@capgo/capacitor-social-login 8.2.25 → 8.3.1

package/android/src/main/java/ee/forgr/capacitor/social/login/SocialLoginPlugin.java

@@ -2,6 +2,7 @@ package ee.forgr.capacitor.social.login;
 
 import android.content.Intent;
 import android.net.Uri;
+import android.util.Base64;
 import android.util.Log;
 import androidx.browser.customtabs.CustomTabsIntent;
 import com.getcapacitor.JSArray;
@@ -12,6 +13,7 @@ import com.getcapacitor.PluginMethod;
 import com.getcapacitor.annotation.CapacitorPlugin;
 import ee.forgr.capacitor.social.login.helpers.DependencyAvailabilityChecker;
 import ee.forgr.capacitor.social.login.helpers.SocialProvider;
+import java.nio.charset.StandardCharsets;
 import java.util.HashMap;
 import org.json.JSONArray;
 import org.json.JSONException;
@@ -20,7 +22,7 @@ import org.json.JSONObject;
 @CapacitorPlugin(name = "SocialLogin")
 public class SocialLoginPlugin extends Plugin {
 
-    private final String pluginVersion = "8.2.25";
+    private final String pluginVersion = "8.3.1";
 
     public static String LOG_TAG = "CapgoSocialLogin";
 
@@ -430,6 +432,96 @@ public class SocialLoginPlugin extends Plugin {
         }
     }
 
+    @PluginMethod
+    public void refreshToken(final PluginCall call) {
+        String provider = call.getString("provider", "");
+        if (!"oauth2".equals(provider)) {
+            call.reject("refreshToken is only implemented for oauth2");
+            return;
+        }
+        String providerId = call.getString("providerId");
+        if (providerId == null || providerId.isEmpty()) {
+            call.reject("providerId is required for oauth2 refreshToken");
+            return;
+        }
+        SocialProvider p = socialProviderHashMap.get("oauth2");
+        if (!(p instanceof OAuth2Provider)) {
+            call.reject("OAuth2 provider is not initialized");
+            return;
+        }
+        String refreshToken = call.getString("refreshToken");
+        JSObject additionalParams = call.getObject("additionalParameters");
+        ((OAuth2Provider) p).refreshTokenRaw(call, providerId, refreshToken, additionalParams);
+    }
+
+    @PluginMethod
+    public void handleRedirectCallback(final PluginCall call) {
+        call.reject("handleRedirectCallback is only available on web");
+    }
+
+    @PluginMethod
+    public void decodeIdToken(final PluginCall call) {
+        String idToken = call.getString("idToken");
+        if (idToken == null || idToken.isEmpty()) {
+            idToken = call.getString("token");
+        }
+        if (idToken == null || idToken.isEmpty()) {
+            call.reject("idToken (or token) is required");
+            return;
+        }
+        try {
+            String[] parts = idToken.split("\\\\.");
+            if (parts.length < 2) {
+                call.reject("Invalid JWT");
+                return;
+            }
+            byte[] decoded = Base64.decode(parts[1], Base64.URL_SAFE | Base64.NO_PADDING | Base64.NO_WRAP);
+            String json = new String(decoded, StandardCharsets.UTF_8);
+            JSONObject claims = new JSONObject(json);
+            JSObject ret = new JSObject();
+            ret.put("claims", claims);
+            call.resolve(ret);
+        } catch (Exception e) {
+            call.reject("Failed to decode idToken", e);
+        }
+    }
+
+    @PluginMethod
+    public void getAccessTokenExpirationDate(final PluginCall call) {
+        Long expiresAt = call.getLong("accessTokenExpirationDate");
+        if (expiresAt == null) {
+            call.reject("accessTokenExpirationDate is required");
+            return;
+        }
+        String iso = new java.text.SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSSXXX").format(new java.util.Date(expiresAt));
+        call.resolve(new JSObject().put("date", iso));
+    }
+
+    @PluginMethod
+    public void isAccessTokenAvailable(final PluginCall call) {
+        String token = call.getString("accessToken");
+        boolean ok = token != null && !token.isEmpty();
+        call.resolve(new JSObject().put("isAvailable", ok));
+    }
+
+    @PluginMethod
+    public void isAccessTokenExpired(final PluginCall call) {
+        Long expiresAt = call.getLong("accessTokenExpirationDate");
+        if (expiresAt == null) {
+            call.reject("accessTokenExpirationDate is required");
+            return;
+        }
+        boolean expired = expiresAt <= System.currentTimeMillis();
+        call.resolve(new JSObject().put("isExpired", expired));
+    }
+
+    @PluginMethod
+    public void isRefreshTokenAvailable(final PluginCall call) {
+        String token = call.getString("refreshToken");
+        boolean ok = token != null && !token.isEmpty();
+        call.resolve(new JSObject().put("isAvailable", ok));
+    }
+
     @PluginMethod
     public void openSecureWindow(PluginCall call) {
         String authEndpoint = call.getString("authEndpoint");

