@t4h.framework/oidc 0.4.0 → 0.5.0

package/.ai/skills/framework-oidc/SKILL.md

@@ -3,15 +3,15 @@ name: framework-oidc
 description: >-
   Wire OpenID Connect authorization in T4H Framework apps and workflows using
   @t4h.framework/oidc: OIDCAuthorization manifest, OIDCAuthorizationContext,
-  Bearer token introspection via OAuth client credentials, discoveryUrl,
-  scope, and resource. Use when securing App/Workflow with OIDC, token
+  RFC 7662 bearer token introspection with client_secret_basic, and
+  discoveryUrl. Use when securing App/Workflow with OIDC, token
   validation, OpenID Provider discovery, introspection_endpoint, attaching
   authorization to manifests, or testing @t4h.framework/oidc/authorize.
 ---
 
 # @t4h.framework/oidc
 
-OpenID Connect–oriented **authorization** for the T4H Framework. This package does **not** define Activities or Claims; it extends core’s `Authorization` and supplies a runtime handler that validates an incoming credential via **token introspection** after obtaining a service token with the **OAuth 2.0 client credentials** grant.
+OpenID Connect–oriented **authorization** for the T4H Framework. This package does **not** define Activities or Claims; it extends core’s `Authorization` and supplies a runtime handler that validates an incoming credential via **token introspection** (**RFC 7662**), authenticating that call with **`client_secret_basic`**.
 
 Package path: `framework/packages/oidc`. Peer dependency: `@t4h.framework/core` (same major line). Node `>=22`.
 
@@ -61,7 +61,6 @@ export default new App({
     clientId: 'my-service',
     clientSecret: process.env.OIDC_CLIENT_SECRET!,
     token: 'Bearer <incoming-access-token-from-runtime>',
-    scope: ['introspection'],
   }),
   workflows: [/* ... */],
 })
@@ -91,7 +90,7 @@ const secured = new Workflow(
 Subclass of `Authorization<OIDCAuthorizationContext>`. Constructor stores context; `toManifest()` always sets:
 
 - `pathToModule: '@t4h.framework/oidc/authorize'`
-- `context`: full context object (including `scope` / `resource` as `undefined` when omitted)
+- `context`: full context object (`discoveryUrl`, `clientId`, `clientSecret`, `token`)
 
 ```typescript
 new OIDCAuthorization({
@@ -99,8 +98,6 @@ new OIDCAuthorization({
   clientId: 'svc',
   clientSecret: 'secret',
   token: 'Bearer t',
-  scope: ['a', 'b'],           // optional
-  resource: 'https://api.example.com', // optional
 })
 ```
 
@@ -122,12 +119,10 @@ Author with whatever placeholder or value your deployment pipeline documents; th
 
 | Field | Required | Description |
 |-------|----------|-------------|
-| `discoveryUrl` | Yes | OpenID Provider configuration document URL (JSON with `token_endpoint` and `introspection_endpoint`). |
-| `clientId` | Yes | OAuth 2.0 client id for client credentials grant. |
-| `clientSecret` | Yes | OAuth 2.0 client secret for client credentials grant. |
+| `discoveryUrl` | Yes | OpenID Provider configuration document URL (JSON with `introspection_endpoint`). |
+| `clientId` | Yes | OAuth 2.0 client id used as the Basic username on introspection. |
+| `clientSecret` | Yes | OAuth 2.0 client secret used as the Basic password on introspection. |
 | `token` | Yes | Credential to verify. Must use a `Bearer ` prefix for the token value to be sent to introspection (see below). |
-| `scope` | No | Scopes for the client-credentials token (`string[]`, joined with spaces on the wire). |
-| `resource` | No | If set, sent as `resource` on the client credentials request (RFC 8707 style). |
 
 Types exported: `OIDCAuthorizationContext`, `OIDCAuthorizationManifest` (`AuthorizationManifest<OIDCAuthorizationContext>`).
 
