@substrat-run/vertical-auth 0.15.3 → 0.15.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/instance-auth.d.ts.map +1 -1
- package/dist/instance-auth.js +16 -2
- package/dist/instance-auth.js.map +1 -1
- package/dist/oidc.d.ts +8 -3
- package/dist/oidc.d.ts.map +1 -1
- package/dist/oidc.js +22 -23
- package/dist/oidc.js.map +1 -1
- package/package.json +4 -4
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"instance-auth.d.ts","sourceRoot":"","sources":["../src/instance-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkD,CAAC,EAAE,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;
|
|
1
|
+
{"version":3,"file":"instance-auth.d.ts","sourceRoot":"","sources":["../src/instance-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkD,CAAC,EAAE,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAI7G,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD;;;;;;;;;;;GAWG;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU;;;;;;;iBAQrB,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,4EAA4E;AAC5E,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAE/C;;;;;;GAMG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IAEtC,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG;IAD5B,YACW,MAAM,EAAE,GAAG,GAAG,GAAG,EAC1B,OAAO,EAAE,MAAM,EAIhB;CACF;AAED,MAAM,WAAW,YAAY;IAC3B,oFAAoF;IACpF,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC;IAC5B,qDAAqD;IACrD,aAAa,EAAE,MAAM,CAAC;IACtB,qFAAqF;IACrF,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,IAAI,YAAY,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,qCAAqC;IACrC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B,GAAG,OAAO,CAAC,YAAY,CAAC,CAiBxB;AAED,wFAAwF;AACxF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,IAAI,CAQ1E;AAED;;;;;;;;;;;;;GAaG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC9C,GAAG,MAAM,EAAE,CAQX;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,GAAG,YAAY,CAwCf"}
|
package/dist/instance-auth.js
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import { SHARED_ISSUER_CONFIG_KEY, resolveScopedEnvSpec, z } from '@substrat-run/contracts';
|
|
2
|
+
import { issuerRefusal } from '@substrat-run/oidc-rp/discovery';
|
|
2
3
|
import { oidcAuthProvider } from './oidc.js';
|
|
3
4
|
import { oidcRpAuthProvider } from './oidc-rp-provider.js';
|
|
4
5
|
/**
|
|
@@ -120,10 +121,13 @@ export function parseAuthChoice(raw) {
|
|
|
120
121
|
*/
|
|
121
122
|
export function authorizationServersOf(opts) {
|
|
122
123
|
const { identity, settings } = opts;
|
|
124
|
+
// Empty for an issuer `selectAuthProvider` refuses too (`issuerRefusal`): the metadata must
|
|
125
|
+
// not send a client to an authorization server this instance will not talk to.
|
|
126
|
+
const named = (issuer) => (issuer && issuerRefusal(issuer) === null ? [issuer] : []);
|
|
123
127
|
if (identity?.mode === 'oidc')
|
|
124
|
-
return identity.issuer
|
|
128
|
+
return named(identity.issuer);
|
|
125
129
|
if (settings.AUTH_PROVIDER === 'oidc')
|
|
126
|
-
return settings.OIDC_ISSUER
|
|
130
|
+
return named(settings.OIDC_ISSUER);
|
|
127
131
|
return [];
|
|
128
132
|
}
|
|
129
133
|
export function selectAuthProvider(opts) {
|
|
@@ -132,6 +136,13 @@ export function selectAuthProvider(opts) {
|
|
|
132
136
|
if (!identity.issuer || !identity.clientId) {
|
|
133
137
|
throw new AuthConfigError(503, "this instance's OIDC configuration is incomplete — set issuer and clientId");
|
|
134
138
|
}
|
|
139
|
+
// Refused HERE, loudly, and not in the schema above: a schema refusal reads as "nothing
|
|
140
|
+
// delivered" and the instance would quietly run the deployment's default identity provider
|
|
141
|
+
// instead. The relying party sends its client secret to this issuer, so it is https (or a
|
|
142
|
+
// loopback dev issuer) or the instance answers 503.
