@civic/auth 0.9.0 → 0.9.1-alpha.1

package/dist/reactjs/core/GlobalAuthManager.js

@@ -92,8 +92,8 @@ class GlobalAuthManager {
         try {
             this.events = new AuthenticationEvents();
             this.setupEventListeners();
-            const authConfig = {
-                clientId: config.clientId,
+            // Build base config common to both branches
+            const baseConfig = {
                 oauthServerBaseUrl: config.config?.oauthServer,
                 scopes: config.scopes || [
                     "openid",
@@ -108,12 +108,22 @@ class GlobalAuthManager {
                 preloadIframe: config.preloadIframe,
                 autoRedirect: config.autoRedirect,
                 events: this.events,
-                logging: {
-                    enabled: true,
-                    level: "debug",
-                },
                 framework: config.framework,
             };
+            // Build auth config based on discriminated union requirements
+            const authConfig = config.loginUrl
+                ? {
+                    // Backend integration mode: loginUrl required, clientId optional
+                    ...baseConfig,
+                    loginUrl: config.loginUrl,
+                    clientId: config.clientId,
+                }
+                : {
+                    // Standard OAuth mode: clientId required, loginUrl optional
+                    ...baseConfig,
+                    clientId: config.clientId,
+                    loginUrl: config.loginUrl,
+                };
             // Only add redirectUrl if provided
             if (config.redirectUrl) {
                 authConfig.redirectUrl = config.redirectUrl;

