@autonomous-ai/auth-sdk 1.0.7

package/README.md

@@ -0,0 +1,300 @@
+# @autonomous-ai/auth-sdk
+
+Client SDK for the auth-service SSO flow — OAuth2 Authorization Code + PKCE (S256), with first-class React bindings.
+
+- **Zero runtime dependencies** — React is an optional peer dependency
+- **ESM only**, ships TypeScript types
+- Automatic token refresh before expiry
+- Post-login redirect via `nextUrl`, no server-side changes needed
+
+## Installation
+
+```bash
+npm install @autonomous-ai/auth-sdk
+```
+
+React is optional — only needed if you import `@autonomous-ai/auth-sdk/react`:
+
+```bash
+npm install react   # >= 18
+```
+
+### Local development
+
+```bash
+npm install && npm run build
+npm link                       # in this repo
+npm link @autonomous-ai/auth-sdk   # in the consuming app
+```
+
+## Entry points
+
+| Import path                     | Contents                                             |
+| ------------------------------- | ---------------------------------------------------- |
+| `@autonomous-ai/auth-sdk`       | `AuthClient`, `TokenManager`, PKCE helpers, all types |
+| `@autonomous-ai/auth-sdk/react` | `AuthProvider`, `useAuth`, `useUser`, `useAuthCallback` |
+
+## Quick Start (React)
+
+### 1. Wrap your app with AuthProvider
+
+Define `authConfig` outside the component (or memoize it) — a new object identity on every render re-triggers the provider's effects.
+
+```tsx
+import { AuthProvider } from "@autonomous-ai/auth-sdk/react";
+
+const authConfig = {
+  ssoUrl: "https://sso.example.com",
+  clientId: "my-app",
+  redirectUri: "https://app.example.com/callback",
+  scope: "openid profile email",
+};
+
+function App() {
+  return (
+    <AuthProvider config={authConfig}>
+      <YourApp />
+    </AuthProvider>
+  );
+}
+```
+
+### 2. Use the hooks
+
+```tsx
+import { useAuth, useUser } from "@autonomous-ai/auth-sdk/react";
+
+function LoginButton() {
+  const { isAuthenticated, login, logout, isLoading } = useAuth();
+
+  if (isLoading) return <div>Loading...</div>;
+
+  if (isAuthenticated) {
+    return <button onClick={() => logout()}>Logout</button>;
+  }
+
+  return <button onClick={() => login()}>Login with SSO</button>;
+}
+
+function UserProfile() {
+  const user = useUser();
+
+  if (!user) return null;
+
+  return <p>Welcome, {user.fullName || user.email}!</p>;
+}
+```
+
+### 3. Handle the OAuth2 callback
+
+Mount this on the route you registered as `redirectUri`. The hook reads `code` / `state` from the URL, exchanges them for tokens, and is guarded against React StrictMode double-invocation.
+
+```tsx
+import { useEffect } from "react";
+import { useAuthCallback, useAuth } from "@autonomous-ai/auth-sdk/react";
+import { useNavigate } from "react-router-dom";
+
+function CallbackPage() {
+  const navigate = useNavigate();
+  const { refreshAuthState } = useAuth();
+  const { isLoading, error, success, nextUrl } = useAuthCallback(authConfig);
+
+  useEffect(() => {
+    if (success) {
+      refreshAuthState(); // re-read tokens written by the callback
+      navigate(nextUrl || "/");
+    }
+  }, [success, nextUrl, navigate, refreshAuthState]);
+
+  if (isLoading) return <div>Processing login...</div>;
+  if (error) return <div>Login failed: {error}</div>;
+
+  return null;
+}
+```
+
+### 4. Post-login redirect (`nextUrl`)
+
+Pass `nextUrl` to `login()` to send the user back to the page they started from. It is stored in `sessionStorage` before the SSO redirect and returned by `useAuthCallback` after a successful exchange.
