@starci/auth 0.5.0 → 0.6.0

package/dist/testing/oidc.js

@@ -0,0 +1,493 @@
+import { createHash, randomUUID } from "node:crypto";
+import { createServer } from "node:http";
+import { SignJWT, calculateJwkThumbprint, exportJWK, generateKeyPair } from "jose";
+import { OIDC_CLAIMS } from "../contracts/oidc.js";
+const KEYCLOAK_PATHS = {
+    authorization: "/protocol/openid-connect/auth",
+    token: "/protocol/openid-connect/token",
+    certs: "/protocol/openid-connect/certs",
+    logout: "/protocol/openid-connect/logout",
+    revoke: "/protocol/openid-connect/revoke",
+};
+const DISCOVERY = "/.well-known/openid-configuration";
+const SECOND_MS = 1000;
+const s256 = (verifier) => createHash("sha256").update(verifier).digest("base64url");
+const generateKey = async (algorithm) => {
+    const pair = await generateKeyPair(algorithm, { extractable: true });
+    const exported = await exportJWK(pair.publicKey);
+    const kid = await calculateJwkThumbprint(exported);
+    return { kid, privateKey: pair.privateKey, jwk: { ...exported, kid, alg: algorithm, use: "sig" } };
+};
+const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const form = (value) => Object.fromEntries(new URLSearchParams(value));
+const readBody = async (request) => {
+    const chunks = [];
+    for await (const chunk of request)
+        chunks.push(Buffer.from(chunk));
+    return Buffer.concat(chunks).toString("utf8");
+};
+/**
+ * A fake OIDC provider that behaves like Keycloak for what the package uses: the discovery document, the JWKS, the token endpoint (authorization
+ * code with PKCE, refresh token with rotation) and the logout endpoint, with keys that rotate and tokens a spec can bend (expired, wrong
+ * audience, wrong issuer, unknown key, foreign signature). Its `http` is an in-memory `OidcHttp` (no socket, no port), so an app's spec registers
+ * the module against it and needs no Keycloak; `listen: true` serves the same issuer on a real socket for a browser.
+ */
+export class FakeOidcIssuer {
+    clientId;
+    #realm;
+    #algorithm;
+    #audience;
+    #secret;
+    #clock;
+    #accessTtl;
+    #ring = [];
+    #codes = new Map();
+    #refreshTokens = new Map();
+    #refreshTtl;
+    #providers;
+    #revocation;
+    #minPassword;
+    #users = new Map();
+    #adminTokens = new Map();
+    #hints = [];
+    #failures = [];
+    #requests = [];
+    #issuer;
+    #server;
+    #down = false;
+    #idOverrides = {};
+    constructor(options, issuer) {
+        this.clientId = options.clientId ?? "test-client";
+        this.#realm = options.realm ?? "test";
+        this.#algorithm = options.algorithm ?? "RS256";
+        this.#audience = options.audience ?? this.clientId;
+        this.#secret = options.clientSecret;
+        this.#clock = options.clock ?? { now: () => new Date() };
+        this.#accessTtl = options.accessTtlSeconds ?? 300;
+        this.#refreshTtl = options.refreshTtlSeconds ?? 1800;
+        this.#providers = options.identityProviders;
+        this.#revocation = options.revocation ?? true;
+        this.#minPassword = options.minPasswordLength ?? 8;
+        this.#issuer = issuer;
+    }
+    /** Creates an issuer with one signing key, and starts its socket when `listen` is set. */
+    static async create(options = {}) {
+        const realm = options.realm ?? "test";
+        const issuer = new FakeOidcIssuer(options, `${options.origin ?? "https://idp.test"}/realms/${realm}`);
+        issuer.#ring.push(await generateKey(issuer.#algorithm));
+        if (options.listen === true)
+            await issuer.#start();
+        return issuer;
+    }
+    /** The exact issuer: the `iss` claim and the `issuer` of the discovery document. */
+    get issuer() {
+        return this.#issuer;
+    }
+    /** The in-memory outbound port: answers like the issuer's endpoints, with the failures the spec injected. */
+    get http() {
+        return { request: (request) => this.#serve(request) };
+    }
+    /**
+     * Moves the issuer to another origin (`https://127.0.0.1:41001`), for a host that serves it on an address it only knows after it listens, as a
+     * test-world fake does. Tokens minted afterwards carry the new `iss` and the discovery document names the new endpoints; the keys stay.
