@chipmobilesdk/rn-auth 0.3.0 → 0.4.0

package/src/diagnostics/messageKeys.ts

@@ -1,61 +1,72 @@
-/**
- * Stable, localizable message keys with English default copy (UX-006 / LIB-011).
- * The library takes no i18n runtime dependency: consuming apps map these keys to
- * localized strings via their own i18n system. User-actionable copy and
- * developer/tenant-configuration copy are kept separate (UX-005).
- */
-
-export interface AuthMessageMap {
-	// User-facing actions and states
-	'auth.action.continueGoogle': string;
-	'auth.action.continueApple': string;
-	'auth.action.continueFacebook': string;
-	'auth.state.signedOut': string;
-	'auth.state.authenticating': string;
-	'auth.state.signedIn': string;
-	'auth.state.signingOut': string;
-	// Access tier (user-facing)
-	'auth.tier.free': string;
-	'auth.tier.premium': string;
-	'auth.tier.unverified': string;
-	// User-actionable errors
-	'auth.error.cancelled': string;
-	'auth.error.sessionExpired': string;
-	'auth.error.entitlement': string;
-	'auth.error.network': string;
-	// Developer / tenant-configuration errors
-	'auth.error.configuration': string;
-	'auth.error.redirectMismatch': string;
-	'auth.error.token': string;
-	'auth.error.consentDenied': string;
-}
-
-export type AuthMessageKey = keyof AuthMessageMap;
-
-export const DEFAULT_MESSAGES: AuthMessageMap = {
-	'auth.action.continueGoogle': 'Continue with Google',
-	'auth.action.continueApple': 'Continue with Apple',
-	'auth.action.continueFacebook': 'Continue with Facebook',
-	'auth.state.signedOut': 'Sign in to continue',
-	'auth.state.authenticating': 'Signing you in…',
-	'auth.state.signedIn': 'You are signed in',
-	'auth.state.signingOut': 'Signing out…',
-	'auth.tier.free': 'Free',
-	'auth.tier.premium': 'Premium',
-	'auth.tier.unverified': 'Membership could not be verified',
-	'auth.error.cancelled': 'Sign-in was cancelled. You can try again.',
-	'auth.error.sessionExpired': 'Your session expired. Please sign in again.',
-	'auth.error.entitlement': 'This feature requires a verified premium membership.',
-	'auth.error.network': 'No connection. Some features are limited until you reconnect.',
-	'auth.error.configuration': 'Authentication is not configured correctly.',
-	'auth.error.redirectMismatch': 'The sign-in redirect does not match the app configuration.',
-	'auth.error.token': 'We could not complete the request. Please try again.',
-	'auth.error.consentDenied': 'Access to this resource was denied.',
-};
-
-/** Resolve a message, preferring app overrides over the English defaults. */
-export function resolveMessages(
-	overrides?: Partial<AuthMessageMap>,
-): AuthMessageMap {
-	return { ...DEFAULT_MESSAGES, ...(overrides ?? {}) };
-}
+/**
+ * Stable, localizable message keys with English default copy (UX-006 / LIB-011).
+ * The library takes no i18n runtime dependency: consuming apps map these keys to
