@civic/auth 0.0.1-beta.9 → 0.0.1-tsc.alpha.2

package/.rollup.cache/Users/flippie/civic/repos/civic-auth/packages/civic-auth-client/dist/esm/src/services/AuthenticationService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthenticationService.d.ts","sourceRoot":"","sources":["../../../../src/services/AuthenticationService.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,WAAW,EACX,SAAS,EAET,qBAAqB,EACrB,WAAW,EACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AAerE,OAAO,KAAK,EACV,uBAAuB,EACvB,sBAAsB,EACtB,YAAY,EACb,MAAM,qBAAqB,CAAC;AAM7B;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,8BAA+B,YAAW,uBAAuB;IAC5E,OAAO,CAAC,kBAAkB,CAAgD;IAE1E,SAAS,CAAC,MAAM,EAAE;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,EAAE,CAAC;QAEjB,WAAW,EAAE,WAAW,CAAC;QACzB,WAAW,EAAE,MAAM,CAAC;QAEpB,iBAAiB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAEvC,YAAY,EAAE,YAAY,CAAC;QAE3B,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;gBAEU,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM;IAKhC,yBAAyB,CAAC,WAAW,EAAE,MAAM;IAU7C,MAAM,CAAC,SAAS,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC;IA4CzD,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC;IAU7B,OAAO;CAKR;AAED;;;GAGG;AACH,qBAAa,8BAA+B,YAAW,uBAAuB;IAC5E,SAAS,CAAC,MAAM,EAAE;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;QAEf,iBAAiB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAEvC,YAAY,EAAE,YAAY,CAAC;KAC5B,CAAC;gBAEU,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM;IAShC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC;IAItB,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC;CAG9B;AAED,KAAK,2BAA2B,GAAG;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACvC,WAAW,EAAE,WAAW,CAAC;CAC1B,CAAC;AAEF;;;GAGG;AACH,qBAAa,4BAA6B,SAAQ,8BAA8B;IAQ5E,SAAS,CAAC,YAAY;IAPxB,OAAO,CAAC,YAAY,CAA2B;IAC/C,OAAO,CAAC,SAAS,CAAwB;gBAIvC,MAAM,EAAE,2BAA2B,EAEzB,YAAY,kCAAwC;IAgB1D,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAqBrB,aAAa,CACjB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,qBAAqB,CAAC;IAiC3B,cAAc,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAa7C,uBAAuB,IAAI,OAAO,CAAC,WAAW,CAAC;WAgCxC,KAAK,CAChB,MAAM,EAAE,2BAA2B,GAClC,OAAO,CAAC,sBAAsB,CAAC;CAMnC"}

package/.rollup.cache/Users/flippie/civic/repos/civic-auth/packages/civic-auth-client/dist/esm/src/services/AuthenticationService.js

@@ -0,0 +1,222 @@
+// Proposals for revised versions of the SessionService AKA AuthSessionService
+import { BrowserPublicClientPKCEProducer } from "@/services/PKCE.js";
+import { clearTokens, clearUser, exchangeTokens, generateOauthLoginUrl, generateOauthLogoutUrl, getEndpointsWithOverrides, retrieveTokens, storeTokens, validateOauth2Tokens, } from "@/shared/lib/util.js";
+import { displayModeFromState, generateState } from "@/lib/oauth.js";
+import { OAuth2Client } from "oslo/oauth2";
+import { LocalStorageAdapter } from "@/browser/storage.js";
+import { PopupError } from "@/services/types.js";
+import { removeParamsWithoutReload } from "@/lib/windowUtil.js";
+import { DEFAULT_OAUTH_GET_PARAMS } from "@/constants.js";
+import { validateLoginAppPostMessage } from "@/lib/postMessage.js";
+/**
+ * An authentication initiator that works on a browser. Since this is just triggering
+ * login and logout, session data is not stored here.
+ * An associated AuthenticationResolver would be needed to get the session data.
+ * Storage is needed for the code verifier, this is the domain of the PKCEConsumer
+ * The storage used by the PKCEConsumer should be available to the AuthenticationResolver.
+ *
+ * Example usage:
+ *
+ * 1) Client-only SPA -eg a react app with no server:
+ * new BrowserAuthenticationInitiator({
+ *   pkceConsumer: new BrowserPublicClientPKCEProducer(), // generate and retrieve the challenge client-side
+ *   ... other config
+ * })
+ *
+ * 2) Client-side of a client/server app - eg a react app with a backend:
+ * new BrowserAuthenticationInitiator({
+ *  pkceConsumer: new ConfidentialClientPKCEConsumer("https://myserver.com/pkce"), // get the challenge from the server
+ *  ... other config
+ * })
+ */
+export class BrowserAuthenticationInitiator {
+    postMessageHandler = null;
+    config;
+    constructor(config) {
+        this.config = config;
+        console.log("BrowserAuthenticationInitiator constructor", this.config);
+    }
+    async handleLoginAppPopupFailed(redirectUrl) {
+        console.warn("Login app popup failed open a popup, using redirect mode instead...", redirectUrl);
+        window.location.href = redirectUrl;
+    }
+    // Use the config (Client ID, scopes OAuth Server, Endpoints, PKCEConsumer) to generate a new login url
+    // and then use the display mode to decide how to send the user there
+    async signIn(iframeRef) {
+        const url = await generateOauthLoginUrl(this.config);
+        this.postMessageHandler = (event) => {
+            const thisURL = new URL(window.location.href);
+            if (event.origin.endsWith("civic.com") ||
+                thisURL.hostname === "localhost") {
+                if (!validateLoginAppPostMessage(event.data, this.config.clientId)) {
+                    console.log("Received invalid message from login app", event.data);
+                    return;
+                }
+                const loginMessage = event.data;
+                console.log("Received message from login app", event.data);
+                this.handleLoginAppPopupFailed(loginMessage.data.url);
+            }
+        };
+        window.addEventListener("message", this.postMessageHandler);
+        if (this.config.displayMode === "iframe") {
+            if (!iframeRef)
+                throw new Error("iframeRef is required for displayMode 'iframe'");
+            iframeRef.setAttribute("src", url.toString());
+        }
+        if (this.config.displayMode === "redirect") {
+            window.location.href = url.toString();
+        }
+        if (this.config.displayMode === "new_tab") {
+            try {
+                const popupWindow = window.open(url.toString(), "_blank");
+                console.log("signIn", popupWindow);
+                if (!popupWindow) {
+                    throw new PopupError("Failed to open popup window");
+                }
+            }
+            catch (error) {
+                console.error("popupWindow", error);
+                throw new PopupError("window.open has thrown: Failed to open popup window");
+            }
+        }
+        return url;
+    }
+    async signOut() {
+        const localStorage = new LocalStorageAdapter();
+        clearTokens(localStorage);
+        clearUser(localStorage);
+        // TODO open the iframe or new tab etc: the logout URL is not currently
+        // supported by on the oauth, so just clear state until then
+        const url = await generateOauthLogoutUrl(this.config);
+        return url;
+    }
+    cleanup() {
+        if (this.postMessageHandler) {
+            window.removeEventListener("message", this.postMessageHandler);
+        }
+    }
+}
+/** A general-purpose authentication initiator, that just generates urls, but lets
+ * the caller decide how to use them. This is useful for server-side applications
+ * that may serve this URL to their front-ends or just call them directly
+ */
+export class GenericAuthenticationInitiator {
+    config;
+    constructor(config) {
+        this.config = config;
+        console.log("GenericAuthenticationInitiator constructor", {
+            config,
+        });
+    }
+    // Use the config (Client ID, scopes OAuth Server, Endpoints, PKCEConsumer) to generate a new login url
+    // and simply return the url
+    async signIn() {
+        return generateOauthLoginUrl(this.config);
+    }
+    async signOut() {
+        return generateOauthLogoutUrl(this.config);
+    }
+}
+/**
+ * An authentication resolver that can run on the browser (i.e. a public client)
+ * It uses PKCE for security. PKCE and Session data are stored in local storage
+ */
+export class BrowserAuthenticationService extends BrowserAuthenticationInitiator {
+    pkceProducer;
+    oauth2client;
+    endpoints;
+    // TODO WIP - perhaps we want to keep resolver and initiator separate here
+    constructor(config, 
+    // Since we are running fully on the client, we produce as well as consume the PKCE challenge
+    pkceProducer = new BrowserPublicClientPKCEProducer()) {
+        console.log("BrowserAuthenticationService constructor", {
+            config,
+        });
+        super({
+            ...config,
+            state: generateState(config.displayMode),
+            // Store and retrieve the PKCE challenge in local storage
+            pkceConsumer: pkceProducer,
+        });
+        this.pkceProducer = pkceProducer;
+    }
+    // TODO too much code duplication here between the browser and the server variant.
+    // Suggestion for refactor: Standardise the config for AuthenticationResolvers and create a one-shot
+    // function for generating an oauth2client from it
+    async init() {
+        // resolve oauth config
+        this.endpoints = await getEndpointsWithOverrides(this.config.oauthServer, this.config.endpointOverrides);
+        this.oauth2client = new OAuth2Client(this.config.clientId, this.endpoints.auth, this.endpoints.token, {
+            redirectURI: this.config.redirectUrl,
+        });
+        return this;
+    }
+    // Two responsibilities:
+    // 1. resolve the auth code to get the tokens (should use library code)
+    // 2. store the tokens in local storage
+    async tokenExchange(code, state) {
+        if (!this.oauth2client)
+            await this.init();
+        const codeVerifier = await this.pkceProducer.getCodeVerifier();
+        if (!codeVerifier)
+            throw new Error("Code verifier not found in storage");
+        // exchange auth code for tokens
+        const tokens = await exchangeTokens(code, state, this.pkceProducer, this.oauth2client, // clean up types here to avoid the ! operator
+        this.config.oauthServer, this.endpoints);
+        storeTokens(new LocalStorageAdapter(), tokens);
+        // cleanup the browser window if needed
+        const parsedDisplayMode = displayModeFromState(state, this.config.displayMode);
+        if (parsedDisplayMode === "new_tab") {
+            // Close the popup window
+            window.close();
+        }
+        // these are the default oAuth params that get added to the URL in redirect which we want to remove if present
+        removeParamsWithoutReload(DEFAULT_OAUTH_GET_PARAMS);
+        return tokens;
+    }
+    // Get the session data from local storage
+    async getSessionData() {
+        const storageData = retrieveTokens(new LocalStorageAdapter());
+        if (!storageData)
+            return null;
+        return {
+            authenticated: !!storageData.id_token,
+            idToken: storageData.id_token,
+            accessToken: storageData.access_token,
+            refreshToken: storageData.refresh_token,
+        };
+    }
+    async validateExistingSession() {
+        try {
+            const sessionData = await this.getSessionData();
+            if (!sessionData?.idToken || !sessionData.accessToken) {
+                const unAuthenticatedSession = { ...sessionData, authenticated: false };
+                clearTokens(new LocalStorageAdapter());
+                return unAuthenticatedSession;
+            }
+            if (!this.endpoints || !this.oauth2client)
+                await this.init();
+            // this function will throw if any of the tokens are invalid
+            await validateOauth2Tokens({
+                access_token: sessionData.accessToken,
+                id_token: sessionData.idToken,
+                refresh_token: sessionData.refreshToken,
+            }, this.endpoints, this.oauth2client, this.config.oauthServer);
+            return sessionData;
+        }
+        catch (error) {
+            console.warn("Failed to validate existing tokens", error);
+            const unAuthenticatedSession = {
+                authenticated: false,
+            };
+            clearTokens(new LocalStorageAdapter());
+            return unAuthenticatedSession;
+        }
+    }
+    static async build(config) {
+        const resolver = new BrowserAuthenticationService(config);
+        await resolver.init();
+        return resolver;
+    }
+}
+//# sourceMappingURL=AuthenticationService.js.map

