@substrat-run/vertical-auth 0.15.2 → 0.15.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/instance-auth.d.ts.map +1 -1
- package/dist/instance-auth.js +16 -2
- package/dist/instance-auth.js.map +1 -1
- package/dist/oidc.d.ts +8 -3
- package/dist/oidc.d.ts.map +1 -1
- package/dist/oidc.js +22 -23
- package/dist/oidc.js.map +1 -1
- package/dist/places.d.ts +11 -0
- package/dist/places.d.ts.map +1 -1
- package/dist/places.js +45 -2
- package/dist/places.js.map +1 -1
- package/package.json +5 -5
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"instance-auth.d.ts","sourceRoot":"","sources":["../src/instance-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkD,CAAC,EAAE,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;
|
|
1
|
+
{"version":3,"file":"instance-auth.d.ts","sourceRoot":"","sources":["../src/instance-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkD,CAAC,EAAE,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAI7G,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD;;;;;;;;;;;GAWG;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU;;;;;;;iBAQrB,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,4EAA4E;AAC5E,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAE/C;;;;;;GAMG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IAEtC,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG;IAD5B,YACW,MAAM,EAAE,GAAG,GAAG,GAAG,EAC1B,OAAO,EAAE,MAAM,EAIhB;CACF;AAED,MAAM,WAAW,YAAY;IAC3B,oFAAoF;IACpF,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC;IAC5B,qDAAqD;IACrD,aAAa,EAAE,MAAM,CAAC;IACtB,qFAAqF;IACrF,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,IAAI,YAAY,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,qCAAqC;IACrC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B,GAAG,OAAO,CAAC,YAAY,CAAC,CAiBxB;AAED,wFAAwF;AACxF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,IAAI,CAQ1E;AAED;;;;;;;;;;;;;GAaG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC9C,GAAG,MAAM,EAAE,CAQX;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,GAAG,YAAY,CAwCf"}
|
package/dist/instance-auth.js
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import { SHARED_ISSUER_CONFIG_KEY, resolveScopedEnvSpec, z } from '@substrat-run/contracts';
|
|
2
|
+
import { issuerRefusal } from '@substrat-run/oidc-rp/discovery';
|
|
2
3
|
import { oidcAuthProvider } from './oidc.js';
|
|
3
4
|
import { oidcRpAuthProvider } from './oidc-rp-provider.js';
|
|
4
5
|
/**
|
|
@@ -120,10 +121,13 @@ export function parseAuthChoice(raw) {
|
|
|
120
121
|
*/
|
|
121
122
|
export function authorizationServersOf(opts) {
|
|
122
123
|
const { identity, settings } = opts;
|
|
124
|
+
// Empty for an issuer `selectAuthProvider` refuses too (`issuerRefusal`): the metadata must
|
|
125
|
+
// not send a client to an authorization server this instance will not talk to.
|
|
126
|
+
const named = (issuer) => (issuer && issuerRefusal(issuer) === null ? [issuer] : []);
|
|
123
127
|
if (identity?.mode === 'oidc')
|
|
124
|
-
return identity.issuer
|
|
128
|
+
return named(identity.issuer);
|
|
125
129
|
if (settings.AUTH_PROVIDER === 'oidc')
|
|
126
|
-
return settings.OIDC_ISSUER
|
|
130
|
+
return named(settings.OIDC_ISSUER);
|
|
127
131
|
return [];
|
|
128
132
|
}
|
|
129
133
|
export function selectAuthProvider(opts) {
|
|
@@ -132,6 +136,13 @@ export function selectAuthProvider(opts) {
|
|
|
132
136
|
if (!identity.issuer || !identity.clientId) {
|
|
133
137
|
throw new AuthConfigError(503, "this instance's OIDC configuration is incomplete — set issuer and clientId");
|
|
134
138
|
}
|
|
139
|
+
// Refused HERE, loudly, and not in the schema above: a schema refusal reads as "nothing
|
|
140
|
+
// delivered" and the instance would quietly run the deployment's default identity provider
|
|
141
|
+
// instead. The relying party sends its client secret to this issuer, so it is https (or a
|
|
142
|
+
// loopback dev issuer) or the instance answers 503.
