@bounded-sh/client 0.0.24 → 0.0.26

package/dist/auth/oidc-auth.d.ts

@@ -16,22 +16,50 @@ export interface OidcLoginOptions {
      * when the issuer explicitly enables text OTP.
      */
     provider?: HostedAuthMethod;
+    /**
+     * Standard OIDC `prompt`. Pass `'login'` to FORCE a fresh sign-in even if the
+     * issuer already has a session — so the user can choose a DIFFERENT account
+     * (e.g. retry with another email after an access denial) instead of being
+     * silently re-signed-in as the same one. `'select_account'` behaves the same.
+     */
+    prompt?: 'login' | 'select_account' | 'consent' | 'none' | (string & {});
 }
 export interface PopupLoginOptions extends OidcLoginOptions {
     width?: number;
     height?: number;
 }
-/** Start login: navigate the whole page to the hosted Bounded login. Returns after redirect
- *  to `redirectUri?code=...`, where you call completeLoginFromRedirect(). Web only. */
-export declare function loginWithRedirect(opts: OidcLoginOptions): Promise<void>;
+/** Start hosted login (Google / Apple / email / hosted phone). Works on WEB and REACT NATIVE.
+ *
+ *  WEB: navigates the whole page to the hosted Bounded login and resolves (void) as the page
+ *  unloads; on return to `redirectUri?code=...` you call completeLoginFromRedirect().
+ *
+ *  REACT NATIVE: opens the hosted page via expo-web-browser, awaits the https universal-link
+ *  callback, runs the PKCE exchange INLINE, and resolves with the signed-in User. No
+ *  completeLoginFromRedirect() call is needed on native. Requires `redirectUri` to be an
+ *  https UNIVERSAL LINK whose origin the app owner registered in the app's allowedOrigins
+ *  (custom `myapp://` schemes are rejected by the issuer). Needs the optional peer deps
+ *  expo-web-browser + (expo-crypto or react-native-get-random-values). */
+export declare function loginWithRedirect(opts: OidcLoginOptions): Promise<User | void>;
 /** UPGRADE the current anonymous (guest) session by linking a SOCIAL/redirect login
- *  (e.g. Google) — Firebase `linkWithPopup`/redirect parity. Stashes the guest token,
- *  then runs the normal redirect login; `completeLoginFromRedirect()` on the callback
- *  page finishes the link automatically (if the social account is brand-new the guest's
- *  `@user.id` is preserved, else it stays separate). Requires an active guest session. */
-export declare function linkWithRedirect(opts: OidcLoginOptions): Promise<void>;
-/** Finish login on the redirect_uri page: exchange ?code= for a token (PKCE-verified), store
- *  the session, and return the User. Idempotent: returns null if there's no ?code= in the URL. */
+ *  (e.g. Google) — Firebase `linkWithPopup`/redirect parity. Carries the guest's signed
+ *  id-token THROUGH the OIDC authorize request (as a single-use hint bound to the PKCE
+ *  challenge), then runs the normal redirect login. The issuer completes the link during
+ *  the standard code→token exchange: if the chosen account is brand-new the guest's
+ *  `@user.id` is preserved (the returned id_token is minted under it), else the account
+ *  stays separate (guest id discarded). Requires an active guest session.
+ *
+ *  Works on WEB (navigates, finish with completeLoginFromRedirect) and REACT NATIVE
+ *  (opens expo-web-browser and resolves with the upgraded User inline). */
+export declare function linkWithRedirect(opts: OidcLoginOptions): Promise<User | void>;
+/** Finish login on the redirect_uri page (WEB ONLY): exchange ?code= for a token (PKCE-verified),
+ *  store the session, and return the User. Idempotent: returns null if there's no ?code= in the URL.
+ *  When the redirect was a guest UPGRADE (linkWithRedirect) and the issuer adopted the guest
+ *  id, the exchanged id_token already carries the preserved `@user.id`, so the returned User
+ *  reflects it automatically (no extra round-trip).
