@civic/auth 0.0.1-beta.4 → 0.0.1-beta.6

package/dist/react.js

@@ -1,7 +1,7 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
 
-var _chunkWPISYQG3js = require('./chunk-WPISYQG3.js');
+var _chunkMVO4UZ2Ajs = require('./chunk-MVO4UZ2A.js');
 
 
 
@@ -12,7 +12,10 @@ var _chunkWPISYQG3js = require('./chunk-WPISYQG3.js');
 
 
 
-var _chunkOLT5HB3Gjs = require('./chunk-OLT5HB3G.js');
+
+
+
+var _chunkYNLXRD5Ljs = require('./chunk-YNLXRD5L.js');
 
 
 
@@ -55,15 +58,31 @@ var useAuth = () => {
 
 // src/react/providers/SessionProvider.tsx
 
+
+
 var _jsxruntime = require('react/jsx-runtime');
 var defaultSession = {
   authenticated: false,
   idToken: void 0,
   accessToken: void 0,
-  displayMode: "iframe"
+  displayMode: "iframe",
+  iframeRef: null,
+  setAuthResponseUrl: () => {
+  }
 };
 var SessionContext = _react.createContext.call(void 0, defaultSession);
-var SessionProvider = ({ children, session }) => /* @__PURE__ */ _jsxruntime.jsx.call(void 0, SessionContext.Provider, { value: session || defaultSession, children });
+var SessionProvider = ({
+  children,
+  session,
+  iframeRef,
+  setAuthResponseUrl
+}) => /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
+  SessionContext.Provider,
+  {
+    value: _chunkCRTRMMJ7js.__spreadProps.call(void 0, _chunkCRTRMMJ7js.__spreadValues.call(void 0, {}, session || defaultSession), { iframeRef, setAuthResponseUrl }),
+    children
+  }
+);
 
 // src/react/hooks/useSession.tsx
 var useSession = () => {
@@ -147,26 +166,18 @@ var useToken = () => {
 var UserContext = _react.createContext.call(void 0, null);
 var UserProvider = ({
   children,
-  userInfoService
+  storage
 }) => {
   const { isLoading: authLoading, error: authError } = useAuth();
   const session = useSession();
-  const { forwardedTokens, idToken, accessToken, refreshToken } = useToken();
+  const { accessToken } = useToken();
   const { signIn, signOut } = useAuth();
   const fetchUser = () => _chunkCRTRMMJ7js.__async.call(void 0, void 0, null, function* () {
-    if (!accessToken || !userInfoService) {
-      return null;
-    }
-    const user2 = yield userInfoService == null ? void 0 : userInfoService.getUserInfo(accessToken, idToken);
-    if (!user2) {
+    if (!accessToken) {
       return null;
     }
-    return _chunkCRTRMMJ7js.__spreadProps.call(void 0, _chunkCRTRMMJ7js.__spreadValues.call(void 0, {}, user2), {
-      forwardedTokens,
-      idToken,
-      accessToken,
-      refreshToken
-    });
+    const userSession = new (0, _chunkYNLXRD5Ljs.GenericUserSession)(storage);
+    return userSession.get();
   });
   const {
     data: user,
@@ -205,344 +216,7 @@ var UserProvider = ({
 
 
 
