@web-ts-toolkit/express-oidc-vault 0.28.0

package/index.d.mts

@@ -0,0 +1,258 @@
+import { Request, Response, RequestHandler, Router } from 'express';
+import { KeyObject } from 'node:crypto';
+import { JWK } from 'jose';
+
+type OidcVaultRouteName = 'login' | 'callback' | 'exchange' | 'refresh' | 'logout' | 'backchannel-logout';
+interface OidcVaultUserProfile {
+    sub: string;
+    email?: string;
+    name?: string;
+    preferredUsername?: string;
+    [key: string]: unknown;
+}
+interface OidcVaultProviderMetadata {
+    issuer?: string;
+    clientId?: string;
+}
+interface OidcVaultSession {
+    sessionId: string;
+    subject: string;
+    providerSessionId?: string;
+    provider?: OidcVaultProviderMetadata;
+    refreshToken: string;
+    idToken: string;
+    accessToken?: string;
+    scope?: string;
+    expiresAt?: number;
+    createdAt: number;
+    updatedAt: number;
+    user?: OidcVaultUserProfile;
+    metadata?: Record<string, unknown>;
+}
+interface AuthorizationTransactionInput {
+    state: string;
+    nonce: string;
+    pkceVerifier: string;
+    codeChallenge: string;
+    returnTo?: string;
+    createdAt: number;
+    expiresAt: number;
+    metadata?: Record<string, unknown>;
+}
+type AuthorizationTransaction = AuthorizationTransactionInput;
+interface ExchangeCodeRecordInput {
+    code: string;
+    sessionId: string;
+    returnTo?: string;
+    createdAt: number;
+    expiresAt: number;
+}
+type ExchangeCodeRecord = ExchangeCodeRecordInput;
+interface OidcVaultSessionInput extends Omit<OidcVaultSession, 'createdAt' | 'updatedAt'> {
+    createdAt?: number;
+    updatedAt?: number;
+}
+interface RotateSessionInput {
+    sessionId: string;
+    nextSession: OidcVaultSession;
+}
+interface DeleteSessionsBySubjectInput {
+    subject: string;
+    issuer?: string;
+    clientId?: string;
+}
+interface DeleteSessionsByProviderSessionIdInput {
+    providerSessionId: string;
+    issuer?: string;
+    clientId?: string;
+}
+declare class OidcVaultStoreConflictError extends Error {
+    constructor(message?: string);
+}
+interface OidcVaultStoreProvider {
+    createAuthorizationTransaction(input: AuthorizationTransactionInput): Promise<void>;
+    consumeAuthorizationTransaction(state: string): Promise<AuthorizationTransaction | null>;
+    createExchangeCode(input: ExchangeCodeRecordInput): Promise<void>;
+    consumeExchangeCode(code: string): Promise<ExchangeCodeRecord | null>;
+    createSession(input: OidcVaultSessionInput): Promise<OidcVaultSession>;
+    getSession(sessionId: string): Promise<OidcVaultSession | null>;
+    rotateSession(input: RotateSessionInput): Promise<OidcVaultSession>;
+    deleteSession(sessionId: string): Promise<void>;
+    deleteSessionsBySubject(input: string | DeleteSessionsBySubjectInput): Promise<number>;
+    deleteSessionsByProviderSessionId(input: string | DeleteSessionsByProviderSessionIdInput): Promise<number>;
+}
+interface OidcVaultHookContext {
+    route: OidcVaultRouteName;
+    req: Request;
+    res: Response;
+    session?: OidcVaultSession;
+    metadata?: Record<string, unknown>;
+}
+interface OidcVaultErrorContext extends OidcVaultHookContext {
+    error: unknown;
+}
+interface OidcVaultHooks {
+    onLoginStart?(context: OidcVaultHookContext): void | Promise<void>;
+    onAuthorizationUrl?(context: OidcVaultHookContext): void | Promise<void>;
+    onCallbackTokens?(context: OidcVaultHookContext): void | Promise<void>;
+    onUserInfo?(context: OidcVaultHookContext): void | Promise<void>;
+    onBeforeSessionCreate?(context: OidcVaultHookContext): void | Promise<void>;
+    onSessionCreated?(context: OidcVaultHookContext): void | Promise<void>;
+    onSessionRefreshed?(context: OidcVaultHookContext): void | Promise<void>;
+    onBeforeLogout?(context: OidcVaultHookContext): void | Promise<void>;
