@relyper/sp-auth 0.1.0 → 0.4.0

package/dist/oidc-fastify.js

@@ -0,0 +1,264 @@
+import fp from 'fastify-plugin';
+import { createRelyperOidcClient, safeReturnTo } from './oidc/client.js';
+import { clearCookie, createLoginCodec, createSessionCodec, createSessionId, parseCookies, serializeCookie } from './oidc/session.js';
+import { RelyperOidcError } from './oidc/types.js';
+const DEFAULTS = {
+    sessionCookieName: 'relyper_session',
+    loginCookieName: 'relyper_login',
+    cookiePath: '/',
+    sessionTtlSeconds: 8 * 60 * 60,
+    sessionAbsoluteTtlSeconds: 24 * 60 * 60,
+    loginTtlSeconds: 10 * 60,
+    loginPath: '/auth/login',
+    callbackPath: '/auth/callback',
+    logoutPath: '/auth/logout',
+    postLogoutRedirect: '/'
+};
+async function plugin(app, options) {
+    const client = createRelyperOidcClient(options);
+    const sessions = createSessionCodec(options.sessionSecret);
+    const logins = createLoginCodec(options.sessionSecret);
+    const sessionCookieName = options.sessionCookieName ?? DEFAULTS.sessionCookieName;
+    const loginCookieName = options.loginCookieName ?? DEFAULTS.loginCookieName;
+    const sessionTtl = options.sessionTtlSeconds ?? DEFAULTS.sessionTtlSeconds;
+    const absoluteTtl = options.sessionAbsoluteTtlSeconds ?? DEFAULTS.sessionAbsoluteTtlSeconds;
+    const loginTtl = options.loginTtlSeconds ?? DEFAULTS.loginTtlSeconds;
+    const rolling = options.rollingSession ?? true;
+    const keepIdToken = options.keepIdToken ?? false;
+    const principalKey = options.principalKey ?? 'principal';
+    const hook = options.hook ?? 'onRequest';
+    const loginPath = options.loginPath ?? DEFAULTS.loginPath;
+    const callbackPath = options.callbackPath ?? DEFAULTS.callbackPath;
+    const logoutPath = options.logoutPath ?? DEFAULTS.logoutPath;
+    const postLogoutRedirect = safeReturnTo(options.postLogoutRedirect ?? DEFAULTS.postLogoutRedirect);
+    const authRoutes = new Set([loginPath, callbackPath, logoutPath]);
+    const nodeEnv = process.env.NODE_ENV ?? 'development';
+    const cookieBase = {
+        path: options.cookiePath ?? DEFAULTS.cookiePath,
+        domain: options.cookieDomain,
+        httpOnly: true,
+        // Lax, not Strict: the callback arrives as a top-level navigation from the
+        // IdP, and Strict would withhold the login cookie exactly then.
+        sameSite: 'Lax',
+        secure: options.cookieSecure ?? (nodeEnv !== 'development' && nodeEnv !== 'test')
+    };
+    const errorBody = options.errorBody
+        ?? ((failure) => ({
+            error: failure.message,
+            code: failure.code,
+            loginUrl: loginPath
+        }));
+    if (!app.hasRequestDecorator('relyperIdentity')) {
+        app.decorateRequest('relyperIdentity', null);
+    }
+    if (!app.hasRequestDecorator('relyperSession')) {
+        app.decorateRequest('relyperSession', null);
+    }
+    if (!app.hasRequestDecorator(principalKey)) {
+        app.decorateRequest(principalKey, null);
+    }
+    if (!app.hasDecorator('relyperOidc')) {
+        app.decorate('relyperOidc', client);
+    }
+    function pathOf(request) {
+        const url = request.url ?? '/';
+        const index = url.indexOf('?');
+        return index === -1 ? url : url.slice(0, index);
+    }
+    const protect = options.protect ?? ((request) => !authRoutes.has(pathOf(request)));
+    function wantsRedirect(request) {
+        if (typeof options.redirectUnauthenticated === 'function')
+            return options.redirectUnauthenticated(request);
+        if (typeof options.redirectUnauthenticated === 'boolean')
+            return options.redirectUnauthenticated;
+        // A browser navigating to a page accepts HTML and is best served a redirect;
+        // an XHR from a single-page app wants a status code it can act on.
