@substrat-run/vertical-auth 0.26.1 → 0.27.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/auth-diagnostics.d.ts +5 -0
- package/dist/auth-diagnostics.d.ts.map +1 -0
- package/dist/auth-diagnostics.js +28 -0
- package/dist/auth-diagnostics.js.map +1 -0
- package/dist/mcp-discovery.d.ts +3 -0
- package/dist/mcp-discovery.d.ts.map +1 -0
- package/dist/mcp-discovery.js +11 -0
- package/dist/mcp-discovery.js.map +1 -0
- package/dist/oidc-rp-provider.d.ts.map +1 -1
- package/dist/oidc-rp-provider.js +10 -1
- package/dist/oidc-rp-provider.js.map +1 -1
- package/dist/oidc.d.ts +2 -2
- package/dist/oidc.d.ts.map +1 -1
- package/dist/oidc.js +34 -10
- package/dist/oidc.js.map +1 -1
- package/package.json +4 -4
|
@@ -0,0 +1,5 @@
|
|
|
1
|
+
import { type AuthCheck } from '@substrat-run/contracts/auth-diagnostics';
|
|
2
|
+
/** Read jose's stable codes structurally: bundled copies need not share constructors. */
|
|
3
|
+
export declare function verificationReason(error: unknown): AuthCheck['reason'] | undefined;
|
|
4
|
+
export declare function bearerRefused(reason: AuthCheck['reason'], outcome?: 'refused' | 'error'): null;
|
|
5
|
+
//# sourceMappingURL=auth-diagnostics.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"auth-diagnostics.d.ts","sourceRoot":"","sources":["../src/auth-diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,0CAA0C,CAAC;AAE3F,yFAAyF;AACzF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,SAAS,CAmBlF;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAE,SAAS,GAAG,OAAmB,GAAG,IAAI,CAGzG"}
|
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
import { recordAuthCheck } from '@substrat-run/contracts/auth-diagnostics';
|
|
2
|
+
/** Read jose's stable codes structurally: bundled copies need not share constructors. */
|
|
3
|
+
export function verificationReason(error) {
|
|
4
|
+
if (!error || typeof error !== 'object')
|
|
5
|
+
return undefined;
|
|
6
|
+
const { code, claim } = error;
|
|
7
|
+
switch (code) {
|
|
8
|
+
case 'ERR_JWT_EXPIRED': return 'token-expired';
|
|
9
|
+
case 'ERR_JWT_CLAIM_VALIDATION_FAILED':
|
|
10
|
+
switch (claim) {
|
|
11
|
+
case 'iss': return 'issuer-invalid';
|
|
12
|
+
case 'aud': return 'audience-invalid';
|
|
13
|
+
case 'nbf': return 'token-not-active';
|
|
14
|
+
default: return 'claims-invalid';
|
|
15
|
+
}
|
|
16
|
+
case 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED': return 'signature-invalid';
|
|
17
|
+
case 'ERR_JWS_INVALID':
|
|
18
|
+
case 'ERR_JWT_INVALID':
|
|
19
|
+
case 'ERR_JOSE_ALG_NOT_ALLOWED':
|
|
20
|
+
case 'ERR_JOSE_NOT_SUPPORTED': return 'token-invalid';
|
|
21
|
+
default: return undefined;
|
|
22
|
+
}
|
|
23
|
+
}
|
|
24
|
+
export function bearerRefused(reason, outcome = 'refused') {
|
|
25
|
+
recordAuthCheck({ stage: 'bearer', outcome, reason });
|
|
26
|
+
return null;
|
|
27
|
+
}
|
|
28
|
+
//# sourceMappingURL=auth-diagnostics.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"auth-diagnostics.js","sourceRoot":"","sources":["../src/auth-diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAkB,MAAM,0CAA0C,CAAC;AAE3F,yFAAyF;AACzF,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,KAA4C,CAAC;IACrE,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,iBAAiB,EAAE,OAAO,eAAe,CAAC;QAC/C,KAAK,iCAAiC;YACpC,QAAQ,KAAK,EAAE,CAAC;gBACd,KAAK,KAAK,EAAE,OAAO,gBAAgB,CAAC;gBACpC,KAAK,KAAK,EAAE,OAAO,kBAAkB,CAAC;gBACtC,KAAK,KAAK,EAAE,OAAO,kBAAkB,CAAC;gBACtC,SAAS,OAAO,gBAAgB,CAAC;YACnC,CAAC;QACH,KAAK,uCAAuC,EAAE,OAAO,mBAAmB,CAAC;QACzE,KAAK,iBAAiB,CAAC;QACvB,KAAK,iBAAiB,CAAC;QACvB,KAAK,0BAA0B,CAAC;QAChC,KAAK,wBAAwB,EAAE,OAAO,eAAe,CAAC;QACtD,SAAS,OAAO,SAAS,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAA2B,EAAE,OAAO,GAAwB,SAAS;IACjG,eAAe,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC;AACd,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"mcp-discovery.d.ts","sourceRoot":"","sources":["../src/mcp-discovery.ts"],"names":[],"mappings":"AAGA,2FAA2F;AAC3F,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAOnF"}
|
|
@@ -0,0 +1,11 @@
|
|
|
1
|
+
import { MCP_AUTHORIZATION_SERVERS_PATH } from '@substrat-run/contracts';
|
|
2
|
+
import { issuerRefusal } from '@substrat-run/oidc-rp/discovery';
|
|
3
|
+
/** Public configuration only: no session, upstream fetch, registration, or credentials. */
