@runeditrun/rer 0.0.0-stage → 0.1.1

package/modules/operator-auth/identity/oidc/index.mjs

@@ -0,0 +1,287 @@
+// Server-only entry. Never include this module or its configuration in a browser bundle.
+// OpenID Connect sign-in for several pinned providers at once. Each provider
+// has its own start and callback route; its output is a verified principal,
+// which the accounts layer admits through the admission it is given.
+import { safeReturnTo } from '../../policy.mjs';
+import { securityHeaders, requireLoopback, localCookieName } from '../../http.mjs';
+import { configure } from './config.mjs';
+import { check, OidcError } from './errors.mjs';
+import { random, isRandom, digest, keyedHash, seal, unseal } from './crypto.mjs';
+import { storage } from './store.mjs';
+import { discover, exchange, readJson } from './network.mjs';
+import { parseIdToken, knowsKey, verifyIdToken, principalOf } from './jwt.mjs';
+import { PRESETS, MINIMUM_PROVIDER_VERSION } from './presets.mjs';
+import { refuseInProduction } from '../principal.mjs';
+export { OidcError } from './errors.mjs';
+export { PRESETS, MINIMUM_PROVIDER_VERSION } from './presets.mjs';
+
+export const HIDE_AFTER_MS = 5 * 60000;
+const PROBE_EVERY_MS = 60000;
+
+function cookieName(config, state) { return config.local ? `${localCookieName('oa_oidc_local', config.origin)}_${state}` : `__Host-oa_oidc_${state}`; }
+function cookie(config, state, value, age = config.transactionSeconds) {
+  return `${cookieName(config, state)}=${value}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${age}${config.secure ? '; Secure' : ''}`;
+}
+function bindingCookie(request, config, state) {
+  const header = request.headers.get('cookie') ?? '';
+  check(header.length <= 16384, 'oidc_invalid_correlation');
+  const prefix = `${cookieName(config, state)}=`;
+  const matches = header.split(';').map(s => s.trim()).filter(s => s.startsWith(prefix));
+  check(matches.length === 1 && isRandom(matches[0].slice(prefix.length)), 'oidc_invalid_correlation');
+  return matches[0].slice(prefix.length);
+}
+function redirect(location, cookies) {
+  const headers = new Headers({ ...securityHeaders(), Location: location });
+  for (const value of cookies) headers.append('Set-Cookie', value);
+  return new Response(null, { status: 303, headers });
+}
+// A browser navigation or form post gets the sign-in page back with a notice
+// and the email link; API callers get the JSON error code.
+function errorResponse(error, config, request, clearCookie) {
+  const known = error instanceof OidcError;
+  const headers = new Headers(securityHeaders());
+  if (clearCookie) headers.append('Set-Cookie', clearCookie);
+  const code = known ? error.code : 'oidc_unavailable';
+  if (request && /\btext\/html\b/.test(request.headers.get('accept') ?? '')) {
+    headers.set('Location', `${config.signInPath}?notice=${encodeURIComponent(code)}`);
+    return new Response(null, { status: 303, headers });
+  }
+  return Response.json({ error: code }, { status: known ? error.status : 503, headers });
+}
+function boundary(request, config, post) {
+  const url = new URL(request.url); const host = request.headers.get('host');
+  check(url.origin === config.origin && (!host || host.toLowerCase() === url.host.toLowerCase()), 'oidc_invalid_origin', 403);
+  if (config.local) { try { requireLoopback(request); } catch { throw new OidcError('oidc_invalid_origin', 403); } }
+  if (post) {
+    check(request.method === 'POST', 'oidc_method_not_allowed', 405);
+    check(request.headers.get('origin') === config.origin && request.headers.get('sec-fetch-site') !== 'cross-site', 'oidc_invalid_origin', 403);
+  }
+}
+// Whom the app talks to: the pinned link, never a configuration changed since.
+// While a re-link is pending, the pinned issuer keeps its own preset rules and
+// none of the new configuration's subject associations.
+function pinnedView(provider, link) {
+  if (link.issuer === provider.issuer && link.clientId === provider.clientId && link.preset === provider.preset) return provider;
+  const preset = PRESETS[link.preset];
+  return { ...provider, preset: link.preset, issuer: link.issuer, clientId: link.clientId, tokenAuthMethod: link.tokenAuthMethod, algorithms: link.algorithms,
+    endpointPins: link.preset === 'legacy-rs256' ? { authorization: link.authorization, token: link.token, jwks: link.jwks } : undefined, email: preset.email, interface: preset.interface, minimumVersion: preset.interface ? provider.minimumVersion ?? MINIMUM_PROVIDER_VERSION : undefined, scope: preset.scope, subjectEmails: {},
+    endpointOrigins: [...new Set([link.authorization, link.token, link.jwks].map(u => new URL(u).origin))] };
+}
+const samePin = (link, metadata) => link.issuer === metadata.issuer && link.jwks === metadata.jwks && link.authorization === metadata.authorization
+  && link.token === metadata.token && link.algorithms.every(a => metadata.algorithms.includes(a)) && (!link.responseIssuer || metadata.responseIssuer);
+
+export function createOidcProviders({ admission, db, config: input, clientIp, fetch: fetcher = globalThis.fetch, clock = Date.now, waitUntil, enabled = async () => Boolean(await admission?.accounts?.identityEnabled?.()), claim, claimScope = async () => false, policyVersion = async () => 0 }) {
+  const config = configure(input);
+  check(admission && typeof admission.admit === 'function' && db && typeof db.prepare === 'function' && typeof clientIp === 'function' && typeof fetcher === 'function' && typeof clock === 'function', 'oidc_invalid_configuration', 503);
+  const store = storage(db);
+  const providers = new Map(config.providers.map(p => [p.id, p]));
+  // Every network call records the provider's reachability.
+  async function observe(provider, operation) {
+    try { const value = await operation(); await store.healthy(provider.id, clock()); return value; }
+    catch (error) { if (error instanceof OidcError && error.status === 502) await store.failing(provider.id, error.hard === true, clock()); throw error; }
+  }
+  // The pinned link, made at the provider's first use. Afterwards a changed
+  // configuration only records a pending re-link; the pin is never swapped.
