@t4h.framework/oidc 0.3.0 → 0.5.0

package/.ai/skills/framework-oidc/SKILL.md

@@ -0,0 +1,263 @@
+---
+name: framework-oidc
+description: >-
+  Wire OpenID Connect authorization in T4H Framework apps and workflows using
+  @t4h.framework/oidc: OIDCAuthorization manifest, OIDCAuthorizationContext,
+  RFC 7662 bearer token introspection with client_secret_basic, and
+  discoveryUrl. Use when securing App/Workflow with OIDC, token
+  validation, OpenID Provider discovery, introspection_endpoint, attaching
+  authorization to manifests, or testing @t4h.framework/oidc/authorize.
+---
+
+# @t4h.framework/oidc
+
+OpenID Connect–oriented **authorization** for the T4H Framework. This package does **not** define Activities or Claims; it extends core’s `Authorization` and supplies a runtime handler that validates an incoming credential via **token introspection** (**RFC 7662**), authenticating that call with **`client_secret_basic`**.
+
+Package path: `framework/packages/oidc`. Peer dependency: `@t4h.framework/core` (same major line). Node `>=22`.
+
+For workflow Activities, Claims, and `History.reconciler`, use the **framework-core** skill. OIDC only gates access at the App/Workflow authorization layer.
+
+---
+
+## Imports
+
+| Entry | Import | Purpose |
+|--------|--------|---------|
+| `@t4h.framework/oidc` | `OIDCAuthorization`, `OIDCAuthorizationContext`, `OIDCAuthorizationManifest` | Author-time manifest |
+| `@t4h.framework/oidc/authorize` | default `oidc` handler | Runtime/tests only — `(context) => Promise<boolean>` |
+
+```typescript
+import { OIDCAuthorization } from '@t4h.framework/oidc'
+import type { OIDCAuthorizationContext } from '@t4h.framework/oidc'
+
+// Direct handler import (unit tests, custom runtime wiring):
+import oidc from '@t4h.framework/oidc/authorize'
+```
+
+---
+
+## Where it fits (core `Authorization`)
+
+Core exposes an abstract `Authorization` with `toManifest(): AuthorizationManifest`:
+
+```typescript
+type AuthorizationManifest<TContext extends object = any> = {
+  context?: TContext
+  pathToModule: string
+}
+```
+
+Attach `OIDCAuthorization` on **`App`** or **`Workflow`** options; `toManifest()` embeds `authorization` in the published manifest. The deployed runtime resolves dynamic fields (especially `token`), then loads `@t4h.framework/oidc/authorize` with the manifest `context`.
+
+```typescript
+import { App } from '@t4h.framework/core'
+import { OIDCAuthorization } from '@t4h.framework/oidc'
+
+export default new App({
+  id: 'my-app',
+  authorization: new OIDCAuthorization({
+    discoveryUrl:
+      'https://auth.example.com/.well-known/openid-configuration',
+    clientId: 'my-service',
+    clientSecret: process.env.OIDC_CLIENT_SECRET!,
+    token: 'Bearer <incoming-access-token-from-runtime>',
+  }),
+  workflows: [/* ... */],
+})
+```
+
+Per-workflow override:
+
+```typescript
+import { Workflow } from '@t4h.framework/core'
+import { OIDCAuthorization } from '@t4h.framework/oidc'
+
+const secured = new Workflow(
+  {
+    id: 'orders/v1',
+    authorization: new OIDCAuthorization({ /* same context shape */ }),
+  },
+  async input => ({ ok: true }),
+)
+```
+
+**App-level vs workflow-level:** set on whichever manifest should enforce OIDC. Workflow `authorization` in `toManifest()` is `authorization?.toManifest() ?? null`; App forwards `authorization?.toManifest()` at app scope.
+
+---
+
+## `OIDCAuthorization`
+
+Subclass of `Authorization<OIDCAuthorizationContext>`. Constructor stores context; `toManifest()` always sets:
+
+- `pathToModule: '@t4h.framework/oidc/authorize'`
+- `context`: full context object (`discoveryUrl`, `clientId`, `clientSecret`, `token`)
+
+```typescript
+new OIDCAuthorization({
+  discoveryUrl: 'https://auth.example.com/.well-known/openid-configuration',
+  clientId: 'svc',
+  clientSecret: 'secret',
+  token: 'Bearer t',
+})
+```
+
+There is **no** built-in mapping from environment variables — supply `clientSecret`, `discoveryUrl`, etc. from your app/hosting layer when constructing the instance.
+
+### Runtime token placeholder
+
+`token` is authored as a manifest placeholder the runtime replaces:
+
+```typescript
+token: '<<headers.authorization>>',
+```
+
+Author with whatever placeholder or value your deployment pipeline documents; the handler always receives the resolved string at runtime.
+
+---
+
+## `OIDCAuthorizationContext`
+
+| Field | Required | Description |
+|-------|----------|-------------|
+| `discoveryUrl` | Yes | OpenID Provider configuration document URL (JSON with `introspection_endpoint`). |
+| `clientId` | Yes | OAuth 2.0 client id used as the Basic username on introspection. |
+| `clientSecret` | Yes | OAuth 2.0 client secret used as the Basic password on introspection. |
+| `token` | Yes | Credential to verify. Must use a `Bearer ` prefix for the token value to be sent to introspection (see below). |
+
+Types exported: `OIDCAuthorizationContext`, `OIDCAuthorizationManifest` (`AuthorizationManifest<OIDCAuthorizationContext>`).
+
+---
+
+## Runtime handler (`@t4h.framework/oidc/authorize`)
+
+Default export: async function `(context: OIDCAuthorizationContext) => Promise<boolean>`.
+
+### Flow
+
+```mermaid
+sequenceDiagram
+  participant R as Runtime handler
