@owlmeans/web-oidc-rp 0.1.15 → 0.1.16

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/README.md +3 -4
  2. package/agent-meta/manifest.json +4 -11
  3. package/agent-meta/skills/web-oidc-rp/SKILL.md +10 -1
  4. package/build/components/dispatcher.d.ts.map +1 -1
  5. package/build/components/dispatcher.js +14 -1
  6. package/build/components/dispatcher.js.map +1 -1
  7. package/package.json +16 -16
  8. package/src/components/dispatcher.tsx +16 -1
  9. package/agent-meta/instructions/web-oidc-rp.instructions.md +0 -48
package/README.md CHANGED
@@ -79,10 +79,9 @@ Login and callback React components exported from `./components` (re-exported at
79
79
  <!-- owlmeans:agent-guidance:start -->
80
80
  ## Agent guidance
81
81
 
82
- This package ships embedded Claude Code skills and GitHub Copilot instructions under
83
- `agent-meta/`. After installing your `@owlmeans/*` packages, run the OwlMeans
84
- agent-skills installer to place them into your project's native locations
85
- (`.claude/skills/` and `.github/instructions/`):
82
+ This package ships embedded agent skills under `agent-meta/`. After installing your
83
+ `@owlmeans/*` packages, run the OwlMeans agent-skills installer to place them into
84
+ your project's skill store (`.agents/skills/`):
86
85
 
87
86
  ```sh
88
87
  npx @owlmeans/agent-skills
package/agent-meta/manifest.json CHANGED
@@ -1,8 +1,8 @@
1
1
  {
2
- "schemaVersion": 1,
2
+ "schemaVersion": 2,
3
3
  "package": "@owlmeans/web-oidc-rp",
4
- "version": "0.1.15",
5
- "generatedAt": "2026-08-07T17:06:32.900Z",
4
+ "version": "0.1.16",
5
+ "generatedAt": "2026-08-14T10:14:48.851Z",
6
6
  "canonicalRepo": "https://github.com/owlmeans/common",
7
7
  "entries": [
8
8
  {
@@ -10,14 +10,7 @@
10
10
  "name": "web-oidc-rp",
11
11
  "category": "package-specific",
12
12
  "file": "skills/web-oidc-rp/SKILL.md",
13
- "canonicalPath": ".claude/skills/web-oidc-rp/SKILL.md"
14
- },
15
- {
16
- "kind": "instruction",
17
- "name": "web-oidc-rp",
18
- "category": "package-specific",
19
- "file": "instructions/web-oidc-rp.instructions.md",
20
- "canonicalPath": ".github/instructions/web-oidc-rp.instructions.md"
13
+ "canonicalPath": ".agents/skills/web-oidc-rp/SKILL.md"
21
14
  }
22
15
  ]
23
16
  }
package/agent-meta/skills/web-oidc-rp/SKILL.md CHANGED
@@ -8,7 +8,7 @@ user-invocable: false
8
8
  # @owlmeans/web-oidc-rp
9
9
 
10
10
  **Layer:** Web (React)
11
- **Install:** `"@owlmeans/web-oidc-rp": "^0.1.15"` in `dependencies`
11
+ **Install:** `"@owlmeans/web-oidc-rp": "^0.1.16"` in `dependencies`
12
12
 
13
13
  ## Key Exports
14
14
 
@@ -43,6 +43,15 @@ import { setupOidcGuard } from '@owlmeans/web-oidc-rp'
43
43
  setupOidcGuard(modules, undefined, { payload: { simplified: true } })
44
44
  ```
45
45
 
46
+ ## Dispatcher and authorization errors
47
+
48
+ The `Dispatcher` component is the redirect URI: the provider returns **both** outcomes to it — a
49
+ `code` on success and `error` / `error_description` (`OIDC_ERROR_QUERY`, `OIDC_ERROR_DESCRIPTION_QUERY`
50
+ from `@owlmeans/oidc`) on failure. It must check for the error params **before** re-entering the
51
+ flow and render the message instead: starting authorization again would rebuild the request that
52
+ just failed, so the browser bounces between dispatcher and provider forever and the actual reason
53
+ never reaches the user. The same rule holds for the MUI dispatcher in `@owlmeans/mui-oidc-rp`.
54
+
46
55
  ## Product-Viable Usage Notes
47
56
 