+        if (request.method !== 'GET')
+            return false;
+        const accept = String(request.headers.accept ?? '');
+        const fetchMode = String(request.headers['sec-fetch-mode'] ?? '');
+        if (fetchMode && fetchMode !== 'navigate')
+            return false;
+        return accept.includes('text/html');
+    }
+    async function reject(request, reply, failure) {
+        if (options.onAuthFailure)
+            await options.onAuthFailure(failure, request);
+        if (failure.status === 401 && wantsRedirect(request)) {
+            const target = loginPath + '?returnTo=' + encodeURIComponent(pathOf(request));
+            return reply.redirect(target, 302);
+        }
+        return reply.code(failure.status).send(errorBody(failure, request));
+    }
+    function setSessionCookie(reply, payload, ttl) {
+        return sessions.seal(payload, ttl).then((token) => {
+            reply.header('set-cookie', serializeCookie(sessionCookieName, token, { ...cookieBase, maxAgeSeconds: ttl }));
+        });
+    }
+    // ------------------------------------------------------------- login ---
+    app.get(loginPath, async (request, reply) => {
+        const query = (request.query ?? {});
+        const { url, transaction } = await client.createAuthorizationRequest({
+            returnTo: query.returnTo,
+            prompt: query.prompt
+        });
+        const sealed = await logins.seal(transaction, loginTtl);
+        reply.header('set-cookie', serializeCookie(loginCookieName, sealed, { ...cookieBase, maxAgeSeconds: loginTtl }));
+        // The IdP decides what to show here; caching that decision would be wrong.
+        reply.header('cache-control', 'no-store');
+        return reply.redirect(url, 302);
+    });
+    // ---------------------------------------------------------- callback ---
+    app.get(callbackPath, async (request, reply) => {
+        reply.header('cache-control', 'no-store');
+        const cookies = parseCookies(request.headers.cookie);
+        const transaction = await logins.open(cookies[loginCookieName]);
+        // The handshake cookie is single-use, whatever the outcome.
+        const cleared = clearCookie(loginCookieName, cookieBase);
+        if (!transaction) {
+            reply.header('set-cookie', cleared);
+            return failLogin(request, reply, new RelyperOidcError('missing_transaction', 'The login has expired. Please sign in again.', { status: 400 }));
+        }
+        let result;
+        try {
+            result = await client.completeLogin({
+                query: (request.query ?? {}),
+                transaction
+            });
+        }
+        catch (error) {
+            reply.header('set-cookie', cleared);
+            return failLogin(request, reply, error);
+        }
+        const now = Math.floor(Date.now() / 1000);
+        const sessionId = createSessionId();
+        const payload = {
+            identity: result.identity,
+            authenticatedAt: now,
+            sessionId,
+            ...(keepIdToken ? { idToken: result.tokens.idToken } : {})
+        };
+        if (options.onLogin)
+            await options.onLogin(result, request, sessionId);
+        const sealed = await sessions.seal(payload, sessionTtl);
+        reply.header('set-cookie', [
+            cleared,
+            serializeCookie(sessionCookieName, sealed, { ...cookieBase, maxAgeSeconds: sessionTtl })
+        ]);
+        return reply.redirect(transaction.returnTo, 302);
+    });
+    async function failLogin(request, reply, error) {
+        const oidcError = error instanceof RelyperOidcError
+            ? error
+            : new RelyperOidcError('idp_error', 'The login could not be completed.', {
+                cause: error,
+                detail: error instanceof Error ? error.message : undefined
+            });
+        const failure = {
+            status: oidcError.status,
+            code: oidcError.code,
+            message: oidcError.message,
+            detail: oidcError.detail
+        };
+        // Logged at warn with the detail, because a login that keeps failing is an
+        // operational problem someone has to be able to diagnose.
+        request.log.warn({ relyperOidc: failure.code, detail: failure.detail }, '@relyper/sp-auth: OIDC login failed');
+        if (options.onAuthFailure)
+            await options.onAuthFailure(failure, request);
+        if (options.loginErrorRedirect) {
+            const target = safeReturnTo(options.loginErrorRedirect)
+                + (options.loginErrorRedirect.includes('?') ? '&' : '?')
