@alien_org/sso-sdk-core 1.0.18 → 1.0.20

package/dist/index.cjs

@@ -1 +1 @@
-"use strict";var d=(a,o,s)=>new Promise((n,r)=>{var t=i=>{try{h(s.next(i))}catch(g){r(g)}},c=i=>{try{h(s.throw(i))}catch(g){r(g)}},h=i=>i.done?n(i.value):Promise.resolve(i.value).then(t,c);h((s=s.apply(a,o)).next())});Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const e=require("zod/v4-mini"),j=require("js-sha256"),S=e.z.object({code_challenge:e.z.string(),code_challenge_method:e.z.literal("S256")}),f=e.z.object({deep_link:e.z.string(),polling_code:e.z.string(),expired_at:e.z.number()}),_=e.z.object({polling_code:e.z.string()}),v=["pending","authorized","rejected","expired"],T=e.z.enum(v),m=e.z.object({status:T,authorization_code:e.z.optional(e.z.string())}),z=e.z.object({authorization_code:e.z.string(),code_verifier:e.z.string()}),y=e.z.object({access_token:e.z.string()}),R=e.z.object({access_token:e.z.string()}),k=e.z.object({is_valid:e.z.boolean(),access_token:e.z.optional(e.z.string())}),b=e.z.object({app_callback_session_address:e.z.string(),expired_at:e.z.number(),issued_at:e.z.number()});function w(a){return btoa(a).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function u(a){let o=a.replace(/-/g,"+").replace(/_/g,"/");for(;o.length%4;)o+="=";return atob(o)}const C="https://sso.alien.com",E=5e3,l="alien-sso_",p=(a,o)=>new URL(o,a).toString(),A=e.z.object({ssoBaseUrl:e.z.url(),providerAddress:e.z.string(),pollingInterval:e.z.optional(e.z.number())});class P{constructor(o){this.config=A.parse(o),this.ssoBaseUrl=this.config.ssoBaseUrl||C,this.providerAddress=this.config.providerAddress,this.pollingInterval=this.config.pollingInterval||E}generateCodeVerifier(o=128){let s;const n=typeof window!="undefined"&&window.crypto;if(n&&n.getRandomValues)s=new Uint8Array(o),n.getRandomValues(s);else{s=new Uint8Array(o);for(let t=0;t<o;t++)s[t]=Math.floor(Math.random()*256)}let r="";for(let t=0;t<s.length;t++)r+=String.fromCharCode(s[t]);return w(r)}generateCodeChallenge(o){return j.sha256(o)}generateDeeplink(){return d(this,null,function*(){const o=this.generateCodeVerifier(),s=this.generateCodeChallenge(o);sessionStorage.setItem(l+"code_verifier",o);const n=`${this.config.ssoBaseUrl}/sso/authorize`,r={code_challenge:s,code_challenge_method:"S256"};S.parse(r);const c=yield(yield fetch(n,{method:"POST",headers:{"Content-Type":"application/json","X-PROVIDER-ADDRESS":this.providerAddress},body:JSON.stringify(r)})).json();return f.parse(c)})}pollAuth(o){return d(this,null,function*(){const s={polling_code:o};_.parse(s);const n=yield fetch(p(this.config.ssoBaseUrl,"/sso/poll"),{method:"POST",headers:{"Content-Type":"application/json","X-PROVIDER-ADDRESS":this.providerAddress},body:JSON.stringify(s)});if(!n.ok)throw new Error(`Poll failed: ${n.statusText}`);const r=yield n.json();return m.parse(r)})}exchangeToken(o){return d(this,null,function*(){const s=sessionStorage.getItem(l+"code_verifier");if(!s)throw new Error("Missing code verifier.");const n={authorization_code:o,code_verifier:s};z.parse(n);const r=yield fetch(p(this.config.ssoBaseUrl,"/sso/access_token/exchange"),{method:"POST",headers:{"Content-Type":"application/json","X-PROVIDER-ADDRESS":this.providerAddress},body:JSON.stringify(n)});if(!r.ok)throw new Error(`ExchangeCode failed: ${r.statusText}`);const t=yield r.json(),c=y.parse(t);if(c.access_token)return localStorage.setItem(l+"access_token",c.access_token),c.access_token;throw new Error("Exchange failed")})}verifyAuth(){return d(this,null,function*(){const o=this.getAccessToken();if(!o)return!1;const s={access_token:o};R.parse(s);const n=yield fetch(p(this.config.ssoBaseUrl,"/sso/access_token/verify"),{method:"POST",headers:{"Content-Type":"application/json","X-PROVIDER-ADDRESS":this.providerAddress},body:JSON.stringify(s)});if(!n.ok)return!1;const r=yield n.json(),t=k.parse(r);return t.access_token&&localStorage.setItem(l+"access_token",t.access_token),t.is_valid})}getAccessToken(){return localStorage.getItem(l+"access_token")}getAuthData(){const o=this.getAccessToken();if(!o)return null;const s=o.split(".");if(s.length!==3)return null;let n;try{const t=u(s[0]);n=JSON.parse(t)}catch(t){return null}if(n.alg!=="HS256"||n.typ!=="JWT")return null;let r;try{const t=JSON.parse(u(s[1]));r=b.parse(t)}catch(t){return null}return r}logout(){localStorage.removeItem(l+"access_token"),sessionStorage.removeItem(l+"code_verifier")}}exports.AlienSsoClient=P;exports.AlienSsoClientSchema=A;exports.AuthorizeRequestSchema=S;exports.AuthorizeResponseSchema=f;exports.ExchangeCodeRequestSchema=z;exports.ExchangeCodeResponseSchema=y;exports.PollRequestSchema=_;exports.PollResponseSchema=m;exports.TokenInfoSchema=b;exports.VerifyTokenRequestSchema=R;exports.VerifyTokenResponseSchema=k;
+"use strict";var h=(d,e,o)=>new Promise((r,s)=>{var a=l=>{try{c(o.next(l))}catch(S){s(S)}},n=l=>{try{c(o.throw(l))}catch(S){s(S)}},c=l=>l.done?r(l.value):Promise.resolve(l.value).then(a,n);c((o=o.apply(d,e)).next())});Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const t=require("zod/v4-mini"),I=require("js-sha256"),y=t.z.object({deep_link:t.z.string(),polling_code:t.z.string(),expired_at:t.z.number()}),T=t.z.object({polling_code:t.z.string()}),j=["pending","authorized","rejected","expired"],x=t.z.enum(j),z=t.z.object({status:x,authorization_code:t.z.optional(t.z.string())}),m=t.z.object({access_token:t.z.string(),token_type:t.z.string(),expires_in:t.z.number(),id_token:t.z.string(),refresh_token:t.z.string()}),R=t.z.object({sub:t.z.string()}),A=t.z.object({iss:t.z.string(),sub:t.z.string(),aud:t.z.union([t.z.string(),t.z.array(t.z.string())]),exp:t.z.number(),iat:t.z.number(),nonce:t.z.optional(t.z.string()),auth_time:t.z.optional(t.z.number())}),E=m;function w(d){return btoa(d).