@civic/auth 0.0.1-beta.30 → 0.0.1-beta.4

package/dist/{chunk-O3WGNLRO.mjs → chunk-NQPMNXBL.mjs}

@@ -1,7 +1,3 @@
-import {
-  DEFAULT_AUTH_SERVER,
-  withoutUndefined
-} from "./chunk-4PLCDPEN.mjs";
 import {
   __spreadProps,
   __spreadValues
@@ -59,11 +55,8 @@ var loggers = {
 
 // src/nextjs/config.ts
 var logger = loggers.nextjs.handlers.auth;
-var _a;
-var appUrl = typeof process !== "undefined" ? ((_a = process == null ? void 0 : process.env) == null ? void 0 : _a.NEXT_PUBLIC_APP_URL) || "" : "";
-var defaultServerSecure = !appUrl.startsWith("http://localhost");
 var defaultAuthConfig = {
-  oauthServer: DEFAULT_AUTH_SERVER,
+  oauthServer: "https://auth-dev.civic.com/oauth",
   callbackUrl: "/api/auth/callback",
   challengeUrl: "/api/auth/challenge",
   logoutUrl: "/api/auth/logout",
@@ -72,34 +65,12 @@ var defaultAuthConfig = {
   exclude: [],
   cookies: {
     tokens: {
-      ["id_token" /* ID_TOKEN */]: {
-        secure: defaultServerSecure,
-        httpOnly: true,
-        sameSite: "strict",
-        path: "/"
-      },
-      ["access_token" /* ACCESS_TOKEN */]: {
-        secure: defaultServerSecure,
-        httpOnly: true,
-        sameSite: "strict",
-        path: "/"
-      },
-      ["refresh_token" /* REFRESH_TOKEN */]: {
-        secure: defaultServerSecure,
-        httpOnly: true,
-        sameSite: "strict",
-        path: "/"
-      },
-      ["code_verifier" /* COOKIE_NAME */]: {
-        secure: defaultServerSecure,
-        httpOnly: true,
-        sameSite: "strict",
-        path: "/"
-      }
+      sameSite: "strict",
+      path: "/",
+      maxAge: 60 * 60
+      // 1 hour
     },
     user: {
-      secure: defaultServerSecure,
-      httpOnly: false,
       sameSite: "strict",
       path: "/",
       maxAge: 60 * 60
@@ -107,9 +78,17 @@ var defaultAuthConfig = {
     }
   }
 };
+var withoutUndefined = (obj) => {
+  const result = {};
+  for (const key in obj) {
+    if (obj[key] !== void 0) {
+      result[key] = obj[key];
+    }
+  }
+  return result;
+};
 var resolveAuthConfig = (config = {}) => {
-  var _a2, _b, _c, _d, _e, _f;
-  logger.debug("resolveAuthConfig inputs", JSON.stringify(config, null, 2));
+  var _a, _b, _c, _d;
   const configFromEnv = withoutUndefined({
     clientId: process.env._civic_auth_client_id,
     oauthServer: process.env._civic_oauth_server,
@@ -118,22 +97,19 @@ var resolveAuthConfig = (config = {}) => {
     loginUrl: process.env._civic_auth_login_url,
     appUrl: process.env._civic_auth_app_url,
     logoutUrl: process.env._civic_auth_logout_url,
-    include: (_a2 = process.env._civic_auth_includes) == null ? void 0 : _a2.split(","),
+    include: (_a = process.env._civic_auth_includes) == null ? void 0 : _a.split(","),
     exclude: (_b = process.env._civic_auth_excludes) == null ? void 0 : _b.split(","),
     cookies: process.env._civic_auth_cookie_config ? JSON.parse(process.env._civic_auth_cookie_config) : void 0
   });
   const mergedConfig = __spreadProps(__spreadValues(__spreadValues(__spreadValues({}, defaultAuthConfig), configFromEnv), config), {
     // Override with directly passed config
     cookies: {
-      tokens: __spreadValues(__spreadValues(__spreadValues({}, defaultAuthConfig.cookies.tokens), ((_c = configFromEnv == null ? void 0 : configFromEnv.cookies) == null ? void 0 : _c.tokens) || {}), ((_d = config.cookies) == null ? void 0 : _d.tokens) || {}),
-      user: __spreadValues(__spreadValues(__spreadValues({}, defaultAuthConfig.cookies.user), ((_e = configFromEnv == null ? void 0 : configFromEnv.cookies) == null ? void 0 : _e.user) || {}), ((_f = config.cookies) == null ? void 0 : _f.user) || {})
+      tokens: __spreadValues(__spreadValues({}, defaultAuthConfig.cookies.tokens), ((_c = config.cookies) == null ? void 0 : _c.tokens) || {}),
+      user: __spreadValues(__spreadValues({}, defaultAuthConfig.cookies.user), ((_d = config.cookies) == null ? void 0 : _d.user) || {})
     }
   });
-  logger.debug(
-    "Config from environment:",
-    JSON.stringify(configFromEnv, null, 2)
-  );
-  logger.debug("Resolved config:", JSON.stringify(mergedConfig, null, 2));
+  logger.debug("Config from environment:", configFromEnv);
+  logger.debug("Resolved config:", mergedConfig);
   if (mergedConfig.clientId === void 0) {
     throw new Error("Civic Auth client ID is required");
   }
@@ -141,10 +117,6 @@ var resolveAuthConfig = (config = {}) => {
 };
 var createCivicAuthPlugin = (clientId, authConfig = {}) => {
   return (nextConfig) => {
-    logger.debug(
-      "createCivicAuthPlugin nextConfig",
-      JSON.stringify(nextConfig, null, 2)
-    );
     const resolvedConfig = resolveAuthConfig(__spreadProps(__spreadValues({}, authConfig), { clientId }));
     return __spreadProps(__spreadValues({}, nextConfig), {
       env: __spreadProps(__spreadValues({}, nextConfig == null ? void 0 : nextConfig.env), {
@@ -164,10 +136,19 @@ var createCivicAuthPlugin = (clientId, authConfig = {}) => {
   };
 };
 
+// src/nextjs/utils.ts
+var resolveCallbackUrl = (config, alternativeUrl) => {
+  var _a;
+  const baseUrl = (_a = config.appUrl) != null ? _a : alternativeUrl;
+  const callbackUrl = new URL(config == null ? void 0 : config.callbackUrl, baseUrl).toString();
+  return callbackUrl.toString();
+};
+
 export {
   loggers,
   defaultAuthConfig,
   resolveAuthConfig,
-  createCivicAuthPlugin
+  createCivicAuthPlugin,
+  resolveCallbackUrl
 };
-//# sourceMappingURL=chunk-O3WGNLRO.mjs.map
+//# sourceMappingURL=chunk-NQPMNXBL.mjs.map

