Merge branch 'next-release' into 'main'

chore(release): prepare for 0.3.0

See merge request unboundsoftware/auth0mock!187

.gitignore

@@ -1,2 +1,3 @@
 node_modules/
 .idea/
+.claude/

.gitlab-ci.yml

@@ -1,22 +1,17 @@
 include:
 - template: 'Workflows/MergeRequest-Pipelines.gitlab-ci.yml'
+- project: unboundsoftware/ci-templates
+  file: Defaults.gitlab-ci.yml
+- project: unboundsoftware/ci-templates
+  file: Release.gitlab-ci.yml
 
 stages:
 - build
 
-variables:
-  DOCKER_HOST: tcp://docker:2376
-  DOCKER_TLS_CERTDIR: "/certs"
-  DOCKER_TLS_VERIFY: 1
-  DOCKER_CERT_PATH: "$DOCKER_TLS_CERTDIR/client"
-  DOCKER_DRIVER: overlay2
-
 image: buildtool/build-tools:${BUILDTOOLS_VERSION}
 
 build:
   stage: build
-  services:
-  - docker:${DOCKER_DIND_VERSION}
   script:
   - build
   - push

.nvmrc

@@ -1 +1 @@
-20
+24

.version

@@ -0,0 +1 @@
+{"version":"0.3.0"}

CHANGELOG.md

@@ -0,0 +1,248 @@
+## [0.3.0] - 2025-12-28
+
+### 🚀 Features
+
+- Increase resource limits and improve readiness checks
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update dependency debug to v4.4.2
+- Downgrade debug package to version 4.4.1
+- *(deps)* Update dependency debug to v4.4.3
+- *(deps)* Update dependency nodemon to v3.1.11
+- *(deps)* Update dependency body-parser to v2.2.1
+- *(deps)* Update dependency express to v5.2.0
+- *(deps)* Update dependency express to v5.2.1
+- *(deps)* Update dependency jsonwebtoken to v9.0.3
+## [0.2.0] - 2025-06-29
+
+### 🚀 Features
+
+- *(ci)* Add default CI configuration for pipelines
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update dependency nodemon to v3.1.10
+- *(deps)* Update dependency debug to v4.4.1
+- *(deps)* Update dependency serve-favicon to v2.5.1
+- *(k8s)* Update ingress configuration for backend service
+## [0.1.5] - 2025-04-03
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update dependency body-parser to v2
+- *(deps)* Update dependency express to v5
+- Update CORS options for better compatibility
+
+### ⚙️ Miscellaneous Tasks
+
+- *(Dockerfile)* Update Node.js base image version
+## [0.1.4] - 2025-01-24
+
+### 🐛 Bug Fixes
+
+- *(k8s)* Update labels to adhere to best practices
+## [0.1.3] - 2024-12-18
+
+### 🐛 Bug Fixes
+
+- *(deps)* Pin dependencies
+- *(deps)* Update dependency express to v4.21.2
+- *(deps)* Update dependency debug to v4.4.0
+- *(deps)* Update dependency nodemon to v3.1.9
+
+### 🚜 Refactor
+
+- *(ci)* Remove unused Docker variables from config
+
+### ⚙️ Miscellaneous Tasks
+
+- Update renovate configuration to disable auth0mock updates
+- Remove Docker service from build stage configuration
+## [0.1.2] - 2024-10-19
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update dependency cookie-parser to v1.4.7
+- *(deps)* Update dependency express to v4.21.1
+
+### ⚙️ Miscellaneous Tasks
+
+- Update Dockerfile to remove warnings
+- Support issuer in openid-configuration
+## [0.1.1] - 2024-10-05
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update dependency nodemon to v3.1.1
+- *(deps)* Update dependency nodemon to v3.1.2
+- *(deps)* Update dependency debug to v4.3.5
+- *(deps)* Update dependency nodemon to v3.1.3
+- *(deps)* Update dependency nodemon to v3.1.4
+- *(deps)* Update dependency debug to v4.3.6
+- *(deps)* Update dependency debug to v4.3.7
+- *(deps)* Update dependency body-parser to v1.20.3
+- *(deps)* Update dependency express to v4.20.0
+- *(deps)* Update dependency express to v4.21.0
+- *(deps)* Update dependency nodemon to v3.1.5
