@capgo/capacitor-social-login 8.3.19 → 8.3.20

package/android/src/main/java/ee/forgr/capacitor/social/login/FacebookProvider.java

@@ -29,6 +29,7 @@ import org.json.JSONObject;
 public class FacebookProvider implements SocialProvider {
 
     private static final String LOG_TAG = "FacebookProvider";
+    private static final String USER_CANCELLED_CODE = "USER_CANCELLED";
 
     private Activity activity;
     private CallbackManager callbackManager;
@@ -109,7 +110,7 @@ public class FacebookProvider implements SocialProvider {
                     @Override
                     public void onCancel() {
                         Log.d(LOG_TAG, "LoginManager.onCancel");
-                        call.reject("Login cancelled");
+                        call.reject("Login cancelled", USER_CANCELLED_CODE);
                     }
 
                     @Override

package/android/src/main/java/ee/forgr/capacitor/social/login/GoogleProvider.java

@@ -16,6 +16,7 @@ import androidx.credentials.CustomCredential;
 import androidx.credentials.GetCredentialRequest;
 import androidx.credentials.GetCredentialResponse;
 import androidx.credentials.exceptions.ClearCredentialException;
+import androidx.credentials.exceptions.GetCredentialCancellationException;
 import androidx.credentials.exceptions.GetCredentialException;
 import androidx.credentials.exceptions.NoCredentialException;
 import com.getcapacitor.JSObject;
@@ -54,6 +55,7 @@ import org.json.JSONTokener;
 public class GoogleProvider implements SocialProvider {
 
     private static final String LOG_TAG = "GoogleProvider";
+    private static final String USER_CANCELLED_CODE = "USER_CANCELLED";
     private static final String SHARED_PREFERENCE_NAME = "GOOGLE_LOGIN_F13oz0I_SHARED_PERF";
     private static final String GOOGLE_DATA_PREFERENCE = "GOOGLE_LOGIN_GOOGLE_DATA_9158025e-947d-4211-ba51-40451630cc47";
     private static final Integer FUTURE_LIST_LENGTH = 128;
@@ -651,6 +653,10 @@ public class GoogleProvider implements SocialProvider {
                 // do nothing
             }
         }
+        if (e instanceof GetCredentialCancellationException) {
+            call.reject("Google Sign-In cancelled by user", USER_CANCELLED_CODE, e);
+            return;
+        }
         if (e instanceof NoCredentialException) {
             // Check if filterByAuthorizedAccounts is set (default is false if not explicitly set to false)
             boolean filterByAuthorizedAccountsValue = false;

package/android/src/main/java/ee/forgr/capacitor/social/login/OAuth2LoginActivity.java

@@ -17,6 +17,7 @@ public class OAuth2LoginActivity extends Activity {
 
     public static final String EXTRA_AUTH_URL = "authUrl";
     public static final String EXTRA_REDIRECT_URL = "redirectUrl";
+    public static final String EXTRA_USER_CANCELLED = "userCancelled";
 
     private String redirectUrl;
 
@@ -57,7 +58,7 @@ public class OAuth2LoginActivity extends Activity {
         setContentView(webView);
 
         if (authUrl == null) {
-            finishWithError("Missing authorization URL");
+            finishWithError("Missing authorization URL", false);
             return;
         }
 
@@ -96,15 +97,16 @@ public class OAuth2LoginActivity extends Activity {
         return false;
     }
 
-    private void finishWithError(String message) {
+    private void finishWithError(String message, boolean userCancelled) {
         Intent data = new Intent();
         data.putExtra("error", message);
+        data.putExtra(EXTRA_USER_CANCELLED, userCancelled);
         setResult(Activity.RESULT_CANCELED, data);
         finish();
     }
 
     @Override
     public void onBackPressed() {
-        finishWithError("User cancelled");
+        finishWithError("User cancelled", true);
     }
 }

package/android/src/main/java/ee/forgr/capacitor/social/login/OAuth2Provider.java

@@ -39,6 +39,7 @@ public class OAuth2Provider implements SocialProvider {
 
     public static final int REQUEST_CODE = 9402;
     private static final String LOG_TAG = "OAuth2Provider";
+    private static final String USER_CANCELLED_CODE = "USER_CANCELLED";
     private static final String PREFS_NAME = "CapgoOAuth2ProviderPrefs";
     private static final String PREFS_KEY_PREFIX = "OAuth2Tokens_";
 
@@ -671,8 +672,14 @@ public class OAuth2Provider implements SocialProvider {
         }
 
         if (resultCode != Activity.RESULT_OK) {
+            boolean userCancelled = data != null && data.getBooleanExtra(OAuth2LoginActivity.EXTRA_USER_CANCELLED, false);
             String error = data != null ? data.getStringExtra("error") : "User cancelled";
-            pendingCall.reject(error != null ? error : "User cancelled");
+            String message = error != null ? error : "User cancelled";
+            if (userCancelled) {
+                pendingCall.reject(message, USER_CANCELLED_CODE);
+            } else {
+                pendingCall.reject(message);
+            }
             cleanupPending();
             return true;
         }
@@ -687,7 +694,12 @@ public class OAuth2Provider implements SocialProvider {
         String error = data.getStringExtra("error");
         if (error != null) {
             String description = data.getStringExtra("error_description");
-            pendingCall.reject(description != null ? description : error);
+            String message = description != null ? description : error;
+            if (isUserDeniedRedirect(error, description)) {
+                pendingCall.reject(message, USER_CANCELLED_CODE);
+            } else {
+                pendingCall.reject(message);
+            }
             cleanupPending();
             return true;
         }
@@ -711,6 +723,17 @@ public class OAuth2Provider implements SocialProvider {
         return true;
     }
 
+    private boolean isUserDeniedRedirect(String error, String description) {
+        if ("access_denied".equalsIgnoreCase(error)) {
+            return true;
+        }
+        if (description == null) {
+            return false;
+        }
+        String normalizedDescription = description.toLowerCase();
+        return normalizedDescription.contains("access_denied") || normalizedDescription.contains("access denied");
+    }
+
     private void handleImplicitFlowResponse(Intent data) {
         if (pendingState == null) {
             if (pendingCall != null) {

package/android/src/main/java/ee/forgr/capacitor/social/login/SocialLoginPlugin.java

@@ -24,7 +24,7 @@ import org.json.JSONObject;
 @CapacitorPlugin(name = "SocialLogin")
 public class SocialLoginPlugin extends Plugin {
 
-    private final String pluginVersion = "8.3.19";
+    private final String pluginVersion = "8.3.20";
 
     public static String LOG_TAG = "CapgoSocialLogin";
     public HashMap<String, SocialProvider> socialProviderHashMap = new HashMap<>();

package/android/src/main/java/ee/forgr/capacitor/social/login/TwitterLoginActivity.java

@@ -17,6 +17,7 @@ public class TwitterLoginActivity extends Activity {
 
     public static final String EXTRA_AUTH_URL = "authUrl";
     public static final String EXTRA_REDIRECT_URL = "redirectUrl";
+    public static final String EXTRA_USER_CANCELLED = "userCancelled";
 
     private String redirectUrl;
 
@@ -57,7 +58,7 @@ public class TwitterLoginActivity extends Activity {
         setContentView(webView);
 
         if (authUrl == null) {
-            finishWithError("Missing authorization URL");
+            finishWithError("Missing authorization URL", false);
             return;
         }
 
@@ -79,15 +80,16 @@ public class TwitterLoginActivity extends Activity {
         return false;
     }
 
-    private void finishWithError(String message) {
+    private void finishWithError(String message, boolean userCancelled) {
         Intent data = new Intent();
         data.putExtra("error", message);
+        data.putExtra(EXTRA_USER_CANCELLED, userCancelled);
         setResult(Activity.RESULT_CANCELED, data);
         finish();
     }
 
     @Override
     public void onBackPressed() {
-        finishWithError("User cancelled");
+        finishWithError("User cancelled", true);
     }
 }

package/android/src/main/java/ee/forgr/capacitor/social/login/TwitterProvider.java

@@ -37,6 +37,7 @@ public class TwitterProvider implements SocialProvider {
 
     public static final int REQUEST_CODE = 9401;
     private static final String LOG_TAG = "TwitterProvider";
+    private static final String USER_CANCELLED_CODE = "USER_CANCELLED";
     private static final String TOKEN_ENDPOINT = "https://api.x.com/2/oauth2/token";
     private static final String PROFILE_ENDPOINT = "https://api.x.com/2/users/me";
     private static final String PREFS_NAME = "CapgoTwitterProviderPrefs";
@@ -202,8 +203,14 @@ public class TwitterProvider implements SocialProvider {
         }
 
         if (resultCode != Activity.RESULT_OK) {
+            boolean userCancelled = data != null && data.getBooleanExtra(TwitterLoginActivity.EXTRA_USER_CANCELLED, false);
             String error = data != null ? data.getStringExtra("error") : "User cancelled";
-            pendingCall.reject(error != null ? error : "User cancelled");
+            String message = error != null ? error : "User cancelled";
+            if (userCancelled) {
+                pendingCall.reject(message, USER_CANCELLED_CODE);
+            } else {
+                pendingCall.reject(message);
+            }
             cleanupPending();
             return true;
         }
@@ -218,7 +225,12 @@ public class TwitterProvider implements SocialProvider {
         String error = data.getStringExtra("error");
         if (error != null) {
             String description = data.getStringExtra("error_description");
-            pendingCall.reject(description != null ? description : error);
+            String message = description != null ? description : error;
+            if (isUserDeniedRedirect(error, description)) {
+                pendingCall.reject(message, USER_CANCELLED_CODE);
+            } else {
+                pendingCall.reject(message);
+            }
             cleanupPending();
             return true;
         }
@@ -234,6 +246,17 @@ public class TwitterProvider implements SocialProvider {
         return true;
     }
 
+    private boolean isUserDeniedRedirect(String error, String description) {
+        if ("access_denied".equalsIgnoreCase(error)) {
+            return true;
+        }
+        if (description == null) {
+            return false;
+        }
+        String normalizedDescription = description.toLowerCase();
+        return normalizedDescription.contains("access_denied") || normalizedDescription.contains("access denied");
+    }
+
     private void exchangeAuthorizationCode(String code) {
         if (pendingState == null) {
             if (pendingCall != null) {

package/dist/docs.json

@@ -42,7 +42,7 @@
         "tags": [
           {
             "name": "description",
-            "text": "login with the selected provider"
+            "text": "login with the selected provider\n\nOn user dismissal/cancellation, the Promise is rejected with `code === 'USER_CANCELLED'` (see `SocialLoginError`)."
           }
         ],
         "docs": "Login with the selected provider",

package/dist/esm/apple-provider.js

@@ -1,4 +1,5 @@
 import { BaseSocialLogin } from './base';
+import { inferUserCancelledError } from './errors';
 export class AppleSocialLogin extends BaseSocialLogin {
     constructor() {
         super(...arguments);
@@ -59,7 +60,9 @@ export class AppleSocialLogin extends BaseSocialLogin {
                 resolve({ provider: 'apple', result });
             })
                 .catch((error) => {
-                reject(error);
+                var _a, _b, _c;
+                const message = (_c = (_b = (_a = error === null || error === void 0 ? void 0 : error.message) !== null && _a !== void 0 ? _a : error === null || error === void 0 ? void 0 : error.localizedDescription) !== null && _b !== void 0 ? _b : error === null || error === void 0 ? void 0 : error.error) !== null && _c !== void 0 ? _c : 'Apple login failed';
+                reject(inferUserCancelledError(message));
             });
         });
     }

