@stigmer/server 3.14.1 → 3.15.0

package/src/identity/__tests__/oidc-discovery.test.ts

@@ -0,0 +1,122 @@
+/**
+ * Pins the shared OIDC discovery reader (oidc-discovery.ts; 20260911.11
+ * A8): the verifier's validation rules kept (issuer must match exactly,
+ * jwks_uri required), userinfo_endpoint carried when present and absent
+ * otherwise, one fetch per issuer after a success, and a failure that is
+ * NOT cached so a flaky IdP at boot cannot brick a lane. The fetch is
+ * injected; nothing dials out.
+ */
+import { describe, expect, it } from "vitest";
+
+import { discoveryUrl, newIssuerDiscovery } from "../oidc-discovery.js";
+
+const ISSUER = "https://issuer.test";
+
+function fetchAnswering(
+  answers: Array<{ status: number; body?: unknown }>,
+): typeof fetch & { urls: string[] } {
+  const urls: string[] = [];
+  const impl = async (input: string | URL | Request): Promise<Response> => {
+    urls.push(String(input));
+    const next = answers.shift();
+    if (next === undefined) {
+      throw new Error("no scripted answer left");
+    }
+    return new Response(
+      next.body === undefined ? null : JSON.stringify(next.body),
+      { status: next.status },
+    );
+  };
+  return Object.assign(impl as typeof fetch, { urls });
+}
+
+describe("newIssuerDiscovery", () => {
+  it("reads the well-known document once per issuer and carries the three endpoints", async () => {
+    const fetchImpl = fetchAnswering([
+      {
+        status: 200,
+        body: {
+          issuer: ISSUER,
+          jwks_uri: `${ISSUER}/jwks`,
+          userinfo_endpoint: `${ISSUER}/userinfo`,
+        },
+      },
+    ]);
+    const discovery = newIssuerDiscovery(fetchImpl);
+
+    const first = await discovery.discover(ISSUER);
+    const second = await discovery.discover(ISSUER);
+
+    expect(first).toEqual({
+      issuer: ISSUER,
+      jwksUri: `${ISSUER}/jwks`,
+      userinfoEndpoint: `${ISSUER}/userinfo`,
+    });
+    expect(second).toBe(first);
+    expect(fetchImpl.urls).toEqual([discoveryUrl(ISSUER)]);
+  });
+
+  it("strips one trailing slash from the issuer when forming the well-known URL", () => {
+    expect(discoveryUrl("https://issuer.test/")).toBe(
+      "https://issuer.test/.well-known/openid-configuration",
+    );
+  });
+
+  it("carries no userinfo endpoint when the document names none — the consumer decides", async () => {
+    const discovery = newIssuerDiscovery(
+      fetchAnswering([
+        { status: 200, body: { issuer: ISSUER, jwks_uri: `${ISSUER}/jwks` } },
+      ]),
+    );
+    expect((await discovery.discover(ISSUER)).userinfoEndpoint).toBeUndefined();
+  });
+
+  it("refuses a document that names another issuer (RFC 8414 §3.3)", async () => {
+    const discovery = newIssuerDiscovery(
+      fetchAnswering([
+        {
+          status: 200,
+          body: { issuer: "https://elsewhere.test", jwks_uri: "x" },
+        },
+      ]),
+    );
+    await expect(discovery.discover(ISSUER)).rejects.toThrow(
+      "does not match configured issuer",
+    );
+  });
+
+  it("refuses a document with no jwks_uri", async () => {
+    const discovery = newIssuerDiscovery(
+      fetchAnswering([{ status: 200, body: { issuer: ISSUER } }]),
+    );
+    await expect(discovery.discover(ISSUER)).rejects.toThrow(
+      "carries no jwks_uri",
+    );
+  });
+
+  it("does not cache a failure: the next call fetches again", async () => {
+    const fetchImpl = fetchAnswering([
+      { status: 503 },
+      { status: 200, body: { issuer: ISSUER, jwks_uri: `${ISSUER}/jwks` } },
+    ]);
+    const discovery = newIssuerDiscovery(fetchImpl);
+
+    await expect(discovery.discover(ISSUER)).rejects.toThrow(
+      "answered HTTP 503",
+    );
+    expect((await discovery.discover(ISSUER)).jwksUri).toBe(`${ISSUER}/jwks`);
+    expect(fetchImpl.urls).toHaveLength(2);
+  });
+
+  it("keeps issuers apart in the cache", async () => {
+    const other = "https://other.test";
+    const discovery = newIssuerDiscovery(
+      fetchAnswering([
+        { status: 200, body: { issuer: ISSUER, jwks_uri: "a" } },
+        { status: 200, body: { issuer: other, jwks_uri: "b" } },
+      ]),
+    );
+    expect((await discovery.discover(ISSUER)).jwksUri).toBe("a");
+    expect((await discovery.discover(other)).jwksUri).toBe("b");
+  });
+});