|
|
143
|
+
const refused = issuerRefusal(identity.issuer);
|
|
144
|
+
if (refused)
|
|
145
|
+
throw new AuthConfigError(503, `this instance's OIDC issuer is refused: ${refused}`);
|
|
135
146
|
return oidcRpAuthProvider({
|
|
136
147
|
issuer: identity.issuer,
|
|
137
148
|
clientId: identity.clientId,
|
|
@@ -146,6 +157,9 @@ export function selectAuthProvider(opts) {
|
|
|
146
157
|
if (!settings.OIDC_ISSUER) {
|
|
147
158
|
throw new AuthConfigError(500, 'AUTH_PROVIDER=oidc but OIDC_ISSUER is unset');
|
|
148
159
|
}
|
|
160
|
+
const refused = issuerRefusal(settings.OIDC_ISSUER);
|
|
161
|
+
if (refused)
|
|
162
|
+
throw new AuthConfigError(503, `this instance's OIDC issuer is refused: ${refused}`);
|
|
149
163
|
return oidcAuthProvider({
|
|
150
164
|
issuer: settings.OIDC_ISSUER,
|
|
151
165
|
...(settings.OIDC_AUDIENCE ? { audience: settings.OIDC_AUDIENCE } : {}),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"instance-auth.js","sourceRoot":"","sources":["../src/instance-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,CAAC,EAAmB,MAAM,yBAAyB,CAAC;AAC7G,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAI3D;;;;;;;;;;;GAWG;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,0FAA0F;IAC1F,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAIH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAE7B,MAAM;IADjB,YACW,MAAiB,EAC1B,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;sBAHN,MAAM;QAIf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAmBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAQrC;IACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACpF,OAAO;QACL,QAAQ;QACR,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,GAAG,EAAE,CACb,kBAAkB,CAAC;YACjB,QAAQ;YACR,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,QAAQ;YACR,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,KAAK,MAAM;SACjE,CAAC;KACL,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,eAAe,CAAC,GAAuB;IACrD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAGtC;IACC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACpC,
|
|
1
|
+
{"version":3,"file":"instance-auth.js","sourceRoot":"","sources":["../src/instance-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,CAAC,EAAmB,MAAM,yBAAyB,CAAC;AAC7G,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAI3D;;;;;;;;;;;GAWG;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,0FAA0F;IAC1F,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAIH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAE7B,MAAM;IADjB,YACW,MAAiB,EAC1B,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;sBAHN,MAAM;QAIf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAmBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAQrC;IACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACpF,OAAO;QACL,QAAQ;QACR,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,GAAG,EAAE,CACb,kBAAkB,CAAC;YACjB,QAAQ;YACR,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,QAAQ;YACR,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,KAAK,MAAM;SACjE,CAAC;KACL,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,eAAe,CAAC,GAAuB;IACrD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAGtC;IACC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACpC,4FAA4F;IAC5F,+EAA+E;IAC/E,MAAM,KAAK,GAAG,CAAC,MAA0B,EAAY,EAAE,CAAC,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnH,IAAI,QAAQ,EAAE,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,QAAQ,CAAC,aAAa,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1E,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAUlC;IACC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACpC,IAAI,QAAQ,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC3C,MAAM,IAAI,eAAe,CACvB,GAAG,EACH,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,wFAAwF;QACxF,2FAA2F;QAC3F,0FAA0F;QAC1F,oDAAoD;QACpD,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,2CAA2C,OAAO,EAAE,CAAC,CAAC;QAClG,OAAO,kBAAkB,CAAC;YACxB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,EAAE;YACzC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC1B,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,6CAA6C,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,2CAA2C,OAAO,EAAE,CAAC,CAAC;QAClG,OAAO,gBAAgB,CAAC;YACtB,MAAM,EAAE,QAAQ,CAAC,WAAW;YAC5B,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,eAAe,CACvB,GAAG,EACH,uIAAuI,CACxI,CAAC;AACJ,CAAC"}
|
package/dist/oidc.d.ts
CHANGED
|
@@ -7,10 +7,14 @@ import type { AuthProvider } from './provider.js';
|
|
|
7
7
|
* VERIFIES the presented JWT against the issuer's JWKS and reads the subject. There are no
|
|
8
8
|
* server-side auth endpoints to run, so `handle` is informational.