package/dist/reactjs/core/GlobalAuthManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"GlobalAuthManager.js","sourceRoot":"","sources":["../../../src/reactjs/core/GlobalAuthManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EACL,SAAS,EACT,oBAAoB,EACpB,SAAS,GACV,MAAM,0BAA0B,CAAC;AAQlC,OAAO,EAAE,4BAA4B,EAAE,MAAM,yCAAyC,CAAC;AA+CvF;;;GAGG;AACH,MAAM,iBAAiB;IACb,MAAM,CAAC,QAAQ,GAA6B,IAAI,CAAC;IACjD,IAAI,GAAqB,IAAI,CAAC;IAC9B,MAAM,GAAgC,IAAI,CAAC;IAC3C,MAAM,GAA4B,IAAI,CAAC;IACvC,SAAS,GAAG,IAAI,GAAG,EAAiB,CAAC;IACrC,SAAS,GAGb,EAAE,CAAC;IACC,qBAAqB,GAAyB,IAAI,CAAC;IAEnD,KAAK,GAAoB;QAC/B,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,KAAK;QAChB,UAAU,EAAE,iBAAiB;QAC7B,KAAK,EAAE,IAAI;QACX,WAAW,EAAE,SAAS;KACvB,CAAC;IAEF;QACE,oCAAoC;IACtC,CAAC;IAED,MAAM,CAAC,WAAW;QAChB,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC;YAChC,iBAAiB,CAAC,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACvD,CAAC;QACD,OAAO,iBAAiB,CAAC,QAAQ,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,MAAwB;QACvC,gEAAgE;QAChE,IACE,IAAI,CAAC,qBAAqB;YAC1B,IAAI,CAAC,MAAM;YACX,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EACzB,CAAC;YACD,OAAO,IAAI,CAAC,qBAAqB,CAAC;QACpC,CAAC;QAED,wCAAwC;QACxC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC;YAClC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;QAED,8CAA8C;QAC9C,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAChC,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC1D,CAAC;QAED,OAAO,IAAI,CAAC,qBAAqB,CAAC;IACpC,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,aAAa,CAAC,MAAwB;QAClD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG;YACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAEhD,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;YACzC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAE3B,MAAM,UAAU,GAA0B;gBACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW;gBAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI;oBACvB,QAAQ;oBACR,SAAS;oBACT,OAAO;oBACP,gBAAgB;iBACjB;gBACD,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,QAAQ;gBAC3C,iBAAiB,EAAE,MAAM,CAAC,UAAU,IAAI,OAAO;gBAC/C,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,kBAAkB,EAChB,MAAM,CAAC,kBAAkB,IAAI,4BAA4B;gBAC3D,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE;oBACP,OAAO,EAAE,IAAI;oBACb,KAAK,EAAE,OAAgB;iBACxB;gBACD,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC;YAEF,mCAAmC;YACnC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,UAAU,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;YAC9C,CAAC;YAED,yCAAyC;YACzC,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;gBAC7B,UAAU,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;YAC1D,CAAC;YAED,IAAI,CAAC,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAE/C,2BAA2B;YAC3B,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1D,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBACnC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBAEjD,2FAA2F;YAC7F,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC;gBACZ,SAAS,EAAE,KAAK;gBAChB,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,8CAA8C;YAC9C,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC;YAElC,MAAM,SAAS,GACb,KAAK,YAAY,KAAK;gBACpB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,CAAC;gBACZ,KAAK,EAAE,SAAS;gBAChB,UAAU,EAAE,OAAO;gBACnB,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;YACH,MAAM,SAAS,CAAC;QAClB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,QAAuB;QAC/B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM;QACV,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACvD,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAEnC,kCAAkC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QAED,yBAAyB;QACzB,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC;YACZ,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,iBAAiB;SAC9B,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,yBAAyB;QACvB,OAAO,IAAI,CAAC,IAAI,EAAE,yBAAyB,EAAE,IAAI,KAAK,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,OAAgB;QAChC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO,IAAI,CAAC,IAAI,EAAE,iBAAiB,EAAE,IAAI,IAAI,CAAC;IAChD,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,SAA2B;QAC9C,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/B,OAAO,CACL,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ;YAC3C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,KAAK,SAAS,CAAC,MAAM,EAAE,WAAW;YACjE,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;YACjD,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK;YACrC,IAAI,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,aAAa;YACrD,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,YAAY,CACpD,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,mBAAmB;QACzB,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO;QAEzB,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE;YAC7C,IAAI,CAAC,QAAQ,CAAC;gBACZ,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,gBAAgB;gBAC5B,KAAK,EAAE,IAAI;aACZ,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,GAAG,EAAE;YAC9C,IAAI,CAAC,QAAQ,CAAC;gBACZ,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,eAAe;gBAC3B,KAAK,EAAE,IAAI;aACZ,CAAC,CAAC;YACH,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC7B,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC,KAAwB,EAAE,EAAE;YACnE,MAAM,WAAW,GAAG,KAAK,EAAE,MAAM,IAAI,uBAAuB,CAAC;YAC7D,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;YACzC,IAAI,CAAC,QAAQ,CAAC;gBACZ,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,OAAO;gBACnB,KAAK,EAAE,SAAS;aACjB,CAAC,CAAC;YACH,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,GAAG,EAAE;YAC9C,IAAI,CAAC,QAAQ,CAAC;gBACZ,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,aAAa;gBACzB,KAAK,EAAE,IAAI;aACZ,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,iBAAiB,EAAE,GAAG,EAAE;YAC/C,IAAI,CAAC,QAAQ,CAAC;gBACZ,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,iBAAiB;gBAC7B,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,IAAI;aACZ,CAAC,CAAC;YACH,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,oBAAoB,EAAE,GAAG,EAAE;YAClD,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,qBAAqB;QACjC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO;QAEvB,IAAI,CAAC;YACH,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACxC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE;gBAC7B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;aAC3B,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAChB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED;;OAEG;IACK,QAAQ,CAAC,OAAiC;QAChD,IAAI,CAAC,KAAK,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;QAC3C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,OAAO;QACnB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC,4CAA4C;IACjF,CAAC;;AAGH,OAAO,EAAE,iBAAiB,EAAE,CAAC","sourcesContent":["/**\n * GlobalAuthManager - Singleton Authentication State Manager\n *\n * This module provides a global singleton that manages authentication state across a React application\n * without requiring React Context providers or prop drilling. It acts as a centralized authentication\n * manager that wraps the CivicAuth vanilla JavaScript library and provides a React-friendly interface.\n *\n * Key Features:\n * - Singleton pattern ensures single auth instance across the entire app\n * - Eliminates need for React Context providers and reduces bundle size\n * - Manages authentication state (user, session, loading, errors)\n * - Handles sign-in/sign-out flows with event-driven updates\n * - Provides idempotent initialization (safe to call multiple times)\n * - Supports multiple React hooks subscribing to the same auth state\n * - Automatic session refresh and user data synchronization\n *\n * Usage:\n * - Initialize once in your app with authentication configuration\n * - Use React hooks (useCivicAuth, useAuth, etc.) to access auth state\n * - The manager handles all underlying CivicAuth SDK interactions\n * - State updates are automatically propagated to all subscribed components\n *\n * This design pattern is particularly useful for:\n * - Large applications with many components needing auth state\n * - Avoiding provider wrapper hell in React component trees\n * - Ensuring consistent auth state across disconnected component hierarchies\n * - Server-side rendering scenarios where providers might be problematic\n */\n\nimport {\n  CivicAuth,\n  AuthenticationEvents,\n  AuthEvent,\n} from \"../../vanillajs/index.js\";\nimport type {\n  User,\n  Session,\n  CivicAuthClientConfig,\n} from \"../../vanillajs/index.js\";\nimport type { DisplayMode, FrameworkType } from \"../../types.js\";\nimport type { LoggingConfig } from \"@/vanillajs/auth/types/AuthTypes.js\";\nimport { DEFAULT_AUTH_PROCESS_TIMEOUT } from \"../../vanillajs/auth/types/AuthTypes.js\";\n\n// Event payload interfaces\ninterface SignInErrorEvent {\n  detail: string;\n}\n\nexport interface GlobalAuthConfig {\n  clientId: string;\n  redirectUrl?: string;\n  config?: {\n    oauthServer?: string;\n  };\n  displayMode?: DisplayMode;\n  iframeMode?: \"modal\" | \"embedded\";\n  nonce?: string;\n  logoutRedirectUrl?: string;\n  scopes?: string[];\n  authProcessTimeout?: number;\n  onSignIn?: (error?: Error) => void;\n  onSignOut?: () => void;\n  logging?: LoggingConfig;\n  preloadIframe?: boolean;\n  autoRedirect?: boolean;\n  /** Framework being used (for analytics) - internal use only */\n  framework?: FrameworkType;\n}\n\nexport type AuthStatus =\n  | \"authenticated\"\n  | \"unauthenticated\"\n  | \"authenticating\"\n  | \"error\"\n  | \"signing_out\";\n\nexport interface GlobalAuthState {\n  user: User | null;\n  session: Session | null;\n  isLoading: boolean;\n  authStatus: AuthStatus;\n  error: Error | null;\n  displayMode?: DisplayMode;\n  isPreloaded?: boolean;\n}\n\ntype StateListener = (state: GlobalAuthState) => void;\n\n/**\n * Global singleton that manages CivicAuth instance for React hooks\n * Eliminates the need for React providers\n */\nclass GlobalAuthManager {\n  private static instance: GlobalAuthManager | null = null;\n  private auth: CivicAuth | null = null;\n  private events: AuthenticationEvents | null = null;\n  private config: GlobalAuthConfig | null = null;\n  private listeners = new Set<StateListener>();\n  private callbacks: {\n    onSignIn?: (error?: Error) => void;\n    onSignOut?: () => void;\n  } = {};\n  private initializationPromise: Promise<void> | null = null;\n\n  private state: GlobalAuthState = {\n    user: null,\n    session: null,\n    isLoading: false,\n    authStatus: \"unauthenticated\",\n    error: null,\n    displayMode: undefined,\n  };\n\n  private constructor() {\n    // Private constructor for singleton\n  }\n\n  static getInstance(): GlobalAuthManager {\n    if (!GlobalAuthManager.instance) {\n      GlobalAuthManager.instance = new GlobalAuthManager();\n    }\n    return GlobalAuthManager.instance;\n  }\n\n  /**\n   * Initialize auth with config (idempotent)\n   * Returns the same promise for concurrent calls with same config\n   */\n  async initialize(config: GlobalAuthConfig): Promise<void> {\n    // If we have a promise and same config, return existing promise\n    if (\n      this.initializationPromise &&\n      this.config &&\n      this.isSameConfig(config)\n    ) {\n      return this.initializationPromise;\n    }\n\n    // If different config, reset everything\n    if (this.config && !this.isSameConfig(config)) {\n      this.initializationPromise = null;\n      await this.cleanup();\n    }\n\n    // Create new initialization promise if needed\n    if (!this.initializationPromise) {\n      this.initializationPromise = this._doInitialize(config);\n    }\n\n    return this.initializationPromise;\n  }\n\n  /**\n   * Private method that does the actual initialization work\n   */\n  private async _doInitialize(config: GlobalAuthConfig): Promise<void> {\n    this.config = config;\n    this.callbacks = {\n      onSignIn: config.onSignIn,\n      onSignOut: config.onSignOut,\n    };\n    this.setState({ isLoading: true, error: null });\n\n    try {\n      this.events = new AuthenticationEvents();\n      this.setupEventListeners();\n\n      const authConfig: CivicAuthClientConfig = {\n        clientId: config.clientId,\n        oauthServerBaseUrl: config.config?.oauthServer,\n        scopes: config.scopes || [\n          \"openid\",\n          \"profile\",\n          \"email\",\n          \"offline_access\",\n        ],\n        displayMode: config.displayMode || \"iframe\",\n        iframeDisplayMode: config.iframeMode || \"modal\",\n        nonce: config.nonce,\n        authProcessTimeout:\n          config.authProcessTimeout || DEFAULT_AUTH_PROCESS_TIMEOUT,\n        preloadIframe: config.preloadIframe,\n        autoRedirect: config.autoRedirect,\n        events: this.events,\n        logging: {\n          enabled: true,\n          level: \"debug\" as const,\n        },\n        framework: config.framework,\n      };\n\n      // Only add redirectUrl if provided\n      if (config.redirectUrl) {\n        authConfig.redirectUrl = config.redirectUrl;\n      }\n\n      // Only add logoutRedirectUrl if provided\n      if (config.logoutRedirectUrl) {\n        authConfig.logoutRedirectUrl = config.logoutRedirectUrl;\n      }\n\n      this.auth = await CivicAuth.create(authConfig);\n\n      // Check initial auth state\n      const isAuthenticated = await this.auth.isAuthenticated();\n      if (isAuthenticated) {\n        await this.refreshUserAndSession();\n        this.setState({ authStatus: \"authenticated\" });\n      } else {\n        this.setState({ authStatus: \"unauthenticated\" });\n\n        // Note: Preloading is now handled automatically by CivicAuth based on config.preloadIframe\n      }\n\n      this.setState({\n        isLoading: false,\n        displayMode: config.displayMode,\n      });\n    } catch (error) {\n      // Reset promise on error so it can be retried\n      this.initializationPromise = null;\n\n      const authError =\n        error instanceof Error\n          ? error\n          : new Error(\"Auth initialization failed\");\n      this.setState({\n        error: authError,\n        authStatus: \"error\",\n        isLoading: false,\n      });\n      throw authError;\n    }\n  }\n\n  /**\n   * Subscribe to state changes\n   */\n  subscribe(listener: StateListener): () => void {\n    this.listeners.add(listener);\n    return () => this.listeners.delete(listener);\n  }\n\n  /**\n   * Get current state\n   */\n  getState(): GlobalAuthState {\n    return { ...this.state };\n  }\n\n  /**\n   * Sign in\n   */\n  async signIn(): Promise<{ user: User }> {\n    if (!this.auth) {\n      throw new Error(\"Auth not initialized\");\n    }\n\n    const { user } = await this.auth.startAuthentication();\n    await this.refreshUserAndSession();\n\n    // Ensure we have a user to return\n    if (!user) {\n      throw new Error(\"Authentication succeeded but no user was returned\");\n    }\n\n    // Return the user object\n    return { user };\n  }\n\n  /**\n   * Sign out\n   */\n  async signOut(): Promise<void> {\n    if (!this.auth) {\n      throw new Error(\"Auth not initialized\");\n    }\n\n    await this.auth.logout();\n    this.setState({\n      user: null,\n      session: null,\n      authStatus: \"unauthenticated\",\n    });\n  }\n\n  /**\n   * Check if authentication is preloaded and ready for instant sign-in\n   * @returns True if an iframe is preloaded and ready\n   */\n  isAuthenticationPreloaded(): boolean {\n    return this.auth?.isAuthenticationPreloaded() ?? false;\n  }\n\n  /**\n   * Enable or disable iframe preloading\n   */\n  setPreloadEnabled(enabled: boolean): void {\n    if (!this.auth) {\n      throw new Error(\"Auth not initialized\");\n    }\n    this.auth.setPreloadEnabled(enabled);\n  }\n\n  /**\n   * Check if iframe preloading is enabled\n   */\n  getPreloadEnabled(): boolean {\n    return this.auth?.getPreloadEnabled() ?? true;\n  }\n\n  /**\n   * Check if config is the same (for idempotent initialization)\n   */\n  private isSameConfig(newConfig: GlobalAuthConfig): boolean {\n    if (!this.config) return false;\n    return (\n      this.config.clientId === newConfig.clientId &&\n      this.config.config?.oauthServer === newConfig.config?.oauthServer &&\n      this.config.displayMode === newConfig.displayMode &&\n      this.config.nonce === newConfig.nonce &&\n      this.config.preloadIframe === newConfig.preloadIframe &&\n      this.config.autoRedirect === newConfig.autoRedirect\n    );\n  }\n\n  /**\n   * Setup event listeners for auth state changes\n   */\n  private setupEventListeners(): void {\n    if (!this.events) return;\n\n    this.events.on(AuthEvent.SIGN_IN_STARTED, () => {\n      this.setState({\n        isLoading: true,\n        authStatus: \"authenticating\",\n        error: null,\n      });\n    });\n\n    this.events.on(AuthEvent.SIGN_IN_COMPLETE, () => {\n      this.setState({\n        isLoading: false,\n        authStatus: \"authenticated\",\n        error: null,\n      });\n      this.refreshUserAndSession();\n      this.callbacks.onSignIn?.();\n    });\n\n    this.events.on(AuthEvent.SIGN_IN_ERROR, (event?: SignInErrorEvent) => {\n      const errorDetail = event?.detail || \"Authentication failed\";\n      const authError = new Error(errorDetail);\n      this.setState({\n        isLoading: false,\n        authStatus: \"error\",\n        error: authError,\n      });\n      this.callbacks.onSignIn?.(authError);\n    });\n\n    this.events.on(AuthEvent.SIGN_OUT_STARTED, () => {\n      this.setState({\n        isLoading: true,\n        authStatus: \"signing_out\",\n        error: null,\n      });\n    });\n\n    this.events.on(AuthEvent.SIGN_OUT_COMPLETE, () => {\n      this.setState({\n        isLoading: false,\n        authStatus: \"unauthenticated\",\n        user: null,\n        session: null,\n        error: null,\n      });\n      this.callbacks.onSignOut?.();\n    });\n\n    this.events.on(AuthEvent.USER_SESSION_CHANGED, () => {\n      this.refreshUserAndSession();\n    });\n  }\n\n  /**\n   * Refresh user and session data\n   */\n  private async refreshUserAndSession(): Promise<void> {\n    if (!this.auth) return;\n\n    try {\n      const [session, user] = await Promise.all([\n        this.auth.getCurrentSession(),\n        this.auth.getCurrentUser(),\n      ]);\n\n      this.setState({ session, user });\n    } catch (error) {\n      const sessionError =\n        error instanceof Error ? error : new Error(\"Failed to get session\");\n      this.setState({ error: sessionError });\n    }\n  }\n\n  /**\n   * Update state and notify listeners\n   */\n  private setState(updates: Partial<GlobalAuthState>): void {\n    this.state = { ...this.state, ...updates };\n    this.listeners.forEach((listener) => listener(this.state));\n  }\n\n  /**\n   * Cleanup auth instance\n   */\n  private async cleanup(): Promise<void> {\n    if (this.auth) {\n      await this.auth.destroy();\n      this.auth = null;\n    }\n    this.events = null;\n    this.config = null;\n    this.initializationPromise = null; // Reset promise for clean re-initialization\n  }\n}\n\nexport { GlobalAuthManager };\n"]}
