@atlasauth/js 0.23.1 → 0.25.0

package/dist/connections.d.ts

@@ -0,0 +1,161 @@
+import type { FapiClient } from './fapi';
+/**
+ * Connected accounts: the connections an app defined for the signed-in user or
+ * their active organization (an API key or client-credentials the org entered, or
+ * an OAuth account a member shared), with live status. Authorizing an OAuth
+ * connection uses `connectExternalAccount` / `reauthorizeExternalAccount`.
+ */
+export type ConnectionStatus = 'connected' | 'not_connected' | 'needs_reauth' | 'revoked' | 'error';
+export interface AppConnection {
+    object: 'connection';
+    id: string;
+    owner: {
+        type: 'organization' | 'user';
+        id: string;
+    };
+    kind: 'oauth' | 'api_key' | 'client_credentials' | 'bearer' | 'basic' | 'custom_header' | 'hmac_secret' | 'jwt_bearer' | 'oauth1' | 'github_app_installation' | 'admin_consent';
+    provider: string;
+    name: string;
+    allowed_hosts: string[];
+    status: ConnectionStatus;
+    /** Always `data`: a connection is never a sign-in method. */
+    purpose?: 'data';
+    environment?: 'production' | 'sandbox';
+    sandbox?: boolean;
+    /** The provider-side account the connection covers (a company, a workspace, a user id). */
+    external_id?: string | null;
+    host_params?: Record<string, string>;
+    scopes?: string[];
+    expires_at?: number | null;
+    /** Non-secret provider handles captured with the token (realmId, instance_url, team_id...). */
+    metadata?: Record<string, string>;
+    /** The provider's own error behind the status (`invalid_grant`, ...), with the HTTP status it answered. */
+    last_error?: {
+        code: string;
+        message: string;
+        httpStatus?: number | null;
+        at: number;
+    } | null;
+    /** Consecutive failed refreshes; 0 when healthy. */
+    refresh_failures?: number;
+    /** @deprecated Always null: a connection owns its tokens. */
+    external_account_id: string | null;
+    has_secret: boolean;
+    /** When the entered credential expires (epoch ms). The credential itself is never readable from the browser. */
+    secret_expires_at?: number | null;
+}
+/** What the provider said when a connection was disconnected. The stored token is cleared in every case. */
+export interface ConnectionRevokeResult {
+    /** `true` the provider confirmed; `'unsupported'` it has no revoke endpoint; `false` it refused or was unreachable (see `provider_error`). */
+    provider_revoked: boolean | 'unsupported' | 'not_connected';
+    provider_status: number | null;
+    provider_error: {
+        code: string;
+        description: string | null;
+    } | null;
+    local_cleared: true;
+}
+/** What to send when starting the provider authorization of a connection. */
+export interface ConnectConnectionInput {
+    /** Where the owner lands afterwards; the URL carries `__atlas_status=connected` and `__atlas_connection=<id>`. */
+    redirectUrl: string;
+    /** Values for the provider's host templates, e.g. `{ subdomain: 'acme' }` or `{ tenant: 'contoso.onmicrosoft.com' }`. */
+    hostParams?: Record<string, string>;
+    environment?: 'production' | 'sandbox';
+    additionalScopes?: string[];
+    loginHint?: string;
+    display?: 'redirect' | 'popup';
+    /** A different provider account than the connection holds creates a sibling instead of failing with 409. */
+    createIfNew?: boolean;
+}
+export interface ConnectionAuthorization {
+    object: 'connection_authorization';
+    connection_id: string;
+    authorization_url: string;
+    attempt_id: string;
+}
+/** An organization's own OAuth client for a provider (the secret is write-only). */
+export interface ConnectionOAuthClient {
+    object: 'connection_oauth_client';
+    id: string;
+    provider: string;
+    environment: 'production' | 'sandbox';
+    client_id: string;
+    has_secret: true;
+    scopes: string[];
+    host_params: Record<string, string>;
+    enabled: boolean;
+    callback_url: string;
+}
+export interface SetConnectionOAuthClientInput {
+    provider: string;
+    environment?: 'production' | 'sandbox';
+    clientId: string;
+    /** Required the first time; omit to keep the stored secret. */
+    clientSecret?: string;
+    scopes?: string[];
+    hostParams?: Record<string, string>;
+    enabled?: boolean;
+}
+/**
+ * Credential to enter for a non-OAuth connection. Write-only: it is sealed server-side and no browser call can read it
+ * back. Which fields apply depends on the connection's kind.
+ */
+export interface ConnectionCredentialsInput {
+    /** api_key */
+    apiKey?: string;
+    /** bearer */
+    token?: string;
+    /** basic */
+    username?: string;
+    password?: string;
+    /** custom_header */
+    value?: string;
+    /** hmac_secret */
+    secret?: string;
+    /** client_credentials */
+    clientId?: string;
+    clientSecret?: string;
+    tokenUrl?: string;
+    /** jwt_bearer / github_app_installation: a PEM private key, or (jwt_bearer) a Google service-account JSON key. */
+    privateKey?: string;
+    serviceAccountJson?: string;
+    /** oauth1 */
+    consumerKey?: string;
+    consumerSecret?: string;
+    tokenSecret?: string;
+    /** Epoch milliseconds or an ISO date; reminders go out 30, 7 and 1 days before. */
+    expiresAt?: number | string;
+    /** Non-secret settings of the kind (placement, header name, algorithm...). */
+    config?: Record<string, unknown>;
+}
+export declare class ConnectionRequestError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message: string);
+}
+/** The signed-in user's own connections. */
+export declare function listMyConnections(client: FapiClient): Promise<AppConnection[]>;
+/** The active organization's connections. */
+export declare function listOrganizationConnections(client: FapiClient, organizationId: string): Promise<AppConnection[]>;
+/** Enter the organization's credential for a connection (needs the org profile-manage permission). */
+export declare function setOrganizationConnectionCredentials(client: FapiClient, organizationId: string, connectionId: string, input: ConnectionCredentialsInput): Promise<AppConnection>;
+/** Share the signed-in admin's own linked provider account with the organization. */
+export declare function shareOrganizationConnection(client: FapiClient, organizationId: string, connectionId: string): Promise<AppConnection>;
+/**
+ * Connect (or reconnect) one of the signed-in user's own connections. Navigate to `authorization_url`. This stores the
+ * tokens on the connection: it adds no sign-in method and needs no step-up.
+ */
+export declare function connectMyConnection(client: FapiClient, connectionId: string, input: ConnectConnectionInput): Promise<ConnectionAuthorization>;
+/** Disconnect one of the signed-in user's own connections. The answer says whether the provider confirmed the revoke. */
+export declare function revokeMyConnection(client: FapiClient, connectionId: string): Promise<AppConnection & ConnectionRevokeResult>;
+/** Connect (or reconnect) an organization's connection (needs the org profile-manage permission, not a step-up). */
+export declare function connectOrganizationConnection(client: FapiClient, organizationId: string, connectionId: string, input: ConnectConnectionInput): Promise<ConnectionAuthorization>;
+/** Disconnect an organization's connection. */
+export declare function revokeOrganizationConnection(client: FapiClient, organizationId: string, connectionId: string): Promise<AppConnection & ConnectionRevokeResult>;
+/** The organization's own OAuth clients. */
+export declare function listOrganizationOAuthClients(client: FapiClient, organizationId: string): Promise<ConnectionOAuthClient[]>;
+/** Set the organization's own OAuth client for a provider; it overrides the instance client for its connections. */
+export declare function setOrganizationOAuthClient(client: FapiClient, organizationId: string, input: SetConnectionOAuthClientInput): Promise<ConnectionOAuthClient>;
+/** Delete the organization's OAuth client (refused while its connections hold tokens it issued). */
+export declare function deleteOrganizationOAuthClient(client: FapiClient, organizationId: string, clientId: string): Promise<void>;

