@owlmeans/server-oidc-rp 0.1.18-rc.2 → 0.1.18-rc.21

package/build/guard.js

@@ -1,13 +1,13 @@
-import { appendOidcGuard as appendBasicOidcGuard, setupOidcGuard as setupBasicOidcGuard, DISPATCHER_OIDC, DISPATCHER_OIDC_INIT } from '@owlmeans/oidc';
-import { elevate } from '@owlmeans/server-entrypoint';
+import { appendOidcGuard as appendBasicOidcGuard, oidcProtocols, } from '@owlmeans/oidc';
+import { bind } from '@owlmeans/server-entrypoint';
 import * as actions from './actions/index.js';
 export const appendOidcGuard = (context, opts) => {
     const ctx = appendBasicOidcGuard(context, opts);
     return ctx;
 };
-export const setupOidcGuard = (modules, coguards) => {
-    setupBasicOidcGuard(modules, coguards);
-    elevate(modules, DISPATCHER_OIDC_INIT, actions.init);
-    elevate(modules, DISPATCHER_OIDC, actions.authenticate);
-};
+/** Server-local OIDC handlers for the shared OIDC protocol pair. */
+export const oidcEntrypoints = [
+    bind(oidcProtocols.init, actions.init),
+    bind(oidcProtocols.authenticate, actions.authenticate),
+];
 //# sourceMappingURL=guard.js.map

package/build/guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,eAAe,IAAI,oBAAoB,EACvC,cAAc,IAAI,mBAAmB,EACrC,eAAe,EAAE,oBAAoB,EACtC,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AACrD,OAAO,KAAK,OAAO,MAAM,oBAAoB,CAAA;AAE7C,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,OAAU,EAAE,IAAuB,EACnC,EAAE;IACF,MAAM,GAAG,GAAG,oBAAoB,CAAO,OAAO,EAAE,IAAI,CAAC,CAAA;IAErD,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAA2B,EAAE,QAA4B,EAAE,EAAE;IAC1F,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IAEtC,OAAO,CAAC,OAAO,EAAE,oBAAoB,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IACpD,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;AACzD,CAAC,CAAA"}
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,eAAe,IAAI,oBAAoB,EACvC,aAAa,GACd,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAA;AAClD,OAAO,KAAK,OAAO,MAAM,oBAAoB,CAAA;AAE7C,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,OAAU,EAAE,IAAuB,EACnC,EAAE;IACF,MAAM,GAAG,GAAG,oBAAoB,CAAO,OAAO,EAAE,IAAI,CAAC,CAAA;IAErD,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED,oEAAoE;AACpE,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC;IACtC,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC;CACvD,CAAA"}

package/build/index.d.ts

@@ -3,7 +3,7 @@ export * from './consts.js';
 export * from './service.js';
 export * from './guard.js';
 export * from './gate.js';
-export * from './modules.js';
+export * from './entrypoints.js';
 export * from './wrapper.js';
 export { createGateModel } from './model/gate.js';
 export { extractPermissionSets } from './utils/permissions.js';

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,oBAAoB,EACpB,YAAY,EACZ,sBAAsB,EACtB,eAAe,EACf,kBAAkB,EAClB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,EACZ,MAAM,EACN,OAAO,EACP,qBAAqB,EACrB,WAAW,EACX,kBAAkB,GACnB,MAAM,YAAY,CAAA;AACnB,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,oBAAoB,EACpB,YAAY,EACZ,sBAAsB,EACtB,eAAe,EACf,kBAAkB,EAClB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,EACZ,MAAM,EACN,OAAO,EACP,qBAAqB,EACrB,WAAW,EACX,kBAAkB,GACnB,MAAM,YAAY,CAAA;AACnB,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,kBAAkB,CAAA;AAChC,cAAc,cAAc,CAAA;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA"}

package/build/index.js

@@ -2,7 +2,7 @@ export * from './consts.js';
 export * from './service.js';
 export * from './guard.js';
 export * from './gate.js';
-export * from './modules.js';
+export * from './entrypoints.js';
 export * from './wrapper.js';
 export { createGateModel } from './model/gate.js';
 export { extractPermissionSets } from './utils/permissions.js';

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAiBA,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAiBA,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,kBAAkB,CAAA;AAChC,cAAc,cAAc,CAAA;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA"}

package/build/model/gate.js

@@ -1,4 +1,4 @@
-import { AuthForbidden, AuthManagerError, AuthManagerUnsupported, AuthUnknown } from '@owlmeans/auth';
+import { AuthForbidden, AuthManagerError, AuthManagerUnsupported, AuthUnknown, entitySlugOf } from '@owlmeans/auth';
 import { authService, DEFAULT_ALIAS } from '../consts.js';
 import { cache, managedId } from '../utils/cache.js';
 import { ResponseMode } from './consts.js';
@@ -8,15 +8,15 @@ export const createGateModel = (ctx) => {
             const oidc = ctx.service(DEFAULT_ALIAS);
             try {
                 return await oidc.getClient({
-                    entityId: user.entityId,
-                    clientId: oidc.entityToClientId({ entityId: user.entityId })
+                    entityId: entitySlugOf(user),
+                    clientId: oidc.entityToClientId({ entityId: entitySlugOf(user) })
                 });
             }
             catch (e) {
                 if (e instanceof AuthManagerError) {
-                    const [providers] = await ctx.entrypoint(authService.provider.list).call({
+                    const providers = await ctx.entrypoint(authService.provider.list).call({
                         params: { service: ctx.cfg.alias ?? ctx.cfg.service },
-                        query: { entityId: user.entityId }
+                        query: { entityId: entitySlugOf(user) }
                     });
                     if (providers.length < 1) {
                         throw new AuthUnknown();
@@ -57,7 +57,7 @@ export const createGateModel = (ctx) => {
                     && (scope == null || (proof.scopes?.includes(scope) ?? false));
             });
         },
-        fixPermissions: (permissions, user) => permissions.map(perm => perm.replaceAll('{entity}', user.entityId ?? '-')),
+        fixPermissions: (permissions, user) => permissions.map(perm => perm.replaceAll('{entity}', entitySlugOf(user) ?? '-')),
         prepareRequest: async (client, request) => {
             let { permission, ..._request } = request;
             const params = new URLSearchParams(_request);