package/.rollup.cache/Users/flippie/civic/repos/civic-auth/packages/civic-auth-client/dist/esm/src/services/AuthenticationService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthenticationService.js","sourceRoot":"","sources":["../../../../src/services/AuthenticationService.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAS9E,OAAO,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EACL,WAAW,EACX,SAAS,EACT,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,yBAAyB,EACzB,cAAc,EACd,WAAW,EACX,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAM3D,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,8BAA8B;IACjC,kBAAkB,GAA2C,IAAI,CAAC;IAEhE,MAAM,CAcd;IAEF,YAAY,MAA0B;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,4CAA4C,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,yBAAyB,CAAC,WAAmB;QACjD,OAAO,CAAC,IAAI,CACV,qEAAqE,EACrE,WAAW,CACZ,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,WAAW,CAAC;IACrC,CAAC;IAED,uGAAuG;IACvG,qEAAqE;IACrE,KAAK,CAAC,MAAM,CAAC,SAAmC;QAC9C,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAErD,IAAI,CAAC,kBAAkB,GAAG,CAAC,KAAmB,EAAE,EAAE;YAChD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC9C,IACE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAClC,OAAO,CAAC,QAAQ,KAAK,WAAW,EAChC,CAAC;gBACD,IAAI,CAAC,2BAA2B,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACnE,OAAO,CAAC,GAAG,CAAC,yCAAyC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;oBACnE,OAAO;gBACT,CAAC;gBACD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAwB,CAAC;gBACpD,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC3D,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxD,CAAC;QACH,CAAC,CAAC;QACF,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC5D,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACzC,IAAI,CAAC,SAAS;gBACZ,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACpE,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YAC3C,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxC,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;gBAC1D,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;gBACnC,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,UAAU,CAAC,6BAA6B,CAAC,CAAC;gBACtD,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;gBACpC,MAAM,IAAI,UAAU,CAClB,qDAAqD,CACtD,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,YAAY,GAAG,IAAI,mBAAmB,EAAE,CAAC;QAC/C,WAAW,CAAC,YAAY,CAAC,CAAC;QAC1B,SAAS,CAAC,YAAY,CAAC,CAAC;QACxB,uEAAuE;QACvE,4DAA4D;QAC5D,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO;QACL,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,8BAA8B;IAC/B,MAAM,CAWd;IAEF,YAAY,MAA0B;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,4CAA4C,EAAE;YACxD,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,uGAAuG;IACvG,4BAA4B;IAC5B,KAAK,CAAC,MAAM;QACV,OAAO,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,OAAO;QACX,OAAO,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;CACF;AAWD;;;GAGG;AACH,MAAM,OAAO,4BAA6B,SAAQ,8BAA8B;IAQlE;IAPJ,YAAY,CAA2B;IACvC,SAAS,CAAwB;IAEzC,0EAA0E;IAC1E,YACE,MAAmC;IACnC,6FAA6F;IACnF,eAAe,IAAI,+BAA+B,EAAE;QAE9D,OAAO,CAAC,GAAG,CAAC,0CAA0C,EAAE;YACtD,MAAM;SACP,CAAC,CAAC;QACH,KAAK,CAAC;YACJ,GAAG,MAAM;YACT,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC;YACxC,yDAAyD;YACzD,YAAY,EAAE,YAAY;SAC3B,CAAC,CAAC;QAVO,iBAAY,GAAZ,YAAY,CAAwC;IAWhE,CAAC;IAED,kFAAkF;IAClF,oGAAoG;IACpG,kDAAkD;IAClD,KAAK,CAAC,IAAI;QACR,uBAAuB;QACvB,IAAI,CAAC,SAAS,GAAG,MAAM,yBAAyB,CAC9C,IAAI,CAAC,MAAM,CAAC,WAAW,EACvB,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAC9B,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,EACpB,IAAI,CAAC,SAAS,CAAC,IAAI,EACnB,IAAI,CAAC,SAAS,CAAC,KAAK,EACpB;YACE,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;SACrC,CACF,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wBAAwB;IACxB,uEAAuE;IACvE,uCAAuC;IACvC,KAAK,CAAC,aAAa,CACjB,IAAY,EACZ,KAAa;QAEb,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,CAAC;QAC/D,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAEzE,gCAAgC;QAChC,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,IAAI,EACJ,KAAK,EACL,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,YAAa,EAAE,8CAA8C;QAClE,IAAI,CAAC,MAAM,CAAC,WAAW,EACvB,IAAI,CAAC,SAAU,CAChB,CAAC;QAEF,WAAW,CAAC,IAAI,mBAAmB,EAAE,EAAE,MAAM,CAAC,CAAC;QAE/C,uCAAuC;QACvC,MAAM,iBAAiB,GAAG,oBAAoB,CAC5C,KAAK,EACL,IAAI,CAAC,MAAM,CAAC,WAAW,CACxB,CAAC;QAEF,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACpC,yBAAyB;YACzB,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;QACD,8GAA8G;QAC9G,yBAAyB,CAAC,wBAAwB,CAAC,CAAC;QACpD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,0CAA0C;IAC1C,KAAK,CAAC,cAAc;QAClB,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC;QAE9D,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAE9B,OAAO;YACL,aAAa,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ;YACrC,OAAO,EAAE,WAAW,CAAC,QAAQ;YAC7B,WAAW,EAAE,WAAW,CAAC,YAAY;YACrC,YAAY,EAAE,WAAW,CAAC,aAAa;SACxC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,uBAAuB;QAC3B,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAChD,IAAI,CAAC,WAAW,EAAE,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;gBACtD,MAAM,sBAAsB,GAAG,EAAE,GAAG,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;gBACxE,WAAW,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC;gBACvC,OAAO,sBAAsB,CAAC;YAChC,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,YAAY;gBAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAE7D,4DAA4D;YAC5D,MAAM,oBAAoB,CACxB;gBACE,YAAY,EAAE,WAAW,CAAC,WAAW;gBACrC,QAAQ,EAAE,WAAW,CAAC,OAAO;gBAC7B,aAAa,EAAE,WAAW,CAAC,YAAY;aACxC,EACD,IAAI,CAAC,SAAU,EACf,IAAI,CAAC,YAAa,EAClB,IAAI,CAAC,MAAM,CAAC,WAAW,CACxB,CAAC;YACF,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;YAC1D,MAAM,sBAAsB,GAAG;gBAC7B,aAAa,EAAE,KAAK;aACrB,CAAC;YACF,WAAW,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC;YACvC,OAAO,sBAAsB,CAAC;QAChC,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,KAAK,CAChB,MAAmC;QAEnC,MAAM,QAAQ,GAAG,IAAI,4BAA4B,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEtB,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF","sourcesContent":["// Proposals for revised versions of the SessionService AKA AuthSessionService\n\nimport type {\n  DisplayMode,\n  Endpoints,\n  LoginPostMessage,\n  OIDCTokenResponseBody,\n  SessionData,\n} from \"@/types.js\";\nimport { BrowserPublicClientPKCEProducer } from \"@/services/PKCE.js\";\nimport {\n  clearTokens,\n  clearUser,\n  exchangeTokens,\n  generateOauthLoginUrl,\n  generateOauthLogoutUrl,\n  getEndpointsWithOverrides,\n  retrieveTokens,\n  storeTokens,\n  validateOauth2Tokens,\n} from \"@/shared/lib/util.js\";\nimport { displayModeFromState, generateState } from \"@/lib/oauth.js\";\nimport { OAuth2Client } from \"oslo/oauth2\";\nimport { LocalStorageAdapter } from \"@/browser/storage.js\";\nimport type {\n  AuthenticationInitiator,\n  AuthenticationResolver,\n  PKCEConsumer,\n} from \"@/services/types.js\";\nimport { PopupError } from \"@/services/types.js\";\nimport { removeParamsWithoutReload } from \"@/lib/windowUtil.js\";\nimport { DEFAULT_OAUTH_GET_PARAMS } from \"@/constants.js\";\nimport { validateLoginAppPostMessage } from \"@/lib/postMessage.js\";\n\n/**\n * An authentication initiator that works on a browser. Since this is just triggering\n * login and logout, session data is not stored here.\n * An associated AuthenticationResolver would be needed to get the session data.\n * Storage is needed for the code verifier, this is the domain of the PKCEConsumer\n * The storage used by the PKCEConsumer should be available to the AuthenticationResolver.\n *\n * Example usage:\n *\n * 1) Client-only SPA -eg a react app with no server:\n * new BrowserAuthenticationInitiator({\n *   pkceConsumer: new BrowserPublicClientPKCEProducer(), // generate and retrieve the challenge client-side\n *   ... other config\n * })\n *\n * 2) Client-side of a client/server app - eg a react app with a backend:\n * new BrowserAuthenticationInitiator({\n *  pkceConsumer: new ConfidentialClientPKCEConsumer(\"https://myserver.com/pkce\"), // get the challenge from the server\n *  ... other config\n * })\n */\nexport class BrowserAuthenticationInitiator implements AuthenticationInitiator {\n  private postMessageHandler: null | ((event: MessageEvent) => void) = null;\n\n  protected config: {\n    clientId: string;\n    redirectUrl: string;\n    state: string;\n    scopes: string[];\n    // determines whether to trigger the login/logout in an iframe, a new browser window, or redirect the current one.\n    displayMode: DisplayMode;\n    oauthServer: string;\n    // the endpoints to use for the login (if not obtained from the auth server\n    endpointOverrides?: Partial<Endpoints>;\n    // used to get the PKCE challenge\n    pkceConsumer: PKCEConsumer;\n    // the nonce to use for the login\n    nonce?: string;\n  };\n\n  constructor(config: typeof this.config) {\n    this.config = config;\n    console.log(\"BrowserAuthenticationInitiator constructor\", this.config);\n  }\n\n  async handleLoginAppPopupFailed(redirectUrl: string) {\n    console.warn(\n      \"Login app popup failed open a popup, using redirect mode instead...