|
|
143
|
+
const refused = issuerRefusal(identity.issuer);
|
|
144
|
+
if (refused)
|
|
145
|
+
throw new AuthConfigError(503, `this instance's OIDC issuer is refused: ${refused}`);
|
|
135
146
|
return oidcRpAuthProvider({
|
|
136
147
|
issuer: identity.issuer,
|
|
137
148
|
clientId: identity.clientId,
|
|
@@ -146,6 +157,9 @@ export function selectAuthProvider(opts) {
|
|
|
146
157
|
if (!settings.OIDC_ISSUER) {
|
|
147
158
|
throw new AuthConfigError(500, 'AUTH_PROVIDER=oidc but OIDC_ISSUER is unset');
|
|
148
159
|
}
|
|
160
|
+
const refused = issuerRefusal(settings.OIDC_ISSUER);
|
|
161
|
+
if (refused)
|
|
162
|
+
throw new AuthConfigError(503, `this instance's OIDC issuer is refused: ${refused}`);
|
|
149
163
|
return oidcAuthProvider({
|
|
150
164
|
issuer: settings.OIDC_ISSUER,
|
|
151
165
|
...(settings.OIDC_AUDIENCE ? { audience: settings.OIDC_AUDIENCE } : {}),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"instance-auth.js","sourceRoot":"","sources":["../src/instance-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,CAAC,EAAmB,MAAM,yBAAyB,CAAC;AAC7G,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAI3D;;;;;;;;;;;GAWG;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,0FAA0F;IAC1F,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAIH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAE7B,MAAM;IADjB,YACW,MAAiB,EAC1B,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;sBAHN,MAAM;QAIf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAmBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAQrC;IACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACpF,OAAO;QACL,QAAQ;QACR,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,GAAG,EAAE,CACb,kBAAkB,CAAC;YACjB,QAAQ;YACR,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,QAAQ;YACR,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,KAAK,MAAM;SACjE,CAAC;KACL,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,eAAe,CAAC,GAAuB;IACrD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAGtC;IACC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACpC,
|
|
1
|
+
{"version":3,"file":"instance-auth.js","sourceRoot":"","sources":["../src/instance-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,CAAC,EAAmB,MAAM,yBAAyB,CAAC;AAC7G,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAI3D;;;;;;;;;;;GAWG;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,0FAA0F;IAC1F,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAIH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAE7B,MAAM;IADjB,YACW,MAAiB,EAC1B,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;sBAHN,MAAM;QAIf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAmBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAQrC;IACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACpF,OAAO;QACL,QAAQ;QACR,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,GAAG,EAAE,CACb,kBAAkB,CAAC;YACjB,QAAQ;YACR,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,QAAQ;YACR,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,KAAK,MAAM;SACjE,CAAC;KACL,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,eAAe,CAAC,GAAuB;IACrD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAGtC;IACC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACpC,4FAA4F;IAC5F,+EAA+E;IAC/E,MAAM,KAAK,GAAG,CAAC,MAA0B,EAAY,EAAE,CAAC,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnH,IAAI,QAAQ,EAAE,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,QAAQ,CAAC,aAAa,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1E,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAUlC;IACC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACpC,IAAI,QAAQ,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC3C,MAAM,IAAI,eAAe,CACvB,GAAG,EACH,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,wFAAwF;QACxF,2FAA2F;QAC3F,0FAA0F;QAC1F,oDAAoD;QACpD,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,2CAA2C,OAAO,EAAE,CAAC,CAAC;QAClG,OAAO,kBAAkB,CAAC;YACxB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,EAAE;YACzC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC1B,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,6CAA6C,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,2CAA2C,OAAO,EAAE,CAAC,CAAC;QAClG,OAAO,gBAAgB,CAAC;YACtB,MAAM,EAAE,QAAQ,CAAC,WAAW;YAC5B,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,eAAe,CACvB,GAAG,EACH,uIAAuI,CACxI,CAAC;AACJ,CAAC"}
|
package/dist/oidc.d.ts
CHANGED
|
@@ -7,10 +7,14 @@ import type { AuthProvider } from './provider.js';
|
|
|
7
7
|
* VERIFIES the presented JWT against the issuer's JWKS and reads the subject. There are no
|
|
8
8
|
* server-side auth endpoints to run, so `handle` is informational.