|
|
4
|
+
export function mcpDiscovery(request, issuer) {
|
|
5
|
+
if (new URL(request.url).pathname !== MCP_AUTHORIZATION_SERVERS_PATH)
|
|
6
|
+
return undefined;
|
|
7
|
+
if (request.method !== 'GET')
|
|
8
|
+
return new Response(null, { status: 405, headers: { Allow: 'GET' } });
|
|
9
|
+
return Response.json({ authorization_servers: issuerRefusal(issuer) === null ? [issuer] : [] }, { headers: { 'Cache-Control': 'no-store' } });
|
|
10
|
+
}
|
|
11
|
+
//# sourceMappingURL=mcp-discovery.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"mcp-discovery.js","sourceRoot":"","sources":["../src/mcp-discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAEhE,2FAA2F;AAC3F,MAAM,UAAU,YAAY,CAAC,OAAgB,EAAE,MAAc;IAC3D,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,8BAA8B;QAAE,OAAO,SAAS,CAAC;IACvF,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IACpG,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,qBAAqB,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EACzE,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAC7C,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc-rp-provider.d.ts","sourceRoot":"","sources":["../src/oidc-rp-provider.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"oidc-rp-provider.d.ts","sourceRoot":"","sources":["../src/oidc-rp-provider.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,YAAY,EAA+B,MAAM,eAAe,CAAC;AAC/E,OAAO,EAAoB,KAAK,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAIpE;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,YAAY;IAC3B,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,0FAA0F;IAC1F,aAAa,EAAE,MAAM,CAAC;IACtB,gGAAgG;IAChG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AA0HD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,YAAY,GAAG,YAAY,CA0HlE"}
|
package/dist/oidc-rp-provider.js
CHANGED
|
@@ -1,7 +1,9 @@
|
|
|
1
|
+
import { recordAuthCheck } from '@substrat-run/contracts/auth-diagnostics';
|
|
1
2
|
import { beginLogin, completeLogin, federatedLogout, verifySessionEnvelope, readCookie, safePath, SESSION_COOKIE, FLOW_COOKIE, LOGOUT_HINT_COOKIE, LOGOUT_PATH, LOGGED_OUT_PATH, LOGOUT_RETURN_COOKIE, LOGOUT_RETURN_MAXAGE, SESSION_MAXAGE, FLOW_MAXAGE, } from '@substrat-run/oidc-rp';
|
|
2
3
|
import { mcpResourceOf } from '@substrat-run/contracts';
|
|
3
4
|
import { oidcAuthProvider } from './oidc.js';
|
|
4
5
|
import { cookieDomainDecision } from './cookie-domain.js';
|
|
6
|
+
import { mcpDiscovery } from './mcp-discovery.js';
|
|
5
7
|
const envOf = (cfg) => ({
|
|
6
8
|
OIDC_ISSUER: cfg.issuer,
|
|
7
9
|
OIDC_CLIENT_ID: cfg.clientId,
|
|
@@ -112,6 +114,9 @@ function bearerVerifier(cfg) {
|
|
|
112
114
|
export function oidcRpAuthProvider(cfg) {
|
|
113
115
|
const env = envOf(cfg);
|
|
114
116
|
async function handle(request) {
|
|
117
|
+
const discovery = mcpDiscovery(request, cfg.issuer);
|
|
118
|
+
if (discovery)
|
|
119
|
+
return discovery;
|
|
115
120
|
const url = new URL(request.url);
|
|
116
121
|
const origin = url.origin;
|
|
117
122
|
// The flow cookie stays HOST-ONLY even with a cookieDomain: the code flow begins and
|
|
@@ -197,8 +202,10 @@ export function oidcRpAuthProvider(cfg) {
|
|
|
197
202
|
return Response.json({ error: 'this instance authenticates at its OIDC issuer', issuer: cfg.issuer }, { status: 404 });
|
|
198
203
|
}
|
|
199
204
|
async function resolve(headers, url, options) {
|
|
200
|
-
const
|
|
205
|
+
const cookie = readCookie(headers.get('cookie'), SESSION_COOKIE);
|
|
206
|
+
const envelope = await verifySessionEnvelope(env, cookie);
|
|
201
207
|
if (envelope) {
|
|
208
|
+
recordAuthCheck({ stage: 'session', outcome: 'accepted', reason: 'verified' });
|
|
202
209
|
const session = envelope.user;
|
|
203
210
|
return {
|
|
204
211
|
sub: session.id,
|
|
@@ -210,6 +217,8 @@ export function oidcRpAuthProvider(cfg) {
|
|
|
210
217
|
expiresAt: envelope.expiresAt,
|
|
211
218
|
};
|
|
212
219
|
}
|
|
220
|
+
if (cookie)
|
|
221
|
+
recordAuthCheck({ stage: 'session', outcome: 'refused', reason: 'session-invalid' });
|
|
213
222
|
// No cookie session — an API client presenting the issuer's own token directly. On a
|
|
214
223
|
// shared issuer it must be one minted for THIS app (#1683); `url` names our resource.
