@atlasauth/js 0.7.0 → 0.9.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +47 -0
- package/dist/api-keys.d.ts +9 -1
- package/dist/api-keys.js +14 -2
- package/dist/api-keys.js.map +1 -1
- package/dist/attempt.d.ts +13 -0
- package/dist/attempt.js +10 -1
- package/dist/attempt.js.map +1 -1
- package/dist/environment.d.ts +79 -0
- package/dist/environment.js +74 -0
- package/dist/environment.js.map +1 -0
- package/dist/errors.d.ts +58 -0
- package/dist/errors.js +143 -0
- package/dist/errors.js.map +1 -0
- package/dist/fapi.d.ts +17 -0
- package/dist/fapi.js +20 -1
- package/dist/fapi.js.map +1 -1
- package/dist/frontchannel-logout.d.ts +1 -1
- package/dist/index.d.ts +3 -0
- package/dist/index.js +6 -0
- package/dist/index.js.map +1 -1
- package/dist/instance-settings.d.ts +9 -0
- package/dist/instance-settings.js +2 -1
- package/dist/instance-settings.js.map +1 -1
- package/dist/reauth.d.ts +3 -1
- package/dist/reauth.js +14 -2
- package/dist/reauth.js.map +1 -1
- package/dist/sign-out-guard.d.ts +114 -0
- package/dist/sign-out-guard.js +197 -0
- package/dist/sign-out-guard.js.map +1 -0
- package/dist/sign-out.d.ts +28 -0
- package/dist/sign-out.js +47 -1
- package/dist/sign-out.js.map +1 -1
- package/package.json +1 -1
package/dist/fapi.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"fapi.js","sourceRoot":"","sources":["../src/fapi.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"fapi.js","sourceRoot":"","sources":["../src/fapi.ts"],"names":[],"mappings":";;;AAsCA,8CAIC;AAoHD,4CAmBC;AA8BD,wCAkHC;AAWD,0CAMC;AAGD,0BA2BC;AASD,kCAiCC;AAGD,sCAuBC;AAMD,kCAiBC;AAGD,8CAEC;AAhdD,uCAAiG;AAgCjG;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,MAAiC;IACjE,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7C,OAAO,qCAAqC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AASD,MAAa,UAAU;IACQ;IAA7B,YAA6B,OAA0B;QAA1B,YAAO,GAAP,OAAO,CAAmB;IAAG,CAAC;IAE3D,2EAA2E;IAC3E,IAAI,MAAM;QACR,OAAO,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IAED;;;;OAIG;IACH,IAAI,iBAAiB;QACnB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAI,IAAY,EAAE,OAAoB,EAAE;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;QAEhD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC;QAC7B,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,GAAG,IAAI,EAAE,EAAE;gBAC/D,GAAG,IAAI;gBACP,yEAAyE;gBACzE,4DAA4D;gBAC5D,WAAW,EAAE,SAAS;gBACtB,OAAO,EAAE;oBACP,mBAAmB,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc;oBAChD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5D,GAAG,IAAI,CAAC,OAAO;iBAChB;aACF,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP;;;;eAIG;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,CAAC;gBACT,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;aAC5F,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,GAAY,IAAI,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;QAED,OAAO;YACL,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAE,IAAU,CAAC,CAAC,CAAC,IAAI;YACtC,8DAA8D;YAC9D,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAA,qBAAW,EAAC,IAAI,CAAC;SAC7C,CAAC;IACJ,CAAC;IAED,IAAI,CAAI,IAAY,EAAE,IAAc;QAClC,OAAO,IAAI,CAAC,OAAO,CAAI,IAAI,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC5D,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAI,IAAY;QACjB,OAAO,IAAI,CAAC,OAAO,CAAI,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,CAAC;CACF;AAjFD,gCAiFC;AAmBD;;;;;;GAMG;AACI,KAAK,UAAU,gBAAgB,CACpC,MAAkB,EAClB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAK9B,mCAAmC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAE5E,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEhD,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ;QAChC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,YAAY;QACvC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI;QAC3C,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE;KACnC,CAAC;AACJ,CAAC;AAgBY,QAAA,WAAW,GAAc;IACpC,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,EAAE;IACV,IAAI,EAAE,KAAK;IACX,UAAU,EAAE,IAAI;IAChB,MAAM,EAAE,IAAI;CACb,CAAC;AAEF;;;;;GAKG;AACH,SAAgB,cAAc,CAC5B,OAA2B,EAC3B,MAA8B;IAE9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,qBAAqB;YAC3B,sEAAsE;YACtE,yEAAyE;YACzE,uCAAuC;YACvC,IAAI,EAAE;gBACJ,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;gBACnC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzE;SACF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAA,kBAAQ,EAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC;IAE5B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,oBAAoB;YACvB,OAAO;gBACL,IAAI,EAAE,qBAAqB;gBAC3B,IAAI,EAAE;oBACJ,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;oBACnC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACzE;aACF,CAAC;QAEJ,KAAK,sBAAsB;YACzB;;;;;eAKG;YACH,OAAO,MAAM,CAAC,IAAI;gBAChB,CAAC,CAAC;oBACE,IAAI,EAAE,uBAAuB,EAAE,uBAAuB;oBACtD,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;iBACpD;gBACH,CAAC,CAAC;oBACE,IAAI,EAAE,uBAAuB,EAAE,uBAAuB;oBACtD,IAAI,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE;iBAChE,CAAC;QAER,KAAK,uBAAuB;YAC1B,yEAAyE;YACzE,2EAA2E;YAC3E,uBAAuB;YACvB,OAAO;gBACL,IAAI,EAAE,uBAAuB,EAAE,wBAAwB;gBACvD,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;oBACvB,GAAG,CAAC,MAAM,CAAC,eAAe,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxE;aACF,CAAC;QAEJ;;;;WAIG;QACH,KAAK,sBAAsB;YACzB,OAAO;gBACL,IAAI,EAAE,uBAAuB,EAAE,yBAAyB;gBACxD,IAAI,EAAE;oBACJ,SAAS,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;oBAChC,KAAK,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;iBACpD;aACF,CAAC;QAEJ,KAAK,oBAAoB;YACvB,OAAO;gBACL,IAAI,EAAE,uBAAuB,EAAE,uBAAuB;gBACtD,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE;aAClC,CAAC;QAEJ,KAAK,iBAAiB;YACpB;;;;;;eAMG;YACH,OAAO,MAAM,CAAC,aAAa;gBACzB,CAAC,CAAC;oBACE,IAAI,EAAE,qBAAqB;oBAC3B,IAAI,EAAE;wBACJ,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;wBACnC,aAAa,EAAE,MAAM,CAAC,aAAa;qBACpC;iBACF;gBACH,CAAC,CAAC,IAAI,CAAC;QAEX,KAAK,sBAAsB;YACzB,OAAO;gBACL,IAAI,EAAE,8BAA8B,EAAE,mBAAmB;gBACzD,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE;aAC1C,CAAC;QAEJ,KAAK,aAAa,CAAC;QACnB,KAAK,MAAM,CAAC;QACZ,KAAK,SAAS,CAAC;QACf,KAAK,SAAS;YACZ;;;;eAIG;YACH,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,eAAe,CAAC,OAA8C;IAC5E,IAAI,CAAC,OAAO;QAAE,OAAO,mBAAW,CAAC;IACjC,OAAO;QACL,GAAG,mBAAW;QACd,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;KACpD,CAAC;AACJ,CAAC;AAED,0EAA0E;AACnE,KAAK,UAAU,OAAO,CAC3B,MAAkB,EAClB,KAAgB,EAChB,MAA8B;IAE9B,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAE3B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAoC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAElG,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC;;;;WAIG;QACH,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC5D,CAAC;IAED,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,IAAI;QACtB,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,KAAK;QACX,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,oEAAoE;QACpE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI;KACrC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,WAAW,CAC/B,MAAkB,EAClB,KAMC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAoC,qBAAqB,EAAE;QAC3F,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,2EAA2E;QAC3E,kEAAkE;QAClE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,wEAAwE;QACxE,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,EAAE,GAAG,mBAAW,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAClE,CAAC;IAED,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,IAAI;QACtB,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,KAAK;QACX,UAAU,EAAE,mBAAW,CAAC,UAAU;QAClC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI;KACrC,CAAC;AACJ,CAAC;AAED,2DAA2D;AACpD,KAAK,UAAU,aAAa,CACjC,MAAkB,EAClB,KAAgB,EAChB,QAAqC;IAErC,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;IAC7B,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAEtB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,uBAAuB,EAAE,uBAAuB,EAChD,EAAE,QAAQ,EAAE,CACb,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAE5E,OAAO;QACL,GAAG,KAAK;QACR,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,EAAE;QACV,4EAA4E;QAC5E,sCAAsC;QACtC,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,IAAI,IAAI;KAC/C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,WAAW,CAC/B,MAAkB,EAClB,KAAgB;IAEhB,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;IAC7B,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;QAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAE7D,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAC/B,uBAAuB,EAAE,gBAAgB,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAChF,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAEnE,OAAO;QACL,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE;QAC3C,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI;KACrC,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAgB,iBAAiB,CAAC,KAAgB;IAChD,OAAO,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAA,oBAAU,EAAC,KAAK,CAAC,OAAQ,CAAC,CAAC;AAC5F,CAAC"}
|
|
@@ -26,7 +26,7 @@ export interface SignOutOptions {
|
|
|
26
26
|
* Reject with a `SignOutError` when the Frontend API could not revoke the
|
|
27
27
|
* session (after one retry). The local sign-out still happens either way.
|
|
28
28
|
* Default `false`: `signOut()` resolves and reports `revoked: false` instead.
|
|
29
|
-
* Honoured by
|
|
29
|
+
* Honoured by every framework provider.
|
|
30
30
|
*/
|
|
31
31
|
strict?: boolean;
|
|
32
32
|
}
|
package/dist/index.d.ts
CHANGED
|
@@ -1,8 +1,10 @@
|
|
|
1
1
|
export * from './config';
|
|
2
2
|
export * from './sign-out';
|
|
3
|
+
export * from './sign-out-guard';
|
|
3
4
|
export * from './token-cache';
|
|
4
5
|
export * from './tab-election';
|
|
5
6
|
export * from './attempt';
|
|
7
|
+
export * from './errors';
|
|
6
8
|
export * from './redirect';
|
|
7
9
|
export * from './popup-channel';
|
|
8
10
|
export * from './fapi';
|
|
@@ -22,4 +24,5 @@ export * from './captcha';
|
|
|
22
24
|
export * from './captcha-widget';
|
|
23
25
|
export * from './captcha-controller';
|
|
24
26
|
export * from './instance-settings';
|
|
27
|
+
export * from './environment';
|
|
25
28
|
export { type AuthzClaims, type ProtectCondition, type ProtectOutcome, type ProtectReason, evaluate, hasFromClaims, protectFromClaims, ForbiddenError, ROLE_KEY_PATTERN, PERMISSION_KEY_PATTERN, isRoleKey, isPermissionKey, } from '@atlasauth/authz';
|
package/dist/index.js
CHANGED
|
@@ -18,9 +18,13 @@ exports.isPermissionKey = exports.isRoleKey = exports.PERMISSION_KEY_PATTERN = e
|
|
|
18
18
|
// Provider configuration checks (frontendApi) shared by every framework SDK.
|
|
19
19
|
__exportStar(require("./config"), exports);
|
|
20
20
|
__exportStar(require("./sign-out"), exports);
|
|
21
|
+
// The safer sign-out every framework provider drives (tombstones, background revoke).
|
|
22
|
+
__exportStar(require("./sign-out-guard"), exports);
|
|
21
23
|
__exportStar(require("./token-cache"), exports);
|
|
22
24
|
__exportStar(require("./tab-election"), exports);
|
|
23
25
|
__exportStar(require("./attempt"), exports);
|
|
26
|
+
// Server errors in the app's language (`error.<reason>` catalog keys).
|
|
27
|
+
__exportStar(require("./errors"), exports);
|
|
24
28
|
__exportStar(require("./redirect"), exports);
|
|
25
29
|
// §oauth popup mode: the same-origin hand-back for a popup whose opener was severed.
|
|
26
30
|
__exportStar(require("./popup-channel"), exports);
|
|
@@ -49,6 +53,8 @@ __exportStar(require("./captcha-widget"), exports);
|
|
|
49
53
|
// sign-in / sign-up settings (`/v1/appearance`) they are driven by.
|
|
50
54
|
__exportStar(require("./captcha-controller"), exports);
|
|
51
55
|
__exportStar(require("./instance-settings"), exports);
|
|
56
|
+
// `GET /v1/client/environment`, typed, and the `email_delivery` facts.
