@seamless-auth/oidc-provider 0.0.0-stage → 0.1.1

package/dist/clientSecrets.js

@@ -0,0 +1,102 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+import { randomBytes } from 'node:crypto';
+import { currentRequestContext } from './requestContext.js';
+// The library's own body limit, so a body it would refuse is refused here first.
+const BODY_LIMIT = 56 * 1024;
+const FORM = 'application/x-www-form-urlencoded';
+/** RFC 6749 section 2.3.1: Basic credentials are form-encoded before base64. */
+function formDecode(value) {
+    return decodeURIComponent(value.replace(/\+/g, ' '));
+}
+function formEncode(value) {
+    return encodeURIComponent(value);
+}
+function fromBasic(header) {
+    const [scheme, token, extra] = (header ?? '').split(' ');
+    if (scheme?.toLowerCase() !== 'basic' || !token || extra !== undefined) {
+        return undefined;
+    }
+    const decoded = Buffer.from(token, 'base64').toString('utf8');
+    const colon = decoded.indexOf(':');
+    if (colon < 1) {
+        return undefined;
+    }
+    try {
+        const clientId = formDecode(decoded.slice(0, colon));
+        const secret = formDecode(decoded.slice(colon + 1));
+        return secret ? { clientId, secret, via: 'basic' } : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function readBody(stream) {
+    const chunks = [];
+    let received = 0;
+    for await (const chunk of stream) {
+        received += chunk.length;
+        if (received > BODY_LIMIT) {
+            return undefined;
+        }
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks, received);
+}
+/**
+ * ADR D6: a shared secret is checked by the API, never by this service. A presented secret
+ * is sent to `verify-secret`, and when the API accepts it, it is swapped in the request for a
+ * one-time value that the client's metadata carries for this request only (see
+ * `ApiClientAdapter`). The library compares against that value, so it never holds the real
+ * secret, and a secret the API did not accept can match nothing.
+ */
+export function verifyClientSecrets(client) {
+    return async (ctx, next) => {
+        if (ctx.method !== 'POST') {
+            await next();
+            return;
+        }
+        let body;
+        if (ctx.is(FORM) && ctx.req.readable) {
+            const raw = await readBody(ctx.req);
+            if (raw === undefined) {
+                ctx.status = 413;
+                ctx.body = { error: 'invalid_request', error_description: 'request entity too large' };
+                return;
+            }
+            // The library reads a body an upstream parser already consumed from req.body.
+            ctx.req.body = raw;
+            body = new URLSearchParams(raw.toString('utf8'));
+        }
+        const basic = fromBasic(ctx.get('authorization') || undefined);
+        const postSecret = body?.get('client_secret');
+        const postClientId = body?.get('client_id');
+        // Two mechanisms at once is the library's to refuse, so it gets the request untouched.
+        const presented = basic && postSecret
+            ? undefined
+            : (basic ??
+                (postSecret && postClientId
+                    ? { clientId: postClientId, secret: postSecret, via: 'post' }
+                    : undefined));
+        if (presented && (await client.verifySecret(presented.clientId, presented.secret))) {
+            const oneTime = randomBytes(32).toString('base64url');
+            const context = currentRequestContext();
+            if (context) {
+                context.verifiedClientSecret = { clientId: presented.clientId, value: oneTime };
+            }
+            if (presented.via === 'basic') {
+                const credentials = `${formEncode(presented.clientId)}:${formEncode(oneTime)}`;
+                ctx.req.headers.authorization = `Basic ${Buffer.from(credentials).toString('base64')}`;
+            }
+            else if (body) {
+                body.set('client_secret', oneTime);
+                ctx.req.body = Buffer.from(body.toString());
+            }
+        }
+        await next();
+    };
+}
+//# sourceMappingURL=clientSecrets.js.map

package/dist/clientSecrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientSecrets.js","sourceRoot":"","sources":["../src/clientSecrets.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAK1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,iFAAiF;AACjF,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7B,MAAM,IAAI,GAAG,mCAAmC,CAAC;AAEjD,gFAAgF;AAChF,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAQD,SAAS,SAAS,CAAC,MAA0B;IAC3C,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,MAAM,EAAE,WAAW,EAAE,KAAK,OAAO,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACvE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QACpD,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,MAA6B;IACnD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC;QACzB,IAAI,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAqB;IACvD,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,IAAiC,CAAC;QACtC,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;gBACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,CAAC;gBACvF,OAAO;YACT,CAAC;YACD,8EAA8E;YAC7E,GAAG,CAAC,GAA0B,CAAC,IAAI,GAAG,GAAG,CAAC;YAC3C,IAAI,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,SAAS,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAG,IAAI,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;QAC9C,MAAM,YAAY,GAAG,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QAC5C,uFAAuF;QACvF,MAAM,SAAS,GACb,KAAK,IAAI,UAAU;YACjB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,CAAC,KAAK;gBACN,CAAC,UAAU,IAAI,YAAY;oBACzB,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE;oBAC7D,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAEtB,IAAI,SAAS,IAAI,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACnF,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;YACxC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,oBAAoB,GAAG,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;YAClF,CAAC;YACD,IAAI,SAAS,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;gBAC9B,MAAM,WAAW,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/E,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,GAAG,SAAS,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzF,CAAC;iBAAM,IAAI,IAAI,EAAE,CAAC;gBAChB,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;gBAClC,GAAG,CAAC,GAA0B,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/configCache.d.ts

