@undefineds.co/xpod 0.3.1 → 0.3.4

package/dist/cli/commands/start.js

@@ -8,6 +8,7 @@ const path_1 = __importDefault(require("path"));
 const fs_1 = __importDefault(require("fs"));
 const supervisor_1 = require("../../supervisor");
 const runtime_1 = require("../../runtime");
+const css_process_1 = require("../../runtime/css-process");
 const oidc_issuer_1 = require("../../runtime/oidc-issuer");
 const childJsRuntime = typeof globalThis.Bun !== 'undefined'
     ? (process.env.XPOD_NODE_BINARY ?? 'node')
@@ -88,29 +89,29 @@ exports.startCommand = {
         const apiPort = await (0, runtime_1.getFreePort)(cssPort + 1, argv.host);
         const baseUrl = process.env.CSS_BASE_URL || `http://${argv.host}:${mainPort}/`;
         // SP 模式：CSS_OIDC_ISSUER 显式指定外部 IdP；Cloud API 地址不再隐式当作 issuer。
-        const oidcIssuer = (0, oidc_issuer_1.resolveExternalOidcIssuer)(process.env);
+        const externalOidcIssuer = (0, oidc_issuer_1.resolveExternalOidcIssuer)(process.env);
         console.log('Starting xpod...');
         console.log(`  Gateway: ${baseUrl} (${argv.host}:${mainPort})`);
         console.log(`  CSS (internal): http://localhost:${cssPort}`);
         console.log(`  API (internal): http://localhost:${apiPort}`);
-        if (oidcIssuer) {
-            console.log(`  SP mode: Cloud IdP = ${oidcIssuer}`);
+        if (externalOidcIssuer) {
+            console.log(`  SP mode: Cloud IdP = ${externalOidcIssuer}`);
         }
         const supervisor = new supervisor_1.Supervisor();
         const cssBinary = require.resolve('@solid/community-server/bin/server.js');
-        const cssArgs = [cssBinary, '-c', configPath, '-m', runtime_1.PACKAGE_ROOT, '-p', cssPort.toString(), '-b', baseUrl];
-        if (oidcIssuer) {
-            cssArgs.push('--oidcIssuer', oidcIssuer);
-        }
+        const cssArgs = (0, css_process_1.buildCssArgs)({
+            cssBinary,
+            configPath,
+            cssModuleRoot: runtime_1.PACKAGE_ROOT,
+            cssPort,
+            baseUrl,
+            externalOidcIssuer,
+        });
         supervisor.register({
             name: 'css',
             command: childJsRuntime,
             args: cssArgs,
-            env: {
-                ...process.env,
-                CSS_PORT: cssPort.toString(),
-                CSS_BASE_URL: baseUrl,
-            },
+            env: (0, css_process_1.buildCssChildEnv)(baseUrl, cssPort),
         });
         const isDevMode = __filename.endsWith('.ts');
         const apiArgs = isDevMode
@@ -124,14 +125,13 @@ exports.startCommand = {
             name: 'api',
             command: childJsRuntime,
             args: apiArgs,
-            env: {
-                ...process.env,
-                API_PORT: apiPort.toString(),
-                XPOD_MAIN_PORT: mainPort.toString(),
-                CSS_INTERNAL_URL: `http://localhost:${cssPort}`,
-                CSS_BASE_URL: baseUrl,
-                CSS_TOKEN_ENDPOINT: oidcIssuer ? (0, oidc_issuer_1.oidcTokenEndpoint)(oidcIssuer) : `${baseUrl}.oidc/token`,
-            },
+            env: (0, css_process_1.buildApiChildEnv)({
+                apiPort,
+                mainPort,
+                cssPort,
+                baseUrl,
+                externalOidcIssuer,
+            }),
         });
         const proxy = new runtime_1.GatewayProxy(mainPort, supervisor, '0.0.0.0', {
             exitOnStop: true,