+  async function linked(provider) {
+    const link = await store.link(provider.id);
+    if (!link) {
+      const metadata = await observe(provider, () => discover(fetcher, provider, config));
+      return { link: await store.pin(provider.id, provider, metadata, clock()), metadata };
+    }
+    if (link.issuer !== provider.issuer || link.clientId !== provider.clientId || link.preset !== provider.preset) await store.pending(provider.id, provider, clock());
+    else if (link.pendingAt) await store.clearPending(provider.id);
+    return { link };
+  }
+  // A pinned provider whose discovery no longer matches its pin cannot be used
+  // until the owner re-links it.
+  async function current(provider) {
+    const { link, metadata: fresh } = await linked(provider);
+    check(link.status === 'linked', 'oidc_provider_unlinked', 403);
+    const view = pinnedView(provider, link);
+    if (!fresh) {
+      const metadata = await observe(provider, () => discover(fetcher, view, config));
+      if (!samePin(link, metadata)) { await store.failing(provider.id, true, clock()); throw new OidcError('oidc_relink_required', 502); }
+    }
+    return { link, view };
+  }
+  // Changes to a provider's pin, callback or policy invalidate its outstanding logins.
+  const fingerprint = (provider, link) => keyedHash(config.transactionSecret, 'configuration', JSON.stringify({
+    configured: providers.get(provider.id), id: provider.id, linkedAt: link.linkedAt, issuer: link.issuer, clientId: link.clientId, jwks: link.jwks, token: link.token, authorization: link.authorization, algorithms: link.algorithms,
+    redirectUri: provider.redirectUri, method: provider.tokenAuthMethod, subjectEmails: provider.subjectEmails, audiences: provider.additionalAudiences, email: provider.email,
+    transactionSeconds: config.transactionSeconds, maxTokenAgeSeconds: config.maxTokenAgeSeconds, clockSkewSeconds: config.clockSkewSeconds }));
+  // State is keyed to its provider: a response for one provider presented at
+  // another provider's redirect URI finds no transaction.
+  const stateHash = (provider, state) => keyedHash(config.transactionSecret, 'state', `${provider.id}\0${state}`);
+  async function keysFor(provider, link, kid) {
+    if (knowsKey(link.keySet, kid)) return link.keySet;
+    // One refetch for a key this app has not seen; a key still unknown is refused.
+    const fetched = await observe(provider, () => readJson(fetcher, link.jwks, config, {}, 262144));
+    await store.keys(link, fetched, clock());
+    check(knowsKey(fetched, kid), 'oidc_unknown_key');
+    return fetched;
+  }
+  async function probe(provider) {
+    try {
+      const { link, metadata } = await linked(provider);
+      if (link.status !== 'linked') return;
+      if (!metadata) {
+        const fresh = await observe(provider, () => discover(fetcher, pinnedView(provider, link), config));
+        if (!samePin(link, fresh)) { await store.failing(provider.id, true, clock()); return; }
+      }
+      const keys = await observe(provider, () => readJson(fetcher, link.jwks, config, {}, 262144));
+      await store.keys(link, keys, clock());
+    } catch { /* recorded by observe */ }
+  }
+  async function begin(request, id, { returnTo } = {}) {
+    const provider = providers.get(id);
+    try {
+      check(await enabled(), 'oidc_sign_in_disabled', 403);
+      boundary(request, config, true);
+      check(provider && new URL(request.url).pathname === provider.startPath && !new URL(request.url).search, 'oidc_invalid_route', 404);
+      const ip = await clientIp(request);
+      check(typeof ip === 'string' && ip.length > 0 && ip.length <= 256, 'oidc_client_address_unavailable', 503);
+      const now = clock();
+      const window = Math.floor(now / 900000);
+      const bucket = await keyedHash(config.transactionSecret, 'start-limit', `${provider.id}\0${provider.issuer}\0${provider.clientId}\0${ip}\0${window}`);
+      await store.limit(bucket, (window + 1) * 900000, config.startLimit);
+      const { link, view } = await current(provider);
+      const state = random(); const binding = random(); const verifier = random(); const nonce = random();
+      const hashed = await stateHash(provider, state);
+      const expiresAt = clock() + config.transactionSeconds * 1000;
+      const payload = await seal(config.transactionSecret, hashed, { nonce, verifier, returnTo: safeReturnTo(returnTo), expiresAt, provider: provider.id, policyVersion: await policyVersion() });
+      await store.put({ stateHash: hashed, bindingHash: await keyedHash(config.transactionSecret, 'binding', binding), configHash: await fingerprint(view, link), payload, expiresAt });
+      const authorization = new URL(link.authorization);
+      const params = { response_type: 'code', response_mode: 'query', client_id: link.clientId, redirect_uri: provider.redirectUri,
+        scope: view.scope + (await claimScope() ? ' claim' : ''), state, nonce, code_challenge: await digest(verifier), code_challenge_method: 'S256' };
+      for (const [key, value] of Object.entries(params)) authorization.searchParams.set(key, value);
+      return redirect(authorization.href, [cookie(config, state, binding)]);
+    } catch (e) { return errorResponse(e, config, request); }
+  }
+  async function callback(request, id) {
+    const provider = providers.get(id);
+    let clearCookie;
+    try {
+      check(await enabled(), 'oidc_sign_in_disabled', 403);
+      boundary(request, config, false);
+      check(request.method === 'GET', 'oidc_method_not_allowed', 405);
+      check(request.url.length <= 12288, 'oidc_invalid_response');
+      const url = new URL(request.url);
+      check(provider && url.origin + url.pathname === provider.redirectUri && !url.hash, 'oidc_invalid_route', 404);
+      for (const name of url.searchParams.keys()) check(url.searchParams.getAll(name).length === 1);
+      const state = url.searchParams.get('state'); check(isRandom(state), 'oidc_invalid_correlation');
+      const binding = bindingCookie(request, config, state);
+      const link = await store.link(provider.id);
+      check(link && link.status === 'linked', 'oidc_invalid_correlation');
+      const view = pinnedView(provider, link);
+      const hashed = await stateHash(provider, state);
+      const row = await store.consume(hashed, await keyedHash(config.transactionSecret, 'binding', binding), await fingerprint(view, link), clock());
+      check(row, 'oidc_invalid_correlation');
+      clearCookie = cookie(config, state, '', 0);
+      let transaction;
+      try { transaction = await unseal(config.transactionSecret, hashed, row.payload); }
+      catch { throw new OidcError('oidc_storage_unavailable', 503); }
+      check(transaction.provider === provider.id, 'oidc_invalid_correlation');
+      // RFC 9207: where the provider sends iss with its response, it must be the pinned issuer.