+{"version":3,"file":"GlobalAuthManager.js","sourceRoot":"","sources":["../../../src/reactjs/core/GlobalAuthManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EACL,SAAS,EACT,oBAAoB,EACpB,SAAS,GACV,MAAM,0BAA0B,CAAC;AASlC,OAAO,EAAE,4BAA4B,EAAE,MAAM,yCAAyC,CAAC;AAgDvF;;;GAGG;AACH,MAAM,iBAAiB;IACb,MAAM,CAAC,QAAQ,GAA6B,IAAI,CAAC;IACjD,IAAI,GAAqB,IAAI,CAAC;IAC9B,MAAM,GAAgC,IAAI,CAAC;IAC3C,MAAM,GAA4B,IAAI,CAAC;IACvC,SAAS,GAAG,IAAI,GAAG,EAAiB,CAAC;IACrC,SAAS,GAGb,EAAE,CAAC;IACC,qBAAqB,GAAyB,IAAI,CAAC;IAEnD,KAAK,GAAoB;QAC/B,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,KAAK;QAChB,UAAU,EAAE,iBAAiB;QAC7B,KAAK,EAAE,IAAI;QACX,WAAW,EAAE,SAAS;KACvB,CAAC;IAEF;QACE,oCAAoC;IACtC,CAAC;IAED,MAAM,CAAC,WAAW;QAChB,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC;YAChC,iBAAiB,CAAC,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACvD,CAAC;QACD,OAAO,iBAAiB,CAAC,QAAQ,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,MAAwB;QACvC,gEAAgE;QAChE,IACE,IAAI,CAAC,qBAAqB;YAC1B,IAAI,CAAC,MAAM;YACX,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EACzB,CAAC;YACD,OAAO,IAAI,CAAC,qBAAqB,CAAC;QACpC,CAAC;QAED,wCAAwC;QACxC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC;YAClC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;QAED,8CAA8C;QAC9C,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAChC,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC1D,CAAC;QAED,OAAO,IAAI,CAAC,qBAAqB,CAAC;IACpC,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,aAAa,CAAC,MAAwB;QAClD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG;YACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAEhD,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;YACzC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAE3B,4CAA4C;YAC5C,MAAM,UAAU,GAAG;gBACjB,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW;gBAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI;oBACvB,QAAQ;oBACR,SAAS;oBACT,OAAO;oBACP,gBAAgB;iBACjB;gBACD,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,QAAQ;gBAC3C,iBAAiB,EAAE,MAAM,CAAC,UAAU,IAAI,OAAO;gBAC/C,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,kBAAkB,EAChB,MAAM,CAAC,kBAAkB,IAAI,4BAA4B;gBAC3D,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC;YAEF,8DAA8D;YAC9D,MAAM,UAAU,GAA0B,MAAM,CAAC,QAAQ;gBACvD,CAAC,CAAC;oBACE,iEAAiE;oBACjE,GAAG,UAAU;oBACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B;gBACH,CAAC,CAAC;oBACE,4DAA4D;oBAC5D,GAAG,UAAU;oBACb,QAAQ,EAAE,MAAM,CAAC,QAAS;oBAC1B,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B,CAAC;YAEN,mCAAmC;YACnC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,UAAU,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;YAC9C,CAAC;YAED,yCAAyC;YACzC,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;gBAC7B,UAAU,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;YAC1D,CAAC;YAED,IAAI,CAAC,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAE/C,2BAA2B;YAC3B,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1D,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBACnC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBAEjD,2FAA2F;YAC7F,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC;gBACZ,SAAS,EAAE,KAAK;gBAChB,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,8CAA8C;YAC9C,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC;YAElC,MAAM,SAAS,GACb,KAAK,YAAY,KAAK;gBACpB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,CAAC;gBACZ,KAAK,EAAE,SAAS;gBAChB,UAAU,EAAE,OAAO;gBACnB,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;YACH,MAAM,SAAS,CAAC;QAClB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,QAAuB;QAC/B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM;QACV,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACvD,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAEnC,kCAAkC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QAED,yBAAyB;QACzB,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC;YACZ,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,iBAAiB;SAC9B,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,yBAAyB;QACvB,OAAO,IAAI,CAAC,IAAI,EAAE,yBAAyB,EAAE,IAAI,KAAK,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,OAAgB;QAChC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO,IAAI,CAAC,IAAI,EAAE,iBAAiB,EAAE,IAAI,IAAI,CAAC;IAChD,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,SAA2B;QAC9C,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/B,OAAO,CACL,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ;YAC3C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,KAAK,SAAS,CAAC,MAAM,EAAE,WAAW;YACjE,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;YACjD,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK;YACrC,IAAI,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,aAAa;YACrD,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,YAAY,CACpD,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,mBAAmB;QACzB,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO;QAEzB,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE;YAC7C,IAAI,CAAC,QAAQ,CAAC;gBACZ,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,gBAAgB;gBAC5B,KAAK,EAAE,IAAI;aACZ,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,GAAG,EAAE;YAC9C,IAAI,CAAC,QAAQ,CAAC;gBACZ,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,eAAe;gBAC3B,KAAK,EAAE,IAAI;aACZ,CAAC,CAAC;YACH,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC7B,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC,KAAwB,EAAE,EAAE;YACnE,MAAM,WAAW,GAAG,KAAK,EAAE,MAAM,IAAI,uBAAuB,CAAC;YAC7D,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;YACzC,IAAI,CAAC,QAAQ,CAAC;gBACZ,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,OAAO;gBACnB,KAAK,EAAE,SAAS;aACjB,CAAC,CAAC;YACH,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,GAAG,EAAE;YAC9C,IAAI,CAAC,QAAQ,CAAC;gBACZ,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,aAAa;gBACzB,KAAK,EAAE,IAAI;aACZ,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,iBAAiB,EAAE,GAAG,EAAE;YAC/C,IAAI,CAAC,QAAQ,CAAC;gBACZ,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,iBAAiB;gBAC7B,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,IAAI;aACZ,CAAC,CAAC;YACH,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,oBAAoB,EAAE,GAAG,EAAE;YAClD,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,qBAAqB;QACjC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO;QAEvB,IAAI,CAAC;YACH,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACxC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE;gBAC7B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;aAC3B,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAChB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED;;OAEG;IACK,QAAQ,CAAC,OAAiC;QAChD,IAAI,CAAC,KAAK,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;QAC3C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,OAAO;QACnB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC,4CAA4C;IACjF,CAAC;;AAGH,OAAO,EAAE,iBAAiB,EAAE,CAAC","sourcesContent":["/**\n * GlobalAuthManager - Singleton Authentication State Manager\n *\n * This module provides a global singleton that manages authentication state across a React application\n * without requiring React Context providers or prop drilling. It acts as a centralized authentication\n * manager that wraps the CivicAuth vanilla JavaScript library and provides a React-friendly interface.\n *\n * Key Features:\n * - Singleton pattern ensures single auth instance across the entire app\n * - Eliminates need for React Context providers and reduces bundle size\n * - Manages authentication state (user, session, loading, errors)\n * - Handles sign-in/sign-out flows with event-driven updates\n * - Provides idempotent initialization (safe to call multiple times)\n * - Supports multiple React hooks subscribing to the same auth state\n * - Automatic session refresh and user data synchronization\n *\n * Usage:\n * - Initialize once in your app with authentication configuration\n * - Use React hooks (useCivicAuth, useAuth, etc.) to access auth state\n * - The manager handles all underlying CivicAuth SDK interactions\n * - State updates are automatically propagated to all subscribed components\n *\n * This design pattern is particularly useful for:\n * - Large applications with many components needing auth state\n * - Avoiding provider wrapper hell in React component trees\n * - Ensuring consistent auth state across disconnected component hierarchies\n * - Server-side rendering scenarios where providers might be problematic\n */\n\nimport {\n  CivicAuth,\n  AuthenticationEvents,\n  AuthEvent,\n} from \"../../vanillajs/index.js\";\nimport type {\n  User,\n  Session,\n  CivicAuthClientConfig,\n} from \"../../vanillajs/index.js\";\nimport type { FrameworkType } from \"../../types.js\";\nimport type { VanillaJSDisplayMode } from \"../../vanillajs/auth/types/AuthTypes.js\";\nimport type { LoggingConfig } from \"@/vanillajs/auth/types/AuthTypes.js\";\nimport { DEFAULT_AUTH_PROCESS_TIMEOUT } from \"../../vanillajs/auth/types/AuthTypes.js\";\n\n// Event payload interfaces\ninterface SignInErrorEvent {\n  detail: string;\n}\n\nexport interface GlobalAuthConfig {\n  clientId?: string;\n  redirectUrl?: string;\n  loginUrl?: string;\n  config?: {\n    oauthServer?: string;\n  };\n  displayMode?: VanillaJSDisplayMode;\n  iframeMode?: \"modal\" | \"embedded\";\n  nonce?: string;\n  logoutRedirectUrl?: string;\n  scopes?: string[];\n  authProcessTimeout?: number;\n  onSignIn?: (error?: Error) => void;\n  onSignOut?: () => void;\n  logging?: LoggingConfig;\n  preloadIframe?: boolean;\n  autoRedirect?: boolean;\n  /** Framework being used (for analytics) - internal use only */\n  framework?: FrameworkType;\n}\n\nexport type AuthStatus =\n  | \"authenticated\"\n  | \"unauthenticated\"\n  | \"authenticating\"\n  | \"error\"\n  | \"signing_out\";\n\nexport interface GlobalAuthState {\n  user: User | null;\n  session: Session | null;\n  isLoading: boolean;\n  authStatus: AuthStatus;\n  error: Error | null;\n  displayMode?: VanillaJSDisplayMode;\n  isPreloaded?: boolean;\n}\n\ntype StateListener = (state: GlobalAuthState) => void;\n\n/**\n * Global singleton that manages CivicAuth instance for React hooks\n * Eliminates the need for React providers\n */\nclass GlobalAuthManager {\n  private static instance: GlobalAuthManager | null = null;\n  private auth: CivicAuth | null = null;\n  private events: AuthenticationEvents | null = null;\n  private config: GlobalAuthConfig | null = null;\n  private listeners = new Set<StateListener>();\n  private callbacks: {\n    onSignIn?: (error?: Error) => void;\n    onSignOut?: () => void;\n  } = {};\n  private initializationPromise: Promise<void> | null = null;\n\n  private state: GlobalAuthState = {\n    user: null,\n    session: null,\n    isLoading: false,\n    authStatus: \"unauthenticated\",\n    error: null,\n    displayMode: undefined,\n  };\n\n  private constructor() {\n    // Private constructor for singleton\n  }\n\n  static getInstance(): GlobalAuthManager {\n    if (!GlobalAuthManager.instance) {\n      GlobalAuthManager.instance = new GlobalAuthManager();\n    }\n    return GlobalAuthManager.instance;\n  }\n\n  /**\n   * Initialize auth with config (idempotent)\n   * Returns the same promise for concurrent calls with same config\n   */\n  async initialize(config: GlobalAuthConfig): Promise<void> {\n    // If we have a promise and same config, return existing promise\n    if (\n      this.initializationPromise &&\n      this.config &&\n      this.isSameConfig(config)\n    ) {\n      return this.initializationPromise;\n    }\n\n    // If different config, reset everything\n    if (this.config && !this.isSameConfig(config)) {\n      this.initializationPromise = null;\n      await this.cleanup();\n    }\n\n    // Create new initialization promise if needed\n    if (!this.initializationPromise) {\n      this.initializationPromise = this._doInitialize(config);\n    }\n\n    return this.initializationPromise;\n  }\n\n  /**\n   * Private method that does the actual initialization work\n   */\n  private async _doInitialize(config: GlobalAuthConfig): Promise<void> {\n    this.config = config;\n    this.callbacks = {\n      onSignIn: config.onSignIn,\n      onSignOut: config.onSignOut,\n    };\n    this.setState({ isLoading: true, error: null });\n\n    try {\n      this.events = new AuthenticationEvents();\n      this.setupEventListeners();\n\n      // Build base config common to both branches\n      const baseConfig = {\n        oauthServerBaseUrl: config.config?.oauthServer,\n        scopes: config.scopes || [\n          \"openid\",\n          \"profile\",\n          \"email\",\n          \"offline_access\",\n        ],\n        displayMode: config.displayMode || \"iframe\",\n        iframeDisplayMode: config.iframeMode || \"modal\",\n        nonce: config.nonce,\n        authProcessTimeout:\n          config.authProcessTimeout || DEFAULT_AUTH_PROCESS_TIMEOUT,\n        preloadIframe: config.preloadIframe,\n        autoRedirect: config.autoRedirect,\n        events: this.events,\n        framework: config.framework,\n      };\n\n      // Build auth config based on discriminated union requirements\n      const authConfig: CivicAuthClientConfig = config.loginUrl\n        ? {\n            // Backend integration mode: loginUrl required, clientId optional\n            ...baseConfig,\n            loginUrl: config.loginUrl,\n            clientId: config.clientId,\n          }\n        : {\n            // Standard OAuth mode: clientId required, loginUrl optional\n            ...baseConfig,\n            clientId: config.clientId!,\n            loginUrl: config.loginUrl,\n          };\n\n      // Only add redirectUrl if provided\n      if (config.redirectUrl) {\n        authConfig.redirectUrl = config.redirectUrl;\n      }\n\n      // Only add logoutRedirectUrl if provided\n      if (config.logoutRedirectUrl) {\n        authConfig.logoutRedirectUrl = config.logoutRedirectUrl;\n      }\n\n      this.auth = await CivicAuth.create(authConfig);\n\n      // Check initial auth state\n      const isAuthenticated = await this.auth.isAuthenticated();\n      if (isAuthenticated) {\n        await this.refreshUserAndSession();\n        this.setState({ authStatus: \"authenticated\" });\n      } else {\n        this.setState({ authStatus: \"unauthenticated\" });\n\n        // Note: Preloading is now handled automatically by CivicAuth based on config.preloadIframe\n      }\n\n      this.setState({\n        isLoading: false,\n        displayMode: config.displayMode,\n      });\n    } catch (error) {\n      // Reset promise on error so it can be retried\n      this.initializationPromise = null;\n\n      const authError =\n        error instanceof Error\n          ? error\n          : new Error(\"Auth initialization failed\");\n      this.setState({\n        error: authError,\n        authStatus: \"error\",\n        isLoading: false,\n      });\n      throw authError;\n    }\n  }\n\n  /**\n   * Subscribe to state changes\n   */\n  subscribe(listener: StateListener): () => void {\n    this.listeners.add(listener);\n    return () => this.listeners.delete(listener);\n  }\n\n  /**\n   * Get current state\n   */\n  getState(): GlobalAuthState {\n    return { ...this.state };\n  }\n\n  /**\n   * Sign in\n   */\n  async signIn(): Promise<{ user: User }> {\n    if (!this.auth) {\n      throw new Error(\"Auth not initialized\");\n    }\n\n    const { user } = await this.auth.startAuthentication();\n    await this.refreshUserAndSession();\n\n    // Ensure we have a user to return\n    if (!user) {\n      throw new Error(\"Authentication succeeded but no user was returned\");\n    }\n\n    // Return the user object\n    return { user };\n  }\n\n  /**\n   * Sign out\n   */\n  async signOut(): Promise<void> {\n    if (!this.auth) {\n      throw new Error(\"Auth not initialized\");\n    }\n\n    await this.auth.logout();\n    this.setState({\n      user: null,\n      session: null,\n      authStatus: \"unauthenticated\",\n    });\n  }\n\n  /**\n   * Check if authentication is preloaded and ready for instant sign-in\n   * @returns True if an iframe is preloaded and ready\n   */\n  isAuthenticationPreloaded(): boolean {\n    return this.auth?.isAuthenticationPreloaded() ?? false;\n  }\n\n  /**\n   * Enable or disable iframe preloading\n   */\n  setPreloadEnabled(enabled: boolean): void {\n    if (!this.auth) {\n      throw new Error(\"Auth not initialized\");\n    }\n    this.auth.setPreloadEnabled(enabled);\n  }\n\n  /**\n   * Check if iframe preloading is enabled\n   */\n  getPreloadEnabled(): boolean {\n    return this.auth?.getPreloadEnabled() ?? true;\n  }\n\n  /**\n   * Check if config is the same (for idempotent initialization)\n   */\n  private isSameConfig(newConfig: GlobalAuthConfig): boolean {\n    if (!this.config) return false;\n    return (\n      this.config.clientId === newConfig.clientId &&\n      this.config.config?.oauthServer === newConfig.config?.oauthServer &&\n      this.config.displayMode === newConfig.displayMode &&\n      this.config.nonce === newConfig.nonce &&\n      this.config.preloadIframe === newConfig.preloadIframe &&\n      this.config.autoRedirect === newConfig.autoRedirect\n    );\n  }\n\n  /**\n   * Setup event listeners for auth state changes\n   */\n  private setupEventListeners(): void {\n    if (!this.events) return;\n\n    this.events.on(AuthEvent.SIGN_IN_STARTED, () => {\n      this.setState({\n        isLoading: true,\n        authStatus: \"authenticating\",\n        error: null,\n      });\n    });\n\n    this.events.on(AuthEvent.SIGN_IN_COMPLETE, () => {\n      this.setState({\n        isLoading: false,\n        authStatus: \"authenticated\",\n        error: null,\n      });\n      this.refreshUserAndSession();\n      this.callbacks.onSignIn?.();\n    });\n\n    this.events.on(AuthEvent.SIGN_IN_ERROR, (event?: SignInErrorEvent) => {\n      const errorDetail = event?.detail || \"Authentication failed\";\n      const authError = new Error(errorDetail);\n      this.setState({\n        isLoading: false,\n        authStatus: \"error\",\n        error: authError,\n      });\n      this.callbacks.onSignIn?.(authError);\n    });\n\n    this.events.on(AuthEvent.SIGN_OUT_STARTED, () => {\n      this.setState({\n        isLoading: true,\n        authStatus: \"signing_out\",\n        error: null,\n      });\n    });\n\n    this.events.on(AuthEvent.SIGN_OUT_COMPLETE, () => {\n      this.setState({\n        isLoading: false,\n        authStatus: \"unauthenticated\",\n        user: null,\n        session: null,\n        error: null,\n      });\n      this.callbacks.onSignOut?.();\n    });\n\n    this.events.on(AuthEvent.USER_SESSION_CHANGED, () => {\n      this.refreshUserAndSession();\n    });\n  }\n\n  /**\n   * Refresh user and session data\n   */\n  private async refreshUserAndSession(): Promise<void> {\n    if (!this.auth) return;\n\n    try {\n      const [session, user] = await Promise.all([\n        this.auth.getCurrentSession(),\n        this.auth.getCurrentUser(),\n      ]);\n\n      this.setState({ session, user });\n    } catch (error) {\n      const sessionError =\n        error instanceof Error ? error : new Error(\"Failed to get session\");\n      this.setState({ error: sessionError });\n    }\n  }\n\n  /**\n   * Update state and notify listeners\n   */\n  private setState(updates: Partial<GlobalAuthState>): void {\n    this.state = { ...this.state, ...updates };\n    this.listeners.forEach((listener) => listener(this.state));\n  }\n\n  /**\n   * Cleanup auth instance\n   */\n  private async cleanup(): Promise<void> {\n    if (this.auth) {\n      await this.auth.destroy();\n      this.auth = null;\n    }\n    this.events = null;\n    this.config = null;\n    this.initializationPromise = null; // Reset promise for clean re-initialization\n  }\n}\n\nexport { GlobalAuthManager };\n"]}

