@xemahq/oidc-session-nest 1.0.1 → 1.2.0

package/README.md

@@ -110,6 +110,59 @@ differently because they name different things.
 Both values go through the same URL builder as `state`, `nonce` and
 `redirect_uri`, so they are encoded rather than spliced.
 
+### One backend on several addresses
+
+A fixed `OIDC_REDIRECT_URI` sends every sign-in back to one address. When the
+same backend is served on several addresses — a production host and a preview
+host, say — each must sign in and out on its own, because the session cookie is
+host-only. Declare the allowed origins instead:
+
+| Variable | Meaning |
+|---|---|
+| `OIDC_REDIRECT_ALLOWED_ORIGINS` | Comma-separated origins, e.g. `https://app.example.com,https://*-preview.example.com`. One `*` may open the first label only. |
+| `OIDC_REDIRECT_PATH` | The callback path on that origin, e.g. `/auth/callback`. Required with the above. |
+| `OIDC_POST_LOGOUT_REDIRECT_PATH` | Optional. Where end-session returns, on the same origin. |
+| `OIDC_TRUSTED_PROXIES` | Optional. IPs or CIDRs whose `X-Forwarded-Host` is believed. Absent means the header is never read and the `Host` header decides. |
+
+The two forms are exclusive, and the loader refuses both together or neither.
+
+- The redirect URI is `<the request's origin><OIDC_REDIRECT_PATH>`. An origin
+  that is not on the list answers `400 OIDC_REDIRECT_ORIGIN_NOT_ALLOWED`, and
+  there is no default address to fall back to.
+- The redirect URI is bound to the sign-in's pending state. A callback that
+  arrives on a different address answers `400 OIDC_LOGIN_ORIGIN_MISMATCH`, and
+  the code is never exchanged.
+- The code exchange sends the bound value, so it always matches the value the
+  authorization request carried.
+- Keep `SESSION_COOKIE_DOMAIN` unset, so each address keeps its own session.
+
+### Sign-in errors on the application's own page
+
+`GET /auth/login` and `GET /auth/callback` are browser navigations, not
+fetches. By default a refusal there is a JSON `400`, which the browser shows as
+raw JSON on a backend address.
+
+Set `OIDC_NAVIGATION_ERROR_PATH` (or `navigationErrorPath`) to a path on the
+application's own origin, and every refusal on those two routes becomes a
+redirect to it with the error code:
+
+```
+302 Location: /sign-in?error=OIDC_LOGIN_ORIGIN_MISMATCH
+```
+
+- The `Location` is always relative, so it cannot redirect anywhere else and
+  needs no allowlist. The value must start with a single `/` and carry no query
+  or fragment. Anything else fails at boot.
+- The parameter is always `error`, and it carries only the code. The detail
+  text stays in the server log, where each refusal is logged with its code.
+- The codes a sign-in page can receive are `OIDC_REDIRECT_ORIGIN_NOT_ALLOWED`,
+  `OIDC_LOGIN_ORIGIN_MISMATCH`, `OIDC_LOGIN_STATE_UNKNOWN`,
+  `OIDC_CALLBACK_REJECTED` and `OIDC_TOKEN_ENDPOINT_FAILED`.
+- With the variable unset, the two routes keep answering JSON. There is no
+  default path, because a page that does not read `?error=` would hide the
+  refusal.
+- `POST /auth/logout` is a fetch and always answers JSON.
+
 ## Peer requirements
 
 - `@nestjs/common` and `@nestjs/core` `^10 || ^11` — the framework this mounts into.

package/dist/config/oidc-session-config-error.d.ts

@@ -0,0 +1,4 @@
+export declare class OidcSessionConfigError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=oidc-session-config-error.d.ts.map

package/dist/config/oidc-session-config-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-session-config-error.d.ts","sourceRoot":"","sources":["../../src/config/oidc-session-config-error.ts"],"names":[],"mappings":"AAMA,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B"}

package/dist/config/oidc-session-config-error.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OidcSessionConfigError = void 0;
+class OidcSessionConfigError extends Error {
+    constructor(message) {
+        super(`[oidc-session-nest] ${message}`);
+        this.name = 'OidcSessionConfigError';
+    }
+}
+exports.OidcSessionConfigError = OidcSessionConfigError;
+//# sourceMappingURL=oidc-session-config-error.js.map

package/dist/config/oidc-session-config-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-session-config-error.js","sourceRoot":"","sources":["../../src/config/oidc-session-config-error.ts"],"names":[],"mappings":";;;AAMA,MAAa,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AALD,wDAKC"}

package/dist/config/oidc-session-env.d.ts

@@ -1,6 +1,10 @@
 import { type OidcSessionOptions } from './oidc-session-options';
 export type EnvReader = (name: string) => string | undefined;
 export declare const OIDC_SESSION_REQUIRED_ENV_VARS: readonly string[];
+export declare const OIDC_SESSION_REDIRECT_ENV_VARS: {
+    readonly fixed: readonly ["OIDC_REDIRECT_URI", "OIDC_POST_LOGOUT_REDIRECT_URI"];
+    readonly perOrigin: readonly ["OIDC_REDIRECT_ALLOWED_ORIGINS", "OIDC_REDIRECT_PATH", "OIDC_POST_LOGOUT_REDIRECT_PATH", "OIDC_TRUSTED_PROXIES"];
+};
 export declare const OIDC_SESSION_OPTIONAL_ENV_VARS: readonly string[];
 export declare function loadOidcSessionOptionsFromEnv(read: EnvReader): OidcSessionOptions;
 //# sourceMappingURL=oidc-session-env.d.ts.map

package/dist/config/oidc-session-env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-session-env.d.ts","sourceRoot":"","sources":["../../src/config/oidc-session-env.ts"],"names":[],"mappings":"AAaA,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,wBAAwB,CAAC;AAGhC,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;AAU7D,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAK3D,CAAC;AAOF,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAc3D,CAAC;AAoBF,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,SAAS,GACd,kBAAkB,CAiDpB"}
+{"version":3,"file":"oidc-session-env.d.ts","sourceRoot":"","sources":["../../src/config/oidc-session-env.ts"],"names":[],"mappings":"AAaA,OAAO,EAIL,KAAK,kBAAkB,EAExB,MAAM,wBAAwB,CAAC;AAGhC,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;AAU7D,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAI3D,CAAC;AAiBF,eAAO,MAAM,8BAA8B;;;CAQjC,CAAC;AAOX,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAc3D,CAAC;AAoBF,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,SAAS,GACd,kBAAkB,CAmDpB"}

