@seamless-auth/oidc-provider 0.0.0-stage → 0.1.0

package/dist/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,MAAM,aAAa,GAAG,CAAC;KACpB,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACvB,OAAO,CAAC,OAAO,CAAC;KAChB,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC;AAE1C,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7D,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,mBAAmB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC9D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACzD,gBAAgB,EAAE,CAAC;SAChB,MAAM,EAAE;SACR,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK;SACF,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;SACxB,MAAM,CAAC,OAAO,CAAC,CACnB;SACA,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1D,WAAW,EAAE,aAAa;CAC3B,CAAC,CAAC;AAIH,MAAM,UAAU,QAAQ,CAAC,SAA4B,OAAO,CAAC,GAAG;IAC9D,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,18 @@
+import type { OidcSignRefusalCode } from '@seamless-auth/types';
+export declare class OidcApiError extends Error {
+    readonly status: number;
+    readonly path: string;
+    constructor(status: number, path: string, message?: string);
+}
+export declare class OidcSignRefusedError extends Error {
+    readonly code: OidcSignRefusalCode;
+    constructor(code: OidcSignRefusalCode, message?: string);
+}
+export declare class OidcProviderDisabledError extends Error {
+    constructor();
+}
+export declare class OidcContractMismatchError extends Error {
+    readonly apiVersion: number;
+    readonly edgeVersion: number;
+    constructor(apiVersion: number, edgeVersion: number);
+}

package/dist/errors.js

@@ -0,0 +1,40 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+export class OidcApiError extends Error {
+    status;
+    path;
+    constructor(status, path, message = `Seamless Auth API answered ${status} for ${path}`) {
+        super(message);
+        this.status = status;
+        this.path = path;
+        this.name = 'OidcApiError';
+    }
+}
+export class OidcSignRefusedError extends Error {
+    code;
+    constructor(code, message = `Seamless Auth API refused to sign: ${code}`) {
+        super(message);
+        this.code = code;
+        this.name = 'OidcSignRefusedError';
+    }
+}
+export class OidcProviderDisabledError extends Error {
+    constructor() {
+        super('The Seamless Auth API has the OpenID Provider disabled (oidc_provider_enabled is off)');
+        this.name = 'OidcProviderDisabledError';
+    }
+}
+export class OidcContractMismatchError extends Error {
+    apiVersion;
+    edgeVersion;
+    constructor(apiVersion, edgeVersion) {
+        super(`The Seamless Auth API speaks /oidc contract version ${apiVersion}, this service speaks ${edgeVersion}`);
+        this.apiVersion = apiVersion;
+        this.edgeVersion = edgeVersion;
+        this.name = 'OidcContractMismatchError';
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,OAAO,YAAa,SAAQ,KAAK;IAE1B;IACA;IAFX,YACW,MAAc,EACd,IAAY,EACrB,OAAO,GAAG,8BAA8B,MAAM,QAAQ,IAAI,EAAE;QAE5D,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAIrB,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAElC;IADX,YACW,IAAyB,EAClC,OAAO,GAAG,sCAAsC,IAAI,EAAE;QAEtD,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAqB;QAIlC,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD;QACE,KAAK,CAAC,uFAAuF,CAAC,CAAC;QAC/F,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAEvC;IACA;IAFX,YACW,UAAkB,EAClB,WAAmB;QAE5B,KAAK,CACH,uDAAuD,UAAU,yBAAyB,WAAW,EAAE,CACxG,CAAC;QALO,eAAU,GAAV,UAAU,CAAQ;QAClB,gBAAW,GAAX,WAAW,CAAQ;QAK5B,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF"}

package/dist/firstPartySession.d.ts

@@ -0,0 +1,21 @@
+export interface FirstPartySession {
+    userId: string;
+    sessionId: string;
+}
+export interface FirstPartySessionRejection {
+    status: number;
+    error: string;
+}
+export type FirstPartySessionResult = {
+    session: FirstPartySession;
+    rejection?: undefined;
+} | {
+    session?: undefined;
+    rejection: FirstPartySessionRejection;
+};
+/**
+ * Reads the first-party session the hosted pages signed in through this service's adapter.
+ * A recovery session is refused here, as it is on every first-party route that is not
+ * enrollment, so it can never finish a provider sign-in.
+ */
+export declare function readFirstPartySession(cookie: string | undefined, cookieSecret: string): FirstPartySessionResult;