package/dist/cli/commands/start.js.map

@@ -1 +1 @@
-{"version":3,"file":"start.js","sourceRoot":"","sources":["../../../src/cli/commands/start.ts"],"names":[],"mappings":";;;;;;AACA,gDAAwB;AACxB,4CAAoB;AACpB,iDAA8C;AAC9C,2CAAwE;AACxE,2DAAyF;AAUzF,MAAM,cAAc,GAAG,OAAQ,UAAgC,CAAC,GAAG,KAAK,WAAW;IACjF,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,MAAM,CAAC;IAC1C,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;AAErB,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,YAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC3B,CAAC;IACH,CAAC;AACH,CAAC;AAEY,QAAA,YAAY,GAAqC;IAC5D,OAAO,EAAE,OAAO;IAChB,QAAQ,EAAE,qBAAqB;IAC/B,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,KAAK;SACF,MAAM,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;QAC3B,WAAW,EAAE,UAAU;KACxB,CAAC;SACD,MAAM,CAAC,QAAQ,EAAE;QAChB,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,wCAAwC;KACtD,CAAC;SACD,MAAM,CAAC,KAAK,EAAE;QACb,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,mBAAmB;KACjC,CAAC;SACD,MAAM,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,cAAc;QAC3B,OAAO,EAAE,IAAI;KACd,CAAC;SACD,MAAM,CAAC,MAAM,EAAE;QACd,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,cAAc;QAC3B,OAAO,EAAE,WAAW;KACrB,CAAC;IACN,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,QAAQ,GACZ,IAAI,CAAC,IAAI,KAAK,IAAI;YAChB,CAAC,CAAC,IAAI,CAAC,IAAI;YACX,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;QAExE,IAAI,UAAkB,CAAC;QACvB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACrB,UAAU,GAAG,cAAI,CAAC,IAAI,CAAC,sBAAY,EAAE,UAAU,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,cAAI,CAAC,IAAI,CAAC,sBAAY,EAAE,mBAAmB,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAA,qBAAW,EAAC,QAAQ,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAM,IAAA,qBAAW,EAAC,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAE1D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,UAAU,IAAI,CAAC,IAAI,IAAI,QAAQ,GAAG,CAAC;QAE/E,8DAA8D;QAC9D,MAAM,UAAU,GAAG,IAAA,uCAAyB,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAE1D,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,cAAc,OAAO,KAAK,IAAI,CAAC,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAC;QAC7D,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,0BAA0B,UAAU,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,uBAAU,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,sBAAY,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3G,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QAC3C,CAAC;QAED,UAAU,CAAC,QAAQ,CAAC;YAClB,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,cAAc;YACvB,IAAI,EAAE,OAAO;YACb,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAA6B;gBACxC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;gBAC5B,YAAY,EAAE,OAAO;aACtB;SACF,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,SAAS;YACvB,CAAC,CAAC;gBACE,IAAI;gBACJ,OAAO,CAAC,OAAO,CAAC,iCAAiC,CAAC;gBAClD,cAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC;aACtD;YACH,CAAC,CAAC,CAAC,cAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;QAE5D,UAAU,CAAC,QAAQ,CAAC;YAClB,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,cAAc;YACvB,IAAI,EAAE,OAAO;YACb,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAA6B;gBACxC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;gBAC5B,cAAc,EAAE,QAAQ,CAAC,QAAQ,EAAE;gBACnC,gBAAgB,EAAE,oBAAoB,OAAO,EAAE;gBAC/C,YAAY,EAAE,OAAO;gBACrB,kBAAkB,EAAE,UAAU,CAAC,CAAC,CAAC,IAAA,+BAAiB,EAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,aAAa;aACzF;SACF,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAI,sBAAY,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE;YAC9D,UAAU,EAAE,IAAI;YAChB,OAAO;SACR,CAAC,CAAC;QACH,KAAK,CAAC,UAAU,CAAC;YACf,GAAG,EAAE,oBAAoB,OAAO,EAAE;YAClC,GAAG,EAAE,oBAAoB,OAAO,EAAE;SACnC,CAAC,CAAC;QAEH,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC5B,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QAEpB,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;YACvD,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,oBAAoB,CAAC,CAAC;YACtD,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC;QAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,CAAC;CACF,CAAC","sourcesContent":["import type { CommandModule } from 'yargs';\nimport path from 'path';\nimport fs from 'fs';\nimport { Supervisor } from '../../supervisor';\nimport { GatewayProxy, getFreePort, PACKAGE_ROOT } from '../../runtime';\nimport { oidcTokenEndpoint, resolveExternalOidcIssuer } from '../../runtime/oidc-issuer';\n\ninterface StartArgs {\n  mode?: string;\n  config?: string;\n  env?: string;\n  port: number;\n  host: string;\n}\n\nconst childJsRuntime = typeof (globalThis as { Bun?: unknown }).Bun !== 'undefined'\n  ? (process.env.XPOD_NODE_BINARY ?? 'node')\n  : process.execPath;\n\nfunction loadEnvFile(envPath: string): void {\n  if (!fs.existsSync(envPath)) {\n    console.warn(`Env file not found: ${envPath}`);\n    return;\n  }\n  const content = fs.readFileSync(envPath, 'utf-8');\n  for (const line of content.split('\\n')) {\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith('#')) continue;\n    const eqIndex = trimmed.indexOf('=');\n    if (eqIndex === -1) continue;\n    const key = trimmed.slice(0, eqIndex).trim();\n    let value = trimmed.slice(eqIndex + 1).trim();\n    if (\n      (value.startsWith('\"') && value.endsWith('\"')) ||\n      (value.startsWith(\"'\") && value.endsWith(\"'\"))\n    ) {\n      value = value.slice(1, -1);\n    }\n    if (!process.env[key]) {\n      process.env[key] = value;\n    }\n  }\n}\n\nexport const startCommand: CommandModule<object, StartArgs> = {\n  command: 'start',\n  describe: 'Start xpod services',\n  builder: (yargs) =>\n    yargs\n      .option('mode', {\n        alias: 'm',\n        type: 'string',\n        choices: ['local', 'cloud'],\n        description: 'Run mode',\n      })\n      .option('config', {\n        alias: 'c',\n        type: 'string',\n        description: 'Path to config file (overrides --mode)',\n      })\n      .option('env', {\n        alias: 'e',\n        type: 'string',\n        description: 'Path to .env file',\n      })\n      .option('port', {\n        alias: 'p',\n        type: 'number',\n        description: 'Gateway port',\n        default: 3000,\n      })\n      .option('host', {\n        type: 'string',\n        description: 'Gateway host',\n        default: 'localhost',\n      }),\n  handler: async (argv) => {\n    if (argv.env) {\n      loadEnvFile(argv.env);\n    }\n\n    const mainPort =\n      argv.port !== 3000\n        ? argv.port\n        : parseInt(process.env.XPOD_PORT ?? process.env.PORT ?? '3000', 10);\n\n    let configPath: string;\n    if (argv.config) {\n      configPath = argv.config;\n    } else if (argv.mode) {\n      configPath = path.join(PACKAGE_ROOT, `config/${argv.mode}.json`);\n    } else {\n      configPath = path.join(PACKAGE_ROOT, 'config/local.json');\n    }\n\n    const cssPort = await getFreePort(mainPort + 1, argv.host);\n    const apiPort = await getFreePort(cssPort + 1, argv.host);\n\n    const baseUrl = process.env.CSS_BASE_URL || `http://${argv.host}:${mainPort}/`;\n\n    // SP 模式：CSS_OIDC_ISSUER 显式指定外部 IdP；Cloud API 地址不再隐式当作 issuer。\n    const oidcIssuer = resolveExternalOidcIssuer(process.env);\n\n    console.log('Starting xpod...');\n    console.log(`  Gateway: ${baseUrl} (${argv.host}:${mainPort})`);\n    console.log(`  CSS (internal): http://localhost:${cssPort}`);\n    console.log(`  API (internal): http://localhost:${apiPort}`);\n    if (oidcIssuer) {\n      console.log(`  SP mode: Cloud IdP = ${oidcIssuer}`);\n    }\n\n    const supervisor = new Supervisor();\n    const cssBinary = require.resolve('@solid/community-server/bin/server.js');\n    const cssArgs = [cssBinary, '-c', configPath, '-m', PACKAGE_ROOT, '-p', cssPort.toString(), '-b', baseUrl];\n    if (oidcIssuer) {\n      cssArgs.push('--oidcIssuer', oidcIssuer);\n    }\n\n    supervisor.register({\n      name: 'css',\n      command: childJsRuntime,\n      args: cssArgs,\n      env: {\n        ...process.env as Record<string, string>,\n        CSS_PORT: cssPort.toString(),\n        CSS_BASE_URL: baseUrl,\n      },\n    });\n\n    const isDevMode = __filename.endsWith('.ts');\n    const apiArgs = isDevMode\n      ? [\n          '-r',\n          require.resolve('ts-node/register/transpile-only'),\n          path.resolve(__dirname, '..', '..', 'api', 'main.ts'),\n        ]\n      : [path.resolve(__dirname, '..', '..', 'api', 'main.js')];\n\n    supervisor.register({\n      name: 'api',\n      command: childJsRuntime,\n      args: apiArgs,\n      env: {\n        ...process.env as Record<string, string>,\n        API_PORT: apiPort.toString(),\n        XPOD_MAIN_PORT: mainPort.toString(),\n        CSS_INTERNAL_URL: `http://localhost:${cssPort}`,\n        CSS_BASE_URL: baseUrl,\n        CSS_TOKEN_ENDPOINT: oidcIssuer ? oidcTokenEndpoint(oidcIssuer) : `${baseUrl}.oidc/token`,\n      },\n    });\n\n    const proxy = new GatewayProxy(mainPort, supervisor, '0.0.0.0', {\n      exitOnStop: true,\n      baseUrl,\n    });\n    proxy.setTargets({\n      css: `http://localhost:${cssPort}`,\n      api: `http://localhost:${apiPort}`,\n    });\n\n    await supervisor.startAll();\n    await proxy.start();\n\n    const shutdown = async (signal: string): Promise<void> => {\n      console.log(`\\nReceived ${signal}, shutting down...`);\n      await supervisor.stopAll();\n      process.exit(0);\n    };\n\n    process.on('SIGTERM', () => shutdown('SIGTERM'));\n    process.on('SIGINT', () => shutdown('SIGINT'));\n  },\n};\n"]}
