@undefineds.co/xpod 0.1.0-local.202602081751

package/dist/identity/oidc/AutoDetectOidcHandler.jsonld

@@ -0,0 +1,138 @@
+{
+  "@context": [
+    "https://linkedsoftwaredependencies.org/bundles/npm/@undefineds.co/xpod/^0.0.0/components/context.jsonld",
+    "https://linkedsoftwaredependencies.org/bundles/npm/@solid/community-server/^8.0.0/components/context.jsonld"
+  ],
+  "@id": "npmd:@undefineds.co/xpod",
+  "components": [
+    {
+      "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler",
+      "@type": "Class",
+      "requireElement": "AutoDetectOidcHandler",
+      "extends": [
+        "css:dist/server/HttpHandler.jsonld#HttpHandler"
+      ],
+      "comment": "Auto-detect OIDC Handler  自动检测运行模式： - 如果配置了 idpUrl -> SP 模式：禁用本地 OIDC，代理外部 IdP 的 JWKS - 如果没有配置 idpUrl -> 标准模式：所有 OIDC 请求透传（由 CSS 默认 Handler 处理）  使用方式：在 HTTP pipeline 中替换默认的 OidcHandler",
+      "parameters": [
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler_options_idpUrl",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "xsd:string",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          },
+          "comment": "外部 IdP 的基础 URL，如果提供则启用 SP 模式"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler_options_message",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "xsd:string",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          },
+          "comment": "禁用原因说明"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler_options_cacheMs",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "xsd:number",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          },
+          "comment": "JWKS 缓存时间 (ms)"
+        }
+      ],
+      "memberFields": [
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler__member_logger",
+          "memberFieldName": "logger"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler__member_idpUrl",
+          "memberFieldName": "idpUrl"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler__member_jwksUrl",
+          "memberFieldName": "jwksUrl"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler__member_message",
+          "memberFieldName": "message"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler__member_cacheMs",
+          "memberFieldName": "cacheMs"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler__member_jwksCache",
+          "memberFieldName": "jwksCache"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler__member_constructor",
+          "memberFieldName": "constructor"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler__member_canHandle",
+          "memberFieldName": "canHandle"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler__member_handle",
+          "memberFieldName": "handle"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler__member_fetchJwks",
+          "memberFieldName": "fetchJwks"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler__member_isOidcPath",
+          "memberFieldName": "isOidcPath"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler__member_isJwksPath",
+          "memberFieldName": "isJwksPath"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler__member_getPathname",
+          "memberFieldName": "getPathname"
+        }
+      ],
+      "constructorArguments": [
+        {
+          "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler_options__constructorArgument",
+          "fields": [
+            {
+              "keyRaw": "idpUrl",
+              "value": {
+                "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler_options_idpUrl"
+              }
+            },
+            {
+              "keyRaw": "message",
+              "value": {
+                "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler_options_message"
+              }
+            },
+            {
+              "keyRaw": "cacheMs",
+              "value": {
+                "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler_options_cacheMs"
+              }
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}

package/dist/identity/oidc/DisabledIdentityProviderHandler.d.ts