package/dist/connections.js

@@ -0,0 +1,117 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConnectionRequestError = void 0;
+exports.listMyConnections = listMyConnections;
+exports.listOrganizationConnections = listOrganizationConnections;
+exports.setOrganizationConnectionCredentials = setOrganizationConnectionCredentials;
+exports.shareOrganizationConnection = shareOrganizationConnection;
+exports.connectMyConnection = connectMyConnection;
+exports.revokeMyConnection = revokeMyConnection;
+exports.connectOrganizationConnection = connectOrganizationConnection;
+exports.revokeOrganizationConnection = revokeOrganizationConnection;
+exports.listOrganizationOAuthClients = listOrganizationOAuthClients;
+exports.setOrganizationOAuthClient = setOrganizationOAuthClient;
+exports.deleteOrganizationOAuthClient = deleteOrganizationOAuthClient;
+class ConnectionRequestError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = 'ConnectionRequestError';
+    }
+}
+exports.ConnectionRequestError = ConnectionRequestError;
+async function call(client, path, init) {
+    const res = await client.request(path, init);
+    if (!res.ok || !res.data) {
+        const first = res.errors[0];
+        throw new ConnectionRequestError(res.status, first?.code ?? 'UNKNOWN', first?.message ?? 'The request failed.');
+    }
+    return res.data;
+}
+const orgBase = (organizationId) => `/v1/client/organizations/${encodeURIComponent(organizationId)}/connections`;
+/** The signed-in user's own connections. */
+async function listMyConnections(client) {
+    return (await call(client, '/v1/client/me/connections', { method: 'GET' })).data ?? [];
+}
+/** The active organization's connections. */
+async function listOrganizationConnections(client, organizationId) {
+    return (await call(client, orgBase(organizationId), { method: 'GET' })).data ?? [];
+}
+/** Enter the organization's credential for a connection (needs the org profile-manage permission). */
+function setOrganizationConnectionCredentials(client, organizationId, connectionId, input) {
+    const map = [
+        ['apiKey', 'api_key'], ['token', 'token'], ['username', 'username'], ['password', 'password'], ['value', 'value'], ['secret', 'secret'],
+        ['clientId', 'client_id'], ['clientSecret', 'client_secret'], ['tokenUrl', 'token_url'], ['privateKey', 'private_key'],
+        ['serviceAccountJson', 'service_account_json'], ['consumerKey', 'consumer_key'], ['consumerSecret', 'consumer_secret'],
+        ['tokenSecret', 'token_secret'], ['expiresAt', 'expires_at'], ['config', 'config'],
+    ];
+    const body = {};
+    for (const [from, to] of map)
+        if (input[from] !== undefined)
+            body[to] = input[from];
+    return call(client, `${orgBase(organizationId)}/${encodeURIComponent(connectionId)}/credentials`, { method: 'PUT', body: JSON.stringify(body) });
+}
+/** Share the signed-in admin's own linked provider account with the organization. */
+function shareOrganizationConnection(client, organizationId, connectionId) {
+    return call(client, `${orgBase(organizationId)}/${encodeURIComponent(connectionId)}/share`, { method: 'POST', body: '{}' });
+}
+const connectBody = (i) => ({
+    redirect_url: i.redirectUrl,
+    ...(i.hostParams ? { host_params: i.hostParams } : {}),
+    ...(i.environment ? { environment: i.environment } : {}),
+    ...(i.additionalScopes ? { additional_scopes: i.additionalScopes } : {}),
+    ...(i.loginHint ? { login_hint: i.loginHint } : {}),
+    ...(i.display ? { display: i.display } : {}),
+    ...(i.createIfNew ? { create_if_new: true } : {}),
+});
+/**
+ * Connect (or reconnect) one of the signed-in user's own connections. Navigate to `authorization_url`. This stores the
+ * tokens on the connection: it adds no sign-in method and needs no step-up.
+ */
+function connectMyConnection(client, connectionId, input) {
+    return call(client, `/v1/client/me/connections/${encodeURIComponent(connectionId)}/connect`, { method: 'POST', body: JSON.stringify(connectBody(input)) });
+}
+/** Disconnect one of the signed-in user's own connections. The answer says whether the provider confirmed the revoke. */
+function revokeMyConnection(client, connectionId) {
+    return call(client, `/v1/client/me/connections/${encodeURIComponent(connectionId)}/revoke`, { method: 'POST', body: '{}' });
+}
+/** Connect (or reconnect) an organization's connection (needs the org profile-manage permission, not a step-up). */
+function connectOrganizationConnection(client, organizationId, connectionId, input) {
+    return call(client, `${orgBase(organizationId)}/${encodeURIComponent(connectionId)}/connect`, { method: 'POST', body: JSON.stringify(connectBody(input)) });
+}
+/** Disconnect an organization's connection. */
+function revokeOrganizationConnection(client, organizationId, connectionId) {
+    return call(client, `${orgBase(organizationId)}/${encodeURIComponent(connectionId)}/revoke`, { method: 'POST', body: '{}' });
+}
+const clientsBase = (organizationId) => `/v1/client/organizations/${encodeURIComponent(organizationId)}/connection_oauth_clients`;
+/** The organization's own OAuth clients. */
+async function listOrganizationOAuthClients(client, organizationId) {
+    return (await call(client, clientsBase(organizationId), { method: 'GET' })).data ?? [];
+}
+/** Set the organization's own OAuth client for a provider; it overrides the instance client for its connections. */
+function setOrganizationOAuthClient(client, organizationId, input) {
+    return call(client, clientsBase(organizationId), {
+        method: 'PUT',
+        body: JSON.stringify({
+            provider: input.provider,
+            ...(input.environment ? { environment: input.environment } : {}),
+            client_id: input.clientId,
+            ...(input.clientSecret ? { client_secret: input.clientSecret } : {}),
+            ...(input.scopes ? { scopes: input.scopes } : {}),
+            ...(input.hostParams ? { host_params: input.hostParams } : {}),
+            ...(input.enabled !== undefined ? { enabled: input.enabled } : {}),
+        }),
+    });
+}
+/** Delete the organization's OAuth client (refused while its connections hold tokens it issued). */
+async function deleteOrganizationOAuthClient(client, organizationId, clientId) {
+    const res = await client.request(`${clientsBase(organizationId)}/${encodeURIComponent(clientId)}`, { method: 'DELETE' });
+    if (!res.ok) {
+        const first = res.errors[0];
+        throw new ConnectionRequestError(res.status, first?.code ?? 'UNKNOWN', first?.message ?? 'The request failed.');
+    }
+}
+//# sourceMappingURL=connections.js.map