+{"version":3,"file":"start.js","sourceRoot":"","sources":["../../../src/cli/commands/start.ts"],"names":[],"mappings":";;;;;;AACA,gDAAwB;AACxB,4CAAoB;AACpB,iDAA8C;AAC9C,2CAAwE;AACxE,2DAA6F;AAC7F,2DAAsE;AAUtE,MAAM,cAAc,GAAG,OAAQ,UAAgC,CAAC,GAAG,KAAK,WAAW;IACjF,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,MAAM,CAAC;IAC1C,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;AAErB,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,YAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC3B,CAAC;IACH,CAAC;AACH,CAAC;AAEY,QAAA,YAAY,GAAqC;IAC5D,OAAO,EAAE,OAAO;IAChB,QAAQ,EAAE,qBAAqB;IAC/B,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,KAAK;SACF,MAAM,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;QAC3B,WAAW,EAAE,UAAU;KACxB,CAAC;SACD,MAAM,CAAC,QAAQ,EAAE;QAChB,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,wCAAwC;KACtD,CAAC;SACD,MAAM,CAAC,KAAK,EAAE;QACb,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,mBAAmB;KACjC,CAAC;SACD,MAAM,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,cAAc;QAC3B,OAAO,EAAE,IAAI;KACd,CAAC;SACD,MAAM,CAAC,MAAM,EAAE;QACd,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,cAAc;QAC3B,OAAO,EAAE,WAAW;KACrB,CAAC;IACN,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,QAAQ,GACZ,IAAI,CAAC,IAAI,KAAK,IAAI;YAChB,CAAC,CAAC,IAAI,CAAC,IAAI;YACX,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;QAExE,IAAI,UAAkB,CAAC;QACvB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACrB,UAAU,GAAG,cAAI,CAAC,IAAI,CAAC,sBAAY,EAAE,UAAU,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,cAAI,CAAC,IAAI,CAAC,sBAAY,EAAE,mBAAmB,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAA,qBAAW,EAAC,QAAQ,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAM,IAAA,qBAAW,EAAC,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAE1D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,UAAU,IAAI,CAAC,IAAI,IAAI,QAAQ,GAAG,CAAC;QAE/E,8DAA8D;QAC9D,MAAM,kBAAkB,GAAG,IAAA,uCAAyB,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAElE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,cAAc,OAAO,KAAK,IAAI,CAAC,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAC;QAC7D,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,0BAA0B,kBAAkB,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,uBAAU,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAG,IAAA,0BAAY,EAAC;YAC3B,SAAS;YACT,UAAU;YACV,aAAa,EAAE,sBAAY;YAC3B,OAAO;YACP,OAAO;YACP,kBAAkB;SACnB,CAAC,CAAC;QAEH,UAAU,CAAC,QAAQ,CAAC;YAClB,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,cAAc;YACvB,IAAI,EAAE,OAAO;YACb,GAAG,EAAE,IAAA,8BAAgB,EAAC,OAAO,EAAE,OAAO,CAAC;SACxC,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,SAAS;YACvB,CAAC,CAAC;gBACE,IAAI;gBACJ,OAAO,CAAC,OAAO,CAAC,iCAAiC,CAAC;gBAClD,cAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC;aACtD;YACH,CAAC,CAAC,CAAC,cAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;QAE5D,UAAU,CAAC,QAAQ,CAAC;YAClB,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,cAAc;YACvB,IAAI,EAAE,OAAO;YACb,GAAG,EAAE,IAAA,8BAAgB,EAAC;gBACpB,OAAO;gBACP,QAAQ;gBACR,OAAO;gBACP,OAAO;gBACP,kBAAkB;aACnB,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAI,sBAAY,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE;YAC9D,UAAU,EAAE,IAAI;YAChB,OAAO;SACR,CAAC,CAAC;QACH,KAAK,CAAC,UAAU,CAAC;YACf,GAAG,EAAE,oBAAoB,OAAO,EAAE;YAClC,GAAG,EAAE,oBAAoB,OAAO,EAAE;SACnC,CAAC,CAAC;QAEH,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC5B,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QAEpB,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;YACvD,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,oBAAoB,CAAC,CAAC;YACtD,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC;QAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,CAAC;CACF,CAAC","sourcesContent":["import type { CommandModule } from 'yargs';\nimport path from 'path';\nimport fs from 'fs';\nimport { Supervisor } from '../../supervisor';\nimport { GatewayProxy, getFreePort, PACKAGE_ROOT } from '../../runtime';\nimport { buildApiChildEnv, buildCssArgs, buildCssChildEnv } from '../../runtime/css-process';\nimport { resolveExternalOidcIssuer } from '../../runtime/oidc-issuer';\n\ninterface StartArgs {\n  mode?: string;\n  config?: string;\n  env?: string;\n  port: number;\n  host: string;\n}\n\nconst childJsRuntime = typeof (globalThis as { Bun?: unknown }).Bun !== 'undefined'\n  ? (process.env.XPOD_NODE_BINARY ?? 'node')\n  : process.execPath;\n\nfunction loadEnvFile(envPath: string): void {\n  if (!fs.existsSync(envPath)) {\n    console.warn(`Env file not found: ${envPath}`);\n    return;\n  }\n  const content = fs.readFileSync(envPath, 'utf-8');\n  for (const line of content.split('\\n')) {\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith('#')) continue;\n    const eqIndex = trimmed.indexOf('=');\n    if (eqIndex === -1) continue;\n    const key = trimmed.slice(0, eqIndex).trim();\n    let value = trimmed.slice(eqIndex + 1).trim();\n    if (\n      (value.startsWith('\"') && value.endsWith('\"')) ||\n      (value.startsWith(\"'\") && value.endsWith(\"'\"))\n    ) {\n      value = value.slice(1, -1);\n    }\n    if (!process.env[key]) {\n      process.env[key] = value;\n    }\n  }\n}\n\nexport const startCommand: CommandModule<object, StartArgs> = {\n  command: 'start',\n  describe: 'Start xpod services',\n  builder: (yargs) =>\n    yargs\n      .option('mode', {\n        alias: 'm',\n        type: 'string',\n        choices: ['local', 'cloud'],\n        description: 'Run mode',\n      })\n      .option('config', {\n        alias: 'c',\n        type: 'string',\n        description: 'Path to config file (overrides --mode)',\n      })\n      .option('env', {\n        alias: 'e',\n        type: 'string',\n        description: 'Path to .env file',\n      })\n      .option('port', {\n        alias: 'p',\n        type: 'number',\n        description: 'Gateway port',\n        default: 3000,\n      })\n      .option('host', {\n        type: 'string',\n        description: 'Gateway host',\n        default: 'localhost',\n      }),\n  handler: async (argv) => {\n    if (argv.env) {\n      loadEnvFile(argv.env);\n    }\n\n    const mainPort =\n      argv.port !== 3000\n        ? argv.port\n        : parseInt(process.env.XPOD_PORT ?? process.env.PORT ?? '3000', 10);\n\n    let configPath: string;\n    if (argv.config) {\n      configPath = argv.config;\n    } else if (argv.mode) {\n      configPath = path.join(PACKAGE_ROOT, `config/${argv.mode}.json`);\n    } else {\n      configPath = path.join(PACKAGE_ROOT, 'config/local.json');\n    }\n\n    const cssPort = await getFreePort(mainPort + 1, argv.host);\n    const apiPort = await getFreePort(cssPort + 1, argv.host);\n\n    const baseUrl = process.env.CSS_BASE_URL || `http://${argv.host}:${mainPort}/`;\n\n    // SP 模式：CSS_OIDC_ISSUER 显式指定外部 IdP；Cloud API 地址不再隐式当作 issuer。\n    const externalOidcIssuer = resolveExternalOidcIssuer(process.env);\n\n    console.log('Starting xpod...');\n    console.log(`  Gateway: ${baseUrl} (${argv.host}:${mainPort})`);\n    console.log(`  CSS (internal): http://localhost:${cssPort}`);\n    console.log(`  API (internal): http://localhost:${apiPort}`);\n    if (externalOidcIssuer) {\n      console.log(`  SP mode: Cloud IdP = ${externalOidcIssuer}`);\n    }\n\n    const supervisor = new Supervisor();\n    const cssBinary = require.resolve('@solid/community-server/bin/server.js');\n    const cssArgs = buildCssArgs({\n      cssBinary,\n      configPath,\n      cssModuleRoot: PACKAGE_ROOT,\n      cssPort,\n      baseUrl,\n      externalOidcIssuer,\n    });\n\n    supervisor.register({\n      name: 'css',\n      command: childJsRuntime,\n      args: cssArgs,\n      env: buildCssChildEnv(baseUrl, cssPort),\n    });\n\n    const isDevMode = __filename.endsWith('.ts');\n    const apiArgs = isDevMode\n      ? [\n          '-r',\n          require.resolve('ts-node/register/transpile-only'),\n          path.resolve(__dirname, '..', '..', 'api', 'main.ts'),\n        ]\n      : [path.resolve(__dirname, '..', '..', 'api', 'main.js')];\n\n    supervisor.register({\n      name: 'api',\n      command: childJsRuntime,\n      args: apiArgs,\n      env: buildApiChildEnv({\n        apiPort,\n        mainPort,\n        cssPort,\n        baseUrl,\n        externalOidcIssuer,\n      }),\n    });\n\n    const proxy = new GatewayProxy(mainPort, supervisor, '0.0.0.0', {\n      exitOnStop: true,\n      baseUrl,\n    });\n    proxy.setTargets({\n      css: `http://localhost:${cssPort}`,\n      api: `http://localhost:${apiPort}`,\n    });\n\n    await supervisor.startAll();\n    await proxy.start();\n\n    const shutdown = async (signal: string): Promise<void> => {\n      console.log(`\\nReceived ${signal}, shutting down...`);\n      await supervisor.stopAll();\n      process.exit(0);\n    };\n\n    process.on('SIGTERM', () => shutdown('SIGTERM'));\n    process.on('SIGINT', () => shutdown('SIGINT'));\n  },\n};\n"]}