package/dist/reactjs/hooks/useUser.js.map

@@ -1 +1 @@
-{"version":3,"file":"useUser.js","sourceRoot":"","sources":["../../../src/reactjs/hooks/useUser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,YAAY,CAAC;AACb,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,wCAAwC,CAAC;AAIrE,OAAO,EACL,iBAAiB,GAGlB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAsB/E,MAAM,OAAO,GAAG,CACd,MAAyB,EACL,EAAE;IACtB,6DAA6D;IAC7D,MAAM,aAAa,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IAE9C,oCAAoC;IACpC,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAyB,IAAI,CAAC,CAAC;IAE7E,kCAAkC;IAClC,MAAM,kBAAkB,GAAG,aAAa,CAAC;IACzC,MAAM,eAAe,GAAG,CAAC,kBAAkB,CAAC;IAE5C,mDAAmD;IACnD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,eAAe;YAAE,OAAO;QAE7B,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAEhD,4CAA4C;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,cAAc,GAAG,KAAK,IAAI,EAAE;gBAChC,IAAI,CAAC;oBACH,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBACnC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC,CAAC;YACF,cAAc,EAAE,CAAC;QACnB,CAAC;QAED,6BAA6B;QAC7B,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,EAAE;YACjD,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,oBAAoB;QACpB,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAEnC,OAAO,WAAW,CAAC;IACrB,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IAE9B,uCAAuC;IACvC,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC1C,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;QAEvB,6BAA6B;QAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAe,EAAE,CAAC;IACzC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC3C,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1B,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,sCAAsC;IACtC,MAAM,+BAA+B,GAAG,WAAW,CAAC,GAAG,EAAE;QACvD,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAChD,OAAO,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAC7C,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,uBAAuB,GAAG,WAAW,CAAC,CAAC,OAAgB,EAAE,EAAE;QAC/D,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAChD,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,uBAAuB,GAAG,WAAW,CAAC,GAAG,EAAE;QAC/C,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAChD,OAAO,OAAO,CAAC,iBAAiB,EAAE,CAAC;IACrC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,mCAAmC;IACnC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,EAAE;QAChC,OAAO,wBAAwB,CAAC,WAAW,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC;IAChE,CAAC,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAE3B,2DAA2D;IAC3D,MAAM,gBAAgB,GAAG,WAAW,CAAC,KAAK,IAAgC,EAAE;QAC1E,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,oBAAoB;YAClD,sCAAsC;YACtC,IAAI,aAAa,CAAC,IAAI,EAAE,CAAC;gBACvB,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,IAAe,EAAE,CAAC;YACjD,CAAC;YAED,+DAA+D;YAC/D,OAAO,EAAE,IAAI,EAAE,IAA0B,EAAE,CAAC;QAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;IAEpB,uEAAuE;IACvE,MAAM,+BAA+B,GAAG,WAAW,CAAC,GAAG,EAAE;QACvD,OAAO,KAAK,CAAC,CAAC,kCAAkC;IAClD,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,uBAAuB,GAAG,WAAW,CAAC,CAAC,QAAiB,EAAE,EAAE;QAChE,OAAO,CAAC,IAAI,CACV,kFAAkF,EAClF,QAAQ,CACT,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,uBAAuB,GAAG,WAAW,CAAC,GAAG,EAAE;QAC/C,OAAO,KAAK,CAAC,CAAC,kCAAkC;IAClD,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,2EAA2E;IAC3E,mEAAmE;IACnE,2EAA2E;IAE3E,sDAAsD;IACtD,sDAAsD;IACtD,8CAA8C;IAC9C,gFAAgF;IAChF,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO;YACL,IAAI,EAAE,aAAa,CAAC,IAAsB;YAC1C,OAAO,EAAE,aAAa,CAAC,OAAO;YAC9B,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,YAAY,EAAE,SAAS,EAAE,kCAAkC;YAC3D,eAAe,EAAE,aAAa,CAAC,eAAe;YAC9C,SAAS,EAAE,aAAa,CAAC,SAAS;YAClC,UAAU,EAAE,aAAa,CAAC,UAAU;YACpC,KAAK,EAAE,aAAa,CAAC,KAAK;YAC1B,MAAM,EAAE,gBAAgB;YACxB,OAAO,EAAE,aAAa,CAAC,OAAO;YAC9B,yBAAyB,EAAE,+BAA+B;YAC1D,iBAAiB,EAAE,uBAAuB;YAC1C,iBAAiB,EAAE,uBAAuB;YAC1C,WAAW,EAAE,aAAa,CAAC,WAAW;SACvC,CAAC;IACJ,CAAC;IAED,yDAAyD;IACzD,wEAAwE;IACxE,8CAA8C;IAC9C,6EAA6E;IAC7E,yEAAyE;IACzE,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO;YACL,IAAI,EAAE,WAAW,CAAC,IAAsB;YACxC,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,WAAW,EAAE,YAAY,CAAC,WAAW;YACrC,YAAY,EAAE,YAAY,CAAC,YAAY;YACvC,eAAe,EAAE,YAAY,CAAC,eAAe;YAC7C,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,UAAU,EAAE,WAAW,CAAC,UAAwB;YAChD,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,aAAa;YACtB,yBAAyB,EAAE,+BAA+B;YAC1D,iBAAiB,EAAE,uBAAuB;YAC1C,iBAAiB,EAAE,uBAAuB;YAC1C,WAAW,EAAE,WAAW,CAAC,WAAW;SACrC,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,8FAA8F;IAC9F,OAAO;QACL,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,IAAI;QACjB,YAAY,EAAE,IAAI;QAClB,eAAe,EAAE,SAAS;QAC1B,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,iBAA+B;QAC3C,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,YAAY;QACpB,OAAO,EAAE,aAAa;QACtB,yBAAyB,EAAE,+BAA+B;QAC1D,iBAAiB,EAAE,uBAAuB;QAC1C,iBAAiB,EAAE,uBAAuB;QAC1C,WAAW,EAAE,MAAM,EAAE,WAAW;KACjC,CAAC;AACJ,CAAC,CAAC;AAEF,OAAO,EAAE,OAAO,EAAE,CAAC","sourcesContent":["/**\n * useUser Hook\n *\n * A comprehensive user session hook that provides full user data including profile information,\n * authentication tokens, and authentication state. Supports generic typing for custom user data.\n *\n * Use this hook when you:\n * - Need access to user profile information (user object)\n * - Need authentication tokens (JWT, access, refresh tokens)\n * - Are working with custom user data types\n * - Need comprehensive user session data\n * - Want backward compatibility with legacy UserContext\n *\n * This hook supports two authentication patterns with automatic fallback:\n * 1. Provider-based (legacy): Uses CivicAuthProvider or CivicNextAuthProvider\n * 2. Provider-free (modern): Direct configuration via useUser(config)\n *\n * Usage Examples:\n *\n * // With provider (existing approach - NextJS/React providers)\n * <CivicAuthProvider clientId=\"...\" config={{ oauthServer: \"...\" }}>\n *   const { user, isLoading, signIn } = useUser();\n * </CivicAuthProvider>\n *\n * // Without provider (new approach) - direct configuration\n * const { user, authStatus, signOut } = useUser({\n *   clientId: \"your-client-id\",\n *   config: { oauthServer: \"https://auth.civic.com/oauth/\" },\n *   displayMode: \"iframe\", // or \"redirect\", \"popup\", etc.\n *   scopes: [\"openid\", \"profile\", \"email\"],\n *   onSignIn: (error) => console.log(\"Sign in completed\", error),\n *   onSignOut: () => console.log(\"Sign out completed\")\n * });\n *\n * // Generic typing for custom user data\n * interface CustomUser { customField: string; }\n * const { user } = useUser<CustomUser>(); // user will be User<CustomUser> | null\n */\n\"use client\";\nimport { useContext, useState, useEffect, useCallback, useMemo } from \"react\";\nimport { UserContext } from \"../../shared/providers/UserProvider.js\";\nimport type { User, ForwardedTokens } from \"../../types.js\";\nimport type { AuthStatus } from \"../../types.js\";\nimport type { DisplayMode } from \"../../types.js\";\nimport {\n  GlobalAuthManager,\n  type GlobalAuthConfig,\n  type GlobalAuthState,\n} from \"../core/GlobalAuthManager.js\";\nimport { extractTokensFromSession } from \"../../vanillajs/utils/auth-utils.js\";\n\nexport interface UserContextType<\n  T extends Record<string, unknown> = Record<string, never>,\n> {\n  user: User<T> | null;\n  idToken?: string | null;\n  accessToken?: string | null;\n  refreshToken?: string | null;\n  forwardedTokens?: ForwardedTokens;\n  isLoading: boolean;\n  authStatus: AuthStatus;\n  error: Error | null;\n  signIn: () => Promise<{ user: User<T> }>;\n  signOut: () => Promise<void>;\n  // Preloading methods\n  isAuthenticationPreloaded: () => boolean;\n  setPreloadEnabled: (enabled: boolean) => void;\n  getPreloadEnabled: () => boolean;\n  displayMode?: DisplayMode;\n}\n\nconst useUser = <T extends Record<string, unknown> = Record<string, never>>(\n  config?: GlobalAuthConfig,\n): UserContextType<T> => {\n  // Always call context hooks unconditionally (rules of hooks)\n  const sharedContext = useContext(UserContext);\n\n  // State for global manager approach\n  const [globalState, setGlobalState] = useState<GlobalAuthState | null>(null);\n\n  // Determine which approach to use\n  const hasProviderContext = sharedContext;\n  const shouldUseGlobal = !hasProviderContext;\n\n  // Initialize global manager if no provider context\n  useEffect(() => {\n    if (!shouldUseGlobal) return;\n\n    const manager = GlobalAuthManager.getInstance();\n\n    // If config is provided, initialize with it\n    if (config) {\n      const initializeAuth = async () => {\n        try {\n          await manager.initialize(config);\n        } catch (error) {\n          console.error(\"Failed to initialize auth:\", error);\n        }\n      };\n      initializeAuth();\n    }\n\n    // Subscribe to state changes\n    const unsubscribe = manager.subscribe((newState) => {\n      setGlobalState(newState);\n    });\n\n    // Get current state\n    setGlobalState(manager.getState());\n\n    return unsubscribe;\n  }, [shouldUseGlobal, config]);\n\n  // Global manager sign in/out functions\n  const globalSignIn = useCallback(async () => {\n    const manager = GlobalAuthManager.getInstance();\n    await manager.signIn();\n\n    // Get the user after sign in\n    const state = manager.getState();\n    if (!state.user) {\n      throw new Error(\"Authentication succeeded but no user was returned\");\n    }\n\n    return { user: state.user as User<T> };\n  }, []);\n\n  const globalSignOut = useCallback(async () => {\n    const manager = GlobalAuthManager.getInstance();\n    await manager.signOut();\n  }, []);\n\n  // Global manager preloading functions\n  const globalIsAuthenticationPreloaded = useCallback(() => {\n    const manager = GlobalAuthManager.getInstance();\n    return manager.isAuthenticationPreloaded();\n  }, []);\n\n  const globalSetPreloadEnabled = useCallback((enabled: boolean) => {\n    const manager = GlobalAuthManager.getInstance();\n    manager.setPreloadEnabled(enabled);\n  }, []);\n\n  const globalGetPreloadEnabled = useCallback(() => {\n    const manager = GlobalAuthManager.getInstance();\n    return manager.getPreloadEnabled();\n  }, []);\n\n  // Extract tokens from global state\n  const globalTokens = useMemo(() => {\n    return extractTokensFromSession(globalState?.session || null);\n  }, [globalState?.session]);\n\n  // Create wrapper functions for different signIn signatures\n  const wrapSharedSignIn = useCallback(async (): Promise<{ user: User<T> }> => {\n    if (sharedContext) {\n      await sharedContext.signIn(); // This returns void\n      // Get user from context after sign in\n      if (sharedContext.user) {\n        return { user: sharedContext.user as User<T> };\n      }\n\n      // We don't return a user yet in nextjs until the next refactor\n      return { user: null as unknown as User<T> };\n    }\n    throw new Error(\"Shared context not available\");\n  }, [sharedContext]);\n\n  // Shared context preloading stubs (not implemented for legacy context)\n  const sharedIsAuthenticationPreloaded = useCallback(() => {\n    return false; // Not available in shared context\n  }, []);\n\n  const sharedSetPreloadEnabled = useCallback((_enabled: boolean) => {\n    console.warn(\n      \"Preloading not available with legacy UserContext. Use GlobalAuthManager instead.\",\n      _enabled,\n    );\n  }, []);\n\n  const sharedGetPreloadEnabled = useCallback(() => {\n    return false; // Not available in shared context\n  }, []);\n\n  // ========================================================================\n  // FALLBACK PRIORITY SYSTEM - Two authentication context approaches\n  // ========================================================================\n\n  // 1. DEPRECATED UserContext (ACTIVE - Used by NextJS)\n  // Framework-agnostic shared context from UserProvider\n  // Location: shared/providers/UserProvider.tsx\n  // Usage: NextJS example uses CivicNextAuthProvider → UserProvider → UserContext\n  if (sharedContext) {\n    return {\n      user: sharedContext.user as User<T> | null,\n      idToken: sharedContext.idToken,\n      accessToken: sharedContext.accessToken,\n      refreshToken: undefined, // Not available in shared context\n      forwardedTokens: sharedContext.forwardedTokens,\n      isLoading: sharedContext.isLoading,\n      authStatus: sharedContext.authStatus,\n      error: sharedContext.error,\n      signIn: wrapSharedSignIn,\n      signOut: sharedContext.signOut,\n      isAuthenticationPreloaded: sharedIsAuthenticationPreloaded,\n      setPreloadEnabled: sharedSetPreloadEnabled,\n      getPreloadEnabled: sharedGetPreloadEnabled,\n      displayMode: sharedContext.displayMode,\n    };\n  }\n\n  // 2. GlobalAuthManager (MODERN - Provider-free approach)\n  // Singleton-based state management, eliminates need for React providers\n  // Location: reactjs/core/GlobalAuthManager.ts\n  // Usage: React example uses CivicAuthProvider → GlobalAuthManager internally\n  // Can also be used directly: useUser({ clientId: \"...\", config: {...} })\n  if (globalState) {\n    return {\n      user: globalState.user as User<T> | null,\n      idToken: globalTokens.idToken,\n      accessToken: globalTokens.accessToken,\n      refreshToken: globalTokens.refreshToken,\n      forwardedTokens: globalTokens.forwardedTokens,\n      isLoading: globalState.isLoading,\n      authStatus: globalState.authStatus as AuthStatus,\n      error: globalState.error,\n      signIn: globalSignIn,\n      signOut: globalSignOut,\n      isAuthenticationPreloaded: globalIsAuthenticationPreloaded,\n      setPreloadEnabled: globalSetPreloadEnabled,\n      getPreloadEnabled: globalGetPreloadEnabled,\n      displayMode: globalState.displayMode,\n    };\n  }\n\n  // If no context and no global state, provide default loading state\n  // This happens when CivicAuthProvider is present but GlobalAuthManager hasn't initialized yet\n  return {\n    user: null,\n    idToken: null,\n    accessToken: null,\n    refreshToken: null,\n    forwardedTokens: undefined,\n    isLoading: true,\n    authStatus: \"unauthenticated\" as AuthStatus,\n    error: null,\n    signIn: globalSignIn,\n    signOut: globalSignOut,\n    isAuthenticationPreloaded: globalIsAuthenticationPreloaded,\n    setPreloadEnabled: globalSetPreloadEnabled,\n    getPreloadEnabled: globalGetPreloadEnabled,\n    displayMode: config?.displayMode,\n  };\n};\n\nexport { useUser };\n"]}
+{"version":3,"file":"useUser.js","sourceRoot":"","sources":["../../../src/reactjs/hooks/useUser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,YAAY,CAAC;AACb,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,wCAAwC,CAAC;AAIrE,OAAO,EACL,iBAAiB,GAGlB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAsB/E,MAAM,OAAO,GAAG,CACd,MAAyB,EACL,EAAE;IACtB,6DAA6D;IAC7D,MAAM,aAAa,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IAE9C,oCAAoC;IACpC,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAyB,IAAI,CAAC,CAAC;IAE7E,kCAAkC;IAClC,MAAM,kBAAkB,GAAG,aAAa,CAAC;IACzC,MAAM,eAAe,GAAG,CAAC,kBAAkB,CAAC;IAE5C,mDAAmD;IACnD,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,eAAe;YAAE,OAAO;QAE7B,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAEhD,4CAA4C;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,cAAc,GAAG,KAAK,IAAI,EAAE;gBAChC,IAAI,CAAC;oBACH,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBACnC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC,CAAC;YACF,cAAc,EAAE,CAAC;QACnB,CAAC;QAED,6BAA6B;QAC7B,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,EAAE;YACjD,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,oBAAoB;QACpB,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAEnC,OAAO,WAAW,CAAC;IACrB,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IAE9B,uCAAuC;IACvC,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC1C,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;QAEvB,6BAA6B;QAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAe,EAAE,CAAC;IACzC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC3C,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1B,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,sCAAsC;IACtC,MAAM,+BAA+B,GAAG,WAAW,CAAC,GAAG,EAAE;QACvD,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAChD,OAAO,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAC7C,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,uBAAuB,GAAG,WAAW,CAAC,CAAC,OAAgB,EAAE,EAAE;QAC/D,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAChD,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,uBAAuB,GAAG,WAAW,CAAC,GAAG,EAAE;QAC/C,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAChD,OAAO,OAAO,CAAC,iBAAiB,EAAE,CAAC;IACrC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,mCAAmC;IACnC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,EAAE;QAChC,OAAO,wBAAwB,CAAC,WAAW,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC;IAChE,CAAC,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAE3B,2DAA2D;IAC3D,MAAM,gBAAgB,GAAG,WAAW,CAAC,KAAK,IAAgC,EAAE;QAC1E,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,oBAAoB;YAClD,sCAAsC;YACtC,IAAI,aAAa,CAAC,IAAI,EAAE,CAAC;gBACvB,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,IAAe,EAAE,CAAC;YACjD,CAAC;YAED,+DAA+D;YAC/D,OAAO,EAAE,IAAI,EAAE,IAA0B,EAAE,CAAC;QAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;IAEpB,uEAAuE;IACvE,MAAM,+BAA+B,GAAG,WAAW,CAAC,GAAG,EAAE;QACvD,OAAO,KAAK,CAAC,CAAC,kCAAkC;IAClD,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,uBAAuB,GAAG,WAAW,CAAC,CAAC,QAAiB,EAAE,EAAE;QAChE,OAAO,CAAC,IAAI,CACV,kFAAkF,EAClF,QAAQ,CACT,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,uBAAuB,GAAG,WAAW,CAAC,GAAG,EAAE;QAC/C,OAAO,KAAK,CAAC,CAAC,kCAAkC;IAClD,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,2EAA2E;IAC3E,mEAAmE;IACnE,2EAA2E;IAE3E,sDAAsD;IACtD,sDAAsD;IACtD,8CAA8C;IAC9C,gFAAgF;IAChF,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO;YACL,IAAI,EAAE,aAAa,CAAC,IAAsB;YAC1C,OAAO,EAAE,aAAa,CAAC,OAAO;YAC9B,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,YAAY,EAAE,SAAS,EAAE,kCAAkC;YAC3D,eAAe,EAAE,aAAa,CAAC,eAAe;YAC9C,SAAS,EAAE,aAAa,CAAC,SAAS;YAClC,UAAU,EAAE,aAAa,CAAC,UAAU;YACpC,KAAK,EAAE,aAAa,CAAC,KAAK;YAC1B,MAAM,EAAE,gBAAgB;YACxB,OAAO,EAAE,aAAa,CAAC,OAAO;YAC9B,yBAAyB,EAAE,+BAA+B;YAC1D,iBAAiB,EAAE,uBAAuB;YAC1C,iBAAiB,EAAE,uBAAuB;YAC1C,WAAW,EAAE,aAAa,CAAC,WAAW;SACvC,CAAC;IACJ,CAAC;IAED,yDAAyD;IACzD,wEAAwE;IACxE,8CAA8C;IAC9C,6EAA6E;IAC7E,yEAAyE;IACzE,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO;YACL,IAAI,EAAE,WAAW,CAAC,IAAsB;YACxC,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,WAAW,EAAE,YAAY,CAAC,WAAW;YACrC,YAAY,EAAE,YAAY,CAAC,YAAY;YACvC,eAAe,EAAE,YAAY,CAAC,eAAe;YAC7C,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,UAAU,EAAE,WAAW,CAAC,UAAwB;YAChD,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,aAAa;YACtB,yBAAyB,EAAE,+BAA+B;YAC1D,iBAAiB,EAAE,uBAAuB;YAC1C,iBAAiB,EAAE,uBAAuB;YAC1C,WAAW,EAAE,WAAW,CAAC,WAA0B;SACpD,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,8FAA8F;IAC9F,OAAO;QACL,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,IAAI;QACjB,YAAY,EAAE,IAAI;QAClB,eAAe,EAAE,SAAS;QAC1B,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,iBAA+B;QAC3C,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,YAAY;QACpB,OAAO,EAAE,aAAa;QACtB,yBAAyB,EAAE,+BAA+B;QAC1D,iBAAiB,EAAE,uBAAuB;QAC1C,iBAAiB,EAAE,uBAAuB;QAC1C,WAAW,EAAE,MAAM,EAAE,WAA0B;KAChD,CAAC;AACJ,CAAC,CAAC;AAEF,OAAO,EAAE,OAAO,EAAE,CAAC","sourcesContent":["/**\n * useUser Hook\n *\n * A comprehensive user session hook that provides full user data including profile information,\n * authentication tokens, and authentication state. Supports generic typing for custom user data.\n *\n * Use this hook when you:\n * - Need access to user profile information (user object)\n * - Need authentication tokens (JWT, access, refresh tokens)\n * - Are working with custom user data types\n * - Need comprehensive user session data\n * - Want backward compatibility with legacy UserContext\n *\n * This hook supports two authentication patterns with automatic fallback:\n * 1. Provider-based (legacy): Uses CivicAuthProvider or CivicNextAuthProvider\n * 2. Provider-free (modern): Direct configuration via useUser(config)\n *\n * Usage Examples:\n *\n * // With provider (existing approach - NextJS/React providers)\n * <CivicAuthProvider clientId=\"...\" config={{ oauthServer: \"...\" }}>\n *   const { user, isLoading, signIn } = useUser();\n * </CivicAuthProvider>\n *\n * // Without provider (new approach) - direct configuration\n * const { user, authStatus, signOut } = useUser({\n *   clientId: \"your-client-id\",\n *   config: { oauthServer: \"https://auth.civic.com/oauth/\" },\n *   displayMode: \"iframe\", // or \"redirect\", \"popup\", etc.\n *   scopes: [\"openid\", \"profile\", \"email\"],\n *   onSignIn: (error) => console.log(\"Sign in completed\", error),\n *   onSignOut: () => console.log(\"Sign out completed\")\n * });\n *\n * // Generic typing for custom user data\n * interface CustomUser { customField: string; }\n * const { user } = useUser<CustomUser>(); // user will be User<CustomUser> | null\n */\n\"use client\";\nimport { useContext, useState, useEffect, useCallback, useMemo } from \"react\";\nimport { UserContext } from \"../../shared/providers/UserProvider.js\";\nimport type { User, ForwardedTokens } from \"../../types.js\";\nimport type { AuthStatus } from \"../../types.js\";\nimport type { DisplayMode } from \"../../types.js\";\nimport {\n  GlobalAuthManager,\n  type GlobalAuthConfig,\n  type GlobalAuthState,\n} from \"../core/GlobalAuthManager.js\";\nimport { extractTokensFromSession } from \"../../vanillajs/utils/auth-utils.js\";\n\nexport interface UserContextType<\n  T extends Record<string, unknown> = Record<string, never>,\n> {\n  user: User<T> | null;\n  idToken?: string | null;\n  accessToken?: string | null;\n  refreshToken?: string | null;\n  forwardedTokens?: ForwardedTokens;\n  isLoading: boolean;\n  authStatus: AuthStatus;\n  error: Error | null;\n  signIn: () => Promise<{ user: User<T> }>;\n  signOut: () => Promise<void>;\n  // Preloading methods\n  isAuthenticationPreloaded: () => boolean;\n  setPreloadEnabled: (enabled: boolean) => void;\n  getPreloadEnabled: () => boolean;\n  displayMode?: DisplayMode;\n}\n\nconst useUser = <T extends Record<string, unknown> = Record<string, never>>(\n  config?: GlobalAuthConfig,\n): UserContextType<T> => {\n  // Always call context hooks unconditionally (rules of hooks)\n  const sharedContext = useContext(UserContext);\n\n  // State for global manager approach\n  const [globalState, setGlobalState] = useState<GlobalAuthState | null>(null);\n\n  // Determine which approach to use\n  const hasProviderContext = sharedContext;\n  const shouldUseGlobal = !hasProviderContext;\n\n  // Initialize global manager if no provider context\n  useEffect(() => {\n    if (!shouldUseGlobal) return;\n\n    const manager = GlobalAuthManager.getInstance();\n\n    // If config is provided, initialize with it\n    if (config) {\n      const initializeAuth = async () => {\n        try {\n          await manager.initialize(config);\n        } catch (error) {\n          console.error(\"Failed to initialize auth:\", error);\n        }\n      };\n      initializeAuth();\n    }\n\n    // Subscribe to state changes\n    const unsubscribe = manager.subscribe((newState) => {\n      setGlobalState(newState);\n    });\n\n    // Get current state\n    setGlobalState(manager.getState());\n\n    return unsubscribe;\n  }, [shouldUseGlobal, config]);\n\n  // Global manager sign in/out functions\n  const globalSignIn = useCallback(async () => {\n    const manager = GlobalAuthManager.getInstance();\n    await manager.signIn();\n\n    // Get the user after sign in\n    const state = manager.getState();\n    if (!state.user) {\n      throw new Error(\"Authentication succeeded but no user was returned\");\n    }\n\n    return { user: state.user as User<T> };\n  }, []);\n\n  const globalSignOut = useCallback(async () => {\n    const manager = GlobalAuthManager.getInstance();\n    await manager.signOut();\n  }, []);\n\n  // Global manager preloading functions\n  const globalIsAuthenticationPreloaded = useCallback(() => {\n    const manager = GlobalAuthManager.getInstance();\n    return manager.isAuthenticationPreloaded();\n  }, []);\n\n  const globalSetPreloadEnabled = useCallback((enabled: boolean) => {\n    const manager = GlobalAuthManager.getInstance();\n    manager.setPreloadEnabled(enabled);\n  }, []);\n\n  const globalGetPreloadEnabled = useCallback(() => {\n    const manager = GlobalAuthManager.getInstance();\n    return manager.getPreloadEnabled();\n  }, []);\n\n  // Extract tokens from global state\n  const globalTokens = useMemo(() => {\n    return extractTokensFromSession(globalState?.session || null);\n  }, [globalState?.session]);\n\n  // Create wrapper functions for different signIn signatures\n  const wrapSharedSignIn = useCallback(async (): Promise<{ user: User<T> }> => {\n    if (sharedContext) {\n      await sharedContext.signIn(); // This returns void\n      // Get user from context after sign in\n      if (sharedContext.user) {\n        return { user: sharedContext.user as User<T> };\n      }\n\n      // We don't return a user yet in nextjs until the next refactor\n      return { user: null as unknown as User<T> };\n    }\n    throw new Error(\"Shared context not available\");\n  }, [sharedContext]);\n\n  // Shared context preloading stubs (not implemented for legacy context)\n  const sharedIsAuthenticationPreloaded = useCallback(() => {\n    return false; // Not available in shared context\n  }, []);\n\n  const sharedSetPreloadEnabled = useCallback((_enabled: boolean) => {\n    console.warn(\n      \"Preloading not available with legacy UserContext. Use GlobalAuthManager instead.\",\n      _enabled,\n    );\n  }, []);\n\n  const sharedGetPreloadEnabled = useCallback(() => {\n    return false; // Not available in shared context\n  }, []);\n\n  // ========================================================================\n  // FALLBACK PRIORITY SYSTEM - Two authentication context approaches\n  // ========================================================================\n\n  // 1. DEPRECATED UserContext (ACTIVE - Used by NextJS)\n  // Framework-agnostic shared context from UserProvider\n  // Location: shared/providers/UserProvider.tsx\n  // Usage: NextJS example uses CivicNextAuthProvider → UserProvider → UserContext\n  if (sharedContext) {\n    return {\n      user: sharedContext.user as User<T> | null,\n      idToken: sharedContext.idToken,\n      accessToken: sharedContext.accessToken,\n      refreshToken: undefined, // Not available in shared context\n      forwardedTokens: sharedContext.forwardedTokens,\n      isLoading: sharedContext.isLoading,\n      authStatus: sharedContext.authStatus,\n      error: sharedContext.error,\n      signIn: wrapSharedSignIn,\n      signOut: sharedContext.signOut,\n      isAuthenticationPreloaded: sharedIsAuthenticationPreloaded,\n      setPreloadEnabled: sharedSetPreloadEnabled,\n      getPreloadEnabled: sharedGetPreloadEnabled,\n      displayMode: sharedContext.displayMode,\n    };\n  }\n\n  // 2. GlobalAuthManager (MODERN - Provider-free approach)\n  // Singleton-based state management, eliminates need for React providers\n  // Location: reactjs/core/GlobalAuthManager.ts\n  // Usage: React example uses CivicAuthProvider → GlobalAuthManager internally\n  // Can also be used directly: useUser({ clientId: \"...\", config: {...} })\n  if (globalState) {\n    return {\n      user: globalState.user as User<T> | null,\n      idToken: globalTokens.idToken,\n      accessToken: globalTokens.accessToken,\n      refreshToken: globalTokens.refreshToken,\n      forwardedTokens: globalTokens.forwardedTokens,\n      isLoading: globalState.isLoading,\n      authStatus: globalState.authStatus as AuthStatus,\n      error: globalState.error,\n      signIn: globalSignIn,\n      signOut: globalSignOut,\n      isAuthenticationPreloaded: globalIsAuthenticationPreloaded,\n      setPreloadEnabled: globalSetPreloadEnabled,\n      getPreloadEnabled: globalGetPreloadEnabled,\n      displayMode: globalState.displayMode as DisplayMode,\n    };\n  }\n\n  // If no context and no global state, provide default loading state\n  // This happens when CivicAuthProvider is present but GlobalAuthManager hasn't initialized yet\n  return {\n    user: null,\n    idToken: null,\n    accessToken: null,\n    refreshToken: null,\n    forwardedTokens: undefined,\n    isLoading: true,\n    authStatus: \"unauthenticated\" as AuthStatus,\n    error: null,\n    signIn: globalSignIn,\n    signOut: globalSignOut,\n    isAuthenticationPreloaded: globalIsAuthenticationPreloaded,\n    setPreloadEnabled: globalSetPreloadEnabled,\n    getPreloadEnabled: globalGetPreloadEnabled,\n    displayMode: config?.displayMode as DisplayMode,\n  };\n};\n\nexport { useUser };\n"]}

