@portaidentity/server 1.7.0

package/dist/oidc/account-finder.js

@@ -0,0 +1,134 @@
+/**
+ * Account finder for node-oidc-provider.
+ *
+ * Maps user records from the database to OIDC account objects with a
+ * claims() method. The provider calls findAccount when it needs user
+ * information for ID tokens, userinfo endpoint responses, etc.
+ *
+ * This implementation delegates to the user service for lookup and
+ * the claims builder for scope-based claims mapping. The user must
+ * be active to be returned — non-active users get undefined (no account).
+ *
+ * Claims flow:
+ * 1. buildUserClaims(user, scopes) → standard OIDC claims (sub, name, email...)
+ * 2. buildRoleClaims(userId) → role slugs array (cache-first)
+ * 3. buildPermissionClaims(userId) → permission slugs array (cache-first)
+ * 4. buildCustomClaims(userId, appId, tokenType) → custom per-app claims
+ *
+ * The applicationId for custom claims is resolved from the OIDC client
+ * context. If unavailable (e.g., no client context), custom claims are
+ * skipped gracefully.
+ *
+ * @see users/service.ts — User lookup for OIDC
+ * @see users/claims.ts — Standard OIDC claims builder
+ * @see rbac/user-role-service.ts — RBAC claims builders
+ * @see custom-claims/service.ts — Custom claims builder
+ */
+import { findUserForOidc } from '../users/service.js';
+import { buildUserClaims } from '../users/claims.js';
+import { buildRoleClaims, buildPermissionClaims } from '../rbac/user-role-service.js';
+import { buildCustomClaims } from '../custom-claims/service.js';
+import { logger } from '../lib/logger.js';
+/**
+ * Find an OIDC account by subject identifier (user ID).
+ *
+ * Delegates to the user service's findUserForOidc which returns
+ * active users only. Returns an account object with a claims() method
+ * that builds scope-filtered OIDC Standard Claims merged with RBAC
+ * role/permission claims and per-application custom claims.
+ *
+ * @param ctx - Koa context with OIDC extensions (used to resolve client/app context)
+ * @param sub - The subject identifier (user UUID)
+ * @returns Account object with claims() method, or undefined if not found
+ */
+export async function findAccount(ctx, sub) {
+    try {
+        const user = await findUserForOidc(sub);
+        if (!user)
+            return undefined;
+        return {
+            accountId: user.id,
+            /**
+             * Return claims for the user including standard OIDC claims,
+             * RBAC roles/permissions, and per-application custom claims.
+             *
+             * Standard claims are filtered by scopes (OpenID Connect Core §5.4).
+             * RBAC claims (roles, permissions) are always included as arrays.
+             * Custom claims are filtered by token type inclusion flags.
+             */
+            async claims(use, scope) {
+                // Parse space-separated scope string into array
+                const scopes = scope ? scope.split(' ') : [];
+                // 1. Standard OIDC claims (scope-filtered)
+                const standardClaims = buildUserClaims(user, scopes);
+                // 2. RBAC claims (always included — cache-first resolution)
+                const [roles, permissions] = await Promise.all([
+                    buildRoleClaims(user.id),
+                    buildPermissionClaims(user.id),
+                ]);
+                // 3. Custom claims (per-application, filtered by token type)
+                // Resolve applicationId from the OIDC client context if available
+                const applicationId = resolveApplicationId(ctx);
+                let customClaims = {};
+                if (applicationId) {
+                    // Map OIDC 'use' parameter to our TokenType
+                    const tokenType = mapUseToTokenType(use);
+                    customClaims = await buildCustomClaims(user.id, applicationId, tokenType);
+                }
+                // Merge all claims — standard first, then RBAC arrays, then custom
+                return {
+                    ...standardClaims,
+                    roles,
+                    permissions,
+                    ...customClaims,
+                };
+            },
+        };
+    }
+    catch (error) {
+        logger.error({ sub, error }, 'Failed to look up OIDC account');
+        return undefined;
+    }
+}
+/**
+ * Resolve the applicationId from the OIDC context.
+ *
+ * The OIDC provider passes the Koa context which includes the client
+ * object at ctx.oidc.client. The client has an applicationId stored
+ * in its metadata. Returns null if the context doesn't have the
+ * expected structure (graceful fallback).
