Further decouple webserver

[ghostdevv]

It's great that you can already bring your own webserver, however koa is still a dependency and including in the code such that, if you bundle the library you can't really remove the extra code easily. It also presents some additional complexity given that it creates a dependency on the old node style req, res model which doesn't work for the relatively newer web standard cross-runtime web servers.

One idea is that the provider returns a set of functions that take in the newer Request object (which is easy to construct when you don't have it) and return a response (similarly easy to adapt to your webserver framework if it doesn't support it). This would remove the need for the routes config option, instead some documentation showing which routes should call which function. You could then have an optional dependency on koa, and a import { serve } from 'oidc-provider/serve' export to run the built in webserver.

[panva]

When and if https://github.com/jasnell/proposal-fetch-server (with jasnell/proposal-fetch-server#3 taken care of) takes off, sure. Until then I don't intend to make any changes to the fact this is tied to the Node.js runtime which is the only one being tested for and supported. Everything else works either incidentally or due to a well maintained node compatibility layer.

Current fetch-native frameworks suffer from Request/Response normalization. There is no lossless request introspection, some primitives entirely missing, thus making select existing extensions already not implementable. A future RFC9421 based PoP also wouldn't be reliable.