package/dist/server/ServerAuthenticationResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ServerAuthenticationResolver.d.ts","sourceRoot":"","sources":["../../src/server/ServerAuthenticationResolver.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,WAAW,EACX,SAAS,EACT,qBAAqB,EACrB,WAAW,EACZ,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAUrD,OAAO,KAAK,EAAE,sBAAsB,EAAgB,MAAM,qBAAqB,CAAC;AAOhF,qBAAa,4BAA6B,YAAW,sBAAsB;IAMvE,QAAQ,CAAC,UAAU,EAAE,UAAU;IAC/B,QAAQ,CAAC,OAAO,EAAE,WAAW;IAC7B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC;IAPjD,OAAO,CAAC,YAAY,CAAsB;IAC1C,OAAO,CAAC,YAAY,CAA2B;IAC/C,OAAO,CAAC,SAAS,CAAwB;IAEzC,OAAO;IAeP;;;;OAIG;IACG,gBAAgB,CACpB,WAAW,EAAE,WAAW,GAAG,IAAI,GAC9B,OAAO,CAAC,WAAW,CAAC;IA+DvB;;;OAGG;IACG,uBAAuB,CAAC,WAAW,UAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAmDvE,IAAI,WAAW,IAAI,MAAM,CAExB;IAEK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAkBrB,aAAa,CACjB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,qBAAqB,CAAC;IA4B3B,cAAc,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAc7C,qBAAqB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;WAOxC,KAAK,CAChB,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,WAAW,EACpB,iBAAiB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,GACrC,OAAO,CAAC,sBAAsB,CAAC;CAUnC"}
+{"version":3,"file":"ServerAuthenticationResolver.d.ts","sourceRoot":"","sources":["../../src/server/ServerAuthenticationResolver.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,WAAW,EACX,SAAS,EACT,qBAAqB,EACrB,WAAW,EACZ,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAUrD,OAAO,KAAK,EAAE,sBAAsB,EAAgB,MAAM,qBAAqB,CAAC;AAOhF,qBAAa,4BAA6B,YAAW,sBAAsB;IAMvE,QAAQ,CAAC,UAAU,EAAE,UAAU;IAC/B,QAAQ,CAAC,OAAO,EAAE,WAAW;IAC7B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC;IAPjD,OAAO,CAAC,YAAY,CAAsB;IAC1C,OAAO,CAAC,YAAY,CAA2B;IAC/C,OAAO,CAAC,SAAS,CAAwB;IAEzC,OAAO;IAeP;;;;OAIG;IACG,gBAAgB,CACpB,WAAW,EAAE,WAAW,GAAG,IAAI,GAC9B,OAAO,CAAC,WAAW,CAAC;IA+DvB;;;OAGG;IACG,uBAAuB,CAAC,WAAW,UAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAmDvE,IAAI,WAAW,IAAI,MAAM,CAExB;IAEK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAuBrB,aAAa,CACjB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,qBAAqB,CAAC;IA4B3B,cAAc,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAc7C,qBAAqB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;WAOxC,KAAK,CAChB,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,WAAW,EACpB,iBAAiB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,GACrC,OAAO,CAAC,sBAAsB,CAAC;CAUnC"}

package/dist/server/ServerAuthenticationResolver.js

@@ -125,6 +125,10 @@ export class ServerAuthenticationResolver {
         return this.authConfig.oauthServer || DEFAULT_AUTH_SERVER;
     }
     async init() {
+        // Ensure clientId is present for OAuth operations
+        if (!this.authConfig.clientId) {
+            throw new Error("clientId is required for OAuth server operations");
+        }
         // resolve oauth config
         this.endpoints = await getEndpointsWithOverrides(this.oauthServer, this.endpointOverrides);
         this.oauth2client = new OAuth2Client(this.authConfig.clientId, this.endpoints.auth, this.endpoints.token, {