package/dist/chunk-NQPMNXBL.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/lib/logger.ts","../src/nextjs/config.ts","../src/nextjs/utils.ts"],"sourcesContent":["import debug from \"debug\";\n\nconst PACKAGE_NAME = \"@civic/auth\";\n\nexport interface Logger {\n  debug(message: string, ...args: unknown[]): void;\n  info(message: string, ...args: unknown[]): void;\n  warn(message: string, ...args: unknown[]): void;\n  error(message: string, ...args: unknown[]): void;\n}\n\nclass DebugLogger implements Logger {\n  private debugLogger: debug.Debugger;\n  private infoLogger: debug.Debugger;\n  private warnLogger: debug.Debugger;\n  private errorLogger: debug.Debugger;\n\n  constructor(namespace: string) {\n    // Format: @org/package:library:component:level\n    this.debugLogger = debug(`${PACKAGE_NAME}:${namespace}:debug`);\n    this.infoLogger = debug(`${PACKAGE_NAME}:${namespace}:info`);\n    this.warnLogger = debug(`${PACKAGE_NAME}:${namespace}:warn`);\n    this.errorLogger = debug(`${PACKAGE_NAME}:${namespace}:error`);\n\n    this.debugLogger.color = \"4\";\n    this.infoLogger.color = \"2\";\n    this.warnLogger.color = \"3\";\n    this.errorLogger.color = \"1\";\n  }\n\n  debug(message: string, ...args: unknown[]): void {\n    this.debugLogger(message, ...args);\n  }\n\n  info(message: string, ...args: unknown[]): void {\n    this.infoLogger(message, ...args);\n  }\n\n  warn(message: string, ...args: unknown[]): void {\n    this.warnLogger(message, ...args);\n  }\n\n  error(message: string, ...args: unknown[]): void {\n    this.errorLogger(message, ...args);\n  }\n}\n\nexport const createLogger = (namespace: string): Logger =>\n  new DebugLogger(namespace);\n\n// Pre-configured loggers for different parts of your package\nexport const loggers = {\n  // Next.js specific loggers\n  nextjs: {\n    routes: createLogger(\"api:routes\"),\n    middleware: createLogger(\"api:middleware\"),\n    handlers: {\n      auth: createLogger(\"api:handlers:auth\"),\n    },\n  },\n  // React specific loggers\n  react: {\n    components: createLogger(\"react:components\"),\n    hooks: createLogger(\"react:hooks\"),\n    context: createLogger(\"react:context\"),\n  },\n  // Shared utilities loggers\n  services: {\n    validation: createLogger(\"utils:validation\"),\n    network: createLogger(\"utils:network\"),\n  },\n} as const;\n","/* eslint-disable turbo/no-undeclared-env-vars */\n\"use server\";\nimport { NextConfig } from \"next\";\nimport { loggers } from \"@/lib/logger\";\n\nconst logger = loggers.nextjs.handlers.auth;\n\nexport interface CookieConfig {\n  secure?: boolean;\n  sameSite?: \"strict\" | \"lax\" | \"none\";\n  domain?: string;\n  path?: string;\n  maxAge?: number;\n}\n\nexport type AuthConfigWithDefaults = {\n  clientId: string;\n  oauthServer: string;\n  callbackUrl: string;\n  loginUrl: string;\n  logoutUrl: string;\n  appUrl?: string;\n  challengeUrl: string;\n  include: string[];\n  exclude: string[];\n  cookies: {\n    tokens: CookieConfig;\n    user: CookieConfig;\n  };\n};\n\nexport type AuthConfig = Partial<AuthConfigWithDefaults>;\n\nexport type DefinedAuthConfig = AuthConfigWithDefaults;\n\n/**\n * Default configuration values that will be used if not overridden\n */\nexport const defaultAuthConfig: Omit<AuthConfigWithDefaults, \"clientId\"> = {\n  oauthServer: \"https://auth-dev.civic.com/oauth\",\n  callbackUrl: \"/api/auth/callback\",\n  challengeUrl: \"/api/auth/challenge\",\n  logoutUrl: \"/api/auth/logout\",\n  loginUrl: \"/\",\n  include: [\"/*\"],\n  exclude: [],\n  cookies: {\n    tokens: {\n      sameSite: \"strict\",\n      path: \"/\",\n      maxAge: 60 * 60, // 1 hour\n    },\n    user: {\n      sameSite: \"strict\",\n      path: \"/\",\n      maxAge: 60 * 60, // 1 hour\n    },\n  },\n};\n\nconst withoutUndefined = <T extends { [k: string]: unknown }>(\n  obj: T,\n): Partial<T> => {\n  const result: Partial<T> = {};\n  for (const key in obj) {\n    if (obj[key] !== undefined) {\n      result[key] = obj[key];\n    }\n  }\n  return result;\n};\n\n/**\n * Resolves the authentication configuration by combining:\n * 1. Default values\n * 2. Environment variables (set internally by the plugin)\n * 3. Explicitly passed configuration\n *\n * Note: Developers should not set _civic_auth_* environment variables directly.\n * Instead, pass configuration to the createCivicAuthPlugin in next.config.js:\n *\n * @example\n * ```js\n * // next.config.js\n * export default createCivicAuthPlugin({\n *   callbackUrl: '/custom/callback',\n * })\n * ```\n */\nexport const resolveAuthConfig = (\n  config: AuthConfig = {},\n): AuthConfigWithDefaults & { clientId: string } => {\n  // Read configuration that was set by the plugin via environment variables\n  const configFromEnv = withoutUndefined({\n    clientId: process.env._civic_auth_client_id,\n    oauthServer: process.env._civic_oauth_server,\n    callbackUrl: process.env._civic_auth_callback_url,\n    challengeUrl: process.env._civic_auth_challenge_url,\n    loginUrl: process.env._civic_auth_login_url,\n    appUrl: process.env._civic_auth_app_url,\n    logoutUrl: process.env._civic_auth_logout_url,\n    include: process.env._civic_auth_includes?.split(\",\"),\n    exclude: process.env._civic_auth_excludes?.split(\",\"),\n    cookies: process.env._civic_auth_cookie_config\n      ? JSON.parse(process.env._civic_auth_cookie_config)\n      : undefined,\n  });\n\n  const mergedConfig = {\n    ...defaultAuthConfig,\n    ...configFromEnv, // Apply plugin-set config\n    ...config, // Override with directly passed config\n    cookies: {\n      tokens: {\n        ...defaultAuthConfig.cookies.tokens,\n        ...