package/dist/esm/apple-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"apple-provider.js","sourceRoot":"","sources":["../../src/apple-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAKzC,MAAM,OAAO,gBAAiB,SAAQ,eAAe;IAArD;;QACU,aAAQ,GAAkB,IAAI,CAAC;QAC/B,gBAAW,GAAkB,IAAI,CAAC;QAClC,iBAAY,GAAG,KAAK,CAAC;QACrB,cAAS,GAAG,sFAAsF,CAAC;QACnG,2BAAsB,GAAG,KAAK,CAAC;IAqGzC,CAAC;IAnGC,KAAK,CAAC,UAAU,CACd,QAAuB,EACvB,WAAsC,EACtC,sBAAsB,GAAG,KAAK;QAE9B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,IAAI,IAAI,CAAC;QACvC,IAAI,CAAC,sBAAsB,GAAG,sBAAsB,CAAC;QAErD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAA6B;QACvC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;;YACrC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAChB,QAAQ,EAAE,MAAA,IAAI,CAAC,QAAQ,mCAAI,EAAE;gBAC7B,KAAK,EAAE,CAAA,MAAA,OAAO,CAAC,MAAM,0CAAE,IAAI,CAAC,GAAG,CAAC,KAAI,YAAY;gBAChD,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI;gBACrD,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YAEH,OAAO,CAAC,IAAI;iBACT,MAAM,EAAE;iBACR,IAAI,CAAC,CAAC,GAAQ,EAAE,EAAE;;gBACjB,IAAI,WAAW,GAA6B,IAAI,CAAC;gBAEjD,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;oBAChC,+EAA+E;oBAC/E,gFAAgF;oBAChF,iFAAiF;oBACjF,WAAW,GAAG,IAAI,CAAC;gBACrB,CAAC;qBAAM,CAAC;oBACN,qFAAqF;oBACrF,WAAW,GAAG;wBACZ,KAAK,EAAE,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,EAAE;qBACpC,CAAC;gBACJ,CAAC;gBAED,MAAM,MAAM,mBACV,OAAO,EAAE;wBACP,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;wBACpB,KAAK,EAAE,CAAA,MAAA,GAAG,CAAC,IAAI,0CAAE,KAAK,KAAI,IAAI;wBAC9B,SAAS,EAAE,CAAA,MAAA,MAAA,GAAG,CAAC,IAAI,0CAAE,IAAI,0CAAE,SAAS,KAAI,IAAI;wBAC5C,UAAU,EAAE,CAAA,MAAA,MAAA,GAAG,CAAC,IAAI,0CAAE,IAAI,0CAAE,QAAQ,KAAI,IAAI;qBAC7C,EACD,WAAW,EAAE,WAAW,EACxB,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,QAAQ,IAAI,IAAI,IAExC,CAAC,IAAI,CAAC,sBAAsB,IAAI,EAAE,iBAAiB,EAAE,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAClF,CAAC;gBACF,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACzC,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAU,EAAE,EAAE;gBACpB,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM;QACV,gDAAgD;QAChD,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,UAAU;QACd,8DAA8D;QAC9D,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;QACvE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,oBAAoB;QACxB,2DAA2D;QAC3D,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,OAAO;QACX,iDAAiD;QACjD,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,eAAe;QAC3B,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO;QAE9B,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;YAC/C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;CACF","sourcesContent":["import { BaseSocialLogin } from './base';\nimport type { AppleProviderOptions, AppleProviderResponse, AuthorizationCode, LoginResult } from './definitions';\n\ndeclare const AppleID: any;\n\nexport class AppleSocialLogin extends BaseSocialLogin {\n  private clientId: string | null = null;\n  private redirectUrl: string | null = null;\n  private scriptLoaded = false;\n  private scriptUrl = 'https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js';\n  private useProperTokenExchange = false;\n\n  async initialize(\n    clientId: string | null,\n    redirectUrl: string | null | undefined,\n    useProperTokenExchange = false,\n  ): Promise<void> {\n    this.clientId = clientId;\n    this.redirectUrl = redirectUrl || null;\n    this.useProperTokenExchange = useProperTokenExchange;\n\n    if (clientId) {\n      await this.loadAppleScript();\n    }\n  }\n\n  async login(options: AppleProviderOptions): Promise<LoginResult> {\n    if (!this.clientId) {\n      throw new Error('Apple Client ID not set. Call initialize() first.');\n    }\n\n    if (!this.scriptLoaded) {\n      throw new Error('Apple Sign-In script not loaded.');\n    }\n\n    return new Promise((resolve, reject) => {\n      AppleID.auth.init({\n        clientId: this.clientId ?? '',\n        scope: options.scopes?.join(' ') || 'name email',\n        redirectURI: this.redirectUrl || window.location.href,\n        state: options.state,\n        nonce: options.nonce,\n        usePopup: true,\n      });\n\n      AppleID.auth\n        .signIn()\n        .then((res: any) => {\n          let accessToken: { token: string } | null = null;\n\n          if (this.useProperTokenExchange) {\n            // When using proper token exchange, the authorization code should be exchanged\n            // for a proper access token on the backend. For now, we set accessToken to null\n            // and provide the authorization code in a separate field for backend processing.\n            accessToken = null;\n          } else {\n            // Legacy behavior: use authorization code as access token for backward compatibility\n            accessToken = {\n              token: res.authorization.code || '',\n            };\n          }\n\n          const result: AppleProviderResponse = {\n            profile: {\n              user: res.user || '',\n              email: res.user?.email || null,\n              givenName: res.user?.name?.firstName || null,\n              familyName: res.user?.name?.lastName || null,\n            },\n            accessToken: accessToken,\n            idToken: res.authorization.id_token || null,\n            // Add authorization code for proper token exchange when flag is enabled\n            ...(this.useProperTokenExchange && { authorizationCode: res.authorization.code }),\n          };\n          resolve({ provider: 'apple', result });\n        })\n        .catch((error: any) => {\n          reject(error);\n        });\n    });\n  }\n\n  async logout(): Promise<void> {\n    // Apple doesn't provide a logout method for web\n    console.log('Apple logout: Session should be managed on the client side');\n  }\n\n  async isLoggedIn(): Promise<{ isLoggedIn: boolean }> {\n    // Apple doesn't provide a method to check login status on web\n    console.log('Apple login status should be managed on the client side');\n    return { isLoggedIn: false };\n  }\n\n  async getAuthorizationCode(): Promise<AuthorizationCode> {\n    // Apple authorization code should be obtained during login\n    console.log('Apple authorization code should be stored during login');\n    throw new Error('Apple authorization code not available');\n  }\n\n  async refresh(): Promise<void> {\n    // Apple doesn't provide a refresh method for web\n    console.log('Apple refresh not available on web');\n  }\n\n  private async loadAppleScript(): Promise<void> {\n    if (this.scriptLoaded) return;\n\n    return this.loadScript(this.scriptUrl).then(() => {\n      this.scriptLoaded = true;\n    });\n  }\n}\n"]}
+{"version":3,"file":"apple-provider.js","sourceRoot":"","sources":["../../src/apple-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAEzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAInD,MAAM,OAAO,gBAAiB,SAAQ,eAAe;IAArD;;QACU,aAAQ,GAAkB,IAAI,CAAC;QAC/B,gBAAW,GAAkB,IAAI,CAAC;QAClC,iBAAY,GAAG,KAAK,CAAC;QACrB,cAAS,GAAG,sFAAsF,CAAC;QACnG,2BAAsB,GAAG,KAAK,CAAC;IAsGzC,CAAC;IApGC,KAAK,CAAC,UAAU,CACd,QAAuB,EACvB,WAAsC,EACtC,sBAAsB,GAAG,KAAK;QAE9B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,IAAI,IAAI,CAAC;QACvC,IAAI,CAAC,sBAAsB,GAAG,sBAAsB,CAAC;QAErD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAA6B;QACvC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;;YACrC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAChB,QAAQ,EAAE,MAAA,IAAI,CAAC,QAAQ,mCAAI,EAAE;gBAC7B,KAAK,EAAE,CAAA,MAAA,OAAO,CAAC,MAAM,0CAAE,IAAI,CAAC,GAAG,CAAC,KAAI,YAAY;gBAChD,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI;gBACrD,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YAEH,OAAO,CAAC,IAAI;iBACT,MAAM,EAAE;iBACR,IAAI,CAAC,CAAC,GAAQ,EAAE,EAAE;;gBACjB,IAAI,WAAW,GAA6B,IAAI,CAAC;gBAEjD,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;oBAChC,+EAA+E;oBAC/E,gFAAgF;oBAChF,iFAAiF;oBACjF,WAAW,GAAG,IAAI,CAAC;gBACrB,CAAC;qBAAM,CAAC;oBACN,qFAAqF;oBACrF,WAAW,GAAG;wBACZ,KAAK,EAAE,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,EAAE;qBACpC,CAAC;gBACJ,CAAC;gBAED,MAAM,MAAM,mBACV,OAAO,EAAE;wBACP,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;wBACpB,KAAK,EAAE,CAAA,MAAA,GAAG,CAAC,IAAI,0CAAE,KAAK,KAAI,IAAI;wBAC9B,SAAS,EAAE,CAAA,MAAA,MAAA,GAAG,CAAC,IAAI,0CAAE,IAAI,0CAAE,SAAS,KAAI,IAAI;wBAC5C,UAAU,EAAE,CAAA,MAAA,MAAA,GAAG,CAAC,IAAI,0CAAE,IAAI,0CAAE,QAAQ,KAAI,IAAI;qBAC7C,EACD,WAAW,EAAE,WAAW,EACxB,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,QAAQ,IAAI,IAAI,IAExC,CAAC,IAAI,CAAC,sBAAsB,IAAI,EAAE,iBAAiB,EAAE,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAClF,CAAC;gBACF,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACzC,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAU,EAAE,EAAE;;gBACpB,MAAM,OAAO,GAAG,MAAA,MAAA,MAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO,mCAAI,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,oBAAoB,mCAAI,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,KAAK,mCAAI,oBAAoB,CAAC;gBACtG,MAAM,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3C,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM;QACV,gDAAgD;QAChD,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,UAAU;QACd,8DAA8D;QAC9D,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;QACvE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,oBAAoB;QACxB,2DAA2D;QAC3D,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,OAAO;QACX,iDAAiD;QACjD,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,eAAe;QAC3B,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO;QAE9B,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;YAC/C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;CACF","sourcesContent":["import { BaseSocialLogin } from './base';\nimport type { AppleProviderOptions, AppleProviderResponse, AuthorizationCode, LoginResult } from './definitions';\nimport { inferUserCancelledError } from './errors';\n\ndeclare const AppleID: any;\n\nexport class AppleSocialLogin extends BaseSocialLogin {\n  private clientId: string | null = null;\n  private redirectUrl: string | null = null;\n  private scriptLoaded = false;\n  private scriptUrl = 'https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js';\n  private useProperTokenExchange = false;\n\n  async initialize(\n    clientId: string | null,\n    redirectUrl: string | null | undefined,\n    useProperTokenExchange = false,\n  ): Promise<void> {\n    this.clientId = clientId;\n    this.redirectUrl = redirectUrl || null;\n    this.useProperTokenExchange = useProperTokenExchange;\n\n    if (clientId) {\n      await this.loadAppleScript();\n    }\n  }\n\n  async login(options: AppleProviderOptions): Promise<LoginResult> {\n    if (!this.clientId) {\n      throw new Error('Apple Client ID not set. Call initialize() first.');\n    }\n\n    if (!this.scriptLoaded) {\n      throw new Error('Apple Sign-In script not loaded.');\n    }\n\n    return new Promise((resolve, reject) => {\n      AppleID.auth.init({\n        clientId: this.clientId ?? '',\n        scope: options.scopes?.join(' ') || 'name email',\n        redirectURI: this.redirectUrl || window.location.href,\n        state: options.state,\n        nonce: options.nonce,\n        usePopup: true,\n      });\n\n      AppleID.auth\n        .signIn()\n        .then((res: any) => {\n          let accessToken: { token: string } | null = null;\n\n          if (this.useProperTokenExchange) {\n            // When using proper token exchange, the authorization code should be exchanged\n            // for a proper access token on the backend. For now, we set accessToken to null\n            // and provide the authorization code in a separate field for backend processing.\n            accessToken = null;\n          } else {\n            // Legacy behavior: use authorization code as access token for backward compatibility\n            accessToken = {\n              token: res.authorization.code || '',\n            };\n          }\n\n          const result: AppleProviderResponse = {\n            profile: {\n              user: res.user || '',\n              email: res.user?.email || null,\n              givenName: res.user?.name?.firstName || null,\n              familyName: res.user?.name?.lastName || null,\n            },\n            accessToken: accessToken,\n            idToken: res.authorization.id_token || null,\n            // Add authorization code for proper token exchange when flag is enabled\n            ...(this.useProperTokenExchange && { authorizationCode: res.authorization.code }),\n          };\n          resolve({ provider: 'apple', result });\n        })\n        .catch((error: any) => {\n          const message = error?.message ?? error?.localizedDescription ?? error?.error ?? 'Apple login failed';\n          reject(inferUserCancelledError(message));\n        });\n    });\n  }\n\n  async logout(): Promise<void> {\n    // Apple doesn't provide a logout method for web\n    console.log('Apple logout: Session should be managed on the client side');\n  }\n\n  async isLoggedIn(): Promise<{ isLoggedIn: boolean }> {\n    // Apple doesn't provide a method to check login status on web\n    console.log('Apple login status should be managed on the client side');\n    return { isLoggedIn: false };\n  }\n\n  async getAuthorizationCode(): Promise<AuthorizationCode> {\n    // Apple authorization code should be obtained during login\n    console.log('Apple authorization code should be stored during login');\n    throw new Error('Apple authorization code not available');\n  }\n\n  async refresh(): Promise<void> {\n    // Apple doesn't provide a refresh method for web\n    console.log('Apple refresh not available on web');\n  }\n\n  private async loadAppleScript(): Promise<void> {\n    if (this.scriptLoaded) return;\n\n    return this.loadScript(this.scriptUrl).then(() => {\n      this.scriptLoaded = true;\n    });\n  }\n}\n"]}

package/dist/esm/definitions.d.ts

@@ -851,6 +851,21 @@ export type ProviderResponseMap = {
     twitter: TwitterLoginResponse;
     oauth2: OAuth2LoginResponse;
 };
+/**
+ * Error codes returned by the plugin.
+ * @since 8.3.x
+ */
+export type SocialLoginErrorCode = 'USER_CANCELLED';
+/**
+ * Errors thrown by SocialLogin methods.
+ *
+ * When a user dismisses or cancels the provider UI (popup closed, system dialog cancelled, access denied, etc.),
+ * the plugin rejects with `code === 'USER_CANCELLED'` so the caller can distinguish user intent from real failures.
+ * Other errors may omit the code or use provider-specific values.
+ */
+export interface SocialLoginError extends Error {
+    code?: SocialLoginErrorCode | string;
+}
 export interface SocialLoginPlugin {
     /**
      * Initialize the plugin
@@ -860,6 +875,8 @@ export interface SocialLoginPlugin {
     /**
      * Login with the selected provider
      * @description login with the selected provider
+     *
+     * On user dismissal/cancellation, the Promise is rejected with `code === 'USER_CANCELLED'` (see `SocialLoginError`).
      */
     login<T extends LoginOptions['provider']>(options: Extract<LoginOptions, {
         provider: T;

