@confighub/react-auth 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) ConfigHub, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,48 @@
+# @confighub/react-auth
+
+React provider and hooks for authenticating a browser app against the
+[ConfigHub](https://confighub.com) API. Runs the browser-direct flow end to end —
+runtime discovery, OIDC Authorization Code + PKCE against the discovered IdP, then
+RFC 8693 token exchange for a minted ConfigHub token — and hands back a typed
+[`@confighub/api`](https://www.npmjs.com/package/@confighub/api) client pre-wired
+with the token.
+
+```tsx
+import { ConfigHubAuthProvider, useAuth, useConfigHub } from '@confighub/react-auth';
+
+<ConfigHubAuthProvider baseUrl="https://hub.confighub.com" clientId={CLIENT_ID}>
+  <App />
+</ConfigHubAuthProvider>;
+
+function App() {
+  const { status, user, login, logout } = useAuth();
+  const api = useConfigHub(); // typed client, token already attached
+  // await api.GET('/me'); await api.GET('/space/{space_id}/unit', { params: { path: { space_id } } });
+
+  if (status === 'loading') return <p>…</p>;
+  if (status !== 'authenticated') return <button onClick={login}>Log in</button>;
+  return <button onClick={logout}>Sign out {user!.organizationId}</button>;
+}
+```
+
+## Configuration
+
+- `baseUrl` — the ConfigHub instance, e.g. `https://hub.confighub.com`.
+- `clientId` — this app's registered OAuth client id, from
+  `cub oauthclient create <name> --redirect-uri <origin>`.
+
+The IdP issuer and OIDC endpoints are discovered from `{baseUrl}/api/info`, so the
+same build runs against any ConfigHub instance (the bundled Keycloak for Cloud, an
+organization's own IdP for Enterprise).
+
+## Token posture
+
+The minted token is kept in memory, never `localStorage`; only the transient PKCE
+verifier is parked in `sessionStorage` across the authorize redirect. A 401 clears
+the session so the app re-authenticates.
+
+Not yet implemented: silent refresh via refresh-token rotation, and IdP
+end-session on logout. Today a 401 or `logout()` returns the app to the login
+screen. These follow the server-side refresh-rotation work.
+
+`react` (18 or 19) is a peer dependency.

package/dist/index.cjs

@@ -0,0 +1,211 @@
+'use strict';
+
+var api = require('@confighub/api');
+var react = require('react');
+var jsxRuntime = require('react/jsx-runtime');
+
+// src/provider.tsx
+
+// src/core.ts
+var PKCE_KEY = "confighub_pkce";
+var redirectUri = () => window.location.origin + window.location.pathname;
+var trimSlash = (s) => s.replace(/\/+$/, "");
+var b64url = (buf) => btoa(String.fromCharCode(...new Uint8Array(buf))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+var randomString = (n = 64) => b64url(crypto.getRandomValues(new Uint8Array(n)).buffer);
+async function sha256(s) {
+  return b64url(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(s)));
+}
+function decodeJwtClaims(token) {
+  const part = token.split(".")[1];
+  if (!part) return {};
+  return JSON.parse(atob(part.replace(/-/g, "+").replace(/_/g, "/")));
+}
+async function discover(base) {
+  const r = await fetch(trimSlash(base) + "/api/info");
+  if (!r.ok) throw new Error("/api/info failed: " + r.status);
+  return r.json();
+}
+async function oidcMetadata(issuer) {
+  const r = await fetch(trimSlash(issuer) + "/.well-known/openid-configuration");
+  if (!r.ok) throw new Error("OIDC discovery failed: " + r.status);
+  return r.json();
+}
+async function startLogin(base, clientId) {
+  const info = await discover(base);
+  if (!info.AuthIssuer || !info.TokenExchangeEndpoint) {
+    throw new Error(
+      "this instance is not configured for token-exchange auth (server needs CONFIGHUB_IDP_ISSUER)"
+    );
+  }
+  const meta = await oidcMetadata(info.AuthIssuer);
+  const verifier = randomString();
+  const challenge = await sha256(verifier);
+  const state = randomString(16);
+  const pkce = {
+    verifier,
+    state,
+    clientId,
+    tokenEndpoint: meta.token_endpoint,
+    exchangeEndpoint: info.TokenExchangeEndpoint
+  };
+  sessionStorage.setItem(PKCE_KEY, JSON.stringify(pkce));
+  const authURL = new URL(meta.authorization_endpoint);
+  authURL.search = new URLSearchParams({
+    response_type: "code",
+    client_id: clientId,
+    redirect_uri: redirectUri(),
+    // The "organization" scope makes Keycloak emit the org claim the exchange resolves.