@@ -143,41 +138,33 @@ Default export: async function `(context: OIDCAuthorizationContext) => Promise<b
 sequenceDiagram
   participant R as Runtime handler
   participant D as discoveryUrl
-  participant T as token_endpoint
   participant I as introspection_endpoint
 
   R->>D: GET discovery JSON
-  R->>T: POST client_credentials
-  T-->>R: access_token
-  R->>I: POST JSON { token } + Bearer access_token
+  R->>I: POST form { token, token_type_hint } + Basic client credentials
   I-->>R: { active }
   R-->>R: true if active else false
 ```
 
-1. **Discovery** — `GET` `discoveryUrl`; parse JSON as `{ token_endpoint, introspection_endpoint }`. Non-OK HTTP → throw `Discovery request failed: <status> <statusText>`.
-2. **Client credentials** — `POST` `token_endpoint` with `application/x-www-form-urlencoded` body:
-   - `grant_type=client_credentials`
-   - `client_id`, `client_secret`
-   - optional `scope` (space-joined from array)
-   - optional `resource`
-   Non-OK HTTP → throw `Token request failed: ...`.
-3. **Introspection** — `POST` `introspection_endpoint` with:
-   - `Content-Type: application/json`
-   - `Authorization: Bearer <access_token>` (from step 2)
-   - body `JSON.stringify({ token: <stripped incoming token or null> })`
+1. **Discovery** — `GET` `discoveryUrl`; parse JSON as `{ introspection_endpoint }`. Non-OK HTTP → throw `Discovery request failed: <status> <statusText>`.
+2. **Introspection** — `POST` `introspection_endpoint` per **RFC 7662** with:
+   - `Content-Type: application/x-www-form-urlencoded`
+   - `Accept: application/json`
+   - `Authorization: Basic base64(<form-urlencoded clientId>:<form-urlencoded clientSecret>)` (`client_secret_basic`, RFC 6749 section 2.3.1)
+   - body `URLSearchParams` with `token=<stripped incoming token>` and `token_type_hint=access_token`
    Non-OK HTTP → throw `Introspection request failed: ...`.
-4. **Result** — parse `{ active: boolean }`:
+3. **Result** — parse the RFC 7662 response (`active` plus optional `scope`, `client_id`, `exp`, `sub`, `aud`, …):
    - `active: true` → return `true`
-   - `active: false` → return `false`
+   - anything else, including a missing `active` → return `false`
 
 Network failures from `fetch` propagate as rejected promises (not converted to `false`).
 
 ### Bearer prefix rules
 
-Incoming `token` is parsed with a simple prefix check:
+Incoming `token` is parsed as an RFC 6750 bearer credential (scheme matched case-insensitively):
 
-- Starts with `Bearer ` → introspection body uses the substring after the first `Bearer ` (e.g. `Bearer abc.def` → `"abc.def"`).
-- Does **not** start with `Bearer ` → introspection body sends `{ "token": null }` (typically yields `active: false`).
+- `Bearer <token>` → introspection sends the token value (e.g. `Bearer abc.def` → `token=abc.def`).
+- Anything else → the handler returns `false` immediately, with **no** discovery, token or introspection request (`token` is a required RFC 7662 parameter).
 
 Always author/runtime-resolve credentials as `Bearer <access-token>` when you expect introspection of the caller’s token.
 
@@ -188,10 +175,9 @@ Always author/runtime-resolve credentials as `Bearer <access-token>` when you ex
 1. Add `@t4h.framework/oidc` dependency alongside `@t4h.framework/core`.
 2. Construct `new OIDCAuthorization({ discoveryUrl, clientId, clientSecret, token, ... })`.
 3. Attach to `App` and/or `Workflow` `authorization` option.
-4. Ensure IdP discovery document exposes `token_endpoint` and `introspection_endpoint`.
-5. Register a confidential OAuth client allowed to use **client credentials** and call **introspection**.
+4. Ensure IdP discovery document exposes `introspection_endpoint`.
+5. Register a confidential OAuth client allowed to call **introspection** with **`client_secret_basic`**.
 6. Pass incoming caller token with `Bearer ` prefix (or use a runtime placeholder like `<<headers.authorization>>`).
-7. Optionally set `scope` (e.g. scopes required for introspection on the service token) and `resource` (audience/resource indicator for the CC token).
 
 Do **not** look for OIDC Activities or Claim classes in this package — they do not exist here.
 
@@ -212,8 +198,6 @@ expect(authorization.toManifest()).toEqual({
     discoveryUrl: '...',
     clientId: 'svc',
     clientSecret: 'secret',
-    scope: undefined, // when omitted
-    resource: undefined,
     token: 'Bearer t',
   },
 })
@@ -221,7 +205,7 @@ expect(authorization.toManifest()).toEqual({
 
 ### Handler (`import oidc from '@t4h.framework/oidc/authorize'`)
 
-Mock three `fetch` calls in order: discovery → token → introspection.
+Mock two `fetch` calls in order: discovery → introspection.
 