+ *
+ * @param ctx - Koa context with OIDC extensions
+ * @returns Application UUID or null if not resolvable
+ */
+function resolveApplicationId(ctx) {
+    try {
+        // Navigate the OIDC context structure: ctx.oidc.client.applicationId
+        const oidcCtx = ctx;
+        return oidcCtx?.oidc?.client?.applicationId ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Map the OIDC 'use' parameter to our TokenType enum.
+ *
+ * The OIDC provider passes 'id_token', 'userinfo', or occasionally
+ * other values. We map them to our TokenType for custom claims filtering.
+ *
+ * @param use - Token type from OIDC provider
+ * @returns Mapped TokenType
+ */
+function mapUseToTokenType(use) {
+    switch (use) {
+        case 'id_token':
+            return 'id_token';
+        case 'userinfo':
+            return 'userinfo';
+        default:
+            // Default to access_token for introspection and other uses
+            return 'access_token';
+    }
+}
+//# sourceMappingURL=account-finder.js.map

package/dist/oidc/account-finder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-finder.js","sourceRoot":"","sources":["../../src/oidc/account-finder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACtF,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAgB1C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAY,EACZ,GAAW;IAEX,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAE5B,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,EAAE;YAClB;;;;;;;eAOG;YACH,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,KAAa;gBACrC,gDAAgD;gBAChD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAE7C,2CAA2C;gBAC3C,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAErD,4DAA4D;gBAC5D,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBAC7C,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxB,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;iBAC/B,CAAC,CAAC;gBAEH,6DAA6D;gBAC7D,kEAAkE;gBAClE,MAAM,aAAa,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;gBAChD,IAAI,YAAY,GAA4B,EAAE,CAAC;gBAC/C,IAAI,aAAa,EAAE,CAAC;oBAClB,4CAA4C;oBAC5C,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;oBACzC,YAAY,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;gBAC5E,CAAC;gBAED,mEAAmE;gBACnE,OAAO;oBACL,GAAG,cAAc;oBACjB,KAAK;oBACL,WAAW;oBACX,GAAG,YAAY;iBAChB,CAAC;YACJ,CAAC;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,gCAAgC,CAAC,CAAC;QAC/D,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,oBAAoB,CAAC,GAAY;IACxC,IAAI,CAAC;QACH,qEAAqE;QACrE,MAAM,OAAO,GAAG,GAAyD,CAAC;QAC1E,OAAO,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,IAAI,IAAI,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,GAAW;IACpC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB;YACE,2DAA2D;YAC3D,OAAO,cAAc,CAAC;IAC1B,CAAC;AACH,CAAC"}

package/dist/oidc/adapter-factory.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Hybrid adapter factory for node-oidc-provider.
+ *
+ * Routes short-lived, high-throughput models to RedisAdapter and
+ * long-lived models to PostgresAdapter. This maximizes performance
+ * for frequently accessed artifacts (sessions, interactions, auth codes)
+ * while ensuring persistence for long-lived ones (access tokens,
+ * refresh tokens, grants).
+ *
+ * Usage:
+ *   const provider = new Provider(issuer, {
+ *     adapter: createAdapterFactory(),
+ *   });
+ *
+ * The factory returns a CLASS (not an instance) — node-oidc-provider
+ * instantiates it with `new AdapterClass(modelName)`.
+ */
+import { PostgresAdapter } from './postgres-adapter.js';
+import { RedisAdapter } from './redis-adapter.js';
+import type { AdapterPayload } from './postgres-adapter.js';
+/**
+ * Models routed to Redis for performance.
+ *
+ * These are short-lived, high-throughput artifacts where Redis's
+ * in-memory speed and automatic TTL expiry are ideal:
+ * - Session: frequently accessed per-request, 24h TTL
+ * - Interaction: very short-lived login flow state, 1h TTL
+ * - AuthorizationCode: short-lived, high throughput, 10min TTL
+ * - ReplayDetection: performance-critical duplicate detection
+ * - ClientCredentials: short-lived M2M tokens, 1h TTL
+ * - PushedAuthorizationRequest: short-lived PAR requests, 1h TTL
+ */
+export declare const REDIS_MODELS: Set<string>;
+/**
+ * Check if a model name should be stored in Redis.