|
|
9
9
|
*
|
|
10
|
-
* workerd-safe: `jose
|
|
10
|
+
* workerd-safe: `jose`, Web Crypto and `@substrat-run/oidc-rp/discovery` (the bound discovery
|
|
11
|
+
* the login path uses; no login flow and no `hono`).
|
|
11
12
|
*/
|
|
12
13
|
export interface OidcConfig {
|
|
13
|
-
/**
|
|
14
|
+
/**
|
|
15
|
+
* The issuer URL (`iss`). Must be `https` (loopback `http` for a dev issuer); its
|
|
16
|
+
* `/.well-known/openid-configuration` gives the JWKS, and must name this issuer.
|
|
17
|
+
*/
|
|
14
18
|
issuer: string;
|
|
15
19
|
/** Expected audience (`aud`), if the issuer sets one for this app. */
|
|
16
20
|
audience?: string;
|
|
@@ -25,7 +29,8 @@ export interface OidcConfig {
|
|
|
25
29
|
/**
|
|
26
30
|
* With `clientId`: this app's MCP resource identifier on an origin — `mcpResourceOf` from
|
|
27
31
|
* `@substrat-run/contracts`, handed in rather than imported so this subpath keeps its
|
|
28
|
-
* jose-
|
|
32
|
+
* small dependency set (jose + oidc-rp's discovery). An access token whose `aud` names it is
|
|
33
|
+
* this app's own too.
|
|
29
34
|
*/
|
|
30
35
|
resourceOf?: (origin: string) => string;
|
|
31
36
|
/** Override the JWKS URI (skip discovery) — e.g. a self-hosted issuer. */
|
package/dist/oidc.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkD,KAAK,eAAe,EAAE,MAAM,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkD,KAAK,eAAe,EAAE,MAAM,MAAM,CAAC;AAE5F,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,eAAe,CAAC;AAE/D;;;;;;;;;GASG;AACH,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC;IACxC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sGAAsG;IACtG,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAkED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,UAAU,GAAG,YAAY,CAkF9D"}
|
package/dist/oidc.js
CHANGED
|
@@ -1,23 +1,5 @@
|
|
|
1
1
|
import { jwtVerify, createRemoteJWKSet } from 'jose';
|
|
2
|
-
|
|
3
|
-
const discoveryCache = new Map();
|
|
4
|
-
function discoverJwksUri(issuer) {
|
|
5
|
-
let p = discoveryCache.get(issuer);
|
|
6
|
-
if (!p) {
|
|
7
|
-
p = (async () => {
|
|
8
|
-
const url = `${issuer.replace(/\/$/, '')}/.well-known/openid-configuration`;
|
|
9
|
-
const res = await fetch(url);
|
|
10
|
-
if (!res.ok)
|
|
11
|
-
throw new Error(`OIDC discovery failed for ${issuer}: ${res.status}`);
|
|
12
|
-
const meta = (await res.json());
|
|
13
|
-
if (!meta.jwks_uri)
|
|
14
|
-
throw new Error(`OIDC discovery for ${issuer} has no jwks_uri`);
|
|
15
|
-
return meta.jwks_uri;
|
|
16
|
-
})();
|
|
17
|
-
discoveryCache.set(issuer, p);
|
|
18
|
-
}
|
|
19
|
-
return p;
|
|
20
|
-
}
|
|
2
|
+
import { discoverIssuer, isAllowedEndpoint, issuerRefusal } from '@substrat-run/oidc-rp/discovery';
|
|
21
3
|
function bearerFrom(headers) {
|
|
22
4
|
const auth = headers.get('authorization');
|
|
23
5
|
if (auth?.toLowerCase().startsWith('bearer '))
|
|
@@ -90,10 +72,27 @@ export function oidcAuthProvider(cfg) {
|
|
|
90
72
|
if (cfg.keys)
|
|
91
73
|
return cfg.keys;
|
|
92
74
|
if (!keysPromise) {
|
|
93
|
-
|
|
94
|
-
|
|
75
|
+
// The login path's discovery, not a second one: bound to this issuer, https, no redirect
|
|
76
|
+
// off its origin (`discoverIssuer`). A failure is evicted here too, so an issuer that was
|
|
77
|
+
// down or answered wrongly once is asked again rather than refused for the isolate's life.
