@t4h.framework/oidc 0.6.10 → 0.6.12

package/.ai/skills/framework-oidc/SKILL.md

@@ -1,263 +1,88 @@
 ---
 name: framework-oidc
 description: >-
-  Wire OpenID Connect authorization in T4H Framework apps and workflows using
-  @t4h.framework/oidc: OIDCAuthorization manifest, OIDCAuthorizationContext,
-  RFC 7662 bearer token introspection with client_secret_basic, and
-  discoveryUrl. Use when securing App/Workflow with OIDC, token
-  validation, OpenID Provider discovery, introspection_endpoint, attaching
-  authorization to manifests, or testing @t4h.framework/oidc/authorize.
+  Protects a T4H Framework App or Workflow with OpenID Connect using
+  @t4h.framework/oidc: `OIDCAuthorization` with `discoveryUrl`, `clientId`,
+  `clientSecret` and a `token` placeholder such as
+  '<<headers.authorization>>', checked by RFC 7662 token introspection with
+  client_secret_basic. Use when an app or workflow must run only for callers
+  with an active access token from an OpenID Provider (Keycloak, Auth0,
+  Zitadel), when setting the `authorization` option, or when testing
+  `@t4h.framework/oidc/authorize`.
 ---
 
 # @t4h.framework/oidc
 
-OpenID Connect–oriented **authorization** for the T4H Framework. This package does **not** define Activities or Claims; it extends core’s `Authorization` and supplies a runtime handler that validates an incoming credential via **token introspection** (**RFC 7662**), authenticating that call with **`client_secret_basic`**.
-
-Package path: `framework/packages/oidc`. Peer dependency: `@t4h.framework/core` (same major line). Node `>=22`.
-
-For workflow Activities, Claims, and `History.reconciler`, use the **framework-core** skill. OIDC only gates access at the App/Workflow authorization layer.
-
----
-
-## Imports
-
-| Entry | Import | Purpose |
-|--------|--------|---------|
-| `@t4h.framework/oidc` | `OIDCAuthorization`, `OIDCAuthorizationContext`, `OIDCAuthorizationManifest` | Author-time manifest |
-| `@t4h.framework/oidc/authorize` | default `oidc` handler | Runtime/tests only — `(context) => Promise<boolean>` |
-
-```typescript
-import { OIDCAuthorization } from '@t4h.framework/oidc'
-import type { OIDCAuthorizationContext } from '@t4h.framework/oidc'
-
-// Direct handler import (unit tests, custom runtime wiring):
-import oidc from '@t4h.framework/oidc/authorize'
-```
-
----
-
-## Where it fits (core `Authorization`)
-
-Core exposes an abstract `Authorization` with `toManifest(): AuthorizationManifest`:
-
-```typescript
-type AuthorizationManifest<TContext extends object = any> = {
-  context?: TContext
-  pathToModule: string
-}
-```
-
-Attach `OIDCAuthorization` on **`App`** or **`Workflow`** options; `toManifest()` embeds `authorization` in the published manifest. The deployed runtime resolves dynamic fields (especially `token`), then loads `@t4h.framework/oidc/authorize` with the manifest `context`.
-
-```typescript
-import { App } from '@t4h.framework/core'
-import { OIDCAuthorization } from '@t4h.framework/oidc'
-
-export default new App({
-  id: 'my-app',
-  authorization: new OIDCAuthorization({
-    discoveryUrl:
-      'https://auth.example.com/.well-known/openid-configuration',
-    clientId: 'my-service',
-    clientSecret: process.env.OIDC_CLIENT_SECRET!,
-    token: 'Bearer <incoming-access-token-from-runtime>',
-  }),
-  workflows: [/* ... */],
-})
-```
-
-Per-workflow override:
-
-```typescript
-import { Workflow } from '@t4h.framework/core'
-import { OIDCAuthorization } from '@t4h.framework/oidc'
-
-const secured = new Workflow(
-  {
-    id: 'orders/v1',
-    authorization: new OIDCAuthorization({ /* same context shape */ }),
-  },
-  async input => ({ ok: true }),
-)
-```
-
-**App-level vs workflow-level:** set on whichever manifest should enforce OIDC. Workflow `authorization` in `toManifest()` is `authorization?.toManifest() ?? null`; App forwards `authorization?.toManifest()` at app scope.
