@bigso/auth-sdk 0.5.1 → 0.5.2

package/dist/browser/index.js

@@ -0,0 +1,331 @@
+import {
+  verifySignedPayload
+} from "../chunk-5ECHA2VH.js";
+
+// src/utils/crypto.ts
+async function sha256Base64Url(input) {
+  const encoder = new TextEncoder();
+  const data = encoder.encode(input);
+  const digest = await crypto.subtle.digest("SHA-256", data);
+  return base64Url(new Uint8Array(digest));
+}
+function generateVerifier(length = 32) {
+  const array = new Uint8Array(length);
+  crypto.getRandomValues(array);
+  return base64Url(array);
+}
+function base64Url(bytes) {
+  return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function generateRandomId() {
+  return crypto.randomUUID();
+}
+
+// src/utils/events.ts
+var EventEmitter = class {
+  constructor() {
+    this.events = {};
+  }
+  on(event, handler) {
+    if (!this.events[event]) this.events[event] = [];
+    this.events[event].push(handler);
+  }
+  off(event, handler) {
+    if (!this.events[event]) return;
+    this.events[event] = this.events[event].filter((h) => h !== handler);
+  }
+  emit(event, data) {
+    this.events[event]?.forEach((fn) => fn(data));
+  }
+};
+
+// src/browser/auth.ts
+var BigsoAuth = class extends EventEmitter {
+  constructor(options) {
+    super();
+    this.authCompleted = false;
+    this.requestId = generateRandomId();
+    this.loginInProgress = false;
+    this.options = {
+      timeout: 5e3,
+      debug: false,
+      redirectUri: "",
+      tenantHint: "",
+      theme: "light",
+      ...options
+    };
+  }
+  async login() {
+    if (this.loginInProgress) {
+      this.debug("login() ya en curso, ignorando llamada duplicada");
+      return Promise.reject(new Error("Login already in progress"));
+    }
+    this.loginInProgress = true;
+    this.authCompleted = false;
+    const state = generateRandomId();
+    const nonce = generateRandomId();
+    const verifier = generateVerifier();
+    const requestId = this.requestId;
+    sessionStorage.setItem("sso_ctx", JSON.stringify({ state, nonce, verifier, requestId }));
+    this.createUI();
+    return new Promise((resolve, reject) => {
+      this.abortController = new AbortController();
+      const { signal } = this.abortController;
+      const cleanup = () => {
+        if (this.timeoutId) clearTimeout(this.timeoutId);
+        if (this.messageListener) window.removeEventListener("message", this.messageListener);
+        this.iframe?.remove();
+        this.iframe = void 0;
+        this.authCompleted = true;
+        this.loginInProgress = false;
+      };
+      this.messageListener = async (event) => {
+        if (event.origin !== this.options.ssoOrigin) {
+          this.debug("Ignorado mensaje de origen no autorizado:", event.origin);
+          return;
+        }
+        const msg = event.data;
+        this.debug("Mensaje recibido:", msg);
+        if (msg.requestId && msg.requestId !== requestId) {
+          this.debug("requestId no coincide, ignorado");
+          return;
+        }
+        if (msg.type === "sso-ready") {
+          this.debug("sso-ready recibido, iniciando timeout y enviando sso-init");
+          this.timeoutId = window.setTimeout(() => {
+            if (!this.authCompleted) {
+              this.debug("Timeout alcanzado, activando fallback");
+              this.closeUI();
+              cleanup();
+              this.emit("fallback");
+              window.location.href = this.buildFallbackUrl();
+              reject(new Error("Timeout"));
+            }
+          }, this.options.timeout);
+          const codeChallenge = await sha256Base64Url(verifier);
+          const initPayload = {
+            state,
+            nonce,
+            code_challenge: codeChallenge,
+            code_challenge_method: "S256",
+            origin: window.location.origin,
+            ...this.options.redirectUri && { redirect_uri: this.options.redirectUri },
+            ...this.options.tenantHint && { tenant_hint: this.options.tenantHint },
+            timeout_ms: this.options.timeout
+          };
+          this.iframe?.contentWindow?.postMessage({
+            v: "2.3",
