@portaidentity/server 1.7.0

package/dist/middleware/metrics.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Prometheus metrics middleware.
+ *
+ * Provides two Koa middleware functions:
+ *   - `metricsCounter()` — increments an HTTP request counter per response
+ *   - `metricsHandler()` — serves the Prometheus text format at GET /metrics
+ *
+ * Uses a dedicated `prom-client` Registry so default Node.js metrics
+ * (CPU, memory, event loop lag, GC, file descriptors) are collected
+ * automatically alongside the HTTP counter.
+ *
+ * Only mounted when `config.metricsEnabled === true`. When disabled,
+ * GET /metrics returns 404 (no route registered).
+ *
+ * Security note: the /metrics endpoint is unauthenticated by design
+ * (standard Prometheus scraping model). Operators must restrict access
+ * via network policy or reverse proxy.
+ */
+import type { Middleware } from 'koa';
+/**
+ * Middleware that increments the `porta_http_requests_total` counter
+ * after every response. Should be mounted early in the middleware stack
+ * so it captures all downstream responses.
+ *
+ * @returns Koa middleware
+ */
+export declare function metricsCounter(): Middleware;
+/**
+ * Request handler that returns all collected metrics in Prometheus text format.
+ * Mount at `GET /metrics` when metrics are enabled.
+ *
+ * @returns Koa middleware
+ */
+export declare function metricsHandler(): Middleware;
+/**
+ * Reset all metrics — used in tests to avoid counter bleed between test cases.
+ * NOT for production use.
+ */
+export declare function resetMetrics(): void;
+//# sourceMappingURL=metrics.d.ts.map

package/dist/middleware/metrics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../src/middleware/metrics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAqBtC;;;;;;GAMG;AACH,wBAAgB,cAAc,IAAI,UAAU,CAa3C;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,IAAI,UAAU,CAK3C;AAED;;;GAGG;AACH,wBAAgB,YAAY,IAAI,IAAI,CAEnC"}

package/dist/middleware/metrics.js

@@ -0,0 +1,75 @@
+/**
+ * Prometheus metrics middleware.
+ *
+ * Provides two Koa middleware functions:
+ *   - `metricsCounter()` — increments an HTTP request counter per response
+ *   - `metricsHandler()` — serves the Prometheus text format at GET /metrics
+ *
+ * Uses a dedicated `prom-client` Registry so default Node.js metrics
+ * (CPU, memory, event loop lag, GC, file descriptors) are collected
+ * automatically alongside the HTTP counter.
+ *
+ * Only mounted when `config.metricsEnabled === true`. When disabled,
+ * GET /metrics returns 404 (no route registered).
+ *
+ * Security note: the /metrics endpoint is unauthenticated by design
+ * (standard Prometheus scraping model). Operators must restrict access
+ * via network policy or reverse proxy.
+ */
+import client from 'prom-client';
+// ---------------------------------------------------------------------------
+// Registry — one per process, isolated from any global default registry.
+// ---------------------------------------------------------------------------
+const registry = new client.Registry();
+client.collectDefaultMetrics({ register: registry });
+// ---------------------------------------------------------------------------
+// HTTP request counter — low-cardinality labels only (no user IDs, no PII).
+// `route` uses the matched koa-router pattern (e.g. "/api/admin/organizations/:id")
+// so label cardinality stays bounded regardless of path parameter values.
+// ---------------------------------------------------------------------------
+const httpRequests = new client.Counter({
+    name: 'porta_http_requests_total',
+    help: 'Total HTTP requests by method, route pattern, and status code',
+    labelNames: ['method', 'route', 'status'],
+    registers: [registry],
+});
+/**
+ * Middleware that increments the `porta_http_requests_total` counter
+ * after every response. Should be mounted early in the middleware stack
+ * so it captures all downstream responses.
+ *
+ * @returns Koa middleware
+ */
+export function metricsCounter() {
+    return async (ctx, next) => {
+        await next();
+        // koa-router sets ctx._matchedRoute to the pattern string (e.g. "/health").
+        // Fall back to "unknown" for routes not matched by koa-router (e.g. OIDC provider).
+        const route = typeof ctx._matchedRoute === 'string' ? ctx._matchedRoute : 'unknown';
+        httpRequests.inc({
+            method: ctx.method,
+            route,
+            status: String(ctx.status),
+        });
+    };
+}
+/**
+ * Request handler that returns all collected metrics in Prometheus text format.
+ * Mount at `GET /metrics` when metrics are enabled.
+ *
+ * @returns Koa middleware
+ */
+export function metricsHandler() {
+    return async (ctx) => {
+        ctx.set('Content-Type', registry.contentType);
+        ctx.body = await registry.metrics();
+    };
+}
+/**
+ * Reset all metrics — used in tests to avoid counter bleed between test cases.
+ * NOT for production use.
+ */
+export function resetMetrics() {
+    registry.resetMetrics();
+}
+//# sourceMappingURL=metrics.js.map