@@ -0,0 +1,14 @@
+import type { OidcEdgeConfigResponse } from '@seamless-auth/types';
+import type { OidcApiClient } from './apiClient.js';
+/**
+ * The API's `/oidc/config`, re-read at most every `ttlMs`, so an admin turning a flag off
+ * (third-party clients, or the provider itself) takes effect without restarting this service.
+ */
+export declare class EdgeConfigCache {
+    #private;
+    constructor(client: OidcApiClient, initial: OidcEdgeConfigResponse, { ttlMs, now }?: {
+        ttlMs?: number;
+        now?: () => number;
+    });
+    get(): Promise<OidcEdgeConfigResponse>;
+}

package/dist/configCache.js

@@ -0,0 +1,45 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+import { OidcProviderDisabledError } from './errors.js';
+const DEFAULT_TTL_MS = 30_000;
+/**
+ * The API's `/oidc/config`, re-read at most every `ttlMs`, so an admin turning a flag off
+ * (third-party clients, or the provider itself) takes effect without restarting this service.
+ */
+export class EdgeConfigCache {
+    #client;
+    #ttlMs;
+    #now;
+    #value;
+    #fetchedAt;
+    #pending;
+    constructor(client, initial, { ttlMs = DEFAULT_TTL_MS, now = Date.now } = {}) {
+        this.#client = client;
+        this.#ttlMs = ttlMs;
+        this.#now = now;
+        this.#value = initial;
+        this.#fetchedAt = now();
+    }
+    async get() {
+        if (this.#now() - this.#fetchedAt < this.#ttlMs) {
+            return this.#value;
+        }
+        this.#pending ??= this.#refresh().finally(() => {
+            this.#pending = undefined;
+        });
+        return this.#pending;
+    }
+    async #refresh() {
+        const config = await this.#client.config();
+        if (!config) {
+            throw new OidcProviderDisabledError();
+        }
+        this.#value = config;
+        this.#fetchedAt = this.#now();
+        return config;
+    }
+}
+//# sourceMappingURL=configCache.js.map

package/dist/configCache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configCache.js","sourceRoot":"","sources":["../src/configCache.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAExD,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B;;;GAGG;AACH,MAAM,OAAO,eAAe;IACjB,OAAO,CAAgB;IACvB,MAAM,CAAS;IACf,IAAI,CAAe;IAC5B,MAAM,CAAyB;IAC/B,UAAU,CAAS;IACnB,QAAQ,CAA8C;IAEtD,YACE,MAAqB,EACrB,OAA+B,EAC/B,EAAE,KAAK,GAAG,cAAc,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,KAA6C,EAAE;QAEvF,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;QACtB,IAAI,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,GAAG;QACP,IAAI,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAC7C,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,yBAAyB,EAAE,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/createOidcEdge.d.ts

@@ -0,0 +1,45 @@
+import type { OidcEdgeConfigResponse } from '@seamless-auth/types';
+import { type Router } from 'express';
+import Provider from 'oidc-provider';
+import { OidcApiClient } from './apiClient.js';
+export declare const ADAPTER_COOKIE_NAMES: {
+    readonly access: "__Host-seamless-access";
+    readonly registration: "__Host-seamless-ephemeral";
+    readonly refresh: "__Host-seamless-refresh";
+    readonly preAuth: "__Host-seamless-pre-auth";
+};
+export interface OidcEdgeOptions {
+    /** The private Seamless Auth API, as this service reaches it. */
+    apiUrl: string;
+    /** The API's `ISSUER`, when it differs from `apiUrl`. */
+    apiIssuer?: string;
+    /**
+     * This service's own service token secret (`SEAMLESS_OIDC_SERVICE_TOKEN` on the API), used
+     * for `/oidc/*` and for the adapter's first-party calls. Never the adapters' secret.
+     */
+    serviceSecret: string;
+    serviceTokenKid?: string;
+    /** Signs the provider's cookies. The first key signs, the rest still verify. */
+    cookieKeys: string[];
+    /** Signs the first-party session cookies the hosted UI uses. */
+    adapterCookieSecret: string;
+    /**
+     * Set when TLS ends at a proxy in front of this service. The host Express app needs
+     * `trust proxy` set to match.
+     */
+    trustProxy?: boolean;
+    /** `false` keeps the adapter on its bundled route manifest. */
+    fetchAdapterManifest?: boolean;
+    /** The built hosted pages. Defaults to the copy this package ships in `dist/ui`. */
+    uiDir?: string;
+    fetch?: typeof fetch;
+}
+export interface OidcEdge {
+    /** Mount at the root of the app that serves the issuer's origin. */
+    router: Router;
+    provider: Provider;
+    issuer: string;
+    config: OidcEdgeConfigResponse;
+    client: OidcApiClient;
+}
+export declare function createOidcEdge(options: OidcEdgeOptions): Promise<OidcEdge>;