+     */
+    rebase(origin) {
+        this.#issuer = `${origin}/realms/${this.#realm}`;
+    }
+    /** Answers one request as the issuer's endpoints do (the request's URL is under the issuer's address); a host that serves the issuer itself calls this from its listener. */
+    serve(request) {
+        return this.#serve(request);
+    }
+    /** The same endpoints as a `fetch`, for a front-end client under test (the browser client takes a `fetch`, not an `OidcHttp`). */
+    get fetch() {
+        return async (input, init) => {
+            const method = init?.method === "POST" ? "POST" : "GET";
+            const text = typeof init?.body === "string" ? init.body : "";
+            const answer = await this.#serve({ method, url: typeof input === "string" ? input : input instanceof URL ? input.href : input.url, timeoutMs: 1000, ...(text === "" ? {} : { form: form(text) }) });
+            return new Response(JSON.stringify(answer.body), { status: answer.status, headers: { "content-type": "application/json" } });
+        };
+    }
+    /** The requests the issuer has answered, oldest first. */
+    get requests() {
+        return this.#requests;
+    }
+    /** The `kc_idp_hint` of every authorization address `authorize` has played, oldest first (an address without a hint adds nothing). */
+    get idpHints() {
+        return this.#hints;
+    }
+    /** Adds an account the password grant admits (by username or email) and the admin API lists. Answers it with its id. */
+    seedUser(user) {
+        const { password, ...rest } = user;
+        const seeded = { ...rest, id: user.id ?? randomUUID() };
+        this.#users.set(seeded.id, { user: seeded, password });
+        return seeded;
+    }
+    /** The account with this id, username or email (case-insensitive), as the issuer holds it now; undefined when there is none. */
+    findUser(identifier) {
+        return this.#lookup(identifier)?.user;
+    }
+    /** True when the account's current password is this one. */
+    passwordMatches(identifier, password) {
+        return this.#lookup(identifier)?.password === password;
+    }
+    /** How many refresh tokens the issuer holds that can still be used. */
+    get liveRefreshTokens() {
+        return [...this.#refreshTokens.values()].filter((held) => !held.used).length;
+    }
+    /** How many requests asked this path (`/protocol/openid-connect/certs`, `/.well-known/openid-configuration`). */
+    count(path) {
+        return this.#requests.filter((request) => request.path === path).length;
+    }
+    /** The issuer and key set addresses an issuer preset takes as `endpoints` to stand this double in for Google or GitHub Actions. */
+    endpoints() {
+        return { issuer: this.#issuer, jwksUri: `${this.#issuer}${KEYCLOAK_PATHS.certs}` };
+    }
+    /** The options a registration against this issuer takes: the issuer, the audience, the in-memory port, the clock, and the client when `callbackUri` is given. */
+    options(overrides = {}) {
+        const { callbackUri, postLogoutUri, ...rest } = overrides;
+        return {
+            issuer: this.#issuer,
+            audience: this.#audience,
+            http: this.http,
+            clock: this.#clock,
+            allowInsecureHttp: this.#issuer.startsWith("http:"),
+            ...(callbackUri === undefined
+                ? {}
+                : {
+                    client: {
+                        clientId: this.clientId,
+                        ...(this.#secret === undefined ? {} : { clientSecret: this.#secret }),
+                        callbackUri,
+                        postLogoutUri: postLogoutUri ?? new URL("/signed-out", callbackUri).toString(),
+                    },
+                }),
+            ...rest,
+        };
+    }
+    /** The discovery document. */
+    metadata() {
+        const base = `${this.#issuer}/protocol/openid-connect`;
+        return {
+            issuer: this.#issuer,
+            authorization_endpoint: `${base}/auth`,