|
|
9
9
|
*
|
|
10
|
-
* workerd-safe: `jose
|
|
10
|
+
* workerd-safe: `jose`, Web Crypto and `@substrat-run/oidc-rp/discovery` (the bound discovery
|
|
11
|
+
* the login path uses; no login flow and no `hono`).
|
|
11
12
|
*/
|
|
12
13
|
export interface OidcConfig {
|
|
13
|
-
/**
|
|
14
|
+
/**
|
|
15
|
+
* The issuer URL (`iss`). Must be `https` (loopback `http` for a dev issuer); its
|
|
16
|
+
* `/.well-known/openid-configuration` gives the JWKS, and must name this issuer.
|
|
17
|
+
*/
|
|
14
18
|
issuer: string;
|
|
15
19
|
/** Expected audience (`aud`), if the issuer sets one for this app. */
|
|
16
20
|
audience?: string;
|
|
@@ -25,7 +29,8 @@ export interface OidcConfig {
|
|
|
25
29
|
/**
|
|
26
30
|
* With `clientId`: this app's MCP resource identifier on an origin — `mcpResourceOf` from
|
|
27
31
|
* `@substrat-run/contracts`, handed in rather than imported so this subpath keeps its
|
|
28
|
-
* jose-
|
|
32
|
+
* small dependency set (jose + oidc-rp's discovery). An access token whose `aud` names it is
|
|
33
|
+
* this app's own too.
|
|
29
34
|
*/
|
|
30
35
|
resourceOf?: (origin: string) => string;
|
|
31
36
|
/** Override the JWKS URI (skip discovery) — e.g. a self-hosted issuer. */
|
package/dist/oidc.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkD,KAAK,eAAe,EAAE,MAAM,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkD,KAAK,eAAe,EAAE,MAAM,MAAM,CAAC;AAE5F,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,eAAe,CAAC;AAE/D;;;;;;;;;GASG;AACH,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC;IACxC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sGAAsG;IACtG,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAkED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,UAAU,GAAG,YAAY,CAkF9D"}
|
package/dist/oidc.js
CHANGED
|
@@ -1,23 +1,5 @@
|
|
|
1
1
|
import { jwtVerify, createRemoteJWKSet } from 'jose';
|
|
2
|
-
|
|
3
|
-
const discoveryCache = new Map();
|
|
4
|
-
function discoverJwksUri(issuer) {
|
|
5
|
-
let p = discoveryCache.get(issuer);
|
|
6
|
-
if (!p) {
|
|
7
|
-
p = (async () => {
|
|
8
|
-
const url = `${issuer.replace(/\/$/, '')}/.well-known/openid-configuration`;
|
|
9
|
-
const res = await fetch(url);
|
|
10
|
-
if (!res.ok)
|
|
11
|
-
throw new Error(`OIDC discovery failed for ${issuer}: ${res.status}`);
|
|
12
|
-
const meta = (await res.json());
|
|
13
|
-
if (!meta.jwks_uri)
|
|
14
|
-
throw new Error(`OIDC discovery for ${issuer} has no jwks_uri`);
|
|
15
|
-
return meta.jwks_uri;
|
|
16
|
-
})();
|
|
17
|
-
discoveryCache.set(issuer, p);
|
|
18
|
-
}
|
|
19
|
-
return p;
|
|
20
|
-
}
|
|
2
|
+
import { discoverIssuer, isAllowedEndpoint, issuerRefusal } from '@substrat-run/oidc-rp/discovery';
|
|
21
3
|
function bearerFrom(headers) {
|
|
22
4
|
const auth = headers.get('authorization');
|
|
23
5
|
if (auth?.toLowerCase().startsWith('bearer '))
|
|
@@ -90,10 +72,27 @@ export function oidcAuthProvider(cfg) {
|
|
|
90
72
|
if (cfg.keys)
|
|
91
73
|
return cfg.keys;
|
|
92
74
|
if (!keysPromise) {
|
|
93
|
-
|
|
94
|
-
|
|
75
|
+
// The login path's discovery, not a second one: bound to this issuer, https, no redirect
|
|
76
|
+
// off its origin (`discoverIssuer`). A failure is evicted here too, so an issuer that was
|
|
77
|
+
// down or answered wrongly once is asked again rather than refused for the isolate's life.