+  participant D as discoveryUrl
+  participant I as introspection_endpoint
+
+  R->>D: GET discovery JSON
+  R->>I: POST form { token, token_type_hint } + Basic client credentials
+  I-->>R: { active }
+  R-->>R: true if active else false
+```
+
+1. **Discovery** — `GET` `discoveryUrl`; parse JSON as `{ introspection_endpoint }`. Non-OK HTTP → throw `Discovery request failed: <status> <statusText>`.
+2. **Introspection** — `POST` `introspection_endpoint` per **RFC 7662** with:
+   - `Content-Type: application/x-www-form-urlencoded`
+   - `Accept: application/json`
+   - `Authorization: Basic base64(<form-urlencoded clientId>:<form-urlencoded clientSecret>)` (`client_secret_basic`, RFC 6749 section 2.3.1)
+   - body `URLSearchParams` with `token=<stripped incoming token>` and `token_type_hint=access_token`
+   Non-OK HTTP → throw `Introspection request failed: ...`.
+3. **Result** — parse the RFC 7662 response (`active` plus optional `scope`, `client_id`, `exp`, `sub`, `aud`, …):
+   - `active: true` → return `true`
+   - anything else, including a missing `active` → return `false`
+
+Network failures from `fetch` propagate as rejected promises (not converted to `false`).
+
+### Bearer prefix rules
+
+Incoming `token` is parsed as an RFC 6750 bearer credential (scheme matched case-insensitively):
+
+- `Bearer <token>` → introspection sends the token value (e.g. `Bearer abc.def` → `token=abc.def`).
+- Anything else → the handler returns `false` immediately, with **no** discovery, token or introspection request (`token` is a required RFC 7662 parameter).
+
+Always author/runtime-resolve credentials as `Bearer <access-token>` when you expect introspection of the caller’s token.
+
+---
+
+## Authoring checklist
+
+1. Add `@t4h.framework/oidc` dependency alongside `@t4h.framework/core`.
+2. Construct `new OIDCAuthorization({ discoveryUrl, clientId, clientSecret, token, ... })`.
+3. Attach to `App` and/or `Workflow` `authorization` option.
+4. Ensure IdP discovery document exposes `introspection_endpoint`.
+5. Register a confidential OAuth client allowed to call **introspection** with **`client_secret_basic`**.
+6. Pass incoming caller token with `Bearer ` prefix (or use a runtime placeholder like `<<headers.authorization>>`).
+
+Do **not** look for OIDC Activities or Claim classes in this package — they do not exist here.
+
+---
+
+## Testing
+
+Package tests use **Vitest** with `vi.stubGlobal('fetch', ...)`.
+
+### `OIDCAuthorization.toManifest()`
+
+Assert manifest shape:
+
+```typescript
+expect(authorization.toManifest()).toEqual({
+  pathToModule: '@t4h.framework/oidc/authorize',
+  context: {
+    discoveryUrl: '...',
+    clientId: 'svc',
+    clientSecret: 'secret',
+    token: 'Bearer t',
+  },
+})
+```
+
+### Handler (`import oidc from '@t4h.framework/oidc/authorize'`)
+
+Mock two `fetch` calls in order: discovery → introspection.
+
+```typescript
+const baseContext = {
+  discoveryUrl: 'https://auth.example.com/.well-known/openid-configuration',
+  clientId: 'client-id',
+  clientSecret: 'client-secret',
+  token: 'Bearer incoming-token',
+}
+
+// Happy path: true
+fetchMock
+  .mockResolvedValueOnce(jsonResponse({
+    introspection_endpoint: 'https://auth.example.com/oauth/introspect',
+  }))
+  .mockResolvedValueOnce(jsonResponse({ active: true }))
+
+await expect(oidc(baseContext)).resolves.toBe(true)
+```
+
+Verify wire format from tests:
+
+- Introspection: `Authorization: Basic <base64 client-id:client-secret>`, form body `token=incoming-token&token_type_hint=access_token` after stripping `Bearer `.
+- Missing Bearer prefix: resolves `false` with `fetch` never called.
+- Inactive token: second response `{ active: false }` → `false`; a response without `active` also yields `false`.
+- HTTP errors on discovery/introspection: thrown `Error` messages as documented above.
+
+Run package tests: `yarn test` in `packages/oidc`.
+
+Workflow-level authorization behavior in process is owned by the **runtime** (outside this package); this package only defines manifest + handler contract.
+
+---
+
+## Common mistakes
+
+| Mistake | Consequence |
+|---------|-------------|
+| Raw JWT without `Bearer ` prefix | Denied up front; no provider request is made |
+| Expecting env auto-wiring | Secrets/URLs must be set when constructing `OIDCAuthorization` |
+| Missing `introspection_endpoint` on IdP | Discovery JSON incomplete; runtime fails at fetch/parse |
+| Treating `false` as HTTP error | `false` means inactive token; errors are thrown separately |
+| Adding OIDC as a Claim provider | Wrong abstraction — use `Authorization` on App/Workflow |
+| Importing handler from main entry | Use `@t4h.framework/oidc/authorize` (default export) |
+
+---
+
+## API summary
+
+| Symbol | Kind | Role |
+|--------|------|------|
+| `OIDCAuthorization` | class | `Authorization` subclass; `toManifest()` → oidc authorize module |
+| `OIDCAuthorizationContext` | type | Manifest/runtime context |
+| `OIDCAuthorizationManifest` | type | `AuthorizationManifest<OIDCAuthorizationContext>` |
+| default `oidc` | function | `@t4h.framework/oidc/authorize` — discovery + RFC 7662 introspection |
+
+See [README.md](../../../README.md) in this package for the same behavior described for humans.