+                + 'error=' + encodeURIComponent(failure.code);
+            return reply.redirect(target, 302);
+        }
+        return reply.code(failure.status).send(errorBody(failure, request));
+    }
+    // ------------------------------------------------------------ logout ---
+    async function handleLogout(request, reply) {
+        const cookies = parseCookies(request.headers.cookie);
+        const session = await sessions.open(cookies[sessionCookieName]);
+        reply.header('cache-control', 'no-store');
+        reply.header('set-cookie', [
+            clearCookie(sessionCookieName, cookieBase),
+            clearCookie(loginCookieName, cookieBase)
+        ]);
+        // Clearing the cookie only affects the browser that asked. An application
+        // that also wants a copied cookie to stop working records the id here.
+        if (session?.sessionId && options.onLogout) {
+            await options.onLogout(session.sessionId, session, request);
+        }
+        // If the IdP supports RP-initiated logout, end its session too -- otherwise
+        // the next login would silently sign the same user straight back in.
+        const endSession = await client.endSessionUrl({
+            idTokenHint: session?.idToken,
+            postLogoutRedirectUri: undefined
+        });
+        return reply.redirect(endSession ?? postLogoutRedirect, 302);
+    }
+    app.get(logoutPath, handleLogout);
+    app.post(logoutPath, handleLogout);
+    // ------------------------------------------------------------- guard ---
+    app.addHook(hook, async (request, reply) => {
+        if (!protect(request))
+            return;
+        const cookies = parseCookies(request.headers.cookie);
+        const session = await sessions.open(cookies[sessionCookieName]);
+        if (!session?.identity?.subject) {
+            return reject(request, reply, {
+                status: 401,
+                code: 'unauthenticated',
+                message: 'Authentication required.'
+            });
+        }
+        // An absolute cap on top of the rolling window, so a session cannot be kept
+        // alive indefinitely by activity alone.
+        const age = Math.floor(Date.now() / 1000) - (session.authenticatedAt ?? 0);
+        if (age > absoluteTtl) {
+            reply.header('set-cookie', clearCookie(sessionCookieName, cookieBase));
+            return reject(request, reply, {
+                status: 401,
+                code: 'session_expired',
+                message: 'Your session has expired. Please sign in again.'
+            });
+        }
+        if (options.isSessionRevoked && session.sessionId
+            && await options.isSessionRevoked(session.sessionId, request)) {
+            reply.header('set-cookie', clearCookie(sessionCookieName, cookieBase));
+            return reject(request, reply, {
+                status: 401,
+                code: 'session_revoked',
+                message: 'Your session has ended. Please sign in again.'
+            });
+        }
+        // Re-checked on every request, not just at login: if the required role is
+        // tightened in configuration, sessions issued before that must not survive.
+        const requiredRoles = client.options.requiredRoles;
+        if (requiredRoles.length && !client.hasRole(session.identity, requiredRoles, client.options.roleMatch)) {
+            return reject(request, reply, {
+                status: 403,
+                code: 'missing_role',
+                message: 'Your account does not have access to this application.',
+                detail: 'presented roles: ' + (session.identity.roles.join(', ') || '(none)')
+            });
+        }
+        request.relyperSession = session;
+        request.relyperIdentity = session.identity;
+        const principal = options.resolveUser
+            ? await options.resolveUser(session.identity, request)
+            : session.identity;
+        request[principalKey] = principal;
+        if (rolling)
+            await setSessionCookie(reply, session, sessionTtl);
+    });
+    if (options.meRoute) {
+        const meResponse = options.meResponse
+            ?? ((request) => ({ user: request[principalKey] }));
+        app.get(options.meRoute, async (request) => meResponse(request));
+    }
+}
+export const relyperOidcAuth = fp(plugin, {
+    name: '@relyper/sp-auth/oidc-fastify',
+    fastify: '5.x'
+});
+export default relyperOidcAuth;
+//# sourceMappingURL=oidc-fastify.js.map

