The expected audience for tokens from this provider
OptionalclientOAuth client ID for this provider (used by OAuth proxy for upstream auth)
ProtectedconfigOptionaldomainProvider domain hosting the OAuth endpoints when they aren't on the issuer (used by OAuth proxy)
The issuer URL for this provider (must match the 'iss' claim in tokens)
ProtectedjwksThe JWKS endpoint URL for retrieving signing keys
Unique name identifier for this provider
Static ReadonlyDEFAULT_Destroys this provider's keep-alive HTTP agent, closing any open/idle sockets immediately instead of waiting for their own idle timeout. Safe to call more than once.
Extracts user identity from a local-dev JWT payload.
Gets the signing key for token verification with retry logic
Checks if a given issuer URL belongs to this provider
Validates that required configuration is present
StaticConfigConfigures the local development auth provider when MJ_DEV_AUTH_ENABLED
is explicitly enabled ('true' or '1').
Fails loudly if NODE_ENV === 'production'.
Local development authentication provider (
local).Validates short-lived RS256 development JWTs minted by MJAPI's local-only
/auth/dev-loginendpoint (backed by MJ's ephemeralMagicLinkKeyManagerkeypair and JWKS endpoint).SECURITY INVARIANT:
localhost/127.0.0.1) whenMJ_DEV_AUTH_ENABLED=true.NODE_ENV=production—ConfigFromEnvironmentthrows a fatal startup error ifMJ_DEV_AUTH_ENABLEDis truthy in production.