@schemavaults/auth-common 0.23.0 → 0.24.0

package/dist/oidc/index.d.ts

@@ -2,3 +2,4 @@ export { OIDC_OPENID_SCOPE, OIDC_SUPPORTED_SCOPES, DEFAULT_AUTH_SCOPE, OIDC_SCOP
 export type { OidcSupportedScope, OidcScope, ParsedOidcScopes, } from "./scope";
 export { oidcNonceSchema, OIDC_NONCE_VSCHAR_REGEX, parseOidcNonce, OidcNonceValidationError, } from "./nonce";
 export type { OidcNonce } from "./nonce";
+export { OIDC_SUB_CLAIM_DELIMITER, formatOidcSubClaim, parseOidcSubClaim, } from "./sub-claim";

package/dist/oidc/index.js

@@ -1,3 +1,4 @@
 export { OIDC_OPENID_SCOPE, OIDC_SUPPORTED_SCOPES, DEFAULT_AUTH_SCOPE, OIDC_SCOPE_REGEX, oidcScopeSchema, parseAndGrantScopes, serializeOidcScopes, } from "./scope";
 export { oidcNonceSchema, OIDC_NONCE_VSCHAR_REGEX, parseOidcNonce, OidcNonceValidationError, } from "./nonce";
+export { OIDC_SUB_CLAIM_DELIMITER, formatOidcSubClaim, parseOidcSubClaim, } from "./sub-claim";
 //# sourceMappingURL=index.js.map

package/dist/oidc/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oidc/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,SAAS,CAAC;AAOjB,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,cAAc,EACd,wBAAwB,GACzB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oidc/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,SAAS,CAAC;AAOjB,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,cAAc,EACd,wBAAwB,GACzB,MAAM,SAAS,CAAC;AAGjB,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,aAAa,CAAC"}

package/dist/oidc/sub-claim.d.ts

@@ -0,0 +1,21 @@
+import { type AppId } from "@schemavaults/app-definitions";
+export declare const OIDC_SUB_CLAIM_DELIMITER: "|";
+/**
+ * Builds the OIDC-facing `sub` claim for a platform user:
+ * `<auth_server_app_id>|<uid>`. The auth server app id is stable per
+ * deployment, so the resulting subject is stable for the lifetime of
+ * the user (OIDC Core §2: `sub` must be locally unique and never
+ * reassigned within the issuer).
+ */
+export declare function formatOidcSubClaim(auth_server_app_id: AppId | string, uid: string): string;
+/**
+ * Splits an OIDC-facing `sub` claim back into the issuing deployment's
+ * app id and the platform user id. Returns `null` for values not in the
+ * `<app_id>|<uid>` shape (e.g. subjects issued by other providers).
+ * Only the FIRST delimiter splits — the uid keeps any later characters
+ * verbatim.
+ */
+export declare function parseOidcSubClaim(sub: string): {
+    auth_server_app_id: AppId;
+    uid: string;
+} | null;

package/dist/oidc/sub-claim.js

@@ -0,0 +1,57 @@
+import { appIdSchema } from "@schemavaults/app-definitions";
+// The OIDC-facing `sub` claim namespaces the platform user id with the
+// deployment's own app id (SCHEMAVAULTS_AUTH_SERVER_APP_ID), Auth0-style:
+// `<auth_server_app_id>|<uid>` (e.g. "schemavaults-auth|4f7c…"). The
+// prefix marks which auth deployment a subject came from, so RPs that
+// aggregate identities from several issuers / white-label deployments
+// can't collide or confuse them. It applies ONLY at the OIDC boundary —
+// the id_token, /api/oidc/userinfo, and RFC 7662 introspection, which
+// OIDC Core §5.3.2 requires to agree exactly — never inside the
+// platform's own encrypted access/refresh token payloads, whose
+// `sub === uid` invariant (payload_data.ts) resource servers rely on.
+// The app id charset ([a-z0-9_-]) can never contain the delimiter, so
+// the encoding is unambiguous.
+export const OIDC_SUB_CLAIM_DELIMITER = "|";
+/**
+ * Builds the OIDC-facing `sub` claim for a platform user:
+ * `<auth_server_app_id>|<uid>`. The auth server app id is stable per
+ * deployment, so the resulting subject is stable for the lifetime of
+ * the user (OIDC Core §2: `sub` must be locally unique and never
+ * reassigned within the issuer).
+ */
+export function formatOidcSubClaim(auth_server_app_id, uid) {
+    const app_id = appIdSchema.safeParse(auth_server_app_id);
+    if (!app_id.success) {
+        throw new TypeError("Invalid auth server app id for OIDC 'sub' claim prefix!", { cause: app_id.error });
+    }
+    if (typeof uid !== "string" || uid.length === 0) {
+        throw new TypeError("A user id is required to build an OIDC 'sub' claim!");
+    }
+    return `${app_id.data}${OIDC_SUB_CLAIM_DELIMITER}${uid}`;
+}
+/**
+ * Splits an OIDC-facing `sub` claim back into the issuing deployment's
+ * app id and the platform user id. Returns `null` for values not in the
+ * `<app_id>|<uid>` shape (e.g. subjects issued by other providers).
+ * Only the FIRST delimiter splits — the uid keeps any later characters
+ * verbatim.
+ */
+export function parseOidcSubClaim(sub) {
+    if (typeof sub !== "string") {
+        return null;
+    }
+    const delimiter_index = sub.indexOf(OIDC_SUB_CLAIM_DELIMITER);
+    if (delimiter_index <= 0) {
+        return null;
+    }
+    const app_id = appIdSchema.safeParse(sub.slice(0, delimiter_index));
+    if (!app_id.success) {
+        return null;
+    }
+    const uid = sub.slice(delimiter_index + OIDC_SUB_CLAIM_DELIMITER.length);
+    if (uid.length === 0) {
+        return null;
+    }
+    return { auth_server_app_id: app_id.data, uid };
+}
+//# sourceMappingURL=sub-claim.js.map

package/dist/oidc/sub-claim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sub-claim.js","sourceRoot":"","sources":["../../src/oidc/sub-claim.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAc,MAAM,+BAA+B,CAAC;AAExE,uEAAuE;AACvE,0EAA0E;AAC1E,qEAAqE;AACrE,sEAAsE;AACtE,sEAAsE;AACtE,wEAAwE;AACxE,sEAAsE;AACtE,gEAAgE;AAChE,gEAAgE;AAChE,sEAAsE;AACtE,sEAAsE;AACtE,+BAA+B;AAE/B,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAY,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,kBAAkC,EAClC,GAAW;IAEX,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,SAAS,CACjB,yDAAyD,EACzD,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CACxB,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,GAAG,MAAM,CAAC,IAAI,GAAG,wBAAwB,GAAG,GAAG,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAW;IAEX,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC9D,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,eAAe,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,kBAAkB,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC;AAClD,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@schemavaults/auth-common",
   "description": "Types and utility functions for authentication and authorization",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "license": "UNLICENSED",
   "private": false,
   "repository": {