package/dist/middleware/metrics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.js","sourceRoot":"","sources":["../../src/middleware/metrics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,8EAA8E;AAC9E,yEAAyE;AACzE,8EAA8E;AAC9E,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;AACvC,MAAM,CAAC,qBAAqB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;AAErD,8EAA8E;AAC9E,4EAA4E;AAC5E,oFAAoF;AACpF,0EAA0E;AAC1E,8EAA8E;AAC9E,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC;IACtC,IAAI,EAAE,2BAA2B;IACjC,IAAI,EAAE,+DAA+D;IACrE,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAU;IAClD,SAAS,EAAE,CAAC,QAAQ,CAAC;CACtB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,IAAI,EAAE,CAAC;QACb,4EAA4E;QAC5E,oFAAoF;QACpF,MAAM,KAAK,GACT,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,YAAY,CAAC,GAAG,CAAC;YACf,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,KAAK;YACL,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC9C,GAAG,CAAC,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;IACtC,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,QAAQ,CAAC,YAAY,EAAE,CAAC;AAC1B,CAAC"}

package/dist/middleware/oidc-client-tenant.d.ts

@@ -0,0 +1,37 @@
+/**
+ * OIDC client-to-tenant binding middleware.
+ *
+ * Porta exposes one issuer per organization. A client identifier is valid only under the issuer
+ * owned by that client's organization. This middleware rejects cross-organization and unknown
+ * client identifiers before the shared OIDC provider can create an interaction or consume a
+ * credential under the wrong issuer.
+ */
+import type { Middleware } from 'koa';
+/** Minimal provider model boundary needed to resolve an opaque access token's issuing client. */
+export interface OidcOpaqueTokenProvider {
+    /** Opaque access-token model exposed by oidc-provider. */
+    readonly AccessToken: {
+        /** Finds an unexpired access token without interpreting it as a JWT. */
+        find(token: string): Promise<{
+            readonly clientId?: string;
+        } | undefined>;
+    };
+}
+/**
+ * Enforces that every presented OIDC client identifier belongs to the resolved organization.
+ *
+ * Query, form-body, and HTTP Basic identifiers are all checked because different OIDC endpoints
+ * carry client authentication in different locations. Unknown and foreign identifiers receive
+ * the same minimal response so this boundary cannot be used for cross-tenant client discovery.
+ * Requests without a client identifier continue to provider endpoints such as discovery and JWKS.
+ *
+ * Opaque bearer tokens on UserInfo do not carry a separate request `client_id`, so the middleware
+ * resolves the token's issuing client and applies the same organization comparison there. Invalid
+ * or unknown bearer values remain provider-owned errors; an otherwise valid foreign token is
+ * rejected before identity claims can be disclosed.
+ *
+ * @param provider - Provider model access used to resolve opaque UserInfo tokens
+ * @returns Koa middleware mounted after tenant resolution and body parsing
+ */
+export declare function oidcClientTenantBinding(provider: OidcOpaqueTokenProvider): Middleware;
+//# sourceMappingURL=oidc-client-tenant.d.ts.map