(config.cookies?.tokens || {}),\n      },\n      user: {\n        ...defaultAuthConfig.cookies.user,\n        ...(config.cookies?.user || {}),\n      },\n    },\n  };\n\n  logger.debug(\"Config from environment:\", configFromEnv);\n  logger.debug(\"Resolved config:\", mergedConfig);\n  if (mergedConfig.clientId === undefined) {\n    throw new Error(\"Civic Auth client ID is required\");\n  }\n  return mergedConfig as AuthConfigWithDefaults & { clientId: string };\n};\n\n/**\n * Creates a Next.js plugin that handles auth configuration.\n *\n * This is the main configuration point for the auth system.\n * Do not set _civic_auth_* environment variables directly - instead,\n * pass your configuration here:\n *\n * @example\n * ```js\n * // next.config.js\n * export tefault createCivicAuthPlugin({\n *   clientId: 'my-client-id',\n *   callbackUrl: '/custom/callback',\n *   loginUrl: '/custom/login',\n *   logoutUrl: '/custom/logout',\n *   include: ['/protected/*'],\n *   exclude: ['/public/*']\n * })\n * ```\n *\n * The plugin sets internal environment variables that are used by\n * the auth system. These variables should not be set manually.\n */\nexport const createCivicAuthPlugin = (\n  clientId: string,\n  authConfig: AuthConfig = {},\n) => {\n  return (nextConfig?: NextConfig) => {\n    const resolvedConfig = resolveAuthConfig({ ...authConfig, clientId });\n    return {\n      ...nextConfig,\n      env: {\n        ...nextConfig?.env,\n        // Internal environment variables - do not set these manually\n        _civic_auth_client_id: clientId,\n        _civic_oauth_server: resolvedConfig.oauthServer,\n        _civic_auth_callback_url: resolvedConfig.callbackUrl,\n        _civic_auth_challenge_url: resolvedConfig.challengeUrl,\n        _civic_auth_login_url: resolvedConfig.loginUrl,\n        _civic_auth_logout_url: resolvedConfig.logoutUrl,\n        _civic_auth_app_url: resolvedConfig.appUrl,\n        _civic_auth_includes: resolvedConfig.include.join(\",\"),\n        _civic_auth_excludes: resolvedConfig.exclude.join(\",\"),\n        _civic_auth_cookie_config: JSON.stringify(resolvedConfig.cookies),\n      },\n    };\n  };\n};\n","import { AuthConfigWithDefaults } from \"@/nextjs/config\";\n\nexport const resolveCallbackUrl = (\n  config: AuthConfigWithDefaults,\n  alternativeUrl?: string,\n): string => {\n  const baseUrl = config.appUrl ?? alternativeUrl;\n  const callbackUrl = new URL(config?.callbackUrl, baseUrl).toString();\n  return callbackUrl.toString();\n};\n"],"mappings":";;;;;;AAAA,OAAO,WAAW;AAElB,IAAM,eAAe;AASrB,IAAM,cAAN,MAAoC;AAAA,EAMlC,YAAY,WAAmB;AAE7B,SAAK,cAAc,MAAM,GAAG,YAAY,IAAI,SAAS,QAAQ;AAC7D,SAAK,aAAa,MAAM,GAAG,YAAY,IAAI,SAAS,OAAO;AAC3D,SAAK,aAAa,MAAM,GAAG,YAAY,IAAI,SAAS,OAAO;AAC3D,SAAK,cAAc,MAAM,GAAG,YAAY,IAAI,SAAS,QAAQ;AAE7D,SAAK,YAAY,QAAQ;AACzB,SAAK,WAAW,QAAQ;AACxB,SAAK,WAAW,QAAQ;AACxB,SAAK,YAAY,QAAQ;AAAA,EAC3B;AAAA,EAEA,MAAM,YAAoB,MAAuB;AAC/C,SAAK,YAAY,SAAS,GAAG,IAAI;AAAA,EACnC;AAAA,EAEA,KAAK,YAAoB,MAAuB;AAC9C,SAAK,WAAW,SAAS,GAAG,IAAI;AAAA,EAClC;AAAA,EAEA,KAAK,YAAoB,MAAuB;AAC9C,SAAK,WAAW,SAAS,GAAG,IAAI;AAAA,EAClC;AAAA,EAEA,MAAM,YAAoB,MAAuB;AAC/C,SAAK,YAAY,SAAS,GAAG,IAAI;AAAA,EACnC;AACF;AAEO,IAAM,eAAe,CAAC,cAC3B,IAAI,YAAY,SAAS;AAGpB,IAAM,UAAU;AAAA;AAAA,EAErB,QAAQ;AAAA,IACN,QAAQ,aAAa,YAAY;AAAA,IACjC,YAAY,aAAa,gBAAgB;AAAA,IACzC,UAAU;AAAA,MACR,MAAM,aAAa,mBAAmB;AAAA,IACxC;AAAA,EACF;AAAA;AAAA,EAEA,OAAO;AAAA,IACL,YAAY,aAAa,kBAAkB;AAAA,IAC3C,OAAO,aAAa,aAAa;AAAA,IACjC,SAAS,aAAa,eAAe;AAAA,EACvC;AAAA;AAAA,EAEA,UAAU;AAAA,IACR,YAAY,aAAa,kBAAkB;AAAA,IAC3C,SAAS,aAAa,eAAe;AAAA,EACvC;AACF;;;AClEA,IAAM,SAAS,QAAQ,OAAO,SAAS;AAiChC,IAAM,oBAA8D;AAAA,EACzE,aAAa;AAAA,EACb,aAAa;AAAA,EACb,cAAc;AAAA,EACd,WAAW;AAAA,EACX,UAAU;AAAA,EACV,SAAS,CAAC,IAAI;AAAA,EACd,SAAS,CAAC;AAAA,EACV,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,UAAU;AAAA,MACV,MAAM;AAAA,MACN,QAAQ,KAAK;AAAA;AAAA,IACf;AAAA,IACA,MAAM;AAAA,MACJ,UAAU;AAAA,MACV,MAAM;AAAA,MACN,QAAQ,KAAK;AAAA;AAAA,IACf;AAAA,EACF;AACF;AAEA,IAAM,mBAAmB,CACvB,QACe;AACf,QAAM,SAAqB,CAAC;AAC5B,aAAW,OAAO,KAAK;AACrB,QAAI,IAAI,GAAG,MAAM,QAAW;AAC1B,aAAO,GAAG,IAAI,IAAI,GAAG;AAAA,IACvB;AAAA,EACF;AACA,SAAO;AACT;AAmBO,IAAM,oBAAoB,CAC/B,SAAqB,CAAC,MAC4B;AA3FpD;AA6FE,QAAM,gBAAgB,iBAAiB;AAAA,IACrC,UAAU,QAAQ,IAAI;AAAA,IACtB,aAAa,QAAQ,IAAI;AAAA,IACzB,aAAa,QAAQ,IAAI;AAAA,IACzB,cAAc,QAAQ,IAAI;AAAA,IAC1B,UAAU,QAAQ,IAAI;AAAA,IACtB,QAAQ,QAAQ,IAAI;AAAA,IACpB,WAAW,QAAQ,IAAI;AAAA,IACvB,UAAS,aAAQ,IAAI,yBAAZ,mBAAkC,MAAM;AAAA,IACjD,UAAS,aAAQ,IAAI,yBAAZ,mBAAkC,MAAM;AAAA,IACjD,SAAS,QAAQ,IAAI,4BACjB,KAAK,MAAM,QAAQ,IAAI,yBAAyB,IAChD;AAAA,EACN,CAAC;AAED,QAAM,eAAe,+DAChB,oBACA,gBACA,SAHgB;AAAA;AAAA,IAInB,SAAS;AAAA,MACP,QAAQ,kCACH,kBAAkB,QAAQ,WACzB,YAAO,YAAP,mBAAgB,WAAU,CAAC;AAAA,MAEjC,MAAM,kCACD,kBAAkB,QAAQ,SACzB,YAAO,YAAP,mBAAgB,SAAQ,CAAC;AAAA,IAEjC;AAAA,EACF;AAEA,SAAO,MAAM,4BAA4B,aAAa;AACtD,SAAO,MAAM,oBAAoB,YAAY;AAC7C,MAAI,aAAa,aAAa,QAAW;AACvC,UAAM,IAAI,MAAM,kCAAkC;AAAA,EACpD;AACA,SAAO;AACT;AAyBO,IAAM,wBAAwB,CACnC,UACA,aAAyB,CAAC,MACvB;AACH,SAAO,CAAC,eAA4B;AAClC,UAAM,iBAAiB,kBAAkB,iCAAK,aAAL,EAAiB,SAAS,EAAC;AACpE,WAAO,iCACF,aADE;AAAA,MAEL,KAAK,iCACA,yCAAY,MADZ;AAAA;AAAA,QAGH,uBAAuB;AAAA,QACvB,qBAAqB,eAAe;AAAA,QACpC,0BAA0B,eAAe;AAAA,QACzC,2BAA2B,eAAe;AAAA,QAC1C,uBAAuB,eAAe;AAAA,QACtC,wBAAwB,eAAe;AAAA,QACvC,qBAAqB,eAAe;AAAA,QACpC,sBAAsB,eAAe,QAAQ,KAAK,GAAG;AAAA,QACrD,sBAAsB,eAAe,QAAQ,KAAK,GAAG;AAAA,QACrD,2BAA2B,KAAK,UAAU,eAAe,OAAO;AAAA,MAClE;AAAA,IACF;AAAA,EACF;AACF;;;ACjLO,IAAM,qBAAqB,CAChC,QACA,mBACW;AALb;AAME,QAAM,WAAU,YAAO,WAAP,YAAiB;AACjC,QAAM,cAAc,IAAI,IAAI,iCAAQ,aAAa,OAAO,EAAE,SAAS;AACnE,SAAO,YAAY,SAAS;AAC9B;","names":[]}