|
|
215
224
|
// `options` carries the MCP endpoint's channel, which only a bearer can use (#1824).
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc-rp-provider.js","sourceRoot":"","sources":["../src/oidc-rp-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,aAAa,EACb,eAAe,EACf,qBAAqB,EACrB,UAAU,EACV,QAAQ,EACR,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,WAAW,GAEZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,EAAE,gBAAgB,EAAyB,MAAM,WAAW,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;
|
|
1
|
+
{"version":3,"file":"oidc-rp-provider.js","sourceRoot":"","sources":["../src/oidc-rp-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,0CAA0C,CAAC;AAC3E,OAAO,EACL,UAAU,EACV,aAAa,EACb,eAAe,EACf,qBAAqB,EACrB,UAAU,EACV,QAAQ,EACR,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,WAAW,GAEZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,EAAE,gBAAgB,EAAyB,MAAM,WAAW,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAkDlD,MAAM,KAAK,GAAG,CAAC,GAAiB,EAAW,EAAE,CAAC,CAAC;IAC7C,WAAW,EAAE,GAAG,CAAC,MAAM;IACvB,cAAc,EAAE,GAAG,CAAC,QAAQ;IAC5B,kBAAkB,EAAE,GAAG,CAAC,YAAY;IACpC,kFAAkF;IAClF,oFAAoF;IACpF,iFAAiF;IACjF,cAAc,EAAE,oBAAoB,CAClC,GAAG,CAAC,YAAY,EAChB,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,EACjD,GAAG,CAAC,mBAAmB,CACxB,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,aAAa,0BAA0B,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa;CACrF,CAAC,CAAC;AAEH,2GAA2G;AAC3G,SAAS,MAAM,CACb,IAAY,EACZ,KAAa,EACb,MAAc,EACd,MAAc,EACd,MAAsB,EACtB,IAAI,GAAG,GAAG,EACV,QAAQ,GAAqB,KAAK;IAElC,MAAM,KAAK,GAAG;QACZ,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE;QACtC,QAAQ,IAAI,EAAE;QACd,WAAW,MAAM,EAAE;QACnB,UAAU;QACV,YAAY,QAAQ,EAAE;KACvB,CAAC;IACF,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,EAAE,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,KAAa,EAAE,MAAc,EAAE,MAAc,EAAE,MAAqB;IAC1F,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AACxG,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,WAAW,CAAC,KAAa,EAAE,MAAc,EAAE,MAAc,EAAE,MAAqB;IACvF,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrG,OAAO;QACL,MAAM,CAAC,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC;QAChF,MAAM,CAAC,kBAAkB,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,OAAiB;IACvD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,4FAA4F;AAC5F,2FAA2F;AAC3F,oFAAoF;AACpF,sFAAsF;AACtF,sFAAsF;AACtF,8BAA8B;AAC9B,MAAM,WAAW,GAAG,IAAI,GAAG,EAAwB,CAAC;AACpD,SAAS,cAAc,CAAC,GAAiB;IACvC,0FAA0F;IAC1F,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU;QAC/B,CAAC,CAAC;YACE,MAAM,EAAE,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;YAClC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,GAAG,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;SACtH;QACH,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;QACzB,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,QAAQ,IAAI,EAAE;QAClB,GAAG,IAAI,EAAE;QACT,0FAA0F;QAC1F,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;KAC3F,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,gBAAgB,CAAC;YACnB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,MAAc,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC,CAAC;QACH,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAiB;IAClD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAEvB,KAAK,UAAU,MAAM,CAAC,OAAgB;QACpC,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC1B,qFAAqF;QACrF,wFAAwF;QACxF,iFAAiF;QACjF,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAChH,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC;YAC9B,MAAM,CAAC,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,aAAa,CAAC;YACpD,MAAM,CAAC,kBAAkB,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,CAAC;SAChF,CAAC,CAAC,CAAC,EAAE,CAAC;QAEP,IAAI,GAAG,CAAC,QAAQ,KAAK,iBAAiB,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACnD,oFAAoF;YACpF,qFAAqF;YACrF,mFAAmF;YACnF,6EAA6E;YAC7E,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE;gBACvD,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACpD,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS;gBAC1D,UAAU,EAAE,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;gBAC1E,MAAM,EAAE,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;aAC/E,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;QAC9F,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,oBAAoB,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;YACpE,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACrD,IAAI,CAAC;gBACH,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;gBACnF,OAAO,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE;oBAC7C,SAAS;oBACT,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC;oBAC1D,+EAA+E;oBAC/E,6BAA6B;oBAC7B,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC;oBACvD,GAAG,OAAO;iBACX,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,8EAA8E;gBAC9E,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACpG,OAAO,YAAY,CAAC,cAAc,EAAE,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,GAAG,CAAC;YAChE,MAAM,OAAO,GAAG,CAAC,GAAG,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC;YAC9G;;;;;;;;;;;;eAYG;YACH,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,CAAC;gBAC3E,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;gBAC5D,IAAI,GAAG,EAAE,CAAC;oBACR,iFAAiF;oBACjF,gFAAgF;oBAChF,iDAAiD;oBACjD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ;wBACvB,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;wBACnG,CAAC,CAAC,EAAE,CAAC;oBACP,OAAO,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;YACD,OAAO,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,eAAe,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAC,CAAC,IAAI,GAAG,CAAC;YAC9F,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;QAClG,CAAC;QAED,iFAAiF;QACjF,6EAA6E;QAC7E,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,gDAAgD,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAC/E,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,OAAgB,EAAE,GAAY,EAAE,OAAwB;QAC7E,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC1D,IAAI,QAAQ,EAAE,CAAC;YACb,eAAe,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YAC/E,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC;YAC9B,OAAO;gBACL,GAAG,EAAE,OAAO,CAAC,EAAE;gBACf,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;gBAC5B,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;gBAC1B,+EAA+E;gBAC/E,6EAA6E;gBAC7E,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,SAAS,EAAE,QAAQ,CAAC,SAAS;aAC9B,CAAC;QACJ,CAAC;QACD,IAAI,MAAM;YAAE,eAAe,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACjG,qFAAqF;QACrF,sFAAsF;QACtF,qFAAqF;QACrF,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC"}
|
package/dist/oidc.d.ts
CHANGED
|
@@ -7,8 +7,8 @@ import type { AuthProvider } from './provider.js';
|
|
|
7
7
|
* VERIFIES the presented JWT against the issuer's JWKS and reads the subject. There are no
|
|
8
8
|
* server-side auth endpoints to run, so `handle` is informational.
|
|
9
9
|
*
|
|
10
|
-
* workerd-safe: `jose`, Web Crypto
|
|
11
|
-
*
|
|
10
|
+
* workerd-safe: `jose`, Web Crypto, the shared discovery path, and
|
|
11
|
+
* `@substrat-run/oidc-rp/discovery` (no login flow and no `hono`).
|
|
12
12
|
*/
|
|
13
13
|
export interface OidcConfig {
|
|
14
14
|
/**
|
package/dist/oidc.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAEA,OAAO,EAAkD,KAAK,eAAe,EAAE,MAAM,MAAM,CAAC;AAE5F,OAAO,KAAK,EAAE,YAAY,EAA+B,MAAM,eAAe,CAAC;AAG/E;;;;;;;;;GASG;AACH,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC;IACxC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sGAAsG;IACtG,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,MAAM,CAAC;AAExD,gFAAgF;AAChF,eAAO,MAAM,kCAAkC,KAAK,CAAC;AAiMrD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,UAAU,GAAG,YAAY,CA+H9D"}
|
package/dist/oidc.js
CHANGED
|
@@ -1,5 +1,8 @@
|
|
|
1
|
+
import { recordAuthCheck } from '@substrat-run/contracts/auth-diagnostics';
|
|
2
|
+
import { bearerRefused, verificationReason } from './auth-diagnostics.js';
|
|
1
3
|
import { jwtVerify, createRemoteJWKSet } from 'jose';
|
|
2
4
|
import { discoverIssuer, isAllowedEndpoint, issuerRefusal } from '@substrat-run/oidc-rp/discovery';
|
|
5
|
+
import { mcpDiscovery } from './mcp-discovery.js';
|
|
3
6
|
/**
|
|
4
7
|
* The longest a delegated token may live, in seconds: the lifetime the team auth-server's
|
|
5
8
|
* exchange mints (`EXCHANGED_TOKEN_TTL_SECONDS` in `demos/auth-server/src/token-exchange.ts`
|
|
@@ -234,19 +237,28 @@ export function oidcAuthProvider(cfg) {
|
|
|
234
237
|
if (cfg.delegation && cfg.resourceOf && cfg.audience && typeof channel === 'string' && channel !== cfg.audience) {
|
|
235
238
|
warnAudienceRefusesDelegation(cfg.issuer, cfg.audience);
|
|
236
239
|
}
|
|
240
|
+
let discovering = true;
|
|
241
|
+
let resolvingKey = false;
|
|
237
242
|
try {
|
|
238
|
-
const
|
|
243
|
+
const keys = await getKeys();
|
|
244
|
+
discovering = false;
|
|
245
|
+
const { payload } = await jwtVerify(token, async (header, token) => {
|
|
246
|
+
resolvingKey = true;
|
|
247
|
+
const key = await keys(header, token);
|
|
248
|
+
resolvingKey = false;
|
|
249
|
+
return key;
|
|
250
|
+
}, {
|
|
239
251
|
issuer: cfg.issuer,
|
|
240
252
|
...(cfg.audience ? { audience: cfg.audience } : {}),
|
|
241
253
|
});
|
|
242
254
|
if (!payload.sub)
|
|
243
|
-
return
|
|
255
|
+
return bearerRefused('subject-missing');
|
|
244
256
|
// A delegation ASSERTION — the first step of the exchange, which a `substrat_delegation`
|
|
245
257
|
// claim with no `act` marks — is a bearer at no app, on every configuration: it is a
|
|
246
258
|
// credential for the exchange, and only the exchange takes it. `may_act` alone decides
|
|
247
259
|
// nothing here: RFC 8693 §4.4 lets any issuer put it on an ordinary subject token.