\",\n      redirectUrl,\n    );\n    window.location.href = redirectUrl;\n  }\n\n  // Use the config (Client ID, scopes OAuth Server, Endpoints, PKCEConsumer) to generate a new login url\n  // and then use the display mode to decide how to send the user there\n  async signIn(iframeRef: HTMLIFrameElement | null): Promise<URL> {\n    const url = await generateOauthLoginUrl(this.config);\n\n    this.postMessageHandler = (event: MessageEvent) => {\n      const thisURL = new URL(window.location.href);\n      if (\n        event.origin.endsWith(\"civic.com\") ||\n        thisURL.hostname === \"localhost\"\n      ) {\n        if (!validateLoginAppPostMessage(event.data, this.config.clientId)) {\n          console.log(\"Received invalid message from login app\", event.data);\n          return;\n        }\n        const loginMessage = event.data as LoginPostMessage;\n        console.log(\"Received message from login app\", event.data);\n        this.handleLoginAppPopupFailed(loginMessage.data.url);\n      }\n    };\n    window.addEventListener(\"message\", this.postMessageHandler);\n    if (this.config.displayMode === \"iframe\") {\n      if (!iframeRef)\n        throw new Error(\"iframeRef is required for displayMode 'iframe'\");\n      iframeRef.setAttribute(\"src\", url.toString());\n    }\n    if (this.config.displayMode === \"redirect\") {\n      window.location.href = url.toString();\n    }\n    if (this.config.displayMode === \"new_tab\") {\n      try {\n        const popupWindow = window.open(url.toString(), \"_blank\");\n        console.log(\"signIn\", popupWindow);\n        if (!popupWindow) {\n          throw new PopupError(\"Failed to open popup window\");\n        }\n      } catch (error) {\n        console.error(\"popupWindow\", error);\n        throw new PopupError(\n          \"window.open has thrown: Failed to open popup window\",\n        );\n      }\n    }\n    return url;\n  }\n\n  async signOut(): Promise<URL> {\n    const localStorage = new LocalStorageAdapter();\n    clearTokens(localStorage);\n    clearUser(localStorage);\n    // TODO open the iframe or new tab etc: the logout URL is not currently\n    // supported by on the oauth, so just clear state until then\n    const url = await generateOauthLogoutUrl(this.config);\n    return url;\n  }\n\n  cleanup() {\n    if (this.postMessageHandler) {\n      window.removeEventListener(\"message\", this.postMessageHandler);\n    }\n  }\n}\n\n/** A general-purpose authentication initiator, that just generates urls, but lets\n * the caller decide how to use them. This is useful for server-side applications\n * that may serve this URL to their front-ends or just call them directly\n */\nexport class GenericAuthenticationInitiator implements AuthenticationInitiator {\n  protected config: {\n    clientId: string;\n    redirectUrl: string;\n    state: string;\n    scopes: string[];\n    oauthServer: string;\n    nonce?: string;\n    // the endpoints to use for the login (if not obtained from the auth server)\n    endpointOverrides?: Partial<Endpoints>;\n    // used to get the PKCE challenge\n    pkceConsumer: PKCEConsumer;\n  };\n\n  constructor(config: typeof this.config) {\n    this.config = config;\n    console.log(\"GenericAuthenticationInitiator constructor\", {\n      config,\n    });\n  }\n\n  // Use the config (Client ID, scopes OAuth Server, Endpoints, PKCEConsumer) to generate a new login url\n  // and simply return the url\n  async signIn(): Promise<URL> {\n    return generateOauthLoginUrl(this.config);\n  }\n\n  async signOut(): Promise<URL> {\n    return generateOauthLogoutUrl(this.config);\n  }\n}\n\ntype BrowserAuthenticationConfig = {\n  clientId: string;\n  redirectUrl: string;\n  scopes: string[];\n  oauthServer: string;\n  endpointOverrides?: Partial<Endpoints>;\n  displayMode: DisplayMode;\n};\n\n/**\n * An authentication resolver that can run on the browser (i.e. a public client)\n * It uses PKCE for security. PKCE and Session data are stored in local storage\n */\nexport class BrowserAuthenticationService extends BrowserAuthenticationInitiator {\n  private oauth2client: OAuth2Client | undefined;\n  private endpoints: Endpoints | undefined;\n\n  // TODO WIP - perhaps we want to keep resolver and initiator separate here\n  constructor(\n    config: BrowserAuthenticationConfig,\n    // Since we are running fully on the client, we produce as well as consume the PKCE challenge\n    protected pkceProducer = new BrowserPublicClientPKCEProducer(),\n  ) {\n    console.log(\"BrowserAuthenticationService constructor\", {\n      config,\n    });\n    super({\n      ...config,\n      state: generateState(config.displayMode),\n      // Store and retrieve the PKCE challenge in local storage\n      pkceConsumer: pkceProducer,\n    });\n  }\n\n  // TODO too much code duplication here between the browser and the server variant.\n  // Suggestion for refactor: Standardise the config for AuthenticationResolvers and create a one-shot\n  // function for generating an oauth2client from it\n  async init(): Promise<this> {\n    // resolve oauth config\n    this.endpoints = await getEndpointsWithOverrides(\n      this.config.oauthServer,\n      this.config.endpointOverrides,\n    );\n    this.oauth2client = new OAuth2Client(\n      this.config.clientId,\n      this.endpoints.auth,\n      this.endpoints.token,\n      {\n        redirectURI: this.config.redirectUrl,\n      },\n    );\n\n    return this;\n  }\n\n  // Two responsibilities:\n  // 1. resolve the auth code to get the tokens (should use library code)\n  // 2. store the tokens in local storage\n  async tokenExchange(\n    code: string,\n    state: string,\n  ): Promise<OIDCTokenResponseBody> {\n    if (!this.oauth2client) await this.init();\n    const codeVerifier = await this.pkceProducer.getCodeVerifier();\n    if (!codeVerifier) throw new Error(\"Code verifier not found in storage\");\n\n    // exchange auth code for tokens\n    const tokens = await exchangeTokens(\n      code,\n      state,\n      this.pkceProducer,\n      this.oauth2client!, // clean up types here to avoid the ! operator\n      this.config.oauthServer,\n      this.endpoints!, // clean up types here to avoid the ! operator\n    );\n\n    storeTokens(new LocalStorageAdapter(), tokens);\n\n    // cleanup the browser window if needed\n    const parsedDisplayMode = displayModeFromState(\n      state,\n      this.config.displayMode,\n    );\n\n    if (parsedDisplayMode === \"new_tab\") {\n      // Close the popup window\n      window.close();\n    }\n    // these are the default oAuth params that get added to the URL in redirect which we want to remove if present\n    removeParamsWithoutReload(DEFAULT_OAUTH_GET_PARAMS);\n    return tokens;\n  }\n\n  // Get the session data from local storage\n  async getSessionData(): Promise<SessionData | null> {\n    const storageData = retrieveTokens(new LocalStorageAdapter());\n\n    if (!storageData) return null;\n\n    return {\n      authenticated: !!storageData.id_token,\n      idToken: storageData.id_token,\n      accessToken: storageData.access_token,\n      refreshToken: storageData.refresh_token,\n    };\n  }\n\n  async validateExistingSession(): Promise<SessionData> {\n    try {\n      const sessionData = await this.getSessionData();\n      if (!sessionData?.idToken || !sessionData.accessToken) {\n        const unAuthenticatedSession = { ...sessionData, authenticated: false };\n        clearTokens(new LocalStorageAdapter());\n        return unAuthenticatedSession;\n      }\n      if (!this.endpoints || !this.oauth2client) await this.init();\n\n      // this function will throw if any of the tokens are invalid\n      await validateOauth2Tokens(\n        {\n          access_token: sessionData.accessToken,\n          id_token: sessionData.idToken,\n          refresh_token: sessionData.refreshToken,\n        },\n        this.endpoints!,\n        this.oauth2client!,\n        this.config.oauthServer,\n      );\n      return sessionData;\n    } catch (error) {\n      console.warn(\"Failed to validate existing tokens\", error);\n      const unAuthenticatedSession = {\n        authenticated: false,\n      };\n      clearTokens(new LocalStorageAdapter());\n      return unAuthenticatedSession;\n    }\n  }\n\n  static async build(\n    config: BrowserAuthenticationConfig,\n  ): Promise<AuthenticationResolver> {\n    const resolver = new BrowserAuthenticationService(config);\n    await resolver.init();\n\n    return resolver;\n  }\n}\n"]}