+            token_endpoint: `${base}/token`,
+            jwks_uri: `${base}/certs`,
+            end_session_endpoint: `${base}/logout`,
+            ...(this.#revocation ? { revocation_endpoint: `${base}/revoke` } : {}),
+            id_token_signing_alg_values_supported: [this.#algorithm],
+            response_types_supported: ["code"],
+            code_challenge_methods_supported: ["S256"],
+        };
+    }
+    /** The published key set: every key of the ring. */
+    jwks() {
+        return { keys: this.#ring.map((key) => key.jwk) };
+    }
+    /** The `kid` of the key that signs now. */
+    get keyId() {
+        return this.#signer().kid;
+    }
+    /** Rotates the signing key: a new key signs from now on. The old keys stay published (so tokens already minted verify) unless `keepOld` is false. Answers the new `kid`. */
+    async rotateKeys(options = {}) {
+        const fresh = await generateKey(this.#algorithm);
+        if (options.keepOld === false)
+            this.#ring.length = 0;
+        this.#ring.unshift(fresh);
+        return fresh.kid;
+    }
+    /** Mints an access token for the claims, signed by the current key unless an override bends it. */
+    mintAccessToken(claims = {}, overrides = {}) {
+        return this.#mint(claims, { type: "Bearer", ...overrides }, {});
+    }
+    /** Mints an ID token for the client, carrying the nonce of the transaction. */
+    mintIdToken(claims = {}, nonce, overrides = {}) {
+        return this.#mint(claims, { type: "ID", audience: this.clientId, ...overrides }, nonce === undefined ? {} : { nonce });
+    }
+    /**
+     * Plays the browser of a code flow: reads the authorization address the code under test built, registers a one-use code for the claims, and
+     * answers the address the provider would redirect the browser to (the redirect address with `code`, `state` and `iss`).
+     */
+    authorize(authorizationUrl, claims = {}) {
+        const query = new URL(authorizationUrl).searchParams;
+        const redirectUri = query.get("redirect_uri");
+        const state = query.get("state");
+        if (redirectUri === null || state === null || query.get("client_id") !== this.clientId || query.get("code_challenge_method") !== "S256") {
+            throw new Error("fake OIDC issuer: the authorization request is not a registered S256 code flow");
+        }
+        const hint = query.get("kc_idp_hint");
+        if (hint !== null) {
+            if (this.#providers !== undefined && !this.#providers.includes(hint))
+                throw new Error("fake OIDC issuer: the realm brokers no identity provider with this alias");
+            this.#hints.push(hint);
+        }
+        const code = randomUUID();
+        this.#codes.set(code, { claims, nonce: query.get("nonce") ?? "", challenge: query.get("code_challenge") ?? "", redirectUri, used: false });
+        const back = new URL(redirectUri);
+        back.search = new URLSearchParams({ code, state, iss: this.#issuer }).toString();
+        return back.toString();
+    }
+    /** Makes the next `count` requests fail: with an HTTP status, or as a lost connection. */
+    failNext(failure = { status: 503 }, count = 1) {
+        for (let n = 0; n < count; n += 1)
+            this.#failures.push(failure);
+    }
+    /** Bends every ID token the token endpoint mints from now on (an empty object restores them). */
+    bendIdTokens(overrides = {}) {
+        this.#idOverrides = overrides;
+    }
+    /** Ends every refresh token the issuer holds, as an administrator signing the person out of the provider would: the next refresh answers `invalid_grant`. */
+    revokeRefreshTokens() {
+        this.#refreshTokens.clear();
+    }
+    /** While down, every request fails as a lost connection (an outage); `false` brings the issuer back. */
+    setDown(down) {
+        this.#down = down;
+    }
+    /** Stops the socket, when there is one. */
+    async close() {
+        const server = this.#server;