package/dist/docs.json

@@ -161,6 +161,119 @@
         ],
         "slug": "refresh"
       },
+      {
+        "name": "refreshToken",
+        "signature": "(options: { provider: 'oauth2'; providerId: string; refreshToken?: string; additionalParameters?: Record<string, string>; }) => Promise<OAuth2LoginResponse>",
+        "parameters": [
+          {
+            "name": "options",
+            "docs": "",
+            "type": "{ provider: 'oauth2'; providerId: string; refreshToken?: string | undefined; additionalParameters?: Record<string, string> | undefined; }"
+          }
+        ],
+        "returns": "Promise<OAuth2LoginResponse>",
+        "tags": [],
+        "docs": "OAuth2 refresh-token helper (feature parity with Capawesome OAuth).\n\nScope:\n- Only applies to the built-in `oauth2` provider (not Google/Apple/Facebook/Twitter).\n- Requires a token endpoint (either `accessTokenEndpoint`/`tokenEndpoint` or `issuerUrl` discovery).\n\nSecurity note:\n- This does not validate JWT signatures. It only exchanges/refreshes tokens.\n\nIf `refreshToken` is omitted, the plugin will attempt to use the stored refresh token (if available).",
+        "complexTypes": [
+          "OAuth2LoginResponse",
+          "Record"
+        ],
+        "slug": "refreshtoken"
+      },
+      {
+        "name": "handleRedirectCallback",
+        "signature": "() => Promise<LoginResult | null>",
+        "parameters": [],
+        "returns": "Promise<LoginResult | null>",
+        "tags": [],
+        "docs": "Web-only: handle the OAuth redirect callback and return the parsed result.\n\nNotes:\n- This is only meaningful on Web. iOS/Android implementations will reject.\n- Intended for redirect-based flows (e.g. `oauth2` with `flow: 'redirect'`) where the page navigates away.",
+        "complexTypes": [
+          "LoginResult"
+        ],
+        "slug": "handleredirectcallback"
+      },
+      {
+        "name": "decodeIdToken",
+        "signature": "(options: { idToken?: string; token?: string; }) => Promise<{ claims: Record<string, any>; }>",
+        "parameters": [
+          {
+            "name": "options",
+            "docs": "",
+            "type": "{ idToken?: string | undefined; token?: string | undefined; }"
+          }
+        ],
+        "returns": "Promise<{ claims: Record<string, any>; }>",
+        "tags": [],
+        "docs": "Decode a JWT (typically an OIDC ID token) into its claims.\n\nNotes:\n- Accepts both `idToken` and `token` to match common naming (Capawesome uses `token`).\n- This does not validate the signature or issuer/audience. It only base64url-decodes the payload.",
+        "complexTypes": [
+          "Record"
+        ],
+        "slug": "decodeidtoken"
+      },
+      {
+        "name": "getAccessTokenExpirationDate",
+        "signature": "(options: { accessTokenExpirationDate: number; }) => Promise<{ date: string; }>",
+        "parameters": [
+          {
+            "name": "options",
+            "docs": "",
+            "type": "{ accessTokenExpirationDate: number; }"
+          }
+        ],
+        "returns": "Promise<{ date: string; }>",
+        "tags": [],
+        "docs": "Convert an access token expiration timestamp (milliseconds since epoch) to an ISO date string.\n\nThis is a pure helper (feature parity with Capawesome OAuth) and does not depend on provider state.",
+        "complexTypes": [],
+        "slug": "getaccesstokenexpirationdate"
+      },
+      {
+        "name": "isAccessTokenAvailable",
+        "signature": "(options: { accessToken: string | null; }) => Promise<{ isAvailable: boolean; }>",
+        "parameters": [
+          {
+            "name": "options",
+            "docs": "",
+            "type": "{ accessToken: string | null; }"
+          }
+        ],
+        "returns": "Promise<{ isAvailable: boolean; }>",
