@owlmeans/web-oidc-rp 0.1.7 → 0.1.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md
CHANGED
|
@@ -75,3 +75,20 @@ Login and callback React components exported from `./components` (re-exported at
|
|
|
75
75
|
- [`@owlmeans/web-client`](../web-client) — base web context this guard plugs into
|
|
76
76
|
- [`@owlmeans/mui-panel`](../mui-panel) — `makeContext` typically used as the base
|
|
77
77
|
- [`@owlmeans/client-auth`](../client-auth) — auth manager primitives the guard interacts with
|
|
78
|
+
|
|
79
|
+
<!-- owlmeans:agent-guidance:start -->
|
|
80
|
+
## Agent guidance
|
|
81
|
+
|
|
82
|
+
This package ships embedded Claude Code skills and GitHub Copilot instructions under
|
|
83
|
+
`agent-meta/`. After installing your `@owlmeans/*` packages, run the OwlMeans
|
|
84
|
+
agent-skills installer to place them into your project's native locations
|
|
85
|
+
(`.claude/skills/` and `.github/instructions/`):
|
|
86
|
+
|
|
87
|
+
```sh
|
|
88
|
+
npx @owlmeans/agent-skills
|
|
89
|
+
```
|
|
90
|
+
|
|
91
|
+
The embedded files are version-matched to this package release. Do not edit them
|
|
92
|
+
directly — they are regenerated on each publish. To contribute guidance edits,
|
|
93
|
+
open a PR against the source monorepo.
|
|
94
|
+
<!-- owlmeans:agent-guidance:end -->
|
|
@@ -0,0 +1,48 @@
|
|
|
1
|
+
---
|
|
2
|
+
description: "How to use @owlmeans/web-oidc-rp — browser OIDC relying party. appendOidcGuard() to wire the guard into a web context; setupOidcGuard() to wire it into module declarations."
|
|
3
|
+
applyTo: "**/context.ts, **/modules.ts, **/*.ts, **/*.tsx"
|
|
4
|
+
---
|
|
5
|
+
<!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
|
|
6
|
+
|
|
7
|
+
# @owlmeans/web-oidc-rp
|
|
8
|
+
|
|
9
|
+
**Layer:** Web (React)
|
|
10
|
+
**Install:** `"@owlmeans/web-oidc-rp": "^0.1.9"` in `dependencies`
|
|
11
|
+
|
|
12
|
+
## Key Exports
|
|
13
|
+
|
|
14
|
+
| Export | Description |
|
|
15
|
+
|--------|-------------|
|
|
16
|
+
| `appendOidcGuard<C, T>(context)` | Add OIDC guard to a web context |
|
|
17
|
+
| `setupOidcGuard(modules, options?, payloadOptions?)` | Wire OIDC guard onto modules |
|
|
18
|
+
| `service` | Web OIDC RP service (oidc-client-ts based) |
|
|
19
|
+
| `components` | Login / callback components |
|
|
20
|
+
| Constants | OIDC client aliases |
|
|
21
|
+
|
|
22
|
+
## Subpath Exports
|
|
23
|
+
|
|
24
|
+
- `./auth/plugins`
|
|
25
|
+
|
|
26
|
+
## Usage
|
|
27
|
+
|
|
28
|
+
```typescript
|
|
29
|
+
// context.ts
|
|
30
|
+
import { appendOidcGuard } from '@owlmeans/web-oidc-rp'
|
|
31
|
+
appendOidcGuard<C, T>(context)
|
|
32
|
+
|
|
33
|
+
// modules.ts
|
|
34
|
+
import { setupOidcGuard } from '@owlmeans/web-oidc-rp'
|
|
35
|
+
setupOidcGuard(modules, undefined, { payload: { simplified: true } })
|
|
36
|
+
```
|
|
37
|
+
|
|
38
|
+
## Product-Viable Usage Notes
|
|
39
|
+
|
|
40
|
+
- Importing `@owlmeans/web-oidc-rp/auth/plugins` registers both `OIDC_CLIENT_AUTH` and `GOOGLE_CLIENT_AUTH` plugins into the `@owlmeans/client-auth` plugin registry.
|
|
41
|
+
- The Google plugin uses `useValue` to manage redirect side effects, persists auth control state before redirect, restores it on return, then submits URL query params as `AuthCredentials`.
|
|
42
|
+
- The browser plugin starts login; the server finalizes provider exchange, links local identity, and returns a normal bearer token.
|
|
43
|
+
- Do not encode product authorization in browser OIDC plugins. Server module gates and local identity profiles remain the authorization source.
