@civic/auth 0.4.3-alpha.0 → 0.4.3

package/dist/cjs/server/login.js

@@ -1,42 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveOAuthAccessCode = resolveOAuthAccessCode;
-exports.isLoggedIn = isLoggedIn;
-exports.buildLoginUrl = buildLoginUrl;
-const constants_js_1 = require("../constants.js");
-const AuthenticationService_js_1 = require("../services/AuthenticationService.js");
-const PKCE_js_1 = require("../services/PKCE.js");
-const ServerAuthenticationResolver_js_1 = require("../server/ServerAuthenticationResolver.js");
-/**
- * Resolve an OAuth access code to a set of OIDC tokens
- * @param code The access code, typically from a query parameter in the redirect url
- * @param state The oauth random state string, used to distinguish between requests. Typically also passed in the redirect url
- * @param storage The place that this server uses to store session data (e.g. a cookie store)
- * @param config Oauth Server configuration
- */
-async function resolveOAuthAccessCode(code, state, storage, config) {
-    const authSessionService = await ServerAuthenticationResolver_js_1.ServerAuthenticationResolver.build({
-        ...config,
-        oauthServer: config.oauthServer ?? constants_js_1.DEFAULT_AUTH_SERVER,
-    }, storage, config.endpointOverrides);
-    return authSessionService.tokenExchange(code, state);
-}
-async function isLoggedIn(storage) {
-    return !!(await storage.get("id_token"));
-}
-async function buildLoginUrl(config, storage) {
-    // generate a random state if not provided
-    const state = config.state ?? Math.random().toString(36).substring(2);
-    const scopes = config.scopes ?? constants_js_1.DEFAULT_SCOPES;
-    const pkceProducer = new PKCE_js_1.GenericPublicClientPKCEProducer(storage);
-    const authInitiator = new AuthenticationService_js_1.GenericAuthenticationInitiator({
-        ...config,
-        state,
-        scopes,
-        oauthServer: config.oauthServer ?? constants_js_1.DEFAULT_AUTH_SERVER,
-        // When retrieving the PKCE challenge on the server-side, we produce it and store it in the session
-        pkceConsumer: pkceProducer,
-    });
-    return authInitiator.signIn();
-}
-//# sourceMappingURL=login.js.map

package/dist/cjs/server/login.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/server/login.ts"],"names":[],"mappings":";;AAcA,wDAgBC;AAED,gCAEC;AAED,sCAuBC;AA1DD,iDAAqE;AACrE,kFAAqF;AACrF,gDAAqE;AACrE,8FAAwF;AAGxF;;;;;;GAMG;AACI,KAAK,UAAU,sBAAsB,CAC1C,IAAY,EACZ,KAAa,EACb,OAAoB,EACpB,MAAkB;IAElB,MAAM,kBAAkB,GAAG,MAAM,8DAA4B,CAAC,KAAK,CACjE;QACE,GAAG,MAAM;QACT,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,kCAAmB;KACvD,EACD,OAAO,EACP,MAAM,CAAC,iBAAiB,CACzB,CAAC;IAEF,OAAO,kBAAkB,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC;AAEM,KAAK,UAAU,UAAU,CAAC,OAAoB;IACnD,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;AAC3C,CAAC;AAEM,KAAK,UAAU,aAAa,CACjC,MAKG,EACH,OAAoB;IAEpB,0CAA0C;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,6BAAc,CAAC;IAC/C,MAAM,YAAY,GAAG,IAAI,yCAA+B,CAAC,OAAO,CAAC,CAAC;IAClE,MAAM,aAAa,GAAG,IAAI,yDAA8B,CAAC;QACvD,GAAG,MAAM;QACT,KAAK;QACL,MAAM;QACN,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,kCAAmB;QACtD,mGAAmG;QACnG,YAAY,EAAE,YAAY;KAC3B,CAAC,CAAC;IAEH,OAAO,aAAa,CAAC,MAAM,EAAE,CAAC;AAChC,CAAC","sourcesContent":["import type { AuthStorage, OIDCTokenResponseBody } from \"@/types.js\";\nimport { DEFAULT_AUTH_SERVER, DEFAULT_SCOPES } from \"@/constants.js\";\nimport { GenericAuthenticationInitiator } from \"@/services/AuthenticationService.js\";\nimport { GenericPublicClientPKCEProducer } from \"@/services/PKCE.js\";\nimport { ServerAuthenticationResolver } from \"@/server/ServerAuthenticationResolver.js\";\nimport type { AuthConfig } from \"@/server/config.ts\";\n\n/**\n * Resolve an OAuth access code to a set of OIDC tokens\n * @param code The access code, typically from a query parameter in the redirect url\n * @param state The oauth random state string, used to distinguish between requests. Typically also passed in the redirect url\n * @param storage The place that this server uses to store session data (e.g. a cookie store)\n * @param config Oauth Server configuration\n */\nexport async function resolveOAuthAccessCode(\n  code: string,\n  state: string,\n  storage: AuthStorage,\n  config: AuthConfig,\n): Promise<OIDCTokenResponseBody> {\n  const authSessionService = await ServerAuthenticationResolver.build(\n    {\n      ...config,\n      oauthServer: config.oauthServer ?? DEFAULT_AUTH_SERVER,\n    },\n    storage,\n    config.endpointOverrides,\n  );\n\n  return authSessionService.tokenExchange(code, state);\n}\n\nexport async function isLoggedIn(storage: AuthStorage): Promise<boolean> {\n  return !!(await storage.get(\"id_token\"));\n}\n\nexport async function buildLoginUrl(\n  config: Pick<AuthConfig, \"clientId\" | \"redirectUrl\"> &\n    Partial<Pick<AuthConfig, \"oauthServer\">> & {\n      scopes?: string[];\n      state?: string;\n      nonce?: string;\n    },\n  storage: AuthStorage,\n): Promise<URL> {\n  // generate a random state if not provided\n  const state = config.state ?? Math.random().toString(36).substring(2);\n  const scopes = config.scopes ?? DEFAULT_SCOPES;\n  const pkceProducer = new GenericPublicClientPKCEProducer(storage);\n  const authInitiator = new GenericAuthenticationInitiator({\n    ...config,\n    state,\n    scopes,\n    oauthServer: config.oauthServer ?? DEFAULT_AUTH_SERVER,\n    // When retrieving the PKCE challenge on the server-side, we produce it and store it in the session\n    pkceConsumer: pkceProducer,\n  });\n\n  return authInitiator.signIn();\n}\n"]}