+    onLogout?(context: OidcVaultHookContext): void | Promise<void>;
+    onError?(context: OidcVaultErrorContext): void | Promise<void>;
+}
+interface IssueTokenInput {
+    session: OidcVaultSession;
+    req: Request;
+    res: Response;
+}
+interface OidcVaultTokenIssueResult {
+    accessToken: string;
+    expiresIn: number;
+    tokenType?: 'Bearer';
+}
+interface OidcVaultTokenIssuer {
+    issue(input: IssueTokenInput): Promise<OidcVaultTokenIssueResult>;
+}
+interface OidcVaultAccessTokenValidationResult {
+    subject: string;
+    sessionId?: string;
+    scope?: string;
+    claims?: Record<string, unknown>;
+}
+interface OidcVaultAuthContext extends OidcVaultAccessTokenValidationResult {
+    token: string;
+}
+interface OidcVaultAccessTokenValidator {
+    validate(token: string): Promise<OidcVaultAccessTokenValidationResult>;
+}
+interface OidcVaultAccessTokenMiddlewareOptions {
+    validator: OidcVaultAccessTokenValidator;
+    onAuthContext?(input: {
+        req: Request;
+        res: Response;
+        auth: OidcVaultAuthContext;
+    }): void | Promise<void>;
+}
+interface OidcVaultAuthenticatedRequest extends Request {
+    auth?: OidcVaultAuthContext;
+}
+interface OidcVaultJwtAccessTokenValidatorOptions {
+    key: CryptoKey | KeyObject | JWK | Uint8Array;
+    issuer?: string;
+    audience?: string | string[];
+    algorithms?: string[];
+    mapClaims?(claims: Record<string, unknown>): OidcVaultAccessTokenValidationResult;
+}
+declare module 'express' {
+    interface Request {
+        auth?: OidcVaultAuthContext;
+    }
+}
+interface OidcVaultConfig {
+    issuer?: string;
+    authorizationEndpoint?: string;
+    tokenEndpoint?: string;
+    userInfoEndpoint?: string;
+    jwksUri?: string;
+    endSessionEndpoint?: string;
+    clientId?: string;
+    clientSecret?: string;
+    scopes?: string;
+}
+interface OidcVaultLogoutResult {
+    loggedOut: true;
+    upstreamLogoutUrl?: string;
+}
+interface OidcVaultBackchannelLogoutResult {
+    loggedOut: true;
+    revokedSessions: number;
+}
+interface OidcVaultExchangeResult extends Partial<OidcVaultTokenIssueResult> {
+    sessionId?: string;
+    user?: OidcVaultUserProfile;
+}
+type OidcVaultSessionTransport = 'body' | 'cookie';
+type OidcVaultCookieDeploymentMode = 'same-origin' | 'same-site' | 'cross-site';
+type OidcVaultCookieSameSite = 'lax' | 'strict' | 'none';
+interface OidcVaultCookieOptions {
+    name?: string;
+    deploymentMode?: OidcVaultCookieDeploymentMode;
+    sameSite?: OidcVaultCookieSameSite;
+    secure?: boolean;
+    domain?: string;
+    path?: string;
+    httpOnly?: boolean;
+}
+interface OidcVaultOptions {
+    basePath?: string;
+    storeProvider: OidcVaultStoreProvider;
+    config?: OidcVaultConfig;
+    hooks?: OidcVaultHooks;
+    tokenIssuer?: OidcVaultTokenIssuer;
+    frontendRedirectUri?: string;
+    postLogoutRedirectUri?: string;
+    fetchUserInfo?: boolean;
+    authorizationTransactionTtlMs?: number;
+    exchangeCodeTtlMs?: number;
+    sessionTransport?: OidcVaultSessionTransport;
+    cookie?: OidcVaultCookieOptions;
+    trustedOrigins?: string[];
+    now?: () => number;
+}
+
+declare const DEFAULT_OIDC_SCOPES = "openid email profile";
+type OidcVaultConfigMode = 'issuer' | 'manual';
+interface OidcVaultResolvedConfig extends Omit<OidcVaultConfig, 'scopes'> {
+    mode: OidcVaultConfigMode;
+    scopes: string;
+}
+interface OidcVaultEnv {
+    OIDC_ISSUER?: string;
+    OIDC_AUTHORIZATION_ENDPOINT?: string;
+    OIDC_TOKEN_ENDPOINT?: string;
+    OIDC_USERINFO_ENDPOINT?: string;
+    OIDC_JWKS_URI?: string;
+    OIDC_END_SESSION_ENDPOINT?: string;
+    OIDC_CLIENT_ID?: string;
+    OIDC_CLIENT_SECRET?: string;
+    OIDC_SCOPES?: string;
+}
+/**
+ * Resolve OIDC configuration from application input. If an issuer URL is
+ * present, explicit endpoint fields are ignored and discovery mode wins.
