@portaidentity/server 1.7.0

package/dist/middleware/oidc-preflight-cors.js

@@ -0,0 +1,267 @@
+/**
+ * OIDC CORS middleware — pre-sets CORS headers at the outer Koa level.
+ *
+ * Solves a fundamental issue with node-oidc-provider's CORS handling:
+ * the provider uses @koa/cors with `keepHeadersOnError: false`, which
+ * means CORS headers are stripped from error responses (e.g., 400 from
+ * the token endpoint). SPAs that exchange authorization codes or refresh
+ * tokens via cross-origin fetch() cannot read error responses, breaking
+ * error handling in browser-based OIDC flows.
+ *
+ * How this middleware fixes it:
+ *
+ *   1. It sets `Access-Control-Allow-Origin` and related headers BEFORE
+ *      the request enters oidc-provider's internal Koa context.
+ *
+ *   2. The provider's `cors.js` middleware detects existing `access-control-*`
+ *      headers and SKIPS its own CORS handling entirely (see
+ *      node_modules/oidc-provider/lib/shared/cors.js lines 32-37).
+ *
+ *   3. Because the headers are set at the outer Koa level and the provider
+ *      doesn't touch them, they survive regardless of whether the OIDC
+ *      endpoint succeeds or returns an error.
+ *
+ * Origin validation follows the same two-tier strategy as `oidc-cors.ts`:
+ *   - In development mode: all origins are allowed.
+ *   - In production: the client's `allowed_origins` and `redirect_uris`
+ *     are checked. The client is identified from the `client_id` body
+ *     parameter (standard for token, revocation, and introspection
+ *     endpoints). If no client_id is present or the client cannot be
+ *     found, no CORS headers are set — the request proceeds but the
+ *     browser will block the response (correct security behavior).
+ *
+ * Placement: mount in the `oidcRouter` (server.ts) AFTER the body parser
+ * (so `client_id` is available from `ctx.request.body`) but BEFORE the
+ * `clientSecretHash` middleware and the provider delegation handler.
+ *
+ * For OIDC endpoints that don't require client authentication (e.g.,
+ * JWKS, discovery), CORS is always allowed — these are public endpoints
+ * that any origin may access. The middleware detects these by path.
+ *
+ * @module middleware/oidc-preflight-cors
+ */
+import { config } from '../config/index.js';
+import { getClientByClientId } from '../clients/service.js';
+import { getPool } from '../lib/database.js';
+import { logger } from '../lib/logger.js';
+// ---------------------------------------------------------------------------
+// Public-endpoint path patterns — these are accessible without client auth
+// and allow CORS from any origin (same as oidc-provider's "open" CORS).
+// Paths are relative to the /:orgSlug prefix (after tenant resolution).
+// ---------------------------------------------------------------------------
+/** Paths that are publicly accessible and allow any CORS origin. */
+const OPEN_CORS_PATHS = new Set([
+    '/jwks',
+    '/.well-known/openid-configuration',
+    '/.well-known/oauth-authorization-server',
+]);
+/**
+ * Check if the request path (within the org scope) is a public endpoint
+ * that allows CORS from any origin.
+ *
+ * @param fullPath - The full request path (e.g., '/acme/jwks')
+ * @param orgSlug - The organization slug (e.g., 'acme')
+ * @returns true if the path is a public CORS endpoint
+ */
+function isOpenCorsPath(fullPath, orgSlug) {
+    const subPath = fullPath.slice(`/${orgSlug}`.length);
+    return OPEN_CORS_PATHS.has(subPath);
+}
+/**
+ * Check if an origin is allowed for a given client by examining the
+ * client's `allowedOrigins` and `redirectUris` fields.
+ *
+ * This replicates the same logic as `oidc-cors.ts` but works with the
+ * Client domain object (from the service layer) rather than the OIDC
+ * provider's internal client metadata format.
+ *
+ * @param origin - The requesting origin (e.g., 'https://app.example.com')
+ * @param client - Client with allowedOrigins and redirectUris arrays
+ * @returns true if the origin is allowed
+ */
+function isOriginAllowed(origin, client) {
+    // 1. Check explicit allowed_origins
+    if (client.allowedOrigins.includes(origin))
+        return true;
+    // 2. Derive origins from redirect_uris
+    for (const uri of client.redirectUris) {
+        try {
+            const redirectOrigin = new URL(uri).origin;
+            if (redirectOrigin !== 'null' && redirectOrigin === origin)
+                return true;
+        }
+        catch {
+            // Skip malformed URIs
+        }
+    }
+    return false;
+}
+/**
+ * Set standard CORS response headers for an allowed origin.