package/dist/createOidcEdge.js

@@ -0,0 +1,132 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+import { randomUUID } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { createSeamlessAuthServer } from '@seamless-auth/express';
+import express from 'express';
+import Provider from 'oidc-provider';
+import { OidcApiClient } from './apiClient.js';
+import { verifyClientSecrets } from './clientSecrets.js';
+import { EdgeConfigCache } from './configCache.js';
+import { deviceFlowMiddleware } from './deviceFlow.js';
+import { createHostedPageRenderer, createHostedPagesRouter } from './hostedPages.js';
+import { createInteractionRouter } from './interactions.js';
+import { acceptJwtAccessTokens, createJwtAccessTokenLookup } from './jwtAccessTokens.js';
+import { endFirstPartySessionOnLogout, leaveBackchannelLogoutToApi } from './logout.js';
+import { createSameOriginGuard } from './originGuard.js';
+import { buildProviderConfiguration, PROVIDER_COOKIE_NAMES } from './providerConfig.js';
+import { createRateLimiter } from './rateLimit.js';
+import { revokeSessionOnRefreshReuse } from './refreshReuse.js';
+import { runWithRequestContext } from './requestContext.js';
+import { hostOnlyResumeCookie } from './resumeCookie.js';
+import { signingKeysFrom } from './signingKey.js';
+import { checkApiCompatibility } from './startup.js';
+import { auditRevocations } from './tokenAudit.js';
+export const ADAPTER_COOKIE_NAMES = {
+    access: '__Host-seamless-access',
+    registration: '__Host-seamless-ephemeral',
+    refresh: '__Host-seamless-refresh',
+    preAuth: '__Host-seamless-pre-auth',
+};
+export async function createOidcEdge(options) {
+    const client = new OidcApiClient({
+        apiUrl: options.apiUrl,
+        serviceSecret: options.serviceSecret,
+        ...(options.serviceTokenKid ? { serviceTokenKid: options.serviceTokenKid } : {}),
+        ...(options.fetch ? { fetch: options.fetch } : {}),
+    });
+    const config = await checkApiCompatibility(client);
+    const configCache = new EdgeConfigCache(client, config);
+    const signingKeys = signingKeysFrom(await client.jwks(), client);
+    const hostedPages = {
+        uiDir: options.uiDir ?? fileURLToPath(new URL('./ui/', import.meta.url)),
+        configCache,
+    };
+    const renderPage = createHostedPageRenderer(hostedPages);
+    const provider = new Provider(config.issuer, buildProviderConfiguration({
+        client,
+        config,
+        configCache,
+        signingKeys,
+        cookieKeys: options.cookieKeys,
+        renderPage,
+    }));
+    leaveBackchannelLogoutToApi(provider);
+    provider.proxy = options.trustProxy === true;
+    provider.use(hostOnlyResumeCookie(PROVIDER_COOKIE_NAMES.resume, '/authorize'));
+    provider.use(verifyClientSecrets(client));
+    provider.use(revokeSessionOnRefreshReuse(client));
+    provider.use(auditRevocations(client));
+    provider.use(endFirstPartySessionOnLogout(client, Object.values(ADAPTER_COOKIE_NAMES)));
+    provider.use(acceptJwtAccessTokens(createJwtAccessTokenLookup(signingKeys, config.issuer), [
+        '/token/introspection',
+        '/token/revocation',
+    ]));
+    // The library answers a bare server_error and logs nothing, so this is the only trace.
+    provider.on('server_error', (_ctx, error) => {
+        console.error(`[oidc-provider] ${error.name}: ${error.message}`);
+    });
+    const issuerUrl = new URL(config.issuer);
+    const issuerBase = issuerUrl.pathname.replace(/\/$/, '');
+    provider.use(deviceFlowMiddleware());
+    const router = express.Router();
+    // The library builds endpoint URLs from the request's scheme and host, so a request for
+    // any other origin could put a foreign one into discovery or a redirect. Behind a TLS
+    // proxy the host app must set Express's `trust proxy` for the scheme to read as https.
+    const issuerScheme = issuerUrl.protocol.slice(0, -1);
+    router.use((req, res, next) => {
+        if (req.host !== issuerUrl.host || req.protocol !== issuerScheme) {
+            res.status(421).json({ error: 'misdirected_request' });
+            return;
+        }
+        next();
+    });
+    router.use((req, _res, next) => {
+        const userAgent = req.get('user-agent');
+        runWithRequestContext({
+            correlationId: randomUUID(),
+            ...(req.ip ? { clientIp: req.ip } : {}),
+            ...(userAgent ? { userAgent } : {}),
+        }, next);
+    });
+    const sameOrigin = createSameOriginGuard(issuerUrl.origin);
+    router.use('/auth', sameOrigin, createSeamlessAuthServer({
+        authServerUrl: options.apiUrl,
+        audience: options.apiIssuer ?? options.apiUrl,
+        ...(options.apiIssuer ? { authServerIssuer: options.apiIssuer } : {}),
+        cookieSecret: options.adapterCookieSecret,
+        serviceSecret: options.serviceSecret,
+        ...(options.serviceTokenKid ? { jwksKid: options.serviceTokenKid } : {}),
+        cookieSecure: true,
+        cookieSameSite: 'lax',
+        allowedOrigins: [issuerUrl.origin],
+        accessCookieName: ADAPTER_COOKIE_NAMES.access,
+        registrationCookieName: ADAPTER_COOKIE_NAMES.registration,
+        refreshCookieName: ADAPTER_COOKIE_NAMES.refresh,
+        preAuthCookieName: ADAPTER_COOKIE_NAMES.preAuth,
+        ...(options.fetchAdapterManifest === false ? { fetchManifest: false } : {}),
+    }));
+    router.use(createInteractionRouter({
+        provider,
+        client,
+        issuerOrigin: issuerUrl.origin,
+        adapterCookieSecret: options.adapterCookieSecret,
+        accessCookieName: ADAPTER_COOKIE_NAMES.access,
+    }));
+    router.use(createHostedPagesRouter(hostedPages, renderPage));
+    const tokenStatusLimiter = createRateLimiter({ limit: 1200, windowMs: 60_000 });
+    router.use([`${issuerBase}/token/introspection`, `${issuerBase}/token/revocation`], tokenStatusLimiter);
+    // User code entry (RFC 8628 section 5.1). Per IP for a guesser at one address, and across
+    // all of them for one spread over many, per instance.
+    const userCodeLimiters = [
+        createRateLimiter({ limit: 10, windowMs: 60_000 }),
+        createRateLimiter({ limit: 600, windowMs: 60_000, key: () => 'all' }),
+    ];
+    router.post(`${issuerBase}/device`, ...userCodeLimiters);
+    router.use(issuerUrl.pathname, provider.callback());
+    return { router, provider, issuer: config.issuer, config, client };
+}
+//# sourceMappingURL=createOidcEdge.js.map

