@chipmobilesdk/rn-auth 0.4.0 → 0.6.0

package/lib/commonjs/core/authMachine.js

@@ -0,0 +1,406 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.createAuthMachine = createAuthMachine;
+var _rnCore = require("@chipmobilesdk/rn-core");
+var _messageKeys = require("../diagnostics/messageKeys.js");
+var _validateConfig = require("../config/validateConfig.js");
+var _authClient = require("../oidc/authClient.js");
+var _socialRouting = require("../oidc/socialRouting.js");
+var _profile = require("./profile.js");
+var _accessTier = require("../access/accessTier.js");
+var _session = require("./session.js");
+var _secureStore = require("../tokens/secureStore.js");
+var _accessToken = require("../tokens/accessToken.js");
+var _errors = require("../diagnostics/errors.js");
+/**
+ * Auth state machine / orchestrator (FR-005, FR-022, R5, R7). Holds the single
+ * active session, wires the OidcAuthClient + SecureTokenStore ports, profile
+ * mapping, access-tier evaluation, per-resource tokens, restore, and sign-out.
+ *
+ * Every operation that starts or ends a session bumps `sessionEpoch`. Work that
+ * awaited across such a change — a token refresh, a restore, an authorize —
+ * compares the epoch it started with before writing anything back, so a sign-out
+ * can never be undone by a request that was already in flight.
+ */
+
+const SIGNED_OUT = {
+  status: 'signed-out',
+  profile: undefined,
+  accessTier: undefined,
+  restore: 'unavailable',
+  error: undefined
+};
+function createAuthMachine(config, options = {}) {
+  // Throws AuthConfigError before anything else (FR-005, US4 scenario 2).
+  (0, _validateConfig.validateConfig)(config);
+
+  // rn-core's one platform source (CORE-09). Outside Android and iOS (tests on
+  // Node, web) the providers are resolved as for iOS, as before.
+  const detected = (0, _rnCore.currentPlatform)();
+  const platform = options.platform ?? (detected === 'unsupported' ? 'ios' : detected);
+  const secureStore = config.secureStore;
+  const authClient = config.authClient ?? (0, _authClient.createAppAuthClient)();
+  const resources = config.resources ?? [];
+  // Declared since 0.1.0 and read by nothing until now (AUTH-15).
+  const messages = (0, _messageKeys.resolveMessages)(config.messages);
+  let state = Object.freeze({
+    status: 'loading',
+    restore: 'pending'
+  });
+  let refreshToken = null;
+  /** Kept for the end-session `id_token_hint`; without it a global sign-out is a no-op. */
+  let idToken = null;
+  let sessionEpoch = 0;
+  const listeners = (0, _rnCore.createListenerSet)();
+  /**
+   * Every Keychain write and delete, in order. A rotation persisted while a
+   * sign-out runs must not land after the sign-out's delete and resurrect the
+   * session on the next launch.
+   */
+  let storeQueue = Promise.resolve();
+  const enqueueStoreOp = op => {
+    const next = storeQueue.then(op);
+    // The queue itself never rejects, so one failed write does not poison the
+    // writes after it; the caller still sees its own failure through `next`.
+    storeQueue = next.catch(() => undefined);
+    return next;
+  };
+
+  /** The artifact as last written or read, so an identical write is skipped. */
+  let storedSession = null;
+  const writeSession = (session, epoch) => enqueueStoreOp(async () => {
+    if (epoch !== sessionEpoch) {
+      return; // The session this belonged to has already ended.
+    }
+    const artifact = {
+      refreshToken: session.refreshToken,
+      profile: (0, _session.storedProfileFrom)(session.profile),
+      idToken: session.idToken
+    };
+    // A restore that rotated nothing used to write the Keychain again on
+    // every launch, on the startup path (AUTH-23).
+    if (storedSession && (0, _session.sameSession)(storedSession, artifact)) {
+      return;
+    }
+    await secureStore.setItem(_secureStore.AUTH_STORAGE_KEY, JSON.stringify(artifact));
+    storedSession = artifact;
+  });
+  const tokenManager = (0, _accessToken.createAccessTokenManager)({
+    authority: config.authority,
+    clientId: config.clientId,
+    redirectUrl: config.redirectUrl,
+    resources,
+    authClient,
+    getRefreshToken: () => refreshToken,
+    sessionEpoch: () => sessionEpoch,
+    async onRefreshTokenRotated(token, epoch) {
+      if (epoch !== sessionEpoch) {
+        return;
+      }
+      // Live immediately whatever happens to the write: the provider may
+      // already have retired the old token, so memory must not keep using it.
+      refreshToken = token;
+      if (!state.profile) {
+        return;
+      }
+      try {
+        await writeSession({
+          refreshToken: token,
+          profile: state.profile,
+          idToken: idToken ?? undefined
+        }, epoch);
+      } catch {
+        // The session stays usable in memory. The stored artifact keeps the
+        // previous token until the next successful write; a restart before
+        // then restores through it if the provider still accepts it, and
+        // otherwise lands on sign-in — never on a corrupted state.
+      }
+    }
+  });
+
+  /**
+   * The current snapshot, the same object until the state changes, so React reads
+   * it through `useSyncExternalStore` without re-rendering for nothing (PERF-02).
+   * Frozen: a consumer cannot change the machine's state by mutating it.
+   */
+  function getState() {
+    return state;
+  }
+  function setState(patch) {
+    const next = {
+      ...state,
+      ...patch
+    };
+    // No change, no new snapshot and no notification.
+    if ((0, _rnCore.shallowEqual)(state, next)) return;
+    state = Object.freeze(next);
+    if (patch.error) {
+      // The code and audience only; `detail` is already redacted but stays local.
+      channel.emit(patch.error.code, patch.error.audience === 'user' ? 'info' : 'warn', {
+        status: state.status,
+        retryable: patch.error.retryable
+      });
+    }
+    // Isolated: a subscriber that throws neither stops the others nor turns a
+    // completed sign-in into an error; rn-core reports it instead (CORE-03).
+    listeners.notify(getState());
+  }
+
+  /** Ends the local session: memory, cached access tokens, and the stored artifact. */
+  async function clearPersisted() {
+    sessionEpoch += 1;
+    refreshToken = null;
+    idToken = null;
+    storedSession = null;
+    tokenManager.clear();
+    await enqueueStoreOp(() => secureStore.removeItem(_secureStore.AUTH_STORAGE_KEY));
+  }
+  return {
+    getState,
+    subscribe: listener => listeners.add(listener),
+    async restore() {
+      sessionEpoch += 1;
+      const epoch = sessionEpoch;
+      setState({
+        status: 'loading',
+        restore: 'pending',
+        error: undefined
+      });
+      let result;
+      try {
+        result = await (0, _session.restoreSession)({
+          secureStore,
+          authority: config.authority,
+          clientId: config.clientId,
+          redirectUrl: config.redirectUrl,
+          scopes: config.scopes,
+          authClient,
+          mapping: config.accessTierMapping
+        });
+      } catch (error) {
+        // The store could not be read. Nothing is known, nothing is deleted.