package/CHANGELOG.md

@@ -0,0 +1,22 @@
+# @t4h.framework/oidc
+
+## 0.5.0
+
+### Minor Changes
+
+- [#147](https://github.com/tech4humans-brasil/framework/pull/147) [`45182d4`](https://github.com/tech4humans-brasil/framework/commit/45182d4a27c86353747646aa9b70a39bc4c56610) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Makes the `oidc` authorize handler follow RFC 7662. The introspection request now posts `token` and `token_type_hint=access_token` as `application/x-www-form-urlencoded` (instead of a JSON body), sends `Accept: application/json`, and only allows the run when the response reports `active: true`. The incoming credential is parsed as an RFC 6750 bearer credential with a case-insensitive scheme, and a credential without a `Bearer ` prefix is denied up front — `token` is a required introspection parameter, so no request is made for it.
+
+  The client credentials grant is gone: the handler now authenticates the introspection call directly with `client_secret_basic` (RFC 6749 section 2.3.1), so a check costs one round-trip instead of two and your OAuth client only needs permission to call introspection. **Breaking:** `scope` and `resource` were removed from `OIDCAuthorizationContext` — they only fed the client credentials request. Drop them from your `OIDCAuthorization` context and make sure the client is allowed to introspect with `client_secret_basic`.
+
+## 0.4.0
+
+### Patch Changes
+
+- Update skills ([`6d7e7bc`](https://github.com/tech4humans-brasil/framework/commit/6d7e7bca0c780a9c53a0c9e5aa0a865c5af67959))
+
+## 0.3.0
+
+### Minor Changes
+
+- Implements oidc package ([#53](https://github.com/tech4humans-brasil/framework/pull/53))
+- Adds .ai/skills in packages ([#88](https://github.com/tech4humans-brasil/framework/pull/88))

