@runeditrun/rer 0.0.0-stage → 0.1.0

package/modules/operator-auth/identity/oidc/README.md

@@ -0,0 +1,171 @@
+# Identity providers (OpenID Connect)
+
+Server-only portable ESM using Fetch and WebCrypto. An app offers several
+providers at once; each is pinned when linked and has its own routes. A
+provider's output is a verified principal, which the admission (an accounts
+adapter, `../admission.mjs`) turns into a session. Apply `schema/oidc.sql` as a
+new numbered migration on the primary D1 database; every statement is
+`IF NOT EXISTS`, so a store that had the earlier single-issuer adapter applies it
+again as its next migration.
+
+```js
+import { createOperatorAuth, createAuthHandler, createSignInHandler } from './modules/operator-auth/index.mjs';
+const auth = createOperatorAuth({
+  db: env.DB, clientIp, mailSender,
+  // The runtime's fetch; on workerd use redirect 'manual' and refuse every 3xx.
+  fetch: providerFetch,
+  waitUntil: promise => execution.waitUntil(promise),
+  config: {
+    origin: 'https://app.example.com', OWNER_EMAIL: env.OWNER_EMAIL, SESSION_SECRET: env.SESSION_SECRET,
+    // Independent of SESSION_SECRET; at least 32 characters. Both are Worker secrets.
+    OIDC_TRANSACTION_SECRET: env.OIDC_TRANSACTION_SECRET,
+    providers: [
+      // The app's private key (a Worker secret) authenticates it: no shared secret exists.
+      { id: 'auth', preset: 'auth', issuer: env.IDENTITY_PROVIDER, clientId: env.IDENTITY_CLIENT_ID, privateKey: JSON.parse(env.IDENTITY_PRIVATE_KEY) },
+      { id: 'google', preset: 'google', clientId: env.GOOGLE_CLIENT_ID, tokenAuthMethod: 'client_secret_basic', clientSecret: env.GOOGLE_CLIENT_SECRET },
+      { id: 'corp', preset: 'okta', issuer: 'https://corp.okta.com', clientId: env.OKTA_CLIENT_ID, privateKey: JSON.parse(env.OKTA_PRIVATE_KEY),
+        subjectEmails: { '00u1abcd': 'operator@corp.example' } },
+    ],
+  },
+});
+// GET /signin: "Continue with…" for each linked, reachable provider, then the email link.
+const page = await createSignInHandler(auth)(request);
+// /auth/oidc/<id>/start and /auth/oidc/<id>/callback, with the rest of /auth/*.
+const response = page ?? await createAuthHandler(auth)(request);
+```
+
+Register each provider's own redirect URI: `${origin}/auth/oidc/<id>/callback`,
+or an explicit same-origin `redirectUri` for an incumbent route. Both exported
+HTTP handlers own that configured callback outside `/auth/oidc/` too. The old
+default route is unowned after an override. Conflicting callbacks, foreign
+origins, credentials, query and fragment components are refused.
+`createOidcProviders({ admission, db, config, clientIp, fetch, clock, waitUntil })`
+is the same client for a seed whose accounts adapter is its own.
+
+## Presets
+
+| Preset | Issuer | ID-token algorithms | Client authentication | Email trust |
+| --- | --- | --- | --- | --- |
+| `auth` (RER's Auth) | the install's exact HTTPS issuer | ES256 | `private_key_jwt` only | `email_verified` with `email_verified_at` in the last 30 days |
+| `google` | `https://accounts.google.com` (fixed) | RS256 | `private_key_jwt` (default), `client_secret_basic`, `client_secret_post` | `email_verified`, and only for `@gmail.com` or tokens carrying a matching `hd` |
+| `microsoft` | `https://login.microsoftonline.com/<tenant>/v2.0` from `tenant` (never `common`, `organizations` or `consumers`) | RS256 | as Google | never by email: only `subjectEmails` |
+| `okta` | the organisation's exact HTTPS issuer | RS256 | as Google | never by email: only `subjectEmails` |
+| `legacy-rs256` (explicit incumbent opt-in) | exact HTTPS issuer plus required exact `endpointPins` | RS256 | as Google | signed verified email; missing timestamp counts at sign-in, supplied timestamp must be current and valid |
+
+`none` and every `HS*` algorithm are never accepted; a token whose `alg` is not
+in its link's pin is refused before any key is looked up. GitHub is not an
+OpenID provider and is not offered. Outside the explicit incumbent preset, other upstreams identify people only
+through explicit `subjectEmails`, a trusted server map from the provider's `sub`
+to an existing operator's email (never populated from a callback, a token email
+or a request).
+
+An `auth` provider must state, in discovery, the interface it serves:
+`"rer_interfaces": ["oidc-provider@1.0.0"]`. One below the minimum
+(`MINIMUM_PROVIDER_VERSION`, or a provider's higher `minimumVersion`) is refused
+and nothing is pinned.
+
+The incumbent preset requires `endpointPins: { authorization, token, jwks }`.
+Discovery must match these exact HTTPS URLs; this does not loosen Okta,
+Microsoft, Google or Auth trust. See [native adoption](../../docs/native-accounts.md)
+for the full persistence and callback contract.
+
+Callback overrides cannot occupy shared owner-claim, sign-in, auth, dependency
+or dev routes, including `/auth/owner-claim`, `/auth/dev/enter`, `/__dev/key` and
+`/__dev/personas`. These routes keep their original handlers; an incumbent path
+such as `/api/auth/identity/callback` is supported with the same transaction
+binding as the default callback.
+
+## Linking and pinning
+
+A provider is linked at its first use: discovery is fetched and the link pins
+the issuer, client id, JWKS URI, authorization and token endpoints, the allowed
+algorithms (the preset's, as advertised), the client authentication method, and
+whether the provider sends RFC 9207 `iss`. Every later start fetches discovery
