@chipmobilesdk/rn-auth 0.4.0 → 0.6.0

package/lib/commonjs/react/AuthProvider.js

@@ -0,0 +1,37 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.AuthProvider = AuthProvider;
+exports.useAuthInstance = useAuthInstance;
+var _react = _interopRequireWildcard(require("react"));
+var _jsxRuntime = require("react/jsx-runtime");
+function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
+/**
+ * React context boundary for the auth controller (LIB-002).
+ *
+ * The context carries the controller only, never its state: a context value that
+ * changed on every transition re-rendered every consumer on every transition
+ * (PERF-02). Hooks read the state through `useSyncExternalStore` with a selector,
+ * so a component re-renders only when the part it reads changes.
+ */
+
+const AuthContext = /*#__PURE__*/(0, _react.createContext)(null);
+function AuthProvider({
+  auth,
+  children
+}) {
+  return /*#__PURE__*/(0, _jsxRuntime.jsx)(AuthContext.Provider, {
+    value: auth,
+    children: children
+  });
+}
+function useAuthInstance() {
+  const auth = (0, _react.useContext)(AuthContext);
+  if (!auth) {
+    throw new Error('useAuth must be used within an <AuthProvider>.');
+  }
+  return auth;
+}
+//# sourceMappingURL=AuthProvider.js.map

package/lib/commonjs/react/AuthProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_react","_interopRequireWildcard","require","_jsxRuntime","e","t","WeakMap","r","n","__esModule","o","i","f","__proto__","default","has","get","set","hasOwnProperty","call","Object","defineProperty","getOwnPropertyDescriptor","AuthContext","createContext","AuthProvider","auth","children","jsx","Provider","value","useAuthInstance","useContext","Error"],"sourceRoot":"../../../src","sources":["react/AuthProvider.tsx"],"mappings":";;;;;;;AASA,IAAAA,MAAA,GAAAC,uBAAA,CAAAC,OAAA;AAAyD,IAAAC,WAAA,GAAAD,OAAA;AAAA,SAAAD,wBAAAG,CAAA,EAAAC,CAAA,6BAAAC,OAAA,MAAAC,CAAA,OAAAD,OAAA,IAAAE,CAAA,OAAAF,OAAA,YAAAL,uBAAA,YAAAA,CAAAG,CAAA,EAAAC,CAAA,SAAAA,CAAA,IAAAD,CAAA,IAAAA,CAAA,CAAAK,UAAA,SAAAL,CAAA,MAAAM,CAAA,EAAAC,CAAA,EAAAC,CAAA,KAAAC,SAAA,QAAAC,OAAA,EAAAV,CAAA,iBAAAA,CAAA,uBAAAA,CAAA,yBAAAA,CAAA,SAAAQ,CAAA,MAAAF,CAAA,GAAAL,CAAA,GAAAG,CAAA,GAAAD,CAAA,QAAAG,CAAA,CAAAK,GAAA,CAAAX,CAAA,UAAAM,CAAA,CAAAM,GAAA,CAAAZ,CAAA,GAAAM,CAAA,CAAAO,GAAA,CAAAb,CAAA,EAAAQ,CAAA,gBAAAP,CAAA,IAAAD,CAAA,gBAAAC,CAAA,OAAAa,cAAA,CAAAC,IAAA,CAAAf,CAAA,EAAAC,CAAA,OAAAM,CAAA,IAAAD,CAAA,GAAAU,MAAA,CAAAC,cAAA,KAAAD,MAAA,CAAAE,wBAAA,CAAAlB,CAAA,EAAAC,CAAA,OAAAM,CAAA,CAAAK,GAAA,IAAAL,CAAA,CAAAM,GAAA,IAAAP,CAAA,CAAAE,CAAA,EAAAP,CAAA,EAAAM,CAAA,IAAAC,CAAA,CAAAP,CAAA,IAAAD,CAAA,CAAAC,CAAA,WAAAO,CAAA,KAAAR,CAAA,EAAAC,CAAA;AATzD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAKA,MAAMkB,WAAW,gBAAG,IAAAC,oBAAa,EAAc,IAAI,CAAC;AAO7C,SAASC,YAAYA,CAAC;EAAEC,IAAI;EAAEC;AAA4B,CAAC,EAAE;EACnE,oBAAO,IAAAxB,WAAA,CAAAyB,GAAA,EAACL,WAAW,CAACM,QAAQ;IAACC,KAAK,EAAEJ,IAAK;IAAAC,QAAA,EAAEA;EAAQ,CAAuB,CAAC;AAC5E;AAEO,SAASI,eAAeA,CAAA,EAAS;EACvC,MAAML,IAAI,GAAG,IAAAM,iBAAU,EAACT,WAAW,CAAC;EACpC,IAAI,CAACG,IAAI,EAAE;IACV,MAAM,IAAIO,KAAK,CAAC,gDAAgD,CAAC;EAClE;EACA,OAAOP,IAAI;AACZ","ignoreList":[]}

package/lib/commonjs/react/hooks.js

@@ -0,0 +1,122 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.useAccessTier = useAccessTier;
+exports.useAccessToken = useAccessToken;
+exports.useAuth = useAuth;
+exports.useAuthMessages = useAuthMessages;
+exports.useAuthSelector = useAuthSelector;
+exports.useProfile = useProfile;
+exports.useSignInProvider = useSignInProvider;
+exports.useSignInProviders = useSignInProviders;
+var _react = require("@chipmobilesdk/rn-core/react");
+var _react2 = require("react");
+var _AuthProvider = require("./AuthProvider.js");
+var _accessTier = require("../access/accessTier.js");
+/**
+ * Public hooks (LIB-002). Each reads the controller's state through
+ * `useSyncExternalStore` (rn-core's `useExternalStore`), selecting only what it
+ * returns, so `useProfile` does not re-render when only the status changes.
+ */
+
+/**
+ * Any slice of the auth state; the component re-renders only when the slice
+ * changes by `isEqual` (default `Object.is`).
+ */
+function useAuthSelector(select, isEqual) {
+  const auth = (0, _AuthProvider.useAuthInstance)();
+  return (0, _react.useExternalStore)(auth.subscribe, auth.getState, select, isEqual);
+}
+const selectState = state => state;
+const selectProfile = state => state.profile;
+const selectAccessTier = state => state.accessTier;
+function useAuth() {
+  const auth = (0, _AuthProvider.useAuthInstance)();
+  const state = useAuthSelector(selectState);
+  return {
+    state,
+    signIn: (0, _react2.useCallback)(providerId => auth.signIn(providerId), [auth]),
+    signOut: (0, _react2.useCallback)(() => auth.signOut(), [auth]),
+    signOutGlobal: (0, _react2.useCallback)(() => auth.signOutGlobal(), [auth]),
+    restore: (0, _react2.useCallback)(() => auth.restore(), [auth]),
+    canAccessPremium: (0, _react2.useCallback)(() => auth.canAccessPremium(), [auth]),
+    requirePremium: (0, _react2.useCallback)(() => auth.requirePremium(), [auth])
+  };
+}
+
+/** This package's copy, with the app's `messages` overrides applied. */
+function useAuthMessages() {
+  return (0, _AuthProvider.useAuthInstance)().getMessages();
+}
+function useProfile() {
+  return useAuthSelector(selectProfile);
+}
+function useAccessTier() {
+  return useAuthSelector(selectAccessTier) ?? (0, _accessTier.failClosedTier)();
+}
+
+/** The first provider to present on the current platform (UX-004), or undefined. */
+function useSignInProvider() {
+  const auth = (0, _AuthProvider.useAuthInstance)();
+  return auth.getPlatformProvider();
+}
+
+/** All available providers for the current platform, in configuration order (FR-003/FR-004). */
+function useSignInProviders() {
+  const auth = (0, _AuthProvider.useAuthInstance)();
+  return auth.getPlatformProviders();
+}
+function useAccessToken(resourceKey) {
+  const auth = (0, _AuthProvider.useAuthInstance)();
+  const [state, setState] = (0, _react2.useState)({
+    status: 'idle',
+    resourceKey
+  });
+
+  // Which request may still write. A result for a resource the component has
+  // moved on from, or for an unmounted one, is dropped rather than applied
+  // (AUTH-17, standard VII).
+  const live = (0, _react2.useRef)(0);
+  (0, _react2.useEffect)(() => () => {
+    live.current += 1;
+  }, []);
+  const request = (0, _react2.useCallback)(async options => {
+    live.current += 1;
+    const id = live.current;
+    setState({
+      status: 'loading',
+      resourceKey
+    });
+    const result = await auth.requestAccessToken(resourceKey, options);
+    if (id === live.current) {
+      setState({
+        status: result.status,
+        token: result.token,
+        resourceKey
+      });
+    }
+    return result;
+  }, [auth, resourceKey]);
+
+  // A new resource starts from `idle`, not from the previous resource's token.
+  if (state.resourceKey !== resourceKey) {
+    live.current += 1;
+    setState({
+      status: 'idle',
+      resourceKey
+    });
+    return {
+      status: 'idle',
+      token: undefined,
+      request
+    };
+  }
+  return {
+    status: state.status,
+    token: state.token,
+    request
+  };
+}
+//# sourceMappingURL=hooks.js.map