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function _(d){let e=d.replace(/-/g,"+").replace(/_/g,"/");for(;e.length%4;)e+="=";return atob(e)}const v="https://sso.alien.com",P=5e3,i="alien-sso_",g=i+"refresh_token",p=i+"token_expiry",f=(d,e)=>new URL(e,d).toString(),b=t.z.object({ssoBaseUrl:t.z.url(),providerAddress:t.z.string(),pollingInterval:t.z.optional(t.z.number())}),u=class u{constructor(e){this.config=b.parse(e),this.ssoBaseUrl=this.config.ssoBaseUrl||v,this.providerAddress=this.config.providerAddress,this.pollingInterval=this.config.pollingInterval||P}generateCodeVerifier(e=128){let o;const r=typeof window!="undefined"&&window.crypto;if(r&&r.getRandomValues)o=new Uint8Array(e),r.getRandomValues(o);else{o=new Uint8Array(e);for(let a=0;a<e;a++)o[a]=Math.floor(Math.random()*256)}let s="";for(let a=0;a<o.length;a++)s+=String.fromCharCode(o[a]);return w(s)}generateCodeChallenge(e){const o=I.sha256.array(e),r=String.fromCharCode(...o);return w(r)}generateDeeplink(){return h(this,null,function*(){const e=this.generateCodeVerifier(),o=this.generateCodeChallenge(e);sessionStorage.setItem(i+"code_verifier",e);const r=new URLSearchParams({response_type:"code",response_mode:"json",client_id:this.providerAddress,scope:"openid",code_challenge:o,code_challenge_method:"S256"}),s=`${this.config.ssoBaseUrl}/oauth/authorize?${r.toString()}`,a=yield fetch(s,{method:"GET"});if(!a.ok){const c=yield a.json().catch(()=>({error:a.statusText}));throw new Error(`Authorize failed: ${c.error_description||c.error||a.statusText}`)}const n=yield a.json();return y.parse(n)})}pollAuth(e){return h(this,null,function*(){const o={polling_code:e};T.parse(o);const r=yield fetch(f(this.config.ssoBaseUrl,"/oauth/poll"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(o)});if(!r.ok)throw new Error(`Poll failed: ${r.statusText}`);const s=yield r.json();return z.parse(s)})}exchangeToken(e){return h(this,null,function*(){const o=sessionStorage.getItem(i+"code_verifier");if(!o)throw new Error("Missing code verifier.");const r=new URLSearchParams({grant_type:"authorization_code",code:e,client_id:this.providerAddress,code_verifier:o}),s=yield fetch(f(this.config.ssoBaseUrl,"/oauth/token"),{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:r.toString()});if(!s.ok){const l=yield s.json().catch(()=>({error:s.statusText}));throw new Error(`Token exchange failed: ${l.error_description||l.error||s.statusText}`)}const a=yield s.json(),n=m.parse(a);localStorage.setItem(i+"access_token",n.access_token),localStorage.setItem(i+"id_token",n.id_token),localStorage.setItem(g,n.refresh_token);const c=Date.now()+n.expires_in*1e3;return localStorage.setItem(p,c.toString()),sessionStorage.removeItem(i+"code_verifier"),n})}verifyAuth(){return h(this,null,function*(){return this.withAutoRefresh(()=>h(this,null,function*(){const e=this.getAccessToken();if(!e)return null;const o=yield fetch(f(this.config.ssoBaseUrl,"/oauth/userinfo"),{method:"GET",headers:{Authorization:`Bearer ${e}`}});if(!o.ok){if(o.status===401){const s=new Error("Unauthorized");throw s.response={status:401},s}return null}const r=yield o.json();return R.parse(r)}))})}getAccessToken(){return localStorage.getItem(i+"access_token")}getIdToken(){return localStorage.getItem(i+"id_token")}getAuthData(){const e=this.getIdToken()||this.getAccessToken();if(!e)return null;const o=e.split(".");if(o.length!==3)return null;let r;try{const n=_(o[0]);r=JSON.parse(n)}catch(n){return null}if(r.alg!=="RS256"||r.typ!=="JWT")return null;let s;try{const n=JSON.parse(_(o[1]));s=A.parse(n)}catch(n){return null}return(Array.isArray(s.aud)?s.aud:[s.aud]).includes(this.providerAddress)?s:null}getSubject(){const e=this.getAuthData();return(e==null?void 0:e.sub)||null}isTokenExpired(){const e=this.getAuthData();return e?Date.now()/1e3>e.exp:!0}logout(){localStorage.removeItem(i+"access_token"),localStorage.removeItem(i+"id_token"),localStorage.removeItem(g),localStorage.removeItem(p),sessionStorage.removeItem(i+"code_verifier")}getRefreshToken(){return localStorage.getItem(g)}hasRefreshToken(){return!!this.getRefreshToken()}isAccessTokenExpired(){const e=localStorage.getItem(p);if(!e)return!0;const o=parseInt(e,10),r=Date.now(),s=300*1e3;return r>=o-s}refreshAccessToken(){return h(this,null,function*(){return u.refreshPromise||(u.refreshPromise=this.doRefreshAccessToken().finally(()=>{u.refreshPromise=null})),u.refreshPromise})}doRefreshAccessToken(){return h(this,null,function*(){const e=this.getRefreshToken();if(!e)throw new Error("No refresh token available");const o=new URLSearchParams({grant_type:"refresh_token",refresh_token:e,client_id:this.providerAddress}),r=yield fetch(f(this.config.ssoBaseUrl,"/oauth/token"),{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:o.toString()});if(!r.ok){const c=yield r.json().catch(()=>({error:r.statusText}));throw this.logout(),new Error(`Token refresh failed: ${c.error_description||c.error||r.statusText}`)}const s=yield r.json(),a=m.parse(s);localStorage.setItem(i+"access_token",a.access_token),localStorage.setItem(i+"id_token",a.id_token),localStorage.setItem(g,a.refresh_token);const n=Date.now()+a.expires_in*1e3;return localStorage.setItem(p,n.toString()),a})}withAutoRefresh(e,o=1){return h(this,null,function*(){var r,s,a;try{return yield e()}catch(n){if((((r=n==null?void 0:n.response)==null?void 0:r.status)===401||((s=n==null?void 0:n.message)==null?void 0:s.includes("401"))||((a=n==null?void 0:n.message)==null?void 0:a.includes("Unauthorized")))&&o>0&&this.hasRefreshToken())try{return yield this.refreshAccessToken(),yield e()}catch(l){throw n}throw n}})}};u.refreshPromise=null;let k=u;exports.AlienSsoClient=k;exports.AlienSsoClientSchema=b;exports.AuthorizeResponseSchema=y;exports.ExchangeCodeResponseSchema=E;exports.PollRequestSchema=T;exports.PollResponseSchema=z;exports.TokenInfoSchema=A;exports.TokenResponseSchema=m;exports.UserInfoResponseSchema=R;

