@alien_org/sso-sdk-core 1.0.17 → 1.0.19

package/README.md

@@ -2,6 +2,10 @@
 
 Core TypeScript client for [Alien SSO](https://alien.org) authentication. Provides OIDC-compatible authentication with blockchain and TEE backing.
 
+## ⚠️ Alpha Version Notice
+
+**This is an early alpha version.** The SDK is under active development and may contain bugs or undergo breaking changes. Use with caution in production environments.
+
 ## Installation
 
 ```bash

package/dist/index.cjs

@@ -1 +1 @@
-"use strict";var d=(a,o,s)=>new Promise((n,r)=>{var t=i=>{try{h(s.next(i))}catch(g){r(g)}},c=i=>{try{h(s.throw(i))}catch(g){r(g)}},h=i=>i.done?n(i.value):Promise.resolve(i.value).then(t,c);h((s=s.apply(a,o)).next())});Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const e=require("zod/v4-mini"),j=require("js-sha256"),S=e.z.object({code_challenge:e.z.string(),code_challenge_method:e.z.literal("S256")}),f=e.z.object({deep_link:e.z.string(),polling_code:e.z.string(),expired_at:e.z.number()}),_=e.z.object({polling_code:e.z.string()}),v=["pending","authorized","rejected","expired"],T=e.z.enum(v),m=e.z.object({status:T,authorization_code:e.z.optional(e.z.string())}),z=e.z.object({authorization_code:e.z.string(),code_verifier:e.z.string()}),y=e.z.object({access_token:e.z.string()}),R=e.z.object({access_token:e.z.string()}),k=e.z.object({is_valid:e.z.boolean(),access_token:e.z.optional(e.z.string())}),b=e.z.object({app_callback_session_address:e.z.string(),expired_at:e.z.number(),issued_at:e.z.number()});function w(a){return btoa(a).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function u(a){let o=a.replace(/-/g,"+").replace(/_/g,"/");for(;o.length%4;)o+="=";return atob(o)}const C="https://sso.alien.com",E=5e3,l="alien-sso_",p=(a,o)=>new URL(o,a).toString(),A=e.z.object({ssoBaseUrl:e.z.url(),providerAddress:e.z.string(),pollingInterval:e.z.optional(e.z.number())});class P{constructor(o){this.config=A.parse(o),this.ssoBaseUrl=this.config.ssoBaseUrl||C,this.providerAddress=this.config.providerAddress,this.pollingInterval=this.config.pollingInterval||E}generateCodeVerifier(o=128){let s;const n=typeof window!="undefined"&&window.crypto;if(n&&n.getRandomValues)s=new Uint8Array(o),n.getRandomValues(s);else{s=new Uint8Array(o);for(let t=0;t<o;t++)s[t]=Math.floor(Math.random()*256)}let r="";for(let t=0;t<s.length;t++)r+=String.fromCharCode(s[t]);return w(r)}generateCodeChallenge(o){return j.sha256(o)}generateDeeplink(){return d(this,null,function*(){const o=this.generateCodeVerifier(),s=this.generateCodeChallenge(o);sessionStorage.setItem(l+"code_verifier",o);const n=`${this.config.ssoBaseUrl}/sso/authorize`,r={code_challenge:s,code_challenge_method:"S256"};S.parse(r);const c=yield(yield fetch(n,{method:"POST",headers:{"Content-Type":"application/json","X-PROVIDER-ADDRESS":this.providerAddress},body:JSON.stringify(r)})).json();return f.parse(c)})}pollAuth(o){return d(this,null,function*(){const s={polling_code:o};_.parse(s);const n=yield fetch(p(this.config.ssoBaseUrl,"/sso/poll"),{method:"POST",headers:{"Content-Type":"application/json","X-PROVIDER-ADDRESS":this.providerAddress},body:JSON.stringify(s)});if(!n.ok)throw new Error(`Poll failed: ${n.statusText}`);const r=yield n.json();return m.parse(r)})}exchangeToken(o){return d(this,null,function*(){const s=sessionStorage.getItem(l+"code_verifier");if(!s)throw new Error("Missing code verifier.");const n={authorization_code:o,code_verifier:s};z.parse(n);const r=yield fetch(p(this.config.ssoBaseUrl,"/sso/access_token/exchange"),{method:"POST",headers:{"Content-Type":"application/json","X-PROVIDER-ADDRESS":this.providerAddress},body:JSON.stringify(n)});if(!r.ok)throw new Error(`ExchangeCode failed: ${r.statusText}`);const t=yield r.json(),c=y.parse(t);if(c.access_token)return localStorage.setItem(l+"access_token",c.access_token),c.access_token;throw new Error("Exchange failed")})}verifyAuth(){return d(this,null,function*(){const o=this.getAccessToken();if(!o)return!1;const s={access_token:o};R.parse(s);const n=yield fetch(p(this.config.ssoBaseUrl,"/sso/access_token/verify"),{method:"POST",headers:{"Content-Type":"application/json","X-PROVIDER-ADDRESS":this.providerAddress},body:JSON.stringify(s)});if(!n.ok)return!1;const r=yield n.json(),t=k.parse(r);return t.access_token&&localStorage.setItem(l+"access_token",t.access_token),t.is_valid})}getAccessToken(){return localStorage.getItem(l+"access_token")}getAuthData(){const o=this.getAccessToken();if(!o)return null;const s=o.split(".");if(s.length!==3)return null;let n;try{const t=u(s[0]);n=JSON.parse(t)}catch(t){return null}if(n.alg!=="HS256"||n.typ!=="JWT")return null;let r;try{const t=JSON.parse(u(s[1]));r=b.parse(t)}catch(t){return null}return r}logout(){localStorage.removeItem(l+"access_token"),sessionStorage.removeItem(l+"code_verifier")}}exports.AlienSsoClient=P;exports.AlienSsoClientSchema=A;exports.AuthorizeRequestSchema=S;exports.AuthorizeResponseSchema=f;exports.ExchangeCodeRequestSchema=z;exports.ExchangeCodeResponseSchema=y;exports.PollRequestSchema=_;exports.PollResponseSchema=m;exports.TokenInfoSchema=b;exports.VerifyTokenRequestSchema=R;exports.VerifyTokenResponseSchema=k;
+"use strict";var d=(h,e,o)=>new Promise((r,s)=>{var a=l=>{try{c(o.next(l))}catch(m){s(m)}},n=l=>{try{c(o.throw(l))}catch(m){s(m)}},c=l=>l.done?r(l.value):Promise.resolve(l.value).then(a,n);c((o=o.apply(h,e)).next())});Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const t=require("zod/v4-mini"),b=require("js-sha256"),k=t.z.object({deep_link:t.z.string(),polling_code:t.z.string(),expired_at:t.z.number()}),w=t.z.object({polling_code:t.z.string()}),R=["pending","authorized","rejected","expired"],I=t.z.enum(R),y=t.z.object({status:I,authorization_code:t.z.optional(t.z.string())}),f=t.z.object({access_token:t.z.string(),token_type:t.z.string(),expires_in:t.z.number(),id_token:t.z.string(),refresh_token:t.z.string()}),z=t.z.object({sub:t.z.string()}),T=t.z.object({iss:t.z.string(),sub:t.z.string(),aud:t.z.union([t.z.string(),t.z.array(t.z.string())]),exp:t.z.number(),iat:t.z.number(),nonce:t.z.optional(t.z.string()),auth_time:t.z.optional(t.z.number())}),j=f;function S(h){return btoa(h).