feat(core): infer issuer slugs from environment variables (#225)

* feat(core): infer issuer slugs from environment variables

* chore: verify falsy values

Author: halvaradop

apps/nextjs/app-router/src/lib/auth.ts

@@ -6,7 +6,7 @@ export const oauth = Object.keys(builtInOAuthProviders) as BuiltInOAuthProvider[
 export const providers = [builtInOAuthProviders.github(), builtInOAuthProviders.gitlab(), builtInOAuthProviders.bitbucket()]
 
 export const { api, core } = createAuth({
-    oauth: ["github"],
+    oauth: oauth,
     basePath: "/api/auth",
     baseURL: "http://localhost:3000",
     credentials: {

packages/core/CHANGELOG.md

@@ -10,6 +10,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ### Added
 
+- Added support for inferring OpenID Connect (OIDC) provider issuer slugs from environment variables. Issuer slugs can now be configured either through `provider.slugName` or an environment variable following the `PREFIX_SLUG_NAME` naming convention. [#225](https://github.com/aura-stack-ts/auth/pull/225)
+
 - Added the `isProviderConnected()` client API to `createAuthClient()`, providing a client-side interface for the `GET /providers/:provider` endpoint. The API checks whether an OAuth or OpenID Connect (OIDC) provider is currently connected to the active session. [#223](https://github.com/aura-stack-ts/auth/pull/223)
 
 - Added the experimental `isProviderConnected()` API for checking whether an OAuth or OpenID Connect (OIDC) provider is connected to the current session. This API complements `disconnectProvider()` by allowing applications to inspect the connection state without disconnecting the provider. [#223](https://github.com/aura-stack-ts/auth/pull/223)

packages/core/src/@types/oidc.ts

@@ -234,4 +234,4 @@ export type OpenIDProvider<Profile extends object = Record<string, any>, Default
      */
     scope?: string
     profile?: (profile: Profile) => DefaultUser | Promise<DefaultUser>
-} & GetRouteParams<`/${Issuer}`>
+} & Partial<GetRouteParams<`/${Issuer}`>>

packages/core/src/oauth/index.ts

@@ -29,6 +29,7 @@ import { authentik } from "./authentik.ts"
 import { OAuthEnvSchema, OAuthProviderCredentialsSchema, OpenIDProviderSchema } from "@/schemas.ts"
 import { AuraAuthError } from "@/shared/errors.ts"
 import { createOpenIDPlaceholder } from "@/shared/oidc/resolve-provider.ts"
+import { isFalsy } from "@/shared/assert.ts"
 
 export * from "./github.ts"
 export * from "./bitbucket.ts"
@@ -100,11 +101,18 @@ const isOpenIDProvider = (config: BuiltInOAuthProvider | RuntimeOAuthProvider |
     return typeof config === "object" && "issuer" in config && !("accessToken" in config)
 }
 
-export const setDynamicParams = <const T extends string, P extends Record<string, unknown>>(template: T, params: P): string => {
+export const setDynamicParams = <const T extends string, P extends Record<string, unknown>>(
+    template: T,
+    params: P,
+    id: string
+): string => {
     return template.replace(/(^|\/):([A-Za-z_][A-Za-z0-9_]*)/g, (_, prefix, key) => {
-        const value = params[key]
-        if (value == null) {
-            throw new AuraAuthError({ code: "OIDC_INVALID_ISSUER_PARAMS" })
+        const value = getEnv(`${id.replace("-", "_").toUpperCase()}_${key}`) ?? params[key]
+        if (isFalsy(value)) {
+            throw new AuraAuthError({
+                code: "OIDC_INVALID_ISSUER_PARAMS",
+                userMessage: `The "${id}" identity provider configuration is invalid. Please check issuer settings and try again.`,
+            })
         }
         return `${prefix}${encodeURIComponent(String(value))}`
     })
@@ -116,7 +124,7 @@ export const defineOpenIDProviderConfig = (config: OpenIDProvider): RuntimeOAuth
         throw new AuraAuthError({ code: "INVALID_OAUTH_PROVIDER_SCHEMA_CONFIG", cause: parsed.error })
     }
     const envConfig = !config.clientId || !config.clientSecret ? defineOAuthEnvironment(config.id) : undefined
-    config.issuer = setDynamicParams(config.issuer, config)
+    config.issuer = setDynamicParams(config.issuer, config, config.id)
     return createOpenIDPlaceholder(config, {
         clientId: config.clientId || envConfig!.clientId,
         clientSecret: config.clientSecret || envConfig!.clientSecret,

