@relyper/sp-auth 0.1.0 → 0.3.0

package/dist/oidc/discovery.d.ts

@@ -0,0 +1,15 @@
+import { type OidcDiscoveryDocument } from './types.js';
+export type DiscoveryLoaderOptions = {
+    issuer: string;
+    ttlMs: number;
+    requestTimeoutMs: number;
+    fetch: typeof globalThis.fetch;
+};
+export type DiscoveryLoader = {
+    load(): Promise<OidcDiscoveryDocument>;
+    /** Drops the cache, e.g. after a JWKS lookup failed against a rotated IdP. */
+    invalidate(): void;
+};
+export declare function discoveryUrl(issuer: string): string;
+export declare function createDiscoveryLoader(options: DiscoveryLoaderOptions): DiscoveryLoader;
+//# sourceMappingURL=discovery.d.ts.map

package/dist/oidc/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/oidc/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAY1E,MAAM,MAAM,sBAAsB,GAAG;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACvC,8EAA8E;IAC9E,UAAU,IAAI,IAAI,CAAC;CACpB,CAAC;AAEF,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAGnD;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,eAAe,CA8EtF"}

package/dist/oidc/discovery.js

@@ -0,0 +1,90 @@
+import { RelyperOidcError } from './types.js';
+/**
+ * Reads and caches the IdP's discovery document.
+ *
+ * The endpoints are never hardcoded: an IdP is free to move them, and the
+ * document is the contract. Concurrent callers share one in-flight request so a
+ * burst of logins does not turn into a burst of requests against the IdP.
+ */
+const REQUIRED_FIELDS = ['issuer', 'authorization_endpoint', 'token_endpoint', 'jwks_uri'];
+export function discoveryUrl(issuer) {
+    const base = issuer.replace(/\/+$/, '');
+    return base + '/.well-known/openid-configuration';
+}
+export function createDiscoveryLoader(options) {
+    let cached = null;
+    let inFlight = null;
+    async function fetchDocument() {
+        const url = discoveryUrl(options.issuer);
+        let response;
+        try {
+            response = await options.fetch(url, {
+                method: 'GET',
+                headers: { accept: 'application/json' },
+                signal: AbortSignal.timeout(options.requestTimeoutMs)
+            });
+        }
+        catch (cause) {
+            throw new RelyperOidcError('discovery_failed', 'The identity provider could not be reached.', {
+                cause,
+                detail: 'GET ' + url
+            });
+        }
+        if (!response.ok) {
+            throw new RelyperOidcError('discovery_failed', 'The identity provider could not be reached.', {
+                detail: 'GET ' + url + ' returned HTTP ' + response.status
+            });
+        }
+        let document;
+        try {
+            document = (await response.json());
+        }
+        catch (cause) {
+            throw new RelyperOidcError('discovery_failed', 'The identity provider returned a malformed discovery document.', {
+                cause,
+                detail: 'GET ' + url
+            });
+        }
+        for (const field of REQUIRED_FIELDS) {
+            if (typeof document?.[field] !== 'string' || !document[field]) {
+                throw new RelyperOidcError('discovery_failed', 'The discovery document is incomplete.', {
+                    detail: 'missing field: ' + field
+                });
+            }
+        }
+        // The issuer is the identity of the IdP and is compared against the `iss`
+        // claim later. A document that names a different issuer than the one we
+        // configured means we are talking to the wrong party.
+        if (trimSlash(document.issuer) !== trimSlash(options.issuer)) {
+            throw new RelyperOidcError('discovery_failed', 'The identity provider reports a different issuer.', {
+                detail: 'configured ' + options.issuer + ', document ' + document.issuer
+            });
+        }
+        return document;
+    }
+    return {
+        async load() {
+            const now = Date.now();
+            if (cached && cached.expiresAt > now)
+                return cached.document;
+            if (inFlight)
+                return inFlight;
+            inFlight = fetchDocument()
+                .then((document) => {
+                cached = { document, expiresAt: Date.now() + options.ttlMs };
+                return document;
+            })
+                .finally(() => {
+                inFlight = null;
+            });
+            return inFlight;
+        },
+        invalidate() {
+            cached = null;
+        }
+    };
+}
+function trimSlash(value) {
+    return value.replace(/\/+$/, '');
+}
+//# sourceMappingURL=discovery.js.map