package/dist/createOidcEdge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createOidcEdge.js","sourceRoot":"","sources":["../src/createOidcEdge.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAElE,OAAO,OAAwB,MAAM,SAAS,CAAC;AAC/C,OAAO,QAAQ,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AACzF,OAAO,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,MAAM,EAAE,wBAAwB;IAChC,YAAY,EAAE,2BAA2B;IACzC,OAAO,EAAE,yBAAyB;IAClC,OAAO,EAAE,0BAA0B;CAC3B,CAAC;AAsCX,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAwB;IAC3D,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC;QAC/B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,IAAI,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,aAAa,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxE,WAAW;KACZ,CAAC;IACF,MAAM,UAAU,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAEzD,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAC3B,MAAM,CAAC,MAAM,EACb,0BAA0B,CAAC;QACzB,MAAM;QACN,MAAM;QACN,WAAW;QACX,WAAW;QACX,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU;KACX,CAAC,CACH,CAAC;IACF,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IACtC,QAAQ,CAAC,KAAK,GAAG,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC;IAC7C,QAAQ,CAAC,GAAG,CAAC,oBAAoB,CAAC,qBAAqB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;IAC/E,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,QAAQ,CAAC,GAAG,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC,CAAC;IAClD,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;IACvC,QAAQ,CAAC,GAAG,CAAC,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACxF,QAAQ,CAAC,GAAG,CACV,qBAAqB,CAAC,0BAA0B,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE;QAC5E,sBAAsB;QACtB,mBAAmB;KACpB,CAAC,CACH,CAAC;IACF,uFAAuF;IACvF,QAAQ,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,KAAY,EAAE,EAAE;QACjD,OAAO,CAAC,KAAK,CAAC,mBAAmB,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzD,QAAQ,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,wFAAwF;IACxF,sFAAsF;IACtF,uFAAuF;IACvF,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC5B,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACxC,qBAAqB,CACnB;YACE,aAAa,EAAE,UAAU,EAAE;YAC3B,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpC,EACD,IAAI,CACL,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,qBAAqB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAE3D,MAAM,CAAC,GAAG,CACR,OAAO,EACP,UAAU,EACV,wBAAwB,CAAC;QACvB,aAAa,EAAE,OAAO,CAAC,MAAM;QAC7B,QAAQ,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM;QAC7C,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,YAAY,EAAE,OAAO,CAAC,mBAAmB;QACzC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,YAAY,EAAE,IAAI;QAClB,cAAc,EAAE,KAAK;QACrB,cAAc,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,oBAAoB,CAAC,MAAM;QAC7C,sBAAsB,EAAE,oBAAoB,CAAC,YAAY;QACzD,iBAAiB,EAAE,oBAAoB,CAAC,OAAO;QAC/C,iBAAiB,EAAE,oBAAoB,CAAC,OAAO;QAC/C,GAAG,CAAC,OAAO,CAAC,oBAAoB,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,GAAG,CACR,uBAAuB,CAAC;QACtB,QAAQ;QACR,MAAM;QACN,YAAY,EAAE,SAAS,CAAC,MAAM;QAC9B,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,gBAAgB,EAAE,oBAAoB,CAAC,MAAM;KAC9C,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;IAE7D,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAChF,MAAM,CAAC,GAAG,CACR,CAAC,GAAG,UAAU,sBAAsB,EAAE,GAAG,UAAU,mBAAmB,CAAC,EACvE,kBAAkB,CACnB,CAAC;IAEF,0FAA0F;IAC1F,sDAAsD;IACtD,MAAM,gBAAgB,GAAG;QACvB,iBAAiB,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAClD,iBAAiB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;KACtE,CAAC;IACF,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,SAAS,EAAE,GAAG,gBAAgB,CAAC,CAAC;IAEzD,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IAEpD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACrE,CAAC"}