package/dist/cjs/server/logout.d.ts

@@ -1,7 +0,0 @@
-import type { AuthConfig } from "../server/config.js";
-import type { AuthStorage } from "../types.js";
-export declare function buildLogoutRedirectUrl(config: Pick<AuthConfig, "clientId" | "postLogoutRedirectUrl"> & Partial<Pick<AuthConfig, "oauthServer">> & {
-    scopes?: string[];
-    state?: string;
-}, storage: AuthStorage): Promise<URL>;
-//# sourceMappingURL=logout.d.ts.map

package/dist/cjs/server/logout.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../src/server/logout.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAM9C,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,GAAG,uBAAuB,CAAC,GAC5D,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,GAAG;IACzC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,EACH,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,GAAG,CAAC,CAkBd"}

package/dist/cjs/server/logout.js

@@ -1,26 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildLogoutRedirectUrl = buildLogoutRedirectUrl;
-const constants_js_1 = require("../constants.js");
-const PKCE_js_1 = require("../services/PKCE.js");
-const AuthenticationService_js_1 = require("../services/AuthenticationService.js");
-const types_js_1 = require("../shared/lib/types.js");
-async function buildLogoutRedirectUrl(config, storage) {
-    // generate a random state if not provided
-    const state = config.state ?? Math.random().toString(36).substring(2);
-    const scopes = config.scopes ?? constants_js_1.DEFAULT_SCOPES;
-    const pkceProducer = new PKCE_js_1.GenericPublicClientPKCEProducer(storage);
-    const authInitiator = new AuthenticationService_js_1.GenericAuthenticationInitiator({
-        ...config,
-        state,
-        scopes,
-        oauthServer: config.oauthServer ?? constants_js_1.DEFAULT_AUTH_SERVER,
-        pkceConsumer: pkceProducer,
-        redirectUrl: config.postLogoutRedirectUrl || "/",
-    });
-    const idToken = await storage.get(types_js_1.OAuthTokens.ID_TOKEN);
-    if (!idToken)
-        throw new Error("No id_token found in storage");
-    return authInitiator.signOut(idToken);
-}
-//# sourceMappingURL=logout.js.map

