@chipmobilesdk/rn-auth 0.3.0 → 0.3.1

package/src/oidc/classifyError.ts

@@ -1,76 +1,76 @@
-/**
- * Classifies a native OIDC error into an `AuthErrorCode`.
- *
- * The rules are an ordered table rather than a chain of substring checks, so a
- * platform adapter (the iOS one, later) adds its own rows without touching the
- * engine. Order matters: the first matching rule wins.
- *
- * The default is deliberately not "session expired". Restore clears the stored
- * session only on `session-expired`, so anything this table cannot name — a
- * timeout, a 5xx, a discovery failure, a localized message — must keep the
- * session rather than sign the user out.
- */
-
-import { AuthError, type AuthErrorCode } from '../diagnostics/errors';
-
-export interface ClassificationRule {
-	readonly code: AuthErrorCode;
-	readonly messageKey: string;
-	/** Matched against the native error's `code` and `message`, case-insensitively. */
-	readonly pattern: RegExp;
-}
-
-/**
- * OAuth error codes (RFC 6749 §5.2, OIDC Core §3.1.2.6) and the Entra ID AADSTS
- * codes that mean the same thing, plus the transport failures app-auth reports.
- */
-export const DEFAULT_CLASSIFICATION_RULES: readonly ClassificationRule[] = [
-	{
-		code: 'provider-cancelled',
-		messageKey: 'auth.error.cancelled',
-		pattern: /cancel|user_cancel|authorization flow (was )?dismissed/i,
-	},
-	{
-		code: 'session-expired',
-		messageKey: 'auth.error.sessionExpired',
-		// invalid_grant is the refresh-token verdict; the AADSTS codes are Entra's
-		// expired, revoked, or inactive refresh token and password-changed cases.
-		pattern:
-			/\binvalid_grant\b|\binteraction_required\b|\blogin_required\b|AADSTS(700082|700084|50173|70043)\b/i,
-	},
-	{
-		code: 'redirect-mismatch',
-		messageKey: 'auth.error.redirectMismatch',
-		pattern: /redirect_uri|redirect uri|redirect_mismatch|AADSTS50011\b/i,
-	},
-	{
-		code: 'consent-denied',
-		messageKey: 'auth.error.consentDenied',
-		pattern: /\baccess_denied\b|\bconsent_required\b|AADSTS65001\b/i,
-	},
-	{
-		code: 'network-unavailable',
-		messageKey: 'auth.error.network',
-		pattern:
-			/network|connection|offline|timed? ?out|unable to resolve host|unreachable|\bserver_error\b|\btemporarily_unavailable\b|\b5\d\d\b/i,
-	},
-];
-
-/** Maps a native app-auth error to a classified AuthError without leaking tokens. */
-export function classifyAppAuthError(
-	error: unknown,
-	rules: readonly ClassificationRule[] = DEFAULT_CLASSIFICATION_RULES,
-): AuthError {
-	const message = error instanceof Error ? error.message : String(error);
-	const nativeCode = (error as { code?: unknown } | undefined)?.code;
-	const haystack = `${typeof nativeCode === 'string' ? nativeCode : ''} ${message}`;
-	const rule = rules.find(candidate => candidate.pattern.test(haystack));
-	const code = rule?.code ?? 'token-acquisition-failed';
-	return new AuthError({
-		code,
-		messageKey: rule?.messageKey ?? 'auth.error.token',
-		audience: code === 'redirect-mismatch' ? 'developer' : 'user',
-		// AuthError redacts `detail`, so token-shaped values never survive.
-		detail: message,
-	});
-}
+/**
+ * Classifies a native OIDC error into an `AuthErrorCode`.
+ *
+ * The rules are an ordered table rather than a chain of substring checks, so a
+ * platform adapter (the iOS one, later) adds its own rows without touching the
+ * engine. Order matters: the first matching rule wins.
+ *
+ * The default is deliberately not "session expired". Restore clears the stored
+ * session only on `session-expired`, so anything this table cannot name — a
+ * timeout, a 5xx, a discovery failure, a localized message — must keep the
+ * session rather than sign the user out.