package/src/identity/__tests__/oidc-userinfo.test.ts

@@ -0,0 +1,103 @@
+/**
+ * Pins the OIDC userinfo client (oidc-userinfo.ts; 20260911.11 A8): the
+ * endpoint is the vouching issuer's discovered `userinfo_endpoint`, called
+ * with the caller's own token as a bearer; the claims map as the cloud's
+ * client maps them (email, given_name, family_name, picture; missing or
+ * non-string → ""); a document with no userinfo_endpoint and a non-2xx
+ * answer both throw (the domain wraps them UserInfoFetchError). The fetch
+ * and the discovery are injected; nothing dials out.
+ */
+import { describe, expect, it } from "vitest";
+
+import type { IssuerDiscovery } from "../oidc-discovery.js";
+import { newOidcUserInfoClient } from "../oidc-userinfo.js";
+
+const ISSUER = "https://issuer.test";
+
+function discoveryNaming(
+  userinfoEndpoint: string | undefined,
+): IssuerDiscovery {
+  return {
+    discover: (issuer) =>
+      Promise.resolve({ issuer, jwksUri: `${issuer}/jwks`, userinfoEndpoint }),
+  };
+}
+
+function fetchRecording(
+  status: number,
+  body: unknown,
+): typeof fetch & { requests: Array<{ url: string; authorization: string }> } {
+  const requests: Array<{ url: string; authorization: string }> = [];
+  const impl = async (
+    input: string | URL | Request,
+    init?: RequestInit,
+  ): Promise<Response> => {
+    const headers = new Headers(init?.headers);
+    requests.push({
+      url: String(input),
+      authorization: headers.get("authorization") ?? "",
+    });
+    return new Response(JSON.stringify(body), { status });
+  };
+  return Object.assign(impl as typeof fetch, { requests });
+}
+
+describe("newOidcUserInfoClient", () => {
+  it("calls the issuer's discovered userinfo endpoint with the token as a bearer and maps the claims", async () => {
+    const fetchImpl = fetchRecording(200, {
+      sub: "auth0|alice",
+      email: "alice@example.com",
+      given_name: "Alice",
+      family_name: "Liddell",
+      picture: "https://img.example/alice.png",
+    });
+    const client = newOidcUserInfoClient(
+      discoveryNaming(`${ISSUER}/userinfo`),
+      fetchImpl,
+    );
+
+    const profile = await client.fetchUserProfile(ISSUER, "the-token");
+
+    expect(profile).toEqual({
+      email: "alice@example.com",
+      firstName: "Alice",
+      lastName: "Liddell",
+      pictureUrl: "https://img.example/alice.png",
+    });
+    expect(fetchImpl.requests).toEqual([
+      { url: `${ISSUER}/userinfo`, authorization: "Bearer the-token" },
+    ]);
+  });
+
+  it("a missing or non-string claim is the empty string", async () => {
+    const client = newOidcUserInfoClient(
+      discoveryNaming(`${ISSUER}/userinfo`),
+      fetchRecording(200, { sub: "x", email: 42, given_name: null }),
+    );
+    expect(await client.fetchUserProfile(ISSUER, "t")).toEqual({
+      email: "",
+      firstName: "",
+      lastName: "",
+      pictureUrl: "",
+    });
+  });
+
+  it("refuses an issuer whose discovery names no userinfo_endpoint — never a guessed URL", async () => {
+    const fetchImpl = fetchRecording(200, {});
+    const client = newOidcUserInfoClient(discoveryNaming(undefined), fetchImpl);
+    await expect(client.fetchUserProfile(ISSUER, "t")).rejects.toThrow(
+      "publishes no userinfo_endpoint",
+    );
+    expect(fetchImpl.requests).toEqual([]);
+  });
+
+  it("a non-2xx answer throws with the status", async () => {
+    const client = newOidcUserInfoClient(
+      discoveryNaming(`${ISSUER}/userinfo`),
+      fetchRecording(503, {}),
+    );
+    await expect(client.fetchUserProfile(ISSUER, "t")).rejects.toThrow(
+      "userinfo answered 503",
+    );
+  });
+});