+- *(deps)* Update dependency nodemon to v3.1.6
+- *(deps)* Update dependency nodemon to v3.1.7
+
+### ⚙️ Miscellaneous Tasks
+
+- Add release flow
+## [0.1.0] - 2024-04-08
+
+### 🚀 Features
+
+- Replace keystore handling with node-jose
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update dependency express to v4.19.1
+- *(deps)* Update dependency express to v4.19.2
+## [0.0.17] - 2024-03-11
+
+### 🚀 Features
+
+- Support patching of user info
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update dependency express to v4.18.3
+## [0.0.16] - 2023-06-01
+
+### 🚀 Features
+
+- Initial users store
+## [0.0.15] - 2023-05-31
+
+### 🐛 Bug Fixes
+
+- Return empty array
+## [0.0.14] - 2023-05-31
+
+### 🚀 Features
+
+- Remember created users
+## [0.0.13] - 2023-05-02
+
+### 🚀 Features
+
+- Add name and email to id token
+## [0.0.12] - 2023-03-10
+
+### 🐛 Bug Fixes
+
+- Remove session on logout
+## [0.0.11] - 2023-03-10
+
+### 🐛 Bug Fixes
+
+- Update image name to correct location
+- Handle response mode query
+
+### ⚙️ Miscellaneous Tasks
+
+- Use Docker DinD version from variable
+- Change Dependabot rebase strategy
+- Format code and add prettier
+## [0.0.9] - 2022-04-28
+
+### 🚀 Features
+
+- Add support for client id and secret tokens
+## [0.0.8] - 2022-04-26
+
+### 🚀 Features
+
+- Add dummy-implementation of management API
+## [0.0.7] - 2022-04-26
+
+### 🐛 Bug Fixes
+
+- Use correct return-variable
+## [0.0.6] - 2022-04-26
+
+### 🐛 Bug Fixes
+
+- Make sure thumbPrint is a string
+
+### 💼 Other
+
+- *(deps)* Bump express from 4.17.3 to 4.18.0
+
+### ⚙️ Miscellaneous Tasks
+
+- Format code
+## [0.0.5] - 2022-04-26
+
+### 🐛 Bug Fixes
+
+- Add custom claims to both id and access token
+## [0.0.4] - 2022-04-26
+
+### 🚀 Features
+
+- Add email custom claim
+## [0.0.3] - 2022-04-26
+
+### 🚀 Features
+
+- Add env-property for default issuer
+## [0.0.2] - 2022-04-25
+
+### 💼 Other
+
+- *(deps)* Bump node from 17 to 18
+
+### ⚙️ Miscellaneous Tasks
+
+- Change admin-handling
+## [0.0.1] - 2022-04-19
+
+### 🚀 Features
+
+- Initial commit
+- Updated to be compatible with Auth0 SPA which uses the 'Authorization Code Grant using Proof Key for Code Exchange (PKCE)' flow
+- Add ENV-property for setting admin-role
+
+### 🐛 Bug Fixes
+
+- Use correct envs
+- Use commit rather than latest
+- Package.json & yarn.lock to reduce vulnerabilities
+- Package.json & yarn.lock to reduce vulnerabilities
+- Pipeline
+
+### 💼 Other
+
+- *(deps)* Bump nodemon from 2.0.14 to 2.0.15
+- *(deps)* Bump cookie-parser from 1.4.5 to 1.4.6
+- *(deps)* Bump debug from 4.3.2 to 4.3.3
+- *(deps)* Bump body-parser from 1.19.0 to 1.19.1
+- *(deps)* Bump express from 4.17.1 to 4.17.2
+- *(deps)* Bump node-forge from 0.10.0 to 1.0.0
+- *(deps)* Bump node-forge from 1.0.0 to 1.1.0
+- *(deps)* Bump node-forge from 1.1.0 to 1.2.0
+- *(deps)* Bump node-forge from 1.2.0 to 1.2.1
+- *(deps)* Bump body-parser from 1.19.1 to 1.19.2
+- *(deps)* Bump https-localhost from 4.7.0 to 4.7.1
+- *(deps)* Bump express from 4.17.2 to 4.17.3
+- *(deps)* Bump debug from 4.3.3 to 4.3.4
+- *(deps)* Bump node-forge from 1.2.1 to 1.3.0
+- *(deps)* Bump node-forge from 1.3.0 to 1.3.1
+- *(deps)* Bump body-parser from 1.19.2 to 1.20.0
+
+### ⚙️ Miscellaneous Tasks
+
+- Add triggering of acctest
+- Add artifacts
+- Update to latest build-tools
+- Update to latest build-tools
+- Add ingress
+- Add CI workflows
+- Use buildtools version from env
+- Add dependabot config
+- Remove dependabot-standalone
+- Cleanup and remove acctest triggering

