Tizian 「ティツィアーン」
f549fa59df
halkyon_oidc_server and its generated client halkyon_oidc_client: any provider following OpenID Connect's code flow, beside Serverpod's own providers, with a preset for SimpleLogin (no PKCE, no `typ`). Nothing of Halkyon's is in it; BSD-3-Clause, `publish_to: none` for now. - Attempts in `halkyon_oidc_attempt` (ADR 0020's D13): the ID PostgreSQL's gen_random_uuid(), a state and a nonce of 32 random bytes, PKCE's verifier where used, the caller if signed in; ten minutes, taken once. A host may begin the state with a marker. - The code exchanged by the module itself, so a provider out of reach (a timeout, a 5xx) is told apart from a refused code; the ID token checked with dart_jsonwebtoken's algorithms (ADR 0020's D12): the provider's algorithms alone, the key its `kid` names, of the right type; issuer, audience and `azp`, expiry, time issued, `nbf`, a minute's leeway; the attempt's nonce; a `sub`. - Keys kept an hour, fetched again for an unknown `kid` at most once a minute; discovery checked against the issuer; every request with a timeout. - Identities in `halkyon_oidc_identity`: the provider's key and the `sub`, one per person and provider, deleted with the person. - The stock endpoint (`OidcIdpBaseEndpoint`), and the parts for a host with rules of its own: begin, verify, keep and takeKept, link, accountOf, unlink; merging people; a limit per network. - The forwarding page, moved here from halkyon_base in the next commit. The package's main library is the code generator's, as halkyon_base's; a host imports `package:halkyon_oidc_server/oidc.dart`. ADR 0023's point 5 no longer names OAuth2PkceUtil, which the module doesn't use. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
239 lines
No EOL
6.5 KiB
JSON
239 lines
No EOL
6.5 KiB
JSON
{
|
|
"__className__": "serverpod.DatabaseDefinition",
|
|
"schemaVersion": 2,
|
|
"moduleName": "halkyon_oidc",
|
|
"tables": [
|
|
{
|
|
"__className__": "serverpod.TableDefinition",
|
|
"name": "halkyon_oidc_attempt",
|
|
"dartName": "OidcAttempt",
|
|
"module": "halkyon_oidc",
|
|
"schema": "public",
|
|
"columns": [
|
|
{
|
|
"__className__": "serverpod.ColumnDefinition",
|
|
"name": "id",
|
|
"fieldName": "id",
|
|
"columnType": 7,
|
|
"isNullable": false,
|
|
"columnDefault": "random",
|
|
"dartType": "UuidValue?"
|
|
},
|
|
{
|
|
"__className__": "serverpod.ColumnDefinition",
|
|
"name": "provider",
|
|
"fieldName": "provider",
|
|
"columnType": 0,
|
|
"isNullable": false,
|
|
"dartType": "String"
|
|
},
|
|
{
|
|
"__className__": "serverpod.ColumnDefinition",
|
|
"name": "state",
|
|
"fieldName": "state",
|
|
"columnType": 0,
|
|
"isNullable": false,
|
|
"dartType": "String"
|
|
},
|
|
{
|
|
"__className__": "serverpod.ColumnDefinition",
|
|
"name": "nonce",
|
|
"fieldName": "nonce",
|
|
"columnType": 0,
|
|
"isNullable": false,
|
|
"dartType": "String"
|
|
},
|
|
{
|
|
"__className__": "serverpod.ColumnDefinition",
|
|
"name": "codeVerifier",
|
|
"fieldName": "codeVerifier",
|
|
"columnType": 0,
|
|
"isNullable": true,
|
|
"dartType": "String?"
|
|
},
|
|
{
|
|
"__className__": "serverpod.ColumnDefinition",
|
|
"name": "callerId",
|
|
"fieldName": "callerId",
|
|
"columnType": 7,
|
|
"isNullable": true,
|
|
"dartType": "UuidValue?"
|
|
},
|
|
{
|
|
"__className__": "serverpod.ColumnDefinition",
|
|
"name": "subject",
|
|
"fieldName": "subject",
|
|
"columnType": 0,
|
|
"isNullable": true,
|
|
"dartType": "String?"
