alepha 0.22.0 → 0.24.0

package/dist/api/oauth/index.js

@@ -1,10 +1,11 @@
-import { $atom, $inject, $module, $state, Alepha, AlephaError, t } from "alepha";
+import { $atom, $inject, $module, $state, Alepha, AlephaError, z } from "alepha";
 import { $logger } from "alepha/logger";
+import { JwtProvider } from "alepha/security";
 import { $route } from "alepha/server";
 import { createHash, randomUUID } from "node:crypto";
+import { CryptoProvider } from "alepha/crypto";
 import { DateTimeProvider } from "alepha/datetime";
 import { $entity, $repository, db } from "alepha/orm";
-import { JwtProvider } from "alepha/security";
 //#region ../../src/api/oauth/helpers/consentPage.ts
 const escapeHtml = (s) => s.replace(/[&<>"']/g, (c) => ({
 	"&": "&amp;",
@@ -53,6 +54,7 @@ const buildAuthorizationServerMetadata = (baseUrl) => ({
 	authorization_endpoint: `${baseUrl}/oauth/authorize`,
 	token_endpoint: `${baseUrl}/oauth/token`,
 	registration_endpoint: `${baseUrl}/oauth/register`,
+	jwks_uri: `${baseUrl}/oauth/jwks`,
 	response_types_supported: ["code"],
 	grant_types_supported: ["authorization_code", "refresh_token"],
 	code_challenge_methods_supported: ["S256"],
@@ -70,37 +72,65 @@ const buildProtectedResourceMetadata = (baseUrl, resource) => ({
 	bearer_methods_supported: ["header"]
 });
 //#endregion
+//#region ../../src/api/oauth/helpers/oidcMetadata.ts
+/**
+* OpenID Connect Discovery 1.0 — provider metadata document
+* (`/.well-known/openid-configuration`). `baseUrl` is the absolute origin of
+* the OIDC provider (e.g. https://alepha.club).
+*/
+const buildOpenIdConfiguration = (baseUrl) => ({
+	issuer: baseUrl,
+	authorization_endpoint: `${baseUrl}/oauth/authorize`,
+	token_endpoint: `${baseUrl}/oauth/token`,
+	jwks_uri: `${baseUrl}/oauth/jwks`,
+	registration_endpoint: `${baseUrl}/oauth/register`,
+	response_types_supported: ["code"],
+	grant_types_supported: ["authorization_code", "refresh_token"],
+	subject_types_supported: ["public"],
+	id_token_signing_alg_values_supported: ["EdDSA", "RS256"],
+	code_challenge_methods_supported: ["S256"],
+	token_endpoint_auth_methods_supported: ["none", "client_secret_post"],
+	scopes_supported: [
+		"openid",
+		"email",
+		"profile"
+	]
+});
+//#endregion
 //#region ../../src/api/oauth/schemas/authorizeDecisionBodySchema.ts
 /**
 * Body posted by the consent screen. All authorization-request parameters
 * are round-tripped through hidden form fields so the POST handler can
 * re-validate them without server-side session state.
 */
-const authorizeDecisionBodySchema = t.object({
-	decision: t.text(),
-	response_type: t.text(),
-	client_id: t.text(),
-	redirect_uri: t.text({ maxLength: 2048 }),
-	code_challenge: t.text(),
-	code_challenge_method: t.text(),
-	scope: t.optional(t.text({ maxLength: 1024 })),
-	state: t.optional(t.text({ maxLength: 512 })),
-	resource: t.optional(t.text({ maxLength: 2048 }))
+const authorizeDecisionBodySchema = z.object({
+	decision: z.text(),
+	response_type: z.text(),
+	client_id: z.text(),
+	redirect_uri: z.text({ maxLength: 2048 }),
+	code_challenge: z.text(),
+	code_challenge_method: z.text(),
+	scope: z.text({ maxLength: 1024 }).optional(),
+	state: z.text({ maxLength: 512 }).optional(),
+	resource: z.text({ maxLength: 2048 }).optional(),
+	nonce: z.text({ maxLength: 512 }).optional()
 });
 //#endregion
 //#region ../../src/api/oauth/schemas/authorizeQuerySchema.ts
 /**
 * OAuth 2.1 authorization request query parameters (GET /oauth/authorize).