+            source: "@app/widget",
+            type: "sso-init",
+            requestId: this.requestId,
+            payload: initPayload
+          }, this.options.ssoOrigin);
+          this.emit("ready");
+          return;
+        }
+        if (msg.type === "sso-success") {
+          this.debug("sso-success recibido");
+          clearTimeout(this.timeoutId);
+          try {
+            const payload = msg.payload;
+            const ctx = JSON.parse(sessionStorage.getItem("sso_ctx") || "{}");
+            if (payload.state !== ctx.state) {
+              throw new Error("Invalid state");
+            }
+            const decoded = await verifySignedPayload(
+              payload.signed_payload,
+              this.options.jwksUrl,
+              window.location.origin
+            );
+            if (decoded.nonce !== ctx.nonce) {
+              throw new Error("Invalid nonce");
+            }
+            this.debug("JWS v\xE1lido, payload:", decoded);
+            this.closeUI();
+            cleanup();
+            const result = {
+              code: decoded.code,
+              state: decoded.state || ctx.state,
+              nonce: ctx.nonce,
+              codeVerifier: ctx.verifier,
+              signed_payload: payload.signed_payload,
+              tenant: decoded.tenant,
+              jti: decoded.jti,
+              iss: decoded.iss,
+              aud: typeof decoded.aud === "string" ? decoded.aud : void 0,
+              exp: decoded.exp,
+              iat: decoded.iat
+            };
+            this.emit("success", result);
+            resolve(result);
+          } catch (err) {
+            this.debug("Error en sso-success:", err);
+            this.closeUI();
+            cleanup();
+            this.emit("error", err);
+            reject(err);
+          }
+          return;
+        }
+        if (msg.type === "sso-error") {
+          const errorPayload = msg.payload;
+          this.debug("sso-error recibido:", errorPayload);
+          clearTimeout(this.timeoutId);
+          this.closeUI();
+          cleanup();
+          if (errorPayload.code === "version_mismatch") {
+            this.emit("error", errorPayload);
+            window.location.href = this.buildFallbackUrl();
+            reject(new Error(`Version mismatch: expected ${errorPayload.expected_version}`));
+          } else {
+            this.emit("error", errorPayload);
+            reject(errorPayload);
+          }
+        }
+        if (msg.type === "sso-close") {
+          this.debug("sso-close recibido");
+          this.closeUI();
+          cleanup();
+          reject(new Error("Login cancelled by user"));
+        }
+      };
+      window.addEventListener("message", this.messageListener);
+      signal.addEventListener("abort", () => {
+        this.debug("Operaci\xF3n abortada");
+        this.closeUI();
+        cleanup();
+        reject(new Error("Login aborted"));
+      });
+    });
+  }
+  abort() {
+    this.abortController?.abort();
+  }
+  // ─── UI Management ───────────────────────────────────────────────
+  createUI() {
+    if (!this.hostEl) {
+      this.hostEl = document.createElement("div");
+      this.hostEl.id = "bigso-auth-host";
+      this.shadowRoot = this.hostEl.attachShadow({ mode: "open" });
+      const style = document.createElement("style");
+      style.textContent = this.getOverlayStyles();
+      this.shadowRoot.appendChild(style);
+      this.overlayEl = document.createElement("div");
+      this.overlayEl.className = "sso-overlay";
+      const closeBtn = document.createElement("button");
+      closeBtn.className = "sso-close-btn";
+      closeBtn.innerHTML = "×";
+      closeBtn.setAttribute("aria-label", "Cerrar modal");
+      closeBtn.addEventListener("click", () => this.abort());
+      this.overlayEl.appendChild(closeBtn);
+      this.overlayEl.addEventListener("click", (event) => {
+        if (event.target === this.overlayEl) {
+          this.abort();
+        }
+      });
+      this.shadowRoot.appendChild(this.overlayEl);
+      document.body.appendChild(this.hostEl);
+    }