package/dist/connections.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connections.js","sourceRoot":"","sources":["../src/connections.ts"],"names":[],"mappings":";;;AAwJA,8CAEC;AAGD,kEAEC;AAGD,oFAeC;AAGD,kEAEC;AAgBD,kDAEC;AAGD,gDAEC;AAGD,sEAEC;AAGD,oEAEC;AAKD,oEAEC;AAGD,gEAaC;AAGD,sEAMC;AAtHD,MAAa,sBAAuB,SAAQ,KAAK;IAEpC;IACA;IAFX,YACW,MAAc,EACd,IAAY,EACrB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAIrB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AATD,wDASC;AAED,KAAK,UAAU,IAAI,CAAI,MAAkB,EAAE,IAAY,EAAE,IAAiB;IACxE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAI,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,sBAAsB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS,EAAE,KAAK,EAAE,OAAO,IAAI,qBAAqB,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,cAAsB,EAAE,EAAE,CAAC,4BAA4B,kBAAkB,CAAC,cAAc,CAAC,cAAc,CAAC;AAEzH,4CAA4C;AACrC,KAAK,UAAU,iBAAiB,CAAC,MAAkB;IACxD,OAAO,CAAC,MAAM,IAAI,CAA4B,MAAM,EAAE,2BAA2B,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AACpH,CAAC;AAED,6CAA6C;AACtC,KAAK,UAAU,2BAA2B,CAAC,MAAkB,EAAE,cAAsB;IAC1F,OAAO,CAAC,MAAM,IAAI,CAA4B,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AAChH,CAAC;AAED,sGAAsG;AACtG,SAAgB,oCAAoC,CAClD,MAAkB,EAClB,cAAsB,EACtB,YAAoB,EACpB,KAAiC;IAEjC,MAAM,GAAG,GAAsD;QAC7D,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;QACvI,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC;QACtH,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,EAAE,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;QACtH,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;KACnF,CAAC;IACF,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG;QAAE,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,IAAI,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACpF,OAAO,IAAI,CAAgB,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,kBAAkB,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAClK,CAAC;AAED,qFAAqF;AACrF,SAAgB,2BAA2B,CAAC,MAAkB,EAAE,cAAsB,EAAE,YAAoB;IAC1G,OAAO,IAAI,CAAgB,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,kBAAkB,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAC7I,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,CAAyB,EAAE,EAAE,CAAC,CAAC;IAClD,YAAY,EAAE,CAAC,CAAC,WAAW;IAC3B,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CAClD,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,MAAkB,EAAE,YAAoB,EAAE,KAA6B;IACzG,OAAO,IAAI,CAA0B,MAAM,EAAE,6BAA6B,kBAAkB,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;AACtL,CAAC;AAED,yHAAyH;AACzH,SAAgB,kBAAkB,CAAC,MAAkB,EAAE,YAAoB;IACzE,OAAO,IAAI,CAAyC,MAAM,EAAE,6BAA6B,kBAAkB,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AACtK,CAAC;AAED,oHAAoH;AACpH,SAAgB,6BAA6B,CAAC,MAAkB,EAAE,cAAsB,EAAE,YAAoB,EAAE,KAA6B;IAC3I,OAAO,IAAI,CAA0B,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,kBAAkB,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;AACvL,CAAC;AAED,+CAA+C;AAC/C,SAAgB,4BAA4B,CAAC,MAAkB,EAAE,cAAsB,EAAE,YAAoB;IAC3G,OAAO,IAAI,CAAyC,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,kBAAkB,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AACvK,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,cAAsB,EAAE,EAAE,CAAC,4BAA4B,kBAAkB,CAAC,cAAc,CAAC,2BAA2B,CAAC;AAE1I,4CAA4C;AACrC,KAAK,UAAU,4BAA4B,CAAC,MAAkB,EAAE,cAAsB;IAC3F,OAAO,CAAC,MAAM,IAAI,CAAoC,MAAM,EAAE,WAAW,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AAC5H,CAAC;AAED,oHAAoH;AACpH,SAAgB,0BAA0B,CAAC,MAAkB,EAAE,cAAsB,EAAE,KAAoC;IACzH,OAAO,IAAI,CAAwB,MAAM,EAAE,WAAW,CAAC,cAAc,CAAC,EAAE;QACtE,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,SAAS,EAAE,KAAK,CAAC,QAAQ;YACzB,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,oGAAoG;AAC7F,KAAK,UAAU,6BAA6B,CAAC,MAAkB,EAAE,cAAsB,EAAE,QAAgB;IAC9G,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAU,GAAG,WAAW,CAAC,cAAc,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClI,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,sBAAsB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS,EAAE,KAAK,EAAE,OAAO,IAAI,qBAAqB,CAAC,CAAC;IAClH,CAAC;AACH,CAAC"}