package/dist/config/oidc-session-env.js

@@ -1,17 +1,24 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OIDC_SESSION_OPTIONAL_ENV_VARS = exports.OIDC_SESSION_REQUIRED_ENV_VARS = void 0;
+exports.OIDC_SESSION_OPTIONAL_ENV_VARS = exports.OIDC_SESSION_REDIRECT_ENV_VARS = exports.OIDC_SESSION_REQUIRED_ENV_VARS = void 0;
 exports.loadOidcSessionOptionsFromEnv = loadOidcSessionOptionsFromEnv;
 const oidc_session_options_1 = require("./oidc-session-options");
 exports.OIDC_SESSION_REQUIRED_ENV_VARS = [
     'OIDC_ISSUER_URL',
     'OIDC_CLIENT_ID',
-    'OIDC_REDIRECT_URI',
     'SESSION_COOKIE_NAME',
 ];
+exports.OIDC_SESSION_REDIRECT_ENV_VARS = {
+    fixed: ['OIDC_REDIRECT_URI', 'OIDC_POST_LOGOUT_REDIRECT_URI'],
+    perOrigin: [
+        'OIDC_REDIRECT_ALLOWED_ORIGINS',
+        'OIDC_REDIRECT_PATH',
+        'OIDC_POST_LOGOUT_REDIRECT_PATH',
+        'OIDC_TRUSTED_PROXIES',
+    ],
+};
 exports.OIDC_SESSION_OPTIONAL_ENV_VARS = [
     'OIDC_CLIENT_SECRET',
-    'OIDC_POST_LOGOUT_REDIRECT_URI',
     'OIDC_SCOPE',
     'OIDC_KEYCLOAK_IDP_HINT',
     'SESSION_COOKIE_SECURE',
@@ -23,6 +30,7 @@ exports.OIDC_SESSION_OPTIONAL_ENV_VARS = [
     'SESSION_REFRESH_LEAD_SECONDS',
     'SESSION_REFRESH_WAIT_MS',
     'SESSION_KEY_PREFIX',
+    'OIDC_NAVIGATION_ERROR_PATH',
 ];
 const DEFAULT_IDLE_TTL_SECONDS = 8 * 60 * 60;
 const DEFAULT_ABSOLUTE_TTL_SECONDS = 24 * 60 * 60;
@@ -34,16 +42,15 @@ const DEFAULT_SAME_SITE = 'lax';
 const SAME_SITE_VALUES = ['lax', 'strict', 'none'];
 function loadOidcSessionOptionsFromEnv(read) {
     const clientSecret = optional(read, 'OIDC_CLIENT_SECRET');
-    const postLogoutRedirectUri = optional(read, 'OIDC_POST_LOGOUT_REDIRECT_URI');
     const cookieDomain = optional(read, 'SESSION_COOKIE_DOMAIN');
     const keycloakIdpHint = optional(read, 'OIDC_KEYCLOAK_IDP_HINT');
+    const navigationErrorPath = optional(read, 'OIDC_NAVIGATION_ERROR_PATH');
     const options = {
         oidc: {
             issuerUrl: required(read, 'OIDC_ISSUER_URL'),
             clientId: required(read, 'OIDC_CLIENT_ID'),
             ...(clientSecret === undefined ? {} : { clientSecret }),
-            redirectUri: required(read, 'OIDC_REDIRECT_URI'),
-            ...(postLogoutRedirectUri === undefined ? {} : { postLogoutRedirectUri }),
+            ...readRedirect(read),
             scope: withRequiredScope(optional(read, 'OIDC_SCOPE') ?? oidc_session_options_1.REQUIRED_OIDC_SCOPE),
             ...(keycloakIdpHint === undefined ? {} : { keycloakIdpHint }),
         },
@@ -61,9 +68,60 @@ function loadOidcSessionOptionsFromEnv(read) {
             refreshWaitMs: readPositiveNumber(read, 'SESSION_REFRESH_WAIT_MS', DEFAULT_REFRESH_WAIT_MS),
         },
         keyPrefix: optional(read, 'SESSION_KEY_PREFIX') ?? DEFAULT_KEY_PREFIX,
+        ...(navigationErrorPath === undefined ? {} : { navigationErrorPath }),
     };
     return (0, oidc_session_options_1.assertOidcSessionOptions)(options);
 }
+function readRedirect(read) {
+    const declared = (names) => names.filter((name) => optional(read, name) !== undefined);
+    const fixed = declared(exports.OIDC_SESSION_REDIRECT_ENV_VARS.fixed);
+    const perOrigin = declared(exports.OIDC_SESSION_REDIRECT_ENV_VARS.perOrigin);
+    if (fixed.length > 0 && perOrigin.length > 0) {
+        throw new oidc_session_options_1.OidcSessionConfigError(`${fixed.join(', ')} and ${perOrigin.join(', ')} are both set. Declare ` +
+            'ONE redirect form: OIDC_REDIRECT_URI for a single address, or ' +
+            'OIDC_REDIRECT_ALLOWED_ORIGINS for several.');
+    }
+    if (perOrigin.length === 0) {
+        const redirectUri = optional(read, 'OIDC_REDIRECT_URI');
+        if (redirectUri === undefined) {
+            throw new oidc_session_options_1.OidcSessionConfigError('OIDC_REDIRECT_URI (one address) or OIDC_REDIRECT_ALLOWED_ORIGINS ' +
+                '(several) is required and neither is set. It has no safe default: ' +
+                'without it this application cannot complete a sign-in.');
+        }
+        const postLogoutRedirectUri = optional(read, 'OIDC_POST_LOGOUT_REDIRECT_URI');
+        return {
+            redirectUri,
+            ...(postLogoutRedirectUri === undefined ? {} : { postLogoutRedirectUri }),
+        };
+    }
+    const allowedOrigins = readList(read, 'OIDC_REDIRECT_ALLOWED_ORIGINS');
+    if (allowedOrigins === undefined) {
+        throw new oidc_session_options_1.OidcSessionConfigError(`${perOrigin.join(', ')} ${perOrigin.length === 1 ? 'is' : 'are'} set ` +
+            'without OIDC_REDIRECT_ALLOWED_ORIGINS, which selects the per-address ' +
+            'redirect and has no default.');
+    }
+    const postLogoutPath = optional(read, 'OIDC_POST_LOGOUT_REDIRECT_PATH');
+    const trustedProxies = readList(read, 'OIDC_TRUSTED_PROXIES');
+    return {
+        redirectFromRequestOrigin: {
+            allowedOrigins,
+            callbackPath: required(read, 'OIDC_REDIRECT_PATH'),
+            ...(postLogoutPath === undefined ? {} : { postLogoutPath }),
+            ...(trustedProxies === undefined ? {} : { trustedProxies }),
+        },
+    };
+}
+function readList(read, name) {
+    const raw = optional(read, name);
+    if (raw === undefined) {
+        return undefined;
+    }
+    const entries = raw.split(',').map((entry) => entry.trim());
+    if (entries.some((entry) => entry === '')) {
+        throw new oidc_session_options_1.OidcSessionConfigError(`${name} has an empty entry; got "${raw}". Separate entries with single commas.`);
+    }
+    return entries;
+}
 function optional(read, name) {
     const raw = read(name);
     if (raw === undefined || raw.trim() === '') {

