oidc-mock 0.1.2

package/dist/config.js

@@ -0,0 +1,157 @@
+import { readFileSync, statSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { parse } from 'yaml';
+import { z } from 'zod';
+/** `3600`, `"90s"`, `"15m"`, `"1h"`, `"30d"` – always resolved to seconds. */
+const duration = z.union([
+    z.number().int().positive(),
+    z
+        .string()
+        .regex(/^\d+\s*[smhd]$/, 'expected a number of seconds or a string like "15m", "1h", "30d"')
+        .transform((value) => {
+        const amount = Number.parseInt(value, 10);
+        const unit = value.trim().at(-1);
+        return amount * { s: 1, m: 60, h: 3600, d: 86400 }[unit];
+    })
+]);
+const userSchema = z.object({
+    /** The `sub` claim. Stable, so the app sees the same account on every login. */
+    sub: z.string().min(1),
+    /** Button text on the login page. Defaults to `name`, then the email, then `sub`. */
+    label: z.string().optional(),
+    /** Second line on the button, e.g. what this user is meant to test. */
+    description: z.string().optional(),
+    /** Everything that ends up in the id token, the access token and userinfo. */
+    claims: z.record(z.string(), z.unknown()).default({})
+});
+const clientSchema = z.object({
+    client_id: z.string().min(1),
+    /** When set, the token endpoint requires it. Leave it out for public clients. */
+    client_secret: z.string().optional(),
+    /** Allowed redirect URIs. `*` matches anything, e.g. `https://*:5174/*`. Empty allows all. */
+    redirect_uris: z.array(z.string()).default([])
+});
+const configSchema = z.object({
+    /** Where the provider listens. The issuer is built from these unless `issuer` is set. */
+    host: z.string().default('127.0.0.1'),
+    port: z.number().int().min(0).max(65535).default(8090),
+    /** Path prefix of every endpoint. The Vite plugin mounts the login page under the same path. */
+    base_path: z
+        .string()
+        .default('/oidc')
+        .transform((path) => '/' + path.replace(/^\/+|\/+$/g, ''))
+        .transform((path) => (path === '/' ? '' : path)),
+    /** Overrides the issuer, e.g. when the provider sits behind a reverse proxy. */
+    issuer: z.url().optional(),
+    /** Signing key, created on first start. Relative to this file. */
+    key_file: z.string().default('node_modules/.cache/oidc-mock/signing-key.json'),
+    /** No `clients` means every `client_id` is accepted without a secret. */
+    clients: z.array(clientSchema).default([]),
+    tokens: z
+        .object({
+        access_token_ttl: duration.default(3600),
+        id_token_ttl: duration.default(3600),
+        refresh_token_ttl: duration.default(30 * 86400)
+    })
+        .prefault({}),
+    /** Show the free-form “custom claims” box on the login page. */
+    custom_login: z.boolean().default(true),
+    users: z.array(userSchema).default([])
+});
+export class ConfigError extends Error {
+}
+export function resolveConfig(input, file) {
+    const result = configSchema.safeParse(input ?? {});
+    if (!result.success) {
+        const where = file ? ` in ${file}` : '';
+        throw new ConfigError(`Invalid oidc-mock config${where}:\n${z.prettifyError(result.error)}`);
+    }
+    const config = result.data;
+    const subs = new Set();
+    for (const user of config.users) {
+        if (subs.has(user.sub))
+            throw new ConfigError(`Duplicate user sub "${user.sub}"`);
+        subs.add(user.sub);
+    }
+    const issuer = (config.issuer ?? `http://${formatHost(config.host)}:${config.port}${config.base_path}`).replace(/\/+$/, '');
+    const keyFile = resolve(file ? dirname(file) : process.cwd(), config.key_file);
+    return { ...config, issuer, key_file: keyFile, file };
+}
+function formatHost(host) {
+    if (host === '0.0.0.0' || host === '::')
+        return '127.0.0.1';
+    return host.includes(':') ? `[${host}]` : host;
+}
+export function loadConfigFile(path) {
+    const file = resolve(path);
+    const text = readFileSync(file, 'utf8');
+    let parsed;
+    try {
+        parsed = parse(text);
+    }
+    catch (error) {
+        throw new ConfigError(`Could not parse ${file}: ${error.message}`);
+    }
+    return resolveConfig(parsed, file);
+}
+/**
+ * Returns the current config and re-reads the file whenever it changed, so edits to users and
+ * claims apply to the next login without a restart. `host`, `port`, `base_path`, `issuer` and
+ * `key_file` stay as they were at start – changing them needs a restart, and a warning says so.
+ */
+export function watchConfig(initial) {
+    if (!initial.file)
+        return () => initial;
+    const file = initial.file;
+    let current = initial;
+    let lastMtime = statSync(file).mtimeMs;
+    return () => {
+        let mtime;
+        try {
+            mtime = statSync(file).mtimeMs;
+        }
+        catch {
+            return current;
+        }
+        if (mtime === lastMtime)
+            return current;
+        lastMtime = mtime;
+        try {
+            const next = loadConfigFile(file);
+            const fixed = ['host', 'port', 'base_path', 'issuer', 'key_file'];
+            const changed = fixed.filter((key) => next[key] !== initial[key]);
+            if (changed.length) {
+                console.warn(`[oidc-mock] ${changed.join(', ')} changed – restart to apply.`);
+            }
+            current = { ...next, ...Object.fromEntries(fixed.map((key) => [key, initial[key]])) };
+            console.info(`[oidc-mock] Reloaded ${file}`);
+        }
+        catch (error) {
+            console.error(`[oidc-mock] ${error.message}\nKeeping the previous config.`);
+        }
+        return current;
+    };
+}
+export function findClient(config, clientId) {
+    if (!config.clients.length)
+        return { client_id: clientId, redirect_uris: [] };
+    return config.clients.find((client) => client.client_id === clientId);
+}
+export function redirectUriAllowed(client, redirectUri) {
+    if (!client.redirect_uris.length)
+        return true;
+    return client.redirect_uris.some((pattern) => {
+        const regex = new RegExp('^' + pattern.split('*').map(escapeRegex).join('.*') + '$');
+        return regex.test(redirectUri);
+    });
+}
+function escapeRegex(text) {
+    return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+export function userLabel(user) {
+    const name = user.claims.name ?? [user.claims.given_name, user.claims.family_name].join(' ');
+    return (user.label ??
+        (typeof name === 'string' && name.trim() ? name.trim() : undefined) ??
+        (typeof user.claims.email === 'string' ? user.claims.email : undefined) ??
+        user.sub);
+}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { startServer, type MockServer, type StartOptions } from './server.js';
+export { createProvider, type Provider, type ProviderOptions } from './provider.js';
+export { loadConfigFile, resolveConfig, ConfigError, type MockConfig, type MockConfigInput, type MockUser, type MockClient } from './config.js';
+export { loadOrCreateKey, type SigningKey } from './keys.js';