+      const issuer = url.searchParams.get('iss');
+      check(issuer === null ? !link.responseIssuer : issuer === link.issuer, 'oidc_issuer_mismatch');
+      if (url.searchParams.has('error')) { check(!url.searchParams.has('code')); throw new OidcError('oidc_provider_denied', 401); }
+      const code = url.searchParams.get('code');
+      check(typeof code === 'string' && code.length <= 4096 && /^[\x21-\x7e]+$/.test(code));
+      const tokens = await exchange(fetcher, link, view, config, code, transaction.verifier, clock());
+      let claims;
+      try {
+        const parsed = parseIdToken(tokens.id_token, link);
+        const keys = await keysFor(provider, link, parsed.header.kid);
+        claims = await verifyIdToken(parsed, keys, link, view, config, transaction, { ...tokens, code }, clock());
+      } catch (error) { if (error instanceof OidcError && error.status !== 400) throw error; throw new OidcError(error instanceof OidcError ? error.code : 'oidc_invalid_response'); }
+      check(clock() < transaction.expiresAt, 'oidc_invalid_correlation');
+      check(transaction.policyVersion === await policyVersion() && await enabled(), 'oidc_sign_in_disabled', 403);
+      const providerPin={id:link.id,issuer:link.issuer,clientId:link.clientId,linkedAt:link.linkedAt};
+      if (Object.hasOwn(claims,'install_owner')) {
+        check(typeof claim === 'function','oidc_claim_refused',403);
+        const claimed=await claim(request,tokens.id_token,providerPin);check(claimed,'oidc_claim_refused',403);return claimed;
+      }
+      let result;
+      try {
+        const principal = {...principalOf(claims, view),providerGeneration:transaction.policyVersion,providerPin};
+        // A production app refuses dev identities and addresses only local or test systems hold.
+        refuseInProduction(principal, config);
+        result = await admission.admit(request, principal, { returnTo: transaction.returnTo });
+      }
+      catch (error) { throw new OidcError(error?.code === 'provider_required' ? 'oidc_provider_required' : 'oidc_admission_denied', 403); }
+      return redirect(result.returnTo, [clearCookie, result.cookie]);
+    } catch (e) { return errorResponse(e, config, request, clearCookie); }
+  }
+  return Object.freeze({
+    ids: Object.freeze([...providers.keys()]),
+    begin, callback,
+    callbackPaths: Object.freeze(Object.fromEntries([...providers.values()].map(p => [new URL(p.redirectUri).pathname, p.id]))),
+    /** The sign-in page's list: a provider is hidden while unlinked or unreachable. */
+    async list() {
+      if (!await enabled()) return [];
+      const now = clock();
+      const [links, health] = await Promise.all([store.links(), store.health()]);
+      const result = [];
+      const stale = [];
+      for (const provider of providers.values()) {
+        const link = links.find(l => l.id === provider.id);
+        const h = health.get(provider.id);
+        const unreachable = !!h && (h.hardFailureAt !== null || h.failingSince !== null && now - h.failingSince >= HIDE_AFTER_MS);
+        if (unreachable && now - h.checkedAt >= PROBE_EVERY_MS) stale.push(provider);
+        // Where the start route sends the browser: a form posting there needs it in form-action.
+        const authorizationOrigins = link ? [new URL(link.authorization).origin] : [...provider.endpointOrigins];
+        result.push({ id: provider.id, label: provider.label, preset: provider.preset, startPath: provider.startPath, authorizationOrigins,
+          visible: link?.status !== 'unlinked' && !unreachable, linked: link?.status === 'linked', pendingRelink: !!link?.pendingAt });
+      }
+      // A hidden provider is checked again at most once a minute, after the page answers.
+      if (stale.length) { const probes = Promise.all(stale.map(probe)); if (typeof waitUntil === 'function') waitUntil(probes); else await probes; }
+      return result;
+    },
+    /** Owner actions; the caller requires a fresh step-up proof first. */
+    async relink(id) {
+      const provider = providers.get(id);
+      check(provider, 'oidc_unknown_provider', 404);
+      const metadata = await observe(provider, () => discover(fetcher, provider, config));
+      if (await store.link(id)) await store.relink(id, provider, metadata, clock());
+      else await store.pin(id, provider, metadata, clock());
+      return store.link(id);
+    },
+    async unlink(id) {
+      check(providers.has(id), 'oidc_unknown_provider', 404);
+      // Only a pin can be ended; a provider never linked has nothing to unlink.
+      check(await store.link(id), 'oidc_not_linked', 409);
+      await store.unlink(id);
+    },
+    async links() {
+      return (await store.links()).map(({ keySet: _, keysFetchedAt: __, ...link }) => link);
+    },
+  });
+}
+
+// Exact routes only: /auth/oidc/<id>/start and /auth/oidc/<id>/callback.
