@alien_org/sso-sdk-core 1.0.0

package/dist/client.d.ts

@@ -0,0 +1,30 @@
+import { AuthorizeResponse, TokenInfo, UserInfo } from './schema';
+import { z } from 'zod/v4-mini';
+export interface JWTHeader {
+    alg: string;
+    typ: string;
+}
+export declare const AlienSsoSdkClientSchema: z.ZodMiniObject<{
+    serverSdkBaseUrl: z.ZodMiniString<string>;
+    ssoBaseUrl: z.ZodMiniURL;
+    pollingInterval: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
+}, z.core.$strip>;
+export type AlienSsoSdkClientConfig = z.infer<typeof AlienSsoSdkClientSchema>;
+export declare class AlienSsoSdkClient {
+    readonly config: AlienSsoSdkClientConfig;
+    readonly pollingInterval: number;
+    readonly serverSdkBaseUrl: string;
+    readonly ssoBaseUrl: string;
+    constructor(config: AlienSsoSdkClientConfig);
+    private generateCodeVerifier;
+    private generateCodeChallenge;
+    getAuthDeeplink(): Promise<AuthorizeResponse>;
+    pollAuth(pollingCode: string): Promise<string | null>;
+    exchangeToken(authorizationCode: string): Promise<string | null>;
+    verifyAuth(): Promise<boolean>;
+    getAccessToken(): string | null;
+    getUserInfo(): (TokenInfo & {
+        user: UserInfo;
+    }) | null;
+    logout(): void;
+}