package/lib/commonjs/react/hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_react","require","_react2","_AuthProvider","_accessTier","useAuthSelector","select","isEqual","auth","useAuthInstance","useExternalStore","subscribe","getState","selectState","state","selectProfile","profile","selectAccessTier","accessTier","useAuth","signIn","useCallback","providerId","signOut","signOutGlobal","restore","canAccessPremium","requirePremium","useAuthMessages","getMessages","useProfile","useAccessTier","failClosedTier","useSignInProvider","getPlatformProvider","useSignInProviders","getPlatformProviders","useAccessToken","resourceKey","setState","useState","status","live","useRef","useEffect","current","request","options","id","result","requestAccessToken","token","undefined"],"sourceRoot":"../../../src","sources":["react/hooks.ts"],"mappings":";;;;;;;;;;;;;AAMA,IAAAA,MAAA,GAAAC,OAAA;AACA,IAAAC,OAAA,GAAAD,OAAA;AACA,IAAAE,aAAA,GAAAF,OAAA;AAWA,IAAAG,WAAA,GAAAH,OAAA;AAnBA;AACA;AACA;AACA;AACA;;AA+BA;AACA;AACA;AACA;AACO,SAASI,eAAeA,CAC9BC,MAAsC,EACtCC,OAA+C,EACpC;EACX,MAAMC,IAAI,GAAG,IAAAC,6BAAe,EAAC,CAAC;EAC9B,OAAO,IAAAC,uBAAgB,EAACF,IAAI,CAACG,SAAS,EAAEH,IAAI,CAACI,QAAQ,EAAEN,MAAM,EAAEC,OAAO,CAAC;AACxE;AAEA,MAAMM,WAAW,GAAIC,KAAgB,IAAKA,KAAK;AAC/C,MAAMC,aAAa,GAAID,KAAgB,IAAKA,KAAK,CAACE,OAAO;AACzD,MAAMC,gBAAgB,GAAIH,KAAgB,IAAKA,KAAK,CAACI,UAAU;AAExD,SAASC,OAAOA,CAAA,EAAkB;EACxC,MAAMX,IAAI,GAAG,IAAAC,6BAAe,EAAC,CAAC;EAC9B,MAAMK,KAAK,GAAGT,eAAe,CAACQ,WAAW,CAAC;EAC1C,OAAO;IACNC,KAAK;IACLM,MAAM,EAAE,IAAAC,mBAAW,EAAEC,UAAsB,IAAKd,IAAI,CAACY,MAAM,CAACE,UAAU,CAAC,EAAE,CAACd,IAAI,CAAC,CAAC;IAChFe,OAAO,EAAE,IAAAF,mBAAW,EAAC,MAAMb,IAAI,CAACe,OAAO,CAAC,CAAC,EAAE,CAACf,IAAI,CAAC,CAAC;IAClDgB,aAAa,EAAE,IAAAH,mBAAW,EAAC,MAAMb,IAAI,CAACgB,aAAa,CAAC,CAAC,EAAE,CAAChB,IAAI,CAAC,CAAC;IAC9DiB,OAAO,EAAE,IAAAJ,mBAAW,EAAC,MAAMb,IAAI,CAACiB,OAAO,CAAC,CAAC,EAAE,CAACjB,IAAI,CAAC,CAAC;IAClDkB,gBAAgB,EAAE,IAAAL,mBAAW,EAAC,MAAMb,IAAI,CAACkB,gBAAgB,CAAC,CAAC,EAAE,CAAClB,IAAI,CAAC,CAAC;IACpEmB,cAAc,EAAE,IAAAN,mBAAW,EAAC,MAAMb,IAAI,CAACmB,cAAc,CAAC,CAAC,EAAE,CAACnB,IAAI,CAAC;EAChE,CAAC;AACF;;AAEA;AACO,SAASoB,eAAeA,CAAA,EAAmB;EACjD,OAAO,IAAAnB,6BAAe,EAAC,CAAC,CAACoB,WAAW,CAAC,CAAC;AACvC;AAEO,SAASC,UAAUA,CAAA,EAAwB;EACjD,OAAOzB,eAAe,CAACU,aAAa,CAAC;AACtC;AAEO,SAASgB,aAAaA,CAAA,EAAe;EAC3C,OAAO1B,eAAe,CAACY,gBAAgB,CAAC,IAAI,IAAAe,0BAAc,EAAC,CAAC;AAC7D;;AAEA;AACO,SAASC,iBAAiBA,CAAA,EAA+B;EAC/D,MAAMzB,IAAI,GAAG,IAAAC,6BAAe,EAAC,CAAC;EAC9B,OAAOD,IAAI,CAAC0B,mBAAmB,CAAC,CAAC;AAClC;;AAEA;AACO,SAASC,kBAAkBA,CAAA,EAAqB;EACtD,MAAM3B,IAAI,GAAG,IAAAC,6BAAe,EAAC,CAAC;EAC9B,OAAOD,IAAI,CAAC4B,oBAAoB,CAAC,CAAC;AACnC;AAYO,SAASC,cAAcA,CAACC,WAAmB,EAAwB;EACzE,MAAM9B,IAAI,GAAG,IAAAC,6BAAe,EAAC,CAAC;EAC9B,MAAM,CAACK,KAAK,EAAEyB,QAAQ,CAAC,GAAG,IAAAC,gBAAQ,EAI/B;IAAEC,MAAM,EAAE,MAAM;IAAEH;EAAY,CAAC,CAAC;;EAEnC;EACA;EACA;EACA,MAAMI,IAAI,GAAG,IAAAC,cAAM,EAAC,CAAC,CAAC;EACtB,IAAAC,iBAAS,EACR,MAAM,MAAM;IACXF,IAAI,CAACG,OAAO,IAAI,CAAC;EAClB,CAAC,EACD,EACD,CAAC;EAED,MAAMC,OAAO,GAAG,IAAAzB,mBAAW,EAC1B,MAAO0B,OAAmC,IAAK;IAC9CL,IAAI,CAACG,OAAO,IAAI,CAAC;IACjB,MAAMG,EAAE,GAAGN,IAAI,CAACG,OAAO;IACvBN,QAAQ,CAAC;MAAEE,MAAM,EAAE,SAAS;MAAEH;IAAY,CAAC,CAAC;IAC5C,MAAMW,MAAM,GAAG,MAAMzC,IAAI,CAAC0C,kBAAkB,CAACZ,WAAW,EAAES,OAAO,CAAC;IAClE,IAAIC,EAAE,KAAKN,IAAI,CAACG,OAAO,EAAE;MACxBN,QAAQ,CAAC;QAAEE,MAAM,EAAEQ,MAAM,CAACR,MAAM;QAAEU,KAAK,EAAEF,MAAM,CAACE,KAAK;QAAEb;MAAY,CAAC,CAAC;IACtE;IACA,OAAOW,MAAM;EACd,CAAC,EACD,CAACzC,IAAI,EAAE8B,WAAW,CACnB,CAAC;;EAED;EACA,IAAIxB,KAAK,CAACwB,WAAW,KAAKA,WAAW,EAAE;IACtCI,IAAI,CAACG,OAAO,IAAI,CAAC;IACjBN,QAAQ,CAAC;MAAEE,MAAM,EAAE,MAAM;MAAEH;IAAY,CAAC,CAAC;IACzC,OAAO;MAAEG,MAAM,EAAE,MAAM;MAAEU,KAAK,EAAEC,SAAS;MAAEN;IAAQ,CAAC;EACrD;EAEA,OAAO;IAAEL,MAAM,EAAE3B,KAAK,CAAC2B,MAAM;IAAEU,KAAK,EAAErC,KAAK,CAACqC,KAAK;IAAEL;EAAQ,CAAC;AAC7D","ignoreList":[]}