+ */
+declare function resolveOidcVaultConfig(config?: OidcVaultConfig): OidcVaultResolvedConfig;
+/**
+ * Resolve OIDC configuration from the documented environment variables.
+ */
+declare function resolveOidcVaultConfigFromEnv(env?: OidcVaultEnv): OidcVaultResolvedConfig;
+
+declare const DEFAULT_OIDC_VAULT_BASE_PATH = "/auth/oidc";
+declare const DEFAULT_AUTHORIZATION_TRANSACTION_TTL_MS: number;
+declare const DEFAULT_EXCHANGE_CODE_TTL_MS: number;
+declare const DEFAULT_SESSION_COOKIE_NAME = "oidc_vault_session";
+declare const OIDC_VAULT_ROUTE_PATHS: Record<OidcVaultRouteName, string>;
+/**
+ * Normalize the mounted base path for the OIDC router.
+ */
+declare function normalizeOidcVaultBasePath(value?: string): string;
+/**
+ * Create a JWT-based access-token validator for use with
+ * `createOidcVaultAccessTokenMiddleware(...)`.
+ */
+declare function createOidcVaultJwtAccessTokenValidator(options: OidcVaultJwtAccessTokenValidatorOptions): {
+    validate(token: string): Promise<OidcVaultAccessTokenValidationResult>;
+};
+/**
+ * Create bearer-token validation middleware for app-issued access tokens.
+ */
+declare function createOidcVaultAccessTokenMiddleware(options: OidcVaultAccessTokenMiddlewareOptions): RequestHandler;
+/**
+ * Create the core OIDC vault middleware.
+ */
+declare function createOidcVaultMiddleware(options: OidcVaultOptions): Router;
+
+export { type AuthorizationTransaction, type AuthorizationTransactionInput, DEFAULT_AUTHORIZATION_TRANSACTION_TTL_MS, DEFAULT_EXCHANGE_CODE_TTL_MS, DEFAULT_OIDC_SCOPES, DEFAULT_OIDC_VAULT_BASE_PATH, DEFAULT_SESSION_COOKIE_NAME, type DeleteSessionsByProviderSessionIdInput, type DeleteSessionsBySubjectInput, type ExchangeCodeRecord, type ExchangeCodeRecordInput, type IssueTokenInput, OIDC_VAULT_ROUTE_PATHS, type OidcVaultAccessTokenMiddlewareOptions, type OidcVaultAccessTokenValidationResult, type OidcVaultAccessTokenValidator, type OidcVaultAuthContext, type OidcVaultAuthenticatedRequest, type OidcVaultBackchannelLogoutResult, type OidcVaultConfig, type OidcVaultConfigMode, type OidcVaultCookieDeploymentMode, type OidcVaultCookieOptions, type OidcVaultCookieSameSite, type OidcVaultEnv, type OidcVaultErrorContext, type OidcVaultExchangeResult, type OidcVaultHookContext, type OidcVaultHooks, type OidcVaultJwtAccessTokenValidatorOptions, type OidcVaultLogoutResult, type OidcVaultOptions, type OidcVaultProviderMetadata, type OidcVaultResolvedConfig, type OidcVaultRouteName, type OidcVaultSession, type OidcVaultSessionInput, type OidcVaultSessionTransport, OidcVaultStoreConflictError, type OidcVaultStoreProvider, type OidcVaultTokenIssueResult, type OidcVaultTokenIssuer, type OidcVaultUserProfile, type RotateSessionInput, createOidcVaultAccessTokenMiddleware, createOidcVaultJwtAccessTokenValidator, createOidcVaultMiddleware, normalizeOidcVaultBasePath, resolveOidcVaultConfig, resolveOidcVaultConfigFromEnv };

package/index.d.ts

@@ -0,0 +1,258 @@
+import { Request, Response, RequestHandler, Router } from 'express';
+import { KeyObject } from 'node:crypto';
+import { JWK } from 'jose';
+
+type OidcVaultRouteName = 'login' | 'callback' | 'exchange' | 'refresh' | 'logout' | 'backchannel-logout';
+interface OidcVaultUserProfile {
+    sub: string;
+    email?: string;
+    name?: string;
+    preferredUsername?: string;
+    [key: string]: unknown;
+}
+interface OidcVaultProviderMetadata {
+    issuer?: string;
+    clientId?: string;
+}
+interface OidcVaultSession {
+    sessionId: string;
+    subject: string;
