@substrat-run/vertical-auth 0.13.0 → 0.13.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc-rp-provider.d.ts","sourceRoot":"","sources":["../src/oidc-rp-provider.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"oidc-rp-provider.d.ts","sourceRoot":"","sources":["../src/oidc-rp-provider.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,eAAe,CAAC;AAI/D;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,YAAY;IAC3B,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,0FAA0F;IAC1F,aAAa,EAAE,MAAM,CAAC;IACtB,gGAAgG;IAChG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AA4FD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,YAAY,GAAG,YAAY,CA+FlE"}
|
package/dist/oidc-rp-provider.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { beginLogin, completeLogin, verifySession, readCookie, safePath, SESSION_COOKIE, FLOW_COOKIE, SESSION_MAXAGE, FLOW_MAXAGE, } from '@substrat-run/oidc-rp';
|
|
1
|
+
import { beginLogin, completeLogin, federatedLogoutUrl, verifySession, readCookie, safePath, SESSION_COOKIE, FLOW_COOKIE, LOGOUT_HINT_COOKIE, LOGOUT_PATH, SESSION_MAXAGE, FLOW_MAXAGE, } from '@substrat-run/oidc-rp';
|
|
2
2
|
import { oidcAuthProvider } from './oidc.js';
|
|
3
3
|
import { resolveCookieDomain } from './cookie-domain.js';
|
|
4
4
|
const envOf = (cfg) => ({
|
|
@@ -7,14 +7,14 @@ const envOf = (cfg) => ({
|
|
|
7
7
|
OIDC_CLIENT_SECRET: cfg.clientSecret,
|
|
8
8
|
SESSION_SECRET: cfg.sessionSecret,
|
|
9
9
|
});
|
|
10
|
-
/** Serialize one Set-Cookie value — HttpOnly, Lax
|
|
11
|
-
function cookie(name, value, origin, maxAge, domain) {
|
|
10
|
+
/** Serialize one Set-Cookie value — HttpOnly, and by default Lax on path=/ (the oidc-rp mount's flags). */
|
|
11
|
+
function cookie(name, value, origin, maxAge, domain, path = '/', sameSite = 'Lax') {
|
|
12
12
|
const parts = [
|
|
13
13
|
`${name}=${encodeURIComponent(value)}`,
|
|
14
|
-
|
|
14
|
+
`Path=${path}`,
|
|
15
15
|
`Max-Age=${maxAge}`,
|
|
16
16
|
'HttpOnly',
|
|
17
|
-
|
|
17
|
+
`SameSite=${sameSite}`,
|
|
18
18
|
];
|
|
19
19
|
if (domain)
|
|
20
20
|
parts.push(`Domain=${domain}`);
|
|
@@ -34,6 +34,36 @@ function sessionCookies(value, origin, maxAge, domain) {
|
|
|
34
34
|
return [cookie(SESSION_COOKIE, value, origin, maxAge)];
|
|
35
35
|
return [cookie(SESSION_COOKIE, value, origin, maxAge, domain), cookie(SESSION_COOKIE, '', origin, 0)];
|
|
36
36
|
}
|
|
37
|
+
/**
|
|
38
|
+
* The login's ID token, kept ONLY to be handed back to the issuer as `id_token_hint`
|
|
39
|
+
* when this session is signed out federated — see `federatedLogoutUrl`, and the same
|
|
40
|
+
* cookie `mountOidcRoutes` sets.
|
|
41
|
+
*
|
|
42
|
+
* Two attributes differ from the session cookie, both deliberately:
|
|
43
|
+
*
|
|
44
|
+
* - **`Path=/api/auth/logout`**, so the hint rides exactly one request in the session's
|
|
45
|
+
* life instead of every one. It is not a credential this app ever reads.
|
|
46
|
+
* - **`SameSite=Strict`**, where the session is Lax. A Lax cookie IS sent on a
|
|
47
|
+
* top-level cross-site GET, so a hostile page linking to `?federated` would hand the
|
|
48
|
+
* OP a valid hint and get the very confirmation page this removes skipped — logout
|
|
49
|
+
* CSRF against the issuer session. Strict withholds the hint from any cross-site
|
|
50
|
+
* navigation, which downgrades that case to the confirmation page and leaves the
|
|
51
|
+
* in-app sign-out (same-site) redirecting straight through. The session cookie stays
|
|
52
|
+
* Lax because the login callback is itself a cross-site navigation back from the
|
|
53
|
+
* issuer and must arrive carrying it.
|
|
54
|
+
*
|
|
55
|
+
* The `cookieDomain` treatment follows the session's, for the same reason: on a
|
|
56
|
+
* multi-surface install (K-26) the sign-in is shared, so the sign-out has to work from
|
|
57
|
+
* whichever surface the person is on rather than only the one they logged in through.