package/build/model/gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/model/gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AACrG,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAEzD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAEpD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAI1C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAyC,GAAM,EAAa,EAAE;IAC3F,MAAM,KAAK,GAAc;QACvB,SAAS,EAAE,KAAK,EAAC,IAAI,EAAC,EAAE;YACtB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;YAC1D,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC;oBAC1B,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;iBAC7D,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,gBAAgB,EAAE,CAAC;oBAClC,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,GAAG,CAAC,UAAU,CACtC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAC1B,CAAC,IAAI,CAAC;wBACL,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE;wBACrD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;qBACnC,CAAC,CAAA;oBACF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACzB,MAAM,IAAI,WAAW,EAAE,CAAA;oBACzB,CAAC;oBACD,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;oBAE5C,OAAO,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;gBAC9B,CAAC;gBACD,MAAM,CAAC,CAAA;YACT,CAAC;QACH,CAAC;QAED,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;YAC3C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAO,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;YAChE,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAA;YACnC,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YAE1C,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,EAAE,CAAA;YACrC,MAAM,aAAa,GAAG,QAAQ,CAAC,cAAc,CAAA;YAE7C,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,MAAM,IAAI,sBAAsB,CAAC,WAAW,CAAC,CAAA;YAC/C,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,WAAW,CACrC,KAAK,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,EACvC,MAAM,CACP,CAAA;YAED,OAAO,CAAC,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAA;YAEnD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,aAAa,EACb,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAC5C,CAAA;YAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC5B,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC,CAAA;gBAClC,CAAC;gBAED,OAAO,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;gBACnC,OAAO,EAAE,CAAA;YACX,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA0B,CAAA;YAE5D,OAAO,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;gBACrC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAA;gBACxD,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAA;gBAC5E,OAAO,KAAK,IAAI,IAAI;uBACf,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAA;YAClE,CAAC,CAAC,CAAA;QACJ,CAAC;QAED,cAAc,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CACpD,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,CAC1D;QAED,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;YACxC,IAAI,EAAE,UAAU,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAA;YACzC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAA;YAC5C,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;YAClE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAA;YAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;YAE9B,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;YAE9B,MAAM,OAAO,GAAG;gBACd,cAAc,EAAE,mCAAmC;gBACnD,eAAe,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;gBACnG,gBAAgB,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE;aACnC,CAAA;YAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;QAC1C,CAAC;QAED,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE;YACzC,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;YAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,EAAE,CAAA;YACrC,MAAM,UAAU,GAAG;gBACjB,UAAU,EAAE,6CAA6C;gBACzD,QAAQ,EAAE,QAAQ;gBAClB,SAAS,EAAE,QAAQ;gBACnB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE;oBACpD,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;oBAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;oBAC/D,IAAI,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;wBACb,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,EAAE,CAAA;oBAC7B,CAAC;yBAAM,CAAC;wBACN,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;oBACvD,CAAC;oBACD,OAAO,MAAM,CAAA;gBACf,CAAC,EAAE,EAAc,CAAC;gBAClB,aAAa,EAAE,YAAY,CAAC,WAAW;aACZ,CAAA;YAE7B,OAAO,UAAU,CAAA;QACnB,CAAC;KACF,CAAA;IAED,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/model/gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACnH,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAEzD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAEpD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAI1C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAyC,GAAM,EAAa,EAAE;IAC3F,MAAM,KAAK,GAAc;QACvB,SAAS,EAAE,KAAK,EAAC,IAAI,EAAC,EAAE;YACtB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;YAC1D,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC;oBAC1B,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC;oBAC5B,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;iBAClE,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,gBAAgB,EAAE,CAAC;oBAClC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,UAAU,CACpC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAC1B,CAAC,IAAI,CAAC;wBACL,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE;wBACrD,KAAK,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE;qBACxC,CAAC,CAAA;oBACF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACzB,MAAM,IAAI,WAAW,EAAE,CAAA;oBACzB,CAAC;oBACD,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;oBAE5C,OAAO,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;gBAC9B,CAAC;gBACD,MAAM,CAAC,CAAA;YACT,CAAC;QACH,CAAC;QAED,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;YAC3C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAO,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;YAChE,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAA;YACnC,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YAE1C,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,EAAE,CAAA;YACrC,MAAM,aAAa,GAAG,QAAQ,CAAC,cAAc,CAAA;YAE7C,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,MAAM,IAAI,sBAAsB,CAAC,WAAW,CAAC,CAAA;YAC/C,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,WAAW,CACrC,KAAK,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,EACvC,MAAM,CACP,CAAA;YAED,OAAO,CAAC,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAA;YAEnD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,aAAa,EACb,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAC5C,CAAA;YAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC5B,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC,CAAA;gBAClC,CAAC;gBAED,OAAO,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;gBACnC,OAAO,EAAE,CAAA;YACX,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA0B,CAAA;YAE5D,OAAO,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;gBACrC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAA;gBACxD,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAA;gBAC5E,OAAO,KAAK,IAAI,IAAI;uBACf,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAA;YAClE,CAAC,CAAC,CAAA;QACJ,CAAC;QAED,cAAc,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CACpD,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAC/D;QAED,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;YACxC,IAAI,EAAE,UAAU,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAA;YACzC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAA;YAC5C,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;YAClE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAA;YAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;YAE9B,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;YAE9B,MAAM,OAAO,GAAG;gBACd,cAAc,EAAE,mCAAmC;gBACnD,eAAe,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;gBACnG,gBAAgB,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE;aACnC,CAAA;YAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;QAC1C,CAAC;QAED,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE;YACzC,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;YAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,EAAE,CAAA;YACrC,MAAM,UAAU,GAAG;gBACjB,UAAU,EAAE,6CAA6C;gBACzD,QAAQ,EAAE,QAAQ;gBAClB,SAAS,EAAE,QAAQ;gBACnB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE;oBACpD,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;oBAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;oBAC/D,IAAI,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;wBACb,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,EAAE,CAAA;oBAC7B,CAAC;yBAAM,CAAC;wBACN,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;oBACvD,CAAC;oBACD,OAAO,MAAM,CAAA;gBACf,CAAC,EAAE,EAAc,CAAC;gBAClB,aAAa,EAAE,YAAY,CAAC,WAAW;aACZ,CAAA;YAE7B,OAAO,UAAU,CAAA;QACnB,CAAC;KACF,CAAA;IAED,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}