package/dist/index.d.ts

@@ -5,16 +5,84 @@ export declare class AlienSsoClient {
     readonly pollingInterval: number;
     readonly ssoBaseUrl: string;
     readonly providerAddress: string;
+    private static refreshPromise;
     constructor(config: AlienSsoClientConfig);
     private generateCodeVerifier;
     private generateCodeChallenge;
+    /**
+     * Initiates OAuth2 authorization flow with response_mode=json for SPA
+     * GET /oauth/authorize?response_type=code&response_mode=json&...
+     */
     generateDeeplink(): Promise<AuthorizeResponse>;
+    /**
+     * Polls for authorization completion
+     * POST /oauth/poll
+     */
     pollAuth(pollingCode: string): Promise<PollResponse>;
-    exchangeToken(authorizationCode: string): Promise<string>;
-    verifyAuth(): Promise<boolean>;
+    /**
+     * Exchanges authorization code for tokens
+     * POST /oauth/token (application/x-www-form-urlencoded)
+     * Returns both access_token and id_token
+     */
+    exchangeToken(authorizationCode: string): Promise<TokenResponse>;
+    /**
+     * Verifies authentication by calling userinfo endpoint
+     * GET /oauth/userinfo
+     * Automatically refreshes token on 401 if refresh token is available
+     */
+    verifyAuth(): Promise<UserInfoResponse | null>;
+    /**
+     * Gets stored access token
+     */
     getAccessToken(): string | null;
+    /**
+     * Gets stored ID token
+     */
+    getIdToken(): string | null;
+    /**
+     * Decodes and validates JWT token to extract claims
+     * Works with both access_token and id_token (EdDSA signed)
+     */
     getAuthData(): TokenInfo | null;
+    /**
+     * Gets the subject (user identifier) from the token
+     */
+    getSubject(): string | null;
+    /**
+     * Checks if the current token is expired
+     */
+    isTokenExpired(): boolean;
+    /**
+     * Clears all stored authentication data
+     */
     logout(): void;
+    /**
+     * Gets stored refresh token
+     */
+    getRefreshToken(): string | null;
+    /**
+     * Checks if a refresh token is available
+     */
+    hasRefreshToken(): boolean;
+    /**
+     * Checks if the access token is expired or will expire soon (within 5 minutes)
+     */
+    isAccessTokenExpired(): boolean;
+    /**
+     * Refreshes the access token using the stored refresh token
+     * POST /oauth/token with grant_type=refresh_token
+     * Uses singleton pattern to prevent concurrent refresh requests (race condition)
+     */
+    refreshAccessToken(): Promise<TokenResponse>;
+    /**
+     * Internal method that performs the actual token refresh
+     */
+    private doRefreshAccessToken;
+    /**
+     * Executes a function that makes an authenticated request
+     * Automatically refreshes token and retries on 401 error
+     */
+    withAutoRefresh<T>(requestFn: () => Promise<T>, maxRetries?: number): Promise<T>;
 }
 
 export declare type AlienSsoClientConfig = z.infer<typeof AlienSsoClientSchema>;
@@ -25,49 +93,39 @@ export declare const AlienSsoClientSchema: z.ZodMiniObject<{
     pollingInterval: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
 }, z.core.$strip>;
 
-export declare type AuthorizeRequest = z.infer<typeof AuthorizeRequestSchema>;
+export declare type AuthorizeResponse = z.infer<typeof AuthorizeResponseSchema>;
 
 /**
- * Authorize request/response schema
+ * Authorize response schema (for response_mode=json)
+ * GET /oauth/authorize?response_mode=json&...
  */
-export declare const AuthorizeRequestSchema: z.ZodMiniObject<{
-    code_challenge: z.ZodMiniString<string>;
-    code_challenge_method: z.ZodMiniLiteral<"S256">;
-}, z.core.$strip>;
-
-export declare type AuthorizeResponse = z.infer<typeof AuthorizeResponseSchema>;
-
 export declare const AuthorizeResponseSchema: z.ZodMiniObject<{
     deep_link: z.ZodMiniString<string>;
     polling_code: z.ZodMiniString<string>;
     expired_at: z.ZodMiniNumber<number>;
 }, z.core.$strip>;
 
-export declare type ExchangeCodeRequest = z.infer<typeof ExchangeCodeRequestSchema>;
-
-/**
- * ExchangeCode request/response schema
- */
-export declare const ExchangeCodeRequestSchema: z.ZodMiniObject<{
-    authorization_code: z.ZodMiniString<string>;
-    code_verifier: z.ZodMiniString<string>;
-}, z.core.$strip>;
-
-export declare type ExchangeCodeResponse = z.infer<typeof ExchangeCodeResponseSchema>;
+export declare type ExchangeCodeResponse = TokenResponse;
 
 export declare const ExchangeCodeResponseSchema: z.ZodMiniObject<{
     access_token: z.ZodMiniString<string>;
+    token_type: z.ZodMiniString<string>;
+    expires_in: z.ZodMiniNumber<number>;
+    id_token: z.ZodMiniString<string>;
+    refresh_token: z.ZodMiniString<string>;
 }, z.core.$strip>;
 
 export declare interface JWTHeader {
     alg: string;
     typ: string;
+    kid?: string;
 }
 
 export declare type PollRequest = z.infer<typeof PollRequestSchema>;
 
 /**
  * Poll request/response schema
+ * POST /oauth/poll
  */
 export declare const PollRequestSchema: z.ZodMiniObject<{
     polling_code: z.ZodMiniString<string>;
@@ -88,28 +146,41 @@ export declare const PollResponseSchema: z.ZodMiniObject<{
 export declare type TokenInfo = z.infer<typeof TokenInfoSchema>;
 
 /**
- * Token info schema
+ * Token info schema (parsed from JWT)
+ * Standard OIDC claims
  */
 export declare const TokenInfoSchema: z.ZodMiniObject<{
-    app_callback_session_address: z.ZodMiniString<string>;
-    expired_at: z.ZodMiniNumber<number>;
-    issued_at: z.ZodMiniNumber<number>;
+    iss: z.ZodMiniString<string>;
+    sub: z.ZodMiniString<string>;
+    aud: z.ZodMiniUnion<readonly [z.ZodMiniString<string>, z.ZodMiniArray<z.ZodMiniString<string>>]>;
+    exp: z.ZodMiniNumber<number>;
+    iat: z.ZodMiniNumber<number>;
+    nonce: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    auth_time: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
 }, z.core.$strip>;
 
-export declare type VerifyTokenRequest = z.infer<typeof VerifyTokenRequestSchema>;
+export declare type TokenResponse = z.infer<typeof TokenResponseSchema>;
 
