@authu/react 1.0.67 → 1.0.69

package/dist/AuthUProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthUProvider.d.ts","sourceRoot":"","sources":["../src/AuthUProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,SAAS,EAKf,MAAM,OAAO,CAAC;AAef,OAAO,KAAK,EAEV,WAAW,EACX,iBAAiB,EAKlB,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,YAAY,mDAAgD,CAAC;AAO1E,UAAU,kBAAkB;IAC1B,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,SAAS,CAAC;CACrB;AAuDD,wBAAgB,aAAa,CAAC,EAAC,MAAM,EAAE,QAAQ,EAAC,EAAE,kBAAkB,2CA6ZnE"}
+{"version":3,"file":"AuthUProvider.d.ts","sourceRoot":"","sources":["../src/AuthUProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,SAAS,EAKf,MAAM,OAAO,CAAC;AAef,OAAO,KAAK,EAEV,WAAW,EACX,iBAAiB,EAKlB,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,YAAY,mDAAgD,CAAC;AAW1E,UAAU,kBAAkB;IAC1B,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,SAAS,CAAC;CACrB;AA2DD,wBAAgB,aAAa,CAAC,EAAC,MAAM,EAAE,QAAQ,EAAC,EAAE,kBAAkB,2CAobnE"}

package/dist/AuthUProvider.js

@@ -2,8 +2,11 @@ import { jsx as _jsx } from "react/jsx-runtime";
 import { createContext, useCallback, useEffect, useRef, useState } from 'react';
 import { clearCodeVerifier, clearNonce, clearState, generateCodeChallenge, generateCodeVerifier, generateNonce, generateState, getCodeVerifier, getStoredState, storeCodeVerifier, storeNonce, storeState } from './pkce.js';
 export const AuthUContext = createContext(null);
+// A bare IP address is a local dev server reached over the LAN (a phone
+// testing against a laptop): like localhost, it has no certificate.
+const LOCAL_DOMAIN = /^(localhost|\d{1,3}(\.\d{1,3}){3})(:\d+)?$/;
 function buildBaseUrl(domain) {
-    const protocol = domain.startsWith('localhost') ? 'http' : 'https';
+    const protocol = LOCAL_DOMAIN.test(domain) ? 'http' : 'https';
     return `${protocol}://${domain}`;
 }
 /**
@@ -35,6 +38,9 @@ const EMPTY_STATE = {
 function currentLocation() {
     return `${window.location.pathname}${window.location.search}${window.location.hash}`;
 }
+function toError(err, fallback) {
+    return err instanceof Error ? err : new Error(fallback);
+}
 /**
  * Only a same-origin path is ever restored: `//evil.example` is a valid
  * relative URL for the browser but a different origin, so a poisoned entry
@@ -140,7 +146,17 @@ export function AuthUProvider({ config, children }) {
         if (options?.returnTo) {
             sessionStorage.setItem(RETURN_TO_KEY, options.returnTo);
         }
-        window.location.href = await buildAuthorizationUrl(options);
+        try {
+            window.location.href = await buildAuthorizationUrl(options);
+        }
+        catch (err) {
+            setState(prev => ({
+                ...prev,
+                isLoading: false,
+                error: toError(err, 'Login failed')
+            }));
+            throw err;
+        }
     }, [buildAuthorizationUrl]);
     /**
      * A local logout is no longer enough: the session now lives in AuthU's own
@@ -286,8 +302,14 @@ export function AuthUProvider({ config, children }) {
                 // Read and clear the verifier in one go: React StrictMode mounts this
                 // effect twice, and the second pass must not replay the same code.
                 const codeVerifier = getCodeVerifier();
-                if (!codeVerifier)
+                if (!codeVerifier) {
+                    restoreUrl();
+                    setState({
+                        ...EMPTY_STATE,
+                        error: new Error('Missing PKCE code verifier')
+                    });
                     return;
+                }
                 clearCodeVerifier();
                 clearState();
                 clearNonce();
@@ -306,7 +328,7 @@ export function AuthUProvider({ config, children }) {
                 catch (err) {
                     setState({
                         ...EMPTY_STATE,
-                        error: err instanceof Error ? err : new Error('Authentication failed')
+                        error: toError(err, 'Authentication failed')
                     });
                 }
                 return;
@@ -320,7 +342,15 @@ export function AuthUProvider({ config, children }) {
             sessionStorage.setItem(RETURN_TO_KEY, currentLocation());
             window.location.replace(await buildAuthorizationUrl({ prompt: 'none' }));
         };
-        bootstrap();
+        // Anything thrown while starting up (storage access, the PKCE challenge,
+        // URL rewriting) must still end the loading state, or the host app spins
+        // forever without a single request leaving the page.
+        bootstrap().catch(err => {
+            setState({
+                ...EMPTY_STATE,
+                error: toError(err, 'Authentication failed')
+            });
+        });
     }, [
         buildAuthorizationUrl,
         exchangeCodeForTokensWithVerifier,

package/dist/pkce.d.ts

@@ -1,3 +1,12 @@
+/**
+ * Plain SHA-256 (FIPS 180-4), only used where crypto.subtle is missing.
+ * Browsers expose crypto.subtle in secure contexts only, so a dev server
+ * reached over the LAN (a phone opening http://192.168.x.x) has none, while
+ * crypto.getRandomValues is still there: without this fallback the challenge
+ * throws and sign-in never starts.
+ */
+export declare function sha256Fallback(data: Uint8Array): ArrayBuffer;
+export declare function base64UrlEncode(buffer: ArrayBuffer): string;
 export declare function generateCodeVerifier(): string;
 export declare function generateCodeChallenge(verifier: string): Promise<string>;
 export declare function generateState(): string;