package/dist/firstPartySession.js

@@ -0,0 +1,28 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+import { authenticateCookie, verifyCookieJwt } from '@seamless-auth/core';
+/**
+ * Reads the first-party session the hosted pages signed in through this service's adapter.
+ * A recovery session is refused here, as it is on every first-party route that is not
+ * enrollment, so it can never finish a provider sign-in.
+ */
+export function readFirstPartySession(cookie, cookieSecret) {
+    const { user, rejection } = authenticateCookie({ token: cookie, cookieSecret });
+    if (rejection || !user || !cookie) {
+        return {
+            rejection: {
+                status: rejection?.status ?? 401,
+                error: rejection?.errorCode === 'enrollment_required' ? 'enrollment_required' : 'login_required',
+            },
+        };
+    }
+    const payload = verifyCookieJwt(cookie, cookieSecret);
+    if (typeof payload?.sessionId !== 'string' || !payload.sessionId) {
+        return { rejection: { status: 401, error: 'login_required' } };
+    }
+    return { session: { userId: user.id, sessionId: payload.sessionId } };
+}
+//# sourceMappingURL=firstPartySession.js.map

package/dist/firstPartySession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firstPartySession.js","sourceRoot":"","sources":["../src/firstPartySession.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAgB1E;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAA0B,EAC1B,YAAoB;IAEpB,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IAChF,IAAI,SAAS,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAClC,OAAO;YACL,SAAS,EAAE;gBACT,MAAM,EAAE,SAAS,EAAE,MAAM,IAAI,GAAG;gBAChC,KAAK,EACH,SAAS,EAAE,SAAS,KAAK,qBAAqB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,gBAAgB;aAC5F;SACF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,eAAe,CAA0B,MAAM,EAAE,YAAY,CAAC,CAAC;IAC/E,IAAI,OAAO,OAAO,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACjE,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;AACxE,CAAC"}

package/dist/hostedPages.d.ts

@@ -0,0 +1,51 @@
+import type { HostedUi } from '@seamless-auth/types';
+import { type Router } from 'express';
+import type { EdgeConfigCache } from './configCache.js';
+/**
+ * Paths the SPA renders. The adapter's bundled screens (`@seamless-auth/react` AuthRoutes)
+ * own most of them, and the API builds magic link and recovery URLs from some.
+ */
+export declare const HOSTED_PAGE_PATHS: readonly ["/", "/interaction/:uid", "/login", "/passkey-login", "/verify-phone-otp", "/verify-email-otp", "/verify-magiclink", "/oauth/callback", "/register-passkey", "/magic-link-sent", "/recovery-code", "/recovery-codes", "/account-recovery", "/recovery/cancel"];
+export interface HostedBranding {
+    appName: string;
+    logoUrl?: string;
+}
+export interface HostedPagesOptions {
+    /** The built SPA: `index.html` and its `assets/`. */
+    uiDir: string;
+    configCache: EdgeConfigCache;
+}
+/** JSON for an inline `<script type="application/json">`, safe against `</script>`. */
+export declare function inlineJson(value: unknown): string;
+/**
+ * ADR D7's CSP. The bundled screens inject their CSS at runtime, so injected `<style>`
+ * elements take the response's nonce (see `ui/src/nonce.ts`). Scripts stay `'self'` only.
+ */
+export declare function contentSecurityPolicy(nonce: string, logoUrl?: string, formActions?: readonly string[]): string;
+export interface BrandingStyle {
+    css: string;
+    /** Set when the branding has colors, which turns off the stylesheet's dark palette. */
+    palette: boolean;
+}
+/**
+ * `hosted_ui` as CSS variables. The API and this service's config client both validate it
+ * against `HostedUiSchema`, which only admits hex colors and plain font names.
+ */
+export declare function brandingStyle(hostedUi: HostedUi | undefined): BrandingStyle | undefined;
+export declare function brandingFor(appName: string, hostedUi: HostedUi | undefined): HostedBranding;
+/** A page the provider renders itself (logout, device flow), handed to the SPA as data. */
+export type HostedPageData = Record<string, unknown> & {
+    view: string;
+};
+export declare function renderIndex(template: string, branding: HostedBranding, nonce: string, style?: BrandingStyle, page?: HostedPageData): string;
+export interface RenderedPage {
+    html: string;
+    headers: Record<string, string>;
+}
+export type HostedPageRenderer = (page?: HostedPageData, formActions?: readonly string[]) => Promise<RenderedPage>;
+export declare function createHostedPageRenderer(options: HostedPagesOptions): HostedPageRenderer;
+/**
+ * Serves the hosted login and consent pages. Branding is read from the API's config on each
+ * page load and written into `index.html`, so changing it is a config write, never a build.
+ */
+export declare function createHostedPagesRouter(options: HostedPagesOptions, render?: HostedPageRenderer): Router;