package/dist/middleware/oidc-client-tenant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-client-tenant.d.ts","sourceRoot":"","sources":["../../src/middleware/oidc-client-tenant.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAQtC,iGAAiG;AACjG,MAAM,WAAW,uBAAuB;IACtC,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,EAAE;QACpB,wEAAwE;QACxE,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;YAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAC,CAAC;KAC1E,CAAC;CACH;AAkGD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,uBAAuB,GAAG,UAAU,CAoDrF"}

package/dist/middleware/oidc-client-tenant.js

@@ -0,0 +1,156 @@
+/**
+ * OIDC client-to-tenant binding middleware.
+ *
+ * Porta exposes one issuer per organization. A client identifier is valid only under the issuer
+ * owned by that client's organization. This middleware rejects cross-organization and unknown
+ * client identifiers before the shared OIDC provider can create an interaction or consume a
+ * credential under the wrong issuer.
+ */
+import { getClientByClientId } from '../clients/service.js';
+import { observeProtocolSecurityRejection } from '../oidc/protocol-security-observer.js';
+const MAX_CLIENT_ID_LENGTH = 255;
+const MAX_BASIC_HEADER_LENGTH = 4096;
+const MAX_BEARER_HEADER_LENGTH = 8192;
+/** Returns one bounded client identifier or leaves malformed input for the provider to reject. */
+function boundedClientId(value) {
+    if (typeof value !== 'string' || value.length === 0 || value.length > MAX_CLIENT_ID_LENGTH) {
+        return undefined;
+    }
+    return value;
+}
+/** Extracts the client identifier from HTTP Basic credentials without retaining the secret. */
+function basicClientId(authorization) {
+    if (authorization === undefined ||
+        !authorization.startsWith('Basic ') ||
+        authorization.length > MAX_BASIC_HEADER_LENGTH) {
+        return undefined;
+    }
+    try {
+        const decoded = Buffer.from(authorization.slice(6), 'base64').toString('utf8');
+        const separator = decoded.indexOf(':');
+        return separator < 0 ? undefined : boundedClientId(decoded.slice(0, separator));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Reads a client identifier from an already parsed request body. */
+function bodyClientId(body) {
+    if (typeof body !== 'object' || body === null || Array.isArray(body))
+        return undefined;
+    return boundedClientId(Reflect.get(body, 'client_id'));
+}
+/** Reads the organization identifier established by the tenant resolver. */
+function resolvedOrganizationId(organization) {
+    if (typeof organization !== 'object' || organization === null || Array.isArray(organization)) {
+        return undefined;
+    }
+    const id = Reflect.get(organization, 'id');
+    return typeof id === 'string' && id.length > 0 ? id : undefined;
+}
+/** Extracts one bounded opaque bearer token without decoding or retaining it. */
+function bearerToken(authorization) {
+    if (authorization === undefined || authorization.length > MAX_BEARER_HEADER_LENGTH) {
+        return undefined;
+    }
+    return /^Bearer ([^\s]+)$/i.exec(authorization)?.[1];
+}
+/** Reads a bounded form-carried access token without accepting arrays or coerced values. */
+function formAccessToken(body) {
+    if (typeof body !== 'object' || body === null || Array.isArray(body))
+        return undefined;
+    const token = Reflect.get(body, 'access_token');
+    return typeof token === 'string' && token.length > 0 && token.length <= MAX_BEARER_HEADER_LENGTH
+        ? token
+        : undefined;
+}
+/** Identifies supported provider UserInfo routes after the organization prefix. */
+function isUserinfoRequest(method, path, organizationSlug) {
+    if (method !== 'GET' && method !== 'POST')
+        return false;
+    if (typeof organizationSlug !== 'string' || organizationSlug.length === 0)
+        return false;
+    const relativePath = path.slice(`/${organizationSlug}`.length);
+    return relativePath === '/me' || relativePath === '/userinfo';
+}
+/** Returns a single supported UserInfo token mechanism or delegates ambiguous input. */
+function userinfoToken(method, authorization, body) {
+    const headerToken = bearerToken(authorization);
+    const bodyToken = method === 'POST' ? formAccessToken(body) : undefined;
+    if (headerToken !== undefined && bodyToken !== undefined)
+        return undefined;
+    return headerToken ?? bodyToken;
+}
+/** Sends the provider-compatible public response for a tenant-mismatched opaque token. */
+function rejectUserinfoToken(ctx) {
+    ctx.status = 401;
+    ctx.set('WWW-Authenticate', 'Bearer error="invalid_token"');
+    ctx.body = { error: 'invalid_token' };
+}
+/**
+ * Enforces that every presented OIDC client identifier belongs to the resolved organization.
+ *
+ * Query, form-body, and HTTP Basic identifiers are all checked because different OIDC endpoints
+ * carry client authentication in different locations. Unknown and foreign identifiers receive
+ * the same minimal response so this boundary cannot be used for cross-tenant client discovery.
+ * Requests without a client identifier continue to provider endpoints such as discovery and JWKS.
+ *
+ * Opaque bearer tokens on UserInfo do not carry a separate request `client_id`, so the middleware
+ * resolves the token's issuing client and applies the same organization comparison there. Invalid
+ * or unknown bearer values remain provider-owned errors; an otherwise valid foreign token is
+ * rejected before identity claims can be disclosed.
+ *
+ * @param provider - Provider model access used to resolve opaque UserInfo tokens
+ * @returns Koa middleware mounted after tenant resolution and body parsing
+ */
+export function oidcClientTenantBinding(provider) {
+    return async (ctx, next) => {
+        const organizationId = resolvedOrganizationId(ctx.state.organization);
+        if (organizationId === undefined)
+            ctx.throw(500, 'Tenant context unavailable');
+        const candidates = new Set();
+        const queryClientId = boundedClientId(ctx.query.client_id);
+        const parsedBodyClientId = bodyClientId(ctx.request.body);
+        const authenticatedClientId = basicClientId(ctx.headers.authorization);
+        if (queryClientId !== undefined)
+            candidates.add(queryClientId);
+        if (parsedBodyClientId !== undefined)
+            candidates.add(parsedBodyClientId);
+        if (authenticatedClientId !== undefined)
+            candidates.add(authenticatedClientId);
+        for (const clientId of candidates) {
+            const client = await getClientByClientId(clientId);
+            if (client === null || client.organizationId !== organizationId) {
+                observeProtocolSecurityRejection({
+                    request: ctx.req,
+                    eventClass: 'client-tenant-binding-rejected',
+                    clientId,
+                });
+                ctx.throw(404, 'Client not found');
+            }
+        }
+        if (isUserinfoRequest(ctx.method, ctx.path, ctx.params?.orgSlug)) {
+            const token = userinfoToken(ctx.method, ctx.headers.authorization, ctx.request.body);
+            if (token !== undefined) {
+                const accessToken = await provider.AccessToken.find(token);
+                if (accessToken !== undefined) {
+                    const clientId = boundedClientId(accessToken.clientId);
+                    const client = clientId === undefined ? null : await getClientByClientId(clientId);
+                    if (client === null ||
+                        client.status !== 'active' ||
+                        client.organizationId !== organizationId) {
+                        observeProtocolSecurityRejection({
+                            request: ctx.req,
+                            eventClass: 'userinfo-rejected',
+                            clientId,
+                        });
+                        rejectUserinfoToken(ctx);
+                        return;
+                    }
+                }
+            }
+        }
+        await next();
+    };
+}
+//# sourceMappingURL=oidc-client-tenant.js.map

