": "0.1.18-rc.21",
+  "generatedAt": "2026-09-12T08:39:52.728Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-oidc-rp/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: server-oidc-rp
-description: How to use @owlmeans/server-oidc-rp — OIDC relying party. appendOidcGuard(), makeOidcWrappingService(), makeOidcGate() to wire OIDC into a server context; setupOidcGuard() to attach the guard to module declarations. Auto-invoked when importing server-oidc-rp helpers.
+description: How to use @owlmeans/server-oidc-rp — the server-side OIDC relying party — appendOidcGuard, oidcEntrypoints and makeAuthServiceEntrypoints, the OidcClientService and its adapter, the requested-scope contract, the UMA2 gate, the wrapped-token service, and the owned public types that keep openid-client out of the public surface. Auto-invoked when importing server-oidc-rp helpers or configuring identity providers on a server.
 user-invocable: false
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
@@ -8,93 +8,202 @@ user-invocable: false
 # @owlmeans/server-oidc-rp
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-oidc-rp": "^0.1.18-rc.0"` in `dependencies`
+**Install:** `"@owlmeans/server-oidc-rp": "^0.1.18-rc.21"` in `dependencies`
 
 ## Key Exports
 
 | Export | Description |
 |--------|-------------|
-| `appendOidcGuard<C, T>(context)` | Add OIDC auth guard to context |
-| `makeOidcWrappingService()` | OIDC token service factory |
-| `makeOidcGate()` | OIDC gate factory (used by guards) |
-| `setupOidcGuard(modules, options?)` | Wire OIDC guard onto module declarations |
-| `requestedScope(extraScopes?)` | The `scope` of an authorization request — base scopes + provider extras |
-| Constants | OIDC service / guard aliases |
-| `OidcRp` types | RP-side config and token shapes |
+| `makeOidcClientService(alias?)` | The relying-party service: reads `cfg.oidc.providers`, runs discovery, hands back client adapters |
+| `makeOidcWrappingService()` | Registers `WRAPPED_OIDC` — refreshes and re-issues an OIDC-wrapped token before it goes stale |
+| `makeOidcGate(alias?)` | The UMA2 gate, registered under `OIDC_GATE` |
+| `appendOidcGuard<C, T>(context, opts?)` | Registers the OIDC guard on a server context. `opts` is `OidcGuardOptions` (`@owlmeans/oidc`) and is forwarded to the base guard unchanged |
+| `oidcEntrypoints` | Server-local bindings for the shared `oidcProtocols.init` and `.authenticate` declarations |
+| `makeAuthServiceEntrypoints(serviceAlias, prefix?)` | Returns provider-list and token-update protocol declarations, guarded by `GUARD_ED25519`. `prefix` defaults to `oidc-api` |
+| `requestedScope(extraScopes?)` | The `scope` of an authorization request — base scopes plus the provider's extras, deduplicated |
+| `createGateModel(ctx)` | The UMA2 permission model — `loadPermissions(auth, params)` |
+| `extractPermissionSets(claim)` | Shape-validates a `permissions` claim into `PermissionSet[]`, or `undefined` |
+| `authService` | The service entrypoint aliases: `authService.provider.list`, `authService.auth.update` |
+| `DEFAULT_ALIAS` | `'oidc-client'` — the relying-party service alias |
+| `DEF_OIDC_ACCOUNT_LINKING`, `DEF_OIDC_PROVIDER_API` | Default aliases of the two optional seams below |
+| `OIDC_TOKEN_STORE` | The **record-id prefix** this package composes cache ids from — not a resource alias. See "Where the tokens are cached" |
+| `OIDC_AUTH_LIFTETIME` | 24 h — the TTL a stored token record is saved with |
+| `OIDC_WRAP_FRESHNESS` | How long a validated record stays fresh: inside this window of its last validation the wrapping service returns the token unchanged, past it the token is re-validated and re-issued |
+| `PROVIDER_CACHE_TTL` | Exported, but its only use in the package is commented out — it configures nothing |
+| `AccountLinkingService` | Optional seam: turn a provider profile into a local `AuthPayload` (`getLinkedProfile`, `linkProfile`, `linkCredentials`, `getOwnerProfiles`, `getOwnerCredentials`) |
+| `ProviderApiService` | Optional seam onto the provider's own admin API (`getUserDetails`, `getSettings`) |
+| `OidcRpConfig` | `cfg.oidc` plus `accountLinkingService?` and `providerApiService?` |
+
+### Subpath exports
+
+- `./auth` — `OIDC_ADMIN_CLIENT` (`'admin-cli'`)
+- `./auth/plugins` — importing it registers the `OIDC_CLIENT_AUTH` and `GOOGLE_CLIENT_AUTH` plugins
+  into the `@owlmeans/server-auth` manager registry
+
+## Wiring
 
-## Requested scope
-
-Every authorization request this package builds gets its `scope` from `requestedScope(cfg.extraScopes)`
-— `OIDC_RP_BASE_SCOPES` (`@owlmeans/oidc`) plus the provider descriptor's `extraScopes`, deduplicated.
-Both request sites (`actions/init.ts` for the browser-starts-server-finishes flow, and the
-`oidc-client` auth plugin) call it; never write a scope literal at a call site, and never let the two
-drift apart.
-
-The provider's client registration must allow every scope this yields. A provider supports `email`
-as soon as it declares `claims.email` — and then rejects the whole request with
-`invalid_scope: requested scope is not allowed` if the client's own allowlist omits it, rather than
-dropping the scope. A client provisioned by an older revision therefore stays broken until its
-allowlist is backfilled.
-
-## Subpath Exports
-
-- `./auth` — auth integration helpers
-- `./auth/plugins` — pluggable token verifiers
-
-## Usage
-
-### In `context.ts`
 ```typescript
-import { appendOidcGuard, makeOidcWrappingService, makeOidcGate } from '@owlmeans/server-oidc-rp'
+import { appendOidcGuard, makeOidcWrappingService, makeOidcGate, makeOidcClientService } from '@owlmeans/server-oidc-rp'
 
+context.registerService(makeOidcClientService())
 context.registerService(makeOidcWrappingService())
 context.registerService(makeOidcGate())
 appendOidcGuard<C, T>(context)
 ```
 
-### In `modules.ts`
 ```typescript
-import { setupOidcGuard } from '@owlmeans/server-oidc-rp'
-setupOidcGuard(appModules)
+import { withOidcGuard } from '@owlmeans/oidc'
+import { oidcEntrypoints, makeAuthServiceEntrypoints } from '@owlmeans/server-oidc-rp'
+import { bindAll } from '@owlmeans/server-entrypoint'
+
+export const configuredProtocols = withOidcGuard(protocols)
+export const appEntrypoints = [
+  ...bindAll(configuredProtocols.api),
+  ...oidcEntrypoints,
+  ...bindAll(makeAuthServiceEntrypoints('my-auth-api')),
+]
 ```
 
-### Configure OIDC providers in `config.ts`
+Decorate the application tree before binding it; do not mutate declarations or append protocol
+objects to a server entrypoint list. `oidcEntrypoints` are bindings and are spread once. The
+auth-service helper returns declarations, so bind those declarations in the serving app.
+
 ```typescript
+// config
 cfg.oidc ??= {}
 cfg.oidc.providers ??= []
 cfg.oidc.providers.push({
   clientId: OIDC_ADMIN_CLIENT,
   basePath: 'realms/master',
-  service: OIDC_PRODUCT,
+  // the alias of a registered service whose host the issuer is reassembled from;
+  // a provider reachable by its own URL carries `discoveryUrl` instead
+  service: 'my-iam',
   secret: '/etc/master-secret/oidc-admin-secret',
   internal: true
 })
 ```
 
-## Product-Viable Usage Notes
+A consumer that only needs the IAM defaults calls `appendIam()` from `@owlmeans/server-iam`, which
+performs the four registrations above with the IAM gate in place of `makeOidcGate()`.
 