package/dist/chunk-OLT5HB3G.js

@@ -0,0 +1,239 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } }
+
+
+var _chunkCRTRMMJ7js = require('./chunk-CRTRMMJ7.js');
+
+// src/utils.ts
+var _clsx = require('clsx');
+var _tailwindmerge = require('tailwind-merge');
+var isPopupBlocked = () => {
+  const popup = window.open("", "", "width=1,height=1");
+  if (!popup) {
+    return true;
+  }
+  try {
+    if (typeof popup.closed === "undefined") {
+      throw new Error("Popup is blocked");
+    }
+  } catch (e) {
+    return true;
+  }
+  popup.close();
+  return false;
+};
+var cn = (...inputs) => {
+  return _tailwindmerge.twMerge.call(void 0, _clsx.clsx.call(void 0, inputs));
+};
+var withoutUndefined = (obj) => {
+  const result = {};
+  for (const key in obj) {
+    if (obj[key] !== void 0) {
+      result[key] = obj[key];
+    }
+  }
+  return result;
+};
+
+// src/shared/types.ts
+var NextjsServerCookies = /* @__PURE__ */ ((NextjsServerCookies2) => {
+  NextjsServerCookies2["ID_TOKEN"] = "id_token";
+  NextjsServerCookies2["ACCESS_TOKEN"] = "access_token";
+  NextjsServerCookies2["REFRESH_TOKEN"] = "refresh_token";
+  return NextjsServerCookies2;
+})(NextjsServerCookies || {});
+
+// src/shared/util.ts
+var _oauth2 = require('oslo/oauth2');
+
+// src/lib/oauth.ts
+var _uuid = require('uuid');
+var getIssuerVariations = (issuer) => {
+  const issuerWithoutSlash = issuer.endsWith("/") ? issuer.slice(0, issuer.length - 1) : issuer;
+  const issuerWithSlash = `${issuerWithoutSlash}/`;
+  return [issuerWithoutSlash, issuerWithSlash];
+};
+var addSlashIfNeeded = (url) => url.endsWith("/") ? url : `${url}/`;
+var getOauthEndpoints = (oauthServer) => _chunkCRTRMMJ7js.__async.call(void 0, void 0, null, function* () {
+  const openIdConfigResponse = yield fetch(
+    `${addSlashIfNeeded(oauthServer)}.well-known/openid-configuration`
+  );
+  const openIdConfig = yield openIdConfigResponse.json();
+  return {
+    jwks: openIdConfig.jwks_uri,
+    auth: openIdConfig.authorization_endpoint,
+    token: openIdConfig.token_endpoint,
+    userinfo: openIdConfig.userinfo_endpoint
+  };
+});
+var generateState = (displayMode) => {
+  const jsonString = JSON.stringify({
+    uuid: _uuid.v4.call(void 0, ),
+    displayMode
+  });
+  return btoa(jsonString);
+};
+var displayModeFromState = (state, sessionDisplayMode) => {
+  try {
+    const jsonString = btoa(state);
+    return JSON.parse(jsonString).displayMode;
+  } catch (e) {
+    console.error("Failed to parse displayMode from state:", state);
+    return sessionDisplayMode;
+  }
+};
+
+// src/shared/util.ts
+var _jose = require('jose'); var jose = _interopRequireWildcard(_jose);
+function deriveCodeChallenge(codeVerifier, method = "S256") {
+  return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
+    if (method === "Plain") {
+      console.warn("Using insecure plain code challenge method");
+      return codeVerifier;
+    }
+    const encoder = new TextEncoder();
+    const data = encoder.encode(codeVerifier);
+    const digest = yield crypto.subtle.digest("SHA-256", data);
+    return btoa(String.fromCharCode(...new Uint8Array(digest))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  });
+}
+function getEndpointsWithOverrides(_0) {
+  return _chunkCRTRMMJ7js.__async.call(void 0, this, arguments, function* (oauthServer, endpointOverrides = {}) {
+    const endpoints = yield getOauthEndpoints(oauthServer);
+    return _chunkCRTRMMJ7js.__spreadValues.call(void 0, _chunkCRTRMMJ7js.__spreadValues.call(void 0, {}, endpoints), endpointOverrides);
+  });
+}
+function generateOauthLoginUrl(config) {
+  return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
+    const endpoints = yield getEndpointsWithOverrides(
+      config.oauthServer,
+      config.endpointOverrides
+    );
+    const oauth2Client = buildOauth2Client(
+      config.clientId,
+      config.redirectUrl,
+      endpoints
+    );
+    const challenge = yield config.pkceConsumer.getCodeChallenge();
+    const oAuthUrl = yield oauth2Client.createAuthorizationURL({
+      state: config.state,
+      scopes: config.scopes
+    });
+    oAuthUrl.searchParams.append("code_challenge", challenge);
+    oAuthUrl.searchParams.append("code_challenge_method", "S256");
+    if (config.nonce) {
+      oAuthUrl.searchParams.append("nonce", config.nonce);
+    }
+    oAuthUrl.searchParams.append("prompt", "consent");
+    console.log("Generated OAuth URL", oAuthUrl.toString());
+    return oAuthUrl;
+  });
+}
+function generateOauthLogoutUrl(config) {
+  return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
+    console.log(config);
+    return new URL("http://localhost");
+  });
+}
+function buildOauth2Client(clientId, redirectUri, endpoints) {
+  return new (0, _oauth2.OAuth2Client)(clientId, endpoints.auth, endpoints.token, {
+    redirectURI: redirectUri
+  });
+}
+function exchangeTokens(code, state, pkceProducer, oauth2Client, oauthServer, endpoints) {
+  return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
+    const codeVerifier = yield pkceProducer.getCodeVerifier();
+    if (!codeVerifier) throw new Error("Code verifier not found in state");
+    const tokens = yield oauth2Client.validateAuthorizationCode(code, {
+      codeVerifier
+    });
+    try {
+      yield validateOauth2Tokens(tokens, endpoints, oauth2Client, oauthServer);
+    } catch (error) {
+      console.error("tokenExchange error", { error, tokens });
+      throw new Error(
+        `OIDC tokens validation failed: ${error.message}`
+      );
+    }
+    return tokens;
+  });
+}
+function storeTokens(storage, tokens) {
+  storage.set("id_token" /* ID_TOKEN */, tokens.id_token);
+  storage.set("access_token" /* ACCESS_TOKEN */, tokens.access_token);
+  if (tokens.refresh_token)
+    storage.set("refresh_token" /* REFRESH_TOKEN */, tokens.refresh_token);
+}
+function clearTokens(storage) {
+  Object.values(NextjsServerCookies).forEach((cookie) => {
+    storage.set(cookie, "");
+  });
+}
+function retrieveTokens(storage) {
+  const idToken = storage.get("id_token" /* ID_TOKEN */);
+  const accessToken = storage.get("access_token" /* ACCESS_TOKEN */);
+  const refreshToken = storage.get("refresh_token" /* REFRESH_TOKEN */);
+  if (!idToken || !accessToken) return null;
+  return {
+    id_token: idToken,
+    access_token: accessToken,
+    refresh_token: refreshToken != null ? refreshToken : void 0
+  };
+}
+function validateOauth2Tokens(tokens, endpoints, oauth2Client, oauthServer) {
+  return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
+    const JWKS = jose.createRemoteJWKSet(new URL(endpoints.jwks));
+    const idTokenResponse = yield jose.jwtVerify(
+      tokens.id_token,
+      JWKS,
+      {
+        issuer: getIssuerVariations(oauthServer),
+        audience: oauth2Client.clientId
+      }
+    );
+    const accessTokenResponse = yield jose.jwtVerify(
+      tokens.access_token,
+      JWKS,
+      {
+        issuer: getIssuerVariations(oauthServer)
+      }
+    );
+    return withoutUndefined({
+      id_token: idTokenResponse.payload,
+      access_token: accessTokenResponse.payload,
+      refresh_token: tokens.refresh_token
+    });
+  });
+}
+
+// src/constants.ts
+var DEFAULT_SCOPES = [
+  "openid",
+  "profile",
+  "email",
+  "forwardedTokens",
+  "offline_access"
+];
+var IFRAME_ID = "civic-auth-iframe";
+var AUTH_SERVER = "https://auth-dev.civic.com/oauth";
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+exports.getOauthEndpoints = getOauthEndpoints; exports.generateState = generateState; exports.displayModeFromState = displayModeFromState; exports.isPopupBlocked = isPopupBlocked; exports.cn = cn; exports.deriveCodeChallenge = deriveCodeChallenge; exports.getEndpointsWithOverrides = getEndpointsWithOverrides; exports.generateOauthLoginUrl = generateOauthLoginUrl; exports.generateOauthLogoutUrl = generateOauthLogoutUrl; exports.buildOauth2Client = buildOauth2Client; exports.exchangeTokens = exchangeTokens; exports.storeTokens = storeTokens; exports.clearTokens = clearTokens; exports.retrieveTokens = retrieveTokens; exports.validateOauth2Tokens = validateOauth2Tokens; exports.DEFAULT_SCOPES = DEFAULT_SCOPES; exports.IFRAME_ID = IFRAME_ID; exports.AUTH_SERVER = AUTH_SERVER;
+//# sourceMappingURL=chunk-OLT5HB3G.js.map

