oidc-mock 0.1.2

package/dist/provider.js

@@ -0,0 +1,412 @@
+import { findClient, redirectUriAllowed } from './config.js';
+import { loginPage, messagePage } from './pages.js';
+import { sign, verify, verifyAny, withoutReserved } from './tokens.js';
+import { createHash, timingSafeEqual } from 'node:crypto';
+class OAuthError extends Error {
+    error;
+    status;
+    constructor(error, description, status = 400) {
+        super(description);
+        this.error = error;
+        this.status = status;
+    }
+}
+/** Metadata fields that go into the access token but are no user claims. */
+const tokenMeta = new Set(['client_id', 'scope', 'auth_time', 'azp', 'nonce', 'sid']);
+const codeTtl = 120;
+export function createProvider({ config: getConfig, key }) {
+    /** Codes are single-use. Stateless JWTs otherwise, so only redeemed ones need remembering. */
+    const redeemedCodes = new Map();
+    function metadata() {
+        const config = getConfig();
+        const { issuer } = config;
+        const claims = new Set(['sub']);
+        for (const user of config.users)
+            for (const claim of Object.keys(user.claims))
+                claims.add(claim);
+        return {
+            issuer,
+            authorization_endpoint: `${issuer}/authorize`,
+            token_endpoint: `${issuer}/token`,
+            userinfo_endpoint: `${issuer}/userinfo`,
+            jwks_uri: `${issuer}/jwks`,
+            end_session_endpoint: `${issuer}/end_session`,
+            introspection_endpoint: `${issuer}/introspect`,
+            revocation_endpoint: `${issuer}/revoke`,
+            response_types_supported: ['code'],
+            response_modes_supported: ['query'],
+            grant_types_supported: ['authorization_code', 'refresh_token'],
+            subject_types_supported: ['public'],
+            id_token_signing_alg_values_supported: ['RS256'],
+            token_endpoint_auth_methods_supported: ['none', 'client_secret_basic', 'client_secret_post'],
+            code_challenge_methods_supported: ['S256', 'plain'],
+            scopes_supported: ['openid', 'profile', 'email', 'phone', 'address', 'offline_access'],
+            claims_supported: [...claims],
+            authorization_response_iss_parameter_supported: true
+        };
+    }
+    async function handle(req, res) {
+        const config = getConfig();
+        const url = new URL(req.url ?? '/', 'http://oidc-mock');
+        const base = config.base_path;
+        if (url.pathname !== base && !url.pathname.startsWith(base + '/'))
+            return false;
+        const path = url.pathname.slice(base.length) || '/';
+        try {
+            if (req.method === 'OPTIONS') {
+                cors(res);
+                res.writeHead(204).end();
+                return true;
+            }
+            const route = `${req.method} ${path}`;
+            switch (route) {
+                case 'GET /.well-known/openid-configuration':
+                case 'GET /.well-known/oauth-authorization-server':
+                    return json(res, 200, metadata());
+                case 'GET /jwks':
+                    return json(res, 200, { keys: [key.publicJwk] });
+                case 'GET /authorize':
+                    return authorizeGet(config, url.searchParams, res);
+                case 'POST /authorize':
+                    return await authorizePost(config, await readForm(req), res);
+                case 'POST /token':
+                    return await token(config, req, await readForm(req), res);
+                case 'GET /userinfo':
+                case 'POST /userinfo':
+                    return await userinfo(config, req, res);
+                case 'POST /introspect':
+                    return await introspect(config, await readForm(req), res);
+                case 'POST /revoke':
+                    cors(res);
+                    res.writeHead(200).end();
+                    return true;
+                case 'GET /end_session':
+                case 'POST /end_session': {
+                    const params = req.method === 'GET' ? url.searchParams : new URLSearchParams(await readBody(req));
+                    return endSession(params, res);
+                }
+                default:
+                    return json(res, 404, { error: 'not_found', error_description: `${route} is no endpoint` });
+            }
+        }
+        catch (error) {
+            if (error instanceof OAuthError) {
+                if (error.status === 401)
+                    res.setHeader('WWW-Authenticate', 'Basic realm="oidc-mock"');
+                return json(res, error.status, { error: error.error, error_description: error.message });
+            }
+            console.error('[oidc-mock]', error);