+    providerSessionId?: string;
+    provider?: OidcVaultProviderMetadata;
+    refreshToken: string;
+    idToken: string;
+    accessToken?: string;
+    scope?: string;
+    expiresAt?: number;
+    createdAt: number;
+    updatedAt: number;
+    user?: OidcVaultUserProfile;
+    metadata?: Record<string, unknown>;
+}
+interface AuthorizationTransactionInput {
+    state: string;
+    nonce: string;
+    pkceVerifier: string;
+    codeChallenge: string;
+    returnTo?: string;
+    createdAt: number;
+    expiresAt: number;
+    metadata?: Record<string, unknown>;
+}
+type AuthorizationTransaction = AuthorizationTransactionInput;
+interface ExchangeCodeRecordInput {
+    code: string;
+    sessionId: string;
+    returnTo?: string;
+    createdAt: number;
+    expiresAt: number;
+}
+type ExchangeCodeRecord = ExchangeCodeRecordInput;
+interface OidcVaultSessionInput extends Omit<OidcVaultSession, 'createdAt' | 'updatedAt'> {
+    createdAt?: number;
+    updatedAt?: number;
+}
+interface RotateSessionInput {
+    sessionId: string;
+    nextSession: OidcVaultSession;
+}
+interface DeleteSessionsBySubjectInput {
+    subject: string;
+    issuer?: string;
+    clientId?: string;
+}
+interface DeleteSessionsByProviderSessionIdInput {
+    providerSessionId: string;
+    issuer?: string;
+    clientId?: string;
+}
+declare class OidcVaultStoreConflictError extends Error {
+    constructor(message?: string);
+}
+interface OidcVaultStoreProvider {
+    createAuthorizationTransaction(input: AuthorizationTransactionInput): Promise<void>;
+    consumeAuthorizationTransaction(state: string): Promise<AuthorizationTransaction | null>;
+    createExchangeCode(input: ExchangeCodeRecordInput): Promise<void>;
+    consumeExchangeCode(code: string): Promise<ExchangeCodeRecord | null>;
+    createSession(input: OidcVaultSessionInput): Promise<OidcVaultSession>;
+    getSession(sessionId: string): Promise<OidcVaultSession | null>;
+    rotateSession(input: RotateSessionInput): Promise<OidcVaultSession>;
+    deleteSession(sessionId: string): Promise<void>;
+    deleteSessionsBySubject(input: string | DeleteSessionsBySubjectInput): Promise<number>;
+    deleteSessionsByProviderSessionId(input: string | DeleteSessionsByProviderSessionIdInput): Promise<number>;
+}
+interface OidcVaultHookContext {
+    route: OidcVaultRouteName;
+    req: Request;
+    res: Response;
+    session?: OidcVaultSession;
+    metadata?: Record<string, unknown>;
+}
+interface OidcVaultErrorContext extends OidcVaultHookContext {
+    error: unknown;
+}
+interface OidcVaultHooks {
+    onLoginStart?(context: OidcVaultHookContext): void | Promise<void>;
+    onAuthorizationUrl?(context: OidcVaultHookContext): void | Promise<void>;
+    onCallbackTokens?(context: OidcVaultHookContext): void | Promise<void>;
+    onUserInfo?(context: OidcVaultHookContext): void | Promise<void>;
+    onBeforeSessionCreate?(context: OidcVaultHookContext): void | Promise<void>;
+    onSessionCreated?(context: OidcVaultHookContext): void | Promise<void>;
+    onSessionRefreshed?(context: OidcVaultHookContext): void | Promise<void>;
+    onBeforeLogout?(context: OidcVaultHookContext): void | Promise<void>;
+    onLogout?(context: OidcVaultHookContext): void | Promise<void>;
+    onError?(context: OidcVaultErrorContext): void | Promise<void>;
+}
+interface IssueTokenInput {
+    session: OidcVaultSession;
+    req: Request;
+    res: Response;
+}
+interface OidcVaultTokenIssueResult {
+    accessToken: string;
+    expiresIn: number;
+    tokenType?: 'Bearer';