package/dist/deviceFlow.d.ts

@@ -0,0 +1,53 @@
+import type { KoaContextWithOIDC } from 'oidc-provider';
+import type { OidcApiClient } from './apiClient.js';
+import type { HostedPageRenderer } from './hostedPages.js';
+export declare const DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+/** RFC 8628 section 3.5: a client that is told `slow_down` adds five seconds. */
+export declare const DEVICE_POLL_INTERVAL_SECONDS = 5;
+/** ADR D10: user codes live for at most ten minutes. */
+export declare const DEVICE_CODE_TTL_SECONDS = 600;
+/**
+ * Eight characters of the RFC 8628 section 6.1 base-20 set (no vowels, so no words, and no
+ * look-alikes), about 34.5 bits. With codes living ten minutes and entry rate limited,
+ * guessing a live one is out of reach.
+ */
+export declare const USER_CODE_CHARSET: "base-20";
+export declare const USER_CODE_MASK = "****-****";
+/** Whether a stored token or code came from a device approval. */
+export declare function isDeviceGrant(payload: {
+    kind?: unknown;
+    gty?: unknown;
+}): boolean;
+/**
+ * ADR D10. The approving session's `acr` says how the approver signed in, not who holds the
+ * device, and `acr_values` or `max_age` would be satisfied by an approval made somewhere
+ * else, so the device flow takes neither.
+ */
+export declare function checkDeviceRequest(params: Record<string, unknown> | undefined): void;
+export declare function withLoginPrompt(prompt: unknown): string;
+export declare class DevicePollThrottle {
+    #private;
+    constructor(now?: () => number);
+    check(deviceCode: string): void;
+}
+/**
+ * Marks token endpoint posts, and adds `interval` to the device authorization response. The
+ * provider is mounted at the issuer's path, so paths here are relative to it, and the
+ * library's router ignores case.
+ */
+export declare function deviceFlowMiddleware(tokenPath?: string): (ctx: KoaContextWithOIDC, next: () => Promise<unknown>) => Promise<void>;
+/** The device verification pages (RFC 8628 section 3.3), rendered by the hosted UI. */
+export declare function createDevicePages(render: HostedPageRenderer, client: OidcApiClient): {
+    charset: "base-20";
+    mask: string;
+    userCodeInputSource(ctx: KoaContextWithOIDC, _form: string, out?: {
+        error?: string;
+    }, err?: Error & {
+        userCode?: string;
+    }): Promise<void>;
+    userCodeConfirmSource(ctx: KoaContextWithOIDC, _form: string, found: {
+        clientId: string;
+        clientName?: string | undefined;
+    }, _deviceInfo: unknown, userCode: string): Promise<void>;
+    successSource(ctx: KoaContextWithOIDC): Promise<void>;
+};