+        "tags": [],
+        "docs": "Check if an access token is available (non-empty).\n\nThis is a pure helper (feature parity with Capawesome OAuth) and does not depend on provider state.",
+        "complexTypes": [],
+        "slug": "isaccesstokenavailable"
+      },
+      {
+        "name": "isAccessTokenExpired",
+        "signature": "(options: { accessTokenExpirationDate: number; }) => Promise<{ isExpired: boolean; }>",
+        "parameters": [
+          {
+            "name": "options",
+            "docs": "",
+            "type": "{ accessTokenExpirationDate: number; }"
+          }
+        ],
+        "returns": "Promise<{ isExpired: boolean; }>",
+        "tags": [],
+        "docs": "Check if an access token is expired.\n\nThis is a pure helper (feature parity with Capawesome OAuth) and does not depend on provider state.",
+        "complexTypes": [],
+        "slug": "isaccesstokenexpired"
+      },
+      {
+        "name": "isRefreshTokenAvailable",
+        "signature": "(options: { refreshToken: string | null; }) => Promise<{ isAvailable: boolean; }>",
+        "parameters": [
+          {
+            "name": "options",
+            "docs": "",
+            "type": "{ refreshToken: string | null; }"
+          }
+        ],
+        "returns": "Promise<{ isAvailable: boolean; }>",
+        "tags": [],
+        "docs": "Check if a refresh token is available (non-empty).\n\nThis is a pure helper (feature parity with Capawesome OAuth) and does not depend on provider state.",
+        "complexTypes": [],
+        "slug": "isrefreshtokenavailable"
+      },
       {
         "name": "providerSpecificCall",
         "signature": "<T extends ProviderSpecificCall>(options: { call: T; options: ProviderSpecificCallOptionsMap[T]; }) => Promise<ProviderSpecificCallResponseMap[T]>",
@@ -301,9 +414,33 @@
               "name": "example"
             }
           ],
-          "docs": "The OAuth 2.0 client identifier (App ID / Client ID)",
+          "docs": "The OAuth 2.0 client identifier (App ID / Client ID).\n\nNote: this configuration object is only used by the plugin's built-in `oauth2` provider\n(i.e. `SocialLogin.initialize({ oauth2: { ... } })`). It does not affect Google/Apple/Facebook/Twitter.",
           "complexTypes": [],
-          "type": "string"
+          "type": "string | undefined"
+        },
+        {
+          "name": "clientId",
+          "tags": [
+            {
+              "text": "'your-client-id'",
+              "name": "example"
+            }
+          ],
+          "docs": "Alias for `appId` to match common OAuth/OIDC naming (`clientId`).\nIf both are provided, `appId` takes precedence.",
+          "complexTypes": [],
+          "type": "string | undefined"
+        },
+        {
+          "name": "issuerUrl",
+          "tags": [
+            {
+              "text": "'https://accounts.example.com'",
+              "name": "example"
+            }
+          ],
+          "docs": "OpenID Connect issuer URL (enables discovery via `/.well-known/openid-configuration`).\nWhen set, you may omit explicit endpoints like `authorizationBaseUrl` and `accessTokenEndpoint`.\n\nNotes:\n- Explicit endpoints (authorization/token/logout) take precedence over discovered values.\n- Discovery is supported for `oauth2` on Web, iOS, and Android.",
+          "complexTypes": [],
+          "type": "string | undefined"
         },
         {
           "name": "authorizationBaseUrl",
@@ -315,7 +452,19 @@
           ],
           "docs": "The base URL of the authorization endpoint",
           "complexTypes": [],
-          "type": "string"
+          "type": "string | undefined"
+        },
+        {
+          "name": "authorizationEndpoint",
+          "tags": [
+            {
+              "text": "'https://accounts.example.com/oauth2/authorize'",