package/dist/hostedPages.js

@@ -0,0 +1,172 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+import { randomBytes } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import express from 'express';
+/**
+ * Paths the SPA renders. The adapter's bundled screens (`@seamless-auth/react` AuthRoutes)
+ * own most of them, and the API builds magic link and recovery URLs from some.
+ */
+export const HOSTED_PAGE_PATHS = [
+    '/',
+    '/interaction/:uid',
+    '/login',
+    '/passkey-login',
+    '/verify-phone-otp',
+    '/verify-email-otp',
+    '/verify-magiclink',
+    '/oauth/callback',
+    '/register-passkey',
+    '/magic-link-sent',
+    '/recovery-code',
+    '/recovery-codes',
+    '/account-recovery',
+    '/recovery/cancel',
+];
+const HEAD_PLACEHOLDER = '<!--seamless:head-->';
+const COLOR_VARIABLES = {
+    primary: '--seamless-color-primary',
+    onPrimary: '--seamless-color-on-primary',
+    background: '--seamless-color-background',
+    surface: '--seamless-color-surface',
+    text: '--seamless-color-text',
+    muted: '--seamless-color-muted',
+};
+/** JSON for an inline `<script type="application/json">`, safe against `</script>`. */
+export function inlineJson(value) {
+    return JSON.stringify(value)
+        .replace(/</g, '\\u003c')
+        .replace(/>/g, '\\u003e')
+        .replace(/&/g, '\\u0026')
+        .replace(/\u2028/g, '\\u2028')
+        .replace(/\u2029/g, '\\u2029');
+}
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+/**
+ * ADR D7's CSP. The bundled screens inject their CSS at runtime, so injected `<style>`
+ * elements take the response's nonce (see `ui/src/nonce.ts`). Scripts stay `'self'` only.
+ */
+export function contentSecurityPolicy(nonce, logoUrl, formActions = []) {
+    const logoOrigin = logoUrl ? ` ${new URL(logoUrl).origin}` : '';
+    // Browsers apply form-action to the redirects that follow a submission, so a form that
+    // ends at an app's post-logout URI has to name that origin.
+    const formOrigins = formActions.map((uri) => ` ${new URL(uri).origin}`).join('');
+    return [
+        "default-src 'none'",
+        "script-src 'self'",
+        `style-src 'self' 'nonce-${nonce}'`,
+        `img-src 'self' data:${logoOrigin}`,
+        "font-src 'self'",
+        "connect-src 'self'",
+        "manifest-src 'self'",
+        `form-action 'self'${formOrigins}`,
+        "frame-ancestors 'none'",
+        "base-uri 'none'",
+    ].join('; ');
+}
+/**
+ * `hosted_ui` as CSS variables. The API and this service's config client both validate it
+ * against `HostedUiSchema`, which only admits hex colors and plain font names.
+ */
+export function brandingStyle(hostedUi) {
+    const declarations = [];
+    for (const [key, variable] of Object.entries(COLOR_VARIABLES)) {
+        const value = hostedUi?.colors?.[key];
+        if (value) {
+            declarations.push(`${variable}:${value}`);
+        }
+    }
+    const palette = declarations.length > 0;
+    if (palette) {
+        declarations.push('color-scheme:light');
+    }
+    if (hostedUi?.fontFamily) {
+        declarations.push(`--seamless-font-family:${hostedUi.fontFamily}`);
+    }
+    return declarations.length > 0
+        ? { css: `:root:root{${declarations.join(';')}}`, palette }
+        : undefined;
+}
+export function brandingFor(appName, hostedUi) {
+    return {
+        appName: hostedUi?.appName ?? appName,
+        ...(hostedUi?.logoUrl ? { logoUrl: hostedUi.logoUrl } : {}),
+    };
+}
+export function renderIndex(template, branding, nonce, style, page) {
+    const head = [
+        `<meta name="seamless-csp-nonce" content="${nonce}" />`,
+        `<title>Sign in to ${escapeHtml(branding.appName)}</title>`,
+        `<script type="application/json" id="seamless-hosted">${inlineJson(branding)}</script>`,
+        ...(page
+            ? [`<script type="application/json" id="seamless-page">${inlineJson(page)}</script>`]
+            : []),
+        ...(style
+            ? [
+                `<style nonce="${nonce}"${style.palette ? ' id="seamless-palette"' : ''}>${style.css}</style>`,
+            ]
+            : []),
+    ].join('\n    ');
+    return template.replace(HEAD_PLACEHOLDER, head);
+}
+function pageHeaders(nonce, logoUrl, formActions) {
+    return {
+        'content-security-policy': contentSecurityPolicy(nonce, logoUrl, formActions),
+        'cache-control': 'no-store',
+        'cross-origin-opener-policy': 'same-origin',
+        'referrer-policy': 'no-referrer',
+        'x-content-type-options': 'nosniff',
+        'x-frame-options': 'DENY',
+    };
+}
+export function createHostedPageRenderer(options) {
+    const template = readFileSync(join(options.uiDir, 'index.html'), 'utf8');
+    if (!template.includes(HEAD_PLACEHOLDER)) {
+        throw new Error(`${options.uiDir}/index.html has no ${HEAD_PLACEHOLDER} placeholder`);
+    }
+    return async (page, formActions) => {
+        const config = await options.configCache.get();
+        const nonce = randomBytes(16).toString('base64');
+        const branding = brandingFor(config.appName, config.hostedUi);
+        return {
+            html: renderIndex(template, branding, nonce, brandingStyle(config.hostedUi), page),
+            headers: pageHeaders(nonce, branding.logoUrl, formActions),
+        };
+    };
+}
+/**
+ * Serves the hosted login and consent pages. Branding is read from the API's config on each
+ * page load and written into `index.html`, so changing it is a config write, never a build.
+ */
+export function createHostedPagesRouter(options, render = createHostedPageRenderer(options)) {
+    const router = express.Router();
+    router.use('/assets', express.static(join(options.uiDir, 'assets'), {
+        fallthrough: false,
+        immutable: true,
+        maxAge: '365d',
+        index: false,
+        setHeaders: (res) => {
+            res.setHeader('x-content-type-options', 'nosniff');
+        },
+    }));
+    router.get([...HOSTED_PAGE_PATHS], (_req, res, next) => {
+        render()
+            .then(({ html, headers }) => {
+            res.set(headers).type('html').send(html);
+        })
+            .catch(next);
+    });
+    return router;
+}
+//# sourceMappingURL=hostedPages.js.map