+    this.iframe = document.createElement("iframe");
+    this.iframe.className = "sso-frame";
+    this.iframe.src = `${this.options.ssoOrigin}/auth/sign-in?v=2.3&client_id=${this.options.clientId}`;
+    this.iframe.setAttribute("title", "SSO Login");
+    this.overlayEl.appendChild(this.iframe);
+    this.debug("Iframe creado", this.iframe.src);
+    this.overlayEl.classList.remove("sso-closing");
+    this.overlayEl.style.display = "flex";
+  }
+  closeUI() {
+    if (!this.overlayEl || this.overlayEl.style.display === "none") return;
+    this.overlayEl.classList.add("sso-closing");
+    setTimeout(() => {
+      if (this.overlayEl) {
+        this.overlayEl.style.display = "none";
+        this.overlayEl.classList.remove("sso-closing");
+      }
+    }, 200);
+  }
+  getOverlayStyles() {
+    return `
+            .sso-overlay {
+                position: fixed;
+                inset: 0;
+                display: none;
+                justify-content: center;
+                align-items: center;
+                background: rgba(0, 0, 0, 0.6);
+                z-index: 999999;
+                backdrop-filter: blur(4px);
+                -webkit-backdrop-filter: blur(4px);
+                animation: fadeIn 0.2s ease;
+            }
+            .sso-frame {
+                width: 370px;
+                height: 350px;
+                border: none;
+                border-radius: 16px;
+                background: var(--card-bg, #fff);
+                box-shadow: 0 12px 40px rgba(0, 0, 0, 0.3);
+                animation: slideUp 0.3s ease;
+            }
+            @media (max-width: 480px), (max-height: 480px) {
+                .sso-frame {
+                    width: 100%;
+                    height: 100%;
+                    border-radius: 0;
+                }
+            }
+            .sso-close-btn {
+                position: absolute;
+                top: 12px;
+                right: 12px;
+                width: 32px;
+                height: 32px;
+                background: rgba(0, 0, 0, 0.4);
+                color: white;
+                border: none;
+                border-radius: 50%;
+                font-size: 24px;
+                line-height: 1;
+                cursor: pointer;
+                display: flex;
+                align-items: center;
+                justify-content: center;
+                z-index: 1000000;
+                transition: background 0.2s;
+            }
+            .sso-close-btn:hover {
+                background: rgba(0, 0, 0, 0.8);
+            }
+            .sso-overlay.sso-closing {
+                animation: fadeOut 0.2s ease forwards;
+            }
+            .sso-overlay.sso-closing .sso-frame {
+                animation: slideDown 0.2s ease forwards;
+            }
+            @keyframes fadeIn { from { opacity: 0; } to { opacity: 1; } }
+            @keyframes slideUp { from { transform: translateY(20px); opacity: 0; } to { transform: translateY(0); opacity: 1; } }
+            @keyframes fadeOut { from { opacity: 1; } to { opacity: 0; } }
+            @keyframes slideDown { from { transform: translateY(0); opacity: 1; } to { transform: translateY(20px); opacity: 0; } }
+        `;
+  }
+  // ─── Helpers ──────────────────────────────────────────────────────
+  buildFallbackUrl() {
+    const url = new URL(this.options.ssoOrigin);
+    url.searchParams.set("app_id", this.options.clientId);
+    url.searchParams.set("redirect_uri", this.options.redirectUri || window.location.origin);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("state", generateRandomId());
+    url.searchParams.set("code_challenge_method", "S256");
+    url.searchParams.set("client_id", this.options.clientId);
+    return url.toString();
+  }
+  debug(...args) {
+    if (this.options.debug) {
+      console.log("[BigsoAuth]", ...args);
+    }
+  }
+};
+export {
+  BigsoAuth
+};

package/dist/chunk-5ECHA2VH.js

@@ -0,0 +1,32 @@
+// src/utils/jws.ts
+import { jwtVerify, createRemoteJWKSet } from "jose";
+async function verifySignedPayload(token, jwksUrl, expectedAudience) {
+  const JWKS = createRemoteJWKSet(new URL(jwksUrl));