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function _(h){let e=h.replace(/-/g,"+").replace(/_/g,"/");for(;e.length%4;)e+="=";return atob(e)}const x="https://sso.alien.com",E=5e3,i="alien-sso_",u=i+"refresh_token",g=i+"token_expiry",p=(h,e)=>new URL(e,h).toString(),A=t.z.object({ssoBaseUrl:t.z.url(),providerAddress:t.z.string(),pollingInterval:t.z.optional(t.z.number())});class v{constructor(e){this.config=A.parse(e),this.ssoBaseUrl=this.config.ssoBaseUrl||x,this.providerAddress=this.config.providerAddress,this.pollingInterval=this.config.pollingInterval||E}generateCodeVerifier(e=128){let o;const r=typeof window!="undefined"&&window.crypto;if(r&&r.getRandomValues)o=new Uint8Array(e),r.getRandomValues(o);else{o=new Uint8Array(e);for(let a=0;a<e;a++)o[a]=Math.floor(Math.random()*256)}let s="";for(let a=0;a<o.length;a++)s+=String.fromCharCode(o[a]);return S(s)}generateCodeChallenge(e){const o=b.sha256.array(e),r=String.fromCharCode(...o);return S(r)}generateDeeplink(){return d(this,null,function*(){const e=this.generateCodeVerifier(),o=this.generateCodeChallenge(e);sessionStorage.setItem(i+"code_verifier",e);const r=new URLSearchParams({response_type:"code",response_mode:"json",client_id:this.providerAddress,scope:"openid",code_challenge:o,code_challenge_method:"S256"}),s=`${this.config.ssoBaseUrl}/oauth/authorize?${r.toString()}`,a=yield fetch(s,{method:"GET"});if(!a.ok){const c=yield a.json().catch(()=>({error:a.statusText}));throw new Error(`Authorize failed: ${c.error_description||c.error||a.statusText}`)}const n=yield a.json();return k.parse(n)})}pollAuth(e){return d(this,null,function*(){const o={polling_code:e};w.parse(o);const r=yield fetch(p(this.config.ssoBaseUrl,"/oauth/poll"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(o)});if(!r.ok)throw new Error(`Poll failed: ${r.statusText}`);const s=yield r.json();return y.parse(s)})}exchangeToken(e){return d(this,null,function*(){const o=sessionStorage.getItem(i+"code_verifier");if(!o)throw new Error("Missing code verifier.");const r=new URLSearchParams({grant_type:"authorization_code",code:e,client_id:this.providerAddress,code_verifier:o}),s=yield fetch(p(this.config.ssoBaseUrl,"/oauth/token"),{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:r.toString()});if(!s.ok){const l=yield s.json().catch(()=>({error:s.statusText}));throw new Error(`Token exchange failed: ${l.error_description||l.error||s.statusText}`)}const a=yield s.json(),n=f.parse(a);localStorage.setItem(i+"access_token",n.access_token),localStorage.setItem(i+"id_token",n.id_token),localStorage.setItem(u,n.refresh_token);const c=Date.now()+n.expires_in*1e3;return localStorage.setItem(g,c.toString()),sessionStorage.removeItem(i+"code_verifier"),n})}verifyAuth(){return d(this,null,function*(){return this.withAutoRefresh(()=>d(this,null,function*(){const e=this.getAccessToken();if(!e)return null;const o=yield fetch(p(this.config.ssoBaseUrl,"/oauth/userinfo"),{method:"GET",headers:{Authorization:`Bearer ${e}`}});if(!o.ok){if(o.status===401){const s=new Error("Unauthorized");throw s.response={status:401},s}return null}const r=yield o.json();return z.parse(r)}))})}getAccessToken(){return localStorage.getItem(i+"access_token")}getIdToken(){return localStorage.getItem(i+"id_token")}getAuthData(){const e=this.getIdToken()||this.getAccessToken();if(!e)return null;const o=e.split(".");if(o.length!==3)return null;let r;try{const n=_(o[0]);r=JSON.parse(n)}catch(n){return null}if(r.alg!=="RS256"||r.typ!=="JWT")return null;let s;try{const n=JSON.parse(_(o[1]));s=T.parse(n)}catch(n){return null}return(Array.isArray(s.aud)?s.aud:[s.aud]).includes(this.providerAddress)?s:null}getSubject(){const e=this.getAuthData();return(e==null?void 0:e.sub)||null}isTokenExpired(){const e=this.getAuthData();return e?Date.now()/1e3>e.exp:!0}logout(){localStorage.removeItem(i+"access_token"),localStorage.removeItem(i+"id_token"),localStorage.removeItem(u),localStorage.removeItem(g),sessionStorage.removeItem(i+"code_verifier")}getRefreshToken(){return localStorage.getItem(u)}hasRefreshToken(){return!!this.getRefreshToken()}isAccessTokenExpired(){const e=localStorage.getItem(g);if(!e)return!0;const o=parseInt(e,10),r=Date.now(),s=300*1e3;return r>=o-s}refreshAccessToken(){return d(this,null,function*(){const e=this.getRefreshToken();if(!e)throw new Error("No refresh token available");const o=new URLSearchParams({grant_type:"refresh_token",refresh_token:e,client_id:this.providerAddress}),r=yield fetch(p(this.config.ssoBaseUrl,"/oauth/token"),{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:o.toString()});if(!r.ok){const c=yield r.json().catch(()=>({error:r.statusText}));throw this.logout(),new Error(`Token refresh failed: ${c.error_description||c.error||r.statusText}`)}const s=yield r.json(),a=f.parse(s);localStorage.setItem(i+"access_token",a.access_token),localStorage.setItem(i+"id_token",a.id_token),localStorage.setItem(u,a.refresh_token);const n=Date.now()+a.expires_in*1e3;return localStorage.setItem(g,n.toString()),a})}withAutoRefresh(e,o=1){return d(this,null,function*(){var r,s,a;try{return yield e()}catch(n){if((((r=n==null?void 0:n.response)==null?void 0:r.status)===401||((s=n==null?void 0:n.message)==null?void 0:s.includes("401"))||((a=n==null?void 0:n.message)==null?void 0:a.includes("Unauthorized")))&&o>0&&this.hasRefreshToken())try{return yield this.refreshAccessToken(),yield e()}catch(l){throw n}throw n}})}}exports.AlienSsoClient=v;exports.AlienSsoClientSchema=A;exports.AuthorizeResponseSchema=k;exports.ExchangeCodeResponseSchema=j;exports.PollRequestSchema=w;exports.PollResponseSchema=y;exports.TokenInfoSchema=T;exports.TokenResponseSchema=f;exports.UserInfoResponseSchema=z;

package/dist/index.d.ts

@@ -8,13 +8,75 @@ export declare class AlienSsoClient {
     constructor(config: AlienSsoClientConfig);
     private generateCodeVerifier;
     private generateCodeChallenge;
+    /**
+     * Initiates OAuth2 authorization flow with response_mode=json for SPA
+     * GET /oauth/authorize?response_type=code&response_mode=json&...