+
+```tsx
+import { useEffect } from "react";
+import { useAuth } from "@autonomous-ai/auth-sdk/react";
+import { useLocation } from "react-router-dom";
+
+function ProtectedPage() {
+  const location = useLocation();
+  const { isAuthenticated, isLoading, login } = useAuth();
+
+  useEffect(() => {
+    if (!isLoading && !isAuthenticated) {
+      login({
+        nextUrl: `${location.pathname}${location.search}${location.hash}`,
+      });
+    }
+  }, [isAuthenticated, isLoading, login, location]);
+
+  if (isLoading || !isAuthenticated) {
+    return <div>Redirecting to login...</div>;
+  }
+
+  return <div>Protected content</div>;
+}
+```
+
+## Vanilla JavaScript / TypeScript
+
+```typescript
+import { AuthClient } from "@autonomous-ai/auth-sdk";
+
+const client = new AuthClient({
+  ssoUrl: "https://sso.example.com",
+  clientId: "my-app",
+  redirectUri: "https://app.example.com/callback",
+  scope: "openid profile email",
+});
+
+// Start login (redirects the browser to SSO)
+await client.authorize({ nextUrl: "/dashboard" });
+
+// On the callback page
+const params = new URLSearchParams(window.location.search);
+const result = await client.handleCallback(
+  params.get("code")!,
+  params.get("state")!
+);
+
+if (result.success) {
+  if (result.nextUrl) window.location.href = result.nextUrl;
+} else {
+  console.error(result.error);
+}
+
+// Auth status
+if (client.isAuthenticated()) {
+  console.log("User:", client.getUser());
+}
+
+// Access token for API calls — refreshes automatically if expired
+const token = await client.getValidAccessToken();
+await fetch("/api/me", { headers: { Authorization: `Bearer ${token}` } });
+
+// Logout (clears tokens and redirects to SSO logout)
+client.logout();
+```
+
+## API Reference
+
+### AuthClient
+
+| Method                          | Returns                    | Description                              |
+| ------------------------------- | -------------------------- | ---------------------------------------- |
+| `authorize(options?)`           | `Promise<void>`            | Start OAuth2 login flow (redirects away)  |
+| `handleCallback(code, state)`   | `Promise<CallbackResult>`  | Exchange authorization code for tokens    |
+| `refreshToken()`                | `Promise<TokenResponse>`   | Refresh the access token                  |
+| `logout(redirectUri?)`          | `void`                     | Clear tokens and redirect to SSO logout   |
+| `isAuthenticated()`             | `boolean`                  | Whether a valid session exists            |
+| `getAccessToken()`              | `string \| null`           | Current access token                      |
+| `getRefreshToken()`             | `string \| null`           | Current refresh token                     |
+| `getUser()`                     | `User \| null`             | User decoded from the JWT                 |
+| `isTokenExpired(buffer = 60)`   | `boolean`                  | Expiry check with a seconds buffer        |
+| `getValidAccessToken()`         | `Promise<string>`          | Token, refreshed if expired               |
+| `clearTokens()`                 | `void`                     | Clear tokens without an SSO logout        |
+
+`createAuthClient(config)` is a factory shorthand for `new AuthClient(config)`.
+
+### AuthConfig
+
+| Option        | Type           | Default          | Description                          |
+| ------------- | -------------- | ---------------- | ------------------------------------ |
+| `ssoUrl`      | `string`       | required         | SSO server base URL                  |
+| `clientId`    | `string`       | required         | OAuth2 client ID                     |
+| `redirectUri` | `string`       | required         | Callback URL registered with the SSO |
+| `scope`       | `string?`      | -                | Space-separated scopes               |
+| `storage`     | `TokenStorage?` | `localStorage`  | Custom token storage                 |
+
+### AuthorizeOptions
+
+| Option      | Type                                    | Description                               |
+| ----------- | --------------------------------------- | ----------------------------------------- |
+| `prompt`    | `'select_account' \| 'none' \| 'login'` | Force account selection or silent auth    |
+| `loginHint` | `string`                                | Pre-fill email for login                  |
+| `nextUrl`   | `string`                                | URL to redirect to after successful login |
+
+### User
+
+Parsed from the JWT's `ext_info` claim.