+ *
+ * @param ctx - Koa context
+ * @param origin - The allowed origin value
+ */
+function setCorsHeaders(ctx, origin) {
+    ctx.set('Access-Control-Allow-Origin', origin);
+    ctx.set('Vary', 'Origin');
+}
+/**
+ * Set preflight-specific CORS response headers (in addition to the base
+ * headers set by `setCorsHeaders`).
+ *
+ * @param ctx - Koa context
+ */
+function setPreflightHeaders(ctx) {
+    ctx.set('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+    ctx.set('Access-Control-Allow-Headers', 'Authorization, Content-Type, DPoP');
+    ctx.set('Access-Control-Max-Age', '3600');
+}
+// ---------------------------------------------------------------------------
+// Bearer token → clientId resolution
+// ---------------------------------------------------------------------------
+/**
+ * Extract the `clientId` from an opaque Bearer access token by looking
+ * up its record in PostgreSQL.
+ *
+ * node-oidc-provider stores opaque access tokens in the `oidc_payloads`
+ * table (via the PostgresAdapter) with `type = 'AccessToken'`. The token
+ * value sent by the client IS the `jti`, which is the `id` column in the
+ * table. The JSONB `payload` column includes a `clientId` field.
+ *
+ * NOTE: AccessToken is a long-lived model routed to PostgreSQL by the
+ * hybrid adapter factory (adapter-factory.ts). Short-lived models like
+ * Session and AuthorizationCode go to Redis, but AccessToken does NOT.
+ *
+ * This lookup is best-effort: if the token is missing, expired, or the
+ * database is unavailable, `null` is returned and CORS headers are not
+ * set. The actual token validation is still performed by the provider
+ * downstream.
+ *
+ * @param authHeader - The raw `Authorization` header value (e.g., 'Bearer abc123')
+ * @returns The clientId if resolved, or null
+ */
+async function resolveClientIdFromBearerToken(authHeader) {
+    if (!authHeader)
+        return null;
+    // Extract the token value from "Bearer <token>"
+    const match = /^Bearer\s+(\S+)$/i.exec(authHeader);
+    if (!match)
+        return null;
+    const tokenValue = match[1];
+    try {
+        const pool = getPool();
+        const result = await pool.query(`SELECT payload->>'clientId' AS client_id
+       FROM oidc_payloads
+       WHERE id = $1 AND type = 'AccessToken'
+         AND (expires_at IS NULL OR expires_at > NOW())`, [tokenValue]);
+        if (result.rows.length === 0)
+            return null;
+        const clientId = result.rows[0].client_id;
+        return typeof clientId === 'string' && clientId.length > 0 ? clientId : null;
+    }
+    catch (err) {
+        // Database unavailable — graceful degradation.
+        // The provider will still validate the token; we just can't set
+        // CORS headers pre-emptively.
+        logger.debug({ err }, 'OIDC CORS: failed to resolve clientId from Bearer token');
+        return null;
+    }
+}
+// ---------------------------------------------------------------------------
+// Middleware factory
+// ---------------------------------------------------------------------------
+/**
+ * Create the OIDC CORS middleware.
+ *
+ * Must be mounted in the oidcRouter AFTER the body parser (so
+ * `client_id` is available) but BEFORE `clientSecretHash` and the
+ * provider delegation handler.
+ *
+ * @returns Koa middleware that pre-sets CORS headers for OIDC routes
+ */
+export function oidcPreflightCors() {
+    return async function oidcPreflightCorsMiddleware(ctx, next) {
+        const origin = ctx.get('Origin');
+        // No Origin header → not a CORS request (backend service, curl, etc.)
+        // Skip — no CORS headers needed.
+        if (!origin) {
+            return next();
+        }
+        const orgSlug = ctx.params?.orgSlug ?? '';
+        // -----------------------------------------------------------------------
+        // OPTIONS preflight — respond immediately, skip downstream middleware
+        // -----------------------------------------------------------------------
+        if (ctx.method === 'OPTIONS') {
+            // Dev: allow all origins
+            // Prod: allow preflight broadly — the actual request will do the
+            // full client-based check. If the actual request's origin is
+            // unauthorized, it won't have CORS headers and the browser will
+            // block the response. This is secure because the preflight itself
+            // doesn't grant any access — it only tells the browser that a
+            // subsequent actual request is permitted to be sent.