+  const { payload } = await jwtVerify(token, JWKS, {
+    audience: expectedAudience
+  });
+  return payload;
+}
+async function verifyAccessToken(accessToken, jwksUrl) {
+  const JWKS = createRemoteJWKSet(new URL(jwksUrl));
+  const { payload } = await jwtVerify(accessToken, JWKS);
+  if (!payload.sub || !payload.jti) {
+    throw new Error("Invalid token structure: missing sub or jti");
+  }
+  return {
+    sub: payload.sub,
+    jti: payload.jti,
+    iss: payload.iss,
+    aud: payload.aud || "",
+    exp: payload.exp,
+    iat: payload.iat,
+    tenants: payload.tenants || [],
+    systemRole: payload.systemRole || "user",
+    deviceFingerprint: payload.deviceFingerprint
+  };
+}
+
+export {
+  verifySignedPayload,
+  verifyAccessToken
+};

package/dist/express/index.cjs

@@ -0,0 +1,226 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/express/index.ts
+var express_exports = {};
+__export(express_exports, {
+  createSsoAuthRouter: () => createSsoAuthRouter,
+  createSsoSyncRouter: () => createSsoSyncRouter,
+  ssoAuthMiddleware: () => ssoAuthMiddleware,
+  ssoSyncGuardMiddleware: () => ssoSyncGuardMiddleware
+});
+module.exports = __toCommonJS(express_exports);
+
+// src/express/middlewares/ssoAuth.ts
+function ssoAuthMiddleware(options) {
+  return async (req, res, next) => {
+    try {
+      const authHeader = req.headers.authorization;
+      if (!authHeader || !authHeader.startsWith("Bearer ")) {
+        res.status(401).json({ error: "Missing access token" });
+        return;
+      }
+      const accessToken = authHeader.substring(7);
+      const payload = await options.ssoClient.validateAccessToken(accessToken);
+      if (!payload) {
+        res.status(401).json({ error: "Invalid or expired access token" });
+        return;
+      }
+      const primaryTenant = payload.tenants?.[0];
+      req.user = {
+        userId: payload.sub,
+        email: "",
+        firstName: "",
+        lastName: ""
+      };
+      req.tenant = primaryTenant || void 0;
+      req.tokenPayload = payload;
+      next();
+    } catch (error) {
+      console.error("[BigsoAuthSDK] Authentication Middleware Error:", error instanceof Error ? error.message : error);
+      res.status(401).json({ error: "Authentication failed" });
+    }
+  };
+}
+
+// src/express/middlewares/ssoSyncGuard.ts
+var import_dns = require("dns");
+function ssoSyncGuardMiddleware(options) {
+  const isProduction = options.isProduction ?? process.env.NODE_ENV === "production";
+  return async (req, res, next) => {
+    try {
+      const isSecure = req.secure || req.headers["x-forwarded-proto"] === "https";
+      if (!isSecure && isProduction) {
+        console.warn("\u26A0\uFE0F  [BigsoAuthSDK] Blocked non-HTTPS sync request");
+        res.status(403).json({ error: "HTTPS required" });
+        return;
+      }
+      const clientIp = req.ip || req.socket.remoteAddress || "";
+      const isLoopback = clientIp === "::1" || clientIp === "127.0.0.1" || clientIp === "::ffff:127.0.0.1";
+      if (!isProduction && isLoopback) {
+        return next();
+      }
+      const ssoUrl = new URL(options.ssoBackendUrl);
+      const ssoHostname = ssoUrl.hostname;
+      const ssoIps = await import_dns.promises.resolve4(ssoHostname).catch(() => []);
+      const cleanClientIp = clientIp.replace(/^.*:/, "");
+      const isPrivateIp = cleanClientIp.startsWith("10.") || cleanClientIp.startsWith("192.168.") || cleanClientIp.startsWith("172.") && parseInt(cleanClientIp.split(".")[1], 10) >= 16 && parseInt(cleanClientIp.split(".")[1], 10) <= 31;
+      if (!ssoIps.includes(cleanClientIp) && !isPrivateIp) {
+        console.warn(`\u26D4\uFE0F [BigsoAuthSDK] Blocked sync request from unauthorized IP: ${clientIp}`);
+        res.status(403).json({ error: "Unauthorized origin" });
+        return;
+      }
+      next();
+    } catch (error) {
+      console.error("\u274C [BigsoAuthSDK] Sync Guard Validation Error:", error instanceof Error ? error.message : error);
+      res.status(500).json({ error: "Security validation failed" });
+    }
+  };
+}
+
+// src/express/routes/createSsoAuthRouter.ts