+ */
+
+import { AuthError, type AuthErrorCode } from '../diagnostics/errors';
+
+export interface ClassificationRule {
+	readonly code: AuthErrorCode;
+	readonly messageKey: string;
+	/** Matched against the native error's `code` and `message`, case-insensitively. */
+	readonly pattern: RegExp;
+}
+
+/**
+ * OAuth error codes (RFC 6749 §5.2, OIDC Core §3.1.2.6) and the Entra ID AADSTS
+ * codes that mean the same thing, plus the transport failures app-auth reports.
+ */
+export const DEFAULT_CLASSIFICATION_RULES: readonly ClassificationRule[] = [
+	{
+		code: 'provider-cancelled',
+		messageKey: 'auth.error.cancelled',
+		pattern: /cancel|user_cancel|authorization flow (was )?dismissed/i,
+	},
+	{
+		code: 'session-expired',
+		messageKey: 'auth.error.sessionExpired',
+		// invalid_grant is the refresh-token verdict; the AADSTS codes are Entra's
+		// expired, revoked, or inactive refresh token and password-changed cases.
+		pattern:
+			/\binvalid_grant\b|\binteraction_required\b|\blogin_required\b|AADSTS(700082|700084|50173|70043)\b/i,
+	},
+	{
+		code: 'redirect-mismatch',
+		messageKey: 'auth.error.redirectMismatch',
+		pattern: /redirect_uri|redirect uri|redirect_mismatch|AADSTS50011\b/i,
+	},
+	{
+		code: 'consent-denied',
+		messageKey: 'auth.error.consentDenied',
+		pattern: /\baccess_denied\b|\bconsent_required\b|AADSTS65001\b/i,
+	},
+	{
+		code: 'network-unavailable',
+		messageKey: 'auth.error.network',
+		pattern:
+			/network|connection|offline|timed? ?out|unable to resolve host|unreachable|\bserver_error\b|\btemporarily_unavailable\b|\b5\d\d\b/i,
+	},
+];
+
+/** Maps a native app-auth error to a classified AuthError without leaking tokens. */
+export function classifyAppAuthError(
+	error: unknown,
+	rules: readonly ClassificationRule[] = DEFAULT_CLASSIFICATION_RULES,
+): AuthError {
+	const message = error instanceof Error ? error.message : String(error);
+	const nativeCode = (error as { code?: unknown } | undefined)?.code;
+	const haystack = `${typeof nativeCode === 'string' ? nativeCode : ''} ${message}`;
+	const rule = rules.find(candidate => candidate.pattern.test(haystack));
+	const code = rule?.code ?? 'token-acquisition-failed';
+	return new AuthError({
+		code,
+		messageKey: rule?.messageKey ?? 'auth.error.token',
+		audience: code === 'redirect-mismatch' ? 'developer' : 'user',
+		// AuthError redacts `detail`, so token-shaped values never survive.
+		detail: message,
+	});
+}

package/src/oidc/socialRouting.ts

@@ -1,73 +1,66 @@
-/**
- * Social provider routing (FR-002/FR-003, R3). Google and Apple are federated
- * inside the External ID tenant; the app presents the platform-correct action
- * and starts the user flow with a per-provider `domain_hint`.
- */
-
-import type {
-	AuthConfig,
-	DevicePlatform,
-	ProviderConfig,
-	ProviderId,
-} from '../config/types';
-import { AuthConfigError } from '../diagnostics/errors';
-
-/** Find the configured provider, ensuring it is enabled for the platform. */
-export function resolveProvider(
-	config: AuthConfig,
-	providerId: ProviderId,
-	platform: DevicePlatform,
-): ProviderConfig {
-	const provider = config.providers.find(candidate => candidate.id === providerId);
-	if (!provider) {
-		throw new AuthConfigError(
-			'auth.error.configuration',
-			`Provider "${providerId}" is not configured`,
-		);
-	}
-	if (!provider.platforms.includes(platform)) {
-		throw new AuthConfigError(
-			'auth.error.configuration',
-			`Provider "${providerId}" is not enabled for platform "${platform}"`,
-		);
-	}
-	if (provider.available === false) {
-		throw new AuthConfigError(
-			'auth.error.configuration',
-			`Provider "${providerId}" is marked unavailable`,
-		);
-	}
-	return provider;
-}
-
-/** Build the OIDC additional parameters that route to the chosen IdP. */
-export function buildAdditionalParameters(
-	provider: ProviderConfig,
-): Record<string, string> {
-	return { domain_hint: provider.domainHint };
-}
-
-/**
- * All providers to present on a given platform, in configuration array order
- * (FR-003/FR-004). Filtered to providers enabled for the platform and not marked
- * unavailable.