 ```typescript
 const baseContext = {
@@ -234,10 +218,8 @@ const baseContext = {
 // Happy path: true
 fetchMock
   .mockResolvedValueOnce(jsonResponse({
-    token_endpoint: 'https://auth.example.com/oauth/token',
     introspection_endpoint: 'https://auth.example.com/oauth/introspect',
   }))
-  .mockResolvedValueOnce(jsonResponse({ access_token: 'cc-access-token' }))
   .mockResolvedValueOnce(jsonResponse({ active: true }))
 
 await expect(oidc(baseContext)).resolves.toBe(true)
@@ -245,11 +227,10 @@ await expect(oidc(baseContext)).resolves.toBe(true)
 
 Verify wire format from tests:
 
-- Token request: `URLSearchParams` with `grant_type`, `client_id`, `client_secret`; optional `scope` (`openid profile` from `['openid','profile']`); optional `resource`.
-- Introspection: `Authorization: Bearer cc-access-token`, body `{ token: 'incoming-token' }` after stripping `Bearer `.
-- Missing Bearer prefix: body `{ token: null }`.
-- Inactive token: third response `{ active: false }` → `false`.
-- HTTP errors on discovery/token/introspection: thrown `Error` messages as documented above.
+- Introspection: `Authorization: Basic <base64 client-id:client-secret>`, form body `token=incoming-token&token_type_hint=access_token` after stripping `Bearer `.
+- Missing Bearer prefix: resolves `false` with `fetch` never called.
+- Inactive token: second response `{ active: false }` → `false`; a response without `active` also yields `false`.
+- HTTP errors on discovery/introspection: thrown `Error` messages as documented above.
 
 Run package tests: `yarn test` in `packages/oidc`.
 
@@ -261,7 +242,7 @@ Workflow-level authorization behavior in process is owned by the **runtime** (ou
 
 | Mistake | Consequence |
 |---------|-------------|
-| Raw JWT without `Bearer ` prefix | Introspection gets `token: null`; usually denied |
+| Raw JWT without `Bearer ` prefix | Denied up front; no provider request is made |
 | Expecting env auto-wiring | Secrets/URLs must be set when constructing `OIDCAuthorization` |
 | Missing `introspection_endpoint` on IdP | Discovery JSON incomplete; runtime fails at fetch/parse |
 | Treating `false` as HTTP error | `false` means inactive token; errors are thrown separately |
@@ -277,6 +258,6 @@ Workflow-level authorization behavior in process is owned by the **runtime** (ou
 | `OIDCAuthorization` | class | `Authorization` subclass; `toManifest()` → oidc authorize module |
 | `OIDCAuthorizationContext` | type | Manifest/runtime context |
 | `OIDCAuthorizationManifest` | type | `AuthorizationManifest<OIDCAuthorizationContext>` |
-| default `oidc` | function | `@t4h.framework/oidc/authorize` — discovery + CC + introspection |
+| default `oidc` | function | `@t4h.framework/oidc/authorize` — discovery + RFC 7662 introspection |
 