 /**
- * VerifyToken request/response schema
+ * Token exchange response schema (OAuth2 standard)
+ * POST /oauth/token
  */
-export declare const VerifyTokenRequestSchema: z.ZodMiniObject<{
+export declare const TokenResponseSchema: z.ZodMiniObject<{
     access_token: z.ZodMiniString<string>;
+    token_type: z.ZodMiniString<string>;
+    expires_in: z.ZodMiniNumber<number>;
+    id_token: z.ZodMiniString<string>;
+    refresh_token: z.ZodMiniString<string>;
 }, z.core.$strip>;
 
-export declare type VerifyTokenResponse = z.infer<typeof VerifyTokenResponseSchema>;
+export declare type UserInfoResponse = z.infer<typeof UserInfoResponseSchema>;
 
-export declare const VerifyTokenResponseSchema: z.ZodMiniObject<{
-    is_valid: z.ZodMiniBoolean<boolean>;
-    access_token: z.ZodMiniOptional<z.ZodMiniString<string>>;
+/**
+ * UserInfo response schema
+ * GET /oauth/userinfo
+ */
+export declare const UserInfoResponseSchema: z.ZodMiniObject<{
+    sub: z.ZodMiniString<string>;
 }, z.core.$strip>;
 
 export { }

package/dist/index.esm.js

@@ -1,225 +1,354 @@
-var d = (a, o, s) => new Promise((n, r) => {
-  var t = (i) => {
+var h = (u, e, r) => new Promise((o, s) => {
+  var a = (l) => {
     try {
-      h(s.next(i));
-    } catch (p) {
-      r(p);
+      c(r.next(l));
+    } catch (m) {
+      s(m);
     }
-  }, c = (i) => {
+  }, n = (l) => {
     try {
-      h(s.throw(i));
-    } catch (p) {
-      r(p);
+      c(r.throw(l));
+    } catch (m) {
+      s(m);
     }
-  }, h = (i) => i.done ? n(i.value) : Promise.resolve(i.value).then(t, c);
-  h((s = s.apply(a, o)).next());
+  }, c = (l) => l.done ? o(l.value) : Promise.resolve(l.value).then(a, n);
+  c((r = r.apply(u, e)).next());
 });
-import { z as e } from "zod/v4-mini";
-import { sha256 as f } from "js-sha256";
-const _ = e.object({
-  code_challenge: e.string(),
-  code_challenge_method: e.literal("S256")
-}), S = e.object({
-  deep_link: e.string(),
-  polling_code: e.string(),
-  expired_at: e.number()
-}), m = e.object({
-  polling_code: e.string()
-}), y = ["pending", "authorized", "rejected", "expired"], k = e.enum(y), b = e.object({
-  status: k,
-  authorization_code: e.optional(e.string())
-}), R = e.object({
-  authorization_code: e.string(),
-  code_verifier: e.string()
-}), A = e.object({
-  access_token: e.string()
-}), j = e.object({
-  access_token: e.string()
-}), v = e.object({
-  is_valid: e.boolean(),
-  access_token: e.optional(e.string())
-}), w = e.object({
-  app_callback_session_address: e.string(),
-  expired_at: e.number(),
-  issued_at: e.number()
-});
-function E(a) {
-  return btoa(a).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+import { z as t } from "zod/v4-mini";
+import { sha256 as y } from "js-sha256";
+const T = t.object({
+  deep_link: t.string(),
+  polling_code: t.string(),
+  expired_at: t.number()
+}), b = t.object({
+  polling_code: t.string()
+}), A = ["pending", "authorized", "rejected", "expired"], I = t.enum(A), R = t.object({
+  status: I,
+  authorization_code: t.optional(t.string())
+}), k = t.object({
+  access_token: t.string(),
+  token_type: t.string(),
+  expires_in: t.number(),
+  id_token: t.string(),
+  refresh_token: t.string()
+}), x = t.object({
+  sub: t.string()
+}), j = t.object({
+  iss: t.string(),
+  sub: t.string(),
+  aud: t.union([t.string(), t.array(t.string())]),
+  exp: t.number(),
+  iat: t.number(),
+  nonce: t.optional(t.string()),
+  auth_time: t.optional(t.number())
+}), z = k;
+function w(u) {
+  return btoa(u).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
-function u(a) {
-  let o = a.replace(/-/g, "+").replace(/_/g, "/");
-  for (; o.length % 4; )
-    o += "=";
-  return atob(o);
+function _(u) {
+  let e = u.replace(/-/g, "+").replace(/_/g, "/");
+  for (; e.length % 4; )
+    e += "=";
+  return atob(e);
 }
-const T = "https://sso.alien.com", C = 5e3, l = "alien-sso_", g = (a, o) => new URL(o, a).toString(), O = e.object({
-  ssoBaseUrl: e.url(),
-  providerAddress: e.string(),
-  pollingInterval: e.optional(e.number())
-});
-class x {
-  constructor(o) {
-    this.config = O.parse(o), this.ssoBaseUrl = this.config.ssoBaseUrl || T, this.providerAddress = this.config.providerAddress, this.pollingInterval = this.config.pollingInterval || C;
+const E = "https://sso.alien.com", v = 5e3, i = "alien-sso_", g = i + "refresh_token", p = i + "token_expiry", f = (u, e) => new URL(e, u).toString(), U = t.object({
+  ssoBaseUrl: t.url(),
+  providerAddress: t.string(),
+  pollingInterval: t.optional(t.number())
+}), d = class d {
+  constructor(e) {
+    this.config = U.parse(e), this.ssoBaseUrl = this.config.ssoBaseUrl || E, this.providerAddress = this.config.providerAddress, this.pollingInterval = this.config.pollingInterval || v;
   }
-  generateCodeVerifier(o = 128) {
-    let s;
-    const n = typeof window != "undefined" && window.crypto;
-    if (n && n.getRandomValues)
-      s = new Uint8Array(o), n.getRandomValues(s);
+  generateCodeVerifier(e = 128) {
+    let r;
+    const o = typeof window != "undefined" && window.crypto;
+    if (o && o.getRandomValues)
+      r = new Uint8Array(e), o.getRandomValues(r);
     else {
-      s = new Uint8Array(o);
-      for (let t = 0; t < o; t++)
-        s[t] = Math.floor(Math.random() * 256);
+      r = new Uint8Array(e);
+      for (let a = 0; a < e; a++)
+        r[a] = Math.floor(Math.random() * 256);
     }
-    let r = "";
-    for (let t = 0; t < s.length; t++)
-      r += String.fromCharCode(s[t]);
-    return E(r);
+    let s = "";
+    for (let a = 0; a < r.length; a++)
+      s += String.fromCharCode(r[a]);
+    return w(s);
   }
-  generateCodeChallenge(o) {
-    return f(o);
+  generateCodeChallenge(e) {
+    const r = y.array(e), o = String.fromCharCode(...r);
+    return w(o);
   }
+  /**
+   * Initiates OAuth2 authorization flow with response_mode=json for SPA
+   * GET /oauth/authorize?response_type=code&response_mode=json&...