CLAUDE.md

@@ -0,0 +1,83 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+auth0mock is a Node.js/Express application that simulates an Auth0 authentication server for local development. It provides OAuth 2.0 and OpenID Connect (OIDC) endpoints compatible with the Auth0 API, allowing developers to test authentication flows without connecting to the actual Auth0 service.
+
+## Development Commands
+
+```bash
+# Install dependencies
+yarn install
+
+# Start production server (port 3333)
+yarn start
+
+# Development with auto-reload (nodemon)
+yarn dev
+
+# Format code
+yarn lintfix
+
+# Check formatting
+yarn lint
+```
+
+## Architecture
+
+This is a single-file Express application (`app.js`) that implements:
+
+**Authentication Endpoints:**
+
+- `POST /oauth/token` - Token exchange (OAuth 2.0 authorization code flow)
+- `GET /authorize` - Authorization endpoint with HTML login form
+- `POST /code` - Code generation for PKCE flow
+
+**Discovery Endpoints:**
+
+- `GET /.well-known/openid-configuration` - OIDC discovery document
+- `GET /.well-known/jwks.json` - JSON Web Key Set for token verification
+
+**Management API (Auth0-compatible):**
+
+- `GET /api/v2/users-by-email` - Get user by email
+- `POST /api/v2/users` - Create user
+- `PATCH /api/v2/users/:userid` - Update user
+- `POST /api/v2/tickets/password-change` - Password change ticket
+
+**Key Implementation Details:**
+
+- RSA 2048-bit key pair generated at startup using `node-jose`
+- In-memory session and user storage (not persistent)
+- PKCE support with code challenge verification
+- Custom claims for admin (`https://unbound.se/admin`) and email (`https://unbound.se/email`)
+
+## Environment Variables
+
+| Variable     | Default                    | Purpose                          |
+| ------------ | -------------------------- | -------------------------------- |
+| `ISSUER`     | `localhost:3333`           | JWT issuer claim                 |
+| `AUDIENCE`   | `https://generic-audience` | JWT audience claim               |
+| `USERS_FILE` | `./users.json`             | Path to initial users JSON file  |
+| `DEBUG`      | (unset)                    | Debug logging (`app*` to enable) |
+
+## Initial Users
+
+Create a `users.json` file to seed users on startup:
+
+```json
+{
+  "email@test.com": {
+    "given_name": "John",
+    "family_name": "Doe",
+    "user_id": "auth0|email@test.com",
+    "email": "email@test.com"
+  }
+}
+```
+
+## Integration with Shiny
+
+This service is used for local development and acceptance testing of the Shiny platform. The gateway and frontend services are configured to accept tokens signed by this mock server when running locally.

Dockerfile

@@ -1,7 +1,7 @@
-FROM node:20
-ENV AUDIENCE "https://shiny.unbound.se"
-ENV ORIGIN_HOST "auth0mock"
-ENV ORIGIN "https://auth0mock:3333"
+FROM amd64/node:24.12.0@sha256:e8bb5aafe1964147c8344b1ea7698218e3675340407a07a14c49901df97455f6
+ENV AUDIENCE="https://shiny.unbound.se"
+ENV ORIGIN_HOST="auth0mock"
+ENV ORIGIN="https://auth0mock:3333"
 EXPOSE 3333
 WORKDIR /app
 ADD package.json yarn.lock /app/
@@ -9,4 +9,4 @@ RUN yarn install --frozen-lockfile
 ADD *.js /app/
 ADD public /app/public
 RUN mkdir -p /root/.config
-ENTRYPOINT yarn start
+ENTRYPOINT ["yarn", "start"]

app.js

@@ -8,7 +8,7 @@ const Debug = require('debug')
 const path = require('path')
 const cors = require('cors')
 const bodyParser = require('body-parser')
-const jose = require('node-jose');
+const jose = require('node-jose')
 const favicon = require('serve-favicon')
 const initialUsers = require('./users')
 
@@ -54,7 +54,7 @@ const signToken = async (token) => {
 
 // Configure our small auth0-mock-server
 app
-  .options('*', cors(corsOpts))
+  .options('*all', cors(corsOpts))
   .use(cors())
   .use(bodyParser.json({ strict: false }))
   .use(bodyParser.urlencoded({ extended: true }))
@@ -128,6 +128,10 @@ app.post('/oauth/token', async (req, res) => {
 
     debug('Signed token for ' + session.email)
 