 See [README.md](../../../README.md) in this package for the same behavior described for humans.

package/CHANGELOG.md

@@ -0,0 +1,22 @@
+# @t4h.framework/oidc
+
+## 0.5.0
+
+### Minor Changes
+
+- [#147](https://github.com/tech4humans-brasil/framework/pull/147) [`45182d4`](https://github.com/tech4humans-brasil/framework/commit/45182d4a27c86353747646aa9b70a39bc4c56610) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Makes the `oidc` authorize handler follow RFC 7662. The introspection request now posts `token` and `token_type_hint=access_token` as `application/x-www-form-urlencoded` (instead of a JSON body), sends `Accept: application/json`, and only allows the run when the response reports `active: true`. The incoming credential is parsed as an RFC 6750 bearer credential with a case-insensitive scheme, and a credential without a `Bearer ` prefix is denied up front — `token` is a required introspection parameter, so no request is made for it.
+
+  The client credentials grant is gone: the handler now authenticates the introspection call directly with `client_secret_basic` (RFC 6749 section 2.3.1), so a check costs one round-trip instead of two and your OAuth client only needs permission to call introspection. **Breaking:** `scope` and `resource` were removed from `OIDCAuthorizationContext` — they only fed the client credentials request. Drop them from your `OIDCAuthorization` context and make sure the client is allowed to introspect with `client_secret_basic`.
+
+## 0.4.0
+
+### Patch Changes
+
+- Update skills ([`6d7e7bc`](https://github.com/tech4humans-brasil/framework/commit/6d7e7bca0c780a9c53a0c9e5aa0a865c5af67959))
+
+## 0.3.0
+
+### Minor Changes
+
+- Implements oidc package ([#53](https://github.com/tech4humans-brasil/framework/pull/53))
+- Adds .ai/skills in packages ([#88](https://github.com/tech4humans-brasil/framework/pull/88))

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Tech for humans
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,6 +1,6 @@
 # @t4h.framework/oidc
 
-OpenID Connect–oriented authorization for the T4H Framework. It exposes a core `Authorization` manifest and a runtime handler that obtains an access token via the OAuth 2.0 client credentials grant, then validates an incoming credential through the **token introspection** endpoint from the issuer’s OpenID configuration.
+OpenID Connect–oriented authorization for the T4H Framework. It exposes a core `Authorization` manifest and a runtime handler that validates an incoming credential through the **token introspection** endpoint ([RFC 7662](https://www.rfc-editor.org/rfc/rfc7662)) from the issuer’s OpenID configuration.
 
 ## Peer dependency
 
@@ -23,12 +23,10 @@ You construct it with a context object; your app or hosting layer is responsible
 
 | Field | Required | Description |
 |-------|----------|-------------|
-| `discoveryUrl` | Yes | OpenID Provider configuration document URL (must return JSON with at least `token_endpoint` and `introspection_endpoint`). |
-| `clientId` | Yes | OAuth 2.0 client identifier used for the client credentials grant. |
-| `clientSecret` | Yes | OAuth 2.0 client secret used for the client credentials grant. |
+| `discoveryUrl` | Yes | OpenID Provider configuration document URL (must return JSON with at least `introspection_endpoint`). |
+| `clientId` | Yes | OAuth 2.0 client identifier used to authenticate the introspection call. |
+| `clientSecret` | Yes | OAuth 2.0 client secret used to authenticate the introspection call. |
 | `token` | Yes | Credential to verify. Must use a `Bearer ` prefix (see below). |
-| `scope` | No | Scopes requested on the client credentials token (array of strings, joined with spaces for the request). |
-| `resource` | No | If set, sent as the `resource` parameter on the client credentials request (RFC 8707 style resource indication). |
 
 ## Runtime handler (`oidc/authorize`)
 
@@ -40,16 +38,15 @@ The default export is an async function:
 
 Behavior:
 
