@owlmeans/server-oidc-rp 0.1.18-rc.4 → 0.1.18-rc.6

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-oidc-rp",
-  "version": "0.1.18-rc.0",
-  "generatedAt": "2026-08-16T22:20:50.509Z",
+  "version": "0.1.18-rc.6",
+  "generatedAt": "2026-08-18T14:48:00.531Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-oidc-rp/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/server-oidc-rp
 
 **Layer:** Server
-**Install:** `"@owlmeans/server-oidc-rp": "^0.1.18-rc.0"` in `dependencies`
+**Install:** `"@owlmeans/server-oidc-rp": "^0.1.18-rc.6"` in `dependencies`
 
 ## Key Exports
 
@@ -78,6 +78,33 @@ cfg.oidc.providers.push({
 - `setupAuthServiceModules(managerModules, AUTH_API)` exposes provider-list and token-update service modules protected by `GUARD_ED25519`.
 - When a downstream app uses OIDC/Google only for login and maps users into `@owlmeans/server-auth-identity`, do not reintroduce `appendOidcGuard()`, `makeOidcGate()`, or `setupOidcGuard()` as product authorization. Use a product-specific `GateService` over local identity data.
 
+## Only the `id_token` is a JWT
+
+`id_token` is a JWT by specification; an **access token's format is provider-private**. `oidc-provider`
+issues opaque access tokens by default, so `decodeJwt(tokenSet.access_token)` (`jose`) throws
+`JWTInvalid: Invalid JWT`. Inside the exchange handler that failure surfaces as a 500 on
+`/authenticate/oidc/process` *after* the code exchange already succeeded, which reads as a broken
+login rather than as the log line it came from. Decode only `tokenSet.id_token` — every claim this
+package needs (`sub`, the `PERMISSIONS_CLAIM` grant) lives there. This applies to debug logging too:
+a `console.log` argument is evaluated before the call, so a throwing decode in a log statement fails
+the request just as hard as one in real logic. Never introspect an access token locally; use the
+provider's introspection endpoint (`tokenIntrospection`) when its contents are genuinely needed.
+
+## Gotcha: `entityId` in the browser-starts-server-finishes flow
+
+`actions/init.ts` resolves the OIDC client two ways: via `oidc.getDefault()` (a provider flagged
+`def: true`, matched without looking at `entityId` at all) or, only when no default exists, via a
+remote provider lookup keyed by the caller-supplied `entityId`. The verifier record it caches must
+only carry `entityId` when the **second** path actually used it to resolve the client — never
+unconditionally. `utils/auth.ts`'s exchange step later does
+`getConfig({ clientId: verification.client, ...(verification.entityId != null ? { entityId: ... } : {}) })`,
+which requires an **exact** match on every field it's given; a stored `entityId` that was never
+validated against the registered provider (e.g. a caller-side default/placeholder value) makes the
+exchange fail with a bare `AuthenFailed()` even though the same default provider that worked at
+init time is trivially available again at exchange time. Fixed 2026-08-17 — if this regresses, check
+that the default-provider fast path in `actions/init.ts` still omits `entityId` from the cached
+verifier.
+
 ## Public type contract (isolation principle)
 
 `openid-client` types **never appear in this package's public exports**. All public types are OwlMeans-owned:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-oidc-rp",
-  "version": "0.1.18-rc.4",
+  "version": "0.1.18-rc.6",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -37,7 +37,7 @@
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@owlmeans/test-auth": "^0.1.18-rc.4",
+    "@owlmeans/test-auth": "^0.1.18-rc.6",
     "@types/bun": "^1.3.14",
     "@types/node": "^26.1.0",
     "nodemon": "^3.1.14",
@@ -45,21 +45,21 @@
   },
   "dependencies": {
     "@noble/hashes": "^1.5.0",
-    "@owlmeans/auth": "^0.1.18-rc.4",
-    "@owlmeans/auth-common": "^0.1.18-rc.4",
-    "@owlmeans/basic-envelope": "^0.1.18-rc.4",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.4",
-    "@owlmeans/config": "^0.1.18-rc.4",
-    "@owlmeans/context": "^0.1.18-rc.4",
-    "@owlmeans/did": "^0.1.18-rc.4",
-    "@owlmeans/entrypoint": "^0.1.18-rc.4",
-    "@owlmeans/oidc": "^0.1.18-rc.4",
-    "@owlmeans/resource": "^0.1.18-rc.4",
-    "@owlmeans/route": "^0.1.18-rc.4",
-    "@owlmeans/server-api": "^0.1.18-rc.4",
-    "@owlmeans/server-auth": "^0.1.18-rc.4",
-    "@owlmeans/server-context": "^0.1.18-rc.4",
-    "@owlmeans/server-entrypoint": "^0.1.18-rc.4",
+    "@owlmeans/auth": "^0.1.18-rc.6",
+    "@owlmeans/auth-common": "^0.1.18-rc.6",
+    "@owlmeans/basic-envelope": "^0.1.18-rc.6",
+    "@owlmeans/client-entrypoint": "^0.1.18-rc.6",
+    "@owlmeans/config": "^0.1.18-rc.6",
+    "@owlmeans/context": "^0.1.18-rc.6",
+    "@owlmeans/did": "^0.1.18-rc.6",
+    "@owlmeans/entrypoint": "^0.1.18-rc.6",
+    "@owlmeans/oidc": "^0.1.18-rc.6",
+    "@owlmeans/resource": "^0.1.18-rc.6",
+    "@owlmeans/route": "^0.1.18-rc.6",
+    "@owlmeans/server-api": "^0.1.18-rc.6",
+    "@owlmeans/server-auth": "^0.1.18-rc.6",
+    "@owlmeans/server-context": "^0.1.18-rc.6",
+    "@owlmeans/server-entrypoint": "^0.1.18-rc.6",
     "@scure/base": "^2.3.0",
     "dayjs": "^1.11.13",
     "jose": "6.2.5",