|
|
57
|
+
__exportStar(require("./environment"), exports);
|
|
52
58
|
// Framework-agnostic authorization primitive — `has()`/`evaluate` for any
|
|
53
59
|
// non-React/Next consumer reading org_role/org_permissions off its session.
|
|
54
60
|
var authz_1 = require("@atlasauth/authz");
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6EAA6E;AAC7E,2CAAyB;AACzB,6CAA2B;AAC3B,gDAA8B;AAC9B,iDAA+B;AAC/B,4CAA0B;AAC1B,6CAA2B;AAC3B,qFAAqF;AACrF,kDAAgC;AAChC,yCAAuB;AACvB,2CAAyB;AACzB,mDAAiC;AACjC,4CAA0B;AAC1B,6CAA2B;AAC3B,yCAAuB;AACvB,8CAA4B;AAC5B,2CAAyB;AACzB,4DAA4D;AAC5D,6CAA2B;AAC3B,4CAA0B;AAC1B,mDAAiC;AACjC,kDAAgC;AAChC,sDAAsD;AACtD,wDAAsC;AACtC,+EAA+E;AAC/E,2EAA2E;AAC3E,4CAA0B;AAC1B,kFAAkF;AAClF,mDAAiC;AACjC,kFAAkF;AAClF,yEAAyE;AACzE,oEAAoE;AACpE,uDAAqC;AACrC,sDAAoC;AACpC,0EAA0E;AAC1E,4EAA4E;AAC5E,0CAa0B;AARxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,yGAAA,gBAAgB,OAAA;AAChB,+GAAA,sBAAsB,OAAA;AACtB,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6EAA6E;AAC7E,2CAAyB;AACzB,6CAA2B;AAC3B,sFAAsF;AACtF,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,4CAA0B;AAC1B,uEAAuE;AACvE,2CAAyB;AACzB,6CAA2B;AAC3B,qFAAqF;AACrF,kDAAgC;AAChC,yCAAuB;AACvB,2CAAyB;AACzB,mDAAiC;AACjC,4CAA0B;AAC1B,6CAA2B;AAC3B,yCAAuB;AACvB,8CAA4B;AAC5B,2CAAyB;AACzB,4DAA4D;AAC5D,6CAA2B;AAC3B,4CAA0B;AAC1B,mDAAiC;AACjC,kDAAgC;AAChC,sDAAsD;AACtD,wDAAsC;AACtC,+EAA+E;AAC/E,2EAA2E;AAC3E,4CAA0B;AAC1B,kFAAkF;AAClF,mDAAiC;AACjC,kFAAkF;AAClF,yEAAyE;AACzE,oEAAoE;AACpE,uDAAqC;AACrC,sDAAoC;AACpC,uEAAuE;AACvE,gDAA8B;AAC9B,0EAA0E;AAC1E,4EAA4E;AAC5E,0CAa0B;AARxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,yGAAA,gBAAgB,OAAA;AAChB,+GAAA,sBAAsB,OAAA;AACtB,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA"}
|
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import type { CaptchaFlowKey, FlowCaptcha } from './captcha-widget';
|
|
2
|
+
import { type EmailDelivery } from './environment';
|
|
2
3
|
import type { FapiClient } from './fapi';
|
|
3
4
|
/**
|
|
4
5
|
* The instance's public sign-in / sign-up settings, read from
|
|
@@ -19,6 +20,14 @@ export interface InstanceSettings {
|
|
|
19
20
|
privacyUrl: string | null;
|
|
20
21
|
required: boolean;
|
|
21
22
|
};
|
|
23
|
+
/**
|
|
24
|
+
* Whether the app can deliver email, and what that allows: hide "Forgot
|
|
25
|
+
* password?" when `passwordReset` is false, email code / link options when
|
|
26
|
+
* `available` is false, and show a "can't send email" state instead of the
|
|
27
|
+
* password sign-up form when `passwordSignUp` is false. All true on an older
|
|
28
|
+
* server that does not say.
|
|
29
|
+
*/
|
|
30
|
+
emailDelivery: EmailDelivery;
|
|
22
31
|
}
|
|
23
32
|
/** One configurable sign-up field, exactly as `/v1/appearance` resolves it. */
|
|
24
33
|
export interface PublicSignUpField {
|
|
@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
3
3
|
exports.instanceSettingsFrom = instanceSettingsFrom;
|
|
4
4
|
exports.fetchInstanceSettings = fetchInstanceSettings;
|
|
5
5
|
exports.toSignUpInput = toSignUpInput;
|
|
6
|
+
const environment_1 = require("./environment");
|
|
6
7
|
const NO_LEGAL = { termsUrl: null, privacyUrl: null, required: false };
|
|
7
8
|
const isRecord = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
|
|
8
9
|
/**
|
|
@@ -40,7 +41,7 @@ function instanceSettingsFrom(body) {
|
|
|
40
41
|
required: legalRaw.required === true,
|
|
41
42
|
}
|
|
42
43
|
: NO_LEGAL;
|
|
43
|
-
return { captchaFlows, signUpFields, legal };
|
|
44
|
+
return { captchaFlows, signUpFields, legal, emailDelivery: (0, environment_1.emailDeliveryFrom)(root) };
|
|
44
45
|
}
|
|
45
46
|
/**
|
|
46
47
|
* Fetch the instance's public settings (`GET /v1/appearance`). Null when the
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"instance-settings.js","sourceRoot":"","sources":["../src/instance-settings.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"instance-settings.js","sourceRoot":"","sources":["../src/instance-settings.ts"],"names":[],"mappings":";;AA6DA,oDAoCC;AAOD,sDAOC;AASD,sCAeC;AAtID,+CAAsE;AAkDtE,MAAM,QAAQ,GAA8B,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAElG,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAgC,EAAE,CAC5D,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEpD;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,IAAa;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAEpE,MAAM,YAAY,GAAqC,EAAE,CAAC;IAC1D,IAAI,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAU,EAAE,CAAC;YAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC9B,YAAY,CAAC,GAAG,CAAC,GAAG;gBAClB,OAAO,EAAE,IAAI,CAAC,OAAO,KAAK,IAAI;gBAC9B,GAAG,CAAC,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzE,GAAG,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,WAAW,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;oBACvF,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;oBACzB,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;QACzD,CAAC,CAAE,UAAU,CAAC,YAAY,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CACvD;QAC3B,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,MAAM,KAAK,GAAG,QAAQ;QACpB,CAAC,CAAC;YACE,QAAQ,EAAE,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;YAC1E,UAAU,EAAE,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;YAChF,QAAQ,EAAE,QAAQ,CAAC,QAAQ,KAAK,IAAI;SACrC;QACH,CAAC,CAAC,QAAQ,CAAC;IAEb,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,IAAA,+BAAiB,EAAC,IAAI,CAAC,EAAE,CAAC;AACvF,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,qBAAqB,CAAC,MAAkB;IAC5D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAU,gBAAgB,CAAC,CAAC;QAC7D,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAC3B,MAA8B,EAC9B,OAAgB,EAChB,YAA4B;IAQ5B,MAAM,EAAE,KAAK,GAAG,EAAE,EAAE,QAAQ,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IACtD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,IAAI,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAChF,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACzF,CAAC"}
|
package/dist/reauth.d.ts
CHANGED
|
@@ -20,10 +20,12 @@ export interface ReauthOptions {
|
|
|
20
20
|
api: string;
|
|
21
21
|
publishableKey: string;
|
|
22
22
|
fetchImpl?: typeof fetch;
|
|
23
|
+
/** The app's UI language, sent as `Accept-Language` (see `FapiClientOptions.locale`). */
|
|
24
|
+
locale?: string;
|
|
23
25
|
}
|
|
24
26
|
/**
|
|
25
27
|
* Re-authenticate the current session. Resolves on success; throws with the
|
|
26
|
-
* server's message (and a `.code`) on failure — `STEP_UP_REQUIRED` cannot recur
|
|
28
|
+
* server's message (and a `.code`, plus `.reason` when the server sent one) on failure — `STEP_UP_REQUIRED` cannot recur
|
|
27
29
|
* here, but a wrong password surfaces as a 401.