package/dist/credentials.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Wallet-side helpers for Atlas verifiable credentials (OpenID4VCI / OpenID4VP,
+ * SD-JWT VC): redeem a credential offer, hold the credential with its device
+ * key, and build a selective presentation. For web wallets, tests and demos.
+ * Uses WebCrypto (ES256) only. mdoc credentials are received as-is
+ * (`format: 'mso_mdoc'`); building an mdoc DeviceResponse is a native-wallet job.
+ */
+export interface CredentialOffer {
+    credential_issuer: string;
+    credential_configuration_ids: string[];
+    grants?: Record<string, {
+        'pre-authorized_code'?: string;
+        tx_code?: {
+            length?: number;
+        };
+    }>;
+}
+/** The offer inside an `openid-credential-offer://` link (or an https link carrying `credential_offer`). */
+export declare function parseCredentialOffer(link: string): CredentialOffer;
+export interface HolderKey {
+    privateJwk: JsonWebKey;
+    publicJwk: JsonWebKey;
+}
+/** A fresh P-256 device key. */
+export declare function generateHolderKey(): Promise<HolderKey>;
+export interface ReceivedCredential extends HolderKey {
+    credential: string;
+    format: 'dc+sd-jwt' | 'mso_mdoc';
+}
+/** Redeem an offer (pre-authorized code flow) and receive the credential bound to a new device key. */
+export declare function receiveCredential(offer: CredentialOffer, opts?: {
+    txCode?: string;
+    fetch?: typeof fetch;
+    key?: HolderKey;
+    configurationId?: string;
+}): Promise<ReceivedCredential>;
+/**
+ * Build an SD-JWT VC presentation revealing only the claims in `reveal`, with a
+ * key-binding JWT over `aud` and `nonce` (from the verifier's request object).
+ */
+export declare function presentSdJwt(input: {
+    credential: string;
+    reveal: string[];
+    aud: string;
+    nonce: string;
+    privateJwk: JsonWebKey;
+}): Promise<string>;