package/dist/esm/definitions.js.map

@@ -1 +1 @@
-{"version":3,"file":"definitions.js","sourceRoot":"","sources":["../../src/definitions.ts"],"names":[],"mappings":"","sourcesContent":["/**\n * Configuration for a single OAuth2 provider instance\n */\nexport interface OAuth2ProviderConfig {\n  /**\n   * The OAuth 2.0 client identifier (App ID / Client ID).\n   *\n   * Note: this configuration object is only used by the plugin's built-in `oauth2` provider\n   * (i.e. `SocialLogin.initialize({ oauth2: { ... } })`). It does not affect Google/Apple/Facebook/Twitter.\n   * @example 'your-client-id'\n   */\n  appId?: string;\n  /**\n   * Alias for `appId` to match common OAuth/OIDC naming (`clientId`).\n   * If both are provided, `appId` takes precedence.\n   * @example 'your-client-id'\n   */\n  clientId?: string;\n  /**\n   * OpenID Connect issuer URL (enables discovery via `/.well-known/openid-configuration`).\n   * When set, you may omit explicit endpoints like `authorizationBaseUrl` and `accessTokenEndpoint`.\n   *\n   * Notes:\n   * - Explicit endpoints (authorization/token/logout) take precedence over discovered values.\n   * - Discovery is supported for `oauth2` on Web, iOS, and Android.\n   *\n   * @example 'https://accounts.example.com'\n   */\n  issuerUrl?: string;\n  /**\n   * The base URL of the authorization endpoint\n   * @example 'https://accounts.example.com/oauth2/authorize'\n   */\n  authorizationBaseUrl?: string;\n  /**\n   * Alias for `authorizationBaseUrl` (to match common OAuth/OIDC naming).\n   * @example 'https://accounts.example.com/oauth2/authorize'\n   */\n  authorizationEndpoint?: string;\n  /**\n   * OAuth 2.0 client secret for token requests (e.g., when exchanging the code).\n   * This value is sent as `client_secret` in token/refresh requests when provided.\n   */\n  clientSecret?: string;\n  /**\n   * The URL to exchange the authorization code for tokens\n   * Required for authorization code flow\n   * @example 'https://accounts.example.com/oauth2/token'\n   */\n  accessTokenEndpoint?: string;\n  /**\n   * Alias for `accessTokenEndpoint` (to match common OAuth/OIDC naming).\n   * @example 'https://accounts.example.com/oauth2/token'\n   */\n  tokenEndpoint?: string;\n  /**\n   * Redirect URL that receives the OAuth callback\n   * @example 'myapp://oauth/callback'\n   */\n  redirectUrl: string;\n  /**\n   * Optional URL to fetch user profile/resource data after authentication\n   * The access token will be sent as Bearer token in the Authorization header\n   * @example 'https://api.example.com/userinfo'\n   */\n  resourceUrl?: string;\n  /**\n   * The OAuth response type\n   * - 'code': Authorization Code flow (recommended, requires accessTokenEndpoint)\n   * - 'token': Implicit flow (less secure, tokens returned directly)\n   * @default 'code'\n   */\n  responseType?: 'code' | 'token';\n  /**\n   * Enable PKCE (Proof Key for Code Exchange)\n   * Strongly recommended for public clients (mobile/web apps)\n   * @default true\n   */\n  pkceEnabled?: boolean;\n  /**\n   * Default scopes to request during authorization\n   * @example 'openid profile email'\n   * @example ['openid','profile','email']\n   */\n  scope?: string | string[];\n  /**\n   * Alias for `scope` using common naming (`scopes`).\n   * If both are provided, `scope` takes precedence.\n   */\n  scopes?: string[];\n  /**\n   * Additional parameters to include in the authorization request\n   * @example { prompt: 'consent', login_hint: 'user@example.com' }\n   */\n  additionalParameters?: Record<string, string>;\n  /**\n   * Convenience option for OIDC `login_hint`.\n   * Equivalent to passing `additionalParameters.login_hint`.\n   */\n  loginHint?: string;\n  /**\n   * Convenience option for OAuth/OIDC `prompt`.\n   * Equivalent to passing `additionalParameters.prompt`.\n   */\n  prompt?: string;\n  /**\n   * Additional parameters to include in token requests (code exchange / refresh).\n   * Useful for providers that require non-standard parameters.\n   */\n  additionalTokenParameters?: Record<string, string>;\n  /**\n   * Additional headers to include when fetching the resource URL\n   * @example { 'X-Custom-Header': 'value' }\n   */\n  additionalResourceHeaders?: Record<string, string>;\n  /**\n   * Custom logout URL for ending the session\n   * @example 'https://accounts.example.com/logout'\n   */\n  logoutUrl?: string;\n  /**\n   * Alias for `logoutUrl` to match OIDC naming (`endSessionEndpoint`).\n   * @example 'https://accounts.example.com/logout'\n   */\n  endSessionEndpoint?: string;\n  /**\n   * OIDC post logout redirect URL (sent as `post_logout_redirect_uri` when building the end-session URL).\n   * @example 'myapp://logout/callback'\n   */\n  postLogoutRedirectUrl?: string;\n  /**\n   * Additional parameters to include in logout / end-session URL.\n   */\n  additionalLogoutParameters?: Record<string, string>;\n  /**\n   * iOS-only: Whether to prefer an ephemeral browser session for ASWebAuthenticationSession.\n   * Defaults to true to match existing behavior in this plugin.\n   */\n  iosPrefersEphemeralWebBrowserSession?: boolean;\n  /**\n   * Alias for `iosPrefersEphemeralWebBrowserSession` (to match Capawesome OAuth naming).\n   */\n  iosPrefersEphemeralSession?: boolean;\n  /**\n   * Enable debug logging\n   * @default false\n   */\n  logsEnabled?: boolean;\n}\n\nexport interface InitializeOptions {\n  /**\n   * OAuth2 provider configurations.\n   * Supports multiple providers by using a Record with provider IDs as keys.\n   * @example\n   * {\n   *   github: { appId: '...', authorizationBaseUrl: 'https://github.com/login/oauth/authorize', ... },\n   *   azure: { appId: '...', authorizationBaseUrl: 'https://login.microsoftonline.com/.../oauth2/v2.0/authorize', ... }\n   * }\n   */\n  oauth2?: Record<string, OAuth2ProviderConfig>;\n  twitter?: {\n    /**\n     * The OAuth 2.0 client identifier issued by X (Twitter) Developer Portal\n     * @example 'Y2xpZW50SWQ'\n     */\n    clientId: string;\n    /**\n     * Redirect URL that is registered inside the X Developer Portal.\n     * The plugin uses this URL on every platform to receive the authorization code.\n     * @example 'myapp://auth/x'\n     */\n    redirectUrl: string;\n    /**\n     * Default scopes appended to every login request when no custom scopes are provided.\n     * @description Defaults to the minimum required scopes for Log in with X.\n     * @default ['tweet.read','users.read']\n     */\n    defaultScopes?: string[];\n    /**\n     * Force the consent screen to show on every login attempt.\n     * Mirrors X's `force_login=true` flag.\n     * @default false\n     */\n    forceLogin?: boolean;\n    /**\n     * Optional audience value when your application has been approved for multi-tenant access.\n     */\n    audience?: string;\n  };\n  facebook?: {\n    /**\n     * Facebook App ID, provided by Facebook for web, in mobile it's set in the native files\n     * @description For business integrations, use your Business App ID from Facebook Developer Console.\n     * Business apps can access additional permissions like Instagram API, Pages API, and business management features.\n     * @see docs/facebook_business_login.md for business app setup guide\n     */\n    appId: string;\n    /**\n     * Facebook Client Token, provided by Facebook for web, in mobile it's set in the native files\n     */\n    clientToken?: string;\n    /**\n     * Locale\n     * @description The locale to use for the Facebook SDK (e.g., 'en_US', 'fr_FR', 'es_ES')\n     * @default 'en_US'\n     * @example 'fr_FR'\n     */\n    locale?: string;\n  };\n\n  google?: {\n    /**\n     * The app's client ID, found and created in the Google Developers Console.\n     * Required for iOS platform.\n     * @example xxxxxx-xxxxxxxxxxxxxxxxxx.apps.googleusercontent.com\n     * @since 3.1.0\n     */\n    iOSClientId?: string;\n    /**\n     * The app's server client ID, required for offline mode on iOS.\n     * Should be the same value as webClientId.\n     * Found and created in the Google Developers Console.\n     * @example xxxxxx-xxxxxxxxxxxxxxxxxx.apps.googleusercontent.com\n     * @since 3.1.0\n     */\n    iOSServerClientId?: string;\n    /**\n     * The app's web client ID, found and created in the Google Developers Console.\n     * Required for Android and Web platforms.\n     * @example xxxxxx-xxxxxxxxxxxxxxxxxx.apps.googleusercontent.com\n     * @since 3.1.0\n     */\n    webClientId?: string;\n    /**\n     * The login mode, can be online or offline.\n     *\n     * **Online mode (default):**\n     * - Returns user profile data and access tokens\n     * - Supports all methods: login, logout, isLoggedIn, getAuthorizationCode\n     *\n     * **Offline mode:**\n     * - Returns only serverAuthCode for backend authentication\n     * - No user profile data available\n     * - **Limitations:** The following methods are NOT supported in offline mode:\n     *   - `logout()` - Will reject with \"not implemented when using offline mode\"\n     *   - `isLoggedIn()` - Will reject with \"not implemented when using offline mode\"\n     *   - `getAuthorizationCode()` - Will reject with \"not implemented when using offline mode\"\n     *   - `refresh()` - Will reject because offline mode only returns `serverAuthCode`; token refresh must happen on your backend\n     * - Only `login()` method works in offline mode, returning serverAuthCode only\n     * - `serverAuthCode` must be exchanged on your backend for access/refresh tokens\n     * - Requires `iOSServerClientId` to be set on iOS\n     *\n     * @example 'offline'\n     * @default 'online'\n     * @since 3.1.0\n     */\n    mode?: 'online' | 'offline';\n    /**\n     * Filter visible accounts by hosted domain\n     * @description filter visible accounts by hosted domain\n     */\n    hostedDomain?: string;\n    /**\n     * Google Redirect URL, should be your backend url that is configured in your google app\n     */\n    redirectUrl?: string;\n  };\n  apple?: {\n    /**\n     * Apple Client ID, provided by Apple for web and Android\n     */\n    clientId?: string;\n    /**\n     * Apple Redirect URL, should be your backend url that is configured in your apple app\n     *\n     * **Note**: Use empty string `''` for iOS to prevent redirect.\n     * **Note**: Not required when using Broadcast Channel mode on Android.\n     */\n    redirectUrl?: string;\n    /**\n     * Use proper token exchange for Apple Sign-In\n     * @description Controls how Apple Sign-In tokens are handled and what gets returned:\n     *\n     * **When `true` (Recommended for new implementations):**\n     * - Exchanges authorization code for proper access tokens via Apple's token endpoint\n     * - `idToken`: JWT containing user identity information (email, name, user ID)\n     * - `accessToken.token`: Proper access token from Apple (short-lived, ~1 hour)\n     * - `authorizationCode`: Raw authorization code for backend token exchange\n     *\n     * **When `false` (Default - Legacy mode):**\n     * - Uses authorization code directly as access token for backward compatibility\n     * - `idToken`: JWT containing user identity information (email, name, user ID)\n     * - `accessToken.token`: The authorization code itself (not a real access token)\n     * - `authorizationCode`: undefined\n     *\n     * @default false\n     * @example\n     * // Enable proper token exchange (recommended)\n     * useProperTokenExchange: true\n     * // Result: idToken=JWT, accessToken=real_token, authorizationCode=present\n     *\n     * // Legacy mode (backward compatibility)\n     * useProperTokenExchange: false\n     * // Result: idToken=JWT, accessToken=auth_code, authorizationCode=undefined\n     */\n    useProperTokenExchange?: boolean;\n    /**\n     * Use Broadcast Channel for Android Apple Sign-In (Recommended)\n     * @description When enabled, Android uses Broadcast Channel API instead of URL redirects.\n     * This eliminates the need for redirect URL configuration and server-side setup.\n     *\n     * **Benefits:**\n     * - No redirect URL configuration required\n     * - No backend server needed for Android\n     * - Simpler setup and more reliable communication\n     * - Direct client-server communication via Broadcast Channel\n     *\n     * **When `true`:**\n     * - Uses Broadcast Channel for authentication flow\n     * - `redirectUrl` is ignored\n     * - Requires Broadcast Channel compatible backend or direct token handling\n     *\n     * **When `false` (Default - Legacy mode):**\n     * - Uses traditional URL redirect flow\n     * - Requires `redirectUrl` configuration\n     * - Requires backend server for token exchange\n     *\n     * @default false\n     * @since 7.10.0\n     * @example\n     * // Enable Broadcast Channel mode (recommended for new Android implementations)\n     * useBroadcastChannel: true\n     * // Result: Simplified setup, no redirect URL needed\n     *\n     * // Legacy mode (backward compatibility)\n     * useBroadcastChannel: false\n     * // Result: Traditional URL redirect flow with server-side setup\n     */\n    useBroadcastChannel?: boolean;\n  };\n}\n\nexport interface FacebookLoginOptions {\n  /**\n   * Permissions\n   * @description Select permissions to login with. Supports both consumer and business permissions.\n   *\n   * **Consumer Permissions:**\n   * - `email` - User's email address\n   * - `public_profile` - User's public profile info\n   * - `user_friends` - List of friends who also use your app\n   *\n   * **Business Permissions** (require business app configuration and may need App Review):\n   * - `instagram_basic` - Instagram Basic Display API access\n   * - `instagram_manage_insights` - Instagram Insights data\n   * - `instagram_manage_comments` - Manage Instagram comments\n   * - `instagram_content_publish` - Publish to Instagram\n   * - `pages_show_list` - List of Pages managed by user\n   * - `pages_read_engagement` - Read Page engagement metrics\n   * - `pages_manage_posts` - Manage Page posts\n   * - `pages_messaging` - Page messaging features\n   * - `business_management` - Manage business assets\n   * - `catalog_management` - Manage product catalogs\n   * - `ads_management` - Manage advertising accounts\n   *\n   * @example ['email', 'public_profile'] // Consumer permissions\n   * @example ['email', 'instagram_basic', 'pages_show_list'] // Business permissions\n   * @see https://developers.facebook.com/docs/permissions/reference\n   * @see docs/facebook_business_login.md for complete business integration guide\n   */\n  permissions: string[];\n  /**\n   * Is Limited Login\n   * @description use limited login for Facebook iOS only. Important: This is iOS-only and doesn't affect Android.\n   * Even if set to false, Facebook will automatically force it to true if App Tracking Transparency (ATT) permission is not granted.\n   * Developers should always be prepared to handle both limited and full login scenarios.\n   * @default false\n   */\n  limitedLogin?: boolean;\n  /**\n   * Nonce\n   * @description A custom nonce to use for the login request\n   */\n  nonce?: string;\n}\n\nexport interface TwitterLoginOptions {\n  /**\n   * Additional scopes to request during login.\n   * If omitted the plugin falls back to the default scopes configured during initialization.\n   * @example ['tweet.read','users.read','offline.access']\n   */\n  scopes?: string[];\n  /**\n   * Provide a custom OAuth state value.