-
----
-
-## `OIDCAuthorization`
-
-Subclass of `Authorization<OIDCAuthorizationContext>`. Constructor stores context; `toManifest()` always sets:
-
-- `pathToModule: '@t4h.framework/oidc/authorize'`
-- `context`: full context object (`discoveryUrl`, `clientId`, `clientSecret`, `token`)
-
-```typescript
-new OIDCAuthorization({
-  discoveryUrl: 'https://auth.example.com/.well-known/openid-configuration',
-  clientId: 'svc',
-  clientSecret: 'secret',
-  token: 'Bearer t',
-})
-```
-
-There is **no** built-in mapping from environment variables — supply `clientSecret`, `discoveryUrl`, etc. from your app/hosting layer when constructing the instance.
-
-### Runtime token placeholder
-
-`token` is authored as a manifest placeholder the runtime replaces:
-
-```typescript
-token: '<<headers.authorization>>',
-```
-
-Author with whatever placeholder or value your deployment pipeline documents; the handler always receives the resolved string at runtime.
-
----
-
-## `OIDCAuthorizationContext`
-
-| Field | Required | Description |
-|-------|----------|-------------|
-| `discoveryUrl` | Yes | OpenID Provider configuration document URL (JSON with `introspection_endpoint`). |
-| `clientId` | Yes | OAuth 2.0 client id used as the Basic username on introspection. |
-| `clientSecret` | Yes | OAuth 2.0 client secret used as the Basic password on introspection. |
-| `token` | Yes | Credential to verify. Must use a `Bearer ` prefix for the token value to be sent to introspection (see below). |
-
-Types exported: `OIDCAuthorizationContext`, `OIDCAuthorizationManifest` (`AuthorizationManifest<OIDCAuthorizationContext>`).
-
----
-
-## Runtime handler (`@t4h.framework/oidc/authorize`)
-
-Default export: async function `(context: OIDCAuthorizationContext) => Promise<boolean>`.
-
-### Flow
-
-```mermaid
-sequenceDiagram
-  participant R as Runtime handler
-  participant D as discoveryUrl
-  participant I as introspection_endpoint
-
-  R->>D: GET discovery JSON
-  R->>I: POST form { token, token_type_hint } + Basic client credentials
-  I-->>R: { active }
-  R-->>R: true if active else false
-```
-
-1. **Discovery** — `GET` `discoveryUrl`; parse JSON as `{ introspection_endpoint }`. Non-OK HTTP → throw `Discovery request failed: <status> <statusText>`.
-2. **Introspection** — `POST` `introspection_endpoint` per **RFC 7662** with:
-   - `Content-Type: application/x-www-form-urlencoded`
-   - `Accept: application/json`
-   - `Authorization: Basic base64(<form-urlencoded clientId>:<form-urlencoded clientSecret>)` (`client_secret_basic`, RFC 6749 section 2.3.1)
-   - body `URLSearchParams` with `token=<stripped incoming token>` and `token_type_hint=access_token`
-   Non-OK HTTP → throw `Introspection request failed: ...`.
-3. **Result** — parse the RFC 7662 response (`active` plus optional `scope`, `client_id`, `exp`, `sub`, `aud`, …):
-   - `active: true` → return `true`
-   - anything else, including a missing `active` → return `false`
-
-Network failures from `fetch` propagate as rejected promises (not converted to `false`).
-
-### Bearer prefix rules
-
-Incoming `token` is parsed as an RFC 6750 bearer credential (scheme matched case-insensitively):
-
-- `Bearer <token>` → introspection sends the token value (e.g. `Bearer abc.def` → `token=abc.def`).
-- Anything else → the handler returns `false` immediately, with **no** discovery, token or introspection request (`token` is a required RFC 7662 parameter).