+export function createOidcHandler(oidc) {
+  return async request => {
+    const path = new URL(request.url).pathname;
+    const callbackId = oidc.callbackPaths?.[path];
+    if (callbackId) return oidc.callback(request, callbackId);
+    const match = /^\/auth\/oidc\/([a-z][a-z0-9-]{0,31})\/(start|callback|logout)$/.exec(path);
+    if (!match || !oidc.ids.includes(match[1])) return null;
+    if (match[2] === 'logout') return oidc.logout?.(request) ?? new Response(null,{status:404});
+    if (match[2] === 'callback') return oidc.callbackPaths ? null : oidc.callback(request, match[1]);
+    try {
+      check(request.method === 'POST', 'oidc_method_not_allowed', 405);
+      const type = (request.headers.get('content-type') ?? '').split(';')[0].trim().toLowerCase();
+      check(type === 'application/x-www-form-urlencoded' || type === 'application/json', 'oidc_unsupported_media_type', 415);
+      // Read a bounded stream, never unbounded request.json()/formData().
+      const reader = request.body?.getReader(); let bytes = 0; const chunks = [];
+      if (reader) { try { while (true) { const { done, value } = await reader.read(); if (done) break; bytes += value.length; check(bytes <= 4096, 'oidc_input_too_large', 413); chunks.push(value); } } finally { void reader.cancel().catch(() => {}); } }
+      const all = new Uint8Array(bytes); let offset = 0; for (const chunk of chunks) { all.set(chunk, offset); offset += chunk.length; }
+      const text = new TextDecoder('utf-8', { fatal: true }).decode(all);
+      let input;
+      if (type === 'application/json') input = JSON.parse(text);
+      else { const form = new URLSearchParams(text); check(form.getAll('returnTo').length <= 1); input = { returnTo: form.get('returnTo') ?? undefined }; }
+      check(input && typeof input === 'object' && !Array.isArray(input));
+      return oidc.begin(request, match[1], { returnTo: input.returnTo });
+    } catch (e) { return Response.json({ error: e instanceof OidcError ? e.code : 'oidc_invalid_input' }, { status: e instanceof OidcError ? e.status : 400, headers: securityHeaders() }); }
+  };
+}

package/modules/operator-auth/identity/oidc/jwt.mjs

@@ -0,0 +1,102 @@
+import { check } from './errors.mjs';
+import { decode, encode, utf8 } from './crypto.mjs';
+
+function object(part) {
+  const value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(decode(part)));
+  check(value && typeof value === 'object' && !Array.isArray(value)); return value;
+}
+
+// Header checks come first, before any key is looked up: the algorithm must be
+// one the link pinned (so never `none`, HS* or anything unlisted).
+export function parseIdToken(token, link, purpose = 'JWT') {
+  check(typeof token === 'string' && token.length < 32768);
+  const parts = token.split('.'); check(parts.length === 3);
+  const [headerPart, bodyPart, signaturePart] = parts;
+  const header = object(headerPart); const claims = object(bodyPart);
+  check(typeof header.alg === 'string' && link.algorithms.includes(header.alg) && (header.typ === undefined || header.typ === purpose), 'oidc_algorithm_refused');
+  check(typeof header.kid === 'string' && header.kid.length > 0 && header.kid.length <= 256);
+  // Neither remote header keys nor critical/alternate payload semantics are used.
+  check(!['crit', 'jku', 'jwk', 'x5u', 'b64', 'zip'].some(k => Object.hasOwn(header, k)));
+  return { header, claims, input: `${headerPart}.${bodyPart}`, signature: signaturePart };
+}
+
+export function knowsKey(jwks, kid) {
+  return Array.isArray(jwks?.keys) && jwks.keys.some(k => k && typeof k === 'object' && k.kid === kid);
+}
+
+export async function verifyIdToken(parsed, jwks, link, provider, settings, transaction, tokens, now) {
+  check(!Object.hasOwn(parsed.claims, 'events'), 'oidc_invalid_id_token');
+  const { header, claims } = parsed;
+  await verifySignature(parsed, jwks);
+  // The token's issuer is the pinned issuer, and its audience is this client.
+  check(claims.iss === link.issuer && typeof claims.sub === 'string' && claims.sub.length > 0 && claims.sub.length <= 255, 'oidc_issuer_mismatch');
+  const audiences = typeof claims.aud === 'string' ? [claims.aud] : claims.aud;
+  check(Array.isArray(audiences) && audiences.length > 0 && audiences.every(a => typeof a === 'string' && a.length > 0) && new Set(audiences).size === audiences.length && audiences.includes(link.clientId), 'oidc_audience_mismatch');
+  check(audiences.every(a => a === link.clientId || provider.additionalAudiences.includes(a)), 'oidc_audience_mismatch');
+  check(audiences.length === 1 || claims.azp === link.clientId, 'oidc_audience_mismatch');
+  check(claims.azp === undefined || claims.azp === link.clientId, 'oidc_audience_mismatch');
+  const time = now / 1000; const skew = settings.clockSkewSeconds;
+  check(Number.isSafeInteger(claims.exp) && Number.isSafeInteger(claims.iat) && claims.exp > claims.iat && claims.exp > time - skew && claims.iat <= time + skew && claims.iat >= time - settings.maxTokenAgeSeconds - skew);
+  check(claims.nbf === undefined || Number.isSafeInteger(claims.nbf) && claims.nbf <= time + skew);
+  check(claims.nonce === transaction.nonce);
+  for (const [claim, value] of [['at_hash', tokens.access_token], ['c_hash', tokens.code]]) {
+    if (claims[claim] !== undefined) {
+      check(typeof value === 'string');
+      const hash = await crypto.subtle.digest('SHA-256', utf8.encode(value));
+      check(claims[claim] === encode(new Uint8Array(hash).slice(0, 16)));
+    }
+  }
+  return claims;
+}
+
+// What a verified token says about the person, under the provider's email
+// trust. A configured subject association replaces the email claim; it is
+// never turned into a fictional verified email.