+    // Clean up session and challenge after successful token exchange
+    delete sessions[code]
+    delete challenges[code]
+
     res.json({
       access_token: accessToken,
       id_token: idToken,
@@ -141,22 +145,6 @@ app.post('/oauth/token', async (req, res) => {
   }
 })
 
-// This route can be used to generate a valid jwt-token.
-app.get('/token/:email', (req, res) => {
-  if (!req.params.email) {
-    debug('No user was given!')
-    return res.status(400).send('user is missing')
-  }
-  const token = jwt.sign(
-    {
-      user_id: 'auth0|' + req.params.email
-    },
-    privateKey
-  )
-  debug('Signed token for ' + req.params.email)
-  res.json({ token })
-})
-
 app.post('/code', (req, res) => {
   if (!req.body.email || !req.body.password || !req.body.codeChallenge) {
     debug('Body is invalid!', req.body)
@@ -301,65 +289,66 @@ app.get('/.well-known/openid-configuration', (req, res) => {
   debug('Fetching OpenID configuration')
   res.contentType('application/json').send(
     JSON.stringify({
-      "issuer":
-        "https://auth0",
-      "authorization_endpoint":
-        "https://server.example.com/authorize",
-      "token_endpoint":
-        "https://server.example.com/oauth/token",
-      "token_endpoint_auth_methods_supported":
-        ["client_secret_basic", "private_key_jwt"],
-      "token_endpoint_auth_signing_alg_values_supported":
-        ["RS256"],
-      "userinfo_endpoint":
-        "https://server.example.com/userinfo",
-      "check_session_iframe":
-        "https://server.example.com/check_session",
-      "end_session_endpoint":
-        "https://server.example.com/end_session",
-      "jwks_uri":
-        "https://server.example.com/.well-known/jwks.json",
-      "registration_endpoint":
-        "https://server.example.com/register",
-      "scopes_supported":
-        ["openid", "profile", "email", "address",
-          "phone", "offline_access"],
-      "response_types_supported":
-        ["code", "code id_token", "id_token", "id_token token"],
-      "acr_values_supported":
-        [],
-      "subject_types_supported":
-        ["public", "pairwise"],
-      "userinfo_signing_alg_values_supported":
-        ["RS256", "ES256", "HS256"],
-      "userinfo_encryption_alg_values_supported":
-        ["RSA-OAEP-256", "A128KW"],
-      "userinfo_encryption_enc_values_supported":
-        ["A128CBC-HS256", "A128GCM"],
-      "id_token_signing_alg_values_supported":
-        ["RS256", "ES256", "HS256"],
-      "id_token_encryption_alg_values_supported":
-        ["RSA-OAEP-256", "A128KW"],
-      "id_token_encryption_enc_values_supported":
-        ["A128CBC-HS256", "A128GCM"],
-      "request_object_signing_alg_values_supported":
-        ["none", "RS256", "ES256"],
-      "display_values_supported":
-        ["page", "popup"],
-      "claim_types_supported":
-        ["normal", "distributed"],
-      "claims_supported":
-        ["sub", "iss", "auth_time", "acr",
-          "name", "given_name", "family_name", "nickname",
-          "profile", "picture", "website",
-          "email", "email_verified", "locale", "zoneinfo",
-          "https://unbound.se/email", "https://unbound.se/admin"],
-      "claims_parameter_supported":
-        true,
-      "service_documentation":
-        "http://auth0/",
-      "ui_locales_supported":
-        ["en-US"]
+      issuer: `${jwksOrigin}`,
+      authorization_endpoint: `${jwksOrigin}authorize`,
+      token_endpoint: `${jwksOrigin}oauth/token`,
+      token_endpoint_auth_methods_supported: [
+        'client_secret_basic',
+        'private_key_jwt'
+      ],
+      token_endpoint_auth_signing_alg_values_supported: ['RS256'],
+      userinfo_endpoint: `${jwksOrigin}userinfo`,
+      check_session_iframe: `${jwksOrigin}check_session`,
+      end_session_endpoint: `${jwksOrigin}end_session`,
+      jwks_uri: `${jwksOrigin}.well-known/jwks.json`,
+      registration_endpoint: `${jwksOrigin}register`,
+      scopes_supported: [
+        'openid',
+        'profile',
+        'email',
+        'address',
+        'phone',
+        'offline_access'
+      ],
+      response_types_supported: [
+        'code',
+        'code id_token',
+        'id_token',
+        'id_token token'
+      ],
+      acr_values_supported: [],
+      subject_types_supported: ['public', 'pairwise'],
+      userinfo_signing_alg_values_supported: ['RS256', 'ES256', 'HS256'],
+      userinfo_encryption_alg_values_supported: ['RSA-OAEP-256', 'A128KW'],
+      userinfo_encryption_enc_values_supported: ['A128CBC-HS256', 'A128GCM'],
+      id_token_signing_alg_values_supported: ['RS256', 'ES256', 'HS256'],
+      id_token_encryption_alg_values_supported: ['RSA-OAEP-256', 'A128KW'],
+      id_token_encryption_enc_values_supported: ['A128CBC-HS256', 'A128GCM'],
+      request_object_signing_alg_values_supported: ['none', 'RS256', 'ES256'],
+      display_values_supported: ['page', 'popup'],
+      claim_types_supported: ['normal', 'distributed'],
+      claims_supported: [
+        'sub',
+        'iss',
+        'auth_time',
+        'acr',
+        'name',
+        'given_name',
+        'family_name',
+        'nickname',
+        'profile',
+        'picture',
+        'website',
+        'email',
+        'email_verified',
+        'locale',
+        'zoneinfo',
+        'https://unbound.se/email',
+        'https://unbound.se/admin'
+      ],
+      claims_parameter_supported: true,
+      service_documentation: 'http://auth0/',
+      ui_locales_supported: ['en-US']
     })
   )
 })