-
-Always author/runtime-resolve credentials as `Bearer <access-token>` when you expect introspection of the caller’s token.
-
----
-
-## Authoring checklist
-
-1. Add `@t4h.framework/oidc` dependency alongside `@t4h.framework/core`.
-2. Construct `new OIDCAuthorization({ discoveryUrl, clientId, clientSecret, token, ... })`.
-3. Attach to `App` and/or `Workflow` `authorization` option.
-4. Ensure IdP discovery document exposes `introspection_endpoint`.
-5. Register a confidential OAuth client allowed to call **introspection** with **`client_secret_basic`**.
-6. Pass incoming caller token with `Bearer ` prefix (or use a runtime placeholder like `<<headers.authorization>>`).
-
-Do **not** look for OIDC Activities or Claim classes in this package — they do not exist here.
-
----
-
-## Testing
-
-Package tests use **Vitest** with `vi.stubGlobal('fetch', ...)`.
-
-### `OIDCAuthorization.toManifest()`
-
-Assert manifest shape:
-
-```typescript
-expect(authorization.toManifest()).toEqual({
-  pathToModule: '@t4h.framework/oidc/authorize',
-  context: {
-    discoveryUrl: '...',
-    clientId: 'svc',
-    clientSecret: 'secret',
-    token: 'Bearer t',
-  },
-})
-```
-
-### Handler (`import oidc from '@t4h.framework/oidc/authorize'`)
-
-Mock two `fetch` calls in order: discovery → introspection.
-
-```typescript
-const baseContext = {
-  discoveryUrl: 'https://auth.example.com/.well-known/openid-configuration',
-  clientId: 'client-id',
-  clientSecret: 'client-secret',
-  token: 'Bearer incoming-token',
-}
-
-// Happy path: true
-fetchMock
-  .mockResolvedValueOnce(jsonResponse({
-    introspection_endpoint: 'https://auth.example.com/oauth/introspect',
-  }))
-  .mockResolvedValueOnce(jsonResponse({ active: true }))
-
-await expect(oidc(baseContext)).resolves.toBe(true)
-```
-
-Verify wire format from tests:
-
-- Introspection: `Authorization: Basic <base64 client-id:client-secret>`, form body `token=incoming-token&token_type_hint=access_token` after stripping `Bearer `.
-- Missing Bearer prefix: resolves `false` with `fetch` never called.
-- Inactive token: second response `{ active: false }` → `false`; a response without `active` also yields `false`.
-- HTTP errors on discovery/introspection: thrown `Error` messages as documented above.
-
-Run package tests: `yarn test` in `packages/oidc`.
-
-Workflow-level authorization behavior in process is owned by the **runtime** (outside this package); this package only defines manifest + handler contract.
-
----
-
-## Common mistakes
-
-| Mistake | Consequence |
-|---------|-------------|
-| Raw JWT without `Bearer ` prefix | Denied up front; no provider request is made |
-| Expecting env auto-wiring | Secrets/URLs must be set when constructing `OIDCAuthorization` |
-| Missing `introspection_endpoint` on IdP | Discovery JSON incomplete; runtime fails at fetch/parse |
-| Treating `false` as HTTP error | `false` means inactive token; errors are thrown separately |
-| Adding OIDC as a Claim provider | Wrong abstraction — use `Authorization` on App/Workflow |
-| Importing handler from main entry | Use `@t4h.framework/oidc/authorize` (default export) |
-
----
-
-## API summary
-
-| Symbol | Kind | Role |
-|--------|------|------|
-| `OIDCAuthorization` | class | `Authorization` subclass; `toManifest()` → oidc authorize module |
-| `OIDCAuthorizationContext` | type | Manifest/runtime context |
-| `OIDCAuthorizationManifest` | type | `AuthorizationManifest<OIDCAuthorizationContext>` |
-| default `oidc` | function | `@t4h.framework/oidc/authorize` — discovery + RFC 7662 introspection |
-
-See [README.md](../../../README.md) in this package for the same behavior described for humans.