+
+| Field                | Type        | Description               |
+| -------------------- | ----------- | ------------------------- |
+| `id`                 | `string`    | User ID                   |
+| `email`              | `string`    | User email                |
+| `fullName`           | `string?`   | Full name                 |
+| `code`               | `string?`   | User code                 |
+| `roles`              | `string[]?` | User roles                |
+| `scope`              | `string?`   | Granted scope             |
+| `companyDomain`      | `string?`   | Company domain            |
+| `companyDomainType`  | `string?`   | Company domain type       |
+| `isEppUser`          | `boolean?`  | Employee Purchase Program |
+| `vendorId`           | `string?`   | Vendor ID                 |
+| `vendorCode`         | `string?`   | Vendor code               |
+| `vendorName`         | `string?`   | Vendor name               |
+| `referralCode`       | `string?`   | Referral code             |
+
+### CallbackResult
+
+| Field     | Type              | Description                            |
+| --------- | ----------------- | -------------------------------------- |
+| `success` | `boolean`         | Whether the code exchange succeeded    |
+| `tokens`  | `TokenResponse?`  | Tokens returned by auth-service        |
+| `error`   | `string?`         | Error message when `success` is false  |
+| `nextUrl` | `string?`         | Post-login redirect target             |
+
+### React hooks
+
+| Hook                      | Returns                                                     | Description            |
+| ------------------------- | ----------------------------------------------------------- | ---------------------- |
+| `useAuth()`               | `AuthContextValue`                                           | Auth state and actions |
+| `useUser()`               | `User \| null`                                               | Current user           |
+| `useAuthCallback(config)` | `{ isLoading, error, success, result, nextUrl }`             | Handle OAuth2 callback |
+
+`useAuth()` returns `isAuthenticated`, `isLoading`, `user`, `error`, plus `login()`, `logout()`, `getAccessToken()`, `refreshToken()` and `refreshAuthState()`.
+
+`useAuthCallback` creates its own `AuthClient` and works outside `AuthProvider` — but call `refreshAuthState()` afterwards so the provider picks up the new tokens.
+
+### AuthProvider props
+
+| Prop            | Type         | Default  | Description                      |
+| --------------- | ------------ | -------- | -------------------------------- |
+| `config`        | `AuthConfig` | required | Auth configuration               |
+| `autoRefresh`   | `boolean`    | `true`   | Auto-refresh tokens              |
+| `refreshBuffer` | `number`     | `60`     | Seconds before expiry to refresh |
+| `onAuthChange`  | `function`   | -        | Called on auth state change      |
+
+## Custom storage
+
+Tokens go to `localStorage` by default. Supply any object implementing `TokenStorage` to change that — e.g. `sessionStorage` so the session dies with the tab:
+
+```typescript
+const client = new AuthClient({
+  ...config,
+  storage: {
+    getItem: (key) => sessionStorage.getItem(key),
+    setItem: (key, value) => sessionStorage.setItem(key, value),
+    removeItem: (key) => sessionStorage.removeItem(key),
+  },
+});
+```
+
+The PKCE verifier and `state` always use `sessionStorage`, regardless of this setting.
