@owlmeans/server-oidc-rp 0.1.18-rc.26 → 0.1.18-rc.28

package/README.md

@@ -39,7 +39,7 @@ import { withOidcGuard } from '@owlmeans/oidc'
 import { oidcEntrypoints } from '@owlmeans/server-oidc-rp'
 
 const configuredProtocols = withOidcGuard(protocols)
-const appEntrypoints = [
+const serverBindings = [
   // Bind application protocols against configuredProtocols here.
   ...oidcEntrypoints,
 ]
@@ -117,7 +117,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.19
+npx @owlmeans/agent-skills@^0.1.18-rc.20
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-oidc-rp",
-  "version": "0.1.18-rc.26",
-  "generatedAt": "2026-09-12T13:51:53.536Z",
+  "version": "0.1.18-rc.28",
+  "generatedAt": "2026-09-14T17:28:17.884Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-oidc-rp/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/server-oidc-rp
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-oidc-rp": "^0.1.18-rc.26"` in `dependencies`
+**Install:** `"@owlmeans/server-oidc-rp": "^0.1.18-rc.28"` in `dependencies`
 
 ## Key Exports
 
@@ -57,7 +57,7 @@ import { oidcEntrypoints, makeAuthServiceEntrypoints } from '@owlmeans/server-oi
 import { bindAll } from '@owlmeans/server-entrypoint'
 
 export const configuredProtocols = withOidcGuard(protocols)
-export const appEntrypoints = [
+export const serverBindings = [
   ...bindAll(configuredProtocols.api),
   ...oidcEntrypoints,
   ...bindAll(makeAuthServiceEntrypoints('my-auth-api')),
@@ -164,6 +164,29 @@ every field it is given; a stored `entityId` that was never validated against th
 — a caller-side default or placeholder, say — makes the exchange fail with a bare `AuthenFailed()`
 even though the same default provider is trivially available again at exchange time.
 
+## Building the redirect URI: the init handler has no `url()`
+
+`init.ts` runs on the SERVER, but `DISPATCHER` (`@owlmeans/auth`) is a FRONTEND route
+(`frontend({ service: DISPATCHER })` in `@owlmeans/auth-common`'s entrypoints) — the browser page
+the identity provider redirects back to. `.url()` is attached to an entrypoint reference only by
+`@owlmeans/client-entrypoint`, for a browser context that can resolve its own address; a server
+context's `context.entrypoint(DISPATCHER)` is a `CommonEntrypoint` and has no such method. Typing
+the call as `ClientEntrypoint<string>` (which does declare `.url()`) type-checks and builds clean
+but throws at request time: `context.entrypoint(DISPATCHER).url is not a function`. This shipped
+unnoticed for a long time because it is unreachable until a caller's own OIDC login FLOW actually
+reaches the step that calls `authenticate()` — a consumer whose flow config never reaches that step
+never exercises this line, so the fault surfaces only in a fully wired application, and only on the
+very first sign-in attempt.
+
+The fix — and the pattern for anywhere else in this package (or a consumer) that needs an absolute
+URL for a route it does not own — is the one `@owlmeans/server-oidc-provider`'s interaction `url`
+callback already uses: type the reference as `CommonEntrypoint`, then compose the address from
+`.path()` and `.address()` through `makeSecurityHelper(ctx).makeUrl(entry.address(), entry.path())`
+(`@owlmeans/config`). A route with path params (this one has none) needs its own substitution
+first, the way the interaction URL substitutes `:uid` before qualifying it. Typing the reference as
+`CommonEntrypoint` rather than `ClientEntrypoint` is itself the regression guard: calling `.url()`
+on it is now a compile error, not a runtime one.
+
 ## Public type contract (isolation principle)
 