package/dist/cjs/server/logout.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../../src/server/logout.ts"],"names":[],"mappings":";;AAOA,wDAyBC;AA9BD,iDAAqE;AACrE,gDAAqE;AACrE,kFAAqF;AACrF,oDAAoD;AAE7C,KAAK,UAAU,sBAAsB,CAC1C,MAIG,EACH,OAAoB;IAEpB,0CAA0C;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,6BAAc,CAAC;IAC/C,MAAM,YAAY,GAAG,IAAI,yCAA+B,CAAC,OAAO,CAAC,CAAC;IAClE,MAAM,aAAa,GAAG,IAAI,yDAA8B,CAAC;QACvD,GAAG,MAAM;QACT,KAAK;QACL,MAAM;QACN,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,kCAAmB;QACtD,YAAY,EAAE,YAAY;QAC1B,WAAW,EAAE,MAAM,CAAC,qBAAqB,IAAI,GAAG;KACjD,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,sBAAW,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAE9D,OAAO,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC","sourcesContent":["import type { AuthConfig } from \"@/server/config.js\";\nimport type { AuthStorage } from \"@/types.js\";\nimport { DEFAULT_AUTH_SERVER, DEFAULT_SCOPES } from \"@/constants.js\";\nimport { GenericPublicClientPKCEProducer } from \"@/services/PKCE.js\";\nimport { GenericAuthenticationInitiator } from \"@/services/AuthenticationService.js\";\nimport { OAuthTokens } from \"@/shared/lib/types.js\";\n\nexport async function buildLogoutRedirectUrl(\n  config: Pick<AuthConfig, \"clientId\" | \"postLogoutRedirectUrl\"> &\n    Partial<Pick<AuthConfig, \"oauthServer\">> & {\n      scopes?: string[];\n      state?: string;\n    },\n  storage: AuthStorage,\n): Promise<URL> {\n  // generate a random state if not provided\n  const state = config.state ?? Math.random().toString(36).substring(2);\n  const scopes = config.scopes ?? DEFAULT_SCOPES;\n  const pkceProducer = new GenericPublicClientPKCEProducer(storage);\n  const authInitiator = new GenericAuthenticationInitiator({\n    ...config,\n    state,\n    scopes,\n    oauthServer: config.oauthServer ?? DEFAULT_AUTH_SERVER,\n    pkceConsumer: pkceProducer,\n    redirectUrl: config.postLogoutRedirectUrl || \"/\",\n  });\n\n  const idToken = await storage.get(OAuthTokens.ID_TOKEN);\n  if (!idToken) throw new Error(\"No id_token found in storage\");\n\n  return authInitiator.signOut(idToken);\n}\n"]}

package/dist/cjs/server/refresh.d.ts

@@ -1,7 +0,0 @@
-import type { AuthStorage, OIDCTokenResponseBody } from "../types.js";
-import type { AuthConfig } from "../server/config.ts";
-/**
- * Refresh the current set of OIDC tokens
- */
-export declare function refreshTokens(storage: AuthStorage, config: AuthConfig): Promise<OIDCTokenResponseBody>;
-//# sourceMappingURL=refresh.d.ts.map

package/dist/cjs/server/refresh.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/server/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAErE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGrD;;GAEG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,qBAAqB,CAAC,CAehC"}

package/dist/cjs/server/refresh.js

@@ -1,19 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.refreshTokens = refreshTokens;
-const constants_js_1 = require("../constants.js");
-const AuthenticationRefresherImpl_js_1 = require("../shared/lib/AuthenticationRefresherImpl.js");
-/**
- * Refresh the current set of OIDC tokens
- */
-async function refreshTokens(storage, config) {
-    const refresher = await AuthenticationRefresherImpl_js_1.AuthenticationRefresherImpl.build({
-        ...config,
-        oauthServer: config.oauthServer ?? constants_js_1.DEFAULT_AUTH_SERVER,
-    }, storage, (error) => {
-        console.error("Error refreshing tokens", error);
-        return Promise.reject(error);
-    }, config.endpointOverrides);
-    return refresher.refreshTokens();
-}
-//# sourceMappingURL=refresh.js.map

package/dist/cjs/server/refresh.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../../../src/server/refresh.ts"],"names":[],"mappings":";;AAQA,sCAkBC;AAzBD,iDAAqD;AAErD,gGAA0F;AAE1F;;GAEG;AACI,KAAK,UAAU,aAAa,CACjC,OAAoB,EACpB,MAAkB;IAElB,MAAM,SAAS,GAAG,MAAM,4DAA2B,CAAC,KAAK,CACvD;QACE,GAAG,MAAM;QACT,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,kCAAmB;KACvD,EACD,OAAO,EACP,CAAC,KAAK,EAAE,EAAE;QACR,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC,EACD,MAAM,CAAC,iBAAiB,CACzB,CAAC;IAEF,OAAO,SAAS,CAAC,aAAa,EAAE,CAAC;AACnC,CAAC","sourcesContent":["import type { AuthStorage, OIDCTokenResponseBody } from \"@/types.js\";\nimport { DEFAULT_AUTH_SERVER } from \"@/constants.js\";\nimport type { AuthConfig } from \"@/server/config.ts\";\nimport { AuthenticationRefresherImpl } from \"@/shared/lib/AuthenticationRefresherImpl.js\";\n\n/**\n * Refresh the current set of OIDC tokens\n */\nexport async function refreshTokens(\n  storage: AuthStorage,\n  config: AuthConfig,\n): Promise<OIDCTokenResponseBody> {\n  const refresher = await AuthenticationRefresherImpl.build(\n    {\n      ...config,\n      oauthServer: config.oauthServer ?? DEFAULT_AUTH_SERVER,\n    },\n    storage,\n    (error) => {\n      console.error(\"Error refreshing tokens\", error);\n      return Promise.reject(error);\n    },\n    config.endpointOverrides,\n  );\n\n  return refresher.refreshTokens();\n}\n"]}