|
|
28
30
|
*/
|
|
29
31
|
export declare function reauthenticate(input: ReauthInput, opts: ReauthOptions): Promise<void>;
|
package/dist/reauth.js
CHANGED
|
@@ -10,9 +10,10 @@
|
|
|
10
10
|
*/
|
|
11
11
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
12
12
|
exports.reauthenticate = reauthenticate;
|
|
13
|
+
const fapi_1 = require("./fapi");
|
|
13
14
|
/**
|
|
14
15
|
* Re-authenticate the current session. Resolves on success; throws with the
|
|
15
|
-
* server's message (and a `.code`) on failure — `STEP_UP_REQUIRED` cannot recur
|
|
16
|
+
* server's message (and a `.code`, plus `.reason` when the server sent one) on failure — `STEP_UP_REQUIRED` cannot recur
|
|
16
17
|
* here, but a wrong password surfaces as a 401.
|
|
17
18
|
*/
|
|
18
19
|
async function reauthenticate(input, opts) {
|
|
@@ -20,25 +21,36 @@ async function reauthenticate(input, opts) {
|
|
|
20
21
|
? { strategy: 'password', password: input.password }
|
|
21
22
|
: { strategy: 'id_token', provider: input.provider, id_token: input.idToken };
|
|
22
23
|
const doFetch = opts.fetchImpl ?? fetch;
|
|
24
|
+
const language = (0, fapi_1.acceptLanguageFor)(opts.locale);
|
|
23
25
|
const res = await doFetch(`${opts.api}/v1/client/me/reauthenticate`, {
|
|
24
26
|
method: 'POST',
|
|
25
|
-
headers: {
|
|
27
|
+
headers: {
|
|
28
|
+
'content-type': 'application/json',
|
|
29
|
+
'x-publishable-key': opts.publishableKey,
|
|
30
|
+
...(language ? { 'accept-language': language } : {}),
|
|
31
|
+
},
|
|
26
32
|
credentials: 'include',
|
|
27
33
|
body: JSON.stringify(body),
|
|
28
34
|
});
|
|
29
35
|
if (!res.ok) {
|
|
30
36
|
let message = 'Re-authentication failed.';
|
|
31
37
|
let code;
|
|
38
|
+
let reason;
|
|
32
39
|
try {
|
|
33
40
|
const parsed = (await res.json());
|
|
34
41
|
message = parsed.errors?.[0]?.message ?? message;
|
|
35
42
|
code = parsed.errors?.[0]?.code;
|
|
43
|
+
const sent = parsed.errors?.[0]?.reason;
|
|
44
|
+
if (typeof sent === 'string' && sent !== '')
|
|
45
|
+
reason = sent;
|
|
36
46
|
}
|
|
37
47
|
catch {
|
|
38
48
|
/* keep the default */
|
|
39
49
|
}
|
|
40
50
|
const err = new Error(message);
|
|
41
51
|
err.code = code;
|
|
52
|
+
if (reason)
|
|
53
|
+
err.reason = reason;
|
|
42
54
|
throw err;
|
|
43
55
|
}
|
|
44
56
|
}
|
package/dist/reauth.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"reauth.js","sourceRoot":"","sources":["../src/reauth.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;
|
|
1
|
+
{"version":3,"file":"reauth.js","sourceRoot":"","sources":["../src/reauth.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAsBH,wCAoCC;AAxDD,iCAA2C;AAe3C;;;;GAIG;AACI,KAAK,UAAU,cAAc,CAAC,KAAkB,EAAE,IAAmB;IAC1E,MAAM,IAAI,GACR,KAAK,CAAC,QAAQ,KAAK,UAAU;QAC3B,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;QACpD,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAElF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAA,wBAAiB,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,8BAA8B,EAAE;QACnE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,mBAAmB,EAAE,IAAI,CAAC,cAAc;YACxC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD;QACD,WAAW,EAAE,SAAS;QACtB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,OAAO,GAAG,2BAA2B,CAAC;QAC1C,IAAI,IAAwB,CAAC;QAC7B,IAAI,MAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyE,CAAC;YAC1G,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,OAAO,CAAC;YACjD,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;YAChC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;YACxC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE;gBAAE,MAAM,GAAG,IAAI,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,GAAyB,CAAC,IAAI,GAAG,IAAI,CAAC;QACvC,IAAI,MAAM;YAAG,GAA2B,CAAC,MAAM,GAAG,MAAM,CAAC;QACzD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}
|
|
@@ -0,0 +1,114 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* The whole safer sign-out, once, for every framework provider.