 `openid-client` types **never appear in this package's public exports**. All public types are

package/build/actions/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/actions/init.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAkBzE,eAAO,MAAM,IAAI,EAAE,sBA0FjB,CAAA"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/actions/init.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAoBzE,eAAO,MAAM,IAAI,EAAE,sBAiGjB,CAAA"}

package/build/actions/init.js

@@ -1,6 +1,7 @@
 import { handleBody } from '@owlmeans/server-api';
 import { AuthenPayloadError, AuthUnknown, DISPATCHER } from '@owlmeans/auth';
 import { assertContext } from '@owlmeans/context';
+import { makeSecurityHelper } from '@owlmeans/config';
 import { authService, DEFAULT_ALIAS } from '../consts.js';
 // import {  PROVIDER_CACHE_TTL } from '../consts.js'
 // import type { Client } from 'openid-client'
@@ -72,7 +73,14 @@ export const init = handleBody(async (body, ctx) => {
         client: client.getClientId(),
         ...(entityIdUsedForResolution ? { entityId } : {}),
     }, { ttl: AUTHEN_TIMEFRAME / 1000 });
-    const dispatcherUrl = await context.entrypoint(DISPATCHER).url();
+    // The dispatcher is a FRONTEND route, and this is a server context — the entrypoint registered
+    // here has no `url()` (that helper is attached by `@owlmeans/client-entrypoint` only, for a
+    // browser context that can resolve its own address). Assembled the way `server-oidc-provider`'s
+    // interaction URL is: the entrypoint's path, qualified with the address it answers on — the
+    // frontend service's, not this backend's.
+    const dispatcherEntry = context.entrypoint(DISPATCHER);
+    const dispatcherUrl = makeSecurityHelper(context)
+        .makeUrl(dispatcherEntry.address(), dispatcherEntry.path());
     const cfg = client.getConfig();
     const url = client.makeAuthUrl({
         scope: requestedScope(cfg?.extraScopes),