+            setCorsHeaders(ctx, origin);
+            setPreflightHeaders(ctx);
+            ctx.status = 204;
+            return;
+        }
+        // -----------------------------------------------------------------------
+        // Actual request (GET, POST, etc.) with Origin header
+        // -----------------------------------------------------------------------
+        // Public endpoints (jwks, discovery) allow any origin — no client check.
+        if (isOpenCorsPath(ctx.path, orgSlug)) {
+            setCorsHeaders(ctx, origin);
+            return next();
+        }
+        // Development mode: allow all origins for convenience.
+        if (config.nodeEnv === 'development') {
+            setCorsHeaders(ctx, origin);
+            return next();
+        }
+        // Production mode: client-based CORS check.
+        // Strategy: identify the client from one of two sources, then check
+        // whether the requesting origin is allowed for that client.
+        //
+        //   1. `client_id` in the body — token, revocation, introspection
+        //      endpoints send client_id in the form-encoded body.
+        //   2. Bearer token in `Authorization` header — userinfo (/me) and
+        //      other authenticated GET endpoints. The access token record in
+        //      PostgreSQL contains the clientId that issued it.
+        //
+        // If neither source yields a client, no CORS headers are set (safe
+        // default: browser blocks the cross-origin response).
+        const body = ctx.request.body;
+        let clientId = typeof body?.client_id === 'string' && body.client_id.length > 0
+            ? body.client_id
+            : null;
+        // Fallback: extract clientId from a Bearer access token stored in PostgreSQL.
+        // This enables CORS for endpoints like /me (userinfo) where the only
+        // client identifier is embedded in the opaque access token record.
+        if (!clientId) {
+            clientId = await resolveClientIdFromBearerToken(ctx.get('Authorization'));
+        }
+        if (!clientId) {
+            // Can't identify client from body or Bearer token — skip CORS.
+            // The provider will process the request, but the browser blocks
+            // the cross-origin response. This is correct security behavior.
+            return next();
+        }
+        try {
+            const client = await getClientByClientId(clientId);
+            if (client && isOriginAllowed(origin, client)) {
+                setCorsHeaders(ctx, origin);
+            }
+            // If client not found or origin not allowed, don't set CORS headers.
+            // The provider processes the request normally, but the browser blocks
+            // the cross-origin response — correct security behavior.
+        }
+        catch (err) {
+            // Graceful degradation: if the client lookup fails (e.g., DB down),
+            // don't set CORS headers. The request proceeds but the browser
+            // blocks the response. This is the safe default.
+            logger.warn({ err, clientId, origin }, 'OIDC CORS: client lookup failed, CORS headers not set');
+        }
+        return next();
+    };
+}
+//# sourceMappingURL=oidc-preflight-cors.js.map

package/dist/middleware/oidc-preflight-cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-preflight-cors.js","sourceRoot":"","sources":["../../src/middleware/oidc-preflight-cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,8EAA8E;AAC9E,2EAA2E;AAC3E,wEAAwE;AACxE,wEAAwE;AACxE,8EAA8E;AAE9E,oEAAoE;AACpE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,OAAO;IACP,mCAAmC;IACnC,yCAAyC;CAC1C,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,QAAgB,EAAE,OAAe;IACvD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACrD,OAAO,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CACtB,MAAc,EACd,MAA4D;IAE5D,oCAAoC;IACpC,IAAI,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAExD,uCAAuC;IACvC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;YAC3C,IAAI,cAAc,KAAK,MAAM,IAAI,cAAc,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CACrB,GAAmD,EACnD,MAAc;IAEd,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;IAC/C,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAC1B,GAAmD;IAEnD,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC;IAC9D,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,mCAAmC,CAAC,CAAC;IAC7E,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,qCAAqC;AACrC,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,KAAK,UAAU,8BAA8B,CAAC,UAAkB;IAC9D,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE7B,gDAAgD;IAChD,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAE5B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;wDAGkD,EAClD,CAAC,UAAU,CAAC,CACb,CAAC;QAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAE1C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1C,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,+CAA+C;QAC/C,gEAAgE;QAChE,8BAA8B;QAC9B,MAAM,CAAC,KAAK,CACV,EAAE,GAAG,EAAE,EACP,yDAAyD,CAC1D,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,KAAK,UAAU,2BAA2B,CAAC,GAAG,EAAE,IAAI;QACzD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEjC,sEAAsE;QACtE,iCAAiC;QACjC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;QAE1C,0EAA0E;QAC1E,sEAAsE;QACtE,0EAA0E;QAC1E,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,yBAAyB;YACzB,iEAAiE;YACjE,6DAA6D;YAC7D,gEAAgE;YAChE,kEAAkE;YAClE,8DAA8D;YAC9D,qDAAqD;YACrD,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC5B,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACzB,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,OAAO;QACT,CAAC;QAED,0EAA0E;QAC1E,sDAAsD;QACtD,0EAA0E;QAE1E,yEAAyE;QACzE,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YACtC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC5B,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,uDAAuD;QACvD,IAAI,MAAM,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;YACrC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC5B,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,4CAA4C;QAC5C,oEAAoE;QACpE,4DAA4D;QAC5D,EAAE;QACF,kEAAkE;QAClE,0DAA0D;QAC1D,mEAAmE;QACnE,qEAAqE;QACrE,wDAAwD;QACxD,EAAE;QACF,mEAAmE;QACnE,sDAAsD;QACtD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAA2C,CAAC;QACrE,IAAI,QAAQ,GACV,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;YAC9D,CAAC,CAAC,IAAI,CAAC,SAAS;YAChB,CAAC,CAAC,IAAI,CAAC;QAEX,8EAA8E;QAC9E,qEAAqE;QACrE,mEAAmE;QACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,MAAM,8BAA8B,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,+DAA+D;YAC/D,gEAAgE;YAChE,gEAAgE;YAChE,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,MAAM,IAAI,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC9C,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC9B,CAAC;YACD,qEAAqE;YACrE,sEAAsE;YACtE,yDAAyD;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,+DAA+D;YAC/D,iDAAiD;YACjD,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,EACzB,uDAAuD,CACxD,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/prompt-login-reset.d.ts

@@ -0,0 +1,103 @@
+/**
+ * prompt=login session-reset middleware.
+ *
+ * Fixes the "Something went wrong" dead-end on browser re-login (Bug #1).
+ *
+ * Root cause: a stale `_session` cookie from a previous login survives into a
+ * new `prompt=login` authorization flow. The provider rotates the session id
+ * during resume, so the interaction's recorded session uid no longer matches
+ * the live session uid → node-oidc-provider throws `SessionNotFound` and the
+ * user sees a terminal error. (Confirmed: the Redis Session record is present
+ * during the failure — this is NOT a Redis durability problem.)
+ *
+ * Fix: on an initial GET/POST authorize request whose `prompt` parameter
+ * contains `login`, clear the `_session` + `_session.sig` cookies BEFORE the
+ * provider runs. With no stale cookie, the provider mints a fresh session and
+ * there is no uid mismatch. The stale Redis Session record is left to expire on
+ * its own via TTL (AR-2, revised) — clearing the cookie is what fixes the bug.
+ *
+ * Design notes:
+ * - Only acts when `prompt` contains the `login` value (AR-3). Normal SSO /
+ *   session-reuse logins are unaffected (AR-5).
+ * - Reads `prompt` from the query string. The CLI and standard browser RP flows
+ *   use GET authorize with `prompt` in the query, so this covers the real flow
+ *   without consuming the POST body stream the provider needs (PF-005).
+ * - Cookie clearing is signing-free: we expire both `_session` and
+ *   `_session.sig` explicitly. The outer Koa app does not set `app.keys`, so we
+ *   must NOT rely on Koa's signed-cookie API here (PF-001/PF-002).
+ *
+ * @module middleware/prompt-login-reset
+ */
+import type { Middleware } from 'koa';
+import type Provider from 'oidc-provider';
+/**
+ * Does the OIDC `prompt` parameter request a forced login?
+ *
+ * Per OIDC Core §3.1.2.1, `prompt` is a space-delimited list of values.
+ * Returns true only when `login` is one of those values (exact token match —
+ * not a substring, so `logins` or `login_hint` values do not match).