+
+## Security
+
+- PKCE (S256) prevents authorization code interception
+- `state` parameter for CSRF protection, validated on callback
+- PKCE verifier kept in `sessionStorage`, never in `localStorage`
+- Tokens refreshed automatically before expiry (`refreshBuffer`)
+
+## License
+
+MIT

package/dist/client.d.ts

@@ -0,0 +1,60 @@
+import type { AuthConfig, AuthorizeOptions, CallbackResult, TokenResponse, User } from './types';
+/**
+ * Auth Client for OAuth2 SSO flow with PKCE
+ */
+export declare class AuthClient {
+    private config;
+    private tokenManager;
+    constructor(config: AuthConfig);
+    /**
+     * Start OAuth2 authorization flow with PKCE
+     * Redirects the browser to SSO login page
+     */
+    authorize(options?: AuthorizeOptions): Promise<void>;
+    /**
+     * Handle OAuth2 callback - exchange code for tokens
+     * Call this from your callback page
+     */
+    handleCallback(code: string, state: string): Promise<CallbackResult>;
+    /**
+     * Refresh access token using refresh token
+     */
+    refreshToken(): Promise<TokenResponse>;
+    /**
+     * Logout - clears tokens and redirects to SSO logout
+     */
+    logout(redirectUri?: string): void;
+    /**
+     * Check if user is authenticated
+     */
+    isAuthenticated(): boolean;
+    /**
+     * Get current access token
+     */
+    getAccessToken(): string | null;
+    /**
+     * Get current refresh token
+     */
+    getRefreshToken(): string | null;
+    /**
+     * Get user info from current token
+     */
+    getUser(): User | null;
+    /**
+     * Check if token is expired or about to expire
+     */
+    isTokenExpired(bufferSeconds?: number): boolean;
+    /**
+     * Get a valid access token, refreshing if needed
+     */
+    getValidAccessToken(): Promise<string>;
+    /**
+     * Clear all stored tokens (local logout without SSO redirect)
+     */
+    clearTokens(): void;
+}
+/**
+ * Create a new AuthClient instance
+ */
+export declare function createAuthClient(config: AuthConfig): AuthClient;
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,UAAU,EACV,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,IAAI,EACL,MAAM,SAAS,CAAC;AAGjB;;GAEG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,YAAY,CAAe;gBAEvB,MAAM,EAAE,UAAU;IAS9B;;;OAGG;IACG,SAAS,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAuC1D;;;OAGG;IACG,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAqE1E;;OAEG;IACG,YAAY,IAAI,OAAO,CAAC,aAAa,CAAC;IAiC5C;;OAEG;IACH,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI;IAqBlC;;OAEG;IACH,eAAe,IAAI,OAAO;IAI1B;;OAEG;IACH,cAAc,IAAI,MAAM,GAAG,IAAI;IAI/B;;OAEG;IACH,eAAe,IAAI,MAAM,GAAG,IAAI;IAIhC;;OAEG;IACH,OAAO,IAAI,IAAI,GAAG,IAAI;IAItB;;OAEG;IACH,cAAc,CAAC,aAAa,GAAE,MAAW,GAAG,OAAO;IAInD;;OAEG;IACG,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;IAa5C;;OAEG;IACH,WAAW,IAAI,IAAI;CAIpB;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAE/D"}

package/dist/client.js

@@ -0,0 +1,224 @@
+import { generateCodeChallenge, generateCodeVerifier, generateState, pkceStorage } from './pkce';
+import { TokenManager, defaultStorage } from './storage';
+import { SDK_VERSION } from './version';
+/**
+ * Auth Client for OAuth2 SSO flow with PKCE
+ */
+export class AuthClient {
+    constructor(config) {
+        this.config = {
+            scope: 'openid profile email',
+            storage: defaultStorage,
+            ...config,
+        };
+        this.tokenManager = new TokenManager(this.config.storage);
+    }
+    /**
+     * Start OAuth2 authorization flow with PKCE
+     * Redirects the browser to SSO login page
+     */
+    async authorize(options) {
+        // Generate and store PKCE code verifier
+        const codeVerifier = generateCodeVerifier();
+        const codeChallenge = await generateCodeChallenge(codeVerifier);
+        pkceStorage.setCodeVerifier(codeVerifier);
+        // Generate and store state for CSRF protection
+        const state = generateState();
+        pkceStorage.setState(state);
+        // Build authorization URL
+        const params = new URLSearchParams({
+            response_type: 'code',
+            client_id: this.config.clientId,
+            redirect_uri: this.config.redirectUri,
+            scope: this.config.scope,
+            state: state,
+            code_challenge: codeChallenge,
+            code_challenge_method: 'S256',
+            autonomous_sdk_version: SDK_VERSION,