package/dist/oidc-fastify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-fastify.js","sourceRoot":"","sources":["../src/oidc-fastify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEhC,OAAO,EAAE,uBAAuB,EAAE,YAAY,EAA0B,MAAM,kBAAkB,CAAC;AACjG,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,eAAe,EAGhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gBAAgB,EAAoD,MAAM,iBAAiB,CAAC;AA6HrG,MAAM,QAAQ,GAAG;IACf,iBAAiB,EAAE,iBAAiB;IACpC,eAAe,EAAE,eAAe;IAChC,UAAU,EAAE,GAAG;IACf,iBAAiB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE;IAC9B,yBAAyB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;IACvC,eAAe,EAAE,EAAE,GAAG,EAAE;IACxB,SAAS,EAAE,aAAa;IACxB,YAAY,EAAE,gBAAgB;IAC9B,UAAU,EAAE,cAAc;IAC1B,kBAAkB,EAAE,GAAG;CACxB,CAAC;AAEF,KAAK,UAAU,MAAM,CAAC,GAAoB,EAAE,OAAkC;IAC5E,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAEvD,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,QAAQ,CAAC,iBAAiB,CAAC;IAClF,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe,CAAC;IAC5E,MAAM,UAAU,GAAG,OAAO,CAAC,iBAAiB,IAAI,QAAQ,CAAC,iBAAiB,CAAC;IAC3E,MAAM,WAAW,GAAG,OAAO,CAAC,yBAAyB,IAAI,QAAQ,CAAC,yBAAyB,CAAC;IAC5F,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe,CAAC;IACrE,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC;IAC/C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC;IACjD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,WAAW,CAAC;IACzD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IAEzC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAC;IAC1D,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,QAAQ,CAAC,YAAY,CAAC;IACnE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC;IAC7D,MAAM,kBAAkB,GAAG,YAAY,CAAC,OAAO,CAAC,kBAAkB,IAAI,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACnG,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;IAElE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa,CAAC;IACtD,MAAM,UAAU,GAAkB;QAChC,IAAI,EAAE,OAAO,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU;QAC/C,MAAM,EAAE,OAAO,CAAC,YAAY;QAC5B,QAAQ,EAAE,IAAI;QACd,2EAA2E;QAC3E,gEAAgE;QAChE,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,KAAK,aAAa,IAAI,OAAO,KAAK,MAAM,CAAC;KAClF,CAAC;IAEF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS;WAC9B,CAAC,CAAC,OAA+B,EAAE,EAAE,CAAC,CAAC;YACxC,KAAK,EAAE,OAAO,CAAC,OAAO;YACtB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAC,CAAC;IAEN,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,eAAe,CAAC,iBAAiB,EAAE,IAAkC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,eAAe,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,SAAS,MAAM,CAAC,OAAuB;QACrC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC;QAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,OAAuB,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEnG,SAAS,aAAa,CAAC,OAAuB;QAC5C,IAAI,OAAO,OAAO,CAAC,uBAAuB,KAAK,UAAU;YAAE,OAAO,OAAO,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC3G,IAAI,OAAO,OAAO,CAAC,uBAAuB,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,uBAAuB,CAAC;QACjG,6EAA6E;QAC7E,mEAAmE;QACnE,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;QAClE,IAAI,SAAS,IAAI,SAAS,KAAK,UAAU;YAAE,OAAO,KAAK,CAAC;QACxD,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,UAAU,MAAM,CACnB,OAAuB,EACvB,KAAmB,EACnB,OAA+B;QAE/B,IAAI,OAAO,CAAC,aAAa;YAAE,MAAM,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,MAAM,MAAM,GAAG,SAAS,GAAG,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9E,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,SAAS,gBAAgB,CAAC,KAAmB,EAAE,OAAuB,EAAE,GAAW;QACjF,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YAChD,KAAK,CAAC,MAAM,CACV,YAAY,EACZ,eAAe,CAAC,iBAAiB,EAAE,KAAK,EAAE,EAAE,GAAG,UAAU,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CACjF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAE1E,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACxE,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAuC,CAAC;QAC1E,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC;YACnE,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACxD,KAAK,CAAC,MAAM,CACV,YAAY,EACZ,eAAe,CAAC,eAAe,EAAE,MAAM,EAAE,EAAE,GAAG,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CACrF,CAAC;QACF,2EAA2E;QAC3E,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC1C,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAE1E,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC3E,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAE1C,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;QAChE,4DAA4D;QAC5D,MAAM,OAAO,GAAG,WAAW,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAEzD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACpC,OAAO,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,gBAAgB,CACnD,qBAAqB,EACrB,8CAA8C,EAC9C,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC;gBAClC,KAAK,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAkD;gBAC7E,WAAW;aACZ,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACpC,OAAO,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;QACpC,MAAM,OAAO,GAAmB;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,eAAe,EAAE,GAAG;YACpB,SAAS;YACT,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC;QAEF,IAAI,OAAO,CAAC,OAAO;YAAE,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAEvE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACxD,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE;YACzB,OAAO;YACP,eAAe,CAAC,iBAAiB,EAAE,MAAM,EAAE,EAAE,GAAG,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;SACzF,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,SAAS,CAAC,OAAuB,EAAE,KAAmB,EAAE,KAAc;QACnF,MAAM,SAAS,GAAG,KAAK,YAAY,gBAAgB;YACjD,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,IAAI,gBAAgB,CAAC,WAAW,EAAE,mCAAmC,EAAE;gBACrE,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;aAC3D,CAAC,CAAC;QAEP,MAAM,OAAO,GAA2B;YACtC,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,MAAM,EAAE,SAAS,CAAC,MAAM;SACzB,CAAC;QAEF,2EAA2E;QAC3E,0DAA0D;QAC1D,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EACrD,qCAAqC,CACtC,CAAC;QACF,IAAI,OAAO,CAAC,aAAa;YAAE,MAAM,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEzE,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,kBAAkB,CAAC;kBACnD,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;kBACtD,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChD,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACrC,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,0EAA0E;IAE1E,KAAK,UAAU,YAAY,CAAC,OAAuB,EAAE,KAAmB;QACtE,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAEhE,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC1C,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE;YACzB,WAAW,CAAC,iBAAiB,EAAE,UAAU,CAAC;YAC1C,WAAW,CAAC,eAAe,EAAE,UAAU,CAAC;SACzC,CAAC,CAAC;QAEH,0EAA0E;QAC1E,uEAAuE;QACvE,IAAI,OAAO,EAAE,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC3C,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9D,CAAC;QAED,4EAA4E;QAC5E,qEAAqE;QACrE,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC;YAC5C,WAAW,EAAE,OAAO,EAAE,OAAO;YAC7B,qBAAqB,EAAE,SAAS;SACjC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,QAAQ,CAAC,UAAU,IAAI,kBAAkB,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAClC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAEnC,0EAA0E;IAE1E,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACvE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO;QAE9B,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAEhE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE;gBAC5B,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,0BAA0B;aACpC,CAAC,CAAC;QACL,CAAC;QAED,4EAA4E;QAC5E,wCAAwC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC;QAC3E,IAAI,GAAG,GAAG,WAAW,EAAE,CAAC;YACtB,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC;YACvE,OAAO,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE;gBAC5B,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,iDAAiD;aAC3D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,SAAS;eAC5C,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;YAChE,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC;YACvE,OAAO,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE;gBAC5B,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,+CAA+C;aACzD,CAAC,CAAC;QACL,CAAC;QAED,0EAA0E;QAC1E,4EAA4E;QAC5E,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC;QACnD,IAAI,aAAa,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACvG,OAAO,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE;gBAC5B,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,wDAAwD;gBACjE,MAAM,EAAE,mBAAmB,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;aAC9E,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,cAAc,GAAG,OAAO,CAAC;QACjC,OAAO,CAAC,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC;QAE3C,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW;YACnC,CAAC,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC;YACtD,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACpB,OAA8C,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC;QAE1E,IAAI,OAAO;YAAE,MAAM,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU;eAChC,CAAC,CAAC,OAAuB,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAG,OAA8C,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9G,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,OAAuB,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC,MAAM,EAAE;IACxC,IAAI,EAAE,+BAA+B;IACrC,OAAO,EAAE,KAAK;CACf,CAAC,CAAC;AAEH,eAAe,eAAe,CAAC"}

package/dist/oidc.d.ts

@@ -0,0 +1,15 @@
+/**
+ * OIDC entry point: the Relyper IdP as a real identity provider.