-- Viable uses `makeOidcClientService()` to read provider descriptors from `cfg.oidc.providers`, including Google and internal admin providers.
-- `findProvider(predicate)`, `hasProvider(params)`, and `entityToClientId(params)` are the preferred provider lookup helpers; avoid scanning config ad hoc in downstream code.
-- `setupAuthServiceModules(managerModules, AUTH_API)` exposes provider-list and token-update service modules protected by `GUARD_ED25519`.
-- When a downstream app uses OIDC/Google only for login and maps users into `@owlmeans/server-auth-identity`, do not reintroduce `appendOidcGuard()`, `makeOidcGate()`, or `setupOidcGuard()` as product authorization. Use a product-specific `GateService` over local identity data.
+## Resolving a provider
+
+`OidcClientService` is the only way to reach a provider descriptor. Use `findProvider(predicate)`,
+`hasProvider(params)`, `getConfig(clientId | partial)`, `getDefault()` and
+`entityToClientId(params)` rather than scanning `cfg.oidc.providers` in downstream code.
+`registerTemporaryProvider` / `unregisterTemporaryProvider` add a descriptor learned at runtime and
+are reference-counted, so every registration needs its matching removal.
+
+`getConfiguration` prefers `discoveryUrl` verbatim; it falls back to `service` + `basePath` and fails
+with `AuthManagerError('oidc.client.basepath')` or `('oidc.client.service')` when neither is usable.
+`getClient` returns an `OidcClientAdapter`: `getMetadata`, `getClientId`, `getConfig`, `makeAuthUrl`,
+`grantWithCredentials`, `grantWithCode`, `refresh` and `introspect`. That adapter is the whole
+supported surface — no `openid-client` object is ever handed out.
+
+## Requested scope
+
+`requestedScope(extraScopes)` is `OIDC_RP_BASE_SCOPES` (`@owlmeans/oidc`) plus the provider
+descriptor's `extraScopes`, deduplicated and trimmed. The two generic request sites — the
+browser-starts-server-finishes init handler and the `oidc-client` auth plugin — both build their
+`scope` from it, and neither may grow a scope literal.
+
+The `GOOGLE_CLIENT_AUTH` plugin is the exception, and it behaves differently on purpose: it sends
+the descriptor's `extraScopes` as the **whole** scope, falling back to `'openid profile email'` when
+the descriptor names none. So on a Google descriptor `extraScopes` replaces the base scopes instead
+of extending them, and adding a scope to `OIDC_RP_BASE_SCOPES` does not reach it.
+
+The provider's client registration must allow every scope this yields. A provider supports `email`
+as soon as it declares `claims.email` — and then rejects the whole request with
+`invalid_scope: requested scope is not allowed` if the client's own allowlist omits it, rather than
+dropping the scope. A client provisioned by an older revision stays broken until its allowlist is
+backfilled.
+
+## Only the `id_token` is a JWT
+
+`id_token` is a JWT by specification; an **access token's format is provider-private**. `oidc-provider`
+issues opaque access tokens by default, so `decodeJwt(tokenSet.access_token)` (`jose`) throws
+`JWTInvalid: Invalid JWT`. Inside the exchange handler that failure surfaces as a 500 on the
+`DISPATCHER_OIDC` endpoint *after* the code exchange already succeeded, which reads as a broken login
+rather than as the log line it came from. Decode only `tokenSet.id_token` — every claim this package
+needs (`sub`, the `PERMISSIONS_CLAIM` grant) lives there. This applies to debug logging too: a
+`console.log` argument is evaluated before the call, so a throwing decode in a log statement fails the
+request just as hard as one in real logic. Never introspect an access token locally; use the
+provider's introspection endpoint (`introspect`) when its contents are genuinely needed.
+
+## Where the tokens are cached
+
+There is no dedicated resource. The cache is `AUTH_CACHE` from `@owlmeans/server-auth`, and
+`OIDC_TOKEN_STORE` is only the prefix of the ids written into it:
+
+| Record id | Holds |
+|---|---|
+| `${OIDC_TOKEN_STORE}:verifier:<challenge or state>` | The PKCE verifier and the client it belongs to, until the exchange takes it |
+| `${OIDC_TOKEN_STORE}:exchange:<exchange token>` | The token set from a completed code exchange, short-lived, deleted when the process step consumes it |
+| `${OIDC_TOKEN_STORE}:token:<bearer token>` | The live token set for an issued bearer token, saved with `OIDC_AUTH_LIFTETIME` |
+
+A consumer that needs the provider token set behind the request it is serving reads
+`context.resource(AUTH_CACHE)` at `${OIDC_TOKEN_STORE}:token:<token>` — never
+`context.resource(OIDC_TOKEN_STORE)`, which resolves nothing.
+
+## PKCE verifiers are consume-once
+
+The verifier cached at init is read back with the resource's `take` — a delete-and-return. The
+exchange therefore succeeds exactly once per authorization code: a repeated exchange (a React effect
+that runs twice for one `code`, a retried request) fails with `resource:unknown-record` even though
+the first attempt worked. Callers guard against re-entry rather than expecting the read to be
+idempotent.
+
+## `entityId` in the browser-starts-server-finishes flow
+
+The init handler resolves the OIDC client two ways: via `getDefault()` (a provider flagged `def: true`,
+matched without looking at `entityId` at all) or, only when no default exists, via a remote provider
+lookup keyed by the caller-supplied `entityId`. The cached verifier record carries `entityId` **only**
+when that second path actually used it to resolve the client. The exchange step later calls
+`getConfig({ clientId, ...(entityId != null ? { entityId } : {}) })`, which requires an exact match on
+every field it is given; a stored `entityId` that was never validated against the registered provider
+— a caller-side default or placeholder, say — makes the exchange fail with a bare `AuthenFailed()`
+even though the same default provider is trivially available again at exchange time.
 