package/dist/deviceFlow.js

@@ -0,0 +1,168 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+import { errors } from 'oidc-provider';
+import { currentRequestContext } from './requestContext.js';
+export const DEVICE_CODE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';
+/** RFC 8628 section 3.5: a client that is told `slow_down` adds five seconds. */
+export const DEVICE_POLL_INTERVAL_SECONDS = 5;
+/** ADR D10: user codes live for at most ten minutes. */
+export const DEVICE_CODE_TTL_SECONDS = 600;
+/**
+ * Eight characters of the RFC 8628 section 6.1 base-20 set (no vowels, so no words, and no
+ * look-alikes), about 34.5 bits. With codes living ten minutes and entry rate limited,
+ * guessing a live one is out of reach.
+ */
+export const USER_CODE_CHARSET = 'base-20';
+export const USER_CODE_MASK = '****-****';
+/** Whether a stored token or code came from a device approval. */
+export function isDeviceGrant(payload) {
+    return (payload.kind === 'DeviceCode' ||
+        (typeof payload.gty === 'string' && payload.gty.split(' ').includes('device_code')));
+}
+/**
+ * ADR D10. The approving session's `acr` says how the approver signed in, not who holds the
+ * device, and `acr_values` or `max_age` would be satisfied by an approval made somewhere
+ * else, so the device flow takes neither.
+ */
+export function checkDeviceRequest(params) {
+    if (params?.acr_values !== undefined || params?.max_age !== undefined) {
+        throw new errors.InvalidRequest('acr_values and max_age are not supported by the device flow');
+    }
+}
+export function withLoginPrompt(prompt) {
+    const prompts = new Set(typeof prompt === 'string' ? prompt.split(' ').filter(Boolean) : []);
+    prompts.add('login');
+    return [...prompts].join(' ');
+}
+/**
+ * Per device code, per instance. The library has no polling interval of its own, so a
+ * client polling sooner than `interval` is told `slow_down` and its interval grows.
+ */
+const MAX_TRACKED_CODES = 10_000;
+export class DevicePollThrottle {
+    #polls = new Map();
+    #now;
+    constructor(now = () => Date.now()) {
+        this.#now = now;
+    }
+    check(deviceCode) {
+        const now = this.#now();
+        if (this.#polls.size >= MAX_TRACKED_CODES) {
+            for (const [code, poll] of this.#polls) {
+                if (now - poll.at > DEVICE_CODE_TTL_SECONDS * 1000)
+                    this.#polls.delete(code);
+            }
+            // Still full of live entries: drop the oldest, so the map has a hard ceiling.
+            for (const code of this.#polls.keys()) {
+                if (this.#polls.size < MAX_TRACKED_CODES)
+                    break;
+                this.#polls.delete(code);
+            }
+        }
+        const last = this.#polls.get(deviceCode);
+        // Deleted first so the Map's insertion order stays oldest-poll first.
+        this.#polls.delete(deviceCode);
+        if (last && now - last.at < last.interval * 1000) {
+            this.#polls.set(deviceCode, {
+                at: now,
+                interval: last.interval + DEVICE_POLL_INTERVAL_SECONDS,
+            });
+            throw new errors.SlowDown();
+        }
+        this.#polls.set(deviceCode, {
+            at: now,
+            interval: last?.interval ?? DEVICE_POLL_INTERVAL_SECONDS,
+        });
+    }
+}
+/**
+ * Marks token endpoint posts, and adds `interval` to the device authorization response. The
+ * provider is mounted at the issuer's path, so paths here are relative to it, and the
+ * library's router ignores case.
+ */
+export function deviceFlowMiddleware(tokenPath = '/token') {
+    return async (ctx, next) => {
+        const context = currentRequestContext();
+        if (context && ctx.method === 'POST' && ctx.path.toLowerCase() === tokenPath) {
+            context.tokenRequest = true;
+        }
+        await next();
+        if (ctx.oidc?.route === 'device_authorization' &&
+            ctx.status === 200 &&
+            ctx.body &&
+            typeof ctx.body === 'object') {
+            ctx.body.interval = DEVICE_POLL_INTERVAL_SECONDS;
+        }
+    };
+}
+function send(ctx, { html, headers }) {
+    ctx.set(headers);
+    ctx.type = 'html';
+    ctx.body = html;
+}
+function clientName(client) {
+    return client ? (client.clientName ?? client.clientId) : null;
+}
+const INPUT_ERRORS = {
+    NotFoundError: 'not_found',
+    ExpiredError: 'expired',
+    AlreadyUsedError: 'already_used',
+    AbortedError: 'aborted',
+    NoCodeError: 'no_code',
+};
+/** The device verification pages (RFC 8628 section 3.3), rendered by the hosted UI. */
+export function createDevicePages(render, client) {
+    async function audit(type, clientId) {
+        const context = currentRequestContext();
+        if (!context)
+            return;
+        try {
+            await client.event({
+                type,
+                correlationId: context.correlationId,
+                occurredAt: new Date().toISOString(),
+                ...(clientId ? { clientId } : {}),
+                ...(context.sessionId ? { sessionId: context.sessionId } : {}),
+            });
+        }
+        catch (error) {
+            console.error(`[oidc-provider] could not record a device decision: ${String(error)}`);
+        }
+    }
+    return {
+        charset: USER_CODE_CHARSET,
+        mask: USER_CODE_MASK,
+        async userCodeInputSource(ctx, _form, out, err) {
+            if (err?.name === 'AbortedError') {
+                await audit('device_code_denied', ctx.oidc.entities.DeviceCode?.clientId);
+            }
+            const error = err ? (INPUT_ERRORS[err.name] ?? out?.error ?? 'server_error') : null;
+            send(ctx, await render({
+                view: 'device_input',
+                action: ctx.oidc.urlFor('code_verification'),
+                xsrf: ctx.oidc.session?.state?.secret,
+                userCode: err?.userCode ?? null,
+                error,
+            }));
+        },
+        async userCodeConfirmSource(ctx, _form, found, _deviceInfo, userCode) {
+            const scope = ctx.oidc.entities.DeviceCode?.params?.scope;
+            send(ctx, await render({
+                view: 'device_confirm',
+                action: ctx.oidc.urlFor('code_verification'),
+                xsrf: ctx.oidc.session?.state?.secret,
+                userCode,
+                clientName: clientName(found),
+                scopes: typeof scope === 'string' ? scope.split(' ').filter(Boolean) : [],
+            }));
+        },
+        async successSource(ctx) {
+            await audit('device_code_approved', ctx.oidc.client?.clientId);
+            send(ctx, await render({ view: 'device_done', clientName: clientName(ctx.oidc.client) }));
+        },
+    };
+}
+//# sourceMappingURL=deviceFlow.js.map