packages/core/src/shared/oidc/resolve-provider.ts

@@ -21,7 +21,7 @@ export const resolveOpenIDProvider = async (provider: RuntimeOAuthProvider): Pro
     if (!issuer) {
         throw new Error("OIDC provider is missing issuer configuration: " + provider.id)
     }
-    issuer = setDynamicParams(issuer, provider as unknown as Record<string, unknown>)
+    issuer = setDynamicParams(issuer, provider as unknown as Record<string, unknown>, provider.id)
 
     const metadata = await discoveryMetadata(issuer)
     const scope =
@@ -75,7 +75,7 @@ export const createOpenIDPlaceholder = (
         revokeToken: config.revokeToken,
         refreshWindow: config.refreshWindow,
         oidc: {
-            issuer: setDynamicParams(config.issuer, config),
+            issuer: setDynamicParams(config.issuer, config, config.id),
         },
     }
 }

packages/core/test/actions/providers/connected.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect, vi, afterEach, beforeEach, expectTypeOf } from "vitest"
+import { describe, test, expect, vi, afterEach, beforeEach } from "vitest"
 import { createCSRF } from "@/shared/crypto.ts"
 import { GET, jose, oauthTokens, sessionPayload } from "@test/presets.ts"
 

packages/core/test/oauth.test.ts

@@ -1,14 +1,14 @@
-import { describe, test, expect } from "vitest"
+import { describe, test, expect, vi } from "vitest"
 import {
     createBuiltInOAuthProviders,
     builtInOAuthProviders,
-    type GitHubProfile,
     setDynamicParams,
     defineOpenIDProviderConfig,
+    type GitHubProfile,
 } from "@/oauth/index.ts"
-import type { OAuthProviderCredentials, User } from "@/@types/index.ts"
 import { AuraAuthError } from "@/shared/errors.ts"
-import { openIDCustomProvider } from "./presets.ts"
+import { openIDCustomProvider } from "@test/presets.ts"
+import type { OAuthProviderCredentials, User } from "@/@types/index.ts"
 
 describe("createBuiltInOAuthProviders", () => {
     test("create oauth config for github", () => {
@@ -91,6 +91,24 @@ describe("createBuiltInOAuthProviders", () => {
             },
         })
     })
+
+    test("infer dynamic slugs in issuer via environment variables", () => {
+        vi.stubEnv("AURA_AUTH_OIDC_PROVIDER_TEAMID", "1")
+        vi.stubEnv("AURA_AUTH_OIDC_PROVIDER_APPID", "2")
+
+        const oidc = createBuiltInOAuthProviders([
+            { ...openIDCustomProvider, issuer: "https://app.com/issuer/:teamId/apps/:appId" } as any,
+        ])
+        expect(oidc["oidc-provider"]).toMatchObject({
+            id: "oidc-provider",
+            name: "OIDC",
+            clientId: "oidc_client_id",
+            clientSecret: "oidc_client_secret",
+            oidc: {
+                issuer: "https://app.com/issuer/1/apps/2",
+            },
+        })
+    })
 })
 
 describe("setDynamicParams", () => {
@@ -136,7 +154,7 @@ describe("setDynamicParams", () => {
 
         for (const { description, input, values, expected } of testCases) {
             test(description, () => {
-                expect(setDynamicParams(input, values)).toBe(expected)
+                expect(setDynamicParams(input, values, "acme")).toBe(expected)
             })
         }
     })
@@ -152,7 +170,7 @@ describe("setDynamicParams", () => {
 
         for (const { description, input, values } of testCases) {
             test(description, () => {
-                expect(() => setDynamicParams(input, values)).toThrow(AuraAuthError)
+                expect(() => setDynamicParams(input, values, "acme")).toThrow(AuraAuthError)
             })
         }
     })