|
|
78
|
+
const pending = (async () => {
|
|
79
|
+
const jwksUri = cfg.jwksUri ?? (await discoverIssuer(cfg.issuer)).jwks_uri;
|
|
80
|
+
// An override skips discovery, not the transport rule: the keys are fetched from it.
|
|
81
|
+
// Nor the issuer rule: with no discovery, nothing else has looked at `cfg.issuer`.
|
|
82
|
+
if (cfg.jwksUri) {
|
|
83
|
+
const refused = issuerRefusal(cfg.issuer);
|
|
84
|
+
if (refused)
|
|
85
|
+
throw new Error(refused);
|
|
86
|
+
if (!isAllowedEndpoint(cfg.issuer, cfg.jwksUri))
|
|
87
|
+
throw new Error('jwksUri is not https');
|
|
88
|
+
}
|
|
95
89
|
return createRemoteJWKSet(new URL(jwksUri));
|
|
96
90
|
})();
|
|
91
|
+
pending.catch(() => {
|
|
92
|
+
if (keysPromise === pending)
|
|
93
|
+
keysPromise = undefined;
|
|
94
|
+
});
|
|
95
|
+
keysPromise = pending;
|
|
97
96
|
}
|
|
98
97
|
return keysPromise;
|
|
99
98
|
};
|
|
@@ -115,8 +114,8 @@ export function oidcAuthProvider(cfg) {
|
|
|
115
114
|
// browser-login path: a boolean when the issuer asserts one, and the `"true"` /
|
|
116
115
|
// `"false"` strings some issuers in the Auth0 lineage emit instead — anything else,
|
|
117
116
|
// the claim's absence included, stays `undefined` rather than becoming a guess.
|
|
118
|
-
// Written out here rather than imported so this subpath keeps
|
|
119
|
-
//
|
|
117
|
+
// Written out here rather than imported so this subpath keeps a small dependency
|
|
118
|
+
// set (jose + oidc-rp's discovery, no login flow) and a bearer-only consumer needs no hono.
|
|
120
119
|
const verified = meta['email_verified'];
|
|
121
120
|
return {
|
|
122
121
|
sub: String(payload.sub),
|
package/dist/oidc.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAyC,MAAM,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAyC,MAAM,MAAM,CAAC;AAC5F,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AA0CnG,SAAS,UAAU,CAAC,OAAgB;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC1C,IAAI,IAAI,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IACnF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,YAAY,CAAC,OAAgB,EAAE,GAAuB,EAAE,UAAsC;IACrG,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,OAAO,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;IAChD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,CAAC,UAAU,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,UAAU,CAAC,OAAmB,EAAE,QAAgB,EAAE,SAA4B;IACrF,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5G,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACzG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;IACpE,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAe;IAC9C,IAAI,WAAiD,CAAC;IACtD,MAAM,OAAO,GAAG,KAAK,IAA8B,EAAE;QACnD,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC;QAC9B,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,yFAAyF;YACzF,0FAA0F;YAC1F,2FAA2F;YAC3F,MAAM,OAAO,GAA6B,CAAC,KAAK,IAAI,EAAE;gBACpD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,MAAM,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAC3E,qFAAqF;gBACrF,mFAAmF;gBACnF,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;oBAChB,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBAC1C,IAAI,OAAO;wBAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;oBACtC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAC3F,CAAC;gBACD,OAAO,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9C,CAAC,CAAC,EAAE,CAAC;YACL,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;gBACjB,IAAI,WAAW,KAAK,OAAO;oBAAE,WAAW,GAAG,SAAS,CAAC;YACvD,CAAC,CAAC,CAAC;YACH,WAAW,GAAG,OAAO,CAAC;QACxB,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IAEF,KAAK,UAAU,MAAM,CAAC,KAAa,EAAE,OAAgB,EAAE,GAAuB;QAC5E,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,OAAO,EAAE,EAAE;gBAC1D,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBAClC,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnF,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC;oBAAE,OAAO,IAAI,CAAC;YACjE,CAAC;YACD,MAAM,IAAI,GAAG,OAAkC,CAAC;YAChD,4EAA4E;YAC5E,gFAAgF;YAChF,oFAAoF;YACpF,gFAAgF;YAChF,iFAAiF;YACjF,4FAA4F;YAC5F,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACxC,OAAO;gBACL,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;gBACxB,KAAK,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,IAAI;gBAC3E,aAAa,EACX,OAAO,QAAQ,KAAK,SAAS;oBAC3B,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,QAAQ,KAAK,MAAM;wBACnB,CAAC,CAAC,IAAI;wBACN,CAAC,CAAC,QAAQ,KAAK,OAAO;4BACpB,CAAC,CAAC,KAAK;4BACP,CAAC,CAAC,SAAS;gBACnB,IAAI,EACF,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ;oBAC9B,CAAC,CAAE,IAAI,CAAC,MAAM,CAAY;oBAC1B,CAAC,CAAC,OAAQ,IAAI,CAAC,eAAe,CAAwB,EAAE,IAAI,KAAK,QAAQ;wBACvE,CAAC,CAAC,CAAE,IAAI,CAAC,eAAe,CAAsB,CAAC,IAAI,CAAC;wBACpD,CAAC,CAAC,IAAI;aACb,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,0EAA0E;QACzF,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,MAAM;YACV,OAAO,QAAQ,CAAC,IAAI,CAAC;gBACnB,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,+EAA+E;aACtF,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG;YACxB,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;YAClC,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpD,CAAC;KACF,CAAC;AACJ,CAAC"}
|
package/dist/places.d.ts
CHANGED
|
@@ -24,6 +24,16 @@ import type { IdentityStub } from './identity-do.js';
|
|
|
24
24
|
* - **`reportScopeMembers`**, the repair: the whole set bound in the scope, which drops every
|
|
25
25
|
* entry it does not name. Run it from the platform's reconcile.
|
|
26
26
|
*
|
|
27
|
+
* ## Where the secret goes
|
|
28
|
+
*
|
|
29
|
+
* The report carries the install's `client_secret`, and the endpoint comes out of a document the
|
|
30
|
+
* issuer serves. So the endpoint is held to the issuer's own ORIGIN (scheme, host and port,
|
|
31
|
+
* exactly), to `https:` (`http:` only on a loopback issuer, which is what the dev issuer is), and
|
|
32
|
+
* to no embedded credentials; and the POST is made with `redirect: 'manual'`, so a 30x is a
|
|
33
|
+
* failure and never a second hop for the secret. A refused endpoint sends nothing, is reported as
|
|
34
|
+
* `failed` like an unreachable issuer, and is logged once with its origin only (#1771): the
|
|
35
|
+
* origin is what is bound and shown, since a path and query are the issuer's own and may carry a token.
|
|
36
|
+
*
|
|
27
37
|
* Every report is best-effort and **never throws**: a login must never fail because the index
|
|
28
38
|
* could not be told. A lost report is what the repair exists for.