package/dist/chunk-OLT5HB3G.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/Users/lucas/dev/civic/civic-auth/packages/civic-auth-client/dist/chunk-OLT5HB3G.js","../src/utils.ts","../src/shared/types.ts","../src/shared/util.ts","../src/lib/oauth.ts","../src/constants.ts"],"names":["NextjsServerCookies"],"mappings":"AAAA;AACE;AACA;AACF,sDAA4B;AAC5B;AACA;ACLA,4BAAsC;AACtC,+CAAwB;AAUxB,IAAM,eAAA,EAAiB,CAAA,EAAA,GAAe;AAEpC,EAAA,MAAM,MAAA,EAAQ,MAAA,CAAO,IAAA,CAAK,EAAA,EAAI,EAAA,EAAI,kBAAkB,CAAA;AAGpD,EAAA,GAAA,CAAI,CAAC,KAAA,EAAO;AACV,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,IAAI;AAEF,IAAA,GAAA,CAAI,OAAO,KAAA,CAAM,OAAA,IAAW,WAAA,EAAa;AACvC,MAAA,MAAM,IAAI,KAAA,CAAM,kBAAkB,CAAA;AAAA,IACpC;AAAA,EACF,EAAA,MAAA,CAAQ,CAAA,EAAA;AAEN,IAAA,OAAO,IAAA;AAAA,EACT;AAGA,EAAA,KAAA,CAAM,KAAA,CAAM,CAAA;AACZ,EAAA,OAAO,KAAA;AACT,CAAA;AAEA,IAAM,GAAA,EAAK,CAAA,GAAI,MAAA,EAAA,GAAyB;AACtC,EAAA,OAAO,oCAAA,wBAAQ,MAAW,CAAC,CAAA;AAC7B,CAAA;AAUO,IAAM,iBAAA,EAAmB,CAC9B,GAAA,EAAA,GACwB;AACxB,EAAA,MAAM,OAAA,EAAS,CAAC,CAAA;AAEhB,EAAA,IAAA,CAAA,MAAW,IAAA,GAAO,GAAA,EAAK;AACrB,IAAA,GAAA,CAAI,GAAA,CAAI,GAAG,EAAA,IAAM,KAAA,CAAA,EAAW;AAI1B,MAAC,MAAA,CAAe,GAAG,EAAA,EAAI,GAAA,CAAI,GAAG,CAAA;AAAA,IAChC;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT,CAAA;AD3BA;AACA;AEpCO,IAAK,oBAAA,kBAAL,CAAA,CAAKA,oBAAAA,EAAAA,GAAL;AACL,EAAAA,oBAAAA,CAAA,UAAA,EAAA,EAAW,UAAA;AACX,EAAAA,oBAAAA,CAAA,cAAA,EAAA,EAAe,cAAA;AACf,EAAAA,oBAAAA,CAAA,eAAA,EAAA,EAAgB,eAAA;AAHN,EAAA,OAAAA,oBAAAA;AAAA,CAAA,CAAA,CAAA,oBAAA,GAAA,CAAA,CAAA,CAAA;AF2CZ;AACA;AGlCA,qCAA6B;AHoC7B;AACA;AI9CA,4BAA2B;AAE3B,IAAM,oBAAA,EAAsB,CAAC,MAAA,EAAA,GAA6B;AACxD,EAAA,MAAM,mBAAA,EAAqB,MAAA,CAAO,QAAA,CAAS,GAAG,EAAA,EAC1C,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,MAAA,CAAO,OAAA,EAAS,CAAC,EAAA,EACjC,MAAA;AAEJ,EAAA,MAAM,gBAAA,EAAkB,CAAA,EAAA;AAEhB,EAAA;AACV;AAE0B;AAGO;AACzB,EAAA;AACgB,IAAA;AACtB,EAAA;AAEG,EAAA;AACI,EAAA;AACc,IAAA;AACA,IAAA;AACC,IAAA;AACG,IAAA;AACzB,EAAA;AACF;AAOuB;AACG,EAAA;AACX,IAAA;AACX,IAAA;AACD,EAAA;AAEqB,EAAA;AACxB;AAQ6B;AAIvB,EAAA;AACiB,IAAA;AAED,IAAA;AACR,EAAA;AACI,IAAA;AACP,IAAA;AACT,EAAA;AACF;AJqB2B;AACA;AGxEL;AAQA;AAGH,EAAA;AACF,IAAA;AACA,MAAA;AACN,MAAA;AACT,IAAA;AAEoB,IAAA;AACC,IAAA;AACA,IAAA;AACF,IAAA;AAIrB,EAAA;AAAA;AAEsB;AAGpB,EAAA;AACkB,IAAA;AACX,IAAA;AAIT,EAAA;AAAA;AAEsB;AAUL,EAAA;AACG,IAAA;AACT,MAAA;AACA,MAAA;AACT,IAAA;AACqB,IAAA;AACZ,MAAA;AACA,MAAA;AACP,MAAA;AACF,IAAA;AACkB,IAAA;AACK,IAAA;AACP,MAAA;AACC,MAAA;AAChB,IAAA;AAGqB,IAAA;AACA,IAAA;AACJ,IAAA;AAEP,MAAA;AACX,IAAA;AAEsB,IAAA;AAEV,IAAA;AACL,IAAA;AACT,EAAA;AAAA;AAEsB;AAOL,EAAA;AAEG,IAAA;AACH,IAAA;AACjB,EAAA;AAAA;AAGE;AAIwB,EAAA;AACT,IAAA;AACd,EAAA;AACH;AAGE;AAMA,EAAA;AACqB,IAAA;AACF,IAAA;AAGX,IAAA;AACJ,MAAA;AACD,IAAA;AAGC,IAAA;AACI,MAAA;AACQ,IAAA;AACA,MAAA;AACJ,MAAA;AACR,QAAA;AACF,MAAA;AACF,IAAA;AAEO,IAAA;AACT,EAAA;AAAA;AAGE;AAIQ,EAAA;AACA,EAAA;AACG,EAAA;AACD,IAAA;AACZ;AAE4B;AACZ,EAAA;AACU,IAAA;AACvB,EAAA;AACH;AAGE;AAEwB,EAAA;AACJ,EAAA;AACC,EAAA;AAEJ,EAAA;AAEV,EAAA;AACK,IAAA;AACI,IAAA;AACC,IAAA;AACjB,EAAA;AACF;AAEsB;AAKG,EAAA;AACL,IAAA;AAGZ,IAAA;AACG,MAAA;AACP,MAAA;AACA,MAAA;AACU,QAAA;AACE,QAAA;AACZ,MAAA;AACF,IAAA;AAGM,IAAA;AACG,MAAA;AACP,MAAA;AACA,MAAA;AACU,QAAA;AACV,MAAA;AACF,IAAA;AAEO,IAAA;AACK,MAAA;AACI,MAAA;AACC,MAAA;AAChB,IAAA;AACH,EAAA;AAAA;AHA2B;AACA;AK/MJ;AACrB,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACF;AACkB;AAEE;ALgNO;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA","file":"/Users/lucas/dev/civic/civic-auth/packages/civic-auth-client/dist/chunk-OLT5HB3G.js","sourcesContent":[null,"import { clsx, type ClassValue } from \"clsx\";\nimport { twMerge } from \"tailwind-merge\";\n\n/**\n * Checks if a popup window is blocked by the browser.\n *\n * This function attempts to open a small popup window and then checks if it was successfully created.\n * If the popup is blocked by the browser, the function returns `true`. Otherwise, it returns `false`.\n *\n * @returns {boolean} - `true` if the popup is blocked, `false` otherwise.\n */\nconst isPopupBlocked = (): boolean => {\n  // First we try to open a small popup window. It either returns a window object or null.\n  const popup = window.open(\"\", \"\", \"width=1,height=1\");\n\n  // If window.open() returns null, popup is definitely blocked\n  if (!popup) {\n    return true;\n  }\n\n  try {\n    // Try to access a property of the popup to check if it's usable\n    if (typeof popup.closed === \"undefined\") {\n      throw new Error(\"Popup is blocked\");\n    }\n  } catch {\n    // Accessing the popup's properties throws an error if the popup is blocked\n    return true;\n  }\n\n  // Close the popup immediately if it was opened\n  popup.close();\n  return false;\n};\n\nconst cn = (...inputs: ClassValue[]) => {\n  return twMerge(clsx(inputs));\n};\n\n// This type narrows T as far as it can by:\n// - removing all keys where the value is `undefined`\n// - making keys that are not undefined required\n// So, for example: given { a: string | undefined, b: string | undefined },\n// if you pass in { a: \"foo\" }, it returns an object of type: { a: string }\ntype WithoutUndefined<T> = {\n  [K in keyof T as undefined extends T[K] ? never : K]: T[K];\n};\nexport const withoutUndefined = <T extends { [K in keyof T]: unknown }>(\n  obj: T,\n): WithoutUndefined<T> => {\n  const result = {} as WithoutUndefined<T>;\n\n  for (const key in obj) {\n    if (obj[key] !