package/.rollup.cache/Users/flippie/civic/repos/civic-auth/packages/civic-auth-client/dist/esm/src/services/PKCE.d.ts

@@ -0,0 +1,20 @@
+import type { PKCEConsumer, PKCEProducer } from "@/services/types.js";
+import type { AuthStorage } from "@/types.js";
+/** A PKCE consumer that retrieves the challenge from a server endpoint */
+export declare class ConfidentialClientPKCEConsumer implements PKCEConsumer {
+    private pkceChallengeEndpoint;
+    constructor(pkceChallengeEndpoint: string);
+    getCodeChallenge(): Promise<string>;
+}
+/** A PKCE Producer that can generate and store a code verifier, but is agnostic as to the storage location */
+export declare class GenericPublicClientPKCEProducer implements PKCEProducer {
+    private storage;
+    constructor(storage: AuthStorage);
+    getCodeChallenge(): Promise<string>;
+    getCodeVerifier(): Promise<string | null>;
+}
+/** A PKCE Producer that is expected to run on a browser, and does not need a backend */
+export declare class BrowserPublicClientPKCEProducer extends GenericPublicClientPKCEProducer {
+    constructor();
+}
+//# sourceMappingURL=PKCE.d.ts.map

package/.rollup.cache/Users/flippie/civic/repos/civic-auth/packages/civic-auth-client/dist/esm/src/services/PKCE.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PKCE.d.ts","sourceRoot":"","sources":["../../../../src/services/PKCE.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAG9C,0EAA0E;AAC1E,qBAAa,8BAA+B,YAAW,YAAY;IACrD,OAAO,CAAC,qBAAqB;gBAArB,qBAAqB,EAAE,MAAM;IAC3C,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;CAO1C;AAED,8GAA8G;AAC9G,qBAAa,+BAAgC,YAAW,YAAY;IACtD,OAAO,CAAC,OAAO;gBAAP,OAAO,EAAE,WAAW;IAIlC,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;IASnC,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAGhD;AAED,wFAAwF;AACxF,qBAAa,+BAAgC,SAAQ,+BAA+B;;CAInF"}

package/.rollup.cache/Users/flippie/civic/repos/civic-auth/packages/civic-auth-client/dist/esm/src/services/PKCE.js

@@ -0,0 +1,44 @@
+import { deriveCodeChallenge } from "@/shared/lib/util.js";
+import { generateCodeVerifier } from "oslo/oauth2";
+import { LocalStorageAdapter } from "@/browser/storage.js";
+import { CodeVerifier } from "@/shared/lib/types.js";
+/** A PKCE consumer that retrieves the challenge from a server endpoint */
+export class ConfidentialClientPKCEConsumer {
+    pkceChallengeEndpoint;
+    constructor(pkceChallengeEndpoint) {
+        this.pkceChallengeEndpoint = pkceChallengeEndpoint;
+    }
+    async getCodeChallenge() {
+        const response = await fetch(`${this.pkceChallengeEndpoint}?appUrl=${window.location.origin}`);
+        const data = (await response.json());
+        return data.challenge;
+    }
+}
+/** A PKCE Producer that can generate and store a code verifier, but is agnostic as to the storage location */
+export class GenericPublicClientPKCEProducer {
+    storage;
+    constructor(storage) {
+        this.storage = storage;
+    }
+    // if there is already a verifier, return it,
+    // If not, create a new one and store it
+    async getCodeChallenge() {
+        // let verifier = await this.getCodeVerifier();
+        // if (!verifier) {
+        const verifier = generateCodeVerifier();
+        this.storage.set(CodeVerifier.COOKIE_NAME, verifier);
+        // }
+        return deriveCodeChallenge(verifier);
+    }
+    // if there is already a verifier, return it,
+    async getCodeVerifier() {
+        return this.storage.get(CodeVerifier.COOKIE_NAME);
+    }
+}
+/** A PKCE Producer that is expected to run on a browser, and does not need a backend */
+export class BrowserPublicClientPKCEProducer extends GenericPublicClientPKCEProducer {
+    constructor() {
+        super(new LocalStorageAdapter());
+    }
+}
+//# sourceMappingURL=PKCE.js.map

package/.rollup.cache/Users/flippie/civic/repos/civic-auth/packages/civic-auth-client/dist/esm/src/services/PKCE.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PKCE.js","sourceRoot":"","sources":["../../../../src/services/PKCE.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAG3D,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,0EAA0E;AAC1E,MAAM,OAAO,8BAA8B;IACrB;IAApB,YAAoB,qBAA6B;QAA7B,0BAAqB,GAArB,qBAAqB,CAAQ;IAAG,CAAC;IACrD,KAAK,CAAC,gBAAgB;QACpB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,IAAI,CAAC,qBAAqB,WAAW,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CACjE,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0B,CAAC;QAC9D,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;CACF;AAED,8GAA8G;AAC9G,MAAM,OAAO,+BAA+B;IACtB;IAApB,YAAoB,OAAoB;QAApB,YAAO,GAAP,OAAO,CAAa;IAAG,CAAC;IAE5C,6CAA6C;IAC7C,wCAAwC;IACxC,KAAK,CAAC,gBAAgB;QACpB,+CAA+C;QAC/C,mBAAmB;QACnB,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI;QACJ,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IACD,6CAA6C;IAC7C,KAAK,CAAC,eAAe;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IACpD,CAAC;CACF;AAED,wFAAwF;AACxF,MAAM,OAAO,+BAAgC,SAAQ,+BAA+B;IAClF;QACE,KAAK,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC;IACnC,CAAC;CACF","sourcesContent":["import { deriveCodeChallenge } from \"@/shared/lib/util.js\";\nimport { generateCodeVerifier } from \"oslo/oauth2\";\nimport { LocalStorageAdapter } from \"@/browser/storage.js\";\nimport type { PKCEConsumer, PKCEProducer } from \"@/services/types.js\";\nimport type { AuthStorage } from \"@/types.js\";\nimport { CodeVerifier } from \"@/shared/lib/types.js\";\n\n/** A PKCE consumer that retrieves the challenge from a server endpoint */\nexport class ConfidentialClientPKCEConsumer implements PKCEConsumer {\n  constructor(private pkceChallengeEndpoint: string) {}\n  async getCodeChallenge(): Promise<string> {\n    const response = await fetch(\n      `${this.pkceChallengeEndpoint}?appUrl=${window.location.origin}`,\n    );\n    const data = (await response.json()) as { challenge: string };\n    return data.challenge;\n  }\n}\n\n/** A PKCE Producer that can generate and store a code verifier, but is agnostic as to the storage location */\nexport class GenericPublicClientPKCEProducer implements PKCEProducer {\n  constructor(private storage: AuthStorage) {}\n\n  // if there is already a verifier, return it,\n  // If not, create a new one and store it\n  async getCodeChallenge(): Promise<string> {\n    // let verifier = await this.getCodeVerifier();\n    // if (!verifier) {\n    const verifier = generateCodeVerifier();\n    this.storage.set(CodeVerifier.COOKIE_NAME, verifier);\n    // }\n    return deriveCodeChallenge(verifier);\n  }\n  // if there is already a verifier, return it,\n  async getCodeVerifier(): Promise<string | null> {\n    return this.storage.get(CodeVerifier.COOKIE_NAME);\n  }\n}\n\n/** A PKCE Producer that is expected to run on a browser, and does not need a backend */\nexport class BrowserPublicClientPKCEProducer extends GenericPublicClientPKCEProducer {\n  constructor() {\n    super(new LocalStorageAdapter());\n  }\n}\n"]}