package/dist/credentials.js

@@ -0,0 +1,95 @@
+"use strict";
+/**
+ * Wallet-side helpers for Atlas verifiable credentials (OpenID4VCI / OpenID4VP,
+ * SD-JWT VC): redeem a credential offer, hold the credential with its device
+ * key, and build a selective presentation. For web wallets, tests and demos.
+ * Uses WebCrypto (ES256) only. mdoc credentials are received as-is
+ * (`format: 'mso_mdoc'`); building an mdoc DeviceResponse is a native-wallet job.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseCredentialOffer = parseCredentialOffer;
+exports.generateHolderKey = generateHolderKey;
+exports.receiveCredential = receiveCredential;
+exports.presentSdJwt = presentSdJwt;
+const PRE_AUTH = 'urn:ietf:params:oauth:grant-type:pre-authorized_code';
+/** The offer inside an `openid-credential-offer://` link (or an https link carrying `credential_offer`). */
+function parseCredentialOffer(link) {
+    const raw = new URL(link).searchParams.get('credential_offer');
+    if (!raw)
+        throw new Error('The link does not carry a credential_offer.');
+    const offer = JSON.parse(raw);
+    if (typeof offer.credential_issuer !== 'string' || !Array.isArray(offer.credential_configuration_ids)) {
+        throw new Error('Malformed credential offer.');
+    }
+    return offer;
+}
+const enc = new TextEncoder();
+const b64u = (b) => {
+    const bytes = b instanceof Uint8Array ? b : new Uint8Array(b);
+    let s = '';
+    for (const x of bytes)
+        s += String.fromCharCode(x);
+    return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+};
+const b64uJson = (v) => b64u(enc.encode(JSON.stringify(v)));
+/** A fresh P-256 device key. */
+async function generateHolderKey() {
+    const pair = await crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, true, ['sign', 'verify']);
+    const publicJwk = await crypto.subtle.exportKey('jwk', pair.publicKey);
+    return { privateJwk: await crypto.subtle.exportKey('jwk', pair.privateKey), publicJwk: { ...publicJwk, alg: 'ES256' } };
+}
+async function signJwt(header, payload, privateJwk) {
+    const key = await crypto.subtle.importKey('jwk', privateJwk, { name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign']);
+    const input = `${b64uJson({ alg: 'ES256', ...header })}.${b64uJson(payload)}`;
+    const sig = await crypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, key, enc.encode(input));
+    return `${input}.${b64u(sig)}`;
+}
+async function json(res) {
+    const body = (await res.json().catch(() => ({})));
+    if (!res.ok)
+        throw new Error(body.error_description ?? body.error ?? `Request failed (${res.status}).`);
+    return body;
+}
+/** Redeem an offer (pre-authorized code flow) and receive the credential bound to a new device key. */
+async function receiveCredential(offer, opts = {}) {
+    const f = opts.fetch ?? ((...a) => fetch(...a));
+    const code = offer.grants?.[PRE_AUTH]?.['pre-authorized_code'];
+    if (!code)
+        throw new Error('The offer has no pre-authorized code.');
+    const issuer = offer.credential_issuer.replace(/\/$/, '');
+    const meta = await json(await f(`${issuer}/.well-known/openid-credential-issuer`));
+    const asBase = (meta.authorization_servers?.[0] ?? issuer).replace(/\/$/, '');
+    const as = await json(await f(`${asBase}/.well-known/oauth-authorization-server`));
+    const configurationId = opts.configurationId ?? offer.credential_configuration_ids[0];
+    const token = await json(await f(as.token_endpoint, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({ grant_type: PRE_AUTH, 'pre-authorized_code': code, ...(opts.txCode ? { tx_code: opts.txCode } : {}) }).toString(),
+    }));
+    const key = opts.key ?? (await generateHolderKey());
+    const proof = await signJwt({ typ: 'openid4vci-proof+jwt', jwk: { kty: key.publicJwk.kty, crv: key.publicJwk.crv, x: key.publicJwk.x, y: key.publicJwk.y, alg: 'ES256' } }, { aud: issuer, iat: Math.floor(Date.now() / 1000), nonce: token.c_nonce }, key.privateJwk);
+    const issued = await json(await f(meta.credential_endpoint, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', authorization: `Bearer ${token.access_token}` },
+        body: JSON.stringify({ credential_configuration_id: configurationId, proof: { proof_type: 'jwt', jwt: proof } }),