+ *
+ *  On REACT NATIVE this returns null and is a no-op: native login completes INLINE inside
+ *  loginWithRedirect()/linkWithRedirect() (which resolve with the User), so there is no
+ *  separate redirect page to finish from. Calling it on RN is harmless. */
 export declare function completeLoginFromRedirect(): Promise<User | null>;
 /** Popup variant: open the hosted login in a popup; resolves with the User once the popup's
  *  redirect_uri page posts the code back. The redirect_uri page must call completeLoginInPopup(). */

package/dist/index.js

@@ -91,6 +91,17 @@ function createWebPlatform() {
             const hash = createHash('sha256').update(data).digest();
             return hash.buffer.slice(hash.byteOffset, hash.byteOffset + hash.byteLength);
         },
+        getRandomBytes(length) {
+            const out = new Uint8Array(length);
+            const g = typeof globalThis !== 'undefined' ? globalThis : undefined;
+            if (g && g.crypto && typeof g.crypto.getRandomValues === 'function') {
+                g.crypto.getRandomValues(out);
+                return out;
+            }
+            throw new Error('No secure random source available for PKCE. On React Native, either import ' +
+                "'react-native-get-random-values' once at your app entry, or pass getRandomBytes " +
+                'via setPlatform({ getRandomBytes }) (e.g. expo-crypto getRandomBytes).');
+        },
         getUserAgent() {
             if (hasWindow && typeof navigator !== 'undefined')
                 return navigator.userAgent;
@@ -4258,24 +4269,27 @@ async function issuerBase() {
     const cfg = await core.getConfig();
     return (cfg.humanAuthApiUrl || 'https://auth.bounded.sh').replace(/\/$/, '');
 }
+// Base64url-encode raw bytes via the platform abstraction (web: window.btoa;
+// RN/Node: the polyfilled/Buffer btoa supplied by getPlatform()). On web this is
+// byte-identical to the previous direct `btoa(...)` call.
 function b64url(buf) {
     let s = '';
-    const bytes = new Uint8Array(buf);
+    const bytes = buf instanceof Uint8Array ? buf : new Uint8Array(buf);
     for (let i = 0; i < bytes.length; i++)
         s += String.fromCharCode(bytes[i]);
-    return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+    return getPlatform().btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
 }
+// PKCE verifier + S256 challenge, fully platform-neutral: random bytes and the
+// SHA-256 digest both come from getPlatform() (web → WebCrypto, RN → polyfill/
+// expo-crypto). Web output is identical to the previous raw-crypto path.
 async function makePkce() {
-    const rnd = new Uint8Array(32);
-    crypto.getRandomValues(rnd);
-    const verifier = b64url(rnd.buffer);
-    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
+    const rnd = getPlatform().getRandomBytes(32);
+    const verifier = b64url(rnd);
+    const digest = await getPlatform().sha256(getPlatform().textEncode(verifier));
     return { verifier, challenge: b64url(digest) };
 }
 function randomState() {
-    const rnd = new Uint8Array(16);
-    crypto.getRandomValues(rnd);
-    return b64url(rnd.buffer);
+    return b64url(getPlatform().getRandomBytes(16));
 }
 function normalizeMethod(value) {
     const normalized = String(value || '').trim().toLowerCase();
@@ -4291,84 +4305,171 @@ function appendHostedLoginHints(params, opts) {
     const provider = normalizeMethod(opts.provider);
     if (provider)
         params.set('bounded_provider', provider);
-}
-async function buildAuthorizeUrl(opts) {
+    // Standard OIDC prompt (e.g. 'login' to force a fresh sign-in / account choice).
+    const prompt = normalizeMethod(opts.prompt);
+    if (prompt)
+        params.set('prompt', prompt);
+}
+// Build the authorize URL + the PKCE state that pairs with it. PURE: no storage,
+// no navigation — so it's shared verbatim by the web redirect/popup paths and the
+// native (expo-web-browser) path. The caller decides where the PkceState lives
+// (web → sessionStorage across the full-page redirect; native → in-memory across
+// the awaited browser session).
+async function buildAuthorize(opts, guestHint) {
     const cfg = await core.getConfig();
     if (!cfg.appId)
         throw new Error('appId is not configured (init the SDK with your appId)');
     const redirectUri = opts.redirectUri;
     const { verifier, challenge } = await makePkce();
     const state = randomState();
-    // Stash the verifier + state so the redirect_uri page can finish the exchange. sessionStorage
-    // is per-tab and cleared on close — appropriate for a short-lived auth handshake.