\n   * When not provided the plugin generates a cryptographically random value.\n   */\n  state?: string;\n  /**\n   * Provide a pre-computed PKCE code verifier (mostly used for testing).\n   * When omitted the plugin generates a secure verifier automatically.\n   */\n  codeVerifier?: string;\n  /**\n   * Override the redirect URI for a single login call.\n   * Useful when the same app supports multiple callback URLs per platform.\n   */\n  redirectUrl?: string;\n  /**\n   * Force the consent screen on every attempt, maps to `force_login=true`.\n   */\n  forceLogin?: boolean;\n}\n\nexport interface OAuth2LoginOptions {\n  /**\n   * The provider ID as configured in initialize()\n   * This is required to identify which OAuth2 provider to use\n   * @example 'github', 'azure', 'keycloak'\n   */\n  providerId: string;\n  /**\n   * Override the scopes for this login request\n   * If not provided, uses the scopes from initialization\n   */\n  scope?: string | string[];\n  /**\n   * Alias for `scope` using common naming (`scopes`).\n   * If both are provided, `scope` takes precedence.\n   */\n  scopes?: string[];\n  /**\n   * Custom state parameter for CSRF protection\n   * If not provided, a random value is generated\n   */\n  state?: string;\n  /**\n   * Override PKCE code verifier (for testing purposes)\n   * If not provided, a secure random verifier is generated\n   */\n  codeVerifier?: string;\n  /**\n   * Override redirect URL for this login request\n   */\n  redirectUrl?: string;\n  /**\n   * Additional parameters to add to the authorization URL\n   */\n  additionalParameters?: Record<string, string>;\n  /**\n   * Convenience option for OIDC `login_hint`.\n   * Equivalent to passing `additionalParameters.login_hint`.\n   */\n  loginHint?: string;\n  /**\n   * Convenience option for OAuth/OIDC `prompt`.\n   * Equivalent to passing `additionalParameters.prompt`.\n   */\n  prompt?: string;\n  /**\n   * Web-only (`oauth2` provider only): Use a full-page redirect instead of a popup window.\n   *\n   * When using `redirect`, the promise returned by `login()` will not resolve because the page navigates away.\n   * After the redirect lands back in your app, call `SocialLogin.handleRedirectCallback()` on that page to\n   * parse the result.\n   *\n   * @default 'popup'\n   */\n  flow?: 'popup' | 'redirect';\n}\n\nexport interface OAuth2LoginResponse {\n  /**\n   * The provider ID that was used for this login\n   */\n  providerId: string;\n  /**\n   * The access token received from the OAuth provider\n   */\n  accessToken: AccessToken | null;\n  /**\n   * The ID token (JWT) if provided by the OAuth server (e.g., OpenID Connect)\n   */\n  idToken: string | null;\n  /**\n   * The refresh token if provided (requires appropriate scope like offline_access)\n   */\n  refreshToken: string | null;\n  /**\n   * Resource data fetched from resourceUrl if configured\n   * Contains the raw JSON response from the resource endpoint\n   */\n  resourceData: Record<string, unknown> | null;\n  /**\n   * The scopes that were granted\n   */\n  scope: string[];\n  /**\n   * Token type (usually 'bearer')\n   */\n  tokenType: string;\n  /**\n   * Token expiration time in seconds\n   */\n  expiresIn: number | null;\n}\n\nexport interface GoogleLoginOptions {\n  /**\n   * Specifies the scopes required for accessing Google APIs\n   * The default is defined in the configuration.\n   * @example [\"profile\", \"email\"]\n   * @see [Google OAuth2 Scopes](https://developers.google.com/identity/protocols/oauth2/scopes)\n   */\n  scopes?: string[];\n  /**\n   * Nonce\n   * @description nonce\n   */\n  nonce?: string;\n  /**\n   * Force refresh token (only for Android)\n   * @description force refresh token\n   * @default false\n   * @note On Android, the OS caches access tokens, and if a token is invalid (e.g., user revoked app access), the plugin might return an invalid accessToken. Using getAuthorizationCode() is recommended to ensure the token is valid.\n   */\n  forceRefreshToken?: boolean;\n  /**\n   * Force account selection prompt (iOS)\n   * @description forces the account selection prompt to appear on iOS\n   * @default false\n   */\n  forcePrompt?: boolean;\n  /**\n   * Style\n   * @description style\n   * @default 'standard'\n   */\n  style?: 'bottom' | 'standard';\n  /**\n   * Filter by authorized accounts (Android only)\n   * @description Only show accounts that have previously been used to sign in to the app.\n   * This option is only available for the 'bottom' style.\n   * Note: For Family Link supervised accounts, this should be set to false.\n   * @default true\n   */\n  filterByAuthorizedAccounts?: boolean;\n  /**\n   * Auto select enabled (Android only)\n   * @description Automatically select the account if only one Google account is available.\n   * This option is only available for the 'bottom' style.\n   * @default false\n   */\n  autoSelectEnabled?: boolean;\n  /**\n   * Prompt parameter for Google OAuth (Web only)\n   * @description A space-delimited, case-sensitive list of prompts to present the user.\n   * If you don't specify this parameter, the user will be prompted only the first time your project requests access.\n   *\n   * **Possible values:**\n   * - `none`: Don't display any authentication or consent screens. Must not be specified with other values.\n   * - `consent`: Prompt the user for consent.\n   * - `select_account`: Prompt the user to select an account.\n   *\n   * **Examples:**\n   * - `prompt: 'consent'` - Always show consent screen\n   * - `prompt: 'select_account'` - Always show account selection\n   * - `prompt: 'consent select_account'` - Show both consent and account selection\n   *\n   * **Note:** This parameter only affects web platform behavior. Mobile platforms use their own native prompts.\n   *\n   * @example 'consent'\n   * @example 'select_account'\n   * @example 'consent select_account'\n   * @see [Google OAuth2 Prompt Parameter](https://developers.google.com/identity/protocols/oauth2/openid-connect#prompt)\n   * @since 7.12.0\n   */\n  prompt?: 'none' | 'consent' | 'select_account' | 'consent select_account' | 'select_account consent';\n}\n\nexport interface GoogleLoginResponseOnline {\n  accessToken: AccessToken | null;\n  idToken: string | null;\n  profile: {\n    email: string | null;\n    familyName: string | null;\n    givenName: string | null;\n    id: string | null;\n    name: string | null;\n    imageUrl: string | null;\n  };\n  responseType: 'online';\n}\n\nexport interface GoogleLoginResponseOffline {\n  serverAuthCode: string;\n  responseType: 'offline';\n}\n\nexport type GoogleLoginResponse = GoogleLoginResponseOnline | GoogleLoginResponseOffline;\n\nexport interface AppleProviderOptions {\n  /**\n   * Scopes\n   * @description An array of scopes to request during login\n   * @example [\"name\", \"email\"]\n   * default: [\"name\", \"email\"]\n   */\n  scopes?: string[];\n  /**\n   * Nonce\n   * @description nonce\n   */\n  nonce?: string;\n  /**\n   * State\n   * @description state\n   */\n  state?: string;\n  /**\n   * Use Broadcast Channel for authentication flow\n   * @description When enabled, uses Broadcast Channel API for communication instead of URL redirects.\n   * Only applicable on platforms that support Broadcast Channel (Android).\n   * @default false\n   */\n  useBroadcastChannel?: boolean;\n}\n\nexport interface AppleProviderResponse {\n  /**\n   * Access token from Apple\n   * @description Content depends on `useProperTokenExchange` setting:\n   * - When `useProperTokenExchange: true`: Real access token from Apple (~1 hour validity)\n   * - When `useProperTokenExchange: false`: Contains authorization code as token (legacy mode)\n   * Use `idToken` for user authentication, `accessToken` for API calls when properly exchanged.\n   */\n  accessToken: AccessToken | null;\n\n  /**\n   * Identity token (JWT) from Apple\n   * @description Always contains the JWT with user identity information including:\n   * - User ID (sub claim)\n   * - Email (if user granted permission)\n   * - Name components (if user granted permission)\n   * - Email verification status\n   * This is the primary token for user authentication and should be verified on your backend.\n   */\n  idToken: string | null;\n\n  /**\n   * User profile information\n   * @description Basic user profile data extracted from the identity token and Apple response:\n   * - `user`: Apple's user identifier (sub claim from idToken)\n   * - `email`: User's email address (if permission granted)\n   * - `givenName`: User's first name (if permission granted)\n   * - `familyName`: User's last name (if permission granted)\n   */\n  profile: {\n    user: string;\n    email: string | null;\n    givenName: string | null;\n    familyName: string | null;\n  };\n\n  /**\n   * Authorization code for proper token exchange (when useProperTokenExchange is enabled)\n   * @description Only present when `useProperTokenExchange` is `true`. This code should be exchanged\n   * for proper access tokens on your backend using Apple's token endpoint. Use this for secure\n   * server-side token validation and to obtain refresh tokens.\n   * @see https://developer.apple.com/documentation/sign_in_with_apple/tokenresponse\n   */\n  authorizationCode?: string;\n}\n\nexport type LoginOptions =\n  | {\n      provider: 'facebook';\n      options: FacebookLoginOptions;\n    }\n  | {\n      provider: 'google';\n      options: GoogleLoginOptions;\n    }\n  | {\n      provider: 'apple';\n      options: AppleProviderOptions;\n    }\n  | {\n      provider: 'twitter';\n      options: TwitterLoginOptions;\n    }\n  | {\n      provider: 'oauth2';\n      options: OAuth2LoginOptions;\n    };\n\nexport type LoginResult =\n  | {\n      provider: 'facebook';\n      result: FacebookLoginResponse;\n    }\n  | {\n      provider: 'google';\n      result: GoogleLoginResponse;\n    }\n  | {\n      provider: 'apple';\n      result: AppleProviderResponse;\n    }\n  | {\n      provider: 'twitter';\n      result: TwitterLoginResponse;\n    }\n  | {\n      provider: 'oauth2';\n      result: OAuth2LoginResponse;\n    };\n\nexport interface AccessToken {\n  applicationId?: string;\n  declinedPermissions?: string[];\n  expires?: string;\n  isExpired?: boolean;\n  lastRefresh?: string;\n  permissions?: string[];\n  token: string;\n  tokenType?: string;\n  refreshToken?: string;\n  userId?: string;\n}\n\nexport interface FacebookLoginResponse {\n  accessToken: AccessToken | null;\n  idToken: string | null;\n  profile: {\n    userID: string;\n    email: string | null;\n    friendIDs: string[];\n    birthday: string | null;\n    ageRange: { min?: number; max?: number } | null;\n    gender: string | null;\n    location: { id: string; name: string } | null;\n    hometown: { id: string; name: string } | null;\n    profileURL: string | null;\n    name: string | null;\n    imageURL: string | null;\n  };\n}\n\nexport interface TwitterProfile {\n  id: string;\n  username: string;\n  name: string | null;\n  profileImageUrl: string | null;\n  verified: boolean;\n  email?: string | null;\n}\n\nexport interface TwitterLoginResponse {\n  accessToken: AccessToken | null;\n  refreshToken?: string | null;\n  scope: string[];\n  tokenType: 'bearer';\n  expiresIn?: number | null;\n  profile: TwitterProfile;\n}\n\nexport interface AuthorizationCode {\n  /**\n   * Jwt\n   * @description A JSON web token\n   */\n  jwt?: string;\n  /**\n   * Access Token\n   * @description An access token\n   */\n  accessToken?: string;\n}\n\nexport interface AuthorizationCodeOptions {\n  /**\n   * Provider\n   * @description Provider for the authorization code\n   */\n  provider: 'apple' | 'google' | 'facebook' | 'twitter' | 'oauth2';\n  /**\n   * Provider ID for OAuth2 providers (required when provider is 'oauth2')\n   * @description The ID used when configuring the OAuth2 provider in initialize()\n   */\n  providerId?: string;\n}\n\nexport interface isLoggedInOptions {\n  /**\n   * Provider\n   * @description Provider for the isLoggedIn\n   */\n  provider: 'apple' | 'google' | 'facebook' | 'twitter' | 'oauth2';\n  /**\n   * Provider ID for OAuth2 providers (required when provider is 'oauth2')\n   * @description The ID used when configuring the OAuth2 provider in initialize()\n   */\n  providerId?: string;\n}\n\n// Define the provider-specific call types\nexport type ProviderSpecificCall = 'facebook#getProfile' | 'facebook#requestTracking';\n\n// Define the options and response types for each specific call\nexport interface FacebookGetProfileOptions {\n  /**\n   * Fields to retrieve from Facebook profile\n   * @example [\"id\", \"name\", \"email\", \"picture\"]\n   */\n  fields?: string[];\n}\n\nexport interface FacebookGetProfileResponse {\n  /**\n   * Facebook profile data\n   */\n  profile: {\n    id: string | null;\n    name: string | null;\n    email: string | null;\n    first_name: string | null;\n    last_name: string | null;\n    picture?: {\n      data: {\n        height: number | null;\n        is_silhouette: boolean | null;\n        url: string | null;\n        width: number | null;\n      };\n    } | null;\n    [key: string]: any; // For additional fields that might be requested\n  };\n}\n\nexport interface OpenSecureWindowOptions {\n  /**\n   * The endpoint to open\n   */\n  authEndpoint: string;\n  /**\n   * The redirect URI to use for the openSecureWindow call.\n   * This will be checked to make sure it matches the redirect URI after the window finishes the redirection.\n   */\n  redirectUri: string;\n  /**\n   * The name of the broadcast channel to listen to, relevant only for web\n   */\n  broadcastChannelName?: string;\n}\n\nexport interface OpenSecureWindowResponse {\n  /**\n   * The result of the openSecureWindow call\n   */\n  redirectedUri: string;\n}\n\nexport type FacebookRequestTrackingOptions = Record<string, never>;\n\nexport interface FacebookRequestTrackingResponse {\n  /**\n   * App tracking authorization status\n   */\n  status: 'authorized' | 'denied' | 'notDetermined' | 'restricted';\n}\n\n// Map call strings to their options and response types\nexport type ProviderSpecificCallOptionsMap = {\n  'facebook#getProfile': FacebookGetProfileOptions;\n  'facebook#requestTracking': FacebookRequestTrackingOptions;\n};\n\nexport type ProviderSpecificCallResponseMap = {\n  'facebook#getProfile': FacebookGetProfileResponse;\n  'facebook#requestTracking': FacebookRequestTrackingResponse;\n};\n\n// Add a helper type to map providers to their response types\nexport type ProviderResponseMap = {\n  facebook: FacebookLoginResponse;\n  google: GoogleLoginResponse;\n  apple: AppleProviderResponse;\n  twitter: TwitterLoginResponse;\n  oauth2: OAuth2LoginResponse;\n};\n\nexport interface SocialLoginPlugin {\n  /**\n   * Initialize the plugin\n   * @description initialize the plugin with the required options\n   */\n  initialize(options: InitializeOptions): Promise<void>;\n  /**\n   * Login with the selected provider\n   * @description login with the selected provider\n   */\n  login<T extends LoginOptions['provider']>(\n    options: Extract<LoginOptions, { provider: T }>,\n  ): Promise<{ provider: T; result: ProviderResponseMap[T] }>;\n  /**\n   * Logout\n   * @description Logout the user from the specified provider\n   *\n   * **Google Offline Mode Limitation:**\n   * This method is NOT supported when Google is initialized with `mode: 'offline'`.