+              "name": "example"
+            }
+          ],
+          "docs": "Alias for `authorizationBaseUrl` (to match common OAuth/OIDC naming).",
+          "complexTypes": [],
+          "type": "string | undefined"
         },
         {
           "name": "accessTokenEndpoint",
@@ -329,6 +478,18 @@
           "complexTypes": [],
           "type": "string | undefined"
         },
+        {
+          "name": "tokenEndpoint",
+          "tags": [
+            {
+              "text": "'https://accounts.example.com/oauth2/token'",
+              "name": "example"
+            }
+          ],
+          "docs": "Alias for `accessTokenEndpoint` (to match common OAuth/OIDC naming).",
+          "complexTypes": [],
+          "type": "string | undefined"
+        },
         {
           "name": "redirectUrl",
           "tags": [
@@ -383,11 +544,22 @@
             {
               "text": "'openid profile email'",
               "name": "example"
+            },
+            {
+              "text": "['openid','profile','email']",
+              "name": "example"
             }
           ],
           "docs": "Default scopes to request during authorization",
           "complexTypes": [],
-          "type": "string | undefined"
+          "type": "string | string[] | undefined"
+        },
+        {
+          "name": "scopes",
+          "tags": [],
+          "docs": "Alias for `scope` using common naming (`scopes`).\nIf both are provided, `scope` takes precedence.",
+          "complexTypes": [],
+          "type": "string[] | undefined"
         },
         {
           "name": "additionalParameters",
@@ -403,6 +575,29 @@
           ],
           "type": "Record<string, string>"
         },
+        {
+          "name": "loginHint",
+          "tags": [],
+          "docs": "Convenience option for OIDC `login_hint`.\nEquivalent to passing `additionalParameters.login_hint`.",
+          "complexTypes": [],
+          "type": "string | undefined"
+        },
+        {
+          "name": "prompt",
+          "tags": [],
+          "docs": "Convenience option for OAuth/OIDC `prompt`.\nEquivalent to passing `additionalParameters.prompt`.",
+          "complexTypes": [],
+          "type": "string | undefined"
+        },
+        {
+          "name": "additionalTokenParameters",
+          "tags": [],
+          "docs": "Additional parameters to include in token requests (code exchange / refresh).\nUseful for providers that require non-standard parameters.",
+          "complexTypes": [
+            "Record"
+          ],
+          "type": "Record<string, string>"
+        },
         {
           "name": "additionalResourceHeaders",
           "tags": [
@@ -429,6 +624,53 @@
           "complexTypes": [],
           "type": "string | undefined"
         },
+        {
+          "name": "endSessionEndpoint",
+          "tags": [
+            {
+              "text": "'https://accounts.example.com/logout'",
+              "name": "example"
+            }
+          ],
+          "docs": "Alias for `logoutUrl` to match OIDC naming (`endSessionEndpoint`).",
+          "complexTypes": [],
+          "type": "string | undefined"
+        },
+        {
+          "name": "postLogoutRedirectUrl",
+          "tags": [
+            {
+              "text": "'myapp://logout/callback'",
+              "name": "example"
+            }
+          ],
+          "docs": "OIDC post logout redirect URL (sent as `post_logout_redirect_uri` when building the end-session URL).",
+          "complexTypes": [],
+          "type": "string | undefined"
+        },
+        {
+          "name": "additionalLogoutParameters",
+          "tags": [],
+          "docs": "Additional parameters to include in logout / end-session URL.",
+          "complexTypes": [
+            "Record"
+          ],
+          "type": "Record<string, string>"