+            return json(res, 500, { error: 'server_error', error_description: String(error) });
+        }
+    }
+    /** Checks client and redirect URI. Without both there is nowhere safe to send an error. */
+    function validateAuthorizeRequest(config, params) {
+        if (!params.client_id)
+            return 'The request has no client_id.';
+        const client = findClient(config, params.client_id);
+        if (!client)
+            return `Unknown client_id "${params.client_id}". Add it under "clients" in the config.`;
+        if (!params.redirect_uri)
+            return 'The request has no redirect_uri.';
+        try {
+            new URL(params.redirect_uri);
+        }
+        catch {
+            return `redirect_uri "${params.redirect_uri}" is no absolute URL.`;
+        }
+        if (!redirectUriAllowed(client, params.redirect_uri)) {
+            return `redirect_uri "${params.redirect_uri}" is not allowed for client "${client.client_id}".`;
+        }
+        return undefined;
+    }
+    function authorizeGet(config, search, res) {
+        const params = Object.fromEntries(search);
+        const invalid = validateAuthorizeRequest(config, params);
+        if (invalid)
+            return html(res, 400, messagePage('Invalid request', invalid));
+        if (params.response_type !== 'code') {
+            return redirectWithError(res, config, params, 'unsupported_response_type', 'Only "code" is supported.');
+        }
+        if (params.prompt?.split(' ').includes('none')) {
+            return redirectWithError(res, config, params, 'login_required', 'oidc-mock keeps no sessions.');
+        }
+        return html(res, 200, loginPage({ config, params }));
+    }
+    async function authorizePost(config, form, res) {
+        let params;
+        try {
+            params = JSON.parse(form.get('params') ?? '');
+        }
+        catch {
+            return html(res, 400, messagePage('Invalid request', 'The login form lost its parameters.'));
+        }
+        const invalid = validateAuthorizeRequest(config, params);
+        if (invalid)
+            return html(res, 400, messagePage('Invalid request', invalid));
+        let sub;
+        let claims;
+        let preset;
+        if (form.has('custom')) {
+            const customSub = form.get('custom_sub')?.trim() ?? '';
+            const customClaims = form.get('custom_claims') ?? '';
+            const retry = (error) => html(res, 400, loginPage({ config, params, error, customSub, customClaims }));
+            if (!config.custom_login)
+                return retry('Custom claims are disabled in the config.');
+            let parsed = {};
+            if (customClaims.trim()) {
+                try {
+                    parsed = JSON.parse(customClaims);
+                }
+                catch (error) {
+                    return retry(`The claims are no valid JSON: ${error.message}`);
+                }
+            }
+            if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+                return retry('The claims must be a JSON object.');
+            }
+            claims = parsed;
+            sub = customSub || (typeof claims.sub === 'string' ? claims.sub : '');
+            if (!sub)
+                return retry('Enter a sub.');
+            preset = false;
+        }
+        else {
+            const user = config.users.find((candidate) => candidate.sub === form.get('sub'));
+            if (!user) {
+                return html(res, 400, loginPage({ config, params, error: `Unknown user "${form.get('sub')}".` }));
+            }
+            ({ sub, claims } = user);
+            preset = true;
+        }
+        const grant = {
+            sub,
+            claims: withoutReserved(claims),
+            preset,
+            client_id: params.client_id,
+            scope: params.scope ?? '',
+            auth_time: Math.floor(Date.now() / 1000),
+            nonce: params.nonce,
+            redirect_uri: params.redirect_uri,
+            code_challenge: params.code_challenge,
+            code_challenge_method: params.code_challenge
+                ? (params.code_challenge_method ?? 'plain')
+                : undefined
+        };
+        const code = await sign(key, 'code', { grant }, {
+            issuer: config.issuer,
+            audience: grant.client_id,
+            subject: sub,
+            ttl: codeTtl
+        });
+        const target = new URL(params.redirect_uri);
+        target.searchParams.set('code', code);
+        if (params.state !== undefined)
+            target.searchParams.set('state', params.state);
+        target.searchParams.set('iss', config.issuer);
+        return redirect(res, target.toString());
+    }