package/build/utils/auth.js

@@ -18,7 +18,7 @@ export const makeOidcAuthentication = (context) => async (credential) => {
         throw new AuthenPayloadError('code_challenge');
     }
     console.log("\n\nWe are picking verifier by id: ", verifierId(challenge));
-    const verification = await cache(context).pick(verifierId(challenge));
+    const verification = await cache(context).take(verifierId(challenge));
     console.log("Verification we get: ", verification, "\n\n");
     if (verification.verifier == null) {
         throw new AuthenFailed();

package/build/wrapper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wrapper.d.ts","sourceRoot":"","sources":["../src/wrapper.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAyC,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAc/F,eAAO,MAAM,uBAAuB,QAAO,kBAqH1C,CAAA"}
+{"version":3,"file":"wrapper.d.ts","sourceRoot":"","sources":["../src/wrapper.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAyC,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAc/F,eAAO,MAAM,uBAAuB,QAAO,kBAqI1C,CAAA"}

package/build/wrapper.js

@@ -33,7 +33,7 @@ export const makeOidcWrappingService = () => {
                 }
                 record.validated = new Date();
                 if (ctx.hasEntrypoint(authService.auth.update)) {
-                    const [update] = await ctx.entrypoint(authService.auth.update)
+                    const update = await ctx.entrypoint(authService.auth.update)
                         .call({ body: { token, tokenSet: record.payload } });
                     const updateEnvelope = makeEnvelopeModel(update.token, EnvelopeKind.Token);
                     const authManager = await trust(ctx, TRUSTED, AUTH_SRV_KEY);
@@ -46,11 +46,11 @@ export const makeOidcWrappingService = () => {
                         role: updatedAuth.role ?? AuthRole.Guest,
                         userId: updatedAuth.userId ?? user.userId,
                         profileId: updatedAuth.profileId,
-                        entityId: updatedAuth.entityId ?? user.entityId,
+                        entitySlug: updatedAuth.entitySlug ?? user.entitySlug,
                         createdAt: new Date()
                     };
                     if (updatedAuth.challenge !== user.token) {
-                        await cache(ctx).delete(record);
+                        await cache(ctx).delete(managedId(user.token));
                         updatedUser.token = updatedAuth.challenge;
                         record.id = managedId(updatedUser.token);
                     }
@@ -67,10 +67,25 @@ export const makeOidcWrappingService = () => {
                     if (defaultClientId != null) {
                         let tokenSet = record.payload;
                         const client = await oidc.getClient(defaultClientId);
-                        if (days.unix(tokenSet.expires_at ?? 0).isBefore()) {
+                        // Revalidate using only what this session and this provider actually support.
+                        // `expires_at` is the token set's own absolute expiry; **absent is not expired** —
+                        // reading a missing value as the epoch (the former `?? 0`) sent every single
+                        // validation, including one moments after login, down the refresh path. That path
+                        // cannot work for a session granted without `offline_access`, because such a token
+                        // set carries no refresh token at all, so a valid login died as a 403.
+                        const expiresAt = tokenSet.expires_at;
+                        if (expiresAt != null && days.unix(expiresAt).isBefore()) {
+                            if (tokenSet.refresh_token == null) {
+                                // Expired with nothing to renew it — the user has to authenticate again.
+                                throw new AuthorizationError('access-token');
+                            }
                             tokenSet = await client.refresh(tokenSet);
                         }
-                        else {
+                        else if (client.getMetadata().introspection_endpoint != null) {
+                            // Introspection is the only way to notice a revocation that happened before the
+                            // token's own expiry, so it stays the check of choice — but it is an optional
+                            // provider feature. Calling an endpoint the discovery document never advertised
+                            // throws, which would fail the session for the opposite reason to the one above.
                             const result = await client.introspect(tokenSet, 'access_token');
                             if (!result.active) {
                                 throw new AuthorizationError('access-token');