+        if (server === undefined)
+            return;
+        this.#server = undefined;
+        server.closeAllConnections();
+        await new Promise((resolve) => {
+            server.close(() => {
+                resolve();
+            });
+        });
+    }
+    #signer() {
+        const [key] = this.#ring;
+        if (key === undefined)
+            throw new Error("fake OIDC issuer: no signing key");
+        return key;
+    }
+    async #mint(claims, overrides, extra) {
+        const signer = overrides.signer === "foreign" ? await generateKey(this.#algorithm) : this.#signer();
+        const issuedAt = Math.floor((overrides.issuedAt ?? this.#clock.now()).getTime() / SECOND_MS);
+        const subject = claims.sub ?? "user-1";
+        const realm = claims.roles === undefined ? {} : { [OIDC_CLAIMS.realmAccess]: { roles: claims.roles } };
+        const clients = claims.clientRoles === undefined
+            ? {}
+            : { [OIDC_CLAIMS.resourceAccess]: Object.fromEntries(Object.entries(claims.clientRoles).map(([client, roles]) => [client, { roles }])) };
+        const jwt = new SignJWT({
+            ...realm,
+            ...clients,
+            [OIDC_CLAIMS.sessionId]: claims.sessionId ?? `sid-${subject}`,
+            [OIDC_CLAIMS.authorizedParty]: this.clientId,
+            ...(overrides.type === undefined ? {} : { [OIDC_CLAIMS.tokenType]: overrides.type }),
+            ...(claims.email === undefined ? {} : { [OIDC_CLAIMS.email]: claims.email }),
+            ...(claims.name === undefined ? {} : { [OIDC_CLAIMS.name]: claims.name }),
+            ...(claims.username === undefined ? {} : { [OIDC_CLAIMS.username]: claims.username }),
+            ...claims.extra,
+            ...extra,
+        })
+            .setProtectedHeader({ alg: this.#algorithm, typ: "JWT", ...(overrides.kid === null ? {} : { kid: overrides.kid ?? signer.kid }) })
+            .setSubject(subject)
+            .setIssuer(overrides.issuer ?? this.#issuer)
+            .setAudience(overrides.audience === undefined ? this.#audience : typeof overrides.audience === "string" ? overrides.audience : [...overrides.audience])
+            .setJti(randomUUID())
+            .setIssuedAt(issuedAt)
+            .setExpirationTime(issuedAt + (overrides.expiresInSeconds ?? this.#accessTtl));
+        if (overrides.notBefore !== undefined)
+            jwt.setNotBefore(Math.floor(overrides.notBefore.getTime() / SECOND_MS));
+        return jwt.sign(signer.privateKey);
+    }
+    async #serve(request) {
+        const url = new URL(request.url);
+        const path = url.pathname.startsWith(new URL(this.#issuer).pathname) ? url.pathname.slice(new URL(this.#issuer).pathname.length) : url.pathname;
+        this.#requests.push({ method: request.method, path });
+        if (this.#down)
+            throw new Error("fake OIDC issuer: connection refused");
+        const failure = this.#failures.shift();
+        if (failure === "network")
+            throw new Error("fake OIDC issuer: connection reset");
+        if (failure !== undefined)
+            return { status: failure.status, body: { error: "server_error" } };
+        return this.#handle({ method: request.method, path, query: url.searchParams, params: request.form ?? {}, body: request.body, authorization: request.headers?.authorization });
+    }
+    async #handle(inbound) {
+        const { method, path, params } = inbound;
+        if (method === "GET" && path === DISCOVERY)
+            return { status: 200, body: this.metadata() };
+        if (method === "GET" && path === KEYCLOAK_PATHS.certs)
+            return { status: 200, body: this.jwks() };
+        if (method === "GET" && path === KEYCLOAK_PATHS.logout)
+            return { status: 200, body: {} };
+        if (method === "POST" && path === KEYCLOAK_PATHS.token)
+            return this.#token(params);
+        if (method === "POST" && (path === KEYCLOAK_PATHS.revoke || path === KEYCLOAK_PATHS.logout))