== undefined) {\n      // TypeScript needs assurance that key is a valid key in WithoutUndefined<T>\n      // We use type assertion here\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      (result as any)[key] = obj[key];\n    }\n  }\n\n  return result;\n};\n\nexport { cn, isPopupBlocked };\n","export enum NextjsServerCookies {\n  ID_TOKEN = \"id_token\",\n  ACCESS_TOKEN = \"access_token\",\n  REFRESH_TOKEN = \"refresh_token\",\n}\n\nexport enum NextjsClientCookies {\n  USER = \"user\",\n}\n","// Utility functions shared by auth server and client integrations\n// Typically these functions should be used inside AuthenticationInitiator and AuthenticationResolver implementations\n\nimport {\n  Endpoints,\n  JWTPayload,\n  OIDCTokenResponseBody,\n  ParsedTokens,\n} from \"@/types.js\";\nimport { NextjsServerCookies } from \"./types\";\nimport { OAuth2Client } from \"oslo/oauth2\";\nimport { getIssuerVariations, getOauthEndpoints } from \"@/lib/oauth.js\";\nimport * as jose from \"jose\";\nimport { withoutUndefined } from \"@/utils.js\";\nimport { AuthStorage } from \"@/shared/storage.js\";\nimport { PKCEConsumer, PKCEProducer } from \"@/services/types.js\";\n\n/**\n * Given a PKCE code verifier, derive the code challenge using SHA\n */\nexport async function deriveCodeChallenge(\n  codeVerifier: string,\n  method: \"Plain\" | \"S256\" = \"S256\",\n): Promise<string> {\n  if (method === \"Plain\") {\n    console.warn(\"Using insecure plain code challenge method\");\n    return codeVerifier;\n  }\n\n  const encoder = new TextEncoder();\n  const data = encoder.encode(codeVerifier);\n  const digest = await crypto.subtle.digest(\"SHA-256\", data);\n  return btoa(String.fromCharCode(...new Uint8Array(digest)))\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nexport async function getEndpointsWithOverrides(\n  oauthServer: string,\n  endpointOverrides: Partial<Endpoints> = {},\n) {\n  const endpoints = await getOauthEndpoints(oauthServer);\n  return {\n    ...endpoints,\n    ...endpointOverrides,\n  };\n}\n\nexport async function generateOauthLoginUrl(config: {\n  clientId: string;\n  scopes: string[];\n  state: string;\n  redirectUrl: string;\n  oauthServer: string;\n  nonce?: string;\n  endpointOverrides?: Partial<Endpoints>;\n  // used to get the PKCE challenge\n  pkceConsumer: PKCEConsumer;\n}): Promise<URL> {\n  const endpoints = await getEndpointsWithOverrides(\n    config.oauthServer,\n    config.endpointOverrides,\n  );\n  const oauth2Client = buildOauth2Client(\n    config.clientId,\n    config.redirectUrl,\n    endpoints,\n  );\n  const challenge = await config.pkceConsumer.getCodeChallenge();\n  const oAuthUrl = await oauth2Client.createAuthorizationURL({\n    state: config.state,\n    scopes: config.scopes,\n  });\n  // The OAuth2 client supports PKCE, but does not allow passing in a code challenge from some other source\n  // It only allows passing in a code verifier which it then hashes itself.\n  oAuthUrl.searchParams.append(\"code_challenge\", challenge);\n  oAuthUrl.searchParams.append(\"code_challenge_method\", \"S256\");\n  if (config.nonce) {\n    // nonce isn't supported by oslo, so we add it manually\n    oAuthUrl.searchParams.append(\"nonce\", config.nonce);\n  }\n  // Required by the auth server for offline_access scope\n  oAuthUrl.searchParams.append(\"prompt\", \"consent\");\n\n  console.log(\"Generated OAuth URL\", oAuthUrl.toString());\n  return oAuthUrl;\n}\n\nexport async function generateOauthLogoutUrl(config: {\n  clientId: string;\n  scopes: string[];\n  oauthServer: string;\n  endpointOverrides?: Partial<Endpoints>;\n  // used to get the PKCE challenge\n  pkceConsumer: PKCEConsumer;\n}): Promise<URL> {\n  // TODO\n  console.log(config);\n  return new URL(\"http://localhost\");\n}\n\nexport function buildOauth2Client(\n  clientId: string,\n  redirectUri: string,\n  endpoints: Endpoints,\n): OAuth2Client {\n  return new OAuth2Client(clientId, endpoints.auth, endpoints.token, {\n    redirectURI: redirectUri,\n  });\n}\n\nexport async function exchangeTokens(\n  code: string,\n  state: string,\n  pkceProducer: PKCEProducer,\n  oauth2Client: OAuth2Client,\n  oauthServer: string,\n  endpoints: Endpoints,\n) {\n  const codeVerifier = await pkceProducer.getCodeVerifier();\n  if (!codeVerifier) throw new Error(\"Code verifier not found in state\");\n\n  const tokens =\n    await oauth2Client.validateAuthorizationCode<OIDCTokenResponseBody>(code, {\n      codeVerifier,\n    });\n\n  // Validate relevant tokens\n  try {\n    await validateOauth2Tokens(tokens, endpoints, oauth2Client, oauthServer);\n  } catch (error) {\n    console.error(\"tokenExchange error\", { error, tokens });\n    throw new Error(\n      `OIDC tokens validation failed: ${(error as Error).message}`,\n    );\n  }\n\n  return tokens;\n}\n\nexport function storeTokens(\n  storage: AuthStorage,\n  tokens: OIDCTokenResponseBody,\n) {\n  // store tokens in storage ( TODO we should probably store them against the state to allow multiple logins )\n  storage.set(NextjsServerCookies.ID_TOKEN, tokens.id_token);\n  storage.set(NextjsServerCookies.ACCESS_TOKEN, tokens.access_token);\n  if (tokens.refresh_token)\n    storage.set(NextjsServerCookies.REFRESH_TOKEN, tokens.refresh_token);\n}\n\nexport function clearTokens(storage: AuthStorage) {\n  Object.values(NextjsServerCookies).forEach((cookie) => {\n    storage.set(cookie, \"\");\n  });\n}\n\nexport function retrieveTokens(\n  storage: AuthStorage,\n): OIDCTokenResponseBody | null {\n  const idToken = storage.get(NextjsServerCookies.ID_TOKEN);\n  const accessToken = storage.get(NextjsServerCookies.ACCESS_TOKEN);\n  const refreshToken = storage.get(NextjsServerCookies.REFRESH_TOKEN);\n\n  if (!idToken || !accessToken) return null;\n\n  return {\n    id_token: idToken,\n    access_token: accessToken,\n    refresh_token: refreshToken ?? undefined,\n  };\n}\n\nexport async function validateOauth2Tokens(\n  tokens: OIDCTokenResponseBody,\n  endpoints: Endpoints,\n  oauth2Client: OAuth2Client,\n  oauthServer: string,\n): Promise<ParsedTokens> {\n  const JWKS = jose.createRemoteJWKSet(new URL(endpoints.jwks));\n\n  // validate the ID token\n  const idTokenResponse = await jose.jwtVerify<JWTPayload>(\n    tokens.id_token,\n    JWKS,\n    {\n      issuer: getIssuerVariations(oauthServer),\n      audience: oauth2Client.clientId,\n    },\n  );\n\n  // validate the access token\n  const accessTokenResponse = await jose.jwtVerify<JWTPayload>(\n    tokens.access_token,\n    JWKS,\n    {\n      issuer: getIssuerVariations(oauthServer),\n    },\n  );\n\n  return withoutUndefined({\n    id_token: idTokenResponse.payload,\n    access_token: accessTokenResponse.payload,\n    refresh_token: tokens.refresh_token,\n  });\n}\n","import { DisplayMode, Endpoints, OpenIdConfiguration } from \"@/types\";\nimport { v4 as uuid } from \"uuid\";\n\nconst getIssuerVariations = (issuer: string): string[] => {\n  const issuerWithoutSlash = issuer.endsWith(\"/\")\n    ? issuer.slice(0, issuer.length - 1)\n    : issuer;\n\n  const issuerWithSlash = `${issuerWithoutSlash}/`;\n\n  return [issuerWithoutSlash, issuerWithSlash];\n};\n\nconst addSlashIfNeeded = (url: string): string =>\n  url.endsWith(\"/\") ? url : `${url}/`;\n\nconst getOauthEndpoints = async (oauthServer: string): Promise<Endpoints> => {\n  const openIdConfigResponse = await fetch(\n    `${addSlashIfNeeded(oauthServer)}.well-known/openid-configuration`,\n  );\n  const openIdConfig =\n    (await openIdConfigResponse.json()) as OpenIdConfiguration;\n  return {\n    jwks: openIdConfig.jwks_uri,\n    auth: openIdConfig.authorization_endpoint,\n    token: openIdConfig.token_endpoint,\n    userinfo: openIdConfig.userinfo_endpoint,\n  };\n};\n\n/**\n * creates a state string for the OAuth2 flow, encoding the display mode too for future use\n * @param {DisplayMode} displayMode\n * @returns {string}\n */\nconst generateState = (displayMode: DisplayMode): string => {\n  const jsonString = JSON.stringify({\n    uuid: uuid(),\n    displayMode,\n  });\n\n  return btoa(jsonString);\n};\n\n/**\n * parses the state string from the OAuth2 flow, decoding the display mode too\n * @param state\n * @param sessionDisplayMode\n * @returns { uuid: string, displayMode: DisplayMode }\n */\nconst displayModeFromState = (\n  state: string,\n  sessionDisplayMode: DisplayMode | undefined,\n): DisplayMode | undefined => {\n  try {\n    const jsonString = btoa(state);\n\n    return JSON.parse(jsonString).displayMode;\n  } catch (e) {\n    console.error(\"Failed to parse displayMode from state:\", state);\n    return sessionDisplayMode;\n  }\n};\n\nexport {\n  getIssuerVariations,\n  getOauthEndpoints,\n  displayModeFromState,\n  generateState,\n};\n","const DEFAULT_SCOPES = [\n  \"openid\",\n  \"profile\",\n  \"email\",\n  \"forwardedTokens\",\n  \"offline_access\",\n];\nconst IFRAME_ID = \"civic-auth-iframe\";\n\nconst AUTH_SERVER = \"https://auth-dev.civic.com/oauth\";\n\nexport { DEFAULT_SCOPES, IFRAME_ID, AUTH_SERVER };\n"]}