package/dist/oidc/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/oidc/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAA8B,MAAM,YAAY,CAAC;AAE1E;;;;;;GAMG;AAEH,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,UAAU,CAAU,CAAC;AAepG,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxC,OAAO,IAAI,GAAG,mCAAmC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAA+B;IACnE,IAAI,MAAM,GAAkE,IAAI,CAAC;IACjF,IAAI,QAAQ,GAA0C,IAAI,CAAC;IAE3D,KAAK,UAAU,aAAa;QAC1B,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;gBAClC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC;aACtD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,6CAA6C,EAAE;gBAC5F,KAAK;gBACL,MAAM,EAAE,MAAM,GAAG,GAAG;aACrB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,6CAA6C,EAAE;gBAC5F,MAAM,EAAE,MAAM,GAAG,GAAG,GAAG,iBAAiB,GAAG,QAAQ,CAAC,MAAM;aAC3D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,QAA+B,CAAC;QACpC,IAAI,CAAC;YACH,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0B,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,gEAAgE,EAAE;gBAC/G,KAAK;gBACL,MAAM,EAAE,MAAM,GAAG,GAAG;aACrB,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,IAAI,OAAO,QAAQ,EAAE,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,uCAAuC,EAAE;oBACtF,MAAM,EAAE,iBAAiB,GAAG,KAAK;iBAClC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,wEAAwE;QACxE,sDAAsD;QACtD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,mDAAmD,EAAE;gBAClG,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,GAAG,aAAa,GAAG,QAAQ,CAAC,MAAM;aACzE,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI;YACR,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG;gBAAE,OAAO,MAAM,CAAC,QAAQ,CAAC;YAC7D,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAE9B,QAAQ,GAAG,aAAa,EAAE;iBACvB,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;gBACjB,MAAM,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;gBAC7D,OAAO,QAAQ,CAAC;YAClB,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACZ,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC,CAAC,CAAC;YAEL,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,UAAU;YACR,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC"}

package/dist/oidc/pkce.d.ts

@@ -0,0 +1,6 @@
+export declare function createCodeVerifier(): string;
+export declare function createState(): string;
+export declare function createNonce(): string;
+/** S256 challenge for a verifier. `plain` is deliberately not offered. */
+export declare function codeChallengeFor(verifier: string): string;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/oidc/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/oidc/pkce.ts"],"names":[],"mappings":"AAeA,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEzD"}

package/dist/oidc/pkce.js

@@ -0,0 +1,26 @@
+import { randomBytes, createHash } from 'node:crypto';
+/**
+ * Client side of Proof Key for Code Exchange (RFC 7636) plus the random values
+ * that protect the authorization request: `state` against CSRF on the callback,
+ * `nonce` against a replayed ID token.
+ *
+ * All three are 256 bits of CSPRNG output rendered as base64url, which lands in
+ * the 43 characters RFC 7636 asks for as a minimum.
+ */
+function randomUrlSafe(byteLength = 32) {
+    return randomBytes(byteLength).toString('base64url');
+}
+export function createCodeVerifier() {
+    return randomUrlSafe(32);
+}
+export function createState() {
+    return randomUrlSafe(32);
+}
+export function createNonce() {
+    return randomUrlSafe(32);
+}
+/** S256 challenge for a verifier. `plain` is deliberately not offered. */
+export function codeChallengeFor(verifier) {
+    return createHash('sha256').update(verifier).digest('base64url');
+}
+//# sourceMappingURL=pkce.js.map

package/dist/oidc/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/oidc/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD;;;;;;;GAOG;AAEH,SAAS,aAAa,CAAC,UAAU,GAAG,EAAE;IACpC,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,aAAa,CAAC,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,aAAa,CAAC,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,aAAa,CAAC,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC"}