@@ -0,0 +1,51 @@
+import { HttpHandler, type HttpHandlerInput } from '@solid/community-server';
+export interface DisabledIdentityProviderHandlerOptions {
+    /** 禁用原因说明 */
+    message?: string;
+    /** 是否保留某些只读端点 */
+    allowReadOnly?: boolean;
+}
+/**
+ * Disabled Identity Provider Handler
+ *
+ * 用于 SP (Storage Provider) 模式，禁用本地账户管理功能。
+ *
+ * 行为:
+ * - 拒绝所有账户注册请求
+ * - 拒绝所有登录请求
+ * - 拒绝所有密码重置请求
+ * - 可选：保留某些只读端点（如账户信息查询）
+ *
+ * 这样用户必须通过外部 IdP 进行身份验证，SP 只负责存储。
+ */
+export declare class DisabledIdentityProviderHandler extends HttpHandler {
+    private readonly logger;
+    private readonly message;
+    private readonly allowReadOnly;
+    private readonly identityPaths;
+    private readonly readOnlyPaths;
+    constructor(options?: DisabledIdentityProviderHandlerOptions);
+    /**
+     * 处理账户管理请求
+     *
+     * 默认拒绝所有请求，返回 501 Not Implemented
+     */
+    canHandle({ request }: HttpHandlerInput): Promise<void>;
+    /**
+     * handle 方法理论上不会被执行，因为 canHandle 总是抛出异常
+     * 但为了完整性，保留此方法
+     */
+    handle({ response }: HttpHandlerInput): Promise<void>;
+    /**
+     * 检查是否是账户管理路径
+     */
+    private isIdentityPath;
+    /**
+     * 检查是否是只读路径
+     */
+    private isReadOnlyPath;
+    /**
+     * 从 URL 提取 pathname
+     */
+    private getPathname;
+}

package/dist/identity/oidc/DisabledIdentityProviderHandler.js

@@ -0,0 +1,104 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DisabledIdentityProviderHandler = void 0;
+const global_logger_factory_1 = require("global-logger-factory");
+const community_server_1 = require("@solid/community-server");
+/**
+ * Disabled Identity Provider Handler
+ *
+ * 用于 SP (Storage Provider) 模式，禁用本地账户管理功能。
+ *
+ * 行为:
+ * - 拒绝所有账户注册请求
+ * - 拒绝所有登录请求
+ * - 拒绝所有密码重置请求
+ * - 可选：保留某些只读端点（如账户信息查询）
+ *
+ * 这样用户必须通过外部 IdP 进行身份验证，SP 只负责存储。
+ */
+class DisabledIdentityProviderHandler extends community_server_1.HttpHandler {
+    constructor(options = {}) {
+        super();
+        this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
+        // 账户管理相关路径
+        this.identityPaths = [
+            '/idp/',
+            '/account/',
+            '/login',
+            '/logout',
+            '/register',
+            '/reset-password',
+            '/forgot-password',
+            '/.account/',
+        ];
+        // 只读路径（如果 allowReadOnly 为 true）
+        this.readOnlyPaths = [
+            '/account/info',
+            '/account/profile',
+        ];
+        this.message = options.message ?? 'Account management handled by external IdP';
+        this.allowReadOnly = options.allowReadOnly ?? false;
+        this.logger.info(`Initialized: ${this.message}`);
+    }
+    /**
+     * 处理账户管理请求
+     *
+     * 默认拒绝所有请求，返回 501 Not Implemented
+     */
+    async canHandle({ request }) {
+        const url = request.url ?? '';
+        const method = request.method ?? 'GET';
+        // 检查是否是账户管理路径
+        if (!this.isIdentityPath(url)) {
+            throw new community_server_1.NotImplementedHttpError('Not an identity management request');
+        }
+        // 如果是只读路径且允许只读
+        if (this.allowReadOnly && this.isReadOnlyPath(url) && method === 'GET') {
+            // 继续处理（抛出 NotImplemented，因为 SP 模式下不支持查询账户信息）
+            throw new community_server_1.NotImplementedHttpError(`${this.message}. Account queries not supported in SP mode.`);
+        }
+        // 拒绝所有账户管理请求
+        throw new community_server_1.NotImplementedHttpError(`${this.message}. Please use the external IdP for authentication.`);
+    }
+    /**
+     * handle 方法理论上不会被执行，因为 canHandle 总是抛出异常
+     * 但为了完整性，保留此方法
+     */
+    async handle({ response }) {
+        this.logger.warn('DisabledIdentityProviderHandler.handle() should not be called');
+        response.statusCode = 501;
+        response.setHeader('Content-Type', 'application/json');
+        response.end(JSON.stringify({
+            error: 'not_implemented',
+            message: this.message,
+            hint: 'This is a Storage Provider (SP). Please authenticate with the external IdP.'