|
|
44
|
+
- **URL generation:** The Google plugin uses module-based URL generation via `context.module<Module<string>>(alias).call({ full: true })` to build its `source` (redirect_uri) and post-auth home redirect. Never use raw `window.location.origin` concatenation — use the `HOME` module for the app root and `CAUTHEN_AUTHEN_TYPED` with `{ params: { type } }` for the current auth page URL.
|
|
45
|
+
|
|
46
|
+
## Depends On
|
|
47
|
+
|
|
48
|
+
- `@owlmeans/oidc`, `@owlmeans/web-client`, `@owlmeans/web-panel`, `@owlmeans/client-auth`, `@owlmeans/auth-common`, `oidc-client-ts`, `react`
|
|
@@ -0,0 +1,23 @@
|
|
|
1
|
+
{
|
|
2
|
+
"schemaVersion": 1,
|
|
3
|
+
"package": "@owlmeans/web-oidc-rp",
|
|
4
|
+
"version": "0.1.9",
|
|
5
|
+
"generatedAt": "2026-06-14T13:34:06.130Z",
|
|
6
|
+
"canonicalRepo": "https://github.com/owlmeans/common",
|
|
7
|
+
"entries": [
|
|
8
|
+
{
|
|
9
|
+
"kind": "skill",
|
|
10
|
+
"name": "web-oidc-rp",
|
|
11
|
+
"category": "package-specific",
|
|
12
|
+
"file": "skills/web-oidc-rp/SKILL.md",
|
|
13
|
+
"canonicalPath": ".claude/skills/web-oidc-rp/SKILL.md"
|
|
14
|
+
},
|
|
15
|
+
{
|
|
16
|
+
"kind": "instruction",
|
|
17
|
+
"name": "web-oidc-rp",
|
|
18
|
+
"category": "package-specific",
|
|
19
|
+
"file": "instructions/web-oidc-rp.instructions.md",
|
|
20
|
+
"canonicalPath": ".github/instructions/web-oidc-rp.instructions.md"
|
|
21
|
+
}
|
|
22
|
+
]
|
|
23
|
+
}
|
|
@@ -0,0 +1,59 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: web-oidc-rp
|
|
3
|
+
description: How to use @owlmeans/web-oidc-rp — browser OIDC relying party. appendOidcGuard() to wire the guard into a web context; setupOidcGuard() to wire it into module declarations. Auto-invoked when importing web-oidc-rp helpers.
|
|
4
|
+
user-invocable: false
|
|
5
|
+
---
|
|
6
|
+
<!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
|
|
7
|
+
|
|
8
|
+
# @owlmeans/web-oidc-rp
|
|
9
|
+
|
|
10
|
+
**Layer:** Web (React)
|
|
11
|
+
**Install:** `"@owlmeans/web-oidc-rp": "^0.1.9"` in `dependencies`
|
|
12
|
+
|
|
13
|
+
## Key Exports
|
|
14
|
+
|
|
15
|
+
| Export | Description |
|
|
16
|
+
|--------|-------------|
|
|
17
|
+
| `appendOidcGuard<C, T>(context)` | Add OIDC guard to a web context |
|
|
18
|
+
| `setupOidcGuard(modules, options?, payloadOptions?)` | Wire OIDC guard onto module declarations |
|
|
19
|
+
| `service` | Web OIDC RP service (oidc-client-ts based) |
|
|
20
|
+
| `components` | Login / callback React components |
|
|
21
|
+
| Constants | OIDC client aliases |
|
|
22
|
+
|
|
23
|
+
## Subpath Exports
|
|
24
|
+
|
|
25
|
+
- `./auth/plugins` — pluggable token/session plugins
|
|
26
|
+
|
|
27
|
+
## Usage
|
|
28
|
+
|
|
29
|
+
### In `context.ts`
|
|
30
|
+
```typescript
|
|
31
|
+
import { appendOidcGuard } from '@owlmeans/web-oidc-rp'
|
|
32
|
+
|
|
33
|
+
export const makeContext = <C extends Config, T extends Context<C>>(cfg: C): T => {
|
|
34
|
+
const context = makeBasicContext<C, T>(cfg)
|
|
35
|
+
appendOidcGuard<C, T>(context)
|
|
36
|
+
return context
|
|
37
|
+
}
|
|
38
|
+
```
|
|
39
|
+
|
|
40
|
+
### In `modules.ts`
|
|
41
|
+
```typescript
|
|
42
|
+
import { setupOidcGuard } from '@owlmeans/web-oidc-rp'
|
|
43
|
+
setupOidcGuard(modules, undefined, { payload: { simplified: true } })
|
|
44
|
+
```
|
|
45
|
+
|
|
46
|
+
## Product-Viable Usage Notes
|
|
47
|
+
|
|
48
|
+
- Importing `@owlmeans/web-oidc-rp/auth/plugins` registers both `OIDC_CLIENT_AUTH` and `GOOGLE_CLIENT_AUTH` plugins into the `@owlmeans/client-auth` plugin registry.