+        if (epoch === sessionEpoch) {
+          setState({
+            ...SIGNED_OUT,
+            status: 'error',
+            error: (0, _errors.toAuthError)(error)
+          });
+        }
+        return getState();
+      }
+      if (epoch !== sessionEpoch) {
+        // A sign-in or sign-out ran meanwhile; its outcome stands.
+        return getState();
+      }
+      storedSession = result.persisted ?? null;
+      if (result.outcome === 'restored' && result.profile && result.refreshToken) {
+        refreshToken = result.refreshToken;
+        idToken = result.idToken ?? null;
+        try {
+          await writeSession({
+            refreshToken: result.refreshToken,
+            profile: result.profile,
+            idToken: result.idToken
+          }, epoch);
+        } catch {
+          // The refresh succeeded, so the user is signed in for this run. Only
+          // the next launch is affected, and it falls back to sign-in.
+        }
+        if (epoch !== sessionEpoch) {
+          return getState();
+        }
+        setState({
+          status: 'authenticated',
+          profile: result.profile,
+          accessTier: result.accessTier,
+          restore: 'restored',
+          error: undefined
+        });
+      } else if (result.outcome === 'offline' && result.profile) {
+        refreshToken = result.refreshToken ?? null;
+        idToken = result.idToken ?? null;
+        setState({
+          status: 'authenticated',
+          profile: result.profile,
+          accessTier: result.accessTier ?? (0, _accessTier.failClosedTier)(),
+          restore: 'offline',
+          error: undefined
+        });
+      } else {
+        await clearPersisted();
+        setState(SIGNED_OUT);
+      }
+      return getState();
+    },
+    async signIn(providerId) {
+      sessionEpoch += 1;
+      const epoch = sessionEpoch;
+      setState({
+        status: 'authenticating',
+        error: undefined
+      });
+      let provider;
+      try {
+        provider = (0, _socialRouting.resolveProvider)(config, providerId, platform);
+      } catch (error) {
+        setState({
+          status: 'error',
+          error: (0, _errors.toAuthError)(error, 'configuration-error', 'auth.error.configuration')
+        });
+        return getState();
+      }
+      try {
+        const tokens = await authClient.authorize({
+          authority: config.authority,
+          clientId: config.clientId,
+          redirectUrl: config.redirectUrl,
+          scopes: config.scopes,
+          additionalParameters: (0, _socialRouting.buildAdditionalParameters)(provider)
+        });
+        if (epoch !== sessionEpoch) {
+          return getState();
+        }
+        if (!tokens.refreshToken) {
+          // `offline_access` is required by configuration, so its absence is the
+          // tenant's doing. Signing in anyway would give a session that silently
+          // never survives a restart.
+          setState({
+            status: 'error',
+            error: new _errors.AuthError({
+              code: 'configuration-error',
+              messageKey: 'auth.error.configuration',
+              audience: 'developer',
+              detail: 'authorize returned no refresh token; check that the app registration grants offline_access'
+            })
+          });
+          return getState();
+        }
+        const profile = (0, _profile.mapClaimsToProfile)(tokens.claims, providerId);
+        const accessTier = (0, _accessTier.evaluateAccessTier)(tokens.claims, config.accessTierMapping);
+        // Written first, committed to memory second: a failed write leaves no
+        // half-signed-in session holding a refresh token that was never stored.
+        await writeSession({
+          refreshToken: tokens.refreshToken,
+          profile,
+          idToken: tokens.idToken
+        }, epoch);
+        if (epoch !== sessionEpoch) {
+          return getState();
+        }
+        // Single active account: a new sign-in replaces any prior session.
+        refreshToken = tokens.refreshToken;
+        idToken = tokens.idToken ?? null;
+        tokenManager.clear();
+        setState({
+          status: 'authenticated',
+          profile,
+          accessTier,
+          restore: 'restored',
+          error: undefined
+        });
+      } catch (error) {
+        if (epoch !== sessionEpoch) {
+          return getState();
+        }
+        const authError = (0, _errors.toAuthError)(error);
+        if (authError.code === 'provider-cancelled') {
+          setState({
+            status: 'cancelled',
+            error: authError
+          });
+        } else {
+          setState({
+            status: 'error',
+            error: authError
+          });
+        }
+      }
+      return getState();
+    },
+    async signOut() {
+      await clearPersisted();
+      setState(SIGNED_OUT);
+    },
+    async signOutGlobal() {
+      let result = {
+        global: 'ended'
+      };
+      try {
+        await authClient.endSession({
+          authority: config.authority,
+          clientId: config.clientId,
+          redirectUrl: config.redirectUrl,
+          idToken: idToken ?? undefined
+        });
+      } catch (error) {
+        // Reported, not swallowed: the tenant session may still be alive. It
+        // still must not block clearing local state.
+        result = {
+          global: 'failed',
+          error: (0, _errors.toAuthError)(error)
+        };
+      }
+      await clearPersisted();
+      setState(SIGNED_OUT);
+      return result;
+    },
+    async requestAccessToken(resourceKey, tokenOptions) {
+      const epoch = sessionEpoch;
+      // Only a real network refresh is a `token-refreshing` phase; a cache hit
+      // would otherwise flash every subscriber twice for nothing.
+      const refreshing = state.status === 'authenticated' && (tokenOptions?.forceRefresh === true || !tokenManager.hasFreshToken(resourceKey));
+      if (refreshing) {
+        setState({
+          status: 'token-refreshing'
+        });
+      }
+      const result = await tokenManager.request(resourceKey, tokenOptions);
+      // Restored only if nothing else moved the session meanwhile: a sign-out
+      // during the refresh used to be overwritten back to `authenticated`.