package/dist/components/context.jsonld

@@ -1837,8 +1837,8 @@
         "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler",
         "@prefix": true,
         "@context": {
-          "options_oidcIssuer": {
-            "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler_options_oidcIssuer"
+          "options_idpUrl": {
+            "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler_options_idpUrl"
           },
           "options_message": {
             "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler_options_message"
@@ -1846,8 +1846,8 @@
           "options_cacheMs": {
             "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler_options_cacheMs"
           },
-          "oidcIssuer": {
-            "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler_options_oidcIssuer"
+          "idpUrl": {
+            "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler_options_idpUrl"
           },
           "message": {
             "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler_options_message"
@@ -1861,8 +1861,8 @@
         "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler",
         "@prefix": true,
         "@context": {
-          "options_oidcIssuer": {
-            "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler_options_oidcIssuer"
+          "options_idpUrl": {
+            "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler_options_idpUrl"
           },
           "options_message": {
             "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler_options_message"
@@ -1870,8 +1870,8 @@
           "options_source": {
             "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler_options_source"
           },
-          "oidcIssuer": {
-            "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler_options_oidcIssuer"
+          "idpUrl": {
+            "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler_options_idpUrl"
           },
           "message": {
             "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler_options_message"

package/dist/identity/oidc/AutoDetectIdentityProviderHandler.d.ts

@@ -1,7 +1,7 @@
 import { HttpHandler, type HttpHandlerInput } from '@solid/community-server';
 export interface AutoDetectIdentityProviderHandlerOptions {
     /** 外部 IdP 的基础 URL，如果提供则启用 SP 模式 */
-    oidcIssuer?: string;
+    idpUrl?: string;
     /** 禁用时的消息 */
     message?: string;
     /** CSS 默认的 IdentityProviderHandler，标准模式下委托给它 */
@@ -11,12 +11,12 @@ export interface AutoDetectIdentityProviderHandlerOptions {
  * Auto-detect Identity Provider Handler
  *
  * 自动检测运行模式：
- * - 如果配置了 oidcIssuer -> SP 模式：禁用本地账户管理
- * - 如果没有配置 oidcIssuer -> 标准模式：委托给 CSS 默认 Handler
+ * - 如果配置了 idpUrl -> SP 模式：禁用本地账户管理
+ * - 如果没有配置 idpUrl -> 标准模式：委托给 CSS 默认 Handler
  */
 export declare class AutoDetectIdentityProviderHandler extends HttpHandler {
     private readonly logger;
-    private readonly oidcIssuer?;
+    private readonly idpUrl?;
     private readonly message;
     private readonly source?;
     constructor(options?: AutoDetectIdentityProviderHandlerOptions);

package/dist/identity/oidc/AutoDetectIdentityProviderHandler.js

@@ -7,18 +7,18 @@ const community_server_1 = require("@solid/community-server");
  * Auto-detect Identity Provider Handler
  *
  * 自动检测运行模式：
- * - 如果配置了 oidcIssuer -> SP 模式：禁用本地账户管理
- * - 如果没有配置 oidcIssuer -> 标准模式：委托给 CSS 默认 Handler
+ * - 如果配置了 idpUrl -> SP 模式：禁用本地账户管理
+ * - 如果没有配置 idpUrl -> 标准模式：委托给 CSS 默认 Handler
  */
 class AutoDetectIdentityProviderHandler extends community_server_1.HttpHandler {
     constructor(options = {}) {
         super();
         this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
-        this.oidcIssuer = options.oidcIssuer;
+        this.idpUrl = options.idpUrl;
         this.message = options.message ?? 'Account management handled by external IdP';
         this.source = options.source;
-        if (this.oidcIssuer) {
-            this.logger.info(`SP mode enabled: ${this.message}, external IdP: ${this.oidcIssuer}`);
+        if (this.idpUrl) {
+            this.logger.info(`SP mode enabled: ${this.message}, external IdP: ${this.idpUrl}`);
         }
         else {
             this.logger.info('Standard mode enabled, delegating to source IdentityProviderHandler');
@@ -36,7 +36,7 @@ class AutoDetectIdentityProviderHandler extends community_server_1.HttpHandler {
             throw new community_server_1.NotImplementedHttpError('Not an IdP request');
         }
         // SP 模式：接受 IdP 路径请求，在 handle 中返回 404
-        if (this.oidcIssuer) {
+        if (this.idpUrl) {
             return;
         }
         // 标准模式：委托给 source Handler
@@ -53,7 +53,7 @@ class AutoDetectIdentityProviderHandler extends community_server_1.HttpHandler {
      * - 标准模式：委托给 source Handler
      */
     async handle(input) {
-        if (this.oidcIssuer) {
+        if (this.idpUrl) {
             const { response } = input;
             response.writeHead(404, { 'Content-Type': 'application/json' });
             response.end(JSON.stringify({ error: this.message }));