package/dist/config/oidc-session-env.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-session-env.js","sourceRoot":"","sources":["../../src/config/oidc-session-env.ts"],"names":[],"mappings":";;;AA6EA,sEAmDC;AAnHD,iEAKgC;AAanB,QAAA,8BAA8B,GAAsB;IAC/D,iBAAiB;IACjB,gBAAgB;IAChB,mBAAmB;IACnB,qBAAqB;CACtB,CAAC;AAOW,QAAA,8BAA8B,GAAsB;IAC/D,oBAAoB;IACpB,+BAA+B;IAC/B,YAAY;IACZ,wBAAwB;IACxB,uBAAuB;IACvB,uBAAuB;IACvB,0BAA0B;IAC1B,qBAAqB;IACrB,0BAA0B;IAC1B,8BAA8B;IAC9B,8BAA8B;IAC9B,yBAAyB;IACzB,oBAAoB;CACrB,CAAC;AAEF,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;AAC7C,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAClD,MAAM,4BAA4B,GAAG,EAAE,CAAC;AACxC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AACtC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAC1C,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAC;AAU5D,SAAgB,6BAA6B,CAC3C,IAAe;IAEf,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAC1D,MAAM,qBAAqB,GAAG,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;IAC9E,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAC7D,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IAEjE,MAAM,OAAO,GAAuB;QAClC,IAAI,EAAE;YACJ,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;YAC5C,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;YAC1C,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;YACvD,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;YAChD,GAAG,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC;YACzE,KAAK,EAAE,iBAAiB,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,0CAAmB,CAAC;YAC7E,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;SAC9D;QACD,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;YAC3C,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,uBAAuB,EAAE,IAAI,CAAC;YACxD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YAC/D,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC,IAAI,mBAAmB;YAClE,QAAQ,EAAE,YAAY,CAAC,IAAI,EAAE,0BAA0B,EAAE,iBAAiB,CAAC;SAC5E;QACD,GAAG,EAAE;YACH,cAAc,EAAE,kBAAkB,CAChC,IAAI,EACJ,0BAA0B,EAC1B,wBAAwB,CACzB;YACD,kBAAkB,EAAE,kBAAkB,CACpC,IAAI,EACJ,8BAA8B,EAC9B,4BAA4B,CAC7B;YACD,kBAAkB,EAAE,kBAAkB,CACpC,IAAI,EACJ,8BAA8B,EAC9B,4BAA4B,CAC7B;YACD,aAAa,EAAE,kBAAkB,CAC/B,IAAI,EACJ,yBAAyB,EACzB,uBAAuB,CACxB;SACF;QACD,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC,IAAI,kBAAkB;KACtE,CAAC;IAEF,OAAO,IAAA,+CAAwB,EAAC,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,QAAQ,CAAC,IAAe,EAAE,IAAY;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAe,EAAE,IAAY;IAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,6CAAsB,CAC9B,GAAG,IAAI,8DAA8D;YACnE,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;IAChE,IAAI,KAAK,CAAC,QAAQ,CAAC,0CAAmB,CAAC,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,0CAAmB,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnD,CAAC;AASD,SAAS,WAAW,CAAC,IAAe,EAAE,IAAY,EAAE,QAAiB;IACnE,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAClC,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,6CAAsB,CAC9B,GAAG,IAAI,oCAAoC,GAAG,IAAI,CACnD,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAe,EACf,IAAY,EACZ,QAAgB;IAEhB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,6CAAsB,CAC9B,GAAG,IAAI,oCAAoC,GAAG,IAAI,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CACnB,IAAe,EACf,IAAY,EACZ,QAAkB;IAElB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC;IAClE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,6CAAsB,CAC9B,GAAG,IAAI,mBAAmB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"oidc-session-env.js","sourceRoot":"","sources":["../../src/config/oidc-session-env.ts"],"names":[],"mappings":";;;AAsGA,sEAqDC;AA9ID,iEAMgC;AAanB,QAAA,8BAA8B,GAAsB;IAC/D,iBAAiB;IACjB,gBAAgB;IAChB,qBAAqB;CACtB,CAAC;AAiBW,QAAA,8BAA8B,GAAG;IAC5C,KAAK,EAAE,CAAC,mBAAmB,EAAE,+BAA+B,CAAC;IAC7D,SAAS,EAAE;QACT,+BAA+B;QAC/B,oBAAoB;QACpB,gCAAgC;QAChC,sBAAsB;KACvB;CACO,CAAC;AAOE,QAAA,8BAA8B,GAAsB;IAC/D,oBAAoB;IACpB,YAAY;IACZ,wBAAwB;IACxB,uBAAuB;IACvB,uBAAuB;IACvB,0BAA0B;IAC1B,qBAAqB;IACrB,0BAA0B;IAC1B,8BAA8B;IAC9B,8BAA8B;IAC9B,yBAAyB;IACzB,oBAAoB;IACpB,4BAA4B;CAC7B,CAAC;AAEF,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;AAC7C,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAClD,MAAM,4BAA4B,GAAG,EAAE,CAAC;AACxC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AACtC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAC1C,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAC;AAU5D,SAAgB,6BAA6B,CAC3C,IAAe;IAEf,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAC7D,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IAGjE,MAAM,mBAAmB,GAAG,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;IAEzE,MAAM,OAAO,GAAuB;QAClC,IAAI,EAAE;YACJ,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;YAC5C,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;YAC1C,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;YACvD,GAAG,YAAY,CAAC,IAAI,CAAC;YACrB,KAAK,EAAE,iBAAiB,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,0CAAmB,CAAC;YAC7E,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;SAC9D;QACD,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;YAC3C,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,uBAAuB,EAAE,IAAI,CAAC;YACxD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YAC/D,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC,IAAI,mBAAmB;YAClE,QAAQ,EAAE,YAAY,CAAC,IAAI,EAAE,0BAA0B,EAAE,iBAAiB,CAAC;SAC5E;QACD,GAAG,EAAE;YACH,cAAc,EAAE,kBAAkB,CAChC,IAAI,EACJ,0BAA0B,EAC1B,wBAAwB,CACzB;YACD,kBAAkB,EAAE,kBAAkB,CACpC,IAAI,EACJ,8BAA8B,EAC9B,4BAA4B,CAC7B;YACD,kBAAkB,EAAE,kBAAkB,CACpC,IAAI,EACJ,8BAA8B,EAC9B,4BAA4B,CAC7B;YACD,aAAa,EAAE,kBAAkB,CAC/B,IAAI,EACJ,yBAAyB,EACzB,uBAAuB,CACxB;SACF;QACD,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC,IAAI,kBAAkB;QACrE,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACtE,CAAC;IAEF,OAAO,IAAA,+CAAwB,EAAC,OAAO,CAAC,CAAC;AAC3C,CAAC;AAQD,SAAS,YAAY,CAAC,IAAe;IAKnC,MAAM,QAAQ,GAAG,CAAC,KAAwB,EAAY,EAAE,CACtD,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,QAAQ,CAAC,sCAA8B,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,QAAQ,CAAC,sCAA8B,CAAC,SAAS,CAAC,CAAC;IAErE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,6CAAsB,CAC9B,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB;YACtE,gEAAgE;YAChE,4CAA4C,CAC/C,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QACxD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,6CAAsB,CAC9B,mEAAmE;gBACjE,oEAAoE;gBACpE,wDAAwD,CAC3D,CAAC;QACJ,CAAC;QACD,MAAM,qBAAqB,GAAG,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;QAC9E,OAAO;YACL,WAAW;YACX,GAAG,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC;SAC1E,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;IACvE,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,6CAAsB,CAC9B,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO;YACrE,uEAAuE;YACvE,8BAA8B,CACjC,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC;IACxE,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;IAC9D,OAAO;QACL,yBAAyB,EAAE;YACzB,cAAc;YACd,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;YAClD,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;YAC3D,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;SAC5D;KACF,CAAC;AACJ,CAAC;AAMD,SAAS,QAAQ,CAAC,IAAe,EAAE,IAAY;IAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,6CAAsB,CAC9B,GAAG,IAAI,6BAA6B,GAAG,yCAAyC,CACjF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAe,EAAE,IAAY;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAe,EAAE,IAAY;IAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,6CAAsB,CAC9B,GAAG,IAAI,8DAA8D;YACnE,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;IAChE,IAAI,KAAK,CAAC,QAAQ,CAAC,0CAAmB,CAAC,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,0CAAmB,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnD,CAAC;AASD,SAAS,WAAW,CAAC,IAAe,EAAE,IAAY,EAAE,QAAiB;IACnE,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAClC,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,6CAAsB,CAC9B,GAAG,IAAI,oCAAoC,GAAG,IAAI,CACnD,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAe,EACf,IAAY,EACZ,QAAgB;IAEhB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,6CAAsB,CAC9B,GAAG,IAAI,oCAAoC,GAAG,IAAI,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CACnB,IAAe,EACf,IAAY,EACZ,QAAkB;IAElB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC;IAClE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,6CAAsB,CAC9B,GAAG,IAAI,mBAAmB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/config/oidc-session-options.d.ts