-1. **Discovery** — `GET` `discoveryUrl` and read JSON with `token_endpoint` and `introspection_endpoint`.
-2. **Client credentials** — `POST` the token endpoint with `grant_type=client_credentials`, `client_id`, `client_secret`, and optional `scope` / `resource` (`application/x-www-form-urlencoded`).
-3. **Introspection** — `POST` the introspection endpoint with JSON body `{ "token": "<access token>" }`, where the value is taken from `token` after stripping the leading `Bearer ` prefix.
-4. **Authorization header** — The introspection call uses `Authorization: Bearer <access_token>` with the access token from step 2.
+1. **Discovery** — `GET` `discoveryUrl` and read JSON with `introspection_endpoint`.
+2. **Introspection** — `POST` the introspection endpoint following [RFC 7662](https://www.rfc-editor.org/rfc/rfc7662), with `token` and `token_type_hint=access_token` as `application/x-www-form-urlencoded`, where `token` is taken from the context `token` after stripping the `Bearer ` prefix (the scheme is matched case-insensitively).
+3. **Client authentication** — RFC 7662 requires the caller to authorize itself; the handler uses `client_secret_basic` (RFC 6749 section 2.3.1), sending `Authorization: Basic base64(clientId:clientSecret)` with both values form-urlencoded. Your client must be allowed to call introspection with this method.
 
 Result:
 
-- Returns `true` if the introspection response includes `"active": true`.
-- Returns `false` when the introspection response includes `"active": false`.
-- If the incoming credential does not start with `Bearer `, the handler sends `token: null` to introspection (final result then depends on the provider response, and is typically `false`).
+- Returns `true` only if the introspection response includes `"active": true`.
+- Returns `false` for any other response, including a missing `active` member.
+- If the incoming credential does not carry a `Bearer ` prefix, the handler returns `false` without contacting the provider — `token` is a required introspection parameter.
 
 There is no built-in mapping from environment variables; all configuration comes from the manifest context.
 