package/dist/middleware/oidc-client-tenant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-client-tenant.js","sourceRoot":"","sources":["../../src/middleware/oidc-client-tenant.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AAEzF,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AACrC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAiBtC,kGAAkG;AAClG,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QAC3F,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+FAA+F;AAC/F,SAAS,aAAa,CAAC,aAAiC;IACtD,IACE,aAAa,KAAK,SAAS;QAC3B,CAAC,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC;QACnC,aAAa,CAAC,MAAM,GAAG,uBAAuB,EAC9C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,SAAS,YAAY,CAAC,IAAa;IACjC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACvF,OAAO,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,4EAA4E;AAC5E,SAAS,sBAAsB,CAAC,YAAqB;IACnD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7F,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAC3C,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED,iFAAiF;AACjF,SAAS,WAAW,CAAC,aAAiC;IACpD,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;QACnF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,4FAA4F;AAC5F,SAAS,eAAe,CAAC,IAAa;IACpC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACvF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,wBAAwB;QAC9F,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,mFAAmF;AACnF,SAAS,iBAAiB,CAAC,MAAc,EAAE,IAAY,EAAE,gBAAyB;IAChF,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,OAAO,gBAAgB,KAAK,QAAQ,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxF,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,gBAAgB,EAAE,CAAC,MAAM,CAAC,CAAC;IAC/D,OAAO,YAAY,KAAK,KAAK,IAAI,YAAY,KAAK,WAAW,CAAC;AAChE,CAAC;AAED,wFAAwF;AACxF,SAAS,aAAa,CACpB,MAAc,EACd,aAAiC,EACjC,IAAa;IAEb,MAAM,WAAW,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,IAAI,WAAW,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3E,OAAO,WAAW,IAAI,SAAS,CAAC;AAClC,CAAC;AAED,0FAA0F;AAC1F,SAAS,mBAAmB,CAAC,GAI5B;IACC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;IACjB,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,8BAA8B,CAAC,CAAC;IAC5D,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;AACxC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAiC;IACvE,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,cAAc,GAAG,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACtE,IAAI,cAAc,KAAK,SAAS;YAAE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;QAC/E,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,MAAM,aAAa,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,kBAAkB,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,qBAAqB,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAEvE,IAAI,aAAa,KAAK,SAAS;YAAE,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC/D,IAAI,kBAAkB,KAAK,SAAS;YAAE,UAAU,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACzE,IAAI,qBAAqB,KAAK,SAAS;YAAE,UAAU,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAE/E,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;gBAChE,gCAAgC,CAAC;oBAC/B,OAAO,EAAE,GAAG,CAAC,GAAG;oBAChB,UAAU,EAAE,gCAAgC;oBAC5C,QAAQ;iBACT,CAAC,CAAC;gBACH,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YACjE,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC3D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;oBAC9B,MAAM,QAAQ,GAAG,eAAe,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;oBACvD,MAAM,MAAM,GACV,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;oBACtE,IACE,MAAM,KAAK,IAAI;wBACf,MAAM,CAAC,MAAM,KAAK,QAAQ;wBAC1B,MAAM,CAAC,cAAc,KAAK,cAAc,EACxC,CAAC;wBACD,gCAAgC,CAAC;4BAC/B,OAAO,EAAE,GAAG,CAAC,GAAG;4BAChB,UAAU,EAAE,mBAAmB;4BAC/B,QAAQ;yBACT,CAAC,CAAC;wBACH,mBAAmB,CAAC,GAAG,CAAC,CAAC;wBACzB,OAAO;oBACT,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/oidc-cors.d.ts

