@t4h.framework/oidc 0.0.0-experimental-4621dcf-2ba30d83b350fbc392d4 → 0.0.1

package/README.md

@@ -23,7 +23,7 @@ You construct it with a context object; your app or hosting layer is responsible
 
 | Field | Required | Description |
 |-------|----------|-------------|
-| `wellKnownUrl` | Yes | OpenID Provider configuration document URL (must return JSON with at least `token_endpoint` and `introspection_endpoint`). |
+| `discoveryUrl` | Yes | OpenID Provider configuration document URL (must return JSON with at least `token_endpoint` and `introspection_endpoint`). |
 | `clientId` | Yes | OAuth 2.0 client identifier used for the client credentials grant. |
 | `clientSecret` | Yes | OAuth 2.0 client secret used for the client credentials grant. |
 | `token` | Yes | Credential to verify. Must use a `Bearer ` prefix (see below). |
@@ -40,15 +40,16 @@ The default export is an async function:
 
 Behavior:
 
-1. **Discovery** — `GET` `wellKnownUrl` and read JSON with `token_endpoint` and `introspection_endpoint`.
+1. **Discovery** — `GET` `discoveryUrl` and read JSON with `token_endpoint` and `introspection_endpoint`.
 2. **Client credentials** — `POST` the token endpoint with `grant_type=client_credentials`, `client_id`, `client_secret`, and optional `scope` / `resource` (`application/x-www-form-urlencoded`).
-3. **Introspection** — `POST` the introspection endpoint with JSON body `{ "token": "<access token>" }`, where the value is taken from `token` after stripping a leading `Authorization: Bearer ` style prefix (the implementation expects `token` to start with `Bearer `).
+3. **Introspection** — `POST` the introspection endpoint with JSON body `{ "token": "<access token>" }`, where the value is taken from `token` after stripping the leading `Bearer ` prefix.
 4. **Authorization header** — The introspection call uses `Authorization: Bearer <access_token>` with the access token from step 2.
 
 Result:
 
 - Returns `true` if the introspection response includes `"active": true`.
-- Returns `false` if the token is inactive or introspection indicates failure (including when the Bearer prefix is missing or the token cannot be extracted).
+- Returns `false` when the introspection response includes `"active": false`.
+- If the incoming credential does not start with `Bearer `, the handler sends `token: null` to introspection (final result then depends on the provider response, and is typically `false`).
 
 There is no built-in mapping from environment variables; all configuration comes from the manifest context.
 
@@ -58,7 +59,7 @@ There is no built-in mapping from environment variables; all configuration comes
 import { OIDCAuthorization } from '@t4h.framework/oidc'
 
 const authorization = new OIDCAuthorization({
-  wellKnownUrl: 'https://auth.example.com/.well-known/openid-configuration',
+  discoveryUrl: 'https://auth.example.com/.well-known/openid-configuration',
   clientId: 'my-service',
   clientSecret: process.env.OIDC_CLIENT_SECRET!,
   token: 'Bearer <incoming-access-token-from-runtime>',

package/dist/models/OIDCAuthorization.d.ts

@@ -1,4 +1,4 @@
-import { Authorization, type AuthenticationManifest } from '@t4h.framework/core';
+import { Authorization, type AuthorizationManifest } from '@t4h.framework/core';
 export type OIDCAuthorizationContext = {
     discoveryUrl: string;
     clientId: string;
@@ -7,7 +7,7 @@ export type OIDCAuthorizationContext = {
     scope?: string[];
     resource?: string;
 };
-export type OIDCAuthorizationManifest = AuthenticationManifest<OIDCAuthorizationContext>;
+export type OIDCAuthorizationManifest = AuthorizationManifest<OIDCAuthorizationContext>;
 export declare class OIDCAuthorization extends Authorization<OIDCAuthorizationContext> {
     private readonly context;
     constructor(context: OIDCAuthorizationContext);

package/dist/models/OIDCAuthorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OIDCAuthorization.d.ts","sourceRoot":"","sources":["../../src/models/OIDCAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,KAAK,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAEhF,MAAM,MAAM,wBAAwB,GAAG;IACrC,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,yBAAyB,GACnC,sBAAsB,CAAC,wBAAwB,CAAC,CAAA;AAElD,qBAAa,iBAAkB,SAAQ,aAAa,CAAC,wBAAwB,CAAC;IAChE,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,wBAAwB;IAIvD,UAAU,IAAI,yBAAyB;CAa/C"}
+{"version":3,"file":"OIDCAuthorization.d.ts","sourceRoot":"","sources":["../../src/models/OIDCAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAE/E,MAAM,MAAM,wBAAwB,GAAG;IACrC,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,yBAAyB,GACnC,qBAAqB,CAAC,wBAAwB,CAAC,CAAA;AAEjD,qBAAa,iBAAkB,SAAQ,aAAa,CAAC,wBAAwB,CAAC;IAChE,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,wBAAwB;IAIvD,UAAU,IAAI,yBAAyB;CAa/C"}

