@alien_org/sso-sdk-core 1.0.21 → 1.0.22

package/dist/index.cjs

@@ -1 +1 @@
-"use strict";var h=(u,e,o)=>new Promise((r,s)=>{var a=l=>{try{c(o.next(l))}catch(S){s(S)}},n=l=>{try{c(o.throw(l))}catch(S){s(S)}},c=l=>l.done?r(l.value):Promise.resolve(l.value).then(a,n);c((o=o.apply(u,e)).next())});Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const t=require("zod/v4-mini"),I=require("js-sha256"),y=t.z.object({deep_link:t.z.string(),polling_code:t.z.string(),expired_at:t.z.number()}),T=t.z.object({polling_code:t.z.string()}),j=["pending","authorized","rejected","expired"],x=t.z.enum(j),z=t.z.object({status:x,authorization_code:t.z.optional(t.z.string())}),m=t.z.object({access_token:t.z.string(),token_type:t.z.string(),expires_in:t.z.number(),id_token:t.z.optional(t.z.string()),refresh_token:t.z.string()}),R=t.z.object({sub:t.z.string()}),A=t.z.object({iss:t.z.string(),sub:t.z.string(),aud:t.z.union([t.z.string(),t.z.array(t.z.string())]),exp:t.z.number(),iat:t.z.number(),nonce:t.z.optional(t.z.string()),auth_time:t.z.optional(t.z.number())}),E=m;function _(u){return btoa(u).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function w(u){let e=u.replace(/-/g,"+").replace(/_/g,"/");for(;e.length%4;)e+="=";return atob(e)}const v="https://sso.alien.com",P=5e3,i="alien-sso_",g=i+"refresh_token",p=i+"token_expiry",f=(u,e)=>new URL(e,u).toString(),b=t.z.object({ssoBaseUrl:t.z.url(),providerAddress:t.z.string(),pollingInterval:t.z.optional(t.z.number())}),d=class d{constructor(e){this.config=b.parse(e),this.ssoBaseUrl=this.config.ssoBaseUrl||v,this.providerAddress=this.config.providerAddress,this.pollingInterval=this.config.pollingInterval||P}generateCodeVerifier(e=128){let o;const r=typeof window!="undefined"&&window.crypto;if(r&&r.getRandomValues)o=new Uint8Array(e),r.getRandomValues(o);else{o=new Uint8Array(e);for(let a=0;a<e;a++)o[a]=Math.floor(Math.random()*256)}let s="";for(let a=0;a<o.length;a++)s+=String.fromCharCode(o[a]);return _(s)}generateCodeChallenge(e){const o=I.sha256.array(e),r=String.fromCharCode(...o);return _(r)}generateDeeplink(){return h(this,null,function*(){const e=this.generateCodeVerifier(),o=this.generateCodeChallenge(e);sessionStorage.setItem(i+"code_verifier",e);const r=new URLSearchParams({response_type:"code",response_mode:"json",client_id:this.providerAddress,scope:"openid",code_challenge:o,code_challenge_method:"S256"}),s=`${this.config.ssoBaseUrl}/oauth/authorize?${r.toString()}`,a=yield fetch(s,{method:"GET"});if(!a.ok){const c=yield a.json().catch(()=>({error:a.statusText}));throw new Error(`Authorize failed: ${c.error_description||c.error||a.statusText}`)}const n=yield a.json();return y.parse(n)})}pollAuth(e){return h(this,null,function*(){const o={polling_code:e};T.parse(o);const r=yield fetch(f(this.config.ssoBaseUrl,"/oauth/poll"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(o)});if(!r.ok)throw new Error(`Poll failed: ${r.statusText}`);const s=yield r.json();return z.parse(s)})}exchangeToken(e){return h(this,null,function*(){const o=sessionStorage.getItem(i+"code_verifier");if(!o)throw new Error("Missing code verifier.");const r=new URLSearchParams({grant_type:"authorization_code",code:e,client_id:this.providerAddress,code_verifier:o}),s=yield fetch(f(this.config.ssoBaseUrl,"/oauth/token"),{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:r.toString()});if(!s.ok){const l=yield s.json().catch(()=>({error:s.statusText}));throw new Error(`Token exchange failed: ${l.error_description||l.error||s.statusText}`)}const a=yield s.json(),n=m.parse(a);localStorage.setItem(i+"access_token",n.access_token),n.id_token&&localStorage.setItem(i+"id_token",n.id_token),localStorage.setItem(g,n.refresh_token);const c=Date.now()+n.expires_in*1e3;return localStorage.setItem(p,c.toString()),sessionStorage.removeItem(i+"code_verifier"),n})}verifyAuth(){return h(this,null,function*(){return this.withAutoRefresh(()=>h(this,null,function*(){const e=this.getAccessToken();if(!e)return null;const o=yield fetch(f(this.config.ssoBaseUrl,"/oauth/userinfo"),{method:"GET",headers:{Authorization:`Bearer ${e}`}});if(!o.ok){if(o.status===401){const s=new Error("Unauthorized");throw s.response={status:401},s}return null}const r=yield o.json();return R.parse(r)}))})}getAccessToken(){return localStorage.getItem(i+"access_token")}getIdToken(){return localStorage.getItem(i+"id_token")}getAuthData(){const e=this.getIdToken()||this.getAccessToken();if(!e)return null;const o=e.split(".");if(o.length!