package/dist/index.js

@@ -0,0 +1,4 @@
+export { startServer } from './server.js';
+export { createProvider } from './provider.js';
+export { loadConfigFile, resolveConfig, ConfigError } from './config.js';
+export { loadOrCreateKey } from './keys.js';

package/dist/keys.d.ts

@@ -0,0 +1,13 @@
+import { type CryptoKey, type JWK } from 'jose';
+export type SigningKey = {
+    kid: string;
+    privateKey: CryptoKey;
+    publicKey: CryptoKey;
+    publicJwk: JWK;
+};
+/**
+ * Loads the signing key from `file`, or creates and stores one. Keeping it across restarts means
+ * the sessions of the app survive a restart of the mock – a fresh key would invalidate every
+ * token the app still holds.
+ */
+export declare function loadOrCreateKey(file: string): Promise<SigningKey>;

package/dist/keys.js

@@ -0,0 +1,36 @@
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { calculateJwkThumbprint, exportJWK, generateKeyPair, importJWK } from 'jose';
+const alg = 'RS256';
+/**
+ * Loads the signing key from `file`, or creates and stores one. Keeping it across restarts means
+ * the sessions of the app survive a restart of the mock – a fresh key would invalidate every
+ * token the app still holds.
+ */
+export async function loadOrCreateKey(file) {
+    let privateJwk;
+    try {
+        privateJwk = JSON.parse(readFileSync(file, 'utf8'));
+    }
+    catch {
+        const { privateKey } = await generateKeyPair(alg, { extractable: true });
+        privateJwk = await exportJWK(privateKey);
+        try {
+            mkdirSync(dirname(file), { recursive: true });
+            writeFileSync(file, JSON.stringify(privateJwk), { mode: 0o600 });
+        }
+        catch (error) {
+            console.warn(`[oidc-mock] Could not store the signing key in ${file} (${error.message}). ` +
+                'Tokens will not survive a restart.');
+        }
+    }
+    const { d, p, q, dp, dq, qi, ...publicPart } = privateJwk;
+    const kid = await calculateJwkThumbprint(publicPart);
+    const publicJwk = { ...publicPart, kid, alg, use: 'sig' };
+    return {
+        kid,
+        privateKey: (await importJWK({ ...privateJwk, alg }, alg)),
+        publicKey: (await importJWK(publicJwk, alg)),
+        publicJwk
+    };
+}