package/dist/identity/oidc/AutoDetectIdentityProviderHandler.js.map

@@ -1 +1 @@
-{"version":3,"file":"AutoDetectIdentityProviderHandler.js","sourceRoot":"","sources":["../../../src/identity/oidc/AutoDetectIdentityProviderHandler.ts"],"names":[],"mappings":";;;AAAA,iEAAqD;AACrD,8DAIiC;AAWjC;;;;;;GAMG;AACH,MAAa,iCAAkC,SAAQ,8BAAW;IAMhE,YAAY,UAAoD,EAAE;QAChE,KAAK,EAAE,CAAC;QANO,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAO3C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,4CAA4C,CAAC;QAC/E,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAE7B,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,IAAI,CAAC,OAAO,mBAAmB,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACzF,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IAED;;;;OAIG;IACa,KAAK,CAAC,SAAS,CAAC,KAAuB;QACrD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;QAEpC,eAAe;QACf,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,0CAAuB,CAAC,oBAAoB,CAAC,CAAC;QAC1D,CAAC;QAED,qCAAqC;QACrC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QAED,0BAA0B;QAC1B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,0CAAuB,CAAC,8CAA8C,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED;;;;OAIG;IACa,KAAK,CAAC,MAAM,CAAC,KAAuB;QAClD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;YAC3B,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAChE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QAED,0BAA0B;QAC1B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,0CAAuB,CAAC,8CAA8C,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED;;OAEG;IACK,SAAS,CAAC,GAAW;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;YAC5B,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC;YACjC,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,QAAQ;YACrB,QAAQ,KAAK,SAAS,CACvB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,GAAW;QAC7B,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;CACF;AA1FD,8EA0FC","sourcesContent":["import { getLoggerFor } from 'global-logger-factory';\nimport {\n  HttpHandler,\n  type HttpHandlerInput,\n  NotImplementedHttpError,\n} from '@solid/community-server';\n\nexport interface AutoDetectIdentityProviderHandlerOptions {\n  /** 外部 IdP 的基础 URL，如果提供则启用 SP 模式 */\n  oidcIssuer?: string;\n  /** 禁用时的消息 */\n  message?: string;\n  /** CSS 默认的 IdentityProviderHandler，标准模式下委托给它 */\n  source?: HttpHandler;\n}\n\n/**\n * Auto-detect Identity Provider Handler\n *\n * 自动检测运行模式：\n * - 如果配置了 oidcIssuer -> SP 模式：禁用本地账户管理\n * - 如果没有配置 oidcIssuer -> 标准模式：委托给 CSS 默认 Handler\n */\nexport class AutoDetectIdentityProviderHandler extends HttpHandler {\n  private readonly logger = getLoggerFor(this);\n  private readonly oidcIssuer?: string;\n  private readonly message: string;\n  private readonly source?: HttpHandler;\n\n  constructor(options: AutoDetectIdentityProviderHandlerOptions = {}) {\n    super();\n    this.oidcIssuer = options.oidcIssuer;\n    this.message = options.message ?? 'Account management handled by external IdP';\n    this.source = options.source;\n\n    if (this.oidcIssuer) {\n      this.logger.info(`SP mode enabled: ${this.message}, external IdP: ${this.oidcIssuer}`);\n    } else {\n      this.logger.info('Standard mode enabled, delegating to source IdentityProviderHandler');\n    }\n  }\n\n  /**\n   * 判断是否处理请求\n   * - SP 模式：拒绝所有 IdP 请求\n   * - 标准模式：委托给 source Handler\n   */\n  public override async canHandle(input: HttpHandlerInput): Promise<void> {\n    const url = input.request.url ?? '';\n\n    // 检查是否是 IdP 路径\n    if (!this.isIdpPath(url)) {\n      throw new NotImplementedHttpError('Not an IdP request');\n    }\n\n    // SP 模式：接受 IdP 路径请求，在 handle 中返回 404\n    if (this.oidcIssuer) {\n      return;\n    }\n\n    // 标准模式：委托给 source Handler\n    if (this.source) {\n      await this.source.canHandle(input);\n    } else {\n      throw new NotImplementedHttpError('No source IdentityProviderHandler configured');\n    }\n  }\n\n  /**\n   * 处理请求\n   * - SP 模式：不应该到达这里\n   * - 标准模式：委托给 source Handler\n   */\n  public override async handle(input: HttpHandlerInput): Promise<void> {\n    if (this.oidcIssuer) {\n      const { response } = input;\n      response.writeHead(404, { 'Content-Type': 'application/json' });\n      response.end(JSON.stringify({ error: this.message }));\n      return;\n    }\n\n    // 标准模式：委托给 source Handler\n    if (this.source) {\n      await this.source.handle(input);\n    } else {\n      throw new NotImplementedHttpError('No source IdentityProviderHandler configured');\n    }\n  }\n\n  /**\n   * 检查是否是 IdP 路径\n   */\n  private isIdpPath(url: string): boolean {\n    const pathname = this.getPathname(url);\n    return (\n      pathname.startsWith('/idp/') ||\n      pathname.startsWith('/.account/') ||\n      pathname === '/register' ||\n      pathname === '/login' ||\n      pathname === '/logout'\n    );\n  }\n\n  /**\n   * 从 URL 提取 pathname\n   */\n  private getPathname(url: string): string {\n    try {\n      return new URL(url, 'http://localhost').pathname;\n    } catch {\n      return url.split('?')[0];\n    }\n  }\n}\n"]}
+{"version":3,"file":"AutoDetectIdentityProviderHandler.js","sourceRoot":"","sources":["../../../src/identity/oidc/AutoDetectIdentityProviderHandler.ts"],"names":[],"mappings":";;;AAAA,iEAAqD;AACrD,8DAIiC;AAWjC;;;;;;GAMG;AACH,MAAa,iCAAkC,SAAQ,8BAAW;IAMhE,YAAY,UAAoD,EAAE;QAChE,KAAK,EAAE,CAAC;QANO,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAO3C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,4CAA4C,CAAC;QAC/E,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAE7B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,IAAI,CAAC,OAAO,mBAAmB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACrF,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IAED;;;;OAIG;IACa,KAAK,CAAC,SAAS,CAAC,KAAuB;QACrD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;QAEpC,eAAe;QACf,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,0CAAuB,CAAC,oBAAoB,CAAC,CAAC;QAC1D,CAAC;QAED,qCAAqC;QACrC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO;QACT,CAAC;QAED,0BAA0B;QAC1B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,0CAAuB,CAAC,8CAA8C,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED;;;;OAIG;IACa,KAAK,CAAC,MAAM,CAAC,KAAuB;QAClD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;YAC3B,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAChE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QAED,0BAA0B;QAC1B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,0CAAuB,CAAC,8CAA8C,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED;;OAEG;IACK,SAAS,CAAC,GAAW;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;YAC5B,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC;YACjC,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,QAAQ;YACrB,QAAQ,KAAK,SAAS,CACvB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,GAAW;QAC7B,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;CACF;AA1FD,8EA0FC","sourcesContent":["import { getLoggerFor } from 'global-logger-factory';\nimport {\n  HttpHandler,\n  type HttpHandlerInput,\n  NotImplementedHttpError,\n} from '@solid/community-server';\n\nexport interface AutoDetectIdentityProviderHandlerOptions {\n  /** 外部 IdP 的基础 URL，如果提供则启用 SP 模式 */\n  idpUrl?: string;\n  /** 禁用时的消息 */\n  message?: string;\n  /** CSS 默认的 IdentityProviderHandler，标准模式下委托给它 */\n  source?: HttpHandler;\n}\n\n/**\n * Auto-detect Identity Provider Handler\n *\n * 自动检测运行模式：\n * - 如果配置了 idpUrl -> SP 模式：禁用本地账户管理\n * - 如果没有配置 idpUrl -> 标准模式：委托给 CSS 默认 Handler\n */\nexport class AutoDetectIdentityProviderHandler extends HttpHandler {\n  private readonly logger = getLoggerFor(this);\n  private readonly idpUrl?: string;\n  private readonly message: string;\n  private readonly source?: HttpHandler;\n\n  constructor(options: AutoDetectIdentityProviderHandlerOptions = {}) {\n    super();\n    this.idpUrl = options.idpUrl;\n    this.message = options.message ?? 'Account management handled by external IdP';\n    this.source = options.source;\n\n    if (this.idpUrl) {\n      this.logger.info(`SP mode enabled: ${this.message}, external IdP: ${this.idpUrl}`);\n    } else {\n      this.logger.info('Standard mode enabled, delegating to source IdentityProviderHandler');\n    }\n  }\n\n  /**\n   * 判断是否处理请求\n   * - SP 模式：拒绝所有 IdP 请求\n   * - 标准模式：委托给 source Handler\n   */\n  public override async canHandle(input: HttpHandlerInput): Promise<void> {\n    const url = input.request.url ?? '';\n\n    // 检查是否是 IdP 路径\n    if (!this.isIdpPath(url)) {\n      throw new NotImplementedHttpError('Not an IdP request');\n    }\n\n    // SP 模式：接受 IdP 路径请求，在 handle 中返回 404\n    if (this.idpUrl) {\n      return;\n    }\n\n    // 标准模式：委托给 source Handler\n    if (this.source) {\n      await this.source.canHandle(input);\n    } else {\n      throw new NotImplementedHttpError('No source IdentityProviderHandler configured');\n    }\n  }\n\n  /**\n   * 处理请求\n   * - SP 模式：不应该到达这里\n   * - 标准模式：委托给 source Handler\n   */\n  public override async handle(input: HttpHandlerInput): Promise<void> {\n    if (this.idpUrl) {\n      const { response } = input;\n      response.writeHead(404, { 'Content-Type': 'application/json' });\n      response.end(JSON.stringify({ error: this.message }));\n      return;\n    }\n\n    // 标准模式：委托给 source Handler\n    if (this.source) {\n      await this.source.handle(input);\n    } else {\n      throw new NotImplementedHttpError('No source IdentityProviderHandler configured');\n    }\n  }\n\n  /**\n   * 检查是否是 IdP 路径\n   */\n  private isIdpPath(url: string): boolean {\n    const pathname = this.getPathname(url);\n    return (\n      pathname.startsWith('/idp/') ||\n      pathname.startsWith('/.account/') ||\n      pathname === '/register' ||\n      pathname === '/login' ||\n      pathname === '/logout'\n    );\n  }\n\n  /**\n   * 从 URL 提取 pathname\n   */\n  private getPathname(url: string): string {\n    try {\n      return new URL(url, 'http://localhost').pathname;\n    } catch {\n      return url.split('?')[0];\n    }\n  }\n}\n"]}

package/dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld

@@ -12,10 +12,10 @@
       "extends": [
         "css:dist/server/HttpHandler.jsonld#HttpHandler"
       ],
-      "comment": "Auto-detect Identity Provider Handler  自动检测运行模式： - 如果配置了 oidcIssuer -> SP 模式：禁用本地账户管理 - 如果没有配置 oidcIssuer -> 标准模式：委托给 CSS 默认 Handler",
+      "comment": "Auto-detect Identity Provider Handler  自动检测运行模式： - 如果配置了 idpUrl -> SP 模式：禁用本地账户管理 - 如果没有配置 idpUrl -> 标准模式：委托给 CSS 默认 Handler",
       "parameters": [
         {
-          "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler_options_oidcIssuer",
+          "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler_options_idpUrl",
           "range": {
             "@type": "ParameterRangeUnion",
             "parameterRangeElements": [
@@ -60,8 +60,8 @@
           "memberFieldName": "logger"
         },
         {
-          "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler__member_oidcIssuer",
-          "memberFieldName": "oidcIssuer"
+          "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler__member_idpUrl",
+          "memberFieldName": "idpUrl"
         },
         {
           "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler__member_message",
@@ -97,9 +97,9 @@
           "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler_options__constructorArgument",
           "fields": [
             {
-              "keyRaw": "oidcIssuer",
+              "keyRaw": "idpUrl",
               "value": {
-                "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler_options_oidcIssuer"
+                "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler_options_idpUrl"
               }
             },
             {