|
|
248
260
|
if (payload['substrat_delegation'] !== undefined && payload['act'] === undefined)
|
|
249
|
-
return
|
|
261
|
+
return bearerRefused('assertion-not-access-token');
|
|
250
262
|
// A token carrying `act` is a delegation, on every configuration: admitted only through
|
|
251
263
|
// the opt-in, and never by the rules below, which would take it as the user's own.
|
|
252
264
|
let delegation;
|
|
@@ -255,13 +267,13 @@ export function oidcAuthProvider(cfg) {
|
|
|
255
267
|
const now = Math.floor(Date.now() / 1000);
|
|
256
268
|
const admitted = cfg.delegation && cfg.resourceOf ? delegationOf(payload, cfg.delegation, options?.delegated, url, now) : null;
|
|
257
269
|
if (!admitted)
|
|
258
|
-
return
|
|
270
|
+
return bearerRefused('delegation-refused');
|
|
259
271
|
delegation = admitted;
|
|
260
272
|
}
|
|
261
273
|
else if (!cfg.audience && cfg.clientId) {
|
|
262
274
|
const resources = cfg.resourceOf ? ownResources(headers, url, cfg.resourceOf) : [];
|
|
263
275
|
if (!isOwnToken(payload, cfg.clientId, resources, cfg.resourceOf))
|
|
264
|
-
return
|
|
276
|
+
return bearerRefused('token-not-for-app');
|
|
265
277
|
}
|
|
266
278
|
const meta = payload;
|
|
267
279
|
// `email_verified`, read exactly as `@substrat-run/oidc-rp` reads it on the
|
|
@@ -271,7 +283,7 @@ export function oidcAuthProvider(cfg) {
|
|
|
271
283
|
// Written out here rather than imported so this subpath keeps a small dependency
|
|
272
284
|
// set (jose + oidc-rp's discovery, no login flow) and a bearer-only consumer needs no hono.
|
|
273
285
|
const verified = meta['email_verified'];
|
|
274
|
-
|
|
286
|
+
const subject = {
|
|
275
287
|
sub: String(payload.sub),
|
|
276
288
|
email: typeof meta['email'] === 'string' ? meta['email'] : null,
|
|
277
289
|
emailVerified: typeof verified === 'boolean'
|
|
@@ -289,13 +301,22 @@ export function oidcAuthProvider(cfg) {
|
|
|
289
301
|
...(typeof payload.exp === 'number' ? { expiresAt: new Date(payload.exp * 1000).toISOString() } : {}),
|
|
290
302
|
...(delegation ? { delegation } : {}),
|
|
291
303
|
};
|
|
304
|
+
recordAuthCheck({ stage: 'bearer', outcome: 'accepted', reason: 'verified' });
|
|
305
|
+
return subject;
|
|
292
306
|
}
|
|
293
|
-
catch {
|
|
294
|
-
|
|
307
|
+
catch (error) {
|
|
308
|
+
// Never copy an exception message, payload or claim value into diagnostics.
|
|
309
|
+
// Key resolution runs inside jose, so track that boundary independently of its errors.