@@ -0,0 +1,33 @@
+/**
+ * CORS handler for OIDC endpoints.
+ *
+ * node-oidc-provider accepts a `clientBasedCORS` configuration function
+ * that determines whether a given origin is allowed for CORS requests.
+ *
+ * Origin resolution follows a two-tier strategy:
+ *   1. **Explicit allowed_origins** — checks the client's `allowed_origins`
+ *      field from the database (stored as `urn:porta:allowed_origins` in
+ *      provider metadata).
+ *   2. **Redirect URI derivation** — extracts the origin (scheme + host +
+ *      port) from each of the client's registered `redirect_uris`. If the
+ *      requesting origin matches any redirect URI's origin, CORS is allowed.
+ *      This is safe because the client already trusts those origins for
+ *      redirect flows.
+ *
+ * In development mode, all origins are allowed for convenience.
+ */
+/**
+ * Determine if a CORS origin is allowed for OIDC requests.
+ *
+ * Called by node-oidc-provider for cross-origin requests to OIDC endpoints
+ * (e.g., /token from a browser-based SPA). Checks if the requesting origin
+ * matches the client's registered allowed_origins or the origin of any
+ * registered redirect_uri.
+ *
+ * @param _ctx - Koa context with OIDC extensions
+ * @param origin - The requesting origin (e.g., 'https://app.example.com')
+ * @param client - The matched OIDC client metadata (may be undefined for non-client requests)
+ * @returns true if the origin is allowed, false otherwise
+ */
+export declare function oidcCors(_ctx: unknown, origin: string, client: unknown): boolean;
+//# sourceMappingURL=oidc-cors.d.ts.map