+    scope: "openid email profile organization",
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+    state
+  }).toString();
+  window.location.assign(authURL.toString());
+}
+var pending = null;
+function completeLoginFromRedirect() {
+  if (!pending) pending = doCompleteLogin();
+  return pending;
+}
+async function doCompleteLogin() {
+  const params = new URLSearchParams(window.location.search);
+  const code = params.get("code");
+  const error = params.get("error");
+  if (error) {
+    history.replaceState({}, "", redirectUri());
+    throw new Error(`IdP returned error: ${error} ${params.get("error_description") ?? ""}`);
+  }
+  if (!code) return null;
+  const savedRaw = sessionStorage.getItem(PKCE_KEY);
+  sessionStorage.removeItem(PKCE_KEY);
+  history.replaceState({}, "", redirectUri());
+  if (!savedRaw) throw new Error("no PKCE state; restart login");
+  const saved = JSON.parse(savedRaw);
+  if (params.get("state") !== saved.state) throw new Error("state mismatch; aborting");
+  const tokenResp = await fetch(saved.tokenEndpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: redirectUri(),
+      client_id: saved.clientId,
+      code_verifier: saved.verifier
+    })
+  });
+  if (!tokenResp.ok) {
+    throw new Error(`IdP token endpoint ${tokenResp.status}: ${await tokenResp.text()}`);
+  }
+  const idpToken = await tokenResp.json();
+  const exResp = await fetch(saved.exchangeEndpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
+      subject_token: idpToken.access_token,
+      subject_token_type: "urn:ietf:params:oauth:token-type:access_token"
+    })
+  });
+  if (!exResp.ok) throw new Error(`/auth/exchange ${exResp.status}: ${await exResp.text()}`);
+  const minted = await exResp.json();
+  return {
+    accessToken: minted.access_token,
+    organizationId: minted.organization_id,
+    idpClaims: decodeJwtClaims(idpToken.access_token)
+  };
+}
+function resetPending() {
+  pending = null;
+}
+
+// src/tokenStore.ts
+var currentToken;
+function setAccessToken(token) {
+  currentToken = token;
+}
+function getAccessToken() {
+  return currentToken;
+}
+var ConfigHubAuthContext = react.createContext(null);
+function ConfigHubAuthProvider({
+  baseUrl,
+  clientId,
+  children
+}) {
+  const [status, setStatus] = react.useState("loading");
+  const [user, setUser] = react.useState(null);
+  const [error, setError] = react.useState(null);
+  const tokenRef = react.useRef(void 0);
+  const applySession = react.useCallback((session) => {
+    tokenRef.current = session.accessToken;
+    setAccessToken(session.accessToken);
+    setUser({ organizationId: session.organizationId, idpClaims: session.idpClaims });
+    setError(null);
+    setStatus("authenticated");
+  }, []);
+  react.useEffect(() => {
+    let cancelled = false;
+    completeLoginFromRedirect().then((session) => {
+      if (cancelled) return;
+      if (session) applySession(session);
+      else setStatus("unauthenticated");
+    }).catch((e) => {
+      if (cancelled) return;
+      setError(e instanceof Error ? e : new Error(String(e)));
+      setStatus("error");
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [applySession]);