package/dist/oidc/session.d.ts

@@ -0,0 +1,47 @@
+import type { RelyperIdentity } from '../types.js';
+import type { RelyperLoginTransaction } from './types.js';
+export type SessionPayload = {
+    identity: RelyperIdentity;
+    /** Seconds since the epoch at which the IdP login happened. */
+    authenticatedAt: number;
+    /**
+     * Identifier of this login. The session itself is stateless, so this exists
+     * for the application: recording it at logout and rejecting it afterwards is
+     * what turns "the browser dropped its cookie" into a revocation that also
+     * stops a cookie someone copied beforehand.
+     */
+    sessionId: string;
+    /**
+     * ID token, kept only when `keepIdToken` is on -- it is needed as the
+     * `id_token_hint` of an RP-initiated logout and for nothing else.
+     */
+    idToken?: string;
+};
+/** Opaque, unguessable identifier for one login. */
+export declare function createSessionId(): string;
+export type SealedCodec<T> = {
+    seal(value: T, ttlSeconds: number): Promise<string>;
+    /** Returns null for anything that is not a valid, unexpired token of this codec. */
+    open(token: string | undefined | null): Promise<T | null>;
+};
+export declare function createSessionCodec(secret: string): SealedCodec<SessionPayload>;
+export declare function createLoginCodec(secret: string): SealedCodec<RelyperLoginTransaction>;
+/** Constant-time string comparison for CSRF-style tokens of equal expected length. */
+export declare function safeEqual(a: string, b: string): boolean;
+export type CookieOptions = {
+    path?: string;
+    domain?: string;
+    maxAgeSeconds?: number;
+    httpOnly?: boolean;
+    secure?: boolean;
+    sameSite?: 'Lax' | 'Strict' | 'None';
+};
+/**
+ * Minimal cookie serialisation, so consumers are not forced to install a cookie
+ * plugin just to use this package.
+ */
+export declare function serializeCookie(name: string, value: string, options?: CookieOptions): string;
+/** Cookie header that deletes `name`. */
+export declare function clearCookie(name: string, options?: CookieOptions): string;
+export declare function parseCookies(header: string | undefined | null): Record<string, string>;
+//# sourceMappingURL=session.d.ts.map

package/dist/oidc/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/oidc/session.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAwB1D,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,eAAe,CAAC;IAC1B,+DAA+D;IAC/D,eAAe,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,oDAAoD;AACpD,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,MAAM,MAAM,WAAW,CAAC,CAAC,IAAI;IAC3B,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,oFAAoF;IACpF,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;CAC3D,CAAC;AAqCF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,CAAC,cAAc,CAAC,CAE9E;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,CAAC,uBAAuB,CAAC,CAErF;AAED,sFAAsF;AACtF,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAKvD;AAID,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;CACtC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,MAAM,CAchG;AAED,yCAAyC;AACzC,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,MAAM,CAE7E;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgBtF"}