+ * localized strings via their own i18n system. User-actionable copy and
+ * developer/tenant-configuration copy are kept separate (UX-005).
+ */
+
+import { defineMessages } from '@chipmobilesdk/rn-core';
+
+export interface AuthMessageMap {
+	// User-facing actions and states
+	'auth.action.continueGoogle': string;
+	'auth.action.continueApple': string;
+	'auth.action.continueFacebook': string;
+	'auth.state.signedOut': string;
+	'auth.state.authenticating': string;
+	'auth.state.signedIn': string;
+	'auth.state.signingOut': string;
+	// Access tier (user-facing)
+	'auth.tier.free': string;
+	'auth.tier.premium': string;
+	'auth.tier.unverified': string;
+	// User-actionable errors
+	'auth.error.cancelled': string;
+	'auth.error.sessionExpired': string;
+	'auth.error.entitlement': string;
+	'auth.error.network': string;
+	// Developer / tenant-configuration errors
+	'auth.error.configuration': string;
+	'auth.error.redirectMismatch': string;
+	'auth.error.token': string;
+	'auth.error.consentDenied': string;
+}
+
+export type AuthMessageKey = keyof AuthMessageMap;
+
+/**
+ * The catalog, as an rn-core message set: `user` copy may reach an end user,
+ * `developer` copy describes a tenant or configuration fault (UX-005). Register
+ * `authMessages.user` with rn-i18n to translate it like app copy.
+ */
+export const authMessages = defineMessages({
+	user: {
+		'auth.action.continueGoogle': 'Continue with Google',
+		'auth.action.continueApple': 'Continue with Apple',
+		'auth.action.continueFacebook': 'Continue with Facebook',
+		'auth.state.signedOut': 'Sign in to continue',
+		'auth.state.authenticating': 'Signing you in…',
+		'auth.state.signedIn': 'You are signed in',
+		'auth.state.signingOut': 'Signing out…',
+		'auth.tier.free': 'Free',
+		'auth.tier.premium': 'Premium',
+		'auth.tier.unverified': 'Membership could not be verified',
+		'auth.error.cancelled': 'Sign-in was cancelled. You can try again.',
+		'auth.error.sessionExpired': 'Your session expired. Please sign in again.',
+		'auth.error.entitlement': 'This feature requires a verified premium membership.',
+		'auth.error.network': 'No connection. Some features are limited until you reconnect.',
+	},
+	developer: {
+		'auth.error.configuration': 'Authentication is not configured correctly.',
+		'auth.error.redirectMismatch': 'The sign-in redirect does not match the app configuration.',
+		'auth.error.token': 'We could not complete the request. Please try again.',
+		'auth.error.consentDenied': 'Access to this resource was denied.',
+	},
+});
+
+export const DEFAULT_MESSAGES: AuthMessageMap = authMessages.defaults;
+
+/** Resolve a message, preferring app overrides over the English defaults. */
+export function resolveMessages(overrides?: Partial<AuthMessageMap>): AuthMessageMap {
+	return authMessages.resolve(overrides);
+}