\n   * It will reject with error: \"logout is not implemented when using offline mode\"\n   *\n   * @throws Error if Google provider is in offline mode\n   */\n  logout(options: {\n    provider: 'apple' | 'google' | 'facebook' | 'twitter' | 'oauth2';\n    providerId?: string;\n  }): Promise<void>;\n  /**\n   * IsLoggedIn\n   * @description Check if the user is currently logged in with the specified provider\n   *\n   * **Google Offline Mode Limitation:**\n   * This method is NOT supported when Google is initialized with `mode: 'offline'`.\n   * It will reject with error: \"isLoggedIn is not implemented when using offline mode\"\n   *\n   * @throws Error if Google provider is in offline mode\n   */\n  isLoggedIn(options: isLoggedInOptions): Promise<{ isLoggedIn: boolean }>;\n\n  /**\n   * Get the current authorization code\n   * @description Get the authorization code for server-side authentication\n   *\n   * **Google Offline Mode Limitation:**\n   * This method is NOT supported when Google is initialized with `mode: 'offline'`.\n   * It will reject with error: \"getAuthorizationCode is not implemented when using offline mode\"\n   *\n   * In offline mode, the authorization code (serverAuthCode) is already returned by the `login()` method.\n   *\n   * @throws Error if Google provider is in offline mode\n   */\n  getAuthorizationCode(options: AuthorizationCodeOptions): Promise<AuthorizationCode>;\n  /**\n   * Refresh the access token\n   * @description refresh the access token\n   *\n   * **Google Offline Mode Limitation:**\n   * This method is NOT supported when Google is initialized with `mode: 'offline'`.\n   * Offline mode only returns `serverAuthCode` for backend token exchange, so token refresh must happen on your backend.\n   * The plugin logs and rejects with a message explaining that you should send `serverAuthCode` to your backend,\n   * refresh the Google tokens there, or switch to `mode: 'online'` for client-side refresh.\n   *\n   * **Google Web Limitation:**\n   * On Web, Google `refresh()` is not implemented, even when using `mode: 'online'`.\n   * Call `login()` again on Web to obtain a fresh token instead.\n   *\n   * @throws Error if Google provider is in offline mode, or on Web where Google `refresh()` is not implemented\n   */\n  refresh(options: LoginOptions): Promise<void>;\n\n  /**\n   * OAuth2 refresh-token helper (feature parity with Capawesome OAuth).\n   *\n   * Scope:\n   * - Only applies to the built-in `oauth2` provider (not Google/Apple/Facebook/Twitter).\n   * - Requires a token endpoint (either `accessTokenEndpoint`/`tokenEndpoint` or `issuerUrl` discovery).\n   *\n   * Security note:\n   * - This does not validate JWT signatures. It only exchanges/refreshes tokens.\n   *\n   * If `refreshToken` is omitted, the plugin will attempt to use the stored refresh token (if available).\n   */\n  refreshToken(options: {\n    provider: 'oauth2';\n    providerId: string;\n    refreshToken?: string;\n    additionalParameters?: Record<string, string>;\n  }): Promise<OAuth2LoginResponse>;\n\n  /**\n   * Web-only: handle the OAuth redirect callback and return the parsed result.\n   *\n   * Notes:\n   * - This is only meaningful on Web. iOS/Android implementations will reject.\n   * - Intended for redirect-based flows (e.g. `oauth2` with `flow: 'redirect'`) where the page navigates away.\n   */\n  handleRedirectCallback(): Promise<LoginResult | null>;\n\n  /**\n   * Decode a JWT (typically an OIDC ID token) into its claims.\n   *\n   * Notes:\n   * - Accepts both `idToken` and `token` to match common naming (Capawesome uses `token`).\n   * - This does not validate the signature or issuer/audience. It only base64url-decodes the payload.\n   */\n  decodeIdToken(options: { idToken?: string; token?: string }): Promise<{ claims: Record<string, any> }>;\n\n  /**\n   * Convert an access token expiration timestamp (milliseconds since epoch) to an ISO date string.\n   *\n   * This is a pure helper (feature parity with Capawesome OAuth) and does not depend on provider state.\n   */\n  getAccessTokenExpirationDate(options: {\n    /**\n     * Access token expiration date in milliseconds since epoch.\n     * Typically: `Date.now() + expiresInSeconds * 1000`.\n     */\n    accessTokenExpirationDate: number;\n  }): Promise<{ date: string }>;\n\n  /**\n   * Check if an access token is available (non-empty).\n   *\n   * This is a pure helper (feature parity with Capawesome OAuth) and does not depend on provider state.\n   */\n  isAccessTokenAvailable(options: { accessToken: string | null }): Promise<{ isAvailable: boolean }>;\n\n  /**\n   * Check if an access token is expired.\n   *\n   * This is a pure helper (feature parity with Capawesome OAuth) and does not depend on provider state.\n   */\n  isAccessTokenExpired(options: { accessTokenExpirationDate: number }): Promise<{ isExpired: boolean }>;\n\n  /**\n   * Check if a refresh token is available (non-empty).\n   *\n   * This is a pure helper (feature parity with Capawesome OAuth) and does not depend on provider state.\n   */\n  isRefreshTokenAvailable(options: { refreshToken: string | null }): Promise<{ isAvailable: boolean }>;\n\n  /**\n   * Execute provider-specific calls\n   * @description Execute a provider-specific functionality\n   */\n  providerSpecificCall<T extends ProviderSpecificCall>(options: {\n    call: T;\n    options: ProviderSpecificCallOptionsMap[T];\n  }): Promise<ProviderSpecificCallResponseMap[T]>;\n\n  /**\n   * Get the native Capacitor plugin version\n   *\n   * @returns {Promise<{ id: string }>} an Promise with version for this device\n   * @throws An error if the something went wrong\n   */\n  getPluginVersion(): Promise<{ version: string }>;\n\n  /**\n   * Opens a secured window for OAuth2 authentication.\n   * For web, you should have the code in the redirected page to use a broadcast channel to send the redirected url to the app\n   * Something like:\n   * ```html\n   * <html>\n   * <head></head>\n   * <body>\n   * <script>\n   *   const searchParams = new URLSearchParams(location.search)\n   *   if (searchParams.has(\"code\")) {\n   *     new BroadcastChannel(\"my-channel-name\").postMessage(location.href);\n   *     window.close();\n   *   }\n   * </script>\n   * </body>\n   * </html>\n   * ```\n   * For mobile, you should have a redirect uri that opens the app, something like: `myapp://oauth_callback/`\n   * And make sure to register it in the app's info.plist:\n   * ```xml\n   * <key>CFBundleURLTypes</key>\n   * <array>\n   *    <dict>\n   *       <key>CFBundleURLSchemes</key>\n   *       <array>\n   *          <string>myapp</string>\n   *       </array>\n   *    </dict>\n   * </array>\n   * ```\n   * And in the AndroidManifest.xml file:\n   * ```xml\n   * <activity>\n   *    <intent-filter>\n   *       <action android:name=\"android.intent.action.VIEW\" />\n   *       <category android:name=\"android.intent.category.DEFAULT\" />\n   *       <category android:name=\"android.intent.category.BROWSABLE\" />\n   *       <data android:host=\"oauth_callback\" android:scheme=\"myapp\" />\n   *    </intent-filter>\n   * </activity>\n   * ```\n   * @param options - the options for the openSecureWindow call\n   */\n  openSecureWindow(options: OpenSecureWindowOptions): Promise<OpenSecureWindowResponse>;\n}\n"]}
+{"version":3,"file":"definitions.js","sourceRoot":"","sources":["../../src/definitions.ts"],"names":[],"mappings":"","sourcesContent":["/**\n * Configuration for a single OAuth2 provider instance\n */\nexport interface OAuth2ProviderConfig {\n  /**\n   * The OAuth 2.0 client identifier (App ID / Client ID).\n   *\n   * Note: this configuration object is only used by the plugin's built-in `oauth2` provider\n   * (i.e. `SocialLogin.initialize({ oauth2: { ... } })`). It does not affect Google/Apple/Facebook/Twitter.\n   * @example 'your-client-id'\n   */\n  appId?: string;\n  /**\n   * Alias for `appId` to match common OAuth/OIDC naming (`clientId`).\n   * If both are provided, `appId` takes precedence.\n   * @example 'your-client-id'\n   */\n  clientId?: string;\n  /**\n   * OpenID Connect issuer URL (enables discovery via `/.well-known/openid-configuration`).\n   * When set, you may omit explicit endpoints like `authorizationBaseUrl` and `accessTokenEndpoint`.\n   *\n   * Notes:\n   * - Explicit endpoints (authorization/token/logout) take precedence over discovered values.\n   * - Discovery is supported for `oauth2` on Web, iOS, and Android.\n   *\n   * @example 'https://accounts.example.com'\n   */\n  issuerUrl?: string;\n  /**\n   * The base URL of the authorization endpoint\n   * @example 'https://accounts.example.com/oauth2/authorize'\n   */\n  authorizationBaseUrl?: string;\n  /**\n   * Alias for `authorizationBaseUrl` (to match common OAuth/OIDC naming).\n   * @example 'https://accounts.example.com/oauth2/authorize'\n   */\n  authorizationEndpoint?: string;\n  /**\n   * OAuth 2.0 client secret for token requests (e.g., when exchanging the code).\n   * This value is sent as `client_secret` in token/refresh requests when provided.\n   */\n  clientSecret?: string;\n  /**\n   * The URL to exchange the authorization code for tokens\n   * Required for authorization code flow\n   * @example 'https://accounts.example.com/oauth2/token'\n   */\n  accessTokenEndpoint?: string;\n  /**\n   * Alias for `accessTokenEndpoint` (to match common OAuth/OIDC naming).\n   * @example 'https://accounts.example.com/oauth2/token'\n   */\n  tokenEndpoint?: string;\n  /**\n   * Redirect URL that receives the OAuth callback\n   * @example 'myapp://oauth/callback'\n   */\n  redirectUrl: string;\n  /**\n   * Optional URL to fetch user profile/resource data after authentication\n   * The access token will be sent as Bearer token in the Authorization header\n   * @example 'https://api.example.com/userinfo'\n   */\n  resourceUrl?: string;\n  /**\n   * The OAuth response type\n   * - 'code': Authorization Code flow (recommended, requires accessTokenEndpoint)\n   * - 'token': Implicit flow (less secure, tokens returned directly)\n   * @default 'code'\n   */\n  responseType?: 'code' | 'token';\n  /**\n   * Enable PKCE (Proof Key for Code Exchange)\n   * Strongly recommended for public clients (mobile/web apps)\n   * @default true\n   */\n  pkceEnabled?: boolean;\n  /**\n   * Default scopes to request during authorization\n   * @example 'openid profile email'\n   * @example ['openid','profile','email']\n   */\n  scope?: string | string[];\n  /**\n   * Alias for `scope` using common naming (`scopes`).\n   * If both are provided, `scope` takes precedence.\n   */\n  scopes?: string[];\n  /**\n   * Additional parameters to include in the authorization request\n   * @example { prompt: 'consent', login_hint: 'user@example.com' }\n   */\n  additionalParameters?: Record<string, string>;\n  /**\n   * Convenience option for OIDC `login_hint`.\n   * Equivalent to passing `additionalParameters.login_hint`.\n   */\n  loginHint?: string;\n  /**\n   * Convenience option for OAuth/OIDC `prompt`.\n   * Equivalent to passing `additionalParameters.prompt`.\n   */\n  prompt?: string;\n  /**\n   * Additional parameters to include in token requests (code exchange / refresh).\n   * Useful for providers that require non-standard parameters.\n   */\n  additionalTokenParameters?: Record<string, string>;\n  /**\n   * Additional headers to include when fetching the resource URL\n   * @example { 'X-Custom-Header': 'value' }\n   */\n  additionalResourceHeaders?: Record<string, string>;\n  /**\n   * Custom logout URL for ending the session\n   * @example 'https://accounts.example.com/logout'\n   */\n  logoutUrl?: string;\n  /**\n   * Alias for `logoutUrl` to match OIDC naming (`endSessionEndpoint`).\n   * @example 'https://accounts.example.com/logout'\n   */\n  endSessionEndpoint?: string;\n  /**\n   * OIDC post logout redirect URL (sent as `post_logout_redirect_uri` when building the end-session URL).\n   * @example 'myapp://logout/callback'\n   */\n  postLogoutRedirectUrl?: string;\n  /**\n   * Additional parameters to include in logout / end-session URL.\n   */\n  additionalLogoutParameters?: Record<string, string>;\n  /**\n   * iOS-only: Whether to prefer an ephemeral browser session for ASWebAuthenticationSession.\n   * Defaults to true to match existing behavior in this plugin.\n   */\n  iosPrefersEphemeralWebBrowserSession?: boolean;\n  /**\n   * Alias for `iosPrefersEphemeralWebBrowserSession` (to match Capawesome OAuth naming).\n   */\n  iosPrefersEphemeralSession?: boolean;\n  /**\n   * Enable debug logging\n   * @default false\n   */\n  logsEnabled?: boolean;\n}\n\nexport interface InitializeOptions {\n  /**\n   * OAuth2 provider configurations.\n   * Supports multiple providers by using a Record with provider IDs as keys.\n   * @example\n   * {\n   *   github: { appId: '...', authorizationBaseUrl: 'https://github.com/login/oauth/authorize', ... },\n   *   azure: { appId: '...', authorizationBaseUrl: 'https://login.microsoftonline.com/.../oauth2/v2.0/authorize', ... }\n   * }\n   */\n  oauth2?: Record<string, OAuth2ProviderConfig>;\n  twitter?: {\n    /**\n     * The OAuth 2.0 client identifier issued by X (Twitter) Developer Portal\n     * @example 'Y2xpZW50SWQ'\n     */\n    clientId: string;\n    /**\n     * Redirect URL that is registered inside the X Developer Portal.\n     * The plugin uses this URL on every platform to receive the authorization code.\n     * @example 'myapp://auth/x'\n     */\n    redirectUrl: string;\n    /**\n     * Default scopes appended to every login request when no custom scopes are provided.\n     * @description Defaults to the minimum required scopes for Log in with X.\n     * @default ['tweet.read','users.read']\n     */\n    defaultScopes?: string[];\n    /**\n     * Force the consent screen to show on every login attempt.\n     * Mirrors X's `force_login=true` flag.\n     * @default false\n     */\n    forceLogin?: boolean;\n    /**\n     * Optional audience value when your application has been approved for multi-tenant access.\n     */\n    audience?: string;\n  };\n  facebook?: {\n    /**\n     * Facebook App ID, provided by Facebook for web, in mobile it's set in the native files\n     * @description For business integrations, use your Business App ID from Facebook Developer Console.\n     * Business apps can access additional permissions like Instagram API, Pages API, and business management features.\n     * @see docs/facebook_business_login.md for business app setup guide\n     */\n    appId: string;\n    /**\n     * Facebook Client Token, provided by Facebook for web, in mobile it's set in the native files\n     */\n    clientToken?: string;\n    /**\n     * Locale\n     * @description The locale to use for the Facebook SDK (e.g., 'en_US', 'fr_FR', 'es_ES')\n     * @default 'en_US'\n     * @example 'fr_FR'\n     */\n    locale?: string;\n  };\n\n  google?: {\n    /**\n     * The app's client ID, found and created in the Google Developers Console.\n     * Required for iOS platform.\n     * @example xxxxxx-xxxxxxxxxxxxxxxxxx.apps.googleusercontent.com\n     * @since 3.1.0\n     */\n    iOSClientId?: string;\n    /**\n     * The app's server client ID, required for offline mode on iOS.\n     * Should be the same value as webClientId.\n     * Found and created in the Google Developers Console.