 */
-const authorizeQuerySchema = t.object({
-	response_type: t.text(),
-	client_id: t.text(),
-	redirect_uri: t.text({ maxLength: 2048 }),
-	code_challenge: t.text(),
-	code_challenge_method: t.text(),
-	scope: t.optional(t.text({ maxLength: 1024 })),
-	state: t.optional(t.text({ maxLength: 512 })),
-	resource: t.optional(t.text({ maxLength: 2048 }))
+const authorizeQuerySchema = z.object({
+	response_type: z.text(),
+	client_id: z.text(),
+	redirect_uri: z.text({ maxLength: 2048 }),
+	code_challenge: z.text(),
+	code_challenge_method: z.text(),
+	scope: z.text({ maxLength: 1024 }).optional(),
+	state: z.text({ maxLength: 512 }).optional(),
+	resource: z.text({ maxLength: 2048 }).optional(),
+	prompt: z.text({ maxLength: 64 }).optional(),
+	nonce: z.text({ maxLength: 512 }).optional()
 });
 //#endregion
 //#region ../../src/api/oauth/schemas/registerClientBodySchema.ts
@@ -108,13 +138,13 @@ const authorizeQuerySchema = t.object({
 * RFC 7591 Dynamic Client Registration request body.
 * Only the fields Alepha consumes are typed; unknown fields are ignored.
 */
-const registerClientBodySchema = t.object({
-	client_name: t.optional(t.text({ maxLength: 200 })),
-	redirect_uris: t.array(t.text({ maxLength: 2048 }), { minItems: 1 }),
-	scope: t.optional(t.text({ maxLength: 1024 })),
-	grant_types: t.optional(t.array(t.text())),
-	token_endpoint_auth_method: t.optional(t.text())
-}, { additionalProperties: true });
+const registerClientBodySchema = z.object({
+	client_name: z.text({ maxLength: 200 }).optional(),
+	redirect_uris: z.array(z.text({ maxLength: 2048 })).min(1),
+	scope: z.text({ maxLength: 1024 }).optional(),
+	grant_types: z.array(z.text()).optional(),
+	token_endpoint_auth_method: z.text().optional()
+}).meta({ additionalProperties: true });
 //#endregion
 //#region ../../src/api/oauth/schemas/tokenRequestBodySchema.ts
 /**
@@ -123,13 +153,14 @@ const registerClientBodySchema = t.object({
 * optional at the schema level; the handler enforces the grant-specific
 * requirements and returns the appropriate OAuth error responses.
 */
-const tokenRequestBodySchema = t.object({
-	grant_type: t.optional(t.text()),
-	code: t.optional(t.text({ maxLength: 4096 })),
-	client_id: t.optional(t.text()),
-	redirect_uri: t.optional(t.text({ maxLength: 2048 })),
-	code_verifier: t.optional(t.text({ maxLength: 256 })),
-	refresh_token: t.optional(t.text({ maxLength: 4096 }))
+const tokenRequestBodySchema = z.object({
+	grant_type: z.text().optional(),
+	code: z.text({ maxLength: 4096 }).optional(),
+	client_id: z.text().optional(),
+	redirect_uri: z.text({ maxLength: 2048 }).optional(),
+	code_verifier: z.text({ maxLength: 256 }).optional(),
+	refresh_token: z.text({ maxLength: 4096 }).optional(),
+	client_secret: z.text({ maxLength: 512 }).optional()
 });
 //#endregion
 //#region ../../src/api/oauth/entities/oauthClientEntity.ts
@@ -143,19 +174,36 @@ const tokenRequestBodySchema = t.object({
 */
 const oauthClientEntity = $entity({
 	name: "oauth_clients",
-	schema: t.object({
-		id: db.primaryKey(t.uuid()),
+	schema: z.object({
+		id: db.primaryKey(z.uuid()),
 		createdAt: db.createdAt(),
 		updatedAt: db.updatedAt(),
-		clientId: t.text({ maxLength: 64 }),
-		clientName: t.text({ maxLength: 200 }),
-		redirectUris: db.default(t.array(t.text({ maxLength: 2048 })), []),
-		scopes: db.default(t.array(t.text({ maxLength: 64 })), []),
-		realm: t.text({ maxLength: 100 }),
-		source: db.default(t.text({ maxLength: 16 }), "dcr"),
-		createdByUserId: t.optional(t.uuid()),
-		lastUsedAt: t.optional(t.datetime()),
-		revokedAt: t.optional(t.datetime())
+		clientId: z.text({ maxLength: 64 }),
+		clientName: z.text({ maxLength: 200 }),
+		redirectUris: db.default(z.array(z.text({ maxLength: 2048 })), []),
+		scopes: db.default(z.array(z.text({ maxLength: 64 })), []),
+		realm: z.text({ maxLength: 100 }),
+		/**
+		* OAuth client type. `confidential` clients authenticate at the token
+		* endpoint with a secret; `public` clients rely on PKCE only.