package/src/identity/__tests__/oidc-verifier.test.ts

@@ -7,16 +7,41 @@
  * classifyAuthError arms, and the infrastructure-fault posture (discovery
  * failures are plain errors for the chassis's INTERNAL arm — never
  * credential rejections).
+ *
+ * Since 20260911.11 (Q-IA-2, A1) the verifier also resolves the subject to
+ * an identity ACCOUNT id when one exists — the cloud's direct-login
+ * posture — through the store port it is composed with: a hit stamps the
+ * account id, a miss admits the caller idp-shaped (identityId = sub) so
+ * whoAmI can answer NOT_FOUND and provisionMyAccount can run. One
+ * primary-key read per request, no cache (the same liveness posture as
+ * the API-key lane). The store is a REQUIRED dependency (a nullable that
+ * changes what identityId means is exactly the modeled-state rule
+ * forbids); over an empty store every pre-entry arm reads as before.
+ *
+ * Issuer discovery is a REQUIRED dependency too (T01_1_review.md A8; the
+ * S2 slice-2 refinement): the verifier reads the JWKS location through
+ * the shared oidc-discovery module the composition root builds once for
+ * every lane. Two arms make the memo visible — N sequential verifies
+ * fetch the well-known document once and the JWKS once — and one pins
+ * that claim-or-pass precedes discovery: a non-JWT token passes with no
+ * network even when the issuer is unreachable.
  */
 import { createServer } from "node:http";
 import type { Server } from "node:http";
 import { once } from "node:events";
 
+import { create } from "@bufbuild/protobuf";
 import { Code, ConnectError } from "@connectrpc/connect";
 import { SignJWT, exportJWK, generateKeyPair } from "jose";
 import type { GenerateKeyPairResult } from "jose";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
+
+import { fakeIdentityAccountStore } from "../../domain/identityaccount/__tests__/support.js";
+import { accountIdFor } from "../../domain/identityaccount/constants.js";
+import { newIssuerDiscovery } from "../oidc-discovery.js";
 import {
   INVALID_TOKEN_MESSAGE,
   TOKEN_AUDIENCE_MESSAGE,
@@ -31,19 +56,27 @@ let issuerServer: Server;
 let issuer: string;
 let keys: GenerateKeyPairResult;
 let strangerKeys: GenerateKeyPairResult;
+// How often the hermetic issuer served each document — the memo arms read these.
+const hits = { discovery: 0, jwks: 0 };
 
 beforeAll(async () => {
   keys = await generateKeyPair("RS256");
   strangerKeys = await generateKeyPair("RS256");
-  const jwk = { ...(await exportJWK(keys.publicKey)), kid: "test-key", alg: "RS256" };
+  const jwk = {
+    ...(await exportJWK(keys.publicKey)),
+    kid: "test-key",
+    alg: "RS256",
+  };
 
   issuerServer = createServer((req, res) => {
     if (req.url === "/.well-known/openid-configuration") {
+      hits.discovery += 1;
       res.setHeader("content-type", "application/json");
       res.end(JSON.stringify({ issuer, jwks_uri: `${issuer}/jwks` }));
       return;
     }
     if (req.url === "/jwks") {
+      hits.jwks += 1;
       res.setHeader("content-type", "application/json");
       res.end(JSON.stringify({ keys: [jwk] }));
       return;
@@ -93,8 +126,14 @@ async function mintToken(options: TokenOptions = {}): Promise<string> {
   return jwt.sign(key);
 }
 