package/lib/commonjs/testing/conformance.js

@@ -0,0 +1,148 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.oidcAuthClientChecks = void 0;
+exports.runOidcAuthClientConformance = runOidcAuthClientConformance;
+exports.runSecureTokenStoreConformance = runSecureTokenStoreConformance;
+exports.secureTokenStoreChecks = void 0;
+var _testing = require("@chipmobilesdk/rn-core/testing");
+/**
+ * What any `SecureTokenStore` and `OidcAuthClient` must do (IOS-12, AUTH-13).
+ *
+ * The same checks run against the in-memory doubles and against the keychain and
+ * app-auth adapters (native modules mocked in Jest, or for real from a demo
+ * screen on a device), so a test that drives a double proves something about the
+ * device path. Each check builds its own subject through a harness.
+ */
+
+const KEY = '@chipmobilesdk/rn-auth/conformance';
+const OTHER_KEY = '@chipmobilesdk/rn-auth/conformance-other';
+const secureTokenStoreChecks = exports.secureTokenStoreChecks = [{
+  name: 'reads nothing for a key never written',
+  async run(harness) {
+    const value = await harness.create().getItem(KEY);
+    (0, _testing.ensure)(value === null, `expected null, got ${JSON.stringify(value)}`);
+  }
+}, {
+  name: 'reads back the last value written',
+  async run(harness) {
+    const store = harness.create();
+    await store.setItem(KEY, 'first');
+    await store.setItem(KEY, 'second');
+    const value = await store.getItem(KEY);
+    (0, _testing.ensure)(value === 'second', `expected the last write, got ${JSON.stringify(value)}`);
+  }
+}, {
+  name: 'keeps keys apart',
+  async run(harness) {
+    const store = harness.create();
+    await store.setItem(KEY, 'one');
+    await store.setItem(OTHER_KEY, 'two');
+    await store.removeItem(OTHER_KEY);
+    (0, _testing.ensure)((await store.getItem(KEY)) === 'one', 'removing one key touched another');
+  }
+}, {
+  name: 'forgets a removed key, and removes a missing key safely',
+  async run(harness) {
+    const store = harness.create();
+    await store.removeItem(KEY);
+    await store.setItem(KEY, 'value');
+    await store.removeItem(KEY);
+    (0, _testing.ensure)((await store.getItem(KEY)) === null, 'a removed key still reads back');
+  }
+}, {
+  name: 'keeps a long session artifact with non-ASCII text intact',
+  async run(harness) {
+    const store = harness.create();
+    const artifact = JSON.stringify({
+      name: 'Nguyễn Ánh',
+      pad: 'x'.repeat(4096)
+    });
+    await store.setItem(KEY, artifact);
+    (0, _testing.ensure)((await store.getItem(KEY)) === artifact, 'the artifact changed on the way back');
+  }
+}];
+const SIGN_IN = {
+  authority: 'https://login.example.com/tenant/v2.0',
+  clientId: 'conformance-client',
+  redirectUrl: 'com.example.app://auth',
+  scopes: ['openid', 'offline_access']
+};
+function codeOf(error) {
+  return error?.code;
+}
+const oidcAuthClientChecks = exports.oidcAuthClientChecks = [{
+  name: 'signs in with an access token, the id-token claims and a future expiry',
+  async run(harness) {
+    const subject = harness.create();
+    subject.issues({
+      oid: 'user-1',
+      name: 'Ada'
+    });
+    const before = Date.now();
+    const tokens = await subject.client.authorize(SIGN_IN);
+    (0, _testing.ensure)(typeof tokens.accessToken === 'string' && tokens.accessToken !== '', 'no access token');
+    (0, _testing.ensure)(tokens.claims.oid === 'user-1', `claims ${JSON.stringify(tokens.claims)}`);
+    (0, _testing.ensure)(tokens.accessTokenExpiresAt === undefined || tokens.accessTokenExpiresAt > before, 'the access token expires in the past');
+  }
+}, {
+  name: 'refreshes with a refresh token',
+  async run(harness) {
+    const subject = harness.create();
+    subject.issues({
+      oid: 'user-1'
+    });
+    const tokens = await subject.client.refresh({
+      ...SIGN_IN,
+      refreshToken: 'refresh-1'
+    });
+    (0, _testing.ensure)(typeof tokens.accessToken === 'string' && tokens.accessToken !== '', 'no access token');
+  }
+}, {
+  name: 'reports a closed sign-in sheet as provider-cancelled',
+  async run(harness) {
+    const subject = harness.create();
+    subject.userCancels();
+    let code;
+    try {
+      await subject.client.authorize(SIGN_IN);
+    } catch (error) {
+      code = codeOf(error);
+    }
+    (0, _testing.ensure)(code === 'provider-cancelled', `expected provider-cancelled, got ${String(code)}`);
+  }
+}, {
+  name: 'reports a rejected refresh token as session-expired',
+  async run(harness) {
+    const subject = harness.create();
+    subject.rejectsRefresh();
+    let code;
+    try {
+      await subject.client.refresh({
+        ...SIGN_IN,
+        refreshToken: 'revoked'
+      });
+    } catch (error) {
+      code = codeOf(error);
+    }
+    (0, _testing.ensure)(code === 'session-expired', `expected session-expired, got ${String(code)}`);
+  }
+}, {
+  name: 'ends the session',
+  async run(harness) {
+    const subject = harness.create();
+    await subject.client.endSession({
+      ...SIGN_IN,
+      idToken: undefined
+    });
+  }
+}];
+function runSecureTokenStoreConformance(harness) {
+  return (0, _testing.runChecks)(() => harness, secureTokenStoreChecks);
+}
+function runOidcAuthClientConformance(harness) {
+  return (0, _testing.runChecks)(() => harness, oidcAuthClientChecks);
+}
+//# sourceMappingURL=conformance.js.map