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Tech for humans
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,6 +1,6 @@
 # @t4h.framework/oidc
 
-OpenID Connect–oriented authorization for the T4H Framework. It exposes a core `Authorization` manifest and a runtime handler that obtains an access token via the OAuth 2.0 client credentials grant, then validates an incoming credential through the **token introspection** endpoint from the issuer’s OpenID configuration.
+OpenID Connect–oriented authorization for the T4H Framework. It exposes a core `Authorization` manifest and a runtime handler that validates an incoming credential through the **token introspection** endpoint ([RFC 7662](https://www.rfc-editor.org/rfc/rfc7662)) from the issuer’s OpenID configuration.
 
 ## Peer dependency
 
@@ -23,12 +23,10 @@ You construct it with a context object; your app or hosting layer is responsible
 
 | Field | Required | Description |
 |-------|----------|-------------|
-| `discoveryUrl` | Yes | OpenID Provider configuration document URL (must return JSON with at least `token_endpoint` and `introspection_endpoint`). |
-| `clientId` | Yes | OAuth 2.0 client identifier used for the client credentials grant. |
-| `clientSecret` | Yes | OAuth 2.0 client secret used for the client credentials grant. |
+| `discoveryUrl` | Yes | OpenID Provider configuration document URL (must return JSON with at least `introspection_endpoint`). |
+| `clientId` | Yes | OAuth 2.0 client identifier used to authenticate the introspection call. |
+| `clientSecret` | Yes | OAuth 2.0 client secret used to authenticate the introspection call. |
 | `token` | Yes | Credential to verify. Must use a `Bearer ` prefix (see below). |
-| `scope` | No | Scopes requested on the client credentials token (array of strings, joined with spaces for the request). |
-| `resource` | No | If set, sent as the `resource` parameter on the client credentials request (RFC 8707 style resource indication). |
 
 ## Runtime handler (`oidc/authorize`)
 
@@ -40,16 +38,15 @@ The default export is an async function:
 
 Behavior:
 
-1. **Discovery** — `GET` `discoveryUrl` and read JSON with `token_endpoint` and `introspection_endpoint`.
-2. **Client credentials** — `POST` the token endpoint with `grant_type=client_credentials`, `client_id`, `client_secret`, and optional `scope` / `resource` (`application/x-www-form-urlencoded`).
-3. **Introspection** — `POST` the introspection endpoint with JSON body `{ "token": "<access token>" }`, where the value is taken from `token` after stripping the leading `Bearer ` prefix.
-4. **Authorization header** — The introspection call uses `Authorization: Bearer <access_token>` with the access token from step 2.
+1. **Discovery** — `GET` `discoveryUrl` and read JSON with `introspection_endpoint`.
+2. **Introspection** — `POST` the introspection endpoint following [RFC 7662](https://www.rfc-editor.org/rfc/rfc7662), with `token` and `token_type_hint=access_token` as `application/x-www-form-urlencoded`, where `token` is taken from the context `token` after stripping the `Bearer ` prefix (the scheme is matched case-insensitively).
+3. **Client authentication** — RFC 7662 requires the caller to authorize itself; the handler uses `client_secret_basic` (RFC 6749 section 2.3.1), sending `Authorization: Basic base64(clientId:clientSecret)` with both values form-urlencoded. Your client must be allowed to call introspection with this method.
 
 Result:
 
-- Returns `true` if the introspection response includes `"active": true`.
-- Returns `false` when the introspection response includes `"active": false`.
-- If the incoming credential does not start with `Bearer `, the handler sends `token: null` to introspection (final result then depends on the provider response, and is typically `false`).
+- Returns `true` only if the introspection response includes `"active": true`.
+- Returns `false` for any other response, including a missing `active` member.
+- If the incoming credential does not carry a `Bearer ` prefix, the handler returns `false` without contacting the provider — `token` is a required introspection parameter.
 