package/dist/client.js

@@ -0,0 +1,200 @@
+import { AuthorizeResponseSchema, ExchangeCodeRequestSchema, ExchangeCodeResponseSchema, InternalAuthorizeRequestSchema, PollRequestSchema, PollResponseSchema, TokenInfoSchema, UserInfoSchema, VerifyTokenRequestSchema, VerifyTokenResponseSchema, } from './schema';
+import { z } from 'zod/v4-mini';
+import base64url from 'base64url';
+import CryptoJS from 'crypto-js';
+const SERVER_SDK_BASEURL = 'http://localhost:3000';
+const SSO_BASE_URL = 'https://sso.alien.com';
+const POLLING_INTERVAL = 5000;
+const STORAGE_KEY = 'alien-sso_';
+export const AlienSsoSdkClientSchema = z.object({
+    serverSdkBaseUrl: z.string(),
+    ssoBaseUrl: z.url(),
+    pollingInterval: z.optional(z.number()),
+});
+export class AlienSsoSdkClient {
+    constructor(config) {
+        this.config = AlienSsoSdkClientSchema.parse(config);
+        this.ssoBaseUrl = this.config.ssoBaseUrl || SSO_BASE_URL;
+        this.serverSdkBaseUrl = this.config.serverSdkBaseUrl || SERVER_SDK_BASEURL;
+        this.pollingInterval = this.config.pollingInterval || POLLING_INTERVAL;
+    }
+    generateCodeVerifier(length = 128) {
+        let array;
+        const cryptoObj = typeof window !== 'undefined' && window.crypto;
+        if (cryptoObj && cryptoObj.getRandomValues) {
+            array = new Uint8Array(length);
+            cryptoObj.getRandomValues(array);
+        }
+        else {
+            array = new Uint8Array(length);
+            for (let i = 0; i < length; i++) {
+                array[i] = Math.floor(Math.random() * 256);
+            }
+        }
+        let str = '';
+        for (let i = 0; i < array.length; i++) {
+            str += String.fromCharCode(array[i]);
+        }
+        return base64url.encode(str);
+    }
+    async generateCodeChallenge(codeVerifier) {
+        return CryptoJS.SHA256(codeVerifier).toString(CryptoJS.enc.Hex);
+    }
+    async getAuthDeeplink() {
+        const codeVerifier = this.generateCodeVerifier();
+        const codeChallenge = await this.generateCodeChallenge(codeVerifier);
+        sessionStorage.setItem(STORAGE_KEY + 'code_verifier', codeVerifier);
+        const authorizeUrl = `${this.config.serverSdkBaseUrl}/authorize`;
+        const authorizePayload = {
+            code_challenge: codeChallenge,
+        };
+        InternalAuthorizeRequestSchema.parse(authorizePayload);
+        const response = await fetch(authorizeUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify(authorizePayload),
+        });
+        const json = await response.json();
+        return AuthorizeResponseSchema.parse(json);
+    }
+    async pollAuth(pollingCode) {
+        const pollPayload = {
+            polling_code: pollingCode,
+        };
+        PollRequestSchema.parse(pollPayload);
+        const pollingUrl = `${this.config.ssoBaseUrl}/poll`;
+        while (true) {
+            const response = await fetch(pollingUrl, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify(pollPayload),
+            });
+            if (!response.ok) {
+                throw new Error(`Poll failed: ${response.statusText}`);
+            }
+            const json = await response.json();
+            const pollResponse = PollResponseSchema.parse(json);
+            if (pollResponse.status === 'authorized' &&
+                pollResponse.authorization_code) {
+                return pollResponse.authorization_code;
+            }
+            if (pollResponse.status === 'pending') {
+                await new Promise((resolve) => setTimeout(resolve, this.pollingInterval));
+            }
+            else {
+                throw new Error(`Poll failed`);
+            }
+        }
+    }
+    async exchangeToken(authorizationCode) {
+        const codeVerifier = sessionStorage.getItem(STORAGE_KEY + 'code_verifier');
+        if (!codeVerifier)
+            throw new Error('Missing code verifier.');
+        const exchangeCodePayload = {
+            authorization_code: authorizationCode,
+            code_verifier: codeVerifier,
+        };
+        ExchangeCodeRequestSchema.parse(exchangeCodePayload);
+        const exchangeUrl = `${this.config.ssoBaseUrl}/access_token/exchange`;
+        const response = await fetch(exchangeUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify(exchangeCodePayload),
+        });
+        if (!response.ok) {
+            throw new Error(`ExchangeCode failed: ${response.statusText}`);
+        }
+        const json = await response.json();
+        const exchangeCodeResponse = ExchangeCodeResponseSchema.parse(json);
+        if (exchangeCodeResponse.access_token) {
+            localStorage.setItem(STORAGE_KEY + 'access_token', exchangeCodeResponse.access_token);
+            return exchangeCodeResponse.access_token;
+        }
+        else {
+            throw new Error('Exchange failed');
+        }
+    }
+    async verifyAuth() {
+        const access_token = this.getAccessToken();
+        if (!access_token) {
+            throw new Error('Access token is invalid.');
+        }
+        const verifyTokenPayload = {
+            access_token,
+        };
+        VerifyTokenRequestSchema.parse(verifyTokenPayload);
+        const verifyTokenUrl = `${this.config.ssoBaseUrl}/access_token/verify`;
+        const response = await fetch(verifyTokenUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify(verifyTokenPayload),
+        });
+        if (!response.ok) {
+            throw new Error(`VerifyToken failed: ${response.statusText}`);
+        }
+        const json = await response.json();
+        const verifyTokenResponse = VerifyTokenResponseSchema.parse(json);
+        if (!verifyTokenResponse.is_valid) {
+            throw new Error('Access token is invalid.');
+        }
+        return verifyTokenResponse.is_valid;
+    }
+    getAccessToken() {
+        return localStorage.getItem(STORAGE_KEY + 'access_token');
+    }
+    getUserInfo() {
+        const token = this.getAccessToken();
+        if (!token)
+            return null;
+        const tokenParts = token.split('.');
+        if (tokenParts.length !== 3) {
+            throw new Error('Invalid token format');
+        }
+        const headerPart = tokenParts[0];
+        if (!headerPart)
+            return null;
+        let header;
+        try {
+            const headerJson = base64url.decode(headerPart);
+            header = JSON.parse(headerJson);
+        }
+        catch {
+            throw new Error('Invalid token header format');
+        }
+        if (header.alg !== 'HS256' || header.typ !== 'JWT') {
+            throw new Error('Unsupported token algorithm or type');
+        }
+        const payloadPart = tokenParts[1];
+        if (!payloadPart)
+            return null;
+        let payload;
+        try {
+            const payloadJson = JSON.parse(base64url.decode(payloadPart));
+            payload = TokenInfoSchema.parse(payloadJson);
+        }
+        catch {
+            throw new Error('Invalid token payload format');
+        }
+        let user;
+        try {
+            const userJson = JSON.parse(payload.app_callback_payload);
+            user = UserInfoSchema.parse(userJson);
+        }
+        catch {
+            throw new Error('Invalid app_callback_payload JSON format');
+        }
+        return Object.assign({}, payload, { user });
+    }
+    logout() {
+        localStorage.removeItem(STORAGE_KEY + 'access_token');
+        sessionStorage.removeItem(STORAGE_KEY + 'code_verifier');
+    }
+}