+var import_express = require("express");
+function createSsoAuthRouter(options) {
+  const router = (0, import_express.Router)();
+  router.post("/exchange", async (req, res) => {
+    try {
+      const { code, codeVerifier } = req.body;
+      if (!code || !codeVerifier) {
+        res.status(400).json({ error: "code and codeVerifier are required" });
+        return;
+      }
+      const ssoResponse = await options.ssoClient.exchangeCode(code, codeVerifier);
+      if (options.onLoginSuccess) {
+        await options.onLoginSuccess(ssoResponse);
+      }
+      res.json({
+        success: true,
+        tokens: ssoResponse.tokens,
+        user: ssoResponse.user,
+        tenant: ssoResponse.tenant
+      });
+    } catch (error) {
+      console.error("[BigsoAuthSDK] Error exchanging code:", error.message);
+      res.status(401).json({ error: error.message || "Failed to exchange authorization code" });
+    }
+  });
+  router.post("/exchange-v2", async (req, res) => {
+    try {
+      const { payload } = req.body;
+      if (!payload) {
+        res.status(400).json({ error: "Signed payload is required" });
+        return;
+      }
+      const verified = await options.ssoClient.verifySignedPayload(payload, options.frontendUrl);
+      if (!verified.code) {
+        res.status(400).json({ error: "No authorization code found in payload" });
+        return;
+      }
+      const codeVerifier = verified.code_verifier;
+      if (!codeVerifier) {
+        res.status(400).json({ error: "code_verifier is required for PKCE exchange" });
+        return;
+      }
+      const ssoResponse = await options.ssoClient.exchangeCode(verified.code, codeVerifier);
+      if (options.onLoginSuccess) {
+        await options.onLoginSuccess(ssoResponse);
+      }
+      res.json({
+        success: true,
+        tokens: ssoResponse.tokens,
+        user: ssoResponse.user,
+        tenant: ssoResponse.tenant
+      });
+    } catch (error) {
+      console.error("[BigsoAuthSDK] Error exchanging v2 payload:", error.message);
+      res.status(401).json({ error: error.message || "Failed to verify signed payload" });
+    }
+  });
+  router.get("/session", ssoAuthMiddleware({ ssoClient: options.ssoClient }), (req, res) => {
+    res.set("Cache-Control", "no-store, no-cache, must-revalidate, private");
+    res.set("Pragma", "no-cache");
+    res.set("Expires", "0");
+    res.json({
+      success: true,
+      user: req.user,
+      tenant: req.tenant,
+      tokenPayload: req.tokenPayload
+    });
+  });
+  router.post("/refresh", async (req, res) => {
+    try {
+      const ssoResponse = await options.ssoClient.refreshTokens();
+      res.json({
+        success: true,
+        tokens: ssoResponse.tokens
+      });
+    } catch (error) {
+      console.error("[BigsoAuthSDK] Error refreshing tokens:", error.message);
+      res.status(401).json({ error: error.message || "Failed to refresh tokens" });
+    }
+  });
+  router.post("/logout", ssoAuthMiddleware({ ssoClient: options.ssoClient }), async (req, res) => {
+    try {
+      const accessToken = req.headers.authorization?.substring(7) || "";
+      const { revokeAll = false } = req.body || {};
+      await options.ssoClient.logout(accessToken, revokeAll);
+      if (options.onLogout) {
+        await options.onLogout(accessToken);
+      }
+      res.json({ success: true, message: "Logged out" });
+    } catch (error) {
+      console.warn("[BigsoAuthSDK] Failed to logout in SSO Backend.", error.message);
+      res.json({ success: true, message: "Logged out (backend revocation failed)" });
+    }
+  });
+  return router;
+}
+
+// src/express/routes/createSsoSyncRouter.ts
+var import_express2 = require("express");
+function createSsoSyncRouter(options) {
+  const router = (0, import_express2.Router)();
+  router.get("/resources", ssoSyncGuardMiddleware({
+    ssoBackendUrl: options.ssoBackendUrl,
+    isProduction: options.isProduction
+  }), (req, res) => {
+    try {
+      res.json({
+        success: true,
+        resources: options.resources,
+        meta: {
+          appId: options.appId,