+		*/
+		type: db.default(z.enum(["public", "confidential"]), "public"),
+		/**
+		* First-party client: skip the consent screen. Consent exists to protect a
+		* user from THIRD-party apps requesting their data; a trusted client is the
+		* authorization server's own product (same vendor), so an authenticated
+		* user is sent straight back with a code — no "App X wants to connect" page.
+		*/
+		trusted: db.default(z.boolean(), false),
+		/**
+		* Scrypt hash of the client secret (confidential clients only). Null for
+		* public clients. Verified via `OAuthClientService.verifySecret`.
+		*/
+		clientSecretHash: z.text({ maxLength: 256 }).optional(),
+		source: db.default(z.text({ maxLength: 16 }), "dcr"),
+		createdByUserId: z.uuid().optional(),
+		lastUsedAt: z.datetime().optional(),
+		revokedAt: z.datetime().optional()
 	}),
 	indexes: [{
 		columns: ["clientId"],
@@ -182,6 +230,7 @@ var OAuthClientService = class {
 	log = $logger();
 	repo = $repository(oauthClientEntity);
 	jwt = $inject(JwtProvider);
+	crypto = $inject(CryptoProvider);
 	/**
 	* Codes already redeemed in this process. Single-use enforcement only
 	* needs to cover the ~60s code lifetime, so a bounded in-memory set is
@@ -221,6 +270,35 @@ var OAuthClientService = class {
 		};
 	}
 	/**
+	* Mint an OIDC `id_token` for a consumed grant, signed by the realm's issuer
+	* key (asymmetric when configured). Claims: iss, sub, aud (client_id), exp,
+	* iat, nonce (when present), plus the standard profile claims the loader
+	* provides: email, email_verified, name, given_name, family_name,
+	* preferred_username, picture.
+	*/
+	async issueIdToken(realm, params) {
+		const entry = this.issuers.get(realm);
+		if (!entry) throw new AlephaError(`No issuer registered for realm '${realm}'`);
+		const user = await entry.loadUser(params.userId);
+		const iat = this.dateTime.now().unix();
+		const exp = iat + entry.issuer.accessTokenExpiration.asSeconds();
+		return this.jwt.create({
+			iss: params.issuer,
+			sub: user.id,
+			aud: params.clientId,
+			exp,
+			iat,
+			...params.nonce ? { nonce: params.nonce } : {},
+			...user.email ? { email: user.email } : {},
+			...user.emailVerified !== void 0 ? { email_verified: user.emailVerified } : {},
+			...user.name ? { name: user.name } : {},
+			...user.firstName ? { given_name: user.firstName } : {},
+			...user.lastName ? { family_name: user.lastName } : {},
+			...user.username ? { preferred_username: user.username } : {},
+			...user.picture ? { picture: user.picture } : {}
+		}, realm, { header: { typ: "JWT" } });
+	}
+	/**
 	* Exchange a refresh token for a fresh access token (OAuth 2.1
 	* `refresh_token` grant), using the issuer registered for `realm`. Lets an
 	* MCP client stay connected for the refresh token's full lifetime without
@@ -230,11 +308,12 @@ var OAuthClientService = class {
 	async refreshAccessToken(realm, refreshToken) {
 		const entry = this.issuers.get(realm);
 		if (!entry) throw new AlephaError(`No issuer registered for realm '${realm}'`);
-		const { tokens } = await entry.issuer.refreshToken(refreshToken);
+		const { tokens, user } = await entry.issuer.refreshToken(refreshToken);
 		return {
 			access_token: tokens.access_token,
 			expires_in: tokens.expires_in,
-			refresh_token: tokens.refresh_token
+			refresh_token: tokens.refresh_token,
+			userId: user.id
 		};
 	}
 	/**
@@ -243,35 +322,106 @@ var OAuthClientService = class {
 	*/
 	async register(options) {
 		if (options.redirectUris.length === 0) throw new AlephaError("At least one redirect_uri is required");
-		for (const uri of options.redirectUris) if (!uri.startsWith("https://") && !uri.startsWith("http://localhost")) throw new AlephaError(`Invalid redirect_uri: ${uri}`);
-		const clientId = `mcp_${randomUUID().replace(/-/g, "")}`;
+		for (const uri of options.redirectUris) this.assertValidRedirectUri(uri);
+		const type = options.type ?? "public";
+		if (type === "confidential" && !options.secret) throw new AlephaError("A confidential client requires a secret");