+ *
+ * @param prompt - The raw `prompt` parameter value (or undefined)
+ * @returns true if `login` is present among the space-delimited values
+ */
+export declare function promptHasLogin(prompt: string | undefined | null): boolean;
+/**
+ * Is this request the INITIAL org-scoped authorize endpoint?
+ *
+ * Matches `GET`/`POST` `/{orgSlug}/auth` (with optional trailing slash) but
+ * NOT the resume route `/{orgSlug}/auth/{uid}` and not other OIDC endpoints
+ * (`/token`, `/jwks`, etc.). The resume route must be excluded because the
+ * session-mismatch happens there — we reset on the *initial* authorize so the
+ * interaction binds to a fresh session.
+ *
+ * @param method - HTTP method
+ * @param path - Request path (outer Koa path, includes the org slug)
+ * @returns true if this is the initial authorize endpoint
+ */
+export declare function isInitialAuthorize(method: string, path: string): boolean;
+/**
+ * Clear the OIDC session cookie pair (`_session` + `_session.sig`).
+ *
+ * Expires BOTH cookie names at path `/` with attributes matching how the
+ * provider wrote them (httpOnly, sameSite=lax, secure per issuer scheme). This
+ * is intentionally signing-free: it sets each cookie to an expired value
+ * directly, so it works regardless of whether `app.keys` is configured on the
+ * Koa app (the outer Porta app does not set it). (PF-001/PF-002, AR-2)
+ *
+ * @param ctx - Koa context (outer app context or provider ctx — both work)
+ * @param sessionCookieName - The provider's session cookie name (e.g. `_session`)
+ */
+export declare function clearSessionCookies(ctx: any, sessionCookieName: string): void;
+/**
+ * Strip the OIDC session cookie pair from the INBOUND request header.
+ *
+ * This is the critical half of the fix. node-oidc-provider is invoked via
+ * `provider.callback()(ctx.req, ctx.res)` and reads the session cookie from the
+ * raw inbound request (`ctx.req.headers.cookie`) — NOT from anything we write to
+ * the response. Clearing the response cookie (via `clearSessionCookies`) only
+ * tells the *browser* to drop the cookie on *future* requests; it does nothing
+ * for the current request the provider is about to process.
+ *
+ * To prevent the provider from seeing the stale `_session` during THIS request
+ * (and thus hitting the session-id-rotation `SessionNotFound`), we must remove
+ * the session cookie pair from `ctx.req.headers.cookie` before calling `next()`.
+ *
+ * Removes any cookie whose name is exactly `sessionCookieName` or begins with
+ * `${sessionCookieName}.` (covers `_session.sig`, `_session.legacy`,
+ * `_session.legacy.sig`). All other cookies are preserved unchanged.
+ *
+ * @param ctx - Koa context (its `ctx.req` is the same raw req the provider reads)
+ * @param sessionCookieName - The provider's session cookie name (e.g. `_session`)
+ */
+export declare function stripSessionCookiesFromRequest(ctx: any, sessionCookieName: string): void;
+/**
+ * Create the prompt=login session-reset middleware.
+ *
+ * Mounted in `src/server.ts` BEFORE the `/:orgSlug/*` OIDC router so it runs on
+ * the outer Koa context before the provider processes the authorize request.
+ *
+ * @param provider - OIDC provider instance (used only for the session cookie name)
+ * @returns Koa middleware
+ */
+export declare function promptLoginReset(provider: Provider): Middleware;
+//# sourceMappingURL=prompt-login-reset.d.ts.map

package/dist/middleware/prompt-login-reset.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-login-reset.d.ts","sourceRoot":"","sources":["../../src/middleware/prompt-login-reset.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAS1C;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAGzE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAKxE;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAEjC,GAAG,EAAE,GAAG,EACR,iBAAiB,EAAE,MAAM,GACxB,IAAI,CAiBN;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,8BAA8B,CAE5C,GAAG,EAAE,GAAG,EACR,iBAAiB,EAAE,MAAM,GACxB,IAAI,CAoBN;AAMD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,GAAG,UAAU,CAqD/D"}

package/dist/middleware/prompt-login-reset.js

@@ -0,0 +1,204 @@
+/**
+ * prompt=login session-reset middleware.
+ *
+ * Fixes the "Something went wrong" dead-end on browser re-login (Bug #1).