-// src/services/UserInfoService.ts
-
-var UserInfoServiceImpl = class {
-  constructor(endpoints) {
-    this.endpoints = endpoints;
-  }
-  extractUserFromIdToken(idToken) {
-    const parsedJWT = _jwt.parseJWT.call(void 0, idToken);
-    if (!parsedJWT) {
-      return null;
-    }
-    return parsedJWT.payload;
-  }
-  getUserInfo(accessToken, idToken) {
-    return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
-      if (idToken) {
-        return this.extractUserFromIdToken(idToken);
-      }
-      const userInfo = yield fetch(this.endpoints.userinfo, {
-        headers: { Authorization: `Bearer ${accessToken}` }
-      });
-      return userInfo.json();
-    });
-  }
-};
-
-// src/services/SessionService.ts
-var _oauth2 = require('oslo/oauth2');
-var AuthSessionServiceImpl = class {
-  constructor(clientId, redirectUrl, oauthServer, inputEndpoints) {
-    this.clientId = clientId;
-    this.redirectUrl = redirectUrl;
-    this.oauthServer = oauthServer;
-    this.inputEndpoints = inputEndpoints;
-    this.codeVerifier = void 0;
-    this.refreshTokenTimeout = null;
-    this.codeVerifier = this.getCodeVerifier();
-    this.endpoints = inputEndpoints;
-    this.redirectUrl = redirectUrl;
-  }
-  getCodeVerifier() {
-    return _oauth2.generateCodeVerifier.call(void 0, );
-  }
-  getUserInfoService() {
-    return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
-      if (this.userInfoService) {
-        return this.userInfoService;
-      }
-      const endpoints = yield this.getEndpoints();
-      this.userInfoService = new UserInfoServiceImpl(endpoints);
-      return this.userInfoService;
-    });
-  }
-  getEndpoints() {
-    return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
-      var _a;
-      if ((_a = this.endpoints) == null ? void 0 : _a.auth) {
-        return this.endpoints;
-      }
-      const jwksEndpoints = yield _chunkOLT5HB3Gjs.getOauthEndpoints.call(void 0, this.oauthServer);
-      return this.endpoints ? _chunkCRTRMMJ7js.__spreadValues.call(void 0, _chunkCRTRMMJ7js.__spreadValues.call(void 0, {}, this.endpoints), jwksEndpoints) : jwksEndpoints;
-    });
-  }
-  getOauth2Client() {
-    return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
-      if (this.oauth2Client) {
-        return this.oauth2Client;
-      }
-      const endpoints = yield this.getEndpoints();
-      this.oauth2Client = _chunkOLT5HB3Gjs.buildOauth2Client.call(void 0, 
-        this.clientId,
-        this.redirectUrl,
-        endpoints
-      );
-      return this.oauth2Client;
-    });
-  }
-  getSessionData() {
-    console.log("getSessionData", this.clientId);
-    const storedItem = localStorage.getItem(`civic-auth:${this.clientId}`) || "{}";
-    console.log("stored item", storedItem);
-    return JSON.parse(storedItem);
-  }
-  updateSessionData(data) {
-    localStorage.setItem(
-      `civic-auth:${this.clientId}`,
-      JSON.stringify(_chunkCRTRMMJ7js.__spreadValues.call(void 0, {}, data))
-    );
-  }
-  getUser() {
-    return JSON.parse(
-      localStorage.getItem(`civic-auth:${this.clientId}:user`) || "{}"
-    );
-  }
-  setUser(data) {
-    localStorage.setItem(
-      `civic-auth:${this.clientId}:user`,
-      JSON.stringify(data === null ? {} : data)
-    );
-  }
-  clearSessionData() {
-    localStorage.setItem(`civic-auth:${this.clientId}`, JSON.stringify({}));
-  }
-  getAuthorizationUrlWithChallenge(state, scopes) {
-    return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
-      var _a;
-      const oauth2Client = yield this.getOauth2Client();
-      if ((_a = this.endpoints) == null ? void 0 : _a.challenge) {
-        const challenge = yield fetch(this.endpoints.challenge).then(
-          (res) => res.json().then((data) => data.challenge)
-        );
-        const oAuthUrl = yield oauth2Client.createAuthorizationURL({
-          state,
-          scopes
-        });
-        oAuthUrl.searchParams.append("code_challenge", challenge);
-        oAuthUrl.searchParams.append("code_challenge_method", "S256");
-        return oAuthUrl;
-      }
-      return oauth2Client.createAuthorizationURL({
-        state,
-        codeVerifier: this.codeVerifier,
-        codeChallengeMethod: "S256",
-        scopes
-      });
-    });
-  }
-  getAuthorizationUrl(scopes, displayMode, nonce) {
-    return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
-      const state = _chunkOLT5HB3Gjs.generateState.call(void 0, displayMode);
-      const existingSessionData = this.getSessionData();
-      this.updateSessionData(_chunkCRTRMMJ7js.__spreadProps.call(void 0, _chunkCRTRMMJ7js.__spreadValues.call(void 0, {}, existingSessionData), {
-        codeVerifier: this.codeVerifier,
-        displayMode
-      }));
-      const oAuthUrl = yield this.getAuthorizationUrlWithChallenge(state, scopes);
-      if (nonce) {
-        oAuthUrl.searchParams.append("nonce", nonce);
-      }
-      oAuthUrl.searchParams.append("prompt", "consent");
-      return oAuthUrl.toString();
-    });
-  }
-  // TODO fix the Window reference
-  loadAuthorizationUrl(authorizationURL, displayMode) {
-    switch (displayMode) {
-      case "iframe":
-        break;
-      case "redirect":
-        window.location.href = authorizationURL;
-        break;
-      case "new_tab":
-        window.open(authorizationURL, "_blank");
-        break;
-      case "custom_tab":
-        break;
-    }
-  }
-  init() {
-    return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
-      yield this.getOauth2Client();
-      return this;
-    });
-  }
-  logout() {
-    return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
-      this.updateSessionData({ authenticated: false });
-    });
-  }
-  determineDisplayMode(displayMode) {
-    if (_chunkOLT5HB3Gjs.isPopupBlocked.call(void 0, ) && displayMode === "iframe") {
-      displayMode = "redirect";
-    }
-    return displayMode;
-  }
-  signIn(displayMode, scopes, nonce) {
-    return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
