@authorizerdev/authorizer-js 3.0.1 → 3.0.3

package/lib/index.mjs

@@ -58,7 +58,9 @@ var createQueryParams = /* @__PURE__ */ __name((params) => {
   return Object.keys(params).filter((k) => typeof params[k] !== "undefined").map((k) => `${encodeURIComponent(k)}=${encodeURIComponent(params[k])}`).join("&");
 }, "createQueryParams");
 var sha256 = /* @__PURE__ */ __name(async (s) => {
-  const digestOp = getCryptoSubtle().digest({
+  const subtle = getCryptoSubtle();
+  if (!subtle) throw new Error("Web Crypto API is not available");
+  const digestOp = subtle.digest({
     name: "SHA-256"
   }, new TextEncoder().encode(s));
   if (window.msCrypto) {
@@ -88,8 +90,16 @@ var bufferToBase64UrlEncoded = /* @__PURE__ */ __name((input) => {
   const ie11SafeInput = new Uint8Array(input);
   return urlEncodeB64(window.btoa(String.fromCharCode(...Array.from(ie11SafeInput))));
 }, "bufferToBase64UrlEncoded");
+var originFromAuthorizerUrl = /* @__PURE__ */ __name((authorizerUrl) => {
+  try {
+    return new URL(authorizerUrl).origin;
+  } catch {
+    return authorizerUrl;
+  }
+}, "originFromAuthorizerUrl");
 var executeIframe = /* @__PURE__ */ __name((authorizeUrl, eventOrigin, timeoutInSeconds = DEFAULT_AUTHORIZE_TIMEOUT_IN_SECONDS) => {
   return new Promise((resolve, reject) => {
+    const expectedOrigin = originFromAuthorizerUrl(eventOrigin);
     const iframe = window.document.createElement("iframe");
     iframe.setAttribute("id", "authorizer-iframe");
     iframe.setAttribute("width", "0");
@@ -106,11 +116,12 @@ var executeIframe = /* @__PURE__ */ __name((authorizeUrl, eventOrigin, timeoutIn
       removeIframe();
     }, timeoutInSeconds * 1e3);
     const iframeEventHandler = /* @__PURE__ */ __name(function(e) {
-      if (e.origin !== eventOrigin) return;
+      if (e.origin !== expectedOrigin) return;
       if (!e.data || !e.data.response) return;
       const eventSource = e.source;
       if (eventSource) eventSource.close();
-      e.data.response.error ? reject(e.data.response) : resolve(e.data.response);
+      if (e.data.response.error) reject(e.data.response);
+      else resolve(e.data.response);
       clearTimeout(timeoutSetTimeoutId);
       window.removeEventListener("message", iframeEventHandler, false);
       setTimeout(removeIframe, CLEANUP_IFRAME_TIMEOUT_IN_SECONDS * 1e3);
@@ -125,25 +136,60 @@ var executeIframe = /* @__PURE__ */ __name((authorizeUrl, eventOrigin, timeoutIn
 var userFragment = "id email email_verified given_name family_name middle_name nickname preferred_username picture signup_methods gender birthdate phone_number phone_number_verified roles created_at updated_at revoked_timestamp is_multi_factor_auth_enabled app_data";
 var authTokenFragment = `message access_token expires_in refresh_token id_token should_show_email_otp_screen should_show_mobile_otp_screen should_show_totp_screen authenticator_scanner_image authenticator_secret authenticator_recovery_codes user { ${userFragment} }`;
 var getFetcher = /* @__PURE__ */ __name(() => hasWindow() ? window.fetch : crossFetch, "getFetcher");
+function toErrorList(errors) {
+  if (Array.isArray(errors)) {
+    return errors.map((item) => {
+      if (item instanceof Error) return item;
+      if (item && typeof item === "object" && "message" in item) return new Error(String(item.message));
+      return new Error(String(item));
+    });
+  }
+  if (errors instanceof Error) return [
+    errors
+  ];
+  if (errors !== null && typeof errors === "object") {
+    const o = errors;
+    if (typeof o.error_description === "string") return [
+      new Error(o.error_description)
+    ];
+    if (typeof o.error === "string") {
+      const desc = typeof o.error_description === "string" ? `: ${o.error_description}` : "";
+      return [
+        new Error(`${o.error}${desc}`)
+      ];
+    }
+    if (typeof o.message === "string") return [
+      new Error(o.message)
+    ];
+  }
+  if (errors === void 0 || errors === null) return [
+    new Error("Unknown error")
+  ];
+  return [
+    new Error(String(errors))
+  ];
+}
+__name(toErrorList, "toErrorList");
 var _Authorizer = class _Authorizer {
   // class variable
   config;
   codeVerifier;
   // constructor
   constructor(config) {
+    var _a, _b;
     if (!config) throw new Error("Configuration is required");
     this.config = config;