@@ -1,12 +1,20 @@
+import { OidcSessionConfigError } from './oidc-session-config-error';
 export interface OidcProviderOptions {
     readonly issuerUrl: string;
     readonly clientId: string;
     readonly clientSecret?: string;
-    readonly redirectUri: string;
+    readonly redirectUri?: string;
     readonly postLogoutRedirectUri?: string;
+    readonly redirectFromRequestOrigin?: RequestOriginRedirectOptions;
     readonly scope: string;
     readonly keycloakIdpHint?: string;
 }
+export interface RequestOriginRedirectOptions {
+    readonly allowedOrigins: readonly string[];
+    readonly callbackPath: string;
+    readonly postLogoutPath?: string;
+    readonly trustedProxies?: readonly string[];
+}
 export interface SessionCookieOptions {
     readonly name: string;
     readonly secure: boolean;
@@ -25,10 +33,9 @@ export interface OidcSessionOptions {
     readonly cookie: SessionCookieOptions;
     readonly ttl: SessionTtlOptions;
     readonly keyPrefix: string;
+    readonly navigationErrorPath?: string;
 }
-export declare class OidcSessionConfigError extends Error {
-    constructor(message: string);
-}
+export { OidcSessionConfigError };
 export declare const REQUIRED_OIDC_SCOPE = "openid";
 export declare function assertOidcSessionOptions(options: OidcSessionOptions): OidcSessionOptions;
 //# sourceMappingURL=oidc-session-options.d.ts.map

package/dist/config/oidc-session-options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-session-options.d.ts","sourceRoot":"","sources":["../../src/config/oidc-session-options.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,mBAAmB;IAQlC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAM1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAM/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAKxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAavB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAGD,MAAM,WAAW,oBAAoB;IAEnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAMtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAEzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAOtB,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;CAC9C;AAGD,MAAM,WAAW,iBAAiB;IAMhC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAKhC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAMpC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAOpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAGD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC;IAMhC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAGD,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAGD,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAU5C,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,kBAAkB,GAC1B,kBAAkB,CAwEpB"}
+{"version":3,"file":"oidc-session-options.d.ts","sourceRoot":"","sources":["../../src/config/oidc-session-options.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AASrE,MAAM,WAAW,mBAAmB;IAQlC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAM1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAQ/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAK9B,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAOxC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,4BAA4B,CAAC;IAKlE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAavB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAgBD,MAAM,WAAW,4BAA4B;IAE3C,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAE3C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAM9B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IASjC,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAGD,MAAM,WAAW,oBAAoB;IAEnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAMtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAEzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAOtB,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;CAC9C;AAGD,MAAM,WAAW,iBAAiB;IAMhC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAKhC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAMpC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAOpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAGD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC;IAMhC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAkB3B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CACvC;AAED,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAGlC,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAU5C,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,kBAAkB,GAC1B,kBAAkB,CAwEpB"}