\n     * @example xxxxxx-xxxxxxxxxxxxxxxxxx.apps.googleusercontent.com\n     * @since 3.1.0\n     */\n    iOSServerClientId?: string;\n    /**\n     * The app's web client ID, found and created in the Google Developers Console.\n     * Required for Android and Web platforms.\n     * @example xxxxxx-xxxxxxxxxxxxxxxxxx.apps.googleusercontent.com\n     * @since 3.1.0\n     */\n    webClientId?: string;\n    /**\n     * The login mode, can be online or offline.\n     *\n     * **Online mode (default):**\n     * - Returns user profile data and access tokens\n     * - Supports all methods: login, logout, isLoggedIn, getAuthorizationCode\n     *\n     * **Offline mode:**\n     * - Returns only serverAuthCode for backend authentication\n     * - No user profile data available\n     * - **Limitations:** The following methods are NOT supported in offline mode:\n     *   - `logout()` - Will reject with \"not implemented when using offline mode\"\n     *   - `isLoggedIn()` - Will reject with \"not implemented when using offline mode\"\n     *   - `getAuthorizationCode()` - Will reject with \"not implemented when using offline mode\"\n     *   - `refresh()` - Will reject because offline mode only returns `serverAuthCode`; token refresh must happen on your backend\n     * - Only `login()` method works in offline mode, returning serverAuthCode only\n     * - `serverAuthCode` must be exchanged on your backend for access/refresh tokens\n     * - Requires `iOSServerClientId` to be set on iOS\n     *\n     * @example 'offline'\n     * @default 'online'\n     * @since 3.1.0\n     */\n    mode?: 'online' | 'offline';\n    /**\n     * Filter visible accounts by hosted domain\n     * @description filter visible accounts by hosted domain\n     */\n    hostedDomain?: string;\n    /**\n     * Google Redirect URL, should be your backend url that is configured in your google app\n     */\n    redirectUrl?: string;\n  };\n  apple?: {\n    /**\n     * Apple Client ID, provided by Apple for web and Android\n     */\n    clientId?: string;\n    /**\n     * Apple Redirect URL, should be your backend url that is configured in your apple app\n     *\n     * **Note**: Use empty string `''` for iOS to prevent redirect.\n     * **Note**: Not required when using Broadcast Channel mode on Android.\n     */\n    redirectUrl?: string;\n    /**\n     * Use proper token exchange for Apple Sign-In\n     * @description Controls how Apple Sign-In tokens are handled and what gets returned:\n     *\n     * **When `true` (Recommended for new implementations):**\n     * - Exchanges authorization code for proper access tokens via Apple's token endpoint\n     * - `idToken`: JWT containing user identity information (email, name, user ID)\n     * - `accessToken.token`: Proper access token from Apple (short-lived, ~1 hour)\n     * - `authorizationCode`: Raw authorization code for backend token exchange\n     *\n     * **When `false` (Default - Legacy mode):**\n     * - Uses authorization code directly as access token for backward compatibility\n     * - `idToken`: JWT containing user identity information (email, name, user ID)\n     * - `accessToken.token`: The authorization code itself (not a real access token)\n     * - `authorizationCode`: undefined\n     *\n     * @default false\n     * @example\n     * // Enable proper token exchange (recommended)\n     * useProperTokenExchange: true\n     * // Result: idToken=JWT, accessToken=real_token, authorizationCode=present\n     *\n     * // Legacy mode (backward compatibility)\n     * useProperTokenExchange: false\n     * // Result: idToken=JWT, accessToken=auth_code, authorizationCode=undefined\n     */\n    useProperTokenExchange?: boolean;\n    /**\n     * Use Broadcast Channel for Android Apple Sign-In (Recommended)\n     * @description When enabled, Android uses Broadcast Channel API instead of URL redirects.\n     * This eliminates the need for redirect URL configuration and server-side setup.\n     *\n     * **Benefits:**\n     * - No redirect URL configuration required\n     * - No backend server needed for Android\n     * - Simpler setup and more reliable communication\n     * - Direct client-server communication via Broadcast Channel\n     *\n     * **When `true`:**\n     * - Uses Broadcast Channel for authentication flow\n     * - `redirectUrl` is ignored\n     * - Requires Broadcast Channel compatible backend or direct token handling\n     *\n     * **When `false` (Default - Legacy mode):**\n     * - Uses traditional URL redirect flow\n     * - Requires `redirectUrl` configuration\n     * - Requires backend server for token exchange\n     *\n     * @default false\n     * @since 7.10.0\n     * @example\n     * // Enable Broadcast Channel mode (recommended for new Android implementations)\n     * useBroadcastChannel: true\n     * // Result: Simplified setup, no redirect URL needed\n     *\n     * // Legacy mode (backward compatibility)\n     * useBroadcastChannel: false\n     * // Result: Traditional URL redirect flow with server-side setup\n     */\n    useBroadcastChannel?: boolean;\n  };\n}\n\nexport interface FacebookLoginOptions {\n  /**\n   * Permissions\n   * @description Select permissions to login with. Supports both consumer and business permissions.\n   *\n   * **Consumer Permissions:**\n   * - `email` - User's email address\n   * - `public_profile` - User's public profile info\n   * - `user_friends` - List of friends who also use your app\n   *\n   * **Business Permissions** (require business app configuration and may need App Review):\n   * - `instagram_basic` - Instagram Basic Display API access\n   * - `instagram_manage_insights` - Instagram Insights data\n   * - `instagram_manage_comments` - Manage Instagram comments\n   * - `instagram_content_publish` - Publish to Instagram\n   * - `pages_show_list` - List of Pages managed by user\n   * - `pages_read_engagement` - Read Page engagement metrics\n   * - `pages_manage_posts` - Manage Page posts\n   * - `pages_messaging` - Page messaging features\n   * - `business_management` - Manage business assets\n   * - `catalog_management` - Manage product catalogs\n   * - `ads_management` - Manage advertising accounts\n   *\n   * @example ['email', 'public_profile'] // Consumer permissions\n   * @example ['email', 'instagram_basic', 'pages_show_list'] // Business permissions\n   * @see https://developers.facebook.com/docs/permissions/reference\n   * @see docs/facebook_business_login.md for complete business integration guide\n   */\n  permissions: string[];\n  /**\n   * Is Limited Login\n   * @description use limited login for Facebook iOS only. Important: This is iOS-only and doesn't affect Android.\n   * Even if set to false, Facebook will automatically force it to true if App Tracking Transparency (ATT) permission is not granted.\n   * Developers should always be prepared to handle both limited and full login scenarios.\n   * @default false\n   */\n  limitedLogin?: boolean;\n  /**\n   * Nonce\n   * @description A custom nonce to use for the login request\n   */\n  nonce?: string;\n}\n\nexport interface TwitterLoginOptions {\n  /**\n   * Additional scopes to request during login.\n   * If omitted the plugin falls back to the default scopes configured during initialization.\n   * @example ['tweet.read','users.read','offline.access']\n   */\n  scopes?: string[];\n  /**\n   * Provide a custom OAuth state value.\n   * When not provided the plugin generates a cryptographically random value.\n   */\n  state?: string;\n  /**\n   * Provide a pre-computed PKCE code verifier (mostly used for testing).\n   * When omitted the plugin generates a secure verifier automatically.\n   */\n  codeVerifier?: string;\n  /**\n   * Override the redirect URI for a single login call.\n   * Useful when the same app supports multiple callback URLs per platform.\n   */\n  redirectUrl?: string;\n  /**\n   * Force the consent screen on every attempt, maps to `force_login=true`.\n   */\n  forceLogin?: boolean;\n}\n\nexport interface OAuth2LoginOptions {\n  /**\n   * The provider ID as configured in initialize()\n   * This is required to identify which OAuth2 provider to use\n   * @example 'github', 'azure', 'keycloak'\n   */\n  providerId: string;\n  /**\n   * Override the scopes for this login request\n   * If not provided, uses the scopes from initialization\n   */\n  scope?: string | string[];\n  /**\n   * Alias for `scope` using common naming (`scopes`).\n   * If both are provided, `scope` takes precedence.\n   */\n  scopes?: string[];\n  /**\n   * Custom state parameter for CSRF protection\n   * If not provided, a random value is generated\n   */\n  state?: string;\n  /**\n   * Override PKCE code verifier (for testing purposes)\n   * If not provided, a secure random verifier is generated\n   */\n  codeVerifier?: string;\n  /**\n   * Override redirect URL for this login request\n   */\n  redirectUrl?: string;\n  /**\n   * Additional parameters to add to the authorization URL\n   */\n  additionalParameters?: Record<string, string>;\n  /**\n   * Convenience option for OIDC `login_hint`.\n   * Equivalent to passing `additionalParameters.login_hint`.\n   */\n  loginHint?: string;\n  /**\n   * Convenience option for OAuth/OIDC `prompt`.\n   * Equivalent to passing `additionalParameters.prompt`.\n   */\n  prompt?: string;\n  /**\n   * Web-only (`oauth2` provider only): Use a full-page redirect instead of a popup window.\n   *\n   * When using `redirect`, the promise returned by `login()` will not resolve because the page navigates away.\n   * After the redirect lands back in your app, call `SocialLogin.handleRedirectCallback()` on that page to\n   * parse the result.\n   *\n   * @default 'popup'\n   */\n  flow?: 'popup' | 'redirect';\n}\n\nexport interface OAuth2LoginResponse {\n  /**\n   * The provider ID that was used for this login\n   */\n  providerId: string;\n  /**\n   * The access token received from the OAuth provider\n   */\n  accessToken: AccessToken | null;\n  /**\n   * The ID token (JWT) if provided by the OAuth server (e.g., OpenID Connect)\n   */\n  idToken: string | null;\n  /**\n   * The refresh token if provided (requires appropriate scope like offline_access)\n   */\n  refreshToken: string | null;\n  /**\n   * Resource data fetched from resourceUrl if configured\n   * Contains the raw JSON response from the resource endpoint\n   */\n  resourceData: Record<string, unknown> | null;\n  /**\n   * The scopes that were granted\n   */\n  scope: string[];\n  /**\n   * Token type (usually 'bearer')\n   */\n  tokenType: string;\n  /**\n   * Token expiration time in seconds\n   */\n  expiresIn: number | null;\n}\n\nexport interface GoogleLoginOptions {\n  /**\n   * Specifies the scopes required for accessing Google APIs\n   * The default is defined in the configuration.\n   * @example [\"profile\", \"email\"]\n   * @see [Google OAuth2 Scopes](https://developers.google.com/identity/protocols/oauth2/scopes)\n   */\n  scopes?: string[];\n  /**\n   * Nonce\n   * @description nonce\n   */\n  nonce?: string;\n  /**\n   * Force refresh token (only for Android)\n   * @description force refresh token\n   * @default false\n   * @note On Android, the OS caches access tokens, and if a token is invalid (e.g., user revoked app access), the plugin might return an invalid accessToken. Using getAuthorizationCode() is recommended to ensure the token is valid.\n   */\n  forceRefreshToken?: boolean;\n  /**\n   * Force account selection prompt (iOS)\n   * @description forces the account selection prompt to appear on iOS\n   * @default false\n   */\n  forcePrompt?: boolean;\n  /**\n   * Style\n   * @description style\n   * @default 'standard'\n   */\n  style?: 'bottom' | 'standard';\n  /**\n   * Filter by authorized accounts (Android only)\n   * @description Only show accounts that have previously been used to sign in to the app.\n   * This option is only available for the 'bottom' style.\n   * Note: For Family Link supervised accounts, this should be set to false.\n   * @default true\n   */\n  filterByAuthorizedAccounts?: boolean;\n  /**\n   * Auto select enabled (Android only)\n   * @description Automatically select the account if only one Google account is available.\n   * This option is only available for the 'bottom' style.\n   * @default false\n   */\n  autoSelectEnabled?: boolean;\n  /**\n   * Prompt parameter for Google OAuth (Web only)\n   * @description A space-delimited, case-sensitive list of prompts to present the user.\n   * If you don't specify this parameter, the user will be prompted only the first time your project requests access.\n   *\n   * **Possible values:**\n   * - `none`: Don't display any authentication or consent screens. Must not be specified with other values.\n   * - `consent`: Prompt the user for consent.\n   * - `select_account`: Prompt the user to select an account.\n   *\n   * **Examples:**\n   * - `prompt: 'consent'` - Always show consent screen\n   * - `prompt: 'select_account'` - Always show account selection\n   * - `prompt: 'consent select_account'` - Show both consent and account selection\n   *\n   * **Note:** This parameter only affects web platform behavior. Mobile platforms use their own native prompts.\n   *\n   * @example 'consent'\n   * @example 'select_account'\n   * @example 'consent select_account'\n   * @see [Google OAuth2 Prompt Parameter](https://developers.google.com/identity/protocols/oauth2/openid-connect#prompt)\n   * @since 7.12.0\n   */\n  prompt?: 'none' | 'consent' | 'select_account' | 'consent select_account' | 'select_account consent';\n}\n\nexport interface GoogleLoginResponseOnline {\n  accessToken: AccessToken | null;\n  idToken: string | null;\n  profile: {\n    email: string | null;\n    familyName: string | null;\n    givenName: string | null;\n    id: string | null;\n    name: string | null;\n    imageUrl: string | null;\n  };\n  responseType: 'online';\n}\n\nexport interface GoogleLoginResponseOffline {\n  serverAuthCode: string;\n  responseType: 'offline';\n}\n\nexport type GoogleLoginResponse = GoogleLoginResponseOnline | GoogleLoginResponseOffline;\n\nexport interface AppleProviderOptions {\n  /**\n   * Scopes\n   * @description An array of scopes to request during login\n   * @example [\"name\", \"email\"]\n   * default: [\"name\", \"email\"]\n   */\n  scopes?: string[];\n  /**\n   * Nonce\n   * @description nonce\n   */\n  nonce?: string;\n  /**\n   * State\n   * @description state\n   */\n  state?: string;\n  /**\n   * Use Broadcast Channel for authentication flow\n   * @description When enabled, uses Broadcast Channel API for communication instead of URL redirects.\n   * Only applicable on platforms that support Broadcast Channel (Android).\n   * @default false\n   */\n  useBroadcastChannel?: boolean;\n}\n\nexport interface AppleProviderResponse {\n  /**\n   * Access token from Apple\n   * @description Content depends on `useProperTokenExchange` setting:\n   * - When `useProperTokenExchange: true`: Real access token from Apple (~1 hour validity)\n   * - When `useProperTokenExchange: false`: Contains authorization code as token (legacy mode)\n   * Use `idToken` for user authentication, `accessToken` for API calls when properly exchanged.\n   */\n  accessToken: AccessToken | null;\n\n  /**\n   * Identity token (JWT) from Apple\n   * @description Always contains the JWT with user identity information including:\n   * - User ID (sub claim)\n   * - Email (if user granted permission)\n   * - Name components (if user granted permission)\n   * - Email verification status\n   * This is the primary token for user authentication and should be verified on your backend.