+export function principalOf(claims, provider) {
+  const base = { emailVerified:claims.email_verified===true, datedEmailRequired: provider.email === 'verified-at', ...(Object.hasOwn(claims,'email_verified_at') ? {emailVerifiedAt:typeof claims.email_verified_at==='number'?claims.email_verified_at*1000:null} : {}), sid: typeof claims.sid === 'string' && claims.sid.length > 0 ? claims.sid : undefined, issuer: provider.issuer, subject: claims.sub, provider: provider.id, ...(Array.isArray(claims.amr) ? { amr: claims.amr.filter(v => typeof v === 'string') } : {}) };
+  if (Object.hasOwn(provider.subjectEmails, claims.sub)) return { ...base, associatedEmail: provider.subjectEmails[claims.sub] };
+  const email = typeof claims.email === 'string' ? claims.email : undefined;
+  if (!email) return base;
+  const domain = email.slice(email.lastIndexOf('@') + 1).toLowerCase();
+  if (provider.email === 'verified-at') {
+    const verified = claims.email_verified === true && Number.isSafeInteger(claims.email_verified_at);
+    return { ...base, email, emailVerified: verified, ...(verified ? { emailVerifiedAt: claims.email_verified_at * 1000 } : {}) };
+  }
+  if (provider.email === 'legacy-verified') {
+    const dated = Object.hasOwn(claims, 'email_verified_at');
+    const validDate = Number.isSafeInteger(claims.email_verified_at) && Number.isSafeInteger(claims.email_verified_at * 1000);
+    return { ...base, email, emailVerified: claims.email_verified === true && (!dated || validDate) };
+  }
+  if (provider.email === 'google') {
+    const dated = Object.hasOwn(claims, 'email_verified_at');
+    const validDate = Number.isSafeInteger(claims.email_verified_at) && Number.isSafeInteger(claims.email_verified_at * 1000);
+    const trusted = claims.email_verified === true && (!dated || validDate) && (domain === 'gmail.com' || typeof claims.hd === 'string' && claims.hd.toLowerCase() === domain);
+    return { ...base, email, emailVerified: trusted, ...(dated && validDate ? { emailVerifiedAt: claims.email_verified_at * 1000 } : {}) };
+  }
+  return { ...base, email, emailVerified: false };
+}
+
+export async function verifySignature(parsed, jwks) {
+  const { header } = parsed;
+  check(Array.isArray(jwks.keys) && jwks.keys.length > 0 && jwks.keys.length <= 100);
+  const candidates = jwks.keys.filter(k => k && typeof k === 'object' && k.kid === header.kid);
+  check(candidates.length === 1);
+  const key = candidates[0];
+  check((key.alg === undefined || key.alg === header.alg) && (key.use === undefined || key.use === 'sig') &&
+    (key.key_ops === undefined || Array.isArray(key.key_ops) && key.key_ops.length === 1 && key.key_ops[0] === 'verify'));
+  check(!['d', 'p', 'q', 'dp', 'dq', 'qi', 'oth', 'k'].some(k => Object.hasOwn(key, k)));
+  let algorithm; let publicKey;
+  if (header.alg === 'RS256') {
+    check(key.kty === 'RSA'); const n = decode(key.n); const e = decode(key.e);
+    check(n.length >= 256 && n.length <= 1024 && n[0] >= 128 && e.length > 0 && e.length <= 4 && e[0] !== 0);
+    const exponent = e.reduce((v, b) => v * 256 + b, 0); check(exponent >= 3 && exponent % 2 === 1);
+    algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' };
+    publicKey = { kty: 'RSA', n: key.n, e: key.e };
+  } else {
+    check(header.alg === 'ES256' && key.kty === 'EC' && key.crv === 'P-256' && decode(key.x).length === 32 && decode(key.y).length === 32 && decode(parsed.signature).length === 64);
+    algorithm = { name: 'ECDSA', namedCurve: 'P-256', hash: 'SHA-256' };
+    publicKey = { kty: 'EC', crv: 'P-256', x: key.x, y: key.y };
+  }
+  const imported = await crypto.subtle.importKey('jwk', publicKey, algorithm, false, ['verify']);
+  check(await crypto.subtle.verify(algorithm, imported, decode(parsed.signature), utf8.encode(parsed.input)));
+}

package/modules/operator-auth/identity/oidc/network.mjs

@@ -0,0 +1,93 @@
+import { check, fail, OidcError } from './errors.mjs';
+import { endpoint } from './config.mjs';
+import { compareVersions, validVersion } from './presets.mjs';
+import { clientAssertion } from './client-auth.mjs';
+
+// A provider failure that hides it at once: the address no longer exists (404)
+// or its name does not resolve (a resolver error, or the 530 a Cloudflare
+// Worker receives for an origin DNS failure).
+export class ProviderUnreachable extends OidcError { constructor() { super('oidc_provider_unavailable', 502); this.hard = true; } }
+const dnsFailure = error => /\b(?:dns|getaddrinfo|enotfound|eai_again|name not resolved|could not resolve)\b/i.test(String(error?.message ?? error));
+
+// The deadline includes stream consumption; redirects never forward credentials.
+export async function readJson(fetcher, uri, settings, init = {}, maxBytes = 65536) {
+  const controller = new AbortController();
+  let timer, hard = false;
+  const deadline = new Promise((_, reject) => { timer = setTimeout(() => { controller.abort(); reject(new Error('deadline')); }, settings.timeoutMs); });
+  let reader;
+  try {
+    return await Promise.race([deadline, (async () => {
+      let response;
+      try { response = await fetcher(uri, { ...init, redirect: 'manual', signal: controller.signal, headers: { Accept: 'application/json', ...init.headers } }); }
+      catch (error) { hard = dnsFailure(error); throw error; }
+      check(response.status < 300 || response.status >= 400, 'oidc_provider_redirect', 502);
+      if (response.status === 404 || response.status === 530) hard = true;
+      check(response.status === 200 && !response.redirected && (!response.url || response.url === uri), 'oidc_provider_unavailable', 502);
+      check(/^application\/(?:[a-z0-9.+-]+\+)?json(?:\s*;|$)/i.test(response.headers.get('content-type') ?? ''), 'oidc_provider_unavailable', 502);
+      const length = response.headers.get('content-length');
+      check(!length || /^\d+$/.test(length) && Number(length) <= maxBytes, 'oidc_provider_unavailable', 502);
+      check(response.body, 'oidc_provider_unavailable', 502);
+      reader = response.body.getReader();
+      let size = 0; const chunks = [];
+      while (true) { const { done, value } = await reader.read(); if (done) break; size += value.byteLength; check(size <= maxBytes, 'oidc_provider_unavailable', 502); chunks.push(value); }
+      const bytes = new Uint8Array(size); let offset = 0;
+      for (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength; }
+      const body = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+      check(body && typeof body === 'object' && !Array.isArray(body), 'oidc_provider_unavailable', 502);
+      return body;
+    })()]);
+  } catch { if (hard) throw new ProviderUnreachable(); fail('oidc_provider_unavailable', 502); }
+  finally { clearTimeout(timer); controller.abort(); if (reader) void reader.cancel().catch(() => {}); }
+}
+
+// Discovery for one provider. The result is what linking pins.