|
|
29
39
|
*
|
|
@@ -66,6 +76,7 @@ export declare function placesReporter(opts: {
|
|
|
66
76
|
identity: AuthChoice | null;
|
|
67
77
|
fetch?: FetchLike;
|
|
68
78
|
now?: () => number;
|
|
79
|
+
log?: (line: string) => void;
|
|
69
80
|
}): PlacesReporter | null;
|
|
70
81
|
/**
|
|
71
82
|
* Tell the pool what a resolve just established: `principal` non-null ⇒ the subject is bound
|
package/dist/places.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"places.d.ts","sourceRoot":"","sources":["../src/places.ts"],"names":[],"mappings":"AAKA,OAAO,
|
|
1
|
+
{"version":3,"file":"places.d.ts","sourceRoot":"","sources":["../src/places.ts"],"names":[],"mappings":"AAKA,OAAO,EAA0C,KAAK,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAC9F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,8FAA8F;AAC9F,MAAM,MAAM,iBAAiB,GACzB;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE;AACrB,gFAAgF;GAC9E;IAAE,OAAO,EAAE,UAAU,CAAA;CAAE;AACzB,qFAAqF;GACnF;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,OAAO,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C,MAAM,WAAW,cAAc;IAC7B,2CAA2C;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAClE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjE,qEAAqE;IACrE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC/E;AAoDD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC;IAC5B,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B,GAAG,cAAc,GAAG,IAAI,CAuDxB;AAoBD;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,cAAc,GAAG,IAAI,EAC/B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,GAAG,GAAE,MAAM,MAAiB,GAC3B,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAanC;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,EACvC,QAAQ,EAAE,cAAc,GAAG,IAAI,EAC/B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAAE,CAAC,CAMjE;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,EAC3C,QAAQ,EAAE,cAAc,GAAG,IAAI,EAC/B,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAmC,GACzD,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAgBnC;AAED,mEAAmE;AACnE,wBAAgB,eAAe,IAAI,IAAI,CAItC"}
|
package/dist/places.js
CHANGED
|
@@ -4,6 +4,30 @@ import { globalFetch } from '@substrat-run/kernel';
|
|
|
4
4
|
const DISCOVERY_TTL_MS = 10 * 60_000;
|
|
5
5
|
/** Per isolate: issuer → where it takes reports (null = it keeps no index), and until when. */
|
|
6
6
|
const discovered = new Map();
|
|
7
|
+
const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]']);
|
|
8
|
+
/** Why `endpoint` may not receive the client secret of `issuer`, or null when it may. */
|
|
9
|
+
function endpointRefusal(issuer, endpoint) {
|
|
10
|
+
let e;
|
|
11
|
+
let i;
|
|
12
|
+
try {
|
|
13
|
+
e = new URL(endpoint);
|
|
14
|
+
i = new URL(issuer);
|
|
15
|
+
}
|
|
16
|
+
catch {
|
|
17
|
+
return 'not a URL';
|
|
18
|
+
}
|
|
19
|
+
if (e.origin !== i.origin)
|
|
20
|
+
return `origin ${e.origin} is not the issuer's ${i.origin}`;
|
|
21
|
+
if (e.username || e.password)
|
|
22
|
+
return 'carries credentials';
|
|
23
|
+
if (e.protocol !== 'https:' && !(e.protocol === 'http:' && LOOPBACK_HOSTS.has(e.hostname))) {
|
|
24
|
+
return `scheme ${e.protocol} is not https`;
|
|
25
|
+
}
|
|
26
|
+
return null;
|
|
27
|
+
}
|
|
28
|
+
/** Per isolate: the refusals already logged, so a request path that repeats does not flood. */
|
|
29
|
+
const refusalLogged = new Set();
|
|
30
|
+
const REFUSAL_LOG_LIMIT = 100;
|
|
7
31
|
const reasonOf = (e) => (e instanceof Error ? e.message : String(e));
|
|
8
32
|
async function reportEndpointOf(issuer, fetchImpl, now) {
|
|
9
33
|
const cached = discovered.get(issuer);
|
|
@@ -36,16 +60,34 @@ export function placesReporter(opts) {
|
|
|
36
60
|
const { issuer, clientId, clientSecret } = identity;
|
|
37
61
|
const fetchImpl = opts.fetch ?? globalFetch;
|
|
38
62
|
const now = opts.now ?? Date.now;
|
|
63
|
+
const log = opts.log ?? ((line) => console.warn(line));
|
|
39
64
|
async function send(body) {
|
|
40
65
|
try {
|
|
41
66
|
const endpoint = await reportEndpointOf(issuer, fetchImpl, now());
|
|
42
67
|
if (!endpoint)
|
|
43
68
|
return { outcome: 'no-index' };
|
|
44
|
-
const
|
|
69
|
+
const refusal = endpointRefusal(issuer, endpoint);
|
|
70
|
+
if (refusal) {
|
|
71
|
+
// Logged with the endpoint's origin only: its path and query are the issuer's to keep.