package/dist/oidc/session.js

@@ -0,0 +1,119 @@
+import { hkdfSync, randomBytes, timingSafeEqual } from 'node:crypto';
+import { EncryptJWT, jwtDecrypt } from 'jose';
+/**
+ * Cookie-backed state for the OIDC flow, with no server-side store.
+ *
+ * Two cookies are involved and both are encrypted, not merely signed:
+ *
+ *   - the login cookie, which lives for the seconds between the redirect out and
+ *     the callback and carries `state`, `nonce` and the PKCE `code_verifier`;
+ *   - the session cookie, which carries the identity after a successful login.
+ *
+ * Encryption (JWE, direct A256GCM) rather than a signature means the browser
+ * never sees the verifier or the user's claims, and A256GCM authenticates the
+ * ciphertext, so tampering fails to decrypt instead of yielding a forged value.
+ *
+ * Both keys are derived from one application secret through HKDF with distinct
+ * info labels, so the two cookies can never be swapped for one another.
+ */
+const MIN_SECRET_LENGTH = 32;
+const HKDF_SALT = 'relyper-sp-auth/v1';
+const SESSION_LABEL = 'session';
+const LOGIN_LABEL = 'login-transaction';
+/** Opaque, unguessable identifier for one login. */
+export function createSessionId() {
+    return randomBytes(16).toString('base64url');
+}
+function deriveKey(secret, label) {
+    if (typeof secret !== 'string' || secret.length < MIN_SECRET_LENGTH) {
+        throw new TypeError('@relyper/sp-auth/oidc: the session secret must be at least ' + MIN_SECRET_LENGTH + ' characters.');
+    }
+    return new Uint8Array(hkdfSync('sha256', Buffer.from(secret, 'utf8'), HKDF_SALT, label, 32));
+}
+function createCodec(secret, label) {
+    const key = deriveKey(secret, label);
+    return {
+        async seal(value, ttlSeconds) {
+            return new EncryptJWT(value)
+                .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
+                .setIssuedAt()
+                .setExpirationTime(Math.floor(Date.now() / 1000) + ttlSeconds)
+                .encrypt(key);
+        },
+        async open(token) {
+            if (!token)
+                return null;
+            try {
+                const { payload } = await jwtDecrypt(token, key, { clockTolerance: 5 });
+                return payload;
+            }
+            catch {
+                // Expired, tampered with, or sealed by an older secret. All of these mean
+                // the same thing to the caller: there is no usable state here.
+                return null;
+            }
+        }
+    };
+}
+export function createSessionCodec(secret) {
+    return createCodec(secret, SESSION_LABEL);
+}
+export function createLoginCodec(secret) {
+    return createCodec(secret, LOGIN_LABEL);
+}
+/** Constant-time string comparison for CSRF-style tokens of equal expected length. */
+export function safeEqual(a, b) {
+    const left = Buffer.from(String(a), 'utf8');
+    const right = Buffer.from(String(b), 'utf8');
+    if (left.length !== right.length)
+        return false;
+    return timingSafeEqual(left, right);
+}
+/**
+ * Minimal cookie serialisation, so consumers are not forced to install a cookie
+ * plugin just to use this package.
+ */
+export function serializeCookie(name, value, options = {}) {
+    const parts = [name + '=' + encodeURIComponent(value)];
+    parts.push('Path=' + (options.path ?? '/'));
+    if (options.domain)
+        parts.push('Domain=' + options.domain);
+    if (typeof options.maxAgeSeconds === 'number') {
+        parts.push('Max-Age=' + Math.max(0, Math.floor(options.maxAgeSeconds)));
+        // Expires alongside Max-Age for the benefit of clients that ignore the latter.
+        const expires = new Date(Date.now() + Math.max(0, options.maxAgeSeconds) * 1000);
+        parts.push('Expires=' + expires.toUTCString());
+    }
+    if (options.httpOnly !== false)
+        parts.push('HttpOnly');
+    if (options.secure)
+        parts.push('Secure');
+    parts.push('SameSite=' + (options.sameSite ?? 'Lax'));
+    return parts.join('; ');
+}
+/** Cookie header that deletes `name`. */
+export function clearCookie(name, options = {}) {
+    return serializeCookie(name, '', { ...options, maxAgeSeconds: 0 });
+}
+export function parseCookies(header) {
+    const result = {};
+    if (!header)
+        return result;
+    for (const part of header.split(';')) {
+        const index = part.indexOf('=');
+        if (index < 1)
+            continue;
+        const name = part.slice(0, index).trim();
+        if (!name || name in result)
+            continue;
+        const raw = part.slice(index + 1).trim();
+        try {
+            result[name] = decodeURIComponent(raw);
+        }
+        catch {
+            result[name] = raw;
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=session.js.map