+        },
+        {
+          "name": "iosPrefersEphemeralWebBrowserSession",
+          "tags": [],
+          "docs": "iOS-only: Whether to prefer an ephemeral browser session for ASWebAuthenticationSession.\nDefaults to true to match existing behavior in this plugin.",
+          "complexTypes": [],
+          "type": "boolean | undefined"
+        },
+        {
+          "name": "iosPrefersEphemeralSession",
+          "tags": [],
+          "docs": "Alias for `iosPrefersEphemeralWebBrowserSession` (to match Capawesome OAuth naming).",
+          "complexTypes": [],
+          "type": "boolean | undefined"
+        },
         {
           "name": "logsEnabled",
           "tags": [
@@ -1210,7 +1452,14 @@
           "tags": [],
           "docs": "Override the scopes for this login request\nIf not provided, uses the scopes from initialization",
           "complexTypes": [],
-          "type": "string | undefined"
+          "type": "string | string[] | undefined"
+        },
+        {
+          "name": "scopes",
+          "tags": [],
+          "docs": "Alias for `scope` using common naming (`scopes`).\nIf both are provided, `scope` takes precedence.",
+          "complexTypes": [],
+          "type": "string[] | undefined"
         },
         {
           "name": "state",
@@ -1241,6 +1490,32 @@
             "Record"
           ],
           "type": "Record<string, string>"
+        },
+        {
+          "name": "loginHint",
+          "tags": [],
+          "docs": "Convenience option for OIDC `login_hint`.\nEquivalent to passing `additionalParameters.login_hint`.",
+          "complexTypes": [],
+          "type": "string | undefined"
+        },
+        {
+          "name": "prompt",
+          "tags": [],
+          "docs": "Convenience option for OAuth/OIDC `prompt`.\nEquivalent to passing `additionalParameters.prompt`.",
+          "complexTypes": [],
+          "type": "string | undefined"
+        },
+        {
+          "name": "flow",
+          "tags": [
+            {
+              "text": "'popup'",
+              "name": "default"
+            }
+          ],
+          "docs": "Web-only (`oauth2` provider only): Use a full-page redirect instead of a popup window.\n\nWhen using `redirect`, the promise returned by `login()` will not resolve because the page navigates away.\nAfter the redirect lands back in your app, call `SocialLogin.handleRedirectCallback()` on that page to\nparse the result.",
+          "complexTypes": [],
+          "type": "'popup' | 'redirect' | undefined"
         }
       ]
     },
@@ -1546,6 +1821,43 @@
         }
       ]
     },
+    {
+      "name": "LoginResult",
+      "slug": "loginresult",
+      "docs": "",
+      "types": [
+        {
+          "text": "{\n      provider: 'facebook';\n      result: FacebookLoginResponse;\n    }",
+          "complexTypes": [
+            "FacebookLoginResponse"
+          ]
+        },
+        {
+          "text": "{\n      provider: 'google';\n      result: GoogleLoginResponse;\n    }",
+          "complexTypes": [
+            "GoogleLoginResponse"
+          ]
+        },
+        {
+          "text": "{\n      provider: 'apple';\n      result: AppleProviderResponse;\n    }",
+          "complexTypes": [
+            "AppleProviderResponse"
+          ]
+        },
+        {
+          "text": "{\n      provider: 'twitter';\n      result: TwitterLoginResponse;\n    }",
+          "complexTypes": [
+            "TwitterLoginResponse"
+          ]
+        },
+        {
+          "text": "{\n      provider: 'oauth2';\n      result: OAuth2LoginResponse;\n    }",
+          "complexTypes": [
+            "OAuth2LoginResponse"
+          ]
+        }
+      ]
+    },
     {
       "name": "ProviderSpecificCallResponseMap",
       "slug": "providerspecificcallresponsemap",