-    if (!config.authorizerURL && !config.authorizerURL.trim()) throw new Error("Invalid authorizerURL");
-    if (config.authorizerURL) this.config.authorizerURL = trimURL(config.authorizerURL);
-    if (!config.redirectURL && !config.redirectURL.trim()) throw new Error("Invalid redirectURL");
-    else this.config.redirectURL = trimURL(config.redirectURL);
+    if (!((_a = config.authorizerURL) == null ? void 0 : _a.trim())) throw new Error("Invalid authorizerURL");
+    this.config.authorizerURL = trimURL(config.authorizerURL);
+    if (!((_b = config.redirectURL) == null ? void 0 : _b.trim())) throw new Error("Invalid redirectURL");
+    this.config.redirectURL = trimURL(config.redirectURL);
+    this.config.clientID = ((config == null ? void 0 : config.clientID) || "").trim();
     this.config.extraHeaders = {
       ...config.extraHeaders || {},
-      "x-authorizer-url": this.config.authorizerURL,
-      "x-authorizer-client-id": this.config.clientID || "",
+      "x-authorizer-url": config.authorizerURL,
+      "x-authorizer-client-id": config.clientID || "",
       "Content-Type": "application/json"
     };
-    this.config.clientID = ((config == null ? void 0 : config.clientID) || "").trim();
   }
   authorize = /* @__PURE__ */ __name(async (data) => {
     var _a;
@@ -170,6 +216,7 @@ var _Authorizer = class _Authorizer {
       const sha = await sha256(this.codeVerifier);
       const codeChallenge = bufferToBase64UrlEncoded(sha);
       requestData.code_challenge = codeChallenge;
+      requestData.code_challenge_method = "S256";
     }
     const authorizeURL = `${this.config.authorizerURL}/authorize?${createQueryParams(requestData)}`;
     if (requestData.response_mode !== "web_message") {
@@ -218,7 +265,7 @@ var _Authorizer = class _Authorizer {
     }
   }, "browserLogin");
   forgotPassword = /* @__PURE__ */ __name(async (data) => {
-    var _a;
+    var _a, _b;
     if (!data.state) data.state = encode(createRandomString());
     if (!data.redirect_uri) data.redirect_uri = this.config.redirectURL;
     try {
@@ -226,9 +273,10 @@ var _Authorizer = class _Authorizer {
         query: "mutation forgotPassword($data: ForgotPasswordRequest!) {	forgot_password(params: $data) { message should_show_mobile_otp_screen } }",
         variables: {
           data
-        }
+        },
+        operationName: "forgotPassword"
       });
-      return ((_a = forgotPasswordResp == null ? void 0 : forgotPasswordResp.errors) == null ? void 0 : _a.length) ? this.errorResponse(forgotPasswordResp.errors) : this.okResponse(forgotPasswordResp == null ? void 0 : forgotPasswordResp.data.forgot_password);
+      return ((_a = forgotPasswordResp == null ? void 0 : forgotPasswordResp.errors) == null ? void 0 : _a.length) ? this.errorResponse(forgotPasswordResp.errors) : this.okResponse((_b = forgotPasswordResp == null ? void 0 : forgotPasswordResp.data) == null ? void 0 : _b.forgot_password);
     } catch (error) {
       return this.errorResponse([
         error
@@ -239,7 +287,8 @@ var _Authorizer = class _Authorizer {
     var _a;
     try {
       const res = await this.graphqlQuery({
-        query: "query { meta { version client_id is_google_login_enabled is_facebook_login_enabled is_github_login_enabled is_linkedin_login_enabled is_apple_login_enabled is_twitter_login_enabled is_microsoft_login_enabled is_twitch_login_enabled is_roblox_login_enabled is_email_verification_enabled is_basic_authentication_enabled is_magic_link_login_enabled is_sign_up_enabled is_strong_password_enabled is_multi_factor_auth_enabled is_mobile_basic_authentication_enabled is_phone_verification_enabled } }"
+        query: "query meta { meta { version client_id is_google_login_enabled is_facebook_login_enabled is_github_login_enabled is_linkedin_login_enabled is_apple_login_enabled is_twitter_login_enabled is_microsoft_login_enabled is_twitch_login_enabled is_roblox_login_enabled is_email_verification_enabled is_basic_authentication_enabled is_magic_link_login_enabled is_sign_up_enabled is_strong_password_enabled is_multi_factor_auth_enabled is_mobile_basic_authentication_enabled is_phone_verification_enabled } }",
+        operationName: "meta"
       });
       return ((_a = res == null ? void 0 : res.errors) == null ? void 0 : _a.length) ? this.errorResponse(res.errors) : this.okResponse(res.data.meta);
     } catch (error) {