package/dist/config/oidc-session-options.js

@@ -2,40 +2,37 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.REQUIRED_OIDC_SCOPE = exports.OidcSessionConfigError = void 0;
 exports.assertOidcSessionOptions = assertOidcSessionOptions;
-class OidcSessionConfigError extends Error {
-    constructor(message) {
-        super(`[oidc-session-nest] ${message}`);
-        this.name = 'OidcSessionConfigError';
-    }
-}
-exports.OidcSessionConfigError = OidcSessionConfigError;
+const oidc_session_config_error_1 = require("./oidc-session-config-error");
+Object.defineProperty(exports, "OidcSessionConfigError", { enumerable: true, get: function () { return oidc_session_config_error_1.OidcSessionConfigError; } });
+const redirect_origin_1 = require("./redirect-origin");
+const cookie_1 = require("../http/cookie");
+const request_authority_1 = require("../http/request-authority");
 exports.REQUIRED_OIDC_SCOPE = 'openid';
 function assertOidcSessionOptions(options) {
     const { oidc, cookie, ttl, keyPrefix } = options;
     for (const [name, value] of [
         ['issuerUrl', oidc.issuerUrl],
         ['clientId', oidc.clientId],
-        ['redirectUri', oidc.redirectUri],
         ['cookie.name', cookie.name],
         ['keyPrefix', keyPrefix],
     ]) {
         if (typeof value !== 'string' || value.trim() === '') {
-            throw new OidcSessionConfigError(`${name} must be a non-empty string.`);
+            throw new oidc_session_config_error_1.OidcSessionConfigError(`${name} must be a non-empty string.`);
         }
     }
     assertAbsoluteHttpUrl('issuerUrl', oidc.issuerUrl);
-    assertAbsoluteHttpUrl('redirectUri', oidc.redirectUri);
-    if (oidc.postLogoutRedirectUri !== undefined) {
-        assertAbsoluteHttpUrl('postLogoutRedirectUri', oidc.postLogoutRedirectUri);
-    }
+    assertRedirectStatement(oidc);
     if (!oidc.scope.split(/\s+/u).includes(exports.REQUIRED_OIDC_SCOPE)) {
-        throw new OidcSessionConfigError(`scope must include "${exports.REQUIRED_OIDC_SCOPE}"; got "${oidc.scope}".`);
+        throw new oidc_session_config_error_1.OidcSessionConfigError(`scope must include "${exports.REQUIRED_OIDC_SCOPE}"; got "${oidc.scope}".`);
     }
     if (oidc.keycloakIdpHint !== undefined &&
         (typeof oidc.keycloakIdpHint !== 'string' || oidc.keycloakIdpHint.trim() === '')) {
-        throw new OidcSessionConfigError('keycloakIdpHint must be a non-empty string when set; omit it to let the ' +
+        throw new oidc_session_config_error_1.OidcSessionConfigError('keycloakIdpHint must be a non-empty string when set; omit it to let the ' +
             'realm show its own login page.');
     }
+    if (options.navigationErrorPath !== undefined) {
+        assertNavigationErrorPath(options.navigationErrorPath);
+    }
     for (const [name, value] of [
         ['ttl.idleTtlSeconds', ttl.idleTtlSeconds],
         ['ttl.absoluteTtlSeconds', ttl.absoluteTtlSeconds],
@@ -43,30 +40,76 @@ function assertOidcSessionOptions(options) {
         ['ttl.refreshWaitMs', ttl.refreshWaitMs],
     ]) {
         if (!Number.isFinite(value) || value <= 0) {
-            throw new OidcSessionConfigError(`${name} must be a positive finite number; got ${String(value)}.`);
+            throw new oidc_session_config_error_1.OidcSessionConfigError(`${name} must be a positive finite number; got ${String(value)}.`);
         }
     }
     if (ttl.idleTtlSeconds > ttl.absoluteTtlSeconds) {
-        throw new OidcSessionConfigError(`ttl.idleTtlSeconds (${ttl.idleTtlSeconds}) exceeds ttl.absoluteTtlSeconds ` +
+        throw new oidc_session_config_error_1.OidcSessionConfigError(`ttl.idleTtlSeconds (${ttl.idleTtlSeconds}) exceeds ttl.absoluteTtlSeconds ` +
             `(${ttl.absoluteTtlSeconds}), so the idle window could never be reached. ` +
             'Lower the idle TTL or raise the absolute one.');
     }
     if (cookie.sameSite === 'none' && !cookie.secure) {
-        throw new OidcSessionConfigError('cookie.sameSite "none" requires cookie.secure — browsers reject the pair, ' +
+        throw new oidc_session_config_error_1.OidcSessionConfigError('cookie.sameSite "none" requires cookie.secure — browsers reject the pair, ' +
             'so the session cookie would be silently dropped on every response.');
     }
     return options;
 }
+function assertRedirectStatement(oidc) {
+    const fixed = oidc.redirectUri;
+    const perOrigin = oidc.redirectFromRequestOrigin;
+    if (fixed !== undefined && perOrigin !== undefined) {
+        throw new oidc_session_config_error_1.OidcSessionConfigError('redirectUri and redirectFromRequestOrigin are both set. State ONE: a ' +
+            'fixed redirect URI for a single address, or an origin allowlist for ' +
+            'several.');
+    }
+    if (fixed === undefined && perOrigin === undefined) {
+        throw new oidc_session_config_error_1.OidcSessionConfigError('neither redirectUri nor redirectFromRequestOrigin is set, so no sign-in ' +
+            'could ever return to this application.');
+    }
+    if (fixed !== undefined) {
+        if (typeof fixed !== 'string' || fixed.trim() === '') {
+            throw new oidc_session_config_error_1.OidcSessionConfigError('redirectUri must be a non-empty string.');
+        }
+        assertAbsoluteHttpUrl('redirectUri', fixed);
+        if (oidc.postLogoutRedirectUri !== undefined) {
+            assertAbsoluteHttpUrl('postLogoutRedirectUri', oidc.postLogoutRedirectUri);
+        }
+        return;
+    }
+    if (perOrigin === undefined) {
+        return;
+    }
+    if (oidc.postLogoutRedirectUri !== undefined) {
+        throw new oidc_session_config_error_1.OidcSessionConfigError('postLogoutRedirectUri names ONE address, but redirectFromRequestOrigin ' +
+            'serves several. State redirectFromRequestOrigin.postLogoutPath instead.');
+    }
+    (0, redirect_origin_1.parseRedirectOriginAllowlist)(perOrigin.allowedOrigins);
+    (0, redirect_origin_1.assertOriginRelativePath)('redirectFromRequestOrigin.callbackPath', perOrigin.callbackPath);
+    if (perOrigin.postLogoutPath !== undefined) {
+        (0, redirect_origin_1.assertOriginRelativePath)('redirectFromRequestOrigin.postLogoutPath', perOrigin.postLogoutPath);
+    }
+    (0, request_authority_1.parseTrustedProxies)(perOrigin.trustedProxies ?? []);
+}
+function assertNavigationErrorPath(value) {
+    if (typeof value !== 'string' || value.trim() === '') {
+        throw new oidc_session_config_error_1.OidcSessionConfigError('navigationErrorPath must be a non-empty path when set; omit it to keep ' +
+            'JSON refusals on the navigation routes.');
+    }
+    (0, redirect_origin_1.assertOriginRelativePath)('navigationErrorPath', value);
+    if ((0, cookie_1.containsControlCharacter)(value)) {
+        throw new oidc_session_config_error_1.OidcSessionConfigError('navigationErrorPath contains a control character.');
+    }
+}
 function assertAbsoluteHttpUrl(name, value) {
     let parsed;
     try {
         parsed = new URL(value);
     }
     catch {
-        throw new OidcSessionConfigError(`${name} must be an absolute URL; got "${value}".`);
+        throw new oidc_session_config_error_1.OidcSessionConfigError(`${name} must be an absolute URL; got "${value}".`);
     }
     if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
-        throw new OidcSessionConfigError(`${name} must be http or https; got "${parsed.protocol}".`);
+        throw new oidc_session_config_error_1.OidcSessionConfigError(`${name} must be http or https; got "${parsed.protocol}".`);
     }
 }
 //# sourceMappingURL=oidc-session-options.js.map