|
|
78
|
+
const pending = (async () => {
|
|
79
|
+
const jwksUri = cfg.jwksUri ?? (await discoverIssuer(cfg.issuer)).jwks_uri;
|
|
80
|
+
// An override skips discovery, not the transport rule: the keys are fetched from it.
|
|
81
|
+
// Nor the issuer rule: with no discovery, nothing else has looked at `cfg.issuer`.
|
|
82
|
+
if (cfg.jwksUri) {
|
|
83
|
+
const refused = issuerRefusal(cfg.issuer);
|
|
84
|
+
if (refused)
|
|
85
|
+
throw new Error(refused);
|
|
86
|
+
if (!isAllowedEndpoint(cfg.issuer, cfg.jwksUri))
|
|
87
|
+
throw new Error('jwksUri is not https');
|
|
88
|
+
}
|
|
95
89
|
return createRemoteJWKSet(new URL(jwksUri));
|
|
96
90
|
})();
|
|
91
|
+
pending.catch(() => {
|
|
92
|
+
if (keysPromise === pending)
|
|
93
|
+
keysPromise = undefined;
|
|
94
|
+
});
|
|
95
|
+
keysPromise = pending;
|
|
97
96
|
}
|
|
98
97
|
return keysPromise;
|
|
99
98
|
};
|
|
@@ -115,8 +114,8 @@ export function oidcAuthProvider(cfg) {
|
|
|
115
114
|
// browser-login path: a boolean when the issuer asserts one, and the `"true"` /
|
|
116
115
|
// `"false"` strings some issuers in the Auth0 lineage emit instead — anything else,
|
|
117
116
|
// the claim's absence included, stays `undefined` rather than becoming a guess.
|
|
118
|
-
// Written out here rather than imported so this subpath keeps
|
|
119
|
-
//
|
|
117
|
+
// Written out here rather than imported so this subpath keeps a small dependency
|
|
118
|
+
// set (jose + oidc-rp's discovery, no login flow) and a bearer-only consumer needs no hono.