package/.rollup.cache/Users/flippie/civic/repos/civic-auth/packages/civic-auth-client/dist/esm/src/services/types.d.ts

@@ -0,0 +1,23 @@
+import type { OIDCTokenResponseBody, SessionData } from "@/types.js";
+export interface PKCEConsumer {
+    getCodeChallenge(): Promise<string>;
+}
+export interface PKCEProducer extends PKCEConsumer {
+    getCodeVerifier(): Promise<string | null>;
+}
+export interface AuthenticationInitiator {
+    signIn(iframeRef: HTMLIFrameElement | null): Promise<URL>;
+    signOut(): Promise<URL>;
+}
+export interface AuthenticationResolver {
+    tokenExchange(code: string, state: string): Promise<OIDCTokenResponseBody>;
+    getSessionData(): Promise<SessionData | null>;
+    validateExistingSession(): Promise<SessionData>;
+}
+export interface AuthenticationRefresher {
+    refreshTokens: () => Promise<OIDCTokenResponseBody>;
+}
+export declare class PopupError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=types.d.ts.map

package/.rollup.cache/Users/flippie/civic/repos/civic-auth/packages/civic-auth-client/dist/esm/src/services/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/services/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AASrE,MAAM,WAAW,YAAY;IAE3B,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACrC;AAGD,MAAM,WAAW,YAAa,SAAQ,YAAY;IAEhD,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC3C;AAGD,MAAM,WAAW,uBAAuB;IAEtC,MAAM,CAAC,SAAS,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAG1D,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;CACzB;AAGD,MAAM,WAAW,sBAAsB;IAKrC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAG3E,cAAc,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAG9C,uBAAuB,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACrD;AAED,qBAAa,UAAW,SAAQ,KAAK;gBACvB,OAAO,EAAE,MAAM;CAI5B"}

package/.rollup.cache/Users/flippie/civic/repos/civic-auth/packages/civic-auth-client/dist/esm/src/services/types.js

@@ -0,0 +1,7 @@
+export class PopupError extends Error {
+    constructor(message) {
+        super(message);
+        Object.setPrototypeOf(this, PopupError.prototype);
+    }
+}
+//# sourceMappingURL=types.js.map

package/.rollup.cache/Users/flippie/civic/repos/civic-auth/packages/civic-auth-client/dist/esm/src/services/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/services/types.ts"],"names":[],"mappings":"AAgDA,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF","sourcesContent":["import type { OIDCTokenResponseBody, SessionData } from \"@/types.js\";\n\n// A PKCEConsumer can get a code challenge to use in the login process\n// A PKCEProducer can also generate and store verifiers. The producer must also be a consumer in order to get the challenge from an existing flow\n// Examples:\n// - Client-only SPA: The SPA generates the code challenge and verifier, stores the verifier in state and returns the code challenge\n// Note - The SPA should use PKCEProducer instead to do both\n// - Client-side of a client/server app: The client calls the backend to get the challenge.\n// - Server-side: The server should generate a new stored verifier and derive the challenge from it.\nexport interface PKCEConsumer {\n  // Retrieve a new PKCE challenge\n  getCodeChallenge(): Promise<string>;\n}\n\n// All producers are consumers, because the producer can get its own challenge\nexport interface PKCEProducer extends PKCEConsumer {\n  // Retrieve the PKCE challenge from the session if one exists\n  getCodeVerifier(): Promise<string | null>;\n}\n\n// A service that can initiate requests to login or log out\nexport interface AuthenticationInitiator {\n  // trigger a new login\n  signIn(iframeRef: HTMLIFrameElement | null): Promise<URL>;\n\n  // trigger a new logout\n  signOut(): Promise<URL>;\n}\n\n// A service that can resolve an authentication request according to the OAuth Auth Code grant types\nexport interface AuthenticationResolver {\n  // Given an auth code, get the tokens from the auth server and store them. works in PKCE and non-PKCE environments\n  // Note, if we choose later to implement other grants, this method would move into a subinterface specifically\n  // for the authorization code grant type.\n  // The return type is just for convenience and can be ignored, as the same data would be provided by getSessionData\n  tokenExchange(code: string, state: string): Promise<OIDCTokenResponseBody>;\n\n  // If the tokens have already been retrieved, return them\n  getSessionData(): Promise<SessionData | null>;\n\n  // If an existing session is found, validate it and return the session data\n  validateExistingSession(): Promise<SessionData>;\n}\n\nexport interface AuthenticationRefresher {\n  refreshTokens: () => Promise<OIDCTokenResponseBody>;\n}\n\nexport class PopupError extends Error {\n  constructor(message: string) {\n    super(message);\n    Object.setPrototypeOf(this, PopupError.prototype);\n  }\n}\n"]}

package/.rollup.cache/Users/flippie/civic/repos/civic-auth/packages/civic-auth-client/dist/esm/src/shared/components/CivicAuthIframe.d.ts

@@ -0,0 +1,8 @@
+import React from "react";
+type CivicAuthIframeProps = {
+    onLoad?: () => void;
+};
+declare const CivicAuthIframe: React.ForwardRefExoticComponent<CivicAuthIframeProps & React.RefAttributes<HTMLIFrameElement>>;
+export type { CivicAuthIframeProps };
+export { CivicAuthIframe };
+//# sourceMappingURL=CivicAuthIframe.d.ts.map

package/.rollup.cache/Users/flippie/civic/repos/civic-auth/packages/civic-auth-client/dist/esm/src/shared/components/CivicAuthIframe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CivicAuthIframe.d.ts","sourceRoot":"","sources":["../../../../../src/shared/components/CivicAuthIframe.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAqB,MAAM,OAAO,CAAC;AAE1C,KAAK,oBAAoB,GAAG;IAC1B,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC;CACrB,CAAC;AAEF,QAAA,MAAM,eAAe,gGAWpB,CAAC;AAIF,YAAY,EAAE,oBAAoB,EAAE,CAAC;AAErC,OAAO,EAAE,eAAe,EAAE,CAAC"}

package/.rollup.cache/Users/flippie/civic/repos/civic-auth/packages/civic-auth-client/dist/esm/src/shared/components/CivicAuthIframe.js

@@ -0,0 +1,9 @@
+"use client";
+import { IFRAME_ID } from "@/constants.js";
+import React, { forwardRef } from "react";
+const CivicAuthIframe = forwardRef(({ onLoad }, ref) => {
+    return (React.createElement("iframe", { id: IFRAME_ID, ref: ref, className: "cac-h-[26rem] cac-w-full cac-border-none", onLoad: onLoad }));
+});
+CivicAuthIframe.displayName = "CivicAuthIframe";
+export { CivicAuthIframe };
+//# sourceMappingURL=CivicAuthIframe.js.map

package/.rollup.cache/Users/flippie/civic/repos/civic-auth/packages/civic-auth-client/dist/esm/src/shared/components/CivicAuthIframe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CivicAuthIframe.js","sourceRoot":"","sources":["../../../../../src/shared/components/CivicAuthIframe.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;AACb,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAM1C,MAAM,eAAe,GAAG,UAAU,CAChC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE;IAClB,OAAO,CACL,gCACE,EAAE,EAAE,SAAS,EACb,GAAG,EAAE,GAAG,EACR,SAAS,EAAC,0CAA0C,EACpD,MAAM,EAAE,MAAM,GACd,CACH,CAAC;AACJ,CAAC,CACF,CAAC;AAEF,eAAe,CAAC,WAAW,GAAG,iBAAiB,CAAC;AAIhD,OAAO,EAAE,eAAe,EAAE,CAAC","sourcesContent":["\"use client\";\nimport { IFRAME_ID } from \"@/constants.js\";\nimport React, { forwardRef } from \"react\";\n\ntype CivicAuthIframeProps = {\n  onLoad?: () => void;\n};\n\nconst CivicAuthIframe = forwardRef<HTMLIFrameElement, CivicAuthIframeProps>(\n  ({ onLoad }, ref) => {\n    return (\n      <iframe\n        id={IFRAME_ID}\n        ref={ref}\n        className=\"cac-h-[26rem] cac-w-full cac-border-none\"\n        onLoad={onLoad}\n      />\n    );\n  },\n);\n\nCivicAuthIframe.displayName = \"CivicAuthIframe\";\n\nexport type { CivicAuthIframeProps };\n\nexport { CivicAuthIframe };\n"]}

package/.rollup.cache/Users/flippie/civic/repos/civic-auth/packages/civic-auth-client/dist/esm/src/shared/components/CivicAuthIframeContainer.d.ts