package/lib/commonjs/testing/conformance.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_testing","require","KEY","OTHER_KEY","secureTokenStoreChecks","exports","name","run","harness","value","create","getItem","ensure","JSON","stringify","store","setItem","removeItem","artifact","pad","repeat","SIGN_IN","authority","clientId","redirectUrl","scopes","codeOf","error","code","oidcAuthClientChecks","subject","issues","oid","before","Date","now","tokens","client","authorize","accessToken","claims","accessTokenExpiresAt","undefined","refresh","refreshToken","userCancels","String","rejectsRefresh","endSession","idToken","runSecureTokenStoreConformance","runChecks","runOidcAuthClientConformance"],"sourceRoot":"../../../src","sources":["testing/conformance.ts"],"mappings":";;;;;;;;;AAQA,IAAAA,QAAA,GAAAC,OAAA;AARA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AA8BA,MAAMC,GAAG,GAAG,oCAAoC;AAChD,MAAMC,SAAS,GAAG,0CAA0C;AAErD,MAAMC,sBAA4D,GAAAC,OAAA,CAAAD,sBAAA,GAAG,CAC3E;EACCE,IAAI,EAAE,uCAAuC;EAC7C,MAAMC,GAAGA,CAACC,OAAO,EAAE;IAClB,MAAMC,KAAK,GAAG,MAAMD,OAAO,CAACE,MAAM,CAAC,CAAC,CAACC,OAAO,CAACT,GAAG,CAAC;IACjD,IAAAU,eAAM,EAACH,KAAK,KAAK,IAAI,EAAE,sBAAsBI,IAAI,CAACC,SAAS,CAACL,KAAK,CAAC,EAAE,CAAC;EACtE;AACD,CAAC,EACD;EACCH,IAAI,EAAE,mCAAmC;EACzC,MAAMC,GAAGA,CAACC,OAAO,EAAE;IAClB,MAAMO,KAAK,GAAGP,OAAO,CAACE,MAAM,CAAC,CAAC;IAC9B,MAAMK,KAAK,CAACC,OAAO,CAACd,GAAG,EAAE,OAAO,CAAC;IACjC,MAAMa,KAAK,CAACC,OAAO,CAACd,GAAG,EAAE,QAAQ,CAAC;IAClC,MAAMO,KAAK,GAAG,MAAMM,KAAK,CAACJ,OAAO,CAACT,GAAG,CAAC;IACtC,IAAAU,eAAM,EAACH,KAAK,KAAK,QAAQ,EAAE,gCAAgCI,IAAI,CAACC,SAAS,CAACL,KAAK,CAAC,EAAE,CAAC;EACpF;AACD,CAAC,EACD;EACCH,IAAI,EAAE,kBAAkB;EACxB,MAAMC,GAAGA,CAACC,OAAO,EAAE;IAClB,MAAMO,KAAK,GAAGP,OAAO,CAACE,MAAM,CAAC,CAAC;IAC9B,MAAMK,KAAK,CAACC,OAAO,CAACd,GAAG,EAAE,KAAK,CAAC;IAC/B,MAAMa,KAAK,CAACC,OAAO,CAACb,SAAS,EAAE,KAAK,CAAC;IACrC,MAAMY,KAAK,CAACE,UAAU,CAACd,SAAS,CAAC;IACjC,IAAAS,eAAM,EAAC,CAAC,MAAMG,KAAK,CAACJ,OAAO,CAACT,GAAG,CAAC,MAAM,KAAK,EAAE,kCAAkC,CAAC;EACjF;AACD,CAAC,EACD;EACCI,IAAI,EAAE,yDAAyD;EAC/D,MAAMC,GAAGA,CAACC,OAAO,EAAE;IAClB,MAAMO,KAAK,GAAGP,OAAO,CAACE,MAAM,CAAC,CAAC;IAC9B,MAAMK,KAAK,CAACE,UAAU,CAACf,GAAG,CAAC;IAC3B,MAAMa,KAAK,CAACC,OAAO,CAACd,GAAG,EAAE,OAAO,CAAC;IACjC,MAAMa,KAAK,CAACE,UAAU,CAACf,GAAG,CAAC;IAC3B,IAAAU,eAAM,EAAC,CAAC,MAAMG,KAAK,CAACJ,OAAO,CAACT,GAAG,CAAC,MAAM,IAAI,EAAE,gCAAgC,CAAC;EAC9E;AACD,CAAC,EACD;EACCI,IAAI,EAAE,0DAA0D;EAChE,MAAMC,GAAGA,CAACC,OAAO,EAAE;IAClB,MAAMO,KAAK,GAAGP,OAAO,CAACE,MAAM,CAAC,CAAC;IAC9B,MAAMQ,QAAQ,GAAGL,IAAI,CAACC,SAAS,CAAC;MAAER,IAAI,EAAE,YAAY;MAAEa,GAAG,EAAE,GAAG,CAACC,MAAM,CAAC,IAAI;IAAE,CAAC,CAAC;IAC9E,MAAML,KAAK,CAACC,OAAO,CAACd,GAAG,EAAEgB,QAAQ,CAAC;IAClC,IAAAN,eAAM,EAAC,CAAC,MAAMG,KAAK,CAACJ,OAAO,CAACT,GAAG,CAAC,MAAMgB,QAAQ,EAAE,sCAAsC,CAAC;EACxF;AACD,CAAC,CACD;AAED,MAAMG,OAAO,GAAG;EACfC,SAAS,EAAE,uCAAuC;EAClDC,QAAQ,EAAE,oBAAoB;EAC9BC,WAAW,EAAE,wBAAwB;EACrCC,MAAM,EAAE,CAAC,QAAQ,EAAE,gBAAgB;AACpC,CAAC;AAED,SAASC,MAAMA,CAACC,KAAc,EAAW;EACxC,OAAQA,KAAK,EAAgCC,IAAI;AAClD;AAEO,MAAMC,oBAAmD,GAAAxB,OAAA,CAAAwB,oBAAA,GAAG,CAClE;EACCvB,IAAI,EAAE,wEAAwE;EAC9E,MAAMC,GAAGA,CAACC,OAAO,EAAE;IAClB,MAAMsB,OAAO,GAAGtB,OAAO,CAACE,MAAM,CAAC,CAAC;IAChCoB,OAAO,CAACC,MAAM,CAAC;MAAEC,GAAG,EAAE,QAAQ;MAAE1B,IAAI,EAAE;IAAM,CAAC,CAAC;IAC9C,MAAM2B,MAAM,GAAGC,IAAI,CAACC,GAAG,CAAC,CAAC;IACzB,MAAMC,MAAM,GAAG,MAAMN,OAAO,CAACO,MAAM,CAACC,SAAS,CAACjB,OAAO,CAAC;IACtD,IAAAT,eAAM,EACL,OAAOwB,MAAM,CAACG,WAAW,KAAK,QAAQ,IAAIH,MAAM,CAACG,WAAW,KAAK,EAAE,EACnE,iBACD,CAAC;IACD,IAAA3B,eAAM,EAACwB,MAAM,CAACI,MAAM,CAACR,GAAG,KAAK,QAAQ,EAAE,UAAUnB,IAAI,CAACC,SAAS,CAACsB,MAAM,CAACI,MAAM,CAAC,EAAE,CAAC;IACjF,IAAA5B,eAAM,EACLwB,MAAM,CAACK,oBAAoB,KAAKC,SAAS,IAAIN,MAAM,CAACK,oBAAoB,GAAGR,MAAM,EACjF,sCACD,CAAC;EACF;AACD,CAAC,EACD;EACC3B,IAAI,EAAE,gCAAgC;EACtC,MAAMC,GAAGA,CAACC,OAAO,EAAE;IAClB,MAAMsB,OAAO,GAAGtB,OAAO,CAACE,MAAM,CAAC,CAAC;IAChCoB,OAAO,CAACC,MAAM,CAAC;MAAEC,GAAG,EAAE;IAAS,CAAC,CAAC;IACjC,MAAMI,MAAM,GAAG,MAAMN,OAAO,CAACO,MAAM,CAACM,OAAO,CAAC;MAAE,GAAGtB,OAAO;MAAEuB,YAAY,EAAE;IAAY,CAAC,CAAC;IACtF,IAAAhC,eAAM,EACL,OAAOwB,MAAM,CAACG,WAAW,KAAK,QAAQ,IAAIH,MAAM,CAACG,WAAW,KAAK,EAAE,EACnE,iBACD,CAAC;EACF;AACD,CAAC,EACD;EACCjC,IAAI,EAAE,sDAAsD;EAC5D,MAAMC,GAAGA,CAACC,OAAO,EAAE;IAClB,MAAMsB,OAAO,GAAGtB,OAAO,CAACE,MAAM,CAAC,CAAC;IAChCoB,OAAO,CAACe,WAAW,CAAC,CAAC;IACrB,IAAIjB,IAAa;IACjB,IAAI;MACH,MAAME,OAAO,CAACO,MAAM,CAACC,SAAS,CAACjB,OAAO,CAAC;IACxC,CAAC,CAAC,OAAOM,KAAK,EAAE;MACfC,IAAI,GAAGF,MAAM,CAACC,KAAK,CAAC;IACrB;IACA,IAAAf,eAAM,EAACgB,IAAI,KAAK,oBAAoB,EAAE,oCAAoCkB,MAAM,CAAClB,IAAI,CAAC,EAAE,CAAC;EAC1F;AACD,CAAC,EACD;EACCtB,IAAI,EAAE,qDAAqD;EAC3D,MAAMC,GAAGA,CAACC,OAAO,EAAE;IAClB,MAAMsB,OAAO,GAAGtB,OAAO,CAACE,MAAM,CAAC,CAAC;IAChCoB,OAAO,CAACiB,cAAc,CAAC,CAAC;IACxB,IAAInB,IAAa;IACjB,IAAI;MACH,MAAME,OAAO,CAACO,MAAM,CAACM,OAAO,CAAC;QAAE,GAAGtB,OAAO;QAAEuB,YAAY,EAAE;MAAU,CAAC,CAAC;IACtE,CAAC,CAAC,OAAOjB,KAAK,EAAE;MACfC,IAAI,GAAGF,MAAM,CAACC,KAAK,CAAC;IACrB;IACA,IAAAf,eAAM,EAACgB,IAAI,KAAK,iBAAiB,EAAE,iCAAiCkB,MAAM,CAAClB,IAAI,CAAC,EAAE,CAAC;EACpF;AACD,CAAC,EACD;EACCtB,IAAI,EAAE,kBAAkB;EACxB,MAAMC,GAAGA,CAACC,OAAO,EAAE;IAClB,MAAMsB,OAAO,GAAGtB,OAAO,CAACE,MAAM,CAAC,CAAC;IAChC,MAAMoB,OAAO,CAACO,MAAM,CAACW,UAAU,CAAC;MAAE,GAAG3B,OAAO;MAAE4B,OAAO,EAAEP;IAAU,CAAC,CAAC;EACpE;AACD,CAAC,CACD;AAEM,SAASQ,8BAA8BA,CAC7C1C,OAA2B,EACE;EAC7B,OAAO,IAAA2C,kBAAS,EAAC,MAAM3C,OAAO,EAAEJ,sBAAsB,CAAC;AACxD;AAEO,SAASgD,4BAA4BA,CAAC5C,OAAoB,EAA8B;EAC9F,OAAO,IAAA2C,kBAAS,EAAC,MAAM3C,OAAO,EAAEqB,oBAAoB,CAAC;AACtD","ignoreList":[]}