package/dist/models/OIDCAuthorization.js.map

@@ -1 +1 @@
-{"version":3,"file":"OIDCAuthorization.js","sourceRoot":"","sources":["../../src/models/OIDCAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAA+B,MAAM,qBAAqB,CAAA;AAchF,MAAM,OAAO,iBAAkB,SAAQ,aAAuC;IAC/C;IAA7B,YAA6B,OAAiC;QAC5D,KAAK,EAAE,CAAA;QADoB,YAAO,GAAP,OAAO,CAA0B;IAE9D,CAAC;IAEM,UAAU;QACf,OAAO;YACL,OAAO,EAAE;gBACP,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;gBACvC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAC/B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;gBACvC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;gBACzB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAC/B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;aAC1B;YACD,YAAY,EAAE,+BAA+B;SAC9C,CAAA;IACH,CAAC;CACF"}
+{"version":3,"file":"OIDCAuthorization.js","sourceRoot":"","sources":["../../src/models/OIDCAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAA8B,MAAM,qBAAqB,CAAA;AAc/E,MAAM,OAAO,iBAAkB,SAAQ,aAAuC;IAC/C;IAA7B,YAA6B,OAAiC;QAC5D,KAAK,EAAE,CAAA;QADoB,YAAO,GAAP,OAAO,CAA0B;IAE9D,CAAC;IAEM,UAAU;QACf,OAAO;YACL,OAAO,EAAE;gBACP,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;gBACvC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAC/B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;gBACvC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;gBACzB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAC/B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;aAC1B;YACD,YAAY,EAAE,+BAA+B;SAC9C,CAAA;IACH,CAAC;CACF"}

package/dist/oidc-authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-authorize.d.ts","sourceRoot":"","sources":["../src/oidc-authorize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAA;AAezD,wBAA8B,IAAI,CAChC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,OAAO,CAAC,CAwClB"}
+{"version":3,"file":"oidc-authorize.d.ts","sourceRoot":"","sources":["../src/oidc-authorize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAA;AAezD,wBAA8B,IAAI,CAChC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,OAAO,CAAC,CAiElB"}

package/dist/oidc-authorize.js

@@ -5,9 +5,12 @@ function getAccessToken(token) {
     return accessToken;
 }
 export default async function oidc(context) {
-    const discovery = await fetch(context.discoveryUrl, {
+    const discoveryResponse = await fetch(context.discoveryUrl, {
         method: 'GET',
-    }).then(response => response.json());
+    });
+    if (!discoveryResponse.ok)
+        throw new Error(`Discovery request failed: ${discoveryResponse.status} ${discoveryResponse.statusText}`);
+    const discovery = (await discoveryResponse.json());
     const scope = Array.isArray(context.scope)
         ? context.scope.join(' ')
         : context.scope;
@@ -20,14 +23,17 @@ export default async function oidc(context) {
         body.scope = scope;
     if (context.resource)
         body.resource = context.resource;
-    const { access_token } = await fetch(discovery.token_endpoint, {
+    const tokenResponse = await fetch(discovery.token_endpoint, {
         body: new URLSearchParams(body),
         method: 'POST',
         headers: {
             'Content-Type': 'application/x-www-form-urlencoded',
         },
-    }).then(response => response.json());
-    const introspection = await fetch(discovery.introspection_endpoint, {
+    });
+    if (!tokenResponse.ok)
+        throw new Error(`Token request failed: ${tokenResponse.status} ${tokenResponse.statusText}`);
+    const { access_token } = (await tokenResponse.json());
+    const introspectionResponse = await fetch(discovery.introspection_endpoint, {
         body: JSON.stringify({
             token: getAccessToken(context.token),
         }),
@@ -36,7 +42,10 @@ export default async function oidc(context) {
             'Content-Type': 'application/json',
             Authorization: `Bearer ${access_token}`,
         },
-    }).then(response => response.json());
+    });
+    if (!introspectionResponse.ok)
+        throw new Error(`Introspection request failed: ${introspectionResponse.status} ${introspectionResponse.statusText}`);
+    const introspection = (await introspectionResponse.json());
     if (!introspection.active)
         return false;
     return true;