+again and refuses (and hides the provider) if it no longer matches the pin; only
+the owner's re-link changes a pin.
+
+A changed configuration (for example a new `IDENTITY_PROVIDER` answer: another
+issuer or client id) only records a **pending re-link**. Sign-in keeps using the
+pinned provider; nothing is swapped in place. The owner completes the re-link at
+`POST /auth/providers/relink {provider}`, or ends a link at
+`POST /auth/providers/unlink {provider}`, each with a fresh step-up proof.
+`GET /auth/providers` lists the pins and pending re-links. Completing a re-link
+invalidates logins in flight. An unlinked provider stays unlinked even while its
+configuration remains, until the owner re-links it.
+
+## The protocol
+
+`POST /auth/oidc/<id>/start` (exact Origin, matching Host, no cross-site Fetch
+Metadata; JSON or a native form with `returnTo`, at most 4096 bytes) sends
+`response_type=code`, `response_mode=query`, the preset's scope, independent
+256-bit state and nonce, and mandatory S256 PKCE to the pinned authorization
+endpoint, with a per-state browser-binding cookie (`__Host-oa_oidc_<state>`, or
+`oa_oidc_local_<port>_<state>` on a loopback origin). State is keyed to its provider:
+an authorization response for one provider presented at another provider's
+redirect URI finds no transaction and is refused (the mix-up defence), and no
+code reaches the wrong token endpoint.
+
+`GET /auth/oidc/<id>/callback`, in order: exact route and method, no duplicate
+parameters, state and its browser binding consume the durable transaction once
+(`DELETE … RETURNING`, before any exchange), the transaction belongs to this
+provider, RFC 9207: `iss` must equal the pinned issuer where the provider sends
+it (and is required where its discovery says so), a provider error is reported
+without its text, then the code is exchanged at the pinned token endpoint. With
+`private_key_jwt` the app sends a one-minute RFC 7523 assertion signed by its own
+key (`iss`=`sub`=client id, `aud` the token endpoint, unique `jti`); no secret is
+shared. The ID token's header must name a pinned algorithm and a kid; the key
+comes from the link's cached JWKS, refetched **once** when the kid is unknown and
+refused if still unknown; a substituted key under a known kid fails without a
+refetch. Then the signature, `iss` (the pinned issuer), `aud`/`azp` (this client,
+plus explicitly trusted `additionalAudiences`), `exp`/`iat`/`nbf`, `nonce`, and
+`at_hash`/`c_hash` when present. Access and refresh tokens are never stored or
+returned.
+
+The principal then carries the provider's email only as far as its preset
+trusts it, and the admission refuses, in production (not `local`), `amr`
+containing `dev` and addresses under `.localhost`, `.test` or `.invalid`. A
+proof older than 30 days does not count. Successful callback returns 303 to the
+**stored** local `returnTo` with the session cookie.
+
+Errors are JSON `{error:code}` for API callers; a browser navigation or native
+form post (`Accept: text/html`) is sent back to the sign-in page with
+`?notice=<code>` and the email link. Codes include `oidc_invalid_correlation`,
+`oidc_issuer_mismatch`, `oidc_audience_mismatch`, `oidc_algorithm_refused`,
+`oidc_unknown_key`, `oidc_provider_denied`, `oidc_admission_denied`,
+`oidc_provider_required`, `oidc_provider_unavailable`, `oidc_relink_required`,
+`oidc_provider_version_unsupported`, `oidc_rate_limited`, `oidc_storage_unavailable`.
+
+## Reachability
+
+Every discovery and JWKS call records the provider's health in
+`oa_identity_provider_health`. A provider that has failed discovery or JWKS for
+5 minutes (`HIDE_AFTER_MS`), or answered 404 or a DNS failure (a resolver error,
+or the 530 a Worker receives for an origin DNS failure), is hidden from the
+sign-in page, which offers the email link instead of redirecting. A hidden
+provider is checked again at most once a minute, after the page answers
+(`waitUntil`), and shown again once a check succeeds.
+
+## Storage and limits
+
+`oa_oidc_transactions` stores domain-separated HMAC hashes of state, binding and
+the provider's pin, plus the AES-GCM sealed nonce, verifier, returnTo, expiry and
+provider id. `oa_oidc_limits` counts starts per provider, client address and
+15-minute window (default 30, `identityStartLimit`). `oa_identity_providers`
+holds the pins and cached JWKS. Delete expired rows from the two transaction
+tables periodically (`expires_at <= now`, milliseconds). Discovery and token
+JSON are limited to 64 KiB, JWKS to 256 KiB and 100 keys; each call has a
+deadline including the body (default 5000 ms, `identityTimeoutMs`); redirects are
+never followed.
+
+## Checks and proof boundary
+
+`node --test modules/operator-auth/identity/oidc/tests/*.test.mjs` runs the
+protocol suite on Node SQLite (`client.test.mjs`, `boundaries.test.mjs`) and the
+fake-provider suite through the public HTTP door in real workerd with D1
+(`providers.test.mjs`): a happy path per preset, the mix-up, wrong `iss` and
+`aud`, `none`/HS256/unlisted algorithms, an unknown kid refetched once then
+refused, a replayed state, `amr: ["dev"]`, unverified, stale and unproven
+emails, bindings, the domain rule, step-up for each action, reachability, the
+minimum version and the re-link. Fakes stand only at the provider edge
+(`idp.mjs`, `fake-worker.mjs`). This proves the module, not a real provider
+account, client registration or deployment.