 There is no built-in mapping from environment variables; all configuration comes from the manifest context.
 
@@ -63,7 +60,6 @@ const authorization = new OIDCAuthorization({
   clientId: 'my-service',
   clientSecret: process.env.OIDC_CLIENT_SECRET!,
   token: 'Bearer <incoming-access-token-from-runtime>',
-  scope: ['introspection'],
 })
 ```
 

package/dist/models/OIDCAuthorization.d.ts

@@ -4,8 +4,6 @@ export type OIDCAuthorizationContext = {
     clientId: string;
     clientSecret: string;
     token: string;
-    scope?: string[];
-    resource?: string;
 };
 export type OIDCAuthorizationManifest = AuthorizationManifest<OIDCAuthorizationContext>;
 export declare class OIDCAuthorization extends Authorization<OIDCAuthorizationContext> {

package/dist/models/OIDCAuthorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OIDCAuthorization.d.ts","sourceRoot":"","sources":["../../src/models/OIDCAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAE/E,MAAM,MAAM,wBAAwB,GAAG;IACrC,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,yBAAyB,GACnC,qBAAqB,CAAC,wBAAwB,CAAC,CAAA;AAEjD,qBAAa,iBAAkB,SAAQ,aAAa,CAAC,wBAAwB,CAAC;IAChE,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,wBAAwB;IAIvD,UAAU,IAAI,yBAAyB;CAa/C"}
+{"version":3,"file":"OIDCAuthorization.d.ts","sourceRoot":"","sources":["../../src/models/OIDCAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAE/E,MAAM,MAAM,wBAAwB,GAAG;IACrC,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAED,MAAM,MAAM,yBAAyB,GACnC,qBAAqB,CAAC,wBAAwB,CAAC,CAAA;AAEjD,qBAAa,iBAAkB,SAAQ,aAAa,CAAC,wBAAwB,CAAC;IAChE,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,wBAAwB;IAIvD,UAAU,IAAI,yBAAyB;CAW/C"}

package/dist/models/OIDCAuthorization.js

@@ -11,8 +11,6 @@ export class OIDCAuthorization extends Authorization {
                 discoveryUrl: this.context.discoveryUrl,
                 clientId: this.context.clientId,
                 clientSecret: this.context.clientSecret,
-                scope: this.context.scope,
-                resource: this.context.resource,
                 token: this.context.token,
             },
             pathToModule: '@t4h.framework/oidc/authorize',

package/dist/models/OIDCAuthorization.js.map

@@ -1 +1 @@
-{"version":3,"file":"OIDCAuthorization.js","sourceRoot":"","sources":["../../src/models/OIDCAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAA8B,MAAM,qBAAqB,CAAA;AAc/E,MAAM,OAAO,iBAAkB,SAAQ,aAAuC;IAC/C;IAA7B,YAA6B,OAAiC;QAC5D,KAAK,EAAE,CAAA;QADoB,YAAO,GAAP,OAAO,CAA0B;IAE9D,CAAC;IAEM,UAAU;QACf,OAAO;YACL,OAAO,EAAE;gBACP,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;gBACvC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAC/B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;gBACvC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;gBACzB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAC/B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;aAC1B;YACD,YAAY,EAAE,+BAA+B;SAC9C,CAAA;IACH,CAAC;CACF"}
+{"version":3,"file":"OIDCAuthorization.js","sourceRoot":"","sources":["../../src/models/OIDCAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAA8B,MAAM,qBAAqB,CAAA;AAY/E,MAAM,OAAO,iBAAkB,SAAQ,aAAuC;IAC/C;IAA7B,YAA6B,OAAiC;QAC5D,KAAK,EAAE,CAAA;QADoB,YAAO,GAAP,OAAO,CAA0B;IAE9D,CAAC;IAEM,UAAU;QACf,OAAO;YACL,OAAO,EAAE;gBACP,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;gBACvC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAC/B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;gBACvC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;aAC1B;YACD,YAAY,EAAE,+BAA+B;SAC9C,CAAA;IACH,CAAC;CACF"}

package/dist/oidc-authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-authorize.d.ts","sourceRoot":"","sources":["../src/oidc-authorize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAA;AAezD,wBAA8B,IAAI,CAChC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,OAAO,CAAC,CAiElB"}