+    function redirectWithError(res, config, params, error, description) {
+        const target = new URL(params.redirect_uri);
+        target.searchParams.set('error', error);
+        target.searchParams.set('error_description', description);
+        if (params.state !== undefined)
+            target.searchParams.set('state', params.state);
+        target.searchParams.set('iss', config.issuer);
+        return redirect(res, target.toString());
+    }
+    function authenticateClient(config, req, form) {
+        let clientId = form.get('client_id') ?? undefined;
+        let secret = form.get('client_secret') ?? undefined;
+        const header = req.headers.authorization;
+        if (header?.startsWith('Basic ')) {
+            const decoded = Buffer.from(header.slice(6), 'base64').toString('utf8');
+            const colon = decoded.indexOf(':');
+            clientId = decodeURIComponent(decoded.slice(0, colon));
+            secret = decodeURIComponent(decoded.slice(colon + 1));
+        }
+        if (!clientId)
+            throw new OAuthError('invalid_client', 'No client_id given.', 401);
+        const client = findClient(config, clientId);
+        if (!client)
+            throw new OAuthError('invalid_client', `Unknown client_id "${clientId}".`, 401);
+        if (client.client_secret !== undefined && !safeEqual(client.client_secret, secret ?? '')) {
+            throw new OAuthError('invalid_client', 'Wrong client_secret.', 401);
+        }
+        return client;
+    }
+    async function token(config, req, form, res) {
+        cors(res);
+        const client = authenticateClient(config, req, form);
+        const grantType = form.get('grant_type');
+        let grant;
+        if (grantType === 'authorization_code') {
+            const code = form.get('code') ?? '';
+            let payload;
+            try {
+                payload = await verify(key, 'code', code, config.issuer);
+            }
+            catch {
+                throw new OAuthError('invalid_grant', 'The code is invalid or expired.');
+            }
+            grant = payload.grant;
+            if (grant.client_id !== client.client_id) {
+                throw new OAuthError('invalid_grant', 'The code was issued to another client.');
+            }
+            pruneRedeemed();
+            if (redeemedCodes.has(payload.jti))
+                throw new OAuthError('invalid_grant', 'The code was already used.');
+            redeemedCodes.set(payload.jti, payload.exp);
+            if (grant.redirect_uri !== form.get('redirect_uri')) {
+                throw new OAuthError('invalid_grant', 'redirect_uri does not match the authorization request.');
+            }
+            if (grant.code_challenge) {
+                const verifier = form.get('code_verifier');
+                if (!verifier)
+                    throw new OAuthError('invalid_grant', 'code_verifier is missing.');
+                const expected = grant.code_challenge_method === 'S256'
+                    ? createHash('sha256').update(verifier).digest('base64url')
+                    : verifier;
+                if (expected !== grant.code_challenge) {
+                    throw new OAuthError('invalid_grant', 'code_verifier does not match the code_challenge.');
+                }
+            }
+        }
+        else if (grantType === 'refresh_token') {
+            let payload;
+            try {
+                payload = await verify(key, 'refresh', form.get('refresh_token') ?? '', config.issuer);
+            }
+            catch {
+                throw new OAuthError('invalid_grant', 'The refresh token is invalid or expired.');
+            }
+            grant = payload.grant;
+            if (grant.client_id !== client.client_id) {
+                throw new OAuthError('invalid_grant', 'The refresh token was issued to another client.');
+            }
+            // Edits in the YAML apply on the next refresh, not only on the next login.
+            if (grant.preset) {
+                const user = config.users.find((candidate) => candidate.sub === grant.sub);
+                if (!user)
+                    throw new OAuthError('invalid_grant', `User "${grant.sub}" was removed from the config.`);
+                grant = { ...grant, claims: withoutReserved(user.claims) };
+            }
+            grant = { ...grant, nonce: undefined };
+        }
+        else {
+            throw new OAuthError('unsupported_grant_type', `grant_type "${grantType}" is not supported.`);
+        }
+        const scopes = grant.scope.split(' ').filter(Boolean);
+        const common = { issuer: config.issuer, audience: client.client_id, subject: grant.sub };
+        const response = {
+            token_type: 'Bearer',