package/modules/operator-auth/identity/oidc/client-auth.mjs

@@ -0,0 +1,16 @@
+import { encode, utf8, random } from './crypto.mjs';
+
+const ALGORITHMS = { ES256: { name: 'ECDSA', namedCurve: 'P-256', hash: 'SHA-256' }, RS256: { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' } };
+
+// RFC 7523 client authentication (`private_key_jwt`): a one-minute assertion,
+// unique by jti, addressed to the pinned token endpoint.
+export async function clientAssertion(provider, link, now) {
+  const algorithm = ALGORITHMS[provider.keyAlgorithm];
+  const { kid, alg: _, use: __, key_ops: ___, ...jwk } = provider.privateKey;
+  const key = await crypto.subtle.importKey('jwk', jwk, algorithm, false, ['sign']);
+  const iat = Math.floor(now / 1000);
+  const header = { alg: provider.keyAlgorithm, kid, typ: 'JWT' };
+  const claims = { iss: link.clientId, sub: link.clientId, aud: link.token, jti: random(), iat, exp: iat + 60 };
+  const input = `${encode(utf8.encode(JSON.stringify(header)))}.${encode(utf8.encode(JSON.stringify(claims)))}`;
+  return `${input}.${encode(await crypto.subtle.sign(algorithm, key, utf8.encode(input)))}`;
+}