package/build/wrapper.js.map

@@ -1 +1 @@
-{"version":3,"file":"wrapper.js","sourceRoot":"","sources":["../src/wrapper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAE3E,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACjE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAEnD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAClG,OAAO,IAAI,MAAM,OAAO,CAAA;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAChC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAE9D,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AAEnD,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAuB,EAAE;IAC9D,MAAM,OAAO,GAAG,aAAa,CAAqB,YAAY,EAAE;QAC9D,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YAChD,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAA;YACxD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACvC,CAAC;YACD,MAAM,CAAC,EAAE,cAAc,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC3C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,cAAc,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAC5E,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YAE/B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;gBAC1D,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;oBAC7C,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;gBACxC,CAAC;gBAED,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;qBACnD,GAAG,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;oBACtD,OAAO,EAAE,KAAK,EAAE,CAAA;gBAClB,CAAC;gBAED,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAA;gBAE7B,IAAI,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC/C,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,UAAU,CAAoC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;yBAC9F,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;oBAEtD,MAAM,cAAc,GAAG,iBAAiB,CAAkB,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;oBAC3F,MAAM,WAAW,GAAG,MAAM,KAAK,CAAkB,GAAG,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;oBAC5E,IAAI,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;wBAClD,MAAM,IAAI,YAAY,EAAE,CAAA;oBAC1B,CAAC;oBAED,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,EAAE,CAAA;oBAE5C,MAAM,WAAW,GAAS;wBACxB,GAAG,IAAI;wBACP,IAAI,EAAE,WAAW,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK;wBACxC,MAAM,EAAE,WAAW,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM;wBACzC,SAAS,EAAE,WAAW,CAAC,SAAS;wBAChC,QAAQ,EAAE,WAAW,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;wBAC/C,SAAS,EAAE,IAAI,IAAI,EAAE;qBACtB,CAAA;oBAED,IAAI,WAAW,CAAC,SAAS,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;wBACzC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;wBAC/B,WAAW,CAAC,KAAK,GAAG,WAAW,CAAC,SAAS,CAAA;wBACzC,MAAM,CAAC,EAAE,GAAG,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;oBAC1C,CAAC;oBAGD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;oBAC5F,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAO,kBAAkB,CAAC;yBACpE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;oBAEhE,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,QAAkC,CAAA;oBAE1D,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,mBAAmB,GAAG,IAAI,EAAE,CAAC,CAAA;oBAElE,OAAO,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,WAAW,EAAE,IAAI,aAAa,EAAE,EAAE,CAAA;gBAC1E,CAAC;qBAAM,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;oBAClC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;oBAC1D,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;oBACzC,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;wBAC5B,IAAI,QAAQ,GAAyB,MAAM,CAAC,OAA+B,CAAA;wBAC3E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;wBACpD,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;4BACnD,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,QAAkC,CAAyB,CAAA;wBAC7F,CAAC;6BAAM,CAAC;4BACN,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,QAAkC,EAAE,cAAc,CAAC,CAAA;4BAC1F,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gCACnB,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAA;4BAC9C,CAAC;wBACH,CAAC;wBAED,MAAM,WAAW,GAAS;4BACxB,GAAG,IAAI;4BACP,SAAS,EAAE,IAAI,IAAI,EAAE;yBACtB,CAAA;wBAED,qEAAqE;wBACrE,IAAI,QAAQ,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;4BAC9B,MAAM,WAAW,GAAG,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAA;4BAC1F,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;gCACxB,WAAW,CAAC,WAAW,GAAG,WAAW,CAAA;gCACrC,WAAW,CAAC,YAAY,GAAG,IAAI,CAAA;4BACjC,CAAC;wBACH,CAAC;wBAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;wBAC5F,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAO,kBAAkB,CAAC;6BACpE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;wBAEhE,MAAM,CAAC,OAAO,GAAG,QAAkC,CAAA;wBAEnD,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,mBAAmB,GAAG,IAAI,EAAE,CAAC,CAAA;wBAElE,OAAO,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,WAAW,EAAE,IAAI,aAAa,EAAE,EAAE,CAAA;oBAC1E,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAClB,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;gBAC9C,IAAI,GAAG,EAAE,CAAC;oBACR,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;wBACtC,MAAM,GAAG,CAAA;oBACX,CAAC;oBACD,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;gBACzC,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
+{"version":3,"file":"wrapper.js","sourceRoot":"","sources":["../src/wrapper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAE3E,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACjE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAEnD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAClG,OAAO,IAAI,MAAM,OAAO,CAAA;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAChC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAE9D,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AAEnD,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAuB,EAAE;IAC9D,MAAM,OAAO,GAAG,aAAa,CAAqB,YAAY,EAAE;QAC9D,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YAChD,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAA;YACxD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACvC,CAAC;YACD,MAAM,CAAC,EAAE,cAAc,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC3C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,cAAc,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAC5E,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YAE/B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;gBAC1D,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