48
57
  - Importing `@owlmeans/web-oidc-rp/auth/plugins` registers both `OIDC_CLIENT_AUTH` and `GOOGLE_CLIENT_AUTH` plugins into the `@owlmeans/client-auth` plugin registry.
package/build/components/dispatcher.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../../src/components/dispatcher.tsx"],"names":[],"mappings":"AAUA,eAAO,MAAM,UAAU,6FAiDrB,CAAA"}
1
+ {"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../../src/components/dispatcher.tsx"],"names":[],"mappings":"AAWA,eAAO,MAAM,UAAU,6FA+DrB,CAAA"}
package/build/components/dispatcher.js CHANGED
@@ -4,6 +4,7 @@ import { useEffect } from 'react';
4
4
  import { useContext } from '@owlmeans/web-client';
5
5
  import { useI18nLib } from '@owlmeans/client-i18n';
6
6
  import { AUTH_QUERY } from '@owlmeans/auth';
7
+ import { OIDC_ERROR_DESCRIPTION_QUERY, OIDC_ERROR_QUERY } from '@owlmeans/oidc';
7
8
  import { useFlow } from '@owlmeans/web-flow';
8
9
  import { DEFAULT_ALIAS } from '../consts.js';
9
10
  export const Dispatcher = DispatcherHOC(({ provideToken, navigate }) => {
@@ -11,10 +12,19 @@ export const Dispatcher = DispatcherHOC(({ provideToken, navigate }) => {
11
12
  const [query] = context.router().useSearchParams();
12
13
  const client = useFlow();
13
14
  const t = useI18nLib('auth', 'dispatcher');
15
+ // The provider reports a failed authorization by redirecting BACK here with `error` set. Re-entering
16
+ // the flow at that point sends the browser into the very authorization request that just failed —
17
+ // an endless dispatcher <-> provider redirect loop that also hides the reason. Surface it, stop.
18
+ const error = query.get(OIDC_ERROR_QUERY);
19
+ const errorDescription = query.get(OIDC_ERROR_DESCRIPTION_QUERY);
14
20
  useEffect(() => {
15
21
  if (client == null) {
16
22
  return;
17
23
  }
24
+ if (error != null) {
25
+ console.error(`[oidc] authorization failed: ${error}${errorDescription != null ? ` — ${errorDescription}` : ''}`);
26
+ return;
27
+ }
18
28
  const token = query.get(AUTH_QUERY);
19
29
  const params = {};
20
30
  query.forEach((value, key) => {
@@ -49,7 +59,10 @@ export const Dispatcher = DispatcherHOC(({ provideToken, navigate }) => {
49
59
  }
50
60
  });
51
61
  }
52
- }, [client]);
62
+ }, [client, error]);
63
+ if (error != null) {
64
+ return _jsx("div", { children: t('error', { error: errorDescription ?? error }) });
65
+ }
53
66
  return query.has(AUTH_QUERY)
54
67
  ? _jsx("div", { children: t('loading') })
55
68
  : undefined;
package/build/components/dispatcher.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"dispatcher.js","sourceRoot":"","sources":["../../src/components/dispatcher.tsx"],"names":[],"mappings":";AACA,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAE5C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAE5C,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE;IACrE,MAAM,OAAO,GAAG,UAAU,EAAE,CAAA;IAC5B,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,eAAe,EAAE,CAAA;IAClD,MAAM,MAAM,GAAG,OAAO,EAAE,CAAA;IAExB,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IAE1C,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,OAAM;QACR,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACnC,MAAM,MAAM,GAA2B,EAAE,CAAA;QACzC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC3B,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;gBACvB,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;YACrB,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,yEAAyE;YACzE,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAA;QACjC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAkB,aAAa,CAAC,CAAA;YAC5D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,EAAC,UAAU,EAAC,EAAE;gBAC5C,IAAI,UAAU,EAAE,CAAC;oBACf,OAAO,MAAM,QAAQ,EAAE,CAAA;gBACzB,CAAC;gBACD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;oBACnB,OAAM;gBACR,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAA;gBAC/D,IAAI,QAAQ,IAAI,IAAI,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;oBACxC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,QAAQ,CAAA;oBACjC,OAAM;gBACR,CAAC;gBACD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,CAAA;gBACvD,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;oBACvB,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,CAAA;gBACxC,CAAC;qBAAM,CAAC;oBACN,MAAM,QAAQ,EAAE,CAAA;gBAClB,CAAC;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;IAEZ,OAAO,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;QAC1B,CAAC,CAAC,wBAAM,CAAC,CAAC,SAAS,CAAC,GAAO;QAC3B,CAAC,CAAC,SAAS,CAAA;AACf,CAAC,CAAC,CAAA"}
1