@@ -252,8 +301,9 @@ var _Authorizer = class _Authorizer {
     var _a;
     try {
       const profileRes = await this.graphqlQuery({
-        query: `query {	profile { ${userFragment} } }`,
-        headers
+        query: `query profile {	profile { ${userFragment} } }`,
+        headers,
+        operationName: "profile"
       });
       return ((_a = profileRes == null ? void 0 : profileRes.errors) == null ? void 0 : _a.length) ? this.errorResponse(profileRes.errors) : this.okResponse(profileRes.data.profile);
     } catch (error) {
@@ -271,7 +321,8 @@ var _Authorizer = class _Authorizer {
         headers,
         variables: {
           params
-        }
+        },
+        operationName: "getSession"
       });
       return ((_a = res == null ? void 0 : res.errors) == null ? void 0 : _a.length) ? this.errorResponse(res.errors) : this.okResponse((_b = res.data) == null ? void 0 : _b.session);
     } catch (err) {
@@ -279,8 +330,9 @@ var _Authorizer = class _Authorizer {
     }
   }, "getSession");
   getToken = /* @__PURE__ */ __name(async (data) => {
+    var _a;
     if (!data.grant_type) data.grant_type = "authorization_code";
-    if (data.grant_type === "refresh_token" && !data.refresh_token) return this.errorResponse([
+    if (data.grant_type === "refresh_token" && !((_a = data.refresh_token) == null ? void 0 : _a.trim())) return this.errorResponse([
       new Error("Invalid refresh_token")
     ]);
     if (data.grant_type === "authorization_code" && !this.codeVerifier) return this.errorResponse([
@@ -303,10 +355,22 @@ var _Authorizer = class _Authorizer {
         },
         credentials: "include"
       });
-      const json = await res.json();
-      if (res.status >= 400) return this.errorResponse([
-        new Error(json.error_description || json.error)
-      ]);
+      const text = await res.text();
+      let json = {};
+      if (text) {
+        try {
+          json = JSON.parse(text);
+        } catch {
+          return this.errorResponse([
+            new Error(res.ok ? "Invalid JSON from token endpoint" : `HTTP ${res.status}`)
+          ]);
+        }
+      }
+      if (!res.ok) {
+        return this.errorResponse([
+          new Error(String(json.error_description || json.error || `HTTP ${res.status}`))
+        ]);
+      }
       return this.okResponse(json);
     } catch (err) {
       return this.errorResponse(err);
@@ -321,23 +385,23 @@ var _Authorizer = class _Authorizer {
 				`,
         variables: {
           data
-        }
+        },
+        operationName: "login"
       });
       return ((_a = res == null ? void 0 : res.errors) == null ? void 0 : _a.length) ? this.errorResponse(res.errors) : this.okResponse((_b = res.data) == null ? void 0 : _b.login);
     } catch (err) {
-      return this.errorResponse([
-        new Error(err)
-      ]);
+      return this.errorResponse(err);
     }
   }, "login");
   logout = /* @__PURE__ */ __name(async (headers) => {
     var _a, _b;
     try {
       const res = await this.graphqlQuery({
-        query: " mutation { logout { message } } ",
-        headers
+        query: "mutation logout { logout { message } }",
+        headers,
+        operationName: "logout"
       });
-      return ((_a = res == null ? void 0 : res.errors) == null ? void 0 : _a.length) ? this.errorResponse(res.errors) : this.okResponse((_b = res.data) == null ? void 0 : _b.response);
+      return ((_a = res == null ? void 0 : res.errors) == null ? void 0 : _a.length) ? this.errorResponse(res.errors) : this.okResponse((_b = res.data) == null ? void 0 : _b.logout);
     } catch (err) {
       return this.errorResponse([
         err
@@ -355,7 +419,8 @@ var _Authorizer = class _Authorizer {
 				`,
         variables: {
           data
-        }
+        },
+        operationName: "magicLinkLogin"
       });
       return ((_a = res == null ? void 0 : res.errors) == null ? void 0 : _a.length) ? this.errorResponse(res.errors) : this.okResponse((_b = res.data) == null ? void 0 : _b.magic_link_login);
     } catch (err) {
@@ -369,8 +434,9 @@ var _Authorizer = class _Authorizer {
     if (!urlState) {
       urlState = encode(createRandomString());
     }
-    if (!Object.values(OAuthProviders).includes(oauthProvider)) {
-      throw new Error(`only following oauth providers are supported: ${Object.values(oauthProvider).toString()}`);
