@willyim/idp 0.1.1 → 0.3.0

package/dist/src/wire.d.ts

@@ -0,0 +1,164 @@
+/**
+ * The OIDC wire, as zod schemas: discovery, the token endpoint, and the claim
+ * set. These are not in `./schemas` with the management API because they are
+ * standards-defined — nothing generates them, and they never appear in our
+ * OpenAPI document.
+ *
+ * Two different postures live here on purpose:
+ *
+ *  - **Strict** on anything we act on. Without `token_endpoint` there is no
+ *    flow to run, and an `access_token` that is absent must not become `""`
+ *    and get written to a session row.
+ *  - **Tolerant** on claims. A user with no permissions, no workspaces, or no
+ *    display name is ordinary, not an error — those degrade to empty. Only
+ *    `sub` is genuinely required, since it is the identity.
+ *
+ * Unknown fields pass through everywhere: an IdP is allowed to grow.
+ */
+import { z } from "zod";
+export declare const PERMISSIONS_CLAIM = "https://willy.im/permissions";
+export declare const WORKSPACES_CLAIM = "https://willy.im/workspaces";
+/** The subset of the discovery document we use, plus the fields we may. */
+export declare const DiscoverySchema: z.ZodObject<{
+    issuer: z.ZodString;
+    authorization_endpoint: z.ZodString;
+    token_endpoint: z.ZodString;
+    userinfo_endpoint: z.ZodString;
+    end_session_endpoint: z.ZodOptional<z.ZodString>;
+    jwks_uri: z.ZodOptional<z.ZodString>;
+    /**
+     * Per-app session ceiling, in seconds. Not standard OIDC — an IdP extension
+     * the SDK clamps `session.expiresIn` against when present.
+     */
+    session_max_age: z.ZodOptional<z.ZodNumber>;
+}, z.core.$loose>;
+export type Discovery = z.output<typeof DiscoverySchema>;
+/** Token-endpoint output, camelCased so app code never sees the wire shape. */
+export declare const TokensSchema: z.ZodPipe<z.ZodObject<{
+    access_token: z.ZodString;
+    token_type: z.ZodDefault<z.ZodString>;
+    expires_in: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    refresh_token: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    id_token: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    scope: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$loose>, z.ZodTransform<{
+    accessToken: string;
+    tokenType: string;
+    /** Seconds until the access token expires, when the IdP says. */
+    expiresIn: number | null;
+    refreshToken: string | null;
+    idToken: string | null;
+    scope: string | null;
+}, {
+    [x: string]: unknown;
+    access_token: string;
+    token_type: string;
+    expires_in?: number | null | undefined;
+    refresh_token?: string | null | undefined;
+    id_token?: string | null | undefined;
+    scope?: string | null | undefined;
+}>>;
+export type Tokens = z.output<typeof TokensSchema>;
+/** A tenant inside THIS app. `domain` is set for multi-domain apps, else null. */
+export declare const WorkspaceSchema: z.ZodObject<{
+    id: z.ZodString;
+    slug: z.ZodDefault<z.ZodString>;
+    name: z.ZodDefault<z.ZodString>;
+    domain: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | null, string | null | undefined>>;
+    role: z.ZodDefault<z.ZodString>;
+}, z.core.$loose>;
+export type Workspace = z.output<typeof WorkspaceSchema>;
+/**