package/dist/pages.d.ts

@@ -0,0 +1,10 @@
+import { type MockConfig } from './config.js';
+export declare function escapeHtml(value: unknown): string;
+export declare function loginPage({ config, params, error, customSub, customClaims }: {
+    config: MockConfig;
+    params: Record<string, string>;
+    error?: string;
+    customSub?: string;
+    customClaims?: string;
+}): string;
+export declare function messagePage(title: string, message: string): string;

package/dist/pages.js

@@ -0,0 +1,134 @@
+import { userLabel } from './config.js';
+export function escapeHtml(value) {
+    return String(value)
+        .replaceAll('&', '&')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;')
+        .replaceAll('"', '&quot;')
+        .replaceAll("'", '&#39;');
+}
+const styles = /* css */ `
+:root {
+	--bg: #f4f5f7; --card: #fff; --text: #1d2330; --muted: #667085; --border: #dde1e8;
+	--accent: #2f5bea; --accent-text: #fff; --hover: #eef2ff; --error-bg: #fdecec; --error: #b42318;
+	--code: #f1f3f6;
+	color-scheme: light;
+}
+@media (prefers-color-scheme: dark) {
+	:root {
+		--bg: #12151b; --card: #1b1f27; --text: #e6e9ef; --muted: #98a2b3; --border: #2c323d;
+		--accent: #7c9cff; --accent-text: #0b1020; --hover: #232a38; --error-bg: #3a1a1a; --error: #ffb4ab;
+		--code: #151920;
+		color-scheme: dark;
+	}
+}
+* { box-sizing: border-box; }
+body {
+	margin: 0; min-height: 100vh; background: var(--bg); color: var(--text);
+	font: 15px/1.45 system-ui, -apple-system, 'Segoe UI', sans-serif;
+	display: flex; justify-content: center; align-items: flex-start; padding: 48px 16px;
+}
+main { width: 100%; max-width: 440px; }
+.card { background: var(--card); border: 1px solid var(--border); border-radius: 14px; padding: 24px; }
+h1 { font-size: 18px; margin: 0 0 4px; }
+.meta { color: var(--muted); font-size: 13px; margin: 0 0 20px; word-break: break-all; }
+.meta code { font-size: 12px; }
+.users { display: grid; gap: 8px; }
+.user { display: flex; align-items: stretch; gap: 6px; }
+.user button[name=sub] {
+	flex: 1; text-align: left; padding: 10px 14px; border-radius: 10px; cursor: pointer;
+	border: 1px solid var(--border); background: transparent; color: inherit; font: inherit;
+}
+.user button[name=sub]:hover, .user button[name=sub]:focus-visible { background: var(--hover); border-color: var(--accent); outline: none; }
+.user small { display: block; color: var(--muted); font-size: 13px; }
+.edit {
+	width: 40px; border-radius: 10px; border: 1px solid var(--border); background: transparent;
+	color: var(--muted); cursor: pointer; font-size: 16px;
+}
+.edit:hover { color: var(--text); background: var(--hover); }
+details { margin-top: 20px; border-top: 1px solid var(--border); padding-top: 16px; }
+summary { cursor: pointer; color: var(--muted); font-size: 14px; }
+label { display: block; font-size: 13px; color: var(--muted); margin: 14px 0 4px; }
+input[type=text], textarea {
+	width: 100%; padding: 8px 10px; border-radius: 8px; border: 1px solid var(--border);
+	background: var(--code); color: inherit; font: 13px/1.4 ui-monospace, SFMono-Regular, Menlo, monospace;
+}
+textarea { min-height: 220px; resize: vertical; }
+.primary {
+	margin-top: 12px; width: 100%; padding: 10px; border: 0; border-radius: 10px; cursor: pointer;
+	background: var(--accent); color: var(--accent-text); font: inherit; font-weight: 600;
+}
+.cancel { display: inline-block; margin-top: 16px; color: var(--muted); font-size: 13px; }
+.error { background: var(--error-bg); color: var(--error); padding: 10px 12px; border-radius: 8px; margin-bottom: 16px; font-size: 14px; }
+.empty { color: var(--muted); font-size: 14px; }
+`;
+function layout(title, body) {