+    const oauthProviderIds = Object.values(OAuthProviders);
+    if (!oauthProviderIds.includes(oauthProvider)) {
+      throw new Error(`only following oauth providers are supported: ${oauthProviderIds.join(", ")}`);
     }
     if (!hasWindow()) throw new Error("oauthLogin is only supported for browsers");
     if (roles && roles.length) urlState += `&roles=${roles.join(",")}`;
@@ -385,7 +451,8 @@ var _Authorizer = class _Authorizer {
 				`,
         variables: {
           data
-        }
+        },
+        operationName: "resendOtp"
       });
       return ((_a = res == null ? void 0 : res.errors) == null ? void 0 : _a.length) ? this.errorResponse(res.errors) : this.okResponse((_b = res.data) == null ? void 0 : _b.resend_otp);
     } catch (err) {
@@ -401,7 +468,8 @@ var _Authorizer = class _Authorizer {
         query: "mutation resetPassword($data: ResetPasswordRequest!) {	reset_password(params: $data) { message } }",
         variables: {
           data
-        }
+        },
+        operationName: "resetPassword"
       });
       return ((_a = resetPasswordRes == null ? void 0 : resetPasswordRes.errors) == null ? void 0 : _a.length) ? this.errorResponse(resetPasswordRes.errors) : this.okResponse((_b = resetPasswordRes.data) == null ? void 0 : _b.reset_password);
     } catch (error) {
@@ -411,22 +479,43 @@ var _Authorizer = class _Authorizer {
     }
   }, "resetPassword");
   revokeToken = /* @__PURE__ */ __name(async (data) => {
-    if (!data.refresh_token && !data.refresh_token.trim()) return this.errorResponse([
+    var _a;
+    if (!((_a = data.refresh_token) == null ? void 0 : _a.trim())) return this.errorResponse([
       new Error("Invalid refresh_token")
     ]);
-    const fetcher = getFetcher();
-    const res = await fetcher(`${this.config.authorizerURL}/oauth/revoke`, {
-      method: "POST",
-      headers: {
-        ...this.config.extraHeaders
-      },
-      body: JSON.stringify({
-        refresh_token: data.refresh_token,
-        client_id: this.config.clientID
-      })
-    });
-    const responseData = await res.json();
-    return this.okResponse(responseData);
+    try {
+      const fetcher = getFetcher();
+      const res = await fetcher(`${this.config.authorizerURL}/oauth/revoke`, {
+        method: "POST",
+        headers: {
+          ...this.config.extraHeaders
+        },
+        body: JSON.stringify({
+          refresh_token: data.refresh_token,
+          client_id: this.config.clientID
+        })
+      });
+      const text = await res.text();
+      let responseData = {};
+      if (text) {
+        try {
+          responseData = JSON.parse(text);
+        } catch {
+          return this.errorResponse([
+            new Error(res.ok ? "Invalid JSON from revoke endpoint" : `HTTP ${res.status}`)
+          ]);
+        }
+      }
+      if (!res.ok) {
+        const errBody = responseData;
+        return this.errorResponse([
+          new Error(String(errBody.error_description || errBody.error || `HTTP ${res.status}`))
+        ]);
+      }
+      return this.okResponse(responseData);
+    } catch (err) {
+      return this.errorResponse(err);
+    }
   }, "revokeToken");
   signup = /* @__PURE__ */ __name(async (data) => {
     var _a, _b;
@@ -437,7 +526,8 @@ var _Authorizer = class _Authorizer {
 				`,
         variables: {
           data
-        }
+        },
+        operationName: "signup"
       });
       return ((_a = res == null ? void 0 : res.errors) == null ? void 0 : _a.length) ? this.errorResponse(res.errors) : this.okResponse((_b = res.data) == null ? void 0 : _b.signup);
     } catch (err) {
@@ -454,7 +544,8 @@ var _Authorizer = class _Authorizer {
         headers,
         variables: {
           data
-        }
+        },
+        operationName: "updateProfile"
       });
       return ((_a = updateProfileRes == null ? void 0 : updateProfileRes.errors) == null ? void 0 : _a.length) ? this.errorResponse(updateProfileRes.errors) : this.okResponse((_b = updateProfileRes.data) == null ? void 0 : _b.update_profile);
     } catch (error) {
@@ -468,7 +559,8 @@ var _Authorizer = class _Authorizer {
     try {
       const res = await this.graphqlQuery({
         query: "mutation deactivateAccount { deactivate_account { message } }",
-        headers
+        headers,
+        operationName: "deactivateAccount"