package/dist/identity/oidc/AutoDetectOidcHandler.d.ts

@@ -1,7 +1,7 @@
 import { HttpHandler, type HttpHandlerInput } from '@solid/community-server';
 export interface AutoDetectOidcHandlerOptions {
     /** 外部 IdP 的基础 URL，如果提供则启用 SP 模式 */
-    oidcIssuer?: string;
+    idpUrl?: string;
     /** 禁用原因说明 */
     message?: string;
     /** JWKS 缓存时间 (ms) */
@@ -11,14 +11,14 @@ export interface AutoDetectOidcHandlerOptions {
  * Auto-detect OIDC Handler
  *
  * 自动检测运行模式：
- * - 如果配置了 oidcIssuer -> SP 模式：禁用本地 OIDC，代理外部 IdP 的 JWKS
- * - 如果没有配置 oidcIssuer -> 标准模式：所有 OIDC 请求透传（由 CSS 默认 Handler 处理）
+ * - 如果配置了 idpUrl -> SP 模式：禁用本地 OIDC，代理外部 IdP 的 JWKS
+ * - 如果没有配置 idpUrl -> 标准模式：所有 OIDC 请求透传（由 CSS 默认 Handler 处理）
  *
  * 使用方式：在 HTTP pipeline 中替换默认的 OidcHandler
  */
 export declare class AutoDetectOidcHandler extends HttpHandler {
     private readonly logger;
-    private readonly oidcIssuer?;
+    private readonly idpUrl?;
     private readonly jwksUrl?;
     private readonly message;
     private readonly cacheMs;

package/dist/identity/oidc/AutoDetectOidcHandler.js

@@ -8,8 +8,8 @@ const community_server_1 = require("@solid/community-server");
  * Auto-detect OIDC Handler
  *
  * 自动检测运行模式：
- * - 如果配置了 oidcIssuer -> SP 模式：禁用本地 OIDC，代理外部 IdP 的 JWKS
- * - 如果没有配置 oidcIssuer -> 标准模式：所有 OIDC 请求透传（由 CSS 默认 Handler 处理）
+ * - 如果配置了 idpUrl -> SP 模式：禁用本地 OIDC，代理外部 IdP 的 JWKS
+ * - 如果没有配置 idpUrl -> 标准模式：所有 OIDC 请求透传（由 CSS 默认 Handler 处理）
  *
  * 使用方式：在 HTTP pipeline 中替换默认的 OidcHandler
  */
@@ -17,12 +17,12 @@ class AutoDetectOidcHandler extends community_server_1.HttpHandler {
     constructor(options = {}) {
         super();
         this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
-        this.oidcIssuer = options.oidcIssuer;
-        this.jwksUrl = this.oidcIssuer ? `${this.oidcIssuer.replace(/\/$/, '')}/.oidc/jwks` : undefined;
+        this.idpUrl = options.idpUrl;
+        this.jwksUrl = this.idpUrl ? `${this.idpUrl.replace(/\/$/, '')}/.oidc/jwks` : undefined;
         this.message = options.message ?? 'OIDC disabled in storage provider mode';
         this.cacheMs = options.cacheMs ?? 300000; // 默认 5 分钟
-        if (this.oidcIssuer) {
-            this.logger.info(`SP mode enabled, external IdP: ${this.oidcIssuer}, JWKS: ${this.jwksUrl}`);
+        if (this.idpUrl) {
+            this.logger.info(`SP mode enabled, external IdP: ${this.idpUrl}, JWKS: ${this.jwksUrl}`);
         }
         else {
             this.logger.info('Standard mode enabled, OIDC requests will pass through');