+        }));
+    }
+    /**
+     * 检查是否是账户管理路径
+     */
+    isIdentityPath(url) {
+        const pathname = this.getPathname(url);
+        return this.identityPaths.some(path => pathname.startsWith(path));
+    }
+    /**
+     * 检查是否是只读路径
+     */
+    isReadOnlyPath(url) {
+        const pathname = this.getPathname(url);
+        return this.readOnlyPaths.some(path => pathname.startsWith(path));
+    }
+    /**
+     * 从 URL 提取 pathname
+     */
+    getPathname(url) {
+        try {
+            return new URL(url, 'http://localhost').pathname;
+        }
+        catch {
+            return url.split('?')[0];
+        }
+    }
+}
+exports.DisabledIdentityProviderHandler = DisabledIdentityProviderHandler;
+//# sourceMappingURL=DisabledIdentityProviderHandler.js.map

package/dist/identity/oidc/DisabledIdentityProviderHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DisabledIdentityProviderHandler.js","sourceRoot":"","sources":["../../../src/identity/oidc/DisabledIdentityProviderHandler.ts"],"names":[],"mappings":";;;AAAA,iEAAqD;AACrD,8DAIiC;AASjC;;;;;;;;;;;;GAYG;AACH,MAAa,+BAAgC,SAAQ,8BAAW;IAuB9D,YAAY,UAAkD,EAAE;QAC9D,KAAK,EAAE,CAAC;QAvBO,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAI7C,WAAW;QACM,kBAAa,GAAG;YAC/B,OAAO;YACP,WAAW;YACX,QAAQ;YACR,SAAS;YACT,WAAW;YACX,iBAAiB;YACjB,kBAAkB;YAClB,YAAY;SACb,CAAC;QAEF,gCAAgC;QACf,kBAAa,GAAG;YAC/B,eAAe;YACf,kBAAkB;SACnB,CAAC;QAIA,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,4CAA4C,CAAC;QAC/E,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACa,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAoB;QAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;QAEvC,cAAc;QACd,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,0CAAuB,CAAC,oCAAoC,CAAC,CAAC;QAC1E,CAAC;QAED,eAAe;QACf,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACvE,6CAA6C;YAC7C,MAAM,IAAI,0CAAuB,CAC/B,GAAG,IAAI,CAAC,OAAO,6CAA6C,CAC7D,CAAC;QACJ,CAAC;QAED,aAAa;QACb,MAAM,IAAI,0CAAuB,CAC/B,GAAG,IAAI,CAAC,OAAO,mDAAmD,CACnE,CAAC;IACJ,CAAC;IAED;;;OAGG;IACa,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAoB;QACzD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;QAElF,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;QAC1B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QACvD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YAC1B,KAAK,EAAE,iBAAiB;YACxB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,6EAA6E;SACpF,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,GAAW;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,GAAW;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,GAAW;QAC7B,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;CACF;AApGD,0EAoGC","sourcesContent":["import { getLoggerFor } from 'global-logger-factory';\nimport {\n  HttpHandler,\n  type HttpHandlerInput,\n  NotImplementedHttpError,\n} from '@solid/community-server';\n\nexport interface DisabledIdentityProviderHandlerOptions {\n  /** 禁用原因说明 */\n  message?: string;\n  /** 是否保留某些只读端点 */\n  allowReadOnly?: boolean;\n}\n\n/**\n * Disabled Identity Provider Handler\n *\n * 用于 SP (Storage Provider) 模式，禁用本地账户管理功能。\n *\n * 行为:\n * - 拒绝所有账户注册请求\n * - 拒绝所有登录请求\n * - 拒绝所有密码重置请求\n * - 可选：保留某些只读端点（如账户信息查询）\n *\n * 这样用户必须通过外部 IdP 进行身份验证，SP 只负责存储。\n */\nexport class DisabledIdentityProviderHandler extends HttpHandler {\n  private readonly logger = getLoggerFor(this);\n  private readonly message: string;\n  private readonly allowReadOnly: boolean;\n\n  // 账户管理相关路径\n  private readonly identityPaths = [\n    '/idp/',\n    '/account/',\n    '/login',\n    '/logout',\n    '/register',\n    '/reset-password',\n    '/forgot-password',\n    '/.account/',\n  ];\n\n  // 只读路径（如果 allowReadOnly 为 true）\n  private readonly readOnlyPaths = [\n    '/account/info',\n    '/account/profile',\n  ];\n\n  constructor(options: DisabledIdentityProviderHandlerOptions = {}) {\n    super();\n    this.message = options.message ?? 'Account management handled by external IdP';\n    this.allowReadOnly = options.allowReadOnly ?? false;\n    this.logger.info(`Initialized: ${this.message}`);\n  }\n\n  /**\n   * 处理账户管理请求\n   *\n   * 默认拒绝所有请求，返回 501 Not Implemented\n   */\n  public override async canHandle({ request }: HttpHandlerInput): Promise<void> {\n    const url = request.url ?? '';\n    const method = request.method ?? 