+ *
+ * @param name - OIDC model name (e.g., 'Session', 'AccessToken')
+ * @returns true if the model should use Redis, false for PostgreSQL
+ */
+export declare function isRedisModel(name: string): boolean;
+/**
+ * Create the hybrid adapter factory for node-oidc-provider.
+ *
+ * Returns a class constructor that node-oidc-provider calls with
+ * `new AdapterClass(modelName)`. The constructor internally creates
+ * either a RedisAdapter or PostgresAdapter based on the model name.
+ *
+ * @returns A class constructor compatible with node-oidc-provider's adapter option
+ */
+export declare function createAdapterFactory(): {
+    new (name: string): {
+        /** The underlying adapter (Redis or PostgreSQL) */
+        delegate: PostgresAdapter | RedisAdapter;
+        /** The OIDC model name this adapter instance handles */
+        name: string;
+        /** Create or update an OIDC artifact */
+        upsert(id: string, payload: AdapterPayload, expiresIn: number): Promise<void>;
+        /**
+         * Find an artifact by its primary ID.
+         *
+         * For the 'Client' model, routes to findForOidc() which resolves
+         * clients from the clients table (not oidc_payloads). This is the
+         * bridge between Porta's client management and oidc-provider.
+         */
+        find(id: string): Promise<AdapterPayload | undefined>;
+        /** Find an artifact by user code (device flow) */
+        findByUserCode(userCode: string): Promise<AdapterPayload | undefined>;
+        /** Find an artifact by UID (sessions) */
+        findByUid(uid: string): Promise<AdapterPayload | undefined>;
+        /** Mark an artifact as consumed */
+        consume(id: string): Promise<void>;
+        /**
+         * Delete an artifact by ID.
+         *
+         * For Session models, this performs a cascade delete: before destroying the
+         * session itself, it reads the session's authorizations to extract grant IDs,
+         * then deletes all associated grants and tokens from PostgreSQL and cleans up
+         * Redis grant sets. This ensures "explicit logout = total cleanup."
+         *
+         * For all other models, delegates directly to the underlying adapter.
+         *
+         * Error handling: cascade failures are logged but do NOT prevent the session
+         * from being destroyed — the user must always be able to log out.
+         */
+        destroy(id: string): Promise<void>;
+        /** Revoke all artifacts for a given grant */
+        revokeByGrantId(grantId: string): Promise<void>;
+    };
+};
+//# sourceMappingURL=adapter-factory.d.ts.map

package/dist/oidc/adapter-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-factory.d.ts","sourceRoot":"","sources":["../../src/oidc/adapter-factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,eAAe,EAAqB,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAsB,MAAM,oBAAoB,CAAC;AAGtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY,aAOvB,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAElD;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB;eAad,MAAM;QANxB,mDAAmD;kBAClC,eAAe,GAAG,YAAY;QAE/C,wDAAwD;cAC3C,MAAM;QAanB,wCAAwC;mBACvB,MAAM,WAAW,cAAc,aAAa,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;QAInF;;;;;;WAMG;iBACY,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;QAO3D,kDAAkD;iCACnB,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;QAI3E,yCAAyC;uBACpB,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;QAIjE,mCAAmC;oBACjB,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;QAIxC;;;;;;;;;;;;WAYG;oBACe,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;QAgDxC,6CAA6C;iCACd,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;;EAIxD"}

package/dist/oidc/adapter-factory.js

@@ -0,0 +1,165 @@
+/**
+ * Hybrid adapter factory for node-oidc-provider.
+ *
+ * Routes short-lived, high-throughput models to RedisAdapter and
+ * long-lived models to PostgresAdapter. This maximizes performance
+ * for frequently accessed artifacts (sessions, interactions, auth codes)
+ * while ensuring persistence for long-lived ones (access tokens,
+ * refresh tokens, grants).
+ *
+ * Usage:
+ *   const provider = new Provider(issuer, {
+ *     adapter: createAdapterFactory(),
+ *   });
+ *
+ * The factory returns a CLASS (not an instance) — node-oidc-provider
+ * instantiates it with `new AdapterClass(modelName)`.
+ */
+import { PostgresAdapter, revokeGrantsByIds } from './postgres-adapter.js';
+import { RedisAdapter, cleanupRedisGrants } from './redis-adapter.js';
+import { findForOidc } from '../clients/service.js';
+import { logger } from '../lib/logger.js';
+/**
+ * Models routed to Redis for performance.