+ *
+ * Root cause: a stale `_session` cookie from a previous login survives into a
+ * new `prompt=login` authorization flow. The provider rotates the session id
+ * during resume, so the interaction's recorded session uid no longer matches
+ * the live session uid → node-oidc-provider throws `SessionNotFound` and the
+ * user sees a terminal error. (Confirmed: the Redis Session record is present
+ * during the failure — this is NOT a Redis durability problem.)
+ *
+ * Fix: on an initial GET/POST authorize request whose `prompt` parameter
+ * contains `login`, clear the `_session` + `_session.sig` cookies BEFORE the
+ * provider runs. With no stale cookie, the provider mints a fresh session and
+ * there is no uid mismatch. The stale Redis Session record is left to expire on
+ * its own via TTL (AR-2, revised) — clearing the cookie is what fixes the bug.
+ *
+ * Design notes:
+ * - Only acts when `prompt` contains the `login` value (AR-3). Normal SSO /
+ *   session-reuse logins are unaffected (AR-5).
+ * - Reads `prompt` from the query string. The CLI and standard browser RP flows
+ *   use GET authorize with `prompt` in the query, so this covers the real flow
+ *   without consuming the POST body stream the provider needs (PF-005).
+ * - Cookie clearing is signing-free: we expire both `_session` and
+ *   `_session.sig` explicitly. The outer Koa app does not set `app.keys`, so we
+ *   must NOT rely on Koa's signed-cookie API here (PF-001/PF-002).
+ *
+ * @module middleware/prompt-login-reset
+ */
+import { config } from '../config/index.js';
+import { logger } from '../lib/logger.js';
+import { writeAuditLog } from '../lib/audit-log.js';
+// ---------------------------------------------------------------------------
+// Pure helpers (exported for testing)
+// ---------------------------------------------------------------------------
+/**
+ * Does the OIDC `prompt` parameter request a forced login?
+ *
+ * Per OIDC Core §3.1.2.1, `prompt` is a space-delimited list of values.
+ * Returns true only when `login` is one of those values (exact token match —
+ * not a substring, so `logins` or `login_hint` values do not match).
+ *
+ * @param prompt - The raw `prompt` parameter value (or undefined)
+ * @returns true if `login` is present among the space-delimited values
+ */
+export function promptHasLogin(prompt) {
+    if (!prompt)
+        return false;
+    return prompt.split(' ').filter(Boolean).includes('login');
+}
+/**
+ * Is this request the INITIAL org-scoped authorize endpoint?
+ *
+ * Matches `GET`/`POST` `/{orgSlug}/auth` (with optional trailing slash) but
+ * NOT the resume route `/{orgSlug}/auth/{uid}` and not other OIDC endpoints
+ * (`/token`, `/jwks`, etc.). The resume route must be excluded because the
+ * session-mismatch happens there — we reset on the *initial* authorize so the
+ * interaction binds to a fresh session.
+ *
+ * @param method - HTTP method
+ * @param path - Request path (outer Koa path, includes the org slug)
+ * @returns true if this is the initial authorize endpoint
+ */
+export function isInitialAuthorize(method, path) {
+    if (method !== 'GET' && method !== 'POST')
+        return false;
+    // ^/{slug}/auth or /{slug}/auth/ — exactly one path segment before /auth,
+    // and nothing (or only a trailing slash) after.
+    return /^\/[^/]+\/auth\/?$/.test(path);
+}
+// ---------------------------------------------------------------------------
+// Cookie clearing (signing-free, shared)
+// ---------------------------------------------------------------------------
+/**
+ * Clear the OIDC session cookie pair (`_session` + `_session.sig`).
+ *
+ * Expires BOTH cookie names at path `/` with attributes matching how the
+ * provider wrote them (httpOnly, sameSite=lax, secure per issuer scheme). This
+ * is intentionally signing-free: it sets each cookie to an expired value
+ * directly, so it works regardless of whether `app.keys` is configured on the
+ * Koa app (the outer Porta app does not set it). (PF-001/PF-002, AR-2)
+ *
+ * @param ctx - Koa context (outer app context or provider ctx — both work)
+ * @param sessionCookieName - The provider's session cookie name (e.g. `_session`)
+ */
+export function clearSessionCookies(
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+ctx, sessionCookieName) {
+    const secure = config.issuerBaseUrl.startsWith('https://');
+    const opts = {
+        path: '/',
+        httpOnly: true,
+        sameSite: 'lax',
+        secure,
+        // Do NOT use signed: true — the outer app has no app.keys.