;oBAC7C,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;gBACxC,CAAC;gBAED,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;qBACnD,GAAG,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;oBACtD,OAAO,EAAE,KAAK,EAAE,CAAA;gBAClB,CAAC;gBAED,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAA;gBAE7B,IAAI,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC/C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAoC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;yBAC5F,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;oBAEtD,MAAM,cAAc,GAAG,iBAAiB,CAAkB,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;oBAC3F,MAAM,WAAW,GAAG,MAAM,KAAK,CAAkB,GAAG,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;oBAC5E,IAAI,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;wBAClD,MAAM,IAAI,YAAY,EAAE,CAAA;oBAC1B,CAAC;oBAED,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,EAAE,CAAA;oBAE5C,MAAM,WAAW,GAAS;wBACxB,GAAG,IAAI;wBACP,IAAI,EAAE,WAAW,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK;wBACxC,MAAM,EAAE,WAAW,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM;wBACzC,SAAS,EAAE,WAAW,CAAC,SAAS;wBAChC,UAAU,EAAE,WAAW,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU;wBACrD,SAAS,EAAE,IAAI,IAAI,EAAE;qBACtB,CAAA;oBAED,IAAI,WAAW,CAAC,SAAS,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;wBACzC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;wBAC9C,WAAW,CAAC,KAAK,GAAG,WAAW,CAAC,SAAS,CAAA;wBACzC,MAAM,CAAC,EAAE,GAAG,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;oBAC1C,CAAC;oBAGD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;oBAC5F,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAO,kBAAkB,CAAC;yBACpE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;oBAEhE,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,QAAkC,CAAA;oBAE1D,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,mBAAmB,GAAG,IAAI,EAAE,CAAC,CAAA;oBAElE,OAAO,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,WAAW,EAAE,IAAI,aAAa,EAAE,EAAE,CAAA;gBAC1E,CAAC;qBAAM,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;oBAClC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;oBAC1D,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;oBACzC,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;wBAC5B,IAAI,QAAQ,GAAyB,MAAM,CAAC,OAA+B,CAAA;wBAC3E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;wBAEpD,8EAA8E;wBAC9E,mFAAmF;wBACnF,6EAA6E;wBAC7E,kFAAkF;wBAClF,mFAAmF;wBACnF,uEAAuE;wBACvE,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAA;wBACrC,IAAI,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;4BACzD,IAAI,QAAQ,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;gCACnC,yEAAyE;gCACzE,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAA;4BAC9C,CAAC;4BACD,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,QAAkC,CAAyB,CAAA;wBAC7F,CAAC;6BAAM,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,sBAAsB,IAAI,IAAI,EAAE,CAAC;4BAC/D,gFAAgF;4BAChF,8EAA8E;4BAC9E,gFAAgF;4BAChF,iFAAiF;4BACjF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,QAAkC,EAAE,cAAc,CAAC,CAAA;4BAC1F,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gCACnB,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAA;4BAC9C,CAAC;wBACH,CAAC;wBAED,MAAM,WAAW,GAAS;4BACxB,GAAG,IAAI;4BACP,SAAS,EAAE,IAAI,IAAI,EAAE;yBACtB,CAAA;wBAED,qEAAqE;wBACrE,IAAI,QAAQ,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;4BAC9B,MAAM,WAAW,GAAG,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAA;4BAC1F,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;gCACxB,WAAW,CAAC,WAAW,GAAG,WAAW,CAAA;gCACrC,WAAW,CAAC,YAAY,GAAG,IAAI,CAAA;4BACjC,CAAC;wBACH,CAAC;wBAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;wBAC5F,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAO,kBAAkB,CAAC;6BACpE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;wBAEhE,MAAM,CAAC,OAAO,GAAG,QAAkC,CAAA;wBAEnD,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,mBAAmB,GAAG,IAAI,EAAE,CAAC,CAAA;wBAElE,OAAO,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,WAAW,EAAE,IAAI,aAAa,EAAE,EAAE,CAAA;oBAC1E,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAClB,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;gBAC9C,IAAI,GAAG,EAAE,CAAC;oBACR,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;wBACtC,MAAM,GAAG,CAAA;oBACX,CAAC;oBACD,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;gBACzC,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-oidc-rp",
-  "version": "0.1.18-rc.2",
+  "version": "0.1.18-rc.21",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -37,29 +37,29 @@
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/test-auth": "^0.1.18-rc.2",
-    "@types/bun": "^1.3.14",
+    "@owlmeans/test-auth": "^0.1.18-rc.16",
+    "@types/bun": "^1.4.0",
     "@types/node": "^26.1.0",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"
   },
   "dependencies": {
     "@noble/hashes": "^1.5.0",
-    "@owlmeans/auth": "^0.1.18-rc.2",
-    "@owlmeans/auth-common": "^0.1.18-rc.2",
-    "@owlmeans/basic-envelope": "^0.1.18-rc.2",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.2",
-    "@owlmeans/config": "^0.1.18-rc.2",
-    "@owlmeans/context": "^0.1.18-rc.2",
-    "@owlmeans/did": "^0.1.18-rc.2",
-    "@owlmeans/entrypoint": "^0.1.18-rc.2",
-    "@owlmeans/oidc": "^0.1.18-rc.2",
-    "@owlmeans/resource": "^0.1.18-rc.2",
-    "@owlmeans/route": "^0.1.18-rc.2",
-    "@owlmeans/server-api": "^0.1.18-rc.2",
-    "@owlmeans/server-auth": "^0.1.18-rc.2",
-    "@owlmeans/server-context": "^0.1.18-rc.2",
-    "@owlmeans/server-entrypoint": "^0.1.18-rc.2",
+    "@owlmeans/auth": "^0.1.18-rc.12",
+    "@owlmeans/auth-common": "^0.1.18-rc.16",
+    "@owlmeans/basic-envelope": "^0.1.18-rc.15",
+    "@owlmeans/client-entrypoint": "^0.1.18-rc.16",
+    "@owlmeans/config": "^0.1.18-rc.15",
+    "@owlmeans/context": "^0.1.18-rc.11",
+    "@owlmeans/did": "^0.1.18-rc.15",
+    "@owlmeans/entrypoint": "^0.1.18-rc.14",
+    "@owlmeans/oidc": "^0.1.18-rc.24",
+    "@owlmeans/resource": "^0.1.18-rc.12",
+    "@owlmeans/route": "^0.1.18-rc.12",
+    "@owlmeans/server-api": "^0.1.18-rc.20",
+    "@owlmeans/server-auth": "^0.1.18-rc.21",
+    "@owlmeans/server-context": "^0.1.18-rc.15",
+    "@owlmeans/server-entrypoint": "^0.1.18-rc.14",
     "@scure/base": "^2.3.0",
     "dayjs": "^1.11.13",
     "jose": "6.2.5",