+ *
+ * The service provider is registered at the IdP as a confidential client and
+ * authenticates with its client secret, so no part of the trust chain depends on
+ * headers a proxy may or may not have set.
+ */
+export { createRelyperOidcClient, safeReturnTo, type AuthorizationRequestOptions, type RelyperOidcClient } from './oidc/client.js';
+export { defaultClaimsToIdentity } from './oidc/claims.js';
+export { createCodeVerifier, createNonce, createState, codeChallengeFor } from './oidc/pkce.js';
+export { createDiscoveryLoader, discoveryUrl, type DiscoveryLoader, type DiscoveryLoaderOptions } from './oidc/discovery.js';
+export { clearCookie, createLoginCodec, createSessionCodec, createSessionId, parseCookies, safeEqual, serializeCookie, type CookieOptions, type SealedCodec, type SessionPayload } from './oidc/session.js';
+export { RelyperOidcError, type OidcDiscoveryDocument, type RelyperAuthorizationRequest, type RelyperLoginResult, type RelyperLoginTransaction, type RelyperOidcErrorCode, type RelyperOidcOptions, type RelyperTokenSet, type ResolvedRelyperOidcOptions, type TokenEndpointAuthMethod } from './oidc/types.js';
+export type { RelyperIdentity } from './types.js';
+//# sourceMappingURL=oidc.d.ts.map

package/dist/oidc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,KAAK,2BAA2B,EAChC,KAAK,iBAAiB,EACvB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,WAAW,EACX,gBAAgB,EACjB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,qBAAqB,EACrB,YAAY,EACZ,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC5B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,SAAS,EACT,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,gBAAgB,EAChB,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,0BAA0B,EAC/B,KAAK,uBAAuB,EAC7B,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC"}

package/dist/oidc.js

@@ -0,0 +1,14 @@
+/**
+ * OIDC entry point: the Relyper IdP as a real identity provider.
+ *
+ * The service provider is registered at the IdP as a confidential client and
+ * authenticates with its client secret, so no part of the trust chain depends on
+ * headers a proxy may or may not have set.
+ */
+export { createRelyperOidcClient, safeReturnTo } from './oidc/client.js';
+export { defaultClaimsToIdentity } from './oidc/claims.js';
+export { createCodeVerifier, createNonce, createState, codeChallengeFor } from './oidc/pkce.js';
+export { createDiscoveryLoader, discoveryUrl } from './oidc/discovery.js';
+export { clearCookie, createLoginCodec, createSessionCodec, createSessionId, parseCookies, safeEqual, serializeCookie } from './oidc/session.js';
+export { RelyperOidcError } from './oidc/types.js';
+//# sourceMappingURL=oidc.js.map

package/dist/oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,uBAAuB,EACvB,YAAY,EAGb,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,WAAW,EACX,gBAAgB,EACjB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,qBAAqB,EACrB,YAAY,EAGb,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,SAAS,EACT,eAAe,EAIhB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,gBAAgB,EAUjB,MAAM,iBAAiB,CAAC"}

package/dist/types.d.ts

@@ -1,10 +1,22 @@
-/** Identity that the Relyper IdP passes to a service provider via the gateway. */
+/**
+ * Identity of a user as this service provider sees it.
+ *
+ * Produced either by the OIDC login (verified ID token) or, in a gateway
+ * deployment, by the trusted request headers. The tenant fields are only filled
+ * in by the OIDC path, because a gateway header set does not carry them.