|
|
3
|
+
*
|
|
4
|
+
* `@atlasauth/react` grew this inline; every other provider (Vue, Svelte,
|
|
5
|
+
* Angular, Solid, Qwik, the native SDKs) drives the same steps through a
|
|
6
|
+
* {@link SignOutGuard} so the behaviour cannot drift:
|
|
7
|
+
*
|
|
8
|
+
* - `signOut()` remembers the session id BEFORE revoking (a tombstone), revokes
|
|
9
|
+
* it on the Frontend API (retried once), runs front-channel logout, and
|
|
10
|
+
* reports `{ revoked, activeSessionId? }` — or rejects with a
|
|
11
|
+
* {@link SignOutError} under `{ strict: true }`;
|
|
12
|
+
* - every boot / reload / refresh / sibling-tab broadcast asks
|
|
13
|
+
* {@link SignOutGuard.refuse} before adopting a session, so a session this
|
|
14
|
+
* browser signed out of is never re-adopted from a refresh cookie (or a
|
|
15
|
+
* stored token) the revoke did not clear;
|
|
16
|
+
* - a refused session is revoked again in the background, and its tombstone is
|
|
17
|
+
* dropped once the server confirms;
|
|
18
|
+
* - a parked session the server promoted on revoke is adopted
|
|
19
|
+
* ({@link SignOutGuard.promoted}).
|
|
20
|
+
*
|
|
21
|
+
* The provider keeps its own state and calls these at the matching points.
|
|
22
|
+
*/
|
|
23
|
+
import type { SignOutOptions } from './frontchannel-logout';
|
|
24
|
+
import { SessionTombstones, type RevokeSessionOutcome, type SignOutResult, type TombstoneStore } from './sign-out';
|
|
25
|
+
/** A credentialed Frontend API request (`path` is relative to the FAPI base URL). */
|
|
26
|
+
export type FapiRequest = (path: string, init?: RequestInit) => Promise<Response>;
|
|
27
|
+
/** Options for {@link SignOutGuard}. */
|
|
28
|
+
export interface SignOutGuardOptions {
|
|
29
|
+
/** The provider's FAPI request: cookies (web) or its bearer token (native). */
|
|
30
|
+
request: FapiRequest;
|
|
31
|
+
/** The Frontend API base URL — tombstones are kept per Frontend API origin. */
|
|
32
|
+
frontendApi?: string;
|
|
33
|
+
/** A persistent store for platforms without `localStorage` (see {@link TombstoneStore}). */
|
|
34
|
+
store?: TombstoneStore;
|
|
35
|
+
/** Bring your own tombstones (tests, or a set shared with other code). */
|
|
36
|
+
tombstones?: SessionTombstones;
|
|
37
|
+
/**
|
|
38
|
+
* Delays (ms) between background re-tries of a revoke `signOut()` could not
|
|
39
|
+
* complete. Default `[15_000, 60_000, 300_000]`; `[]` re-tries only when a
|
|
40
|
+
* refused session shows up on a later boot.
|
|
41
|
+
*/
|
|
42
|
+
retryDelaysMs?: number[];
|
|
43
|
+
/** Skip front-channel logout entirely (runtimes without a DOM). */
|
|
44
|
+
frontChannelLogout?: boolean;
|
|
45
|
+
}
|
|
46
|
+
/** What {@link SignOutGuard.revoke} did on the server. */
|
|
47
|
+
export interface SignOutAttempt {
|
|
48
|
+
/** The session that was signed out of, or null when there was none. */
|
|
49
|
+
sessionId: string | null;
|
|
50
|
+
outcome: RevokeSessionOutcome;
|
|
51
|
+
}
|
|
52
|
+
/** The cross-tab sign-out signal: session ids (never tokens) a tab signed out of. */
|
|
53
|
+
export interface SignedOutSignal {
|
|
54
|
+
signedOut?: string[];
|
|
55
|
+
}
|
|
56
|
+
export declare class SignOutGuard {
|
|
57
|
+
/** The sessions this browser (or app) signed out of. */
|
|
58
|
+
readonly tombstones: SessionTombstones;
|
|
59
|
+
private readonly request;
|
|
60
|
+
private readonly retryDelaysMs;
|
|
61
|
+
private readonly frontChannelLogout;
|
|
62
|
+
/** Sessions with a background revoke in flight or scheduled. */
|
|
63
|
+
private readonly retrying;
|
|
64
|
+
private readonly timers;
|
|
65
|
+
constructor(options: SignOutGuardOptions);
|
|
66
|
+
/** Settles once persisted tombstones are loaded — await it before the first boot. */
|
|
67
|
+
get ready(): Promise<void>;
|
|
68
|
+
/** Whether this browser signed out of `sessionId`. */
|
|
69
|
+
isSignedOut(sessionId: string | null | undefined): boolean;
|
|
70
|
+
/**
|
|
71
|
+
* Call with the session a boot / reload / refresh is about to adopt. True when
|
|
72
|
+
* it must NOT be adopted (this browser signed out of it); the revoke is then
|
|
73
|
+
* re-tried in the background and the tombstone dropped once it lands.
|
|
74
|
+
*/
|
|
75
|
+
refuse(sessionId: string | null | undefined, request?: FapiRequest): boolean;
|
|
76
|
+
/**
|
|
77
|
+
* The server half of `signOut()`. Finds the session to end when the provider
|
|
78
|
+
* does not know it (`GET /v1/client` — the revoke works from the cookies, so a
|
|
79
|
+
* missing in-memory token never skips it), tombstones it, revokes it (retried
|
|
80
|
+
* once) and runs front-channel logout. A failed revoke is re-tried in the
|
|
81
|
+
* background. Pass `request` to revoke with a credential the provider is about
|
|
82
|
+
* to drop (a native bearer token).
|
|
83
|
+
*/
|
|
84
|
+
revoke(sessionId: string | null | undefined, options?: SignOutOptions & {
|
|
85
|
+
request?: FapiRequest;
|
|
86
|
+
}): Promise<SignOutAttempt>;
|
|
87
|
+
/** The parked session the server promoted on revoke, when it should be adopted. */
|
|
88
|
+
promoted(attempt: SignOutAttempt): string | null;
|
|
89
|
+
/**
|
|
90
|
+
* What `signOut()` resolves with — or, with `{ strict: true }` and a revoke the
|
|
91
|
+
* server never confirmed, the {@link SignOutError} it rejects with. Call after
|
|
92
|
+
* the local sign-out.