package/build/actions/init.js.map

@@ -1 +1 @@
-{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/actions/init.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEjD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAGjD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACzD,qDAAqD;AACrD,8CAA8C;AAE9C,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAExD,MAAM,CAAC,MAAM,IAAI,GAA2B,UAAU,CAAC,KAAK,EAAE,IAAwB,EAAE,GAAG,EAAE,EAAE;IAC7F,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IACxC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAA;IAE5B,MAAM,OAAO,GAAG,aAAa,CAAkB,GAAG,CAAC,CAAA;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;IAE9D,IAAI,MAAM,GAA6B,IAAI,CAAA;IAC3C,4FAA4F;IAC5F,sFAAsF;IACtF,4FAA4F;IAC5F,0FAA0F;IAC1F,0EAA0E;IAC1E,IAAI,yBAAyB,GAAG,KAAK,CAAA;IAErC,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;IACzC,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;IAChD,CAAC;IACD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,yBAAyB,GAAG,IAAI,CAAA;QAChC,yCAAyC;QACzC;;;WAGG;QACH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,UAAU,CACxC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAC1B,CAAC,IAAI,CAAC;YACL,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE;YAC7D,KAAK,EAAE,EAAE,QAAQ,EAAE;SACpB,CAAC,CAAA;QAEF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,WAAW,EAAE,CAAA;QACzB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,qDAAqD,EAAE,SAAS,CAAC,CAAA;QAE7E,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,CAAA;QACzE,iFAAiF;QACjF,IAAI,QAAQ,IAAI,IAAI,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC1C,OAAO,QAAQ,CAAC,GAAG,CAAA;QACrB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAA;QAChD,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;QAEjC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,EAAE,CAAA;QACzB,CAAC;QACD,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,oEAAoE;IACpE,+FAA+F;IAC/F,WAAW;IACX,oCAAoC;IACpC,8DAA8D;IAC9D,OAAO;IACP,IAAI;IAEJ,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;IAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEjD,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAA;IAE3H,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAC1B,EAAE,EAAE,UAAU,CAAC,SAAS,CAAC;QACzB,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE;QAC5B,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;IAEpC,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,UAAU,CAA2B,UAAU,CAAC,CAAC,GAAG,EAAE,CAAA;IAE1F,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;IAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC;QAC7B,KAAK,EAAE,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC;QACvC,cAAc,EAAE,SAAS;QACzB,qBAAqB,EAAE,MAAM;QAC7B,YAAY,EAAE,aAAa;KAC5B,CAAC,CAAA;IAEF,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAA;IAE9B,OAAO,GAAG,CAAA;AACZ,CAAC,CAAC,CAAA"}
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/actions/init.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEjD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAIjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACzD,qDAAqD;AACrD,8CAA8C;AAE9C,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAExD,MAAM,CAAC,MAAM,IAAI,GAA2B,UAAU,CAAC,KAAK,EAAE,IAAwB,EAAE,GAAG,EAAE,EAAE;IAC7F,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IACxC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAA;IAE5B,MAAM,OAAO,GAAG,aAAa,CAAkB,GAAG,CAAC,CAAA;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;IAE9D,IAAI,MAAM,GAA6B,IAAI,CAAA;IAC3C,4FAA4F;IAC5F,sFAAsF;IACtF,4FAA4F;IAC5F,0FAA0F;IAC1F,0EAA0E;IAC1E,IAAI,yBAAyB,GAAG,KAAK,CAAA;IAErC,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;IACzC,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;IAChD,CAAC;IACD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,yBAAyB,GAAG,IAAI,CAAA;QAChC,yCAAyC;QACzC;;;WAGG;QACH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,UAAU,CACxC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAC1B,CAAC,IAAI,CAAC;YACL,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE;YAC7D,KAAK,EAAE,EAAE,QAAQ,EAAE;SACpB,CAAC,CAAA;QAEF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,WAAW,EAAE,CAAA;QACzB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,qDAAqD,EAAE,SAAS,CAAC,CAAA;QAE7E,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,CAAA;QACzE,iFAAiF;QACjF,IAAI,QAAQ,IAAI,IAAI,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC1C,OAAO,QAAQ,CAAC,GAAG,CAAA;QACrB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAA;QAChD,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;QAEjC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,EAAE,CAAA;QACzB,CAAC;QACD,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,oEAAoE;IACpE,+FAA+F;IAC/F,WAAW;IACX,oCAAoC;IACpC,8DAA8D;IAC9D,OAAO;IACP,IAAI;IAEJ,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;IAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEjD,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAA;IAE3H,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAC1B,EAAE,EAAE,UAAU,CAAC,SAAS,CAAC;QACzB,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE;QAC5B,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;IAEpC,+FAA+F;IAC/F,4FAA4F;IAC5F,gGAAgG;IAChG,4FAA4F;IAC5F,0CAA0C;IAC1C,MAAM,eAAe,GAAG,OAAO,CAAC,UAAU,CAAmB,UAAU,CAAC,CAAA;IACxE,MAAM,aAAa,GAAG,kBAAkB,CAAkB,OAAO,CAAC;SAC/D,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,eAAe,CAAC,IAAI,EAAE,CAAC,CAAA;IAE7D,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;IAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC;QAC7B,KAAK,EAAE,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC;QACvC,cAAc,EAAE,SAAS;QACzB,qBAAqB,EAAE,MAAM;QAC7B,YAAY,EAAE,aAAa;KAC5B,CAAC,CAAA;IAEF,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAA;IAE9B,OAAO,GAAG,CAAA;AACZ,CAAC,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-oidc-rp",
-  "version": "0.1.18-rc.26",
+  "version": "0.1.18-rc.28",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -37,7 +37,7 @@
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/test-auth": "^0.1.18-rc.20",
+    "@owlmeans/test-auth": "^0.1.18-rc.21",
     "@types/bun": "^1.4.0",
     "@types/node": "^26.1.0",
     "nodemon": "^3.1.14",
@@ -45,21 +45,21 @@
   },
   "dependencies": {
     "@noble/hashes": "^1.5.0",
-    "@owlmeans/auth": "^0.1.18-rc.16",
-    "@owlmeans/auth-common": "^0.1.18-rc.20",
-    "@owlmeans/basic-envelope": "^0.1.18-rc.19",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.20",
-    "@owlmeans/config": "^0.1.18-rc.19",
-    "@owlmeans/context": "^0.1.18-rc.15",
-    "@owlmeans/did": "^0.1.18-rc.19",
-    "@owlmeans/entrypoint": "^0.1.18-rc.18",
-    "@owlmeans/oidc": "^0.1.18-rc.28",
-    "@owlmeans/resource": "^0.1.18-rc.16",
-    "@owlmeans/route": "^0.1.18-rc.16",
-    "@owlmeans/server-api": "^0.1.18-rc.24",
-    "@owlmeans/server-auth": "^0.1.18-rc.26",
-    "@owlmeans/server-context": "^0.1.18-rc.19",
-    "@owlmeans/server-entrypoint": "^0.1.18-rc.18",
+    "@owlmeans/auth": "^0.1.18-rc.17",
+    "@owlmeans/auth-common": "^0.1.18-rc.21",
+    "@owlmeans/basic-envelope": "^0.1.18-rc.20",
+    "@owlmeans/client-entrypoint": "^0.1.18-rc.21",
+    "@owlmeans/config": "^0.1.18-rc.20",
+    "@owlmeans/context": "^0.1.18-rc.16",
+    "@owlmeans/did": "^0.1.18-rc.20",
+    "@owlmeans/entrypoint": "^0.1.18-rc.19",
+    "@owlmeans/oidc": "^0.1.18-rc.29",
+    "@owlmeans/resource": "^0.1.18-rc.17",
+    "@owlmeans/route": "^0.1.18-rc.17",
+    "@owlmeans/server-api": "^0.1.18-rc.25",
+    "@owlmeans/server-auth": "^0.1.18-rc.27",
+    "@owlmeans/server-context": "^0.1.18-rc.20",
+    "@owlmeans/server-entrypoint": "^0.1.18-rc.19",
     "@scure/base": "^2.3.0",
     "dayjs": "^1.11.13",
     "jose": "6.2.5",