+		const clientId = options.clientId ?? `mcp_${randomUUID().replace(/-/g, "")}`;
+		const clientSecretHash = options.secret ? await this.crypto.hashPassword(options.secret) : void 0;
 		const client = await this.repo.create({
 			clientId,
-			clientName: options.clientName || "MCP Client",
+			clientName: options.clientName || "OAuth Client",
 			redirectUris: options.redirectUris,
-			scopes: options.scopes,
+			scopes: options.scopes ?? ["openid"],
 			realm: options.realm,
+			type,
+			trusted: options.trusted ?? false,
+			clientSecretHash,
 			source: options.source ?? "dcr",
 			createdByUserId: options.createdByUserId
 		});
 		this.log.info("OAuth client registered", {
 			clientId,
+			type,
 			source: client.source
 		});
 		return client;
 	}
 	/**
+	* Idempotently align a registered client's redirect_uri allowlist with the
+	* given list. No-op when the client is unknown or the list already matches —
+	* safe to call from post-deploy seeders (allowlist changes ship as code, and
+	* `register` alone would leave existing rows stale).
+	*/
+	async updateRedirectUris(clientId, redirectUris) {
+		if (redirectUris.length === 0) throw new AlephaError("At least one redirect_uri is required");
+		for (const uri of redirectUris) this.assertValidRedirectUri(uri);
+		const client = await this.findByClientId(clientId);
+		if (!client) return;
+		if (client.redirectUris.length === redirectUris.length && client.redirectUris.every((uri, i) => uri === redirectUris[i])) return;
+		await this.repo.updateById(client.id, { redirectUris });
+		this.log.info("OAuth client redirect_uris updated", {
+			clientId,
+			redirectUris
+		});
+	}
+	/**
+	* Verify a confidential client's secret against its stored scrypt hash.
+	* Returns false for unknown/revoked/public (no-hash) clients.
+	*/
+	async verifySecret(clientId, secret) {
+		const client = await this.findByClientId(clientId);
+		if (!client || client.revokedAt || !client.clientSecretHash) return false;
+		return this.crypto.verifyPassword(secret, client.clientSecretHash);
+	}
+	/**
+	* Validate a registered redirect_uri. https (or http://localhost) only, and
+	* at most a single `*` which must live inside the host (see
+	* `redirectUriMatches` for the matching rule).
+	*/
+	assertValidRedirectUri(uri) {
+		const stars = (uri.match(/\*/g) ?? []).length;
+		if (stars > 1) throw new AlephaError(`At most one '*' wildcard is allowed in redirect_uri: ${uri}`);
+		const probe = uri.replace("*", "wildcard");
+		if (!probe.startsWith("https://") && !probe.startsWith("http://localhost")) throw new AlephaError(`Invalid redirect_uri: ${uri}`);
+		if (stars === 1) {
+			if (!(uri.slice(uri.indexOf("://") + 3).split("/")[0] ?? "").includes("*")) throw new AlephaError(`Wildcard '*' is only allowed in the host: ${uri}`);
+		}
+	}
+	/**
 	* Look up a client by its public `clientId`. Returns null if unknown.
 	*/
 	async findByClientId(clientId) {
 		return await this.repo.findOne({ where: { clientId: { eq: clientId } } }) ?? null;
 	}
 	/**
-	* Exact-match redirect_uri check. OAuth 2.1 forbids substring/prefix
-	* matching — the value must equal a registered URI byte-for-byte.
+	* Narrow the scopes a client asks for to those it is actually registered
+	* for. The requested scope string is attacker-controlled, so it must never
+	* be trusted verbatim — a client registered for `["mcp"]` that asks for
+	* `mcp admin` must only be granted `mcp`. When nothing (usable) is
+	* requested, the client's full registered set is the default grant.
+	* Requested order is preserved and duplicates are dropped.
+	*/
+	intersectScopes(requested, allowed) {
+		if (!requested || requested.length === 0) return allowed;
+		const allowedSet = new Set(allowed);
+		const granted = [];
+		for (const scope of requested) if (allowedSet.has(scope) && !granted.includes(scope)) granted.push(scope);
+		return granted;
+	}
+	/**
+	* Redirect_uri check. A registered pattern is matched byte-exact unless it
+	* contains a single `*`, which matches exactly ONE host label (no dots).