+      if (refreshing && epoch === sessionEpoch && state.status === 'token-refreshing') {
+        setState({
+          status: 'authenticated'
+        });
+      }
+      return result;
+    },
+    getAccessTier() {
+      return state.accessTier ?? (0, _accessTier.failClosedTier)();
+    },
+    canAccessPremium() {
+      const tier = state.accessTier ?? (0, _accessTier.failClosedTier)();
+      return {
+        allowed: tier.tier === 'premium' && tier.verification === 'verified',
+        tier
+      };
+    },
+    requirePremium() {
+      const tier = state.accessTier ?? (0, _accessTier.failClosedTier)();
+      const allowed = tier.tier === 'premium' && tier.verification === 'verified';
+      if (!allowed) {
+        setState({
+          status: 'access-denied'
+        });
+      }
+      return {
+        allowed,
+        tier
+      };
+    },
+    getMessages() {
+      return messages;
+    },
+    getPlatformProvider() {
+      return (0, _socialRouting.defaultProviderForPlatform)(config, platform);
+    },
+    getPlatformProviders() {
+      return (0, _socialRouting.availableProvidersForPlatform)(config, platform);
+    }
+  };
+}
+/** Every error the machine lands in also goes to the app's SDK sinks (CORE-08). */
+const channel = (0, _rnCore.createDiagnosticChannel)('rn-auth');
+//# sourceMappingURL=authMachine.js.map

package/lib/commonjs/core/authMachine.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_rnCore","require","_messageKeys","_validateConfig","_authClient","_socialRouting","_profile","_accessTier","_session","_secureStore","_accessToken","_errors","SIGNED_OUT","status","profile","undefined","accessTier","restore","error","createAuthMachine","config","options","validateConfig","detected","currentPlatform","platform","secureStore","authClient","createAppAuthClient","resources","messages","resolveMessages","state","Object","freeze","refreshToken","idToken","sessionEpoch","listeners","createListenerSet","storeQueue","Promise","resolve","enqueueStoreOp","op","next","then","catch","storedSession","writeSession","session","epoch","artifact","storedProfileFrom","sameSession","setItem","AUTH_STORAGE_KEY","JSON","stringify","tokenManager","createAccessTokenManager","authority","clientId","redirectUrl","getRefreshToken","onRefreshTokenRotated","token","getState","setState","patch","shallowEqual","channel","emit","code","audience","retryable","notify","clearPersisted","clear","removeItem","subscribe","listener","add","result","restoreSession","scopes","mapping","accessTierMapping","toAuthError","persisted","outcome","failClosedTier","signIn","providerId","provider","resolveProvider","tokens","authorize","additionalParameters","buildAdditionalParameters","AuthError","messageKey","detail","mapClaimsToProfile","claims","evaluateAccessTier","authError","signOut","signOutGlobal","global","endSession","requestAccessToken","resourceKey","tokenOptions","refreshing","forceRefresh","hasFreshToken","request","getAccessTier","canAccessPremium","tier","allowed","verification","requirePremium","getMessages","getPlatformProvider","defaultProviderForPlatform","getPlatformProviders","availableProvidersForPlatform","createDiagnosticChannel"],"sourceRoot":"../../../src","sources":["core/authMachine.ts"],"mappings":";;;;;;AAWA,IAAAA,OAAA,GAAAC,OAAA;AAQA,IAAAC,YAAA,GAAAD,OAAA;AAYA,IAAAE,eAAA,GAAAF,OAAA;AACA,IAAAG,WAAA,GAAAH,OAAA;AACA,IAAAI,cAAA,GAAAJ,OAAA;AAMA,IAAAK,QAAA,GAAAL,OAAA;AACA,IAAAM,WAAA,GAAAN,OAAA;AACA,IAAAO,QAAA,GAAAP,OAAA;AACA,IAAAQ,YAAA,GAAAR,OAAA;AACA,IAAAS,YAAA,GAAAT,OAAA;AACA,IAAAU,OAAA,GAAAV,OAAA;AA5CA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAqCA,MAAMW,UAA8B,GAAG;EACtCC,MAAM,EAAE,YAAY;EACpBC,OAAO,EAAEC,SAAS;EAClBC,UAAU,EAAED,SAAS;EACrBE,OAAO,EAAE,aAAa;EACtBC,KAAK,EAAEH;AACR,CAAC;AAEM,SAASI,iBAAiBA,CAACC,MAAkB,EAAEC,OAA0B,GAAG,CAAC,CAAC,EAAQ;EAC5F;EACA,IAAAC,8BAAc,EAACF,MAAM,CAAC;;EAEtB;EACA;EACA,MAAMG,QAAQ,GAAG,IAAAC,uBAAe,EAAC,CAAC;EAClC,MAAMC,QAAwB,GAC7BJ,OAAO,CAACI,QAAQ,KAAKF,QAAQ,KAAK,aAAa,GAAG,KAAK,GAAGA,QAAQ,CAAC;EACpE,MAAMG,WAAW,GAAGN,MAAM,CAACM,WAAW;EACtC,MAAMC,UAAU,GAAGP,MAAM,CAACO,UAAU,IAAI,IAAAC,+BAAmB,EAAC,CAAC;EAC7D,MAAMC,SAAS,GAAGT,MAAM,CAACS,SAAS,IAAI,EAAE;EACxC;EACA,MAAMC,QAAQ,GAAG,IAAAC,4BAAe,EAACX,MAAM,CAACU,QAAQ,CAAC;EAEjD,IAAIE,KAAgB,GAAGC,MAAM,CAACC,MAAM,CAAC;IAAErB,MAAM,EAAE,SAAS;IAAEI,OAAO,EAAE;EAAU,CAAC,CAAC;EAC/E,IAAIkB,YAA2B,GAAG,IAAI;EACtC;EACA,IAAIC,OAAsB,GAAG,IAAI;EACjC,IAAIC,YAAY,GAAG,CAAC;EACpB,MAAMC,SAAS,GAAG,IAAAC,yBAAiB,EAAc,CAAC;EAClD;AACD;AACA;AACA;AACA;EACC,IAAIC,UAAyB,GAAGC,OAAO,CAACC,OAAO,CAAC,CAAC;EAEjD,MAAMC,cAAc,GAAIC,EAAuB,IAAoB;IAClE,MAAMC,IAAI,GAAGL,UAAU,CAACM,IAAI,CAACF,EAAE,CAAC;IAChC;IACA;IACAJ,UAAU,GAAGK,IAAI,CAACE,KAAK,CAAC,MAAMhC,SAAS,CAAC;IACxC,OAAO8B,IAAI;EACZ,CAAC;;EAED;EACA,IAAIG,aAAsC,GAAG,IAAI;EAEjD,MAAMC,YAAY,GAAGA,CACpBC,OAAiF,EACjFC,KAAa,KAEbR,cAAc,CAAC,YAAY;IAC1B,IAAIQ,KAAK,KAAKd,YAAY,EAAE;MAC3B,OAAO,CAAC;IACT;IACA,MAAMe,QAA0B,GAAG;MAClCjB,YAAY,EAAEe,OAAO,CAACf,YAAY;MAClCrB,OAAO,EAAE,IAAAuC,0BAAiB,EAACH,OAAO,CAACpC,OAAO,CAAC;MAC3CsB,OAAO,EAAEc,OAAO,CAACd;IAClB,CAAC;IACD;IACA;IACA,IAAIY,aAAa,IAAI,IAAAM,oBAAW,EAACN,aAAa,EAAEI,QAAQ,CAAC,EAAE;MAC1D;IACD;IACA,MAAM1B,WAAW,CAAC6B,OAAO,CAACC,6BAAgB,EAAEC,IAAI,CAACC,SAAS,CAACN,QAAQ,CAAC,CAAC;IACrEJ,aAAa,GAAGI,QAAQ;EACzB,CAAC,CAAC;EAEH,MAAMO,YAAY,GAAG,IAAAC,qCAAwB,EAAC;IAC7CC,SAAS,EAAEzC,MAAM,CAACyC,SAAS;IAC3BC,QAAQ,EAAE1C,MAAM,CAAC0C,QAAQ;IACzBC,WAAW,EAAE3C,MAAM,CAAC2C,WAAW;IAC/BlC,SAAS;IACTF,UAAU;IACVqC,eAAe,EAAEA,CAAA,KAAM7B,YAAY;IACnCE,YAAY,EAAEA,CAAA,KAAMA,YAAY;IAChC,MAAM4B,qBAAqBA,CAACC,KAAK,EAAEf,KAAK,EAAE;MACzC,IAAIA,KAAK,KAAKd,YAAY,EAAE;QAC3B;MACD;MACA;MACA;MACAF,YAAY,GAAG+B,KAAK;MACpB,IAAI,CAAClC,KAAK,CAAClB,OAAO,EAAE;QACnB;MACD;MACA,IAAI;QACH,MAAMmC,YAAY,CACjB;UAAEd,YAAY,EAAE+B,KAAK;UAAEpD,OAAO,EAAEkB,KAAK,CAAClB,OAAO;UAAEsB,OAAO,EAAEA,OAAO,IAAIrB;QAAU,CAAC,EAC9EoC,KACD,CAAC;MACF,CAAC,CAAC,MAAM;QACP;QACA;QACA;QACA;MAAA;IAEF;EACD,CAAC,CAAC;;EAEF;AACD;AACA;AACA;AACA;EACC,SAASgB,QAAQA,CAAA,EAAc;IAC9B,OAAOnC,KAAK;EACb;EAEA,SAASoC,QAAQA,CAACC,KAAyB,EAAQ;IAClD,MAAMxB,IAAI,GAAG;MAAE,GAAGb,KAAK;MAAE,GAAGqC;IAAM,CAAC;IACnC;IACA,IAAI,IAAAC,oBAAY,EAACtC,KAAK,EAAEa,IAAI,CAAC,EAAE;IAC/Bb,KAAK,GAAGC,MAAM,CAACC,MAAM,CAACW,IAAI,CAAC;IAC3B,IAAIwB,KAAK,CAACnD,KAAK,EAAE;MAChB;MACAqD,OAAO,CAACC,IAAI,CAACH,KAAK,CAACnD,KAAK,CAACuD,IAAI,EAAEJ,KAAK,CAACnD,KAAK,CAACwD,QAAQ,KAAK,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE;QACjF7D,MAAM,EAAEmB,KAAK,CAACnB,MAAM;QACpB8D,SAAS,EAAEN,KAAK,CAACnD,KAAK,CAACyD;MACxB,CAAC,CAAC;IACH;IACA;IACA;IACArC,SAAS,CAACsC,MAAM,CAACT,QAAQ,CAAC,CAAC,CAAC;EAC7B;;EAEA;EACA,eAAeU,cAAcA,CAAA,EAAkB;IAC9CxC,YAAY,IAAI,CAAC;IACjBF,YAAY,GAAG,IAAI;IACnBC,OAAO,GAAG,IAAI;IACdY,aAAa,GAAG,IAAI;IACpBW,YAAY,CAACmB,KAAK,CAAC,CAAC;IACpB,MAAMnC,cAAc,CAAC,MAAMjB,WAAW,CAACqD,UAAU,CAACvB,6BAAgB,CAAC,CAAC;EACrE;EAEA,OAAO;IACNW,QAAQ;IAERa,SAAS,EAAEC,QAAQ,IAAI3C,SAAS,CAAC4C,GAAG,CAACD,QAAQ,CAAC;IAE9C,MAAMhE,OAAOA,CAAA,EAAG;MACfoB,YAAY,IAAI,CAAC;MACjB,MAAMc,KAAK,GAAGd,YAAY;MAC1B+B,QAAQ,CAAC;QAAEvD,MAAM,EAAE,SAAS;QAAEI,OAAO,EAAE,SAAS;QAAEC,KAAK,EAAEH;MAAU,CAAC,CAAC;MAErE,IAAIoE,MAAM;MACV,IAAI;QACHA,MAAM,GAAG,MAAM,IAAAC,uBAAc,EAAC;UAC7B1D,WAAW;UACXmC,SAAS,EAAEzC,MAAM,CAACyC,SAAS;UAC3BC,QAAQ,EAAE1C,MAAM,CAAC0C,QAAQ;UACzBC,WAAW,EAAE3C,MAAM,CAAC2C,WAAW;UAC/BsB,MAAM,EAAEjE,MAAM,CAACiE,MAAM;UACrB1D,UAAU;UACV2D,OAAO,EAAElE,MAAM,CAACmE;QACjB,CAAC,CAAC;MACH,CAAC,CAAC,OAAOrE,KAAK,EAAE;QACf;QACA,IAAIiC,KAAK,KAAKd,YAAY,EAAE;UAC3B+B,QAAQ,CAAC;YAAE,GAAGxD,UAAU;YAAEC,MAAM,EAAE,OAAO;YAAEK,KAAK,EAAE,IAAAsE,mBAAW,EAACtE,KAAK;UAAE,CAAC,CAAC;QACxE;QACA,OAAOiD,QAAQ,CAAC,CAAC;MAClB;MAEA,IAAIhB,KAAK,KAAKd,YAAY,EAAE;QAC3B;QACA,OAAO8B,QAAQ,CAAC,CAAC;MAClB;MAEAnB,aAAa,GAAGmC,MAAM,CAACM,SAAS,IAAI,IAAI;MAExC,IAAIN,MAAM,CAACO,OAAO,KAAK,UAAU,IAAIP,MAAM,CAACrE,OAAO,IAAIqE,MAAM,CAAChD,YAAY,EAAE;QAC3EA,YAAY,GAAGgD,MAAM,CAAChD,YAAY;QAClCC,OAAO,GAAG+C,MAAM,CAAC/C,OAAO,IAAI,IAAI;QAChC,IAAI;UACH,MAAMa,YAAY,CACjB;YAAEd,YAAY,EAAEgD,MAAM,CAAChD,YAAY;YAAErB,OAAO,EAAEqE,MAAM,CAACrE,OAAO;YAAEsB,OAAO,EAAE+C,MAAM,CAAC/C;UAAQ,CAAC,EACvFe,KACD,CAAC;QACF,CAAC,CAAC,MAAM;UACP;UACA;QAAA;QAED,IAAIA,KAAK,KAAKd,YAAY,EAAE;UAC3B,OAAO8B,QAAQ,CAAC,CAAC;QAClB;QACAC,QAAQ,CAAC;UACRvD,MAAM,EAAE,eAAe;UACvBC,OAAO,EAAEqE,MAAM,CAACrE,OAAO;UACvBE,UAAU,EAAEmE,MAAM,CAACnE,UAAU;UAC7BC,OAAO,EAAE,UAAU;UACnBC,KAAK,EAAEH;QACR,CAAC,CAAC;MACH,CAAC,MAAM,IAAIoE,MAAM,CAACO,OAAO,KAAK,SAAS,IAAIP,MAAM,CAACrE,OAAO,EAAE;QAC1DqB,YAAY,GAAGgD,MAAM,CAAChD,YAAY,IAAI,IAAI;QAC1CC,OAAO,GAAG+C,MAAM,CAAC/C,OAAO,IAAI,IAAI;QAChCgC,QAAQ,CAAC;UACRvD,MAAM,EAAE,eAAe;UACvBC,OAAO,EAAEqE,MAAM,CAACrE,OAAO;UACvBE,UAAU,EAAEmE,MAAM,CAACnE,UAAU,IAAI,IAAA2E,0BAAc,EAAC,CAAC;UACjD1E,OAAO,EAAE,SAAS;UAClBC,KAAK,EAAEH;QACR,CAAC,CAAC;MACH,CAAC,MAAM;QACN,MAAM8D,cAAc,CAAC,CAAC;QACtBT,QAAQ,CAACxD,UAAU,CAAC;MACrB;MACA,OAAOuD,QAAQ,CAAC,CAAC;IAClB,CAAC;IAED,MAAMyB,