package/dist/oidc/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/oidc/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAI9C;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,SAAS,GAAG,oBAAoB,CAAC;AACvC,MAAM,aAAa,GAAG,SAAS,CAAC;AAChC,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAoBxC,oDAAoD;AACpD,MAAM,UAAU,eAAe;IAC7B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAQD,SAAS,SAAS,CAAC,MAAc,EAAE,KAAa;IAC9C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACpE,MAAM,IAAI,SAAS,CACjB,6DAA6D,GAAG,iBAAiB,GAAG,cAAc,CACnG,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,WAAW,CAAoC,MAAc,EAAE,KAAa;IACnF,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAErC,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,KAAQ,EAAE,UAAkB;YACrC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC;iBACzB,kBAAkB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;iBAClD,WAAW,EAAE;iBACb,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,UAAU,CAAC;iBAC7D,OAAO,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,KAAgC;YACzC,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,CAAC;gBACxE,OAAO,OAAuB,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,0EAA0E;gBAC1E,+DAA+D;gBAC/D,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,OAAO,WAAW,CAAiB,MAAM,EAAE,aAAa,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,OAAO,WAAW,CAA0B,MAAM,EAAE,WAAW,CAAC,CAAC;AACnE,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,SAAS,CAAC,CAAS,EAAE,CAAS;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AAaD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa,EAAE,OAAO,GAAkB,EAAE;IACtF,MAAM,KAAK,GAAG,CAAC,IAAI,GAAG,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;IACvD,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,IAAI,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QACxE,+EAA+E;QAC/E,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,CAAC;QACjF,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,OAAO,GAAkB,EAAE;IACnE,OAAO,eAAe,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAiC;IAC5D,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC;YAAE,SAAS;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,MAAM;YAAE,SAAS;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/oidc/types.d.ts