package/dist/server/ServerAuthenticationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"ServerAuthenticationResolver.js","sourceRoot":"","sources":["../../src/server/ServerAuthenticationResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAQ3C,OAAO,EACL,WAAW,EACX,SAAS,EACT,cAAc,EACd,yBAAyB,EACzB,cAAc,EACd,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE1C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;AAE3C,MAAM,OAAO,4BAA4B;IAM5B;IACA;IACA;IAPH,YAAY,CAAsB;IAClC,YAAY,CAA2B;IACvC,SAAS,CAAwB;IAEzC,YACW,UAAsB,EACtB,OAAoB,EACpB,iBAAsC;QAFtC,eAAU,GAAV,UAAU,CAAY;QACtB,YAAO,GAAP,OAAO,CAAa;QACpB,sBAAiB,GAAjB,iBAAiB,CAAqB;QAE/C,mDAAmD;QACnD,kBAAkB;QAClB,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,KAAK,KAAK,CAAC;QAE1C,gDAAgD;QAChD,IAAI,CAAC,YAAY,GAAG,OAAO;YACzB,CAAC,CAAC,IAAI,+BAA+B,CAAC,OAAO,CAAC;YAC9C,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CACpB,WAA+B;QAE/B,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;QAClD,wDAAwD;QACxD,IAAI,WAAW,EAAE,YAAY,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,uDAAuD;gBACvD,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;oBAChD,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;gBACpB,CAAC;gBAED,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;oBAChD,MAAM,IAAI,KAAK,CACb,qDAAqD,CACtD,CAAC;gBACJ,CAAC;gBAED,mDAAmD;gBACnD,MAAM,cAAc,GAA2B,EAAE,CAAC;gBAClD,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;oBACjC,cAAc,CAAC,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;oBAC1D,cAAc,CAAC,gBAAgB,GAAG,cAAc,CAAC;gBACnD,CAAC;gBAED,MAAM,iBAAiB,GAAG,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CACnE,WAAW,CAAC,YAAY,EACxB,cAAc,CACf,CAA0B,CAAC;gBAE5B,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBACvB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;gBAC/D,CAAC;gBAED,gCAAgC;gBAChC,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,IAAI,CAAC,SAAS,CAAC,IAAI,EACnB,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,WAAW,CACjB,CAAC;gBAEF,6BAA6B;gBAC7B,MAAM,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;gBAEzD,oDAAoD;gBACpD,OAAO;oBACL,aAAa,EAAE,IAAI;oBACnB,OAAO,EAAE,iBAAiB,CAAC,QAAQ;oBACnC,WAAW,EAAE,iBAAiB,CAAC,YAAY;oBAC3C,YAAY,EAAE,iBAAiB,CAAC,aAAa;oBAC7C,oBAAoB,EAAE,iBAAiB,CAAC,uBAAuB;iBAChE,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;gBAC/C,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAChC,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC9B,OAAO,EAAE,GAAG,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;YAClD,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,OAAO,EAAE,GAAG,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IAClD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,uBAAuB,CAAC,WAAW,GAAG,IAAI;QAC9C,sEAAsE;QACtE,qFAAqF;QACrF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAEhD,0EAA0E;QAC1E,wDAAwD;QACxD,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC;YAC1B,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACtE,IAAI,oBAAoB,CAAC,aAAa,EAAE,CAAC;oBACvC,OAAO,oBAAoB,CAAC;gBAC9B,CAAC;YACH,CAAC;YACD,OAAO,EAAE,GAAG,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QAClD,CAAC;QAED,uBAAuB;QACvB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAEnE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QAED,IAAI,CAAC;YACH,+EAA+E;YAC/E,MAAM,oBAAoB,CACxB;gBACE,YAAY,EAAE,WAAW,CAAC,WAAW,EAAE,mBAAmB;gBAC1D,QAAQ,EAAE,WAAW,CAAC,OAAO,EAAE,kBAAkB;gBACjD,aAAa,EAAE,WAAW,CAAC,YAAY;gBACvC,uBAAuB,EAAE,WAAW,CAAC,oBAAoB;aAC1D,EACD,IAAI,CAAC,SAAS,CAAC,IAAI,EACnB,IAAI,CAAC,YAAa,EAClB,IAAI,CAAC,WAAW,CACjB,CAAC;YACF,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC/D,IAAI,WAAW,EAAE,CAAC;gBAChB,mDAAmD;gBACnD,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACtE,IAAI,oBAAoB,CAAC,aAAa,EAAE,CAAC;oBACvC,OAAO,oBAAoB,CAAC;gBAC9B,CAAC;YACH,CAAC;YACD,OAAO,EAAE,GAAG,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QAClD,CAAC;IACH,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,IAAI,mBAAmB,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,IAAI;QACR,uBAAuB;QACvB,IAAI,CAAC,SAAS,GAAG,MAAM,yBAAyB,CAC9C,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,iBAAiB,CACvB,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAClC,IAAI,CAAC,UAAU,CAAC,QAAQ,EACxB,IAAI,CAAC,SAAS,CAAC,IAAI,EACnB,IAAI,CAAC,SAAS,CAAC,KAAK,EACpB;YACE,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW;SACzC,CACF,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,IAAY,EACZ,KAAa;QAEb,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAE1C,iEAAiE;QACjE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,CAAC;YAC/D,IAAI,CAAC,YAAY;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC3E,CAAC;QAED,gCAAgC;QAChC,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,IAAI,EACJ,KAAK,EACL,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,YAAa,EAAE,8CAA8C;QAClE,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,SAAU,EAAE,8CAA8C;QAC/D,IAAI,CAAC,UAAU,CAAC,YAAY,CAC7B,CAAC;QAEF,MAAM,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9C,wEAAwE;QACxE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEvD,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAE9B,OAAO;YACL,aAAa,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,EAAE,iDAAiD;YACxF,OAAO,EAAE,WAAW,CAAC,QAAQ;YAC7B,WAAW,EAAE,WAAW,CAAC,YAAY,EAAE,WAAW;YAClD,YAAY,EAAE,WAAW,CAAC,aAAa;YACvC,oBAAoB,EAAE,WAAW,CAAC,uBAAuB;SAC1D,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,qBAAqB;QACzB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;IACnC,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,KAAK,CAChB,UAAsB,EACtB,OAAoB,EACpB,iBAAsC;QAEtC,MAAM,QAAQ,GAAG,IAAI,4BAA4B,CAC/C,UAAU,EACV,OAAO,EACP,iBAAiB,CAClB,CAAC;QACF,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEtB,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF","sourcesContent":["import { GenericPublicClientPKCEProducer } from \"@/services/PKCE.js\";\nimport { OAuth2Client } from \"oslo/oauth2\";\nimport type {\n  AuthStorage,\n  Endpoints,\n  OIDCTokenResponseBody,\n  SessionData,\n} from \"@/types.js\";\nimport type { AuthConfig } from \"@/server/config.js\";\nimport {\n  clearTokens,\n  clearUser,\n  exchangeTokens,\n  getEndpointsWithOverrides,\n  retrieveTokens,\n  storeServerTokens,\n  validateOauth2Tokens,\n} from \"@/shared/lib/util.js\";\nimport type { AuthenticationResolver, PKCEProducer } from \"@/services/types.ts\";\nimport { DEFAULT_AUTH_SERVER } from \"@/constants.js\";\nimport { CodeVerifier } from \"@/shared/lib/types.js\";\nimport { loggers } from \"@/lib/logger.js\";\n\nconst logger = loggers.services.validation;\n\nexport class ServerAuthenticationResolver implements AuthenticationResolver {\n  private pkceProducer: PKCEProducer | null;\n  private oauth2client: OAuth2Client | undefined;\n  private endpoints: Endpoints | undefined;\n\n  private constructor(\n    readonly authConfig: AuthConfig,\n    readonly storage: AuthStorage,\n    readonly endpointOverrides?: Partial<Endpoints>,\n  ) {\n    // Determine if PKCE should be used based on config\n    // Default to true\n    const usePkce = authConfig.pkce !== false;\n\n    // Only create PKCE producer if we're using PKCE\n    this.pkceProducer = usePkce\n      ? new GenericPublicClientPKCEProducer(storage)\n      : null;\n  }\n\n  /**\n   * Attempts to refresh tokens if a refresh token is available\n   * @param sessionData Current session data\n   * @returns Updated session data\n   */\n  async tryRefreshTokens(\n    sessionData: SessionData | null,\n  ): Promise<SessionData> {\n    logger.debug(\"tryRefreshTokens\", { sessionData });\n    // If there's a refresh token, attempt to refresh tokens\n    if (sessionData?.refreshToken) {\n      try {\n        // Only attempt refresh if we have necessary components\n        if (!this.oauth2client || !this.endpoints?.jwks) {\n          await this.init();\n        }\n\n        if (!this.oauth2client || !this.endpoints?.jwks) {\n          throw new Error(\n            \"Failed to initialize OAuth client for token refresh\",\n          );\n        }\n\n        // Use the oauth2client to refresh the access token\n        const refreshOptions: Record<string, string> = {};\n        if (this.authConfig.clientSecret) {\n          refreshOptions.credentials = this.authConfig.clientSecret;\n          refreshOptions.authenticateWith = \"request_body\";\n        }\n\n        const tokenResponseBody = (await this.oauth2client.refreshAccessToken(\n          sessionData.refreshToken,\n          refreshOptions,\n        )) as OIDCTokenResponseBody;\n\n        if (!tokenResponseBody) {\n          throw new Error(\"Failed to get token response from refresh\");\n        }\n\n        // Validate the refreshed tokens\n        await validateOauth2Tokens(\n          tokenResponseBody,\n          this.endpoints.jwks,\n          this.oauth2client,\n          this.oauthServer,\n        );\n\n        // Store the refreshed tokens\n        await storeServerTokens(this.storage, tokenResponseBody);\n\n        // Construct a refreshed session with the new tokens\n        return {\n          authenticated: true,\n          idToken: tokenResponseBody.id_token,\n          accessToken: tokenResponseBody.access_token,\n          refreshToken: tokenResponseBody.refresh_token,\n          oidcSessionExpiresAt: tokenResponseBody.oidc_session_expires_at,\n        };\n      } catch (error) {\n        logger.warn(\"Failed to refresh tokens\", error);\n        await clearTokens(this.storage);\n        await clearUser(this.storage);\n        return { ...sessionData, authenticated: false };\n      }\n    }\n\n    // No refresh token available\n    return { ...sessionData, authenticated: false };\n  }\n\n  /**\n   * returns The session data if the session is valid, otherwise an unauthenticated session\n   * @returns {Promise<SessionData>}\n   */\n  async validateExistingSession(autoRefresh = true): Promise<SessionData> {\n    // TODO: investigate a more peformant way to validate a server session\n    // other than using JWKS and JWT verification which is what validateOauth2Tokens uses\n    const sessionData = await this.getSessionData();\n\n    // If we don't have an ID token, try to refresh if we have a refresh token\n    // Access token is no longer required for authentication\n    if (!sessionData?.idToken) {\n      if (autoRefresh) {\n        const refreshedSessionData = await this.tryRefreshTokens(sessionData);\n        if (refreshedSessionData.authenticated) {\n          return refreshedSessionData;\n        }\n      }\n      return { ...sessionData, authenticated: false };\n    }\n\n    // Initialize if needed\n    if (!this.endpoints?.jwks || !this.oauth2client) await this.init();\n\n    if (!this.endpoints?.jwks) {\n      throw new Error(\"JWKS endpoint not found\");\n    }\n\n    try {\n      // Validate existing tokens - access token validation happens only if it exists\n      await validateOauth2Tokens(\n        {\n          access_token: sessionData.accessToken, // May be undefined\n          id_token: sessionData.idToken, // Always required\n          refresh_token: sessionData.refreshToken,\n          oidc_session_expires_at: sessionData.oidcSessionExpiresAt,\n        },\n        this.endpoints.jwks,\n        this.oauth2client!,\n        this.oauthServer,\n      );\n      return sessionData;\n    } catch (error) {\n      logger.warn(\"Error validating tokens\", { error, autoRefresh });\n      if (autoRefresh) {\n        // If token validation fails, try to refresh tokens\n        const refreshedSessionData = await this.tryRefreshTokens(sessionData);\n        if (refreshedSessionData.authenticated) {\n          return refreshedSessionData;\n        }\n      }\n      return { ...sessionData, authenticated: false };\n    }\n  }\n\n  get oauthServer(): string {\n    return this.authConfig.oauthServer || DEFAULT_AUTH_SERVER;\n  }\n\n  async init(): Promise<this> {\n    // resolve oauth config\n    this.endpoints = await getEndpointsWithOverrides(\n      this.oauthServer,\n      this.endpointOverrides,\n    );\n    this.oauth2client = new OAuth2Client(\n      this.authConfig.clientId,\n      this.endpoints.auth,\n      this.endpoints.token,\n      {\n        redirectURI: this.authConfig.redirectUrl,\n      },\n    );\n\n    return this;\n  }\n\n  async tokenExchange(\n    code: string,\n    state: string,\n  ): Promise<OIDCTokenResponseBody> {\n    if (!this.oauth2client) await this.init();\n\n    // Check if we're using PKCE and validate code verifier if needed\n    if (this.pkceProducer) {\n      const codeVerifier = await this.pkceProducer.getCodeVerifier();\n      if (!codeVerifier) throw new Error(\"Code verifier not found in storage\");\n    }\n\n    // exchange auth code for tokens\n    const tokens = await exchangeTokens(\n      code,\n      state,\n      this.pkceProducer,\n      this.oauth2client!, // clean up types here to avoid the ! operator\n      this.oauthServer,\n      this.endpoints!, // clean up types here to avoid the ! operator\n      this.authConfig.clientSecret,\n    );\n\n    await storeServerTokens(this.storage, tokens);\n    // the code verifier should be single-use, so we delete it if using PKCE\n    if (this.pkceProducer) {\n      await this.storage.delete(CodeVerifier.COOKIE_NAME);\n    }\n    return tokens;\n  }\n\n  async getSessionData(): Promise<SessionData | null> {\n    const storageData = await retrieveTokens(this.storage);\n\n    if (!storageData) return null;\n\n    return {\n      authenticated: !!storageData.id_token, // User is authenticated if they have an ID token\n      idToken: storageData.id_token,\n      accessToken: storageData.access_token, // Optional\n      refreshToken: storageData.refresh_token,\n      oidcSessionExpiresAt: storageData.oidc_session_expires_at,\n    };\n  }\n\n  async getEndSessionEndpoint(): Promise<string | null> {\n    if (!this.endpoints) {\n      return null;\n    }\n    return this.endpoints.endsession;\n  }\n\n  static async build(\n    authConfig: AuthConfig,\n    storage: AuthStorage,\n    endpointOverrides?: Partial<Endpoints>,\n  ): Promise<AuthenticationResolver> {\n    const resolver = new ServerAuthenticationResolver(\n      authConfig,\n      storage,\n      endpointOverrides,\n    );\n    await resolver.init();\n\n    return resolver;\n  }\n}\n"]}
+{"version":3,"file":"ServerAuthenticationResolver.js","sourceRoot":"","sources":["../../src/server/ServerAuthenticationResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAQ3C,OAAO,EACL,WAAW,EACX,SAAS,EACT,cAAc,EACd,yBAAyB,EACzB,cAAc,EACd,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE1C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;AAE3C,MAAM,OAAO,4BAA4B;IAM5B;IACA;IACA;IAPH,YAAY,CAAsB;IAClC,YAAY,CAA2B;IACvC,SAAS,CAAwB;IAEzC,YACW,UAAsB,EACtB,OAAoB,EACpB,iBAAsC;QAFtC,eAAU,GAAV,UAAU,CAAY;QACtB,YAAO,GAAP,OAAO,CAAa;QACpB,sBAAiB,GAAjB,iBAAiB,CAAqB;QAE/C,mDAAmD;QACnD,kBAAkB;QAClB,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,KAAK,KAAK,CAAC;QAE1C,gDAAgD;QAChD,IAAI,CAAC,YAAY,GAAG,OAAO;YACzB,CAAC,CAAC,IAAI,+BAA+B,CAAC,OAAO,CAAC;YAC9C,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CACpB,WAA+B;QAE/B,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;QAClD,wDAAwD;QACxD,IAAI,WAAW,EAAE,YAAY,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,uDAAuD;gBACvD,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;oBAChD,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;gBACpB,CAAC;gBAED,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;oBAChD,MAAM,IAAI,KAAK,CACb,qDAAqD,CACtD,CAAC;gBACJ,CAAC;gBAED,mDAAmD;gBACnD,MAAM,cAAc,GAA2B,EAAE,CAAC;gBAClD,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;oBACjC,cAAc,CAAC,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;oBAC1D,cAAc,CAAC,gBAAgB,GAAG,cAAc,CAAC;gBACnD,CAAC;gBAED,MAAM,iBAAiB,GAAG,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CACnE,WAAW,CAAC,YAAY,EACxB,cAAc,CACf,CAA0B,CAAC;gBAE5B,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBACvB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;gBAC/D,CAAC;gBAED,gCAAgC;gBAChC,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,IAAI,CAAC,SAAS,CAAC,IAAI,EACnB,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,WAAW,CACjB,CAAC;gBAEF,6BAA6B;gBAC7B,MAAM,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;gBAEzD,oDAAoD;gBACpD,OAAO;oBACL,aAAa,EAAE,IAAI;oBACnB,OAAO,EAAE,iBAAiB,CAAC,QAAQ;oBACnC,WAAW,EAAE,iBAAiB,CAAC,YAAY;oBAC3C,YAAY,EAAE,iBAAiB,CAAC,aAAa;oBAC7C,oBAAoB,EAAE,iBAAiB,CAAC,uBAAuB;iBAChE,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;gBAC/C,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAChC,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC9B,OAAO,EAAE,GAAG,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;YAClD,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,OAAO,EAAE,GAAG,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IAClD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,uBAAuB,CAAC,WAAW,GAAG,IAAI;QAC9C,sEAAsE;QACtE,qFAAqF;QACrF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAEhD,0EAA0E;QAC1E,wDAAwD;QACxD,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC;YAC1B,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACtE,IAAI,oBAAoB,CAAC,aAAa,EAAE,CAAC;oBACvC,OAAO,oBAAoB,CAAC;gBAC9B,CAAC;YACH,CAAC;YACD,OAAO,EAAE,GAAG,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QAClD,CAAC;QAED,uBAAuB;QACvB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAEnE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QAED,IAAI,CAAC;YACH,+EAA+E;YAC/E,MAAM,oBAAoB,CACxB;gBACE,YAAY,EAAE,WAAW,CAAC,WAAW,EAAE,mBAAmB;gBAC1D,QAAQ,EAAE,WAAW,CAAC,OAAO,EAAE,kBAAkB;gBACjD,aAAa,EAAE,WAAW,CAAC,YAAY;gBACvC,uBAAuB,EAAE,WAAW,CAAC,oBAAoB;aAC1D,EACD,IAAI,CAAC,SAAS,CAAC,IAAI,EACnB,IAAI,CAAC,YAAa,EAClB,IAAI,CAAC,WAAW,CACjB,CAAC;YACF,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC/D,IAAI,WAAW,EAAE,CAAC;gBAChB,mDAAmD;gBACnD,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACtE,IAAI,oBAAoB,CAAC,aAAa,EAAE,CAAC;oBACvC,OAAO,oBAAoB,CAAC;gBAC9B,CAAC;YACH,CAAC;YACD,OAAO,EAAE,GAAG,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QAClD,CAAC;IACH,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,IAAI,mBAAmB,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,IAAI;QACR,kDAAkD;QAClD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QAED,uBAAuB;QACvB,IAAI,CAAC,SAAS,GAAG,MAAM,yBAAyB,CAC9C,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,iBAAiB,CACvB,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAClC,IAAI,CAAC,UAAU,CAAC,QAAQ,EACxB,IAAI,CAAC,SAAS,CAAC,IAAI,EACnB,IAAI,CAAC,SAAS,CAAC,KAAK,EACpB;YACE,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW;SACzC,CACF,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,IAAY,EACZ,KAAa;QAEb,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAE1C,iEAAiE;QACjE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,CAAC;YAC/D,IAAI,CAAC,YAAY;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC3E,CAAC;QAED,gCAAgC;QAChC,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,IAAI,EACJ,KAAK,EACL,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,YAAa,EAAE,8CAA8C;QAClE,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,SAAU,EAAE,8CAA8C;QAC/D,IAAI,CAAC,UAAU,CAAC,YAAY,CAC7B,CAAC;QAEF,MAAM,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9C,wEAAwE;QACxE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEvD,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAE9B,OAAO;YACL,aAAa,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,EAAE,iDAAiD;YACxF,OAAO,EAAE,WAAW,CAAC,QAAQ;YAC7B,WAAW,EAAE,WAAW,CAAC,YAAY,EAAE,WAAW;YAClD,YAAY,EAAE,WAAW,CAAC,aAAa;YACvC,oBAAoB,EAAE,WAAW,CAAC,uBAAuB;SAC1D,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,qBAAqB;QACzB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;IACnC,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,KAAK,CAChB,UAAsB,EACtB,OAAoB,EACpB,iBAAsC;QAEtC,MAAM,QAAQ,GAAG,IAAI,4BAA4B,CAC/C,UAAU,EACV,OAAO,EACP,iBAAiB,CAClB,CAAC;QACF,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEtB,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF","sourcesContent":["import { GenericPublicClientPKCEProducer } from \"@/services/PKCE.js\";\nimport { OAuth2Client } from \"oslo/oauth2\";\nimport type {\n  AuthStorage,\n  Endpoints,\n  OIDCTokenResponseBody,\n  SessionData,\n} from \"@/types.js\";\nimport type { AuthConfig } from \"@/server/config.js\";\nimport {\n  clearTokens,\n  clearUser,\n  exchangeTokens,\n  getEndpointsWithOverrides,\n  retrieveTokens,\n  storeServerTokens,\n  validateOauth2Tokens,\n} from \"@/shared/lib/util.js\";\nimport type { AuthenticationResolver, PKCEProducer } from \"@/services/types.ts\";\nimport { DEFAULT_AUTH_SERVER } from \"@/constants.js\";\nimport { CodeVerifier } from \"@/shared/lib/types.js\";\nimport { loggers } from \"@/lib/logger.js\";\n\nconst logger = loggers.services.validation;\n\nexport class ServerAuthenticationResolver implements AuthenticationResolver {\n  private pkceProducer: PKCEProducer | null;\n  private oauth2client: OAuth2Client | undefined;\n  private endpoints: Endpoints | undefined;\n\n  private constructor(\n    readonly authConfig: AuthConfig,\n    readonly storage: AuthStorage,\n    readonly endpointOverrides?: Partial<Endpoints>,\n  ) {\n    // Determine if PKCE should be used based on config\n    // Default to true\n    const usePkce = authConfig.pkce !== false;\n\n    // Only create PKCE producer if we're using PKCE\n    this.pkceProducer = usePkce\n      ? new GenericPublicClientPKCEProducer(storage)\n      : null;\n  }\n\n  /**\n   * Attempts to refresh tokens if a refresh token is available\n   * @param sessionData Current session data\n   * @returns Updated session data\n   */\n  async tryRefreshTokens(\n    sessionData: SessionData | null,\n  ): Promise<SessionData> {\n    logger.debug(\"tryRefreshTokens\", { sessionData });\n    // If there's a refresh token, attempt to refresh tokens\n    if (sessionData?.refreshToken) {\n      try {\n        // Only attempt refresh if we have necessary components\n        if (!this.oauth2client || !this.endpoints?.jwks) {\n          await this.init();\n        }\n\n        if (!this.oauth2client || !this.endpoints?.jwks) {\n          throw new Error(\n            \"Failed to initialize OAuth client for token refresh\",\n          );\n        }\n\n        // Use the oauth2client to refresh the access token\n        const refreshOptions: Record<string, string> = {};\n        if (this.authConfig.clientSecret) {\n          refreshOptions.credentials = this.authConfig.clientSecret;\n          refreshOptions.authenticateWith = \"request_body\";\n        }\n\n        const tokenResponseBody = (await this.oauth2client.refreshAccessToken(\n          sessionData.refreshToken,\n          refreshOptions,\n        )) as OIDCTokenResponseBody;\n\n        if (!tokenResponseBody) {\n          throw new Error(\"Failed to get token response from refresh\");\n        }\n\n        // Validate the refreshed tokens\n        await validateOauth2Tokens(\n          tokenResponseBody,\n          this.endpoints.jwks,\n          this.oauth2client,\n          this.oauthServer,\n        );\n\n        // Store the refreshed tokens\n        await storeServerTokens(this.storage, tokenResponseBody);\n\n        // Construct a refreshed session with the new tokens\n        return {\n          authenticated: true,\n          idToken: tokenResponseBody.id_token,\n          accessToken: tokenResponseBody.access_token,\n          refreshToken: tokenResponseBody.refresh_token,\n          oidcSessionExpiresAt: tokenResponseBody.oidc_session_expires_at,\n        };\n      } catch (error) {\n        logger.warn(\"Failed to refresh tokens\", error);\n        await clearTokens(this.storage);\n        await clearUser(this.storage);\n        return { ...sessionData, authenticated: false };\n      }\n    }\n\n    // No refresh token available\n    return { ...sessionData, authenticated: false };\n  }\n\n  /**\n   * returns The session data if the session is valid, otherwise an unauthenticated session\n   * @returns {Promise<SessionData>}\n   */\n  async validateExistingSession(autoRefresh = true): Promise<SessionData> {\n    // TODO: investigate a more peformant way to validate a server session\n    // other than using JWKS and JWT verification which is what validateOauth2Tokens uses\n    const sessionData = await this.getSessionData();\n\n    // If we don't have an ID token, try to refresh if we have a refresh token\n    // Access token is no longer required for authentication\n    if (!sessionData?.idToken) {\n      if (autoRefresh) {\n        const refreshedSessionData = await this.tryRefreshTokens(sessionData);\n        if (refreshedSessionData.authenticated) {\n          return refreshedSessionData;\n        }\n      }\n      return { ...sessionData, authenticated: false };\n    }\n\n    // Initialize if needed\n    if (!this.endpoints?.jwks || !this.oauth2client) await this.init();\n\n    if (!this.endpoints?.jwks) {\n      throw new Error(\"JWKS endpoint not found\");\n    }\n\n    try {\n      // Validate existing tokens - access token validation happens only if it exists\n      await validateOauth2Tokens(\n        {\n          access_token: sessionData.accessToken, // May be undefined\n          id_token: sessionData.idToken, // Always required\n          refresh_token: sessionData.refreshToken,\n          oidc_session_expires_at: sessionData.oidcSessionExpiresAt,\n        },\n        this.endpoints.jwks,\n        this.oauth2client!,\n        this.oauthServer,\n      );\n      return sessionData;\n    } catch (error) {\n      logger.warn(\"Error validating tokens\", { error, autoRefresh });\n      if (autoRefresh) {\n        // If token validation fails, try to refresh tokens\n        const refreshedSessionData = await this.tryRefreshTokens(sessionData);\n        if (refreshedSessionData.authenticated) {\n          return refreshedSessionData;\n        }\n      }\n      return { ...sessionData, authenticated: false };\n    }\n  }\n\n  get oauthServer(): string {\n    return this.authConfig.oauthServer || DEFAULT_AUTH_SERVER;\n  }\n\n  async init(): Promise<this> {\n    // Ensure clientId is present for OAuth operations\n    if (!this.authConfig.clientId) {\n      throw new Error(\"clientId is required for OAuth server operations\");\n    }\n\n    // resolve oauth config\n    this.endpoints = await getEndpointsWithOverrides(\n      this.oauthServer,\n      this.endpointOverrides,\n    );\n    this.oauth2client = new OAuth2Client(\n      this.authConfig.clientId,\n      this.endpoints.auth,\n      this.endpoints.token,\n      {\n        redirectURI: this.authConfig.redirectUrl,\n      },\n    );\n\n    return this;\n  }\n\n  async tokenExchange(\n    code: string,\n    state: string,\n  ): Promise<OIDCTokenResponseBody> {\n    if (!this.oauth2client) await this.init();\n\n    // Check if we're using PKCE and validate code verifier if needed\n    if (this.pkceProducer) {\n      const codeVerifier = await this.pkceProducer.getCodeVerifier();\n      if (!codeVerifier) throw new Error(\"Code verifier not found in storage\");\n    }\n\n    // exchange auth code for tokens\n    const tokens = await exchangeTokens(\n      code,\n      state,\n      this.pkceProducer,\n      this.oauth2client!, // clean up types here to avoid the ! operator\n      this.oauthServer,\n      this.endpoints!, // clean up types here to avoid the ! operator\n      this.authConfig.clientSecret,\n    );\n\n    await storeServerTokens(this.storage, tokens);\n    // the code verifier should be single-use, so we delete it if using PKCE\n    if (this.pkceProducer) {\n      await this.storage.delete(CodeVerifier.COOKIE_NAME);\n    }\n    return tokens;\n  }\n\n  async getSessionData(): Promise<SessionData | null> {\n    const storageData = await retrieveTokens(this.storage);\n\n    if (!storageData) return null;\n\n    return {\n      authenticated: !!storageData.id_token, // User is authenticated if they have an ID token\n      idToken: storageData.id_token,\n      accessToken: storageData.access_token, // Optional\n      refreshToken: storageData.refresh_token,\n      oidcSessionExpiresAt: storageData.oidc_session_expires_at,\n    };\n  }\n\n  async getEndSessionEndpoint(): Promise<string | null> {\n    if (!this.endpoints) {\n      return null;\n    }\n    return this.endpoints.endsession;\n  }\n\n  static async build(\n    authConfig: AuthConfig,\n    storage: AuthStorage,\n    endpointOverrides?: Partial<Endpoints>,\n  ): Promise<AuthenticationResolver> {\n    const resolver = new ServerAuthenticationResolver(\n      authConfig,\n      storage,\n      endpointOverrides,\n    );\n    await resolver.init();\n\n    return resolver;\n  }\n}\n"]}