package/dist/cjs/services/AuthenticationService.d.ts

@@ -1,93 +0,0 @@
-import type { DisplayMode, Endpoints, LoginAppDesignOptions, OIDCTokenResponseBody, SessionData } from "../types.js";
-import { BrowserPublicClientPKCEProducer } from "../services/PKCE.js";
-import type { AuthenticationInitiator, AuthenticationResolver, PKCEConsumer } from "../services/types.js";
-export type GenericAuthenticationInitiatorConfig = {
-    clientId: string;
-    redirectUrl: string;
-    state: string;
-    scopes: string[];
-    oauthServer: string;
-    nonce?: string;
-    endpointOverrides?: Partial<Endpoints>;
-    pkceConsumer: PKCEConsumer;
-};
-export type BrowserAuthenticationInitiatorConfig = Omit<GenericAuthenticationInitiatorConfig, "state"> & {
-    logoutUrl?: string;
-    logoutRedirectUrl: string;
-    displayMode: DisplayMode;
-};
-/**
- * An authentication initiator that works on a browser. Since this is just triggering
- * login and logout, session data is not stored here.
- * An associated AuthenticationResolver would be needed to get the session data.
- * Storage is needed for the code verifier, this is the domain of the PKCEConsumer
- * The storage used by the PKCEConsumer should be available to the AuthenticationResolver.
- *
- * Example usage:
- *
- * 1) Client-only SPA -eg a react app with no server:
- * new BrowserAuthenticationInitiator({
- *   pkceConsumer: new BrowserPublicClientPKCEProducer(), // generate and retrieve the challenge client-side
- *   ... other config
- * })
- *
- * 2) Client-side of a client/server app - eg a react app with a backend:
- * new BrowserAuthenticationInitiator({
- *  pkceConsumer: new ConfidentialClientPKCEConsumer("https://myserver.com/pkce"), // get the challenge from the server
- *  ... other config
- * })
- */
-export declare class BrowserAuthenticationInitiator implements AuthenticationInitiator {
-    readonly setDesignOptions: (value: LoginAppDesignOptions) => void;
-    private postMessageHandler;
-    protected config: BrowserAuthenticationInitiatorConfig;
-    setDisplayMode(displayMode: DisplayMode): void;
-    get displayMode(): DisplayMode;
-    get isServerTokenExchange(): boolean;
-    get state(): string;
-    constructor(config: typeof this.config, setDesignOptions?: (value: LoginAppDesignOptions) => void);
-    handleLoginAppPopupFailed(redirectUrl: string): Promise<void>;
-    handleLoginAppDesignUpdate(options: LoginAppDesignOptions): Promise<void>;
-    signIn(iframeRef: HTMLIFrameElement | null): Promise<URL>;
-    protected handleIframeUrlChange(iframe: HTMLIFrameElement, expectedUrl: string): Promise<void>;
-    signOut(idToken: string | undefined, iframeRef: HTMLIFrameElement | null): Promise<URL>;
-    cleanup(): void;
-}
-/** A general-purpose authentication initiator, that just generates urls, but lets
- * the caller decide how to use them. This is useful for server-side applications
- * that may serve this URL to their front-ends or just call them directly
- */
-export declare class GenericAuthenticationInitiator implements AuthenticationInitiator {
-    protected config: GenericAuthenticationInitiatorConfig;
-    constructor(config: typeof this.config);
-    signIn(): Promise<URL>;
-    signOut(idToken: string): Promise<URL>;
-}
-type BrowserAuthenticationConfig = {
-    clientId: string;
-    redirectUrl: string;
-    logoutUrl?: string;
-    logoutRedirectUrl: string;
-    scopes: string[];
-    oauthServer: string;
-    endpointOverrides?: Partial<Endpoints>;
-    displayMode: DisplayMode;
-};
-/**
- * An authentication resolver that can run on the browser (i.e. a public client)
- * It uses PKCE for security. PKCE and Session data are stored in local storage
- */
-export declare class BrowserAuthenticationService extends BrowserAuthenticationInitiator {
-    protected pkceProducer: BrowserPublicClientPKCEProducer;
-    private oauth2client;
-    private endpoints;
-    constructor(config: BrowserAuthenticationConfig, pkceProducer?: BrowserPublicClientPKCEProducer);
-    init(): Promise<this>;
-    tokenExchange(code: string, state: string): Promise<OIDCTokenResponseBody>;
-    getSessionData(): Promise<SessionData | null>;
-    validateExistingSession(): Promise<SessionData>;
-    getEndSessionEndpoint(): Promise<string | null>;
-    static build(config: BrowserAuthenticationConfig): Promise<AuthenticationResolver>;
-}
-export {};
-//# sourceMappingURL=AuthenticationService.d.ts.map