package/src/actions/init.ts

@@ -45,7 +45,7 @@ export const init: RefedEntrypointHandler = handleBody(async (body: OIDCAuthInit
      * @TODO We need to move it to some remote resource.
      * And make oidc service itself use such a resource to get required client.
      */
-    const [providers] = await context.entrypoint<ClientEntrypoint<OidcProviderDescriptor[]>>(
+    const providers = await context.entrypoint<ClientEntrypoint<OidcProviderDescriptor[]>>(
       authService.provider.list
     ).call({
       params: { service: context.cfg.alias ?? context.cfg.service },
@@ -93,7 +93,7 @@ export const init: RefedEntrypointHandler = handleBody(async (body: OIDCAuthInit
     ...(entityIdUsedForResolution ? { entityId } : {}),
   }, { ttl: AUTHEN_TIMEFRAME / 1000 })
 
-  const [dispatcherUrl] = await context.entrypoint<ClientEntrypoint<string>>(DISPATCHER).call()
+  const dispatcherUrl = await context.entrypoint<ClientEntrypoint<string>>(DISPATCHER).url()
 
   const cfg = client.getConfig()
   const url = client.makeAuthUrl({

package/src/actions/process.ts

@@ -59,18 +59,11 @@ export const authenticate: RefedEntrypointHandler = handleBody(async (
 
   await cache(context).delete(exchangeId(token))
 
-  console.log(
-    'List provided user permisssions',
-    decodeJwt(tokenSet.access_token)
-  )
-
+  // Only the id_token is guaranteed to be a JWT. An access token's format is provider-private —
+  // `oidc-provider` issues opaque ones by default — so decoding it throws `JWTInvalid` and, from
+  // inside this handler, fails the whole exchange after it has already succeeded. Nothing here
+  // needs it either: the permission grant is read from the id_token below.
   const id = decodeJwt(tokenSet.id_token)
-  console.log(
-    'token set',
-    tokenSet,
-    tokenSet.claims(),
-    id
-  )
 
   // Integrated IAM mode: the provider mints the subject's PermissionSet[] into the id_token
   const permissions = extractPermissionSets(id[PERMISSIONS_CLAIM])
@@ -95,7 +88,7 @@ export const authenticate: RefedEntrypointHandler = handleBody(async (
     // @TODO Actually this is highly incorrect - we need to get profile details
     // from the OwlMeans Auth intead
     // profileId: user?.userId,
-    entityId: cfg.entityId,
+    entitySlug: cfg.entityId,
     ...(permissions != null ? { permissions, permissioned: true } : {}),
     isUser: true,
     createdAt: new Date(),

package/src/auth/plugins/google-client.ts

@@ -89,7 +89,7 @@ export const googleClientPlugin = <C extends Config, T extends Context<C>>(conte
       }
 
       // Look up the PKCE verifier using the state parameter
-      const verification = await cache<C, T>(context).pick(verifierId(state))
+      const verification = await cache<C, T>(context).take(verifierId(state))
       if (verification == null || verification.verifier == null) {
         throw new AuthenFailed()
       }
@@ -179,7 +179,7 @@ export const googleClientPlugin = <C extends Config, T extends Context<C>>(conte
       credential.type = GOOGLE_CLIENT_AUTH
       credential.userId = profile.userId
       credential.profileId = profile.profileId
-      credential.entityId = profile.entityId
+      credential.entitySlug = profile.entitySlug
 
       return { token: exchangeToken }
     }

package/src/auth/plugins/oidc-client.ts

@@ -8,7 +8,7 @@ import type { OidcUserDetails, ProviderProfileDetails } from '@owlmeans/oidc'
 import { base64urlnopad as base64 } from '@scure/base'
 import { randomBytes } from '@noble/hashes/utils'
 import { sha256 } from '@noble/hashes/sha256'
-import { ALL_SCOPES, AuthenFailed, AuthenPayloadError, AuthManagerError, AuthRole } from '@owlmeans/auth'
+import { ALL_SCOPES, AuthenFailed, AuthenPayloadError, AuthManagerError, AuthRole, entitySlugOf } from '@owlmeans/auth'
 import { AUTHEN_TIMEFRAME } from '@owlmeans/server-auth'
 import { decodeJwt } from 'jose'
 import { KEY_OWL } from '@owlmeans/did'
@@ -78,7 +78,7 @@ export const oidcClientPlugin = <C extends Config, T extends Context<C>>(context
       
       // @TODO Actually think about how to make oidc service configurable
       const oidc = context.service<OidcClientService>(DEFAULT_ALIAS)
-      let entityId = request.entityId ?? oidc.getDefault()
+      let entityId = entitySlugOf(request) ?? oidc.getDefault()
 
       if (entityId == null) {
         throw new AuthenPayloadError('client')
@@ -237,7 +237,7 @@ export const oidcClientPlugin = <C extends Config, T extends Context<C>>(context
       credential.type = OIDC_CLIENT_AUTH
       credential.userId = profile.userId
       credential.profileId = profile.profileId
-      credential.entityId = profile.entityId
+      credential.entitySlug = profile.entitySlug
 
       return { token: exchangeToken }
     }

package/src/entrypoints.ts

@@ -0,0 +1,24 @@
+import { contract, openProtocol, protocol, typed } from '@owlmeans/entrypoint'
+import type { EntrypointProtocolDeclaration } from '@owlmeans/entrypoint'
+import { backend, route, RouteMethod, service } from '@owlmeans/route'
+import { authService } from './consts.js'
+import { GUARD_ED25519 } from '@owlmeans/auth-common'
+import { OIDCTokenUpdateSchema } from '@owlmeans/oidc'
+
+export const makeAuthServiceEntrypoints = (
+  serviceAlias: string,
+  prefix: string = 'oidc-api'
+): EntrypointProtocolDeclaration[] => [
+  openProtocol(
+    route(authService.provider.list, `/${prefix}/provider/:service`, service(serviceAlias)),
+    { guards: GUARD_ED25519 },
+  ),
+  protocol(
+    route(
+      authService.auth.update, `/${prefix}/auth/update`,
+      backend(service(serviceAlias), RouteMethod.POST),
+    ),
+    contract.request({ body: typed(OIDCTokenUpdateSchema) }, typed<any>()),
+    { guards: GUARD_ED25519 },
+  ),
+]