+   */
   generateDeeplink() {
-    return d(this, null, function* () {
-      const o = this.generateCodeVerifier(), s = this.generateCodeChallenge(o);
-      sessionStorage.setItem(l + "code_verifier", o);
-      const n = `${this.config.ssoBaseUrl}/sso/authorize`, r = {
-        code_challenge: s,
+    return h(this, null, function* () {
+      const e = this.generateCodeVerifier(), r = this.generateCodeChallenge(e);
+      sessionStorage.setItem(i + "code_verifier", e);
+      const o = new URLSearchParams({
+        response_type: "code",
+        response_mode: "json",
+        client_id: this.providerAddress,
+        scope: "openid",
+        code_challenge: r,
         code_challenge_method: "S256"
-      };
-      _.parse(r);
-      const c = yield (yield fetch(n, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "X-PROVIDER-ADDRESS": this.providerAddress
-        },
-        body: JSON.stringify(r)
-      })).json();
-      return S.parse(c);
+      }), s = `${this.config.ssoBaseUrl}/oauth/authorize?${o.toString()}`, a = yield fetch(s, {
+        method: "GET"
+      });
+      if (!a.ok) {
+        const c = yield a.json().catch(() => ({ error: a.statusText }));
+        throw new Error(`Authorize failed: ${c.error_description || c.error || a.statusText}`);
+      }
+      const n = yield a.json();
+      return T.parse(n);
     });
   }
-  pollAuth(o) {
-    return d(this, null, function* () {
-      const s = {
-        polling_code: o
+  /**
+   * Polls for authorization completion
+   * POST /oauth/poll
+   */
+  pollAuth(e) {
+    return h(this, null, function* () {
+      const r = {
+        polling_code: e
       };
-      m.parse(s);
-      const n = yield fetch(g(this.config.ssoBaseUrl, "/sso/poll"), {
+      b.parse(r);
+      const o = yield fetch(f(this.config.ssoBaseUrl, "/oauth/poll"), {
         method: "POST",
         headers: {
-          "Content-Type": "application/json",
-          "X-PROVIDER-ADDRESS": this.providerAddress
+          "Content-Type": "application/json"
         },
-        body: JSON.stringify(s)
+        body: JSON.stringify(r)
       });
-      if (!n.ok)
-        throw new Error(`Poll failed: ${n.statusText}`);
-      const r = yield n.json();
-      return b.parse(r);
+      if (!o.ok)
+        throw new Error(`Poll failed: ${o.statusText}`);
+      const s = yield o.json();
+      return R.parse(s);
     });
   }
-  exchangeToken(o) {
-    return d(this, null, function* () {
-      const s = sessionStorage.getItem(l + "code_verifier");
-      if (!s) throw new Error("Missing code verifier.");
-      const n = {
-        authorization_code: o,
-        code_verifier: s
-      };
-      R.parse(n);
-      const r = yield fetch(
-        g(this.config.ssoBaseUrl, "/sso/access_token/exchange"),
+  /**
+   * Exchanges authorization code for tokens
+   * POST /oauth/token (application/x-www-form-urlencoded)
+   * Returns both access_token and id_token
+   */
+  exchangeToken(e) {
+    return h(this, null, function* () {
+      const r = sessionStorage.getItem(i + "code_verifier");
+      if (!r) throw new Error("Missing code verifier.");
+      const o = new URLSearchParams({
+        grant_type: "authorization_code",
+        code: e,
+        client_id: this.providerAddress,
+        code_verifier: r
+      }), s = yield fetch(
+        f(this.config.ssoBaseUrl, "/oauth/token"),
         {
           method: "POST",
           headers: {
-            "Content-Type": "application/json",
-            "X-PROVIDER-ADDRESS": this.providerAddress
+            "Content-Type": "application/x-www-form-urlencoded"
           },
-          body: JSON.stringify(n)
+          body: o.toString()
         }
       );
-      if (!r.ok)
-        throw new Error(`ExchangeCode failed: ${r.statusText}`);
-      const t = yield r.json(), c = A.parse(t);
-      if (c.access_token)
-        return localStorage.setItem(
-          l + "access_token",
-          c.access_token
-        ), c.access_token;
-      throw new Error("Exchange failed");
+      if (!s.ok) {
+        const l = yield s.json().catch(() => ({ error: s.statusText }));
+        throw new Error(`Token exchange failed: ${l.error_description || l.error || s.statusText}`);
+      }
+      const a = yield s.json(), n = k.parse(a);
+      localStorage.setItem(i + "access_token", n.access_token), localStorage.setItem(i + "id_token", n.id_token), localStorage.setItem(g, n.refresh_token);
+      const c = Date.now() + n.expires_in * 1e3;
+      return localStorage.setItem(p, c.toString()), sessionStorage.removeItem(i + "code_verifier"), n;
     });
   }
+  /**
+   * Verifies authentication by calling userinfo endpoint
+   * GET /oauth/userinfo
+   * Automatically refreshes token on 401 if refresh token is available
+   */
   verifyAuth() {
-    return d(this, null, function* () {
-      const o = this.getAccessToken();
-      if (!o)
-        return !1;
-      const s = {
-        access_token: o
-      };
-      j.parse(s);
-      const n = yield fetch(
-        g(this.config.ssoBaseUrl, "/sso/access_token/verify"),
-        {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            "X-PROVIDER-ADDRESS": this.providerAddress
-          },
-          body: JSON.stringify(s)
+    return h(this, null, function* () {
+      return this.withAutoRefresh(() => h(this, null, function* () {
+        const e = this.getAccessToken();
+        if (!e)
+          return null;
+        const r = yield fetch(
+          f(this.config.ssoBaseUrl, "/oauth/userinfo"),
+          {
+            method: "GET",
+            headers: {
+              Authorization: `Bearer ${e}`
+            }
+          }
+        );
+        if (!r.ok) {
+          if (r.status === 401) {
+            const s = new Error("Unauthorized");
+            throw s.response = { status: 401 }, s;
+          }
+          return null;
         }
-      );
-      if (!n.ok)