+     */
     generateDeeplink(): Promise<AuthorizeResponse>;
+    /**
+     * Polls for authorization completion
+     * POST /oauth/poll
+     */
     pollAuth(pollingCode: string): Promise<PollResponse>;
-    exchangeToken(authorizationCode: string): Promise<string>;
-    verifyAuth(): Promise<boolean>;
+    /**
+     * Exchanges authorization code for tokens
+     * POST /oauth/token (application/x-www-form-urlencoded)
+     * Returns both access_token and id_token
+     */
+    exchangeToken(authorizationCode: string): Promise<TokenResponse>;
+    /**
+     * Verifies authentication by calling userinfo endpoint
+     * GET /oauth/userinfo
+     * Automatically refreshes token on 401 if refresh token is available
+     */
+    verifyAuth(): Promise<UserInfoResponse | null>;
+    /**
+     * Gets stored access token
+     */
     getAccessToken(): string | null;
+    /**
+     * Gets stored ID token
+     */
+    getIdToken(): string | null;
+    /**
+     * Decodes and validates JWT token to extract claims
+     * Works with both access_token and id_token (EdDSA signed)
+     */
     getAuthData(): TokenInfo | null;
+    /**
+     * Gets the subject (user identifier) from the token
+     */
+    getSubject(): string | null;
+    /**
+     * Checks if the current token is expired
+     */
+    isTokenExpired(): boolean;
+    /**
+     * Clears all stored authentication data
+     */
     logout(): void;
+    /**
+     * Gets stored refresh token
+     */
+    getRefreshToken(): string | null;
+    /**
+     * Checks if a refresh token is available
+     */
+    hasRefreshToken(): boolean;
+    /**
+     * Checks if the access token is expired or will expire soon (within 5 minutes)
+     */
+    isAccessTokenExpired(): boolean;
+    /**
+     * Refreshes the access token using the stored refresh token
+     * POST /oauth/token with grant_type=refresh_token
+     */
+    refreshAccessToken(): Promise<TokenResponse>;
+    /**
+     * Executes a function that makes an authenticated request
+     * Automatically refreshes token and retries on 401 error
+     */
+    withAutoRefresh<T>(requestFn: () => Promise<T>, maxRetries?: number): Promise<T>;
 }
 
 export declare type AlienSsoClientConfig = z.infer<typeof AlienSsoClientSchema>;
@@ -25,49 +87,39 @@ export declare const AlienSsoClientSchema: z.ZodMiniObject<{
     pollingInterval: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
 }, z.core.$strip>;
 
-export declare type AuthorizeRequest = z.infer<typeof AuthorizeRequestSchema>;
+export declare type AuthorizeResponse = z.infer<typeof AuthorizeResponseSchema>;
 
 /**
- * Authorize request/response schema
+ * Authorize response schema (for response_mode=json)
+ * GET /oauth/authorize?response_mode=json&...
  */
-export declare const AuthorizeRequestSchema: z.ZodMiniObject<{
-    code_challenge: z.ZodMiniString<string>;
-    code_challenge_method: z.ZodMiniLiteral<"S256">;
-}, z.core.$strip>;
-
-export declare type AuthorizeResponse = z.infer<typeof AuthorizeResponseSchema>;
-
 export declare const AuthorizeResponseSchema: z.ZodMiniObject<{
     deep_link: z.ZodMiniString<string>;
     polling_code: z.ZodMiniString<string>;
     expired_at: z.ZodMiniNumber<number>;
 }, z.core.$strip>;
 
-export declare type ExchangeCodeRequest = z.infer<typeof ExchangeCodeRequestSchema>;
-
-/**
- * ExchangeCode request/response schema
- */
-export declare const ExchangeCodeRequestSchema: z.ZodMiniObject<{
-    authorization_code: z.ZodMiniString<string>;
-    code_verifier: z.ZodMiniString<string>;
-}, z.core.$strip>;
-
-export declare type ExchangeCodeResponse = z.infer<typeof ExchangeCodeResponseSchema>;
+export declare type ExchangeCodeResponse = TokenResponse;
 
 export declare const ExchangeCodeResponseSchema: z.ZodMiniObject<{
     access_token: z.ZodMiniString<string>;
+    token_type: z.ZodMiniString<string>;
+    expires_in: z.ZodMiniNumber<number>;
+    id_token: z.ZodMiniString<string>;
+    refresh_token: z.ZodMiniString<string>;
 }, z.core.$strip>;
 
 export declare interface JWTHeader {
     alg: string;
     typ: string;
+    kid?: string;
 }
 
 export declare type PollRequest = z.infer<typeof PollRequestSchema>;
 
 /**
  * Poll request/response schema
+ * POST /oauth/poll
  */
 export declare const PollRequestSchema: z.ZodMiniObject<{
     polling_code: z.ZodMiniString<string>;
@@ -88,28 +140,41 @@ export declare const PollResponseSchema: z.ZodMiniObject<{
 export declare type TokenInfo = z.infer<typeof TokenInfoSchema>;
 
 /**
- * Token info schema
+ * Token info schema (parsed from JWT)
+ * Standard OIDC claims
  */
 export declare const TokenInfoSchema: z.ZodMiniObject<{
-    app_callback_session_address: z.ZodMiniString<string>;
-    expired_at: z.ZodMiniNumber<number>;
-    issued_at: z.ZodMiniNumber<number>;
+    iss: z.ZodMiniString<string>;
+    sub: z.ZodMiniString<string>;
+    aud: z.ZodMiniUnion<readonly [z.ZodMiniString<string>, z.ZodMiniArray<z.ZodMiniString<string>>]>;
+    exp: z.ZodMiniNumber<number>;
+    iat: z.ZodMiniNumber<number>;
+    nonce: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    auth_time: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
 }, z.core.$strip>;
 
-export declare type VerifyTokenRequest = z.infer<typeof VerifyTokenRequestSchema>;
+export declare type TokenResponse = z.infer<typeof TokenResponseSchema>;
 
 /**
- * VerifyToken request/response schema
+ * Token exchange response schema (OAuth2 standard)
+ * POST /oauth/token
  */
-export declare const VerifyTokenRequestSchema: z.ZodMiniObject<{
+export declare const TokenResponseSchema: z.ZodMiniObject<{
     access_token: z.ZodMiniString<string>;