==3)return null;let r;try{const n=w(o[0]);r=JSON.parse(n)}catch(n){return null}if(r.alg!=="RS256"||r.typ!=="JWT")return null;let s;try{const n=JSON.parse(w(o[1]));s=A.parse(n)}catch(n){return null}return(Array.isArray(s.aud)?s.aud:[s.aud]).includes(this.providerAddress)?s:null}getSubject(){const e=this.getAuthData();return(e==null?void 0:e.sub)||null}isTokenExpired(){const e=this.getAuthData();return e?Date.now()/1e3>e.exp:!0}logout(){localStorage.removeItem(i+"access_token"),localStorage.removeItem(i+"id_token"),localStorage.removeItem(g),localStorage.removeItem(p),sessionStorage.removeItem(i+"code_verifier")}getRefreshToken(){return localStorage.getItem(g)}hasRefreshToken(){return!!this.getRefreshToken()}isAccessTokenExpired(){const e=localStorage.getItem(p);if(!e)return!0;const o=parseInt(e,10),r=Date.now(),s=300*1e3;return r>=o-s}refreshAccessToken(){return h(this,null,function*(){return d.refreshPromise||(d.refreshPromise=this.doRefreshAccessToken().finally(()=>{d.refreshPromise=null})),d.refreshPromise})}doRefreshAccessToken(){return h(this,null,function*(){const e=this.getRefreshToken();if(!e)throw new Error("No refresh token available");const o=new URLSearchParams({grant_type:"refresh_token",refresh_token:e,client_id:this.providerAddress}),r=yield fetch(f(this.config.ssoBaseUrl,"/oauth/token"),{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:o.toString()});if(!r.ok){const c=yield r.json().catch(()=>({error:r.statusText}));throw this.logout(),new Error(`Token refresh failed: ${c.error_description||c.error||r.statusText}`)}const s=yield r.json(),a=m.parse(s);localStorage.setItem(i+"access_token",a.access_token),a.id_token&&localStorage.setItem(i+"id_token",a.id_token),localStorage.setItem(g,a.refresh_token);const n=Date.now()+a.expires_in*1e3;return localStorage.setItem(p,n.toString()),a})}withAutoRefresh(e,o=1){return h(this,null,function*(){var r,s,a;try{return yield e()}catch(n){if((((r=n==null?void 0:n.response)==null?void 0:r.status)===401||((s=n==null?void 0:n.message)==null?void 0:s.includes("401"))||((a=n==null?void 0:n.message)==null?void 0:a.includes("Unauthorized")))&&o>0&&this.hasRefreshToken())try{return yield this.refreshAccessToken(),yield e()}catch(l){throw n}throw n}})}};d.refreshPromise=null;let k=d;exports.AlienSsoClient=k;exports.AlienSsoClientSchema=b;exports.AuthorizeResponseSchema=y;exports.ExchangeCodeResponseSchema=E;exports.PollRequestSchema=T;exports.PollResponseSchema=z;exports.TokenInfoSchema=A;exports.TokenResponseSchema=m;exports.UserInfoResponseSchema=R;
+"use strict";var h=(d,e,o)=>new Promise((s,r)=>{var a=l=>{try{c(o.next(l))}catch(S){r(S)}},n=l=>{try{c(o.throw(l))}catch(S){r(S)}},c=l=>l.done?s(l.value):Promise.resolve(l.value).then(a,n);c((o=o.apply(d,e)).next())});Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const t=require("zod/v4-mini"),I=require("js-sha256"),y=t.z.object({deep_link:t.z.string(),polling_code:t.z.string(),expired_at:t.z.number()}),T=t.z.object({polling_code:t.z.string()}),j=["pending","authorized","rejected","expired"],x=t.z.enum(j),z=t.z.object({status:x,authorization_code:t.z.optional(t.z.string())}),m=t.z.object({access_token:t.z.string(),token_type:t.z.string(),expires_in:t.z.number(),id_token:t.z.optional(t.z.string()),refresh_token:t.z.string()}),A=t.z.object({sub:t.z.string()}),R=t.z.object({iss:t.z.string(),sub:t.z.string(),aud:t.z.union([t.z.string(),t.z.array(t.z.string())]),exp:t.z.number(),iat:t.z.number(),nonce:t.z.optional(t.z.string()),auth_time:t.z.optional(t.z.number())}),E=m;function _(d){return btoa(d).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function w(d){let e=d.replace(/-/g,"+").replace(/_/g,"/");for(;e.length%4;)e+="=";return atob(e)}const v="https://sso.alien.com",P=5e3,i="alien-sso_",g=i+"refresh_token",p=i+"token_expiry",f=(d,e)=>new URL(e,d).toString(),b=t.z.object({ssoBaseUrl:t.z.url(),providerAddress:t.z.string(),pollingInterval:t.z.optional(t.z.number())}),u=class u{constructor(e){this.config=b.parse(e),this.ssoBaseUrl=this.config.ssoBaseUrl||v,this.providerAddress=this.config.providerAddress,this.pollingInterval=this.config.pollingInterval||P}generateCodeVerifier(e=128){let o;const s=typeof window!