package/lib/commonjs/testing/index.js

@@ -0,0 +1,53 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.createMemorySecureStore = createMemorySecureStore;
+Object.defineProperty(exports, "oidcAuthClientChecks", {
+  enumerable: true,
+  get: function () {
+    return _conformance.oidcAuthClientChecks;
+  }
+});
+Object.defineProperty(exports, "runOidcAuthClientConformance", {
+  enumerable: true,
+  get: function () {
+    return _conformance.runOidcAuthClientConformance;
+  }
+});
+Object.defineProperty(exports, "runSecureTokenStoreConformance", {
+  enumerable: true,
+  get: function () {
+    return _conformance.runSecureTokenStoreConformance;
+  }
+});
+Object.defineProperty(exports, "secureTokenStoreChecks", {
+  enumerable: true,
+  get: function () {
+    return _conformance.secureTokenStoreChecks;
+  }
+});
+var _conformance = require("./conformance.js");
+/**
+ * `@chipmobilesdk/rn-auth/testing`: test doubles and the port conformance suites.
+ *
+ * A separate entrypoint so neither can reach a production bundle.
+ */
+
+/** A `SecureTokenStore` held in memory, for tests and for the conformance suite. */
+function createMemorySecureStore(seed = {}) {
+  const values = new Map(Object.entries(seed));
+  return {
+    async getItem(key) {
+      return values.get(key) ?? null;
+    },
+    async setItem(key, value) {
+      values.set(key, value);
+    },
+    async removeItem(key) {
+      values.delete(key);
+    }
+  };
+}
+//# sourceMappingURL=index.js.map