@@ -0,0 +1,9 @@
+import React from "react";
+type CivicAuthIframeContainerProps = {
+    onClose?: () => void;
+    closeOnRedirect?: boolean;
+};
+declare const CivicAuthIframeContainer: ({ onClose, closeOnRedirect, }: CivicAuthIframeContainerProps) => React.JSX.Element;
+export type { CivicAuthIframeContainerProps };
+export { CivicAuthIframeContainer };
+//# sourceMappingURL=CivicAuthIframeContainer.d.ts.map

package/.rollup.cache/Users/flippie/civic/repos/civic-auth/packages/civic-auth-client/dist/esm/src/shared/components/CivicAuthIframeContainer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CivicAuthIframeContainer.d.ts","sourceRoot":"","sources":["../../../../../src/shared/components/CivicAuthIframeContainer.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAmD,MAAM,OAAO,CAAC;AAOxE,KAAK,6BAA6B,GAAG;IACnC,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAuCF,QAAA,MAAM,wBAAwB,kCAG3B,6BAA6B,sBA8F/B,CAAC;AAEF,YAAY,EAAE,6BAA6B,EAAE,CAAC;AAE9C,OAAO,EAAE,wBAAwB,EAAE,CAAC"}

package/.rollup.cache/Users/flippie/civic/repos/civic-auth/packages/civic-auth-client/dist/esm/src/shared/components/CivicAuthIframeContainer.js

@@ -0,0 +1,92 @@
+"use client";
+import React, { useCallback, useEffect, useRef, useState } from "react";
+import { LoadingIcon } from "@/shared/components/LoadingIcon.js";
+import { CloseIcon } from "@/shared/components/CloseIcon.js";
+import { CivicAuthIframe } from "@/shared/components/CivicAuthIframe.js";
+import { useAuth, useConfig, useIframe } from "@/shared/hooks/index.js";
+import { TOKEN_EXCHANGE_TRIGGER_TEXT } from "@/constants.js";
+function NoChrome({ children, }) {
+    return React.createElement("div", { className: "cac-relative" }, children);
+}
+function IframeChrome({ children, onClose, }) {
+    return (React.createElement("div", { className: "cac-absolute cac-left-0 cac-top-0 cac-z-50 cac-flex cac-h-screen cac-w-screen cac-min-w-72 cac-items-center cac-justify-center cac-bg-neutral-950 cac-bg-opacity-50", onClick: onClose },
+        React.createElement("div", { className: "cac-relative cac-overflow-hidden cac-rounded-3xl cac-bg-white cac-p-2 cac-shadow-lg sm:cac-p-6", onClick: (e) => e.stopPropagation() },
+            React.createElement("button", { className: "cac-absolute cac-right-4 cac-top-4 cac-flex cac-cursor-pointer cac-items-center cac-justify-center cac-border-none cac-bg-transparent cac-p-1 cac-text-neutral-400", onClick: onClose },
+                React.createElement(CloseIcon, null)),
+            children)));
+}
+const CivicAuthIframeContainer = ({ onClose, closeOnRedirect = true, }) => {
+    const [isLoading, setIsLoading] = useState(true);
+    const { isLoading: isAuthLoading } = useAuth();
+    const config = useConfig();
+    const { setAuthResponseUrl, iframeRef } = useIframe();
+    const processIframeUrl = useCallback(() => {
+        if (iframeRef && iframeRef.current && iframeRef.current.contentWindow) {
+            try {
+                const iframeUrl = iframeRef.current.contentWindow.location.href;
+                // we know that oauth has finished when the iframe redirects to our redirectUrl
+                if (iframeUrl.startsWith(config.redirectUrl)) {
+                    // we still want to show the spinner during redirect
+                    setIsLoading(true);
+                    const iframeBody = iframeRef.current.contentWindow.document.body.innerHTML;
+                    // If we're doing a server token exchange, we need to call the server a second time
+                    // using a fetch so that we're on the same domain and cookies can be sent and read
+                    // The server will use the presence of the code_verifier cookie to determine whether to do a token exchange or not.
+                    // On the initial (3rd party) redirect from the auth server, the cookie won't be sent, so the server-side callback route will just render a blank page,
+                    // and we'll do the exchange request from here, which will include the cookies.
+                    if (iframeBody.includes(TOKEN_EXCHANGE_TRIGGER_TEXT)) {
+                        console.log(`${TOKEN_EXCHANGE_TRIGGER_TEXT}, calling callback URL again...`);
+                        const params = new URL(iframeUrl).searchParams;
+                        const appUrl = globalThis.window?.location?.origin;
+                        fetch(`${config.redirectUrl}?${params.toString()}&appUrl=${appUrl}`);
+                    }
+                    else {
+                        // if we're doing token-exchange in the client, we can just set the authResponseUrl
+                        // to be handled by the auth provider
+                        setAuthResponseUrl(iframeUrl);
+                    }
+                    if (closeOnRedirect)
+                        onClose?.();
+                    return true; // Successfully processed the URL
+                }
+            }
+            catch {
+                // If we get here, the iframe hasn't redirected to our origin yet
+                console.log("Waiting for redirect...");
+            }
+        }
+        return false; // Haven't processed the URL yet
+    }, [
+        closeOnRedirect,
+        config.redirectUrl,
+        iframeRef,
+        onClose,
+        setAuthResponseUrl,
+    ]);
+    const intervalId = useRef();
+    const handleEscape = useCallback((event) => {
+        if (event.key === "Escape") {
+            onClose?.();
+        }
+    }, [onClose]);
+    // handle Escape
+    useEffect(() => {
+        window.addEventListener("keydown", handleEscape);
+        return () => window.removeEventListener("keydown", handleEscape);
+    });
+    const handleIframeLoad = () => {
+        setIsLoading(false);
+        console.log("handleIframeLoad");
+        if (processIframeUrl() && intervalId.current) {
+            clearInterval(intervalId.current);
+        }
+    };
+    const showLoadingIcon = isLoading || isAuthLoading || !iframeRef?.current?.getAttribute("src");
+    const WrapperComponent = config.modalIframe ? IframeChrome : NoChrome;
+    return (React.createElement(WrapperComponent, { onClose: onClose },
+        showLoadingIcon && (React.createElement("div", { className: "cac-absolute cac-inset-0 cac-flex cac-items-center cac-justify-center cac-bg-white" },
+            React.createElement(LoadingIcon, null))),
+        React.createElement(CivicAuthIframe, { ref: iframeRef, onLoad: handleIframeLoad })));
+};
+export { CivicAuthIframeContainer };
+//# sourceMappingURL=CivicAuthIframeContainer.js.map