="undefined"&&window.crypto;if(s&&s.getRandomValues)o=new Uint8Array(e),s.getRandomValues(o);else{o=new Uint8Array(e);for(let a=0;a<e;a++)o[a]=Math.floor(Math.random()*256)}let r="";for(let a=0;a<o.length;a++)r+=String.fromCharCode(o[a]);return _(r)}generateCodeChallenge(e){const o=I.sha256.array(e),s=String.fromCharCode(...o);return _(s)}generateDeeplink(){return h(this,null,function*(){const e=this.generateCodeVerifier(),o=this.generateCodeChallenge(e);sessionStorage.setItem(i+"code_verifier",e);const s=new URLSearchParams({response_type:"code",response_mode:"json",client_id:this.providerAddress,scope:"openid",code_challenge:o,code_challenge_method:"S256"}),r=`${this.config.ssoBaseUrl}/oauth/authorize?${s.toString()}`,a=yield fetch(r,{method:"GET"});if(!a.ok){const c=yield a.json().catch(()=>({error:a.statusText}));throw new Error(`Authorize failed: ${c.error_description||c.error||a.statusText}`)}const n=yield a.json();return y.parse(n)})}pollAuth(e){return h(this,null,function*(){const o={polling_code:e};T.parse(o);const s=yield fetch(f(this.config.ssoBaseUrl,"/oauth/poll"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(o)});if(!s.ok)throw new Error(`Poll failed: ${s.statusText}`);const r=yield s.json();return z.parse(r)})}exchangeToken(e){return h(this,null,function*(){const o=sessionStorage.getItem(i+"code_verifier");if(!o)throw new Error("Missing code verifier.");const s=new URLSearchParams({grant_type:"authorization_code",code:e,client_id:this.providerAddress,code_verifier:o}),r=yield fetch(f(this.config.ssoBaseUrl,"/oauth/token"),{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:s.toString()});if(!r.ok){const l=yield r.json().catch(()=>({error:r.statusText}));throw new Error(`Token exchange failed: ${l.error_description||l.error||r.statusText}`)}const a=yield r.json(),n=m.parse(a);localStorage.setItem(i+"access_token",n.access_token),n.id_token&&localStorage.setItem(i+"id_token",n.id_token),localStorage.setItem(g,n.refresh_token);const c=Date.now()+n.expires_in*1e3;return localStorage.setItem(p,c.toString()),sessionStorage.removeItem(i+"code_verifier"),n})}verifyAuth(){return h(this,null,function*(){return this.withAutoRefresh(()=>h(this,null,function*(){const e=this.getAccessToken();if(!e)return null;const o=yield fetch(f(this.config.ssoBaseUrl,"/oauth/userinfo"),{method:"GET",headers:{Authorization:`Bearer ${e}`}});if(!o.ok){if(o.status===401){const r=new Error("Unauthorized");throw r.response={status:401},r}return null}const s=yield o.json();return A.parse(s)}))})}getAccessToken(){return localStorage.getItem(i+"access_token")}getIdToken(){return localStorage.getItem(i+"id_token")}getAuthData(){const e=this.getIdToken()||this.getAccessToken();if(!e)return null;const o=e.split(".");if(o.length!==3)return null;let s;try{const n=w(o[0]);s=JSON.parse(n)}catch(n){return null}if(s.alg!=="RS256"||s.typ!=="JWT")return null;let r;try{const n=JSON.parse(w(o[1]));r=R.parse(n)}catch(n){return null}return(Array.isArray(r.aud)?r.aud:[r.aud]).includes(this.providerAddress)?r:null}getSubject(){const e=this.getAuthData();return(e==null?void 0:e.sub)||null}isTokenExpired(){const e=this.getAuthData();return e?Date.now()/1e3>e.exp:!0}logout(){localStorage.removeItem(i+"access_token"),localStorage.removeItem(i+"id_token"),localStorage.removeItem(g),localStorage.removeItem(p),sessionStorage.removeItem(i+"code_verifier")}getRefreshToken(){return localStorage.getItem(g)}hasRefreshToken(){return!!this.getRefreshToken()}isAccessTokenExpired(){const e=localStorage.getItem(p);if(!e)return!0;const o=parseInt(e,10),s=Date.now(),r=300*1e3;return s>=o-r}refreshAccessToken(){return h(this,null,function*(){return u.refreshPromise||(u.refreshPromise=this.doRefreshAccessToken().finally(()=>{u.refreshPromise=null})),u.refreshPromise})}doRefreshAccessToken(){return h(this,null,function*(){const e=this.getRefreshToken();if(console.log("[AlienSsoClient] doRefreshAccessToken, hasRefreshToken:",!!e),!e)throw new Error("No refresh token available");const o=new URLSearchParams({grant_type:"refresh_token",refresh_token:e,client_id:this.providerAddress}),s=yield fetch(f(this.config.ssoBaseUrl,"/oauth/token"),{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:o.toString()});if(console.log("[AlienSsoClient] /oauth/token