MAAMA,CAACC,UAAsB,EAAE;MACpCxD,YAAY,IAAI,CAAC;MACjB,MAAMc,KAAK,GAAGd,YAAY;MAC1B+B,QAAQ,CAAC;QAAEvD,MAAM,EAAE,gBAAgB;QAAEK,KAAK,EAAEH;MAAU,CAAC,CAAC;MACxD,IAAI+E,QAAQ;MACZ,IAAI;QACHA,QAAQ,GAAG,IAAAC,8BAAe,EAAC3E,MAAM,EAAEyE,UAAU,EAAEpE,QAAQ,CAAC;MACzD,CAAC,CAAC,OAAOP,KAAK,EAAE;QACfkD,QAAQ,CAAC;UACRvD,MAAM,EAAE,OAAO;UACfK,KAAK,EAAE,IAAAsE,mBAAW,EAACtE,KAAK,EAAE,qBAAqB,EAAE,0BAA0B;QAC5E,CAAC,CAAC;QACF,OAAOiD,QAAQ,CAAC,CAAC;MAClB;MAEA,IAAI;QACH,MAAM6B,MAAM,GAAG,MAAMrE,UAAU,CAACsE,SAAS,CAAC;UACzCpC,SAAS,EAAEzC,MAAM,CAACyC,SAAS;UAC3BC,QAAQ,EAAE1C,MAAM,CAAC0C,QAAQ;UACzBC,WAAW,EAAE3C,MAAM,CAAC2C,WAAW;UAC/BsB,MAAM,EAAEjE,MAAM,CAACiE,MAAM;UACrBa,oBAAoB,EAAE,IAAAC,wCAAyB,EAACL,QAAQ;QACzD,CAAC,CAAC;QACF,IAAI3C,KAAK,KAAKd,YAAY,EAAE;UAC3B,OAAO8B,QAAQ,CAAC,CAAC;QAClB;QACA,IAAI,CAAC6B,MAAM,CAAC7D,YAAY,EAAE;UACzB;UACA;UACA;UACAiC,QAAQ,CAAC;YACRvD,MAAM,EAAE,OAAO;YACfK,KAAK,EAAE,IAAIkF,iBAAS,CAAC;cACpB3B,IAAI,EAAE,qBAAqB;cAC3B4B,UAAU,EAAE,0BAA0B;cACtC3B,QAAQ,EAAE,WAAW;cACrB4B,MAAM,EACL;YACF,CAAC;UACF,CAAC,CAAC;UACF,OAAOnC,QAAQ,CAAC,CAAC;QAClB;QACA,MAAMrD,OAAO,GAAG,IAAAyF,2BAAkB,EAACP,MAAM,CAACQ,MAAM,EAAEX,UAAU,CAAC;QAC7D,MAAM7E,UAAU,GAAG,IAAAyF,8BAAkB,EAACT,MAAM,CAACQ,MAAM,EAAEpF,MAAM,CAACmE,iBAAiB,CAAC;QAC9E;QACA;QACA,MAAMtC,YAAY,CACjB;UAAEd,YAAY,EAAE6D,MAAM,CAAC7D,YAAY;UAAErB,OAAO;UAAEsB,OAAO,EAAE4D,MAAM,CAAC5D;QAAQ,CAAC,EACvEe,KACD,CAAC;QACD,IAAIA,KAAK,KAAKd,YAAY,EAAE;UAC3B,OAAO8B,QAAQ,CAAC,CAAC;QAClB;QACA;QACAhC,YAAY,GAAG6D,MAAM,CAAC7D,YAAY;QAClCC,OAAO,GAAG4D,MAAM,CAAC5D,OAAO,IAAI,IAAI;QAChCuB,YAAY,CAACmB,KAAK,CAAC,CAAC;QACpBV,QAAQ,CAAC;UACRvD,MAAM,EAAE,eAAe;UACvBC,OAAO;UACPE,UAAU;UACVC,OAAO,EAAE,UAAU;UACnBC,KAAK,EAAEH;QACR,CAAC,CAAC;MACH,CAAC,CAAC,OAAOG,KAAK,EAAE;QACf,IAAIiC,KAAK,KAAKd,YAAY,EAAE;UAC3B,OAAO8B,QAAQ,CAAC,CAAC;QAClB;QACA,MAAMuC,SAAS,GAAG,IAAAlB,mBAAW,EAACtE,KAAK,CAAC;QACpC,IAAIwF,SAAS,CAACjC,IAAI,KAAK,oBAAoB,EAAE;UAC5CL,QAAQ,CAAC;YAAEvD,MAAM,EAAE,WAAW;YAAEK,KAAK,EAAEwF;UAAU,CAAC,CAAC;QACpD,CAAC,MAAM;UACNtC,QAAQ,CAAC;YAAEvD,MAAM,EAAE,OAAO;YAAEK,KAAK,EAAEwF;UAAU,CAAC,CAAC;QAChD;MACD;MACA,OAAOvC,QAAQ,CAAC,CAAC;IAClB,CAAC;IAED,MAAMwC,OAAOA,CAAA,EAAG;MACf,MAAM9B,cAAc,CAAC,CAAC;MACtBT,QAAQ,CAACxD,UAAU,CAAC;IACrB,CAAC;IAED,MAAMgG,aAAaA,CAAA,EAAiC;MACnD,IAAIzB,MAA2B,GAAG;QAAE0B,MAAM,EAAE;MAAQ,CAAC;MACrD,IAAI;QACH,MAAMlF,UAAU,CAACmF,UAAU,CAAC;UAC3BjD,SAAS,EAAEzC,MAAM,CAACyC,SAAS;UAC3BC,QAAQ,EAAE1C,MAAM,CAAC0C,QAAQ;UACzBC,WAAW,EAAE3C,MAAM,CAAC2C,WAAW;UAC/B3B,OAAO,EAAEA,OAAO,IAAIrB;QACrB,CAAC,CAAC;MACH,CAAC,CAAC,OAAOG,KAAK,EAAE;QACf;QACA;QACAiE,MAAM,GAAG;UAAE0B,MAAM,EAAE,QAAQ;UAAE3F,KAAK,EAAE,IAAAsE,mBAAW,EAACtE,KAAK;QAAE,CAAC;MACzD;MACA,MAAM2D,cAAc,CAAC,CAAC;MACtBT,QAAQ,CAACxD,UAAU,CAAC;MACpB,OAAOuE,MAAM;IACd,CAAC;IAED,MAAM4B,kBAAkBA,CAACC,WAAW,EAAEC,YAAY,EAAE;MACnD,MAAM9D,KAAK,GAAGd,YAAY;MAC1B;MACA;MACA,MAAM6E,UAAU,GACflF,KAAK,CAACnB,MAAM,KAAK,eAAe,KAC/BoG,YAAY,EAAEE,YAAY,KAAK,IAAI,IAAI,CAACxD,YAAY,CAACyD,aAAa,CAACJ,WAAW,CAAC,CAAC;MAClF,IAAIE,UAAU,EAAE;QACf9C,QAAQ,CAAC;UAAEvD,MAAM,EAAE;QAAmB,CAAC,CAAC;MACzC;MACA,MAAMsE,MAAM,GAAG,MAAMxB,YAAY,CAAC0D,OAAO,CAACL,WAAW,EAAEC,YAAY,CAAC;MACpE;MACA;MACA,IAAIC,UAAU,IAAI/D,KAAK,KAAKd,YAAY,IAAIL,KAAK,CAACnB,MAAM,KAAK,kBAAkB,EAAE;QAChFuD,QAAQ,CAAC;UAAEvD,MAAM,EAAE;QAAgB,CAAC,CAAC;MACtC;MACA,OAAOsE,MAAM;IACd,CAAC;IAEDmC,aAAaA,CAAA,EAAG;MACf,OAAOtF,KAAK,CAAChB,UAAU,IAAI,IAAA2E,0BAAc,EAAC,CAAC;IAC5C,CAAC;IAED4B,gBAAgBA,CAAA,EAAsB;MACrC,MAAMC,IAAI,GAAGxF,KAAK,CAAChB,UAAU,IAAI,IAAA2E,0BAAc,EAAC,CAAC;MACjD,OAAO;QAAE8B,OAAO,EAAED,IAAI,CAACA,IAAI,KAAK,SAAS,IAAIA,IAAI,CAACE,YAAY,KAAK,UAAU;QAAEF;MAAK,CAAC;IACtF,CAAC;IAEDG,cAAcA,CAAA,EAAsB;MACnC,MAAMH,IAAI,GAAGxF,KAAK,CAAChB,UAAU,IAAI,IAAA2E,0BAAc,EAAC,CAAC;MACjD,MAAM8B,OAAO,GAAGD,IAAI,CAACA,IAAI,KAAK,SAAS,IAAIA,IAAI,CAACE,YAAY,KAAK,UAAU;MAC3E,IAAI,CAACD,OAAO,EAAE;QACbrD,QAAQ,CAAC;UAAEvD,MAAM,EAAE;QAAgB,CAAC,CAAC;MACtC;MACA,OAAO;QAAE4G,OAAO;QAAED;MAAK,CAAC;IACzB,CAAC;IAEDI,WAAWA,CAAA,EAAmB;MAC7B,OAAO9F,QAAQ;IAChB,CAAC;IAED+F,mBAAmBA,CAAA,EAAG;MACrB,OAAO,IAAAC,yCAA0B,EAAC1G,MAAM,EAAEK,QAAQ,CAAC;IACpD,CAAC;IAEDsG,oBAAoBA,CAAA,EAAG;MACtB,OAAO,IAAAC,4CAA6B,EAAC5G,MAAM,EAAEK,QAAQ,CAAC;IACvD;EACD,CAAC;AACF;AAGA;AACA,MAAM8C,OAAO,GAAG,IAAA0D,+BAAuB,EAAgB,SAAS,CAAC","ignoreList":[]}

package/lib/commonjs/core/profile.js

@@ -0,0 +1,59 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.describeProviderIdentity = describeProviderIdentity;
+exports.mapClaimsToProfile = mapClaimsToProfile;
+/**