package/lib/commonjs/testing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_conformance","require","createMemorySecureStore","seed","values","Map","Object","entries","getItem","key","get","setItem","value","set","removeItem","delete"],"sourceRoot":"../../../src","sources":["testing/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,IAAAA,YAAA,GAAAC,OAAA;AAvBA;AACA;AACA;AACA;AACA;;AAGA;AACO,SAASC,uBAAuBA,CAACC,IAA4B,GAAG,CAAC,CAAC,EAAoB;EAC5F,MAAMC,MAAM,GAAG,IAAIC,GAAG,CAAiBC,MAAM,CAACC,OAAO,CAACJ,IAAI,CAAC,CAAC;EAC5D,OAAO;IACN,MAAMK,OAAOA,CAACC,GAAG,EAAE;MAClB,OAAOL,MAAM,CAACM,GAAG,CAACD,GAAG,CAAC,IAAI,IAAI;IAC/B,CAAC;IACD,MAAME,OAAOA,CAACF,GAAG,EAAEG,KAAK,EAAE;MACzBR,MAAM,CAACS,GAAG,CAACJ,GAAG,EAAEG,KAAK,CAAC;IACvB,CAAC;IACD,MAAME,UAAUA,CAACL,GAAG,EAAE;MACrBL,MAAM,CAACW,MAAM,CAACN,GAAG,CAAC;IACnB;EACD,CAAC;AACF","ignoreList":[]}

package/lib/commonjs/tokens/accessToken.js

@@ -0,0 +1,165 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.createAccessTokenManager = createAccessTokenManager;
+var _errors = require("../diagnostics/errors.js");
+/**
+ * Per-resource delegated access-token acquisition with an in-memory cache and
+ * silent refresh (FR-007, PERF-003, R4). Access tokens are never persisted to
+ * disk (FR-021) — only kept in memory keyed by resource until expiry.
+ */
+
+const EXPIRY_SKEW_MS = 60_000;
+const SESSION_ENDED = {
+  status: 'unavailable',
+  errorCode: 'session-expired'
+};
+function createAccessTokenManager(deps) {
+  const cache = new Map();
+  /**
+   * Refreshes in progress, by resource. Concurrent callers for one resource
+   * share a single network call; with a rotating refresh token, a second call
+   * would race the first with a token the first may have just retired.
+   */
+  const inFlight = new Map();
+  const fresh = resourceKey => {
+    const cached = cache.get(resourceKey);
+    return cached && cached.expiresAt - EXPIRY_SKEW_MS > Date.now() ? cached : undefined;
+  };
+  const refresh = async resource => {
+    const resourceKey = resource.key;
+    const epoch = deps.sessionEpoch();
+    const refreshToken = deps.getRefreshToken();
+    if (!refreshToken) {
+      return {
+        resourceKey,
+        ...SESSION_ENDED
+      };
+    }
+    try {
+      const tokens = await deps.authClient.refresh({
+        authority: deps.authority,
+        clientId: deps.clientId,
+        redirectUrl: deps.redirectUrl,
+        refreshToken,
+        scopes: resource.scopes
+      });
+      // Signed out, or signed in as someone else, while this was in flight:
+      // nothing from it may be written back, and its token is not handed out.
+      if (deps.sessionEpoch() !== epoch) {
+        return {
+          resourceKey,
+          ...SESSION_ENDED
+        };
+      }
+      if (tokens.refreshToken && tokens.refreshToken !== refreshToken) {
+        await deps.onRefreshTokenRotated(tokens.refreshToken, epoch);
+        if (deps.sessionEpoch() !== epoch) {
+          return {
+            resourceKey,
+            ...SESSION_ENDED
+          };
+        }
+      }
+      if (!tokens.accessToken) {
+        return {
+          resourceKey,
+          status: 'error',
+          errorCode: 'token-acquisition-failed'
+        };
+      }
+      const expiresAt = tokens.accessTokenExpiresAt ?? Date.now() + 3_600_000;
+      cache.set(resourceKey, {
+        token: tokens.accessToken,
+        expiresAt
+      });
+      return {
+        resourceKey,
+        status: 'success',
+        token: tokens.accessToken,
+        expiresAt
+      };
+    } catch (error) {
+      if ((0, _errors.isAuthError)(error)) {
+        if (error.code === 'consent-denied') {
+          return {
+            resourceKey,
+            status: 'denied',
+            errorCode: error.code
+          };
+        }
+        if (error.code === 'network-unavailable') {
+          return {
+            resourceKey,
+            status: 'unavailable',
+            errorCode: error.code
+          };
+        }
+        if (error.code === 'session-expired') {
+          return {
+            resourceKey,
+            status: 'unavailable',
+            errorCode: error.code
+          };
+        }
+        return {
+          resourceKey,
+          status: 'error',
+          errorCode: error.code
+        };
+      }
+      return {
+        resourceKey,
+        status: 'error',
+        errorCode: 'token-acquisition-failed'
+      };
+    }
+  };
+  return {
+    clear() {
+      cache.clear();
+      inFlight.clear();
+    },
+    hasFreshToken(resourceKey) {
+      return fresh(resourceKey) !== undefined;
+    },
+    request(resourceKey, options = {}) {
+      const resource = deps.resources.find(entry => entry.key === resourceKey);
+      if (!resource) {
+        return Promise.resolve({
+          resourceKey,
+          status: 'error',
+          errorCode: 'configuration-error'
+        });
+      }
+      if (options.forceRefresh === true) {
+        // Dropped, not just skipped: the token is known bad, so no later
+        // caller should be handed it either.
+        cache.delete(resourceKey);
+      }
+      const cached = options.forceRefresh === true ? undefined : fresh(resourceKey);
+      if (cached) {
+        return Promise.resolve({
+          resourceKey,
+          status: 'success',
+          token: cached.token,
+          expiresAt: cached.expiresAt
+        });
+      }
+      const running = inFlight.get(resourceKey);
+      if (running) {
+        return running;
+      }
+      const flight = refresh(resource).finally(() => {
+        if (inFlight.get(resourceKey) === flight) {
+          inFlight.delete(resourceKey);
+        }
+      });
+      inFlight.set(resourceKey, flight);
+      return flight;
+    }
+  };
+}
+//# sourceMappingURL=accessToken.js.map