-        return !1;
-      const r = yield n.json(), t = v.parse(r);
-      return t.access_token && localStorage.setItem(
-        l + "access_token",
-        t.access_token
-      ), t.is_valid;
+        const o = yield r.json();
+        return x.parse(o);
+      }));
     });
   }
+  /**
+   * Gets stored access token
+   */
   getAccessToken() {
-    return localStorage.getItem(l + "access_token");
+    return localStorage.getItem(i + "access_token");
   }
+  /**
+   * Gets stored ID token
+   */
+  getIdToken() {
+    return localStorage.getItem(i + "id_token");
+  }
+  /**
+   * Decodes and validates JWT token to extract claims
+   * Works with both access_token and id_token (EdDSA signed)
+   */
   getAuthData() {
-    const o = this.getAccessToken();
-    if (!o) return null;
-    const s = o.split(".");
-    if (s.length !== 3)
+    const e = this.getIdToken() || this.getAccessToken();
+    if (!e) return null;
+    const r = e.split(".");
+    if (r.length !== 3)
       return null;
-    let n;
+    let o;
     try {
-      const t = u(s[0]);
-      n = JSON.parse(t);
-    } catch (t) {
+      const n = _(r[0]);
+      o = JSON.parse(n);
+    } catch (n) {
       return null;
     }
-    if (n.alg !== "HS256" || n.typ !== "JWT")
+    if (o.alg !== "RS256" || o.typ !== "JWT")
       return null;
-    let r;
+    let s;
     try {
-      const t = JSON.parse(u(s[1]));
-      r = w.parse(t);
-    } catch (t) {
+      const n = JSON.parse(_(r[1]));
+      s = j.parse(n);
+    } catch (n) {
       return null;
     }
-    return r;
+    return (Array.isArray(s.aud) ? s.aud : [s.aud]).includes(this.providerAddress) ? s : null;
+  }
+  /**
+   * Gets the subject (user identifier) from the token
+   */
+  getSubject() {
+    const e = this.getAuthData();
+    return (e == null ? void 0 : e.sub) || null;
+  }
+  /**
+   * Checks if the current token is expired
+   */
+  isTokenExpired() {
+    const e = this.getAuthData();
+    return e ? Date.now() / 1e3 > e.exp : !0;
   }
+  /**
+   * Clears all stored authentication data
+   */
   logout() {
-    localStorage.removeItem(l + "access_token"), sessionStorage.removeItem(l + "code_verifier");
+    localStorage.removeItem(i + "access_token"), localStorage.removeItem(i + "id_token"), localStorage.removeItem(g), localStorage.removeItem(p), sessionStorage.removeItem(i + "code_verifier");
   }
-}
+  /**
+   * Gets stored refresh token
+   */
+  getRefreshToken() {
+    return localStorage.getItem(g);
+  }
+  /**
+   * Checks if a refresh token is available
+   */
+  hasRefreshToken() {
+    return !!this.getRefreshToken();
+  }
+  /**
+   * Checks if the access token is expired or will expire soon (within 5 minutes)
+   */
+  isAccessTokenExpired() {
+    const e = localStorage.getItem(p);
+    if (!e) return !0;
+    const r = parseInt(e, 10), o = Date.now(), s = 300 * 1e3;
+    return o >= r - s;
+  }
+  /**
+   * Refreshes the access token using the stored refresh token
+   * POST /oauth/token with grant_type=refresh_token
+   * Uses singleton pattern to prevent concurrent refresh requests (race condition)
+   */
+  refreshAccessToken() {
+    return h(this, null, function* () {
+      return d.refreshPromise || (d.refreshPromise = this.doRefreshAccessToken().finally(() => {
+        d.refreshPromise = null;
+      })), d.refreshPromise;
+    });
+  }
+  /**
+   * Internal method that performs the actual token refresh
+   */
+  doRefreshAccessToken() {
+    return h(this, null, function* () {
+      const e = this.getRefreshToken();
+      if (!e)
+        throw new Error("No refresh token available");
+      const r = new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: e,
+        client_id: this.providerAddress
+      }), o = yield fetch(
+        f(this.config.ssoBaseUrl, "/oauth/token"),
+        {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/x-www-form-urlencoded"
+          },
+          body: r.toString()
+        }
+      );
+      if (!o.ok) {
+        const c = yield o.json().catch(() => ({ error: o.statusText }));
+        throw this.logout(), new Error(`Token refresh failed: ${c.error_description || c.error || o.statusText}`);
+      }
+      const s = yield o.json(), a = k.parse(s);
+      localStorage.setItem(i + "access_token", a.access_token), localStorage.setItem(i + "id_token", a.id_token), localStorage.setItem(g, a.refresh_token);
+      const n = Date.now() + a.expires_in * 1e3;
+      return localStorage.setItem(p, n.toString()), a;
+    });
+  }
+  /**
+   * Executes a function that makes an authenticated request
+   * Automatically refreshes token and retries on 401 error
+   */
+  withAutoRefresh(e, r = 1) {
+    return h(this, null, function* () {
+      var o, s, a;
+      try {
+        return yield e();
+      } catch (n) {
+        if ((((o = n == null ? void 0 : n.response) == null ? void 0 : o.status) === 401 || ((s = n == null ? void 0 : n.message) == null ? void 0 : s.includes("401")) || ((a = n == null ? void 0 : n.message) == null ? void 0 : a.includes("Unauthorized"))) && r > 0 && this.hasRefreshToken())
+          try {
+            return yield this.refreshAccessToken(), yield e();
+          } catch (l) {
+            throw n;
+          }
+        throw n;
+      }
+    });
+  }
+};
+d.refreshPromise = null;
+let S = d;
 export {
-  x as AlienSsoClient,
-  O as AlienSsoClientSchema,
-  _ as AuthorizeRequestSchema,
-  S as AuthorizeResponseSchema,
-  R as ExchangeCodeRequestSchema,
-  A as ExchangeCodeResponseSchema,
-  m as PollRequestSchema,
-  b as PollResponseSchema,
-  w as TokenInfoSchema,
-  j as VerifyTokenRequestSchema,
-  v as VerifyTokenResponseSchema
+  S as AlienSsoClient,
+  U as AlienSsoClientSchema,
+  T as AuthorizeResponseSchema,
+  z as ExchangeCodeResponseSchema,
+  b as PollRequestSchema,
+  R as PollResponseSchema,
+  j as TokenInfoSchema,
+  k as TokenResponseSchema,
+  x as UserInfoResponseSchema
 };