+        });
+        // Store next URL for post-login redirect
+        if (options?.nextUrl) {
+            pkceStorage.setNextUrl(options.nextUrl);
+        }
+        // Add optional parameters
+        if (options?.prompt) {
+            params.set('prompt', options.prompt);
+        }
+        if (options?.loginHint) {
+            params.set('login_hint', options.loginHint);
+        }
+        // Redirect to SSO authorization endpoint
+        window.location.href = `${this.config.ssoUrl}/oauth2/authorize?${params.toString()}`;
+    }
+    /**
+     * Handle OAuth2 callback - exchange code for tokens
+     * Call this from your callback page
+     */
+    async handleCallback(code, state) {
+        try {
+            // Verify state to prevent CSRF
+            const storedState = pkceStorage.getState();
+            if (!storedState || storedState !== state) {
+                return {
+                    success: false,
+                    error: 'Invalid state parameter - possible CSRF attack',
+                };
+            }
+            // Get PKCE code verifier
+            const codeVerifier = pkceStorage.getCodeVerifier();
+            if (!codeVerifier) {
+                return {
+                    success: false,
+                    error: 'Missing code verifier - PKCE flow incomplete',
+                };
+            }
+            // Exchange code for tokens
+            const response = await fetch(`${this.config.ssoUrl}/oauth2/token`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                },
+                body: new URLSearchParams({
+                    grant_type: 'authorization_code',
+                    code: code,
+                    redirect_uri: this.config.redirectUri,
+                    client_id: this.config.clientId,
+                    code_verifier: codeVerifier,
+                    autonomous_sdk_version: SDK_VERSION,
+                }),
+            });
+            // Get next URL before clearing PKCE storage
+            const nextUrl = pkceStorage.getNextUrl() || undefined;
+            // Clear PKCE storage after use
+            pkceStorage.clear();
+            const result = await response.json();
+            // Check for OAuth2 error response
+            if (!result.access_token) {
+                return {
+                    success: false,
+                    error: 'Token exchange failed',
+                };
+            }
+            // Store tokens
+            this.tokenManager.setTokens(result);
+            return {
+                success: true,
+                tokens: result,
+                nextUrl,
+            };
+        }
+        catch (err) {
+            pkceStorage.clear();
+            return {
+                success: false,
+                error: err instanceof Error ? err.message : 'Unknown error during callback',
+            };
+        }
+    }
+    /**
+     * Refresh access token using refresh token
+     */
+    async refreshToken() {
+        const refreshToken = this.tokenManager.getRefreshToken();
+        if (!refreshToken) {
+            throw new Error('No refresh token available');
+        }
+        const response = await fetch(`${this.config.ssoUrl}/oauth2/token`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+            body: new URLSearchParams({
+                grant_type: 'refresh_token',
+                refresh_token: refreshToken,
+                client_id: this.config.clientId,
+                autonomous_sdk_version: SDK_VERSION,
+            }),
+        });
+        const result = await response.json();
+        // Check for OAuth2 error response
+        if (!result.access_token) {
+            // Clear tokens on refresh failure
+            this.tokenManager.clearTokens();
+            throw new Error('Token refresh failed');
+        }
+        this.tokenManager.setTokens(result);
+        return result;
+    }
+    /**
+     * Logout - clears tokens and redirects to SSO logout
+     */
+    logout(redirectUri) {
+        const postLogoutRedirectUri = redirectUri || window.location.origin;
+        const idToken = this.tokenManager.getAccessToken();
+        // Clear local tokens
+        this.tokenManager.clearTokens();
+        pkceStorage.clear();
+        // Build logout URL
+        const params = new URLSearchParams({
+            post_logout_redirect_uri: postLogoutRedirectUri,
+        });