package/dist/middleware/oidc-cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-cors.d.ts","sourceRoot":"","sources":["../../src/middleware/oidc-cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH;;;;;;;;;;;;GAYG;AACH,wBAAgB,QAAQ,CACtB,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,OAAO,GACd,OAAO,CAqCT"}

package/dist/middleware/oidc-cors.js

@@ -0,0 +1,68 @@
+/**
+ * CORS handler for OIDC endpoints.
+ *
+ * node-oidc-provider accepts a `clientBasedCORS` configuration function
+ * that determines whether a given origin is allowed for CORS requests.
+ *
+ * Origin resolution follows a two-tier strategy:
+ *   1. **Explicit allowed_origins** — checks the client's `allowed_origins`
+ *      field from the database (stored as `urn:porta:allowed_origins` in
+ *      provider metadata).
+ *   2. **Redirect URI derivation** — extracts the origin (scheme + host +
+ *      port) from each of the client's registered `redirect_uris`. If the
+ *      requesting origin matches any redirect URI's origin, CORS is allowed.
+ *      This is safe because the client already trusts those origins for
+ *      redirect flows.
+ *
+ * In development mode, all origins are allowed for convenience.
+ */
+import { config } from '../config/index.js';
+/**
+ * Determine if a CORS origin is allowed for OIDC requests.
+ *
+ * Called by node-oidc-provider for cross-origin requests to OIDC endpoints
+ * (e.g., /token from a browser-based SPA). Checks if the requesting origin
+ * matches the client's registered allowed_origins or the origin of any
+ * registered redirect_uri.
+ *
+ * @param _ctx - Koa context with OIDC extensions
+ * @param origin - The requesting origin (e.g., 'https://app.example.com')
+ * @param client - The matched OIDC client metadata (may be undefined for non-client requests)
+ * @returns true if the origin is allowed, false otherwise
+ */
+export function oidcCors(_ctx, origin, client) {
+    // In development, allow all origins for convenience during local testing
+    if (config.nodeEnv === 'development')
+        return true;
+    // If no client context, deny CORS (non-client requests shouldn't have CORS)
+    if (!client)
+        return false;
+    // Cast to access client metadata properties.
+    // findForOidc() stores allowed_origins under the namespaced key
+    // 'urn:porta:allowed_origins' (required by extraClientMetadata config).
+    // redirect_uris is a standard OIDC property always present on clients.
+    const clientMeta = client;
+    // 1. Check explicit allowed_origins
+    const allowedOrigins = clientMeta['urn:porta:allowed_origins'] ?? [];
+    if (allowedOrigins.includes(origin))
+        return true;
+    // 2. Derive origins from redirect_uris — if the client has a redirect_uri
+    //    at a given origin, it's safe to allow CORS from that origin.
+    //    new URL(uri).origin extracts 'scheme://host[:port]', which is exactly
+    //    what the browser sends as the CORS Origin header.
+    const redirectUris = clientMeta.redirect_uris ?? [];
+    for (const uri of redirectUris) {
+        try {
+            const { origin: redirectOrigin } = new URL(uri);
+            // Skip native app schemes (e.g., 'myapp://callback') which produce
+            // 'null' as origin — native apps don't make browser CORS requests.
+            if (redirectOrigin !== 'null' && redirectOrigin === origin)
+                return true;
+        }
+        catch {
+            // Skip malformed URIs
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=oidc-cors.js.map