+ * The RFC 8693 `act` claim: present while an IdP admin is impersonating the
+ * user. Audit-only — tag your logs with it, never branch authorization on it.
+ */
+export declare const ActorSchema: z.ZodObject<{
+    sub: z.ZodString;
+    email: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
+export type Actor = z.output<typeof ActorSchema>;
+/**
+ * Wire claims -> `Claims`. The `https://willy.im/*` namespace is unwrapped
+ * here: namespaced URI claims are an OIDC requirement, not something app code
+ * should ever have to type.
+ */
+export declare const ClaimsSchema: z.ZodPipe<z.ZodObject<{
+    sub: z.ZodString;
+    email: z.ZodCatch<z.ZodString>;
+    email_verified: z.ZodCatch<z.ZodBoolean>;
+    name: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+    picture: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+    image: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
+    "https://willy.im/permissions": z.ZodPipe<z.ZodCatch<z.ZodArray<z.ZodCatch<z.ZodNullable<z.ZodString>>>>, z.ZodTransform<string[], (string | null)[]>>;
+    "https://willy.im/workspaces": z.ZodPipe<z.ZodCatch<z.ZodArray<z.ZodCatch<z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        slug: z.ZodDefault<z.ZodString>;
+        name: z.ZodDefault<z.ZodString>;
+        domain: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | null, string | null | undefined>>;
+        role: z.ZodDefault<z.ZodString>;
+    }, z.core.$loose>>>>>, z.ZodTransform<{
+        [x: string]: unknown;
+        id: string;
+        slug: string;
+        name: string;
+        domain: string | null;
+        role: string;
+    }[], ({
+        [x: string]: unknown;
+        id: string;
+        slug: string;
+        name: string;
+        domain: string | null;
+        role: string;
+    } | null)[]>>;
+    act: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        sub: z.ZodString;
+        email: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>>>;
+}, z.core.$loose>, z.ZodTransform<{
+    sub: string;
+    email: string;
+    emailVerified: boolean;
+    name: string | null;
+    image: string | null;
+    /** Product permissions granted in this app. Unwrapped from the namespace. */
+    permissions: string[];
+    /** Workspaces the user belongs to in this app. Unwrapped from the namespace. */
+    workspaces: {
+        [x: string]: unknown;
+        id: string;
+        slug: string;
+        name: string;
+        domain: string | null;
+        role: string;
+    }[];
+    actor: {
+        [x: string]: unknown;
+        sub: string;
+        email?: string | undefined;
+    } | null;
+}, {
+    [x: string]: unknown;
+    sub: string;
+    email: string;
+    email_verified: boolean;
+    "https://willy.im/permissions": string[];
+    "https://willy.im/workspaces": {
+        [x: string]: unknown;
+        id: string;
+        slug: string;
+        name: string;
+        domain: string | null;
+        role: string;
+    }[];
+    name?: string | null | undefined;
+    picture?: string | null | undefined;
+    image?: string | null | undefined;
+    act?: {
+        [x: string]: unknown;
+        sub: string;
+        email?: string | undefined;
+    } | null | undefined;
+}>>;
+export type Claims = z.output<typeof ClaimsSchema>;
+//# sourceMappingURL=wire.d.ts.map