package/dist/identity/oidc/AutoDetectOidcHandler.js.map

@@ -1 +1 @@
-{"version":3,"file":"AutoDetectOidcHandler.js","sourceRoot":"","sources":["../../../src/identity/oidc/AutoDetectOidcHandler.ts"],"names":[],"mappings":";;;AAAA,uCAA+B;AAC/B,iEAAqD;AACrD,8DAKiC;AAgBjC;;;;;;;;GAQG;AACH,MAAa,qBAAsB,SAAQ,8BAAW;IAQpD,YAAY,UAAwC,EAAE;QACpD,KAAK,EAAE,CAAC;QARO,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAS3C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QAChG,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,wCAAwC,CAAC;QAC3E,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,UAAU;QAEpD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,IAAI,CAAC,UAAU,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/F,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED;;;;OAIG;IACa,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAoB;QAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;QAE9B,gBAAgB;QAChB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,0CAAuB,CAAC,qBAAqB,CAAC,CAAC;QAC3D,CAAC;QAED,8BAA8B;QAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,0CAAuB,CAAC,sCAAsC,CAAC,CAAC;QAC5E,CAAC;QAED,uBAAuB;QACvB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,0CAAuB,CAC/B,sBAAsB,IAAI,CAAC,OAAO,2CAA2C,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACa,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAoB;QACzD,eAAe;QACf,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,sCAAmB,CAAC,mEAAmE,CAAC,CAAC;QACrG,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YAEpC,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;YAC1B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YACvD,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,mBAAmB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1F,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAEnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAuB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YACpE,MAAM,IAAI,sCAAmB,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,SAAS;QACrB,OAAO;QACP,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACvC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAExD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE;YACpC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAyB,CAAC;QAErD,aAAa;QACb,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO;QACP,IAAI,CAAC,SAAS,GAAG;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO;SACrC,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,IAAI,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,GAAW;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;YAC9B,QAAQ,KAAK,mCAAmC;YAChD,QAAQ,KAAK,yCAAyC;YACtD,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAC7B,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,GAAW;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK,kBAAkB,CAAC;IACvE,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,GAAW;QAC7B,IAAI,CAAC;YACH,OAAO,IAAI,cAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;YAC3B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;CACF;AAnJD,sDAmJC","sourcesContent":["import { URL } from 'node:url';\nimport { getLoggerFor } from 'global-logger-factory';\nimport {\n  HttpHandler,\n  type HttpHandlerInput,\n  NotImplementedHttpError,\n  InternalServerError,\n} from '@solid/community-server';\n\nexport interface AutoDetectOidcHandlerOptions {\n  /** 外部 IdP 的基础 URL，如果提供则启用 SP 模式 */\n  oidcIssuer?: string;\n  /** 禁用原因说明 */\n  message?: string;\n  /** JWKS 缓存时间 (ms) */\n  cacheMs?: number;\n}\n\ninterface JwksCache {\n  keys: unknown[];\n  expiresAt: number;\n}\n\n/**\n * Auto-detect OIDC Handler\n *\n * 自动检测运行模式：\n * - 如果配置了 oidcIssuer -> SP 模式：禁用本地 OIDC，代理外部 IdP 的 JWKS\n * - 如果没有配置 oidcIssuer -> 标准模式：所有 OIDC 请求透传（由 CSS 默认 Handler 处理）\n *\n * 使用方式：在 HTTP pipeline 中替换默认的 OidcHandler\n */\nexport class AutoDetectOidcHandler extends HttpHandler {\n  private readonly logger = getLoggerFor(this);\n  private readonly oidcIssuer?: string;\n  private readonly jwksUrl?: string;\n  private readonly message: string;\n  private readonly cacheMs: number;\n  private jwksCache?: JwksCache;\n\n  constructor(options: AutoDetectOidcHandlerOptions = {}) {\n    super();\n    this.oidcIssuer = options.oidcIssuer;\n    this.jwksUrl = this.oidcIssuer ? `${this.oidcIssuer.replace(/\\/$/, '')}/.oidc/jwks` : undefined;\n    this.message = options.message ?? 'OIDC disabled in storage provider mode';\n    this.cacheMs = options.cacheMs ?? 300000; // 默认 5 分钟\n\n    if (this.oidcIssuer) {\n      this.logger.info(`SP mode enabled, external IdP: ${this.oidcIssuer}, JWKS: ${this.jwksUrl}`);\n    } else {\n      this.logger.info('Standard mode enabled, OIDC requests will pass through');\n    }\n  }\n\n  /**\n   * 判断是否处理请求\n   * - SP 模式：只处理 JWKS 请求，其他 OIDC 请求返回 501\n   * - 标准模式：不处理任何请求（透传给 CSS 默认 Handler）\n   */\n  public override async canHandle({ request }: HttpHandlerInput): Promise<void> {\n    const url = request.url ?? '';\n\n    // 检查是否是 OIDC 路径\n    if (!this.isOidcPath(url)) {\n      throw new NotImplementedHttpError('Not an OIDC request');\n    }\n\n    // 标准模式：不处理，透传给 CSS 默认 Handler\n    if (!this.jwksUrl) {\n      throw new NotImplementedHttpError('Pass through to default OIDC handler');\n    }\n\n    // SP 模式：只有 JWKS 请求可以处理\n    if (!this.isJwksPath(url)) {\n      throw new NotImplementedHttpError(\n        `External IdP mode: ${this.message}. Authentication handled by external IdP.`\n      );\n    }\n  }\n\n  /**\n   * 处理请求\n   * - SP 模式：代理 JWKS\n   * - 标准模式：不应该到达这里\n   */\n  public override async handle({ response }: HttpHandlerInput): Promise<void> {\n    // 标准模式：不应该到达这里\n    if (!this.jwksUrl) {\n      throw new InternalServerError('AutoDetectOidcHandler should not handle requests in standard mode');\n    }\n\n    try {\n      const jwks = await this.fetchJwks();\n\n      response.statusCode = 200;\n      response.setHeader('Content-Type', 'application/json');\n      response.setHeader('Cache-Control', `public, max-age=${Math.floor(this.cacheMs / 1000)}`);\n      response.end(JSON.stringify(jwks));\n\n      this.logger.debug('JWKS proxy successful');\n    } catch (error) {\n      this.logger.error(`JWKS proxy failed: ${(error as Error).message}`);\n      throw new InternalServerError('Failed to proxy JWKS request', { cause: error });\n    }\n  }\n\n  /**\n   * 获取并缓存 JWKS\n   */\n  private async fetchJwks(): Promise<{ keys: unknown[] }> {\n    // 检查缓存\n    if (this.jwksCache && this.jwksCache.expiresAt > Date.now()) {\n      this.logger.debug('Returning cached JWKS');\n      return { keys: this.jwksCache.keys };\n    }\n\n    if (!this.jwksUrl) {\n      throw new Error('External JWKS URL not configured');\n    }\n\n    this.logger.debug(`Fetching JWKS from ${this.jwksUrl}`);\n\n    const res = await fetch(this.jwksUrl, {\n      headers: { Accept: 'application/json' },\n    });\n\n    if (!res.ok) {\n      throw new Error(`Failed to fetch JWKS: ${res.status} ${res.statusText}`);\n    }\n\n    const jwks = await res.json() as { keys: unknown[] };\n\n    // 验证 JWKS 格式\n    if (!Array.isArray(jwks.keys)) {\n      throw new Error('Invalid JWKS format: missing keys array');\n    }\n\n    // 更新缓存\n    this.jwksCache = {\n      keys: jwks.keys,\n      expiresAt: Date.now() + this.cacheMs,\n    };\n\n    this.logger.debug(`JWKS cached with ${jwks.keys.length} keys`);\n    return jwks;\n  }\n\n  /**\n   * 检查是否是 OIDC 路径\n   */\n  private isOidcPath(url: string): boolean {\n    const pathname = this.getPathname(url);\n    return (\n      pathname.startsWith('/.oidc/') ||\n      pathname === '/.well-known/openid-configuration' ||\n      pathname === '/.well-known/oauth-authorization-server' ||\n      pathname.startsWith('/idp/')\n    );\n  }\n\n  /**\n   * 检查是否是 JWKS 路径\n   */\n  private isJwksPath(url: string): boolean {\n    const pathname = this.getPathname(url);\n    return pathname === '/.oidc/jwks' || pathname === '/.oidc/jwks.json';\n  }\n\n  /**\n   * 从 URL 提取 pathname\n   */\n  private getPathname(url: string): string {\n    try {\n      return new URL(url, 'http://localhost').pathname;\n    } catch {\n      // 如果解析失败，直接返回 url（可能是相对路径）\n      return url.split('?')[0];\n    }\n  }\n}\n"]}
+{"version":3,"file":"AutoDetectOidcHandler.js","sourceRoot":"","sources":["../../../src/identity/oidc/AutoDetectOidcHandler.ts"],"names":[],"mappings":";;;AAAA,uCAA+B;AAC/B,iEAAqD;AACrD,8DAKiC;AAgBjC;;;;;;;;GAQG;AACH,MAAa,qBAAsB,SAAQ,8BAAW;IAQpD,YAAY,UAAwC,EAAE;QACpD,KAAK,EAAE,CAAC;QARO,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAS3C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QACxF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,wCAAwC,CAAC;QAC3E,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,UAAU;QAEpD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,IAAI,CAAC,MAAM,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED;;;;OAIG;IACa,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAoB;QAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;QAE9B,gBAAgB;QAChB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,0CAAuB,CAAC,qBAAqB,CAAC,CAAC;QAC3D,CAAC;QAED,8BAA8B;QAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,0CAAuB,CAAC,sCAAsC,CAAC,CAAC;QAC5E,CAAC;QAED,uBAAuB;QACvB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,0CAAuB,CAC/B,sBAAsB,IAAI,CAAC,OAAO,2CAA2C,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACa,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAoB;QACzD,eAAe;QACf,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,sCAAmB,CAAC,mEAAmE,CAAC,CAAC;QACrG,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YAEpC,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;YAC1B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YACvD,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,mBAAmB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1F,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAEnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAuB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YACpE,MAAM,IAAI,sCAAmB,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,SAAS;QACrB,OAAO;QACP,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACvC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAExD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE;YACpC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAyB,CAAC;QAErD,aAAa;QACb,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO;QACP,IAAI,CAAC,SAAS,GAAG;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO;SACrC,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,IAAI,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,GAAW;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;YAC9B,QAAQ,KAAK,mCAAmC;YAChD,QAAQ,KAAK,yCAAyC;YACtD,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAC7B,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,GAAW;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK,kBAAkB,CAAC;IACvE,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,GAAW;QAC7B,IAAI,CAAC;YACH,OAAO,IAAI,cAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;YAC3B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;CACF;AAnJD,sDAmJC","sourcesContent":["import { URL } from 'node:url';\nimport { getLoggerFor } from 'global-logger-factory';\nimport {\n  HttpHandler,\n  type HttpHandlerInput,\n  NotImplementedHttpError,\n  InternalServerError,\n} from '@solid/community-server';\n\nexport interface AutoDetectOidcHandlerOptions {\n  /** 外部 IdP 的基础 URL，如果提供则启用 SP 模式 */\n  idpUrl?: string;\n  /** 禁用原因说明 */\n  message?: string;\n  /** JWKS 缓存时间 (ms) */\n  cacheMs?: number;\n}\n\ninterface JwksCache {\n  keys: unknown[];\n  expiresAt: number;\n}\n\n/**\n * Auto-detect OIDC Handler\n *\n * 自动检测运行模式：\n * - 如果配置了 idpUrl -> SP 模式：禁用本地 OIDC，代理外部 IdP 的 JWKS\n * - 如果没有配置 idpUrl -> 标准模式：所有 OIDC 请求透传（由 CSS 默认 Handler 处理）\n *\n * 使用方式：在 HTTP pipeline 中替换默认的 OidcHandler\n */\nexport class AutoDetectOidcHandler extends HttpHandler {\n  private readonly logger = getLoggerFor(this);\n  private readonly idpUrl?: string;\n  private readonly jwksUrl?: string;\n  private readonly message: string;\n  private readonly cacheMs: number;\n  private jwksCache?: JwksCache;\n\n  constructor(options: AutoDetectOidcHandlerOptions = {}) {\n    super();\n    this.idpUrl = options.idpUrl;\n    this.jwksUrl = this.idpUrl ? `${this.idpUrl.replace(/\\/$/, '')}/.oidc/jwks` : undefined;\n    this.message = options.message ?? 'OIDC disabled in storage provider mode';\n    this.cacheMs = options.cacheMs ?? 300000; // 默认 5 分钟\n\n    if (this.idpUrl) {\n      this.logger.info(`SP mode enabled, external IdP: ${this.idpUrl}, JWKS: ${this.jwksUrl}`);\n    } else {\n      this.logger.info('Standard mode enabled, OIDC requests will pass through');\n    }\n  }\n\n  /**\n   * 判断是否处理请求\n   * - SP 模式：只处理 JWKS 请求，其他 OIDC 请求返回 501\n   * - 标准模式：不处理任何请求（透传给 CSS 默认 Handler）\n   */\n  public override async canHandle({ request }: HttpHandlerInput): Promise<void> {\n    const url = request.url ?? '';\n\n    // 检查是否是 OIDC 路径\n    if (!this.isOidcPath(url)) {\n      throw new NotImplementedHttpError('Not an OIDC request');\n    }\n\n    // 标准模式：不处理，透传给 CSS 默认 Handler\n    if (!this.jwksUrl) {\n      throw new NotImplementedHttpError('Pass through to default OIDC handler');\n    }\n\n    // SP 模式：只有 JWKS 请求可以处理\n    if (!this.isJwksPath(url)) {\n      throw new NotImplementedHttpError(\n        `External IdP mode: ${this.message}. Authentication handled by external IdP.`\n      );\n    }\n  }\n\n  /**\n   * 处理请求\n   * - SP 模式：代理 JWKS\n   * - 标准模式：不应该到达这里\n   */\n  public override async handle({ response }: HttpHandlerInput): Promise<void> {\n    // 标准模式：不应该到达这里\n    if (!this.jwksUrl) {\n      throw new InternalServerError('AutoDetectOidcHandler should not handle requests in standard mode');\n    }\n\n    try {\n      const jwks = await this.fetchJwks();\n\n      response.statusCode = 200;\n      response.setHeader('Content-Type', 'application/json');\n      response.setHeader('Cache-Control', `public, max-age=${Math.floor(this.cacheMs / 1000)}`);\n      response.end(JSON.stringify(jwks));\n\n      this.logger.debug('JWKS proxy successful');\n    } catch (error) {\n      this.logger.error(`JWKS proxy failed: ${(error as Error).message}`);\n      throw new InternalServerError('Failed to proxy JWKS request', { cause: error });\n    }\n  }\n\n  /**\n   * 获取并缓存 JWKS\n   */\n  private async fetchJwks(): Promise<{ keys: unknown[] }> {\n    // 检查缓存\n    if (this.jwksCache && this.jwksCache.expiresAt > Date.now()) {\n      this.logger.debug('Returning cached JWKS');\n      return { keys: this.jwksCache.keys };\n    }\n\n    if (!this.jwksUrl) {\n      throw new Error('External JWKS URL not configured');\n    }\n\n    this.logger.debug(`Fetching JWKS from ${this.jwksUrl}`);\n\n    const res = await fetch(this.jwksUrl, {\n      headers: { Accept: 'application/json' },\n    });\n\n    if (!res.ok) {\n      throw new Error(`Failed to fetch JWKS: ${res.status} ${res.statusText}`);\n    }\n\n    const jwks = await res.json() as { keys: unknown[] };\n\n    // 验证 JWKS 格式\n    if (!Array.isArray(jwks.keys)) {\n      throw new Error('Invalid JWKS format: missing keys array');\n    }\n\n    // 更新缓存\n    this.jwksCache = {\n      keys: jwks.keys,\n      expiresAt: Date.now() + this.cacheMs,\n    };\n\n    this.logger.debug(`JWKS cached with ${jwks.keys.length} keys`);\n    return jwks;\n  }\n\n  /**\n   * 检查是否是 OIDC 路径\n   */\n  private isOidcPath(url: string): boolean {\n    const pathname = this.getPathname(url);\n    return (\n      pathname.startsWith('/.oidc/') ||\n      pathname === '/.well-known/openid-configuration' ||\n      pathname === '/.well-known/oauth-authorization-server' ||\n      pathname.startsWith('/idp/')\n    );\n  }\n\n  /**\n   * 检查是否是 JWKS 路径\n   */\n  private isJwksPath(url: string): boolean {\n    const pathname = this.getPathname(url);\n    return pathname === '/.oidc/jwks' || pathname === '/.oidc/jwks.json';\n  }\n\n  /**\n   * 从 URL 提取 pathname\n   */\n  private getPathname(url: string): string {\n    try {\n      return new URL(url, 'http://localhost').pathname;\n    } catch {\n      // 如果解析失败，直接返回 url（可能是相对路径）\n      return url.split('?')[0];\n    }\n  }\n}\n"]}