 ## Public type contract (isolation principle)
 
-`openid-client` types **never appear in this package's public exports**. All public types are OwlMeans-owned:
+`openid-client` types **never appear in this package's public exports**. All public types are
+OwlMeans-owned:
 
 | Owned type | Replaces upstream | Description |
 |---|---|---|
-| `OidcTokenSet` | `TokenEndpointResponse & TokenEndpointResponseHelpers` | `access_token`, `refresh_token`, `id_token`, `token_type`, `expires_in`, `scope` |
-| `OidcTokenSetParameters` | `TokenEndpointResponse` | Subset without helper methods |
+| `OidcTokenSet` | `TokenEndpointResponse & TokenEndpointResponseHelpers` | `access_token`, `refresh_token`, `id_token`, `token_type`, `expires_in`, `scope`, `claims()` |
+| `OidcTokenSetParameters` | `TokenEndpointResponse` | The same without the helper method |
 | `OidcGrantChecks` | `AuthorizationCodeGrantChecks` | `{ pkceCodeVerifier?: string; idTokenExpected?: boolean }` |
 | `OidcServerMetadata` | `ServerMetadata` | Issuer and endpoint metadata |
-| `OidcIntrospectionResponse` | `IntrospectionResponse` | Active, scope, sub, client_id |
+| `OidcIntrospectionResponse` | `IntrospectionResponse` | `active`, `scope`, `sub`, `client_id`, … |
 | `OidcClientDescriptor` | `Configuration` (opaque) | Pass-through; consumers must never read its internals |
 
-Upstream `openid-client` types are imported **only** in `src/service.ts`; mappings happen at the method boundaries. This keeps future library swaps confined to that one file.
+What the owned names guarantee is the **exported** surface, not the internal imports. The type module
+imports `Configuration`, `ServerMetadata`, `TokenEndpointResponse` and `TokenEndpointResponseHelpers`
+from `openid-client` in order to alias them under those names; the service module imports the
+functional `openid-client` API; and `jose`'s `decodeJwt` is read directly by the token wrapper, the
+`oidc-client` auth plugin and the exchange handler. A library swap touches every one of those
+modules — what the owned names buy is that it stops there and never reaches a consumer. See
+[[oidc-versions]].
+
+## Rules
+
+- An application that uses an identity provider **only to log in**, and then maps the subject onto a
+  local identity through `@owlmeans/server-auth-identity`, must not adopt `appendOidcGuard()` or
+  `makeOidcGate()` as its authorization mechanism. Those decide against the
+  provider's grants; a product that owns its own identity records declares its own `GateService` over
+  them.
+- The browser starts the flow and the server finishes it: the exchange, the account linking and the
+  bearer token an application actually carries are all produced here.
+- Register the wrapping service whenever the guard is registered — an OIDC-wrapped token that nothing
+  refreshes expires mid-session.
 
 ## Depends On
 
-- `@owlmeans/oidc`, `@owlmeans/server-auth`, `@owlmeans/server-context`, `@owlmeans/server-entrypoint`
-- `@owlmeans/auth-common`, `@owlmeans/basic-keys`
-- `openid-client@6.8.4` (exact), `jose@6.2.3` (exact) — see [[oidc-versions]]
+- `@owlmeans/oidc`, `@owlmeans/server-auth`, `@owlmeans/server-context`, `@owlmeans/server-entrypoint`,
+  `@owlmeans/server-api`, `@owlmeans/auth`, `@owlmeans/auth-common`, `@owlmeans/basic-envelope`,
+  `@owlmeans/client-entrypoint`, `@owlmeans/config`, `@owlmeans/context`, `@owlmeans/did`,
+  `@owlmeans/entrypoint`, `@owlmeans/resource`, `@owlmeans/route`, `@noble/hashes`, `@scure/base`,
+  `dayjs`
+- `ajv` (peer)
+- `openid-client@6.8.4` (exact), `jose@6.2.5` (exact) — see [[oidc-versions]]

package/build/actions/init.js

@@ -35,7 +35,7 @@ export const init = handleBody(async (body, ctx) => {
          * @TODO We need to move it to some remote resource.
          * And make oidc service itself use such a resource to get required client.
          */
-        const [providers] = await context.entrypoint(authService.provider.list).call({
+        const providers = await context.entrypoint(authService.provider.list).call({
             params: { service: context.cfg.alias ?? context.cfg.service },
             query: { entityId }
         });
@@ -72,7 +72,7 @@ export const init = handleBody(async (body, ctx) => {
         client: client.getClientId(),
         ...(entityIdUsedForResolution ? { entityId } : {}),
     }, { ttl: AUTHEN_TIMEFRAME / 1000 });
-    const [dispatcherUrl] = await context.entrypoint(DISPATCHER).call();
+    const dispatcherUrl = await context.entrypoint(DISPATCHER).url();
     const cfg = client.getConfig();
     const url = client.makeAuthUrl({
         scope: requestedScope(cfg?.extraScopes),

package/build/actions/init.js.map

@@ -1 +1 @@
-{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/actions/init.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEjD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAGjD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACzD,qDAAqD;AACrD,8CAA8C;AAE9C,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAExD,MAAM,CAAC,MAAM,IAAI,GAA2B,UAAU,CAAC,KAAK,EAAE,IAAwB,EAAE,GAAG,EAAE,EAAE;IAC7F,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IACxC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAA;IAE5B,MAAM,OAAO,GAAG,aAAa,CAAkB,GAAG,CAAC,CAAA;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;IAE9D,IAAI,MAAM,GAA6B,IAAI,CAAA;IAC3C,4FAA4F;IAC5F,sFAAsF;IACtF,4FAA4F;IAC5F,0FAA0F;IAC1F,0EAA0E;IAC1E,IAAI,yBAAyB,GAAG,KAAK,CAAA;IAErC,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;IACzC,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;IAChD,CAAC;IACD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,yBAAyB,GAAG,IAAI,CAAA;QAChC,yCAAyC;QACzC;;;WAGG;QACH,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAC1C,WAAW,CAAC,QAAQ,CAAC,IAAI,CAC1B,CAAC,IAAI,CAAC;YACL,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE;YAC7D,KAAK,EAAE,EAAE,QAAQ,EAAE;SACpB,CAAC,CAAA;QAEF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,WAAW,EAAE,CAAA;QACzB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,qDAAqD,EAAE,SAAS,CAAC,CAAA;QAE7E,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,CAAA;QACzE,iFAAiF;QACjF,IAAI,QAAQ,IAAI,IAAI,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC1C,OAAO,QAAQ,CAAC,GAAG,CAAA;QACrB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAA;QAChD,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;QAEjC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,EAAE,CAAA;QACzB,CAAC;QACD,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,oEAAoE;IACpE,+FAA+F;IAC/F,WAAW;IACX,oCAAoC;IACpC,8DAA8D;IAC9D,OAAO;IACP,IAAI;IAEJ,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;IAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEjD,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAA;IAE3H,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAC1B,EAAE,EAAE,UAAU,CAAC,SAAS,CAAC;QACzB,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE;QAC5B,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;IAEpC,MAAM,CAAC,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAA2B,UAAU,CAAC,CAAC,IAAI,EAAE,CAAA;IAE7F,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;IAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC;QAC7B,KAAK,EAAE,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC;QACvC,cAAc,EAAE,SAAS;QACzB,qBAAqB,EAAE,MAAM;QAC7B,YAAY,EAAE,aAAa;KAC5B,CAAC,CAAA;IAEF,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAA;IAE9B,OAAO,GAAG,CAAA;AACZ,CAAC,CAAC,CAAA"}
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/actions/init.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEjD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAGjD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACzD,qDAAqD;AACrD,8CAA8C;AAE9C,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAExD,MAAM,CAAC,MAAM,IAAI,GAA2B,UAAU,CAAC,KAAK,EAAE,IAAwB,EAAE,GAAG,EAAE,EAAE;IAC7F,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IACxC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAA;IAE5B,MAAM,OAAO,GAAG,aAAa,CAAkB,GAAG,CAAC,CAAA;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;IAE9D,IAAI,MAAM,GAA6B,IAAI,CAAA;IAC3C,4FAA4F;IAC5F,sFAAsF;IACtF,4FAA4F;IAC5F,0FAA0F;IAC1F,0EAA0E;IAC1E,IAAI,yBAAyB,GAAG,KAAK,CAAA;IAErC,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;IACzC,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;IAChD,CAAC;IACD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,yBAAyB,GAAG,IAAI,CAAA;QAChC,yCAAyC;QACzC;;;WAGG;QACH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,UAAU,CACxC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAC1B,CAAC,IAAI,CAAC;YACL,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE;YAC7D,KAAK,EAAE,EAAE,QAAQ,EAAE;SACpB,CAAC,CAAA;QAEF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,WAAW,EAAE,CAAA;QACzB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,qDAAqD,EAAE,SAAS,CAAC,CAAA;QAE7E,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,CAAA;QACzE,iFAAiF;QACjF,IAAI,QAAQ,IAAI,IAAI,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC1C,OAAO,QAAQ,CAAC,GAAG,CAAA;QACrB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAA;QAChD,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;QAEjC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,EAAE,CAAA;QACzB,CAAC;QACD,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,oEAAoE;IACpE,+FAA+F;IAC/F,WAAW;IACX,oCAAoC;IACpC,8DAA8D;IAC9D,OAAO;IACP,IAAI;IAEJ,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;IAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEjD,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAA;IAE3H,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAC1B,EAAE,EAAE,UAAU,CAAC,SAAS,CAAC;QACzB,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE;QAC5B,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;IAEpC,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,UAAU,CAA2B,UAAU,CAAC,CAAC,GAAG,EAAE,CAAA;IAE1F,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;IAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC;QAC7B,KAAK,EAAE,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC;QACvC,cAAc,EAAE,SAAS;QACzB,qBAAqB,EAAE,MAAM;QAC7B,YAAY,EAAE,aAAa;KAC5B,CAAC,CAAA;IAEF,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAA;IAE9B,OAAO,GAAG,CAAA;AACZ,CAAC,CAAC,CAAA"}