package/dist/src/wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../../src/wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,iBAAiB,iCAAiC,CAAA;AAC/D,eAAO,MAAM,gBAAgB,gCAAgC,CAAA;AAE7D,2EAA2E;AAC3E,eAAO,MAAM,eAAe;;;;;;;IAO1B;;;OAGG;;iBAEH,CAAA;AAEF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,eAAe,CAAC,CAAA;AAExD,+EAA+E;AAC/E,eAAO,MAAM,YAAY;;;;;;;;;;IAYrB,iEAAiE;;;;;;;;;;;;;GAKhE,CAAA;AAEL,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,YAAY,CAAC,CAAA;AAElD,kFAAkF;AAClF,eAAO,MAAM,eAAe;;;;;;iBAM1B,CAAA;AAEF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,eAAe,CAAC,CAAA;AAExD;;;GAGG;AACH,eAAO,MAAM,WAAW;;;iBAGtB,CAAA;AAEF,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,WAAW,CAAC,CAAA;AAMhD;;;;GAIG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAkBrB,6EAA6E;;IAE7E,gFAAgF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAG/E,CAAA;AAEL,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,YAAY,CAAC,CAAA"}

package/dist/src/wire.js

@@ -0,0 +1,100 @@
+/**
+ * The OIDC wire, as zod schemas: discovery, the token endpoint, and the claim
+ * set. These are not in `./schemas` with the management API because they are
+ * standards-defined — nothing generates them, and they never appear in our
+ * OpenAPI document.
+ *
+ * Two different postures live here on purpose:
+ *
+ *  - **Strict** on anything we act on. Without `token_endpoint` there is no
+ *    flow to run, and an `access_token` that is absent must not become `""`
+ *    and get written to a session row.
+ *  - **Tolerant** on claims. A user with no permissions, no workspaces, or no
+ *    display name is ordinary, not an error — those degrade to empty. Only
+ *    `sub` is genuinely required, since it is the identity.
+ *
+ * Unknown fields pass through everywhere: an IdP is allowed to grow.
+ */
+import { z } from "zod";
+export const PERMISSIONS_CLAIM = "https://willy.im/permissions";
+export const WORKSPACES_CLAIM = "https://willy.im/workspaces";
+/** The subset of the discovery document we use, plus the fields we may. */
+export const DiscoverySchema = z.looseObject({
+    issuer: z.string(),
+    authorization_endpoint: z.string().url(),
+    token_endpoint: z.string().url(),
+    userinfo_endpoint: z.string().url(),
+    end_session_endpoint: z.string().url().optional(),
+    jwks_uri: z.string().url().optional(),
+    /**
+     * Per-app session ceiling, in seconds. Not standard OIDC — an IdP extension
+     * the SDK clamps `session.expiresIn` against when present.
+     */
+    session_max_age: z.number().optional(),
+});
+/** Token-endpoint output, camelCased so app code never sees the wire shape. */
+export const TokensSchema = z
+    .looseObject({
+    access_token: z.string().min(1),
+    token_type: z.string().default("Bearer"),
+    expires_in: z.number().nullish(),
+    refresh_token: z.string().nullish(),
+    id_token: z.string().nullish(),
+    scope: z.string().nullish(),
+})
+    .transform((raw) => ({
+    accessToken: raw.access_token,
+    tokenType: raw.token_type,
+    /** Seconds until the access token expires, when the IdP says. */
+    expiresIn: raw.expires_in ?? null,
+    refreshToken: raw.refresh_token ?? null,
+    idToken: raw.id_token ?? null,
+    scope: raw.scope ?? null,
+}));
+/** A tenant inside THIS app. `domain` is set for multi-domain apps, else null. */
+export const WorkspaceSchema = z.looseObject({
+    id: z.string(),
+    slug: z.string().default(""),
+    name: z.string().default(""),
+    domain: z.string().nullish().transform((value) => value || null),
+    role: z.string().default("member"),
+});
+/**
+ * The RFC 8693 `act` claim: present while an IdP admin is impersonating the
+ * user. Audit-only — tag your logs with it, never branch authorization on it.
+ */
+export const ActorSchema = z.looseObject({
+    sub: z.string().min(1),
+    email: z.string().optional(),
+});
+/** `.catch` per field, so one bad element degrades instead of failing a login. */
+const tolerantArray = (item) => z.array(item.nullable().catch(null)).catch([]).transform((values) => values.filter((v) => v !== null));
+/**
+ * Wire claims -> `Claims`. The `https://willy.im/*` namespace is unwrapped
+ * here: namespaced URI claims are an OIDC requirement, not something app code
+ * should ever have to type.
+ */
+export const ClaimsSchema = z
+    .looseObject({
+    sub: z.string().min(1),
+    email: z.string().catch(""),
+    email_verified: z.boolean().catch(false),
+    name: z.string().nullish().catch(null),
+    picture: z.string().nullish().catch(null),
+    image: z.string().nullish().catch(null),
+    [PERMISSIONS_CLAIM]: tolerantArray(z.string()),
+    [WORKSPACES_CLAIM]: tolerantArray(WorkspaceSchema),
+    act: ActorSchema.nullish().catch(null),
+})
+    .transform((raw) => ({
+    sub: raw.sub,
+    email: raw.email,
+    emailVerified: raw.email_verified,
+    name: raw.name || null,
+    image: raw.picture || raw.image || null,
+    /** Product permissions granted in this app. Unwrapped from the namespace. */
+    permissions: raw[PERMISSIONS_CLAIM],
+    /** Workspaces the user belongs to in this app. Unwrapped from the namespace. */
+    workspaces: raw[WORKSPACES_CLAIM],
+    actor: raw.act ?? null,
+}));