package/dist/server/config.d.ts

@@ -12,7 +12,6 @@ export interface BackendEndpoints {
     user?: string;
 }
 export type AuthConfig = {
-    clientId: string;
     clientSecret?: string;
     pkce?: boolean;
     redirectUrl: string;
@@ -21,7 +20,6 @@ export type AuthConfig = {
     refreshUrl?: string;
     endpointOverrides?: Partial<Endpoints> | undefined;
     postLogoutRedirectUrl?: string;
-    loginUrl?: string;
     /**
      * Custom backend endpoints configuration for backend integration
      * Only used when loginUrl is provided. Allows overriding default endpoints.
@@ -56,5 +54,15 @@ export type AuthConfig = {
      * Useful for testing environments like Cypress where iframe detection may interfere with expected redirects.
      */
     disableIframeDetection?: boolean;
-};
+} & ({
+    /** OAuth client ID - required for standard OAuth flow */
+    clientId: string;
+    /** Custom login URL for backend integration - optional */
+    loginUrl?: string;
+} | {
+    /** OAuth client ID - optional when using backend integration */
+    clientId?: string;
+    /** Custom login URL for backend integration - required when clientId is not provided */
+    loginUrl: string;
+});
 //# sourceMappingURL=config.d.ts.map

package/dist/server/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/server/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;IACnD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;OAEG;IACH,IAAI,CAAC,EAAE;QACL,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;QACrC,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;KAC3B,CAAC;IACF;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/server/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;IACnD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;OAEG;IACH,IAAI,CAAC,EAAE;QACL,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;QACrC,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;KAC3B,CAAC;IACF;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC,GAAG,CACA;IACE,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACD;IACE,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wFAAwF;IACxF,QAAQ,EAAE,MAAM,CAAC;CAClB,CACJ,CAAC"}

package/dist/server/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/server/config.ts"],"names":[],"mappings":"","sourcesContent":["import type { Endpoints } from \"@/types.ts\";\n\n/**\n * Configuration for backend authentication endpoints\n * Allows customization of API endpoints when using backend integration (loginUrl)\n */\nexport interface BackendEndpoints {\n  /** Endpoint for token refresh (default: \"/auth/refresh\") */\n  refresh?: string;\n  /** Endpoint for logout (default: \"/auth/logout\") */\n  logout?: string;\n  /** Endpoint for user info and session validation (default: \"/auth/user\") */\n  user?: string;\n}\n\nexport type AuthConfig = {\n  clientId: string;\n  clientSecret?: string; // Optional client secret for confidential clients\n  pkce?: boolean; // Optional PKCE flag, defaults to true if not specified\n  redirectUrl: string;\n  oauthServer?: string;\n  challengeUrl?: string;\n  refreshUrl?: string;\n  endpointOverrides?: Partial<Endpoints> | undefined;\n  postLogoutRedirectUrl?: string;\n  loginUrl?: string;\n  /**\n   * Custom backend endpoints configuration for backend integration\n   * Only used when loginUrl is provided. Allows overriding default endpoints.\n   */\n  backendEndpoints?: BackendEndpoints;\n  /**\n   * Optional URL to redirect frontend clients back to after successful authentication.\n   * When provided, the backend will automatically redirect SPA clients to this URL\n   * instead of traditional server-side redirects. Useful for backend + frontend integration.\n   * Example: \"http://localhost:5173\" or \"https://your-spa.com\"\n   */\n  loginSuccessUrl?: string;\n  /**\n   * Optional CORS configuration for authentication endpoints\n   */\n  cors?: {\n    origin?: string | string[] | boolean;\n    credentials?: boolean;\n    optionsSuccessStatus?: number;\n    allowedHeaders?: string[];\n    exposedHeaders?: string[];\n  };\n  /**\n   * Optional logger configuration for authentication middleware\n   */\n  logger?: {\n    enabled?: boolean; // Defaults to true if not specified\n  };\n  /**\n   * Optional flag to disable iframe detection in handleCallback.\n   * When true, callbacks will always attempt to redirect instead of returning HTML content for iframes.\n   * Useful for testing environments like Cypress where iframe detection may interfere with expected redirects.\n   */\n  disableIframeDetection?: boolean;\n};\n"]}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/server/config.ts"],"names":[],"mappings":"","sourcesContent":["import type { Endpoints } from \"@/types.ts\";\n\n/**\n * Configuration for backend authentication endpoints\n * Allows customization of API endpoints when using backend integration (loginUrl)\n */\nexport interface BackendEndpoints {\n  /** Endpoint for token refresh (default: \"/auth/refresh\") */\n  refresh?: string;\n  /** Endpoint for logout (default: \"/auth/logout\") */\n  logout?: string;\n  /** Endpoint for user info and session validation (default: \"/auth/user\") */\n  user?: string;\n}\n\nexport type AuthConfig = {\n  clientSecret?: string; // Optional client secret for confidential clients\n  pkce?: boolean; // Optional PKCE flag, defaults to true if not specified\n  redirectUrl: string;\n  oauthServer?: string;\n  challengeUrl?: string;\n  refreshUrl?: string;\n  endpointOverrides?: Partial<Endpoints> | undefined;\n  postLogoutRedirectUrl?: string;\n  /**\n   * Custom backend endpoints configuration for backend integration\n   * Only used when loginUrl is provided. Allows overriding default endpoints.\n   */\n  backendEndpoints?: BackendEndpoints;\n  /**\n   * Optional URL to redirect frontend clients back to after successful authentication.\n   * When provided, the backend will automatically redirect SPA clients to this URL\n   * instead of traditional server-side redirects. Useful for backend + frontend integration.\n   * Example: \"http://localhost:5173\" or \"https://your-spa.com\"\n   */\n  loginSuccessUrl?: string;\n  /**\n   * Optional CORS configuration for authentication endpoints\n   */\n  cors?: {\n    origin?: string | string[] | boolean;\n    credentials?: boolean;\n    optionsSuccessStatus?: number;\n    allowedHeaders?: string[];\n    exposedHeaders?: string[];\n  };\n  /**\n   * Optional logger configuration for authentication middleware\n   */\n  logger?: {\n    enabled?: boolean; // Defaults to true if not specified\n  };\n  /**\n   * Optional flag to disable iframe detection in handleCallback.\n   * When true, callbacks will always attempt to redirect instead of returning HTML content for iframes.\n   * Useful for testing environments like Cypress where iframe detection may interfere with expected redirects.\n   */\n  disableIframeDetection?: boolean;\n} & (\n  | {\n      /** OAuth client ID - required for standard OAuth flow */\n      clientId: string;\n      /** Custom login URL for backend integration - optional */\n      loginUrl?: string;\n    }\n  | {\n      /** OAuth client ID - optional when using backend integration */\n      clientId?: string;\n      /** Custom login URL for backend integration - required when clientId is not provided */\n      loginUrl: string;\n    }\n);\n"]}

package/dist/server/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/server/login.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,qBAAqB,EACrB,aAAa,EACd,MAAM,YAAY,CAAC;AAKpB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGrD;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,qBAAqB,CAAC,CAWhC;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAEvE;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,GAAG,aAAa,CAAC,GAClD,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,GAAG,MAAM,GAAG,cAAc,CAAC,CAAC,GAAG;IACnE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,EACH,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,GAAG,CAAC,CAsCd"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/server/login.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,qBAAqB,EACrB,aAAa,EACd,MAAM,YAAY,CAAC;AAKpB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGrD;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,qBAAqB,CAAC,CAWhC;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAEvE;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,GAAG,aAAa,CAAC,GAClD,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,GAAG,MAAM,GAAG,cAAc,CAAC,CAAC,GAAG;IACnE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,EACH,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,GAAG,CAAC,CA4Cd"}

package/dist/server/login.js

@@ -44,8 +44,13 @@ export async function buildLoginUrl(config, storage) {
     const usePkce = config.pkce !== false;
     // Only create PKCE producer if we're using PKCE and have storage
     const pkceProducer = usePkce && storage ? new GenericPublicClientPKCEProducer(storage) : null;
+    // Ensure clientId is present for OAuth operations
+    if (!config.clientId) {
+        throw new Error("clientId is required for OAuth login operations");
+    }
     const authInitiator = new GenericAuthenticationInitiator({
         ...config,
+        clientId: config.clientId,
         state,
         scopes,
         oauthServer: config.oauthServer ?? DEFAULT_AUTH_SERVER,

