oidc-mock 0.1.2

package/dist/vite.js

@@ -0,0 +1,114 @@
+import { resolve } from 'node:path';
+import { attachToRunning, startServer } from './server.js';
+/**
+ * One mock per config and port for the whole process. Vite re-creates plugins on every restart
+ * (config change, `server.restart()`), but the port stays taken until the old server is closed –
+ * reusing it is simpler and keeps the app's session valid across restarts.
+ */
+const running = (globalThis.__oidcMock ??=
+    new Map());
+function acquire(configFile, port) {
+    const id = `${configFile}#${port ?? ''}`;
+    let server = running.get(id);
+    if (!server) {
+        server = startServer({ config: configFile, port }).catch(async (error) => {
+            if (error.code !== 'EADDRINUSE')
+                throw error;
+            const attached = await attachToRunning({ config: configFile, port });
+            if (!attached) {
+                throw new Error(`Port ${error.port} is taken by something that is not this oidc-mock. ` +
+                    'Pick another port in the config or with oidcMock({ port }).');
+            }
+            return attached;
+        });
+        server.catch(() => running.delete(id));
+        running.set(id, server);
+    }
+    return server;
+}
+/**
+ * Runs the mock provider next to the Vite dev server.
+ *
+ * The provider listens on its own loopback port (the back channel: discovery, token, JWKS –
+ * called by the app's server), and the Vite server serves the same endpoints under `base_path`
+ * (the front channel: the login page, called by the browser). Redirects the app sends to the
+ * back channel are rewritten to relative URLs, so the browser stays on whatever host it used to
+ * reach Vite – `localhost`, a LAN address with `--host`, or a forwarded port.
+ */
+export function oidcMock(options = {}) {
+    let root = process.cwd();
+    let mock;
+    function install(server) {
+        const configFile = resolve(root, options.config ?? 'oidc-mock.yaml');
+        const pending = acquire(configFile, options.port);
+        mock = pending;
+        pending.then((started) => {
+            const log = server.config.logger;
+            log.info(`  ➜  oidc-mock: ${started.discoveryUrl}\n` +
+                `               ${started.config().users.length} users from ${configFile}` +
+                (started.server
+                    ? ''
+                    : '\n               port taken by another oidc-mock with this issuer – sharing its back channel'));
+        }, (error) => server.config.logger.error(`[oidc-mock] ${error.message}`));
+        server.middlewares.use(middleware);
+    }
+    const middleware = (req, res, next) => {
+        if (!mock)
+            return next();
+        mock.then(async (started) => {
+            if (options.rewriteRedirects !== false)
+                rewriteLocation(res, started);
+            if (await started.provider.handle(req, res))
+                return;
+            next();
+        }, () => next());
+    };
+    return {
+        name: 'oidc-mock',
+        configResolved(config) {
+            root = config.root;
+        },
+        configureServer(server) {
+            install(server);
+        },
+        configurePreviewServer(server) {
+            if (options.preview !== false)
+                install(server);
+        }
+    };
+}
+/**
+ * Turns `Location: <issuer origin>/<base_path>/…` into `/<base_path>/…`, both for
+ * `setHeader` and for `writeHead`, which is what SvelteKit, Express and friends use.
+ */
+function rewriteLocation(res, mock) {
+    const issuer = new URL(mock.issuer);
+    const prefix = issuer.origin + mock.config().base_path;
+    const rewrite = (value) => typeof value === 'string' && (value === prefix || value.startsWith(prefix + '/') || value.startsWith(prefix + '?'))
+        ? value.slice(issuer.origin.length)
+        : value;
+    const setHeader = res.setHeader.bind(res);
+    res.setHeader = (name, value) => setHeader(name, name.toLowerCase() === 'location' ? rewrite(value) : value);
+    const writeHead = res.writeHead.bind(res);
+    res.writeHead = ((...args) => {
+        const headersIndex = typeof args[1] === 'string' ? 2 : 1;
+        const headers = args[headersIndex];
+        if (Array.isArray(headers)) {
+            // Either [[name, value], …] or a flat [name, value, name, value, …].
+            if (Array.isArray(headers[0])) {
+                args[headersIndex] = headers.map(([name, value]) => [name, name.toLowerCase() === 'location' ? rewrite(value) : value]);
+            }
+            else {
+                args[headersIndex] = headers.map((value, i) => i % 2 === 1 && String(headers[i - 1]).toLowerCase() === 'location' ? rewrite(value) : value);
+            }
+        }
+        else if (headers && typeof headers === 'object') {
+            args[headersIndex] = Object.fromEntries(Object.entries(headers).map(([name, value]) => [
+                name,
+                name.toLowerCase() === 'location' ? rewrite(value) : value
+            ]));
+        }
+        return writeHead(...args);
+    });
+}
+export default oidcMock;