response status:",s.status),!s.ok){const c=yield s.json().catch(()=>({error:s.statusText}));throw console.log("[AlienSsoClient] /oauth/token error:",c),this.logout(),new Error(`Token refresh failed: ${c.error_description||c.error||s.statusText}`)}const r=yield s.json();console.log("[AlienSsoClient] /oauth/token json keys:",Object.keys(r));const a=m.parse(r);localStorage.setItem(i+"access_token",a.access_token),a.id_token&&localStorage.setItem(i+"id_token",a.id_token),localStorage.setItem(g,a.refresh_token);const n=Date.now()+a.expires_in*1e3;return localStorage.setItem(p,n.toString()),a})}withAutoRefresh(e,o=1){return h(this,null,function*(){var s,r,a;try{return yield e()}catch(n){if((((s=n==null?void 0:n.response)==null?void 0:s.status)===401||((r=n==null?void 0:n.message)==null?void 0:r.includes("401"))||((a=n==null?void 0:n.message)==null?void 0:a.includes("Unauthorized")))&&o>0&&this.hasRefreshToken())try{return yield this.refreshAccessToken(),yield e()}catch(l){throw n}throw n}})}};u.refreshPromise=null;let k=u;exports.AlienSsoClient=k;exports.AlienSsoClientSchema=b;exports.AuthorizeResponseSchema=y;exports.ExchangeCodeResponseSchema=E;exports.PollRequestSchema=T;exports.PollResponseSchema=z;exports.TokenInfoSchema=R;exports.TokenResponseSchema=m;exports.UserInfoResponseSchema=A;

package/dist/index.esm.js

@@ -20,10 +20,10 @@ const T = t.object({
   deep_link: t.string(),
   polling_code: t.string(),
   expired_at: t.number()
-}), b = t.object({
+}), A = t.object({
   polling_code: t.string()
-}), A = ["pending", "authorized", "rejected", "expired"], I = t.enum(A), R = t.object({
-  status: I,
+}), b = ["pending", "authorized", "rejected", "expired"], R = t.enum(b), I = t.object({
+  status: R,
   authorization_code: t.optional(t.string())
 }), k = t.object({
   access_token: t.string(),
@@ -32,9 +32,9 @@ const T = t.object({
   id_token: t.optional(t.string()),
   // Optional - not returned on refresh_token grant
   refresh_token: t.string()
-}), x = t.object({
-  sub: t.string()
 }), j = t.object({
+  sub: t.string()
+}), x = t.object({
   iss: t.string(),
   sub: t.string(),
   aud: t.union([t.string(), t.array(t.string())]),
@@ -43,10 +43,10 @@ const T = t.object({
   nonce: t.optional(t.string()),
   auth_time: t.optional(t.number())
 }), z = k;
-function _(u) {
+function S(u) {
   return btoa(u).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
-function w(u) {
+function _(u) {
   let e = u.replace(/-/g, "+").replace(/_/g, "/");
   for (; e.length % 4; )
     e += "=";
@@ -73,11 +73,11 @@ const E = "https://sso.alien.com", v = 5e3, i = "alien-sso_", g = i + "refresh_t
     let s = "";
     for (let a = 0; a < o.length; a++)
       s += String.fromCharCode(o[a]);
-    return _(s);
+    return S(s);
   }
   generateCodeChallenge(e) {
     const o = y.array(e), r = String.fromCharCode(...o);
-    return _(r);
+    return S(r);
   }
   /**
    * Initiates OAuth2 authorization flow with response_mode=json for SPA
@@ -114,7 +114,7 @@ const E = "https://sso.alien.com", v = 5e3, i = "alien-sso_", g = i + "refresh_t
       const o = {
         polling_code: e
       };
-      b.parse(o);
+      A.parse(o);
       const r = yield fetch(f(this.config.ssoBaseUrl, "/oauth/poll"), {
         method: "POST",
         headers: {
@@ -125,7 +125,7 @@ const E = "https://sso.alien.com", v = 5e3, i = "alien-sso_", g = i + "refresh_t
       if (!r.ok)
         throw new Error(`Poll failed: ${r.statusText}`);
       const s = yield r.json();
-      return R.parse(s);
+      return I.parse(s);
     });
   }
   /**
@@ -190,7 +190,7 @@ const E = "https://sso.alien.com", v = 5e3, i = "alien-sso_", g = i + "refresh_t
           return null;
         }
         const r = yield o.json();
-        return x.parse(r);
+        return j.parse(r);
       }));
     });
   }
@@ -218,7 +218,7 @@ const E = "https://sso.alien.com", v = 5e3, i = "alien-sso_", g = i + "refresh_t
       return null;
     let r;
     try {
-      const n = w(o[0]);
+      const n = _(o[0]);
       r = JSON.parse(n);
     } catch (n) {
       return null;
@@ -227,8 +227,8 @@ const E = "https://sso.alien.com", v = 5e3, i = "alien-sso_", g = i + "refresh_t
       return null;
     let s;
     try {