@@ -63,7 +60,6 @@ const authorization = new OIDCAuthorization({
   clientId: 'my-service',
   clientSecret: process.env.OIDC_CLIENT_SECRET!,
   token: 'Bearer <incoming-access-token-from-runtime>',
-  scope: ['introspection'],
 })
 ```
 

package/dist/models/OIDCAuthorization.d.ts

@@ -4,8 +4,6 @@ export type OIDCAuthorizationContext = {
     clientId: string;
     clientSecret: string;
     token: string;
-    scope?: string[];
-    resource?: string;
 };
 export type OIDCAuthorizationManifest = AuthorizationManifest<OIDCAuthorizationContext>;
 export declare class OIDCAuthorization extends Authorization<OIDCAuthorizationContext> {

package/dist/models/OIDCAuthorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OIDCAuthorization.d.ts","sourceRoot":"","sources":["../../src/models/OIDCAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAE/E,MAAM,MAAM,wBAAwB,GAAG;IACrC,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,yBAAyB,GACnC,qBAAqB,CAAC,wBAAwB,CAAC,CAAA;AAEjD,qBAAa,iBAAkB,SAAQ,aAAa,CAAC,wBAAwB,CAAC;IAChE,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,wBAAwB;IAIvD,UAAU,IAAI,yBAAyB;CAa/C"}
+{"version":3,"file":"OIDCAuthorization.d.ts","sourceRoot":"","sources":["../../src/models/OIDCAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAE/E,MAAM,MAAM,wBAAwB,GAAG;IACrC,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAED,MAAM,MAAM,yBAAyB,GACnC,qBAAqB,CAAC,wBAAwB,CAAC,CAAA;AAEjD,qBAAa,iBAAkB,SAAQ,aAAa,CAAC,wBAAwB,CAAC;IAChE,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,wBAAwB;IAIvD,UAAU,IAAI,yBAAyB;CAW/C"}

package/dist/models/OIDCAuthorization.js

@@ -11,8 +11,6 @@ export class OIDCAuthorization extends Authorization {
                 discoveryUrl: this.context.discoveryUrl,
                 clientId: this.context.clientId,
                 clientSecret: this.context.clientSecret,
-                scope: this.context.scope,
-                resource: this.context.resource,
                 token: this.context.token,
             },
             pathToModule: '@t4h.framework/oidc/authorize',

package/dist/models/OIDCAuthorization.js.map

@@ -1 +1 @@
-{"version":3,"file":"OIDCAuthorization.js","sourceRoot":"","sources":["../../src/models/OIDCAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAA8B,MAAM,qBAAqB,CAAA;AAc/E,MAAM,OAAO,iBAAkB,SAAQ,aAAuC;IAC/C;IAA7B,YAA6B,OAAiC;QAC5D,KAAK,EAAE,CAAA;QADoB,YAAO,GAAP,OAAO,CAA0B;IAE9D,CAAC;IAEM,UAAU;QACf,OAAO;YACL,OAAO,EAAE;gBACP,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;gBACvC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAC/B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;gBACvC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;gBACzB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAC/B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;aAC1B;YACD,YAAY,EAAE,+BAA+B;SAC9C,CAAA;IACH,CAAC;CACF"}
+{"version":3,"file":"OIDCAuthorization.js","sourceRoot":"","sources":["../../src/models/OIDCAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAA8B,MAAM,qBAAqB,CAAA;AAY/E,MAAM,OAAO,iBAAkB,SAAQ,aAAuC;IAC/C;IAA7B,YAA6B,OAAiC;QAC5D,KAAK,EAAE,CAAA;QADoB,YAAO,GAAP,OAAO,CAA0B;IAE9D,CAAC;IAEM,UAAU;QACf,OAAO;YACL,OAAO,EAAE;gBACP,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;gBACvC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAC/B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;gBACvC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;aAC1B;YACD,YAAY,EAAE,+BAA+B;SAC9C,CAAA;IACH,CAAC;CACF"}

package/dist/oidc-authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-authorize.d.ts","sourceRoot":"","sources":["../src/oidc-authorize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAA;AAezD,wBAA8B,IAAI,CAChC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,OAAO,CAAC,CAiElB"}
+{"version":3,"file":"oidc-authorize.d.ts","sourceRoot":"","sources":["../src/oidc-authorize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAA;AAmCzD,wBAA8B,IAAI,CAChC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,OAAO,CAAC,CA6ClB"}

package/dist/oidc-authorize.js

@@ -1,53 +1,41 @@
+const BEARER_CREDENTIAL = /^Bearer +(?<token>[^ ]+) *$/i;
 function getAccessToken(token) {
-    if (!token.startsWith('Bearer '))
-        return null;
-    const [, accessToken] = token.split('Bearer ');
-    return accessToken;
+    const match = BEARER_CREDENTIAL.exec(token);
+    return match?.groups?.token ?? null;
+}
+function encodeCredential(value) {
+    const [, encoded] = new URLSearchParams({ value }).toString().split('=');
+    return encoded;
 }
 export default async function oidc(context) {
+    const accessToken = getAccessToken(context.token);
