export default defineConfig({
    secret: "pussyhair",
    providers: [
        {
            id: "umbraco",
            name: "Umbraco",
            type: "oidc",// oidc or oauth?
            issuer: "https://localhost:44336/",
            clientId: "umbraco-member",
            token: "https://localhost:44336/umbraco/delivery/api/v1/security/member/token",
            authorization: {
                params: {
                    scope: "openid",
                    response_mode: "query"
                }
            },
            checks: ["pkce", "state"],
            client: {
                token_endpoint_auth_method: "none"
            },
            profile(profile) {
                console.log(profile); // I'm here, and this is not a profile!
                return {
                    id: profile.sub,
                    name: profile.name,
                    email: profile.email,
                    image: profile.picture,
                };
            },
        },
    ],
    cookies: {
        pkceCodeVerifier: {
            options: {
                httpOnly: true,
                sameSite: false,
                path: "/",
                secure: false,
            },
        },
    }
});

form_post

query

using System.Security.Claims;
using Microsoft.AspNetCore.Authentication;
using OpenIddict.Validation.AspNetCore;
using Umbraco.Cms.Core.DeliveryApi;
using Umbraco.Cms.Web.Common.Controllers;

namespace Humble.Umbraco_13.Website;

public class MemberController : UmbracoApiController
{
    private readonly IHttpContextAccessor _httpContextAccessor;

    public MemberController(IHttpContextAccessor httpContextAccessor)
    {
        _httpContextAccessor = httpContextAccessor;
    }
    
    // /Umbraco/Api/Member/Profile
    public async Task<object> Profile()
    {
        ClaimsPrincipal? requestPrincipal = await GetRequestPrincipal();
        var claims = requestPrincipal?.Claims;
        var identity = requestPrincipal?.Identity;
        return new
        {
            id = claims?.FirstOrDefault(x => x.Type.Equals("sub"))?.Value,
            name = claims?.FirstOrDefault(x => x.Type.Equals(ClaimTypes.Name))?.Value,
            email = claims?.FirstOrDefault(x => x.Type.Equals(ClaimTypes.Email))?.Value,
            image = claims?.FirstOrDefault(x => x.Type.Equals("picture"))?.Value
        };
    }
    
    /// <summary>
    /// Ref: https://github.com/umbraco/Umbraco-CMS/blob/contrib/src/Umbraco.Cms.Api.Delivery/Services/RequestMemberAccessService.cs#L39
    /// </summary>
    /// <returns></returns>
    private async Task<ClaimsPrincipal?> GetRequestPrincipal()
    {
        HttpContext httpContext = _httpContextAccessor.GetRequiredHttpContext();
        
        // Local calls
        var user = httpContext.User;
        if (user.Identity.IsAuthenticated) 
            return user;
        
        // Remote calls
        AuthenticateResult result = await httpContext.AuthenticateAsync(OpenIddictValidationAspNetCoreDefaults.AuthenticationScheme);
        return result.Succeeded
            ? result.Principal
            : null;
    }
}