+    token_type: z.ZodMiniString<string>;
+    expires_in: z.ZodMiniNumber<number>;
+    id_token: z.ZodMiniString<string>;
+    refresh_token: z.ZodMiniString<string>;
 }, z.core.$strip>;
 
-export declare type VerifyTokenResponse = z.infer<typeof VerifyTokenResponseSchema>;
+export declare type UserInfoResponse = z.infer<typeof UserInfoResponseSchema>;
 
-export declare const VerifyTokenResponseSchema: z.ZodMiniObject<{
-    is_valid: z.ZodMiniBoolean<boolean>;
-    access_token: z.ZodMiniOptional<z.ZodMiniString<string>>;
+/**
+ * UserInfo response schema
+ * GET /oauth/userinfo
+ */
+export declare const UserInfoResponseSchema: z.ZodMiniObject<{
+    sub: z.ZodMiniString<string>;
 }, z.core.$strip>;
 
 export { }

package/dist/index.esm.js

@@ -1,225 +1,342 @@
-var d = (a, o, s) => new Promise((n, r) => {
-  var t = (i) => {
+var d = (h, e, o) => new Promise((r, s) => {
+  var a = (l) => {
     try {
-      h(s.next(i));
-    } catch (p) {
-      r(p);
+      c(o.next(l));
+    } catch (f) {
+      s(f);
     }
-  }, c = (i) => {
+  }, n = (l) => {
     try {
-      h(s.throw(i));
-    } catch (p) {
-      r(p);
+      c(o.throw(l));
+    } catch (f) {
+      s(f);
     }
-  }, h = (i) => i.done ? n(i.value) : Promise.resolve(i.value).then(t, c);
-  h((s = s.apply(a, o)).next());
+  }, c = (l) => l.done ? r(l.value) : Promise.resolve(l.value).then(a, n);
+  c((o = o.apply(h, e)).next());
 });
-import { z as e } from "zod/v4-mini";
-import { sha256 as f } from "js-sha256";
-const _ = e.object({
-  code_challenge: e.string(),
-  code_challenge_method: e.literal("S256")
-}), S = e.object({
-  deep_link: e.string(),
-  polling_code: e.string(),
-  expired_at: e.number()
-}), m = e.object({
-  polling_code: e.string()
-}), y = ["pending", "authorized", "rejected", "expired"], k = e.enum(y), b = e.object({
-  status: k,
-  authorization_code: e.optional(e.string())
-}), R = e.object({
-  authorization_code: e.string(),
-  code_verifier: e.string()
-}), A = e.object({
-  access_token: e.string()
-}), j = e.object({
-  access_token: e.string()
-}), v = e.object({
-  is_valid: e.boolean(),
-  access_token: e.optional(e.string())
-}), w = e.object({
-  app_callback_session_address: e.string(),
-  expired_at: e.number(),
-  issued_at: e.number()
-});
-function E(a) {
-  return btoa(a).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+import { z as t } from "zod/v4-mini";
+import { sha256 as S } from "js-sha256";
+const w = t.object({
+  deep_link: t.string(),
+  polling_code: t.string(),
+  expired_at: t.number()
+}), y = t.object({
+  polling_code: t.string()
+}), T = ["pending", "authorized", "rejected", "expired"], A = t.enum(T), b = t.object({
+  status: A,
+  authorization_code: t.optional(t.string())
+}), m = t.object({
+  access_token: t.string(),
+  token_type: t.string(),
+  expires_in: t.number(),
+  id_token: t.string(),
+  refresh_token: t.string()
+}), I = t.object({
+  sub: t.string()
+}), R = t.object({
+  iss: t.string(),
+  sub: t.string(),
+  aud: t.union([t.string(), t.array(t.string())]),
+  exp: t.number(),
+  iat: t.number(),
+  nonce: t.optional(t.string()),
+  auth_time: t.optional(t.number())
+}), P = m;
+function _(h) {
+  return btoa(h).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
-function u(a) {
-  let o = a.replace(/-/g, "+").replace(/_/g, "/");
-  for (; o.length % 4; )
-    o += "=";
-  return atob(o);
+function k(h) {
+  let e = h.replace(/-/g, "+").replace(/_/g, "/");
+  for (; e.length % 4; )
+    e += "=";
+  return atob(e);
 }
-const T = "https://sso.alien.com", C = 5e3, l = "alien-sso_", g = (a, o) => new URL(o, a).toString(), O = e.object({
-  ssoBaseUrl: e.url(),
-  providerAddress: e.string(),
-  pollingInterval: e.optional(e.number())
+const x = "https://sso.alien.com", j = 5e3, i = "alien-sso_", u = i + "refresh_token", g = i + "token_expiry", p = (h, e) => new URL(e, h).toString(), E = t.object({
+  ssoBaseUrl: t.url(),
+  providerAddress: t.string(),
+  pollingInterval: t.optional(t.number())
 });
-class x {
-  constructor(o) {
-    this.config = O.parse(o), this.ssoBaseUrl = this.config.ssoBaseUrl || T, this.providerAddress = this.config.providerAddress, this.pollingInterval = this.config.pollingInterval || C;
+class O {
+  constructor(e) {
+    this.config = E.parse(e), this.ssoBaseUrl = this.config.ssoBaseUrl || x, this.providerAddress = this.config.providerAddress, this.pollingInterval = this.config.pollingInterval || j;
   }
-  generateCodeVerifier(o = 128) {
-    let s;
-    const n = typeof window != "undefined" && window.crypto;
-    if (n && n.getRandomValues)
-      s = new Uint8Array(o), n.getRandomValues(s);
+  generateCodeVerifier(e = 128) {
+    let o;
+    const r = typeof window != "undefined" && window.crypto;
+    if (r && r.getRandomValues)
+      o = new Uint8Array(e), r.getRandomValues(o);
     else {
-      s = new Uint8Array(o);
-      for (let t = 0; t < o; t++)
-        s[t] = Math.floor(Math.random() * 256);
+      o = new Uint8Array(e);
+      for (let a = 0; a < e; a++)
+        o[a] = Math.floor(Math.random() * 256);
     }
-    let r = "";
-    for (let t = 0; t < s.length; t++)
-      r += String.fromCharCode(s[t]);
-    return E(r);
+    let s = "";
+    for (let a = 0; a < o.length; a++)
+      s += String.fromCharCode(o[a]);
+    return _(s);
   }
-  generateCodeChallenge(o) {
-    return f(o);
+  generateCodeChallenge(e) {
+    const o = S.array(e), r = String.fromCharCode(...o);
+    return _(r);
   }
+  /**
+   * Initiates OAuth2 authorization flow with response_mode=json for SPA
+   * GET /oauth/authorize?response_type=code&response_mode=json&...