+          count: options.resources.length,
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        }
+      });
+    } catch (error) {
+      console.error("\u274C [BigsoAuthSDK] Error in sync endpoint:", error.message);
+      res.status(500).json({ error: error.message });
+    }
+  });
+  return router;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createSsoAuthRouter,
+  createSsoSyncRouter,
+  ssoAuthMiddleware,
+  ssoSyncGuardMiddleware
+});

package/dist/express/index.d.cts

@@ -0,0 +1,46 @@
+import { Request, Response, NextFunction, Router } from 'express';
+import { BigsoSsoClient } from '../node/index.cjs';
+import { S as SsoJwtTenant, b as SsoTokenPayload, V as V2ExchangeResponse } from '../types-D5BaCbus.cjs';
+
+interface SsoAuthMiddlewareOptions {
+    ssoClient: BigsoSsoClient;
+}
+declare global {
+    namespace Express {
+        interface Request {
+            user?: {
+                userId: string;
+                email: string;
+                firstName: string;
+                lastName: string;
+            };
+            tenant?: SsoJwtTenant;
+            tokenPayload?: SsoTokenPayload;
+        }
+    }
+}
+declare function ssoAuthMiddleware(options: SsoAuthMiddlewareOptions): (req: Request, res: Response, next: NextFunction) => Promise<void>;
+
+interface SsoSyncGuardOptions {
+    ssoBackendUrl: string;
+    isProduction?: boolean;
+}
+declare function ssoSyncGuardMiddleware(options: SsoSyncGuardOptions): (req: Request, res: Response, next: NextFunction) => Promise<void>;
+
+interface CreateSsoAuthRouterOptions {
+    ssoClient: BigsoSsoClient;
+    frontendUrl: string;
+    onLoginSuccess?: (session: V2ExchangeResponse) => void | Promise<void>;
+    onLogout?: (accessToken: string) => void | Promise<void>;
+}
+declare function createSsoAuthRouter(options: CreateSsoAuthRouterOptions): Router;
+
+interface SsoSyncRouterOptions {
+    resources: any[];
+    appId: string;
+    ssoBackendUrl: string;
+    isProduction?: boolean;
+}
+declare function createSsoSyncRouter(options: SsoSyncRouterOptions): Router;
+
+export { type CreateSsoAuthRouterOptions, type SsoAuthMiddlewareOptions, type SsoSyncGuardOptions, type SsoSyncRouterOptions, createSsoAuthRouter, createSsoSyncRouter, ssoAuthMiddleware, ssoSyncGuardMiddleware };

package/dist/express/index.d.ts

@@ -0,0 +1,46 @@
+import { Request, Response, NextFunction, Router } from 'express';
+import { BigsoSsoClient } from '../node/index.js';
+import { S as SsoJwtTenant, b as SsoTokenPayload, V as V2ExchangeResponse } from '../types-D5BaCbus.js';
+
+interface SsoAuthMiddlewareOptions {
+    ssoClient: BigsoSsoClient;
+}
+declare global {
+    namespace Express {
+        interface Request {
+            user?: {
+                userId: string;
+                email: string;
+                firstName: string;
+                lastName: string;
+            };
+            tenant?: SsoJwtTenant;
+            tokenPayload?: SsoTokenPayload;
+        }
+    }
+}
+declare function ssoAuthMiddleware(options: SsoAuthMiddlewareOptions): (req: Request, res: Response, next: NextFunction) => Promise<void>;
+
+interface SsoSyncGuardOptions {
+    ssoBackendUrl: string;
+    isProduction?: boolean;
+}
+declare function ssoSyncGuardMiddleware(options: SsoSyncGuardOptions): (req: Request, res: Response, next: NextFunction) => Promise<void>;
+
+interface CreateSsoAuthRouterOptions {
+    ssoClient: BigsoSsoClient;
+    frontendUrl: string;
+    onLoginSuccess?: (session: V2ExchangeResponse) => void | Promise<void>;
+    onLogout?: (accessToken: string) => void | Promise<void>;
+}
+declare function createSsoAuthRouter(options: CreateSsoAuthRouterOptions): Router;
+
+interface SsoSyncRouterOptions {
+    resources: any[];
+    appId: string;
+    ssoBackendUrl: string;
+    isProduction?: boolean;
+}
+declare function createSsoSyncRouter(options: SsoSyncRouterOptions): Router;
+
+export { type CreateSsoAuthRouterOptions, type SsoAuthMiddlewareOptions, type SsoSyncGuardOptions, type SsoSyncRouterOptions, createSsoAuthRouter, createSsoSyncRouter, ssoAuthMiddleware, ssoSyncGuardMiddleware };