+            expires_in: config.tokens.access_token_ttl,
+            scope: grant.scope,
+            access_token: await sign(key, 'access', { ...grant.claims, client_id: client.client_id, scope: grant.scope, auth_time: grant.auth_time }, { ...common, ttl: config.tokens.access_token_ttl })
+        };
+        if (scopes.includes('openid')) {
+            response.id_token = await sign(key, 'id', { ...grant.claims, azp: client.client_id, auth_time: grant.auth_time, nonce: grant.nonce }, { ...common, ttl: config.tokens.id_token_ttl });
+        }
+        if (scopes.includes('offline_access')) {
+            const { redirect_uri, code_challenge, code_challenge_method, ...kept } = grant;
+            response.refresh_token = await sign(key, 'refresh', { grant: kept }, {
+                ...common,
+                ttl: config.tokens.refresh_token_ttl
+            });
+        }
+        res.setHeader('Cache-Control', 'no-store');
+        return json(res, 200, response);
+    }
+    async function userinfo(config, req, res) {
+        cors(res);
+        const header = req.headers.authorization;
+        let accessToken = header?.match(/^Bearer\s+(.+)$/i)?.[1];
+        if (!accessToken && req.method === 'POST')
+            accessToken = (await readForm(req)).get('access_token') ?? undefined;
+        try {
+            const payload = await verify(key, 'access', accessToken ?? '', config.issuer);
+            const claims = Object.fromEntries(Object.entries(withoutReserved(payload)).filter(([claim]) => !tokenMeta.has(claim)));
+            return json(res, 200, { ...claims, sub: payload.sub });
+        }
+        catch {
+            res.setHeader('WWW-Authenticate', 'Bearer error="invalid_token"');
+            return json(res, 401, { error: 'invalid_token', error_description: 'Missing or invalid access token.' });
+        }
+    }
+    async function introspect(config, form, res) {
+        cors(res);
+        const result = await verifyAny(key, form.get('token') ?? '', config.issuer);
+        if (!result)
+            return json(res, 200, { active: false });
+        const { grant, ...payload } = result.payload;
+        const refresh = result.kind === 'refresh' ? grant : undefined;
+        return json(res, 200, {
+            ...payload,
+            ...(refresh ? { client_id: refresh.client_id, scope: refresh.scope } : {}),
+            active: true,
+            token_type: result.kind === 'refresh' ? 'refresh_token' : 'Bearer'
+        });
+    }
+    function endSession(params, res) {
+        const target = params.get('post_logout_redirect_uri');
+        if (target) {
+            try {
+                const url = new URL(target);
+                const state = params.get('state');
+                if (state !== null)
+                    url.searchParams.set('state', state);
+                return redirect(res, url.toString());
+            }
+            catch {
+                return html(res, 400, messagePage('Invalid request', 'post_logout_redirect_uri is no absolute URL.'));
+            }
+        }
+        return html(res, 200, messagePage('Signed out', 'You can close this page.'));
+    }
+    function pruneRedeemed() {
+        const now = Date.now() / 1000;
+        for (const [jti, exp] of redeemedCodes)
+            if (exp < now)
+                redeemedCodes.delete(jti);
+    }
+    return { handle, metadata };
+}
+function safeEqual(a, b) {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    return left.length === right.length && timingSafeEqual(left, right);
+}
+function cors(res) {
+    res.setHeader('Access-Control-Allow-Origin', '*');
+    res.setHeader('Access-Control-Allow-Headers', 'Authorization, Content-Type');
+    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+}
+function json(res, status, body) {
+    cors(res);
+    res.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8' });
+    res.end(JSON.stringify(body));
+    return true;
+}
+function html(res, status, body) {
+    res.writeHead(status, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' });
+    res.end(body);
+    return true;
+}
+function redirect(res, location) {
+    res.writeHead(302, { Location: location, 'Cache-Control': 'no-store' });
+    res.end();
+    return true;
+}
+async function readBody(req) {
+    const chunks = [];
+    for await (const chunk of req)
+        chunks.push(chunk);
+    return Buffer.concat(chunks).toString('utf8');
+}
+async function readForm(req) {
+    const body = await readBody(req);
+    if (req.headers['content-type']?.includes('application/json')) {
+        const parsed = JSON.parse(body || '{}');
+        return new URLSearchParams(Object.entries(parsed).map(([k, v]) => [k, String(v)]));
+    }
+    return new URLSearchParams(body);
+}