package/dist/cjs/services/AuthenticationService.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"AuthenticationService.d.ts","sourceRoot":"","sources":["../../../src/services/AuthenticationService.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,WAAW,EACX,SAAS,EAET,qBAAqB,EAErB,qBAAqB,EACrB,WAAW,EACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,+BAA+B,EAEhC,MAAM,oBAAoB,CAAC;AAe5B,OAAO,KAAK,EACV,uBAAuB,EACvB,sBAAsB,EACtB,YAAY,EACb,MAAM,qBAAqB,CAAC;AAS7B,MAAM,MAAM,oCAAoC,GAAG;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,iBAAiB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAEvC,YAAY,EAAE,YAAY,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,oCAAoC,GAAG,IAAI,CACrD,oCAAoC,EACpC,OAAO,CACR,GAAG;IACF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAE1B,WAAW,EAAE,WAAW,CAAC;CAC1B,CAAC;AAKF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,8BAA+B,YAAW,uBAAuB;IAqB1E,QAAQ,CAAC,gBAAgB,UA7CW,qBAAqB;IAyB3D,OAAO,CAAC,kBAAkB,CAAgD;IAE1E,SAAS,CAAC,MAAM,EAAE,oCAAoC,CAAC;IAEhD,cAAc,CAAC,WAAW,EAAE,WAAW;IAI9C,IAAI,WAAW,gBAEd;IAED,IAAI,qBAAqB,YAExB;IACD,IAAI,KAAK,WAER;gBAEC,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,EACjB,gBAAgB,WA7CW,qBAAqB,SA6CN;IAiC/C,yBAAyB,CAAC,WAAW,EAAE,MAAM;IAQ7C,0BAA0B,CAAC,OAAO,EAAE,qBAAqB;IAMzD,MAAM,CAAC,SAAS,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC;IAiC/D,SAAS,CAAC,qBAAqB,CAC7B,MAAM,EAAE,iBAAiB,EACzB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IAqDV,OAAO,CACX,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,SAAS,EAAE,iBAAiB,GAAG,IAAI,GAClC,OAAO,CAAC,GAAG,CAAC;IAiEf,OAAO;CAKR;AAED;;;GAGG;AACH,qBAAa,8BAA+B,YAAW,uBAAuB;IAC5E,SAAS,CAAC,MAAM,EAAE,oCAAoC,CAAC;gBAE3C,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM;IAMhC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC;IAItB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;CAM7C;AAED,KAAK,2BAA2B,GAAG;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACvC,WAAW,EAAE,WAAW,CAAC;CAC1B,CAAC;AAEF;;;GAGG;AACH,qBAAa,4BAA6B,SAAQ,8BAA8B;IAQ5E,SAAS,CAAC,YAAY;IAPxB,OAAO,CAAC,YAAY,CAA2B;IAC/C,OAAO,CAAC,SAAS,CAAwB;gBAIvC,MAAM,EAAE,2BAA2B,EAEzB,YAAY,kCAAwC;IAY1D,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAqBrB,aAAa,CACjB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,qBAAqB,CAAC;IA0C3B,cAAc,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAc7C,uBAAuB,IAAI,OAAO,CAAC,WAAW,CAAC;IAiC/C,qBAAqB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;WAOxC,KAAK,CAChB,MAAM,EAAE,2BAA2B,GAClC,OAAO,CAAC,sBAAsB,CAAC;CAMnC"}