-      const authorizationURL = yield this.getAuthorizationUrl(
-        scopes,
-        displayMode,
-        nonce
-      );
-      this.loadAuthorizationUrl(authorizationURL, displayMode);
-    });
-  }
-  tokenExchange(responseUrl) {
-    return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
-      let session = this.getSessionData();
-      if (!session.authenticated) {
-        const url = new URL(responseUrl);
-        const authorizationCode = url.searchParams.get("code");
-        const returnedState = url.searchParams.get("state");
-        if (!authorizationCode || !returnedState) {
-          throw new Error("Invalid authorization response");
-        }
-        const codeVerifier = session.codeVerifier;
-        const oauth2Client = yield this.getOauth2Client();
-        const tokens = yield oauth2Client.validateAuthorizationCode(
-          authorizationCode,
-          {
-            codeVerifier
-          }
-        );
-        try {
-          yield this.validateTokens(tokens);
-        } catch (error) {
-          console.error("tokenExchange tokens", { error, tokens });
-          throw new Error(
-            `OIDC tokens validation failed: ${error.message}`
-          );
-        }
-        const parsedDisplayMode = _chunkOLT5HB3Gjs.displayModeFromState.call(void 0, 
-          returnedState,
-          session.displayMode
-        );
-        session = _chunkCRTRMMJ7js.__spreadProps.call(void 0, _chunkCRTRMMJ7js.__spreadValues.call(void 0, {}, session), {
-          displayMode: parsedDisplayMode,
-          idToken: tokens.id_token,
-          authenticated: true,
-          state: returnedState,
-          accessToken: tokens.access_token,
-          refreshToken: tokens.refresh_token,
-          timestamp: Date.now(),
-          expiresIn: tokens.expires_in
-        });
-        this.updateSessionData(session);
-        const user = yield (yield this.getUserInfoService()).getUserInfo(tokens.access_token, tokens.id_token || null);
-        this.setUser(user);
-      }
-      this.setupTokenRefresh(session);
-      if (session.displayMode === "new_tab") {
-        window.close();
-      } else if (session.displayMode === "redirect") {
-      }
-      return session;
-    });
-  }
-  setupTokenRefresh(session) {
-    if (this.refreshTokenTimeout) {
-      clearTimeout(this.refreshTokenTimeout);
-    }
-    if (session.expiresIn) {
-      const elapsedTime = Date.now() - (session.timestamp || 0);
-      const remainingTime = session.expiresIn * 1e3 - elapsedTime;
-      const refreshTime = Math.max(0, remainingTime - 6e4);
-      this.refreshTokenTimeout = setTimeout(() => {
-        this.refreshToken().then((newSession) => {
-          console.log("Token refreshed successfully", newSession);
-        }).catch((error) => {
-          console.error("Failed to refresh token:", error);
-          this.updateSessionData({});
-        });
-      }, refreshTime);
-    }
-  }
-  refreshToken() {
-    return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
-      const sessionData = this.getSessionData();
-      if (!sessionData.refreshToken) {
-        throw new Error("No refresh token available");
-      }
-      const oauth2Client = yield this.getOauth2Client();
-      const tokens = yield oauth2Client.refreshAccessToken(
-        sessionData.refreshToken
-      );
-      const session = _chunkCRTRMMJ7js.__spreadProps.call(void 0, _chunkCRTRMMJ7js.__spreadValues.call(void 0, {}, sessionData), {
-        idToken: tokens.id_token,
-        authenticated: true,
-        accessToken: tokens.access_token,
-        refreshToken: tokens.refresh_token,
-        timestamp: Date.now(),
-        expiresIn: tokens.expires_in
-      });
-      this.updateSessionData(session);
-      this.setupTokenRefresh(session);
-      return session;
-    });
-  }
-  getUserInfo() {
-    return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
-      const sessionData = this.getSessionData();
-      if (!sessionData.accessToken) {
-        throw new Error("No access token available");
-      }
-      const userInfoService = yield this.getUserInfoService();
-      return userInfoService.getUserInfo(
-        sessionData.accessToken,
-        sessionData.idToken || null
-      );
-    });
-  }
-  /**
-   * Uses the jose library to validate a JWT token using the OAuth JWKS endpoint
-   * @returns {Promise<jose.JWTPayload>}
-   * @throws {Error} if the token is invalid
-   * @param tokens
-   */
-  validateTokens(tokens) {
-    return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
-      const endpoints = yield this.getEndpoints();
-      if (!this.oauth2Client) yield this.init();
-      return _chunkOLT5HB3Gjs.validateOauth2Tokens.call(void 0, 
-        tokens,
-        endpoints,
-        this.oauth2Client,
-        this.oauthServer
-      );
-    });
-  }
-  validateExistingSession() {
-    return _chunkCRTRMMJ7js.__async.call(void 0, this, null, function* () {
-      const sessionData = this.getSessionData();
-      try {
-        if (!sessionData.idToken || !sessionData.accessToken) {
-          const unAuthenticatedSession = _chunkCRTRMMJ7js.__spreadProps.call(void 0, _chunkCRTRMMJ7js.__spreadValues.call(void 0, {}, sessionData), { authenticated: false });
-          this.updateSessionData(unAuthenticatedSession);
-          return unAuthenticatedSession;
-        }
-        yield this.validateTokens({
-          id_token: sessionData.idToken,
-          access_token: sessionData.accessToken,
-          refresh_token: sessionData.refreshToken
-        });
-        sessionData.authenticated = true;
-        return sessionData;
-      } catch (error) {
-        console.warn("Failed to validate existing tokens", error);
-        const unAuthenticatedSession = {
-          authenticated: false
-        };
-        this.updateSessionData(unAuthenticatedSession);
-        return unAuthenticatedSession;
-      }
-    });
-  }
-};
-
-// src/react/components/CivicAuthIframeModal.tsx
+// src/react/components/CivicAuthIframeContainer.tsx
 