package/dist/server.d.ts

@@ -0,0 +1,34 @@
+import { type Server } from 'node:http';
+import { type MockConfig, type MockConfigInput } from './config.js';
+import { type Provider } from './provider.js';
+export type StartOptions = {
+    /** Path to the YAML file. Watched: edits to users and claims apply without a restart. */
+    config?: string;
+    /** Inline config instead of a file, e.g. for tests. Ignored when `config` is set. */
+    inline?: MockConfigInput;
+    /** Overrides for the values from the file. */
+    host?: string;
+    port?: number;
+};
+export type MockServer = {
+    /** Issuer URL – the part before `/.well-known/openid-configuration`. */
+    issuer: string;
+    /** The discovery URL, what an OIDC client wants as “authority”. */
+    discoveryUrl: string;
+    config: () => MockConfig;
+    provider: Provider;
+    /** Missing when another process owns the port, see `attachToRunning`. */
+    server?: Server;
+    close(): Promise<void>;
+};
+export declare function loadInitialConfig(options: StartOptions): MockConfig;
+export declare function startServer(options?: StartOptions): Promise<MockServer>;
+/**
+ * For when the port is taken by another oidc-mock with the same issuer – typically a second dev
+ * server in the same checkout. Codes and refresh tokens are self-contained JWTs, and both
+ * processes read the same key file, so a code issued here is redeemed there without shared
+ * state. This process then only serves the front channel.
+ *
+ * Returns `undefined` if the port belongs to something else.
+ */
+export declare function attachToRunning(options: StartOptions): Promise<MockServer | undefined>;

package/dist/server.js

@@ -0,0 +1,77 @@
+import { createServer } from 'node:http';
+import { loadConfigFile, resolveConfig, watchConfig } from './config.js';
+import { loadOrCreateKey } from './keys.js';
+import { createProvider } from './provider.js';
+export function loadInitialConfig(options) {
+    const config = options.config ? loadConfigFile(options.config) : resolveConfig(options.inline ?? {});
+    if (options.host === undefined && options.port === undefined)
+        return config;
+    return withAddress(config, options.host ?? config.host, options.port ?? config.port);
+}
+/** Re-resolves the config for another address, so the default issuer follows it. */
+function withAddress(config, host, port) {
+    const { file, key_file, issuer, ...rest } = config;
+    const explicitIssuer = issuer !== resolveConfig({ ...rest, issuer: undefined }).issuer;
+    return {
+        ...resolveConfig({ ...rest, host, port, issuer: explicitIssuer ? issuer : undefined }, file),
+        key_file
+    };
+}
+export async function startServer(options = {}) {
+    let initial = loadInitialConfig(options);
+    let handler = (_req, res) => res.writeHead(503).end();
+    const server = createServer((req, res) => handler(req, res));
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(initial.port, initial.host, () => resolve());
+    });
+    // Port 0 picks a free port; the issuer has to name the one we actually got.
+    if (initial.port === 0) {
+        initial = withAddress(initial, initial.host, server.address().port);
+    }
+    const config = watchConfig(initial);
+    const provider = createProvider({ config, key: await loadOrCreateKey(initial.key_file) });
+    handler = (req, res) => {
+        provider.handle(req, res).then((handled) => {
+            if (handled)
+                return;
+            res.writeHead(302, { Location: `${config().base_path}/.well-known/openid-configuration` });
+            res.end();
+        });
+    };
+    return {
+        issuer: initial.issuer,
+        discoveryUrl: `${initial.issuer}/.well-known/openid-configuration`,
+        config,
+        provider,
+        server,
+        close: () => new Promise((resolve) => {
+            server.close(() => resolve());
+            server.closeAllConnections();
+        })
+    };
+}
+/**
+ * For when the port is taken by another oidc-mock with the same issuer – typically a second dev
+ * server in the same checkout. Codes and refresh tokens are self-contained JWTs, and both
+ * processes read the same key file, so a code issued here is redeemed there without shared
+ * state. This process then only serves the front channel.
+ *
+ * Returns `undefined` if the port belongs to something else.
+ */
+export async function attachToRunning(options) {
+    const initial = loadInitialConfig(options);
+    const discoveryUrl = `${initial.issuer}/.well-known/openid-configuration`;
+    try {
+        const response = await fetch(discoveryUrl, { signal: AbortSignal.timeout(2000) });
+        const { issuer } = (await response.json());
+        if (issuer !== initial.issuer)
+            return undefined;
+    }
+    catch {
+        return undefined;
+    }
+    const config = watchConfig(initial);
+    const provider = createProvider({ config, key: await loadOrCreateKey(initial.key_file) });
+    return { issuer: initial.issuer, discoveryUrl, config, provider, close: async () => { } };
+}