-    sessionStorage.setItem(PKCE_STORE_KEY, JSON.stringify({ verifier, state, redirectUri }));
     const base = await issuerBase();
     const params = new URLSearchParams({
         client_id: cfg.appId, redirect_uri: redirectUri, response_type: 'code', scope: 'openid profile email',
         code_challenge: challenge, code_challenge_method: 'S256', state,
     });
     appendHostedLoginHints(params, opts);
-    return `${base}/api/auth/oauth2/authorize?${params.toString()}`;
+    // Anonymous→real UPGRADE (linkWithRedirect): carry the guest's signed id-token THROUGH
+    // the authorize request as a hint. The issuer signature-verifies it and binds it to this
+    // request's PKCE code_challenge, so the link is completed single-use during the normal
+    // code→token exchange — no retired /link/social, and the appId stays bound to client_id.
+    if (guestHint)
+        params.set('bounded_guest_hint', guestHint);
+    return { url: `${base}/api/auth/oauth2/authorize?${params.toString()}`, pkce: { verifier, state, redirectUri } };
+}
+// Are we on React Native (no DOM)? OIDC dispatch uses this to choose the native
+// expo-web-browser driver vs. the web full-page-redirect/popup driver.
+function isNative() {
+    return !getPlatform().hasDOM;
+}
+// ---------------------------------------------------------------------------
+// Native (React Native / Expo) redirect driver
+// ---------------------------------------------------------------------------
+// Lazily load expo-web-browser. It's an OPTIONAL peer dep — imported dynamically
+// so the web/Node bundle never requires it. Throws an actionable error if a native
+// app calls hosted login without installing it.
+async function loadExpoWebBrowser() {
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
+        return await import('expo-web-browser');
+    }
+    catch (_a) {
+        throw new Error('React Native hosted login requires the optional peer dependency "expo-web-browser". ' +
+            'Install it with `npx expo install expo-web-browser` (and `expo-crypto`), then retry.');
+    }
+}
+// Parse code/state out of the universal-link callback URL. Hand-rolled (no `new URL()`)
+// because React Native's URL implementation is non-spec-compliant for query parsing.
+function parseCallbackParams(callbackUrl) {
+    var _a, _b;
+    const qIndex = callbackUrl.indexOf('?');
+    if (qIndex < 0)
+        return { code: null, state: null };
+    const query = callbackUrl.slice(qIndex + 1).split('#')[0];
+    const out = {};
+    for (const part of query.split('&')) {
+        if (!part)
+            continue;
+        const eq = part.indexOf('=');
+        const k = eq < 0 ? part : part.slice(0, eq);
+        const v = eq < 0 ? '' : part.slice(eq + 1);
+        try {
+            out[decodeURIComponent(k)] = decodeURIComponent(v.replace(/\+/g, ' '));
+        }
+        catch (_c) {
+            out[k] = v;
+        }
+    }
+    return { code: (_a = out['code']) !== null && _a !== void 0 ? _a : null, state: (_b = out['state']) !== null && _b !== void 0 ? _b : null };
+}
+// Full native login: open the hosted page in the system auth session, await the
+// universal-link callback, verify state, and run the SAME PKCE code→token exchange
+// as web. Returns the signed-in User (native completes inline — there's no separate
+// completeLoginFromRedirect() round-trip the way the web full-page redirect needs).
+async function runNativeLogin(opts, guestHint) {
+    var _a, _b;
+    const { url, pkce } = await buildAuthorize(opts, guestHint);
+    const WebBrowser = await loadExpoWebBrowser();
+    const openAuthSession = WebBrowser.openAuthSessionAsync || ((_a = WebBrowser.default) === null || _a === void 0 ? void 0 : _a.openAuthSessionAsync);
+    if (typeof openAuthSession !== 'function') {
+        throw new Error('expo-web-browser.openAuthSessionAsync is unavailable — update expo-web-browser.');
+    }
+    setAuthLoading(true);
+    try {
+        // openAuthSessionAsync keeps JS alive while the system browser is shown, then
+        // resolves with the callback URL once the universal link fires — so `pkce`
+        // stays in scope and never needs to be persisted.