+{"version":3,"file":"oidc-authorize.d.ts","sourceRoot":"","sources":["../src/oidc-authorize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAA;AAmCzD,wBAA8B,IAAI,CAChC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,OAAO,CAAC,CA6ClB"}

package/dist/oidc-authorize.js

@@ -1,53 +1,41 @@
+const BEARER_CREDENTIAL = /^Bearer +(?<token>[^ ]+) *$/i;
 function getAccessToken(token) {
-    if (!token.startsWith('Bearer '))
-        return null;
-    const [, accessToken] = token.split('Bearer ');
-    return accessToken;
+    const match = BEARER_CREDENTIAL.exec(token);
+    return match?.groups?.token ?? null;
+}
+function encodeCredential(value) {
+    const [, encoded] = new URLSearchParams({ value }).toString().split('=');
+    return encoded;
 }
 export default async function oidc(context) {
+    const accessToken = getAccessToken(context.token);
+    if (!accessToken)
+        return false;
     const discoveryResponse = await fetch(context.discoveryUrl, {
         method: 'GET',
+        headers: {
+            Accept: 'application/json',
+        },
     });
     if (!discoveryResponse.ok)
         throw new Error(`Discovery request failed: ${discoveryResponse.status} ${discoveryResponse.statusText}`);
     const discovery = (await discoveryResponse.json());
-    const scope = Array.isArray(context.scope)
-        ? context.scope.join(' ')
-        : context.scope;
-    const body = {
-        grant_type: 'client_credentials',
-        client_id: context.clientId,
-        client_secret: context.clientSecret,
-    };
-    if (scope)
-        body.scope = scope;
-    if (context.resource)
-        body.resource = context.resource;
-    const tokenResponse = await fetch(discovery.token_endpoint, {
-        body: new URLSearchParams(body),
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/x-www-form-urlencoded',
-        },
-    });
-    if (!tokenResponse.ok)
-        throw new Error(`Token request failed: ${tokenResponse.status} ${tokenResponse.statusText}`);
-    const { access_token } = (await tokenResponse.json());
+    const credentials = Buffer.from(`${encodeCredential(context.clientId)}:${encodeCredential(context.clientSecret)}`).toString('base64');
     const introspectionResponse = await fetch(discovery.introspection_endpoint, {
-        body: JSON.stringify({
-            token: getAccessToken(context.token),
+        body: new URLSearchParams({
+            token: accessToken,
+            token_type_hint: 'access_token',
         }),
         method: 'POST',
         headers: {
-            'Content-Type': 'application/json',
-            Authorization: `Bearer ${access_token}`,
+            'Content-Type': 'application/x-www-form-urlencoded',
+            Accept: 'application/json',
+            Authorization: `Basic ${credentials}`,
         },
     });
     if (!introspectionResponse.ok)
         throw new Error(`Introspection request failed: ${introspectionResponse.status} ${introspectionResponse.statusText}`);
     const introspection = (await introspectionResponse.json());
-    if (!introspection.active)
-        return false;
-    return true;
+    return introspection.active === true;
 }
 //# sourceMappingURL=oidc-authorize.js.map

package/dist/oidc-authorize.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-authorize.js","sourceRoot":"","sources":["../src/oidc-authorize.ts"],"names":[],"mappings":"AAOA,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAA;IAE7C,MAAM,CAAC,EAAE,WAAW,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAE9C,OAAO,WAAW,CAAA;AACpB,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,IAAI,CAChC,OAAiC;IAEjC,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE;QAC1D,MAAM,EAAE,KAAK;KACd,CAAC,CAAA;IAEF,IAAI,CAAC,iBAAiB,CAAC,EAAE;QACvB,MAAM,IAAI,KAAK,CACb,6BAA6B,iBAAiB,CAAC,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,CACxF,CAAA;IAEH,MAAM,SAAS,GAAG,