+export async function discover(fetcher, provider, settings) {
+  const d = await readJson(fetcher, `${provider.issuer.replace(/\/$/, '')}/.well-known/openid-configuration`, settings);
+  check(d.issuer === provider.issuer, 'oidc_issuer_mismatch', 502);
+  check(Array.isArray(d.response_types_supported) && d.response_types_supported.includes('code'), 'oidc_provider_unsupported', 502);
+  check(d.response_modes_supported === undefined || Array.isArray(d.response_modes_supported) && d.response_modes_supported.includes('query'), 'oidc_provider_unsupported', 502);
+  check(d.grant_types_supported === undefined || Array.isArray(d.grant_types_supported) && d.grant_types_supported.includes('authorization_code'), 'oidc_provider_unsupported', 502);
+  // Discovery may omit PKCE metadata (Google does). Always send S256 anyway.
+  check(d.code_challenge_methods_supported === undefined || Array.isArray(d.code_challenge_methods_supported) && d.code_challenge_methods_supported.includes('S256'), 'oidc_provider_unsupported', 502);
+  check(Array.isArray(d.id_token_signing_alg_values_supported), 'oidc_provider_unsupported', 502);
+  const algorithms = provider.algorithms.filter(a => d.id_token_signing_alg_values_supported.includes(a));
+  check(algorithms.length > 0, 'oidc_provider_unsupported', 502);
+  const methods = d.token_endpoint_auth_methods_supported ?? ['client_secret_basic'];
+  check(Array.isArray(methods) && methods.includes(provider.tokenAuthMethod), 'oidc_provider_unsupported', 502);
+  if (provider.tokenAuthMethod === 'private_key_jwt') {
+    const signing = d.token_endpoint_auth_signing_alg_values_supported;
+    check(signing === undefined || Array.isArray(signing) && signing.includes(provider.keyAlgorithm), 'oidc_provider_unsupported', 502);
+  }
+  check(d.authorization_response_iss_parameter_supported === undefined || typeof d.authorization_response_iss_parameter_supported === 'boolean', 'oidc_provider_unsupported', 502);
+  let interfaceVersion = null;
+  if (provider.interface) {
+    // An RER provider states the interface versions it serves; one below the
+    // minimum this app needs is refused.
+    const served = Array.isArray(d.rer_interfaces) ? d.rer_interfaces.filter(v => typeof v === 'string' && v.startsWith(`${provider.interface}@`)).map(v => v.slice(provider.interface.length + 1)).filter(validVersion) : [];
+    interfaceVersion = served.sort(compareVersions).at(-1) ?? null;
+    check(interfaceVersion && compareVersions(interfaceVersion, provider.minimumVersion) >= 0, 'oidc_provider_version_unsupported', 502);
+  }
+  if (provider.endpointPins) check(d.authorization_endpoint === provider.endpointPins.authorization && d.token_endpoint === provider.endpointPins.token && d.jwks_uri === provider.endpointPins.jwks, 'oidc_relink_required', 502);
+  return { issuer: d.issuer, authorization: endpoint(d.authorization_endpoint, provider), token: endpoint(d.token_endpoint, provider), jwks: endpoint(d.jwks_uri, provider),
+    algorithms, responseIssuer: d.authorization_response_iss_parameter_supported === true, interfaceVersion };
+}
+
+export async function exchange(fetcher, link, provider, settings, code, verifier, now) {
+  const form = new URLSearchParams({ grant_type: 'authorization_code', code, redirect_uri: provider.redirectUri, client_id: link.clientId, code_verifier: verifier });
+  const headers = { 'Content-Type': 'application/x-www-form-urlencoded' };
+  if (provider.tokenAuthMethod === 'client_secret_post') form.set('client_secret', provider.clientSecret);
+  if (provider.tokenAuthMethod === 'client_secret_basic') {
+    const formEncode = s => new URLSearchParams({ v: s }).toString().slice(2);
+    headers.Authorization = `Basic ${btoa(`${formEncode(link.clientId)}:${formEncode(provider.clientSecret)}`)}`;
+  }
+  if (provider.tokenAuthMethod === 'private_key_jwt') {
+    // No shared secret exists: the app proves itself with a short assertion
+    // signed by its own private key, addressed to the pinned token endpoint.
+    form.set('client_assertion_type', 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer');
+    form.set('client_assertion', await clientAssertion(provider, link, now));
+  }
+  const response = await readJson(fetcher, link.token, settings, { method: 'POST', headers, body: form.toString() });
+  check(!Object.hasOwn(response, 'error') && typeof response.id_token === 'string' && (response.access_token === undefined || typeof response.access_token === 'string' && /^[\x21-\x7e]+$/.test(response.access_token))
+    && (response.token_type === undefined && response.access_token === undefined || typeof response.token_type === 'string' && response.token_type.toLowerCase() === 'bearer'));
+  return response;
+}

package/modules/operator-auth/identity/oidc/presets.mjs

@@ -0,0 +1,26 @@
+// The providers an app can offer. Each preset fixes the signing algorithms its
+// ID tokens may use (never `none` or HS*) and how far its email claim is
+// trusted. GitHub is not an OpenID provider and is not offered.