 
 // src/react/components/LoadingIcon.tsx
@@ -603,13 +277,12 @@ var CloseIcon = () => /* @__PURE__ */ _jsxruntime.jsxs.call(void 0,
 
 
 var CivicAuthIframe = _react.forwardRef.call(void 0, 
-  ({ authUrl, onLoad }, ref) => {
+  ({ onLoad }, ref) => {
     return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
       "iframe",
       {
-        id: _chunkOLT5HB3Gjs.IFRAME_ID,
+        id: _chunkYNLXRD5Ljs.IFRAME_ID,
         ref,
-        src: authUrl,
         className: "cac-h-96 cac-w-80 cac-border-none",
         onLoad
       }
@@ -618,25 +291,57 @@ var CivicAuthIframe = _react.forwardRef.call(void 0,
 );
 CivicAuthIframe.displayName = "CivicAuthIframe";
 
-// src/react/components/CivicAuthIframeModal.tsx
+// src/react/components/CivicAuthIframeContainer.tsx
 
-var CivicAuthIframeModal = ({
-  authUrl,
-  redirectUri,
-  setAuthResponseUrl,
+function NoChrome({
+  children
+}) {
+  return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _jsxruntime.Fragment, { children });
+}
+function IframeChrome({
+  children,
+  onClose
+}) {
+  return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
+    "div",
+    {
+      className: "cac-absolute cac-left-0 cac-top-0 cac-z-50 cac-flex cac-h-screen cac-w-screen cac-items-center cac-justify-center cac-bg-neutral-950 cac-bg-opacity-50",
+      onClick: onClose,
+      children: /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, 
+        "div",
+        {
+          className: "cac-relative cac-rounded-3xl cac-bg-white cac-p-6 cac-shadow-lg",
+          onClick: (e) => e.stopPropagation(),
+          children: [
+            /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
+              "button",
+              {
+                className: "cac-absolute cac-right-4 cac-top-4 cac-flex cac-cursor-pointer cac-items-center cac-justify-center cac-border-none cac-bg-transparent cac-p-1 cac-text-neutral-400",
+                onClick: onClose,
+                children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, CloseIcon, {})
+              }
+            ),
+            children
+          ]
+        }
+      )
+    }
+  );
+}
+var CivicAuthIframeContainer = ({
   onClose,
-  iframeRef,
-  redirectInProgress = false,
   closeOnRedirect = true
 }) => {
   const [isLoading, setIsLoading] = _react.useState.call(void 0, true);
+  const config = useConfig();
+  const { setAuthResponseUrl, iframeRef } = useSession();
   const processIframeUrl = _react.useCallback.call(void 0, () => {
-    if (iframeRef.current && iframeRef.current.contentWindow) {
+    if (iframeRef && iframeRef.current && iframeRef.current.contentWindow) {
       try {
         const iframeUrl = iframeRef.current.contentWindow.location.href;
-        if (iframeUrl.startsWith(redirectUri)) {
+        if (iframeUrl.startsWith(config.redirectUrl)) {
           setAuthResponseUrl(iframeUrl);
-          if (closeOnRedirect) onClose();
+          if (closeOnRedirect) onClose == null ? void 0 : onClose();
           return true;
         }
       } catch (e) {
@@ -644,12 +349,18 @@ var CivicAuthIframeModal = ({
       }
     }
     return false;
-  }, [closeOnRedirect, iframeRef, onClose, redirectUri, setAuthResponseUrl]);
+  }, [
+    closeOnRedirect,
+    config.redirectUrl,
+    iframeRef,
+    onClose,
+    setAuthResponseUrl
+  ]);
   const intervalId = _react.useRef.call(void 0, );
   const handleEscape = _react.useCallback.call(void 0, 
     (event) => {
       if (event.key === "Escape") {
-        onClose();
+        onClose == null ? void 0 : onClose();
       }
     },
     [onClose]
@@ -665,39 +376,11 @@ var CivicAuthIframeModal = ({
       clearInterval(intervalId.current);
     }
   };
-  return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
-    "div",
-    {
-      className: "cac-absolute cac-left-0 cac-top-0 cac-z-50 cac-flex cac-h-screen cac-w-screen cac-items-center cac-justify-center cac-bg-neutral-950 cac-bg-opacity-50",
-      onClick: onClose,
-      children: /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, 
-        "div",
-        {
-          className: "cac-relative cac-rounded-3xl cac-bg-white cac-p-6 cac-shadow-lg",
-          onClick: (e) => e.stopPropagation(),
-          children: [
-            /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
-              "button",
-              {
-                className: "cac-absolute cac-right-4 cac-top-4 cac-flex cac-cursor-pointer cac-items-center cac-justify-center cac-border-none cac-bg-transparent cac-p-1 cac-text-neutral-400",
-                onClick: onClose,
-                children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, CloseIcon, {})
-              }
-            ),
-            (isLoading || redirectInProgress) && /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "div", { className: "cac-absolute cac-inset-0 cac-flex cac-items-center cac-justify-center cac-rounded-3xl cac-bg-neutral-100", children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, LoadingIcon, {}) }),
-            /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
-              CivicAuthIframe,
-              {
-                ref: iframeRef,
-                authUrl,
-                onLoad: handleIframeLoad
-              }
-            )
-          ]
-        }
-      )
-    }
-  );
+  const WrapperComponent = config.modalIframe ? IframeChrome : NoChrome;
+  return /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, WrapperComponent, { onClose, children: [
+    isLoading && /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "div", { className: "cac-absolute cac-inset-0 cac-flex cac-items-center cac-justify-center cac-rounded-3xl cac-bg-neutral-100", children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, LoadingIcon, {}) }),
+    /* @__PURE__ */ _jsxruntime.jsx.call(void 0, CivicAuthIframe, { ref: iframeRef, onLoad: handleIframeLoad })
+  ] });
 };
 