package/dist/errors.d.ts

@@ -0,0 +1,8 @@
+declare class BaseError extends Error {
+    constructor(message: string);
+}
+export declare class ValidationError extends BaseError {
+}
+export declare class AuthenticationError extends BaseError {
+}
+export {};

package/dist/errors.js

@@ -0,0 +1,13 @@
+class BaseError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = this.constructor.name;
+        if (Error.captureStackTrace) {
+            Error.captureStackTrace(this, this.constructor);
+        }
+    }
+}
+export class ValidationError extends BaseError {
+}
+export class AuthenticationError extends BaseError {
+}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export * from './client';
+export * from './server';
+export * from './errors';
+export * from './schema';

package/dist/index.js

@@ -0,0 +1,4 @@
+export * from './client';
+export * from './server';
+export * from './errors';
+export * from './schema';

package/dist/schema.d.ts

@@ -0,0 +1,80 @@
+import { z } from 'zod/v4-mini';
+/**
+ * Internal Authorize request/response schema to server SDK
+ */
+export declare const InternalAuthorizeRequestSchema: z.ZodMiniObject<{
+    code_challenge: z.ZodMiniString<string>;
+}, z.core.$strip>;
+export type InternalAuthorizeRequest = z.infer<typeof InternalAuthorizeRequestSchema>;
+/**
+ * Authorize request/response schema
+ */
+export declare const AuthorizeRequestSchema: z.ZodMiniObject<{
+    code_challenge: z.ZodMiniString<string>;
+    code_challenge_method: z.ZodMiniLiteral<"S256">;
+    provider_address: z.ZodMiniString<string>;
+    provider_signature: z.ZodMiniString<string>;
+}, z.core.$strip>;
+export type AuthorizeRequest = z.infer<typeof AuthorizeRequestSchema>;
+export declare const AuthorizeResponseSchema: z.ZodMiniObject<{
+    deep_link: z.ZodMiniString<string>;
+    polling_code: z.ZodMiniString<string>;
+    expired_at: z.ZodMiniNumber<number>;
+}, z.core.$strip>;
+export type AuthorizeResponse = z.infer<typeof AuthorizeResponseSchema>;
+/**
+ * Poll request/response schema
+ */
+export declare const PollRequestSchema: z.ZodMiniObject<{
+    polling_code: z.ZodMiniString<string>;
+}, z.core.$strip>;
+export type PollRequest = z.infer<typeof PollRequestSchema>;
+export declare const PollResponseSchema: z.ZodMiniObject<{
+    status: z.ZodMiniEnum<{
+        pending: "pending";
+        authorized: "authorized";
+    }>;
+    authorization_code: z.ZodMiniOptional<z.ZodMiniString<string>>;
+}, z.core.$strip>;
+export type PollResponse = z.infer<typeof PollResponseSchema>;
+/**
+ * ExchangeCode request/response schema
+ */
+export declare const ExchangeCodeRequestSchema: z.ZodMiniObject<{
+    authorization_code: z.ZodMiniString<string>;
+    code_verifier: z.ZodMiniString<string>;
+}, z.core.$strip>;
+export type ExchangeCodeRequest = z.infer<typeof ExchangeCodeRequestSchema>;
+export declare const ExchangeCodeResponseSchema: z.ZodMiniObject<{
+    access_token: z.ZodMiniString<string>;
+}, z.core.$strip>;
+export type ExchangeCodeResponse = z.infer<typeof ExchangeCodeResponseSchema>;
+/**
+ * VerifyToken request/response schema
+ */
+export declare const VerifyTokenRequestSchema: z.ZodMiniObject<{
+    access_token: z.ZodMiniString<string>;
+}, z.core.$strip>;
+export type VerifyTokenRequest = z.infer<typeof VerifyTokenRequestSchema>;
+export declare const VerifyTokenResponseSchema: z.ZodMiniObject<{
+    is_valid: z.ZodMiniBoolean<boolean>;
+}, z.core.$strip>;
+export type VerifyTokenResponse = z.infer<typeof VerifyTokenResponseSchema>;
+/**
+ * User info schema
+ */
+export declare const UserInfoSchema: z.ZodMiniObject<{
+    session_address: z.ZodMiniString<string>;
+}, z.core.$strip>;
+export type UserInfo = z.infer<typeof UserInfoSchema>;
+/**
+ * Token info schema
+ */
+export declare const TokenInfoSchema: z.ZodMiniObject<{
+    app_callback_payload: z.ZodMiniString<string>;
+    app_callback_session_signature: z.ZodMiniString<string>;
+    app_callback_session_address: z.ZodMiniString<string>;
+    expired_at: z.ZodMiniNumber<number>;
+    issued_at: z.ZodMiniNumber<number>;
+}, z.core.$strip>;
+export type TokenInfo = z.infer<typeof TokenInfoSchema>;