+        if (idToken) {
+            params.set('id_token_hint', idToken);
+        }
+        // Redirect to SSO logout endpoint
+        window.location.href = `${this.config.ssoUrl}/oauth2/logout?${params.toString()}`;
+    }
+    /**
+     * Check if user is authenticated
+     */
+    isAuthenticated() {
+        return this.tokenManager.isAuthenticated();
+    }
+    /**
+     * Get current access token
+     */
+    getAccessToken() {
+        return this.tokenManager.getAccessToken();
+    }
+    /**
+     * Get current refresh token
+     */
+    getRefreshToken() {
+        return this.tokenManager.getRefreshToken();
+    }
+    /**
+     * Get user info from current token
+     */
+    getUser() {
+        return this.tokenManager.getUser();
+    }
+    /**
+     * Check if token is expired or about to expire
+     */
+    isTokenExpired(bufferSeconds = 60) {
+        return this.tokenManager.isTokenExpired(bufferSeconds);
+    }
+    /**
+     * Get a valid access token, refreshing if needed
+     */
+    async getValidAccessToken() {
+        if (this.isTokenExpired()) {
+            await this.refreshToken();
+        }
+        const token = this.getAccessToken();
+        if (!token) {
+            throw new Error('No access token available');
+        }
+        return token;
+    }
+    /**
+     * Clear all stored tokens (local logout without SSO redirect)
+     */
+    clearTokens() {
+        this.tokenManager.clearTokens();
+        pkceStorage.clear();
+    }
+}
+/**
+ * Create a new AuthClient instance
+ */
+export function createAuthClient(config) {
+    return new AuthClient(config);
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACjG,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAQzD,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC;;GAEG;AACH,MAAM,OAAO,UAAU;IAIrB,YAAY,MAAkB;QAC5B,IAAI,CAAC,MAAM,GAAG;YACZ,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,cAAc;YACvB,GAAG,MAAM;SACV,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,OAA0B;QACxC,wCAAwC;QACxC,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAC;QAC5C,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAAC,YAAY,CAAC,CAAC;QAChE,WAAW,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;QAE1C,+CAA+C;QAC/C,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE5B,0BAA0B;QAC1B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,aAAa,EAAE,MAAM;YACrB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;YACxB,KAAK,EAAE,KAAK;YACZ,cAAc,EAAE,aAAa;YAC7B,qBAAqB,EAAE,MAAM;YAC7B,sBAAsB,EAAE,WAAW;SACpC,CAAC,CAAC;QAEH,yCAAyC;QACzC,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;YACrB,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;QAED,0BAA0B;QAC1B,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC9C,CAAC;QAED,yCAAyC;QACzC,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,qBAAqB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACvF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,IAAY,EAAE,KAAa;QAC9C,IAAI,CAAC;YACH,+BAA+B;YAC/B,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,EAAE,CAAC;YAC3C,IAAI,CAAC,WAAW,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;gBAC1C,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,gDAAgD;iBACxD,CAAC;YACJ,CAAC;YAED,yBAAyB;YACzB,MAAM,YAAY,GAAG,WAAW,CAAC,eAAe,EAAE,CAAC;YACnD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,8CAA8C;iBACtD,CAAC;YACJ,CAAC;YAED,2BAA2B;YAC3B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,eAAe,EAAE;gBACjE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;iBACpD;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,UAAU,EAAE,oBAAoB;oBAChC,IAAI,EAAE,IAAI;oBACV,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;oBACrC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;oBAC/B,aAAa,EAAE,YAAY;oBAC3B,sBAAsB,EAAE,WAAW;iBACpC,CAAC;aACH,CAAC,CAAC;YAEH,4CAA4C;YAC5C,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,EAAE,IAAI,SAAS,CAAC;YAEtD,+BAA+B;YAC/B,WAAW,CAAC,KAAK,EAAE,CAAC;YAEpB,MAAM,MAAM,GAAkB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAEpD,kCAAkC;YAClC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;gBACzB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,uBAAuB;iBAC/B,CAAC;YACJ,CAAC;YAED,eAAe;YACf,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAEpC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,MAAM;gBACd,OAAO;aACR,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,KAAK,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