+/** The verifier over an EMPTY account store: every subject is a miss, so the pre-entry arms read exactly as before. */
 function verifier() {
-  return newOidcIdentityVerifier({ issuer, audience: AUDIENCE });
+  return newOidcIdentityVerifier({
+    issuer,
+    audience: AUDIENCE,
+    accounts: fakeIdentityAccountStore(),
+    discovery: newIssuerDiscovery(),
+  });
 }
 
 async function rejectionOf(promise: Promise<unknown>): Promise<unknown> {
@@ -166,7 +205,10 @@ describe("the byte-pinned classifyAuthError arms", () => {
   });
 
   it("issuer-claim mismatch → 'invalid token' (the fallback arm)", async () => {
-    const token = await mintToken({ sub: "s", issuerClaim: "https://evil.test" });
+    const token = await mintToken({
+      sub: "s",
+      issuerClaim: "https://evil.test",
+    });
     const error = await rejectionOf(verifier().verify(token));
     expect(ConnectError.from(error).rawMessage).toBe(INVALID_TOKEN_MESSAGE);
   });
@@ -178,12 +220,138 @@ describe("the byte-pinned classifyAuthError arms", () => {
   });
 });
 
+describe("subject → account resolution (20260911.11 Q-IA-2, A1)", () => {
+  function seeded(sub: string, email: string) {
+    const accounts = fakeIdentityAccountStore();
+    accounts.rows.set(
+      accountIdFor(sub),
+      create(IdentityAccountSchema, {
+        metadata: { id: accountIdFor(sub), name: email },
+        spec: {
+          idpId: sub,
+          email,
+          provisioningMode: IdentityAccountProvisioningMode.direct,
+        },
+      }),
+    );
+    return accounts;
+  }
+
+  it("a subject with an account resolves to the ACCOUNT id; the claims still flow", async () => {
+    const accounts = seeded("auth0|known", "known@example.com");
+    const token = await mintToken({
+      sub: "auth0|known",
+      email: "known@example.com",
+      name: "Known",
+    });
+    const identity = await newOidcIdentityVerifier({
+      issuer,
+      audience: AUDIENCE,
+      accounts,
+      discovery: newIssuerDiscovery(),
+    }).verify(token);
+    expect(identity).toEqual({
+      identityId: accountIdFor("auth0|known"),
+      callerClass: "user",
+      issuer,
+      rawToken: token,
+      email: "known@example.com",
+      displayName: "Known",
+    });
+  });
+
+  it("a subject without an account is admitted idp-shaped — identityId is the sub", async () => {
+    const accounts = seeded("auth0|someone-else", "other@example.com");
+    const token = await mintToken({ sub: "auth0|unknown" });
+    const identity = await newOidcIdentityVerifier({
+      issuer,
+      audience: AUDIENCE,
+      accounts,
+      discovery: newIssuerDiscovery(),
+    }).verify(token);
+    expect(identity?.identityId).toBe("auth0|unknown");
+  });
+
+  it("resolution is one primary-key read per request, no cache — a row created after the first request is seen on the next", async () => {
+    const accounts = fakeIdentityAccountStore();
+    const verifierWithStore = newOidcIdentityVerifier({
+      issuer,
+      audience: AUDIENCE,
+      accounts,
+      discovery: newIssuerDiscovery(),
+    });
+    const token = await mintToken({ sub: "auth0|late" });
+    expect((await verifierWithStore.verify(token))?.identityId).toBe(
+      "auth0|late",
+    );
+
+    accounts.rows.set(
+      accountIdFor("auth0|late"),
+      create(IdentityAccountSchema, {
+        metadata: { id: accountIdFor("auth0|late"), name: "late" },
+        spec: {
+          idpId: "auth0|late",
+          provisioningMode: IdentityAccountProvisioningMode.direct,
+        },
+      }),
+    );
+    expect((await verifierWithStore.verify(token))?.identityId).toBe(
+      accountIdFor("auth0|late"),
+    );
+  });
+
+  it("a store fault during resolution is an infrastructure fault (plain error), never a credential rejection", async () => {
+    const accounts = fakeIdentityAccountStore();
+    const broken = {
+      ...accounts,
+      findDirectByIdpId: () => Promise.reject(new Error("store is on fire")),
+    };
+    const token = await mintToken({ sub: "auth0|anyone" });
+    const error = await rejectionOf(
+      newOidcIdentityVerifier({
+        issuer,
+        audience: AUDIENCE,
+        accounts: broken,
+        discovery: newIssuerDiscovery(),
+      }).verify(token),
+    );
+    expect(error).not.toBeInstanceOf(ConnectError);
+    expect(String(error)).toContain("store is on fire");
+  });
+});
+
+describe("discovery and keys are fetched once per verifier (A8; the shared oidc-discovery module)", () => {
+  it("N sequential verifies fetch the well-known document once and the JWKS once", async () => {
+    const one = verifier();
+    const before = { ...hits };
+    for (const sub of ["auth0|a", "auth0|b", "auth0|c"]) {
+      expect((await one.verify(await mintToken({ sub })))?.identityId).toBe(
+        sub,
+      );
+    }
+    expect(hits.discovery - before.discovery).toBe(1);
+    expect(hits.jwks - before.jwks).toBe(1);
+  });
+
+  it("claim-or-pass precedes discovery: a non-JWT token passes with no network, even when the issuer is unreachable", async () => {
+    const dead = newOidcIdentityVerifier({
+      issuer: "http://127.0.0.1:1",
+      audience: AUDIENCE,
+      accounts: fakeIdentityAccountStore(),
+      discovery: newIssuerDiscovery(),
+    });
+    expect(await dead.verify("stk_notajwt")).toBeNull();
+  });
+});
+
 describe("infrastructure faults are never credential rejections", () => {
   it("an unreachable issuer throws a PLAIN error (chassis maps INTERNAL)", async () => {
     const dead = newOidcIdentityVerifier({
       // Port 1 is deterministically closed.
       issuer: "http://127.0.0.1:1",
       audience: AUDIENCE,
+      accounts: fakeIdentityAccountStore(),
+      discovery: newIssuerDiscovery(),
     });
     const error = await rejectionOf(dead.verify(await mintToken({ sub: "s" })));
     expect(error).not.toBeInstanceOf(ConnectError);
@@ -195,6 +363,8 @@ describe("infrastructure faults are never credential rejections", () => {
       // one — the discovery-document identity check must refuse.
       issuer: `${issuer}/`,
       audience: AUDIENCE,
+      accounts: fakeIdentityAccountStore(),
+      discovery: newIssuerDiscovery(),
     });
     const error = await rejectionOf(
       misconfigured.verify(await mintToken({ sub: "s" })),

