@kaged/sso
Stateless kaged SSO relay: performs the OAuth dance with upstream providers and mints short-lived ES256 identity tokens. Self-hostable, no database.
8
source files
2
test files
851
lines
✓ 19 pass
tests
pass
typecheck
clean
lint
Test results 19
return-url validation > accepts absolute https
[0.130ms]
return-url validation > accepts http only for localhost/127.0.0.1
[0.050ms]
return-url validation > rejects fragments and relative urls
[0.110ms]
return-url validation > appends token in fragment
[0.060ms]
signed state > round-trips a fresh state
[1.89ms]
signed state > rejects tampered body
[0.370ms]
signed state > rejects stale state (> 10 min)
[0.280ms]
signed state > rejects wrong secret
[0.220ms]
token minting > mints a verifiable ES256 token with the contract claims
[5.57ms]
token minting > refuses to mint when email_verified is false
[0.260ms]
provider identity mapping > google prefixes sub and reads email_verified
[0.070ms]
provider identity mapping > github prefixes sub and resolves primary verified email
[0.110ms]
relay server > GET /providers returns provider list with CORS *
[0.720ms]
relay server > JWKS endpoint serves a public key with kid, no private material
[0.720ms]
relay server > login redirects to provider authorize with signed state
[0.630ms]
relay server > login rejects an invalid return url
[0.210ms]
relay server > callback mints a token delivered in the fragment, verifiable by relay's public key
[1.68ms]
relay server > callback refuses when email is not verified
[0.530ms]
relay server > callback rejects a tampered state
[0.350ms]