package/modules/operator-auth/identity/oidc/config.mjs

@@ -0,0 +1,102 @@
+import { normalizeEmail } from '../../policy.mjs';
+import { isLoopbackHost } from '../../http.mjs';
+import { check } from './errors.mjs';
+import { PRESETS, MINIMUM_PROVIDER_VERSION, compareVersions, validVersion } from './presets.mjs';
+
+function integer(value, defaultValue, min, max) {
+  const v = value ?? defaultValue;
+  check(Number.isSafeInteger(v) && v >= min && v <= max, 'oidc_invalid_configuration', 503); return v;
+}
+function httpsUrl(value) {
+  const u = new URL(value);
+  check(typeof value === 'string' && u.protocol === 'https:' && !u.username && !u.password && !u.search && !u.hash && !/[\s\\]/.test(value));
+  return u;
+}
+// A private JWK for private_key_jwt. Its public half is what the provider holds.
+function privateKey(jwk, algorithm) {
+  check(jwk && typeof jwk === 'object' && typeof jwk.kid === 'string' && jwk.kid.length > 0 && jwk.kid.length <= 256 && typeof jwk.d === 'string');
+  check(algorithm === 'ES256' ? jwk.kty === 'EC' && jwk.crv === 'P-256' : jwk.kty === 'RSA');
+  return Object.freeze({ ...jwk });
+}
+
+function provider(input, origin) {
+  check(input && typeof input === 'object' && typeof input.id === 'string' && /^[a-z][a-z0-9-]{0,31}$/.test(input.id));
+  const preset = PRESETS[input.preset];
+  check(preset && Object.hasOwn(PRESETS, input.preset));
+  let issuer = preset.issuer ?? input.issuer;
+  if (preset.tenantIssuer) {
+    // A tenant-specific issuer only: never common, organizations or consumers.
+    check(typeof input.tenant === 'string' && /^[A-Za-z0-9-]{1,64}(\.[A-Za-z0-9-]{1,63})*$/.test(input.tenant) && !['common', 'organizations', 'consumers'].includes(input.tenant.toLowerCase()));
+    issuer = preset.tenantIssuer(input.tenant);
+  }
+  check(input.issuer === undefined || input.issuer === issuer);
+  const issuerUrl = httpsUrl(issuer);
+  check(typeof input.clientId === 'string' && input.clientId.length > 0 && input.clientId.length <= 512 && !/[\x00-\x1f\x7f]/.test(input.clientId));
+  const tokenAuthMethod = input.tokenAuthMethod ?? preset.methods[0];
+  check(preset.methods.includes(tokenAuthMethod));
+  check(tokenAuthMethod === 'private_key_jwt' ? input.clientSecret === undefined : input.privateKey === undefined);
+  check(!tokenAuthMethod.startsWith('client_secret') || typeof input.clientSecret === 'string' && input.clientSecret.length > 0 && input.clientSecret.length <= 4096);
+  const keyAlgorithm = tokenAuthMethod === 'private_key_jwt' ? input.privateKey?.alg ?? (input.privateKey?.kty === 'EC' ? 'ES256' : 'RS256') : undefined;
+  check(keyAlgorithm === undefined || ['ES256', 'RS256'].includes(keyAlgorithm));
+  const additionalAudiences = input.additionalAudiences ?? [];
+  check(Array.isArray(additionalAudiences) && additionalAudiences.length <= 10 && additionalAudiences.every(a => typeof a === 'string' && a.length > 0 && a.length <= 512));
+  const endpointOrigins = input.endpointOrigins ?? preset.endpointOrigins ?? [issuerUrl.origin];
+  check(Array.isArray(endpointOrigins) && endpointOrigins.length > 0 && endpointOrigins.every(o => { const u = new URL(o); return u.origin === o && u.protocol === 'https:'; }));
+  const subjectEmails = Object.fromEntries(Object.entries(input.subjectEmails ?? {}).map(([subject, email]) => {
+    check(subject.length > 0 && subject.length <= 255); return [subject, normalizeEmail(email)];
+  }));
+  const minimumVersion = preset.interface ? input.minimumVersion ?? MINIMUM_PROVIDER_VERSION : undefined;
+  check(minimumVersion === undefined || validVersion(minimumVersion) && compareVersions(minimumVersion, MINIMUM_PROVIDER_VERSION) >= 0);
+  const label = input.label ?? preset.label;
+  check(typeof label === 'string' && label.length > 0 && label.length <= 60 && !/[\x00-\x1f\x7f]/.test(label));
+  const redirectUri = input.redirectUri ?? `${origin}/auth/oidc/${input.id}/callback`;
+  const redirect = new URL(redirectUri);
+  check(typeof redirectUri === 'string' && redirect.href === redirectUri && redirect.origin === origin && !redirect.username && !redirect.password && !redirect.search && !redirect.hash && !/[\s\\]/.test(redirectUri));