package/dist/identity/oidc/AutoDetectOidcHandler.jsonld

@@ -12,10 +12,10 @@
       "extends": [
         "css:dist/server/HttpHandler.jsonld#HttpHandler"
       ],
-      "comment": "Auto-detect OIDC Handler  自动检测运行模式： - 如果配置了 oidcIssuer -> SP 模式：禁用本地 OIDC，代理外部 IdP 的 JWKS - 如果没有配置 oidcIssuer -> 标准模式：所有 OIDC 请求透传（由 CSS 默认 Handler 处理）  使用方式：在 HTTP pipeline 中替换默认的 OidcHandler",
+      "comment": "Auto-detect OIDC Handler  自动检测运行模式： - 如果配置了 idpUrl -> SP 模式：禁用本地 OIDC，代理外部 IdP 的 JWKS - 如果没有配置 idpUrl -> 标准模式：所有 OIDC 请求透传（由 CSS 默认 Handler 处理）  使用方式：在 HTTP pipeline 中替换默认的 OidcHandler",
       "parameters": [
         {
-          "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler_options_oidcIssuer",
+          "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler_options_idpUrl",
           "range": {
             "@type": "ParameterRangeUnion",
             "parameterRangeElements": [
@@ -60,8 +60,8 @@
           "memberFieldName": "logger"
         },
         {
-          "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler__member_oidcIssuer",
-          "memberFieldName": "oidcIssuer"
+          "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler__member_idpUrl",
+          "memberFieldName": "idpUrl"
         },
         {
           "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler__member_jwksUrl",
@@ -113,9 +113,9 @@
           "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler_options__constructorArgument",
           "fields": [
             {
-              "keyRaw": "oidcIssuer",
+              "keyRaw": "idpUrl",
               "value": {
-                "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler_options_oidcIssuer"
+                "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler_options_idpUrl"
               }
             },
             {

package/dist/main.js

@@ -13,6 +13,8 @@ const global_logger_factory_1 = require("global-logger-factory");
 const yargs_1 = __importDefault(require("yargs"));
 const helpers_1 = require("yargs/helpers");
 const runtime_1 = require("./runtime");
+const css_process_1 = require("./runtime/css-process");
+const oidc_issuer_1 = require("./runtime/oidc-issuer");
 const ConfigurableLoggerFactory_1 = require("./logging/ConfigurableLoggerFactory");
 const supervisor_1 = require("./supervisor");
 const EXIT_OK = 0;
@@ -218,21 +220,23 @@ async function startRuntime(options) {
     logger.info(`  - API (internal): http://localhost:${apiPort}`);
     const supervisor = new supervisor_1.Supervisor();
     const cssBinary = require.resolve('@solid/community-server/bin/server.js');
+    const cssModuleRoot = path_1.default.dirname(require.resolve('@solid/community-server/package.json'));
+    const externalOidcIssuer = (0, oidc_issuer_1.resolveExternalOidcIssuer)(process.env);
+    if (externalOidcIssuer) {
+        logger.info(`  - SP mode external IdP: ${externalOidcIssuer}`);
+    }
     supervisor.register({
         name: 'css',
         command: childJsRuntime,
-        args: [
+        args: (0, css_process_1.buildCssArgs)({
             cssBinary,
-            '-c', configPath,
-            '-m', runtime_1.PACKAGE_ROOT,
-            '-p', cssPort.toString(),
-            '-b', baseUrl,
-        ],
-        env: {
-            ...process.env,
-            CSS_PORT: cssPort.toString(),
-            CSS_BASE_URL: baseUrl,
-        },
+            configPath,
+            cssModuleRoot,
+            cssPort,
+            baseUrl,
+            externalOidcIssuer,
+        }),
+        env: (0, css_process_1.buildCssChildEnv)(baseUrl, cssPort),
     });
     // API server: resolve the entry point dynamically
     // In dev (ts-node): use ts-node to run the .ts file
@@ -249,14 +253,13 @@ async function startRuntime(options) {
         name: 'api',
         command: childJsRuntime,
         args: apiArgs,
-        env: {
-            ...process.env,
-            API_PORT: apiPort.toString(),
-            XPOD_MAIN_PORT: mainPort.toString(),
-            CSS_INTERNAL_URL: `http://localhost:${cssPort}`,
-            CSS_BASE_URL: baseUrl,
-            CSS_TOKEN_ENDPOINT: `${baseUrl}.oidc/token`,
-        },
+        env: (0, css_process_1.buildApiChildEnv)({
+            apiPort,
+            mainPort,
+            cssPort,
+            baseUrl,
+            externalOidcIssuer,
+        }),
     });
     // Bind host: use CLI --host value; if not explicitly set, derive from the public Base URL.
     // In local dev/sandboxed environments, binding 0.0.0.0 can fail with EPERM.