'GET';\n\n    // 检查是否是账户管理路径\n    if (!this.isIdentityPath(url)) {\n      throw new NotImplementedHttpError('Not an identity management request');\n    }\n\n    // 如果是只读路径且允许只读\n    if (this.allowReadOnly && this.isReadOnlyPath(url) && method === 'GET') {\n      // 继续处理（抛出 NotImplemented，因为 SP 模式下不支持查询账户信息）\n      throw new NotImplementedHttpError(\n        `${this.message}. Account queries not supported in SP mode.`\n      );\n    }\n\n    // 拒绝所有账户管理请求\n    throw new NotImplementedHttpError(\n      `${this.message}. Please use the external IdP for authentication.`\n    );\n  }\n\n  /**\n   * handle 方法理论上不会被执行，因为 canHandle 总是抛出异常\n   * 但为了完整性，保留此方法\n   */\n  public override async handle({ response }: HttpHandlerInput): Promise<void> {\n    this.logger.warn('DisabledIdentityProviderHandler.handle() should not be called');\n\n    response.statusCode = 501;\n    response.setHeader('Content-Type', 'application/json');\n    response.end(JSON.stringify({\n      error: 'not_implemented',\n      message: this.message,\n      hint: 'This is a Storage Provider (SP). Please authenticate with the external IdP.'\n    }));\n  }\n\n  /**\n   * 检查是否是账户管理路径\n   */\n  private isIdentityPath(url: string): boolean {\n    const pathname = this.getPathname(url);\n    return this.identityPaths.some(path => pathname.startsWith(path));\n  }\n\n  /**\n   * 检查是否是只读路径\n   */\n  private isReadOnlyPath(url: string): boolean {\n    const pathname = this.getPathname(url);\n    return this.readOnlyPaths.some(path => pathname.startsWith(path));\n  }\n\n  /**\n   * 从 URL 提取 pathname\n   */\n  private getPathname(url: string): string {\n    try {\n      return new URL(url, 'http://localhost').pathname;\n    } catch {\n      return url.split('?')[0];\n    }\n  }\n}\n"]}

package/dist/identity/oidc/DisabledIdentityProviderHandler.jsonld

@@ -0,0 +1,111 @@
+{
+  "@context": [
+    "https://linkedsoftwaredependencies.org/bundles/npm/@undefineds.co/xpod/^0.0.0/components/context.jsonld",
+    "https://linkedsoftwaredependencies.org/bundles/npm/@solid/community-server/^8.0.0/components/context.jsonld"
+  ],
+  "@id": "npmd:@undefineds.co/xpod",
+  "components": [
+    {
+      "@id": "undefineds:dist/identity/oidc/DisabledIdentityProviderHandler.jsonld#DisabledIdentityProviderHandler",
+      "@type": "Class",
+      "requireElement": "DisabledIdentityProviderHandler",
+      "extends": [
+        "css:dist/server/HttpHandler.jsonld#HttpHandler"
+      ],
+      "comment": "Disabled Identity Provider Handler  用于 SP (Storage Provider) 模式，禁用本地账户管理功能。  行为: - 拒绝所有账户注册请求 - 拒绝所有登录请求 - 拒绝所有密码重置请求 - 可选：保留某些只读端点（如账户信息查询）  这样用户必须通过外部 IdP 进行身份验证，SP 只负责存储。",
+      "parameters": [
+        {
+          "@id": "undefineds:dist/identity/oidc/DisabledIdentityProviderHandler.jsonld#DisabledIdentityProviderHandler_options_message",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "xsd:string",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          },
+          "comment": "禁用原因说明"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/DisabledIdentityProviderHandler.jsonld#DisabledIdentityProviderHandler_options_allowReadOnly",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "xsd:boolean",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          },
+          "comment": "是否保留某些只读端点"
+        }
+      ],
+      "memberFields": [
+        {
+          "@id": "undefineds:dist/identity/oidc/DisabledIdentityProviderHandler.jsonld#DisabledIdentityProviderHandler__member_logger",
+          "memberFieldName": "logger"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/DisabledIdentityProviderHandler.jsonld#DisabledIdentityProviderHandler__member_message",
+          "memberFieldName": "message"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/DisabledIdentityProviderHandler.jsonld#DisabledIdentityProviderHandler__member_allowReadOnly",
+          "memberFieldName": "allowReadOnly"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/DisabledIdentityProviderHandler.jsonld#DisabledIdentityProviderHandler__member_identityPaths",