package/dist/cjs/services/AuthenticationService.js

@@ -1,367 +0,0 @@
-"use strict";
-// Proposals for revised versions of the SessionService AKA AuthSessionService
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BrowserAuthenticationService = exports.GenericAuthenticationInitiator = exports.BrowserAuthenticationInitiator = void 0;
-const PKCE_js_1 = require("../services/PKCE.js");
-const util_js_1 = require("../shared/lib/util.js");
-const oauth_js_1 = require("../lib/oauth.js");
-const oauth2_1 = require("oslo/oauth2");
-const storage_js_1 = require("../browser/storage.js");
-const types_js_1 = require("../services/types.js");
-const windowUtil_js_1 = require("../lib/windowUtil.js");
-const constants_js_1 = require("../constants.js");
-const postMessage_js_1 = require("../lib/postMessage.js");
-const session_js_1 = require("../shared/lib/session.js");
-const UserSession_js_1 = require("../shared/lib/UserSession.js");
-const iframeUtils_js_1 = require("../shared/lib/iframeUtils.js");
-const defaultSetDesignOptions = (value) => {
-    localStorage.setItem("loginAppDesign", JSON.stringify(value));
-};
-/**
- * An authentication initiator that works on a browser. Since this is just triggering
- * login and logout, session data is not stored here.
- * An associated AuthenticationResolver would be needed to get the session data.
- * Storage is needed for the code verifier, this is the domain of the PKCEConsumer
- * The storage used by the PKCEConsumer should be available to the AuthenticationResolver.
- *
- * Example usage:
- *
- * 1) Client-only SPA -eg a react app with no server:
- * new BrowserAuthenticationInitiator({
- *   pkceConsumer: new BrowserPublicClientPKCEProducer(), // generate and retrieve the challenge client-side
- *   ... other config
- * })
- *
- * 2) Client-side of a client/server app - eg a react app with a backend:
- * new BrowserAuthenticationInitiator({
- *  pkceConsumer: new ConfidentialClientPKCEConsumer("https://myserver.com/pkce"), // get the challenge from the server
- *  ... other config
- * })
- */
-class BrowserAuthenticationInitiator {
-    setDesignOptions;
-    postMessageHandler = null;
-    config;
-    setDisplayMode(displayMode) {
-        this.config.displayMode = displayMode;
-    }
-    get displayMode() {
-        return this.config.displayMode;
-    }
-    get isServerTokenExchange() {
-        return this.config.pkceConsumer instanceof PKCE_js_1.ConfidentialClientPKCEConsumer;
-    }
-    get state() {
-        return (0, oauth_js_1.generateState)(this.config.displayMode, this.isServerTokenExchange);
-    }
-    constructor(config, setDesignOptions = defaultSetDesignOptions) {
-        this.setDesignOptions = setDesignOptions;
-        this.config = config;
-        this.postMessageHandler = (event) => {
-            const thisURL = new URL(window.location.href);
-            if (event.origin.endsWith("civic.com") ||
-                thisURL.hostname === "localhost") {
-                if (!(0, postMessage_js_1.validateLoginAppPostMessage)(event.data, this.config.clientId)) {
-                    return;
-                }
-                const loginMessage = event.data;
-                if (loginMessage.type === "generatePopupFailed") {
-                    this.handleLoginAppPopupFailed(loginMessage.data.url);
-                    return;
-                }
-                if (loginMessage.type === "design") {
-                    // TODO handle the design message
-                    this.handleLoginAppDesignUpdate(loginMessage.data);
-                    return;
-                }
-            }
-        };
-        window.addEventListener("message", this.postMessageHandler);
-    }
-    async handleLoginAppPopupFailed(redirectUrl) {
-        console.warn("Login app popup failed open a popup, using redirect mode instead...", redirectUrl);
-        window.location.href = redirectUrl;
-    }
-    async handleLoginAppDesignUpdate(options) {
-        this.setDesignOptions(options);
-    }
-    // Use the config (Client ID, scopes OAuth Server, Endpoints, PKCEConsumer) to generate a new login url
-    // and then use the display mode to decide how to send the user there
-    async signIn(iframeRef) {
-        const url = await (0, util_js_1.generateOauthLoginUrl)({
-            ...this.config,
-            state: this.state,
-        });
-        if (this.config.displayMode === "iframe") {
-            const ref = (0, iframeUtils_js_1.getIframeRef)(iframeRef);
-            ref.setAttribute("src", url.toString());
-        }
-        if (this.config.displayMode === "redirect") {
-            window.location.href = url.toString();
-        }
-        if (this.config.displayMode === "new_tab") {
-            try {
-                const popupWindow = window.open(url.toString(), "_blank");
-                if (!popupWindow) {
-                    throw new types_js_1.PopupError("Failed to open popup window");
-                }
-                // TODO handle the 'onclose' event to clean up and reset the authStatus
-            }
-            catch (error) {
-                console.error("popupWindow", error);
-                throw new types_js_1.PopupError("window.open has thrown: Failed to open popup window");
-            }
-        }
-        return url;
-    }
-    handleIframeUrlChange(iframe, expectedUrl) {
-        return new Promise((resolve, reject) => {
-            let interval = undefined;
-            let timeout = undefined;
-            const messageHandler = (event) => {