package/src/actions/init.ts

@@ -5,6 +5,8 @@ import { AuthenPayloadError, AuthUnknown, DISPATCHER } from '@owlmeans/auth'
 import { assertContext } from '@owlmeans/context'
 import type { Config, Context, OidcClientAdapter, OidcClientService } from '../types.js'
 import type { ClientEntrypoint } from '@owlmeans/client-entrypoint'
+import type { CommonEntrypoint } from '@owlmeans/entrypoint'
+import { makeSecurityHelper } from '@owlmeans/config'
 import { authService, DEFAULT_ALIAS } from '../consts.js'
 // import {  PROVIDER_CACHE_TTL } from '../consts.js'
 // import type { Client } from 'openid-client'
@@ -93,7 +95,14 @@ export const init: RefedEntrypointHandler = handleBody(async (body: OIDCAuthInit
     ...(entityIdUsedForResolution ? { entityId } : {}),
   }, { ttl: AUTHEN_TIMEFRAME / 1000 })
 
-  const dispatcherUrl = await context.entrypoint<ClientEntrypoint<string>>(DISPATCHER).url()
+  // The dispatcher is a FRONTEND route, and this is a server context — the entrypoint registered
+  // here has no `url()` (that helper is attached by `@owlmeans/client-entrypoint` only, for a
+  // browser context that can resolve its own address). Assembled the way `server-oidc-provider`'s
+  // interaction URL is: the entrypoint's path, qualified with the address it answers on — the
+  // frontend service's, not this backend's.
+  const dispatcherEntry = context.entrypoint<CommonEntrypoint>(DISPATCHER)
+  const dispatcherUrl = makeSecurityHelper<Config, Context>(context)
+    .makeUrl(dispatcherEntry.address(), dispatcherEntry.path())
 
   const cfg = client.getConfig()
   const url = client.makeAuthUrl({