package/dist/tokens.d.ts

@@ -0,0 +1,36 @@
+import { type JWTPayload } from 'jose';
+import type { SigningKey } from './keys.js';
+/**
+ * Authorization codes and refresh tokens are signed JWTs as well. The mock keeps no session state
+ * besides a set of redeemed codes, so a restart loses nothing – the key is on disk.
+ */
+export type TokenKind = 'code' | 'access' | 'id' | 'refresh';
+/** What an authorization code and a refresh token carry, so both can be turned into tokens. */
+export type Grant = {
+    sub: string;
+    claims: Record<string, unknown>;
+    /** Came from a user in the YAML: re-read the claims from there on refresh. */
+    preset: boolean;
+    client_id: string;
+    scope: string;
+    auth_time: number;
+    nonce?: string;
+    redirect_uri?: string;
+    code_challenge?: string;
+    code_challenge_method?: string;
+};
+export declare function withoutReserved(claims: Record<string, unknown>): {
+    [k: string]: unknown;
+};
+export declare function sign(key: SigningKey, kind: TokenKind, payload: Record<string, unknown>, { issuer, audience, subject, ttl }: {
+    issuer: string;
+    audience: string;
+    subject: string;
+    ttl: number;
+}): Promise<string>;
+export declare function verify(key: SigningKey, kind: TokenKind, token: string, issuer: string): Promise<JWTPayload>;
+/** Tries each kind in turn – for introspection, which does not know what it was handed. */
+export declare function verifyAny(key: SigningKey, token: string, issuer: string): Promise<{
+    kind: "access" | "id" | "refresh";
+    payload: JWTPayload;
+} | undefined>;

package/dist/tokens.js

@@ -0,0 +1,44 @@
+import { randomUUID } from 'node:crypto';
+import { jwtVerify, SignJWT } from 'jose';
+const typ = {
+    code: 'oidc-mock-code+jwt',
+    access: 'at+jwt',
+    id: 'JWT',
+    refresh: 'oidc-mock-refresh+jwt'
+};
+/** Registered claims of a JWT, which a user's claims must not override. */
+const reserved = new Set(['iss', 'sub', 'aud', 'exp', 'iat', 'nbf', 'jti']);
+export function withoutReserved(claims) {
+    return Object.fromEntries(Object.entries(claims).filter(([key]) => !reserved.has(key)));
+}
+export async function sign(key, kind, payload, { issuer, audience, subject, ttl }) {
+    return new SignJWT(payload)
+        .setProtectedHeader({ alg: 'RS256', kid: key.kid, typ: typ[kind] })
+        .setIssuer(issuer)
+        .setAudience(audience)
+        .setSubject(subject)
+        .setIssuedAt()
+        .setExpirationTime(Math.floor(Date.now() / 1000) + ttl)
+        .setJti(randomUUID())
+        .sign(key.privateKey);
+}
+export async function verify(key, kind, token, issuer) {
+    const { payload } = await jwtVerify(token, key.publicKey, {
+        issuer,
+        typ: typ[kind],
+        algorithms: ['RS256']
+    });
+    return payload;
+}
+/** Tries each kind in turn – for introspection, which does not know what it was handed. */
+export async function verifyAny(key, token, issuer) {
+    for (const kind of ['access', 'refresh', 'id']) {
+        try {
+            return { kind, payload: await verify(key, kind, token, issuer) };
+        }
+        catch {
+            // next
+        }
+    }
+    return undefined;
+}

package/dist/vite.d.ts

@@ -0,0 +1,25 @@
+import type { Plugin } from 'vite';
+export type OidcMockPluginOptions = {
+    /** YAML file, relative to the Vite root. Default: `oidc-mock.yaml`. */
+    config?: string;
+    /** Overrides `port` from the YAML. */
+    port?: number;
+    /**
+     * Rewrite redirects to the mock into relative ones (default: `true`). This is what makes
+     * `vite --host` work, see the README.
+     */
+    rewriteRedirects?: boolean;
+    /** Also run in `vite preview` (default: `true`). */
+    preview?: boolean;
+};
+/**
+ * Runs the mock provider next to the Vite dev server.
+ *
+ * The provider listens on its own loopback port (the back channel: discovery, token, JWKS –
+ * called by the app's server), and the Vite server serves the same endpoints under `base_path`
+ * (the front channel: the login page, called by the browser). Redirects the app sends to the
+ * back channel are rewritten to relative URLs, so the browser stays on whatever host it used to
+ * reach Vite – `localhost`, a LAN address with `--host`, or a forwarded port.
+ */
+export declare function oidcMock(options?: OidcMockPluginOptions): Plugin;
+export default oidcMock;