|
|
120
119
|
const verified = meta['email_verified'];
|
|
121
120
|
return {
|
|
122
121
|
sub: String(payload.sub),
|
package/dist/oidc.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAyC,MAAM,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAyC,MAAM,MAAM,CAAC;AAC5F,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AA0CnG,SAAS,UAAU,CAAC,OAAgB;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC1C,IAAI,IAAI,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IACnF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,YAAY,CAAC,OAAgB,EAAE,GAAuB,EAAE,UAAsC;IACrG,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,OAAO,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;IAChD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,CAAC,UAAU,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,UAAU,CAAC,OAAmB,EAAE,QAAgB,EAAE,SAA4B;IACrF,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5G,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACzG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;IACpE,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAe;IAC9C,IAAI,WAAiD,CAAC;IACtD,MAAM,OAAO,GAAG,KAAK,IAA8B,EAAE;QACnD,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC;QAC9B,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,yFAAyF;YACzF,0FAA0F;YAC1F,2FAA2F;YAC3F,MAAM,OAAO,GAA6B,CAAC,KAAK,IAAI,EAAE;gBACpD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,MAAM,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAC3E,qFAAqF;gBACrF,mFAAmF;gBACnF,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;oBAChB,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBAC1C,IAAI,OAAO;wBAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;oBACtC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAC3F,CAAC;gBACD,OAAO,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9C,CAAC,CAAC,EAAE,CAAC;YACL,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;gBACjB,IAAI,WAAW,KAAK,OAAO;oBAAE,WAAW,GAAG,SAAS,CAAC;YACvD,CAAC,CAAC,CAAC;YACH,WAAW,GAAG,OAAO,CAAC;QACxB,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IAEF,KAAK,UAAU,MAAM,CAAC,KAAa,EAAE,OAAgB,EAAE,GAAuB;QAC5E,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,OAAO,EAAE,EAAE;gBAC1D,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBAClC,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnF,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC;oBAAE,OAAO,IAAI,CAAC;YACjE,CAAC;YACD,MAAM,IAAI,GAAG,OAAkC,CAAC;YAChD,4EAA4E;YAC5E,gFAAgF;YAChF,oFAAoF;YACpF,gFAAgF;YAChF,iFAAiF;YACjF,4FAA4F;YAC5F,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACxC,OAAO;gBACL,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;gBACxB,KAAK,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,IAAI;gBAC3E,aAAa,EACX,OAAO,QAAQ,KAAK,SAAS;oBAC3B,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,QAAQ,KAAK,MAAM;wBACnB,CAAC,CAAC,IAAI;wBACN,CAAC,CAAC,QAAQ,KAAK,OAAO;4BACpB,CAAC,CAAC,KAAK;4BACP,CAAC,CAAC,SAAS;gBACnB,IAAI,EACF,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ;oBAC9B,CAAC,CAAE,IAAI,CAAC,MAAM,CAAY;oBAC1B,CAAC,CAAC,OAAQ,IAAI,CAAC,eAAe,CAAwB,EAAE,IAAI,KAAK,QAAQ;wBACvE,CAAC,CAAC,CAAE,IAAI,CAAC,eAAe,CAAsB,CAAC,IAAI,CAAC;wBACpD,CAAC,CAAC,IAAI;aACb,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,0EAA0E;QACzF,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,MAAM;YACV,OAAO,QAAQ,CAAC,IAAI,CAAC;gBACnB,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,+EAA+E;aACtF,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG;YACxB,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;YAClC,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpD,CAAC;KACF,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@substrat-run/vertical-auth",
|
|
3
|
-
"version": "0.15.
|
|
3
|
+
"version": "0.15.4",
|
|
4
4
|
"description": "Pluggable auth for Substrat verticals — the AuthProvider contract, an OIDC provider (Supabase/Auth0/AuthHero/Keycloak), a full relying-party login flow, and a per-tenant identity Durable Object (Better Auth + sub→principal directory). Workers-targeted; the vertical worker bundles it.",
|
|
5
5
|
"license": "AGPL-3.0-only",
|
|
6
6
|
"repository": {
|
|
@@ -44,10 +44,10 @@
|
|
|
44
44
|
"better-auth": "^1.7.1",
|
|
45
45
|
"drizzle-orm": "^0.45.2",
|
|
46
46
|
"jose": "^6.2.3",
|
|
47
|
-
"@substrat-run/kernel": "^0.121.0",
|
|
48
47
|
"@substrat-run/psl": "^0.2.5",
|
|
49
|
-
"@substrat-run/contracts": "^0.
|
|
50
|
-
"@substrat-run/
|
|
48
|
+
"@substrat-run/contracts": "^0.122.0",
|
|
49
|
+
"@substrat-run/kernel": "^0.122.0",
|
|
50
|
+
"@substrat-run/oidc-rp": "^0.9.1"
|
|
51
51
|
},
|
|
52
52
|
"peerDependencies": {
|
|
53
53
|
"hono": "^4.6.0"
|