+   */
   generateDeeplink() {
     return d(this, null, function* () {
-      const o = this.generateCodeVerifier(), s = this.generateCodeChallenge(o);
-      sessionStorage.setItem(l + "code_verifier", o);
-      const n = `${this.config.ssoBaseUrl}/sso/authorize`, r = {
-        code_challenge: s,
+      const e = this.generateCodeVerifier(), o = this.generateCodeChallenge(e);
+      sessionStorage.setItem(i + "code_verifier", e);
+      const r = new URLSearchParams({
+        response_type: "code",
+        response_mode: "json",
+        client_id: this.providerAddress,
+        scope: "openid",
+        code_challenge: o,
         code_challenge_method: "S256"
-      };
-      _.parse(r);
-      const c = yield (yield fetch(n, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "X-PROVIDER-ADDRESS": this.providerAddress
-        },
-        body: JSON.stringify(r)
-      })).json();
-      return S.parse(c);
+      }), s = `${this.config.ssoBaseUrl}/oauth/authorize?${r.toString()}`, a = yield fetch(s, {
+        method: "GET"
+      });
+      if (!a.ok) {
+        const c = yield a.json().catch(() => ({ error: a.statusText }));
+        throw new Error(`Authorize failed: ${c.error_description || c.error || a.statusText}`);
+      }
+      const n = yield a.json();
+      return w.parse(n);
     });
   }
-  pollAuth(o) {
+  /**
+   * Polls for authorization completion
+   * POST /oauth/poll
+   */
+  pollAuth(e) {
     return d(this, null, function* () {
-      const s = {
-        polling_code: o
+      const o = {
+        polling_code: e
       };
-      m.parse(s);
-      const n = yield fetch(g(this.config.ssoBaseUrl, "/sso/poll"), {
+      y.parse(o);
+      const r = yield fetch(p(this.config.ssoBaseUrl, "/oauth/poll"), {
         method: "POST",
         headers: {
-          "Content-Type": "application/json",
-          "X-PROVIDER-ADDRESS": this.providerAddress
+          "Content-Type": "application/json"
         },
-        body: JSON.stringify(s)
+        body: JSON.stringify(o)
       });
-      if (!n.ok)
-        throw new Error(`Poll failed: ${n.statusText}`);
-      const r = yield n.json();
-      return b.parse(r);
+      if (!r.ok)
+        throw new Error(`Poll failed: ${r.statusText}`);
+      const s = yield r.json();
+      return b.parse(s);
     });
   }
-  exchangeToken(o) {
+  /**
+   * Exchanges authorization code for tokens
+   * POST /oauth/token (application/x-www-form-urlencoded)
+   * Returns both access_token and id_token
+   */
+  exchangeToken(e) {
     return d(this, null, function* () {
-      const s = sessionStorage.getItem(l + "code_verifier");
-      if (!s) throw new Error("Missing code verifier.");
-      const n = {
-        authorization_code: o,
-        code_verifier: s
-      };
-      R.parse(n);
-      const r = yield fetch(
-        g(this.config.ssoBaseUrl, "/sso/access_token/exchange"),
+      const o = sessionStorage.getItem(i + "code_verifier");
+      if (!o) throw new Error("Missing code verifier.");
+      const r = new URLSearchParams({
+        grant_type: "authorization_code",
+        code: e,
+        client_id: this.providerAddress,
+        code_verifier: o
+      }), s = yield fetch(
+        p(this.config.ssoBaseUrl, "/oauth/token"),
         {
           method: "POST",
           headers: {
-            "Content-Type": "application/json",
-            "X-PROVIDER-ADDRESS": this.providerAddress
+            "Content-Type": "application/x-www-form-urlencoded"
           },
-          body: JSON.stringify(n)
+          body: r.toString()
         }
       );
-      if (!r.ok)
-        throw new Error(`ExchangeCode failed: ${r.statusText}`);
-      const t = yield r.json(), c = A.parse(t);
-      if (c.access_token)
-        return localStorage.setItem(
-          l + "access_token",
-          c.access_token
-        ), c.access_token;
-      throw new Error("Exchange failed");
+      if (!s.ok) {
+        const l = yield s.json().catch(() => ({ error: s.statusText }));
+        throw new Error(`Token exchange failed: ${l.error_description || l.error || s.statusText}`);
+      }
+      const a = yield s.json(), n = m.parse(a);
+      localStorage.setItem(i + "access_token", n.access_token), localStorage.setItem(i + "id_token", n.id_token), localStorage.setItem(u, n.refresh_token);
+      const c = Date.now() + n.expires_in * 1e3;
+      return localStorage.setItem(g, c.toString()), sessionStorage.removeItem(i + "code_verifier"), n;
     });
   }
+  /**
+   * Verifies authentication by calling userinfo endpoint
+   * GET /oauth/userinfo
+   * Automatically refreshes token on 401 if refresh token is available
+   */
   verifyAuth() {
     return d(this, null, function* () {
-      const o = this.getAccessToken();
-      if (!o)
-        return !1;
-      const s = {
-        access_token: o
-      };
-      j.parse(s);
-      const n = yield fetch(
-        g(this.config.ssoBaseUrl, "/sso/access_token/verify"),
-        {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            "X-PROVIDER-ADDRESS": this.providerAddress
-          },
-          body: JSON.stringify(s)
+      return this.withAutoRefresh(() => d(this, null, function* () {
+        const e = this.getAccessToken();
+        if (!e)
+          return null;
+        const o = yield fetch(
+          p(this.config.ssoBaseUrl, "/oauth/userinfo"),
+          {
+            method: "GET",
+            headers: {
+              Authorization: `Bearer ${e}`
+            }
+          }
+        );
+        if (!o.ok) {
+          if (o.status === 401) {
+            const s = new Error("Unauthorized");
+            throw s.response = { status: 401 }, s;
+          }
+          return null;
         }
-      );
-      if (!n.ok)
-        return !1;
-      const r = yield n.json(), t = v.parse(r);