+    }));
+    return { ...key, credential: issued.credential, format: issued.format ?? meta.credential_configurations_supported?.[configurationId]?.format ?? 'dc+sd-jwt' };
+}
+/**
+ * Build an SD-JWT VC presentation revealing only the claims in `reveal`, with a
+ * key-binding JWT over `aud` and `nonce` (from the verifier's request object).
+ */
+async function presentSdJwt(input) {
+    const [jwt, ...rest] = input.credential.split('~').filter(Boolean);
+    if (!jwt)
+        throw new Error('Not an SD-JWT credential.');
+    const shown = rest.filter((d) => {
+        const name = JSON.parse(atob(d.replace(/-/g, '+').replace(/_/g, '/')));
+        return input.reveal.includes(String(name[1]));
+    });
+    const base = `${[jwt, ...shown].join('~')}~`;
+    const digest = await crypto.subtle.digest('SHA-256', enc.encode(base));
+    const kb = await signJwt({ typ: 'kb+jwt' }, { aud: input.aud, nonce: input.nonce, iat: Math.floor(Date.now() / 1000), sd_hash: b64u(digest) }, input.privateJwk);
+    return `${base}${kb}`;
+}
+//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAWH,oDAQC;AAiBD,8CAIC;AAqBD,8CAqCC;AAMD,oCAeC;AA/GD,MAAM,QAAQ,GAAG,sDAAsD,CAAC;AAExE,4GAA4G;AAC5G,SAAgB,oBAAoB,CAAC,IAAY;IAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC/D,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;IACjD,IAAI,OAAO,KAAK,CAAC,iBAAiB,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC,EAAE,CAAC;QACtG,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,IAAI,GAAG,CAAC,CAA2B,EAAU,EAAE;IACnD,MAAM,KAAK,GAAG,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC,CAAC;AACF,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAOrE,gCAAgC;AACzB,KAAK,UAAU,iBAAiB;IACrC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/G,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACvE,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC;AAC1H,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,MAA+B,EAAE,OAAgC,EAAE,UAAsB;IAC9G,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACtH,MAAM,KAAK,GAAG,GAAG,QAAQ,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACjG,OAAO,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACjC,CAAC;AAOD,KAAK,UAAU,IAAI,CAAI,GAAa;IAClC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuD,CAAC;IACxG,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,IAAI,mBAAmB,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IACxG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uGAAuG;AAChG,KAAK,UAAU,iBAAiB,CACrC,KAAsB,EACtB,OAA6F,EAAE;IAE/F,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAA2B,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,MAAM,IAAI,CACrB,MAAM,CAAC,CAAC,GAAG,MAAM,uCAAuC,CAAC,CAC1D,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9E,MAAM,EAAE,GAAG,MAAM,IAAI,CAA6B,MAAM,CAAC,CAAC,GAAG,MAAM,yCAAyC,CAAC,CAAC,CAAC;IAC/G,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAE,CAAC;IAEvF,MAAM,KAAK,GAAG,MAAM,IAAI,CACtB,MAAM,CAAC,CAAC,EAAE,CAAC,cAAc,EAAE;QACzB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,qBAAqB,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC9I,CAAC,CACH,CAAC;IAEF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,iBAAiB,EAAE,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,MAAM,OAAO,CACzB,EAAE,GAAG,EAAE,sBAAsB,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAC9I,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,EACzE,GAAG,CAAC,UAAU,CACf,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,IAAI,CACvB,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,YAAY,EAAE,EAAE;QAC9F,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,2BAA2B,EAAE,eAAe,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;KACjH,CAAC,CACH,CAAC;IACF,OAAO,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAK,IAAI,CAAC,mCAAmC,EAAE,CAAC,eAAe,CAAC,EAAE,MAAsB,IAAI,WAAW,EAAE,CAAC;AACjL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,YAAY,CAAC,KAAmG;IACpI,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnE,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAc,CAAC;QACpF,OAAO,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,MAAM,EAAE,GAAG,MAAM,OAAO,CACtB,EAAE,GAAG,EAAE,QAAQ,EAAE,EACjB,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EACjG,KAAK,CAAC,UAAU,CACjB,CAAC;IACF,OAAO,GAAG,IAAI,GAAG,EAAE,EAAE,CAAC;AACxB,CAAC"}