+ *
+ * These are short-lived, high-throughput artifacts where Redis's
+ * in-memory speed and automatic TTL expiry are ideal:
+ * - Session: frequently accessed per-request, 24h TTL
+ * - Interaction: very short-lived login flow state, 1h TTL
+ * - AuthorizationCode: short-lived, high throughput, 10min TTL
+ * - ReplayDetection: performance-critical duplicate detection
+ * - ClientCredentials: short-lived M2M tokens, 1h TTL
+ * - PushedAuthorizationRequest: short-lived PAR requests, 1h TTL
+ */
+export const REDIS_MODELS = new Set([
+    'Session',
+    'Interaction',
+    'AuthorizationCode',
+    'ReplayDetection',
+    'ClientCredentials',
+    'PushedAuthorizationRequest',
+]);
+/**
+ * Check if a model name should be stored in Redis.
+ *
+ * @param name - OIDC model name (e.g., 'Session', 'AccessToken')
+ * @returns true if the model should use Redis, false for PostgreSQL
+ */
+export function isRedisModel(name) {
+    return REDIS_MODELS.has(name);
+}
+/**
+ * Create the hybrid adapter factory for node-oidc-provider.
+ *
+ * Returns a class constructor that node-oidc-provider calls with
+ * `new AdapterClass(modelName)`. The constructor internally creates
+ * either a RedisAdapter or PostgresAdapter based on the model name.
+ *
+ * @returns A class constructor compatible with node-oidc-provider's adapter option
+ */
+export function createAdapterFactory() {
+    /**
+     * HybridAdapter delegates all operations to either RedisAdapter or
+     * PostgresAdapter based on the model name. This is transparent to
+     * node-oidc-provider — it just sees a standard adapter interface.
+     */
+    return class HybridAdapter {
+        /** The underlying adapter (Redis or PostgreSQL) */
+        delegate;
+        /** The OIDC model name this adapter instance handles */
+        name;
+        constructor(name) {
+            this.name = name;
+            // Route to the appropriate adapter based on the model name
+            if (REDIS_MODELS.has(name)) {
+                this.delegate = new RedisAdapter(name);
+            }
+            else {
+                this.delegate = new PostgresAdapter(name);
+            }
+        }
+        /** Create or update an OIDC artifact */
+        async upsert(id, payload, expiresIn) {
+            return this.delegate.upsert(id, payload, expiresIn);
+        }
+        /**
+         * Find an artifact by its primary ID.
+         *
+         * For the 'Client' model, routes to findForOidc() which resolves
+         * clients from the clients table (not oidc_payloads). This is the
+         * bridge between Porta's client management and oidc-provider.
+         */
+        async find(id) {
+            if (this.name === 'Client') {
+                return findForOidc(id);
+            }
+            return this.delegate.find(id);
+        }
+        /** Find an artifact by user code (device flow) */
+        async findByUserCode(userCode) {
+            return this.delegate.findByUserCode(userCode);
+        }
+        /** Find an artifact by UID (sessions) */
+        async findByUid(uid) {
+            return this.delegate.findByUid(uid);
+        }
+        /** Mark an artifact as consumed */
+        async consume(id) {
+            return this.delegate.consume(id);
+        }
+        /**
+         * Delete an artifact by ID.
+         *
+         * For Session models, this performs a cascade delete: before destroying the
+         * session itself, it reads the session's authorizations to extract grant IDs,
+         * then deletes all associated grants and tokens from PostgreSQL and cleans up
+         * Redis grant sets. This ensures "explicit logout = total cleanup."
+         *
+         * For all other models, delegates directly to the underlying adapter.
+         *
+         * Error handling: cascade failures are logged but do NOT prevent the session
+         * from being destroyed — the user must always be able to log out.
+         */
+        async destroy(id) {
+            if (this.name === 'Session') {
+                try {
+                    // Step 1: Read session to extract grant IDs before destroying it.
+                    // The session payload has an `authorizations` map:
+                    //   { [clientId]: { grantId, sid } }
+                    const session = await this.delegate.find(id);
+                    if (session?.authorizations) {
+                        const grantIds = [];
+                        const authorizations = session.authorizations;
+                        for (const auth of Object.values(authorizations)) {
+                            if (auth.grantId)
+                                grantIds.push(auth.grantId);
+                        }
+                        if (grantIds.length > 0) {
+                            // Step 2a: Cascade delete all grant-related records from PostgreSQL.