+ * Claims → Profile mapping (FR-006). Tolerant of Apple private-relay emails and
+ * missing display name / given name (edge cases).
+ */
+
+function asString(value) {
+  return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+function looksLikeEmail(value) {
+  return !!value && /.+@.+\..+/.test(value);
+}
+
+/** Map id-token claims to the app-visible Profile. */
+function mapClaimsToProfile(claims, providerId) {
+  const tenantUserId = asString(claims.oid) ?? asString(claims.sub) ?? asString(claims.unique_name) ?? 'unknown';
+  const givenName = asString(claims.given_name);
+  const familyName = asString(claims.family_name);
+  const composedName = [givenName, familyName].filter(Boolean).join(' ') || undefined;
+  const displayName = asString(claims.name) ?? composedName;
+  const preferred = asString(claims.preferred_username);
+  const email = asString(claims.email) ?? (looksLikeEmail(preferred) ? preferred : undefined);
+  const provider = providerId ?? asString(claims.idp) ?? asString(claims.identityProvider) ?? 'unknown';
+  return {
+    tenantUserId,
+    displayName,
+    email,
+    provider,
+    claims
+  };
+}
+
+/**
+ * Describe the external provider identity behind the profile (FR-004 edge
+ * cases). `emailBehavior` is what a screen needs to explain an address the user
+ * did not choose: Apple's private relay forwards mail and is not the address
+ * they type anywhere else.
+ */
+function describeProviderIdentity(claims, providerId) {
+  const provider = providerId ?? asString(claims.idp) ?? 'unknown';
+  const subject = asString(claims.sub) ?? asString(claims.oid) ?? 'unknown';
+  const email = asString(claims.email);
+  let emailBehavior = 'none';
+  if (email) {
+    emailBehavior = email.endsWith('@privaterelay.appleid.com') ? 'private-relay' : 'direct';
+  }
+  return {
+    provider,
+    subject,
+    emailBehavior
+  };
+}
+//# sourceMappingURL=profile.js.map

package/lib/commonjs/core/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["asString","value","length","undefined","looksLikeEmail","test","mapClaimsToProfile","claims","providerId","tenantUserId","oid","sub","unique_name","givenName","given_name","familyName","family_name","composedName","filter","Boolean","join","displayName","name","preferred","preferred_username","email","provider","idp","identityProvider","describeProviderIdentity","subject","emailBehavior","endsWith"],"sourceRoot":"../../../src","sources":["core/profile.ts"],"mappings":";;;;;;;AAAA;AACA;AACA;AACA;;AAIA,SAASA,QAAQA,CAACC,KAAc,EAAsB;EACrD,OAAO,OAAOA,KAAK,KAAK,QAAQ,IAAIA,KAAK,CAACC,MAAM,GAAG,CAAC,GAAGD,KAAK,GAAGE,SAAS;AACzE;AAEA,SAASC,cAAcA,CAACH,KAAyB,EAAW;EAC3D,OAAO,CAAC,CAACA,KAAK,IAAI,WAAW,CAACI,IAAI,CAACJ,KAAK,CAAC;AAC1C;;AAEA;AACO,SAASK,kBAAkBA,CACjCC,MAA+B,EAC/BC,UAAuB,EACb;EACV,MAAMC,YAAY,GACjBT,QAAQ,CAACO,MAAM,CAACG,GAAG,CAAC,IAAIV,QAAQ,CAACO,MAAM,CAACI,GAAG,CAAC,IAAIX,QAAQ,CAACO,MAAM,CAACK,WAAW,CAAC,IAAI,SAAS;EAE1F,MAAMC,SAAS,GAAGb,QAAQ,CAACO,MAAM,CAACO,UAAU,CAAC;EAC7C,MAAMC,UAAU,GAAGf,QAAQ,CAACO,MAAM,CAACS,WAAW,CAAC;EAC/C,MAAMC,YAAY,GAAG,CAACJ,SAAS,EAAEE,UAAU,CAAC,CAACG,MAAM,CAACC,OAAO,CAAC,CAACC,IAAI,CAAC,GAAG,CAAC,IAAIjB,SAAS;EACnF,MAAMkB,WAAW,GAAGrB,QAAQ,CAACO,MAAM,CAACe,IAAI,CAAC,IAAIL,YAAY;EAEzD,MAAMM,SAAS,GAAGvB,QAAQ,CAACO,MAAM,CAACiB,kBAAkB,CAAC;EACrD,MAAMC,KAAK,GAAGzB,QAAQ,CAACO,MAAM,CAACkB,KAAK,CAAC,KAAKrB,cAAc,CAACmB,SAAS,CAAC,GAAGA,SAAS,GAAGpB,SAAS,CAAC;EAE3F,MAAMuB,QAAQ,GACblB,UAAU,IAAIR,QAAQ,CAACO,MAAM,CAACoB,GAAG,CAAC,IAAI3B,QAAQ,CAACO,MAAM,CAACqB,gBAAgB,CAAC,IAAI,SAAS;EAErF,OAAO;IACNnB,YAAY;IACZY,WAAW;IACXI,KAAK;IACLC,QAAQ;IACRnB;EACD,CAAC;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACO,SAASsB,wBAAwBA,CACvCtB,MAA+B,EAC/BC,UAAuB,EACJ;EACnB,MAAMkB,QAAQ,GAAGlB,UAAU,IAAIR,QAAQ,CAACO,MAAM,CAACoB,GAAG,CAAC,IAAI,SAAS;EAChE,MAAMG,OAAO,GAAG9B,QAAQ,CAACO,MAAM,CAACI,GAAG,CAAC,IAAIX,QAAQ,CAACO,MAAM,CAACG,GAAG,CAAC,IAAI,SAAS;EACzE,MAAMe,KAAK,GAAGzB,QAAQ,CAACO,MAAM,CAACkB,KAAK,CAAC;EACpC,IAAIM,aAAgD,GAAG,MAAM;EAC7D,IAAIN,KAAK,EAAE;IACVM,aAAa,GAAGN,KAAK,CAACO,QAAQ,CAAC,2BAA2B,CAAC,GAAG,eAAe,GAAG,QAAQ;EACzF;EACA,OAAO;IAAEN,QAAQ;IAAEI,OAAO;IAAEC;EAAc,CAAC;AAC5C","ignoreList":[]}

package/lib/commonjs/core/session.js

@@ -0,0 +1,125 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.parsePersistedSession = parsePersistedSession;
+exports.profileFromStored = profileFromStored;
+exports.restoreSession = restoreSession;
+exports.sameSession = sameSession;