package/dist/deviceFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deviceFlow.js","sourceRoot":"","sources":["../src/deviceFlow.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAIvC,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,MAAM,CAAC,MAAM,iBAAiB,GAAG,8CAA8C,CAAC;AAEhF,iFAAiF;AACjF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAE9C,wDAAwD;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAE3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAkB,CAAC;AACpD,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;AAE1C,kEAAkE;AAClE,MAAM,UAAU,aAAa,CAAC,OAA0C;IACtE,OAAO,CACL,OAAO,CAAC,IAAI,KAAK,YAAY;QAC7B,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CACpF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAA2C;IAC5E,IAAI,MAAM,EAAE,UAAU,KAAK,SAAS,IAAI,MAAM,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;QACtE,MAAM,IAAI,MAAM,CAAC,cAAc,CAAC,6DAA6D,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAe;IAC7C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7F,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrB,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC,MAAM,OAAO,kBAAkB;IACpB,MAAM,GAAG,IAAI,GAAG,EAA4C,CAAC;IAC7D,IAAI,CAAe;IAE5B,YAAY,MAAoB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QAC9C,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,UAAkB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,iBAAiB,EAAE,CAAC;YAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBACvC,IAAI,GAAG,GAAG,IAAI,CAAC,EAAE,GAAG,uBAAuB,GAAG,IAAI;oBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC/E,CAAC;YACD,8EAA8E;YAC9E,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBACtC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,iBAAiB;oBAAE,MAAM;gBAChD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzC,sEAAsE;QACtE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC/B,IAAI,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,EAAE,CAAC;YACjD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE;gBAC1B,EAAE,EAAE,GAAG;gBACP,QAAQ,EAAE,IAAI,CAAC,QAAQ,GAAG,4BAA4B;aACvD,CAAC,CAAC;YACH,MAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE;YAC1B,EAAE,EAAE,GAAG;YACP,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,4BAA4B;SACzD,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAS,GAAG,QAAQ;IACvD,OAAO,KAAK,EAAE,GAAuB,EAAE,IAA4B,EAAE,EAAE;QACrE,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;QACxC,IAAI,OAAO,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,SAAS,EAAE,CAAC;YAC7E,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;QAC9B,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;QACb,IACE,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,sBAAsB;YAC1C,GAAG,CAAC,MAAM,KAAK,GAAG;YAClB,GAAG,CAAC,IAAI;YACR,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAC5B,CAAC;YACA,GAAG,CAAC,IAAgC,CAAC,QAAQ,GAAG,4BAA4B,CAAC;QAChF,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,GAAuB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAgB;IACpE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjB,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;IAClB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,MAAyE;IAC3F,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAED,MAAM,YAAY,GAA2B;IAC3C,aAAa,EAAE,WAAW;IAC1B,YAAY,EAAE,SAAS;IACvB,gBAAgB,EAAE,cAAc;IAChC,YAAY,EAAE,SAAS;IACvB,WAAW,EAAE,SAAS;CACvB,CAAC;AAEF,uFAAuF;AACvF,MAAM,UAAU,iBAAiB,CAAC,MAA0B,EAAE,MAAqB;IACjF,KAAK,UAAU,KAAK,CAClB,IAAmD,EACnD,QAA4B;QAE5B,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC;gBACjB,IAAI;gBACJ,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,uDAAuD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,iBAAiB;QAC1B,IAAI,EAAE,cAAc;QACpB,KAAK,CAAC,mBAAmB,CACvB,GAAuB,EACvB,KAAa,EACb,GAAwB,EACxB,GAAmC;YAEnC,IAAI,GAAG,EAAE,IAAI,KAAK,cAAc,EAAE,CAAC;gBACjC,MAAM,KAAK,CAAC,oBAAoB,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,KAAK,IAAI,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACpF,IAAI,CACF,GAAG,EACH,MAAM,MAAM,CAAC;gBACX,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;gBAC5C,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM;gBACrC,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,IAAI;gBAC/B,KAAK;aACN,CAAC,CACH,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,qBAAqB,CACzB,GAAuB,EACvB,KAAa,EACb,KAA4D,EAC5D,WAAoB,EACpB,QAAgB;YAEhB,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC;YAC1D,IAAI,CACF,GAAG,EACH,MAAM,MAAM,CAAC;gBACX,IAAI,EAAE,gBAAgB;gBACtB,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;gBAC5C,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM;gBACrC,QAAQ;gBACR,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC;gBAC7B,MAAM,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;aAC1E,CAAC,CACH,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,GAAuB;YACzC,MAAM,KAAK,CAAC,sBAAsB,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC/D,IAAI,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5F,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/env.d.ts