+            return this.#revoke(params, path === KEYCLOAK_PATHS.logout);
+        if (path.startsWith(this.#adminBase()))
+            return this.#admin(inbound);
+        return { status: 404, body: { error: "not_found" } };
+    }
+    #adminBase() {
+        return `/admin/realms/${this.#realm}`;
+    }
+    #lookup(identifier) {
+        const wanted = identifier.toLowerCase();
+        return this.#users.get(identifier) ?? [...this.#users.values()].find(({ user }) => user.username.toLowerCase() === wanted || user.email?.toLowerCase() === wanted);
+    }
+    #claimsOf(user) {
+        return { sub: user.id, username: user.username, email: user.email, name: user.name, roles: user.roles };
+    }
+    #policy(password) {
+        if (typeof password === "string" && password.length >= this.#minPassword)
+            return undefined;
+        return { status: 400, body: { error: "invalid_password", error_description: `Invalid password: minimum length ${String(this.#minPassword)}.` } };
+    }
+    #revoke(params, endSession) {
+        if (params.client_id !== this.clientId || (this.#secret !== undefined && params.client_secret !== this.#secret))
+            return { status: 401, body: { error: "invalid_client" } };
+        const token = (endSession ? params.refresh_token : params.token) ?? "";
+        const known = this.#refreshTokens.delete(token);
+        // RFC 7009 answers 200 for a token it does not know; the end-session endpoint answers invalid_grant for one it cannot end.
+        if (!endSession)
+            return { status: 200, body: {} };
+        return known ? { status: 204, body: undefined } : { status: 400, body: { error: "invalid_grant" } };
+    }
+    #admin(inbound) {
+        const bearer = inbound.authorization?.startsWith("Bearer ") === true ? inbound.authorization.slice("Bearer ".length) : "";
+        const until = this.#adminTokens.get(bearer);
+        if (until === undefined || until <= this.#clock.now().getTime())
+            return { status: 401, body: { error: "HTTP 401 Unauthorized" } };
+        const rest = inbound.path.slice(this.#adminBase().length);
+        const body = isObject(inbound.body) ? inbound.body : {};
+        if (rest === "/users" && inbound.method === "POST")
+            return this.#createUser(body);
+        if (rest === "/users" && inbound.method === "GET")
+            return this.#listUsers(inbound.query);
+        const match = /^\/users\/([^/]+)\/(reset-password|logout)$/u.exec(rest);
+        if (match === null || (match[2] === "reset-password") !== (inbound.method === "PUT"))
+            return { status: 404, body: { error: "not_found" } };
+        const held = this.#users.get(decodeURIComponent(match[1] ?? ""));
+        if (held === undefined)
+            return { status: 404, body: { error: "User not found" } };
+        if (match[2] === "logout") {
+            for (const [token, refresh] of this.#refreshTokens)
+                if ((refresh.claims.sub ?? "user-1") === held.user.id)
+                    this.#refreshTokens.delete(token);
+            return { status: 204, body: undefined };
+        }
+        const refused = this.#policy(body.value);
+        if (refused !== undefined)
+            return refused;
+        held.password = String(body.value);
+        return { status: 204, body: undefined };
+    }
+    #createUser(body) {
+        const credential = Array.isArray(body.credentials) ? body.credentials[0] : undefined;
+        if (typeof body.username !== "string" || typeof body.email !== "string" || !isObject(credential))
+            return { status: 400, body: { error: "invalid_request" } };
+        if (this.#lookup(body.username) !== undefined || this.#lookup(body.email) !== undefined)
+            return { status: 409, body: { errorMessage: "User exists with same username or email" } };
+        const refused = this.#policy(credential.value);
+        if (refused !== undefined)
+            return refused;