package/dist/server/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/server/login.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AAExF,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAY/C;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAY,EACZ,KAAa,EACb,OAAoB,EACpB,MAAkB;IAElB,MAAM,kBAAkB,GAAG,MAAM,4BAA4B,CAAC,KAAK,CACjE;QACE,GAAG,MAAM;QACT,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,mBAAmB;KACvD,EACD,OAAO,EACP,MAAM,CAAC,iBAAiB,CACzB,CAAC;IAEF,OAAO,kBAAkB,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAoB;IACnD,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAOG,EACH,OAAqB;IAErB,oFAAoF;IACpF,IAAI,KAAa,CAAC;IAClB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,sEAAsE;QACtE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IACvB,CAAC;SAAM,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACjD,wDAAwD;QACxD,KAAK,GAAG,aAAa,CAAC;YACpB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,oCAAoC;QACpC,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,cAAc,CAAC;IAE/C,mDAAmD;IACnD,8DAA8D;IAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC;IAEtC,iEAAiE;IACjE,MAAM,YAAY,GAChB,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,+BAA+B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE3E,MAAM,aAAa,GAAG,IAAI,8BAA8B,CAAC;QACvD,GAAG,MAAM;QACT,KAAK;QACL,MAAM;QACN,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,mBAAmB;QACtD,mGAAmG;QACnG,kEAAkE;QAClE,YAAY,EAAE,YAAY,IAAI,SAAS;KACxC,CAAC,CAAC;IAEH,OAAO,aAAa,CAAC,MAAM,EAAE,CAAC;AAChC,CAAC","sourcesContent":["import type {\n  AuthStorage,\n  OIDCTokenResponseBody,\n  FrameworkType,\n} from \"@/types.js\";\nimport { DEFAULT_AUTH_SERVER, DEFAULT_SCOPES } from \"@/constants.js\";\nimport { GenericAuthenticationInitiator } from \"@/services/AuthenticationService.js\";\nimport { GenericPublicClientPKCEProducer } from \"@/services/PKCE.js\";\nimport { ServerAuthenticationResolver } from \"@/server/ServerAuthenticationResolver.js\";\nimport type { AuthConfig } from \"@/server/config.ts\";\nimport { generateState } from \"@/lib/oauth.js\";\n\n/**\n * Context interface for detecting frontend vs backend requests\n */\nexport interface RequestContext {\n  referer?: string;\n  origin?: string;\n  userAgent?: string;\n  acceptsJson?: boolean;\n}\n\n/**\n * Resolve an OAuth access code to a set of OIDC tokens\n * @param code The access code, typically from a query parameter in the redirect url\n * @param state The oauth random state string, used to distinguish between requests. Typically also passed in the redirect url\n * @param storage The place that this server uses to store session data (e.g. a cookie store)\n * @param config Oauth Server configuration\n */\nexport async function resolveOAuthAccessCode(\n  code: string,\n  state: string,\n  storage: AuthStorage,\n  config: AuthConfig,\n): Promise<OIDCTokenResponseBody> {\n  const authSessionService = await ServerAuthenticationResolver.build(\n    {\n      ...config,\n      oauthServer: config.oauthServer ?? DEFAULT_AUTH_SERVER,\n    },\n    storage,\n    config.endpointOverrides,\n  );\n\n  return authSessionService.tokenExchange(code, state);\n}\n\nexport async function isLoggedIn(storage: AuthStorage): Promise<boolean> {\n  return !!(await storage.get(\"id_token\"));\n}\n\nexport async function buildLoginUrl(\n  config: Pick<AuthConfig, \"clientId\" | \"redirectUrl\"> &\n    Partial<Pick<AuthConfig, \"oauthServer\" | \"pkce\" | \"clientSecret\">> & {\n      scopes?: string[];\n      state?: string;\n      nonce?: string;\n      framework?: FrameworkType;\n      sdkVersion?: string;\n    },\n  storage?: AuthStorage,\n): Promise<URL> {\n  // Generate state: prioritize provided state (which preserves frontend display mode)\n  let state: string;\n  if (config.state) {\n    // Use the provided state (e.g., from frontend with display mode info)\n    state = config.state;\n  } else if (config.sdkVersion || config.framework) {\n    // Generate new structured state with framework/SDK info\n    state = generateState({\n      framework: config.framework,\n      sdkVersion: config.sdkVersion,\n    });\n  } else {\n    // Generate random state as fallback\n    state = Math.random().toString(36).substring(2);\n  }\n\n  const scopes = config.scopes ?? DEFAULT_SCOPES;\n\n  // Determine if PKCE should be used based on config\n  // Default to true for backward compatibility if not specified\n  const usePkce = config.pkce !== false;\n\n  // Only create PKCE producer if we're using PKCE and have storage\n  const pkceProducer =\n    usePkce && storage ? new GenericPublicClientPKCEProducer(storage) : null;\n\n  const authInitiator = new GenericAuthenticationInitiator({\n    ...config,\n    state,\n    scopes,\n    oauthServer: config.oauthServer ?? DEFAULT_AUTH_SERVER,\n    // When retrieving the PKCE challenge on the server-side, we produce it and store it in the session\n    // For confidential clients not using PKCE, this will be undefined\n    pkceConsumer: pkceProducer ?? undefined,\n  });\n\n  return authInitiator.signIn();\n}\n"]}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/server/login.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AAExF,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAY/C;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAY,EACZ,KAAa,EACb,OAAoB,EACpB,MAAkB;IAElB,MAAM,kBAAkB,GAAG,MAAM,4BAA4B,CAAC,KAAK,CACjE;QACE,GAAG,MAAM;QACT,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,mBAAmB;KACvD,EACD,OAAO,EACP,MAAM,CAAC,iBAAiB,CACzB,CAAC;IAEF,OAAO,kBAAkB,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAoB;IACnD,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAOG,EACH,OAAqB;IAErB,oFAAoF;IACpF,IAAI,KAAa,CAAC;IAClB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,sEAAsE;QACtE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IACvB,CAAC;SAAM,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACjD,wDAAwD;QACxD,KAAK,GAAG,aAAa,CAAC;YACpB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,oCAAoC;QACpC,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,cAAc,CAAC;IAE/C,mDAAmD;IACnD,8DAA8D;IAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC;IAEtC,iEAAiE;IACjE,MAAM,YAAY,GAChB,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,+BAA+B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE3E,kDAAkD;IAClD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,8BAA8B,CAAC;QACvD,GAAG,MAAM;QACT,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK;QACL,MAAM;QACN,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,mBAAmB;QACtD,mGAAmG;QACnG,kEAAkE;QAClE,YAAY,EAAE,YAAY,IAAI,SAAS;KACxC,CAAC,CAAC;IAEH,OAAO,aAAa,CAAC,MAAM,EAAE,CAAC;AAChC,CAAC","sourcesContent":["import type {\n  AuthStorage,\n  OIDCTokenResponseBody,\n  FrameworkType,\n} from \"@/types.js\";\nimport { DEFAULT_AUTH_SERVER, DEFAULT_SCOPES } from \"@/constants.js\";\nimport { GenericAuthenticationInitiator } from \"@/services/AuthenticationService.js\";\nimport { GenericPublicClientPKCEProducer } from \"@/services/PKCE.js\";\nimport { ServerAuthenticationResolver } from \"@/server/ServerAuthenticationResolver.js\";\nimport type { AuthConfig } from \"@/server/config.ts\";\nimport { generateState } from \"@/lib/oauth.js\";\n\n/**\n * Context interface for detecting frontend vs backend requests\n */\nexport interface RequestContext {\n  referer?: string;\n  origin?: string;\n  userAgent?: string;\n  acceptsJson?: boolean;\n}\n\n/**\n * Resolve an OAuth access code to a set of OIDC tokens\n * @param code The access code, typically from a query parameter in the redirect url\n * @param state The oauth random state string, used to distinguish between requests. Typically also passed in the redirect url\n * @param storage The place that this server uses to store session data (e.g. a cookie store)\n * @param config Oauth Server configuration\n */\nexport async function resolveOAuthAccessCode(\n  code: string,\n  state: string,\n  storage: AuthStorage,\n  config: AuthConfig,\n): Promise<OIDCTokenResponseBody> {\n  const authSessionService = await ServerAuthenticationResolver.build(\n    {\n      ...config,\n      oauthServer: config.oauthServer ?? DEFAULT_AUTH_SERVER,\n    },\n    storage,\n    config.endpointOverrides,\n  );\n\n  return authSessionService.tokenExchange(code, state);\n}\n\nexport async function isLoggedIn(storage: AuthStorage): Promise<boolean> {\n  return !!(await storage.get(\"id_token\"));\n}\n\nexport async function buildLoginUrl(\n  config: Pick<AuthConfig, \"clientId\" | \"redirectUrl\"> &\n    Partial<Pick<AuthConfig, \"oauthServer\" | \"pkce\" | \"clientSecret\">> & {\n      scopes?: string[];\n      state?: string;\n      nonce?: string;\n      framework?: FrameworkType;\n      sdkVersion?: string;\n    },\n  storage?: AuthStorage,\n): Promise<URL> {\n  // Generate state: prioritize provided state (which preserves frontend display mode)\n  let state: string;\n  if (config.state) {\n    // Use the provided state (e.g., from frontend with display mode info)\n    state = config.state;\n  } else if (config.sdkVersion || config.framework) {\n    // Generate new structured state with framework/SDK info\n    state = generateState({\n      framework: config.framework,\n      sdkVersion: config.sdkVersion,\n    });\n  } else {\n    // Generate random state as fallback\n    state = Math.random().toString(36).substring(2);\n  }\n\n  const scopes = config.scopes ?? DEFAULT_SCOPES;\n\n  // Determine if PKCE should be used based on config\n  // Default to true for backward compatibility if not specified\n  const usePkce = config.pkce !== false;\n\n  // Only create PKCE producer if we're using PKCE and have storage\n  const pkceProducer =\n    usePkce && storage ? new GenericPublicClientPKCEProducer(storage) : null;\n\n  // Ensure clientId is present for OAuth operations\n  if (!config.clientId) {\n    throw new Error(\"clientId is required for OAuth login operations\");\n  }\n\n  const authInitiator = new GenericAuthenticationInitiator({\n    ...config,\n    clientId: config.clientId,\n    state,\n    scopes,\n    oauthServer: config.oauthServer ?? DEFAULT_AUTH_SERVER,\n    // When retrieving the PKCE challenge on the server-side, we produce it and store it in the session\n    // For confidential clients not using PKCE, this will be undefined\n    pkceConsumer: pkceProducer ?? undefined,\n  });\n\n  return authInitiator.signIn();\n}\n"]}

package/dist/server/logout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../src/server/logout.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAM9C,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,GAAG,uBAAuB,CAAC,GAC5D,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,GAAG;IACzC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,EACH,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,GAAG,CAAC,CAkBd"}
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../src/server/logout.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAM9C,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,GAAG,uBAAuB,CAAC,GAC5D,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,GAAG;IACzC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,EACH,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,GAAG,CAAC,CAwBd"}

package/dist/server/logout.js

@@ -3,12 +3,17 @@ import { GenericPublicClientPKCEProducer } from "../services/PKCE.js";
 import { GenericAuthenticationInitiator } from "../services/AuthenticationService.js";
 import { OAuthTokenTypes } from "../shared/lib/types.js";
 export async function buildLogoutRedirectUrl(config, storage) {
+    // Ensure clientId is present for OAuth operations
+    if (!config.clientId) {
+        throw new Error("clientId is required for OAuth logout operations");
+    }
     // generate a random state if not provided
     const state = config.state ?? Math.random().toString(36).substring(2);
     const scopes = config.scopes ?? DEFAULT_SCOPES;
     const pkceProducer = new GenericPublicClientPKCEProducer(storage);
     const authInitiator = new GenericAuthenticationInitiator({
         ...config,
+        clientId: config.clientId,
         state,
         scopes,
         oauthServer: config.oauthServer ?? DEFAULT_AUTH_SERVER,

package/dist/server/logout.js.map

@@ -1 +1 @@
-{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/server/logout.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAIG,EACH,OAAoB;IAEpB,0CAA0C;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,cAAc,CAAC;IAC/C,MAAM,YAAY,GAAG,IAAI,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAClE,MAAM,aAAa,GAAG,IAAI,8BAA8B,CAAC;QACvD,GAAG,MAAM;QACT,KAAK;QACL,MAAM;QACN,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,mBAAmB;QACtD,YAAY,EAAE,YAAY;QAC1B,WAAW,EAAE,MAAM,CAAC,qBAAqB,IAAI,GAAG;KACjD,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAE9D,OAAO,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC","sourcesContent":["import type { AuthConfig } from \"@/server/config.js\";\nimport type { AuthStorage } from \"@/types.js\";\nimport { DEFAULT_AUTH_SERVER, DEFAULT_SCOPES } from \"@/constants.js\";\nimport { GenericPublicClientPKCEProducer } from \"@/services/PKCE.js\";\nimport { GenericAuthenticationInitiator } from \"@/services/AuthenticationService.js\";\nimport { OAuthTokenTypes } from \"@/shared/lib/types.js\";\n\nexport async function buildLogoutRedirectUrl(\n  config: Pick<AuthConfig, \"clientId\" | \"postLogoutRedirectUrl\"> &\n    Partial<Pick<AuthConfig, \"oauthServer\">> & {\n      scopes?: string[];\n      state?: string;\n    },\n  storage: AuthStorage,\n): Promise<URL> {\n  // generate a random state if not provided\n  const state = config.state ?? Math.random().toString(36).substring(2);\n  const scopes = config.scopes ?? DEFAULT_SCOPES;\n  const pkceProducer = new GenericPublicClientPKCEProducer(storage);\n  const authInitiator = new GenericAuthenticationInitiator({\n    ...config,\n    state,\n    scopes,\n    oauthServer: config.oauthServer ?? DEFAULT_AUTH_SERVER,\n    pkceConsumer: pkceProducer,\n    redirectUrl: config.postLogoutRedirectUrl || \"/\",\n  });\n\n  const idToken = await storage.get(OAuthTokenTypes.ID_TOKEN);\n  if (!idToken) throw new Error(\"No id_token found in storage\");\n\n  return authInitiator.signOut(idToken);\n}\n"]}
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/server/logout.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAIG,EACH,OAAoB;IAEpB,kDAAkD;IAClD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,0CAA0C;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,cAAc,CAAC;IAC/C,MAAM,YAAY,GAAG,IAAI,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAClE,MAAM,aAAa,GAAG,IAAI,8BAA8B,CAAC;QACvD,GAAG,MAAM;QACT,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK;QACL,MAAM;QACN,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,mBAAmB;QACtD,YAAY,EAAE,YAAY;QAC1B,WAAW,EAAE,MAAM,CAAC,qBAAqB,IAAI,GAAG;KACjD,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAE9D,OAAO,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC","sourcesContent":["import type { AuthConfig } from \"@/server/config.js\";\nimport type { AuthStorage } from \"@/types.js\";\nimport { DEFAULT_AUTH_SERVER, DEFAULT_SCOPES } from \"@/constants.js\";\nimport { GenericPublicClientPKCEProducer } from \"@/services/PKCE.js\";\nimport { GenericAuthenticationInitiator } from \"@/services/AuthenticationService.js\";\nimport { OAuthTokenTypes } from \"@/shared/lib/types.js\";\n\nexport async function buildLogoutRedirectUrl(\n  config: Pick<AuthConfig, \"clientId\" | \"postLogoutRedirectUrl\"> &\n    Partial<Pick<AuthConfig, \"oauthServer\">> & {\n      scopes?: string[];\n      state?: string;\n    },\n  storage: AuthStorage,\n): Promise<URL> {\n  // Ensure clientId is present for OAuth operations\n  if (!config.clientId) {\n    throw new Error(\"clientId is required for OAuth logout operations\");\n  }\n\n  // generate a random state if not provided\n  const state = config.state ?? Math.random().toString(36).substring(2);\n  const scopes = config.scopes ?? DEFAULT_SCOPES;\n  const pkceProducer = new GenericPublicClientPKCEProducer(storage);\n  const authInitiator = new GenericAuthenticationInitiator({\n    ...config,\n    clientId: config.clientId,\n    state,\n    scopes,\n    oauthServer: config.oauthServer ?? DEFAULT_AUTH_SERVER,\n    pkceConsumer: pkceProducer,\n    redirectUrl: config.postLogoutRedirectUrl || \"/\",\n  });\n\n  const idToken = await storage.get(OAuthTokenTypes.ID_TOKEN);\n  if (!idToken) throw new Error(\"No id_token found in storage\");\n\n  return authInitiator.signOut(idToken);\n}\n"]}

package/dist/server/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/server/session.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,IAAI,EACT,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAE3B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAgBrD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAIlE,MAAM,MAAM,qBAAqB,GAAG;IAClC,OAAO,EAAE;QACP,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;QAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,qBAAqB,CAAC;CAC5B,CAAC;AAwCF;;;GAGG;AACH,qBAAa,SAAS;IAGlB,QAAQ,CAAC,OAAO,EAAE,WAAW;IAC7B,QAAQ,CAAC,UAAU,EAAE,UAAU;IAHjC,aAAa,EAAE,sBAAsB,GAAG,IAAI,CAAQ;gBAEzC,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,UAAU;IAGjC,IAAI,WAAW,IAAI,MAAM,CAExB;IAEK,eAAe,IAAI,OAAO,CAAC,sBAAsB,CAAC;IAaxD;;;OAGG;IACG,OAAO,CACX,CAAC,SAAS,aAAa,GAAG,WAAW,KAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAkB5B;;;OAGG;IACG,SAAS,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAoB9C;;;;;OAKG;IACG,sBAAsB,CAC1B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,qBAAqB,CAAC;IAIjC;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC;IAMpC;;;;OAIG;IACG,aAAa,CAAC,OAAO,CAAC,EAAE;QAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,GAAG,CAAC;IAchB;;;;OAIG;IACG,sBAAsB,CAAC,OAAO,CAAC,EAAE;QACrC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,GAAG,CAAC;IAyChB;;;OAGG;IACG,aAAa,IAAI,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAI5D;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAIlC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACG,cAAc,CAClB,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,oBAAoB,EAC1C,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,GACA,OAAO,CAAC;QACT,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,GAAG;YAAE,OAAO,EAAE,OAAO,CAAC;YAAC,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;SAAE,CAAC;KAC7D,CAAC;IAyFF;;OAEG;IACH,OAAO,CAAC,4BAA4B;CA0DrC"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/server/session.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,IAAI,EACT,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAE3B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAgBrD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAIlE,MAAM,MAAM,qBAAqB,GAAG;IAClC,OAAO,EAAE;QACP,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;QAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,qBAAqB,CAAC;CAC5B,CAAC;AAwCF;;;GAGG;AACH,qBAAa,SAAS;IAGlB,QAAQ,CAAC,OAAO,EAAE,WAAW;IAC7B,QAAQ,CAAC,UAAU,EAAE,UAAU;IAHjC,aAAa,EAAE,sBAAsB,GAAG,IAAI,CAAQ;gBAEzC,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,UAAU;IAGjC,IAAI,WAAW,IAAI,MAAM,CAExB;IAEK,eAAe,IAAI,OAAO,CAAC,sBAAsB,CAAC;IAaxD;;;OAGG;IACG,OAAO,CACX,CAAC,SAAS,aAAa,GAAG,WAAW,KAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAkB5B;;;OAGG;IACG,SAAS,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAoB9C;;;;;OAKG;IACG,sBAAsB,CAC1B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,qBAAqB,CAAC;IAIjC;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC;IAMpC;;;;OAIG;IACG,aAAa,CAAC,OAAO,CAAC,EAAE;QAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,GAAG,CAAC;IAchB;;;;OAIG;IACG,sBAAsB,CAAC,OAAO,CAAC,EAAE;QACrC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,GAAG,CAAC;IA8ChB;;;OAGG;IACG,aAAa,IAAI,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAI5D;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAIlC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACG,cAAc,CAClB,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,oBAAoB,EAC1C,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,GACA,OAAO,CAAC;QACT,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,GAAG;YAAE,OAAO,EAAE,OAAO,CAAC;YAAC,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;SAAE,CAAC;KAC7D,CAAC;IA0FF;;OAEG;IACH,OAAO,CAAC,4BAA4B;CA0DrC"}

package/dist/server/session.js

@@ -150,6 +150,10 @@ export class CivicAuth {
             // since for logout we just need the raw ID token, not validated tokens
             const tokens = await getTokensFromShared(this.storage);
             if (tokens?.idToken) {
+                // Ensure clientId is present for OAuth operations
+                if (!this.authConfig.clientId) {
+                    throw new Error("clientId is required for OAuth logout operations");
+                }
                 // We have access to the ID token from HTTP-only cookies
                 // Build the logout URL manually using the shared utility
                 const logoutUrl = await generateOauthLogoutUrl({
@@ -230,6 +234,7 @@ export class CivicAuth {
         const isTopLevelRedirect = req.headers["sec-fetch-dest"] === "document";
         const isApiRequest = options?.apiResponse || req.headers.accept?.includes("application/json");
         // Detect Safari or other browsers where iframe postMessage may fail due to cross-origin restrictions
+        //TODO: Find a better way to detect this
         const userAgent = req.headers["user-agent"] || "";
         const isSafari = userAgent.includes("Safari") && !userAgent.includes("Chrome");
         const isLikelyCrossOriginIframe = isSafari ||