+          "memberFieldName": "identityPaths"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/DisabledIdentityProviderHandler.jsonld#DisabledIdentityProviderHandler__member_readOnlyPaths",
+          "memberFieldName": "readOnlyPaths"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/DisabledIdentityProviderHandler.jsonld#DisabledIdentityProviderHandler__member_constructor",
+          "memberFieldName": "constructor"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/DisabledIdentityProviderHandler.jsonld#DisabledIdentityProviderHandler__member_canHandle",
+          "memberFieldName": "canHandle"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/DisabledIdentityProviderHandler.jsonld#DisabledIdentityProviderHandler__member_handle",
+          "memberFieldName": "handle"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/DisabledIdentityProviderHandler.jsonld#DisabledIdentityProviderHandler__member_isIdentityPath",
+          "memberFieldName": "isIdentityPath"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/DisabledIdentityProviderHandler.jsonld#DisabledIdentityProviderHandler__member_isReadOnlyPath",
+          "memberFieldName": "isReadOnlyPath"
+        },
+        {
+          "@id": "undefineds:dist/identity/oidc/DisabledIdentityProviderHandler.jsonld#DisabledIdentityProviderHandler__member_getPathname",
+          "memberFieldName": "getPathname"
+        }
+      ],
+      "constructorArguments": [
+        {
+          "@id": "undefineds:dist/identity/oidc/DisabledIdentityProviderHandler.jsonld#DisabledIdentityProviderHandler_options__constructorArgument",
+          "fields": [
+            {
+              "keyRaw": "message",
+              "value": {
+                "@id": "undefineds:dist/identity/oidc/DisabledIdentityProviderHandler.jsonld#DisabledIdentityProviderHandler_options_message"
+              }
+            },
+            {
+              "keyRaw": "allowReadOnly",
+              "value": {
+                "@id": "undefineds:dist/identity/oidc/DisabledIdentityProviderHandler.jsonld#DisabledIdentityProviderHandler_options_allowReadOnly"
+              }
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}

package/dist/identity/oidc/DisabledOidcHandler.d.ts

@@ -0,0 +1,55 @@
+import { HttpHandler, type HttpHandlerInput } from '@solid/community-server';
+export interface DisabledOidcHandlerOptions {
+    /** 外部 IdP 的 JWKS URL */
+    externalJwksUrl?: string;
+    /** 禁用原因说明 */
+    message?: string;
+    /** JWKS 缓存时间 (ms) */
+    cacheMs?: number;
+    /** 是否完全禁用 (不代理 JWKS) */
+    fullyDisabled?: boolean;
+}
+/**
+ * Disabled OIDC Handler
+ *
+ * 用于 SP (Storage Provider) 模式，禁用本地 OIDC 服务端功能。
+ *
+ * 行为:
+ * 1. 对 /.oidc/jwks 请求：代理到外部 IdP 的 JWKS (支持缓存)
+ * 2. 对其他 OIDC 请求：返回 501 Not Implemented
+ *
+ * 这样 SP 可以验证来自外部 IdP 的 token，但不颁发 token。
+ */
+export declare class DisabledOidcHandler extends HttpHandler {
+    private readonly logger;
+    private readonly externalJwksUrl?;
+    private readonly message;
+    private readonly cacheMs;
+    private readonly fullyDisabled;
+    private jwksCache?;
+    constructor(options?: DisabledOidcHandlerOptions);
+    /**
+     * 只处理 OIDC 相关的请求路径
+     */
+    canHandle({ request }: HttpHandlerInput): Promise<void>;
+    /**
+     * 处理 JWKS 代理请求
+     */
+    handle({ response }: HttpHandlerInput): Promise<void>;
+    /**
+     * 获取并缓存 JWKS
+     */
+    private fetchJwks;
+    /**
+     * 检查是否是 OIDC 路径
+     */
+    private isOidcPath;
+    /**
+     * 检查是否是 JWKS 路径
+     */
+    private isJwksPath;
+    /**
+     * 从 URL 提取 pathname
+     */
+    private getPathname;
+}

package/dist/identity/oidc/DisabledOidcHandler.js

@@ -0,0 +1,132 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DisabledOidcHandler = void 0;
+const node_url_1 = require("node:url");
+const global_logger_factory_1 = require("global-logger-factory");
+const community_server_1 = require("@solid/community-server");
+/**
+ * Disabled OIDC Handler
+ *
+ * 用于 SP (Storage Provider) 模式，禁用本地 OIDC 服务端功能。