|
|
58
|
+
*/
|
|
59
|
+
function hintCookies(value, origin, maxAge, domain) {
|
|
60
|
+
if (!domain)
|
|
61
|
+
return [cookie(LOGOUT_HINT_COOKIE, value, origin, maxAge, null, LOGOUT_PATH, 'Strict')];
|
|
62
|
+
return [
|
|
63
|
+
cookie(LOGOUT_HINT_COOKIE, value, origin, maxAge, domain, LOGOUT_PATH, 'Strict'),
|
|
64
|
+
cookie(LOGOUT_HINT_COOKIE, '', origin, 0, null, LOGOUT_PATH, 'Strict'),
|
|
65
|
+
];
|
|
66
|
+
}
|
|
37
67
|
function redirectWith(location, cookies) {
|
|
38
68
|
const headers = new Headers({ location });
|
|
39
69
|
for (const c of cookies)
|
|
@@ -80,10 +110,13 @@ export function oidcRpAuthProvider(cfg) {
|
|
|
80
110
|
const flow = readCookie(request.headers.get('cookie'), FLOW_COOKIE);
|
|
81
111
|
const clearFlow = cookie(FLOW_COOKIE, '', origin, 0);
|
|
82
112
|
try {
|
|
83
|
-
const { session, returnTo } = await completeLogin(env, origin, url, flow);
|
|
113
|
+
const { session, returnTo, idToken } = await completeLogin(env, origin, url, flow);
|
|
84
114
|
return redirectWith(safePath(returnTo) ?? '/', [
|
|
85
115
|
clearFlow,
|
|
86
116
|
...sessionCookies(session, origin, SESSION_MAXAGE, domain),
|
|
117
|
+
// Same lifetime as the session, so the two expire together and a stale hint is
|
|
118
|
+
// never the thing left over.
|
|
119
|
+
...hintCookies(idToken, origin, SESSION_MAXAGE, domain),
|
|
87
120
|
]);
|
|
88
121
|
}
|
|
89
122
|
catch (err) {
|
|
@@ -92,10 +125,29 @@ export function oidcRpAuthProvider(cfg) {
|
|
|
92
125
|
return redirectWith('/?error=auth', [clearFlow]);
|
|
93
126
|
}
|
|
94
127
|
}
|
|
95
|
-
if (url.pathname ===
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
128
|
+
if (url.pathname === LOGOUT_PATH) {
|
|
129
|
+
const local = safePath(url.searchParams.get('returnTo')) ?? '/';
|
|
130
|
+
const cleared = [...sessionCookies('', origin, 0, domain), ...hintCookies('', origin, 0, domain)];
|
|
131
|
+
/**
|
|
132
|
+
* `?federated` ALSO ends the issuer's own session (OIDC RP-Initiated Logout 1.0).
|
|
133
|
+
* Without it the issuer's cookie silently signs the same person straight back in on
|
|
134
|
+
* the next "Sign in", so the sign-out looks like it never happened — and "use
|
|
135
|
+
* another account" can never work. Opt-in per link, as in `mountOidcRoutes`: a plain
|
|
136
|
+
* logout stays local, which is what a surface sharing an issuer session with others
|
|
137
|
+
* wants.
|
|
138
|
+
*
|
|
139
|
+
* The cookies above are on THIS response, whatever happens next: an issuer that is
|
|
140
|
+
* down, advertises no end-session endpoint, or refuses our
|
|
141
|
+
* `post_logout_redirect_uri` can only leave its own session standing — never keep
|
|
142
|
+
* somebody signed in here.
|
|
143
|
+
*/
|
|
144
|
+
if (url.searchParams.has('federated')) {
|
|
145
|
+
const hint = readCookie(request.headers.get('cookie'), LOGOUT_HINT_COOKIE);
|
|
146
|
+
const away = await federatedLogoutUrl(env, origin, local, hint);
|
|
147
|
+
if (away)
|
|
148
|
+
return redirectWith(away, cleared);
|
|
149
|
+
}
|
|
150
|
+
return redirectWith(local, cleared);
|
|
99
151
|
}
|
|
100
152
|
// Anything else under /api/auth/* (sign-up, password endpoints, …) has no server
|
|
101
153
|
// here — accounts live at the issuer. JSON, never a fall-through to the SPA.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc-rp-provider.js","sourceRoot":"","sources":["../src/oidc-rp-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,aAAa,EACb,aAAa,EACb,UAAU,EACV,QAAQ,EACR,cAAc,EACd,WAAW,EACX,cAAc,EACd,WAAW,GAEZ,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAkCzD,MAAM,KAAK,GAAG,CAAC,GAAiB,EAAW,EAAE,CAAC,CAAC;IAC7C,WAAW,EAAE,GAAG,CAAC,MAAM;IACvB,cAAc,EAAE,GAAG,CAAC,QAAQ;IAC5B,kBAAkB,EAAE,GAAG,CAAC,YAAY;IACpC,cAAc,EAAE,GAAG,CAAC,aAAa;CAClC,CAAC,CAAC;AAEH,
|
|
1
|
+