 // src/config.ts
@@ -706,20 +389,27 @@ var authConfig = {
   oauthServer: "https://auth-dev.civic.com/oauth/"
 };
 
-// src/lib/windowUtil.ts
-var isWindowInIframe = (window2) => {
-  var _a;
-  if (typeof window2 !== "undefined") {
-    try {
-      if (((_a = window2 == null ? void 0 : window2.frameElement) == null ? void 0 : _a.id) === "civic-auth-iframe") {
-        return true;
-      }
-    } catch (_e) {
-      return false;
-    }
-  }
-  return false;
+// src/react/providers/ConfigProvider.tsx
+
+
+var defaultConfig = {
+  config: authConfig,
+  redirectUrl: "",
+  modalIframe: true
 };
+var ConfigContext = _react.createContext.call(void 0, defaultConfig);
+var ConfigProvider = ({
+  children,
+  config,
+  redirectUrl,
+  modalIframe
+}) => /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
+  ConfigContext.Provider,
+  {
+    value: { config, redirectUrl, modalIframe: !!modalIframe },
+    children
+  }
+);
 
 // src/shared/AuthProvider.tsx
 
@@ -732,28 +422,36 @@ if (typeof window !== "undefined") {
   globalThisObject = Function("return this")();
 }
 globalThisObject.globalThis = globalThisObject;
+function BlockDisplay({ children }) {
+  return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "div", { className: "cac-absolute cac-left-0 cac-top-0 cac-z-50 cac-flex cac-h-screen cac-w-screen cac-items-center cac-justify-center cac-bg-white", children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "div", { className: "cac-absolute cac-inset-0 cac-flex cac-items-center cac-justify-center cac-bg-white", children }) });
+}
 var AuthProvider = ({
   children,
   clientId,
   redirectUrl: inputRedirectUrl,
   config = authConfig,
-  nonce,
   onSignIn,
   onSignOut,
-  authServiceImpl,
-  serverSideTokenExchange
+  pkceConsumer,
+  nonce,
+  modalIframe = true
 }) => {
   const [iframeUrl, setIframeUrl] = _react.useState.call(void 0, null);
   const [currentUrl, setCurrentUrl] = _react.useState.call(void 0, null);
   const [isInIframe, setIsInIframe] = _react.useState.call(void 0, false);
   const [authResponseUrl, setAuthResponseUrl] = _react.useState.call(void 0, null);
   const [tokenExchangeError, setTokenExchangeError] = _react.useState.call(void 0, );
+  const [displayMode, setDisplayMode] = _react.useState.call(void 0, "iframe");
+  const [browserAuthenticationInitiator, setBrowserAuthenticationInitiator] = _react.useState.call(void 0, );
+  const [showIFrame, setShowIFrame] = _react.useState.call(void 0, false);
+  const [isRedirecting, setIsRedirecting] = _react.useState.call(void 0, false);
   const queryClient3 = _reactquery.useQueryClient.call(void 0, );
   const iframeRef = _react.useRef.call(void 0, null);
+  const serverBasedPKCE = pkceConsumer instanceof _chunkYNLXRD5Ljs.ConfidentialClientPKCEConsumer;
   _react.useEffect.call(void 0, () => {
     if (typeof globalThis.window !== "undefined") {
       setCurrentUrl(globalThis.window.location.href);
-      const isInIframeVal = isWindowInIframe(globalThis.window);
+      const isInIframeVal = _chunkYNLXRD5Ljs.isWindowInIframe.call(void 0, globalThis.window);
       setIsInIframe(isInIframeVal);
     }
   }, []);
@@ -761,26 +459,30 @@ var AuthProvider = ({
     () => (inputRedirectUrl || currentUrl || "").split("?")[0],
     [currentUrl, inputRedirectUrl]
   );
-  const authService = _react.useMemo.call(void 0, 
-    () => currentUrl ? authServiceImpl || new AuthSessionServiceImpl(
+  const [authService, setAuthService] = _react.useState.call(void 0, );
+  _react.useEffect.call(void 0, () => {
+    if (!currentUrl) return;
+    _chunkYNLXRD5Ljs.BrowserAuthenticationService.build({
       clientId,
       redirectUrl,
-      config == null ? void 0 : config.oauthServer,
-      config == null ? void 0 : config.endpoints
-    ) : null,
-    [currentUrl, clientId, redirectUrl, config, authServiceImpl]
-  );
-  const [userInfoService, setUserInfoService] = _react.useState.call(void 0, );
-  _react.useEffect.call(void 0, () => {
-    if (!authService) return;
-    authService.getUserInfoService().then(setUserInfoService);
-  }, [authService]);
+      oauthServer: config.oauthServer,
+      scopes: _chunkYNLXRD5Ljs.DEFAULT_SCOPES,
+      displayMode
+    }).then(setAuthService);
+  }, [currentUrl, clientId, redirectUrl, config, displayMode]);
   const {
     data: session,
     isLoading,
     error
   } = _reactquery.useQuery.call(void 0, {
-    queryKey: ["session", authResponseUrl, iframeUrl, currentUrl, isInIframe],
+    queryKey: [
+      "session",
+      authResponseUrl,
+      iframeUrl,
+      currentUrl,
+      isInIframe,
+      authService
+    ],
     queryFn: () => _chunkCRTRMMJ7js.__async.call(void 0, void 0, null, function* () {
       if (!authService) {
         return { authenticated: false };
@@ -789,12 +491,24 @@ var AuthProvider = ({
         authResponseUrl ? authResponseUrl : globalThis.window.location.href || ""
       );
       const code = url.searchParams.get("code");
-      if (code && !isInIframe && !serverSideTokenExchange) {
+      const state = url.searchParams.get("state");
+      if (!serverBasedPKCE && code && state && !isInIframe) {
         try {
-          console.log("AuthProvider useQuery code", { isInIframe, code });
-          const newSession = yield authService.tokenExchange(url.toString());
+          console.log("AuthProvider useQuery code", {
+            isInIframe,
+            code,
+            state
+          });
+          yield authService.tokenExchange(code, state);
+          const clientStorage = new (0, _chunkYNLXRD5Ljs.LocalStorageAdapter)();
+          const user = yield _chunkYNLXRD5Ljs.getUser.call(void 0, clientStorage);
+          if (!user) {
+            throw new Error("Failed to get user info");
+          }
+          const userSession = new (0, _chunkYNLXRD5Ljs.GenericUserSession)(clientStorage);
+          userSession.set(user);
           onSignIn == null ? void 0 : onSignIn();
-          return newSession;
+          return authService.getSessionData();
         } catch (error2) {
           setTokenExchangeError(error2);
           onSignIn == null ? void 0 : onSignIn(
@@ -812,39 +526,90 @@ var AuthProvider = ({
   });
   const signOutMutation = _reactquery.useMutation.call(void 0, {
     mutationFn: () => _chunkCRTRMMJ7js.__async.call(void 0, void 0, null, function* () {
-      authService == null ? void 0 : authService.updateSessionData({});
+      const authInitiator = getAuthInitiator();
+      authInitiator == null ? void 0 : authInitiator.signOut();
       setIframeUrl(null);