+ *
+ * 行为:
+ * 1. 对 /.oidc/jwks 请求：代理到外部 IdP 的 JWKS (支持缓存)
+ * 2. 对其他 OIDC 请求：返回 501 Not Implemented
+ *
+ * 这样 SP 可以验证来自外部 IdP 的 token，但不颁发 token。
+ */
+class DisabledOidcHandler extends community_server_1.HttpHandler {
+    constructor(options = {}) {
+        super();
+        this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
+        this.externalJwksUrl = options.externalJwksUrl;
+        this.message = options.message ?? 'OIDC disabled in storage provider mode';
+        this.cacheMs = options.cacheMs ?? 300000; // 默认 5 分钟
+        this.fullyDisabled = options.fullyDisabled ?? false;
+        if (!this.fullyDisabled && !this.externalJwksUrl) {
+            this.logger.warn('DisabledOidcHandler: no externalJwksUrl provided, JWKS proxy will fail');
+        }
+    }
+    /**
+     * 只处理 OIDC 相关的请求路径
+     */
+    async canHandle({ request }) {
+        const url = request.url ?? '';
+        // 检查是否是 OIDC 路径
+        if (!this.isOidcPath(url)) {
+            throw new community_server_1.NotImplementedHttpError('Not an OIDC request');
+        }
+        // 完全禁用模式下，所有 OIDC 请求都不处理
+        if (this.fullyDisabled) {
+            throw new community_server_1.NotImplementedHttpError(this.message);
+        }
+        // 只有 JWKS 请求可以处理
+        if (!this.isJwksPath(url)) {
+            throw new community_server_1.NotImplementedHttpError(`External IdP mode: ${this.message}. Authentication handled by external IdP.`);
+        }
+        // JWKS 请求但没有配置外部 URL
+        if (!this.externalJwksUrl) {
+            throw new community_server_1.InternalServerError('JWKS proxy not configured');
+        }
+    }
+    /**
+     * 处理 JWKS 代理请求
+     */
+    async handle({ response }) {
+        try {
+            const jwks = await this.fetchJwks();
+            response.statusCode = 200;
+            response.setHeader('Content-Type', 'application/json');
+            response.setHeader('Cache-Control', `public, max-age=${Math.floor(this.cacheMs / 1000)}`);
+            response.end(JSON.stringify(jwks));
+            this.logger.debug('JWKS proxy successful');
+        }
+        catch (error) {
+            this.logger.error(`JWKS proxy failed: ${error.message}`);
+            throw new community_server_1.InternalServerError('Failed to proxy JWKS request', { cause: error });
+        }
+    }
+    /**
+     * 获取并缓存 JWKS
+     */
+    async fetchJwks() {
+        // 检查缓存
+        if (this.jwksCache && this.jwksCache.expiresAt > Date.now()) {
+            this.logger.debug('Returning cached JWKS');
+            return { keys: this.jwksCache.keys };
+        }
+        if (!this.externalJwksUrl) {
+            throw new Error('External JWKS URL not configured');
+        }
+        this.logger.debug(`Fetching JWKS from ${this.externalJwksUrl}`);
+        const res = await fetch(this.externalJwksUrl, {
+            headers: { Accept: 'application/json' },
+        });
+        if (!res.ok) {
+            throw new Error(`Failed to fetch JWKS: ${res.status} ${res.statusText}`);
+        }
+        const jwks = await res.json();
+        // 验证 JWKS 格式
+        if (!Array.isArray(jwks.keys)) {
+            throw new Error('Invalid JWKS format: missing keys array');
+        }
+        // 更新缓存
+        this.jwksCache = {
+            keys: jwks.keys,
+            expiresAt: Date.now() + this.cacheMs,
+        };
+        this.logger.debug(`JWKS cached with ${jwks.keys.length} keys`);
+        return jwks;
+    }
+    /**
+     * 检查是否是 OIDC 路径
+     */
+    isOidcPath(url) {
+        const pathname = this.getPathname(url);
+        return (pathname.startsWith('/.oidc/') ||
+            pathname === '/.well-known/openid-configuration' ||
+            pathname === '/.well-known/oauth-authorization-server' ||
+            pathname.startsWith('/idp/'));
+    }
+    /**
+     * 检查是否是 JWKS 路径
+     */
+    isJwksPath(url) {
+        const pathname = this.getPathname(url);
+        return pathname === '/.oidc/jwks' || pathname === '/.oidc/jwks.json';
+    }
+    /**
+     * 从 URL 提取 pathname
+     */
+    getPathname(url) {
+        try {