+ {"version":3,"file":"dispatcher.js","sourceRoot":"","sources":["../../src/components/dispatcher.tsx"],"names":[],"mappings":";AACA,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAE5C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAE5C,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE;IACrE,MAAM,OAAO,GAAG,UAAU,EAAE,CAAA;IAC5B,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,eAAe,EAAE,CAAA;IAClD,MAAM,MAAM,GAAG,OAAO,EAAE,CAAA;IAExB,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IAE1C,qGAAqG;IACrG,kGAAkG;IAClG,iGAAiG;IACjG,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IACzC,MAAM,gBAAgB,GAAG,KAAK,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAA;IAEhE,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,OAAM;QACR,CAAC;QACD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,gCAAgC,KAAK,GAAG,gBAAgB,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YACjH,OAAM;QACR,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACnC,MAAM,MAAM,GAA2B,EAAE,CAAA;QACzC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC3B,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;gBACvB,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;YACrB,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,yEAAyE;YACzE,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAA;QACjC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAkB,aAAa,CAAC,CAAA;YAC5D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,EAAC,UAAU,EAAC,EAAE;gBAC5C,IAAI,UAAU,EAAE,CAAC;oBACf,OAAO,MAAM,QAAQ,EAAE,CAAA;gBACzB,CAAC;gBACD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;oBACnB,OAAM;gBACR,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAA;gBAC/D,IAAI,QAAQ,IAAI,IAAI,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;oBACxC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,QAAQ,CAAA;oBACjC,OAAM;gBACR,CAAC;gBACD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,CAAA;gBACvD,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;oBACvB,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,CAAA;gBACxC,CAAC;qBAAM,CAAC;oBACN,MAAM,QAAQ,EAAE,CAAA;gBAClB,CAAC;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;IAEnB,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,OAAO,wBAAM,CAAC,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,gBAAgB,IAAI,KAAK,EAAE,CAAC,GAAO,CAAA;IACtE,CAAC;IAED,OAAO,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;QAC1B,CAAC,CAAC,wBAAM,CAAC,CAAC,SAAS,CAAC,GAAO;QAC3B,CAAC,CAAC,SAAS,CAAA;AACf,CAAC,CAAC,CAAA"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@owlmeans/web-oidc-rp",
3
- "version": "0.1.15",
3
+ "version": "0.1.16",
4
4
  "license": "MIT",
5
5
  "type": "module",
6
6
  "scripts": {
@@ -29,19 +29,19 @@
29
29
  }
30
30
  },
31
31
  "dependencies": {
32
- "@owlmeans/auth": "^0.1.15",
33
- "@owlmeans/basic-envelope": "^0.1.15",
34
- "@owlmeans/client": "^0.1.15",
35
- "@owlmeans/client-auth": "^0.1.15",
36
- "@owlmeans/client-flow": "^0.1.15",
37
- "@owlmeans/client-i18n": "^0.1.15",
38
- "@owlmeans/context": "^0.1.15",
39
- "@owlmeans/flow": "^0.1.15",
40
- "@owlmeans/entrypoint": "^0.1.15",
41
- "@owlmeans/oidc": "^0.1.15",
42
- "@owlmeans/resource": "^0.1.15",
43
- "@owlmeans/web-client": "^0.1.15",
44
- "@owlmeans/web-flow": "^0.1.15",
32
+ "@owlmeans/auth": "^0.1.16",
33
+ "@owlmeans/basic-envelope": "^0.1.16",
34
+ "@owlmeans/client": "^0.1.16",
35
+ "@owlmeans/client-auth": "^0.1.16",
36
+ "@owlmeans/client-flow": "^0.1.16",
37
+ "@owlmeans/client-i18n": "^0.1.16",
38
+ "@owlmeans/context": "^0.1.16",
39
+ "@owlmeans/flow": "^0.1.16",
40
+ "@owlmeans/entrypoint": "^0.1.16",
41
+ "@owlmeans/oidc": "^0.1.16",
42
+ "@owlmeans/resource": "^0.1.16",
43
+ "@owlmeans/web-client": "^0.1.16",
44
+ "@owlmeans/web-flow": "^0.1.16",
45
45
  "oidc-client-ts": "3.5.0"
46
46
  },
47
47
  "peerDependencies": {
@@ -55,8 +55,8 @@
55
55
  },
56
56
  "devDependencies": {
57
57
  "@owlmeans/dep-config": "workspace:*",
58
- "@owlmeans/test-auth": "^0.1.15",
59
- "@owlmeans/test-ui": "^0.1.15",
58
+ "@owlmeans/test-auth": "^0.1.16",
59
+ "@owlmeans/test-ui": "^0.1.16",
60
60
  "@radix-ui/react-progress": "^1.1.7",
61
61
  "@tailwindcss/vite": "^4.1.16",
62
62
  "@types/bun": "^1.3.14",
package/src/components/dispatcher.tsx CHANGED
@@ -4,6 +4,7 @@ import { useEffect } from 'react'
4
4
  import { useContext } from '@owlmeans/web-client'
5
5
  import { useI18nLib } from '@owlmeans/client-i18n'
6
6
  import { AUTH_QUERY } from '@owlmeans/auth'
7
+ import { OIDC_ERROR_DESCRIPTION_QUERY, OIDC_ERROR_QUERY } from '@owlmeans/oidc'
7
8
  import { useFlow } from '@owlmeans/web-flow'
8
9
  import { OidcAuthService } from '../types.js'
9
10
  import { DEFAULT_ALIAS } from '../consts.js'
@@ -15,10 +16,20 @@ export const Dispatcher = DispatcherHOC(({ provideToken, navigate }) => {
15
16
 