-      return t.access_token && localStorage.setItem(
-        l + "access_token",
-        t.access_token
-      ), t.is_valid;
+        const r = yield o.json();
+        return I.parse(r);
+      }));
     });
   }
+  /**
+   * Gets stored access token
+   */
   getAccessToken() {
-    return localStorage.getItem(l + "access_token");
+    return localStorage.getItem(i + "access_token");
+  }
+  /**
+   * Gets stored ID token
+   */
+  getIdToken() {
+    return localStorage.getItem(i + "id_token");
   }
+  /**
+   * Decodes and validates JWT token to extract claims
+   * Works with both access_token and id_token (EdDSA signed)
+   */
   getAuthData() {
-    const o = this.getAccessToken();
-    if (!o) return null;
-    const s = o.split(".");
-    if (s.length !== 3)
+    const e = this.getIdToken() || this.getAccessToken();
+    if (!e) return null;
+    const o = e.split(".");
+    if (o.length !== 3)
       return null;
-    let n;
+    let r;
     try {
-      const t = u(s[0]);
-      n = JSON.parse(t);
-    } catch (t) {
+      const n = k(o[0]);
+      r = JSON.parse(n);
+    } catch (n) {
       return null;
     }
-    if (n.alg !== "HS256" || n.typ !== "JWT")
+    if (r.alg !== "RS256" || r.typ !== "JWT")
       return null;
-    let r;
+    let s;
     try {
-      const t = JSON.parse(u(s[1]));
-      r = w.parse(t);
-    } catch (t) {
+      const n = JSON.parse(k(o[1]));
+      s = R.parse(n);
+    } catch (n) {
       return null;
     }
-    return r;
+    return (Array.isArray(s.aud) ? s.aud : [s.aud]).includes(this.providerAddress) ? s : null;
+  }
+  /**
+   * Gets the subject (user identifier) from the token
+   */
+  getSubject() {
+    const e = this.getAuthData();
+    return (e == null ? void 0 : e.sub) || null;
+  }
+  /**
+   * Checks if the current token is expired
+   */
+  isTokenExpired() {
+    const e = this.getAuthData();
+    return e ? Date.now() / 1e3 > e.exp : !0;
   }
+  /**
+   * Clears all stored authentication data
+   */
   logout() {
-    localStorage.removeItem(l + "access_token"), sessionStorage.removeItem(l + "code_verifier");
+    localStorage.removeItem(i + "access_token"), localStorage.removeItem(i + "id_token"), localStorage.removeItem(u), localStorage.removeItem(g), sessionStorage.removeItem(i + "code_verifier");
+  }
+  /**
+   * Gets stored refresh token
+   */
+  getRefreshToken() {
+    return localStorage.getItem(u);
+  }
+  /**
+   * Checks if a refresh token is available
+   */
+  hasRefreshToken() {
+    return !!this.getRefreshToken();
+  }
+  /**
+   * Checks if the access token is expired or will expire soon (within 5 minutes)
+   */
+  isAccessTokenExpired() {
+    const e = localStorage.getItem(g);
+    if (!e) return !0;
+    const o = parseInt(e, 10), r = Date.now(), s = 300 * 1e3;
+    return r >= o - s;
+  }
+  /**
+   * Refreshes the access token using the stored refresh token
+   * POST /oauth/token with grant_type=refresh_token
+   */
+  refreshAccessToken() {
+    return d(this, null, function* () {
+      const e = this.getRefreshToken();
+      if (!e)
+        throw new Error("No refresh token available");
+      const o = new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: e,
+        client_id: this.providerAddress
+      }), r = yield fetch(
+        p(this.config.ssoBaseUrl, "/oauth/token"),
+        {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/x-www-form-urlencoded"
+          },
+          body: o.toString()
+        }
+      );
+      if (!r.ok) {
+        const c = yield r.json().catch(() => ({ error: r.statusText }));
+        throw this.logout(), new Error(`Token refresh failed: ${c.error_description || c.error || r.statusText}`);
+      }
+      const s = yield r.json(), a = m.parse(s);
+      localStorage.setItem(i + "access_token", a.access_token), localStorage.setItem(i + "id_token", a.id_token), localStorage.setItem(u, a.refresh_token);
+      const n = Date.now() + a.expires_in * 1e3;
+      return localStorage.setItem(g, n.toString()), a;
+    });
+  }
+  /**
+   * Executes a function that makes an authenticated request
+   * Automatically refreshes token and retries on 401 error
+   */
+  withAutoRefresh(e, o = 1) {
+    return d(this, null, function* () {
+      var r, s, a;
+      try {
+        return yield e();
+      } catch (n) {
+        if ((((r = n == null ? void 0 : n.response) == null ? void 0 : r.status) === 401 || ((s = n == null ? void 0 : n.message) == null ? void 0 : s.includes("401")) || ((a = n == null ? void 0 : n.message) == null ? void 0 : a.includes("Unauthorized"))) && o > 0 && this.hasRefreshToken())
+          try {
+            return yield this.refreshAccessToken(), yield e();
+          } catch (l) {
+            throw n;
+          }
+        throw n;
+      }
+    });
   }
 }
 export {
-  x as AlienSsoClient,
-  O as AlienSsoClientSchema,
-  _ as AuthorizeRequestSchema,
-  S as AuthorizeResponseSchema,
-  R as ExchangeCodeRequestSchema,
-  A as ExchangeCodeResponseSchema,
-  m as PollRequestSchema,
+  O as AlienSsoClient,
+  E as AlienSsoClientSchema,
+  w as AuthorizeResponseSchema,
+  P as ExchangeCodeResponseSchema,
+  y as PollRequestSchema,
   b as PollResponseSchema,
-  w as TokenInfoSchema,
-  j as VerifyTokenRequestSchema,
-  v as VerifyTokenResponseSchema
+  R as TokenInfoSchema,
+  m as TokenResponseSchema,
+  I as UserInfoResponseSchema
 };

package/dist/index.umd.js

@@ -1 +1 @@
