Add support for multiple issuers (OIDC providers with different JWKS URIs) on a single endpoint

[cuzzlor]

Problem to solve

We want to support access tokens from 2 distinct OIDC endpoints on a single API.

Note: this lib supports different verification options by host name; and additional issuers can be specified in verify options for a single JWKS URIs. The existing middleware and verification does not support multiple JWKS endpoints for the same host.

Proposal

• Create a new middleware with a slightly different config structure, supporting multiple distinct OIDC endpoints keyed by issuer
• When an auth header with bearer token is consumed, we:
  1. decode without verifying
  2. use the config for the token issuer
  3. verify the bearer token
• note: we still support per-host verification options via a (host) => options callback
• note: we cache JwksClients by the jwks URL

Also

• Update everything to latest, including applying ts-toolkit, dual output rollup build etc
• Make the @makerx/node-common Logger import via dev dependency, since we only import the type

[mderriey]

I like it