+                            // This is the critical cleanup — removes AccessTokens, RefreshTokens,
+                            // Grants, and any other artifacts sharing these grant IDs.
+                            await revokeGrantsByIds(grantIds);
+                            // Step 2b: Best-effort cleanup of Redis grant sets and member keys.
+                            // Not critical — Redis keys have TTLs — but removes stale keys immediately.
+                            await cleanupRedisGrants(grantIds);
+                            logger.info({ sessionId: id, grantIds }, 'Session destroy: cascade-deleted grants and tokens');
+                        }
+                    }
+                }
+                catch (err) {
+                    // Cascade failed — log but proceed with session destruction.
+                    // The user must always be able to log out; orphaned tokens will
+                    // expire naturally via their TTLs.
+                    logger.error({ err, sessionId: id }, 'Session destroy: cascade cleanup failed (proceeding with session deletion)');
+                }
+            }
+            // Step 3: Delete the session/artifact itself via the delegate
+            return this.delegate.destroy(id);
+        }
+        /** Revoke all artifacts for a given grant */
+        async revokeByGrantId(grantId) {
+            return this.delegate.revokeByGrantId(grantId);
+        }
+    };
+}
+//# sourceMappingURL=adapter-factory.js.map

package/dist/oidc/adapter-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-factory.js","sourceRoot":"","sources":["../../src/oidc/adapter-factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAG1C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAClC,SAAS;IACT,aAAa;IACb,mBAAmB;IACnB,iBAAiB;IACjB,mBAAmB;IACnB,4BAA4B;CAC7B,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB;IAClC;;;;OAIG;IACH,OAAO,MAAM,aAAa;QACxB,mDAAmD;QAC5C,QAAQ,CAAiC;QAEhD,wDAAwD;QACjD,IAAI,CAAS;QAEpB,YAAY,IAAY;YACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;YAEjB,2DAA2D;YAC3D,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,IAAI,CAAC,QAAQ,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,QAAQ,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,OAAuB,EAAE,SAAiB;YACjE,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACtD,CAAC;QAED;;;;;;WAMG;QACH,KAAK,CAAC,IAAI,CAAC,EAAU;YACnB,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3B,OAAO,WAAW,CAAC,EAAE,CAAwC,CAAC;YAChE,CAAC;YACD,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChC,CAAC;QAED,kDAAkD;QAClD,KAAK,CAAC,cAAc,CAAC,QAAgB;YACnC,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAChD,CAAC;QAED,yCAAyC;QACzC,KAAK,CAAC,SAAS,CAAC,GAAW;YACzB,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QAED,mCAAmC;QACnC,KAAK,CAAC,OAAO,CAAC,EAAU;YACtB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnC,CAAC;QAED;;;;;;;;;;;;WAYG;QACH,KAAK,CAAC,OAAO,CAAC,EAAU;YACtB,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBACH,kEAAkE;oBAClE,mDAAmD;oBACnD,qCAAqC;oBACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAC7C,IAAI,OAAO,EAAE,cAAc,EAAE,CAAC;wBAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;wBAC9B,MAAM,cAAc,GAAG,OAAO,CAAC,cAG9B,CAAC;wBACF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;4BACjD,IAAI,IAAI,CAAC,OAAO;gCAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;wBAChD,CAAC;wBAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BACxB,qEAAqE;4BACrE,sEAAsE;4BACtE,2DAA2D;4BAC3D,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;4BAElC,oEAAoE;4BACpE,4EAA4E;4BAC5E,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;4BAEnC,MAAM,CAAC,IAAI,CACT,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAC3B,oDAAoD,CACrD,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,6DAA6D;oBAC7D,gEAAgE;oBAChE,mCAAmC;oBACnC,MAAM,CAAC,KAAK,CACV,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,EACtB,4EAA4E,CAC7E,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,8DAA8D;YAC9D,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnC,CAAC;QAED,6CAA6C;QAC7C,KAAK,CAAC,eAAe,CAAC,OAAe;YACnC,OAAO,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/oidc/configuration.d.ts

@@ -0,0 +1,155 @@
+/**
+ * OIDC provider configuration builder.