+        const user = this.seedUser({ username: body.username, email: body.email, password: String(credential.value) });
+        return { status: 201, body: undefined, location: `${new URL(this.#issuer).origin}${this.#adminBase()}/users/${user.id}` };
+    }
+    #listUsers(query) {
+        const email = query.get("email");
+        const username = query.get("username");
+        const found = [...this.#users.values()]
+            .map(({ user }) => user)
+            .filter((user) => (email === null || user.email?.toLowerCase() === email.toLowerCase()) && (username === null || user.username.toLowerCase() === username.toLowerCase()));
+        return { status: 200, body: found.map((user) => ({ id: user.id, username: user.username, email: user.email, enabled: user.enabled ?? true })) };
+    }
+    async #token(params) {
+        if (params.client_id !== this.clientId || (this.#secret !== undefined && params.client_secret !== this.#secret))
+            return { status: 401, body: { error: "invalid_client" } };
+        if (params.grant_type === "authorization_code")
+            return this.#exchangeCode(params);
+        if (params.grant_type === "refresh_token")
+            return this.#refresh(params.refresh_token);
+        if (params.grant_type === "password")
+            return this.#password(params);
+        if (params.grant_type === "client_credentials")
+            return this.#serviceAccount();
+        return { status: 400, body: { error: "unsupported_grant_type" } };
+    }
+    async #exchangeCode(params) {
+        const pending = this.#codes.get(params.code ?? "");
+        const verifier = params.code_verifier ?? "";
+        if (pending === undefined || pending.used || pending.redirectUri !== params.redirect_uri || s256(verifier) !== pending.challenge) {
+            return { status: 400, body: { error: "invalid_grant" } };
+        }
+        pending.used = true;
+        return { status: 200, body: await this.#grant(pending.claims, pending.nonce) };
+    }
+    async #password(params) {
+        const held = this.#lookup(params.username ?? "");
+        if (held === undefined || params.password === undefined || held.password !== params.password)
+            return { status: 401, body: { error: "invalid_grant", error_description: "Invalid user credentials" } };
+        if (held.user.enabled === false)
+            return { status: 400, body: { error: "invalid_grant", error_description: "Account disabled" } };
+        return { status: 200, body: await this.#grant(this.#claimsOf(held.user), undefined) };
+    }
+    async #serviceAccount() {
+        if (this.#secret === undefined)
+            return { status: 400, body: { error: "unauthorized_client" } };
+        const name = `service-account-${this.clientId}`;
+        const token = await this.mintAccessToken({ sub: name, username: name });
+        this.#adminTokens.set(token, this.#clock.now().getTime() + this.#accessTtl * SECOND_MS);
+        return { status: 200, body: { token_type: "Bearer", access_token: token, expires_in: this.#accessTtl } };
+    }
+    async #refresh(token) {
+        const held = token === undefined ? undefined : this.#refreshTokens.get(token);
+        if (held === undefined || held.used)
+            return { status: 400, body: { error: "invalid_grant" } };
+        held.used = true;
+        return { status: 200, body: await this.#grant(held.claims, undefined) };
+    }
+    async #grant(claims, nonce) {
+        const refreshToken = randomUUID();
+        this.#refreshTokens.set(refreshToken, { claims, used: false });
+        return {
+            token_type: "Bearer",
+            access_token: await this.mintAccessToken(claims),
+            id_token: await this.mintIdToken(claims, nonce, this.#idOverrides),
+            refresh_token: refreshToken,
+            expires_in: this.#accessTtl,
+            refresh_expires_in: this.#refreshTtl,
+        };
+    }
+    async #start() {
+        const server = createServer((request, response) => {
+            void this.#respond(request, response);