+        const result = await openAuthSession(url, opts.redirectUri);
+        if (!result || result.type === 'cancel' || result.type === 'dismiss') {
+            throw new Error('Login cancelled');
+        }
+        if (result.type !== 'success' || typeof result.url !== 'string') {
+            throw new Error(`Hosted login did not complete (result: ${(_b = result === null || result === void 0 ? void 0 : result.type) !== null && _b !== void 0 ? _b : 'unknown'})`);
+        }
+        const { code, state: returnedState } = parseCallbackParams(result.url);
+        if (!code)
+            throw new Error('No authorization code in the callback URL');
+        if (!returnedState || returnedState !== pkce.state) {
+            throw new Error('OAuth state mismatch — possible CSRF; aborting');
+        }
+        return await exchangeCode(code, pkce.verifier, pkce.redirectUri);
+    }
+    finally {
+        setAuthLoading(false);
+    }
 }
-/** Start login: navigate the whole page to the hosted Bounded login. Returns after redirect
- *  to `redirectUri?code=...`, where you call completeLoginFromRedirect(). Web only. */
+/** Start hosted login (Google / Apple / email / hosted phone). Works on WEB and REACT NATIVE.
+ *
+ *  WEB: navigates the whole page to the hosted Bounded login and resolves (void) as the page
+ *  unloads; on return to `redirectUri?code=...` you call completeLoginFromRedirect().
+ *
+ *  REACT NATIVE: opens the hosted page via expo-web-browser, awaits the https universal-link
+ *  callback, runs the PKCE exchange INLINE, and resolves with the signed-in User. No
+ *  completeLoginFromRedirect() call is needed on native. Requires `redirectUri` to be an
+ *  https UNIVERSAL LINK whose origin the app owner registered in the app's allowedOrigins
+ *  (custom `myapp://` schemes are rejected by the issuer). Needs the optional peer deps
+ *  expo-web-browser + (expo-crypto or react-native-get-random-values). */
 async function loginWithRedirect(opts) {
+    if (isNative())
+        return runNativeLogin(opts);
     if (!hasDOM())
-        throw new Error('loginWithRedirect is web-only');
-    const url = await buildAuthorizeUrl(opts);
+        throw new Error('loginWithRedirect requires a browser or a configured React Native platform');
+    const { url, pkce } = await buildAuthorize(opts);
+    // Stash the verifier + state so the redirect_uri page can finish the exchange. sessionStorage
+    // is per-tab and cleared on close — appropriate for a short-lived auth handshake.
+    sessionStorage.setItem(PKCE_STORE_KEY, JSON.stringify(pkce));
     window.location.href = url;
 }
-const LINK_GUEST_KEY = 'bounded.link.guest';
 /** UPGRADE the current anonymous (guest) session by linking a SOCIAL/redirect login
- *  (e.g. Google) — Firebase `linkWithPopup`/redirect parity. Stashes the guest token,
- *  then runs the normal redirect login; `completeLoginFromRedirect()` on the callback
- *  page finishes the link automatically (if the social account is brand-new the guest's
- *  `@user.id` is preserved, else it stays separate). Requires an active guest session. */
+ *  (e.g. Google) — Firebase `linkWithPopup`/redirect parity. Carries the guest's signed
+ *  id-token THROUGH the OIDC authorize request (as a single-use hint bound to the PKCE
+ *  challenge), then runs the normal redirect login. The issuer completes the link during
+ *  the standard code→token exchange: if the chosen account is brand-new the guest's
+ *  `@user.id` is preserved (the returned id_token is minted under it), else the account
+ *  stays separate (guest id discarded). Requires an active guest session.
+ *
+ *  Works on WEB (navigates, finish with completeLoginFromRedirect) and REACT NATIVE
+ *  (opens expo-web-browser and resolves with the upgraded User inline). */
 async function linkWithRedirect(opts) {
-    if (!hasDOM())
-        throw new Error('linkWithRedirect is web-only');
     const guestToken = sessionManager().getIdToken();
     if (!guestToken)
         throw new Error('linkWithRedirect requires an active anonymous session — call signInAnonymously() first.');
-    sessionStorage.setItem(LINK_GUEST_KEY, guestToken);
-    const url = await buildAuthorizeUrl(opts);
-    window.location.href = url;
-}
-// If a guest-link is pending (linkWithRedirect stashed a guest token before this
-// redirect), exchange it + the fresh social token for an UPGRADED token via
-// /link/social and replace the session. Returns the upgraded user, or null if no
-// link was pending / the link failed (in which case the plain social login stands).