+ *
+ * Builds the complete node-oidc-provider configuration object from external
+ * dependencies (TTLs, keys, adapter factory, finders). This is a pure function
+ * with no side effects — all dependencies are injected as parameters.
+ *
+ * The configuration enables:
+ * - Hybrid adapter (Postgres/Redis) for OIDC artifact storage
+ * - ES256 signing keys loaded from the database
+ * - Client lookup via adapter pattern (adapter.find('Client', id) → findForOidc())
+ * - PKCE required for all authorization code flows (S256 only)
+ * - Token introspection, revocation, and client credentials
+ * - Standard OIDC scopes and claims mapping
+ * - Refresh token rotation
+ * - Cookie signing with rotation support
+ */
+import type { OidcTtlConfig } from '../lib/system-config.js';
+import type { JwkKeyPair } from '../lib/signing-keys.js';
+import type { Organization } from '../organizations/types.js';
+/** Parameters required to build the provider configuration */
+export interface BuildProviderConfigParams {
+    /** Token TTL configuration loaded from system_config table */
+    ttl: OidcTtlConfig;
+    /** JWK key set loaded from signing_keys table */
+    jwks: {
+        keys: JwkKeyPair[];
+    };
+    /** Cookie signing keys from application config (supports rotation) */
+    cookieKeys: string[];
+    /** Account finder function — looks up users by subject ID */
+    findAccount: (ctx: unknown, sub: string) => Promise<{
+        accountId: string;
+        claims: (use: string, scope: string) => Promise<Record<string, unknown>>;
+    } | undefined>;
+    /** Adapter class factory — node-oidc-provider instantiates with `new` */
+    adapterFactory: unknown;
+    /** Interaction URL builder — returns the login/consent URL for a given interaction */
+    interactionUrl: (ctx: unknown, interaction: {
+        uid: string;
+    }) => string;
+    /** CORS handler — determines if an origin is allowed for a client */
+    clientBasedCORS?: (ctx: unknown, origin: string, client: unknown) => boolean;
+}
+/**
+ * Build default branding when org resolution is not possible.
+ * Used by rendering hooks when the session is destroyed or org lookup fails.
+ *
+ * @returns Default branding with Porta's standard blue primary color
+ */
+export declare function buildDefaultBranding(): {
+    logoUrl: string | null;
+    faviconUrl: string | null;
+    primaryColor: string;
+    companyName: string;
+    customCss: string | null;
+};
+/**
+ * Best-effort organization resolution for oidc-provider rendering hooks.
+ *
+ * Tries multiple strategies in order:
+ *   1. Session accountId → user lookup → org lookup
+ *   2. Client metadata → organizationId → org lookup
+ *   3. Returns undefined (caller uses default branding)
+ *
+ * All errors are caught and logged — never throws.
+ *
+ * @param ctx - oidc-provider's enhanced Koa context (KoaContextWithOIDC)
+ * @returns The resolved Organization, or undefined if resolution fails
+ */
+export declare function resolveOrgForProviderHook(ctx: unknown): Promise<Organization | undefined>;
+/**
+ * Custom logoutSource hook for node-oidc-provider.
+ *
+ * Replaces the provider's default bare HTML logout confirmation page with
+ * Porta's styled Handlebars template. Injects a styled submit button into
+ * the provider's pre-built form (which contains the correct action URL and
+ * xsrf hidden field).
+ *
+ * Falls back to minimal inline HTML if the template engine fails, ensuring
+ * the user can still sign out even if templating breaks.
+ *
+ * @param ctx - oidc-provider's enhanced Koa context
+ * @param form - Pre-built HTML form from the provider (contains action + xsrf)
+ */
+export declare function logoutSourceHook(ctx: any, form: string): Promise<void>;
+/**
+ * Custom postLogoutSuccessSource hook for node-oidc-provider.
+ *
+ * Replaces the provider's default bare HTML post-logout page with
+ * Porta's styled Handlebars template. At this point the session is
+ * already destroyed, so org resolution is not possible — default
+ * branding is always used.
+ *
+ * Falls back to minimal inline HTML if the template engine fails.
+ *
+ * @param ctx - oidc-provider's enhanced Koa context
+ */
+export declare function postLogoutSuccessSourceHook(ctx: any): Promise<void>;
+/**
+ * Custom renderError hook for node-oidc-provider.