@@ -0,0 +1,130 @@
+import type { RelyperIdentity } from '../types.js';
+/** Subset of the OIDC discovery document this client relies on. */
+export type OidcDiscoveryDocument = {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    jwks_uri: string;
+    userinfo_endpoint?: string;
+    end_session_endpoint?: string;
+    code_challenge_methods_supported?: string[];
+    token_endpoint_auth_methods_supported?: string[];
+    scopes_supported?: string[];
+};
+export type TokenEndpointAuthMethod = 'client_secret_basic' | 'client_secret_post';
+export type RelyperOidcOptions = {
+    /**
+     * Base URL of the Relyper IdP, exactly as it appears in the `iss` claim.
+     * Discovery is read from `<issuer>/.well-known/openid-configuration`.
+     */
+    issuer: string;
+    /** Client ID registered at the IdP for this service provider. */
+    clientId: string;
+    /** Client secret generated at the IdP. Never ships to the browser. */
+    clientSecret: string;
+    /** Must match one of the redirect URIs registered for this client, byte for byte. */
+    redirectUri: string;
+    /** Default: `openid email profile roles tenant teams`. */
+    scope?: string;
+    /**
+     * How this client authenticates at the token endpoint. Default: whichever of
+     * the two the discovery document advertises, preferring `client_secret_basic`.
+     */
+    tokenEndpointAuthMethod?: TokenEndpointAuthMethod;
+    /** Role(s) required for this service provider. Empty means: no role check. */
+    requiredRole?: string | string[];
+    /** With several required roles: one suffices ('any', default) or all are needed ('all'). */
+    roleMatch?: 'any' | 'all';
+    /** Default: true. Set to false if the IdP does not supply an e-mail address. */
+    requireEmail?: boolean;
+    /**
+     * Also call the UserInfo endpoint after the token exchange. Default: false,
+     * because the Relyper IdP already puts every claim into the ID token. Turn it
+     * on if you need claims the ID token does not carry.
+     */
+    useUserInfo?: boolean;
+    /** Leeway for `exp`/`iat`/`nbf` in seconds. Default: 60. */
+    clockToleranceSeconds?: number;
+    /** How long a discovery document is reused, in milliseconds. Default: 3600000 (1h). */
+    discoveryTtlMs?: number;
+    /** Timeout for every call to the IdP, in milliseconds. Default: 10000. */
+    requestTimeoutMs?: number;
+    /** Custom fetch implementation, e.g. for tests or a proxy-aware agent. */
+    fetch?: typeof globalThis.fetch;
+    /** Maps IdP claims onto the identity. Default: {@link defaultClaimsToIdentity}. */
+    mapClaims?: (claims: Record<string, unknown>) => RelyperIdentity;
+};
+export type ResolvedRelyperOidcOptions = {
+    issuer: string;
+    clientId: string;
+    clientSecret: string;
+    redirectUri: string;
+    scope: string;
+    tokenEndpointAuthMethod: TokenEndpointAuthMethod | null;
+    requiredRoles: string[];
+    roleMatch: 'any' | 'all';
+    requireEmail: boolean;
+    useUserInfo: boolean;
+    clockToleranceSeconds: number;
+    discoveryTtlMs: number;
+    requestTimeoutMs: number;
+};
+/** State this client must remember between the redirect out and the callback. */
+export type RelyperLoginTransaction = {
+    state: string;
+    nonce: string;
+    codeVerifier: string;
+    /** Application path to return to after the login. Always a local path. */
+    returnTo: string;
+};
+export type RelyperAuthorizationRequest = {
+    /** The IdP URL the browser has to be redirected to. */
+    url: string;
+    transaction: RelyperLoginTransaction;
+};
+export type RelyperTokenSet = {
+    accessToken: string;
+    idToken: string;
+    tokenType: string;
+    expiresIn: number | null;
+    refreshToken: string | null;
+    scope: string | null;
+};
+export type RelyperLoginResult = {
+    identity: RelyperIdentity;
+    claims: Record<string, unknown>;
+    tokens: RelyperTokenSet;
+};
+export type RelyperOidcErrorCode = 
+/** The IdP redirected back with an `error` parameter. */
+'idp_error'
+/** `state` missing, unknown, or not the one this browser started with. */
+ | 'invalid_state'
+/** No login transaction cookie -- expired, or a callback nobody started. */
+ | 'missing_transaction'
+/** The IdP refused the code exchange. */
+ | 'token_exchange_failed'
+/** The ID token failed signature, issuer, audience, nonce, or expiry checks. */
+ | 'invalid_id_token'
+/** UserInfo could not be read. */
+ | 'userinfo_failed'
+/** Discovery document or JWKS unreachable or malformed. */
+ | 'discovery_failed'
+/** Authenticated, but without the role this service provider requires. */
+ | 'missing_role'
+/** The IdP supplied no e-mail address although one is required. */
+ | 'missing_email';
+export declare class RelyperOidcError extends Error {
+    readonly code: RelyperOidcErrorCode;
+    /** HTTP status an adapter should answer with. */
+    readonly status: number;
+    readonly cause?: unknown;
+    /** Safe to log: never contains tokens or the client secret. */
+    readonly detail?: string;
+    constructor(code: RelyperOidcErrorCode, message: string, options?: {
+        status?: number;
+        cause?: unknown;
+        detail?: string;
+    });
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/oidc/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/oidc/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,mEAAmE;AACnE,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,gCAAgC,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5C,qCAAqC,CAAC,EAAE,MAAM,EAAE,CAAC;IACjD,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,qBAAqB,GAAG,oBAAoB,CAAC;AAEnF,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,YAAY,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,WAAW,EAAE,MAAM,CAAC;IAEpB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,uBAAuB,CAAC,EAAE,uBAAuB,CAAC;IAElD,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,4FAA4F;IAC5F,SAAS,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;IAC1B,gFAAgF;IAChF,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,4DAA4D;IAC5D,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,uFAAuF;IACvF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0EAA0E;IAC1E,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAChC,mFAAmF;IACnF,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,eAAe,CAAC;CAClE,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,uBAAuB,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACxD,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,EAAE,KAAK,GAAG,KAAK,CAAC;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,OAAO,CAAC;IACrB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,iFAAiF;AACjF,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,uBAAuB,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,MAAM,EAAE,eAAe,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,oBAAoB;AAC9B,yDAAyD;AACvD,WAAW;AACb,0EAA0E;GACxE,eAAe;AACjB,4EAA4E;GAC1E,qBAAqB;AACvB,yCAAyC;GACvC,uBAAuB;AACzB,gFAAgF;GAC9E,kBAAkB;AACpB,kCAAkC;GAChC,iBAAiB;AACnB,2DAA2D;GACzD,kBAAkB;AACpB,0EAA0E;GACxE,cAAc;AAChB,mEAAmE;GACjE,eAAe,CAAC;AAEpB,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,YACE,IAAI,EAAE,oBAAoB,EAC1B,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,EAQpE;CACF"}

package/dist/oidc/types.js

@@ -0,0 +1,17 @@
+export class RelyperOidcError extends Error {
+    code;
+    /** HTTP status an adapter should answer with. */
+    status;
+    cause;
+    /** Safe to log: never contains tokens or the client secret. */
+    detail;
+    constructor(code, message, options = {}) {
+        super(message);
+        this.name = 'RelyperOidcError';
+        this.code = code;
+        this.status = options.status ?? 502;
+        this.cause = options.cause;
+        this.detail = options.detail;
+    }
+}
+//# sourceMappingURL=types.js.map