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex">
+<title>${escapeHtml(title)}</title>
+<style>${styles}</style>
+</head>
+<body><main><div class="card">${body}</div></main></body>
+</html>`;
+}
+export function loginPage({ config, params, error, customSub, customClaims }) {
+    const hidden = `<input type="hidden" name="params" value="${escapeHtml(JSON.stringify(params))}">`;
+    const cancel = new URL(params.redirect_uri);
+    cancel.searchParams.set('error', 'access_denied');
+    if (params.state)
+        cancel.searchParams.set('state', params.state);
+    const users = config.users.length
+        ? config.users
+            .map((user) => `<div class="user">
+	<button type="submit" name="sub" value="${escapeHtml(user.sub)}">
+		${escapeHtml(userLabel(user))}
+		${user.description ? `<small>${escapeHtml(user.description)}</small>` : ''}
+	</button>
+	${config.custom_login
+            ? `<button type="button" class="edit" title="Edit claims before signing in" data-sub="${escapeHtml(user.sub)}" data-claims="${escapeHtml(JSON.stringify(user.claims, null, 2))}">✎</button>`
+            : ''}
+</div>`)
+            .join('\n')
+        : `<p class="empty">No users configured${config.file ? ` in <code>${escapeHtml(config.file)}</code>` : ''}.</p>`;
+    const custom = config.custom_login
+        ? `<details${error || customClaims ? ' open' : ''}>
+	<summary>Sign in with custom claims</summary>
+	<form method="post">
+		${hidden}
+		<label for="custom_sub">sub</label>
+		<input type="text" id="custom_sub" name="custom_sub" value="${escapeHtml(customSub ?? '')}" placeholder="any-subject" autocomplete="off">
+		<label for="custom_claims">Claims (JSON object)</label>
+		<textarea id="custom_claims" name="custom_claims" spellcheck="false" placeholder='{\n  "email": "someone@example.org"\n}'>${escapeHtml(customClaims ?? '')}</textarea>
+		<button type="submit" class="primary" name="custom" value="1">Sign in</button>
+	</form>
+</details>
+<script>
+for (const button of document.querySelectorAll('.edit')) {
+	button.addEventListener('click', () => {
+		document.getElementById('custom_sub').value = button.dataset.sub;
+		document.getElementById('custom_claims').value = button.dataset.claims;
+		const details = document.querySelector('details');
+		details.open = true;
+		details.scrollIntoView({ behavior: 'smooth' });
+		document.getElementById('custom_claims').focus();
+	});
+}
+</script>`
+        : '';
+    return layout('Sign in – oidc-mock', `<h1>Sign in</h1>
+<p class="meta">Client <code>${escapeHtml(params.client_id)}</code> · returns to <code>${escapeHtml(cancel.origin)}</code></p>
+${error ? `<div class="error">${escapeHtml(error)}</div>` : ''}
+<form method="post" class="users">
+	${hidden}
+	${users}
+</form>
+${custom}
+<a class="cancel" href="${escapeHtml(cancel.toString())}">Cancel</a>`);
+}
+export function messagePage(title, message) {
+    return layout(`${title} – oidc-mock`, `<h1>${escapeHtml(title)}</h1><p class="meta">${escapeHtml(message)}</p>`);
+}

package/dist/provider.d.ts

@@ -0,0 +1,14 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { type MockConfig } from './config.js';
+import type { SigningKey } from './keys.js';
+export type ProviderOptions = {
+    /** Called on every request, so a watched config applies without a restart. */
+    config: () => MockConfig;
+    key: SigningKey;
+};
+export type Provider = {
+    /** Handles the request if its path is below `base_path` and returns whether it did. */
+    handle(req: IncomingMessage, res: ServerResponse): Promise<boolean>;
+    metadata(): Record<string, unknown>;
+};
+export declare function createProvider({ config: getConfig, key }: ProviderOptions): Provider;