+exports.storedProfileFrom = storedProfileFrom;
+var _secureStore = require("../tokens/secureStore.js");
+var _profile = require("./profile.js");
+var _accessTier = require("../access/accessTier.js");
+var _errors = require("../diagnostics/errors.js");
+/**
+ * Session restoration (FR-008, R5). Reads the persisted artifact, attempts a
+ * silent refresh, and classifies the outcome:
+ *  - restored: fresh tokens + claims → authenticated
+ *  - offline:  the refresh could not complete for any reason other than the
+ *              session being invalid — no network, a timeout, a 5xx, an error we
+ *              cannot classify → cached profile read-only, tier unverified (fail
+ *              closed) — clarify Q3
+ *  - unavailable: no artifact, or the provider said the refresh token is no
+ *              longer valid → signed-out reauth
+ *
+ * Only `unavailable` deletes the stored session, so it is reserved for a verdict
+ * the provider actually gave. Treating every unclassified error as expiry signed
+ * users out whenever the token endpoint had a bad moment.
+ */
+
+/**
+ * The identity in the stored artifact: who, not what the token said.
+ *
+ * The whole claim set used to be written to the Keychain on every launch — all
+ * of it, groups included — for a value nothing reads back: the access tier is
+ * recomputed from fresh claims, and a restore that cannot reach the provider
+ * fails closed anyway (AUTH-23).
+ */
+
+/** The artifact's identity as a profile. Artifacts written before 0.4.0 carry claims; they are kept. */
+function profileFromStored(stored) {
+  return {
+    ...stored,
+    claims: 'claims' in stored ? stored.claims ?? {} : {}
+  };
+}
+
+/** What goes to the store: everything but the claims. */
+function storedProfileFrom(profile) {
+  return {
+    tenantUserId: profile.tenantUserId,
+    displayName: profile.displayName,
+    email: profile.email,
+    provider: profile.provider
+  };
+}
+
+/** True when the artifact would be byte-identical, so the write can be skipped. */
+function sameSession(a, b) {
+  return a.refreshToken === b.refreshToken && a.idToken === b.idToken && a.profile.tenantUserId === b.profile.tenantUserId && a.profile.displayName === b.profile.displayName && a.profile.email === b.profile.email && a.profile.provider === b.profile.provider;
+}
+function parsePersistedSession(raw) {
+  if (!raw) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed.refreshToken === 'string' && parsed.profile) {
+      return parsed;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+async function restoreSession(deps) {
+  const raw = await deps.secureStore.getItem(_secureStore.AUTH_STORAGE_KEY);
+  const persisted = parsePersistedSession(raw);
+  if (!persisted) {
+    return {
+      outcome: 'unavailable'
+    };
+  }
+  try {
+    const tokens = await deps.authClient.refresh({
+      authority: deps.authority,
+      clientId: deps.clientId,
+      redirectUrl: deps.redirectUrl,
+      refreshToken: persisted.refreshToken,
+      scopes: deps.scopes
+    });
+    // A refresh response may carry no id token, and so no claims. The stored
+    // profile is then still the best identity there is; an empty one is not.
+    const hasClaims = Object.keys(tokens.claims).length > 0;
+    return {
+      outcome: 'restored',
+      persisted,
+      // The provider id came from the sign-in and is not in the claims: a
+      // refresh answered `idp: 'google.com'`, so a restored profile used to
+      // report a different provider than the same session did before (AUTH-10).
+      profile: hasClaims ? (0, _profile.mapClaimsToProfile)(tokens.claims, persisted.profile.provider) : profileFromStored(persisted.profile),
+      accessTier: hasClaims ? (0, _accessTier.evaluateAccessTier)(tokens.claims, deps.mapping) : (0, _accessTier.failClosedTier)(),
+      refreshToken: tokens.refreshToken || persisted.refreshToken,
+      idToken: tokens.idToken || persisted.idToken
+    };
+  } catch (error) {
+    if ((0, _errors.isAuthError)(error) && error.code === 'session-expired') {
+      // The provider rejected the refresh token: reauthentication is required.
+      return {
+        outcome: 'unavailable'
+      };
+    }
+    // Anything else is no verdict on the session. Keep the cached identity
+    // read-only and fail closed on entitlement; the next restore tries again.