package/dist/schema.js

@@ -0,0 +1,68 @@
+import { z } from 'zod/v4-mini';
+/**
+ * Internal Authorize request/response schema to server SDK
+ */
+export const InternalAuthorizeRequestSchema = z.object({
+    code_challenge: z.string(),
+});
+/**
+ * Authorize request/response schema
+ */
+export const AuthorizeRequestSchema = z.object({
+    code_challenge: z.string(),
+    code_challenge_method: z.literal('S256'),
+    provider_address: z.string(),
+    provider_signature: z.string(),
+});
+export const AuthorizeResponseSchema = z.object({
+    deep_link: z.string(),
+    polling_code: z.string(),
+    expired_at: z.number(),
+});
+/**
+ * Poll request/response schema
+ */
+export const PollRequestSchema = z.object({
+    polling_code: z.string(),
+});
+const status = ['pending', 'authorized'];
+const StatusEnum = z.enum(status);
+export const PollResponseSchema = z.object({
+    status: StatusEnum,
+    authorization_code: z.optional(z.string()),
+});
+/**
+ * ExchangeCode request/response schema
+ */
+export const ExchangeCodeRequestSchema = z.object({
+    authorization_code: z.string(),
+    code_verifier: z.string(),
+});
+export const ExchangeCodeResponseSchema = z.object({
+    access_token: z.string(),
+});
+/**
+ * VerifyToken request/response schema
+ */
+export const VerifyTokenRequestSchema = z.object({
+    access_token: z.string(),
+});
+export const VerifyTokenResponseSchema = z.object({
+    is_valid: z.boolean(),
+});
+/**
+ * User info schema
+ */
+export const UserInfoSchema = z.object({
+    session_address: z.string(),
+});
+/**
+ * Token info schema
+ */
+export const TokenInfoSchema = z.object({
+    app_callback_payload: z.string(),
+    app_callback_session_signature: z.string(),
+    app_callback_session_address: z.string(),
+    expired_at: z.number(),
+    issued_at: z.number(),
+});

package/dist/server.d.ts

@@ -0,0 +1,14 @@
+import { AuthorizeResponse } from './schema';
+import { z } from 'zod/v4-mini';
+export declare const AlienSsoSdkServerConfigSchema: z.ZodMiniObject<{
+    providerAddress: z.ZodMiniString<string>;
+    providerPrivateKey: z.ZodMiniString<string>;
+    ssoBaseUrl: z.ZodMiniURL;
+}, z.core.$strip>;
+export type AlienSsoSdkServerConfig = z.infer<typeof AlienSsoSdkServerConfigSchema>;
+export declare class AlienSsoSdkServer {
+    readonly config: AlienSsoSdkServerConfig;
+    readonly ssoBaseUrl: string;
+    constructor(config: AlienSsoSdkServerConfig);
+    authorize(codeChallenge: string): Promise<AuthorizeResponse | null>;
+}