+            return new node_url_1.URL(url, 'http://localhost').pathname;
+        }
+        catch {
+            // 如果解析失败，直接返回 url（可能是相对路径）
+            return url.split('?')[0];
+        }
+    }
+}
+exports.DisabledOidcHandler = DisabledOidcHandler;
+//# sourceMappingURL=DisabledOidcHandler.js.map

package/dist/identity/oidc/DisabledOidcHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DisabledOidcHandler.js","sourceRoot":"","sources":["../../../src/identity/oidc/DisabledOidcHandler.ts"],"names":[],"mappings":";;;AAAA,uCAA+B;AAC/B,iEAAqD;AACrD,8DAKiC;AAkBjC;;;;;;;;;;GAUG;AACH,MAAa,mBAAoB,SAAQ,8BAAW;IAQlD,YAAY,UAAsC,EAAE;QAClD,KAAK,EAAE,CAAC;QARO,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAS3C,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;QAC/C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,wCAAwC,CAAC;QAC3E,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,UAAU;QACpD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC;QAEpD,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IAED;;OAEG;IACa,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAoB;QAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;QAE9B,gBAAgB;QAChB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,0CAAuB,CAAC,qBAAqB,CAAC,CAAC;QAC3D,CAAC;QAED,yBAAyB;QACzB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,IAAI,0CAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;QAED,iBAAiB;QACjB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,0CAAuB,CAC/B,sBAAsB,IAAI,CAAC,OAAO,2CAA2C,CAC9E,CAAC;QACJ,CAAC;QAED,qBAAqB;QACrB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,MAAM,IAAI,sCAAmB,CAAC,2BAA2B,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED;;OAEG;IACa,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAoB;QACzD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YAEpC,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;YAC1B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YACvD,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,mBAAmB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1F,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAEnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAuB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YACpE,MAAM,IAAI,sCAAmB,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,SAAS;QACrB,OAAO;QACP,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACvC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QAEhE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,eAAe,EAAE;YAC5C,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAyB,CAAC;QAErD,aAAa;QACb,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO;QACP,IAAI,CAAC,SAAS,GAAG;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO;SACrC,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,IAAI,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,GAAW;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;YAC9B,QAAQ,KAAK,mCAAmC;YAChD,QAAQ,KAAK,yCAAyC;YACtD,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAC7B,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,GAAW;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK,kBAAkB,CAAC;IACvE,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,GAAW;QAC7B,IAAI,CAAC;YACH,OAAO,IAAI,cAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;YAC3B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;CACF;AA7ID,kDA6IC","sourcesContent":["import { URL } from 'node:url';\nimport { getLoggerFor } from 'global-logger-factory';\nimport {\n  HttpHandler,\n  type HttpHandlerInput,\n  NotImplementedHttpError,\n  InternalServerError,\n} from '@solid/community-server';\n\nexport interface DisabledOidcHandlerOptions {\n  /** 外部 IdP 的 JWKS URL */\n  externalJwksUrl?: string;\n  /** 禁用原因说明 */\n  message?: string;\n  /** JWKS 缓存时间 (ms) */\n  cacheMs?: number;\n  /** 是否完全禁用 (不代理 JWKS) */\n  fullyDisabled?: boolean;\n}\n\ninterface JwksCache {\n  keys: unknown[];\n  expiresAt: number;\n}\n\n/**\n * Disabled OIDC Handler\n *\n * 用于 SP (Storage Provider) 模式，禁用本地 OIDC 服务端功能。\n *\n * 行为:\n * 1. 对 /.oidc/jwks 请求：代理到外部 IdP 的 JWKS (支持缓存)\n * 2. 对其他 OIDC 请求：返回 501 Not Implemented\n *\n * 这样 SP 可以验证来自外部 IdP 的 token，但不颁发 token。