package/dist/custom-challenge.d.ts

@@ -0,0 +1,13 @@
+import type { FapiClient } from './fapi';
+/**
+ * The application's own second factor (a question, a code sent elsewhere, an
+ * identity check): ask Atlas to run the application's challenge for this
+ * sign-in attempt, show the prompt, then submit the answer as the attempt's
+ * `code` with `strategy: 'custom_challenge'` (e.g. `submit({ code, strategy:
+ * 'custom_challenge' })`). Offered when `account.customSecondFactor` is true.
+ */
+export declare function prepareCustomChallenge(client: FapiClient, attemptId: string): Promise<{
+    prompt: string;
+    hint: string | null;
+    expiresAt: number;
+}>;

package/dist/custom-challenge.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.prepareCustomChallenge = prepareCustomChallenge;
+/**
+ * The application's own second factor (a question, a code sent elsewhere, an
+ * identity check): ask Atlas to run the application's challenge for this
+ * sign-in attempt, show the prompt, then submit the answer as the attempt's
+ * `code` with `strategy: 'custom_challenge'` (e.g. `submit({ code, strategy:
+ * 'custom_challenge' })`). Offered when `account.customSecondFactor` is true.
+ */
+async function prepareCustomChallenge(client, attemptId) {
+    const response = await client.post(`/v1/client/sign_ins/${encodeURIComponent(attemptId)}/prepare_second_factor`, { strategy: 'custom_challenge' });
+    if (!response.ok) {
+        const first = response.errors[0];
+        const error = new Error(first?.message ?? 'Could not start the challenge.');
+        if (first?.code)
+            error.code = first.code;
+        throw error;
+    }
+    const d = response.data;
+    return {
+        prompt: typeof d?.prompt === 'string' ? d.prompt : '',
+        hint: typeof d?.hint === 'string' ? d.hint : null,
+        expiresAt: typeof d?.expires_at === 'number' ? d.expires_at : 0,
+    };
+}
+//# sourceMappingURL=custom-challenge.js.map

package/dist/custom-challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-challenge.js","sourceRoot":"","sources":["../src/custom-challenge.ts"],"names":[],"mappings":";;AASA,wDAoBC;AA3BD;;;;;;GAMG;AACI,KAAK,UAAU,sBAAsB,CAC1C,MAAkB,EAClB,SAAiB;IAEjB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,uBAAuB,kBAAkB,CAAC,SAAS,CAAC,wBAAwB,EAC5E,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CACjC,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,EAAE,OAAO,IAAI,gCAAgC,CAA8B,CAAC;QACzG,IAAI,KAAK,EAAE,IAAI;YAAE,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACzC,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC;IACxB,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACrD,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QACjD,SAAS,EAAE,OAAO,CAAC,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;KAChE,CAAC;AACJ,CAAC"}

package/dist/delegated-ui.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Bring-your-own login and consent pages. Atlas sends the browser to your page
+ * with `?login_challenge=` or `?consent_challenge=`. Reading, accepting and
+ * rejecting the challenge needs a secret key, so your page talks to YOUR
+ * backend (see `delegatedUiProxy` in @atlasauth/backend), and then follows the
+ * `redirect_to` Atlas returned.
+ */
+export type DelegatedChallenge = {
+    type: 'login' | 'consent';
+    challenge: string;
+};
+/** The challenge on the current page URL, or null when the page was not reached from Atlas. */
+export declare function readDelegatedChallenge(href: string | URL | {
+    href: string;
+}): DelegatedChallenge | null;
+export interface DelegatedLoginRequest {
+    client: {
+        id: string;
+        client_id: string;
+        name: string;
+    };
+    requested_scope: string[];
+    audience: string | null;
+    page: 'sign-in' | 'sign-up';
+    session_subject: string | null;
+    ui_locales: string | null;
+    login_hint: string | null;
+    expires_at: number;
+}
+export interface DelegatedConsentRequest {
+    subject: string;
+    client: {
+        id: string;
+        client_id: string;
+        name: string;
+        first_party?: boolean;
+    };
+    requested_scope: string[];
+    audience: string | null;
+    authorization_details: unknown[];
+    organization_id: string | null;
+    redirect_uri: string;
+    expires_at: number;
+}
+export interface DelegatedUiClientOptions {
+    /** Base URL of your backend routes that proxy the Atlas calls, e.g. `/atlas/oauth`. */
+    baseUrl: string;
+    fetch?: typeof fetch;
+    headers?: Record<string, string>;
+}
+/**
+ * Calls your backend's proxy routes (`GET {baseUrl}/login`, `POST {baseUrl}/login/accept`, …),
+ * each taking the challenge as a query parameter. Errors throw with the server's message.
+ */
+export declare function createDelegatedUiClient(opts: DelegatedUiClientOptions): {
+    getLoginRequest: (challenge: string) => Promise<DelegatedLoginRequest>;
+    /** `subject` is the Atlas user id your backend authenticated the visitor as. */
+    acceptLogin: (challenge: string, body: {
+        subject: string;
+        remember?: boolean;
+        amr?: string[];
+        acr?: string;
+    }) => Promise<{
+        redirect_to: string;
+    }>;
+    rejectLogin: (challenge: string, body?: {
+        error?: string;
+        error_description?: string;
+    }) => Promise<{
+        redirect_to: string;
+    }>;
+    getConsentRequest: (challenge: string) => Promise<DelegatedConsentRequest>;
+    acceptConsent: (challenge: string, body?: {
+        grant_scope?: string[];
+        remember?: boolean;
+    }) => Promise<{
+        redirect_to: string;
+    }>;
+    rejectConsent: (challenge: string, body?: {
+        error?: string;
+        error_description?: string;
+    }) => Promise<{
+        redirect_to: string;
+    }>;
+};
+/**
+ * Send the browser on to the `redirect_to` Atlas returned. Refuses anything that
+ * is not https (or an allowed origin), so a tampered response cannot redirect elsewhere.
+ */
+export declare function continueDelegatedFlow(redirectTo: string, opts?: {
+    allowedOrigins?: string[];
+    navigate?: (url: string) => void;
+}): void;