+`OIDCAuthorization` gates the incoming call of an `App` or a `Workflow`. Before
+the run starts, the check reads the discovery document, sends the caller's
+token to the provider's `introspection_endpoint`, and allows the run only when
+the response has `"active": true`.
+
+This package does not authenticate outgoing calls. To call an API with an
+OAuth2 token, use the **framework-http** skill. To check a JWT locally against
+the provider's keys, with no introspection call, use the **framework-jwks**
+skill.
+
+## Protect an app or a workflow
+
+1. Declare the values in the `EnvDesign` in `src/constants/environments.ts`.
+   Use `type: String` for the secret: `clientSecret` is a `string`, not a
+   `Secret`.
+
+   ```typescript
+   export const environments = EnvDesign({
+     OIDC_DISCOVERY_URL: { type: String },
+     OIDC_CLIENT: { type: String },
+     OIDC_SECRET: { type: String },
+   })
+   ```
+
+2. Set `authorization` on the `App` (all its workflows) or on one `Workflow`:
+
+   ```typescript
+   import { OIDCAuthorization } from '@t4h.framework/oidc'
+
+   const authorization = new OIDCAuthorization({
+     discoveryUrl: environments.OIDC_DISCOVERY_URL,
+     clientId: environments.OIDC_CLIENT,
+     clientSecret: environments.OIDC_SECRET,
+     token: '<<headers.authorization>>',
+   })
+
+   export default new App({
+     id: 'my-app',
+     workflows: [cashback],
+     authorization,
+   })
+   ```
+
+## Traps
+
+- `token` is a placeholder, not a value. The runtime replaces
+  `<<headers.authorization>>` with the `Authorization` header of the incoming
+  request before the check runs.
+- The token must be `Bearer <token>` (any letter case, no spaces in the
+  token). Any other form is denied without a call to the provider.
+- `@t4h.framework/core/no-literal-secret-in-authorization` rejects a literal
+  `clientSecret`. The package reads no env by itself: pass each value from the
+  `EnvDesign`.
+- `discoveryUrl` is the well-known document
+  (`.../.well-known/openid-configuration`), not the introspection endpoint.
+- The provider must let the client call introspection with
+  `client_secret_basic`.
+- `false` means "denied". An HTTP error from the provider, a missing
+  `introspection_endpoint` or a network failure throws instead.
+
+## Test
+
+- `OIDCAuthorization`: compare `toManifest()` with
+  `{ pathToModule: '@t4h.framework/oidc/authorize', context: { ... } }`.
+- The check: `import oidc from '@t4h.framework/oidc/authorize'`, stub the
+  global `fetch` with `vi.stubGlobal`, and resolve it two times in order:
+  the discovery document, then the introspection response.
+
+## Reference
+
+- Guide, errors and testing: https://tech4humans-brasil.github.io/framework/oidc/
+- Types: `node_modules/@t4h.framework/oidc/dist/oidc.d.ts` and
+  `node_modules/@t4h.framework/oidc/dist/oidc-authorize.d.ts`

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # @t4h.framework/oidc
 
+## 0.6.12
+
+### Patch Changes
+
+- [#257](https://github.com/tech4humans-brasil/framework/pull/257) [`586bfb4`](https://github.com/tech4humans-brasil/framework/commit/586bfb4663f4a478527ee0c8db360603f034d615) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - The oidc docs now describe the errors of the check and how to test it, and no longer say that it uses the client credentials grant. The README is short and the skill keeps only the traps and links to the site.
+
+## 0.6.11
+
+### Patch Changes
+
+- [#241](https://github.com/tech4humans-brasil/framework/pull/241) [`f6b8454`](https://github.com/tech4humans-brasil/framework/commit/f6b845484d22e7c8e7240fe2e113f1cdea7c8ce3) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Adds seven rules to `@t4h.framework/core/eslint` and turns them on in `configs.recommended`:
+  - `no-io-in-workflow` reports `fetch` and calls to network, file, database and mail modules in a workflow and in the `constructor`, `toInput` and `toOutput` of an activity. It also reports `zlib` and `stream` calls there, because they work on the content in memory on each replay.