\n */\nexport class DisabledOidcHandler extends HttpHandler {\n  private readonly logger = getLoggerFor(this);\n  private readonly externalJwksUrl?: string;\n  private readonly message: string;\n  private readonly cacheMs: number;\n  private readonly fullyDisabled: boolean;\n  private jwksCache?: JwksCache;\n\n  constructor(options: DisabledOidcHandlerOptions = {}) {\n    super();\n    this.externalJwksUrl = options.externalJwksUrl;\n    this.message = options.message ?? 'OIDC disabled in storage provider mode';\n    this.cacheMs = options.cacheMs ?? 300000; // 默认 5 分钟\n    this.fullyDisabled = options.fullyDisabled ?? false;\n\n    if (!this.fullyDisabled && !this.externalJwksUrl) {\n      this.logger.warn('DisabledOidcHandler: no externalJwksUrl provided, JWKS proxy will fail');\n    }\n  }\n\n  /**\n   * 只处理 OIDC 相关的请求路径\n   */\n  public override async canHandle({ request }: HttpHandlerInput): Promise<void> {\n    const url = request.url ?? '';\n\n    // 检查是否是 OIDC 路径\n    if (!this.isOidcPath(url)) {\n      throw new NotImplementedHttpError('Not an OIDC request');\n    }\n\n    // 完全禁用模式下，所有 OIDC 请求都不处理\n    if (this.fullyDisabled) {\n      throw new NotImplementedHttpError(this.message);\n    }\n\n    // 只有 JWKS 请求可以处理\n    if (!this.isJwksPath(url)) {\n      throw new NotImplementedHttpError(\n        `External IdP mode: ${this.message}. Authentication handled by external IdP.`\n      );\n    }\n\n    // JWKS 请求但没有配置外部 URL\n    if (!this.externalJwksUrl) {\n      throw new InternalServerError('JWKS proxy not configured');\n    }\n  }\n\n  /**\n   * 处理 JWKS 代理请求\n   */\n  public override async handle({ response }: HttpHandlerInput): Promise<void> {\n    try {\n      const jwks = await this.fetchJwks();\n\n      response.statusCode = 200;\n      response.setHeader('Content-Type', 'application/json');\n      response.setHeader('Cache-Control', `public, max-age=${Math.floor(this.cacheMs / 1000)}`);\n      response.end(JSON.stringify(jwks));\n\n      this.logger.debug('JWKS proxy successful');\n    } catch (error) {\n      this.logger.error(`JWKS proxy failed: ${(error as Error).message}`);\n      throw new InternalServerError('Failed to proxy JWKS request', { cause: error });\n    }\n  }\n\n  /**\n   * 获取并缓存 JWKS\n   */\n  private async fetchJwks(): Promise<{ keys: unknown[] }> {\n    // 检查缓存\n    if (this.jwksCache && this.jwksCache.expiresAt > Date.now()) {\n      this.logger.debug('Returning cached JWKS');\n      return { keys: this.jwksCache.keys };\n    }\n\n    if (!this.externalJwksUrl) {\n      throw new Error('External JWKS URL not configured');\n    }\n\n    this.logger.debug(`Fetching JWKS from ${this.externalJwksUrl}`);\n\n    const res = await fetch(this.externalJwksUrl, {\n      headers: { Accept: 'application/json' },\n    });\n\n    if (!res.ok) {\n      throw new Error(`Failed to fetch JWKS: ${res.status} ${res.statusText}`);\n    }\n\n    const jwks = await res.json() as { keys: unknown[] };\n\n    // 验证 JWKS 格式\n    if (!Array.isArray(jwks.keys)) {\n      throw new Error('Invalid JWKS format: missing keys array');\n    }\n\n    // 更新缓存\n    this.jwksCache = {\n      keys: jwks.keys,\n      expiresAt: Date.now() + this.cacheMs,\n    };\n\n    this.logger.debug(`JWKS cached with ${jwks.keys.length} keys`);\n    return jwks;\n  }\n\n  /**\n   * 检查是否是 OIDC 路径\n   */\n  private isOidcPath(url: string): boolean {\n    const pathname = this.getPathname(url);\n    return (\n      pathname.startsWith('/.oidc/') ||\n      pathname === '/.well-known/openid-configuration' ||\n      pathname === '/.well-known/oauth-authorization-server' ||\n      pathname.startsWith('/idp/')\n    );\n  }\n\n  /**\n   * 检查是否是 JWKS 路径\n   */\n  private isJwksPath(url: string): boolean {\n    const pathname = this.getPathname(url);\n    return pathname === '/.oidc/jwks' || pathname === '/.oidc/jwks.json';\n  }\n\n  /**\n   * 从 URL 提取 pathname\n   */\n  private getPathname(url: string): string {\n    try {\n      return new URL(url, 'http://localhost').pathname;\n    } catch {\n      // 如果解析失败，直接返回 url（可能是相对路径）\n      return url.split('?')[0];\n    }\n  }\n}\n"]}