package/.rollup.cache/Users/flippie/civic/repos/civic-auth/packages/civic-auth-client/dist/esm/src/shared/components/CivicAuthIframeContainer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CivicAuthIframeContainer.js","sourceRoot":"","sources":["../../../../../src/shared/components/CivicAuthIframeContainer.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,KAAK,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAO7D,SAAS,QAAQ,CAAC,EAChB,QAAQ,GAIT;IACC,OAAO,6BAAK,SAAS,EAAC,cAAc,IAAE,QAAQ,CAAO,CAAC;AACxD,CAAC;AAED,SAAS,YAAY,CAAC,EACpB,QAAQ,EACR,OAAO,GAIR;IACC,OAAO,CACL,6BACE,SAAS,EAAC,qKAAqK,EAC/K,OAAO,EAAE,OAAO;QAEhB,6BACE,SAAS,EAAC,gGAAgG,EAC1G,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,EAAE;YAEnC,gCACE,SAAS,EAAC,oKAAoK,EAC9K,OAAO,EAAE,OAAO;gBAEhB,oBAAC,SAAS,OAAG,CACN;YAER,QAAQ,CACL,CACF,CACP,CAAC;AACJ,CAAC;AACD,MAAM,wBAAwB,GAAG,CAAC,EAChC,OAAO,EACP,eAAe,GAAG,IAAI,GACQ,EAAE,EAAE;IAClC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,OAAO,EAAE,CAAC;IAC/C,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,GAAG,SAAS,EAAE,CAAC;IACtD,MAAM,gBAAgB,GAAG,WAAW,CAAC,GAAG,EAAE;QACxC,IAAI,SAAS,IAAI,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YACtE,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAChE,+EAA+E;gBAC/E,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC7C,oDAAoD;oBACpD,YAAY,CAAC,IAAI,CAAC,CAAC;oBACnB,MAAM,UAAU,GACd,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;oBAE1D,mFAAmF;oBACnF,kFAAkF;oBAClF,mHAAmH;oBACnH,uJAAuJ;oBACvJ,+EAA+E;oBAC/E,IAAI,UAAU,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC;wBACrD,OAAO,CAAC,GAAG,CACT,GAAG,2BAA2B,iCAAiC,CAChE,CAAC;wBACF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC;wBAC/C,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC;wBACnD,KAAK,CACH,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,QAAQ,EAAE,WAAW,MAAM,EAAE,CAC9D,CAAC;oBACJ,CAAC;yBAAM,CAAC;wBACN,mFAAmF;wBACnF,qCAAqC;wBACrC,kBAAkB,CAAC,SAAS,CAAC,CAAC;oBAChC,CAAC;oBAED,IAAI,eAAe;wBAAE,OAAO,EAAE,EAAE,CAAC;oBACjC,OAAO,IAAI,CAAC,CAAC,iCAAiC;gBAChD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,iEAAiE;gBACjE,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,gCAAgC;IAChD,CAAC,EAAE;QACD,eAAe;QACf,MAAM,CAAC,WAAW;QAClB,SAAS;QACT,OAAO;QACP,kBAAkB;KACnB,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,MAAM,EAAkB,CAAC;IAE5C,MAAM,YAAY,GAAG,WAAW,CAC9B,CAAC,KAAoB,EAAE,EAAE;QACvB,IAAI,KAAK,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC3B,OAAO,EAAE,EAAE,CAAC;QACd,CAAC;IACH,CAAC,EACD,CAAC,OAAO,CAAC,CACV,CAAC;IAEF,gBAAgB;IAChB,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAEjD,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,GAAG,EAAE;QAC5B,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAChC,IAAI,gBAAgB,EAAE,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YAC7C,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;IACH,CAAC,CAAC;IACF,MAAM,eAAe,GACnB,SAAS,IAAI,aAAa,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAEzE,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC;IAEtE,OAAO,CACL,oBAAC,gBAAgB,IAAC,OAAO,EAAE,OAAO;QAC/B,eAAe,IAAI,CAClB,6BAAK,SAAS,EAAC,oFAAoF;YACjG,oBAAC,WAAW,OAAG,CACX,CACP;QAED,oBAAC,eAAe,IAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,GAAI,CAC5C,CACpB,CAAC;AACJ,CAAC,CAAC;AAIF,OAAO,EAAE,wBAAwB,EAAE,CAAC","sourcesContent":["\"use client\";\n\nimport React, { useCallback, useEffect, useRef, useState } from \"react\";\nimport { LoadingIcon } from \"@/shared/components/LoadingIcon.js\";\nimport { CloseIcon } from \"@/shared/components/CloseIcon.js\";\nimport { CivicAuthIframe } from \"@/shared/components/CivicAuthIframe.js\";\nimport { useAuth, useConfig, useIframe } from \"@/shared/hooks/index.js\";\nimport { TOKEN_EXCHANGE_TRIGGER_TEXT } from \"@/constants.js\";\n\ntype CivicAuthIframeContainerProps = {\n  onClose?: () => void;\n  closeOnRedirect?: boolean;\n};\n\nfunction NoChrome({\n  children,\n}: {\n  children: React.ReactNode;\n  onClose?: () => void;\n}) {\n  return <div className=\"cac-relative\">{children}</div>;\n}\n\nfunction IframeChrome({\n  children,\n  onClose,\n}: {\n  children: React.ReactNode;\n  onClose?: () => void;\n}) {\n  return (\n    <div\n      className=\"cac-absolute cac-left-0 cac-top-0 cac-z-50 cac-flex cac-h-screen cac-w-screen cac-min-w-72 cac-items-center cac-justify-center cac-bg-neutral-950 cac-bg-opacity-50\"\n      onClick={onClose}\n    >\n      <div\n        className=\"cac-relative cac-overflow-hidden cac-rounded-3xl cac-bg-white cac-p-2 cac-shadow-lg sm:cac-p-6\"\n        onClick={(e) => e.stopPropagation()}\n      >\n        <button\n          className=\"cac-absolute cac-right-4 cac-top-4 cac-flex cac-cursor-pointer cac-items-center cac-justify-center cac-border-none cac-bg-transparent cac-p-1 cac-text-neutral-400\"\n          onClick={onClose}\n        >\n          <CloseIcon />\n        </button>\n\n        {children}\n      </div>\n    </div>\n  );\n}\nconst CivicAuthIframeContainer = ({\n  onClose,\n  closeOnRedirect = true,\n}: CivicAuthIframeContainerProps) => {\n  const [isLoading, setIsLoading] = useState(true);\n  const { isLoading: isAuthLoading } = useAuth();\n  const config = useConfig();\n  const { setAuthResponseUrl, iframeRef } = useIframe();\n  const processIframeUrl = useCallback(() => {\n    if (iframeRef && iframeRef.current && iframeRef.current.contentWindow) {\n      try {\n        const iframeUrl = iframeRef.current.contentWindow.location.href;\n        // we know that oauth has finished when the iframe redirects to our redirectUrl\n        if (iframeUrl.startsWith(config.redirectUrl)) {\n          // we still want to show the spinner during redirect\n          setIsLoading(true);\n          const iframeBody =\n            iframeRef.current.contentWindow.document.body.innerHTML;\n\n          // If we're doing a server token exchange, we need to call the server a second time\n          // using a fetch so that we're on the same domain and cookies can be sent and read\n          // The server will use the presence of the code_verifier cookie to determine whether to do a token exchange or not.\n          // On the initial (3rd party) redirect from the auth server, the cookie won't be sent, so the server-side callback route will just render a blank page,\n          // and we'll do the exchange request from here, which will include the cookies.\n          if (iframeBody.includes(TOKEN_EXCHANGE_TRIGGER_TEXT)) {\n            console.log(\n              `${TOKEN_EXCHANGE_TRIGGER_TEXT}, calling callback URL again...`,\n            );\n            const params = new URL(iframeUrl).searchParams;\n            const appUrl = globalThis.window?.location?.origin;\n            fetch(\n              `${config.redirectUrl}?${params.toString()}&appUrl=${appUrl}`,\n            );\n          } else {\n            // if we're doing token-exchange in the client, we can just set the authResponseUrl\n            // to be handled by the auth provider\n            setAuthResponseUrl(iframeUrl);\n          }\n\n          if (closeOnRedirect) onClose?.();\n          return true; // Successfully processed the URL\n        }\n      } catch {\n        // If we get here, the iframe hasn't redirected to our origin yet\n        console.log(\"Waiting for redirect...\");\n      }\n    }\n    return false; // Haven't processed the URL yet\n  }, [\n    closeOnRedirect,\n    config.redirectUrl,\n    iframeRef,\n    onClose,\n    setAuthResponseUrl,\n  ]);\n\n  const intervalId = useRef<NodeJS.Timeout>();\n\n  const handleEscape = useCallback(\n    (event: KeyboardEvent) => {\n      if (event.key === \"Escape\") {\n        onClose?.();\n      }\n    },\n    [onClose],\n  );\n\n  // handle Escape\n  useEffect(() => {\n    window.addEventListener(\"keydown\", handleEscape);\n\n    return () => window.removeEventListener(\"keydown\", handleEscape);\n  });\n\n  const handleIframeLoad = () => {\n    setIsLoading(false);\n    console.log(\"handleIframeLoad\");\n    if (processIframeUrl() && intervalId.current) {\n      clearInterval(intervalId.current);\n    }\n  };\n  const showLoadingIcon =\n    isLoading || isAuthLoading || !iframeRef?.current?.getAttribute(\"src\");\n\n  const WrapperComponent = config.modalIframe ? IframeChrome : NoChrome;\n\n  return (\n    <WrapperComponent onClose={onClose}>\n      {showLoadingIcon && (\n        <div className=\"cac-absolute cac-inset-0 cac-flex cac-items-center cac-justify-center cac-bg-white\">\n          <LoadingIcon />\n        </div>\n      )}\n\n      <CivicAuthIframe ref={iframeRef} onLoad={handleIframeLoad} />\n    </WrapperComponent>\n  );\n};\n\nexport type { CivicAuthIframeContainerProps };\n\nexport { CivicAuthIframeContainer };\n"]}

package/.rollup.cache/Users/flippie/civic/repos/civic-auth/packages/civic-auth-client/dist/esm/src/shared/components/CloseIcon.d.ts

@@ -0,0 +1,4 @@
+import React from "react";
+declare const CloseIcon: () => React.JSX.Element;
+export { CloseIcon };
+//# sourceMappingURL=CloseIcon.d.ts.map

package/.rollup.cache/Users/flippie/civic/repos/civic-auth/packages/civic-auth-client/dist/esm/src/shared/components/CloseIcon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CloseIcon.d.ts","sourceRoot":"","sources":["../../../../../src/shared/components/CloseIcon.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,QAAA,MAAM,SAAS,yBAgBd,CAAC;AAEF,OAAO,EAAE,SAAS,EAAE,CAAC"}

package/.rollup.cache/Users/flippie/civic/repos/civic-auth/packages/civic-auth-client/dist/esm/src/shared/components/CloseIcon.js