+        });
+        this.#server = server;
+        await new Promise((resolve) => {
+            server.listen(0, "127.0.0.1", resolve);
+        });
+        const { port } = server.address();
+        this.#issuer = `http://127.0.0.1:${String(port)}/realms/${this.#realm}`;
+    }
+    async #respond(request, response) {
+        const cors = { "access-control-allow-origin": "*", "access-control-allow-headers": "content-type, authorization", "access-control-allow-methods": "GET, POST, PUT, OPTIONS" };
+        if (request.method === "OPTIONS") {
+            response.writeHead(204, cors).end();
+            return;
+        }
+        const method = request.method === "POST" || request.method === "PUT" ? request.method : "GET";
+        const text = method === "GET" ? "" : await readBody(request);
+        const json = request.headers["content-type"]?.startsWith("application/json") === true;
+        const authorization = request.headers.authorization;
+        try {
+            const answer = await this.#serve({
+                method,
+                url: `${this.#issuer.slice(0, this.#issuer.indexOf("/realms/"))}${request.url ?? "/"}`,
+                timeoutMs: 1000,
+                ...(authorization === undefined ? {} : { headers: { authorization } }),
+                ...(text === "" ? {} : json ? { body: JSON.parse(text) } : { form: form(text) }),
+            });
+            response
+                .writeHead(answer.status, { ...cors, "content-type": "application/json", ...(answer.location === undefined ? {} : { location: answer.location }) })
+                .end(answer.body === undefined ? undefined : JSON.stringify(answer.body));
+        }
+        catch {
+            response.destroy();
+        }
+    }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@starci/auth",
-  "version": "0.5.0",
-  "description": "The sign-in of a StarCi lite app in one package: a NestJS module (EdDSA access tokens with a multi-key JWKS, bcrypt passwords, Google OAuth with state and PKCE, rotating refresh tokens with a reuse grace window and reuse detection, a failures-only sign-in limit, the refresh cookie), the door contracts, a front-end auth client (access token in memory, one shared refresh, signed out only on 401 or 403) with React bindings, and test doubles.",
+  "version": "0.6.0",
+  "description": "The sign-in of a StarCi app in one package, for both editions. Lite: a NestJS module (EdDSA access tokens with a multi-key JWKS, bcrypt passwords, pluggable OAuth sign-in providers with state and PKCE (Google, GitHub), rotating refresh tokens with a reuse grace window and reuse detection, a failures-only sign-in limit, the refresh cookie). Full: the OIDC client of the identity provider (discovery, JWKS with caching and rotation, algorithm-pinned token checks, role mapping, the authorization code flow with PKCE and nonce, Keycloak brokering and admin) and issuer presets (Keycloak, Google ID tokens, GitHub Actions OIDC). The door contracts, the front-end auth clients (lite and OIDC) with React bindings, and test doubles with a fake OIDC issuer.",
   "keywords": [
     "auth",
     "jwt",
@@ -9,8 +9,13 @@
     "eddsa",
     "passport",
     "google-oauth",
+    "github-oauth",
     "pkce",
     "refresh-token",
+    "oidc",
+    "openid-connect",
+    "keycloak",
+    "github-actions",
     "nestjs",
     "react"
   ],
@@ -34,6 +39,10 @@
       "types": "./dist/server/index.d.ts",
       "default": "./dist/server/index.js"
     },
+    "./oidc": {
+      "types": "./dist/oidc/index.d.ts",
+      "default": "./dist/oidc/index.js"
+    },
     "./client": {
       "types": "./dist/client/index.d.ts",
       "default": "./dist/client/index.js"
@@ -42,6 +51,10 @@
       "types": "./dist/react/index.d.ts",
       "default": "./dist/react/index.js"
     },
+    "./client/oidc": {
+      "types": "./dist/client/oidc/index.d.ts",
+      "default": "./dist/client/oidc/index.js"
+    },
     "./contracts": {