package/build/actions/process.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process.d.ts","sourceRoot":"","sources":["../../src/actions/process.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAoBzE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,YAAY,EAAE,sBAoFzB,CAAA"}
+{"version":3,"file":"process.d.ts","sourceRoot":"","sources":["../../src/actions/process.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAoBzE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,YAAY,EAAE,sBA6EzB,CAAA"}

package/build/actions/process.js

@@ -43,9 +43,11 @@ export const authenticate = handleBody(async ({ authUrl, ...params }, ctx) => {
         throw new AuthManagerError('service');
     }
     await cache(context).delete(exchangeId(token));
-    console.log('List provided user permisssions', decodeJwt(tokenSet.access_token));
+    // Only the id_token is guaranteed to be a JWT. An access token's format is provider-private —
+    // `oidc-provider` issues opaque ones by default — so decoding it throws `JWTInvalid` and, from
+    // inside this handler, fails the whole exchange after it has already succeeded. Nothing here
+    // needs it either: the permission grant is read from the id_token below.
     const id = decodeJwt(tokenSet.id_token);
-    console.log('token set', tokenSet, tokenSet.claims(), id);
     // Integrated IAM mode: the provider mints the subject's PermissionSet[] into the id_token
     const permissions = extractPermissionSets(id[PERMISSIONS_CLAIM]);
     let user = {
@@ -68,7 +70,7 @@ export const authenticate = handleBody(async ({ authUrl, ...params }, ctx) => {
         // @TODO Actually this is highly incorrect - we need to get profile details
         // from the OwlMeans Auth intead
         // profileId: user?.userId,
-        entityId: cfg.entityId,
+        entitySlug: cfg.entityId,
         ...(permissions != null ? { permissions, permissioned: true } : {}),
         isUser: true,
         createdAt: new Date(),

package/build/actions/process.js.map

@@ -1 +1 @@
-{"version":3,"file":"process.js","sourceRoot":"","sources":["../../src/actions/process.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,GAAG,MAAM,KAAK,CAAA;AACrB,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEzD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAChC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,YAAY,GAA2B,UAAU,CAAC,KAAK,EAClE,EAAE,OAAO,EAAE,GAAG,MAAM,EAAyB,EAC7C,GAAG,EACH,EAAE;IACF,MAAM,OAAO,GAAG,aAAa,CAAkB,GAAG,CAAC,CAAA;IAEnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAChC,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IAExD,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACnE,SAAS,EAAE,WAAW,GAAG,GAAG,GAAG,OAAO;QACtC,UAAU,EAAE,IAAI,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;KACpC,CAAC,CAAA;IAGrB,OAAO,CAAC,GAAG,CAAC,6DAA6D,EAAE,GAAG,CAAC,CAAA;IAE/E,IAAI,QAAQ,CAAC,QAAQ,IAAI,IAAI,IAAI,QAAQ,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;QAC/D,MAAM,IAAI,YAAY,EAAE,CAAA;IAC1B,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAA;IACvC,CAAC;IAED,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IAE9C,OAAO,CAAC,GAAG,CACT,iCAAiC,EACjC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,CACjC,CAAA;IAED,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACvC,OAAO,CAAC,GAAG,CACT,WAAW,EACX,QAAQ,EACR,QAAQ,CAAC,MAAM,EAAE,EACjB,EAAE,CACH,CAAA;IAED,0FAA0F;IAC1F,MAAM,WAAW,GAAG,qBAAqB,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAA;IAEhE,IAAI,IAAI,GAAS;QACf,IAAI,EAAE,kBAAkB;QACxB,KAAK;QACL,2EAA2E;QAC3E,kCAAkC;QAClC,MAAM,EAAE,EAAE,CAAC,GAAa;QACxB,mEAAmE;QACnE,sBAAsB;QACtB,IAAI,EAAE,QAAQ,CAAC,KAAK;QACpB,kEAAkE;QAClE,MAAM,EAAE;YACN,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,OAAO;YACnB,GAAG,CAAC,OAAO;SACZ;QACD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1E,2EAA2E;QAC3E,gCAAgC;QAChC,2BAA2B;QAC3B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAA;IAED,OAAO,CAAC,GAAG,CAAC,oCAAoC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;IACnE,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CACzB,EAAE,EAAE,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,EACjE,EAAE,GAAG,EAAE,mBAAmB,GAAG,IAAI,EAAE,CACpC,CAAA;IAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACxG,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAO,kBAAkB,CAAC;SACpE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;IAEzD,IAAI,IAAI,GAAG,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,WAAW,EAAE,IAAI,aAAa,EAAE,EAAE,CAAA;IAE5E,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAA;IAExD,OAAO,IAAI,CAAA;AACb,CAAC,CAAC,CAAA"}
+{"version":3,"file":"process.js","sourceRoot":"","sources":["../../src/actions/process.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,GAAG,MAAM,KAAK,CAAA;AACrB,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEzD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAChC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,YAAY,GAA2B,UAAU,CAAC,KAAK,EAClE,EAAE,OAAO,EAAE,GAAG,MAAM,EAAyB,EAC7C,GAAG,EACH,EAAE;IACF,MAAM,OAAO,GAAG,aAAa,CAAkB,GAAG,CAAC,CAAA;IAEnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAChC,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IAExD,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACnE,SAAS,EAAE,WAAW,GAAG,GAAG,GAAG,OAAO;QACtC,UAAU,EAAE,IAAI,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;KACpC,CAAC,CAAA;IAGrB,OAAO,CAAC,GAAG,CAAC,6DAA6D,EAAE,GAAG,CAAC,CAAA;IAE/E,IAAI,QAAQ,CAAC,QAAQ,IAAI,IAAI,IAAI,QAAQ,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;QAC/D,MAAM,IAAI,YAAY,EAAE,CAAA;IAC1B,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAA;IACvC,CAAC;IAED,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IAE9C,8FAA8F;IAC9F,+FAA+F;IAC/F,6FAA6F;IAC7F,yEAAyE;IACzE,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAEvC,0FAA0F;IAC1F,MAAM,WAAW,GAAG,qBAAqB,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAA;IAEhE,IAAI,IAAI,GAAS;QACf,IAAI,EAAE,kBAAkB;QACxB,KAAK;QACL,2EAA2E;QAC3E,kCAAkC;QAClC,MAAM,EAAE,EAAE,CAAC,GAAa;QACxB,mEAAmE;QACnE,sBAAsB;QACtB,IAAI,EAAE,QAAQ,CAAC,KAAK;QACpB,kEAAkE;QAClE,MAAM,EAAE;YACN,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,OAAO;YACnB,GAAG,CAAC,OAAO;SACZ;QACD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1E,2EAA2E;QAC3E,gCAAgC;QAChC,2BAA2B;QAC3B,UAAU,EAAE,GAAG,CAAC,QAAQ;QACxB,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAA;IAED,OAAO,CAAC,GAAG,CAAC,oCAAoC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;IACnE,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CACzB,EAAE,EAAE,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,EACjE,EAAE,GAAG,EAAE,mBAAmB,GAAG,IAAI,EAAE,CACpC,CAAA;IAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACxG,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAO,kBAAkB,CAAC;SACpE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;IAEzD,IAAI,IAAI,GAAG,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,WAAW,EAAE,IAAI,aAAa,EAAE,EAAE,CAAA;IAE5E,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAA;IAExD,OAAO,IAAI,CAAA;AACb,CAAC,CAAC,CAAA"}