package/dist/hostedPages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostedPages.js","sourceRoot":"","sources":["../src/hostedPages.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,OAAwB,MAAM,SAAS,CAAC;AAI/C;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,GAAG;IACH,mBAAmB;IACnB,QAAQ;IACR,gBAAgB;IAChB,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,iBAAiB;IACjB,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,iBAAiB;IACjB,mBAAmB;IACnB,kBAAkB;CACV,CAAC;AAEX,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAOhD,MAAM,eAAe,GAAG;IACtB,OAAO,EAAE,0BAA0B;IACnC,SAAS,EAAE,6BAA6B;IACxC,UAAU,EAAE,6BAA6B;IACzC,OAAO,EAAE,0BAA0B;IACnC,IAAI,EAAE,uBAAuB;IAC7B,KAAK,EAAE,wBAAwB;CACvB,CAAC;AAQX,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SACzB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC;SAC7B,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAa,EACb,OAAgB,EAChB,cAAiC,EAAE;IAEnC,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,uFAAuF;IACvF,4DAA4D;IAC5D,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,OAAO;QACL,oBAAoB;QACpB,mBAAmB;QACnB,2BAA2B,KAAK,GAAG;QACnC,uBAAuB,UAAU,EAAE;QACnC,iBAAiB;QACjB,oBAAoB;QACpB,qBAAqB;QACrB,qBAAqB,WAAW,EAAE;QAClC,wBAAwB;QACxB,iBAAiB;KAClB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,QAA8B;IAC1D,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,QAAQ,EAAE,MAAM,EAAE,CAAC,GAAmC,CAAC,CAAC;QACtE,IAAI,KAAK,EAAE,CAAC;YACV,YAAY,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IACxC,IAAI,OAAO,EAAE,CAAC;QACZ,YAAY,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,QAAQ,EAAE,UAAU,EAAE,CAAC;QACzB,YAAY,CAAC,IAAI,CAAC,0BAA0B,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,GAAG,CAAC;QAC5B,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE;QAC3D,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,QAA8B;IACzE,OAAO;QACL,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,OAAO;QACrC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC;AAKD,MAAM,UAAU,WAAW,CACzB,QAAgB,EAChB,QAAwB,EACxB,KAAa,EACb,KAAqB,EACrB,IAAqB;IAErB,MAAM,IAAI,GAAG;QACX,4CAA4C,KAAK,MAAM;QACvD,qBAAqB,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU;QAC3D,wDAAwD,UAAU,CAAC,QAAQ,CAAC,WAAW;QACvF,GAAG,CAAC,IAAI;YACN,CAAC,CAAC,CAAC,sDAAsD,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YACrF,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK;YACP,CAAC,CAAC;gBACE,iBAAiB,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,CAAC,GAAG,UAAU;aAC/F;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjB,OAAO,QAAQ,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,OAAgB,EAAE,WAA+B;IACnF,OAAO;QACL,yBAAyB,EAAE,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC;QAC7E,eAAe,EAAE,UAAU;QAC3B,4BAA4B,EAAE,aAAa;QAC3C,iBAAiB,EAAE,aAAa;QAChC,wBAAwB,EAAE,SAAS;QACnC,iBAAiB,EAAE,MAAM;KAC1B,CAAC;AACJ,CAAC;AAYD,MAAM,UAAU,wBAAwB,CAAC,OAA2B;IAClE,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IACzE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,sBAAsB,gBAAgB,cAAc,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9D,OAAO;YACL,IAAI,EAAE,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC;YAClF,OAAO,EAAE,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;SAC3D,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAA2B,EAC3B,SAA6B,wBAAwB,CAAC,OAAO,CAAC;IAE9D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CACR,SAAS,EACT,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE;QAC5C,WAAW,EAAE,KAAK;QAClB,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,KAAK;QACZ,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE;YAClB,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACrD,CAAC;KACF,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACrD,MAAM,EAAE;aACL,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;YAC1B,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC,CAAC;aACD,KAAK,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,20 @@
+export { ApiClientAdapter, ApiPayloadAdapter, createApiAdapterFactory } from './adapter.js';
+export { ReplayDetectedError, UnsupportedModelError } from './adapter.js';
+export type { OidcApiClientOptions } from './apiClient.js';
+export { OidcApiClient, SERVICE_TOKEN_SUBJECT } from './apiClient.js';
+export { EdgeConfigCache } from './configCache.js';
+export type { OidcEdge, OidcEdgeOptions } from './createOidcEdge.js';
+export { ADAPTER_COOKIE_NAMES, createOidcEdge } from './createOidcEdge.js';
+export type { Env } from './env.js';
+export { EnvSchema, parseEnv } from './env.js';
+export { OidcApiError, OidcContractMismatchError, OidcProviderDisabledError, OidcSignRefusedError, } from './errors.js';
+export type { FirstPartySession } from './firstPartySession.js';
+export { readFirstPartySession } from './firstPartySession.js';
+export type { InteractionRouterOptions } from './interactions.js';
+export { createInteractionRouter, FIRST_PARTY_CLIENT_PROPERTY } from './interactions.js';
+export { createSameOriginGuard } from './originGuard.js';
+export { buildProviderConfiguration, loadExistingGrant, PROVIDER_COOKIE_NAMES, } from './providerConfig.js';
+export type { EdgeRequestContext } from './requestContext.js';
+export { adoptSession, bindSession, currentRequestContext, runWithRequestContext, } from './requestContext.js';
+export { ApiSigningKey, classifyToken, signingKeysFrom, UnsignableTokenError, } from './signingKey.js';
+export { checkApiCompatibility } from './startup.js';