\n   */\n  idToken: string | null;\n\n  /**\n   * User profile information\n   * @description Basic user profile data extracted from the identity token and Apple response:\n   * - `user`: Apple's user identifier (sub claim from idToken)\n   * - `email`: User's email address (if permission granted)\n   * - `givenName`: User's first name (if permission granted)\n   * - `familyName`: User's last name (if permission granted)\n   */\n  profile: {\n    user: string;\n    email: string | null;\n    givenName: string | null;\n    familyName: string | null;\n  };\n\n  /**\n   * Authorization code for proper token exchange (when useProperTokenExchange is enabled)\n   * @description Only present when `useProperTokenExchange` is `true`. This code should be exchanged\n   * for proper access tokens on your backend using Apple's token endpoint. Use this for secure\n   * server-side token validation and to obtain refresh tokens.\n   * @see https://developer.apple.com/documentation/sign_in_with_apple/tokenresponse\n   */\n  authorizationCode?: string;\n}\n\nexport type LoginOptions =\n  | {\n      provider: 'facebook';\n      options: FacebookLoginOptions;\n    }\n  | {\n      provider: 'google';\n      options: GoogleLoginOptions;\n    }\n  | {\n      provider: 'apple';\n      options: AppleProviderOptions;\n    }\n  | {\n      provider: 'twitter';\n      options: TwitterLoginOptions;\n    }\n  | {\n      provider: 'oauth2';\n      options: OAuth2LoginOptions;\n    };\n\nexport type LoginResult =\n  | {\n      provider: 'facebook';\n      result: FacebookLoginResponse;\n    }\n  | {\n      provider: 'google';\n      result: GoogleLoginResponse;\n    }\n  | {\n      provider: 'apple';\n      result: AppleProviderResponse;\n    }\n  | {\n      provider: 'twitter';\n      result: TwitterLoginResponse;\n    }\n  | {\n      provider: 'oauth2';\n      result: OAuth2LoginResponse;\n    };\n\nexport interface AccessToken {\n  applicationId?: string;\n  declinedPermissions?: string[];\n  expires?: string;\n  isExpired?: boolean;\n  lastRefresh?: string;\n  permissions?: string[];\n  token: string;\n  tokenType?: string;\n  refreshToken?: string;\n  userId?: string;\n}\n\nexport interface FacebookLoginResponse {\n  accessToken: AccessToken | null;\n  idToken: string | null;\n  profile: {\n    userID: string;\n    email: string | null;\n    friendIDs: string[];\n    birthday: string | null;\n    ageRange: { min?: number; max?: number } | null;\n    gender: string | null;\n    location: { id: string; name: string } | null;\n    hometown: { id: string; name: string } | null;\n    profileURL: string | null;\n    name: string | null;\n    imageURL: string | null;\n  };\n}\n\nexport interface TwitterProfile {\n  id: string;\n  username: string;\n  name: string | null;\n  profileImageUrl: string | null;\n  verified: boolean;\n  email?: string | null;\n}\n\nexport interface TwitterLoginResponse {\n  accessToken: AccessToken | null;\n  refreshToken?: string | null;\n  scope: string[];\n  tokenType: 'bearer';\n  expiresIn?: number | null;\n  profile: TwitterProfile;\n}\n\nexport interface AuthorizationCode {\n  /**\n   * Jwt\n   * @description A JSON web token\n   */\n  jwt?: string;\n  /**\n   * Access Token\n   * @description An access token\n   */\n  accessToken?: string;\n}\n\nexport interface AuthorizationCodeOptions {\n  /**\n   * Provider\n   * @description Provider for the authorization code\n   */\n  provider: 'apple' | 'google' | 'facebook' | 'twitter' | 'oauth2';\n  /**\n   * Provider ID for OAuth2 providers (required when provider is 'oauth2')\n   * @description The ID used when configuring the OAuth2 provider in initialize()\n   */\n  providerId?: string;\n}\n\nexport interface isLoggedInOptions {\n  /**\n   * Provider\n   * @description Provider for the isLoggedIn\n   */\n  provider: 'apple' | 'google' | 'facebook' | 'twitter' | 'oauth2';\n  /**\n   * Provider ID for OAuth2 providers (required when provider is 'oauth2')\n   * @description The ID used when configuring the OAuth2 provider in initialize()\n   */\n  providerId?: string;\n}\n\n// Define the provider-specific call types\nexport type ProviderSpecificCall = 'facebook#getProfile' | 'facebook#requestTracking';\n\n// Define the options and response types for each specific call\nexport interface FacebookGetProfileOptions {\n  /**\n   * Fields to retrieve from Facebook profile\n   * @example [\"id\", \"name\", \"email\", \"picture\"]\n   */\n  fields?: string[];\n}\n\nexport interface FacebookGetProfileResponse {\n  /**\n   * Facebook profile data\n   */\n  profile: {\n    id: string | null;\n    name: string | null;\n    email: string | null;\n    first_name: string | null;\n    last_name: string | null;\n    picture?: {\n      data: {\n        height: number | null;\n        is_silhouette: boolean | null;\n        url: string | null;\n        width: number | null;\n      };\n    } | null;\n    [key: string]: any; // For additional fields that might be requested\n  };\n}\n\nexport interface OpenSecureWindowOptions {\n  /**\n   * The endpoint to open\n   */\n  authEndpoint: string;\n  /**\n   * The redirect URI to use for the openSecureWindow call.\n   * This will be checked to make sure it matches the redirect URI after the window finishes the redirection.\n   */\n  redirectUri: string;\n  /**\n   * The name of the broadcast channel to listen to, relevant only for web\n   */\n  broadcastChannelName?: string;\n}\n\nexport interface OpenSecureWindowResponse {\n  /**\n   * The result of the openSecureWindow call\n   */\n  redirectedUri: string;\n}\n\nexport type FacebookRequestTrackingOptions = Record<string, never>;\n\nexport interface FacebookRequestTrackingResponse {\n  /**\n   * App tracking authorization status\n   */\n  status: 'authorized' | 'denied' | 'notDetermined' | 'restricted';\n}\n\n// Map call strings to their options and response types\nexport type ProviderSpecificCallOptionsMap = {\n  'facebook#getProfile': FacebookGetProfileOptions;\n  'facebook#requestTracking': FacebookRequestTrackingOptions;\n};\n\nexport type ProviderSpecificCallResponseMap = {\n  'facebook#getProfile': FacebookGetProfileResponse;\n  'facebook#requestTracking': FacebookRequestTrackingResponse;\n};\n\n// Add a helper type to map providers to their response types\nexport type ProviderResponseMap = {\n  facebook: FacebookLoginResponse;\n  google: GoogleLoginResponse;\n  apple: AppleProviderResponse;\n  twitter: TwitterLoginResponse;\n  oauth2: OAuth2LoginResponse;\n};\n\n/**\n * Error codes returned by the plugin.\n * @since 8.3.x\n */\nexport type SocialLoginErrorCode = 'USER_CANCELLED';\n\n/**\n * Errors thrown by SocialLogin methods.\n *\n * When a user dismisses or cancels the provider UI (popup closed, system dialog cancelled, access denied, etc.),\n * the plugin rejects with `code === 'USER_CANCELLED'` so the caller can distinguish user intent from real failures.\n * Other errors may omit the code or use provider-specific values.\n */\nexport interface SocialLoginError extends Error {\n  code?: SocialLoginErrorCode | string;\n}\n\nexport interface SocialLoginPlugin {\n  /**\n   * Initialize the plugin\n   * @description initialize the plugin with the required options\n   */\n  initialize(options: InitializeOptions): Promise<void>;\n  /**\n   * Login with the selected provider\n   * @description login with the selected provider\n   *\n   * On user dismissal/cancellation, the Promise is rejected with `code === 'USER_CANCELLED'` (see `SocialLoginError`).\n   */\n  login<T extends LoginOptions['provider']>(\n    options: Extract<LoginOptions, { provider: T }>,\n  ): Promise<{ provider: T; result: ProviderResponseMap[T] }>;\n  /**\n   * Logout\n   * @description Logout the user from the specified provider\n   *\n   * **Google Offline Mode Limitation:**\n   * This method is NOT supported when Google is initialized with `mode: 'offline'`.\n   * It will reject with error: \"logout is not implemented when using offline mode\"\n   *\n   * @throws Error if Google provider is in offline mode\n   */\n  logout(options: {\n    provider: 'apple' | 'google' | 'facebook' | 'twitter' | 'oauth2';\n    providerId?: string;\n  }): Promise<void>;\n  /**\n   * IsLoggedIn\n   * @description Check if the user is currently logged in with the specified provider\n   *\n   * **Google Offline Mode Limitation:**\n   * This method is NOT supported when Google is initialized with `mode: 'offline'`.\n   * It will reject with error: \"isLoggedIn is not implemented when using offline mode\"\n   *\n   * @throws Error if Google provider is in offline mode\n   */\n  isLoggedIn(options: isLoggedInOptions): Promise<{ isLoggedIn: boolean }>;\n\n  /**\n   * Get the current authorization code\n   * @description Get the authorization code for server-side authentication\n   *\n   * **Google Offline Mode Limitation:**\n   * This method is NOT supported when Google is initialized with `mode: 'offline'`.\n   * It will reject with error: \"getAuthorizationCode is not implemented when using offline mode\"\n   *\n   * In offline mode, the authorization code (serverAuthCode) is already returned by the `login()` method.\n   *\n   * @throws Error if Google provider is in offline mode\n   */\n  getAuthorizationCode(options: AuthorizationCodeOptions): Promise<AuthorizationCode>;\n  /**\n   * Refresh the access token\n   * @description refresh the access token\n   *\n   * **Google Offline Mode Limitation:**\n   * This method is NOT supported when Google is initialized with `mode: 'offline'`.\n   * Offline mode only returns `serverAuthCode` for backend token exchange, so token refresh must happen on your backend.\n   * The plugin logs and rejects with a message explaining that you should send `serverAuthCode` to your backend,\n   * refresh the Google tokens there, or switch to `mode: 'online'` for client-side refresh.\n   *\n   * **Google Web Limitation:**\n   * On Web, Google `refresh()` is not implemented, even when using `mode: 'online'`.\n   * Call `login()` again on Web to obtain a fresh token instead.\n   *\n   * @throws Error if Google provider is in offline mode, or on Web where Google `refresh()` is not implemented\n   */\n  refresh(options: LoginOptions): Promise<void>;\n\n  /**\n   * OAuth2 refresh-token helper (feature parity with Capawesome OAuth).\n   *\n   * Scope:\n   * - Only applies to the built-in `oauth2` provider (not Google/Apple/Facebook/Twitter).\n   * - Requires a token endpoint (either `accessTokenEndpoint`/`tokenEndpoint` or `issuerUrl` discovery).\n   *\n   * Security note:\n   * - This does not validate JWT signatures. It only exchanges/refreshes tokens.\n   *\n   * If `refreshToken` is omitted, the plugin will attempt to use the stored refresh token (if available).\n   */\n  refreshToken(options: {\n    provider: 'oauth2';\n    providerId: string;\n    refreshToken?: string;\n    additionalParameters?: Record<string, string>;\n  }): Promise<OAuth2LoginResponse>;\n\n  /**\n   * Web-only: handle the OAuth redirect callback and return the parsed result.\n   *\n   * Notes:\n   * - This is only meaningful on Web. iOS/Android implementations will reject.\n   * - Intended for redirect-based flows (e.g. `oauth2` with `flow: 'redirect'`) where the page navigates away.\n   */\n  handleRedirectCallback(): Promise<LoginResult | null>;\n\n  /**\n   * Decode a JWT (typically an OIDC ID token) into its claims.\n   *\n   * Notes:\n   * - Accepts both `idToken` and `token` to match common naming (Capawesome uses `token`).\n   * - This does not validate the signature or issuer/audience. It only base64url-decodes the payload.\n   */\n  decodeIdToken(options: { idToken?: string; token?: string }): Promise<{ claims: Record<string, any> }>;\n\n  /**\n   * Convert an access token expiration timestamp (milliseconds since epoch) to an ISO date string.\n   *\n   * This is a pure helper (feature parity with Capawesome OAuth) and does not depend on provider state.\n   */\n  getAccessTokenExpirationDate(options: {\n    /**\n     * Access token expiration date in milliseconds since epoch.\n     * Typically: `Date.now() + expiresInSeconds * 1000`.\n     */\n    accessTokenExpirationDate: number;\n  }): Promise<{ date: string }>;\n\n  /**\n   * Check if an access token is available (non-empty).\n   *\n   * This is a pure helper (feature parity with Capawesome OAuth) and does not depend on provider state.\n   */\n  isAccessTokenAvailable(options: { accessToken: string | null }): Promise<{ isAvailable: boolean }>;\n\n  /**\n   * Check if an access token is expired.\n   *\n   * This is a pure helper (feature parity with Capawesome OAuth) and does not depend on provider state.\n   */\n  isAccessTokenExpired(options: { accessTokenExpirationDate: number }): Promise<{ isExpired: boolean }>;\n\n  /**\n   * Check if a refresh token is available (non-empty).\n   *\n   * This is a pure helper (feature parity with Capawesome OAuth) and does not depend on provider state.\n   */\n  isRefreshTokenAvailable(options: { refreshToken: string | null }): Promise<{ isAvailable: boolean }>;\n\n  /**\n   * Execute provider-specific calls\n   * @description Execute a provider-specific functionality\n   */\n  providerSpecificCall<T extends ProviderSpecificCall>(options: {\n    call: T;\n    options: ProviderSpecificCallOptionsMap[T];\n  }): Promise<ProviderSpecificCallResponseMap[T]>;\n\n  /**\n   * Get the native Capacitor plugin version\n   *\n   * @returns {Promise<{ id: string }>} an Promise with version for this device\n   * @throws An error if the something went wrong\n   */\n  getPluginVersion(): Promise<{ version: string }>;\n\n  /**\n   * Opens a secured window for OAuth2 authentication.\n   * For web, you should have the code in the redirected page to use a broadcast channel to send the redirected url to the app\n   * Something like:\n   * ```html\n   * <html>\n   * <head></head>\n   * <body>\n   * <script>\n   *   const searchParams = new URLSearchParams(location.search)\n   *   if (searchParams.has(\"code\")) {\n   *     new BroadcastChannel(\"my-channel-name\").postMessage(location.href);\n   *     window.close();\n   *   }\n   * </script>\n   * </body>\n   * </html>\n   * ```\n   * For mobile, you should have a redirect uri that opens the app, something like: `myapp://oauth_callback/`\n   * And make sure to register it in the app's info.plist:\n   * ```xml\n   * <key>CFBundleURLTypes</key>\n   * <array>\n   *    <dict>\n   *       <key>CFBundleURLSchemes</key>\n   *       <array>\n   *          <string>myapp</string>\n   *       </array>\n   *    </dict>\n   * </array>\n   * ```\n   * And in the AndroidManifest.xml file:\n   * ```xml\n   * <activity>\n   *    <intent-filter>\n   *       <action android:name=\"android.intent.action.VIEW\" />\n   *       <category android:name=\"android.intent.category.DEFAULT\" />\n   *       <category android:name=\"android.intent.category.BROWSABLE\" />\n   *       <data android:host=\"oauth_callback\" android:scheme=\"myapp\" />\n   *    </intent-filter>\n   * </activity>\n   * ```\n   * @param options - the options for the openSecureWindow call\n   */\n  openSecureWindow(options: OpenSecureWindowOptions): Promise<OpenSecureWindowResponse>;\n}\n"]}