package/src/identity/oidc-discovery.ts

@@ -0,0 +1,84 @@
+/**
+ * OIDC issuer discovery (20260911.11, T01_1_review.md A8) — the one
+ * reader of `/.well-known/openid-configuration`, shared by every lane
+ * that needs an issuer's endpoints: the userinfo client (oidc-userinfo.ts)
+ * and the identity verifier's JWKS location (oidc-verifier.ts), so one
+ * issuer is discovered once and validated the same way wherever it is
+ * consumed. The composition root builds ONE instance and hands it to
+ * both.
+ *
+ * The verifier's rules, kept: the document's `issuer` must equal the
+ * requested issuer exactly (RFC 8414 §3.3 — a document that names another
+ * issuer is a misconfiguration or a redirect to somewhere else); `jwks_uri`
+ * is required (OpenID Connect Discovery 1.0 §3 says so). `userinfo_endpoint`
+ * is RECOMMENDED by the spec, so it is carried when present and its
+ * consumer decides what its absence means.
+ *
+ * Memoized per issuer ON SUCCESS only: a failed fetch is retried on the
+ * next call, so a flaky IdP at boot never permanently bricks a lane. An
+ * outage is an infrastructure fault thrown as a plain error — the caller
+ * maps it (the chassis to INTERNAL, the provisioning handler to
+ * UNAVAILABLE), never a credential rejection. The fetch is injected so
+ * tests never dial out and the composition root owns the process boundary.
+ */
+
+export interface DiscoveredIssuer {
+  readonly issuer: string;
+  readonly jwksUri: string;
+  /** Absent when the document names none. */
+  readonly userinfoEndpoint: string | undefined;
+}
+
+export interface IssuerDiscovery {
+  /** The validated document for `issuer`, from the cache after the first success. */
+  discover(issuer: string): Promise<DiscoveredIssuer>;
+}
+
+export function discoveryUrl(issuer: string): string {
+  return `${issuer.replace(/\/$/, "")}/.well-known/openid-configuration`;
+}
+
+export function newIssuerDiscovery(
+  fetchImpl: typeof fetch = fetch,
+): IssuerDiscovery {
+  const discovered = new Map<string, DiscoveredIssuer>();
+  return {
+    async discover(issuer: string): Promise<DiscoveredIssuer> {
+      const cached = discovered.get(issuer);
+      if (cached !== undefined) {
+        return cached;
+      }
+      const url = discoveryUrl(issuer);
+      const response = await fetchImpl(url);
+      if (!response.ok) {
+        throw new Error(
+          `OIDC discovery failed: ${url} answered HTTP ${response.status}`,
+        );
+      }
+      const document = (await response.json()) as {
+        issuer?: unknown;
+        jwks_uri?: unknown;
+        userinfo_endpoint?: unknown;
+      };
+      if (document.issuer !== issuer) {
+        throw new Error(
+          `OIDC discovery failed: document issuer '${typeof document.issuer === "string" ? document.issuer : ""}' does not match configured issuer '${issuer}'`,
+        );
+      }
+      if (typeof document.jwks_uri !== "string" || document.jwks_uri === "") {
+        throw new Error(`OIDC discovery failed: ${url} carries no jwks_uri`);
+      }
+      const result: DiscoveredIssuer = {
+        issuer,
+        jwksUri: document.jwks_uri,
+        userinfoEndpoint:
+          typeof document.userinfo_endpoint === "string" &&
+          document.userinfo_endpoint !== ""
+            ? document.userinfo_endpoint
+            : undefined,
+      };
+      discovered.set(issuer, result);
+      return result;
+    },
+  };
+}