package/dist/config/oidc-session-options.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-session-options.js","sourceRoot":"","sources":["../../src/config/oidc-session-options.ts"],"names":[],"mappings":";;;AAyIA,4DA0EC;AA5FD,MAAa,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AALD,wDAKC;AAGY,QAAA,mBAAmB,GAAG,QAAQ,CAAC;AAU5C,SAAgB,wBAAwB,CACtC,OAA2B;IAE3B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAEjD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC;QAC7B,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC;QAC3B,CAAC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC;QACjC,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC;QAC5B,CAAC,WAAW,EAAE,SAAS,CAAC;KAChB,EAAE,CAAC;QACX,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrD,MAAM,IAAI,sBAAsB,CAAC,GAAG,IAAI,8BAA8B,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,qBAAqB,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACnD,qBAAqB,CAAC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;QAC7C,qBAAqB,CAAC,uBAAuB,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,2BAAmB,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,sBAAsB,CAC9B,uBAAuB,2BAAmB,WAAW,IAAI,CAAC,KAAK,IAAI,CACpE,CAAC;IACJ,CAAC;IAQD,IACE,IAAI,CAAC,eAAe,KAAK,SAAS;QAClC,CAAC,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAChF,CAAC;QACD,MAAM,IAAI,sBAAsB,CAC9B,0EAA0E;YACxE,gCAAgC,CACnC,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,oBAAoB,EAAE,GAAG,CAAC,cAAc,CAAC;QAC1C,CAAC,wBAAwB,EAAE,GAAG,CAAC,kBAAkB,CAAC;QAClD,CAAC,wBAAwB,EAAE,GAAG,CAAC,kBAAkB,CAAC;QAClD,CAAC,mBAAmB,EAAE,GAAG,CAAC,aAAa,CAAC;KAChC,EAAE,CAAC;QACX,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,sBAAsB,CAC9B,GAAG,IAAI,0CAA0C,MAAM,CAAC,KAAK,CAAC,GAAG,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,cAAc,GAAG,GAAG,CAAC,kBAAkB,EAAE,CAAC;QAChD,MAAM,IAAI,sBAAsB,CAC9B,uBAAuB,GAAG,CAAC,cAAc,mCAAmC;YAC1E,IAAI,GAAG,CAAC,kBAAkB,gDAAgD;YAC1E,+CAA+C,CAClD,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACjD,MAAM,IAAI,sBAAsB,CAC9B,4EAA4E;YAC1E,oEAAoE,CACvE,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,KAAa;IACxD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,sBAAsB,CAAC,GAAG,IAAI,kCAAkC,KAAK,IAAI,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,sBAAsB,CAC9B,GAAG,IAAI,gCAAgC,MAAM,CAAC,QAAQ,IAAI,CAC3D,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"oidc-session-options.js","sourceRoot":"","sources":["../../src/config/oidc-session-options.ts"],"names":[],"mappings":";;;AA4MA,4DA0EC;AA/QD,2EAAqE;AAwL5D,uGAxLA,kDAAsB,OAwLA;AAvL/B,uDAG2B;AAC3B,2CAA0D;AAC1D,iEAAgE;AAqLnD,QAAA,mBAAmB,GAAG,QAAQ,CAAC;AAU5C,SAAgB,wBAAwB,CACtC,OAA2B;IAE3B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAEjD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC;QAC7B,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC;QAC3B,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC;QAC5B,CAAC,WAAW,EAAE,SAAS,CAAC;KAChB,EAAE,CAAC;QACX,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrD,MAAM,IAAI,kDAAsB,CAAC,GAAG,IAAI,8BAA8B,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,qBAAqB,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACnD,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAE9B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,2BAAmB,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,kDAAsB,CAC9B,uBAAuB,2BAAmB,WAAW,IAAI,CAAC,KAAK,IAAI,CACpE,CAAC;IACJ,CAAC;IAQD,IACE,IAAI,CAAC,eAAe,KAAK,SAAS;QAClC,CAAC,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAChF,CAAC;QACD,MAAM,IAAI,kDAAsB,CAC9B,0EAA0E;YACxE,gCAAgC,CACnC,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC9C,yBAAyB,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,oBAAoB,EAAE,GAAG,CAAC,cAAc,CAAC;QAC1C,CAAC,wBAAwB,EAAE,GAAG,CAAC,kBAAkB,CAAC;QAClD,CAAC,wBAAwB,EAAE,GAAG,CAAC,kBAAkB,CAAC;QAClD,CAAC,mBAAmB,EAAE,GAAG,CAAC,aAAa,CAAC;KAChC,EAAE,CAAC;QACX,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,kDAAsB,CAC9B,GAAG,IAAI,0CAA0C,MAAM,CAAC,KAAK,CAAC,GAAG,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,cAAc,GAAG,GAAG,CAAC,kBAAkB,EAAE,CAAC;QAChD,MAAM,IAAI,kDAAsB,CAC9B,uBAAuB,GAAG,CAAC,cAAc,mCAAmC;YAC1E,IAAI,GAAG,CAAC,kBAAkB,gDAAgD;YAC1E,+CAA+C,CAClD,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACjD,MAAM,IAAI,kDAAsB,CAC9B,4EAA4E;YAC1E,oEAAoE,CACvE,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAOD,SAAS,uBAAuB,CAAC,IAAyB;IACxD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,yBAAyB,CAAC;IACjD,IAAI,KAAK,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QACnD,MAAM,IAAI,kDAAsB,CAC9B,uEAAuE;YACrE,sEAAsE;YACtE,UAAU,CACb,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QACnD,MAAM,IAAI,kDAAsB,CAC9B,0EAA0E;YACxE,wCAAwC,CAC3C,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrD,MAAM,IAAI,kDAAsB,CAAC,yCAAyC,CAAC,CAAC;QAC9E,CAAC;QACD,qBAAqB,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;YAC7C,qBAAqB,CAAC,uBAAuB,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,kDAAsB,CAC9B,yEAAyE;YACvE,yEAAyE,CAC5E,CAAC;IACJ,CAAC;IACD,IAAA,8CAA4B,EAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACvD,IAAA,0CAAwB,EACtB,wCAAwC,EACxC,SAAS,CAAC,YAAY,CACvB,CAAC;IACF,IAAI,SAAS,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC3C,IAAA,0CAAwB,EACtB,0CAA0C,EAC1C,SAAS,CAAC,cAAc,CACzB,CAAC;IACJ,CAAC;IACD,IAAA,uCAAmB,EAAC,SAAS,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;AACtD,CAAC;AAOD,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,kDAAsB,CAC9B,yEAAyE;YACvE,yCAAyC,CAC5C,CAAC;IACJ,CAAC;IACD,IAAA,0CAAwB,EAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;IACvD,IAAI,IAAA,iCAAwB,EAAC,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,kDAAsB,CAC9B,mDAAmD,CACpD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,KAAa;IACxD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kDAAsB,CAAC,GAAG,IAAI,kCAAkC,KAAK,IAAI,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,kDAAsB,CAC9B,GAAG,IAAI,gCAAgC,MAAM,CAAC,QAAQ,IAAI,CAC3D,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/config/redirect-origin.d.ts