-                if (event.source !== iframe.contentWindow) {
-                    // This message did not originate from the iframe. Ignore it.
-                    return;
-                }
-                const message = event.data;
-                if (message.source === "civicloginApp" &&
-                    (message.type === "auth_error" ||
-                        message.type === "auth_error_try_again")) {
-                    clearInterval(interval);
-                    clearTimeout(timeout);
-                    window.removeEventListener("message", messageHandler);
-                    reject(new Error(message.data.error || "Authentication failed"));
-                    return;
-                }
-            };
-            window.addEventListener("message", messageHandler);
-            // Keep the existing URL check logic for success case
-            const checkIframe = () => {
-                try {
-                    const currentUrl = iframe.contentWindow?.location.href;
-                    if (currentUrl?.includes(expectedUrl)) {
-                        clearInterval(interval);
-                        window.removeEventListener("message", messageHandler);
-                        resolve();
-                    }
-                }
-                catch {
-                    // Ignore cross-origin errors
-                }
-            };
-            interval = setInterval(checkIframe, 100);
-            // Timeout after 10 seconds
-            timeout = setTimeout(() => {
-                clearInterval(interval);
-                window.removeEventListener("message", messageHandler);
-                reject(new Error("Timeout waiting for iframe URL change"));
-            }, 10000);
-        });
-    }
-    async signOut(idToken, iframeRef) {
-        let url;
-        const state = this.state;
-        if (this.isServerTokenExchange) {
-            if (!this.config.logoutUrl) {
-                throw new Error("logoutUrl is required for server token exchange");
-            }
-            url = new URL(this.config.logoutUrl, window.location.origin);
-            url.searchParams.append("state", state);
-        }
-        else {
-            if (!idToken) {
-                throw new Error("idToken is required for non-server token exchange");
-            }
-            url = await (0, util_js_1.generateOauthLogoutUrl)({
-                ...this.config,
-                idToken,
-                state,
-                redirectUrl: this.config.logoutRedirectUrl,
-            });
-        }
-        if (this.config.displayMode === "iframe") {
-            const ref = (0, iframeUtils_js_1.getIframeRef)(iframeRef);
-            ref.setAttribute("src", url.toString());
-            try {
-                await this.handleIframeUrlChange(ref, this.config.logoutRedirectUrl);
-            }
-            catch (error) {
-                console.log("Failed to sign out", error);
-                // on logout error, trigger the logout-callback directly,
-                // if it is a logout from the server, so the the session is cleared
-                // and user can still sign out.
-                if (this.isServerTokenExchange) {
-                    url = new URL(this.config.logoutRedirectUrl, window.location.origin);
-                    url.searchParams.append("state", state);
-                    url.searchParams.append("appUrl", window.location.origin);
-                    ref.setAttribute("src", url.toString());
-                }
-            }
-        }
-        if (this.config.displayMode === "redirect") {
-            const localStorage = new storage_js_1.LocalStorageAdapter();
-            localStorage.set(constants_js_1.LOGOUT_STATE, state);
-            window.location.href = url.toString();
-        }
-        if (this.config.displayMode === "new_tab") {
-            try {
-                const popupWindow = window.open(url.toString(), "_blank");
-                if (!popupWindow) {
-                    throw new types_js_1.PopupError("Failed to open popup window");
-                }
-            }
-            catch (error) {
-                console.error("popupWindow", error);
-                throw new types_js_1.PopupError("window.open has thrown: Failed to open popup window");
-            }
-        }
-        return url;
-    }
-    cleanup() {
-        if (this.postMessageHandler) {
-            window.removeEventListener("message", this.postMessageHandler);
-        }
-    }
-}
-exports.BrowserAuthenticationInitiator = BrowserAuthenticationInitiator;
-/** A general-purpose authentication initiator, that just generates urls, but lets
- * the caller decide how to use them. This is useful for server-side applications
- * that may serve this URL to their front-ends or just call them directly
- */
-class GenericAuthenticationInitiator {
-    config;
-    constructor(config) {
-        this.config = config;
-    }
-    // Use the config (Client ID, scopes OAuth Server, Endpoints, PKCEConsumer) to generate a new login url
-    // and simply return the url
-    async signIn() {
-        return (0, util_js_1.generateOauthLoginUrl)(this.config);
-    }
-    async signOut(idToken) {
-        return (0, util_js_1.generateOauthLogoutUrl)({
-            ...this.config,
-            idToken,
-        });
-    }
-}
-exports.GenericAuthenticationInitiator = GenericAuthenticationInitiator;
-/**
- * An authentication resolver that can run on the browser (i.e. a public client)