-(function(t,e){typeof exports=="object"&&typeof module!="undefined"?e(exports,require("zod/v4-mini"),require("js-sha256")):typeof define=="function"&&define.amd?define(["exports","zod/v4-mini","js-sha256"],e):(t=typeof globalThis!="undefined"?globalThis:t||self,e(t.AlienSsoCore={},t.Zod,t.jsSha256))})(this,(function(t,e,i){"use strict";var f=(t,e,i)=>new Promise((S,g)=>{var m=c=>{try{u(i.next(c))}catch(d){g(d)}},_=c=>{try{u(i.throw(c))}catch(d){g(d)}},u=c=>c.done?S(c.value):Promise.resolve(c.value).then(m,_);u((i=i.apply(t,e)).next())});const S=e.z.object({code_challenge:e.z.string(),code_challenge_method:e.z.literal("S256")}),g=e.z.object({deep_link:e.z.string(),polling_code:e.z.string(),expired_at:e.z.number()}),m=e.z.object({polling_code:e.z.string()}),_=["pending","authorized","rejected","expired"],u=e.z.enum(_),c=e.z.object({status:u,authorization_code:e.z.optional(e.z.string())}),d=e.z.object({authorization_code:e.z.string(),code_verifier:e.z.string()}),y=e.z.object({access_token:e.z.string()}),R=e.z.object({access_token:e.z.string()}),k=e.z.object({is_valid:e.z.boolean(),access_token:e.z.optional(e.z.string())}),A=e.z.object({app_callback_session_address:e.z.string(),expired_at:e.z.number(),issued_at:e.z.number()});function T(h){return btoa(h).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function j(h){let o=h.replace(/-/g,"+").replace(/_/g,"/");for(;o.length%4;)o+="=";return atob(o)}const C="https://sso.alien.com",w=5e3,l="alien-sso_",z=(h,o)=>new URL(o,h).toString(),b=e.z.object({ssoBaseUrl:e.z.url(),providerAddress:e.z.string(),pollingInterval:e.z.optional(e.z.number())});class E{constructor(o){this.config=b.parse(o),this.ssoBaseUrl=this.config.ssoBaseUrl||C,this.providerAddress=this.config.providerAddress,this.pollingInterval=this.config.pollingInterval||w}generateCodeVerifier(o=128){let s;const r=typeof window!="undefined"&&window.crypto;if(r&&r.getRandomValues)s=new Uint8Array(o),r.getRandomValues(s);else{s=new Uint8Array(o);for(let n=0;n<o;n++)s[n]=Math.floor(Math.random()*256)}let a="";for(let n=0;n<s.length;n++)a+=String.fromCharCode(s[n]);return T(a)}generateCodeChallenge(o){return i.sha256(o)}generateDeeplink(){return f(this,null,function*(){const o=this.generateCodeVerifier(),s=this.generateCodeChallenge(o);sessionStorage.setItem(l+"code_verifier",o);const r=`${this.config.ssoBaseUrl}/sso/authorize`,a={code_challenge:s,code_challenge_method:"S256"};S.parse(a);const p=yield(yield fetch(r,{method:"POST",headers:{"Content-Type":"application/json","X-PROVIDER-ADDRESS":this.providerAddress},body:JSON.stringify(a)})).json();return g.parse(p)})}pollAuth(o){return f(this,null,function*(){const s={polling_code:o};m.parse(s);const r=yield fetch(z(this.config.ssoBaseUrl,"/sso/poll"),{method:"POST",headers:{"Content-Type":"application/json","X-PROVIDER-ADDRESS":this.providerAddress},body:JSON.stringify(s)});if(!r.ok)throw new Error(`Poll failed: ${r.statusText}`);const a=yield r.json();return c.parse(a)})}exchangeToken(o){return f(this,null,function*(){const s=sessionStorage.getItem(l+"code_verifier");if(!s)throw new Error("Missing code verifier.");const r={authorization_code:o,code_verifier:s};d.parse(r);const a=yield fetch(z(this.config.ssoBaseUrl,"/sso/access_token/exchange"),{method:"POST",headers:{"Content-Type":"application/json","X-PROVIDER-ADDRESS":this.providerAddress},body:JSON.stringify(r)});if(!a.ok)throw new Error(`ExchangeCode failed: ${a.statusText}`);const n=yield a.json(),p=y.parse(n);if(p.access_token)return localStorage.setItem(l+"access_token",p.access_token),p.access_token;throw new Error("Exchange failed")})}verifyAuth(){return f(this,null,function*(){const o=this.getAccessToken();if(!o)return!1;const s={access_token:o};R.parse(s);const r=yield fetch(z(this.config.ssoBaseUrl,"/sso/access_token/verify"),{method:"POST",headers:{"Content-Type":"application/json","X-PROVIDER-ADDRESS":this.providerAddress},body:JSON.stringify(s)});if(!r.ok)return!1;const a=yield r.json(),n=k.parse(a);return n.access_token&&localStorage.setItem(l+"access_token",n.access_token),n.is_valid})}getAccessToken(){return localStorage.getItem(l+"access_token")}getAuthData(){const o=this.getAccessToken();if(!o)return null;const s=o.split(".");if(s.length!==3)return null;let r;try{const n=j(s[0]);r=JSON.parse(n)}catch(n){return null}if(r.alg!=="HS256"||r.typ!=="JWT")return null;let a;try{const n=JSON.parse(j(s[1]));a=A.parse(n)}catch(n){return null}return a}logout(){localStorage.removeItem(l+"access_token"),sessionStorage.removeItem(l+"code_verifier")}}t.AlienSsoClient=E,t.AlienSsoClientSchema=b,t.AuthorizeRequestSchema=S,t.AuthorizeResponseSchema=g,t.ExchangeCodeRequestSchema=d,t.ExchangeCodeResponseSchema=y,t.PollRequestSchema=m,t.PollResponseSchema=c,t.TokenInfoSchema=A,t.VerifyTokenRequestSchema=R,t.VerifyTokenResponseSchema=k,Object.defineProperty(t,Symbol.toStringTag,{value:"Module"})}));
+(function(c,t){typeof exports=="object"&&typeof module!="undefined"?t(exports,require("zod/v4-mini"),require("js-sha256")):typeof define=="function"&&define.amd?define(["exports","zod/v4-mini","js-sha256"],t):(c=typeof globalThis!="undefined"?globalThis:c||self,t(c.AlienSsoCore={},c.Zod,c.jsSha256))})(this,(function(c,t,u){"use strict";var d=(c,t,u)=>new Promise((S,m)=>{var y=l=>{try{g(u.next(l))}catch(p){m(p)}},z=l=>{try{g(u.throw(l))}catch(p){m(p)}},g=l=>l.done?S(l.value):Promise.resolve(l.value).then(y,z);g((u=u.apply(c,t)).next())});const S=t.z.object({deep_link:t.z.string(),polling_code:t.z.string(),expired_at:t.z.number()}),m=t.z.object({polling_code:t.z.string()}),y=["pending","authorized","rejected","expired"],z=t.z.enum(y),g=t.z.object({status:z,authorization_code:t.z.optional(t.z.string())}),l=t.z.object({access_token:t.z.string(),token_type:t.z.string(),expires_in:t.z.number(),id_token:t.z.string(),refresh_token:t.z.string()}),p=t.z.object({sub:t.z.string()}),A=t.z.object({iss:t.z.string(),sub:t.z.string(),aud:t.z.union([t.z.string(),t.z.array(t.z.string())]),exp:t.z.number(),iat:t.z.number(),nonce:t.z.optional(t.z.string()),auth_time:t.z.optional(t.z.number())}),j=l;function R(f){return btoa(f).