+  // Incumbent trust is a separate explicit preset, scoped to exact server-owned
+  // endpoints. No verified-email switch can broaden Okta/Microsoft defaults.
+  let endpointPins;
+  if (input.preset === 'legacy-rs256') {
+    check(input.endpointPins && typeof input.endpointPins === 'object');
+    endpointPins = Object.freeze(Object.fromEntries(['authorization', 'token', 'jwks'].map(key => {
+      const value = input.endpointPins[key], u = httpsUrl(value);
+      check(u.href === value && endpointOrigins.includes(u.origin));
+      return [key, value];
+    })));
+  } else check(input.endpointPins === undefined);
+  return Object.freeze({ id: input.id, preset: input.preset, label, issuer, clientId: input.clientId, tokenAuthMethod,
+    clientSecret: input.clientSecret, privateKey: keyAlgorithm ? privateKey(input.privateKey, keyAlgorithm) : undefined, keyAlgorithm,
+    algorithms: Object.freeze([...preset.algorithms]), email: preset.email, scope: preset.scope, interface: preset.interface, minimumVersion,
+    additionalAudiences: Object.freeze([...new Set(additionalAudiences)]), endpointOrigins: Object.freeze([...new Set(endpointOrigins)]), subjectEmails: Object.freeze(subjectEmails),
+    // Each provider has its own redirect URI; its state is bound to it.
+    endpointPins, startPath: `/auth/oidc/${input.id}/start`, redirectUri });
+}
+
+export function configure(input) {
+  try {
+    const origin = new URL(input.origin);
+    check(origin.origin === input.origin && !origin.username && !origin.password);
+    const local = input.local === true;
+    check(local ? isLoopbackHost(origin.hostname) && ['http:', 'https:'].includes(origin.protocol) : origin.protocol === 'https:');
+    check(typeof input.transactionSecret === 'string' && input.transactionSecret.length >= 32 && input.transactionSecret.length <= 1024);
+    check(Array.isArray(input.providers) && input.providers.length <= 8);
+    const providers = input.providers.map(entry => provider(entry, input.origin));
+    check(new Set(providers.map(p => p.id)).size === providers.length);
+    const callbacks = providers.map(p => new URL(p.redirectUri).pathname);
+    check(new Set(callbacks).size === providers.length);
+    // Auth routes, owner-claim handlers and the local dev gate retain their
+    // handlers even when an edition chooses its own OIDC callback pathname.
+    const reserved = new Set([input.signInPath ?? '/signin', '/auth/owner-claim', '/auth/dev/enter', '/__dev/personas', '/__dev/key', '/auth/bootstrap', '/auth/magic-link', '/auth/confirm', '/auth/signout', '/auth/session', '/auth/invite', '/auth/invite/cancel', '/auth/review-session', '/auth/operators', '/auth/sessions', '/auth/operator/status', '/auth/operator/role', '/auth/session/revoke', '/auth/step-up', '/auth/domain-rules', '/auth/providers', '/auth/providers/unlink', '/auth/providers/relink', '/auth/settings/identity', '/auth/setup-complete']);
+    check(callbacks.every((path, index) => !reserved.has(path) && !path.startsWith('/.well-known/') && !path.startsWith('/auth/dependencies/') && !providers.some(p => path === p.startPath) && (!path.startsWith('/auth/oidc/') || path === `/auth/oidc/${providers[index].id}/callback`)));
+
+    return Object.freeze({ origin: input.origin, local, secure: origin.protocol === 'https:', transactionSecret: input.transactionSecret, providers: Object.freeze(providers),
+      signInPath: input.signInPath ?? '/signin',
+      transactionSeconds: integer(input.transactionSeconds, 600, 60, 900), timeoutMs: integer(input.timeoutMs, 5000, 100, 15000),
+      clockSkewSeconds: integer(input.clockSkewSeconds, 30, 0, 120), maxTokenAgeSeconds: integer(input.maxTokenAgeSeconds, 600, 60, 3600),
+      startLimit: integer(input.startLimit, 30, 1, 1000) });
+  } catch { check(false, 'oidc_invalid_configuration', 503); }
+}
+
+export function endpoint(value, provider) {
+  try { const u = new URL(value); check(typeof value === 'string' && u.href === value && u.protocol === 'https:' && !u.username && !u.password && !u.hash && !u.search && provider.endpointOrigins.includes(u.origin)); return u.href; }
+  catch { check(false, 'oidc_untrusted_endpoint', 503); }
+}