@@ -0,0 +1,12 @@
+export interface RedirectOriginPattern {
+    readonly source: string;
+    readonly scheme: 'http' | 'https';
+    readonly wildcard: boolean;
+    readonly hostRemainder: string;
+    readonly port: number | null;
+}
+export declare function parseRedirectOriginPattern(entry: string): RedirectOriginPattern;
+export declare function parseRedirectOriginAllowlist(entries: readonly string[]): readonly RedirectOriginPattern[];
+export declare function matchRedirectOrigin(patterns: readonly RedirectOriginPattern[], authority: string): string | null;
+export declare function assertOriginRelativePath(name: string, value: string): void;
+//# sourceMappingURL=redirect-origin.d.ts.map

package/dist/config/redirect-origin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-origin.d.ts","sourceRoot":"","sources":["../../src/config/redirect-origin.ts"],"names":[],"mappings":"AAmCA,MAAM,WAAW,qBAAqB;IAEpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAElC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAE3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAoBD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,CA8B/E;AAQD,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB,SAAS,qBAAqB,EAAE,CAsBlC;AASD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,SAAS,qBAAqB,EAAE,EAC1C,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI,CAwBf;AA+BD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAW1E"}

package/dist/config/redirect-origin.js

@@ -0,0 +1,113 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseRedirectOriginPattern = parseRedirectOriginPattern;
+exports.parseRedirectOriginAllowlist = parseRedirectOriginAllowlist;
+exports.matchRedirectOrigin = matchRedirectOrigin;
+exports.assertOriginRelativePath = assertOriginRelativePath;
+const oidc_session_config_error_1 = require("./oidc-session-config-error");
+const DEFAULT_PORT = {
+    http: 80,
+    https: 443,
+};
+const LABEL = '[a-z0-9](?:[a-z0-9-]*[a-z0-9])?';
+const EXACT_HOST = new RegExp(`^${LABEL}(?:\\.${LABEL})*$`, 'u');
+const WILDCARD_REMAINDER = new RegExp(`^[a-z0-9-]*(?:\\.${LABEL}){2,}$`, 'u');
+const ENTRY = /^(https?):\/\/([^/:?#@\s]+)(?::(\d{1,5}))?\/?$/u;
+const AUTHORITY = /^([a-z0-9.-]+)(?::(\d{1,5}))?$/u;
+const WILDCARD_FILL = /^[a-z0-9-]+$/u;
+function parseRedirectOriginPattern(entry) {
+    const trimmed = entry.trim();
+    const match = ENTRY.exec(trimmed.toLowerCase());
+    if (match === null) {
+        throw new oidc_session_config_error_1.OidcSessionConfigError(`redirect origin "${entry}" is not an origin of the form ` +
+            '"https://host[:port]" — no path, query, fragment or credentials.');
+    }
+    const scheme = match[1];
+    const host = match[2] ?? '';
+    const port = parsePort(entry, match[3]);
+    if (host.startsWith('*')) {
+        const remainder = host.slice(1);
+        if (remainder.includes('*') || !WILDCARD_REMAINDER.test(remainder)) {
+            throw new oidc_session_config_error_1.OidcSessionConfigError(`redirect origin "${entry}" has an unsupported wildcard. A single "*" ` +
+                'may open the FIRST label only, and at least two labels must follow ' +
+                'it (e.g. "https://*-preview.example.com").');
+        }
+        return { source: trimmed, scheme, wildcard: true, hostRemainder: remainder, port };
+    }
+    if (host.includes('*') || !EXACT_HOST.test(host)) {
+        throw new oidc_session_config_error_1.OidcSessionConfigError(`redirect origin "${entry}" does not name a valid host.`);
+    }
+    return { source: trimmed, scheme, wildcard: false, hostRemainder: host, port };
+}
+function parseRedirectOriginAllowlist(entries) {
+    if (entries.length === 0) {
+        throw new oidc_session_config_error_1.OidcSessionConfigError('redirect origin allowlist is empty — no address could ever sign in.');
+    }
+    const patterns = entries.map(parseRedirectOriginPattern);
+    const seen = new Map();
+    for (const pattern of patterns) {
+        const key = `${pattern.wildcard ? '*' : ''}${pattern.hostRemainder}:${pattern.port ?? DEFAULT_PORT[pattern.scheme]}`;
+        const earlier = seen.get(key);
+        if (earlier !== undefined) {
+            throw new oidc_session_config_error_1.OidcSessionConfigError(`redirect origins "${earlier}" and "${pattern.source}" name the same ` +
+                'address; each address may appear once, under one scheme.');
+        }
+        seen.set(key, pattern.source);
+    }
+    return patterns;
+}
+function matchRedirectOrigin(patterns, authority) {
+    const parsed = AUTHORITY.exec(authority.trim().toLowerCase());
+    if (parsed === null) {
+        return null;
+    }
+    const host = stripTrailingDot(parsed[1] ?? '');
+    if (!EXACT_HOST.test(host)) {
+        return null;
+    }
+    const requestPort = parsed[2] === undefined ? null : Number(parsed[2]);
+    for (const pattern of patterns) {
+        const expectedPort = pattern.port ?? DEFAULT_PORT[pattern.scheme];
+        if ((requestPort ?? DEFAULT_PORT[pattern.scheme]) !== expectedPort) {
+            continue;
+        }
+        if (!hostMatches(pattern, host)) {
+            continue;
+        }
+        const portSuffix = expectedPort === DEFAULT_PORT[pattern.scheme] ? '' : `:${String(expectedPort)}`;
+        return `${pattern.scheme}://${host}${portSuffix}`;
+    }
+    return null;
+}
+function hostMatches(pattern, host) {
+    if (!pattern.wildcard) {
+        return host === pattern.hostRemainder;
+    }
+    if (!host.endsWith(pattern.hostRemainder)) {
+        return false;
+    }
+    const fill = host.slice(0, host.length - pattern.hostRemainder.length);
+    return WILDCARD_FILL.test(fill);
+}
+function stripTrailingDot(host) {
+    return host.endsWith('.') ? host.slice(0, -1) : host;
+}
+function parsePort(entry, raw) {
+    if (raw === undefined) {
+        return null;
+    }
+    const port = Number(raw);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new oidc_session_config_error_1.OidcSessionConfigError(`redirect origin "${entry}" carries an invalid port "${raw}".`);
+    }
+    return port;
+}
+function assertOriginRelativePath(name, value) {
+    if (!value.startsWith('/') ||
+        value.startsWith('//') ||
+        /[?#\\\s]/u.test(value)) {
+        throw new oidc_session_config_error_1.OidcSessionConfigError(`${name} must be an absolute path on the application's own origin ` +
+            `(e.g. "/auth/callback") with no query or fragment; got "${value}".`);
+    }
+}
+//# sourceMappingURL=redirect-origin.js.map

