@camstack/addon-provider-bosch 0.1.20 → 0.1.22

package/dist/{account-integration-offline-DvuqXgc8.mjs → account-integration-offline-34gaYDfb.mjs}

@@ -1,4 +1,5 @@
-import { x as errMsg } from "./dist-B75tWQLF.mjs";
+import { w as errMsg } from "./dist-DGlq0nuG.mjs";
+import { randomBytes } from "node:crypto";
 //#region src/shared/oauth-callback.ts
 /** A code on its own: no scheme, no query, no separators. */
 var BARE_CODE = /^[A-Za-z0-9._~-]+$/;
@@ -62,6 +63,47 @@ function parseOAuthCallback(input, expectedState) {
 	};
 }
 //#endregion
+//#region src/shared/sign-in-attempt.ts
+/** A sign-in code is only valid for a few minutes; the attempt dies with it. */
+var SIGN_IN_ATTEMPT_TTL_MS = 600 * 1e3;
+function createSignInAttemptStore(ttlMs = SIGN_IN_ATTEMPT_TTL_MS) {
+	const attempts = /* @__PURE__ */ new Map();
+	return {
+		put(verifier, state, nowMs) {
+			const attemptId = randomBytes(16).toString("base64url");
+			attempts.set(attemptId, {
+				verifier,
+				state,
+				expiresAtMs: nowMs + ttlMs
+			});
+			return attemptId;
+		},
+		take(attemptId, nowMs) {
+			const stored = attempts.get(attemptId);
+			if (stored === void 0) return {
+				ok: false,
+				reason: "missing"
+			};
+			attempts.delete(attemptId);
+			if (nowMs > stored.expiresAtMs) return {
+				ok: false,
+				reason: "expired"
+			};
+			return {
+				ok: true,
+				attempt: {
+					verifier: stored.verifier,
+					state: stored.state
+				}
+			};
+		}
+	};
+}
+/** Expired attempts use the same operator text as an expired authorization code. */
+function loginFailureForAttempt(reason) {
+	return reason === "expired" ? "code-rejected" : "state-mismatch";
+}
+//#endregion
 //#region src/shared/account-integration-cascade.ts
 async function cascadeRemoveDevicesForIntegration(input) {
 	const { reg, devices, addonId, system, integrationId, logger } = input;
@@ -99,4 +141,4 @@ function setIntegrationDevicesOnline(devices, system, integrationId, online) {
 	return count;
 }
 //#endregion
-export { cascadeRemoveDevicesForIntegration as n, parseOAuthCallback as r, setIntegrationDevicesOnline as t };
+export { parseOAuthCallback as a, loginFailureForAttempt as i, cascadeRemoveDevicesForIntegration as n, createSignInAttemptStore as r, setIntegrationDevicesOnline as t };

package/dist/{account-integration-offline-7DUtQrPy.js → account-integration-offline-DZLHsBZF.js}

@@ -1,4 +1,5 @@
-const require_dist = require("./dist-CYBUFKeW.js");
+const require_dist = require("./dist-CRlugVId.js");
+let node_crypto = require("node:crypto");
 //#region src/shared/oauth-callback.ts
 /** A code on its own: no scheme, no query, no separators. */
 var BARE_CODE = /^[A-Za-z0-9._~-]+$/;
@@ -62,6 +63,47 @@ function parseOAuthCallback(input, expectedState) {
 	};
 }
 //#endregion
+//#region src/shared/sign-in-attempt.ts
+/** A sign-in code is only valid for a few minutes; the attempt dies with it. */
+var SIGN_IN_ATTEMPT_TTL_MS = 600 * 1e3;
+function createSignInAttemptStore(ttlMs = SIGN_IN_ATTEMPT_TTL_MS) {
+	const attempts = /* @__PURE__ */ new Map();
+	return {
+		put(verifier, state, nowMs) {
+			const attemptId = (0, node_crypto.randomBytes)(16).toString("base64url");
+			attempts.set(attemptId, {
+				verifier,
+				state,
+				expiresAtMs: nowMs + ttlMs
+			});
+			return attemptId;
+		},
+		take(attemptId, nowMs) {
+			const stored = attempts.get(attemptId);
+			if (stored === void 0) return {
+				ok: false,
+				reason: "missing"
+			};
+			attempts.delete(attemptId);
+			if (nowMs > stored.expiresAtMs) return {
+				ok: false,
+				reason: "expired"
+			};
+			return {
+				ok: true,
+				attempt: {
+					verifier: stored.verifier,
+					state: stored.state
+				}
+			};
+		}
+	};
+}
+/** Expired attempts use the same operator text as an expired authorization code. */
+function loginFailureForAttempt(reason) {
+	return reason === "expired" ? "code-rejected" : "state-mismatch";
+}
+//#endregion
 //#region src/shared/account-integration-cascade.ts
 async function cascadeRemoveDevicesForIntegration(input) {
 	const { reg, devices, addonId, system, integrationId, logger } = input;
@@ -105,6 +147,18 @@ Object.defineProperty(exports, "cascadeRemoveDevicesForIntegration", {
 		return cascadeRemoveDevicesForIntegration;
 	}
 });
+Object.defineProperty(exports, "createSignInAttemptStore", {
+	enumerable: true,
+	get: function() {
+		return createSignInAttemptStore;
+	}
+});
+Object.defineProperty(exports, "loginFailureForAttempt", {
+	enumerable: true,
+	get: function() {
+		return loginFailureForAttempt;
+	}
+});
 Object.defineProperty(exports, "parseOAuthCallback", {
 	enumerable: true,
 	get: function() {