@@ -0,0 +1,6 @@
+import React from "react";
+const CloseIcon = () => (React.createElement("svg", { xmlns: "http://www.w3.org/2000/svg", width: "24", height: "24", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", strokeLinejoin: "round", className: "lucide lucide-x" },
+    React.createElement("path", { d: "M18 6 6 18" }),
+    React.createElement("path", { d: "m6 6 12 12" })));
+export { CloseIcon };
+//# sourceMappingURL=CloseIcon.js.map

package/.rollup.cache/Users/flippie/civic/repos/civic-auth/packages/civic-auth-client/dist/esm/src/shared/components/CloseIcon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CloseIcon.js","sourceRoot":"","sources":["../../../../../src/shared/components/CloseIcon.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,CACtB,6BACE,KAAK,EAAC,4BAA4B,EAClC,KAAK,EAAC,IAAI,EACV,MAAM,EAAC,IAAI,EACX,OAAO,EAAC,WAAW,EACnB,IAAI,EAAC,MAAM,EACX,MAAM,EAAC,cAAc,EACrB,WAAW,EAAC,GAAG,EACf,aAAa,EAAC,OAAO,EACrB,cAAc,EAAC,OAAO,EACtB,SAAS,EAAC,iBAAiB;IAE3B,8BAAM,CAAC,EAAC,YAAY,GAAG;IACvB,8BAAM,CAAC,EAAC,YAAY,GAAG,CACnB,CACP,CAAC;AAEF,OAAO,EAAE,SAAS,EAAE,CAAC","sourcesContent":["import React from \"react\";\n\nconst CloseIcon = () => (\n  <svg\n    xmlns=\"http://www.w3.org/2000/svg\"\n    width=\"24\"\n    height=\"24\"\n    viewBox=\"0 0 24 24\"\n    fill=\"none\"\n    stroke=\"currentColor\"\n    strokeWidth=\"2\"\n    strokeLinecap=\"round\"\n    strokeLinejoin=\"round\"\n    className=\"lucide lucide-x\"\n  >\n    <path d=\"M18 6 6 18\" />\n    <path d=\"m6 6 12 12\" />\n  </svg>\n);\n\nexport { CloseIcon };\n"]}

package/.rollup.cache/Users/flippie/civic/repos/civic-auth/packages/civic-auth-client/dist/esm/src/shared/components/LoadingIcon.d.ts

@@ -0,0 +1,4 @@
+import React from "react";
+declare const LoadingIcon: () => React.JSX.Element;
+export { LoadingIcon };
+//# sourceMappingURL=LoadingIcon.d.ts.map

package/.rollup.cache/Users/flippie/civic/repos/civic-auth/packages/civic-auth-client/dist/esm/src/shared/components/LoadingIcon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LoadingIcon.d.ts","sourceRoot":"","sources":["../../../../../src/shared/components/LoadingIcon.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,QAAA,MAAM,WAAW,yBAoBhB,CAAC;AAEF,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/.rollup.cache/Users/flippie/civic/repos/civic-auth/packages/civic-auth-client/dist/esm/src/shared/components/LoadingIcon.js

@@ -0,0 +1,8 @@
+import React from "react";
+const LoadingIcon = () => (React.createElement("div", { role: "status" },
+    React.createElement("svg", { "aria-hidden": "true", className: "cac-inline cac-h-8 cac-w-8 cac-animate-spin cac-fill-neutral-600 cac-text-neutral-200 dark:cac-fill-neutral-300 dark:cac-text-neutral-600", viewBox: "0 0 100 101", fill: "none", xmlns: "http://www.w3.org/2000/svg" },
+        React.createElement("path", { d: "M100 50.5908C100 78.2051 77.6142 100.591 50 100.591C22.3858 100.591 0 78.2051 0 50.5908C0 22.9766 22.3858 0.59082 50 0.59082C77.6142 0.59082 100 22.9766 100 50.5908ZM9.08144 50.5908C9.08144 73.1895 27.4013 91.5094 50 91.5094C72.5987 91.5094 90.9186 73.1895 90.9186 50.5908C90.9186 27.9921 72.5987 9.67226 50 9.67226C27.4013 9.67226 9.08144 27.9921 9.08144 50.5908Z", fill: "currentColor" }),
+        React.createElement("path", { d: "M93.9676 39.0409C96.393 38.4038 97.8624 35.9116 97.0079 33.5539C95.2932 28.8227 92.871 24.3692 89.8167 20.348C85.8452 15.1192 80.8826 10.7238 75.2124 7.41289C69.5422 4.10194 63.2754 1.94025 56.7698 1.05124C51.7666 0.367541 46.6976 0.446843 41.7345 1.27873C39.2613 1.69328 37.813 4.19778 38.4501 6.62326C39.0873 9.04874 41.5694 10.4717 44.0505 10.1071C47.8511 9.54855 51.7191 9.52689 55.5402 10.0491C60.8642 10.7766 65.9928 12.5457 70.6331 15.2552C75.2735 17.9648 79.3347 21.5619 82.5849 25.841C84.9175 28.9121 86.7997 32.2913 88.1811 35.8758C89.083 38.2158 91.5421 39.6781 93.9676 39.0409Z", fill: "currentFill" })),
+    React.createElement("span", { className: "cac-sr-only" }, "Loading...")));
+export { LoadingIcon };
+//# sourceMappingURL=LoadingIcon.js.map

package/.rollup.cache/Users/flippie/civic/repos/civic-auth/packages/civic-auth-client/dist/esm/src/shared/components/LoadingIcon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LoadingIcon.js","sourceRoot":"","sources":["../../../../../src/shared/components/LoadingIcon.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,CACxB,6BAAK,IAAI,EAAC,QAAQ;IAChB,4CACc,MAAM,EAClB,SAAS,EAAC,2IAA2I,EACrJ,OAAO,EAAC,aAAa,EACrB,IAAI,EAAC,MAAM,EACX,KAAK,EAAC,4BAA4B;QAElC,8BACE,CAAC,EAAC,8WAA8W,EAChX,IAAI,EAAC,cAAc,GACnB;QACF,8BACE,CAAC,EAAC,+kBAA+kB,EACjlB,IAAI,EAAC,aAAa,GAClB,CACE;IACN,8BAAM,SAAS,EAAC,aAAa,iBAAkB,CAC3C,CACP,CAAC;AAEF,OAAO,EAAE,WAAW,EAAE,CAAC","sourcesContent":["import React from \"react\";\n\nconst LoadingIcon = () => (\n  <div role=\"status\">\n    <svg\n      aria-hidden=\"true\"\n      className=\"cac-inline cac-h-8 cac-w-8 cac-animate-spin cac-fill-neutral-600 cac-text-neutral-200 dark:cac-fill-neutral-300 dark:cac-text-neutral-600\"\n      viewBox=\"0 0 100 101\"\n      fill=\"none\"\n      xmlns=\"http://www.w3.org/2000/svg\"\n    >\n      <path\n        d=\"M100 50.5908C100 78.2051 77.6142 100.591 50 100.591C22.3858 100.591 0 78.2051 0 50.5908C0 22.9766 22.3858 0.59082 50 0.59082C77.6142 0.59082 100 22.9766 100 50.5908ZM9.08144 50.5908C9.08144 73.1895 27.4013 91.5094 50 91.5094C72.5987 91.5094 90.9186 73.1895 90.9186 50.5908C90.9186 27.9921 72.5987 9.67226 50 9.67226C27.4013 9.67226 9.08144 27.9921 9.08144 50.5908Z\"\n        fill=\"currentColor\"\n      />\n      <path\n        d=\"M93.9676 39.0409C96.393 38.4038 97.8624 35.9116 97.0079 33.5539C95.2932 28.8227 92.871 24.3692 89.8167 20.348C85.8452 15.1192 80.8826 10.7238 75.2124 7.41289C69.5422 4.10194 63.2754 1.94025 56.7698 1.05124C51.7666 0.367541 46.6976 0.446843 41.7345 1.27873C39.2613 1.69328 37.813 4.19778 38.4501 6.62326C39.0873 9.04874 41.5694 10.4717 44.0505 10.1071C47.8511 9.54855 51.7191 9.52689 55.5402 10.0491C60.8642 10.7766 65.9928 12.5457 70.6331 15.2552C75.2735 17.9648 79.3347 21.5619 82.5849 25.841C84.9175 28.9121 86.7997 32.2913 88.1811 35.8758C89.083 38.2158 91.5421 39.6781 93.9676 39.0409Z\"\n        fill=\"currentFill\"\n      />\n    </svg>\n    <span className=\"cac-sr-only\">Loading...</span>\n  </div>\n);\n\nexport { LoadingIcon };\n"]}

package/.rollup.cache/Users/flippie/civic/repos/civic-auth/packages/civic-auth-client/dist/esm/src/shared/hooks/index.d.ts

@@ -0,0 +1,5 @@
+export { useToken } from "@/shared/hooks/useToken.js";
+export { useAuth } from "@/shared/hooks/useAuth.js";
+export { useConfig } from "@/shared/hooks/useConfig.js";
+export { useIframe } from "@/shared/hooks/useIframe.js";
+//# sourceMappingURL=index.d.ts.map