+ *
+ * Replaces the provider's default bare HTML error page with Porta's styled
+ * Handlebars template. The OIDC error code (e.g., 'invalid_client') is shown
+ * to the user, but the raw error_description is intentionally suppressed to
+ * prevent information leakage — a generic i18n error message is shown instead.
+ *
+ * SECURITY: error_description may contain internal details like "client not
+ * found", "grant not found", etc. Only the standardized OIDC error code is
+ * safe to display.
+ *
+ * @param ctx - oidc-provider's enhanced Koa context
+ * @param out - OIDC error details (error code + optional description)
+ * @param _error - Original Error object (used to detect SessionNotFound)
+ */
+export declare function renderErrorHook(ctx: any, out: {
+    error: string;
+    error_description?: string;
+}, _error: Error): Promise<void>;
+/**
+ * Custom `loadExistingGrant` for node-oidc-provider.
+ *
+ * Mirrors the provider default (resolve the grant from the consent result or
+ * the session's grant id), then conditionally **upgrades** an existing grant to
+ * include `offline_access`.
+ *
+ * Why this exists (Bug #2): with `prompt=login` and a pre-existing Grant that
+ * lacks `offline_access`, the provider does not route through the consent
+ * interaction, so the consent handlers' `offline_access`-adding code never runs.
+ * The authorization code is then issued WITHOUT `offline_access` in its granted
+ * scopes, and `issueRefreshToken` returns false — so no refresh token is minted.
+ * This is exactly the CLI failure ("no refresh_token available" ~1h later).
+ *
+ * The upgrade is strictly gated (AR-6 / AR-7): only when the request asked for
+ * `offline_access`, the client allows the `refresh_token` grant, AND the grant
+ * does not already include `offline_access`. In every other case the grant is
+ * returned unchanged — identical to the provider default — so no other client
+ * or flow is affected.
+ *
+ * @param ctx - node-oidc-provider's enhanced Koa context
+ * @returns the existing Grant (possibly upgraded) or undefined
+ */
+export declare function loadExistingGrant(ctx: any): Promise<unknown | undefined>;
+/**
+ * Build the complete node-oidc-provider configuration object.
+ *
+ * Takes all external dependencies as parameters to keep this function
+ * pure and testable. The resulting configuration covers all OIDC features
+ * needed by Porta.
+ *
+ * @param params - All dependencies for the provider configuration
+ * @returns Complete Configuration object for node-oidc-provider
+ */
+export declare function buildProviderConfiguration(params: BuildProviderConfigParams): Record<string, unknown>;
+//# sourceMappingURL=configuration.d.ts.map

package/dist/oidc/configuration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration.d.ts","sourceRoot":"","sources":["../../src/oidc/configuration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAQzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAG9D,8DAA8D;AAC9D,MAAM,WAAW,yBAAyB;IACxC,8DAA8D;IAC9D,GAAG,EAAE,aAAa,CAAC;IACnB,iDAAiD;IACjD,IAAI,EAAE;QAAE,IAAI,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IAC7B,sEAAsE;IACtE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,6DAA6D;IAC7D,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,GAAG,SAAS,CAAC,CAAC;IACjK,yEAAyE;IACzE,cAAc,EAAE,OAAO,CAAC;IACxB,sFAAsF;IACtF,cAAc,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,MAAM,CAAC;IACvE,qEAAqE;IACrE,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC;CAC9E;AAMD;;;;;GAKG;AACH,wBAAgB,oBAAoB;IAEhC,OAAO,EAAU,MAAM,GAAG,IAAI;IAC9B,UAAU,EAAU,MAAM,GAAG,IAAI;IACjC,YAAY;IACZ,WAAW;IACX,SAAS,EAAU,MAAM,GAAG,IAAI;EAEnC;AAmBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CA8B/F;AAMD;;;;;;;;;;;;;GAaG;AAEH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoD5E;AAED;;;;;;;;;;;GAWG;AAEH,wBAAsB,2BAA2B,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBzE;AAkDD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,eAAe,CAEnC,GAAG,EAAE,GAAG,EACR,GAAG,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAE,EAClD,MAAM,EAAE,KAAK,GACZ,OAAO,CAAC,IAAI,CAAC,CA0Df;AAMD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,iBAAiB,CAErC,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CA8B9B;AAMD;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,yBAAyB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyKrG"}