+      setShowIFrame(false);
       setAuthResponseUrl(null);
       onSignOut == null ? void 0 : onSignOut();
     }),
     onSuccess: () => {
       queryClient3.setQueryData(
-        ["session", authResponseUrl, iframeUrl, currentUrl, isInIframe],
+        [
+          "session",
+          authResponseUrl,
+          iframeUrl,
+          currentUrl,
+          isInIframe,
+          authService
+        ],
         null
       );
     }
   });
+  const getAuthInitiator = _react.useCallback.call(void 0, 
+    (overrideDisplayMode) => {
+      const useDisplayMode = overrideDisplayMode || displayMode;
+      if (!pkceConsumer) {
+        return null;
+      }
+      return browserAuthenticationInitiator || new (0, _chunkYNLXRD5Ljs.BrowserAuthenticationInitiator)({
+        pkceConsumer,
+        // generate and retrieve the challenge client-side
+        clientId,
+        redirectUrl,
+        state: _chunkYNLXRD5Ljs.generateState.call(void 0, useDisplayMode),
+        scopes: _chunkYNLXRD5Ljs.DEFAULT_SCOPES,
+        displayMode: useDisplayMode,
+        oauthServer: config.oauthServer,
+        // the endpoints to use for the login (if not obtained from the auth server
+        endpointOverrides: config.endpoints,
+        nonce
+      });
+    },
+    [
+      displayMode,
+      browserAuthenticationInitiator,
+      clientId,
+      redirectUrl,
+      config.oauthServer,
+      config.endpoints,
+      pkceConsumer,
+      nonce
+    ]
+  );
   const signIn = _react.useCallback.call(void 0, 
     (overrideDisplayMode = "iframe") => _chunkCRTRMMJ7js.__async.call(void 0, void 0, null, function* () {
-      if (!authService) return;
-      const url = yield authService.getAuthorizationUrl(
-        // This is the default scope. We will eventually pull this from the partner dashboard
-        _chunkOLT5HB3Gjs.DEFAULT_SCOPES,
-        overrideDisplayMode,
-        nonce
-      );
+      setDisplayMode(overrideDisplayMode);
+      const authInitiator = getAuthInitiator(overrideDisplayMode);
+      setBrowserAuthenticationInitiator(authInitiator);
       if (overrideDisplayMode === "iframe") {
-        setIframeUrl(url);
-        return;
+        setShowIFrame(true);
+      } else if (overrideDisplayMode === "redirect") {
+        setIsRedirecting(true);
       }
-      authService.loadAuthorizationUrl(url, overrideDisplayMode);
+      authInitiator == null ? void 0 : authInitiator.signIn(iframeRef.current);
     }),
-    [authService, nonce]
+    [getAuthInitiator]
   );
   const isAuthenticated = _react.useMemo.call(void 0, 
     () => session ? session.authenticated : false,
     [session]
   );
+  const {
+    data: autoSignIn,
+    isLoading: autoSignInLoading,
+    error: autoSignInError
+  } = _reactquery.useQuery.call(void 0, {
+    queryKey: ["autoSignIn", modalIframe, redirectUrl, isAuthenticated],
+    queryFn: () => _chunkCRTRMMJ7js.__async.call(void 0, void 0, null, function* () {
+      if (!modalIframe && redirectUrl && !isAuthenticated && iframeRef.current) {
+        signIn("iframe");
+      }
+      return true;
+    }),
+    refetchOnWindowFocus: false
+  });
   const value = _react.useMemo.call(void 0, 
     () => ({
       isLoading,
@@ -857,23 +622,37 @@ var AuthProvider = ({
     }),
     [isLoading, error, signOutMutation, isAuthenticated, signIn]
   );
-  return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, AuthContext.Provider, { value, children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, SessionProvider, { session, children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, TokenProvider, { children: /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, UserProvider, { userInfoService, children: [
-    !isInIframe && iframeUrl && !(session == null ? void 0 : session.authenticated) && /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
-      CivicAuthIframeModal,
-      {
-        iframeRef,
-        authUrl: iframeUrl,
-        redirectUri: redirectUrl,
-        setAuthResponseUrl,
-        onClose: () => setIframeUrl(null)
-      }
-    ),
-    (tokenExchangeError || isLoading || error || isInIframe && !(tokenExchangeError || error)) && /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "div", { className: "cac-absolute cac-left-0 cac-top-0 cac-z-50 cac-flex cac-h-screen cac-w-screen cac-items-center cac-justify-center cac-bg-white", children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "div", { className: "cac-absolute cac-inset-0 cac-flex cac-items-center cac-justify-center cac-bg-white", children: tokenExchangeError || error ? /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, "div", { children: [
-      "Error: ",
-      (tokenExchangeError || error).message
-    ] }) : /* @__PURE__ */ _jsxruntime.jsx.call(void 0, LoadingIcon, {}) }) }),
-    children
-  ] }) }) }) });
+  return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, AuthContext.Provider, { value, children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
+    ConfigProvider,
+    {
+      config,
+      redirectUrl,
+      modalIframe,
+      children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
+        SessionProvider,
+        {
+          session,
+          setAuthResponseUrl,
+          iframeRef,
+          children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, TokenProvider, { children: /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, UserProvider, { storage: new (0, _chunkYNLXRD5Ljs.LocalStorageAdapter)(), children: [
+            modalIframe && !isInIframe && !(session == null ? void 0 : session.authenticated) && /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
+              "div",
+              {
+                style: showIFrame ? { display: "block" } : { display: "none" },
+                children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, CivicAuthIframeContainer, { onClose: () => setShowIFrame(false) })
+              }
+            ),
+            modalIframe && (isInIframe || isRedirecting || isLoading) && /* @__PURE__ */ _jsxruntime.jsx.call(void 0, BlockDisplay, { children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, LoadingIcon, {}) }),
+            (tokenExchangeError || error) && /* @__PURE__ */ _jsxruntime.jsx.call(void 0, BlockDisplay, { children: /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, "div", { children: [
+              "Error: ",
+              (tokenExchangeError || error).message
+            ] }) }),
+            children
+          ] }) })
+        }
+      )
+    }
+  ) });
 };
 