{"version":3,"file":"oidc-rp-provider.js","sourceRoot":"","sources":["../src/oidc-rp-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,UAAU,EACV,QAAQ,EACR,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,WAAW,GAEZ,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAkCzD,MAAM,KAAK,GAAG,CAAC,GAAiB,EAAW,EAAE,CAAC,CAAC;IAC7C,WAAW,EAAE,GAAG,CAAC,MAAM;IACvB,cAAc,EAAE,GAAG,CAAC,QAAQ;IAC5B,kBAAkB,EAAE,GAAG,CAAC,YAAY;IACpC,cAAc,EAAE,GAAG,CAAC,aAAa;CAClC,CAAC,CAAC;AAEH,2GAA2G;AAC3G,SAAS,MAAM,CACb,IAAY,EACZ,KAAa,EACb,MAAc,EACd,MAAc,EACd,MAAsB,EACtB,IAAI,GAAG,GAAG,EACV,QAAQ,GAAqB,KAAK;IAElC,MAAM,KAAK,GAAG;QACZ,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE;QACtC,QAAQ,IAAI,EAAE;QACd,WAAW,MAAM,EAAE;QACnB,UAAU;QACV,YAAY,QAAQ,EAAE;KACvB,CAAC;IACF,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,EAAE,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,KAAa,EAAE,MAAc,EAAE,MAAc,EAAE,MAAqB;IAC1F,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AACxG,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,WAAW,CAAC,KAAa,EAAE,MAAc,EAAE,MAAc,EAAE,MAAqB;IACvF,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrG,OAAO;QACL,MAAM,CAAC,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC;QAChF,MAAM,CAAC,kBAAkB,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,OAAiB;IACvD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAwB,CAAC;AACpD,SAAS,cAAc,CAAC,GAAiB;IACvC,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;IAClD,IAAI,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAClG,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAiB;IAClD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAEvB,KAAK,UAAU,MAAM,CAAC,OAAgB;QACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC1B,qFAAqF;QACrF,wFAAwF;QACxF,iFAAiF;QACjF,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEnE,IAAI,GAAG,CAAC,QAAQ,KAAK,iBAAiB,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACnD,oFAAoF;YACpF,qFAAqF;YACrF,mFAAmF;YACnF,6EAA6E;YAC7E,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE;gBACvD,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACpD,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS;gBAC1D,UAAU,EAAE,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;gBAC1E,MAAM,EAAE,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;aAC/E,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,oBAAoB,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;YACpE,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACrD,IAAI,CAAC;gBACH,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;gBACnF,OAAO,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE;oBAC7C,SAAS;oBACT,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC;oBAC1D,+EAA+E;oBAC/E,6BAA6B;oBAC7B,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC;iBACxD,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,8EAA8E;gBAC9E,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACpG,OAAO,YAAY,CAAC,cAAc,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,GAAG,CAAC;YAChE,MAAM,OAAO,GAAG,CAAC,GAAG,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YAClG;;;;;;;;;;;;eAYG;YACH,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,CAAC;gBAC3E,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;gBAChE,IAAI,IAAI;oBAAE,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC/C,CAAC;YACD,OAAO,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACtC,CAAC;QAED,iFAAiF;QACjF,6EAA6E;QAC7E,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,gDAAgD,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAC/E,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,OAAgB;QACrC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC;QAC5F,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO;gBACL,GAAG,EAAE,OAAO,CAAC,EAAE;gBACf,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;gBAC5B,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;gBAC1B,+EAA+E;gBAC/E,6EAA6E;gBAC7E,aAAa,EAAE,OAAO,CAAC,aAAa;aACrC,CAAC;QACJ,CAAC;QACD,gFAAgF;QAChF,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@substrat-run/vertical-auth",
|
|
3
|
-
"version": "0.13.
|
|
3
|
+
"version": "0.13.1",
|
|
4
4
|
"description": "Pluggable auth for Substrat verticals — the AuthProvider contract, an OIDC provider (Supabase/Auth0/AuthHero/Keycloak), a full relying-party login flow, and a per-tenant identity Durable Object (Better Auth + sub→principal directory). Workers-targeted; the vertical worker bundles it.",
|
|
5
5
|
"license": "AGPL-3.0-only",
|
|
6
6
|
"repository": {
|
|
@@ -40,9 +40,9 @@
|
|
|
40
40
|
"better-auth": "^1.7.1",
|
|
41
41
|
"drizzle-orm": "^0.45.2",
|
|
42
42
|
"jose": "^6.2.3",
|
|
43
|
-
"@substrat-run/
|
|
44
|
-
"@substrat-run/
|
|
45
|
-
"@substrat-run/
|
|
43
|
+
"@substrat-run/oidc-rp": "^0.9.0",
|
|
44
|
+
"@substrat-run/contracts": "^0.109.0",
|
|
45
|
+
"@substrat-run/psl": "^0.2.4"
|
|
46
46
|
},
|
|
47
47
|
"devDependencies": {
|
|
48
48
|
"@cloudflare/workers-types": "^4.20250109.0",
|