+	* E.g. `https://*.alepha.club/auth/callback` matches
+	* `https://b14.alepha.club/auth/callback` but NOT `https://alepha.club/...`
+	* nor `https://a.b.alepha.club/...`.
 	*/
 	isRedirectUriAllowed(client, redirectUri) {
-		return client.redirectUris.includes(redirectUri);
+		return client.redirectUris.some((pattern) => this.redirectUriMatches(pattern, redirectUri));
+	}
+	redirectUriMatches(pattern, candidate) {
+		if (!pattern.includes("*")) return pattern === candidate;
+		const escaped = pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+		return new RegExp(`^${escaped.replace("\\*", "[^.]+")}$`).test(candidate);
 	}
 	/**
 	* Mint a stateless authorization code: a short-lived signed JWT
@@ -286,6 +436,7 @@ var OAuthClientService = class {
 			code_challenge: grant.codeChallenge,
 			scopes: grant.scopes,
 			resource: grant.resource,
+			nonce: grant.nonce,
 			iat,
 			exp: iat + 60,
 			jti: randomUUID()
@@ -307,7 +458,8 @@ var OAuthClientService = class {
 		return {
 			userId: payload.sub,
 			scopes: payload.scopes ?? [],
-			resource: payload.resource
+			resource: payload.resource,
+			nonce: payload.nonce
 		};
 	}
 };
@@ -323,10 +475,10 @@ var OAuthClientService = class {
 const oauthOptions = $atom({
 	name: "alepha.api.oauth.options",
 	description: "Configuration for the OAuth authorization server.",
-	schema: t.object({
-		realm: t.text({ default: "users" }),
-		resource: t.text({ default: "/mcp" }),
-		loginPath: t.text({ default: "/login" })
+	schema: z.object({
+		realm: z.text({ default: "users" }),
+		resource: z.text({ default: "/mcp" }),
+		loginPath: z.text({ default: "/login" })
 	}),
 	default: {
 		realm: "users",
@@ -343,6 +495,7 @@ var OAuthController = class {
 	log = $logger();
 	options = $state(oauthOptions);
 	clients = $inject(OAuthClientService);
+	jwt = $inject(JwtProvider);
 	/**
 	* Absolute origin of the current request, e.g. https://app.com.
 	*/
@@ -366,6 +519,22 @@ var OAuthController = class {
 			reply.body = JSON.stringify(buildProtectedResourceMetadata(base, `${base}${this.options.resource}`));
 		}
 	});
+	openidConfiguration = $route({
+		method: "GET",
+		path: "/.well-known/openid-configuration",
+		handler: ({ url, reply }) => {
+			reply.headers["content-type"] = "application/json";
+			reply.body = JSON.stringify(buildOpenIdConfiguration(this.baseUrl(url)));
+		}
+	});
+	jwks = $route({
+		method: "GET",
+		path: "/oauth/jwks",
+		handler: async ({ reply }) => {
+			reply.headers["content-type"] = "application/json";
+			reply.body = JSON.stringify(await this.jwt.getJwks(this.options.realm));
+		}
+	});
 	register = $route({
 		method: "POST",
 		path: "/oauth/register",
@@ -422,16 +591,41 @@ var OAuthController = class {
 				reply.body = "redirect_uri not registered";
 				return;
 			}
+			const silent = query.prompt === "none";
+			const skipConsent = silent || client.trusted === true;
 			if (!user) {
+				if (silent) {
+					const redirect = new URL(query.redirect_uri);
+					redirect.searchParams.set("error", "login_required");
+					if (query.state) redirect.searchParams.set("state", query.state);
+					reply.redirect(redirect.toString(), 302);
+					return;
+				}
 				const returnTo = encodeURIComponent(url.pathname + url.search);
 				reply.redirect(`${this.options.loginPath}?redirect_uri=${returnTo}`, 302);
 				return;
 			}
+			if (skipConsent) {
+				const code = await this.clients.createAuthorizationCode(this.options.realm, {
+					userId: user.id,
+					clientId: query.client_id,
+					redirectUri: query.redirect_uri,
+					codeChallenge: query.code_challenge,
+					scopes: this.clients.intersectScopes(query.scope?.split(" "), client.scopes),
+					resource: query.resource || void 0,
+					nonce: query.nonce
+				});
+				const redirect = new URL(query.redirect_uri);
+				redirect.searchParams.set("code", code);
+				if (query.state) redirect.searchParams.set("state", query.state);
+				reply.redirect(redirect.toString(), 302);
+				return;
+			}