package/lib/commonjs/tokens/accessToken.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_errors","require","EXPIRY_SKEW_MS","SESSION_ENDED","status","errorCode","createAccessTokenManager","deps","cache","Map","inFlight","fresh","resourceKey","cached","get","expiresAt","Date","now","undefined","refresh","resource","key","epoch","sessionEpoch","refreshToken","getRefreshToken","tokens","authClient","authority","clientId","redirectUrl","scopes","onRefreshTokenRotated","accessToken","accessTokenExpiresAt","set","token","error","isAuthError","code","clear","hasFreshToken","request","options","resources","find","entry","Promise","resolve","forceRefresh","delete","running","flight","finally"],"sourceRoot":"../../../src","sources":["tokens/accessToken.ts"],"mappings":";;;;;;AAQA,IAAAA,OAAA,GAAAC,OAAA;AARA;AACA;AACA;AACA;AACA;;AAMA,MAAMC,cAAc,GAAG,MAAM;AA8C7B,MAAMC,aAAqD,GAAG;EAC7DC,MAAM,EAAE,aAAa;EACrBC,SAAS,EAAE;AACZ,CAAC;AAEM,SAASC,wBAAwBA,CAACC,IAA4B,EAAsB;EAC1F,MAAMC,KAAK,GAAG,IAAIC,GAAG,CAAsB,CAAC;EAC5C;AACD;AACA;AACA;AACA;EACC,MAAMC,QAAQ,GAAG,IAAID,GAAG,CAAqC,CAAC;EAE9D,MAAME,KAAK,GAAIC,WAAmB,IAA8B;IAC/D,MAAMC,MAAM,GAAGL,KAAK,CAACM,GAAG,CAACF,WAAW,CAAC;IACrC,OAAOC,MAAM,IAAIA,MAAM,CAACE,SAAS,GAAGb,cAAc,GAAGc,IAAI,CAACC,GAAG,CAAC,CAAC,GAAGJ,MAAM,GAAGK,SAAS;EACrF,CAAC;EAED,MAAMC,OAAO,GAAG,MAAOC,QAAwB,IAAiC;IAC/E,MAAMR,WAAW,GAAGQ,QAAQ,CAACC,GAAG;IAChC,MAAMC,KAAK,GAAGf,IAAI,CAACgB,YAAY,CAAC,CAAC;IACjC,MAAMC,YAAY,GAAGjB,IAAI,CAACkB,eAAe,CAAC,CAAC;IAC3C,IAAI,CAACD,YAAY,EAAE;MAClB,OAAO;QAAEZ,WAAW;QAAE,GAAGT;MAAc,CAAC;IACzC;IAEA,IAAI;MACH,MAAMuB,MAAM,GAAG,MAAMnB,IAAI,CAACoB,UAAU,CAACR,OAAO,CAAC;QAC5CS,SAAS,EAAErB,IAAI,CAACqB,SAAS;QACzBC,QAAQ,EAAEtB,IAAI,CAACsB,QAAQ;QACvBC,WAAW,EAAEvB,IAAI,CAACuB,WAAW;QAC7BN,YAAY;QACZO,MAAM,EAAEX,QAAQ,CAACW;MAClB,CAAC,CAAC;MACF;MACA;MACA,IAAIxB,IAAI,CAACgB,YAAY,CAAC,CAAC,KAAKD,KAAK,EAAE;QAClC,OAAO;UAAEV,WAAW;UAAE,GAAGT;QAAc,CAAC;MACzC;MACA,IAAIuB,MAAM,CAACF,YAAY,IAAIE,MAAM,CAACF,YAAY,KAAKA,YAAY,EAAE;QAChE,MAAMjB,IAAI,CAACyB,qBAAqB,CAACN,MAAM,CAACF,YAAY,EAAEF,KAAK,CAAC;QAC5D,IAAIf,IAAI,CAACgB,YAAY,CAAC,CAAC,KAAKD,KAAK,EAAE;UAClC,OAAO;YAAEV,WAAW;YAAE,GAAGT;UAAc,CAAC;QACzC;MACD;MACA,IAAI,CAACuB,MAAM,CAACO,WAAW,EAAE;QACxB,OAAO;UAAErB,WAAW;UAAER,MAAM,EAAE,OAAO;UAAEC,SAAS,EAAE;QAA2B,CAAC;MAC/E;MACA,MAAMU,SAAS,GAAGW,MAAM,CAACQ,oBAAoB,IAAIlB,IAAI,CAACC,GAAG,CAAC,CAAC,GAAG,SAAS;MACvET,KAAK,CAAC2B,GAAG,CAACvB,WAAW,EAAE;QAAEwB,KAAK,EAAEV,MAAM,CAACO,WAAW;QAAElB;MAAU,CAAC,CAAC;MAChE,OAAO;QAAEH,WAAW;QAAER,MAAM,EAAE,SAAS;QAAEgC,KAAK,EAAEV,MAAM,CAACO,WAAW;QAAElB;MAAU,CAAC;IAChF,CAAC,CAAC,OAAOsB,KAAK,EAAE;MACf,IAAI,IAAAC,mBAAW,EAACD,KAAK,CAAC,EAAE;QACvB,IAAIA,KAAK,CAACE,IAAI,KAAK,gBAAgB,EAAE;UACpC,OAAO;YAAE3B,WAAW;YAAER,MAAM,EAAE,QAAQ;YAAEC,SAAS,EAAEgC,KAAK,CAACE;UAAK,CAAC;QAChE;QACA,IAAIF,KAAK,CAACE,IAAI,KAAK,qBAAqB,EAAE;UACzC,OAAO;YAAE3B,WAAW;YAAER,MAAM,EAAE,aAAa;YAAEC,SAAS,EAAEgC,KAAK,CAACE;UAAK,CAAC;QACrE;QACA,IAAIF,KAAK,CAACE,IAAI,KAAK,iBAAiB,EAAE;UACrC,OAAO;YAAE3B,WAAW;YAAER,MAAM,EAAE,aAAa;YAAEC,SAAS,EAAEgC,KAAK,CAACE;UAAK,CAAC;QACrE;QACA,OAAO;UAAE3B,WAAW;UAAER,MAAM,EAAE,OAAO;UAAEC,SAAS,EAAEgC,KAAK,CAACE;QAAK,CAAC;MAC/D;MACA,OAAO;QAAE3B,WAAW;QAAER,MAAM,EAAE,OAAO;QAAEC,SAAS,EAAE;MAA2B,CAAC;IAC/E;EACD,CAAC;EAED,OAAO;IACNmC,KAAKA,CAAA,EAAG;MACPhC,KAAK,CAACgC,KAAK,CAAC,CAAC;MACb9B,QAAQ,CAAC8B,KAAK,CAAC,CAAC;IACjB,CAAC;IAEDC,aAAaA,CAAC7B,WAAW,EAAE;MAC1B,OAAOD,KAAK,CAACC,WAAW,CAAC,KAAKM,SAAS;IACxC,CAAC;IAEDwB,OAAOA,CAAC9B,WAAW,EAAE+B,OAAO,GAAG,CAAC,CAAC,EAA8B;MAC9D,MAAMvB,QAAQ,GAAGb,IAAI,CAACqC,SAAS,CAACC,IAAI,CAACC,KAAK,IAAIA,KAAK,CAACzB,GAAG,KAAKT,WAAW,CAAC;MACxE,IAAI,CAACQ,QAAQ,EAAE;QACd,OAAO2B,OAAO,CAACC,OAAO,CAAC;UAAEpC,WAAW;UAAER,MAAM,EAAE,OAAO;UAAEC,SAAS,EAAE;QAAsB,CAAC,CAAC;MAC3F;MAEA,IAAIsC,OAAO,CAACM,YAAY,KAAK,IAAI,EAAE;QAClC;QACA;QACAzC,KAAK,CAAC0C,MAAM,CAACtC,WAAW,CAAC;MAC1B;MACA,MAAMC,MAAM,GAAG8B,OAAO,CAACM,YAAY,KAAK,IAAI,GAAG/B,SAAS,GAAGP,KAAK,CAACC,WAAW,CAAC;MAC7E,IAAIC,MAAM,EAAE;QACX,OAAOkC,OAAO,CAACC,OAAO,CAAC;UACtBpC,WAAW;UACXR,MAAM,EAAE,SAAS;UACjBgC,KAAK,EAAEvB,MAAM,CAACuB,KAAK;UACnBrB,SAAS,EAAEF,MAAM,CAACE;QACnB,CAAC,CAAC;MACH;MAEA,MAAMoC,OAAO,GAAGzC,QAAQ,CAACI,GAAG,CAACF,WAAW,CAAC;MACzC,IAAIuC,OAAO,EAAE;QACZ,OAAOA,OAAO;MACf;MACA,MAAMC,MAAM,GAAGjC,OAAO,CAACC,QAAQ,CAAC,CAACiC,OAAO,CAAC,MAAM;QAC9C,IAAI3C,QAAQ,CAACI,GAAG,CAACF,WAAW,CAAC,KAAKwC,MAAM,EAAE;UACzC1C,QAAQ,CAACwC,MAAM,CAACtC,WAAW,CAAC;QAC7B;MACD,CAAC,CAAC;MACFF,QAAQ,CAACyB,GAAG,CAACvB,WAAW,EAAEwC,MAAM,CAAC;MACjC,OAAOA,MAAM;IACd;EACD,CAAC;AACF","ignoreList":[]}