package/examples/oidc-mock.yaml

@@ -0,0 +1,58 @@
+# oidc-mock configuration
+#
+# Edits to `users`, `clients`, `tokens` and `custom_login` apply without a restart.
+# `host`, `port`, `base_path`, `issuer` and `key_file` need one.
+
+# Back channel: where the app's server reaches the provider. The issuer is
+# http://<host>:<port><base_path>, the discovery URL that plus /.well-known/openid-configuration.
+host: 127.0.0.1
+port: 8090
+base_path: /oidc
+
+# Leave `clients` out to accept any client_id without a secret.
+# clients:
+#   - client_id: my-app
+#     client_secret: dev-secret        # omit for public clients (PKCE)
+#     redirect_uris: ['http://*:5173/*', 'https://*:5173/*']
+
+tokens:
+  access_token_ttl: 1h
+  id_token_ttl: 1h
+  refresh_token_ttl: 30d
+
+# Show the “custom claims” box on the login page.
+custom_login: true
+
+# One button per user on the login page. `claims` go into the id token, the access token and
+# userinfo; `sub` is fixed per user, so the app sees the same account every time.
+users:
+  - sub: admin
+    label: Admin
+    description: Every permission
+    claims:
+      email: admin@example.org
+      email_verified: true
+      given_name: Ada
+      family_name: Admin
+      preferred_username: ada
+      locale: en
+      roles: [admin]
+
+  - sub: member
+    label: Member
+    description: Plain account without roles
+    claims:
+      email: member@example.org
+      email_verified: true
+      given_name: Max
+      family_name: Member
+      preferred_username: max
+      locale: en
+      roles: []
+
+  - sub: no-email
+    label: Without email
+    description: Edge case – the email claim is missing
+    claims:
+      given_name: Nora
+      family_name: Noemail

package/package.json

@@ -0,0 +1,72 @@
+{
+	"name": "oidc-mock",
+	"version": "0.1.2",
+	"description": "OpenID Connect provider for local development: users and claims in one YAML file, a login page to pick them, and a Vite plugin that makes it work behind --host.",
+	"license": "MIT",
+	"author": "Tade Strehk <tade@strehk.eu>",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/strehk/oidc-mock.git"
+	},
+	"homepage": "https://github.com/strehk/oidc-mock#readme",
+	"bugs": "https://github.com/strehk/oidc-mock/issues",
+	"type": "module",
+	"keywords": [
+		"oidc",
+		"openid-connect",
+		"oauth2",
+		"mock",
+		"dev-server",
+		"vite-plugin"
+	],
+	"engines": {
+		"node": ">=20"
+	},
+	"bin": {
+		"oidc-mock": "dist/cli.js"
+	},
+	"exports": {
+		".": {
+			"types": "./dist/index.d.ts",
+			"default": "./dist/index.js"
+		},
+		"./vite": {
+			"types": "./dist/vite.d.ts",
+			"default": "./dist/vite.js"
+		}
+	},
+	"files": [
+		"dist",
+		"examples/oidc-mock.yaml"
+	],
+	"scripts": {
+		"build": "rm -rf dist && tsc -p tsconfig.build.json",
+		"dev": "bun --watch src/cli.ts --config examples/oidc-mock.yaml",
+		"test": "bun test",
+		"typecheck": "tsc --noEmit",
+		"prepublishOnly": "bun run typecheck && bun test && bun run build"
+	},
+	"dependencies": {
+		"jose": "^6.2.12",
+		"yaml": "^2.9.1",
+		"zod": "^4.6.5"
+	},
+	"peerDependencies": {
+		"vite": ">=5"
+	},
+	"peerDependenciesMeta": {
+		"vite": {
+			"optional": true
+		}
+	},
+	"devDependencies": {
+		"@types/bun": "latest",
+		"@types/node": "^26.6.3",
+		"openid-client": "^6.8.8",
+		"typescript": "^7.0.2",
+		"vite": "^8.3.1"
+	},
+	"publishConfig": {
+		"access": "public"
+	}
+}