-      const n = JSON.parse(w(o[1]));
-      s = j.parse(n);
+      const n = JSON.parse(_(o[1]));
+      s = x.parse(n);
     } catch (n) {
       return null;
     }
@@ -293,7 +293,7 @@ const E = "https://sso.alien.com", v = 5e3, i = "alien-sso_", g = i + "refresh_t
   doRefreshAccessToken() {
     return h(this, null, function* () {
       const e = this.getRefreshToken();
-      if (!e)
+      if (console.log("[AlienSsoClient] doRefreshAccessToken, hasRefreshToken:", !!e), !e)
         throw new Error("No refresh token available");
       const o = new URLSearchParams({
         grant_type: "refresh_token",
@@ -309,11 +309,13 @@ const E = "https://sso.alien.com", v = 5e3, i = "alien-sso_", g = i + "refresh_t
           body: o.toString()
         }
       );
-      if (!r.ok) {
+      if (console.log("[AlienSsoClient] /oauth/token response status:", r.status), !r.ok) {
         const c = yield r.json().catch(() => ({ error: r.statusText }));
-        throw this.logout(), new Error(`Token refresh failed: ${c.error_description || c.error || r.statusText}`);
+        throw console.log("[AlienSsoClient] /oauth/token error:", c), this.logout(), new Error(`Token refresh failed: ${c.error_description || c.error || r.statusText}`);
       }
-      const s = yield r.json(), a = k.parse(s);
+      const s = yield r.json();
+      console.log("[AlienSsoClient] /oauth/token json keys:", Object.keys(s));
+      const a = k.parse(s);
       localStorage.setItem(i + "access_token", a.access_token), a.id_token && localStorage.setItem(i + "id_token", a.id_token), localStorage.setItem(g, a.refresh_token);
       const n = Date.now() + a.expires_in * 1e3;
       return localStorage.setItem(p, n.toString()), a;
@@ -341,15 +343,15 @@ const E = "https://sso.alien.com", v = 5e3, i = "alien-sso_", g = i + "refresh_t
   }
 };
 d.refreshPromise = null;
-let S = d;
+let w = d;
 export {
-  S as AlienSsoClient,
+  w as AlienSsoClient,
   U as AlienSsoClientSchema,
   T as AuthorizeResponseSchema,
   z as ExchangeCodeResponseSchema,
-  b as PollRequestSchema,
-  R as PollResponseSchema,
-  j as TokenInfoSchema,
+  A as PollRequestSchema,
+  I as PollResponseSchema,
+  x as TokenInfoSchema,
   k as TokenResponseSchema,
-  x as UserInfoResponseSchema
+  j as UserInfoResponseSchema
 };

package/dist/index.umd.js

@@ -1 +1 @@
-(function(c,e){typeof exports=="object"&&typeof module!="undefined"?e(exports,require("zod/v4-mini"),require("js-sha256")):typeof define=="function"&&define.amd?define(["exports","zod/v4-mini","js-sha256"],e):(c=typeof globalThis!="undefined"?globalThis:c||self,e(c.AlienSsoCore={},c.Zod,c.jsSha256))})(this,(function(c,e,f){"use strict";var h=(c,e,f)=>new Promise((k,m)=>{var T=l=>{try{g(f.next(l))}catch(p){m(p)}},z=l=>{try{g(f.throw(l))}catch(p){m(p)}},g=l=>l.done?k(l.value):Promise.resolve(l.value).then(T,z);g((f=f.apply(c,e)).next())});const k=e.z.object({deep_link:e.z.string(),polling_code:e.z.string(),expired_at:e.z.number()}),m=e.z.object({polling_code:e.z.string()}),T=["pending","authorized","rejected","expired"],z=e.z.enum(T),g=e.z.object({status:z,authorization_code:e.z.optional(e.z.string())}),l=e.z.object({access_token:e.z.string(),token_type:e.z.string(),expires_in:e.z.number(),id_token:e.z.optional(e.z.string()),refresh_token:e.z.string()}),p=e.z.object({sub:e.z.string()}),b=e.z.object({iss:e.z.string(),sub:e.z.string(),aud:e.z.union([e.z.string(),e.z.array(e.z.string())]),exp:e.z.number(),iat:e.z.number(),nonce:e.z.optional(e.z.string()),auth_time:e.z.optional(e.z.number())}),P=l;function I(S){return btoa(S).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function j(S){let t=S.replace(/-/g,"+").replace(/_/g,"/");for(;t.length%4;)t+="=";return atob(t)}const x="https://sso.alien.com",U=5e3,i="alien-sso_",_=i+"refresh_token",w=i+"token_expiry",y=(S,t)=>new URL(t,S).toString(),E=e.z.object({ssoBaseUrl:e.z.url(),providerAddress:e.z.string(),pollingInterval:e.z.optional(e.z.number())}),d=class d{constructor(t){this.config=E.parse(t),this.ssoBaseUrl=this.config.ssoBaseUrl||x,this.providerAddress=this.config.providerAddress,this.pollingInterval=this.config.pollingInterval||U}generateCodeVerifier(t=128){let o;const r=typeof window!