package/dist/index.js

@@ -0,0 +1,20 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+export { ApiClientAdapter, ApiPayloadAdapter, createApiAdapterFactory } from './adapter.js';
+export { ReplayDetectedError, UnsupportedModelError } from './adapter.js';
+export { OidcApiClient, SERVICE_TOKEN_SUBJECT } from './apiClient.js';
+export { EdgeConfigCache } from './configCache.js';
+export { ADAPTER_COOKIE_NAMES, createOidcEdge } from './createOidcEdge.js';
+export { EnvSchema, parseEnv } from './env.js';
+export { OidcApiError, OidcContractMismatchError, OidcProviderDisabledError, OidcSignRefusedError, } from './errors.js';
+export { readFirstPartySession } from './firstPartySession.js';
+export { createInteractionRouter, FIRST_PARTY_CLIENT_PROPERTY } from './interactions.js';
+export { createSameOriginGuard } from './originGuard.js';
+export { buildProviderConfiguration, loadExistingGrant, PROVIDER_COOKIE_NAMES, } from './providerConfig.js';
+export { adoptSession, bindSession, currentRequestContext, runWithRequestContext, } from './requestContext.js';
+export { ApiSigningKey, classifyToken, signingKeysFrom, UnsignableTokenError, } from './signingKey.js';
+export { checkApiCompatibility } from './startup.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAC5F,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE1E,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE3E,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,aAAa,EACb,aAAa,EACb,eAAe,EACf,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC"}

package/dist/interactions.d.ts

@@ -0,0 +1,17 @@
+import { type Router } from 'express';
+import type Provider from 'oidc-provider';
+import type { OidcApiClient } from './apiClient.js';
+export declare const FIRST_PARTY_CLIENT_PROPERTY = "urn:seamless:first_party";
+export interface InteractionRouterOptions {
+    provider: Provider;
+    client: OidcApiClient;
+    issuerOrigin: string;
+    adapterCookieSecret: string;
+    accessCookieName: string;
+}
+/**
+ * The JSON routes the hosted pages use to finish an OIDC interaction. They never sign anyone
+ * in: the pages do that through this service's first-party adapter routes, and these routes
+ * only read the resulting session.
+ */
+export declare function createInteractionRouter(options: InteractionRouterOptions): Router;