|
|
93
|
+
*/
|
|
94
|
+
settle(attempt: SignOutAttempt, options?: SignOutOptions): SignOutResult;
|
|
95
|
+
/** The cross-tab message announcing a sign-out (`{}` when there was no session). */
|
|
96
|
+
signal(attempt: SignOutAttempt): SignedOutSignal;
|
|
97
|
+
/**
|
|
98
|
+
* Learn the sessions a sibling tab signed out of from its broadcast — call it
|
|
99
|
+
* BEFORE re-checking, so the re-check cannot re-adopt one. Returns the ids.
|
|
100
|
+
*/
|
|
101
|
+
learn(message: unknown): string[];
|
|
102
|
+
/**
|
|
103
|
+
* Call `onSignedOut` when another tab signs out of the session `current()`
|
|
104
|
+
* returns (its tombstone reached the shared store). Returns the unsubscribe.
|
|
105
|
+
*/
|
|
106
|
+
watch(current: () => string | null | undefined, onSignedOut: () => void): () => void;
|
|
107
|
+
/** Cancel scheduled background re-tries (provider teardown). */
|
|
108
|
+
dispose(): void;
|
|
109
|
+
/**
|
|
110
|
+
* Revoke `sessionId` again: now when `delays` is empty, else after each delay
|
|
111
|
+
* in turn until one lands. Drops the tombstone on success. One chain per session.
|
|
112
|
+
*/
|
|
113
|
+
private retryInBackground;
|
|
114
|
+
}
|
|
@@ -0,0 +1,197 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
/**
|
|
3
|
+
* The whole safer sign-out, once, for every framework provider.
|
|
4
|
+
*
|
|
5
|
+
* `@atlasauth/react` grew this inline; every other provider (Vue, Svelte,
|
|
6
|
+
* Angular, Solid, Qwik, the native SDKs) drives the same steps through a
|
|
7
|
+
* {@link SignOutGuard} so the behaviour cannot drift:
|
|
8
|
+
*
|
|
9
|
+
* - `signOut()` remembers the session id BEFORE revoking (a tombstone), revokes
|
|
10
|
+
* it on the Frontend API (retried once), runs front-channel logout, and
|
|
11
|
+
* reports `{ revoked, activeSessionId? }` — or rejects with a
|
|
12
|
+
* {@link SignOutError} under `{ strict: true }`;
|
|
13
|
+
* - every boot / reload / refresh / sibling-tab broadcast asks
|
|
14
|
+
* {@link SignOutGuard.refuse} before adopting a session, so a session this
|
|
15
|
+
* browser signed out of is never re-adopted from a refresh cookie (or a
|
|
16
|
+
* stored token) the revoke did not clear;
|
|
17
|
+
* - a refused session is revoked again in the background, and its tombstone is
|
|
18
|
+
* dropped once the server confirms;
|
|
19
|
+
* - a parked session the server promoted on revoke is adopted
|
|
20
|
+
* ({@link SignOutGuard.promoted}).
|
|
21
|
+
*
|
|
22
|
+
* The provider keeps its own state and calls these at the matching points.
|
|
23
|
+
*/
|
|
24
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
25
|
+
exports.SignOutGuard = void 0;
|
|
26
|
+
const frontchannel_logout_1 = require("./frontchannel-logout");
|
|
27
|
+
const sign_out_1 = require("./sign-out");
|
|
28
|
+
const DEFAULT_RETRY_DELAYS_MS = [15_000, 60_000, 300_000];
|
|
29
|
+
class SignOutGuard {
|
|
30
|
+
/** The sessions this browser (or app) signed out of. */
|
|
31
|
+
tombstones;
|
|
32
|
+
request;
|
|
33
|
+
retryDelaysMs;
|
|
34
|
+
frontChannelLogout;
|
|
35
|
+
/** Sessions with a background revoke in flight or scheduled. */
|
|
36
|
+
retrying = new Set();
|
|
37
|
+
timers = new Set();
|
|
38
|
+
constructor(options) {
|
|
39
|
+
this.request = options.request;
|
|
40
|
+
this.tombstones =
|
|
41
|
+
options.tombstones ??
|
|
42
|
+
new sign_out_1.SessionTombstones({ frontendApi: options.frontendApi, ...(options.store ? { store: options.store } : {}) });
|
|
43
|
+
this.retryDelaysMs = options.retryDelaysMs ?? DEFAULT_RETRY_DELAYS_MS;
|
|
44
|
+
this.frontChannelLogout = options.frontChannelLogout !== false;
|
|
45
|
+
}
|
|
46
|
+
/** Settles once persisted tombstones are loaded — await it before the first boot. */
|
|
47
|
+
get ready() {
|
|
48
|
+
return this.tombstones.ready;
|
|
49
|
+
}
|
|
50
|
+
/** Whether this browser signed out of `sessionId`. */
|
|
51
|
+
isSignedOut(sessionId) {
|
|
52
|
+
return this.tombstones.has(sessionId);
|
|
53
|
+
}
|
|
54
|
+
/**
|
|
55
|
+
* Call with the session a boot / reload / refresh is about to adopt. True when
|
|
56
|
+
* it must NOT be adopted (this browser signed out of it); the revoke is then
|
|
57
|
+
* re-tried in the background and the tombstone dropped once it lands.
|
|
58
|
+
*/
|
|
59
|
+
refuse(sessionId, request) {
|
|
60
|
+
if (!this.tombstones.has(sessionId))
|
|
61
|
+
return false;
|
|
62
|
+
this.retryInBackground(sessionId, request ?? this.request, []);
|
|
63
|
+
return true;
|
|
64
|
+
}
|
|
65
|
+
/**
|
|
66
|
+
* The server half of `signOut()`. Finds the session to end when the provider
|
|
67
|
+
* does not know it (`GET /v1/client` — the revoke works from the cookies, so a
|
|
68
|
+
* missing in-memory token never skips it), tombstones it, revokes it (retried
|
|
69
|
+
* once) and runs front-channel logout. A failed revoke is re-tried in the
|
|
70
|
+
* background. Pass `request` to revoke with a credential the provider is about
|
|
71
|
+
* to drop (a native bearer token).
|
|
72
|
+
*/
|
|
73
|
+
async revoke(sessionId, options = {}) {
|
|
74
|
+
const request = options.request ?? this.request;
|
|
75
|
+
let id = sessionId || null;
|
|
76
|
+
let outcome = { revoked: true, status: 200 };
|
|
77
|
+
if (!id) {
|
|
78
|
+
try {
|
|
79
|
+
const response = await request('/v1/client');
|
|
80
|
+
if (!response.ok)
|
|
81
|
+
throw new Error('boot failed');
|
|
82
|
+
const body = (await response.json());
|
|
83
|
+
id = typeof body?.session?.id === 'string' ? body.session.id : null;
|
|
84
|
+
}
|
|
85
|
+
catch {
|
|
86
|
+
outcome = { revoked: false, status: 0 };
|
|
87
|
+
}
|
|
88
|
+
}
|
|
89
|
+
if (id) {
|
|
90
|
+
// Remember it first: from here on nothing may re-adopt it.