="undefined"&&window.crypto;if(r&&r.getRandomValues)o=new Uint8Array(t),r.getRandomValues(o);else{o=new Uint8Array(t);for(let a=0;a<t;a++)o[a]=Math.floor(Math.random()*256)}let s="";for(let a=0;a<o.length;a++)s+=String.fromCharCode(o[a]);return I(s)}generateCodeChallenge(t){const o=f.sha256.array(t),r=String.fromCharCode(...o);return I(r)}generateDeeplink(){return h(this,null,function*(){const t=this.generateCodeVerifier(),o=this.generateCodeChallenge(t);sessionStorage.setItem(i+"code_verifier",t);const r=new URLSearchParams({response_type:"code",response_mode:"json",client_id:this.providerAddress,scope:"openid",code_challenge:o,code_challenge_method:"S256"}),s=`${this.config.ssoBaseUrl}/oauth/authorize?${r.toString()}`,a=yield fetch(s,{method:"GET"});if(!a.ok){const u=yield a.json().catch(()=>({error:a.statusText}));throw new Error(`Authorize failed: ${u.error_description||u.error||a.statusText}`)}const n=yield a.json();return k.parse(n)})}pollAuth(t){return h(this,null,function*(){const o={polling_code:t};m.parse(o);const r=yield fetch(y(this.config.ssoBaseUrl,"/oauth/poll"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(o)});if(!r.ok)throw new Error(`Poll failed: ${r.statusText}`);const s=yield r.json();return g.parse(s)})}exchangeToken(t){return h(this,null,function*(){const o=sessionStorage.getItem(i+"code_verifier");if(!o)throw new Error("Missing code verifier.");const r=new URLSearchParams({grant_type:"authorization_code",code:t,client_id:this.providerAddress,code_verifier:o}),s=yield fetch(y(this.config.ssoBaseUrl,"/oauth/token"),{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:r.toString()});if(!s.ok){const R=yield s.json().catch(()=>({error:s.statusText}));throw new Error(`Token exchange failed: ${R.error_description||R.error||s.statusText}`)}const a=yield s.json(),n=l.parse(a);localStorage.setItem(i+"access_token",n.access_token),n.id_token&&localStorage.setItem(i+"id_token",n.id_token),localStorage.setItem(_,n.refresh_token);const u=Date.now()+n.expires_in*1e3;return localStorage.setItem(w,u.toString()),sessionStorage.removeItem(i+"code_verifier"),n})}verifyAuth(){return h(this,null,function*(){return this.withAutoRefresh(()=>h(this,null,function*(){const t=this.getAccessToken();if(!t)return null;const o=yield fetch(y(this.config.ssoBaseUrl,"/oauth/userinfo"),{method:"GET",headers:{Authorization:`Bearer ${t}`}});if(!o.ok){if(o.status===401){const s=new Error("Unauthorized");throw s.response={status:401},s}return null}const r=yield o.json();return p.parse(r)}))})}getAccessToken(){return localStorage.getItem(i+"access_token")}getIdToken(){return localStorage.getItem(i+"id_token")}getAuthData(){const t=this.getIdToken()||this.getAccessToken();if(!t)return null;const o=t.split(".");if(o.length!==3)return null;let r;try{const n=j(o[0]);r=JSON.parse(n)}catch(n){return null}if(r.alg!=="RS256"||r.typ!=="JWT")return null;let s;try{const n=JSON.parse(j(o[1]));s=b.parse(n)}catch(n){return null}return(Array.isArray(s.aud)?s.aud:[s.aud]).includes(this.providerAddress)?s:null}getSubject(){const t=this.getAuthData();return(t==null?void 0:t.sub)||null}isTokenExpired(){const t=this.getAuthData();return t?Date.now()/1e3>t.exp:!0}logout(){localStorage.removeItem(i+"access_token"),localStorage.removeItem(i+"id_token"),localStorage.removeItem(_),localStorage.removeItem(w),sessionStorage.removeItem(i+"code_verifier")}getRefreshToken(){return localStorage.getItem(_)}hasRefreshToken(){return!!this.getRefreshToken()}isAccessTokenExpired(){const t=localStorage.getItem(w);if(!t)return!0;const o=parseInt(t,10),r=Date.now(),s=300*1e3;return r>=o-s}refreshAccessToken(){return h(this,null,function*(){return d.refreshPromise||(d.refreshPromise=this.doRefreshAccessToken().finally(()=>{d.refreshPromise=null})),d.refreshPromise})}doRefreshAccessToken(){return h(this,null,function*(){const t=this.getRefreshToken();if(!t)throw new Error("No refresh token available");const o=new URLSearchParams({grant_type:"refresh_token",refresh_token:t,client_id:this.providerAddress}),r=yield fetch(y(this.config.ssoBaseUrl,"/oauth/token"),{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:o.toString()});if(!r.ok){const u=yield r.json().catch(()=>({error:r.statusText}));throw this.logout(),new Error(`Token refresh failed: ${u.error_description||u.error||r.statusText}`)}const s=yield