package/dist/oidc/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/oidc/types.ts"],"names":[],"mappings":"AAkIA,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,IAAI,CAAuB;IACpC,iDAAiD;IACxC,MAAM,CAAS;IACf,KAAK,CAAW;IACzB,+DAA+D;IACtD,MAAM,CAAU;IAEzB,YACE,IAA0B,EAC1B,OAAe,EACf,OAAO,GAA0D,EAAE;QAEnE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;CACF"}

package/dist/oidc-fastify.d.ts

@@ -0,0 +1,123 @@
+import type { FastifyInstance, FastifyRequest } from 'fastify';
+import { type RelyperOidcClient } from './oidc/client.js';
+import { type SessionPayload } from './oidc/session.js';
+import { type RelyperLoginResult, type RelyperOidcOptions } from './oidc/types.js';
+import type { RelyperIdentity } from './types.js';
+/**
+ * Fastify adapter for the OIDC login against the Relyper IdP.
+ *
+ * Registers the three routes a browser-facing service provider needs -- start
+ * the login, receive the callback, end the session -- and guards the rest of the
+ * application with the resulting session cookie.
+ */
+declare module 'fastify' {
+    interface FastifyRequest {
+        /** Identity from the verified ID token. Set once a protected route has passed the guard. */
+        relyperIdentity: RelyperIdentity;
+        /** Raw session as it was sealed into the cookie. */
+        relyperSession: SessionPayload | null;
+    }
+    interface FastifyInstance {
+        relyperOidc: RelyperOidcClient;
+    }
+}
+export type RelyperOidcFastifyOptions = RelyperOidcOptions & {
+    /**
+     * Secret this application seals its cookies with, at least 32 characters.
+     * Unrelated to the client secret and never shared with the IdP. Rotating it
+     * invalidates every open session.
+     */
+    sessionSecret: string;
+    /** Default: 'relyper_session'. */
+    sessionCookieName?: string;
+    /** Default: 'relyper_login'. */
+    loginCookieName?: string;
+    cookieDomain?: string;
+    cookiePath?: string;
+    /**
+     * `Secure` flag. Default: on, unless NODE_ENV is 'development' or 'test'.
+     * Leaving this on over plain HTTP means the browser silently drops the cookie.
+     */
+    cookieSecure?: boolean;
+    /** Lifetime of a session in seconds. Default: 28800 (8 hours). */
+    sessionTtlSeconds?: number;
+    /** Lifetime of the login handshake in seconds. Default: 600 (10 minutes). */
+    loginTtlSeconds?: number;
+    /**
+     * Re-issue the session cookie on activity so an active user is not logged out
+     * mid-session. Default: true. The IdP login time is preserved either way.
+     */
+    rollingSession?: boolean;
+    /** Absolute lifetime in seconds a session can reach through rolling renewal. Default: 86400 (24h). */
+    sessionAbsoluteTtlSeconds?: number;
+    /** Keep the ID token in the session so RP-initiated logout can pass it. Default: false. */
+    keepIdToken?: boolean;
+    /** Default: '/auth/login'. */
+    loginPath?: string;
+    /** Default: '/auth/callback'. Must match the redirect URI registered at the IdP. */
+    callbackPath?: string;
+    /** Default: '/auth/logout'. Registered for both GET and POST. */
+    logoutPath?: string;
+    /** Local path to land on after logout. Default: '/'. */
+    postLogoutRedirect?: string;
+    /** Local path the callback redirects to when the login fails. Default: none, a JSON error is sent. */
+    loginErrorRedirect?: string;
+    /**
+     * Decides which requests the session guard covers. Default: everything except
+     * the login, callback and logout routes.
+     */
+    protect?: (request: FastifyRequest) => boolean;
+    /** Hook the guard runs in. Default: 'onRequest'. */
+    hook?: 'onRequest' | 'preHandler';
+    /**
+     * Translates the IdP identity into the application's own user object, usually
+     * an upsert into its database. Runs on every guarded request.
+     */
+    resolveUser?: (identity: RelyperIdentity, request: FastifyRequest) => unknown | Promise<unknown>;
+    /** Request property holding the result of `resolveUser`. Default: 'principal'. */
+    principalKey?: string;
+    /** Path for a /me route. Default: false. */
+    meRoute?: string | false;
+    /** Response of the /me route. Default: `{ user: request[principalKey] }`. */
+    meResponse?: (request: FastifyRequest) => unknown;
+    /**
+     * Whether an unauthenticated request is answered with a redirect to the login
+     * instead of a 401. Default: redirect for top-level HTML navigation, 401 for
+     * everything else, which is what a single-page app wants.
+     */
+    redirectUnauthenticated?: boolean | ((request: FastifyRequest) => boolean);
+    /** Body of a 401/403. Default: `{ error, code, loginUrl }`. */
+    errorBody?: (failure: RelyperAuthFailureInfo, request: FastifyRequest) => unknown;
+    /** Audit hook for rejected requests and failed logins. */
+    onAuthFailure?: (failure: RelyperAuthFailureInfo, request: FastifyRequest) => void | Promise<void>;
+    /**
+     * Called after a successful login, before the redirect. Receives the session id
+     * that identifies this login, so an application keeping a revocation list can
+     * record it here.
+     */
+    onLogin?: (result: RelyperLoginResult, request: FastifyRequest, sessionId: string) => void | Promise<void>;
+    /**
+     * Called when a session ends, with the id from {@link RelyperOidcFastifyOptions.onLogin}.
+     * Implement this together with `isSessionRevoked` to make logout binding: the
+     * session cookie itself is stateless, so clearing it only affects the browser
+     * that asked. Recording the id here and rejecting it afterwards also stops a
+     * cookie that was copied before the logout.
+     */
+    onLogout?: (sessionId: string, session: SessionPayload, request: FastifyRequest) => void | Promise<void>;
+    /**
+     * Consulted on every guarded request. Return true to refuse a session whose id
+     * has been revoked. Default: no revocation list, sessions live until they expire.
+     */
+    isSessionRevoked?: (sessionId: string, request: FastifyRequest) => boolean | Promise<boolean>;
+};
+export type RelyperAuthFailureInfo = {
+    status: number;
+    code: string;
+    message: string;
+    /** Safe to log; never contains tokens or secrets. */
+    detail?: string;
+};
+declare function plugin(app: FastifyInstance, options: RelyperOidcFastifyOptions): Promise<void>;
+export declare const relyperOidcAuth: typeof plugin;
+export default relyperOidcAuth;
+//# sourceMappingURL=oidc-fastify.d.ts.map

