@wtfalch/email 0.4.0 → 0.4.1

package/dist/postmaster/objects.d.ts

@@ -13,13 +13,32 @@ export interface MailObjectsInput {
     /**
      * The project's identity provider, once the mail applications are
      * registered there (docs/plans/email.md E3, phase-4.md slice 1): tokens
-     * from `issuerUrl` for `audience` (the ZITADEL project id) sign people in,
-     * on the domain and as the server's default. Absent, the domain keeps the
-     * internal directory and people have passwords.
+     * from `issuerUrl` for `audience` (the provider's project or resource id)
+     * sign people in, on the domain and as the server's default. Absent, the
+     * domain keeps the internal directory and people have passwords.
      */
     oidc?: {
         issuerUrl: string;
         audience: string;
+        /**
+         * Scopes an access token must carry, on top of the audience check.
+         *
+         * **Empty by default, and that is the safe default rather than a lax
+         * one.** Whether an access token carries a `scope` claim at all is the
+         * provider's choice: OIDC Core keeps the `profile` and `email` claims at
+         * the userinfo endpoint rather than in the token, and a provider that
+         * follows it mints access tokens with no `scope` claim to check. Stalwart
+         * reads this against the token's own claims when it validates a JWT
+         * offline, so a requirement here refuses *every* token such a provider
+         * issues — 401 on a credential that is real, current and for this
+         * audience, which is a dead end with nothing on screen to explain it.
+         *
+         * The audience is what binds a token to this server. Set this only for a
+         * provider known to put scopes in the token.
+         */
+        requireScopes?: Record<string, boolean>;
+        /** The claim holding the login name. The OIDC standard one by default. */
+        claimUsername?: string;
     };
 }
 /** A value that names an object created earlier in the same plan. */

package/dist/postmaster/objects.js

@@ -19,8 +19,8 @@ export function mailObjects(i) {
                     description: oidcDescription,
                     issuerUrl: i.oidc.issuerUrl,
                     requireAudience: i.oidc.audience,
-                    requireScopes: { openid: true, email: true },
-                    claimUsername: 'preferred_username',
+                    requireScopes: i.oidc.requireScopes ?? {},
+                    claimUsername: i.oidc.claimUsername ?? 'preferred_username',
                     usernameDomain: i.apex,
                     claimName: 'name',
                 },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/email",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "The wtfalch estate: reading a mailbox over JMAP, and administering the Stalwart server it lives on. Two entries with no code in common.",
   "license": "MIT",
   "type": "module",