+  - `no-binary-subclass` reports a class that extends `Binary`.
+  - `no-framework-activity-in-app` reports `new` and `extends` on an activity of a framework package other than the core.
+  - `no-testing-import-in-source` reports an import of a `@t4h.framework/<package>/testing` entry out of a test file.
+  - `require-workflow-id` reports a `Workflow` with no `id`.
+  - `no-secret-to-string` reports a `Secret` that becomes a string.
+  - `no-literal-secret-in-authorization` reports a string literal in the `secret` or `clientSecret` field of an `Authorization`.
+
+  The package skills now name these rules in place of the text that the rules enforce. The docs and skills give each `Workflow` an `id`, read the HMAC secret from `EnvDesign`, and do not document a custom HTTP activity.
+
+- [#243](https://github.com/tech4humans-brasil/framework/pull/243) [`0ffd663`](https://github.com/tech4humans-brasil/framework/commit/0ffd663ce8369edd7b54206cb3216568ad1de471) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - The README examples read each value from `environments`, an `EnvDesign` in `src/constants/environments.ts`, and pass each credential as a `Secret`. They no longer use `process.env`, the raw `env` from the core or a literal in a `Secret` field. The jwks README describes the real context fields (`signature`, `rawPayload`) and says that a token that `jwt.verify` rejects throws.
+
+- [#240](https://github.com/tech4humans-brasil/framework/pull/240) [`0606115`](https://github.com/tech4humans-brasil/framework/commit/0606115e2e0baa994e9f0ed3559ee54ecac88e44) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - The skills do not repeat a rule that a lint rule, `tsc` or a runtime error already enforces. Each such rule is now one line that names the gate. The examples that broke a gate (`process.env`, `as any`, an inline secret, an `EnvDesign` in a workflow file, `ref.output` before `wait()`) are correct now.
+
+- [#228](https://github.com/tech4humans-brasil/framework/pull/228) [`d29e1ab`](https://github.com/tech4humans-brasil/framework/commit/d29e1ab29a039b13c3e4b075472bd615566ae75e) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Uses exact types and `unknown` in place of `any`, and checks external data with guards.
+  - harness: the fix-issues prompt lists each sensor as `- checkTypes: PASS`. Before, it printed `- 0: [object Object]`.
+  - hmac: an algorithm name such as `constructor` throws `Unsupported algorithm`.
+  - oidc: a discovery response with no `introspection_endpoint`, or a null introspection body, throws a clear error.
+  - `HttpRequestActivity.toOutput` takes `HttpRequestActivityOutput` in place of `any`.
+
 ## 0.6.10
 
 ## 0.6.9

package/README.md

@@ -1,66 +1,38 @@
 # @t4h.framework/oidc
 
-OpenID Connect–oriented authorization for the T4H Framework. It exposes a core `Authorization` manifest and a runtime handler that validates an incoming credential through the **token introspection** endpoint ([RFC 7662](https://www.rfc-editor.org/rfc/rfc7662)) from the issuer’s OpenID configuration.
+OpenID Connect authorization for T4H Framework apps and workflows. It lets a
+run start only when the OpenID Provider reports the caller's token as active,
+through token introspection ([RFC 7662](https://www.rfc-editor.org/rfc/rfc7662)).
 
-## Peer dependency
+## Install
 
-Requires `@t4h.framework/core` (same major line as this package).
-
-## Exports
-
-| Entry | Purpose |
-|--------|---------|
-| `@t4h.framework/oidc` | `OIDCAuthorization`, `OIDCAuthorizationContext`, and related types |
-| `@t4h.framework/oidc/authorize` | Default async handler invoked by the runtime with the manifest context |
-
-## `OIDCAuthorization`
-
-Subclass of [`Authorization`](https://github.com/tech4humans-brasil/framework/tree/main/packages/core) from core. `toManifest()` points the runtime at `@t4h.framework/oidc/authorize` and passes an `OIDCAuthorizationContext`.