- */
-export function availableProvidersForPlatform(
-	config: AuthConfig,
-	platform: DevicePlatform,
-): ProviderConfig[] {
-	return config.providers.filter(
-		provider => provider.platforms.includes(platform) && provider.available !== false,
-	);
-}
-
-/**
- * The first available provider for a platform (UX-004, back-compat). Equals
- * `availableProvidersForPlatform(config, platform)[0]`.
- */
-export function defaultProviderForPlatform(
-	config: AuthConfig,
-	platform: DevicePlatform,
-): ProviderConfig | undefined {
-	return availableProvidersForPlatform(config, platform)[0];
-}
+/**
+ * Social provider routing (FR-002/FR-003, R3). Google and Apple are federated
+ * inside the External ID tenant; the app presents the platform-correct action
+ * and starts the user flow with a per-provider `domain_hint`.
+ */
+
+import type { AuthConfig, DevicePlatform, ProviderConfig, ProviderId } from '../config/types';
+import { AuthConfigError } from '../diagnostics/errors';
+
+/** Find the configured provider, ensuring it is enabled for the platform. */
+export function resolveProvider(
+	config: AuthConfig,
+	providerId: ProviderId,
+	platform: DevicePlatform,
+): ProviderConfig {
+	const provider = config.providers.find(candidate => candidate.id === providerId);
+	if (!provider) {
+		throw new AuthConfigError(
+			'auth.error.configuration',
+			`Provider "${providerId}" is not configured`,
+		);
+	}
+	if (!provider.platforms.includes(platform)) {
+		throw new AuthConfigError(
+			'auth.error.configuration',
+			`Provider "${providerId}" is not enabled for platform "${platform}"`,
+		);
+	}
+	if (provider.available === false) {
+		throw new AuthConfigError(
+			'auth.error.configuration',
+			`Provider "${providerId}" is marked unavailable`,
+		);
+	}
+	return provider;
+}
+
+/** Build the OIDC additional parameters that route to the chosen IdP. */
+export function buildAdditionalParameters(provider: ProviderConfig): Record<string, string> {
+	return { domain_hint: provider.domainHint };
+}
+
+/**
+ * All providers to present on a given platform, in configuration array order
+ * (FR-003/FR-004). Filtered to providers enabled for the platform and not marked
+ * unavailable.
+ */
+export function availableProvidersForPlatform(
+	config: AuthConfig,
+	platform: DevicePlatform,
+): ProviderConfig[] {
+	return config.providers.filter(
+		provider => provider.platforms.includes(platform) && provider.available !== false,
+	);
+}
+
+/**
+ * The first available provider for a platform (UX-004, back-compat). Equals
+ * `availableProvidersForPlatform(config, platform)[0]`.
+ */
+export function defaultProviderForPlatform(
+	config: AuthConfig,
+	platform: DevicePlatform,
+): ProviderConfig | undefined {
+	return availableProvidersForPlatform(config, platform)[0];
+}

package/src/react/AuthProvider.tsx

@@ -1,47 +1,41 @@
-/**
- * React context boundary for the auth controller (LIB-002). Subscribes to the
- * controller and re-renders consumers on every state change.