package/dist/config/redirect-origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-origin.js","sourceRoot":"","sources":["../../src/config/redirect-origin.ts"],"names":[],"mappings":";;AAiEA,gEA8BC;AAQD,oEAwBC;AASD,kDA2BC;AA+BD,4DAWC;AA7KD,2EAAqE;AAerE,MAAM,YAAY,GAA+C;IAC/D,IAAI,EAAE,EAAE;IACR,KAAK,EAAE,GAAG;CACX,CAAC;AAEF,MAAM,KAAK,GAAG,iCAAiC,CAAC;AAChD,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,KAAK,KAAK,EAAE,GAAG,CAAC,CAAC;AAEjE,MAAM,kBAAkB,GAAG,IAAI,MAAM,CACnC,oBAAoB,KAAK,QAAQ,EACjC,GAAG,CACJ,CAAC;AACF,MAAM,KAAK,GAAG,iDAAiD,CAAC;AAEhE,MAAM,SAAS,GAAG,iCAAiC,CAAC;AACpD,MAAM,aAAa,GAAG,eAAe,CAAC;AAGtC,SAAgB,0BAA0B,CAAC,KAAa;IACtD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAChD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,kDAAsB,CAC9B,oBAAoB,KAAK,iCAAiC;YACxD,kEAAkE,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAqB,CAAC;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAExC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,kDAAsB,CAC9B,oBAAoB,KAAK,8CAA8C;gBACrE,qEAAqE;gBACrE,4CAA4C,CAC/C,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACrF,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,kDAAsB,CAC9B,oBAAoB,KAAK,+BAA+B,CACzD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACjF,CAAC;AAQD,SAAgB,4BAA4B,CAC1C,OAA0B;IAE1B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,kDAAsB,CAC9B,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,aAAa,IAChE,OAAO,CAAC,IAAI,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,CAC7C,EAAE,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,kDAAsB,CAC9B,qBAAqB,OAAO,UAAU,OAAO,CAAC,MAAM,kBAAkB;gBACpE,0DAA0D,CAC7D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AASD,SAAgB,mBAAmB,CACjC,QAA0C,EAC1C,SAAiB;IAEjB,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9D,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClE,IAAI,CAAC,WAAW,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC;YACnE,SAAS;QACX,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAChC,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GACd,YAAY,KAAK,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAClF,OAAO,GAAG,OAAO,CAAC,MAAM,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,OAA8B,EAAE,IAAY;IAC/D,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,IAAI,KAAK,OAAO,CAAC,aAAa,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACvE,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,GAAuB;IACvD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACxD,MAAM,IAAI,kDAAsB,CAC9B,oBAAoB,KAAK,8BAA8B,GAAG,IAAI,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAGD,SAAgB,wBAAwB,CAAC,IAAY,EAAE,KAAa;IAClE,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACtB,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QACtB,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EACvB,CAAC;QACD,MAAM,IAAI,kDAAsB,CAC9B,GAAG,IAAI,4DAA4D;YACjE,2DAA2D,KAAK,IAAI,CACvE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/errors.d.ts

@@ -5,7 +5,9 @@ export declare enum OidcSessionErrorCode {
     OidcCallbackRejected = "OIDC_CALLBACK_REJECTED",
     OidcLoginStateUnknown = "OIDC_LOGIN_STATE_UNKNOWN",
     OidcTokenEndpointFailed = "OIDC_TOKEN_ENDPOINT_FAILED",
-    SessionRefreshContended = "SESSION_REFRESH_CONTENDED"
+    SessionRefreshContended = "SESSION_REFRESH_CONTENDED",
+    OidcRedirectOriginNotAllowed = "OIDC_REDIRECT_ORIGIN_NOT_ALLOWED",
+    OidcLoginOriginMismatch = "OIDC_LOGIN_ORIGIN_MISMATCH"
 }
 export interface OidcSessionErrorBody {
     readonly code: OidcSessionErrorCode;
@@ -34,4 +36,10 @@ export declare class OidcTokenEndpointFailedError extends OidcSessionError {
 export declare class SessionRefreshContendedError extends OidcSessionError {
     constructor(detail?: string);
 }
+export declare class OidcRedirectOriginNotAllowedError extends OidcSessionError {
+    constructor(detail: string);
+}
+export declare class OidcLoginOriginMismatchError extends OidcSessionError {
+    constructor(detail?: string);
+}
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAM3D,oBAAY,oBAAoB;IAE9B,eAAe,qBAAqB;IAOpC,cAAc,oBAAoB;IAElC,oBAAoB,2BAA2B;IAM/C,qBAAqB,6BAA6B;IAMlD,uBAAuB,+BAA+B;IAMtD,uBAAuB,8BAA8B;CACtD;AAGD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAGD,qBAAa,gBAAiB,SAAQ,aAAa;IACjD,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;gBAGlC,IAAI,EAAE,oBAAoB,EAC1B,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM;CAYjB;AAED,qBAAa,oBAAqB,SAAQ,gBAAgB;gBAC5C,MAAM,SAAgD;CAQnE;AAED,qBAAa,mBAAoB,SAAQ,gBAAgB;gBAC3C,MAAM,SAAsD;CAQzE;AAED,qBAAa,yBAA0B,SAAQ,gBAAgB;gBACjD,MAAM,EAAE,MAAM;CAQ3B;AAED,qBAAa,0BAA2B,SAAQ,gBAAgB;gBAE5D,MAAM,SAAgF;CASzF;AAED,qBAAa,4BAA6B,SAAQ,gBAAgB;gBACpD,MAAM,EAAE,MAAM;CAQ3B;AAED,qBAAa,4BAA6B,SAAQ,gBAAgB;gBAE9D,MAAM,SAA+D;CASxE"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAM3D,oBAAY,oBAAoB;IAE9B,eAAe,qBAAqB;IAOpC,cAAc,oBAAoB;IAElC,oBAAoB,2BAA2B;IAM/C,qBAAqB,6BAA6B;IAMlD,uBAAuB,+BAA+B;IAMtD,uBAAuB,8BAA8B;IASrD,4BAA4B,qCAAqC;IAOjE,uBAAuB,+BAA+B;CACvD;AAGD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAGD,qBAAa,gBAAiB,SAAQ,aAAa;IACjD,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;gBAGlC,IAAI,EAAE,oBAAoB,EAC1B,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM;CAYjB;AAED,qBAAa,oBAAqB,SAAQ,gBAAgB;gBAC5C,MAAM,SAAgD;CAQnE;AAED,qBAAa,mBAAoB,SAAQ,gBAAgB;gBAC3C,MAAM,SAAsD;CAQzE;AAED,qBAAa,yBAA0B,SAAQ,gBAAgB;gBACjD,MAAM,EAAE,MAAM;CAQ3B;AAED,qBAAa,0BAA2B,SAAQ,gBAAgB;gBAE5D,MAAM,SAAgF;CASzF;AAED,qBAAa,4BAA6B,SAAQ,gBAAgB;gBACpD,MAAM,EAAE,MAAM;CAQ3B;AAED,qBAAa,4BAA6B,SAAQ,gBAAgB;gBAE9D,MAAM,SAA+D;CASxE;AAED,qBAAa,iCAAkC,SAAQ,gBAAgB;gBACzD,MAAM,EAAE,MAAM;CAQ3B;AAED,qBAAa,4BAA6B,SAAQ,gBAAgB;gBAE9D,MAAM,SAAiG;CAS1G"}