package/dist/interactions.js

@@ -0,0 +1,209 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+import cookieParser from 'cookie-parser';
+import express from 'express';
+import { errors } from 'oidc-provider';
+import { authRequirements, stepUpMethods, unmetRequirements } from './authRequirements.js';
+import { readFirstPartySession } from './firstPartySession.js';
+import { createSameOriginGuard } from './originGuard.js';
+import { bindSession } from './requestContext.js';
+import { grantLifetime } from './tokenLifetimes.js';
+export const FIRST_PARTY_CLIENT_PROPERTY = 'urn:seamless:first_party';
+class InteractionRefusal extends Error {
+    status;
+    error;
+    extra;
+    constructor(status, error, extra = {}) {
+        super(error);
+        this.status = status;
+        this.error = error;
+        this.extra = extra;
+        this.name = 'InteractionRefusal';
+    }
+}
+function stringParam(params, name) {
+    const value = params[name];
+    return typeof value === 'string' && value ? value : undefined;
+}
+function promptDetails(interaction) {
+    return interaction.prompt.details;
+}
+function loginResult(accountId, context) {
+    return {
+        accountId,
+        ts: context.authTime,
+        ...(context.amr.length > 0 ? { amr: [...context.amr] } : {}),
+        ...(context.acr ? { acr: context.acr } : {}),
+    };
+}
+/**
+ * The JSON routes the hosted pages use to finish an OIDC interaction. They never sign anyone
+ * in: the pages do that through this service's first-party adapter routes, and these routes
+ * only read the resulting session.
+ */
+export function createInteractionRouter(options) {
+    const { provider, client } = options;
+    const router = express.Router();
+    router.use('/interaction', cookieParser(), createSameOriginGuard(options.issuerOrigin));
+    async function load(req, res) {
+        const interaction = await provider.interactionDetails(req, res);
+        // The cookie names the browser's current interaction. A page left open from an earlier
+        // one must not act on this one.
+        if (interaction.uid !== req.params.uid) {
+            throw new InteractionRefusal(409, 'interaction_mismatch');
+        }
+        return interaction;
+    }
+    async function clientFor(interaction) {
+        const clientId = stringParam(interaction.params, 'client_id');
+        const found = clientId ? await provider.Client.find(clientId) : undefined;
+        if (!found) {
+            throw new InteractionRefusal(400, 'invalid_client');
+        }
+        return found;
+    }
+    function firstPartySession(req) {
+        const cookies = req.cookies;
+        const result = readFirstPartySession(cookies[options.accessCookieName], options.adapterCookieSecret);
+        if (result.rejection) {
+            throw new InteractionRefusal(result.rejection.status, result.rejection.error);
+        }
+        return result.session;
+    }
+    router.get('/interaction/:uid/details', handle(async (req, res) => {
+        const interaction = await load(req, res);
+        const found = await clientFor(interaction);
+        const details = promptDetails(interaction);
+        const redirectUri = stringParam(interaction.params, 'redirect_uri');
+        res.set('cache-control', 'no-store');
+        res.json({
+            uid: interaction.uid,
+            prompt: {
+                name: interaction.prompt.name,
+                reasons: interaction.prompt.reasons,
+                missingScopes: details.missingOIDCScope ?? [],
+                missingClaims: details.missingOIDCClaims ?? [],
+                missingResourceScopes: Object.entries(details.missingResourceScopes ?? {}).map(([resource, scopes]) => ({ resource, scopes })),
+            },
+            client: {
+                id: found.clientId,
+                name: found.clientName ?? found.clientId,
+                firstParty: found[FIRST_PARTY_CLIENT_PROPERTY] === true,
+                redirectHost: redirectUri ? new URL(redirectUri).host : null,
+            },
+            scopes: (stringParam(interaction.params, 'scope') ?? '').split(' ').filter(Boolean),
+            loginHint: stringParam(interaction.params, 'login_hint') ?? null,
+        });
+    }));
+    router.post('/interaction/:uid/login', express.json({ limit: '1kb' }), handle(async (req, res) => {
+        const afterStepUp = typeof req.body === 'object' && req.body !== null && req.body.afterStepUp === true;
+        const session = firstPartySession(req);
+        const interaction = await load(req, res);
+        if (interaction.prompt.name !== 'login') {
+            throw new InteractionRefusal(409, 'login_not_requested');
+        }
+        // Switching accounts would need the provider session ended first, which is
+        // RP-initiated logout's job, so the hosted pages sign out of the old one instead.
+        if (interaction.session?.accountId && interaction.session.accountId !== session.userId) {