package/build/auth/plugins/google-client.js

@@ -67,7 +67,7 @@ export const googleClientPlugin = (context, service = GOOGLE_SERVICE) => {
                 throw new AuthenPayloadError('state');
             }
             // Look up the PKCE verifier using the state parameter
-            const verification = await cache(context).pick(verifierId(state));
+            const verification = await cache(context).take(verifierId(state));
             if (verification == null || verification.verifier == null) {
                 throw new AuthenFailed();
             }
@@ -138,7 +138,7 @@ export const googleClientPlugin = (context, service = GOOGLE_SERVICE) => {
             credential.type = GOOGLE_CLIENT_AUTH;
             credential.userId = profile.userId;
             credential.profileId = profile.profileId;
-            credential.entityId = profile.entityId;
+            credential.entitySlug = profile.entitySlug;
             return { token: exchangeToken };
         }
     };

package/build/auth/plugins/google-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"google-client.js","sourceRoot":"","sources":["../../../src/auth/plugins/google-client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAA;AAElE,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEnE,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzG,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEpE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAE/C,MAAM,oBAAoB,GAAG,8CAA8C,CAAA;AAC3E,MAAM,qBAAqB,GAAG,qCAAqC,CAAA;AACnE,MAAM,wBAAwB,GAAG,+CAA+C,CAAA;AAEhF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAyC,OAAU,EAAE,OAAO,GAAW,cAAc,EAAc,EAAE;IACrI,MAAM,eAAe,GAAG,KAAK,IAAqG,EAAE;QAClI,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;QAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;QAC7C,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,QAAQ,IAAI,IAAI,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;YAC9D,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAA;QAC7C,CAAC;QACD,OAAO,GAA6F,CAAA;IACtG,CAAC,CAAA;IAED,MAAM,MAAM,GAAe;QACzB,IAAI,EAAE,kBAAkB;QAExB,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACpB,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAEhC,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAA;YAEtC,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAA;YAC9C,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;YACjD,kDAAkD;YAClD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YAE5C,MAAM,KAAK,CAAO,OAAO,CAAC,CAAC,MAAM,CAAC;gBAChC,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC;gBACrB,QAAQ;gBACR,MAAM,EAAE,MAAM,CAAC,QAAQ;gBACvB,WAAW,EAAE,OAAO,CAAC,MAAM;aAC5B,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;YAEpC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,IAAI,sBAAsB,CAAA;YAC3D,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,oBAAoB,CAAA;YAEhE,gFAAgF;YAChF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;gBACjC,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,YAAY,EAAE,OAAO,CAAC,MAAM;gBAC5B,aAAa,EAAE,MAAM;gBACrB,KAAK,EAAE,MAAM;gBACb,cAAc,EAAE,SAAS;gBACzB,qBAAqB,EAAE,MAAM;gBAC7B,KAAK;gBACL,WAAW,EAAE,SAAS;gBACtB,MAAM,EAAE,SAAS;aAClB,CAAC,CAAA;YAEF,MAAM,GAAG,GAAG,GAAG,YAAY,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;YAElD,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAA;QAC3B,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAA;YAEtC,uEAAuE;YACvE,MAAM,cAAc,GAAG,IAAI,eAAe,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;YACjE,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACvC,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAEzC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;gBACjB,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAA;YACtC,CAAC;YAED,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBAClC,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACvC,CAAC;YAED,sDAAsD;YACtD,MAAM,YAAY,GAAG,MAAM,KAAK,CAAO,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;YACvE,IAAI,YAAY,IAAI,IAAI,IAAI,YAAY,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;gBAC1D,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,6DAA6D;YAC7D,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,CAAA;YAC5C,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;gBACxB,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,2BAA2B;YAC3B,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,qBAAqB,CAAA;YACnE,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;gBAC/C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,IAAI;oBACJ,SAAS,EAAE,MAAM,CAAC,QAAQ;oBAC1B,aAAa,EAAE,MAAM,CAAC,MAAM;oBAC5B,YAAY,EAAE,WAAW;oBACzB,UAAU,EAAE,oBAAoB;oBAChC,aAAa,EAAE,YAAY,CAAC,QAAQ;iBACrC,CAAC;aACH,CAAC,CAAA;YAEF,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;gBACtB,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAiD,CAAA;YACxF,IAAI,MAAM,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;gBAChC,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,kBAAkB;YAClB,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,wBAAwB,CAAA;YAC5E,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;gBACrD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,YAAY,EAAE,EAAE;aAC5D,CAAC,CAAA;YAEF,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;gBACzB,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAE3C,CAAA;YAED,IAAI,QAAQ,CAAC,GAAG,IAAI,IAAI,IAAI,QAAQ,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;gBACnD,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,6DAA6D;YAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;YAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAkC,CAAA;YACnE,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAA;YACpD,CAAC;YAED,MAAM,cAAc,GAA2B;gBAC7C,IAAI,EAAE,kBAAkB;gBACxB,OAAO;gBACP,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,QAAQ,CAAC,GAAG;gBACpB,QAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK;aAC1C,CAAA;YAED,IAAI,OAAO,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAA;YAE1D,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,cAAc,EAAE;oBAChD,QAAQ,EAAE,QAAQ,CAAC,KAAK;oBACxB,KAAK,EAAE,KAAK;iBACb,CAAC,CAAA;YACJ,CAAC;YAED,qEAAqE;YACrE,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YACpD,MAAM,KAAK,CAAO,OAAO,CAAC,CAAC,MAAM,CAC/B,EAAE,EAAE,EAAE,UAAU,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,MAAa,EAAE,EACzD,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CACjC,CAAA;YAED,UAAU,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,CAAA;YAChC,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAA;YACnC,UAAU,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;YAC/B,UAAU,CAAC,IAAI,GAAG,kBAAkB,CAAA;YACpC,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;YAClC,UAAU,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;YACxC,UAAU,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;YAEtC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAA;QACjC,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}