+//
+// email:
+//   'verified-at'  email_verified with email_verified_at in the last 30 days (Auth)
+//   'google'       email_verified, and only for @gmail.com or tokens carrying hd
+//   'subject'      never by email: only explicit subjectEmails associations
+export const MINIMUM_PROVIDER_VERSION = '1.0.0';
+export const PRESETS = Object.freeze({
+  auth: Object.freeze({ label: 'Auth', algorithms: ['ES256'], methods: ['private_key_jwt'], email: 'verified-at', interface: 'oidc-provider', scope: 'openid email profile' }),
+  google: Object.freeze({ label: 'Google', issuer: 'https://accounts.google.com', algorithms: ['RS256'], methods: ['private_key_jwt', 'client_secret_basic', 'client_secret_post'],
+    email: 'google', endpointOrigins: ['https://accounts.google.com', 'https://oauth2.googleapis.com', 'https://www.googleapis.com'], scope: 'openid email' }),
+  microsoft: Object.freeze({ label: 'Microsoft', tenantIssuer: tenant => `https://login.microsoftonline.com/${tenant}/v2.0`, algorithms: ['RS256'],
+    methods: ['private_key_jwt', 'client_secret_basic', 'client_secret_post'], email: 'subject', endpointOrigins: ['https://login.microsoftonline.com'], scope: 'openid email' }),
+  'legacy-rs256': Object.freeze({ label: 'Company', algorithms: ['RS256'], methods: ['private_key_jwt', 'client_secret_basic', 'client_secret_post'], email: 'legacy-verified', scope: 'openid email' }),
+  okta: Object.freeze({ label: 'Okta', algorithms: ['RS256'], methods: ['private_key_jwt', 'client_secret_basic', 'client_secret_post'], email: 'subject', scope: 'openid email' }),
+});
+
+export function compareVersions(a, b) {
+  const parse = v => v.split('.').map(Number);
+  const [x, y] = [parse(a), parse(b)];
+  for (let i = 0; i < 3; i++) if (x[i] !== y[i]) return x[i] < y[i] ? -1 : 1;
+  return 0;
+}
+export const validVersion = v => typeof v === 'string' && /^(0|[1-9]\d{0,5})\.(0|[1-9]\d{0,5})\.(0|[1-9]\d{0,5})$/.test(v);

package/modules/operator-auth/identity/oidc/schema/oidc.sql

@@ -0,0 +1,50 @@
+-- Identity providers (OpenID Connect). Apply as a NEW numbered migration after
+-- the accounts schema. Every statement is IF NOT EXISTS, so a store that applied
+-- an earlier version of this file applies the current one again as its next
+-- migration and gains only what it lacks.
+CREATE TABLE IF NOT EXISTS oa_oidc_transactions (
+  state_hash TEXT PRIMARY KEY,
+  binding_hash TEXT NOT NULL,
+  config_hash TEXT NOT NULL,
+  payload TEXT NOT NULL,
+  expires_at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS oa_oidc_transactions_expiry ON oa_oidc_transactions(expires_at);
+CREATE TABLE IF NOT EXISTS oa_oidc_limits (
+  bucket TEXT PRIMARY KEY,
+  count INTEGER NOT NULL,
+  expires_at INTEGER NOT NULL
+);
+-- One pinned link per configured provider. Linking stores the issuer, JWKS URI,
+-- client id, endpoints and allowed algorithms; a changed configuration only
+-- records a pending re-link, which the owner completes with a step-up proof.
+CREATE TABLE IF NOT EXISTS oa_identity_providers (
+  provider_id TEXT PRIMARY KEY,
+  preset TEXT NOT NULL,
+  status TEXT NOT NULL CHECK(status IN ('linked','unlinked')),
+  issuer TEXT NOT NULL,
+  client_id TEXT NOT NULL,
+  jwks_uri TEXT NOT NULL,
+  authorization_endpoint TEXT NOT NULL,
+  token_endpoint TEXT NOT NULL,
+  algorithms TEXT NOT NULL,
+  token_auth_method TEXT NOT NULL,
+  response_iss INTEGER NOT NULL,
+  interface_version TEXT,
+  linked_at INTEGER NOT NULL,
+  pending_issuer TEXT,
+  pending_client_id TEXT,
+  pending_preset TEXT,
+  pending_at INTEGER,
+  jwks TEXT,
+  jwks_fetched_at INTEGER
+);
+-- Reachability per configured provider, linked or not. A provider that has
+-- failed discovery or JWKS for 5 minutes, or answered 404 or a DNS failure, is
+-- hidden from the sign-in page until a later check succeeds.