|
|
91
|
+
this.tombstones.add(id);
|
|
92
|
+
outcome = await (0, sign_out_1.revokeSession)(request, id);
|
|
93
|
+
// OIDC Front-Channel Logout: let the apps signed in through this session
|
|
94
|
+
// clear theirs in this browser (hidden iframes, capped at 5 s). Best-effort.
|
|
95
|
+
if (this.frontChannelLogout && options.frontchannel !== false && typeof document !== 'undefined') {
|
|
96
|
+
await (0, frontchannel_logout_1.runFrontChannelLogoutFromResponse)(outcome.response);
|
|
97
|
+
}
|
|
98
|
+
if (!outcome.revoked)
|
|
99
|
+
this.retryInBackground(id, request, this.retryDelaysMs);
|
|
100
|
+
}
|
|
101
|
+
return { sessionId: id, outcome };
|
|
102
|
+
}
|
|
103
|
+
/** The parked session the server promoted on revoke, when it should be adopted. */
|
|
104
|
+
promoted(attempt) {
|
|
105
|
+
const id = attempt.outcome.activeSessionId;
|
|
106
|
+
return id && !this.tombstones.has(id) ? id : null;
|
|
107
|
+
}
|
|
108
|
+
/**
|
|
109
|
+
* What `signOut()` resolves with — or, with `{ strict: true }` and a revoke the
|
|
110
|
+
* server never confirmed, the {@link SignOutError} it rejects with. Call after
|
|
111
|
+
* the local sign-out.
|
|
112
|
+
*/
|
|
113
|
+
settle(attempt, options = {}) {
|
|
114
|
+
const { outcome, sessionId } = attempt;
|
|
115
|
+
if (!outcome.revoked && options.strict)
|
|
116
|
+
throw new sign_out_1.SignOutError(sessionId ?? '', outcome.status);
|
|
117
|
+
return outcome.activeSessionId
|
|
118
|
+
? { revoked: outcome.revoked, activeSessionId: outcome.activeSessionId }
|
|
119
|
+
: { revoked: outcome.revoked };
|
|
120
|
+
}
|
|
121
|
+
/** The cross-tab message announcing a sign-out (`{}` when there was no session). */
|
|
122
|
+
signal(attempt) {
|
|
123
|
+
return attempt.sessionId ? { signedOut: [attempt.sessionId] } : {};
|
|
124
|
+
}
|
|
125
|
+
/**
|
|
126
|
+
* Learn the sessions a sibling tab signed out of from its broadcast — call it
|
|
127
|
+
* BEFORE re-checking, so the re-check cannot re-adopt one. Returns the ids.
|
|
128
|
+
*/
|
|
129
|
+
learn(message) {
|
|
130
|
+
const list = message?.signedOut;
|
|
131
|
+
if (!Array.isArray(list))
|
|
132
|
+
return [];
|
|
133
|
+
const ids = list.filter((id) => typeof id === 'string' && !!id);
|
|
134
|
+
this.tombstones.add(...ids);
|
|
135
|
+
return ids;
|
|
136
|
+
}
|
|
137
|
+
/**
|
|
138
|
+
* Call `onSignedOut` when another tab signs out of the session `current()`
|
|
139
|
+
* returns (its tombstone reached the shared store). Returns the unsubscribe.
|
|
140
|
+
*/
|
|
141
|
+
watch(current, onSignedOut) {
|
|
142
|
+
return this.tombstones.subscribe((ids) => {
|
|
143
|
+
const id = current();
|
|
144
|
+
if (id && ids.includes(id))
|
|
145
|
+
onSignedOut();
|
|
146
|
+
});
|
|
147
|
+
}
|
|
148
|
+
/** Cancel scheduled background re-tries (provider teardown). */
|
|
149
|
+
dispose() {
|
|
150
|
+
for (const t of this.timers)
|
|
151
|
+
clearTimeout(t);
|
|
152
|
+
this.timers.clear();
|
|
153
|
+
this.retrying.clear();
|
|
154
|
+
}
|
|
155
|
+
/**
|
|
156
|
+
* Revoke `sessionId` again: now when `delays` is empty, else after each delay
|
|
157
|
+
* in turn until one lands. Drops the tombstone on success. One chain per session.