-
-You construct it with a context object; your app or hosting layer is responsible for supplying the credential string (`token`) when the workflow runs.
-
-## Context: `OIDCAuthorizationContext`
-
-| Field | Required | Description |
-|-------|----------|-------------|
-| `discoveryUrl` | Yes | OpenID Provider configuration document URL (must return JSON with at least `introspection_endpoint`). |
-| `clientId` | Yes | OAuth 2.0 client identifier used to authenticate the introspection call. |
-| `clientSecret` | Yes | OAuth 2.0 client secret used to authenticate the introspection call. |
-| `token` | Yes | Credential to verify. Must use a `Bearer ` prefix (see below). |
-
-## Runtime handler (`oidc/authorize`)
-
-The default export is an async function:
-
-```ts
-(context: OIDCAuthorizationContext) => Promise<boolean>
+```bash
+npm install @t4h.framework/oidc
 ```
 
-Behavior:
-
-1. **Discovery** — `GET` `discoveryUrl` and read JSON with `introspection_endpoint`.
-2. **Introspection** — `POST` the introspection endpoint following [RFC 7662](https://www.rfc-editor.org/rfc/rfc7662), with `token` and `token_type_hint=access_token` as `application/x-www-form-urlencoded`, where `token` is taken from the context `token` after stripping the `Bearer ` prefix (the scheme is matched case-insensitively).
-3. **Client authentication** — RFC 7662 requires the caller to authorize itself; the handler uses `client_secret_basic` (RFC 6749 section 2.3.1), sending `Authorization: Basic base64(clientId:clientSecret)` with both values form-urlencoded. Your client must be allowed to call introspection with this method.
-
-Result:
+Peer dependency: `@t4h.framework/core`.
 
-- Returns `true` only if the introspection response includes `"active": true`.
-- Returns `false` for any other response, including a missing `active` member.
-- If the incoming credential does not carry a `Bearer ` prefix, the handler returns `false` without contacting the provider — `token` is a required introspection parameter.
-
-There is no built-in mapping from environment variables; all configuration comes from the manifest context.
-
-## Example
+## Usage
 
 ```typescript
+import { App } from '@t4h.framework/core'
 import { OIDCAuthorization } from '@t4h.framework/oidc'
 
-const authorization = new OIDCAuthorization({
-  discoveryUrl: 'https://auth.example.com/.well-known/openid-configuration',
-  clientId: 'my-service',
-  clientSecret: process.env.OIDC_CLIENT_SECRET!,
-  token: 'Bearer <incoming-access-token-from-runtime>',
+import { environments } from './constants/environments.js'
+
+export default new App({
+  id: 'my-app',
+  workflows: [cashback],
+  authorization: new OIDCAuthorization({
+    discoveryUrl: environments.OIDC_DISCOVERY_URL,
+    clientId: environments.OIDC_CLIENT,
+    clientSecret: environments.OIDC_SECRET,
+    token: '<<headers.authorization>>',
+  }),
 })
 ```
 
-Wire `authorization` on an `App` or `Workflow` per the core package; the deployed runtime fills `token` (and any other fields you resolve dynamically) and invokes `@t4h.framework/oidc/authorize`.