|
|
},
|
|
{
|
|
"__className__": "serverpod.ColumnDefinition",
|
|
"name": "expiresAt",
|
|
"fieldName": "expiresAt",
|
|
"columnType": 4,
|
|
"isNullable": false,
|
|
"dartType": "DateTime"
|
|
}
|
|
],
|
|
"foreignKeys": [
|
|
{
|
|
"__className__": "serverpod.ForeignKeyDefinition",
|
|
"constraintName": "halkyon_oidc_attempt_fk_0",
|
|
"columns": [
|
|
"callerId"
|
|
],
|
|
"referenceTable": "serverpod_auth_core_user",
|
|
"referenceTableSchema": "public",
|
|
"referenceColumns": [
|
|
"id"
|
|
],
|
|
"onUpdate": 3,
|
|
"onDelete": 4
|
|
}
|
|
],
|
|
"indexes": [
|
|
{
|
|
"__className__": "serverpod.IndexDefinition",
|
|
"indexName": "halkyon_oidc_attempt_expires_idx",
|
|
"elements": [
|
|
{
|
|
"__className__": "serverpod.IndexElementDefinition",
|
|
"type": 0,
|
|
"definition": "expiresAt"
|
|
}
|
|
],
|
|
"type": "btree",
|
|
"isUnique": false,
|
|
"isPrimary": false
|
|
}
|
|
],
|
|
"managed": true
|
|
},
|
|
{
|
|
"__className__": "serverpod.TableDefinition",
|
|
"name": "halkyon_oidc_identity",
|
|
"dartName": "OidcIdentity",
|
|
"module": "halkyon_oidc",
|
|
"schema": "public",
|
|
"columns": [
|
|
{
|
|
"__className__": "serverpod.ColumnDefinition",
|
|
"name": "id",
|
|
"fieldName": "id",
|
|
"columnType": 7,
|
|
"isNullable": false,
|
|
"columnDefault": "random_v7",
|
|
"dartType": "UuidValue?"
|
|
},
|
|
{
|
|
"__className__": "serverpod.ColumnDefinition",
|
|
"name": "authUserId",
|
|
"fieldName": "authUserId",
|
|
"columnType": 7,
|
|
"isNullable": false,
|
|
"dartType": "UuidValue"
|
|
},
|
|
{
|
|
"__className__": "serverpod.ColumnDefinition",
|
|
"name": "provider",
|
|
"fieldName": "provider",
|
|
"columnType": 0,
|
|
"isNullable": false,
|
|
"dartType": "String"
|
|
},
|
|
{
|
|
"__className__": "serverpod.ColumnDefinition",
|
|
"name": "subject",
|
|
"fieldName": "subject",
|
|
"columnType": 0,
|
|
"isNullable": false,
|
|
"dartType": "String"
|
|
},
|
|
{
|
|
"__className__": "serverpod.ColumnDefinition",
|
|
"name": "createdAt",
|
|
"fieldName": "createdAt",
|
|
"columnType": 4,
|
|
"isNullable": false,
|
|
"dartType": "DateTime"
|
|
}
|
|
],
|
|
"foreignKeys": [
|
|
{
|
|
"__className__": "serverpod.ForeignKeyDefinition",
|
|
"constraintName": "halkyon_oidc_identity_fk_0",
|
|
"columns": [
|
|
"authUserId"
|
|
],
|
|
"referenceTable": "serverpod_auth_core_user",
|
|
"referenceTableSchema": "public",
|
|
"referenceColumns": [
|
|
"id"
|
|
],
|
|
"onUpdate": 3,
|
|
"onDelete": 4
|
|
}
|
|
],
|
|
"indexes": [
|
|
{
|
|
"__className__": "serverpod.IndexDefinition",
|
|
"indexName": "halkyon_oidc_identity_subject_idx",
|
|
"elements": [
|
|
{
|
|
"__className__": "serverpod.IndexElementDefinition",
|
|
"type": 0,
|
|
"definition": "provider"
|
|
},
|
|
{
|
|
"__className__": "serverpod.IndexElementDefinition",
|
|
"type": 0,
|
|
"definition": "subject"
|
|
}
|
|
],
|
|
"type": "btree",
|
|
"isUnique": true,
|
|
"isPrimary": false
|
|
},
|
|
{
|
|
"__className__": "serverpod.IndexDefinition",
|
|
"indexName": "halkyon_oidc_identity_person_idx",
|
|
"elements": [
|
|
{
|
|
"__className__": "serverpod.IndexElementDefinition",
|
|
"type": 0,
|
|
"definition": "authUserId"
|
|
},
|
|
{
|
|
"__className__": "serverpod.IndexElementDefinition",
|
|
"type": 0,
|
|
"definition": "provider"
|
|
}
|
|
],
|
|
"type": "btree",
|
|
"isUnique": true,
|
|
"isPrimary": false
|
|
}
|
|
],
|
|
"managed": true
|
|
}
|
|
],
|
|
"installedModules": [
|
|
{
|
|
"__className__": "serverpod.DatabaseMigrationVersion",
|
|
"module": "serverpod",
|
|
"version": "20260824182259319"
|
|
},
|
|
{
|
|
"__className__": "serverpod.DatabaseMigrationVersion",
|
|
"module": "serverpod_auth_idp",
|
|
"version": "20260924105404509"
|
|
},
|
|
{
|
|
"__className__": "serverpod.DatabaseMigrationVersion",
|
|
"module": "serverpod_auth_core",
|
|
"version": "20260924105232991"
|
|
}
|
|
],
|
|
"migrationApiVersion": 1
|
|
} |