package/src/index.ts

@@ -1,83 +1,72 @@
-/**
- * @chipmobilesdk/rn-auth — reusable Microsoft Entra External ID authentication
- * for ChipMobileSdk-family React Native apps (public OIDC/PKCE client, no
- * backend). This is the single public entrypoint (LIB-003); modules under
- * `core/`, `tokens/`, `oidc/`, `access/`, and `diagnostics/` are private.
- */
-
-import { createAuthMachine } from './core/authMachine';
-import type { Auth, AuthConfig, CreateAuthOptions } from './config/types';
-
-/** Create the auth controller. Throws AuthConfigError on invalid config (FR-005). */
-export function createAuth(config: AuthConfig, options?: CreateAuthOptions): Auth {
-	return createAuthMachine(config, options);
-}
-
-// Public types
-export type {
-	Auth,
-	AuthConfig,
-	CreateAuthOptions,
-	AuthState,
-	AuthStatus,
-	RestoreStatus,
-	Profile,
-	ProviderIdentity,
-	ProviderConfig,
-	ProviderId,
-	DevicePlatform,
-	ResourceConfig,
-	ClaimMatcher,
-	AccessTierMapping,
-	AccessTier,
-	AccessTokenResult,
-	AccessTokenStatus,
-	PremiumGateResult,
-	GlobalSignOutResult,
-} from './config/types';
-
-// Ports + default adapters
-export type { SecureTokenStore } from './tokens/secureStore';
-export { createKeychainSecureStore, AUTH_STORAGE_KEY } from './tokens/secureStore';
-export type {
-	OidcAuthClient,
-	OidcTokens,
-	AuthorizeParams,
-	RefreshParams,
-	EndSessionParams,
-} from './oidc/authClient';
-export { createAppAuthClient } from './oidc/authClient';
-
-// Access-tier evaluation (also exported for app-side reuse/testing)
-export { evaluateAccessTier, failClosedTier } from './access/accessTier';
-
-// Diagnostics
-export {
-	AuthError,
-	AuthConfigError,
-	isAuthError,
-	redact,
-} from './diagnostics/errors';
-export type { AuthErrorCode, AuthErrorAudience } from './diagnostics/errors';
-export {
-	DEFAULT_MESSAGES,
-	resolveMessages,
-} from './diagnostics/messageKeys';
-export type { AuthMessageMap, AuthMessageKey } from './diagnostics/messageKeys';
-
-// React bindings
-export { AuthProvider } from './react/AuthProvider';
-export type { AuthProviderProps } from './react/AuthProvider';
-export {
-	useAuth,
-	useProfile,
-	useAccessTier,
-	useAccessToken,
-	useSignInProvider,
-	useSignInProviders,
-} from './react/hooks';
-export type {
-	UseAuthResult,
-	UseAccessTokenResult,
-	UseAccessTokenStatus,
-} from './react/hooks';
+/**
+ * @chipmobilesdk/rn-auth — reusable Microsoft Entra External ID authentication
+ * for ChipMobileSdk-family React Native apps (public OIDC/PKCE client, no
+ * backend). This is the single public entrypoint (LIB-003); modules under
+ * `core/`, `tokens/`, `oidc/`, `access/`, and `diagnostics/` are private.
+ */
+
+import { createAuthMachine } from './core/authMachine';
+import type { Auth, AuthConfig, CreateAuthOptions } from './config/types';
+
+/** Create the auth controller. Throws AuthConfigError on invalid config (FR-005). */
+export function createAuth(config: AuthConfig, options?: CreateAuthOptions): Auth {
+	return createAuthMachine(config, options);
+}
+
+// Public types
+export type {
+	Auth,
+	AuthConfig,
+	CreateAuthOptions,
+	AuthState,
+	AuthStatus,
+	RestoreStatus,
+	Profile,
+	ProviderIdentity,
+	ProviderConfig,
+	ProviderId,
+	DevicePlatform,
+	ResourceConfig,
+	ClaimMatcher,
+	AccessTierMapping,
+	AccessTier,
+	AccessTokenResult,
+	AccessTokenStatus,
+	PremiumGateResult,
+	GlobalSignOutResult,
+} from './config/types';
+
+// Ports + default adapters
+export type { SecureTokenStore } from './tokens/secureStore';
+export { createKeychainSecureStore, AUTH_STORAGE_KEY } from './tokens/secureStore';
+export type {
+	OidcAuthClient,
+	OidcTokens,
+	AuthorizeParams,
+	RefreshParams,
+	EndSessionParams,
+} from './oidc/authClient';
+export { createAppAuthClient } from './oidc/authClient';
+
+// Access-tier evaluation (also exported for app-side reuse/testing)
+export { evaluateAccessTier, failClosedTier } from './access/accessTier';
+
+// Diagnostics
+export { AuthError, AuthConfigError, isAuthError, redact } from './diagnostics/errors';
+export type { AuthErrorCode, AuthErrorAudience } from './diagnostics/errors';
+export { DEFAULT_MESSAGES, authMessages, resolveMessages } from './diagnostics/messageKeys';
+export type { AuthMessageMap, AuthMessageKey } from './diagnostics/messageKeys';
+
+// React bindings
+export { AuthProvider } from './react/AuthProvider';
+export { useAuthSelector } from './react/hooks';
+export type { AuthProviderProps } from './react/AuthProvider';
+export {
+	useAuth,
+	useProfile,
+	useAccessTier,
+	useAccessToken,
+	useSignInProvider,
+	useSignInProviders,
+} from './react/hooks';
+export type { UseAuthResult, UseAccessTokenResult, UseAccessTokenStatus } from './react/hooks';

package/src/keychain.ts

@@ -0,0 +1,6 @@
+/**
+ * `@chipmobilesdk/rn-auth/keychain`: the default secure token store over
+ * react-native-keychain (AUTH-09). Its own entrypoint, so an app with its own
+ * secure storage never reaches this module.
+ */
+export { createKeychainSecureStore, type KeychainSecureStoreOptions } from './tokens/secureStore';