k8s/deploy.yaml

@@ -6,11 +6,11 @@ spec:
   replicas: 1
   selector:
     matchLabels:
-      app: auth0mock
+      app.kubernetes.io/name: auth0mock
   template:
     metadata:
       labels:
-        app: auth0mock
+        app.kubernetes.io/name: auth0mock
     spec:
       containers:
         - name: auth0mock
@@ -18,9 +18,9 @@ spec:
           imagePullPolicy: "IfNotPresent"
           resources:
             requests:
-              memory: 200Mi
+              memory: 256Mi
             limits:
-              memory: 300Mi
+              memory: 512Mi
           ports:
             - containerPort: 3333
           env:
@@ -29,17 +29,23 @@ spec:
           readinessProbe:
             httpGet:
               port: 3333
-              path: .well-known/jwks.json
+              path: /.well-known/jwks.json
+          livenessProbe:
+            httpGet:
+              port: 3333
+              path: /.well-known/jwks.json
+            initialDelaySeconds: 10
+            periodSeconds: 30
 ---
 apiVersion: v1
 kind: Service
 metadata:
   name: auth0mock
   labels:
-    app: auth0mock
+    app.kubernetes.io/name: auth0mock
 spec:
   ports:
     - port: 3333
   selector:
-    app: auth0mock
+    app.kubernetes.io/name: auth0mock
   type: ClusterIP

k8s/ingress-test.yaml

@@ -1,4 +1,4 @@
-apiVersion: networking.k8s.io/v1beta1
+apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: auth0-ingress
@@ -11,9 +11,12 @@ spec:
     http:
       paths:
       - path: /
+        pathType: Prefix
         backend:
-          serviceName: auth0mock
-          servicePort: 3333
+          service:
+            name: auth0mock
+            port:
+              number: 3333
   tls:
     - hosts:
         - auth0

package.json

@@ -14,18 +14,18 @@
   "author": "",
   "license": "MIT",
   "dependencies": {
-    "body-parser": "^1.20.2",
-    "cookie-parser": "^1.4.6",
-    "cors": "^2.8.3",
-    "debug": "^4.3.4",
-    "express": "^4.18.2",
-    "https-localhost": "^4.7.1",
-    "jsonwebtoken": "^9.0.2",
-    "node-jose": "^2.2.0",
-    "nodemon": "^3.1.0",
-    "serve-favicon": "^2.4.2"
+    "body-parser": "2.2.1",
+    "cookie-parser": "1.4.7",
+    "cors": "2.8.5",
+    "debug": "4.4.3",
+    "express": "5.2.1",
+    "https-localhost": "4.7.1",
+    "jsonwebtoken": "9.0.3",
+    "node-jose": "2.2.0",
+    "nodemon": "3.1.11",
+    "serve-favicon": "2.5.1"
   },
   "devDependencies": {
-    "prettier": "^3.2.5"
+    "prettier": "3.7.4"
   }
 }

renovate.json

@@ -2,5 +2,16 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
     "config:recommended"
+  ],
+  "packageRules": [
+    {
+      "matchManagers": [
+        "kubernetes"
+      ],
+      "matchPackageNames": [
+        "registry.gitlab.com/unboundsoftware/auth0mock"
+      ],
+      "enabled": false
+    }
   ]
 }