package/dist/oidc-fastify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-fastify.d.ts","sourceRoot":"","sources":["../src/oidc-fastify.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgB,cAAc,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAyC,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAQL,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAoB,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;;;GAMG;AAEH,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,cAAc;QACtB,4FAA4F;QAC5F,eAAe,EAAE,eAAe,CAAC;QACjC,oDAAoD;QACpD,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;KACvC;IACD,UAAU,eAAe;QACvB,WAAW,EAAE,iBAAiB,CAAC;KAChC;CACF;AAED,MAAM,MAAM,yBAAyB,GAAG,kBAAkB,GAAG;IAC3D;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;IAEtB,kCAAkC;IAClC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gCAAgC;IAChC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,sGAAsG;IACtG,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,2FAA2F;IAC3F,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sGAAsG;IACtG,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC;IAC/C,oDAAoD;IACpD,IAAI,CAAC,EAAE,WAAW,GAAG,YAAY,CAAC;IAClC;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjG,kFAAkF;IAClF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACzB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC;IAElD;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,CAAC;IAC3E,+DAA+D;IAC/D,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC;IAClF,0DAA0D;IAC1D,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnG;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3G;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzG;;;OAGG;IACH,gBAAgB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC/F,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAeF,iBAAe,MAAM,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoS7F;AAED,eAAO,MAAM,eAAe,eAG1B,CAAC;eAEY,eAAe"}