package/dist/oidc-authorize.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-authorize.js","sourceRoot":"","sources":["../src/oidc-authorize.ts"],"names":[],"mappings":"AAOA,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAA;IAE7C,MAAM,CAAC,EAAE,WAAW,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAE9C,OAAO,WAAW,CAAA;AACpB,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,IAAI,CAChC,OAAiC;IAEjC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE;QAClD,MAAM,EAAE,KAAK;KACd,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAkC,CAAC,CAAA;IAEpE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;QACxC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;QACzB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAA;IAEjB,MAAM,IAAI,GAA2B;QACnC,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;KACpC,CAAA;IAED,IAAI,KAAK;QAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IAC7B,IAAI,OAAO,CAAC,QAAQ;QAAE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;IAEtD,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,cAAc,EAAE;QAC7D,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC;QAC/B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;SACpD;KACF,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAuC,CAAC,CAAA;IAEzE,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,sBAAsB,EAAE;QAClE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC;SACrC,CAAC;QACF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,YAAY,EAAE;SACxC;KACF,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAkC,CAAC,CAAA;IAEpE,IAAI,CAAC,aAAa,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAEvC,OAAO,IAAI,CAAA;AACb,CAAC"}
+{"version":3,"file":"oidc-authorize.js","sourceRoot":"","sources":["../src/oidc-authorize.ts"],"names":[],"mappings":"AAOA,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAA;IAE7C,MAAM,CAAC,EAAE,WAAW,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAE9C,OAAO,WAAW,CAAA;AACpB,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,IAAI,CAChC,OAAiC;IAEjC,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE;QAC1D,MAAM,EAAE,KAAK;KACd,CAAC,CAAA;IAEF,IAAI,CAAC,iBAAiB,CAAC,EAAE;QACvB,MAAM,IAAI,KAAK,CACb,6BAA6B,iBAAiB,CAAC,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,CACxF,CAAA;IAEH,MAAM,SAAS,GAAG,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,CAAwB,CAAA;IAEzE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;QACxC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;QACzB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAA;IAEjB,MAAM,IAAI,GAA2B;QACnC,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;KACpC,CAAA;IAED,IAAI,KAAK;QAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IAC7B,IAAI,OAAO,CAAC,QAAQ;QAAE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;IAEtD,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,cAAc,EAAE;QAC1D,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC;QAC/B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;SACpD;KACF,CAAC,CAAA;IAEF,IAAI,CAAC,aAAa,CAAC,EAAE;QACnB,MAAM,IAAI,KAAK,CACb,yBAAyB,aAAa,CAAC,MAAM,IAAI,aAAa,CAAC,UAAU,EAAE,CAC5E,CAAA;IAEH,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAEnD,CAAA;IAED,MAAM,qBAAqB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,sBAAsB,EAAE;QAC1E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC;SACrC,CAAC;QACF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,YAAY,EAAE;SACxC;KACF,CAAC,CAAA;IAEF,IAAI,CAAC,qBAAqB,CAAC,EAAE;QAC3B,MAAM,IAAI,KAAK,CACb,iCAAiC,qBAAqB,CAAC,MAAM,IAAI,qBAAqB,CAAC,UAAU,EAAE,CACpG,CAAA;IAEH,MAAM,aAAa,GAAG,CAAC,MAAM,qBAAqB,CAAC,IAAI,EAAE,CAExD,CAAA;IAED,IAAI,CAAC,aAAa,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAEvC,OAAO,IAAI,CAAA;AACb,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@t4h.framework/oidc",
-  "version": "0.0.0-experimental-4621dcf-2ba30d83b350fbc392d4",
+  "version": "0.0.1",
   "description": "OIDC module for the T4H Framework authorization",
   "homepage": "https://github.com/tech4humans-brasil/framework/tree/main/packages/oidc",
   "bugs": "https://github.com/tech4humans-brasil/framework/issues",
@@ -36,16 +36,15 @@
     "test:watch": "vitest"
   },
   "devDependencies": {
-    "@t4h.framework/core": "^0.0.0-experimental-4621dcf-2ba30d83b350fbc392d4",
+    "@t4h.framework/core": "^0.0.1",
     "typescript": "^5.9.3",
     "vitest": "^4.0.18"
   },
   "peerDependencies": {
-    "@t4h.framework/core": "^0.0.0-experimental-4621dcf-2ba30d83b350fbc392d4"
+    "@t4h.framework/core": "^0.0.1"
   },
   "packageManager": "yarn@4.12.0",
   "engines": {
     "node": ">=22"
-  },
-  "stableVersion": "0.0.0"
+  }
 }