- * It uses PKCE for security. PKCE and Session data are stored in local storage
- */
-class BrowserAuthenticationService extends BrowserAuthenticationInitiator {
-    pkceProducer;
-    oauth2client;
-    endpoints;
-    // TODO WIP - perhaps we want to keep resolver and initiator separate here
-    constructor(config, 
-    // Since we are running fully on the client, we produce as well as consume the PKCE challenge
-    pkceProducer = new PKCE_js_1.BrowserPublicClientPKCEProducer()) {
-        super({
-            ...config,
-            // Store and retrieve the PKCE challenge in local storage
-            pkceConsumer: pkceProducer,
-        });
-        this.pkceProducer = pkceProducer;
-    }
-    // TODO too much code duplication here between the browser and the server variant.
-    // Suggestion for refactor: Standardise the config for AuthenticationResolvers and create a one-shot
-    // function for generating an oauth2client from it
-    async init() {
-        // resolve oauth config
-        this.endpoints = await (0, util_js_1.getEndpointsWithOverrides)(this.config.oauthServer, this.config.endpointOverrides);
-        this.oauth2client = new oauth2_1.OAuth2Client(this.config.clientId, this.endpoints.auth, this.endpoints.token, {
-            redirectURI: this.config.redirectUrl,
-        });
-        return this;
-    }
-    // Two responsibilities:
-    // 1. resolve the auth code to get the tokens (should use library code)
-    // 2. store the tokens in local storage
-    async tokenExchange(code, state) {
-        if (!this.oauth2client)
-            await this.init();
-        const codeVerifier = await this.pkceProducer.getCodeVerifier();
-        if (!codeVerifier)
-            throw new Error("Code verifier not found in storage");
-        // exchange auth code for tokens
-        const tokens = await (0, util_js_1.exchangeTokens)(code, state, this.pkceProducer, this.oauth2client, // clean up types here to avoid the ! operator
-        this.config.oauthServer, this.endpoints);
-        const clientStorage = new storage_js_1.LocalStorageAdapter();
-        await (0, util_js_1.storeTokens)(clientStorage, tokens);
-        const user = await (0, session_js_1.getUser)(clientStorage);
-        if (!user) {
-            throw new Error("Failed to get user info");
-        }
-        const userSession = new UserSession_js_1.GenericUserSession(clientStorage);
-        await userSession.set(user);
-        storage_js_1.LocalStorageAdapter.emitter.emit("signIn");
-        // cleanup the browser window if needed
-        const parsedDisplayMode = (0, oauth_js_1.displayModeFromState)(state, this.config.displayMode);
-        if (parsedDisplayMode === "new_tab") {
-            // Close the popup window
-            window.addEventListener("beforeunload", () => {
-                window?.opener?.focus();
-            });
-            window.close();
-        }
-        // these are the default oAuth params that get added to the URL in redirect which we want to remove if present
-        (0, windowUtil_js_1.removeParamsWithoutReload)(constants_js_1.DEFAULT_OAUTH_GET_PARAMS);
-        return tokens;
-    }
-    // Get the session data from local storage
-    async getSessionData() {
-        const storageData = await (0, util_js_1.retrieveTokens)(new storage_js_1.LocalStorageAdapter());
-        if (!storageData)
-            return null;
-        return {
-            authenticated: !!storageData.id_token,
-            idToken: storageData.id_token,
-            accessToken: storageData.access_token,
-            refreshToken: storageData.refresh_token,
-            accessTokenExpiresAt: storageData.access_token_expires_at,
-        };
-    }
-    async validateExistingSession() {
-        try {
-            const sessionData = await this.getSessionData();
-            if (!sessionData?.idToken || !sessionData.accessToken) {
-                const unAuthenticatedSession = { ...sessionData, authenticated: false };
-                // await clearTokens(new LocalStorageAdapter());
-                return unAuthenticatedSession;
-            }
-            if (!this.endpoints || !this.oauth2client)
-                await this.init();
-            // this function will throw if any of the tokens are invalid
-            await (0, util_js_1.validateOauth2Tokens)({
-                access_token: sessionData.accessToken,
-                id_token: sessionData.idToken,
-                refresh_token: sessionData.refreshToken,
-                access_token_expires_at: sessionData.accessTokenExpiresAt,
-            }, this.endpoints, this.oauth2client, this.config.oauthServer);
-            return sessionData;
-        }
-        catch (error) {
-            console.warn("Failed to validate existing tokens", error);
-            const unAuthenticatedSession = {
-                authenticated: false,
-            };
-            await (0, util_js_1.clearTokens)(new storage_js_1.LocalStorageAdapter());
-            return unAuthenticatedSession;
-        }
-    }
-    async getEndSessionEndpoint() {
-        if (!this.endpoints) {
-            return null;
-        }
-        return this.endpoints?.endsession;
-    }
-    static async build(config) {
-        const resolver = new BrowserAuthenticationService(config);
-        await resolver.init();
-        return resolver;
-    }
-}
-exports.BrowserAuthenticationService = BrowserAuthenticationService;
-//# sourceMappingURL=AuthenticationService.js.map