r.json(),a=l.parse(s);localStorage.setItem(i+"access_token",a.access_token),a.id_token&&localStorage.setItem(i+"id_token",a.id_token),localStorage.setItem(_,a.refresh_token);const n=Date.now()+a.expires_in*1e3;return localStorage.setItem(w,n.toString()),a})}withAutoRefresh(t,o=1){return h(this,null,function*(){var r,s,a;try{return yield t()}catch(n){if((((r=n==null?void 0:n.response)==null?void 0:r.status)===401||((s=n==null?void 0:n.message)==null?void 0:s.includes("401"))||((a=n==null?void 0:n.message)==null?void 0:a.includes("Unauthorized")))&&o>0&&this.hasRefreshToken())try{return yield this.refreshAccessToken(),yield t()}catch(R){throw n}throw n}})}};d.refreshPromise=null;let A=d;c.AlienSsoClient=A,c.AlienSsoClientSchema=E,c.AuthorizeResponseSchema=k,c.ExchangeCodeResponseSchema=P,c.PollRequestSchema=m,c.PollResponseSchema=g,c.TokenInfoSchema=b,c.TokenResponseSchema=l,c.UserInfoResponseSchema=p,Object.defineProperty(c,Symbol.toStringTag,{value:"Module"})}));
+(function(c,t){typeof exports=="object"&&typeof module!="undefined"?t(exports,require("zod/v4-mini"),require("js-sha256")):typeof define=="function"&&define.amd?define(["exports","zod/v4-mini","js-sha256"],t):(c=typeof globalThis!="undefined"?globalThis:c||self,t(c.AlienSsoCore={},c.Zod,c.jsSha256))})(this,(function(c,t,g){"use strict";var d=(c,t,g)=>new Promise((k,m)=>{var T=l=>{try{f(g.next(l))}catch(p){m(p)}},z=l=>{try{f(g.throw(l))}catch(p){m(p)}},f=l=>l.done?k(l.value):Promise.resolve(l.value).then(T,z);f((g=g.apply(c,t)).next())});const k=t.z.object({deep_link:t.z.string(),polling_code:t.z.string(),expired_at:t.z.number()}),m=t.z.object({polling_code:t.z.string()}),T=["pending","authorized","rejected","expired"],z=t.z.enum(T),f=t.z.object({status:z,authorization_code:t.z.optional(t.z.string())}),l=t.z.object({access_token:t.z.string(),token_type:t.z.string(),expires_in:t.z.number(),id_token:t.z.optional(t.z.string()),refresh_token:t.z.string()}),p=t.z.object({sub:t.z.string()}),b=t.z.object({iss:t.z.string(),sub:t.z.string(),aud:t.z.union([t.z.string(),t.z.array(t.z.string())]),exp:t.z.number(),iat:t.z.number(),nonce:t.z.optional(t.z.string()),auth_time:t.z.optional(t.z.number())}),C=l;function j(S){return btoa(S).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function I(S){let e=S.replace(/-/g,"+").replace(/_/g,"/");for(;e.length%4;)e+="=";return atob(e)}const P="https://sso.alien.com",x=5e3,i="alien-sso_",_=i+"refresh_token",w=i+"token_expiry",y=(S,e)=>new URL(e,S).toString(),E=t.z.object({ssoBaseUrl:t.z.url(),providerAddress:t.z.string(),pollingInterval:t.z.optional(t.z.number())}),u=class u{constructor(e){this.config=E.parse(e),this.ssoBaseUrl=this.config.ssoBaseUrl||P,this.providerAddress=this.config.providerAddress,this.pollingInterval=this.config.pollingInterval||x}generateCodeVerifier(e=128){let s;const o=typeof window!="undefined"&&window.crypto;if(o&&o.getRandomValues)s=new Uint8Array(e),o.getRandomValues(s);else{s=new Uint8Array(e);for(let a=0;a<e;a++)s[a]=Math.floor(Math.random()*256)}let r="";for(let a=0;a<s.length;a++)r+=String.fromCharCode(s[a]);return j(r)}generateCodeChallenge(e){const s=g.sha256.array(e),o=String.fromCharCode(...s);return j(o)}generateDeeplink(){return d(this,null,function*(){const e=this.generateCodeVerifier(),s=this.generateCodeChallenge(e);sessionStorage.setItem(i+"code_verifier",e);const o=new URLSearchParams({response_type:"code",response_mode:"json",client_id:this.providerAddress,scope:"openid",code_challenge:s,code_challenge_method:"S256"}),r=`${this.config.ssoBaseUrl}/oauth/authorize?${o.toString()}`,a=yield fetch(r,{method:"GET"});if(!a.ok){const h=yield a.json().catch(()=>({error:a.statusText}));throw new Error(`Authorize failed: ${h.error_description||h.error||a.statusText}`)}const n=yield a.json();return k.parse(n)})}pollAuth(e){return d(this,null,function*(){const s={polling_code:e};m.parse(s);const o=yield fetch(y(this.config.ssoBaseUrl,"/oauth/poll"),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(s)});if(!o.ok)throw new Error(`Poll failed: ${o.statusText}`);const r=yield o.json();return f.parse(r)})}exchangeToken(e){return d(this,null,function*(){const s=sessionStorage.getItem(i+"code_verifier");if(!s)throw new Error("Missing code verifier.");const o=new URLSearchParams({grant_type:"authorization_code",code:e,client_id:this.providerAddress,code_verifier:s}),r=yield