+## Documentation
+
+Configuration, the validation steps, errors and testing:
+https://tech4humans-brasil.github.io/framework/oidc/

package/dist/oidc-authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-authorize.d.ts","sourceRoot":"","sources":["../src/oidc-authorize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAA;AAmCzD,wBAA8B,IAAI,CAChC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,OAAO,CAAC,CA6ClB"}
+{"version":3,"file":"oidc-authorize.d.ts","sourceRoot":"","sources":["../src/oidc-authorize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAA;AAyCzD,wBAA8B,IAAI,CAChC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,OAAO,CAAC,CA8ClB"}

package/dist/oidc-authorize.js

@@ -1,11 +1,28 @@
 const BEARER_CREDENTIAL = /^Bearer +(?<token>[^ ]+) *$/i;
+const CREDENTIAL_PREFIX = 'value=';
 function getAccessToken(token) {
     const match = BEARER_CREDENTIAL.exec(token);
     return match?.groups?.token ?? null;
 }
 function encodeCredential(value) {
-    const [, encoded] = new URLSearchParams({ value }).toString().split('=');
-    return encoded;
+    return new URLSearchParams({ value })
+        .toString()
+        .slice(CREDENTIAL_PREFIX.length);
+}
+function getIntrospectionEndpoint(discovery) {
+    if (typeof discovery === 'object' &&
+        discovery !== null &&
+        'introspection_endpoint' in discovery &&
+        typeof discovery.introspection_endpoint === 'string')
+        return discovery.introspection_endpoint;
+    throw new Error('Discovery response has no introspection_endpoint');
+}
+function isActive(introspection) {
+    if (introspection === null)
+        throw new Error('Introspection response body is null');
+    return (typeof introspection === 'object' &&
+        'active' in introspection &&
+        introspection.active === true);
 }
 export default async function oidc(context) {
     const accessToken = getAccessToken(context.token);
@@ -18,10 +35,11 @@ export default async function oidc(context) {
         },
     });
     if (!discoveryResponse.ok)
-        throw new Error(`Discovery request failed: ${discoveryResponse.status} ${discoveryResponse.statusText}`);
-    const discovery = (await discoveryResponse.json());
+        throw new Error(`Discovery request failed: ${String(discoveryResponse.status)} ${discoveryResponse.statusText}`);
+    const discovery = await discoveryResponse.json();
+    const introspectionEndpoint = getIntrospectionEndpoint(discovery);
     const credentials = Buffer.from(`${encodeCredential(context.clientId)}:${encodeCredential(context.clientSecret)}`).toString('base64');
-    const introspectionResponse = await fetch(discovery.introspection_endpoint, {
+    const introspectionResponse = await fetch(introspectionEndpoint, {
         body: new URLSearchParams({
             token: accessToken,
             token_type_hint: 'access_token',
@@ -34,8 +52,8 @@ export default async function oidc(context) {
         },
     });
     if (!introspectionResponse.ok)
-        throw new Error(`Introspection request failed: ${introspectionResponse.status} ${introspectionResponse.statusText}`);
-    const introspection = (await introspectionResponse.json());
-    return introspection.active === true;
+        throw new Error(`Introspection request failed: ${String(introspectionResponse.status)} ${introspectionResponse.statusText}`);
+    const introspection = await introspectionResponse.json();
+    return isActive(introspection);
 }
 //# sourceMappingURL=oidc-authorize.js.map