+}
+interface OidcVaultTokenIssuer {
+    issue(input: IssueTokenInput): Promise<OidcVaultTokenIssueResult>;
+}
+interface OidcVaultAccessTokenValidationResult {
+    subject: string;
+    sessionId?: string;
+    scope?: string;
+    claims?: Record<string, unknown>;
+}
+interface OidcVaultAuthContext extends OidcVaultAccessTokenValidationResult {
+    token: string;
+}
+interface OidcVaultAccessTokenValidator {
+    validate(token: string): Promise<OidcVaultAccessTokenValidationResult>;
+}
+interface OidcVaultAccessTokenMiddlewareOptions {
+    validator: OidcVaultAccessTokenValidator;
+    onAuthContext?(input: {
+        req: Request;
+        res: Response;
+        auth: OidcVaultAuthContext;
+    }): void | Promise<void>;
+}
+interface OidcVaultAuthenticatedRequest extends Request {
+    auth?: OidcVaultAuthContext;
+}
+interface OidcVaultJwtAccessTokenValidatorOptions {
+    key: CryptoKey | KeyObject | JWK | Uint8Array;
+    issuer?: string;
+    audience?: string | string[];
+    algorithms?: string[];
+    mapClaims?(claims: Record<string, unknown>): OidcVaultAccessTokenValidationResult;
+}
+declare module 'express' {
+    interface Request {
+        auth?: OidcVaultAuthContext;
+    }
+}
+interface OidcVaultConfig {
+    issuer?: string;
+    authorizationEndpoint?: string;
+    tokenEndpoint?: string;
+    userInfoEndpoint?: string;
+    jwksUri?: string;
+    endSessionEndpoint?: string;
+    clientId?: string;
+    clientSecret?: string;
+    scopes?: string;
+}
+interface OidcVaultLogoutResult {
+    loggedOut: true;
+    upstreamLogoutUrl?: string;
+}
+interface OidcVaultBackchannelLogoutResult {
+    loggedOut: true;
+    revokedSessions: number;
+}
+interface OidcVaultExchangeResult extends Partial<OidcVaultTokenIssueResult> {
+    sessionId?: string;
+    user?: OidcVaultUserProfile;
+}
+type OidcVaultSessionTransport = 'body' | 'cookie';
+type OidcVaultCookieDeploymentMode = 'same-origin' | 'same-site' | 'cross-site';
+type OidcVaultCookieSameSite = 'lax' | 'strict' | 'none';
+interface OidcVaultCookieOptions {
+    name?: string;
+    deploymentMode?: OidcVaultCookieDeploymentMode;
+    sameSite?: OidcVaultCookieSameSite;
+    secure?: boolean;
+    domain?: string;
+    path?: string;
+    httpOnly?: boolean;
+}
+interface OidcVaultOptions {
+    basePath?: string;
+    storeProvider: OidcVaultStoreProvider;
+    config?: OidcVaultConfig;
+    hooks?: OidcVaultHooks;
+    tokenIssuer?: OidcVaultTokenIssuer;
+    frontendRedirectUri?: string;
+    postLogoutRedirectUri?: string;
+    fetchUserInfo?: boolean;
+    authorizationTransactionTtlMs?: number;
+    exchangeCodeTtlMs?: number;
+    sessionTransport?: OidcVaultSessionTransport;
+    cookie?: OidcVaultCookieOptions;
+    trustedOrigins?: string[];
+    now?: () => number;
+}
+
+declare const DEFAULT_OIDC_SCOPES = "openid email profile";
+type OidcVaultConfigMode = 'issuer' | 'manual';
+interface OidcVaultResolvedConfig extends Omit<OidcVaultConfig, 'scopes'> {
+    mode: OidcVaultConfigMode;
+    scopes: string;
+}
+interface OidcVaultEnv {
+    OIDC_ISSUER?: string;
+    OIDC_AUTHORIZATION_ENDPOINT?: string;
+    OIDC_TOKEN_ENDPOINT?: string;
+    OIDC_USERINFO_ENDPOINT?: string;
+    OIDC_JWKS_URI?: string;
+    OIDC_END_SESSION_ENDPOINT?: string;
+    OIDC_CLIENT_ID?: string;
+    OIDC_CLIENT_SECRET?: string;
+    OIDC_SCOPES?: string;
+}
+/**
+ * Resolve OIDC configuration from application input. If an issuer URL is
+ * present, explicit endpoint fields are ignored and discovery mode wins.