package/dist/index.umd.js

@@ -1 +1 @@
-(function(t,e){typeof exports=="object"&&typeof module!="undefined"?e(exports,require("zod/v4-mini"),require("js-sha256")):typeof define=="function"&&define.amd?define(["exports","zod/v4-mini","js-sha256"],e):(t=typeof globalThis!="undefined"?globalThis:t||self,e(t.AlienSsoCore={},t.Zod,t.jsSha256))})(this,(function(t,e,i){"use strict";var f=(t,e,i)=>new Promise((S,g)=>{var m=c=>{try{u(i.next(c))}catch(d){g(d)}},_=c=>{try{u(i.throw(c))}catch(d){g(d)}},u=c=>c.done?S(c.value):Promise.resolve(c.value).then(m,_);u((i=i.apply(t,e)).next())});const S=e.z.object({code_challenge:e.z.string(),code_challenge_method:e.z.literal("S256")}),g=e.z.object({deep_link:e.z.string(),polling_code:e.z.string(),expired_at:e.z.number()}),m=e.z.object({polling_code:e.z.string()}),_=["pending","authorized","rejected","expired"],u=e.z.enum(_),c=e.z.object({status:u,authorization_code:e.z.optional(e.z.string())}),d=e.z.object({authorization_code:e.z.string(),code_verifier:e.z.string()}),y=e.z.object({access_token:e.z.string()}),R=e.z.object({access_token:e.z.string()}),k=e.z.object({is_valid:e.z.boolean(),access_token:e.z.optional(e.z.string())}),A=e.z.object({app_callback_session_address:e.z.string(),expired_at:e.z.number(),issued_at:e.z.number()});function T(h){return btoa(h).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function j(h){let o=h.replace(/-/g,"+").replace(/_/g,"/");for(;o.length%4;)o+="=";return atob(o)}const C="https://sso.alien.com",w=5e3,l="alien-sso_",z=(h,o)=>new URL(o,h).toString(),b=e.z.object({ssoBaseUrl:e.z.url(),providerAddress:e.z.string(),pollingInterval:e.z.optional(e.z.number())});class E{constructor(o){this.config=b.parse(o),this.ssoBaseUrl=this.config.ssoBaseUrl||C,this.providerAddress=this.config.providerAddress,this.pollingInterval=this.config.pollingInterval||w}generateCodeVerifier(o=128){let s;const r=typeof window!="undefined"&&window.crypto;if(r&&r.getRandomValues)s=new Uint8Array(o),r.getRandomValues(s);else{s=new Uint8Array(o);for(let n=0;n<o;n++)s[n]=Math.floor(Math.random()*256)}let a="";for(let n=0;n<s.length;n++)a+=String.fromCharCode(s[n]);return T(a)}generateCodeChallenge(o){return i.sha256(o)}generateDeeplink(){return f(this,null,function*(){const o=this.generateCodeVerifier(),s=this.generateCodeChallenge(o);sessionStorage.setItem(l+"code_verifier",o);const r=`${this.config.ssoBaseUrl}/sso/authorize`,a={code_challenge:s,code_challenge_method:"S256"};S.parse(a);const p=yield(yield fetch(r,{method:"POST",headers:{"Content-Type":"application/json","X-PROVIDER-ADDRESS":this.providerAddress},body:JSON.stringify(a)})).json();return g.parse(p)})}pollAuth(o){return f(this,null,function*(){const s={polling_code:o};m.parse(s);const r=yield fetch(z(this.config.ssoBaseUrl,"/sso/poll"),{method:"POST",headers:{"Content-Type":"application/json","X-PROVIDER-ADDRESS":this.providerAddress},body:JSON.stringify(s)});if(!r.ok)throw new Error(`Poll failed: ${r.statusText}`);const a=yield r.json();return c.parse(a)})}exchangeToken(o){return f(this,null,function*(){const s=sessionStorage.getItem(l+"code_verifier");if(!s)throw new Error("Missing code verifier.");const r={authorization_code:o,code_verifier:s};d.parse(r);const a=yield fetch(z(this.config.ssoBaseUrl,"/sso/access_token/exchange"),{method:"POST",headers:{"Content-Type":"application/json","X-PROVIDER-ADDRESS":this.providerAddress},body:JSON.stringify(r)});if(!a.ok)throw new Error(`ExchangeCode failed: ${a.statusText}`);const n=yield a.json(),p=y.parse(n);if(p.access_token)return localStorage.setItem(l+"access_token",p.access_token),p.access_token;throw new Error("Exchange failed")})}verifyAuth(){return f(this,null,function*(){const o=this.getAccessToken();if(!o)return!1;const s={access_token:o};R.parse(s);const r=yield fetch(z(this.config.ssoBaseUrl,"/sso/access_token/verify"),{method:"POST",headers:{"Content-Type":"application/json","X-PROVIDER-ADDRESS":this.providerAddress},body:JSON.stringify(s)});if(!r.ok)return!1;const a=yield r.json(),n=k.parse(a);return n.access_token&&localStorage.setItem(l+"access_token",n.access_token),n.is_valid})}getAccessToken(){return localStorage.getItem(l+"access_token")}getAuthData(){const o=this.getAccessToken();if(!o)return null;const s=o.split(".");if(s.length!==3)return null;let r;try{const n=j(s[0]);r=JSON.parse(n)}catch(n){return null}if(r.alg!=="HS256"||r.typ!=="JWT")return null;let a;try{const n=JSON.parse(j(s[1]));a=A.parse(n)}catch(n){return null}return a}logout(){localStorage.removeItem(l+"access_token"),sessionStorage.removeItem(l+"code_verifier")}}t.AlienSsoClient=E,t.AlienSsoClientSchema=b,t.AuthorizeRequestSchema=S,t.AuthorizeResponseSchema=g,t.ExchangeCodeRequestSchema=d,t.ExchangeCodeResponseSchema=y,t.PollRequestSchema=m,t.PollResponseSchema=c,t.TokenInfoSchema=A,t.VerifyTokenRequestSchema=R,t.VerifyTokenResponseSchema=k,Object.defineProperty(t,Symbol.toStringTag,{value:"Module"})}));
+(function(c,t){typeof exports=="object"&&typeof module!="undefined"?t(exports,require("zod/v4-mini"),require("js-sha256")):typeof define=="function"&&define.amd?define(["exports","zod/v4-mini","js-sha256"],t):(c=typeof globalThis!="undefined"?globalThis:c||self,t(c.AlienSsoCore={},c.Zod,c.jsSha256))})(this,(function(c,t,g){"use strict";var h=(c,t,g)=>new Promise((k,m)=>{var T=l=>{try{f(g.next(l))}catch(p){m(p)}},z=l=>{try{f(g.throw(l))}catch(p){m(p)}},f=l=>l.done?k(l.value):Promise.resolve(l.value).then(T,z);f((g=g.apply(c,t)).next())});const k=t.z.object({deep_link:t.z.string(),polling_code:t.z.string(),expired_at:t.z.number()}),m=t.z.object({polling_code:t.z.string()}),T=["pending","authorized","rejected","expired"],z=t.z.enum(T),f=t.z.object({status:z,authorization_code:t.z.optional(t.z.string())}),l=t.z.object({access_token:t.z.string(),token_type:t.z.string(),expires_in:t.z.number(),id_token:t.z.string(),refresh_token:t.z.string()}),p=t.z.object({sub:t.z.string()}),b=t.z.object({iss:t.z.string(),sub:t.z.string(),aud:t.z.union([t.z.string(),t.z.array(t.z.string())]),exp:t.z.number(),iat:t.z.number(),nonce:t.z.optional(t.z.string()),auth_time:t.z.optional(t.z.number())}),P=l;function I(S){return btoa(S).