package/dist/middleware/oidc-cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-cors.js","sourceRoot":"","sources":["../../src/middleware/oidc-cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,QAAQ,CACtB,IAAa,EACb,MAAc,EACd,MAAe;IAEf,yEAAyE;IACzE,IAAI,MAAM,CAAC,OAAO,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAElD,4EAA4E;IAC5E,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,6CAA6C;IAC7C,gEAAgE;IAChE,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,UAAU,GAAG,MAGlB,CAAC;IAEF,oCAAoC;IACpC,MAAM,cAAc,GAAG,UAAU,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC;IACrE,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjD,0EAA0E;IAC1E,kEAAkE;IAClE,2EAA2E;IAC3E,uDAAuD;IACvD,MAAM,YAAY,GAAG,UAAU,CAAC,aAAa,IAAI,EAAE,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAChD,mEAAmE;YACnE,mEAAmE;YACnE,IAAI,cAAc,KAAK,MAAM,IAAI,cAAc,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/middleware/oidc-preflight-cors.d.ts

@@ -0,0 +1,54 @@
+/**
+ * OIDC CORS middleware — pre-sets CORS headers at the outer Koa level.
+ *
+ * Solves a fundamental issue with node-oidc-provider's CORS handling:
+ * the provider uses @koa/cors with `keepHeadersOnError: false`, which
+ * means CORS headers are stripped from error responses (e.g., 400 from
+ * the token endpoint). SPAs that exchange authorization codes or refresh
+ * tokens via cross-origin fetch() cannot read error responses, breaking
+ * error handling in browser-based OIDC flows.
+ *
+ * How this middleware fixes it:
+ *
+ *   1. It sets `Access-Control-Allow-Origin` and related headers BEFORE
+ *      the request enters oidc-provider's internal Koa context.
+ *
+ *   2. The provider's `cors.js` middleware detects existing `access-control-*`
+ *      headers and SKIPS its own CORS handling entirely (see
+ *      node_modules/oidc-provider/lib/shared/cors.js lines 32-37).
+ *
+ *   3. Because the headers are set at the outer Koa level and the provider
+ *      doesn't touch them, they survive regardless of whether the OIDC
+ *      endpoint succeeds or returns an error.
+ *
+ * Origin validation follows the same two-tier strategy as `oidc-cors.ts`:
+ *   - In development mode: all origins are allowed.
+ *   - In production: the client's `allowed_origins` and `redirect_uris`
+ *     are checked. The client is identified from the `client_id` body
+ *     parameter (standard for token, revocation, and introspection
+ *     endpoints). If no client_id is present or the client cannot be
+ *     found, no CORS headers are set — the request proceeds but the
+ *     browser will block the response (correct security behavior).
+ *
+ * Placement: mount in the `oidcRouter` (server.ts) AFTER the body parser
+ * (so `client_id` is available from `ctx.request.body`) but BEFORE the
+ * `clientSecretHash` middleware and the provider delegation handler.
+ *
+ * For OIDC endpoints that don't require client authentication (e.g.,
+ * JWKS, discovery), CORS is always allowed — these are public endpoints
+ * that any origin may access. The middleware detects these by path.
+ *
+ * @module middleware/oidc-preflight-cors
+ */
+import type { Middleware } from 'koa';
+/**
+ * Create the OIDC CORS middleware.
+ *
+ * Must be mounted in the oidcRouter AFTER the body parser (so
+ * `client_id` is available) but BEFORE `clientSecretHash` and the
+ * provider delegation handler.
+ *
+ * @returns Koa middleware that pre-sets CORS headers for OIDC routes
+ */
+export declare function oidcPreflightCors(): Middleware;
+//# sourceMappingURL=oidc-preflight-cors.d.ts.map

package/dist/middleware/oidc-preflight-cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-preflight-cors.d.ts","sourceRoot":"","sources":["../../src/middleware/oidc-preflight-cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AA4JtC;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,IAAI,UAAU,CAiG9C"}