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,CAAwB,CAAA;IAEzE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;QACxC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;QACzB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAA;IAEjB,MAAM,IAAI,GAA2B;QACnC,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;KACpC,CAAA;IAED,IAAI,KAAK;QAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IAC7B,IAAI,OAAO,CAAC,QAAQ;QAAE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;IAEtD,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,cAAc,EAAE;QAC1D,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC;QAC/B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;SACpD;KACF,CAAC,CAAA;IAEF,IAAI,CAAC,aAAa,CAAC,EAAE;QACnB,MAAM,IAAI,KAAK,CACb,yBAAyB,aAAa,CAAC,MAAM,IAAI,aAAa,CAAC,UAAU,EAAE,CAC5E,CAAA;IAEH,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAEnD,CAAA;IAED,MAAM,qBAAqB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,sBAAsB,EAAE;QAC1E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC;SACrC,CAAC;QACF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,YAAY,EAAE;SACxC;KACF,CAAC,CAAA;IAEF,IAAI,CAAC,qBAAqB,CAAC,EAAE;QAC3B,MAAM,IAAI,KAAK,CACb,iCAAiC,qBAAqB,CAAC,MAAM,IAAI,qBAAqB,CAAC,UAAU,EAAE,CACpG,CAAA;IAEH,MAAM,aAAa,GAAG,CAAC,MAAM,qBAAqB,CAAC,IAAI,EAAE,CAExD,CAAA;IAED,IAAI,CAAC,aAAa,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAEvC,OAAO,IAAI,CAAA;AACb,CAAC"}
+{"version":3,"file":"oidc-authorize.js","sourceRoot":"","sources":["../src/oidc-authorize.ts"],"names":[],"mappings":"AAqBA,MAAM,iBAAiB,GAAG,8BAA8B,CAAA;AAExD,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAE3C,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,IAAI,CAAA;AACrC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAExE,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,IAAI,CAChC,OAAiC;IAEjC,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAEjD,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAA;IAE9B,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE;QAC1D,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;SAC3B;KACF,CAAC,CAAA;IAEF,IAAI,CAAC,iBAAiB,CAAC,EAAE;QACvB,MAAM,IAAI,KAAK,CACb,6BAA6B,iBAAiB,CAAC,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,CACxF,CAAA;IAEH,MAAM,SAAS,GAAG,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,CAAwB,CAAA;IAEzE,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAC7B,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAClF,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAEpB,MAAM,qBAAqB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,sBAAsB,EAAE;QAC1E,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,KAAK,EAAE,WAAW;YAClB,eAAe,EAAE,cAAc;SAChC,CAAC;QACF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,SAAS,WAAW,EAAE;SACtC;KACF,CAAC,CAAA;IAEF,IAAI,CAAC,qBAAqB,CAAC,EAAE;QAC3B,MAAM,IAAI,KAAK,CACb,iCAAiC,qBAAqB,CAAC,MAAM,IAAI,qBAAqB,CAAC,UAAU,EAAE,CACpG,CAAA;IAEH,MAAM,aAAa,GACjB,CAAC,MAAM,qBAAqB,CAAC,IAAI,EAAE,CAA0B,CAAA;IAE/D,OAAO,aAAa,CAAC,MAAM,KAAK,IAAI,CAAA;AACtC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@t4h.framework/oidc",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "OIDC module for the T4H Framework authorization",
   "homepage": "https://github.com/tech4humans-brasil/framework/tree/main/packages/oidc",
   "bugs": "https://github.com/tech4humans-brasil/framework/issues",
@@ -26,7 +26,8 @@
   "types": "./dist/oidc.d.ts",
   "files": [
     "dist",
-    "LICENSE"
+    "LICENSE",
+    ".ai"
   ],
   "scripts": {
     "build": "tsc --project tsconfig.build.json",
@@ -36,12 +37,12 @@
     "test:watch": "vitest"
   },
   "devDependencies": {
-    "@t4h.framework/core": "^0.3.0",
+    "@t4h.framework/core": "^0.9.1",
     "typescript": "^5.9.3",
     "vitest": "^4.0.18"
   },
   "peerDependencies": {
-    "@t4h.framework/core": "^0.3.0"
+    "@t4h.framework/core": "^0.9.1"
   },
   "packageManager": "yarn@4.12.0",
   "engines": {