package/src/guard.ts

@@ -1,12 +1,10 @@
 import type { OidcGuardOptions } from '@owlmeans/oidc'
 import type { Config, Context } from './types.js'
-import type { CommonEntrypoint } from '@owlmeans/entrypoint'
 import { 
-  appendOidcGuard as appendBasicOidcGuard, 
-  setupOidcGuard as setupBasicOidcGuard, 
-  DISPATCHER_OIDC, DISPATCHER_OIDC_INIT 
+  appendOidcGuard as appendBasicOidcGuard,
+  oidcProtocols,
 } from '@owlmeans/oidc'
-import { elevate } from '@owlmeans/server-entrypoint'
+import { bind } from '@owlmeans/server-entrypoint'
 import * as actions from './actions/index.js'
 
 export const appendOidcGuard = <C extends Config, T extends Context<C>>(
@@ -17,9 +15,8 @@ export const appendOidcGuard = <C extends Config, T extends Context<C>>(
   return ctx
 }
 
-export const setupOidcGuard = (modules: CommonEntrypoint[], coguards?: string | string[]) => {
-  setupBasicOidcGuard(modules, coguards)
-
-  elevate(modules, DISPATCHER_OIDC_INIT, actions.init)
-  elevate(modules, DISPATCHER_OIDC, actions.authenticate)
-}
+/** Server-local OIDC handlers for the shared OIDC protocol pair. */
+export const oidcEntrypoints = [
+  bind(oidcProtocols.init, actions.init),
+  bind(oidcProtocols.authenticate, actions.authenticate),
+]

package/src/index.ts

@@ -19,7 +19,7 @@ export * from './consts.js'
 export * from './service.js'
 export * from './guard.js'
 export * from './gate.js'
-export * from './modules.js'
+export * from './entrypoints.js'
 export * from './wrapper.js'
 export { createGateModel } from './model/gate.js'
 export { extractPermissionSets } from './utils/permissions.js'

package/src/model/gate.ts

@@ -1,4 +1,4 @@
-import { AuthForbidden, AuthManagerError, AuthManagerUnsupported, AuthUnknown } from '@owlmeans/auth'
+import { AuthForbidden, AuthManagerError, AuthManagerUnsupported, AuthUnknown, entitySlugOf } from '@owlmeans/auth'
 import { authService, DEFAULT_ALIAS } from '../consts.js'
 import type { Config, Context, OidcClientService } from '../types.js'
 import { cache, managedId } from '../utils/cache.js'
@@ -13,16 +13,16 @@ export const createGateModel = <C extends Config, T extends Context<C>>(ctx: T):
       const oidc = ctx.service<OidcClientService>(DEFAULT_ALIAS)
       try {
         return await oidc.getClient({
-          entityId: user.entityId,
-          clientId: oidc.entityToClientId({ entityId: user.entityId })
+          entityId: entitySlugOf(user),
+          clientId: oidc.entityToClientId({ entityId: entitySlugOf(user) })
         })
       } catch (e) {
         if (e instanceof AuthManagerError) {
-          const [providers] = await ctx.entrypoint<ClientEntrypoint<OidcProviderDescriptor[]>>(
+          const providers = await ctx.entrypoint<ClientEntrypoint<OidcProviderDescriptor[]>>(
             authService.provider.list
           ).call({
             params: { service: ctx.cfg.alias ?? ctx.cfg.service },
-            query: { entityId: user.entityId }
+            query: { entityId: entitySlugOf(user) }
           })
           if (providers.length < 1) {
             throw new AuthUnknown()
@@ -83,7 +83,7 @@ export const createGateModel = <C extends Config, T extends Context<C>>(ctx: T):
     },
 
     fixPermissions: (permissions, user) => permissions.map(
-      perm => perm.replaceAll('{entity}', user.entityId ?? '-')
+      perm => perm.replaceAll('{entity}', entitySlugOf(user) ?? '-')
     ),
 
     prepareRequest: async (client, request) => {

package/src/utils/auth.ts

@@ -24,7 +24,7 @@ export const makeOidcAuthentication = <C extends Config, T extends Context<C>>(c
     }
 
     console.log("\n\nWe are picking verifier by id: ", verifierId(challenge))
-    const verification = await cache<C, T>(context).pick(verifierId(challenge))
+    const verification = await cache<C, T>(context).take(verifierId(challenge))
     console.log("Verification we get: ", verification, "\n\n")
     if (verification.verifier == null) {
       throw new AuthenFailed()

package/src/wrapper.ts

@@ -42,7 +42,7 @@ export const makeOidcWrappingService = (): WrappedOIDCService => {
         record.validated = new Date()
 
         if (ctx.hasEntrypoint(authService.auth.update)) {
-          const [update] = await ctx.entrypoint<ClientEntrypoint<OIDCTokenUpdate>>(authService.auth.update)
+          const update = await ctx.entrypoint<ClientEntrypoint<OIDCTokenUpdate>>(authService.auth.update)
             .call({ body: { token, tokenSet: record.payload } })
 
           const updateEnvelope = makeEnvelopeModel<AuthCredentials>(update.token, EnvelopeKind.Token)
@@ -58,12 +58,12 @@ export const makeOidcWrappingService = (): WrappedOIDCService => {
             role: updatedAuth.role ?? AuthRole.Guest,
             userId: updatedAuth.userId ?? user.userId,
             profileId: updatedAuth.profileId,
-            entityId: updatedAuth.entityId ?? user.entityId,
+            entitySlug: updatedAuth.entitySlug ?? user.entitySlug,
             createdAt: new Date()
           }
 