+    if (!accessToken)
+        return false;
     const discoveryResponse = await fetch(context.discoveryUrl, {
         method: 'GET',
+        headers: {
+            Accept: 'application/json',
+        },
     });
     if (!discoveryResponse.ok)
         throw new Error(`Discovery request failed: ${discoveryResponse.status} ${discoveryResponse.statusText}`);
     const discovery = (await discoveryResponse.json());
-    const scope = Array.isArray(context.scope)
-        ? context.scope.join(' ')
-        : context.scope;
-    const body = {
-        grant_type: 'client_credentials',
-        client_id: context.clientId,
-        client_secret: context.clientSecret,
-    };
-    if (scope)
-        body.scope = scope;
-    if (context.resource)
-        body.resource = context.resource;
-    const tokenResponse = await fetch(discovery.token_endpoint, {
-        body: new URLSearchParams(body),
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/x-www-form-urlencoded',
-        },
-    });
-    if (!tokenResponse.ok)
-        throw new Error(`Token request failed: ${tokenResponse.status} ${tokenResponse.statusText}`);
-    const { access_token } = (await tokenResponse.json());
+    const credentials = Buffer.from(`${encodeCredential(context.clientId)}:${encodeCredential(context.clientSecret)}`).toString('base64');
     const introspectionResponse = await fetch(discovery.introspection_endpoint, {
-        body: JSON.stringify({
-            token: getAccessToken(context.token),
+        body: new URLSearchParams({
+            token: accessToken,
+            token_type_hint: 'access_token',
         }),
         method: 'POST',
         headers: {
-            'Content-Type': 'application/json',
-            Authorization: `Bearer ${access_token}`,
+            'Content-Type': 'application/x-www-form-urlencoded',
+            Accept: 'application/json',
+            Authorization: `Basic ${credentials}`,
         },
     });
     if (!introspectionResponse.ok)
         throw new Error(`Introspection request failed: ${introspectionResponse.status} ${introspectionResponse.statusText}`);
     const introspection = (await introspectionResponse.json());
-    if (!introspection.active)
-        return false;
-    return true;
+    return introspection.active === true;
 }
 //# sourceMappingURL=oidc-authorize.js.map

package/dist/oidc-authorize.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-authorize.js","sourceRoot":"","sources":["../src/oidc-authorize.ts"],"names":[],"mappings":"AAOA,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAA;IAE7C,MAAM,CAAC,EAAE,WAAW,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAE9C,OAAO,WAAW,CAAA;AACpB,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,IAAI,CAChC,OAAiC;IAEjC,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE;QAC1D,MAAM,EAAE,KAAK;KACd,CAAC,CAAA;IAEF,IAAI,CAAC,iBAAiB,CAAC,EAAE;QACvB,MAAM,IAAI,KAAK,CACb,6BAA6B,iBAAiB,CAAC,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,CACxF,CAAA;IAEH,MAAM,SAAS,GAAG,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,CAAwB,CAAA;IAEzE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;QACxC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;QACzB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAA;IAEjB,MAAM,IAAI,GAA2B;QACnC,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;KACpC,CAAA;IAED,IAAI,KAAK;QAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IAC7B,IAAI,OAAO,CAAC,QAAQ;QAAE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;IAEtD,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,cAAc,EAAE;QAC1D,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC;QAC/B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;SACpD;KACF,CAAC,CAAA;IAEF,IAAI,CAAC,aAAa,CAAC,EAAE;QACnB,MAAM,IAAI,KAAK,CACb,yBAAyB,aAAa,CAAC,MAAM,IAAI,aAAa,CAAC,UAAU,EAAE,CAC5E,CAAA;IAEH,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAEnD,CAAA;IAED,MAAM,qBAAqB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,sBAAsB,EAAE;QAC1E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC;SACrC,CAAC;QACF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,YAAY,EAAE;SACxC;KACF,CAAC,CAAA;IAEF,IAAI,CAAC,qBAAqB,CAAC,EAAE;QAC3B,MAAM,IAAI,KAAK,CACb,iCAAiC,qBAAqB,CAAC,MAAM,IAAI,qBAAqB,CAAC,UAAU,EAAE,CACpG,CAAA;IAEH,MAAM,aAAa,GAAG,CAAC,MAAM,qBAAqB,CAAC,IAAI,EAAE,CAExD,CAAA;IAED,IAAI,CAAC,aAAa,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAEvC,OAAO,IAAI,CAAA;AACb,CAAC"}