- */
-
-import React, {
-	createContext,
-	useContext,
-	useEffect,
-	useMemo,
-	useState,
-} from 'react';
-import type { Auth, AuthState } from '../config/types';
-
-interface AuthContextValue {
-	auth: Auth;
-	state: AuthState;
-}
-
-const AuthContext = createContext<AuthContextValue | null>(null);
-
-export interface AuthProviderProps {
-	auth: Auth;
-	children: React.ReactNode;
-}
-
-export function AuthProvider({ auth, children }: AuthProviderProps) {
-	const [state, setState] = useState<AuthState>(() => auth.getState());
-
-	useEffect(() => {
-		// Sync immediately in case state changed between render and subscribe.
-		setState(auth.getState());
-		return auth.subscribe(setState);
-	}, [auth]);
-
-	const value = useMemo<AuthContextValue>(() => ({ auth, state }), [auth, state]);
-
-	return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;
-}
-
-export function useAuthContext(): AuthContextValue {
-	const value = useContext(AuthContext);
-	if (!value) {
-		throw new Error('useAuth must be used within an <AuthProvider>.');
-	}
-	return value;
-}
+/**
+ * React context boundary for the auth controller (LIB-002). Subscribes to the
+ * controller and re-renders consumers on every state change.
+ */
+
+import React, { createContext, useContext, useEffect, useMemo, useState } from 'react';
+import type { Auth, AuthState } from '../config/types';
+
+interface AuthContextValue {
+	auth: Auth;
+	state: AuthState;
+}
+
+const AuthContext = createContext<AuthContextValue | null>(null);
+
+export interface AuthProviderProps {
+	auth: Auth;
+	children: React.ReactNode;
+}
+
+export function AuthProvider({ auth, children }: AuthProviderProps) {
+	const [state, setState] = useState<AuthState>(() => auth.getState());
+
+	useEffect(() => {
+		// Sync immediately in case state changed between render and subscribe.
+		setState(auth.getState());
+		return auth.subscribe(setState);
+	}, [auth]);
+
+	const value = useMemo<AuthContextValue>(() => ({ auth, state }), [auth, state]);
+
+	return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;
+}
+
+export function useAuthContext(): AuthContextValue {
+	const value = useContext(AuthContext);
+	if (!value) {
+		throw new Error('useAuth must be used within an <AuthProvider>.');
+	}
+	return value;
+}

package/src/react/hooks.ts

@@ -1,91 +1,86 @@
-/**
- * Public hooks (LIB-002). All read from the AuthProvider context so consumers
- * re-render on state changes.
- */
-
-import { useCallback, useState } from 'react';
-import { useAuthContext } from './AuthProvider';
-import type {
-	AccessTier,
-	AccessTokenResult,
-	AuthState,
-	GlobalSignOutResult,
-	PremiumGateResult,
-	Profile,
-	ProviderConfig,
-	ProviderId,
-} from '../config/types';
-import { failClosedTier } from '../access/accessTier';
-
-export interface UseAuthResult {
-	state: AuthState;
-	signIn(providerId: ProviderId): Promise<AuthState>;
-	signOut(): Promise<void>;
-	signOutGlobal(): Promise<GlobalSignOutResult>;
-	restore(): Promise<AuthState>;
-	requirePremium(): PremiumGateResult;
-}
-
-export function useAuth(): UseAuthResult {
-	const { auth, state } = useAuthContext();
-	return {
-		state,
-		signIn: useCallback((providerId: ProviderId) => auth.signIn(providerId), [auth]),
-		signOut: useCallback(() => auth.signOut(), [auth]),
-		signOutGlobal: useCallback(() => auth.signOutGlobal(), [auth]),
-		restore: useCallback(() => auth.restore(), [auth]),
-		requirePremium: useCallback(() => auth.requirePremium(), [auth]),
-	};
-}
-
-export function useProfile(): Profile | undefined {
-	const { state } = useAuthContext();
-	return state.profile;
-}
-
-export function useAccessTier(): AccessTier {
-	const { state } = useAuthContext();
-	return state.accessTier ?? failClosedTier();
-}
-
-/** The first provider to present on the current platform (UX-004), or undefined. */