package/dist/delegated-ui.js

@@ -0,0 +1,62 @@
+"use strict";
+/**
+ * Bring-your-own login and consent pages. Atlas sends the browser to your page
+ * with `?login_challenge=` or `?consent_challenge=`. Reading, accepting and
+ * rejecting the challenge needs a secret key, so your page talks to YOUR
+ * backend (see `delegatedUiProxy` in @atlasauth/backend), and then follows the
+ * `redirect_to` Atlas returned.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readDelegatedChallenge = readDelegatedChallenge;
+exports.createDelegatedUiClient = createDelegatedUiClient;
+exports.continueDelegatedFlow = continueDelegatedFlow;
+/** The challenge on the current page URL, or null when the page was not reached from Atlas. */
+function readDelegatedChallenge(href) {
+    const url = new URL(typeof href === 'string' ? href : href instanceof URL ? href.href : href.href);
+    const login = url.searchParams.get('login_challenge');
+    if (login)
+        return { type: 'login', challenge: login };
+    const consent = url.searchParams.get('consent_challenge');
+    return consent ? { type: 'consent', challenge: consent } : null;
+}
+/**
+ * Calls your backend's proxy routes (`GET {baseUrl}/login`, `POST {baseUrl}/login/accept`, …),
+ * each taking the challenge as a query parameter. Errors throw with the server's message.
+ */
+function createDelegatedUiClient(opts) {
+    const f = opts.fetch ?? ((...a) => fetch(...a));
+    const base = opts.baseUrl.replace(/\/$/, '');
+    async function call(method, path, kind, challenge, body) {
+        const res = await f(`${base}/${path}?${kind}_challenge=${encodeURIComponent(challenge)}`, {
+            method,
+            credentials: 'same-origin',
+            headers: { ...(body !== undefined ? { 'content-type': 'application/json' } : {}), ...opts.headers },
+            ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+        });
+        const json = (await res.json().catch(() => ({})));
+        if (!res.ok)
+            throw new Error(json.error?.message ?? json.message ?? `Request failed (${res.status}).`);
+        return json;
+    }
+    return {
+        getLoginRequest: (challenge) => call('GET', 'login', 'login', challenge),
+        /** `subject` is the Atlas user id your backend authenticated the visitor as. */
+        acceptLogin: (challenge, body) => call('POST', 'login/accept', 'login', challenge, body),
+        rejectLogin: (challenge, body = {}) => call('POST', 'login/reject', 'login', challenge, body),
+        getConsentRequest: (challenge) => call('GET', 'consent', 'consent', challenge),
+        acceptConsent: (challenge, body = {}) => call('POST', 'consent/accept', 'consent', challenge, body),
+        rejectConsent: (challenge, body = {}) => call('POST', 'consent/reject', 'consent', challenge, body),
+    };
+}
+/**
+ * Send the browser on to the `redirect_to` Atlas returned. Refuses anything that
+ * is not https (or an allowed origin), so a tampered response cannot redirect elsewhere.
+ */
+function continueDelegatedFlow(redirectTo, opts = {}) {
+    const url = new URL(redirectTo);
+    const ok = opts.allowedOrigins ? opts.allowedOrigins.includes(url.origin) : url.protocol === 'https:';
+    if (!ok)
+        throw new Error('Refusing to follow an unexpected redirect.');
+    (opts.navigate ?? ((u) => window.location.assign(u)))(url.toString());
+}
+//# sourceMappingURL=delegated-ui.js.map