package/modules/operator-auth/identity/oidc/crypto.mjs

@@ -0,0 +1,29 @@
+import { check } from './errors.mjs';
+export const utf8 = new TextEncoder();
+export function encode(bytes) { return btoa(String.fromCharCode(...new Uint8Array(bytes))).replaceAll('+', '-').replaceAll('/', '_').replaceAll('=', ''); }
+export function decode(value) {
+  check(typeof value === 'string' && /^[A-Za-z0-9_-]+$/.test(value));
+  const bytes = Uint8Array.from(atob(value.replaceAll('-', '+').replaceAll('_', '/')), c => c.charCodeAt(0));
+  check(encode(bytes) === value);
+  return bytes;
+}
+export function random() { return encode(crypto.getRandomValues(new Uint8Array(32))); }
+export function isRandom(value) { return typeof value === 'string' && /^[A-Za-z0-9_-]{43}$/.test(value); }
+export async function digest(value) { return encode(await crypto.subtle.digest('SHA-256', utf8.encode(value))); }
+export async function keyedHash(secret, purpose, value) {
+  const key = await crypto.subtle.importKey('raw', utf8.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+  return encode(await crypto.subtle.sign('HMAC', key, utf8.encode(`oidc-v1:${purpose}\0${value}`)));
+}
+async function encryptionKey(secret) {
+  return crypto.subtle.importKey('raw', await crypto.subtle.digest('SHA-256', utf8.encode(`oidc-v1:encryption\0${secret}`)), 'AES-GCM', false, ['encrypt', 'decrypt']);
+}
+export async function seal(secret, stateHash, value) {
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv, additionalData: utf8.encode(stateHash) }, await encryptionKey(secret), utf8.encode(JSON.stringify(value)));
+  return `${encode(iv)}.${encode(ciphertext)}`;
+}
+export async function unseal(secret, stateHash, value) {
+  const [iv, ciphertext, extra] = value.split('.');
+  check(!extra);
+  return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(await crypto.subtle.decrypt({ name: 'AES-GCM', iv: decode(iv), additionalData: utf8.encode(stateHash) }, await encryptionKey(secret), decode(ciphertext))));
+}

package/modules/operator-auth/identity/oidc/errors.mjs

@@ -0,0 +1,5 @@
+export class OidcError extends Error {
+  constructor(code, status = 400) { super(code); this.name = 'OidcError'; this.code = code; this.status = status; }
+}
+export function fail(code = 'oidc_invalid_response', status = 400) { throw new OidcError(code, status); }
+export function check(value, code, status) { if (!value) fail(code, status); }

package/modules/operator-auth/identity/oidc/index.d.mts

@@ -0,0 +1,33 @@
+import type { Admission, Role, Database, IdentityProviderConfig, IdentityProviders } from '../../index.mjs';
+export interface OidcProvidersConfig {
+  origin: string;
+  local?: boolean;
+  /** Independent high-entropy secret of at least 32 characters; never browser data. */
+  transactionSecret: string;
+  providers: IdentityProviderConfig[];
+  signInPath?: string;
+  transactionSeconds?: number;
+  timeoutMs?: number;
+  clockSkewSeconds?: number;
+  maxTokenAgeSeconds?: number;
+  startLimit?: number;
+}
+export interface OidcProvidersOptions<R extends string = Role> {
+  admission: Pick<Admission<R>, 'admit'> & Partial<Pick<Admission<R>,'accounts'>>;
+  enabled?:()=>Promise<boolean>;
+  policyVersion?:()=>Promise<number>;
+  claimScope?:()=>Promise<boolean>;
+  claim?:(request:Request,token:string,pin:{id:string;issuer:string;clientId:string;linkedAt:number})=>Promise<Response|null>;
+  db: Database;
+  config: OidcProvidersConfig;
+  clientIp: (request: Request) => string | Promise<string>;
+  fetch?: typeof globalThis.fetch;
+  clock?: () => number;
+  waitUntil?: (promise: Promise<unknown>) => void;
+}
+export const HIDE_AFTER_MS: number;
+export const MINIMUM_PROVIDER_VERSION: string;
+export const PRESETS: Readonly<Record<'auth' | 'google' | 'microsoft' | 'okta' | 'legacy-rs256', { label: string; algorithms: string[]; methods: string[]; email: 'verified-at' | 'google' | 'subject' | 'legacy-verified' }>>;
+export function createOidcProviders<R extends string>(options: OidcProvidersOptions<R>): IdentityProviders;
+export function createOidcHandler(providers: IdentityProviders): (request: Request) => Promise<Response | null>;
+export class OidcError extends Error { constructor(code: string, status?: number); code: string; status: number }