package/dist/server.js

@@ -0,0 +1,60 @@
+import { AuthorizeResponseSchema, AuthorizeRequestSchema, } from './schema';
+import { z } from 'zod/v4-mini';
+import { signAsync } from '@noble/ed25519';
+import { AuthenticationError, ValidationError } from './errors';
+const DEFAULT_SSO_BASE_URL = 'https://sso.alien-api.com';
+export const AlienSsoSdkServerConfigSchema = z.object({
+    providerAddress: z.string(),
+    providerPrivateKey: z.string(),
+    ssoBaseUrl: z.url(),
+});
+export class AlienSsoSdkServer {
+    constructor(config) {
+        const parsedConfig = AlienSsoSdkServerConfigSchema.parse(config);
+        this.config = parsedConfig;
+        this.ssoBaseUrl = parsedConfig.ssoBaseUrl || DEFAULT_SSO_BASE_URL;
+    }
+    async authorize(codeChallenge) {
+        if (!codeChallenge || codeChallenge.length !== 64) {
+            throw new ValidationError('Invalid code challenge');
+        }
+        // Note: order of fields important!
+        const signaturePayload = {
+            provider_address: this.config.providerAddress,
+            code_challenge: codeChallenge,
+            code_challenge_method: 'S256',
+        };
+        const message = JSON.stringify(signaturePayload);
+        const messageBytes = new TextEncoder().encode(message);
+        const privateKeyBytes = Buffer.from(this.config.providerPrivateKey, 'hex');
+        const signature = await signAsync(messageBytes, privateKeyBytes);
+        const authorizePayload = {
+            ...signaturePayload,
+            provider_signature: Buffer.from(signature).toString('hex'),
+        };
+        AuthorizeRequestSchema.parse(authorizePayload);
+        const authorizationUrl = `${this.config.ssoBaseUrl}/authorize`;
+        const response = await fetch(authorizationUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify(authorizePayload),
+        });
+        if (!response.ok) {
+            const text = await response.text();
+            throw new AuthenticationError(`SSO Router Authorization failed: ${text}`);
+        }
+        const json = await response.json();
+        const { deep_link, polling_code, expired_at } = AuthorizeResponseSchema.parse(json);
+        const deepLinkBytes = Buffer.from(deep_link, 'utf8');
+        const deepLinkSignature = await signAsync(deepLinkBytes, privateKeyBytes);
+        const deepLinkUrl = new URL(deep_link);
+        deepLinkUrl.searchParams.set('link_signature', Buffer.from(deepLinkSignature).toString('hex'));
+        return {
+            deep_link: deepLinkUrl.toString(),
+            polling_code,
+            expired_at,
+        };
+    }
+}

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "@alien_org/sso-sdk-core",
+  "version": "1.0.0",
+  "exports": {
+    "./client": {
+      "import": "./dist/client/index.js",
+      "types": "./dist/types/client.d.ts"
+    },
+    "./server": {
+      "require": "./dist/server/index.js",
+      "types": "./dist/types/server.d.ts"
+    }
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alien-id/sso-sdk-js.git"
+  },
+  "files": ["dist", "README.md"],
+  "scripts": {
+    "build": "tsc",
+    "test": "jest",
+    "test:unit": "jest tests/unit",
+    "test:integration": "jest tests/integration",
+    "test:watch": "jest --watch",
+    "release": "npm publish --access public",
+    "prepublishOnly": "npm run build"
+  },
+  "devDependencies": {
+    "@types/crypto-js": "^4.2.2",
+    "@types/express": "^5.0.3",
+    "@types/jest": "^30.0.0",
+    "@types/node": "^24.3.0",
+    "@typescript-eslint/eslint-plugin": "^8.41.0",
+    "@typescript-eslint/parser": "^8.41.0",
+    "cross-fetch": "^4.1.0",
+    "eslint": "^9.34.0",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-prettier": "^5.5.4",
+    "express": "^5.1.0",
+    "jest": "^30.1.2",
+    "jest-environment-jsdom": "^30.1.2",
+    "nock": "^14.0.10",
+    "prettier": "^3.6.2",
+    "ts-jest": "^29.4.1",
+    "turbo": "^2.5.6"
+  },
+  "dependencies": {
+    "@noble/ed25519": "^3.0.0",
+    "base64url": "^3.0.1",
+    "crypto-js": "^4.2.0",
+    "zod": "^4.1.5"
+  }
+}