+        signed: false,
+        // Expire immediately.
+        expires: new Date(0),
+        maxAge: 0,
+    };
+    // Clear the main cookie and its signature companion explicitly.
+    ctx.cookies.set(sessionCookieName, null, opts);
+    ctx.cookies.set(`${sessionCookieName}.sig`, null, opts);
+}
+/**
+ * Strip the OIDC session cookie pair from the INBOUND request header.
+ *
+ * This is the critical half of the fix. node-oidc-provider is invoked via
+ * `provider.callback()(ctx.req, ctx.res)` and reads the session cookie from the
+ * raw inbound request (`ctx.req.headers.cookie`) — NOT from anything we write to
+ * the response. Clearing the response cookie (via `clearSessionCookies`) only
+ * tells the *browser* to drop the cookie on *future* requests; it does nothing
+ * for the current request the provider is about to process.
+ *
+ * To prevent the provider from seeing the stale `_session` during THIS request
+ * (and thus hitting the session-id-rotation `SessionNotFound`), we must remove
+ * the session cookie pair from `ctx.req.headers.cookie` before calling `next()`.
+ *
+ * Removes any cookie whose name is exactly `sessionCookieName` or begins with
+ * `${sessionCookieName}.` (covers `_session.sig`, `_session.legacy`,
+ * `_session.legacy.sig`). All other cookies are preserved unchanged.
+ *
+ * @param ctx - Koa context (its `ctx.req` is the same raw req the provider reads)
+ * @param sessionCookieName - The provider's session cookie name (e.g. `_session`)
+ */
+export function stripSessionCookiesFromRequest(
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+ctx, sessionCookieName) {
+    const header = ctx.req?.headers?.cookie;
+    if (!header)
+        return;
+    const prefix = `${sessionCookieName}.`;
+    const kept = header
+        .split(';')
+        .map((pair) => pair.trim())
+        .filter((pair) => {
+        if (!pair)
+            return false;
+        const eq = pair.indexOf('=');
+        const name = (eq === -1 ? pair : pair.slice(0, eq)).trim();
+        return name !== sessionCookieName && !name.startsWith(prefix);
+    });
+    if (kept.length === 0) {
+        delete ctx.req.headers.cookie;
+    }
+    else {
+        ctx.req.headers.cookie = kept.join('; ');
+    }
+}
+// ---------------------------------------------------------------------------
+// Middleware factory
+// ---------------------------------------------------------------------------
+/**
+ * Create the prompt=login session-reset middleware.
+ *
+ * Mounted in `src/server.ts` BEFORE the `/:orgSlug/*` OIDC router so it runs on
+ * the outer Koa context before the provider processes the authorize request.
+ *
+ * @param provider - OIDC provider instance (used only for the session cookie name)
+ * @returns Koa middleware
+ */
+export function promptLoginReset(provider) {
+    // Resolve the session cookie name once (e.g. '_session'). `cookieName` is a
+    // runtime method on the provider that is not present in the TypeScript types,
+    // so we access it via a narrow cast and fall back to the provider default
+    // (`_session`) if it is unavailable.
+    const providerWithCookieName = provider;
+    const sessionCookieName = typeof providerWithCookieName.cookieName === 'function'
+        ? providerWithCookieName.cookieName('session')
+        : '_session';
+    return async (ctx, next) => {
+        if (!isInitialAuthorize(ctx.method, ctx.path)) {
+            return next();
+        }
+        const prompt = ctx.query.prompt;
+        const promptValue = Array.isArray(prompt) ? prompt.join(' ') : prompt;
+        if (!promptHasLogin(promptValue)) {
+            return next();
+        }
+        // Force a clean slate. TWO actions are required:
+        //
+        // 1. Strip the session cookie pair from the INBOUND request header so the
+        //    provider — invoked this same request via `provider.callback()(ctx.req,
+        //    ctx.res)`, which reads `ctx.req.headers.cookie` — does NOT see the
+        //    stale `_session` and cannot hit the session-id-rotation
+        //    `SessionNotFound`. This is the half that actually fixes the bug.
+        // 2. Clear the response cookie pair so the browser drops the stale cookie
+        //    for future requests too.