+ */
 export type RelyperIdentity = {
     /** Stable, unique identifier of the user at the IdP. Never the local database ID. */
     subject: string;
     email: string;
     displayName: string;
     roles: string[];
+    /** Tenant the user is acting in, or null if the IdP sent none. */
+    tenantId?: string | null;
+    /** Every tenant the user belongs to; the first one is {@link tenantId}. */
+    tenantIds?: string[];
+    tenantName?: string | null;
+    teams?: string[];
 };
 export type RelyperAuthFailureCode = 'missing_subject' | 'missing_email' | 'missing_role';
 export type RelyperAuthFailure = {

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,MAAM,MAAM,eAAe,GAAG;IAC5B,qFAAqF;IACrF,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,GAAG,eAAe,GAAG,cAAc,CAAC;AAE1F,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,KAAK,CAAC;IACV,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,sBAAsB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,eAAe,CAAC;IAC1B,uEAAuE;IACvE,UAAU,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AAExE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC3B,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAC7C;IAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;CAAE,CAAC;AAErD,MAAM,MAAM,qBAAqB,GAAG;IAClC,qDAAqD;IACrD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,8FAA8F;IAC9F,SAAS,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;IAC1B,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,gEAAgE;IAChE,WAAW,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC1C;;;OAGG;IACH,sBAAsB,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/D;;;OAGG;IACH,OAAO,CAAC,EAAE,qBAAqB,GAAG,KAAK,CAAC;IACxC,4DAA4D;IAC5D,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,KAAK,MAAM,CAAC,CAAC;IAC9E,oFAAoF;IACpF,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,EAAE,KAAK,GAAG,KAAK,CAAC;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,kBAAkB,CAAC;IAChC,oBAAoB,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAChD,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC;IACjE,qBAAqB,EAAE,MAAM,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,qFAAqF;IACrF,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,GAAG,eAAe,GAAG,cAAc,CAAC;AAE1F,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,KAAK,CAAC;IACV,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,sBAAsB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,eAAe,CAAC;IAC1B,uEAAuE;IACvE,UAAU,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AAExE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC3B,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAC7C;IAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;CAAE,CAAC;AAErD,MAAM,MAAM,qBAAqB,GAAG;IAClC,qDAAqD;IACrD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,8FAA8F;IAC9F,SAAS,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;IAC1B,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,gEAAgE;IAChE,WAAW,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC1C;;;OAGG;IACH,sBAAsB,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/D;;;OAGG;IACH,OAAO,CAAC,EAAE,qBAAqB,GAAG,KAAK,CAAC;IACxC,4DAA4D;IAC5D,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,KAAK,MAAM,CAAC,CAAC;IAC9E,oFAAoF;IACpF,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,EAAE,KAAK,GAAG,KAAK,CAAC;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,kBAAkB,CAAC;IAChC,oBAAoB,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAChD,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC;IACjE,qBAAqB,EAAE,MAAM,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@relyper/sp-auth",
-  "version": "0.1.0",
-  "description": "Service-provider side of Relyper identity: principal resolution from gateway headers, role gating, a Fastify adapter, and a framework-free browser client.",
+  "version": "0.4.0",
+  "description": "Relyper identity for a service provider: an OIDC client (Authorization Code + PKCE) with a Fastify adapter and session cookies, plus the header-based variant for gateway deployments.",
   "license": "MIT",
   "author": "Jonas Esser",
   "type": "module",
@@ -16,7 +16,14 @@
     "authorization",
     "service-provider",
     "fastify",
-    "rbac"
+    "rbac",
+    "oidc",
+    "openid-connect",
+    "oauth2",
+    "pkce",
+    "sso",
+    "coins",
+    "billing"
   ],
   "repository": {
     "type": "git",
@@ -33,6 +40,14 @@
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
     },
+    "./oidc": {
+      "types": "./dist/oidc.d.ts",
+      "import": "./dist/oidc.js"
+    },
+    "./oidc/fastify": {
+      "types": "./dist/oidc-fastify.d.ts",
+      "import": "./dist/oidc-fastify.js"
+    },
     "./fastify": {
       "types": "./dist/fastify.d.ts",
       "import": "./dist/fastify.js"
@@ -41,7 +56,11 @@
       "types": "./dist/client.d.ts",
       "import": "./dist/client.js"
     },
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./coins": {
+      "types": "./dist/coins.d.ts",
+      "import": "./dist/coins.js"
+    }
   },
   "files": [
     "dist",
@@ -55,7 +74,8 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "fastify-plugin": "^5.1.0"
+    "fastify-plugin": "^5.1.0",
+    "jose": "^6.2.10"
   },
   "peerDependencies": {
     "fastify": ">=5"