+ */
+declare function resolveOidcVaultConfig(config?: OidcVaultConfig): OidcVaultResolvedConfig;
+/**
+ * Resolve OIDC configuration from the documented environment variables.
+ */
+declare function resolveOidcVaultConfigFromEnv(env?: OidcVaultEnv): OidcVaultResolvedConfig;
+
+declare const DEFAULT_OIDC_VAULT_BASE_PATH = "/auth/oidc";
+declare const DEFAULT_AUTHORIZATION_TRANSACTION_TTL_MS: number;
+declare const DEFAULT_EXCHANGE_CODE_TTL_MS: number;
+declare const DEFAULT_SESSION_COOKIE_NAME = "oidc_vault_session";
+declare const OIDC_VAULT_ROUTE_PATHS: Record<OidcVaultRouteName, string>;
+/**
+ * Normalize the mounted base path for the OIDC router.
+ */
+declare function normalizeOidcVaultBasePath(value?: string): string;
+/**
+ * Create a JWT-based access-token validator for use with
+ * `createOidcVaultAccessTokenMiddleware(...)`.
+ */
+declare function createOidcVaultJwtAccessTokenValidator(options: OidcVaultJwtAccessTokenValidatorOptions): {
+    validate(token: string): Promise<OidcVaultAccessTokenValidationResult>;
+};
+/**
+ * Create bearer-token validation middleware for app-issued access tokens.
+ */
+declare function createOidcVaultAccessTokenMiddleware(options: OidcVaultAccessTokenMiddlewareOptions): RequestHandler;
+/**
+ * Create the core OIDC vault middleware.
+ */
+declare function createOidcVaultMiddleware(options: OidcVaultOptions): Router;
+
+export { type AuthorizationTransaction, type AuthorizationTransactionInput, DEFAULT_AUTHORIZATION_TRANSACTION_TTL_MS, DEFAULT_EXCHANGE_CODE_TTL_MS, DEFAULT_OIDC_SCOPES, DEFAULT_OIDC_VAULT_BASE_PATH, DEFAULT_SESSION_COOKIE_NAME, type DeleteSessionsByProviderSessionIdInput, type DeleteSessionsBySubjectInput, type ExchangeCodeRecord, type ExchangeCodeRecordInput, type IssueTokenInput, OIDC_VAULT_ROUTE_PATHS, type OidcVaultAccessTokenMiddlewareOptions, type OidcVaultAccessTokenValidationResult, type OidcVaultAccessTokenValidator, type OidcVaultAuthContext, type OidcVaultAuthenticatedRequest, type OidcVaultBackchannelLogoutResult, type OidcVaultConfig, type OidcVaultConfigMode, type OidcVaultCookieDeploymentMode, type OidcVaultCookieOptions, type OidcVaultCookieSameSite, type OidcVaultEnv, type OidcVaultErrorContext, type OidcVaultExchangeResult, type OidcVaultHookContext, type OidcVaultHooks, type OidcVaultJwtAccessTokenValidatorOptions, type OidcVaultLogoutResult, type OidcVaultOptions, type OidcVaultProviderMetadata, type OidcVaultResolvedConfig, type OidcVaultRouteName, type OidcVaultSession, type OidcVaultSessionInput, type OidcVaultSessionTransport, OidcVaultStoreConflictError, type OidcVaultStoreProvider, type OidcVaultTokenIssueResult, type OidcVaultTokenIssuer, type OidcVaultUserProfile, type RotateSessionInput, createOidcVaultAccessTokenMiddleware, createOidcVaultJwtAccessTokenValidator, createOidcVaultMiddleware, normalizeOidcVaultBasePath, resolveOidcVaultConfig, resolveOidcVaultConfigFromEnv };