-async function finishGuestLinkIfPending(socialIdToken) {
+    if (isNative())
+        return runNativeLogin(opts, guestToken);
     if (!hasDOM())
-        return null;
-    const guestToken = sessionStorage.getItem(LINK_GUEST_KEY);
-    if (!guestToken)
-        return null;
-    sessionStorage.removeItem(LINK_GUEST_KEY);
-    try {
-        const cfg = await core.getConfig();
-        const base = await issuerBase();
-        const res = await fetch(`${base}/link/social`, {
-            method: 'POST', headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({ appId: cfg.appId, guestToken, socialToken: socialIdToken }),
-        });
-        const data = await res.json().catch(() => null);
-        const idToken = tokenField(data, 'id_token', 'idToken');
-        if (!res.ok || !idToken)
-            return null; // link failed -> keep the plain social session
-        const upgraded = userFromIdToken(idToken);
-        const accessToken = tokenField(data, 'access_token', 'accessToken') || idToken;
-        const refreshToken = boundedRefreshTokenField(data);
-        await sessionManager().storeSession(String(upgraded.address || ''), accessToken, idToken, refreshToken, base);
-        setCurrentUser(upgraded);
-        return upgraded;
-    }
-    catch (_a) {
-        return null;
-    }
+        throw new Error('linkWithRedirect requires a browser or a configured React Native platform');
+    const { url, pkce } = await buildAuthorize(opts, guestToken);
+    sessionStorage.setItem(PKCE_STORE_KEY, JSON.stringify(pkce));
+    window.location.href = url;
 }
-/** Finish login on the redirect_uri page: exchange ?code= for a token (PKCE-verified), store
- *  the session, and return the User. Idempotent: returns null if there's no ?code= in the URL. */
+/** Finish login on the redirect_uri page (WEB ONLY): exchange ?code= for a token (PKCE-verified),
+ *  store the session, and return the User. Idempotent: returns null if there's no ?code= in the URL.
+ *  When the redirect was a guest UPGRADE (linkWithRedirect) and the issuer adopted the guest
+ *  id, the exchanged id_token already carries the preserved `@user.id`, so the returned User
+ *  reflects it automatically (no extra round-trip).
+ *
+ *  On REACT NATIVE this returns null and is a no-op: native login completes INLINE inside
+ *  loginWithRedirect()/linkWithRedirect() (which resolve with the User), so there is no
+ *  separate redirect page to finish from. Calling it on RN is harmless. */
 async function completeLoginFromRedirect() {
     if (!hasDOM())
         return null;
@@ -4387,15 +4488,11 @@ async function completeLoginFromRedirect() {
             throw new Error('OAuth state mismatch — possible CSRF; aborting');
         const user = await exchangeCode(code, pkce.verifier, pkce.redirectUri);
         sessionStorage.removeItem(PKCE_STORE_KEY);
-        // If this redirect was a guest UPGRADE (linkWithRedirect), finish the link now:
-        // swap the fresh social session for one minted under the guest's preserved id.
-        const socialIdToken = sessionManager().getIdToken();
-        const upgraded = socialIdToken ? await finishGuestLinkIfPending(socialIdToken) : null;
         // Strip code/state from the URL so a reload doesn't re-exchange (codes are single-use anyway).
         url.searchParams.delete('code');
         url.searchParams.delete('state');
         window.history.replaceState({}, document.title, url.pathname + url.search + url.hash);
-        return upgraded !== null && upgraded !== void 0 ? upgraded : user;
+        return user;
     }
     finally {
         setAuthLoading(false);
@@ -4405,8 +4502,9 @@ async function completeLoginFromRedirect() {
  *  redirect_uri page posts the code back. The redirect_uri page must call completeLoginInPopup(). */
 async function loginWithPopup(opts) {
     if (!hasDOM())
-        throw new Error('loginWithPopup is web-only');
-    const url = await buildAuthorizeUrl(opts);
+        throw new Error('loginWithPopup is web-only — on React Native use loginWithRedirect()');
+    const { url, pkce } = await buildAuthorize(opts);
+    sessionStorage.setItem(PKCE_STORE_KEY, JSON.stringify(pkce));
     const w = opts.width || 480, h = opts.height || 720;
     const left = window.screenX + (window.outerWidth - w) / 2;
     const top = window.screenY + (window.outerHeight - h) / 2;