|
|
310
|
+
const reason = discovering ? 'discovery-failed'
|
|
311
|
+
: verificationReason(error) ?? (resolvingKey ? 'key-resolution-failed' : 'verification-failed');
|
|
312
|
+
return bearerRefused(reason, ['discovery-failed', 'key-resolution-failed', 'verification-failed'].includes(reason) ? 'error' : 'refused');
|
|
295
313
|
}
|
|
296
314
|
}
|
|
297
315
|
return {
|
|
298
|
-
async handle() {
|
|
316
|
+
async handle(request) {
|
|
317
|
+
const discovery = mcpDiscovery(request, cfg.issuer);
|
|
318
|
+
if (discovery)
|
|
319
|
+
return discovery;
|
|
299
320
|
return Response.json({
|
|
300
321
|
provider: 'oidc',
|
|
301
322
|
issuer: cfg.issuer,
|
|
@@ -304,7 +325,10 @@ export function oidcAuthProvider(cfg) {
|
|
|
304
325
|
},
|
|
305
326
|
async resolve(headers, url, options) {
|
|
306
327
|
const token = bearerFrom(headers);
|
|
307
|
-
|
|
328
|
+
if (token)
|
|
329
|
+
return verify(token, headers, url, options);
|
|
330
|
+
recordAuthCheck({ stage: 'bearer', outcome: 'absent', reason: 'credential-missing' });
|
|
331
|
+
return null;
|
|
308
332
|
},
|
|
309
333
|
};
|
|
310
334
|
}
|
package/dist/oidc.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAyC,MAAM,MAAM,CAAC;AAC5F,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAiEnG;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,GAAG,CAAC;AAExD,gFAAgF;AAChF,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,CAAC;AAErD,SAAS,UAAU,CAAC,OAAgB;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC1C,IAAI,IAAI,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IACnF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,YAAY,CAAC,OAAgB,EAAE,GAAuB,EAAE,UAAsC;IACrG,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,OAAO,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;IAChD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,CAAC,UAAU,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,SAAS,UAAU,CACjB,OAAmB,EACnB,QAAgB,EAChB,SAA4B,EAC5B,UAAoD;IAEpD,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5G,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,UAAU,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACzG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;IACpE,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC;AACjD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAC,KAAa,EAAE,UAAsC;IAC1E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,cAAc,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACnG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,iDAAiD;AACjD,SAAS,cAAc,CAAC,QAAgB;IACtC,IAAI,IAAI,GAAG,QAAQ,CAAC;IACpB,IAAI,CAAC;QACH,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,SAAS,YAAY,CACnB,OAAmB,EACnB,UAA4B,EAC5B,OAAoC,EACpC,GAAuB,EACvB,UAAkB;IAElB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,GAA8B,CAAC;IACvE,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,KAAK,OAAO,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjF,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACtF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5E,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3I,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAC;IACnC,IAAI,CAAC,GAAG,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAClF,IAAI,CAAC;QACH,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,KAAK,GAAG,UAAU,CAAC,kBAAkB,CAAC;IAC5C,MAAM,KAAK,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;IACjI,iFAAiF;IACjF,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,CAAC,CAAC,GAAG,IAAI,UAAU,GAAG,kCAAkC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,MAAM,KAAK,GAAG,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;AACzC,SAAS,6BAA6B,CAAC,MAAc,EAAE,QAAgB;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/C,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO;IACpC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,CAAC,IAAI,CAAC,oHAAoH,EAAE;QACjI,KAAK,EAAE,UAAU;KAClB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAe;IAC9C,IAAI,WAAiD,CAAC;IACtD,MAAM,OAAO,GAAG,KAAK,IAA8B,EAAE;QACnD,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC;QAC9B,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,yFAAyF;YACzF,0FAA0F;YAC1F,2FAA2F;YAC3F,MAAM,OAAO,GAA6B,CAAC,KAAK,IAAI,EAAE;gBACpD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,MAAM,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAC3E,qFAAqF;gBACrF,mFAAmF;gBACnF,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;oBAChB,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBAC1C,IAAI,OAAO;wBAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;oBACtC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAC3F,CAAC;gBACD,OAAO,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9C,CAAC,CAAC,EAAE,CAAC;YACL,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;gBACjB,IAAI,WAAW,KAAK,OAAO;oBAAE,WAAW,GAAG,SAAS,CAAC;YACvD,CAAC,CAAC,CAAC;YACH,WAAW,GAAG,OAAO,CAAC;QACxB,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IAEF,KAAK,UAAU,MAAM,CACnB,KAAa,EACb,OAAgB,EAChB,GAAuB,EACvB,OAAmC;QAEnC,MAAM,OAAO,GAAG,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