 			reply.headers["content-type"] = "text/html; charset=utf-8";
 			reply.body = renderConsentPage({
 				clientName: client.clientName,
 				userName: user.name ?? user.email ?? "your account",
-				scopes: query.scope ? query.scope.split(" ") : client.scopes,
+				scopes: this.clients.intersectScopes(query.scope?.split(" "), client.scopes),
 				hidden: {
 					response_type: query.response_type,
 					client_id: query.client_id,
@@ -440,7 +634,8 @@ var OAuthController = class {
 					code_challenge_method: query.code_challenge_method,
 					scope: query.scope ?? "",
 					state: query.state ?? "",
-					resource: query.resource ?? ""
+					resource: query.resource ?? "",
+					nonce: query.nonce ?? ""
 				}
 			});
 		}
@@ -484,8 +679,9 @@ var OAuthController = class {
 				clientId: body.client_id,
 				redirectUri: body.redirect_uri,
 				codeChallenge: body.code_challenge,
-				scopes: body.scope ? body.scope.split(" ") : client.scopes,
-				resource: body.resource || void 0
+				scopes: this.clients.intersectScopes(body.scope?.split(" "), client.scopes),
+				resource: body.resource || void 0,
+				nonce: body.nonce
 			});
 			redirect.searchParams.set("code", code);
 			if (body.state) redirect.searchParams.set("state", body.state);
@@ -503,10 +699,23 @@ var OAuthController = class {
 		path: "/oauth/token",
 		schema: { body: tokenRequestBodySchema },
 		use: [],
-		handler: async ({ body, reply }) => {
+		handler: async ({ body, url, reply }) => {
 			reply.headers["content-type"] = "application/json";
 			try {
 				if (body.grant_type === "authorization_code") {
+					const client = await this.clients.findByClientId(body.client_id ?? "");
+					if (!client || client.revokedAt) {
+						reply.status = 400;
+						reply.body = JSON.stringify({ error: "invalid_client" });
+						return;
+					}
+					if (client.type === "confidential") {
+						if (!await this.clients.verifySecret(client.clientId, body.client_secret ?? "")) {
+							reply.status = 401;
+							reply.body = JSON.stringify({ error: "invalid_client" });
+							return;
+						}
+					}
 					const grant = await this.clients.consumeAuthorizationCode(this.options.realm, body.code ?? "", {
 						clientId: body.client_id ?? "",
 						redirectUri: body.redirect_uri ?? "",
@@ -516,23 +725,36 @@ var OAuthController = class {
 						...grant,
 						clientId: body.client_id ?? ""
 					});
-					reply.body = JSON.stringify({
+					const response = {
 						access_token: tokens.access_token,
 						token_type: "Bearer",
 						expires_in: tokens.expires_in,
 						refresh_token: tokens.refresh_token,
 						scope: grant.scopes.join(" ")
+					};
+					if (grant.scopes.includes("openid")) response.id_token = await this.clients.issueIdToken(this.options.realm, {
+						userId: grant.userId,
+						clientId: body.client_id ?? "",
+						issuer: this.baseUrl(url),
+						nonce: grant.nonce
 					});
+					reply.body = JSON.stringify(response);
 					return;
 				}
 				if (body.grant_type === "refresh_token") {
 					const tokens = await this.clients.refreshAccessToken(this.options.realm, body.refresh_token ?? "");
-					reply.body = JSON.stringify({
+					const response = {
 						access_token: tokens.access_token,
 						token_type: "Bearer",
 						expires_in: tokens.expires_in,
 						refresh_token: tokens.refresh_token
+					};
+					if (body.client_id) response.id_token = await this.clients.issueIdToken(this.options.realm, {
+						userId: tokens.userId,
+						clientId: body.client_id,
+						issuer: this.baseUrl(url)
 					});
+					reply.body = JSON.stringify(response);
 					return;
 				}
 				reply.status = 400;
@@ -573,6 +795,6 @@ const AlephaOAuth = $module({
 	services: [OAuthClientService, OAuthController]
 });
 //#endregion
-export { AlephaOAuth, OAuthClientService, OAuthController, oauthClientEntity, oauthOptions };
+export { AlephaOAuth, OAuthClientService, OAuthController, buildOpenIdConfiguration, oauthClientEntity, oauthOptions };
 
 //# sourceMappingURL=index.js.map