package/dist/pkce.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../src/pkce.ts"],"names":[],"mappings":"AA2BA,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG7E;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAcD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAExD;AAED,wBAAgB,eAAe,IAAI,MAAM,GAAG,IAAI,CAE/C;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE9C;AAED,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAE9C;AAED,wBAAgB,UAAU,IAAI,IAAI,CAEjC;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE9C;AAED,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAE9C;AAED,wBAAgB,UAAU,IAAI,IAAI,CAEjC"}
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../src/pkce.ts"],"names":[],"mappings":"AAyBA;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CA0D5D;AAWD,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAU3D;AAED,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG7E;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAcD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAExD;AAED,wBAAgB,eAAe,IAAI,MAAM,GAAG,IAAI,CAE/C;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE9C;AAED,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAE9C;AAED,wBAAgB,UAAU,IAAI,IAAI,CAEjC;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE9C;AAED,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAE9C;AAED,wBAAgB,UAAU,IAAI,IAAI,CAEjC"}

package/dist/pkce.js

@@ -5,12 +5,90 @@ function generateRandomString(length) {
         .map(v => charset[v % charset.length])
         .join('');
 }
+const SHA256_K = new Uint32Array([
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,
+    0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
+    0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,
+    0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,
+    0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
+    0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,
+    0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,
+    0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
+    0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
+]);
+const rotr = (x, n) => (x >>> n) | (x << (32 - n));
+/**
+ * Plain SHA-256 (FIPS 180-4), only used where crypto.subtle is missing.
+ * Browsers expose crypto.subtle in secure contexts only, so a dev server
+ * reached over the LAN (a phone opening http://192.168.x.x) has none, while
+ * crypto.getRandomValues is still there: without this fallback the challenge
+ * throws and sign-in never starts.
+ */
+export function sha256Fallback(data) {
+    const bitLength = data.length * 8;
+    const padded = new Uint8Array(Math.ceil((data.length + 9) / 64) * 64);
+    padded.set(data);
+    padded[data.length] = 0x80;
+    const view = new DataView(padded.buffer);
+    view.setUint32(padded.length - 8, Math.floor(bitLength / 0x100000000));
+    view.setUint32(padded.length - 4, bitLength >>> 0);
+    const h = new Uint32Array([
+        0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c,
+        0x1f83d9ab, 0x5be0cd19
+    ]);
+    const w = new Uint32Array(64);
+    for (let offset = 0; offset < padded.length; offset += 64) {
+        for (let t = 0; t < 16; t++) {
+            w[t] = view.getUint32(offset + t * 4);
+        }
+        for (let t = 16; t < 64; t++) {
+            const s0 = rotr(w[t - 15], 7) ^ rotr(w[t - 15], 18) ^ (w[t - 15] >>> 3);
+            const s1 = rotr(w[t - 2], 17) ^ rotr(w[t - 2], 19) ^ (w[t - 2] >>> 10);
+            w[t] = w[t - 16] + s0 + w[t - 7] + s1;
+        }
+        let [a, b, c, d, e, f, g, hh] = h;
+        for (let t = 0; t < 64; t++) {
+            const S1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+            const ch = (e & f) ^ (~e & g);
+            const temp1 = (hh + S1 + ch + SHA256_K[t] + w[t]) >>> 0;
+            const S0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
+            const maj = (a & b) ^ (a & c) ^ (b & c);
+            const temp2 = (S0 + maj) >>> 0;
+            hh = g;
+            g = f;
+            f = e;
+            e = (d + temp1) >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (temp1 + temp2) >>> 0;
+        }
+        h[0] += a;
+        h[1] += b;
+        h[2] += c;
+        h[3] += d;
+        h[4] += e;
+        h[5] += f;
+        h[6] += g;
+        h[7] += hh;
+    }
+    const digest = new DataView(new ArrayBuffer(32));
+    for (let i = 0; i < 8; i++) {
+        digest.setUint32(i * 4, h[i]);
+    }
+    return digest.buffer;
+}
 async function sha256(plain) {
     const encoder = new TextEncoder();
     const data = encoder.encode(plain);
+    if (!globalThis.crypto?.subtle) {
+        return sha256Fallback(data);
+    }
     return crypto.subtle.digest('SHA-256', data);
 }
-function base64UrlEncode(buffer) {
+export function base64UrlEncode(buffer) {
     const bytes = new Uint8Array(buffer);
     let binary = '';
     for (let i = 0; i < bytes.byteLength; i++) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authu/react",
-  "version": "1.0.67",
+  "version": "1.0.69",
   "description": "React SDK for AuthU - Centralized Multi-Tenant Authentication Service",
   "type": "module",
   "main": "./dist/index.js",
@@ -18,8 +18,9 @@
   "scripts": {
     "build": "tsc",
     "dev": "tsc --watch",
-    "lint": "biome check src && tsc --noEmit",
-    "lint:fix": "biome check --write src",
+    "lint": "biome check src test && tsc --noEmit",
+    "lint:fix": "biome check --write src test",
+    "test": "node --test 'test/**/*.test.ts'",
     "format": "biome format --write src",
     "format:check": "biome format --check src",
     "typecheck": "tsc --noEmit",