|
|
158
|
+
*/
|
|
159
|
+
retryInBackground(sessionId, request, delays) {
|
|
160
|
+
if (this.retrying.has(sessionId))
|
|
161
|
+
return;
|
|
162
|
+
this.retrying.add(sessionId);
|
|
163
|
+
const attempt = async (index) => {
|
|
164
|
+
let revoked = false;
|
|
165
|
+
try {
|
|
166
|
+
revoked = (await (0, sign_out_1.revokeSession)(request, sessionId, { retries: 0 })).revoked;
|
|
167
|
+
}
|
|
168
|
+
catch {
|
|
169
|
+
revoked = false;
|
|
170
|
+
}
|
|
171
|
+
if (revoked) {
|
|
172
|
+
this.tombstones.remove(sessionId);
|
|
173
|
+
this.retrying.delete(sessionId);
|
|
174
|
+
return;
|
|
175
|
+
}
|
|
176
|
+
if (index >= delays.length || !this.retrying.has(sessionId)) {
|
|
177
|
+
this.retrying.delete(sessionId);
|
|
178
|
+
return;
|
|
179
|
+
}
|
|
180
|
+
schedule(index);
|
|
181
|
+
};
|
|
182
|
+
const schedule = (index) => {
|
|
183
|
+
const timer = setTimeout(() => {
|
|
184
|
+
this.timers.delete(timer);
|
|
185
|
+
void attempt(index + 1);
|
|
186
|
+
}, delays[index]);
|
|
187
|
+
timer.unref?.();
|
|
188
|
+
this.timers.add(timer);
|
|
189
|
+
};
|
|
190
|
+
if (delays.length === 0)
|
|
191
|
+
void attempt(0);
|
|
192
|
+
else
|
|
193
|
+
schedule(0);
|
|
194
|
+
}
|
|
195
|
+
}
|
|
196
|
+
exports.SignOutGuard = SignOutGuard;
|
|
197
|
+
//# sourceMappingURL=sign-out-guard.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sign-out-guard.js","sourceRoot":"","sources":["../src/sign-out-guard.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;;AAGH,+DAA0E;AAC1E,yCAOoB;AAqCpB,MAAM,uBAAuB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1D,MAAa,YAAY;IACvB,wDAAwD;IAC/C,UAAU,CAAoB;IACtB,OAAO,CAAc;IACrB,aAAa,CAAW;IACxB,kBAAkB,CAAU;IAC7C,gEAAgE;IAC/C,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7B,MAAM,GAAG,IAAI,GAAG,EAAiC,CAAC;IAEnE,YAAY,OAA4B;QACtC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,UAAU;YACb,OAAO,CAAC,UAAU;gBAClB,IAAI,4BAAiB,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAClH,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,uBAAuB,CAAC;QACtE,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,KAAK,KAAK,CAAC;IACjE,CAAC;IAED,qFAAqF;IACrF,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;IAC/B,CAAC;IAED,sDAAsD;IACtD,WAAW,CAAC,SAAoC;QAC9C,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,SAAoC,EAAE,OAAqB;QAChE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAClD,IAAI,CAAC,iBAAiB,CAAC,SAAmB,EAAE,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CACV,SAAoC,EACpC,UAAsD,EAAE;QAExD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;QAChD,IAAI,EAAE,GAAG,SAAS,IAAI,IAAI,CAAC;QAC3B,IAAI,OAAO,GAAyB,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACnE,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;gBAC7C,IAAI,CAAC,QAAQ,CAAC,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;gBACjD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiD,CAAC;gBACrF,EAAE,GAAG,OAAO,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACtE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YAC1C,CAAC;QACH,CAAC;QACD,IAAI,EAAE,EAAE,CAAC;YACP,2DAA2D;YAC3D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxB,OAAO,GAAG,MAAM,IAAA,wBAAa,EAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC3C,yEAAyE;YACzE,6EAA6E;YAC7E,IAAI,IAAI,CAAC,kBAAkB,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjG,MAAM,IAAA,uDAAiC,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC5D,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IAED,mFAAmF;IACnF,QAAQ,CAAC,OAAuB;QAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;QAC3C,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,OAAuB,EAAE,UAA0B,EAAE;QAC1D,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,uBAAY,CAAC,SAAS,IAAI,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAChG,OAAO,OAAO,CAAC,eAAe;YAC5B,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE;YACxE,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;IACnC,CAAC;IAED,oFAAoF;IACpF,MAAM,CAAC,OAAuB;QAC5B,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAgB;QACpB,MAAM,IAAI,GAAI,OAAkC,EAAE,SAAS,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;QAC5B,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAwC,EAAE,WAAuB;QACrE,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE;YACvC,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;YACrB,IAAI,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAE,WAAW,EAAE,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gEAAgE;IAChE,OAAO;QACL,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED;;;OAGG;IACK,iBAAiB,CAAC,SAAiB,EAAE,OAAoB,EAAE,MAAgB;QACjF,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO;QACzC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,KAAK,EAAE,KAAa,EAAiB,EAAE;YACrD,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,CAAC,MAAM,IAAA,wBAAa,EAAC,OAAO,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAC9E,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAClC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,EAAE;YACjC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1B,KAAK,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC1B,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACjB,KAAgC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;;YACpC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;CACF;AAzKD,oCAyKC"}
|
package/dist/sign-out.d.ts
CHANGED
|
@@ -70,6 +70,24 @@ export interface SessionTombstonesOptions {
|
|
|
70
70
|
storageKey?: string;
|
|
71
71
|
/** Clock, for tests. */
|
|
72
72
|
now?: () => number;
|
|
73
|
+
/**
|
|
74
|
+
* Where to keep the tombstones instead of `localStorage` — for runtimes
|
|
75
|
+
* without one (React Native, Expo, Electron's main process, a Capacitor app,
|
|
76
|
+
* an extension service worker). Pass the platform's persistent store
|
|
77
|
+
* (AsyncStorage, `expo-secure-store`, `chrome.storage`, Capacitor
|
|
78
|
+
* Preferences…) through a two-method adapter. Reads may be async: await
|
|
79
|
+
* {@link SessionTombstones.ready} before trusting `has()` on a cold start.
|
|
80
|
+
*/
|
|
81
|
+
store?: TombstoneStore;
|
|
82
|
+
}
|
|
83
|
+
/**
|
|
84
|
+
* A key → string store for {@link SessionTombstones} on a platform without
|
|
85
|
+
* `localStorage`. Either method may be sync or async; errors are swallowed
|
|
86
|
+
* (memory still protects the running process).
|
|
87
|
+
*/
|
|
88
|
+
export interface TombstoneStore {
|
|
89
|
+
getItem(key: string): string | null | undefined | Promise<string | null | undefined>;
|
|
90
|
+
setItem(key: string, value: string): void | Promise<void>;
|
|
73
91
|
}
|
|
74
92
|
/**
|
|
75
93
|
* The ids of sessions this browser signed out of, so a reload — or a tab opened
|
|
@@ -90,6 +108,14 @@ export declare class SessionTombstones {
|
|
|
90
108
|
private unsaved;
|
|
91
109
|
private readonly storageKey;
|
|
92
110
|
private readonly now;
|
|
111
|
+
private readonly store;
|
|
112
|
+
/** False until a custom store has been read: writing earlier would drop what it holds. */
|
|
113
|
+
private hydrated;
|
|
114
|
+
/**
|
|
115
|
+
* Settles once the tombstones a {@link SessionTombstonesOptions.store} holds
|
|
116
|
+
* have been read (at once for `localStorage`). Never rejects.
|
|
117
|
+
*/
|
|
118
|
+
readonly ready: Promise<void>;
|
|
93
119
|
constructor(options?: string | SessionTombstonesOptions);
|
|
94
120
|
has(sessionId: string | null | undefined): boolean;
|
|
95
121
|
add(...sessionIds: (string | null | undefined)[]): void;
|
|
@@ -111,5 +137,7 @@ export declare class SessionTombstones {
|
|
|
111
137
|
*/
|
|
112
138
|
private sync;
|
|
113
139
|
private prune;
|
|
140
|
+
/** Read a custom store once, merging anything added before it answered. */
|
|
141
|
+
private hydrate;
|
|
114
142
|
private persist;
|
|
115
143
|
}
|