+CREATE TABLE IF NOT EXISTS oa_identity_provider_health (
+  provider_id TEXT PRIMARY KEY,
+  failing_since INTEGER,
+  hard_failure_at INTEGER,
+  checked_at INTEGER NOT NULL
+);

package/modules/operator-auth/identity/oidc/store.mjs

@@ -0,0 +1,68 @@
+import { check, fail } from './errors.mjs';
+
+const linkColumns = `provider_id AS id, preset, status, issuer, client_id AS clientId, jwks_uri AS jwks, authorization_endpoint AS authorization, token_endpoint AS token,
+  algorithms, token_auth_method AS tokenAuthMethod, response_iss AS responseIssuer, interface_version AS interfaceVersion, linked_at AS linkedAt,
+  pending_issuer AS pendingIssuer, pending_client_id AS pendingClientId, pending_preset AS pendingPreset, pending_at AS pendingAt,
+  jwks AS keySet, jwks_fetched_at AS keysFetchedAt`;
+function link(row) {
+  if (!row) return null;
+  return { ...row, algorithms: JSON.parse(row.algorithms), responseIssuer: row.responseIssuer === 1, keySet: row.keySet ? JSON.parse(row.keySet) : null };
+}
+
+export function storage(db) {
+  const guarded = async operation => { try { return await operation(); } catch { fail('oidc_storage_unavailable', 503); } };
+  return {
+    async limit(bucket, expiresAt, maximum) {
+      try {
+        const row = await db.prepare('INSERT INTO oa_oidc_limits (bucket,count,expires_at) VALUES (?,1,?) ON CONFLICT(bucket) DO UPDATE SET count=count+1 RETURNING count').bind(bucket, expiresAt).first();
+        check(row && row.count <= maximum, 'oidc_rate_limited', 429);
+      } catch (e) { if (e.code === 'oidc_rate_limited') throw e; fail('oidc_storage_unavailable', 503); }
+    },
+    put(row) {
+      return guarded(() => db.prepare('INSERT INTO oa_oidc_transactions (state_hash,binding_hash,config_hash,payload,expires_at) VALUES (?,?,?,?,?)').bind(row.stateHash, row.bindingHash, row.configHash, row.payload, row.expiresAt).run());
+    },
+    consume(stateHash, bindingHash, configHash, now) {
+      return guarded(() => db.prepare('DELETE FROM oa_oidc_transactions WHERE state_hash=? AND binding_hash=? AND config_hash=? AND expires_at>? RETURNING payload').bind(stateHash, bindingHash, configHash, now).first());
+    },
+    async links() { return guarded(async () => (await db.prepare(`SELECT ${linkColumns} FROM oa_identity_providers`).all()).results.map(link)); },
+    async link(id) { return guarded(async () => link(await db.prepare(`SELECT ${linkColumns} FROM oa_identity_providers WHERE provider_id=?`).bind(id).first())); },
+    // The first link only: an existing row, linked or unlinked, is never replaced here.
+    async pin(id, provider, metadata, now) {
+      return guarded(async () => {
+        await db.prepare(`INSERT INTO oa_identity_providers(provider_id,preset,status,issuer,client_id,jwks_uri,authorization_endpoint,token_endpoint,algorithms,token_auth_method,response_iss,interface_version,linked_at)
+          VALUES(?,?,'linked',?,?,?,?,?,?,?,?,?,?) ON CONFLICT(provider_id) DO NOTHING`).bind(id, provider.preset, metadata.issuer, provider.clientId, metadata.jwks, metadata.authorization, metadata.token,
+          JSON.stringify(metadata.algorithms), provider.tokenAuthMethod, metadata.responseIssuer ? 1 : 0, metadata.interfaceVersion, now).run();
+        return link(await db.prepare(`SELECT ${linkColumns} FROM oa_identity_providers WHERE provider_id=?`).bind(id).first());
+      });
+    },
+    // A re-link the owner approved: the configured provider replaces the pin.
+    async relink(id, provider, metadata, now) {
+      return guarded(() => db.prepare(`UPDATE oa_identity_providers SET preset=?,status='linked',issuer=?,client_id=?,jwks_uri=?,authorization_endpoint=?,token_endpoint=?,algorithms=?,token_auth_method=?,
+        response_iss=?,interface_version=?,linked_at=MAX(linked_at+1,?),pending_issuer=NULL,pending_client_id=NULL,pending_preset=NULL,pending_at=NULL,jwks=NULL,jwks_fetched_at=NULL
+        WHERE provider_id=?`).bind(provider.preset, metadata.issuer, provider.clientId, metadata.jwks, metadata.authorization, metadata.token, JSON.stringify(metadata.algorithms), provider.tokenAuthMethod,
+        metadata.responseIssuer ? 1 : 0, metadata.interfaceVersion, now, id).run());
+    },
+    // A changed configuration only records what a re-link would pin.
+    pending(id, provider, now) {
+      return guarded(() => db.prepare(`UPDATE oa_identity_providers SET pending_issuer=?,pending_client_id=?,pending_preset=?,pending_at=COALESCE(pending_at,?)
+        WHERE provider_id=? AND (pending_issuer IS NOT ? OR pending_client_id IS NOT ? OR pending_preset IS NOT ?)`).bind(provider.issuer, provider.clientId, provider.preset, now, id, provider.issuer, provider.clientId, provider.preset).run());
+    },
+    clearPending(id) { return guarded(() => db.prepare('UPDATE oa_identity_providers SET pending_issuer=NULL,pending_client_id=NULL,pending_preset=NULL,pending_at=NULL WHERE provider_id=?').bind(id).run()); },
+    unlink(id) { return guarded(() => db.prepare("UPDATE oa_identity_providers SET status='unlinked' WHERE provider_id=?").bind(id).run()); },
+    keys(pin, keySet, now) {
+      return guarded(() => db.prepare("UPDATE oa_identity_providers SET jwks=?,jwks_fetched_at=? WHERE provider_id=? AND status='linked' AND issuer=? AND client_id=? AND linked_at=?").bind(JSON.stringify(keySet), now, pin.id, pin.issuer, pin.clientId, pin.linkedAt).run());
+    },
+    async health() {
+      return guarded(async () => new Map((await db.prepare('SELECT provider_id AS id,failing_since AS failingSince,hard_failure_at AS hardFailureAt,checked_at AS checkedAt FROM oa_identity_provider_health').all()).results.map(r => [r.id, r])));
+    },
+    healthy(id, now) {
+      return guarded(() => db.prepare(`INSERT INTO oa_identity_provider_health(provider_id,failing_since,hard_failure_at,checked_at) VALUES(?,NULL,NULL,?)
+        ON CONFLICT(provider_id) DO UPDATE SET failing_since=NULL,hard_failure_at=NULL,checked_at=excluded.checked_at`).bind(id, now).run());
+    },
+    failing(id, hard, now) {
+      return guarded(() => db.prepare(`INSERT INTO oa_identity_provider_health(provider_id,failing_since,hard_failure_at,checked_at) VALUES(?,?,?,?)
+        ON CONFLICT(provider_id) DO UPDATE SET failing_since=COALESCE(failing_since,excluded.failing_since),hard_failure_at=COALESCE(excluded.hard_failure_at,hard_failure_at),checked_at=excluded.checked_at`)
+        .bind(id, now, hard ? now : null, now).run());
+    },
+  };
+}