           if (updatedAuth.challenge !== user.token) {
-            await cache(ctx).delete(record)
+            await cache(ctx).delete(managedId(user.token))
             updatedUser.token = updatedAuth.challenge
             record.id = managedId(updatedUser.token)
           }
@@ -84,9 +84,25 @@ export const makeOidcWrappingService = (): WrappedOIDCService => {
           if (defaultClientId != null) {
             let tokenSet: CommonTokenSetParams = record.payload as CommonTokenSetParams
             const client = await oidc.getClient(defaultClientId)
-            if (days.unix(tokenSet.expires_at ?? 0).isBefore()) {
+
+            // Revalidate using only what this session and this provider actually support.
+            // `expires_at` is the token set's own absolute expiry; **absent is not expired** —
+            // reading a missing value as the epoch (the former `?? 0`) sent every single
+            // validation, including one moments after login, down the refresh path. That path
+            // cannot work for a session granted without `offline_access`, because such a token
+            // set carries no refresh token at all, so a valid login died as a 403.
+            const expiresAt = tokenSet.expires_at
+            if (expiresAt != null && days.unix(expiresAt).isBefore()) {
+              if (tokenSet.refresh_token == null) {
+                // Expired with nothing to renew it — the user has to authenticate again.
+                throw new AuthorizationError('access-token')
+              }
               tokenSet = await client.refresh(tokenSet as OidcTokenSetParameters) as CommonTokenSetParams
-            } else {
+            } else if (client.getMetadata().introspection_endpoint != null) {
+              // Introspection is the only way to notice a revocation that happened before the
+              // token's own expiry, so it stays the check of choice — but it is an optional
+              // provider feature. Calling an endpoint the discovery document never advertised
+              // throws, which would fail the session for the opposite reason to the one above.
               const result = await client.introspect(tokenSet as OidcTokenSetParameters, 'access_token')
               if (!result.active) {
                 throw new AuthorizationError('access-token')

package/tests/context.ts

@@ -1,4 +1,4 @@
-import { AppType, Layer, makeBasicContext } from '@owlmeans/context'
+import { AppType, makeBasicContext } from '@owlmeans/context'
 import type { BasicConfig, BasicContext } from '@owlmeans/context'
 import { createStaticResource } from '@owlmeans/static-resource'
 import { AUTH_CACHE } from '@owlmeans/server-auth'
@@ -12,7 +12,6 @@ export const makeTestContext = () => {
   const cfg: Config = {
     ready: false,
     service: 'server-oidc-rp-tests',
-    layer: Layer.Service,
     type: AppType.Backend,
     services: {},
     oidc: {

package/build/modules.d.ts

@@ -1,3 +0,0 @@
-import type { CommonEntrypoint } from '@owlmeans/entrypoint';
-export declare const setupAuthServiceModules: (modules: CommonEntrypoint[], serviceAlias: string, prefix?: string) => void;
-//# sourceMappingURL=modules.d.ts.map

package/build/modules.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAQ5D,eAAO,MAAM,uBAAuB,YACzB,gBAAgB,EAAE,gBACb,MAAM,WACZ,MAAM,SAkBf,CAAA"}

package/build/modules.js

@@ -1,12 +0,0 @@
-import { entrypoint, guard, filter, body } from '@owlmeans/entrypoint';
-import { backend, route, RouteMethod, service } from '@owlmeans/route';
-import { authService } from './consts.js';
-import { elevate } from '@owlmeans/client-entrypoint';
-import { GUARD_ED25519 } from '@owlmeans/auth-common';
-import { OIDCTokenUpdateSchema } from '@owlmeans/oidc';
-export const setupAuthServiceModules = (modules, serviceAlias, prefix = 'oidc-api') => {
-    modules.push(entrypoint(route(authService.provider.list, `/${prefix}/provider/:service`, service(serviceAlias)), guard(GUARD_ED25519)), entrypoint(route(authService.auth.update, `/${prefix}/auth/update`, backend(service(serviceAlias), RouteMethod.POST)), filter(body(OIDCTokenUpdateSchema), guard(GUARD_ED25519))));
-    elevate(modules, authService.provider.list);
-    elevate(modules, authService.auth.update);
-};
-//# sourceMappingURL=modules.js.map

package/build/modules.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"modules.js","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAA;AACtE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAEtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,OAA2B,EAC3B,YAAoB,EACpB,MAAM,GAAW,UAAU,EAC3B,EAAE;IACF,OAAO,CAAC,IAAI,CACV,UAAU,CACR,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,MAAM,oBAAoB,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,EACvF,KAAK,CAAC,aAAa,CAAC,CACrB,EACD,UAAU,CACR,KAAK,CACH,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,MAAM,cAAc,EACjD,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,CACjD,EACD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAC1D,CACF,CAAA;IAED,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC3C,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AAC3C,CAAC,CAAA"}

package/src/modules.ts

@@ -1,30 +0,0 @@
-import type { CommonEntrypoint } from '@owlmeans/entrypoint'
-import { entrypoint, guard, filter, body } from '@owlmeans/entrypoint'
-import { backend, route, RouteMethod, service } from '@owlmeans/route'
-import { authService } from './consts.js'
-import { elevate } from '@owlmeans/client-entrypoint'
-import { GUARD_ED25519 } from '@owlmeans/auth-common'
-import { OIDCTokenUpdateSchema } from '@owlmeans/oidc'
-
-export const setupAuthServiceModules = (
-  modules: CommonEntrypoint[],
-  serviceAlias: string,
-  prefix: string = 'oidc-api'
-) => {
-  modules.push(
-    entrypoint(
-      route(authService.provider.list, `/${prefix}/provider/:service`, service(serviceAlias)),
-      guard(GUARD_ED25519)
-    ),
-    entrypoint(
-      route(
-        authService.auth.update, `/${prefix}/auth/update`,
-        backend(service(serviceAlias), RouteMethod.POST)
-      ),
-      filter(body(OIDCTokenUpdateSchema), guard(GUARD_ED25519))
-    )
-  )
-
-  elevate(modules, authService.provider.list)
-  elevate(modules, authService.auth.update)
-}