package/dist/esm/errors.d.ts

@@ -0,0 +1,8 @@
+import type { SocialLoginError, SocialLoginErrorCode } from './definitions';
+export declare const USER_CANCELLED_CODE: SocialLoginErrorCode;
+export declare function createUserCancelledError(message: string): SocialLoginError;
+/**
+ * Detects cancellation-like messages and marks them with USER_CANCELLED.
+ * Falls back to a regular Error when the message doesn't look like a user cancellation.
+ */
+export declare function inferUserCancelledError(message: string): SocialLoginError;

package/dist/esm/errors.js

@@ -0,0 +1,30 @@
+export const USER_CANCELLED_CODE = 'USER_CANCELLED';
+const CANCELLED_PATTERNS = [
+    'access_denied',
+    'access denied',
+    'user_cancelled_authorize',
+    'user_cancelled',
+    'user cancelled',
+    'user canceled',
+    'login cancelled',
+    'login canceled',
+    'popup closed',
+    'window was closed',
+];
+export function createUserCancelledError(message) {
+    const error = new Error(message);
+    error.code = USER_CANCELLED_CODE;
+    return error;
+}
+/**
+ * Detects cancellation-like messages and marks them with USER_CANCELLED.
+ * Falls back to a regular Error when the message doesn't look like a user cancellation.
+ */
+export function inferUserCancelledError(message) {
+    const normalized = message.toLowerCase();
+    if (CANCELLED_PATTERNS.some((pattern) => normalized.includes(pattern))) {
+        return createUserCancelledError(message);
+    }
+    return new Error(message);
+}
+//# sourceMappingURL=errors.js.map

package/dist/esm/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,mBAAmB,GAAyB,gBAAgB,CAAC;AAE1E,MAAM,kBAAkB,GAAG;IACzB,eAAe;IACf,eAAe;IACf,0BAA0B;IAC1B,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,iBAAiB;IACjB,gBAAgB;IAChB,cAAc;IACd,mBAAmB;CACpB,CAAC;AAEF,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAqB,CAAC;IACrD,KAAK,CAAC,IAAI,GAAG,mBAAmB,CAAC;IACjC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC","sourcesContent":["import type { SocialLoginError, SocialLoginErrorCode } from './definitions';\n\nexport const USER_CANCELLED_CODE: SocialLoginErrorCode = 'USER_CANCELLED';\n\nconst CANCELLED_PATTERNS = [\n  'access_denied',\n  'access denied',\n  'user_cancelled_authorize',\n  'user_cancelled',\n  'user cancelled',\n  'user canceled',\n  'login cancelled',\n  'login canceled',\n  'popup closed',\n  'window was closed',\n];\n\nexport function createUserCancelledError(message: string): SocialLoginError {\n  const error = new Error(message) as SocialLoginError;\n  error.code = USER_CANCELLED_CODE;\n  return error;\n}\n\n/**\n * Detects cancellation-like messages and marks them with USER_CANCELLED.\n * Falls back to a regular Error when the message doesn't look like a user cancellation.\n */\nexport function inferUserCancelledError(message: string): SocialLoginError {\n  const normalized = message.toLowerCase();\n  if (CANCELLED_PATTERNS.some((pattern) => normalized.includes(pattern))) {\n    return createUserCancelledError(message);\n  }\n  return new Error(message);\n}\n"]}

package/dist/esm/facebook-provider.d.ts

@@ -1,5 +1,5 @@
 import { BaseSocialLogin } from './base';
-import type { FacebookLoginOptions, AuthorizationCode, LoginResult } from './definitions';
+import type { AuthorizationCode, FacebookLoginOptions, LoginResult } from './definitions';
 export declare class FacebookSocialLogin extends BaseSocialLogin {
     private appId;
     private scriptLoaded;

package/dist/esm/facebook-provider.js

@@ -1,4 +1,5 @@
 import { BaseSocialLogin } from './base';
+import { createUserCancelledError } from './errors';
 export class FacebookSocialLogin extends BaseSocialLogin {
     constructor() {
         super(...arguments);
@@ -84,7 +85,7 @@ export class FacebookSocialLogin extends BaseSocialLogin {
                     resolveWithProfile(response.authResponse);
                 }
                 else if (response.status === 'not_authorized' || response.status === 'unknown') {
-                    reject(new Error('Facebook login was cancelled.'));
+                    reject(createUserCancelledError('Facebook login was cancelled.'));
                 }
                 else {
                     waitForConnected();
@@ -138,7 +139,7 @@ export class FacebookSocialLogin extends BaseSocialLogin {
                     }
                     if (response.status === 'not_authorized' || response.status === 'unknown') {
                         finished = true;
-                        reject(new Error('Facebook login was cancelled.'));
+                        reject(createUserCancelledError('Facebook login was cancelled.'));
                         return;
                     }
                     if (Date.now() - start >= timeoutMs) {