,+BAA+B;aAC5E,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY;QAChB,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,CAAC;QACzD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,eAAe,EAAE;YACjE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,YAAY;gBAC3B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC/B,sBAAsB,EAAE,WAAW;aACpC,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,MAAM,GAAkB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEpD,kCAAkC;QAClC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YACzB,kCAAkC;YAClC,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAEpC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,WAAoB;QACzB,MAAM,qBAAqB,GAAG,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QACpE,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC;QAEnD,qBAAqB;QACrB,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;QAChC,WAAW,CAAC,KAAK,EAAE,CAAC;QAEpB,mBAAmB;QACnB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,wBAAwB,EAAE,qBAAqB;SAChD,CAAC,CAAC;QAEH,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC;QAED,kCAAkC;QAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,kBAAkB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACpF,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,OAAO;QACL,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,gBAAwB,EAAE;QACvC,OAAO,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB;QACvB,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5B,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,WAAW;QACT,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;QAChC,WAAW,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAkB;IACjD,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { AuthClient, createAuthClient } from './client';
+export { TokenManager, defaultStorage } from './storage';
+export { generateCodeVerifier, generateCodeChallenge, generateState, pkceStorage, } from './pkce';
+export type { AuthConfig, TokenStorage, AuthorizeOptions, TokenResponse, OAuth2Error, ApiResponse, JwtPayload, JwtExtInfo, User, AuthState, AuthContextValue, CallbackResult, } from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,aAAa,EACb,WAAW,GACZ,MAAM,QAAQ,CAAC;AAGhB,YAAY,EACV,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,WAAW,EACX,UAAU,EACV,UAAU,EACV,IAAI,EACJ,SAAS,EACT,gBAAgB,EAChB,cAAc,GACf,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -0,0 +1,5 @@
+// Core exports
+export { AuthClient, createAuthClient } from './client';
+export { TokenManager, defaultStorage } from './storage';
+export { generateCodeVerifier, generateCodeChallenge, generateState, pkceStorage, } from './pkce';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,eAAe;AACf,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,aAAa,EACb,WAAW,GACZ,MAAM,QAAQ,CAAC"}

package/dist/pkce.d.ts

@@ -0,0 +1,34 @@
+/**
+ * PKCE (Proof Key for Code Exchange) utilities
+ * Implements RFC 7636 for OAuth2 authorization code flow security
+ */
+/**
+ * Generate a cryptographically random code verifier (43-128 chars)
+ */
+export declare function generateCodeVerifier(): string;
+/**
+ * Generate code challenge from verifier using SHA-256 (S256 method)
+ */
+export declare function generateCodeChallenge(verifier: string): Promise<string>;
+/**
+ * Generate random state for CSRF protection
+ */
+export declare function generateState(): string;
+/**
+ * PKCE and state storage using sessionStorage
+ * (More secure than localStorage for PKCE verifier)
+ */
+export declare const pkceStorage: {
+    setCodeVerifier(verifier: string): void;
+    getCodeVerifier(): string | null;
+    clearCodeVerifier(): void;
+    setState(state: string): void;
+    getState(): string | null;
+    clearState(): void;
+    setNextUrl(url: string): void;
+    getNextUrl(): string | null;
+    clearNextUrl(): void;
+    /** Clear all PKCE-related data */
+    clear(): void;
+};
+//# sourceMappingURL=pkce.d.ts.map

package/dist/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../src/pkce.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAI7C;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAK7E;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAItC;AAgBD;;;GAGG;AACH,eAAO,MAAM,WAAW;8BACI,MAAM,GAAG,IAAI;uBAIpB,MAAM,GAAG,IAAI;yBAIX,IAAI;oBAIT,MAAM,GAAG,IAAI;gBAIjB,MAAM,GAAG,IAAI;kBAIX,IAAI;oBAIF,MAAM,GAAG,IAAI;kBAIf,MAAM,GAAG,IAAI;oBAIX,IAAI;IAIpB,kCAAkC;aACzB,IAAI;CAKd,CAAC"}