+    return {
+      outcome: 'offline',
+      persisted,
+      profile: profileFromStored(persisted.profile),
+      accessTier: (0, _accessTier.failClosedTier)(),
+      refreshToken: persisted.refreshToken,
+      idToken: persisted.idToken
+    };
+  }
+}
+//# sourceMappingURL=session.js.map

package/lib/commonjs/core/session.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_secureStore","require","_profile","_accessTier","_errors","profileFromStored","stored","claims","storedProfileFrom","profile","tenantUserId","displayName","email","provider","sameSession","a","b","refreshToken","idToken","parsePersistedSession","raw","parsed","JSON","parse","restoreSession","deps","secureStore","getItem","AUTH_STORAGE_KEY","persisted","outcome","tokens","authClient","refresh","authority","clientId","redirectUrl","scopes","hasClaims","Object","keys","length","mapClaimsToProfile","accessTier","evaluateAccessTier","mapping","failClosedTier","error","isAuthError","code"],"sourceRoot":"../../../src","sources":["core/session.ts"],"mappings":";;;;;;;;;;AAmBA,IAAAA,YAAA,GAAAC,OAAA;AACA,IAAAC,QAAA,GAAAD,OAAA;AACA,IAAAE,WAAA,GAAAF,OAAA;AACA,IAAAG,OAAA,GAAAH,OAAA;AAtBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAUA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAUA;AACO,SAASI,iBAAiBA,CAACC,MAA+B,EAAW;EAC3E,OAAO;IAAE,GAAGA,MAAM;IAAEC,MAAM,EAAE,QAAQ,IAAID,MAAM,GAAIA,MAAM,CAACC,MAAM,IAAI,CAAC,CAAC,GAAI,CAAC;EAAE,CAAC;AAC9E;;AAEA;AACO,SAASC,iBAAiBA,CAACC,OAAgB,EAAiB;EAClE,OAAO;IACNC,YAAY,EAAED,OAAO,CAACC,YAAY;IAClCC,WAAW,EAAEF,OAAO,CAACE,WAAW;IAChCC,KAAK,EAAEH,OAAO,CAACG,KAAK;IACpBC,QAAQ,EAAEJ,OAAO,CAACI;EACnB,CAAC;AACF;;AAEA;AACO,SAASC,WAAWA,CAACC,CAAmB,EAAEC,CAAmB,EAAW;EAC9E,OACCD,CAAC,CAACE,YAAY,KAAKD,CAAC,CAACC,YAAY,IACjCF,CAAC,CAACG,OAAO,KAAKF,CAAC,CAACE,OAAO,IACvBH,CAAC,CAACN,OAAO,CAACC,YAAY,KAAKM,CAAC,CAACP,OAAO,CAACC,YAAY,IACjDK,CAAC,CAACN,OAAO,CAACE,WAAW,KAAKK,CAAC,CAACP,OAAO,CAACE,WAAW,IAC/CI,CAAC,CAACN,OAAO,CAACG,KAAK,KAAKI,CAAC,CAACP,OAAO,CAACG,KAAK,IACnCG,CAAC,CAACN,OAAO,CAACI,QAAQ,KAAKG,CAAC,CAACP,OAAO,CAACI,QAAQ;AAE3C;AAsBO,SAASM,qBAAqBA,CAACC,GAAkB,EAA2B;EAClF,IAAI,CAACA,GAAG,EAAE;IACT,OAAO,IAAI;EACZ;EACA,IAAI;IACH,MAAMC,MAAM,GAAGC,IAAI,CAACC,KAAK,CAACH,GAAG,CAAqB;IAClD,IAAIC,MAAM,IAAI,OAAOA,MAAM,CAACJ,YAAY,KAAK,QAAQ,IAAII,MAAM,CAACZ,OAAO,EAAE;MACxE,OAAOY,MAAM;IACd;IACA,OAAO,IAAI;EACZ,CAAC,CAAC,MAAM;IACP,OAAO,IAAI;EACZ;AACD;AAEO,eAAeG,cAAcA,CAACC,IAAiB,EAA0B;EAC/E,MAAML,GAAG,GAAG,MAAMK,IAAI,CAACC,WAAW,CAACC,OAAO,CAACC,6BAAgB,CAAC;EAC5D,MAAMC,SAAS,GAAGV,qBAAqB,CAACC,GAAG,CAAC;EAC5C,IAAI,CAACS,SAAS,EAAE;IACf,OAAO;MAAEC,OAAO,EAAE;IAAc,CAAC;EAClC;EAEA,IAAI;IACH,MAAMC,MAAM,GAAG,MAAMN,IAAI,CAACO,UAAU,CAACC,OAAO,CAAC;MAC5CC,SAAS,EAAET,IAAI,CAACS,SAAS;MACzBC,QAAQ,EAAEV,IAAI,CAACU,QAAQ;MACvBC,WAAW,EAAEX,IAAI,CAACW,WAAW;MAC7BnB,YAAY,EAAEY,SAAS,CAACZ,YAAY;MACpCoB,MAAM,EAAEZ,IAAI,CAACY;IACd,CAAC,CAAC;IACF;IACA;IACA,MAAMC,SAAS,GAAGC,MAAM,CAACC,IAAI,CAACT,MAAM,CAACxB,MAAM,CAAC,CAACkC,MAAM,GAAG,CAAC;IACvD,OAAO;MACNX,OAAO,EAAE,UAAU;MACnBD,SAAS;MACT;MACA;MACA;MACApB,OAAO,EAAE6B,SAAS,GACf,IAAAI,2BAAkB,EAACX,MAAM,CAACxB,MAAM,EAAEsB,SAAS,CAACpB,OAAO,CAACI,QAAQ,CAAC,GAC7DR,iBAAiB,CAACwB,SAAS,CAACpB,OAAO,CAAC;MACvCkC,UAAU,EAAEL,SAAS,GAAG,IAAAM,8BAAkB,EAACb,MAAM,CAACxB,MAAM,EAAEkB,IAAI,CAACoB,OAAO,CAAC,GAAG,IAAAC,0BAAc,EAAC,CAAC;MAC1F7B,YAAY,EAAEc,MAAM,CAACd,YAAY,IAAIY,SAAS,CAACZ,YAAY;MAC3DC,OAAO,EAAEa,MAAM,CAACb,OAAO,IAAIW,SAAS,CAACX;IACtC,CAAC;EACF,CAAC,CAAC,OAAO6B,KAAK,EAAE;IACf,IAAI,IAAAC,mBAAW,EAACD,KAAK,CAAC,IAAIA,KAAK,CAACE,IAAI,KAAK,iBAAiB,EAAE;MAC3D;MACA,OAAO;QAAEnB,OAAO,EAAE;MAAc,CAAC;IAClC;IACA;IACA;IACA,OAAO;MACNA,OAAO,EAAE,SAAS;MAClBD,SAAS;MACTpB,OAAO,EAAEJ,iBAAiB,CAACwB,SAAS,CAACpB,OAAO,CAAC;MAC7CkC,UAAU,EAAE,IAAAG,0BAAc,EAAC,CAAC;MAC5B7B,YAAY,EAAEY,SAAS,CAACZ,YAAY;MACpCC,OAAO,EAAEW,SAAS,CAACX;IACpB,CAAC;EACF;AACD","ignoreList":[]}