+{"version":3,"file":"google-client.js","sourceRoot":"","sources":["../../../src/auth/plugins/google-client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAA;AAElE,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEnE,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzG,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEpE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAE/C,MAAM,oBAAoB,GAAG,8CAA8C,CAAA;AAC3E,MAAM,qBAAqB,GAAG,qCAAqC,CAAA;AACnE,MAAM,wBAAwB,GAAG,+CAA+C,CAAA;AAEhF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAyC,OAAU,EAAE,OAAO,GAAW,cAAc,EAAc,EAAE;IACrI,MAAM,eAAe,GAAG,KAAK,IAAqG,EAAE;QAClI,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;QAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;QAC7C,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,QAAQ,IAAI,IAAI,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;YAC9D,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAA;QAC7C,CAAC;QACD,OAAO,GAA6F,CAAA;IACtG,CAAC,CAAA;IAED,MAAM,MAAM,GAAe;QACzB,IAAI,EAAE,kBAAkB;QAExB,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACpB,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAEhC,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAA;YAEtC,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAA;YAC9C,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;YACjD,kDAAkD;YAClD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YAE5C,MAAM,KAAK,CAAO,OAAO,CAAC,CAAC,MAAM,CAAC;gBAChC,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC;gBACrB,QAAQ;gBACR,MAAM,EAAE,MAAM,CAAC,QAAQ;gBACvB,WAAW,EAAE,OAAO,CAAC,MAAM;aAC5B,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;YAEpC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,IAAI,sBAAsB,CAAA;YAC3D,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,oBAAoB,CAAA;YAEhE,gFAAgF;YAChF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;gBACjC,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,YAAY,EAAE,OAAO,CAAC,MAAM;gBAC5B,aAAa,EAAE,MAAM;gBACrB,KAAK,EAAE,MAAM;gBACb,cAAc,EAAE,SAAS;gBACzB,qBAAqB,EAAE,MAAM;gBAC7B,KAAK;gBACL,WAAW,EAAE,SAAS;gBACtB,MAAM,EAAE,SAAS;aAClB,CAAC,CAAA;YAEF,MAAM,GAAG,GAAG,GAAG,YAAY,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;YAElD,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAA;QAC3B,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAA;YAEtC,uEAAuE;YACvE,MAAM,cAAc,GAAG,IAAI,eAAe,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;YACjE,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACvC,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAEzC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;gBACjB,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAA;YACtC,CAAC;YAED,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBAClC,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACvC,CAAC;YAED,sDAAsD;YACtD,MAAM,YAAY,GAAG,MAAM,KAAK,CAAO,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;YACvE,IAAI,YAAY,IAAI,IAAI,IAAI,YAAY,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;gBAC1D,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,6DAA6D;YAC7D,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,CAAA;YAC5C,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;gBACxB,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,2BAA2B;YAC3B,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,qBAAqB,CAAA;YACnE,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;gBAC/C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,IAAI;oBACJ,SAAS,EAAE,MAAM,CAAC,QAAQ;oBAC1B,aAAa,EAAE,MAAM,CAAC,MAAM;oBAC5B,YAAY,EAAE,WAAW;oBACzB,UAAU,EAAE,oBAAoB;oBAChC,aAAa,EAAE,YAAY,CAAC,QAAQ;iBACrC,CAAC;aACH,CAAC,CAAA;YAEF,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;gBACtB,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAiD,CAAA;YACxF,IAAI,MAAM,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;gBAChC,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,kBAAkB;YAClB,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,wBAAwB,CAAA;YAC5E,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;gBACrD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,YAAY,EAAE,EAAE;aAC5D,CAAC,CAAA;YAEF,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;gBACzB,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAE3C,CAAA;YAED,IAAI,QAAQ,CAAC,GAAG,IAAI,IAAI,IAAI,QAAQ,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;gBACnD,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,6DAA6D;YAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;YAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAkC,CAAA;YACnE,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAA;YACpD,CAAC;YAED,MAAM,cAAc,GAA2B;gBAC7C,IAAI,EAAE,kBAAkB;gBACxB,OAAO;gBACP,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,QAAQ,CAAC,GAAG;gBACpB,QAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK;aAC1C,CAAA;YAED,IAAI,OAAO,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAA;YAE1D,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,cAAc,EAAE;oBAChD,QAAQ,EAAE,QAAQ,CAAC,KAAK;oBACxB,KAAK,EAAE,KAAK;iBACb,CAAC,CAAA;YACJ,CAAC;YAED,qEAAqE;YACrE,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YACpD,MAAM,KAAK,CAAO,OAAO,CAAC,CAAC,MAAM,CAC/B,EAAE,EAAE,EAAE,UAAU,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,MAAa,EAAE,EACzD,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CACjC,CAAA;YAED,UAAU,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,CAAA;YAChC,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAA;YACnC,UAAU,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;YAC/B,UAAU,CAAC,IAAI,GAAG,kBAAkB,CAAA;YACpC,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;YAClC,UAAU,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;YACxC,UAAU,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;YAE1C,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAA;QACjC,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}

package/build/auth/plugins/oidc-client.js

@@ -4,7 +4,7 @@ import { OIDC_CLIENT_AUTH } from '@owlmeans/oidc';
 import { base64urlnopad as base64 } from '@scure/base';
 import { randomBytes } from '@noble/hashes/utils';
 import { sha256 } from '@noble/hashes/sha256';
-import { ALL_SCOPES, AuthenFailed, AuthenPayloadError, AuthManagerError, AuthRole } from '@owlmeans/auth';
+import { ALL_SCOPES, AuthenFailed, AuthenPayloadError, AuthManagerError, AuthRole, entitySlugOf } from '@owlmeans/auth';
 import { AUTHEN_TIMEFRAME } from '@owlmeans/server-auth';
 import { decodeJwt } from 'jose';
 import { KEY_OWL } from '@owlmeans/did';
@@ -69,7 +69,7 @@ export const oidcClientPlugin = (context) => {
             }
             // @TODO Actually think about how to make oidc service configurable
             const oidc = context.service(DEFAULT_ALIAS);
-            let entityId = request.entityId ?? oidc.getDefault();
+            let entityId = entitySlugOf(request) ?? oidc.getDefault();
             if (entityId == null) {
                 throw new AuthenPayloadError('client');
             }
@@ -203,7 +203,7 @@ export const oidcClientPlugin = (context) => {
             credential.type = OIDC_CLIENT_AUTH;
             credential.userId = profile.userId;
             credential.profileId = profile.profileId;
-            credential.entityId = profile.entityId;
+            credential.entitySlug = profile.entitySlug;
             return { token: exchangeToken };
         }
     };