 // src/shared/CivicAuthProvider.tsx
@@ -883,7 +662,13 @@ require('@civic/auth/styles.css');
 var queryClient = new (0, _reactquery.QueryClient)();
 var CivicAuthProvider = (_a) => {
   var _b = _a, { children } = _b, props = _chunkCRTRMMJ7js.__objRest.call(void 0, _b, ["children"]);
-  return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _reactquery.QueryClientProvider, { client: queryClient, children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, AuthProvider, _chunkCRTRMMJ7js.__spreadProps.call(void 0, _chunkCRTRMMJ7js.__spreadValues.call(void 0, {}, props), { children })) });
+  return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _reactquery.QueryClientProvider, { client: queryClient, children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
+    AuthProvider,
+    _chunkCRTRMMJ7js.__spreadProps.call(void 0, _chunkCRTRMMJ7js.__spreadValues.call(void 0, {}, props), {
+      pkceConsumer: new (0, _chunkYNLXRD5Ljs.BrowserPublicClientPKCEProducer)(),
+      children
+    })
+  ) });
 };
 
 // src/react/providers/NextAuthProvider.tsx
@@ -901,7 +686,7 @@ var getCookieValue = (key, window2) => {
   const cookies = cookie.split(";");
   for (const c of cookies) {
     const [name, value] = c.trim().split("=");
-    if (name === key) {
+    if (value && name === key) {
       try {
         return JSON.parse(decodeURIComponent(value));
       } catch (e) {
@@ -957,28 +742,20 @@ var CivicNextAuthProvider = (_a) => {
   ]);
   const user = useUserCookie();
   const [redirectUrl, setRedirectUrl] = _react.useState.call(void 0, "");
-  const { clientId, oauthServer, callbackUrl, challengeUrl } = _chunkWPISYQG3js.resolveAuthConfig.call(void 0, );
+  const { clientId, oauthServer, callbackUrl, challengeUrl } = _chunkMVO4UZ2Ajs.resolveAuthConfig.call(void 0, );
   _react.useEffect.call(void 0, () => {
     if (typeof globalThis.window !== "undefined") {
       const currentUrl = globalThis.window.location.href;
-      setRedirectUrl(_chunkWPISYQG3js.resolveCallbackUrl.call(void 0, _chunkWPISYQG3js.resolveAuthConfig.call(void 0, ), currentUrl));
+      setRedirectUrl(_chunkMVO4UZ2Ajs.resolveCallbackUrl.call(void 0, _chunkMVO4UZ2Ajs.resolveAuthConfig.call(void 0, ), currentUrl));
     }
   }, [callbackUrl]);
-  const authService = _react.useMemo.call(void 0, () => {
-    if (redirectUrl && clientId && oauthServer) {
-      return new AuthSessionServiceImpl(clientId, redirectUrl, oauthServer, {
-        challenge: challengeUrl
-      });
-    }
-    return void 0;
-  }, [redirectUrl, clientId, oauthServer, challengeUrl]);
   return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _reactquery.QueryClientProvider, { client: queryClient2, children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
     AuthProvider,
     _chunkCRTRMMJ7js.__spreadProps.call(void 0, _chunkCRTRMMJ7js.__spreadValues.call(void 0, {}, props), {
+      redirectUrl,
       config: { oauthServer },
       clientId,
-      authServiceImpl: authService,
-      serverSideTokenExchange: true,
+      pkceConsumer: new (0, _chunkYNLXRD5Ljs.ConfidentialClientPKCEConsumer)(challengeUrl),
       children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, UserContext2.Provider, { value: user, children })
     })
   ) });
@@ -994,6 +771,16 @@ var useUser = () => {
   return context;
 };
 