package/lib/commonjs/tokens/secureStore.js

@@ -0,0 +1,60 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.AUTH_STORAGE_KEY = void 0;
+exports.createKeychainSecureStore = createKeychainSecureStore;
+var _rnCore = require("@chipmobilesdk/rn-core");
+var _errors = require("../diagnostics/errors.js");
+/**
+ * SecureTokenStore port + default react-native-keychain adapter (FR-021, R2).
+ *
+ * Refresh tokens and the session-restore artifact persist ONLY through this
+ * port, backed by platform secure storage (iOS Keychain / Android Keystore).
+ * Access tokens are never written here — they stay in memory (see accessToken).
+ * The default adapter loads the native module on its first read or write, so
+ * creating it, and unit tests that inject a fake, load no native code.
+ */
+
+/** Single key under which the persisted session artifact is stored. */
+const AUTH_STORAGE_KEY = exports.AUTH_STORAGE_KEY = '@chipmobilesdk/rn-auth/session';
+/**
+ * Default secure store backed by react-native-keychain. Each logical key maps to
+ * a Keychain "service" so multiple keys can coexist. Validated on device.
+ */
+function createKeychainSecureStore(options = {}) {
+  // The native module loads on the first read or write, never at startup (PERF-05).
+  const accessible = () => options.accessible ?? keychain().ACCESSIBLE?.WHEN_UNLOCKED_THIS_DEVICE_ONLY;
+  return {
+    async getItem(key) {
+      const result = await keychain().getGenericPassword({
+        service: key
+      });
+      return result ? result.password : null;
+    },
+    async setItem(key, value) {
+      await keychain().setGenericPassword('token', value, {
+        service: key,
+        accessible: accessible()
+      });
+    },
+    async removeItem(key) {
+      await keychain().resetGenericPassword({
+        service: key
+      });
+    }
+  };
+}
+const keychainPeer = (0, _rnCore.lazyPeer)('react-native-keychain', () => {
+  // Inside `try`, so Metro bundles an app that leaves this optional peer out.
+  try {
+    return require('react-native-keychain');
+  } catch (cause) {
+    throw cause;
+  }
+});
+function keychain() {
+  return keychainPeer.require(peer => new _errors.AuthConfigError('auth.error.configuration', `${peer} is not installed or its native module is not linked`));
+}
+//# sourceMappingURL=secureStore.js.map

package/lib/commonjs/tokens/secureStore.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_rnCore","require","_errors","AUTH_STORAGE_KEY","exports","createKeychainSecureStore","options","accessible","keychain","ACCESSIBLE","WHEN_UNLOCKED_THIS_DEVICE_ONLY","getItem","key","result","getGenericPassword","service","password","setItem","value","setGenericPassword","removeItem","resetGenericPassword","keychainPeer","lazyPeer","cause","peer","AuthConfigError"],"sourceRoot":"../../../src","sources":["tokens/secureStore.ts"],"mappings":";;;;;;;AAUA,IAAAA,OAAA,GAAAC,OAAA;AAEA,IAAAC,OAAA,GAAAD,OAAA;AAZA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAMA;AACO,MAAME,gBAAgB,GAAAC,OAAA,CAAAD,gBAAA,GAAG,gCAAgC;AAahE;AACA;AACA;AACA;AACO,SAASE,yBAAyBA,CACxCC,OAAmC,GAAG,CAAC,CAAC,EACrB;EACnB;EACA,MAAMC,UAAU,GAAGA,CAAA,KAClBD,OAAO,CAACC,UAAU,IAAIC,QAAQ,CAAC,CAAC,CAACC,UAAU,EAAEC,8BAA8B;EAE5E,OAAO;IACN,MAAMC,OAAOA,CAACC,GAAG,EAAE;MAClB,MAAMC,MAAM,GAAG,MAAML,QAAQ,CAAC,CAAC,CAACM,kBAAkB,CAAC;QAAEC,OAAO,EAAEH;MAAI,CAAC,CAAC;MACpE,OAAOC,MAAM,GAAGA,MAAM,CAACG,QAAQ,GAAG,IAAI;IACvC,CAAC;IACD,MAAMC,OAAOA,CAACL,GAAG,EAAEM,KAAK,EAAE;MACzB,MAAMV,QAAQ,CAAC,CAAC,CAACW,kBAAkB,CAAC,OAAO,EAAED,KAAK,EAAE;QACnDH,OAAO,EAAEH,GAAG;QACZL,UAAU,EAAEA,UAAU,CAAC;MACxB,CAAC,CAAC;IACH,CAAC;IACD,MAAMa,UAAUA,CAACR,GAAG,EAAE;MACrB,MAAMJ,QAAQ,CAAC,CAAC,CAACa,oBAAoB,CAAC;QAAEN,OAAO,EAAEH;MAAI,CAAC,CAAC;IACxD;EACD,CAAC;AACF;AAaA,MAAMU,YAAY,GAAG,IAAAC,gBAAQ,EAAC,uBAAuB,EAAE,MAAM;EAC5D;EACA,IAAI;IACH,OAAOtB,OAAO,CAAC,uBAAuB,CAAC;EACxC,CAAC,CAAC,OAAOuB,KAAK,EAAE;IACf,MAAMA,KAAK;EACZ;AACD,CAAC,CAAC;AAEF,SAAShB,QAAQA,CAAA,EAAmB;EACnC,OAAOc,YAAY,CAACrB,OAAO,CAC1BwB,IAAI,IACH,IAAIC,uBAAe,CAClB,0BAA0B,EAC1B,GAAGD,IAAI,sDACR,CACF,CAAC;AACF","ignoreList":[]}