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function j(S){let e=S.replace(/-/g,"+").replace(/_/g,"/");for(;e.length%4;)e+="=";return atob(e)}const x="https://sso.alien.com",U=5e3,i="alien-sso_",w=i+"refresh_token",_=i+"token_expiry",y=(S,e)=>new URL(e,S).toString(),E=t.z.object({ssoBaseUrl:t.z.url(),providerAddress:t.z.string(),pollingInterval:t.z.optional(t.z.number())}),d=class d{constructor(e){this.config=E.parse(e),this.ssoBaseUrl=this.config.ssoBaseUrl||x,this.providerAddress=this.config.providerAddress,this.pollingInterval=this.config.pollingInterval||U}generateCodeVerifier(e=128){let o;const r=typeof window!="undefined"&&window.crypto;if(r&&r.getRandomValues)o=new Uint8Array(e),r.getRandomValues(o);else{o=new Uint8Array(e);for(let a=0;a<e;a++)o[a]=Math.floor(Math.random()*256)}let s="";for(let a=0;a<o.length;a++)s+=String.fromCharCode(o[a]);return I(s)}generateCodeChallenge(e){const o=g.sha256.array(e),r=String.fromCharCode(...o);return I(r)}generateDeeplink(){return h(this,null,function*(){const e=this.generateCodeVerifier(),o=this.generateCodeChallenge(e);sessionStorage.setItem(i+"code_verifier",e);const r=new URLSearchParams({response_type:"code",response_mode:"json",client_id:this.providerAddress,scope:"openid",code_challenge:o,code_challenge_method:"S256"}),s=`${this.config.ssoBaseUrl}/oauth/authorize?${r.toString()}`,a=yield fetch(s,{method:"GET"});if(!a.ok){const u=yield a.json().catch(()=>({error:a.statusText}));throw new Error(`Authorize failed: ${u.error_description||u.error||a.statusText}`)}const n=yield a.json();return k.parse(n)})}pollAuth(e){return h(this,null,function*(){const o={polling_code:e};m.parse(o);const r=yield fetch(y(this.config.ssoBaseUrl,"/oauth/poll"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(o)});if(!r.ok)throw new Error(`Poll failed: ${r.statusText}`);const s=yield r.json();return f.parse(s)})}exchangeToken(e){return h(this,null,function*(){const o=sessionStorage.getItem(i+"code_verifier");if(!o)throw new Error("Missing code verifier.");const r=new URLSearchParams({grant_type:"authorization_code",code:e,client_id:this.providerAddress,code_verifier:o}),s=yield fetch(y(this.config.ssoBaseUrl,"/oauth/token"),{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:r.toString()});if(!s.ok){const R=yield s.json().catch(()=>({error:s.statusText}));throw new Error(`Token exchange failed: ${R.error_description||R.error||s.statusText}`)}const a=yield s.json(),n=l.parse(a);localStorage.setItem(i+"access_token",n.access_token),localStorage.setItem(i+"id_token",n.id_token),localStorage.setItem(w,n.refresh_token);const u=Date.now()+n.expires_in*1e3;return localStorage.setItem(_,u.toString()),sessionStorage.removeItem(i+"code_verifier"),n})}verifyAuth(){return h(this,null,function*(){return this.withAutoRefresh(()=>h(this,null,function*(){const e=this.getAccessToken();if(!e)return null;const o=yield fetch(y(this.config.ssoBaseUrl,"/oauth/userinfo"),{method:"GET",headers:{Authorization:`Bearer ${e}`}});if(!o.ok){if(o.status===401){const s=new Error("Unauthorized");throw s.response={status:401},s}return null}const r=yield o.json();return p.parse(r)}))})}getAccessToken(){return localStorage.getItem(i+"access_token")}getIdToken(){return localStorage.getItem(i+"id_token")}getAuthData(){const e=this.getIdToken()||this.getAccessToken();if(!e)return null;const o=e.split(".");if(o.length!==3)return null;let r;try{const n=j(o[0]);r=JSON.parse(n)}catch(n){return null}if(r.alg!=="RS256"||r.typ!=="JWT")return null;let s;try{const n=JSON.parse(j(o[1]));s=b.parse(n)}catch(n){return null}return(Array.isArray(s.aud)?s.aud:[s.aud]).includes(this.providerAddress)?s:null}getSubject(){const e=this.getAuthData();return(e==null?void 0:e.sub)||null}isTokenExpired(){const e=this.getAuthData();return e?Date.now()/1e3>e.exp:!0}logout(){localStorage.removeItem(i+"access_token"),localStorage.removeItem(i+"id_token"),localStorage.removeItem(w),localStorage.removeItem(_),sessionStorage.removeItem(i+"code_verifier")}getRefreshToken(){return localStorage.getItem(w)}hasRefreshToken(){return!!this.getRefreshToken()}isAccessTokenExpired(){const e=localStorage.getItem(_);if(!e)return!0;const o=parseInt(e,10),r=Date.now(),s=300*1e3;return r>=o-s}refreshAccessToken(){return h(this,null,function*(){return d.refreshPromise||(d.refreshPromise=this.doRefreshAccessToken().finally(()=>{d.refreshPromise=null})),d.refreshPromise})}doRefreshAccessToken(){return h(this,null,function*(){const e=this.getRefreshToken();if(!e)throw new Error("No refresh token available");const o=new URLSearchParams({grant_type:"refresh_token",refresh_token:e,client_id:this.providerAddress}),r=yield fetch(y(this.config.ssoBaseUrl,"/oauth/token"),{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:o.toString()});if(!r.ok){const u=yield r.json().catch(()=>({error:r.statusText}));throw this.logout(),new Error(`Token refresh failed: ${u.error_description||u.error||r.statusText}`)}const s=yield r.json(),a=l.parse(s);localStorage.setItem(i+"access_token",a.access_token),localStorage.setItem(i+"id_token",a.id_token),localStorage.setItem(w,a.refresh_token);const n=Date.now()+a.expires_in*1e3;return localStorage.setItem(_,n.toString()),a})}withAutoRefresh(e,o=1){return h(this,null,function*(){var r,s,a;try{return yield e()}catch(n){if((((r=n==null?void 0:n.response)==null?void 0:r.status)===401||((s=n==null?void 0:n.message)==null?void 0:s.includes("401"))||((a=n==null?void 0:n.message)==null?void 0:a.includes("Unauthorized")))&&o>0&&this.hasRefreshToken())try{return yield this.refreshAccessToken(),yield e()}catch(R){throw n}throw n}})}};d.refreshPromise=null;let A=d;c.AlienSsoClient=A,c.AlienSsoClientSchema=E,c.AuthorizeResponseSchema=k,c.ExchangeCodeResponseSchema=P,c.PollRequestSchema=m,c.PollResponseSchema=f,c.TokenInfoSchema=b,c.TokenResponseSchema=l,c.UserInfoResponseSchema=p,Object.defineProperty(c,Symbol.toStringTag,{value:"Module"})}));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alien_org/sso-sdk-core",
-  "version": "1.0.18",
+  "version": "1.0.20",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/alien-id/sso-sdk-js.git"