+        stripSessionCookiesFromRequest(ctx, sessionCookieName);
+        clearSessionCookies(ctx, sessionCookieName);
+        logger.info({ path: ctx.path }, 'prompt=login: cleared session cookies for forced re-authentication');
+        // Best-effort audit (no sensitive data). Fire-and-forget pattern matches
+        // writeAuditLog's own contract (it never throws).
+        writeAuditLog({
+            eventType: 'auth.prompt_login.session_reset',
+            eventCategory: 'authentication',
+            description: 'Session cookies cleared on prompt=login (forced re-authentication)',
+            ipAddress: ctx.ip,
+        });
+        return next();
+    };
+}
+//# sourceMappingURL=prompt-login-reset.js.map

package/dist/middleware/prompt-login-reset.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-login-reset.js","sourceRoot":"","sources":["../../src/middleware/prompt-login-reset.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,8EAA8E;AAC9E,sCAAsC;AACtC,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,MAAiC;IAC9D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,IAAY;IAC7D,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACxD,0EAA0E;IAC1E,gDAAgD;IAChD,OAAO,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,8EAA8E;AAC9E,yCAAyC;AACzC,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB;AACjC,8DAA8D;AAC9D,GAAQ,EACR,iBAAyB;IAEzB,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,KAAc;QACxB,MAAM;QACN,2DAA2D;QAC3D,MAAM,EAAE,KAAK;QACb,sBAAsB;QACtB,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC;QACpB,MAAM,EAAE,CAAC;KACV,CAAC;IAEF,gEAAgE;IAChE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,iBAAiB,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,8BAA8B;AAC5C,8DAA8D;AAC9D,GAAQ,EACR,iBAAyB;IAEzB,MAAM,MAAM,GAAuB,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC;IAC5D,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,MAAM,GAAG,GAAG,iBAAiB,GAAG,CAAC;IACvC,MAAM,IAAI,GAAG,MAAM;SAChB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAClC,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;QACvB,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,OAAO,IAAI,KAAK,iBAAiB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEL,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAkB;IACjD,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,qCAAqC;IACrC,MAAM,sBAAsB,GAAG,QAE9B,CAAC;IACF,MAAM,iBAAiB,GACrB,OAAO,sBAAsB,CAAC,UAAU,KAAK,UAAU;QACrD,CAAC,CAAC,sBAAsB,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9C,CAAC,CAAC,UAAU,CAAC;IAEjB,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;QAChC,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAEtE,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;YACjC,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,iDAAiD;QACjD,EAAE;QACF,0EAA0E;QAC1E,4EAA4E;QAC5E,wEAAwE;QACxE,6DAA6D;QAC7D,sEAAsE;QACtE,0EAA0E;QAC1E,8BAA8B;QAC9B,8BAA8B,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACvD,mBAAmB,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAE5C,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAClB,oEAAoE,CACrE,CAAC;QAEF,yEAAyE;QACzE,kDAAkD;QAClD,aAAa,CAAC;YACZ,SAAS,EAAE,iCAAiC;YAC5C,aAAa,EAAE,gBAAgB;YAC/B,WAAW,EAAE,oEAAoE;YACjF,SAAS,EAAE,GAAG,CAAC,EAAE;SAClB,CAAC,CAAC;QAEH,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/ready.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Readiness probe handler — GET /ready.
+ *
+ * Separate from /health (liveness): /health confirms the server process
+ * is alive; /ready confirms the server can actually serve requests by
+ * checking that both PostgreSQL and Redis are reachable within a timeout.
+ *
+ * Kubernetes / ECS maps:
+ *   - livenessProbe  → GET /health
+ *   - readinessProbe → GET /ready
+ *
+ * Returns 200 + { status: 'ready', checks } when both backends are healthy,
+ * or 503 + { status: 'not_ready', checks } when either is degraded.
+ */
+import type { Middleware } from 'koa';
+/**
+ * Create the readiness probe middleware.
+ *
+ * Both DB and Redis are checked concurrently with individual timeouts.
+ * A single failure makes the overall probe return 503.
+ */
+export declare function readyHandler(): Middleware;
+//# sourceMappingURL=ready.d.ts.map

package/dist/middleware/ready.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ready.d.ts","sourceRoot":"","sources":["../../src/middleware/ready.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAwBtC;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,UAAU,CA6BzC"}