16
17
  const t = useI18nLib('auth', 'dispatcher')
17
18
 
19
+ // The provider reports a failed authorization by redirecting BACK here with `error` set. Re-entering
20
+ // the flow at that point sends the browser into the very authorization request that just failed —
21
+ // an endless dispatcher <-> provider redirect loop that also hides the reason. Surface it, stop.
22
+ const error = query.get(OIDC_ERROR_QUERY)
23
+ const errorDescription = query.get(OIDC_ERROR_DESCRIPTION_QUERY)
24
+
18
25
  useEffect(() => {
19
26
  if (client == null) {
20
27
  return
21
28
  }
29
+ if (error != null) {
30
+ console.error(`[oidc] authorization failed: ${error}${errorDescription != null ? ` — ${errorDescription}` : ''}`)
31
+ return
32
+ }
22
33
  const token = query.get(AUTH_QUERY)
23
34
  const params: Record<string, string> = {}
24
35
  query.forEach((value, key) => {
@@ -52,7 +63,11 @@ export const Dispatcher = DispatcherHOC(({ provideToken, navigate }) => {
52
63
  }
53
64
  })
54
65
  }
55
- }, [client])
66
+ }, [client, error])
67
+
68
+ if (error != null) {
69
+ return <div>{t('error', { error: errorDescription ?? error })}</div>
70
+ }
56
71
 
57
72
  return query.has(AUTH_QUERY)
58
73
  ? <div>{t('loading')}</div>
package/agent-meta/instructions/web-oidc-rp.instructions.md DELETED
@@ -1,48 +0,0 @@
1
- ---
2
- description: "How to use @owlmeans/web-oidc-rp — browser OIDC relying party. appendOidcGuard() to wire the guard into a web context; setupOidcGuard() to wire it into module declarations."
3
- applyTo: "**/context.ts, **/modules.ts, **/*.ts, **/*.tsx"
4
- ---
5
- <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
6
-
7
- # @owlmeans/web-oidc-rp
8
-
9
- **Layer:** Web (React)
10
- **Install:** `"@owlmeans/web-oidc-rp": "^0.1.15"` in `dependencies`
11
-
12
- ## Key Exports
13
-
14
- | Export | Description |
15
- |--------|-------------|
16
- | `appendOidcGuard<C, T>(context)` | Add OIDC guard to a web context |
17
- | `setupOidcGuard(modules, options?, payloadOptions?)` | Wire OIDC guard onto modules |
18
- | `service` | Web OIDC RP service (oidc-client-ts based) |
19
- | `components` | Login / callback components |
20
- | Constants | OIDC client aliases |
21
-
22
- ## Subpath Exports
23
-
24
- - `./auth/plugins`
25
-
26
- ## Usage
27
-
28
- ```typescript
29
- // context.ts
30
- import { appendOidcGuard } from '@owlmeans/web-oidc-rp'
31
- appendOidcGuard<C, T>(context)
32
-
33
- // modules.ts
34
- import { setupOidcGuard } from '@owlmeans/web-oidc-rp'
35
- setupOidcGuard(modules, undefined, { payload: { simplified: true } })
36
- ```
37
-
38
- ## Product-Viable Usage Notes
39
-
40
- - Importing `@owlmeans/web-oidc-rp/auth/plugins` registers both `OIDC_CLIENT_AUTH` and `GOOGLE_CLIENT_AUTH` plugins into the `@owlmeans/client-auth` plugin registry.
41
- - The Google plugin uses `useValue` to manage redirect side effects, persists auth control state before redirect, restores it on return, then submits URL query params as `AuthCredentials`.
42
- - The browser plugin starts login; the server finalizes provider exchange, links local identity, and returns a normal bearer token.
43
- - Do not encode product authorization in browser OIDC plugins. Server module gates and local identity profiles remain the authorization source.
44
- - **URL generation:** The Google plugin uses module-based URL generation via `context.module<Module<string>>(alias).call({ full: true })` to build its `source` (redirect_uri) and post-auth home redirect. Never use raw `window.location.origin` concatenation — use the `HOME` module for the app root and `CAUTHEN_AUTHEN_TYPED` with `{ params: { type } }` for the current auth page URL.
45
-
46
- ## Depends On
47
-
48
- - `@owlmeans/oidc`, `@owlmeans/web-client`, `@owlmeans/web-panel`, `@owlmeans/client-auth`, `@owlmeans/auth-common`, `oidc-client-ts`, `react`