package/build/auth/plugins/oidc-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-client.js","sourceRoot":"","sources":["../../../src/auth/plugins/oidc-client.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAA;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEjD,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzG,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,4BAA4B;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAyC,OAAU,EAAc,EAAE;IACjG,MAAM,YAAY,GAAG,sBAAsB,CAAO,OAAO,CAAC,CAAA;IAE1D,MAAM,MAAM,GAAe;QACzB,IAAI,EAAE,gBAAgB;QAEtB,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACpB,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAEhC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,KAAK,KAAK,EAAE,CAAC;gBACnD,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAA;YAC7C,CAAC;YAED,mEAAmE;YACnE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;YAC9D,IAAI,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAA;YAEpD,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YAED,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACpF,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC;mBAClD,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;YAEjD,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;YAEnH,MAAM,KAAK,CAAO,OAAO,CAAC,CAAC,MAAM,CAAC;gBAChC,EAAE,EAAE,UAAU,CAAC,SAAS,CAAC;gBACzB,QAAQ;gBACR,MAAM,EAAE,QAAQ;aACjB,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;YAEpC,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAA;YAC9C,CAAC;YAED,8CAA8C;YAE9C,qDAAqD;YACrD,yCAAyC;YACzC,IAAI;YAEJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;YAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC;gBAC7B,KAAK,EAAE,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC;gBACvC,cAAc,EAAE,SAAS;gBACzB,qBAAqB,EAAE,MAAM;gBAC7B,YAAY,EAAE,OAAO,CAAC,MAAM;aAC7B,CAAC,CAAA;YAEF,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAA;QAC3B,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;YAC9B,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,aAAa,CAAC,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,CAAA;YAErE,IAAI,QAAQ,CAAC,QAAQ,IAAI,IAAI,IAAI,QAAQ,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;gBAC/D,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;YAC9D,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAExC,IAAI,GAAG,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;gBACpB,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAA;YACnC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAA;YAClD,CAAC;YAED,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBACxB,MAAM,IAAI,gBAAgB,CAAC,cAAc,CAAC,CAAA;YAC5C,CAAC;YAED,IAAI,OAAO,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC;gBACzC,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,MAAM,EAAE,GAAG,CAAC,GAAG;aACiB,CAAC,CAAA;YAEnC,oEAAoE;YACpE,6CAA6C;YAC7C,oEAAoE;YACpE,sEAAsE;YACtE,IAAI,OAAwB,CAAA;YAC5B,IAAI,GAAG,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBACd,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;gBACvD,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,oBAAoB,EAAE,CAAA;gBAC1D,IAAI,WAAW,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;oBACrC,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAA;gBACzC,CAAC;gBACD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;gBAC9B,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;oBAChB,mEAAmE;oBACnE,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAA;gBAC7C,CAAC;gBACD,OAAO,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,CAAA;YACvE,CAAC;iBAAM,CAAC;gBACN,2EAA2E;gBAC3E,yCAAyC;gBACzC,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAA;YAC3C,CAAC;YAED;YACE,iBAAiB;YACjB,OAAO,IAAI,IAAI;gBACf,yDAAyD;mBACtD,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC,EACjG,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBACd,OAAO,CAAC,YAAY,KAAK,GAAG,CAAC,QAAQ,IAAI,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,GAAG,CAAC,eAAe,CAAA;gBAC7F,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;oBAChE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAA;gBAC9C,CAAC;gBACD,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAA;gBACpF,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;oBAC7B,oFAAoF;oBACpF,gFAAgF;oBAChF,MAAM,IAAI,gBAAgB,CAAC,YAAY,CAAC,CAAA;gBAC1C,CAAC;gBAGD,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;gBAElG,4DAA4D;gBAC5D,uCAAuC;gBACvC,IAAI,OAAO,IAAI,IAAI,IAAI,CACrB,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,GAAG,CAAC,eAAe;oBAChD,4CAA4C;oBAC5C,iEAAiE;oBACjE,wEAAwE;oBACxE,8DAA8D;oBAC9D,oEAAoE;oBACpE,kFAAkF;oBAClF,4EAA4E;oBAC5E,oFAAoF;oBACpF,uDAAuD;uBACpD,OAAO,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,CACrC,EAAE,CAAC;oBACF,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;oBACvB,OAAO,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC;wBAChC,GAAG,OAAO;wBACV,OAAO,EAAE,GAAG,CAAC,OAAO;wBACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;wBACtB,IAAI,EAAE,gBAAgB;qBACvB,EAAE;wBACD,QAAQ,EAAE,GAAG,CAAC,kBAA4B,IAAI,OAAO,CAAC,QAAQ;wBAC9D,kFAAkF;wBAClF,KAAK,EAAE,KAAK;qBACb,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YAEd,UAAU,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,CAAA;YAChC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAA;YAChC,UAAU,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;YAC/B,UAAU,CAAC,IAAI,GAAG,gBAAgB,CAAA;YAClC,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;YAClC,UAAU,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;YACxC,UAAU,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;YAEtC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAA;QACjC,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}
+{"version":3,"file":"oidc-client.js","sourceRoot":"","sources":["../../../src/auth/plugins/oidc-client.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAA;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEjD,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACvH,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,4BAA4B;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAyC,OAAU,EAAc,EAAE;IACjG,MAAM,YAAY,GAAG,sBAAsB,CAAO,OAAO,CAAC,CAAA;IAE1D,MAAM,MAAM,GAAe;QACzB,IAAI,EAAE,gBAAgB;QAEtB,IAAI,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;YACpB,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAEhC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,KAAK,KAAK,EAAE,CAAC;gBACnD,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAA;YAC7C,CAAC;YAED,mEAAmE;YACnE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;YAC9D,IAAI,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAA;YAEzD,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YAED,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACpF,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC;mBAClD,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACxC,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;YAEjD,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;YAEnH,MAAM,KAAK,CAAO,OAAO,CAAC,CAAC,MAAM,CAAC;gBAChC,EAAE,EAAE,UAAU,CAAC,SAAS,CAAC;gBACzB,QAAQ;gBACR,MAAM,EAAE,QAAQ;aACjB,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;YAEpC,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAA;YAC9C,CAAC;YAED,8CAA8C;YAE9C,qDAAqD;YACrD,yCAAyC;YACzC,IAAI;YAEJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;YAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC;gBAC7B,KAAK,EAAE,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC;gBACvC,cAAc,EAAE,SAAS;gBACzB,qBAAqB,EAAE,MAAM;gBAC7B,YAAY,EAAE,OAAO,CAAC,MAAM;aAC7B,CAAC,CAAA;YAEF,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAA;QAC3B,CAAC;QAED,YAAY,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YAC/B,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;YAC9B,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,aAAa,CAAC,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,CAAA;YAErE,IAAI,QAAQ,CAAC,QAAQ,IAAI,IAAI,IAAI,QAAQ,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;gBAC/D,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;YAC9D,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAExC,IAAI,GAAG,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;gBACpB,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAA;YACnC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAA;YAClD,CAAC;YAED,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBACxB,MAAM,IAAI,gBAAgB,CAAC,cAAc,CAAC,CAAA;YAC5C,CAAC;YAED,IAAI,OAAO,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC;gBACzC,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,MAAM,EAAE,GAAG,CAAC,GAAG;aACiB,CAAC,CAAA;YAEnC,oEAAoE;YACpE,6CAA6C;YAC7C,oEAAoE;YACpE,sEAAsE;YACtE,IAAI,OAAwB,CAAA;YAC5B,IAAI,GAAG,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBACd,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;gBACvD,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,oBAAoB,EAAE,CAAA;gBAC1D,IAAI,WAAW,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;oBACrC,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAA;gBACzC,CAAC;gBACD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;gBAC9B,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;oBAChB,mEAAmE;oBACnE,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAA;gBAC7C,CAAC;gBACD,OAAO,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,CAAA;YACvE,CAAC;iBAAM,CAAC;gBACN,2EAA2E;gBAC3E,yCAAyC;gBACzC,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAA;YAC3C,CAAC;YAED;YACE,iBAAiB;YACjB,OAAO,IAAI,IAAI;gBACf,yDAAyD;mBACtD,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC,EACjG,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBACd,OAAO,CAAC,YAAY,KAAK,GAAG,CAAC,QAAQ,IAAI,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,GAAG,CAAC,eAAe,CAAA;gBAC7F,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;oBAChE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAA;gBAC9C,CAAC;gBACD,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAA;gBACpF,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;oBAC7B,oFAAoF;oBACpF,gFAAgF;oBAChF,MAAM,IAAI,gBAAgB,CAAC,YAAY,CAAC,CAAA;gBAC1C,CAAC;gBAGD,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;gBAElG,4DAA4D;gBAC5D,uCAAuC;gBACvC,IAAI,OAAO,IAAI,IAAI,IAAI,CACrB,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,GAAG,CAAC,eAAe;oBAChD,4CAA4C;oBAC5C,iEAAiE;oBACjE,wEAAwE;oBACxE,8DAA8D;oBAC9D,oEAAoE;oBACpE,kFAAkF;oBAClF,4EAA4E;oBAC5E,oFAAoF;oBACpF,uDAAuD;uBACpD,OAAO,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,CACrC,EAAE,CAAC;oBACF,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;oBACvB,OAAO,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC;wBAChC,GAAG,OAAO;wBACV,OAAO,EAAE,GAAG,CAAC,OAAO;wBACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;wBACtB,IAAI,EAAE,gBAAgB;qBACvB,EAAE;wBACD,QAAQ,EAAE,GAAG,CAAC,kBAA4B,IAAI,OAAO,CAAC,QAAQ;wBAC9D,kFAAkF;wBAClF,KAAK,EAAE,KAAK;qBACb,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YAEd,UAAU,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,CAAA;YAChC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAA;YAChC,UAAU,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;YAC/B,UAAU,CAAC,IAAI,GAAG,gBAAgB,CAAA;YAClC,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;YAClC,UAAU,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;YACxC,UAAU,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;YAE1C,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAA;QACjC,CAAC;KACF,CAAA;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}