+{"version":3,"file":"oidc-authorize.js","sourceRoot":"","sources":["../src/oidc-authorize.ts"],"names":[],"mappings":"AAqBA,MAAM,iBAAiB,GAAG,8BAA8B,CAAA;AAExD,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAE3C,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,IAAI,CAAA;AACrC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAExE,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,IAAI,CAChC,OAAiC;IAEjC,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAEjD,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAA;IAE9B,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE;QAC1D,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;SAC3B;KACF,CAAC,CAAA;IAEF,IAAI,CAAC,iBAAiB,CAAC,EAAE;QACvB,MAAM,IAAI,KAAK,CACb,6BAA6B,iBAAiB,CAAC,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,CACxF,CAAA;IAEH,MAAM,SAAS,GAAG,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,CAAwB,CAAA;IAEzE,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAC7B,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAClF,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAEpB,MAAM,qBAAqB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,sBAAsB,EAAE;QAC1E,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,KAAK,EAAE,WAAW;YAClB,eAAe,EAAE,cAAc;SAChC,CAAC;QACF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,SAAS,WAAW,EAAE;SACtC;KACF,CAAC,CAAA;IAEF,IAAI,CAAC,qBAAqB,CAAC,EAAE;QAC3B,MAAM,IAAI,KAAK,CACb,iCAAiC,qBAAqB,CAAC,MAAM,IAAI,qBAAqB,CAAC,UAAU,EAAE,CACpG,CAAA;IAEH,MAAM,aAAa,GACjB,CAAC,MAAM,qBAAqB,CAAC,IAAI,EAAE,CAA0B,CAAA;IAE/D,OAAO,aAAa,CAAC,MAAM,KAAK,IAAI,CAAA;AACtC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@t4h.framework/oidc",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "OIDC module for the T4H Framework authorization",
   "homepage": "https://github.com/tech4humans-brasil/framework/tree/main/packages/oidc",
   "bugs": "https://github.com/tech4humans-brasil/framework/issues",
@@ -37,12 +37,12 @@
     "test:watch": "vitest"
   },
   "devDependencies": {
-    "@t4h.framework/core": "^0.8.0",
+    "@t4h.framework/core": "^0.9.1",
     "typescript": "^5.9.3",
     "vitest": "^4.0.18"
   },
   "peerDependencies": {
-    "@t4h.framework/core": "^0.8.0"
+    "@t4h.framework/core": "^0.9.1"
   },
   "packageManager": "yarn@4.12.0",
   "engines": {

package/dist/helpers/client-credentials.d.ts

@@ -1,3 +0,0 @@
-import type { OIDCAuthorizationOptions } from '../oidc.js';
-export declare function clientCredentials(options: OIDCAuthorizationOptions): Promise<boolean>;
-//# sourceMappingURL=client-credentials.d.ts.map

package/dist/helpers/client-credentials.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"client-credentials.d.ts","sourceRoot":"","sources":["../../src/helpers/client-credentials.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAE1D,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,oBA0BxE"}

package/dist/helpers/client-credentials.js

@@ -1,18 +0,0 @@
-import * as client from 'openid-client';
-export async function clientCredentials(options) {
-    const discovery = await client.discovery(new URL(options.url), options.clientId, options.clientSecret);
-    const scope = Array.isArray(options.scope)
-        ? options.scope.join(' ')
-        : options.scope;
-    const params = new URLSearchParams();
-    if (scope)
-        params.set('scope', scope);
-    if (options.resource)
-        params.set('resource', options.resource);
-    const { access_token } = await client.clientCredentialsGrant(discovery, params);
-    const token = await client.tokenIntrospection(discovery, access_token);
-    if (!token.active)
-        return false;
-    return true;
-}
-//# sourceMappingURL=client-credentials.js.map

package/dist/helpers/client-credentials.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"client-credentials.js","sourceRoot":"","sources":["../../src/helpers/client-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAIvC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAiC;IACvE,MAAM,SAAS,GAAyB,MAAM,MAAM,CAAC,SAAS,CAC5D,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EACpB,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,YAAY,CACrB,CAAA;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;QACxC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;QACzB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAA;IAEjB,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;IAEpC,IAAI,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACrC,IAAI,OAAO,CAAC,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;IAE9D,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAC1D,SAAS,EACT,MAAM,CACP,CAAA;IAED,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;IAEtE,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAE/B,OAAO,IAAI,CAAA;AACb,CAAC"}