       });
       return ((_a = res == null ? void 0 : res.errors) == null ? void 0 : _a.length) ? this.errorResponse(res.errors) : this.okResponse((_b = res.data) == null ? void 0 : _b.deactivate_account);
     } catch (error) {
@@ -484,7 +576,8 @@ var _Authorizer = class _Authorizer {
         query: "query validateJWTToken($params: ValidateJWTTokenRequest!){validate_jwt_token(params: $params) { is_valid claims } }",
         variables: {
           params
-        }
+        },
+        operationName: "validateJWTToken"
       });
       return ((_a = res == null ? void 0 : res.errors) == null ? void 0 : _a.length) ? this.errorResponse(res.errors) : this.okResponse((_b = res.data) == null ? void 0 : _b.validate_jwt_token);
     } catch (error) {
@@ -500,7 +593,8 @@ var _Authorizer = class _Authorizer {
         query: `query validateSession($params: ValidateSessionRequest){validate_session(params: $params) { is_valid user { ${userFragment} } } }`,
         variables: {
           params
-        }
+        },
+        operationName: "validateSession"
       });
       return ((_a = res == null ? void 0 : res.errors) == null ? void 0 : _a.length) ? this.errorResponse(res.errors) : this.okResponse((_b = res.data) == null ? void 0 : _b.validate_session);
     } catch (error) {
@@ -518,7 +612,8 @@ var _Authorizer = class _Authorizer {
 				`,
         variables: {
           data
-        }
+        },
+        operationName: "verifyEmail"
       });
       return ((_a = res == null ? void 0 : res.errors) == null ? void 0 : _a.length) ? this.errorResponse(res.errors) : this.okResponse((_b = res.data) == null ? void 0 : _b.verify_email);
     } catch (err) {
@@ -536,7 +631,8 @@ var _Authorizer = class _Authorizer {
 				`,
         variables: {
           data
-        }
+        },
+        operationName: "resendVerifyEmail"
       });
       return ((_a = res == null ? void 0 : res.errors) == null ? void 0 : _a.length) ? this.errorResponse(res.errors) : this.okResponse((_b = res.data) == null ? void 0 : _b.resend_verify_email);
     } catch (err) {
@@ -554,7 +650,8 @@ var _Authorizer = class _Authorizer {
 				`,
         variables: {
           data
-        }
+        },
+        operationName: "verifyOtp"
       });
       return ((_a = res == null ? void 0 : res.errors) == null ? void 0 : _a.length) ? this.errorResponse(res.errors) : this.okResponse((_b = res.data) == null ? void 0 : _b.verify_otp);
     } catch (err) {
@@ -568,23 +665,55 @@ var _Authorizer = class _Authorizer {
   graphqlQuery = /* @__PURE__ */ __name(async (data) => {
     var _a;
     const fetcher = getFetcher();
+    const body = {
+      query: data.query,
+      variables: data.variables || {}
+    };
+    if (data.operationName) {
+      body.operationName = data.operationName;
+    }
     const res = await fetcher(`${this.config.authorizerURL}/graphql`, {
       method: "POST",
-      body: JSON.stringify({
-        query: data.query,
-        variables: data.variables || {}
-      }),
+      body: JSON.stringify(body),
       headers: {
         ...this.config.extraHeaders,
         ...data.headers || {}
       },
       credentials: "include"
     });
-    const json = await res.json();
+    const text = await res.text();
+    let json = {};
+    if (text) {
+      try {
+        json = JSON.parse(text);
+      } catch {
+        return {
+          data: void 0,
+          errors: [
+            new Error(res.ok ? "Invalid JSON from GraphQL endpoint" : `HTTP ${res.status}`)
+          ]
+        };
+      }
+    } else if (!res.ok) {
+      return {
+        data: void 0,
+        errors: [
+          new Error(`HTTP ${res.status}`)
+        ]
+      };
+    }
     if ((_a = json == null ? void 0 : json.errors) == null ? void 0 : _a.length) {
       return {
         data: void 0,
-        errors: json.errors
+        errors: toErrorList(json.errors)
+      };
+    }
+    if (!res.ok) {
+      return {
+        data: void 0,
+        errors: [
+          new Error(`HTTP ${res.status}`)
+        ]
       };
     }
     return {
@@ -595,7 +724,7 @@ var _Authorizer = class _Authorizer {
   errorResponse = /* @__PURE__ */ __name((errors) => {
     return {
       data: void 0,
-      errors
+      errors: toErrorList(errors)
     };
   }, "errorResponse");
   okResponse = /* @__PURE__ */ __name((data) => {