package/build/entrypoints.d.ts

@@ -0,0 +1,3 @@
+import type { EntrypointProtocolDeclaration } from '@owlmeans/entrypoint';
+export declare const makeAuthServiceEntrypoints: (serviceAlias: string, prefix?: string) => EntrypointProtocolDeclaration[];
+//# sourceMappingURL=entrypoints.d.ts.map

package/build/entrypoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAA;AAMzE,eAAO,MAAM,0BAA0B,iBACvB,MAAM,WACZ,MAAM,KACb,6BAA6B,EAa/B,CAAA"}

package/build/entrypoints.js

@@ -0,0 +1,10 @@
+import { contract, openProtocol, protocol, typed } from '@owlmeans/entrypoint';
+import { backend, route, RouteMethod, service } from '@owlmeans/route';
+import { authService } from './consts.js';
+import { GUARD_ED25519 } from '@owlmeans/auth-common';
+import { OIDCTokenUpdateSchema } from '@owlmeans/oidc';
+export const makeAuthServiceEntrypoints = (serviceAlias, prefix = 'oidc-api') => [
+    openProtocol(route(authService.provider.list, `/${prefix}/provider/:service`, service(serviceAlias)), { guards: GUARD_ED25519 }),
+    protocol(route(authService.auth.update, `/${prefix}/auth/update`, backend(service(serviceAlias), RouteMethod.POST)), contract.request({ body: typed(OIDCTokenUpdateSchema) }, typed()), { guards: GUARD_ED25519 }),
+];
+//# sourceMappingURL=entrypoints.js.map

package/build/entrypoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAE9E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAEtD,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACxC,YAAoB,EACpB,MAAM,GAAW,UAAU,EACM,EAAE,CAAC;IACpC,YAAY,CACV,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,MAAM,oBAAoB,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,EACvF,EAAE,MAAM,EAAE,aAAa,EAAE,CAC1B;IACD,QAAQ,CACN,KAAK,CACH,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,MAAM,cAAc,EACjD,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,CACjD,EACD,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,qBAAqB,CAAC,EAAE,EAAE,KAAK,EAAO,CAAC,EACtE,EAAE,MAAM,EAAE,aAAa,EAAE,CAC1B;CACF,CAAA"}

package/build/guard.d.ts

@@ -1,6 +1,10 @@
 import type { OidcGuardOptions } from '@owlmeans/oidc';
 import type { Config, Context } from './types.js';
-import type { CommonEntrypoint } from '@owlmeans/entrypoint';
 export declare const appendOidcGuard: <C extends Config, T extends Context<C>>(context: T, opts?: OidcGuardOptions) => T;
-export declare const setupOidcGuard: (modules: CommonEntrypoint[], coguards?: string | string[]) => void;
+/** Server-local OIDC handlers for the shared OIDC protocol pair. */
+export declare const oidcEntrypoints: (import("@owlmeans/server-entrypoint").ServerProtocolEntrypoint<import("@owlmeans/entrypoint").EntrypointProtocol<{
+    body: import("@owlmeans/oidc").OIDCAuthInitParams;
+}, any>> | import("@owlmeans/server-entrypoint").ServerProtocolEntrypoint<import("@owlmeans/entrypoint").EntrypointProtocol<{
+    body: import("@owlmeans/oidc").OIDCClientAuthPayload;
+}, any>>)[];
 //# sourceMappingURL=guard.d.ts.map

package/build/guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAS5D,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WAC3D,CAAC,SAAS,gBAAgB,MAKpC,CAAA;AAED,eAAO,MAAM,cAAc,YAAa,gBAAgB,EAAE,aAAa,MAAM,GAAG,MAAM,EAAE,SAKvF,CAAA"}
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAQjD,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WAC3D,CAAC,SAAS,gBAAgB,MAKpC,CAAA;AAED,oEAAoE;AACpE,eAAO,MAAM,eAAe;;;;WAG3B,CAAA"}