-export function useSignInProvider(): ProviderConfig | undefined {
-	const { auth } = useAuthContext();
-	return auth.getPlatformProvider();
-}
-
-/** All available providers for the current platform, in configuration order (FR-003/FR-004). */
-export function useSignInProviders(): ProviderConfig[] {
-	const { auth } = useAuthContext();
-	return auth.getPlatformProviders();
-}
-
-export type UseAccessTokenStatus =
-	| 'idle'
-	| 'loading'
-	| 'success'
-	| 'denied'
-	| 'unavailable'
-	| 'error';
-
-export interface UseAccessTokenResult {
-	status: UseAccessTokenStatus;
-	token?: string;
-	request(): Promise<AccessTokenResult>;
-}
-
-export function useAccessToken(resourceKey: string): UseAccessTokenResult {
-	const { auth } = useAuthContext();
-	const [status, setStatus] = useState<UseAccessTokenStatus>('idle');
-	const [token, setToken] = useState<string | undefined>(undefined);
-
-	const request = useCallback(async () => {
-		setStatus('loading');
-		const result = await auth.requestAccessToken(resourceKey);
-		setStatus(result.status);
-		setToken(result.token);
-		return result;
-	}, [auth, resourceKey]);
-
-	return { status, token, request };
-}
+/**
+ * Public hooks (LIB-002). All read from the AuthProvider context so consumers
+ * re-render on state changes.
+ */
+
+import { useCallback, useState } from 'react';
+import { useAuthContext } from './AuthProvider';
+import type {
+	AccessTier,
+	AccessTokenResult,
+	AuthState,
+	GlobalSignOutResult,
+	PremiumGateResult,
+	Profile,
+	ProviderConfig,
+	ProviderId,
+} from '../config/types';
+import { failClosedTier } from '../access/accessTier';
+
+export interface UseAuthResult {
+	state: AuthState;
+	signIn(providerId: ProviderId): Promise<AuthState>;
+	signOut(): Promise<void>;
+	signOutGlobal(): Promise<GlobalSignOutResult>;
+	restore(): Promise<AuthState>;
+	requirePremium(): PremiumGateResult;
+}
+
+export function useAuth(): UseAuthResult {
+	const { auth, state } = useAuthContext();
+	return {
+		state,
+		signIn: useCallback((providerId: ProviderId) => auth.signIn(providerId), [auth]),
+		signOut: useCallback(() => auth.signOut(), [auth]),
+		signOutGlobal: useCallback(() => auth.signOutGlobal(), [auth]),
+		restore: useCallback(() => auth.restore(), [auth]),
+		requirePremium: useCallback(() => auth.requirePremium(), [auth]),
+	};
+}
+
+export function useProfile(): Profile | undefined {
+	const { state } = useAuthContext();
+	return state.profile;
+}
+
+export function useAccessTier(): AccessTier {
+	const { state } = useAuthContext();
+	return state.accessTier ?? failClosedTier();
+}
+
+/** The first provider to present on the current platform (UX-004), or undefined. */
+export function useSignInProvider(): ProviderConfig | undefined {
+	const { auth } = useAuthContext();
+	return auth.getPlatformProvider();
+}
+
+/** All available providers for the current platform, in configuration order (FR-003/FR-004). */
+export function useSignInProviders(): ProviderConfig[] {
+	const { auth } = useAuthContext();
+	return auth.getPlatformProviders();
+}
+
+export type UseAccessTokenStatus =
+	'idle' | 'loading' | 'success' | 'denied' | 'unavailable' | 'error';
+
+export interface UseAccessTokenResult {
+	status: UseAccessTokenStatus;
+	token?: string;
+	request(): Promise<AccessTokenResult>;
+}
+
+export function useAccessToken(resourceKey: string): UseAccessTokenResult {
+	const { auth } = useAuthContext();
+	const [status, setStatus] = useState<UseAccessTokenStatus>('idle');
+	const [token, setToken] = useState<string | undefined>(undefined);
+
+	const request = useCallback(async () => {
+		setStatus('loading');
+		const result = await auth.requestAccessToken(resourceKey);
+		setStatus(result.status);
+		setToken(result.token);
+		return result;
+	}, [auth, resourceKey]);
+
+	return { status, token, request };
+}