package/dist/oidc-authorize.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-authorize.js","sourceRoot":"","sources":["../src/oidc-authorize.ts"],"names":[],"mappings":"AAqBA,MAAM,iBAAiB,GAAG,8BAA8B,CAAA;AAExD,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAE3C,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,IAAI,CAAA;AACrC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAExE,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,IAAI,CAChC,OAAiC;IAEjC,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAEjD,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAA;IAE9B,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE;QAC1D,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;SAC3B;KACF,CAAC,CAAA;IAEF,IAAI,CAAC,iBAAiB,CAAC,EAAE;QACvB,MAAM,IAAI,KAAK,CACb,6BAA6B,iBAAiB,CAAC,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,CACxF,CAAA;IAEH,MAAM,SAAS,GAAG,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,CAAwB,CAAA;IAEzE,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAC7B,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAClF,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAEpB,MAAM,qBAAqB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,sBAAsB,EAAE;QAC1E,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,KAAK,EAAE,WAAW;YAClB,eAAe,EAAE,cAAc;SAChC,CAAC;QACF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,SAAS,WAAW,EAAE;SACtC;KACF,CAAC,CAAA;IAEF,IAAI,CAAC,qBAAqB,CAAC,EAAE;QAC3B,MAAM,IAAI,KAAK,CACb,iCAAiC,qBAAqB,CAAC,MAAM,IAAI,qBAAqB,CAAC,UAAU,EAAE,CACpG,CAAA;IAEH,MAAM,aAAa,GACjB,CAAC,MAAM,qBAAqB,CAAC,IAAI,EAAE,CAA0B,CAAA;IAE/D,OAAO,aAAa,CAAC,MAAM,KAAK,IAAI,CAAA;AACtC,CAAC"}
+{"version":3,"file":"oidc-authorize.js","sourceRoot":"","sources":["../src/oidc-authorize.ts"],"names":[],"mappings":"AAEA,MAAM,iBAAiB,GAAG,8BAA8B,CAAA;AAExD,MAAM,iBAAiB,GAAG,QAAQ,CAAA;AAElC,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAE3C,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,IAAI,CAAA;AACrC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC;SAClC,QAAQ,EAAE;SACV,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;AACpC,CAAC;AAED,SAAS,wBAAwB,CAAC,SAAkB;IAClD,IACE,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,KAAK,IAAI;QAClB,wBAAwB,IAAI,SAAS;QACrC,OAAO,SAAS,CAAC,sBAAsB,KAAK,QAAQ;QAEpD,OAAO,SAAS,CAAC,sBAAsB,CAAA;IAEzC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;AACrE,CAAC;AAED,SAAS,QAAQ,CAAC,aAAsB;IACtC,IAAI,aAAa,KAAK,IAAI;QACxB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IAExD,OAAO,CACL,OAAO,aAAa,KAAK,QAAQ;QACjC,QAAQ,IAAI,aAAa;QACzB,aAAa,CAAC,MAAM,KAAK,IAAI,CAC9B,CAAA;AACH,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,IAAI,CAChC,OAAiC;IAEjC,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAEjD,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAA;IAE9B,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE;QAC1D,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;SAC3B;KACF,CAAC,CAAA;IAEF,IAAI,CAAC,iBAAiB,CAAC,EAAE;QACvB,MAAM,IAAI,KAAK,CACb,6BAA6B,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,iBAAiB,CAAC,UAAU,EAAE,CAChG,CAAA;IAEH,MAAM,SAAS,GAAY,MAAM,iBAAiB,CAAC,IAAI,EAAE,CAAA;IAEzD,MAAM,qBAAqB,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAA;IAEjE,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAC7B,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAClF,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAEpB,MAAM,qBAAqB,GAAG,MAAM,KAAK,CAAC,qBAAqB,EAAE;QAC/D,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,KAAK,EAAE,WAAW;YAClB,eAAe,EAAE,cAAc;SAChC,CAAC;QACF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,SAAS,WAAW,EAAE;SACtC;KACF,CAAC,CAAA;IAEF,IAAI,CAAC,qBAAqB,CAAC,EAAE;QAC3B,MAAM,IAAI,KAAK,CACb,iCAAiC,MAAM,CAAC,qBAAqB,CAAC,MAAM,CAAC,IAAI,qBAAqB,CAAC,UAAU,EAAE,CAC5G,CAAA;IAEH,MAAM,aAAa,GAAY,MAAM,qBAAqB,CAAC,IAAI,EAAE,CAAA;IAEjE,OAAO,QAAQ,CAAC,aAAa,CAAC,CAAA;AAChC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@t4h.framework/oidc",
-  "version": "0.6.10",
+  "version": "0.6.12",
   "description": "OIDC module for the T4H Framework authorization",
   "homepage": "https://github.com/tech4humans-brasil/framework/tree/main/packages/oidc",
   "bugs": "https://github.com/tech4humans-brasil/framework/issues",
@@ -32,12 +32,14 @@
   "scripts": {
     "build": "tsc --project tsconfig.build.json",
     "check-types": "tsc --noEmit",
+    "check-package": "publint --strict && attw --pack . --profile esm-only",
+    "lint": "eslint . --max-warnings 0",
     "prepublishOnly": "yarn build",
     "test": "vitest run",
     "test:watch": "vitest"
   },
   "devDependencies": {
-    "@t4h.framework/core": "^0.19.0",
+    "@t4h.framework/core": "^0.21.0",
     "typescript": "^5.9.3",
     "vitest": "^4.0.18"
   },