|
|
49
|
+
- The Google plugin uses `useValue` to manage redirect side effects, persists auth control state before redirect, restores it on return, then submits URL query params as `AuthCredentials`.
|
|
50
|
+
- The browser plugin starts login; the server finalizes provider exchange, links local identity, and returns a normal bearer token.
|
|
51
|
+
- Do not encode product authorization in browser OIDC plugins. Server module gates and local identity profiles remain the authorization source.
|
|
52
|
+
- **URL generation:** Use `context.module<Module<string>>(alias).call({ full: true, params })` to build full URLs (redirect_uri, post-auth home). Import `HOME` and module aliases from `@owlmeans/web-client` / `@owlmeans/auth`. Never use raw `window.location.origin + window.location.pathname` concatenation.
|
|
53
|
+
|
|
54
|
+
## Depends On
|
|
55
|
+
|
|
56
|
+
- `@owlmeans/oidc`, `@owlmeans/web-client`, `@owlmeans/web-panel`, `@owlmeans/client-auth`, `@owlmeans/auth-common`
|
|
57
|
+
- `oidc-client-ts@3.5.0` (exact), `react` (peer) — see [[oidc-versions]]
|
|
58
|
+
|
|
59
|
+
**Note:** The `oidc-client-ts` `UserManager` path (for fully browser-side OIDC) is an **incomplete stub**. The production flow uses server-side token exchange via `DISPATCHER_OIDC_INIT` / `DISPATCHER_OIDC` modules, not `UserManager.signinRedirect`.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@owlmeans/web-oidc-rp",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.9",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"scripts": {
|
|
@@ -29,19 +29,19 @@
|
|
|
29
29
|
}
|
|
30
30
|
},
|
|
31
31
|
"dependencies": {
|
|
32
|
-
"@owlmeans/auth": "^0.1.
|
|
33
|
-
"@owlmeans/basic-envelope": "^0.1.
|
|
34
|
-
"@owlmeans/client": "^0.1.
|
|
35
|
-
"@owlmeans/client-auth": "^0.1.
|
|
36
|
-
"@owlmeans/client-flow": "^0.1.
|
|
37
|
-
"@owlmeans/client-i18n": "^0.1.
|
|
38
|
-
"@owlmeans/context": "^0.1.
|
|
39
|
-
"@owlmeans/flow": "^0.1.
|
|
40
|
-
"@owlmeans/entrypoint": "^0.1.
|
|
41
|
-
"@owlmeans/oidc": "^0.1.
|
|
42
|
-
"@owlmeans/resource": "^0.1.
|
|
43
|
-
"@owlmeans/web-client": "^0.1.
|
|
44
|
-
"@owlmeans/web-flow": "^0.1.
|
|
32
|
+
"@owlmeans/auth": "^0.1.9",
|
|
33
|
+
"@owlmeans/basic-envelope": "^0.1.9",
|
|
34
|
+
"@owlmeans/client": "^0.1.9",
|
|
35
|
+
"@owlmeans/client-auth": "^0.1.9",
|
|
36
|
+
"@owlmeans/client-flow": "^0.1.9",
|
|
37
|
+
"@owlmeans/client-i18n": "^0.1.9",
|
|
38
|
+
"@owlmeans/context": "^0.1.9",
|
|
39
|
+
"@owlmeans/flow": "^0.1.9",
|
|
40
|
+
"@owlmeans/entrypoint": "^0.1.9",
|
|
41
|
+
"@owlmeans/oidc": "^0.1.9",
|
|
42
|
+
"@owlmeans/resource": "^0.1.9",
|
|
43
|
+
"@owlmeans/web-client": "^0.1.9",
|
|
44
|
+
"@owlmeans/web-flow": "^0.1.9",
|
|
45
45
|
"oidc-client-ts": "3.5.0"
|
|
46
46
|
},
|
|
47
47
|
"peerDependencies": {
|
|
@@ -56,8 +56,8 @@
|
|
|
56
56
|
},
|
|
57
57
|
"devDependencies": {
|
|
58
58
|
"@owlmeans/dep-config": "workspace:*",
|
|
59
|
-
"@owlmeans/test-auth": "^0.1.
|
|
60
|
-
"@owlmeans/test-ui": "^0.1.
|
|
59
|
+
"@owlmeans/test-auth": "^0.1.9",
|
|
60
|
+
"@owlmeans/test-ui": "^0.1.9",
|
|
61
61
|
"@radix-ui/react-progress": "^1.1.7",
|
|
62
62
|
"@tailwindcss/vite": "^4.1.16",
|
|
63
63
|
"@types/bun": "^1.3.0",
|