|
|
72
|
+
const shown = new URL(endpoint).origin;
|
|
73
|
+
if (!refusalLogged.has(`${issuer}|${shown}`)) {
|
|
74
|
+
if (refusalLogged.size >= REFUSAL_LOG_LIMIT)
|
|
75
|
+
refusalLogged.delete(refusalLogged.values().next().value);
|
|
76
|
+
refusalLogged.add(`${issuer}|${shown}`);
|
|
77
|
+
log(`vertical-auth: places report to ${shown} refused — ${refusal}; the client secret was not sent`);
|
|
78
|
+
}
|
|
79
|
+
return { outcome: 'failed', reason: `places report endpoint refused: ${refusal}` };
|
|
80
|
+
}
|
|
81
|
+
// `redirect` is a field the runtime's fetch reads and `ConnectorRequestInit` does not name.
|
|
82
|
+
const init = {
|
|
45
83
|
method: 'POST',
|
|
46
84
|
headers: { 'content-type': 'application/json' },
|
|
47
85
|
body: JSON.stringify({ client_id: clientId, client_secret: clientSecret, ...body }),
|
|
48
|
-
|
|
86
|
+
redirect: 'manual',
|
|
87
|
+
};
|
|
88
|
+
const res = await fetchImpl(endpoint, init);
|
|
89
|
+
// With `redirect: 'manual'` a 30x (or the opaque redirect some runtimes hand back, status
|
|
90
|
+
// 0) is not `ok`, not a 4xx, and so lands in `failed` below: never followed.
|
|
49
91
|
if (res.status === 204 || res.ok)
|
|
50
92
|
return { outcome: 'sent' };
|
|
51
93
|
if (res.status >= 400 && res.status < 500)
|
|
@@ -146,5 +188,6 @@ export async function reportScopeMembers(directory, reporter, scopeId, log = (li
|
|
|
146
188
|
export function resetPlacesMemo() {
|
|
147
189
|
discovered.clear();
|
|
148
190
|
observed.clear();
|
|
191
|
+
refusalLogged.clear();
|
|
149
192
|
}
|
|
150
193
|
//# sourceMappingURL=places.js.map
|
package/dist/places.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"places.js","sourceRoot":"","sources":["../src/places.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,GAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,
|
|
1
|
+
{"version":3,"file":"places.js","sourceRoot":"","sources":["../src/places.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,GAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,EAA6C,MAAM,sBAAsB,CAAC;AAiE9F,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,EAAE,GAAG,MAAM,CAAC;AAErC,+FAA+F;AAC/F,MAAM,UAAU,GAAG,IAAI,GAAG,EAAsD,CAAC;AAEjF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE,yFAAyF;AACzF,SAAS,eAAe,CAAC,MAAc,EAAE,QAAgB;IACvD,IAAI,CAAM,CAAC;IACX,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtB,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,UAAU,CAAC,CAAC,MAAM,wBAAwB,CAAC,CAAC,MAAM,EAAE,CAAC;IACvF,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ;QAAE,OAAO,qBAAqB,CAAC;IAC3D,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC3F,OAAO,UAAU,CAAC,CAAC,QAAQ,eAAe,CAAC;IAC7C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+FAA+F;AAC/F,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;AACxC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAEtF,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,SAAoB,EAAE,GAAW;IAC/E,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,GAAG,GAAG;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,qBAAqB,EAAE,EAAE;QAClF,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACxC,CAAC,CAAC;IACH,yFAAyF;IACzF,mFAAmF;IACnF,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/F,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7E,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,CAAC;IACD,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,GAAG,gBAAgB,EAAE,CAAC,CAAC;IACpE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAK9B;IACC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IACnF,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,QAAQ,CAAC;IACpD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAK/D,KAAK,UAAU,IAAI,CAAC,IAAgB;QAClC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;YAClE,IAAI,CAAC,QAAQ;gBAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAClD,IAAI,OAAO,EAAE,CAAC;gBACZ,uFAAuF;gBACvF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;gBACvC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC,EAAE,CAAC;oBAC7C,IAAI,aAAa,CAAC,IAAI,IAAI,iBAAiB;wBAAE,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC,CAAC;oBACjH,aAAa,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC;oBACxC,GAAG,CAAC,mCAAmC,KAAK,cAAc,OAAO,kCAAkC,CAAC,CAAC;gBACvG,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,mCAAmC,OAAO,EAAE,EAAE,CAAC;YACrF,CAAC;YACD,4FAA4F;YAC5F,MAAM,IAAI,GAAkD;gBAC1D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,CAAC;gBACnF,QAAQ,EAAE,QAAQ;aACnB,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC5C,0FAA0F;YAC1F,6EAA6E;YAC7E,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YAC7D,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;gBAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;YAC7F,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,0BAA0B,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM;QACN,OAAO,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QAC1E,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;QACxE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;YAC/B,IAAI,IAAI,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;gBACpC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,wBAAwB,iBAAiB,uBAAuB,EAAE,CAAC;YACvH,CAAC;YACD,OAAO,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B;;;;GAIG;AACH,MAAM,eAAe,GAAG,EAAE,GAAG,MAAM,CAAC;AACpC;;;;GAIG;AACH,MAAM,cAAc,GAAG,CAAC,GAAG,MAAM,CAAC;AAElC,+FAA+F;AAC/F,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA6C,CAAC;AAEtE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAA+B,EAC/B,OAAe,EACf,GAAW,EACX,SAAwB,EACxB,GAAG,GAAiB,IAAI,CAAC,GAAG;IAE5B,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,MAAM,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,SAAS,KAAK,IAAI,CAAC;IACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAClG,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAC/G,IAAI,QAAQ,CAAC,IAAI,GAAG,cAAc;YAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,SAAuC,EACvC,QAA+B,EAC/B,OAAe,EACf,GAAW;IAEX,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,mEAAmE;IACnE,IAAI,QAAQ;QAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;IACtE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAA2C,EAC3C,QAA+B,EAC/B,OAAe,EACf,GAAG,GAA2B,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;IAE1D,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACpC,GAAG,CACD,0CAA0C,OAAO,wBAAwB,iBAAiB,aAAa;YACrG,oDAAoD,CACvD,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,iBAAiB,WAAW,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,eAAe;IAC7B,UAAU,CAAC,KAAK,EAAE,CAAC;IACnB,QAAQ,CAAC,KAAK,EAAE,CAAC;IACjB,aAAa,CAAC,KAAK,EAAE,CAAC;AACxB,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@substrat-run/vertical-auth",
|
|
3
|
-
"version": "0.15.
|
|
3
|
+
"version": "0.15.4",
|
|
4
4
|
"description": "Pluggable auth for Substrat verticals — the AuthProvider contract, an OIDC provider (Supabase/Auth0/AuthHero/Keycloak), a full relying-party login flow, and a per-tenant identity Durable Object (Better Auth + sub→principal directory). Workers-targeted; the vertical worker bundles it.",
|
|
5
5
|
"license": "AGPL-3.0-only",
|
|
6
6
|
"repository": {
|
|
@@ -44,10 +44,10 @@
|
|
|
44
44
|
"better-auth": "^1.7.1",
|
|
45
45
|
"drizzle-orm": "^0.45.2",
|
|
46
46
|
"jose": "^6.2.3",
|
|
47
|
-
"@substrat-run/
|
|
48
|
-
"@substrat-run/
|
|
49
|
-
"@substrat-run/
|
|
50
|
-
"@substrat-run/
|
|
47
|
+
"@substrat-run/psl": "^0.2.5",
|
|
48
|
+
"@substrat-run/contracts": "^0.122.0",
|
|
49
|
+
"@substrat-run/kernel": "^0.122.0",
|
|
50
|
+
"@substrat-run/oidc-rp": "^0.9.1"
|
|
51
51
|
},
|
|
52
52
|
"peerDependencies": {
|
|
53
53
|
"hono": "^4.6.0"
|