package/dist/{chunk-6RFRDWIP.js → chunk-T47HULF6.js}

@@ -7,7 +7,8 @@
 
 
 
-var _chunk7K3QN2ATjs = require('./chunk-7K3QN2AT.js');
+
+var _chunkOLT5HB3Gjs = require('./chunk-OLT5HB3G.js');
 
 
 
@@ -31,26 +32,61 @@ var CookieStorage = class {
   }
 };
 
-// src/server/ServerAuthenticationResolver.ts
+// src/services/PKCE.ts
 var _oauth2 = require('oslo/oauth2');
+var GenericPublicClientPKCEProducer = class {
+  constructor(storage) {
+    this.storage = storage;
+  }
+  // if there is already a verifier, return it,
+  // If not, create a new one and store it
+  getCodeChallenge() {
+    return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
+      const verifier = _oauth2.generateCodeVerifier.call(void 0, );
+      this.storage.set("code_verifier", verifier);
+      return _chunkOLT5HB3Gjs.deriveCodeChallenge.call(void 0, verifier);
+    });
+  }
+  // if there is already a verifier, return it,
+  getCodeVerifier() {
+    return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
+      return this.storage.get("code_verifier");
+    });
+  }
+};
+
+// src/services/AuthenticationService.ts
+
+var GenericAuthenticationInitiator = class {
+  constructor(config) {
+    this.config = config;
+  }
+  // Use the config (Client ID, scopes OAuth Server, Endpoints, PKCEConsumer) to generate a new login url
+  // and simply return the url
+  signIn() {
+    return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
+      return _chunkOLT5HB3Gjs.generateOauthLoginUrl.call(void 0, this.config);
+    });
+  }
+  signOut() {
+    return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
+      return _chunkOLT5HB3Gjs.generateOauthLogoutUrl.call(void 0, this.config);
+    });
+  }
+};
+
+// src/server/ServerAuthenticationResolver.ts
+
 var ServerAuthenticationResolver = class _ServerAuthenticationResolver {
   constructor(authConfig, storage, endpointOverrides) {
     this.authConfig = authConfig;
     this.storage = storage;
     this.endpointOverrides = endpointOverrides;
-    console.log("ServerAuthenticationResolver constructor", {
-      authConfig,
-      storage,
-      endpointOverrides
-    });
-    this.pkceProducer = new (0, _chunk7K3QN2ATjs.GenericPublicClientPKCEProducer)(storage);
-  }
-  validateExistingSession() {
-    throw new Error("Method not implemented.");
+    this.pkceProducer = new GenericPublicClientPKCEProducer(storage);
   }
   init() {
     return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
-      this.endpoints = yield _chunk7K3QN2ATjs.getEndpointsWithOverrides.call(void 0, 
+      this.endpoints = yield _chunkOLT5HB3Gjs.getEndpointsWithOverrides.call(void 0, 
         this.authConfig.oauthServer,
         this.endpointOverrides
       );
@@ -70,7 +106,7 @@ var ServerAuthenticationResolver = class _ServerAuthenticationResolver {
       if (!this.oauth2client) yield this.init();
       const codeVerifier = yield this.pkceProducer.getCodeVerifier();
       if (!codeVerifier) throw new Error("Code verifier not found in storage");
-      const tokens = yield _chunk7K3QN2ATjs.exchangeTokens.call(void 0, 
+      const tokens = yield _chunkOLT5HB3Gjs.exchangeTokens.call(void 0, 
         code,
         state,
         this.pkceProducer,
@@ -80,13 +116,13 @@ var ServerAuthenticationResolver = class _ServerAuthenticationResolver {
         this.endpoints
         // clean up types here to avoid the ! operator
       );
-      _chunk7K3QN2ATjs.storeTokens.call(void 0, this.storage, tokens);
+      _chunkOLT5HB3Gjs.storeTokens.call(void 0, this.storage, tokens);
       return tokens;
     });
   }
   getSessionData() {
     return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
-      const storageData = _chunk7K3QN2ATjs.retrieveTokens.call(void 0, this.storage);
+      const storageData = _chunkOLT5HB3Gjs.retrieveTokens.call(void 0, this.storage);
       if (!storageData) return null;
       return {
         authenticated: !!storageData.id_token,
@@ -115,7 +151,7 @@ function resolveOAuthAccessCode(code, state, storage, config) {
     var _a;
     const authSessionService = yield ServerAuthenticationResolver.build(
       _chunkCRTRMMJ7js.__spreadProps.call(void 0, _chunkCRTRMMJ7js.__spreadValues.call(void 0, {}, config), {
-        oauthServer: (_a = config.oauthServer) != null ? _a : _chunk7K3QN2ATjs.DEFAULT_AUTH_SERVER
+        oauthServer: (_a = config.oauthServer) != null ? _a : _chunkOLT5HB3Gjs.AUTH_SERVER
       }),
       storage,
       config.endpointOverrides
@@ -130,12 +166,12 @@ function buildLoginUrl(config, storage) {
   return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
     var _a, _b, _c;
     const state = (_a = config.state) != null ? _a : Math.random().toString(36).substring(2);
-    const scopes = (_b = config.scopes) != null ? _b : _chunk7K3QN2ATjs.DEFAULT_SCOPES;
-    const pkceProducer = new (0, _chunk7K3QN2ATjs.GenericPublicClientPKCEProducer)(storage);
-    const authInitiator = new (0, _chunk7K3QN2ATjs.GenericAuthenticationInitiator)(_chunkCRTRMMJ7js.__spreadProps.call(void 0, _chunkCRTRMMJ7js.__spreadValues.call(void 0, {}, config), {
+    const scopes = (_b = config.scopes) != null ? _b : _chunkOLT5HB3Gjs.DEFAULT_SCOPES;
+    const pkceProducer = new GenericPublicClientPKCEProducer(storage);
+    const authInitiator = new GenericAuthenticationInitiator(_chunkCRTRMMJ7js.__spreadProps.call(void 0, _chunkCRTRMMJ7js.__spreadValues.call(void 0, {}, config), {
       state,
       scopes,
-      oauthServer: (_c = config.oauthServer) != null ? _c : _chunk7K3QN2ATjs.DEFAULT_AUTH_SERVER,
+      oauthServer: (_c = config.oauthServer) != null ? _c : _chunkOLT5HB3Gjs.AUTH_SERVER,
       // When retrieving the PKCE challenge on the server-side, we produce it and store it in the session
       pkceConsumer: pkceProducer
     }));
@@ -143,6 +179,17 @@ function buildLoginUrl(config, storage) {
   });
 }
 
+// src/server/session.ts
+var _jwt = require('oslo/jwt');
+function getUser(storage) {
+  return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
+    var _a, _b;
+    const tokens = _chunkOLT5HB3Gjs.retrieveTokens.call(void 0, storage);
+    if (!tokens) return null;
+    return (_b = (_a = _jwt.parseJWT.call(void 0, tokens.id_token)) == null ? void 0 : _a.payload) != null ? _b : null;
+  });
+}
+
 // src/shared/GenericAuthenticationRefresher.ts
 
 var GenericAuthenticationRefresher = class _GenericAuthenticationRefresher {
@@ -150,14 +197,10 @@ var GenericAuthenticationRefresher = class _GenericAuthenticationRefresher {
     this.authConfig = authConfig;
     this.storage = storage;
     this.endpointOverrides = endpointOverrides;
-    console.log("GenericAuthenticationRefresher constructor", {
-      authConfig,
-      endpointOverrides
-    });
   }
   init() {
     return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
-      this.endpoints = yield _chunk7K3QN2ATjs.getEndpointsWithOverrides.call(void 0, 
+      this.endpoints = yield _chunkOLT5HB3Gjs.getEndpointsWithOverrides.call(void 0, 
         this.authConfig.oauthServer,
         this.endpointOverrides
       );
@@ -186,13 +229,13 @@ var GenericAuthenticationRefresher = class _GenericAuthenticationRefresher {
   refreshTokens() {
     return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
       if (!this.oauth2client) yield this.init();
-      const tokens = _chunk7K3QN2ATjs.retrieveTokens.call(void 0, this.storage);
+      const tokens = _chunkOLT5HB3Gjs.retrieveTokens.call(void 0, this.storage);
       if (!(tokens == null ? void 0 : tokens.refresh_token)) throw new Error("No refresh token available");
       const oauth2Client = this.oauth2client;
       const refreshedTokens = yield oauth2Client.refreshAccessToken(
         tokens.refresh_token
       );
-      _chunk7K3QN2ATjs.storeTokens.call(void 0, this.storage, refreshedTokens);
+      _chunkOLT5HB3Gjs.storeTokens.call(void 0, this.storage, refreshedTokens);
       return tokens;
     });
   }
@@ -204,7 +247,7 @@ function refreshTokens(storage, config) {
     var _a;
     const refresher = yield GenericAuthenticationRefresher.build(
       _chunkCRTRMMJ7js.__spreadProps.call(void 0, _chunkCRTRMMJ7js.__spreadValues.call(void 0, {}, config), {
-        oauthServer: (_a = config.oauthServer) != null ? _a : _chunk7K3QN2ATjs.DEFAULT_AUTH_SERVER
+        oauthServer: (_a = config.oauthServer) != null ? _a : _chunkOLT5HB3Gjs.AUTH_SERVER
       }),
       storage,
       config.endpointOverrides
@@ -219,5 +262,7 @@ function refreshTokens(storage, config) {
 
 
 
-exports.CookieStorage = CookieStorage; exports.resolveOAuthAccessCode = resolveOAuthAccessCode; exports.isLoggedIn = isLoggedIn; exports.buildLoginUrl = buildLoginUrl; exports.refreshTokens = refreshTokens;
-//# sourceMappingURL=chunk-6RFRDWIP.js.map
+
+
+exports.CookieStorage = CookieStorage; exports.GenericPublicClientPKCEProducer = GenericPublicClientPKCEProducer; exports.resolveOAuthAccessCode = resolveOAuthAccessCode; exports.isLoggedIn = isLoggedIn; exports.buildLoginUrl = buildLoginUrl; exports.getUser = getUser; exports.refreshTokens = refreshTokens;
+//# sourceMappingURL=chunk-T47HULF6.js.map