+// src/react/hooks/useConfig.tsx
+
+var useConfig = () => {
+  const context = _react.useContext.call(void 0, ConfigContext);
+  if (!context) {
+    throw new Error("useConfig must be used within an ConfigProvider");
+  }
+  return context;
+};
+
 // src/react/components/UserButton.tsx
 
 
@@ -1070,7 +857,7 @@ var UserButton = ({
       /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, 
         "button",
         {
-          className: _chunkOLT5HB3Gjs.cn.call(void 0, 
+          className: _chunkYNLXRD5Ljs.cn.call(void 0, 
             "cac-flex cac-w-full cac-items-center cac-justify-between cac-gap-2 cac-rounded-full cac-border cac-border-neutral-500 cac-px-3 cac-py-2 cac-text-neutral-500 cac-transition-colors hover:cac-bg-neutral-200 hover:cac-bg-opacity-50",
             className
           ),
@@ -1108,7 +895,8 @@ var UserButton = ({
   return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
     "button",
     {
-      className: _chunkOLT5HB3Gjs.cn.call(void 0, 
+      "data-testid": "sign-in-button",
+      className: _chunkYNLXRD5Ljs.cn.call(void 0, 
         "cac-rounded-full cac-border cac-border-neutral-500 cac-px-3 cac-py-2 cac-transition-colors hover:cac-bg-neutral-200 hover:cac-bg-opacity-50",
         className
       ),
@@ -1128,7 +916,8 @@ var SignInButton = ({
   return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
     "button",
     {
-      className: _chunkOLT5HB3Gjs.cn.call(void 0, 
+      "data-testid": "sign-in-button",
+      className: _chunkYNLXRD5Ljs.cn.call(void 0, 
         "cac-rounded-full cac-border cac-border-neutral-500 cac-px-3 cac-py-2 cac-transition-colors hover:cac-bg-neutral-200 hover:cac-bg-opacity-50",
         className
       ),
@@ -1145,7 +934,7 @@ var SignOutButton = ({ className }) => {
   return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
     "button",
     {
-      className: _chunkOLT5HB3Gjs.cn.call(void 0, 
+      className: _chunkYNLXRD5Ljs.cn.call(void 0, 
         "cac-rounded-full cac-border cac-border-neutral-500 cac-px-3 cac-py-2 cac-transition-colors hover:cac-bg-neutral-200 hover:cac-bg-opacity-50",
         className
       ),
@@ -1158,7 +947,7 @@ var SignOutButton = ({ className }) => {
 // src/react/components/NextLogOut.tsx
 
 var NextLogOut = ({ children }) => {
-  const config = _chunkWPISYQG3js.resolveAuthConfig.call(void 0, );
+  const config = _chunkMVO4UZ2Ajs.resolveAuthConfig.call(void 0, );
   const logoutUrl = `${config.logoutUrl}`;
   return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "a", { href: logoutUrl, children });
 };
@@ -1175,5 +964,7 @@ var NextLogOut = ({ children }) => {
 
 
 
-exports.CivicAuthProvider = CivicAuthProvider; exports.CivicNextAuthProvider = CivicNextAuthProvider; exports.NextLogOut = NextLogOut; exports.SignInButton = SignInButton; exports.SignOutButton = SignOutButton; exports.UserButton = UserButton; exports.useAuth = useAuth; exports.useNextUser = useNextUser; exports.useSession = useSession; exports.useToken = useToken; exports.useUser = useUser; exports.useUserCookie = useUserCookie;
+
+
+exports.CivicAuthIframeContainer = CivicAuthIframeContainer; exports.CivicAuthProvider = CivicAuthProvider; exports.CivicNextAuthProvider = CivicNextAuthProvider; exports.NextLogOut = NextLogOut; exports.SignInButton = SignInButton; exports.SignOutButton = SignOutButton; exports.UserButton = UserButton; exports.useAuth = useAuth; exports.useConfig = useConfig; exports.useNextUser = useNextUser; exports.useSession = useSession; exports.useToken = useToken; exports.useUser = useUser; exports.useUserCookie = useUserCookie;
 //# sourceMappingURL=react.js.map