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function b(f){let e=f.replace(/-/g,"+").replace(/_/g,"/");for(;e.length%4;)e+="=";return atob(e)}const E="https://sso.alien.com",x=5e3,i="alien-sso_",_=i+"refresh_token",k=i+"token_expiry",w=(f,e)=>new URL(e,f).toString(),I=t.z.object({ssoBaseUrl:t.z.url(),providerAddress:t.z.string(),pollingInterval:t.z.optional(t.z.number())});class C{constructor(e){this.config=I.parse(e),this.ssoBaseUrl=this.config.ssoBaseUrl||E,this.providerAddress=this.config.providerAddress,this.pollingInterval=this.config.pollingInterval||x}generateCodeVerifier(e=128){let o;const s=typeof window!="undefined"&&window.crypto;if(s&&s.getRandomValues)o=new Uint8Array(e),s.getRandomValues(o);else{o=new Uint8Array(e);for(let a=0;a<e;a++)o[a]=Math.floor(Math.random()*256)}let r="";for(let a=0;a<o.length;a++)r+=String.fromCharCode(o[a]);return R(r)}generateCodeChallenge(e){const o=u.sha256.array(e),s=String.fromCharCode(...o);return R(s)}generateDeeplink(){return d(this,null,function*(){const e=this.generateCodeVerifier(),o=this.generateCodeChallenge(e);sessionStorage.setItem(i+"code_verifier",e);const s=new URLSearchParams({response_type:"code",response_mode:"json",client_id:this.providerAddress,scope:"openid",code_challenge:o,code_challenge_method:"S256"}),r=`${this.config.ssoBaseUrl}/oauth/authorize?${s.toString()}`,a=yield fetch(r,{method:"GET"});if(!a.ok){const h=yield a.json().catch(()=>({error:a.statusText}));throw new Error(`Authorize failed: ${h.error_description||h.error||a.statusText}`)}const n=yield a.json();return S.parse(n)})}pollAuth(e){return d(this,null,function*(){const o={polling_code:e};m.parse(o);const s=yield fetch(w(this.config.ssoBaseUrl,"/oauth/poll"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(o)});if(!s.ok)throw new Error(`Poll failed: ${s.statusText}`);const r=yield s.json();return g.parse(r)})}exchangeToken(e){return d(this,null,function*(){const o=sessionStorage.getItem(i+"code_verifier");if(!o)throw new Error("Missing code verifier.");const s=new URLSearchParams({grant_type:"authorization_code",code:e,client_id:this.providerAddress,code_verifier:o}),r=yield fetch(w(this.config.ssoBaseUrl,"/oauth/token"),{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:s.toString()});if(!r.ok){const T=yield r.json().catch(()=>({error:r.statusText}));throw new Error(`Token exchange failed: ${T.error_description||T.error||r.statusText}`)}const a=yield r.json(),n=l.parse(a);localStorage.setItem(i+"access_token",n.access_token),localStorage.setItem(i+"id_token",n.id_token),localStorage.setItem(_,n.refresh_token);const h=Date.now()+n.expires_in*1e3;return localStorage.setItem(k,h.toString()),sessionStorage.removeItem(i+"code_verifier"),n})}verifyAuth(){return d(this,null,function*(){return this.withAutoRefresh(()=>d(this,null,function*(){const e=this.getAccessToken();if(!e)return null;const o=yield fetch(w(this.config.ssoBaseUrl,"/oauth/userinfo"),{method:"GET",headers:{Authorization:`Bearer ${e}`}});if(!o.ok){if(o.status===401){const r=new Error("Unauthorized");throw r.response={status:401},r}return null}const s=yield o.json();return p.parse(s)}))})}getAccessToken(){return localStorage.getItem(i+"access_token")}getIdToken(){return localStorage.getItem(i+"id_token")}getAuthData(){const e=this.getIdToken()||this.getAccessToken();if(!e)return null;const o=e.split(".");if(o.length!==3)return null;let s;try{const n=b(o[0]);s=JSON.parse(n)}catch(n){return null}if(s.alg!=="RS256"||s.typ!=="JWT")return null;let r;try{const n=JSON.parse(b(o[1]));r=A.parse(n)}catch(n){return null}return(Array.isArray(r.aud)?r.aud:[r.aud]).includes(this.providerAddress)?r:null}getSubject(){const e=this.getAuthData();return(e==null?void 0:e.sub)||null}isTokenExpired(){const e=this.getAuthData();return e?Date.now()/1e3>e.exp:!0}logout(){localStorage.removeItem(i+"access_token"),localStorage.removeItem(i+"id_token"),localStorage.removeItem(_),localStorage.removeItem(k),sessionStorage.removeItem(i+"code_verifier")}getRefreshToken(){return localStorage.getItem(_)}hasRefreshToken(){return!!this.getRefreshToken()}isAccessTokenExpired(){const e=localStorage.getItem(k);if(!e)return!0;const o=parseInt(e,10),s=Date.now(),r=300*1e3;return s>=o-r}refreshAccessToken(){return d(this,null,function*(){const e=this.getRefreshToken();if(!e)throw new Error("No refresh token available");const o=new URLSearchParams({grant_type:"refresh_token",refresh_token:e,client_id:this.providerAddress}),s=yield fetch(w(this.config.ssoBaseUrl,"/oauth/token"),{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:o.toString()});if(!s.ok){const h=yield s.json().catch(()=>({error:s.statusText}));throw this.logout(),new Error(`Token refresh failed: ${h.error_description||h.error||s.statusText}`)}const r=yield s.json(),a=l.parse(r);localStorage.setItem(i+"access_token",a.access_token),localStorage.setItem(i+"id_token",a.id_token),localStorage.setItem(_,a.refresh_token);const n=Date.now()+a.expires_in*1e3;return localStorage.setItem(k,n.toString()),a})}withAutoRefresh(e,o=1){return d(this,null,function*(){var s,r,a;try{return yield e()}catch(n){if((((s=n==null?void 0:n.response)==null?void 0:s.status)===401||((r=n==null?void 0:n.message)==null?void 0:r.includes("401"))||((a=n==null?void 0:n.message)==null?void 0:a.includes("Unauthorized")))&&o>0&&this.hasRefreshToken())try{return yield this.refreshAccessToken(),yield e()}catch(T){throw n}throw n}})}}c.AlienSsoClient=C,c.AlienSsoClientSchema=I,c.AuthorizeResponseSchema=S,c.ExchangeCodeResponseSchema=j,c.PollRequestSchema=m,c.PollResponseSchema=g,c.TokenInfoSchema=A,c.TokenResponseSchema=l,c.UserInfoResponseSchema=p,Object.defineProperty(c,Symbol.toStringTag,{value:"Module"})}));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alien_org/sso-sdk-core",
-  "version": "1.0.17",
+  "version": "1.0.19",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/alien-id/sso-sdk-js.git"