fetch(y(this.config.ssoBaseUrl,"/oauth/token"),{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:o.toString()});if(!r.ok){const R=yield r.json().catch(()=>({error:r.statusText}));throw new Error(`Token exchange failed: ${R.error_description||R.error||r.statusText}`)}const a=yield r.json(),n=l.parse(a);localStorage.setItem(i+"access_token",n.access_token),n.id_token&&localStorage.setItem(i+"id_token",n.id_token),localStorage.setItem(_,n.refresh_token);const h=Date.now()+n.expires_in*1e3;return localStorage.setItem(w,h.toString()),sessionStorage.removeItem(i+"code_verifier"),n})}verifyAuth(){return d(this,null,function*(){return this.withAutoRefresh(()=>d(this,null,function*(){const e=this.getAccessToken();if(!e)return null;const s=yield fetch(y(this.config.ssoBaseUrl,"/oauth/userinfo"),{method:"GET",headers:{Authorization:`Bearer ${e}`}});if(!s.ok){if(s.status===401){const r=new Error("Unauthorized");throw r.response={status:401},r}return null}const o=yield s.json();return p.parse(o)}))})}getAccessToken(){return localStorage.getItem(i+"access_token")}getIdToken(){return localStorage.getItem(i+"id_token")}getAuthData(){const e=this.getIdToken()||this.getAccessToken();if(!e)return null;const s=e.split(".");if(s.length!==3)return null;let o;try{const n=I(s[0]);o=JSON.parse(n)}catch(n){return null}if(o.alg!=="RS256"||o.typ!=="JWT")return null;let r;try{const n=JSON.parse(I(s[1]));r=b.parse(n)}catch(n){return null}return(Array.isArray(r.aud)?r.aud:[r.aud]).includes(this.providerAddress)?r:null}getSubject(){const e=this.getAuthData();return(e==null?void 0:e.sub)||null}isTokenExpired(){const e=this.getAuthData();return e?Date.now()/1e3>e.exp:!0}logout(){localStorage.removeItem(i+"access_token"),localStorage.removeItem(i+"id_token"),localStorage.removeItem(_),localStorage.removeItem(w),sessionStorage.removeItem(i+"code_verifier")}getRefreshToken(){return localStorage.getItem(_)}hasRefreshToken(){return!!this.getRefreshToken()}isAccessTokenExpired(){const e=localStorage.getItem(w);if(!e)return!0;const s=parseInt(e,10),o=Date.now(),r=300*1e3;return o>=s-r}refreshAccessToken(){return d(this,null,function*(){return u.refreshPromise||(u.refreshPromise=this.doRefreshAccessToken().finally(()=>{u.refreshPromise=null})),u.refreshPromise})}doRefreshAccessToken(){return d(this,null,function*(){const e=this.getRefreshToken();if(console.log("[AlienSsoClient] doRefreshAccessToken, hasRefreshToken:",!!e),!e)throw new Error("No refresh token available");const s=new URLSearchParams({grant_type:"refresh_token",refresh_token:e,client_id:this.providerAddress}),o=yield fetch(y(this.config.ssoBaseUrl,"/oauth/token"),{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:s.toString()});if(console.log("[AlienSsoClient] /oauth/token response status:",o.status),!o.ok){const h=yield o.json().catch(()=>({error:o.statusText}));throw console.log("[AlienSsoClient] /oauth/token error:",h),this.logout(),new Error(`Token refresh failed: ${h.error_description||h.error||o.statusText}`)}const r=yield o.json();console.log("[AlienSsoClient] /oauth/token json keys:",Object.keys(r));const a=l.parse(r);localStorage.setItem(i+"access_token",a.access_token),a.id_token&&localStorage.setItem(i+"id_token",a.id_token),localStorage.setItem(_,a.refresh_token);const n=Date.now()+a.expires_in*1e3;return localStorage.setItem(w,n.toString()),a})}withAutoRefresh(e,s=1){return d(this,null,function*(){var o,r,a;try{return yield e()}catch(n){if((((o=n==null?void 0:n.response)==null?void 0:o.status)===401||((r=n==null?void 0:n.message)==null?void 0:r.includes("401"))||((a=n==null?void 0:n.message)==null?void 0:a.includes("Unauthorized")))&&s>0&&this.hasRefreshToken())try{return yield this.refreshAccessToken(),yield e()}catch(R){throw n}throw n}})}};u.refreshPromise=null;let A=u;c.AlienSsoClient=A,c.AlienSsoClientSchema=E,c.AuthorizeResponseSchema=k,c.ExchangeCodeResponseSchema=C,c.PollRequestSchema=m,c.PollResponseSchema=f,c.TokenInfoSchema=b,c.TokenResponseSchema=l,c.UserInfoResponseSchema=p,Object.defineProperty(c,Symbol.toStringTag,{value:"Module"})}));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alien_org/sso-sdk-core",
-  "version": "1.0.21",
+  "version": "1.0.22",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/alien-id/sso-sdk-js.git"