+            throw new InteractionRefusal(409, 'account_mismatch');
+        }
+        const found = await clientFor(interaction);
+        bindSession(session.sessionId);
+        // The API answers the auth context only for a session holding a grant for the client,
+        // so the grant is saved first. It starts empty: the consent step fills it.
+        const grant = new provider.Grant({ accountId: session.userId, clientId: found.clientId });
+        // Saved outside a provider request, where the ttl.Grant function cannot see the client.
+        Object.assign(grant, { expiresIn: grantLifetime(found) });
+        const grantId = await grant.save();
+        const context = await client.authContext(session.sessionId, found.clientId);
+        const refusal = !context || !context.active || context.userId !== session.userId
+            ? new InteractionRefusal(401, 'login_required')
+            : context.recovery
+                ? new InteractionRefusal(403, 'enrollment_required')
+                : undefined;
+        if (refusal || !context) {
+            // A grant left behind would bind the session to the client without a sign-in.
+            await grant.destroy();
+            throw refusal ?? new InteractionRefusal(401, 'login_required');
+        }
+        const unmet = unmetRequirements(authRequirements(interaction.params), context, interaction.iat);
+        if (unmet) {
+            await grant.destroy();
+            if (!afterStepUp) {
+                throw new InteractionRefusal(409, 'step_up_required', {
+                    methods: stepUpMethods(unmet, context),
+                });
+            }
+            // A weaker step-up than the request needs (a synced passkey for phrh, say) ends the
+            // request instead of issuing a lower acr.
+            const redirectTo = await provider.interactionResult(req, res, {
+                error: 'unmet_authentication_requirements',
+                error_description: 'the requested authentication could not be obtained',
+            }, { mergeWithLastSubmission: false });
+            res.json({ redirectTo });
+            return;
+        }
+        const redirectTo = await provider.interactionResult(req, res, {
+            login: loginResult(session.userId, context),
+            consent: { grantId },
+        });
+        res.json({ redirectTo });
+    }));
+    router.post('/interaction/:uid/consent', handle(async (req, res) => {
+        const session = firstPartySession(req);
+        const interaction = await load(req, res);
+        if (interaction.prompt.name !== 'consent') {
+            throw new InteractionRefusal(409, 'consent_not_requested');
+        }
+        const accountId = interaction.session?.accountId;
+        if (!accountId || accountId !== session.userId) {
+            throw new InteractionRefusal(409, 'account_mismatch');
+        }
+        const found = await clientFor(interaction);
+        const existing = interaction.grantId
+            ? await provider.Grant.find(interaction.grantId)
+            : undefined;
+        const grant = existing && existing.accountId === accountId && existing.clientId === found.clientId
+            ? existing
+            : new provider.Grant({ accountId, clientId: found.clientId });
+        const details = promptDetails(interaction);
+        if (details.missingOIDCScope?.length) {
+            grant.addOIDCScope(details.missingOIDCScope.join(' '));
+        }
+        if (details.missingOIDCClaims?.length) {
+            grant.addOIDCClaims(details.missingOIDCClaims);
+        }
+        for (const [indicator, scopes] of Object.entries(details.missingResourceScopes ?? {})) {
+            grant.addResourceScope(indicator, scopes.join(' '));
+        }
+        Object.assign(grant, { expiresIn: grantLifetime(found) });
+        const grantId = await grant.save();
+        const redirectTo = await provider.interactionResult(req, res, { consent: { grantId } }, { mergeWithLastSubmission: true });
+        res.json({ redirectTo });
+    }));
+    router.post('/interaction/:uid/abort', handle(async (req, res) => {
+        await load(req, res);
+        const redirectTo = await provider.interactionResult(req, res, { error: 'access_denied', error_description: 'End-User aborted interaction' }, { mergeWithLastSubmission: false });
+        res.json({ redirectTo });
+    }));
+    return router;
+}
+function handle(fn) {
+    return (req, res, next) => {
+        fn(req, res).catch((error) => {
+            if (error instanceof InteractionRefusal) {
+                res.status(error.status).json({ ...error.extra, error: error.error });
+                return;
+            }
+            if (error instanceof errors.SessionNotFound) {
+                res.status(404).json({ error: 'interaction_expired' });
+                return;
+            }
+            next(error);
+        });
+    };
+}
+//# sourceMappingURL=interactions.js.map