;QAC7C,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;YAChH,6BAA6B,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,OAAO,EAAE,EAAE;gBAC1D,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC9B,yFAAyF;YACzF,qFAAqF;YACrF,uFAAuF;YACvF,mFAAmF;YACnF,IAAI,OAAO,CAAC,qBAAqB,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YAC9F,wFAAwF;YACxF,mFAAmF;YACnF,IAAI,UAAqC,CAAC;YAC1C,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;gBACjC,kFAAkF;gBAClF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;gBAC1C,MAAM,QAAQ,GACZ,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAChH,IAAI,CAAC,QAAQ;oBAAE,OAAO,IAAI,CAAC;gBAC3B,UAAU,GAAG,QAAQ,CAAC;YACxB,CAAC;iBAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACzC,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnF,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC;oBAAE,OAAO,IAAI,CAAC;YACjF,CAAC;YACD,MAAM,IAAI,GAAG,OAAkC,CAAC;YAChD,4EAA4E;YAC5E,gFAAgF;YAChF,oFAAoF;YACpF,gFAAgF;YAChF,iFAAiF;YACjF,4FAA4F;YAC5F,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACxC,OAAO;gBACL,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;gBACxB,KAAK,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,IAAI;gBAC3E,aAAa,EACX,OAAO,QAAQ,KAAK,SAAS;oBAC3B,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,QAAQ,KAAK,MAAM;wBACnB,CAAC,CAAC,IAAI;wBACN,CAAC,CAAC,QAAQ,KAAK,OAAO;4BACpB,CAAC,CAAC,KAAK;4BACP,CAAC,CAAC,SAAS;gBACnB,IAAI,EACF,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ;oBAC9B,CAAC,CAAE,IAAI,CAAC,MAAM,CAAY;oBAC1B,CAAC,CAAC,OAAQ,IAAI,CAAC,eAAe,CAAwB,EAAE,IAAI,KAAK,QAAQ;wBACvE,CAAC,CAAC,CAAE,IAAI,CAAC,eAAe,CAAsB,CAAC,IAAI,CAAC;wBACpD,CAAC,CAAC,IAAI;gBACZ,GAAG,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,0EAA0E;QACzF,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,MAAM;YACV,OAAO,QAAQ,CAAC,IAAI,CAAC;gBACnB,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,+EAA+E;aACtF,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO;YACjC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;YAClC,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7D,CAAC;KACF,CAAC;AACJ,CAAC"}
|
|
1
|
+
{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,0CAA0C,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAyC,MAAM,MAAM,CAAC;AAC5F,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAEnG,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAgElD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,GAAG,CAAC;AAExD,gFAAgF;AAChF,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,CAAC;AAErD,SAAS,UAAU,CAAC,OAAgB;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC1C,IAAI,IAAI,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IACnF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,YAAY,CAAC,OAAgB,EAAE,GAAuB,EAAE,UAAsC;IACrG,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,OAAO,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;IAChD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,CAAC,UAAU,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,SAAS,UAAU,CACjB,OAAmB,EACnB,QAAgB,EAChB,SAA4B,EAC5B,UAAoD;IAEpD,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5G,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,UAAU,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACzG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;IACpE,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC;AACjD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAC,KAAa,EAAE,UAAsC;IAC1E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,cAAc,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACnG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,iDAAiD;AACjD,SAAS,cAAc,CAAC,QAAgB;IACtC,IAAI,IAAI,GAAG,QAAQ,CAAC;IACpB,IAAI,CAAC;QACH,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,SAAS,YAAY,CACnB,OAAmB,EACnB,UAA4B,EAC5B,OAAoC,EACpC,GAAuB,EACvB,UAAkB;IAElB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,GAA8B,CAAC;IACvE,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,KAAK,OAAO,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjF,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACtF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5E,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3I,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAC;IACnC,IAAI,CAAC,GAAG,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAClF,IAAI,CAAC;QACH,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,KAAK,GAAG,UAAU,CAAC,kBAAkB,CAAC;IAC5C,MAAM,KAAK,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;IACjI,iFAAiF;IACjF,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,CAAC,CAAC,GAAG,IAAI,UAAU,GAAG,kCAAkC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,MAAM,KAAK,GAAG,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;AACzC,SAAS,6BAA6B,CAAC,MAAc,EAAE,QAAgB;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/C,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO;IACpC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,CAAC,IAAI,CAAC,oHAAoH,EAAE;QACjI,KAAK,EAAE,UAAU;KAClB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAe;IAC9C,IAAI,WAAiD,CAAC;IACtD,MAAM,OAAO,GAAG,KAAK,IAA8B,EAAE;QACnD,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC;QAC9B,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,yFAAyF;YACzF,0FAA0F;YAC1F,2FAA2F;YAC3F,MAAM,OAAO,GAA6B,CAAC,KAAK,IAAI,EAAE;gBACpD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,MAAM,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAC3E,qFAAqF;gBACrF,mFAAmF;gBACnF,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;oBAChB,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBAC1C,IAAI,OAAO;wBAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;oBACtC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAC3F,CAAC;gBACD,OAAO,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9C,CAAC,CAAC,EAAE,CAAC;YACL,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;gBACjB,IAAI,WAAW,KAAK,OAAO;oBAAE,WAAW,GAAG,SAAS,CAAC;YACvD,CAAC,CAAC,CAAC;YACH,WAAW,GAAG,OAAO,CAAC;QACxB,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IAEF,KAAK,UAAU,MAAM,CACnB,KAAa,EACb,OAAgB,EAChB,GAAuB,EACvB,OAAmC;QAEnC,MAAM,OAAO,GAAG,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;QAC7C,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;YAChH,6BAA6B,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,WAAW,GAAG,IAAI,CAAC;QACvB,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;YAC7B,WAAW,GAAG,KAAK,CAAC;YACpB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;gBACjE,YAAY,GAAG,IAAI,CAAC;gBACpB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBACtC,YAAY,GAAG,KAAK,CAAC;gBACrB,OAAO,GAAG,CAAC;YACb,CAAC,EAAE;gBACD,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,GAAG;gBAAE,OAAO,aAAa,CAAC,iBAAiB,CAAC,CAAC;YAC1D,yFAAyF;YACzF,qFAAqF;YACrF,uFAAuF;YACvF,mFAAmF;YACnF,IAAI,OAAO,CAAC,qBAAqB,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,SAAS;gBAAE,OAAO,aAAa,CAAC,4BAA4B,CAAC,CAAC;YACrI,wFAAwF;YACxF,mFAAmF;YACnF,IAAI,UAAqC,CAAC;YAC1C,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;gBACjC,kFAAkF;gBAClF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;gBAC1C,MAAM,QAAQ,GACZ,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAChH,IAAI,CAAC,QAAQ;oBAAE,OAAO,aAAa,CAAC,oBAAoB,CAAC,CAAC;gBAC1D,UAAU,GAAG,QAAQ,CAAC;YACxB,CAAC;iBAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACzC,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnF,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC;oBAAE,OAAO,aAAa,CAAC,mBAAmB,CAAC,CAAC;YAC/G,CAAC;YACD,MAAM,IAAI,GAAG,OAAkC,CAAC;YAChD,4EAA4E;YAC5E,gFAAgF;YAChF,oFAAoF;YACpF,gFAAgF;YAChF,iFAAiF;YACjF,4FAA4F;YAC5F,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACxC,MAAM,OAAO,GAAgB;gBAC3B,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;gBACxB,KAAK,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,IAAI;gBAC3E,aAAa,EACX,OAAO,QAAQ,KAAK,SAAS;oBAC3B,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,QAAQ,KAAK,MAAM;wBACnB,CAAC,CAAC,IAAI;wBACN,CAAC,CAAC,QAAQ,KAAK,OAAO;4BACpB,CAAC,CAAC,KAAK;4BACP,CAAC,CAAC,SAAS;gBACnB,IAAI,EACF,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ;oBAC9B,CAAC,CAAE,IAAI,CAAC,MAAM,CAAY;oBAC1B,CAAC,CAAC,OAAQ,IAAI,CAAC,eAAe,CAAwB,EAAE,IAAI,KAAK,QAAQ;wBACvE,CAAC,CAAC,CAAE,IAAI,CAAC,eAAe,CAAsB,CAAC,IAAI,CAAC;wBACpD,CAAC,CAAC,IAAI;gBACZ,GAAG,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtC,CAAC;YACF,eAAe,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YAC9E,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,4EAA4E;YAC5E,uFAAuF;YACvF,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,kBAAkB;gBAC7C,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;YAClG,OAAO,aAAa,CAAC,MAAM,EAAE,CAAC,kBAAkB,EAAE,uBAAuB,EAAE,qBAAqB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5I,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACpD,IAAI,SAAS;gBAAE,OAAO,SAAS,CAAC;YAChC,OAAO,QAAQ,CAAC,IAAI,CAAC;gBACnB,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,+EAA+E;aACtF,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO;YACjC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,KAAK;gBAAE,OAAO,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YACvD,eAAe,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACtF,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@substrat-run/vertical-auth",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.27.2",
|
|
4
4
|
"description": "OIDC authentication for Substrat verticals — token verification, a full relying-party login flow, and a per-tenant identity directory Durable Object. Workers-targeted; the vertical worker bundles it.",
|
|
5
5
|
"license": "AGPL-3.0-only",
|
|
6
6
|
"repository": {
|
|
@@ -50,10 +50,10 @@
|
|
|
50
50
|
],
|
|
51
51
|
"dependencies": {
|
|
52
52
|
"jose": "^6.2.3",
|
|
53
|
-
"@substrat-run/contracts": "^0.
|
|
54
|
-
"@substrat-run/
|
|
53
|
+
"@substrat-run/contracts": "^0.159.0",
|
|
54
|
+
"@substrat-run/psl": "^0.2.5",
|
|
55
55
|
"@substrat-run/oidc-rp": "^0.13.0",
|
|
56
|
-
"@substrat-run/
|
|
56
|
+
"@substrat-run/kernel": "^0.159.0"
|
|
57
57
|
},
|
|
58
58
|
"peerDependencies": {
|
|
59
59
|
"hono": "^4.13.13"
|