@@ -0,0 +1,16 @@
+import { z } from 'zod';
+export declare const EnvSchema: z.ZodObject<{
+    PORT: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    SEAMLESS_API_URL: z.ZodURL;
+    SEAMLESS_API_ISSUER: z.ZodOptional<z.ZodURL>;
+    SEAMLESS_OIDC_SERVICE_TOKEN: z.ZodString;
+    SEAMLESS_JWKS_KID: z.ZodOptional<z.ZodString>;
+    SEAMLESS_COOKIE_SECRET: z.ZodString;
+    OIDC_COOKIE_KEYS: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string[], string>>, z.ZodArray<z.ZodString>>;
+    TRUST_PROXY: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean, "true" | "false">>;
+}, z.core.$strip>;
+export type Env = z.infer<typeof EnvSchema>;
+export declare function parseEnv(source?: NodeJS.ProcessEnv): Env;

package/dist/env.js

@@ -0,0 +1,36 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the Apache License, Version 2.0
+ * See LICENSE file in the project root for full license information
+ */
+import { z } from 'zod';
+const SECRET_MIN_LENGTH = 32;
+const booleanString = z
+    .enum(['true', 'false'])
+    .default('false')
+    .transform((value) => value === 'true');
+export const EnvSchema = z.object({
+    PORT: z.coerce.number().int().min(1).max(65535).default(5314),
+    SEAMLESS_API_URL: z.url(),
+    SEAMLESS_API_ISSUER: z.url().optional(),
+    SEAMLESS_OIDC_SERVICE_TOKEN: z.string().min(SECRET_MIN_LENGTH),
+    SEAMLESS_JWKS_KID: z.string().min(1).optional(),
+    SEAMLESS_COOKIE_SECRET: z.string().min(SECRET_MIN_LENGTH),
+    OIDC_COOKIE_KEYS: z
+        .string()
+        .transform((value) => value
+        .split(',')
+        .map((key) => key.trim())
+        .filter(Boolean))
+        .pipe(z.array(z.string().min(SECRET_MIN_LENGTH)).min(1)),
+    TRUST_PROXY: booleanString,
+});
+export function parseEnv(source = process.env) {
+    const parsed = EnvSchema.safeParse(source);
+    if (!parsed.success) {
+        const fields = parsed.error.issues.map((issue) => issue.path.join('.')).join(', ');
+        throw new Error(`Invalid environment: ${fields}`);
+    }
+    return parsed.data;
+}
+//# sourceMappingURL=env.js.map