package/src/identity/oidc-userinfo.ts

@@ -0,0 +1,64 @@
+/**
+ * The OIDC userinfo client (20260911.11, T01_1_review.md A8) — the
+ * infrastructure behind the identity-account domain's UserInfoClient
+ * port (domain/identityaccount/provisioning.ts): the profile of the
+ * bearer of an access token, from the `userinfo_endpoint` the token's
+ * ISSUER publishes, fetched with that very token.
+ *
+ * The issuer is a per-call argument, not a construction-time binding,
+ * because the composition does not know which issuer will vouch for a
+ * caller: open source's own OIDC lane names one in STIGMER_OIDC_ISSUER,
+ * the cloud's verifiers name theirs on the CallerIdentity they mint. The
+ * one issuer whose userinfo can answer for a token is the one that issued
+ * it — and a verifier already trusted it, so the token goes only where it
+ * came from.
+ *
+ * The endpoint is the discovery document's word, never a guessed
+ * `<issuer>/userinfo`: a document that names no `userinfo_endpoint` is
+ * refused as a fetch failure (the domain maps it UNAVAILABLE with the
+ * cloud's copy), so a misconfigured issuer fails loudly at the first
+ * sign-in rather than silently against a wrong URL.
+ *
+ * Claims read as the cloud's client reads them: `email`, `given_name`,
+ * `family_name`, `picture`; a missing or non-string claim is the empty
+ * string. Any non-2xx or malformed answer throws; the domain's
+ * UserInfoFetchError wraps it.
+ */
+import type {
+  UserInfoClient,
+  UserProfile,
+} from "../domain/identityaccount/provisioning.js";
+import type { IssuerDiscovery } from "./oidc-discovery.js";
+
+export function newOidcUserInfoClient(
+  discovery: IssuerDiscovery,
+  fetchImpl: typeof fetch = fetch,
+): UserInfoClient {
+  return {
+    async fetchUserProfile(issuer, accessToken): Promise<UserProfile> {
+      const { userinfoEndpoint } = await discovery.discover(issuer);
+      if (userinfoEndpoint === undefined) {
+        throw new Error(
+          `issuer '${issuer}' publishes no userinfo_endpoint in its discovery document`,
+        );
+      }
+      const response = await fetchImpl(userinfoEndpoint, {
+        headers: { authorization: `Bearer ${accessToken}` },
+      });
+      if (!response.ok) {
+        throw new Error(`userinfo answered ${response.status}`);
+      }
+      const claims = (await response.json()) as Record<string, unknown>;
+      const text = (key: string): string => {
+        const value = claims[key];
+        return typeof value === "string" ? value : "";
+      };
+      return {
+        email: text("email"),
+        firstName: text("given_name"),
+        lastName: text("family_name"),
+        pictureUrl: text("picture"),
+      };
+    },
+  };
+}