       "types": "./dist/contracts/index.d.ts",
       "default": "./dist/contracts/index.js"
@@ -67,20 +80,21 @@
   },
   "scripts": {
     "build": "node -e \"require('node:fs').rmSync('dist', {recursive: true, force: true})\" && tsc -p tsconfig.build.json && node -e \"const fs = require('node:fs'); for (const f of fs.readdirSync('dist', {recursive: true}).filter((n) => n.endsWith('.d.ts'))) fs.writeFileSync('dist/' + f, fs.readFileSync('dist/' + f, 'utf8').replace(/((?:from |import\\()['\\x22]\\.\\.?\\/[^'\\x22]+)\\.ts(['\\x22])/g, (all, head, quote) => head + '.js' + quote))\"",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.isolated.json",
     "lint": "eslint .",
     "test": "npm run typecheck && npm run lint && node --test --experimental-test-coverage --test-coverage-include=\"src/**/*.ts\" --test-coverage-exclude=\"src/**/*.spec.ts\" --test-coverage-lines=90 \"src/**/*.spec.ts\"",
     "prepack": "npm run build",
     "prepublishOnly": "npm test && npm run build"
   },
   "dependencies": {
-    "@starci/common": "1.0.1",
     "@nestjs/passport": "11.0.5",
+    "@starci/common": "1.0.1",
     "bcryptjs": "3.0.3",
     "jose": "6.2.12",
     "passport": "0.7.0",
     "passport-google-oauth20": "2.0.0",
-    "passport-local": "1.0.0"
+    "passport-local": "1.0.0",
+    "passport-oauth2": "1.8.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11.0.0",
@@ -112,6 +126,7 @@
     "@types/node": "22.20.4",
     "@types/passport-google-oauth20": "2.0.17",
     "@types/passport-local": "1.0.38",
+    "@types/passport-oauth2": "1.8.0",
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",
     "eslint": "10.13.0",
@@ -127,6 +142,6 @@
     "access": "public",
     "provenance": true
   },
-  "gitHead": "f464f759079854716389ba92feb7e4a1512a0ee3",
-  "starciSource": "d302420a970828a385f4e2325e7ed2b3e34b10e48f9d4d552326ff9fa292d945"
+  "gitHead": "6747d857cc26e1f6348193180fd8a119cbdc330f",
+  "starciSource": "158d7eea780b1dd51a8f7ac2c287ff6e8a9bac77224b2ab9e1498ff1d72538c3"
 }

package/dist/server/google-state.d.ts

@@ -1,33 +0,0 @@
-import type { HttpRequest } from "./http.js";
-import type { AuthOptions } from "./options.js";
-import type { AuthClock, AuthIds } from "./ports.js";
-import type { AuthTokens } from "./tokens.js";
-/** The cookie that carries one Google round trip, when the options name none. */
-export declare const DEFAULT_GOOGLE_STATE_COOKIE = "auth_google_state";
-/** The only path the state cookie is sent to. */
-export declare const GOOGLE_STATE_PATH: "/auth/google";
-/** How long a Google round trip may take, in milliseconds. */
-export declare const GOOGLE_STATE_TTL_MS = 600000;
-type StoreDone = (error: Error | null, handle?: string) => void;
-type VerifyDone = (error: Error | null, verifier?: unknown, context?: unknown) => void;
-/**
- * The state store passport-oauth2 calls for `state` and PKCE without a server session: the handle (echoed as `state`), the code
- * verifier and the landing path travel in a signed, httpOnly cookie that only the callback path receives, and the handle is
- * compared on return. The landing path is a same-site path only, so the callback can never redirect off the web origin.
- */
-export declare class GoogleStateClient {
-    #private;
-    constructor(deps: {
-        readonly tokens: AuthTokens;
-        readonly clock: AuthClock;
-        readonly ids: AuthIds;
-        readonly options: Pick<AuthOptions, "returnOrigin" | "google">;
-    });
-    /** The name of the state cookie. */
-    get cookieName(): string;
-    /** Called by passport-oauth2 on the outbound leg (the five-argument PKCE form). */
-    store(req: HttpRequest, verifier: string, _state: unknown, _meta: unknown, done: StoreDone): void;
-    /** Called by passport-oauth2 on the return leg (the meta form, since this method takes four arguments): the cookie must be ours, unexpired and carry the same handle as `state`. */
-    verify(req: HttpRequest, providedState: string, _meta: unknown, done: VerifyDone): void;
-}
-export {};