+  const login = react.useCallback(async () => {
+    setError(null);
+    try {
+      await startLogin(baseUrl, clientId);
+    } catch (e) {
+      setError(e instanceof Error ? e : new Error(String(e)));
+      setStatus("error");
+    }
+  }, [baseUrl, clientId]);
+  const logout = react.useCallback(() => {
+    tokenRef.current = void 0;
+    setAccessToken(void 0);
+    resetPending();
+    setUser(null);
+    setStatus("unauthenticated");
+  }, []);
+  const getToken = react.useCallback(() => tokenRef.current, []);
+  const client = react.useMemo(
+    () => api.createConfigHubClient({
+      baseUrl,
+      getToken,
+      onUnauthorized: () => {
+        logout();
+      }
+    }),
+    [baseUrl, getToken, logout]
+  );
+  const value = react.useMemo(
+    () => ({ status, user, error, login, logout, getToken, client }),
+    [status, user, error, login, logout, getToken, client]
+  );
+  return /* @__PURE__ */ jsxRuntime.jsx(ConfigHubAuthContext.Provider, { value, children });
+}
+function useAuth() {
+  const ctx = react.useContext(ConfigHubAuthContext);
+  if (!ctx) {
+    throw new Error("useAuth must be used within a <ConfigHubAuthProvider>");
+  }
+  return ctx;
+}
+function useConfigHub() {
+  return useAuth().client;
+}
+
+exports.ConfigHubAuthContext = ConfigHubAuthContext;
+exports.ConfigHubAuthProvider = ConfigHubAuthProvider;
+exports.getAccessToken = getAccessToken;
+exports.useAuth = useAuth;
+exports.useConfigHub = useConfigHub;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core.ts","../src/tokenStore.ts","../src/provider.tsx","../src/hooks.ts"],"names":["createContext","useState","useRef","useCallback","useEffect","useMemo","createConfigHubClient","jsx","useContext"],"mappings":";;;;;;;;;AAwCA,IAAM,QAAA,GAAW,gBAAA;AAEjB,IAAM,cAAc,MAAc,MAAA,CAAO,QAAA,CAAS,MAAA,GAAS,OAAO,QAAA,CAAS,QAAA;AAE3E,IAAM,YAAY,CAAC,CAAA,KAAsB,CAAA,CAAE,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAE7D,IAAM,MAAA,GAAS,CAAC,GAAA,KACd,IAAA,CAAK,OAAO,YAAA,CAAa,GAAG,IAAI,UAAA,CAAW,GAAG,CAAC,CAAC,CAAA,CAC7C,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,OAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAEtB,IAAM,YAAA,GAAe,CAAC,CAAA,GAAI,EAAA,KACxB,MAAA,CAAO,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,CAAC,CAAC,CAAA,CAAE,MAAM,CAAA;AAEzD,eAAe,OAAO,CAAA,EAA4B;AAChD,EAAA,OAAO,MAAA,CAAO,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AAClF;AAEA,SAAS,gBAAgB,KAAA,EAAwC;AAC/D,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC/B,EAAA,IAAI,CAAC,IAAA,EAAM,OAAO,EAAC;AACnB,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAC,CAAC,CAAA;AACpE;AAEA,eAAsB,SAAS,IAAA,EAAkC;AAC/D,EAAA,MAAM,IAAI,MAAM,KAAA,CAAM,SAAA,CAAU,IAAI,IAAI,WAAW,CAAA;AACnD,EAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,oBAAA,GAAuB,EAAE,MAAM,CAAA;AAC1D,EAAA,OAAO,EAAE,IAAA,EAAK;AAChB;AAEA,eAAe,aACb,MAAA,EACqE;AACrE,EAAA,MAAM,IAAI,MAAM,KAAA,CAAM,SAAA,CAAU,MAAM,IAAI,mCAAmC,CAAA;AAC7E,EAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,yBAAA,GAA4B,EAAE,MAAM,CAAA;AAC/D,EAAA,OAAO,EAAE,IAAA,EAAK;AAChB;AAOA,eAAsB,UAAA,CAAW,MAAc,QAAA,EAAiC;AAC9E,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAI,CAAA;AAChC,EAAA,IAAI,CAAC,IAAA,CAAK,UAAA,IAAc,CAAC,KAAK,qBAAA,EAAuB;AACnD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAO,MAAM,YAAA,CAAa,IAAA,CAAK,UAAU,CAAA;AAC/C,EAAA,MAAM,WAAW,YAAA,EAAa;AAC9B,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,QAAQ,CAAA;AACvC,EAAA,MAAM,KAAA,GAAQ,aAAa,EAAE,CAAA;AAC7B,EAAA,MAAM,IAAA,GAAkB;AAAA,IACtB,QAAA;AAAA,IACA,KAAA;AAAA,IACA,QAAA;AAAA,IACA,eAAe,IAAA,CAAK,cAAA;AAAA,IACpB,kBAAkB,IAAA,CAAK;AAAA,GACzB;AACA,EAAA,cAAA,CAAe,OAAA,CAAQ,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AAErD,EAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,IAAA,CAAK,sBAAsB,CAAA;AACnD,EAAA,OAAA,CAAQ,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,IACnC,aAAA,EAAe,MAAA;AAAA,IACf,SAAA,EAAW,QAAA;AAAA,IACX,cAAc,WAAA,EAAY;AAAA;AAAA,IAE1B,KAAA,EAAO,mCAAA;AAAA,IACP,cAAA,EAAgB,SAAA;AAAA,IAChB,qBAAA,EAAuB,MAAA;AAAA,IACvB;AAAA,GACD,EAAE,QAAA,EAAS;AACZ,EAAA,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,OAAA,CAAQ,QAAA,EAAU,CAAA;AAC3C;AAGA,IAAI,OAAA,GAAgD,IAAA;AAM7C,SAAS,yBAAA,GAA2D;AACzE,EAAA,IAAI,CAAC,OAAA,EAAS,OAAA,GAAU,eAAA,EAAgB;AACxC,EAAA,OAAO,OAAA;AACT;AAEA,eAAe,eAAA,GAAiD;AAC9D,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAA,CAAO,SAAS,MAAM,CAAA;AACzD,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AAC9B,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA;AAChC,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,OAAA,CAAQ,YAAA,CAAa,EAAC,EAAG,EAAA,EAAI,aAAa,CAAA;AAC1C,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,KAAK,CAAA,CAAA,EAAI,OAAO,GAAA,CAAI,mBAAmB,CAAA,IAAK,EAAE,CAAA,CAAE,CAAA;AAAA,EACzF;AACA,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAElB,EAAA,MAAM,QAAA,GAAW,cAAA,CAAe,OAAA,CAAQ,QAAQ,CAAA;AAChD,EAAA,cAAA,CAAe,WAAW,QAAQ,CAAA;AAClC,EAAA,OAAA,CAAQ,YAAA,CAAa,EAAC,EAAG,EAAA,EAAI,aAAa,CAAA;AAC1C,EAAA,IAAI,CAAC,QAAA,EAAU,MAAM,IAAI,MAAM,8BAA8B,CAAA;AAC7D,EAAA,MAAM,KAAA,GAAmB,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA;AAC5C,EAAA,IAAI,MAAA,CAAO,IAAI,OAAO,CAAA,KAAM,MAAM,KAAA,EAAO,MAAM,IAAI,KAAA,CAAM,0BAA0B,CAAA;AAGnF,EAAA,MAAM,SAAA,GAAY,MAAM,KAAA,CAAM,KAAA,CAAM,aAAA,EAAe;AAAA,IACjD,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,oBAAA;AAAA,MACZ,IAAA;AAAA,MACA,cAAc,WAAA,EAAY;AAAA,MAC1B,WAAW,KAAA,CAAM,QAAA;AAAA,MACjB,eAAe,KAAA,CAAM;AAAA,KACtB;AAAA,GACF,CAAA;AACD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,SAAA,CAAU,MAAM,KAAK,MAAM,SAAA,CAAU,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EACrF;AACA,EAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,IAAA,EAAK;AAGtC,EAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,KAAA,CAAM,gBAAA,EAAkB;AAAA,IACjD,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,iDAAA;AAAA,MACZ,eAAe,QAAA,CAAS,YAAA;AAAA,MACxB,kBAAA,EAAoB;AAAA,KACrB;AAAA,GACF,CAAA;AACD,EAAA,IAAI,CAAC,MAAA,CAAO,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,MAAA,CAAO,MAAM,CAAA,EAAA,EAAK,MAAM,MAAA,CAAO,IAAA,EAAM,CAAA,CAAE,CAAA;AACzF,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,EAAK;AAEjC,EAAA,OAAO;AAAA,IACL,aAAa,MAAA,CAAO,YAAA;AAAA,IACpB,gBAAgB,MAAA,CAAO,eAAA;AAAA,IACvB,SAAA,EAAW,eAAA,CAAgB,QAAA,CAAS,YAAY;AAAA,GAClD;AACF;AAGO,SAAS,YAAA,GAAqB;AACnC,EAAA,OAAA,GAAU,IAAA;AACZ;;;ACpLA,IAAI,YAAA;AAGG,SAAS,eAAe,KAAA,EAAiC;AAC9D,EAAA,YAAA,GAAe,KAAA;AACjB;AAOO,SAAS,cAAA,GAAqC;AACnD,EAAA,OAAO,YAAA;AACT;ACqBO,IAAM,oBAAA,GAAuBA,oBAAgD,IAAI;AAejF,SAAS,qBAAA,CAAsB;AAAA,EACpC,OAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAA,EAA4C;AAC1C,EAAA,MAAM,CAAC,MAAA,EAAQ,SAAS,CAAA,GAAIC,eAAqB,SAAS,CAAA;AAC1D,EAAA,MAAM,CAAC,IAAA,EAAM,OAAO,CAAA,GAAIA,eAA+B,IAAI,CAAA;AAC3D,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAIA,eAAuB,IAAI,CAAA;AAIrD,EAAA,MAAM,QAAA,GAAWC,aAA2B,MAAS,CAAA;AAErD,EAAA,MAAM,YAAA,GAAeC,iBAAA,CAAY,CAAC,OAAA,KAA2B;AAC3D,IAAA,QAAA,CAAS,UAAU,OAAA,CAAQ,WAAA;AAC3B,IAAA,cAAA,CAAe,QAAQ,WAAW,CAAA;AAClC,IAAA,OAAA,CAAQ,EAAE,cAAA,EAAgB,OAAA,CAAQ,gBAAgB,SAAA,EAAW,OAAA,CAAQ,WAAW,CAAA;AAChF,IAAA,QAAA,CAAS,IAAI,CAAA;AACb,IAAA,SAAA,CAAU,eAAe,CAAA;AAAA,EAC3B,CAAA,EAAG,EAAE,CAAA;AAEL,EAAAC,eAAA,CAAU,MAAM;AACd,IAAA,IAAI,SAAA,GAAY,KAAA;AAChB,IAAA,yBAAA,EAA0B,CACvB,IAAA,CAAK,CAAC,OAAA,KAAY;AACjB,MAAA,IAAI,SAAA,EAAW;AACf,MAAA,IAAI,OAAA,eAAsB,OAAO,CAAA;AAAA,qBAClB,iBAAiB,CAAA;AAAA,IAClC,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,CAAA,KAAe;AACrB,MAAA,IAAI,SAAA,EAAW;AACf,MAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,MAAA,SAAA,CAAU,OAAO,CAAA;AAAA,IACnB,CAAC,CAAA;AACH,IAAA,OAAO,MAAM;AACX,MAAA,SAAA,GAAY,IAAA;AAAA,IACd,CAAA;AAAA,EACF,CAAA,EAAG,CAAC,YAAY,CAAC,CAAA;AAEjB,EAAA,MAAM,KAAA,GAAQD,kBAAY,YAAY;AACpC,IAAA,QAAA,CAAS,IAAI,CAAA;AACb,IAAA,IAAI;AACF,MAAA,MAAM,UAAA,CAAW,SAAS,QAAQ,CAAA;AAAA,IACpC,SAAS,CAAA,EAAY;AACnB,MAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,MAAA,SAAA,CAAU,OAAO,CAAA;AAAA,IACnB;AAAA,EACF,CAAA,EAAG,CAAC,OAAA,EAAS,QAAQ,CAAC,CAAA;AAEtB,EAAA,MAAM,MAAA,GAASA,kBAAY,MAAM;AAC/B,IAAA,QAAA,CAAS,OAAA,GAAU,MAAA;AACnB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,YAAA,EAAa;AACb,IAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,IAAA,SAAA,CAAU,iBAAiB,CAAA;AAAA,EAC7B,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,WAAWA,iBAAA,CAAY,MAAM,QAAA,CAAS,OAAA,EAAS,EAAE,CAAA;AAIvD,EAAA,MAAM,MAAA,GAASE,aAAA;AAAA,IACb,MACEC,yBAAA,CAAsB;AAAA,MACpB,OAAA;AAAA,MACA,QAAA;AAAA,MACA,gBAAgB,MAAM;AACpB,QAAA,MAAA,EAAO;AAAA,MACT;AAAA,KACD,CAAA;AAAA,IACH,CAAC,OAAA,EAAS,QAAA,EAAU,MAAM;AAAA,GAC5B;AAEA,EAAA,MAAM,KAAA,GAAQD,aAAA;AAAA,IACZ,OAAO,EAAE,MAAA,EAAQ,IAAA,EAAM,OAAO,KAAA,EAAO,MAAA,EAAQ,UAAU,MAAA,EAAO,CAAA;AAAA,IAC9D,CAAC,MAAA,EAAQ,IAAA,EAAM,OAAO,KAAA,EAAO,MAAA,EAAQ,UAAU,MAAM;AAAA,GACvD;AAEA,EAAA,uBACEE,cAAA,CAAC,oBAAA,CAAqB,QAAA,EAArB,EAA8B,OAAe,QAAA,EAAS,CAAA;AAE3D;AC3HO,SAAS,OAAA,GAAqC;AACnD,EAAA,MAAM,GAAA,GAAMC,iBAAW,oBAAoB,CAAA;AAC3C,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,EACzE;AACA,EAAA,OAAO,GAAA;AACT;AAYO,SAAS,YAAA,GAAgC;AAC9C,EAAA,OAAO,SAAQ,CAAE,MAAA;AACnB","file":"index.cjs","sourcesContent":["// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n//\n// Framework-neutral browser-auth engine for ConfigHub. Productionized from the\n// reference harness `test/browser-auth/src/confighubAuth.ts` in the ConfigHub\n// monorepo, which is validated end to end against staging and prod.\n//\n// Flow (design: third-party-browser-app-auth.md §6):\n//   GET {base}/api/info                 -> discovery { AuthIssuer, TokenExchangeEndpoint }\n//   OIDC discovery on AuthIssuer        -> authorize/token endpoints\n//   PKCE authorize + code->token        -> IdP token\n//   POST {TokenExchangeEndpoint} (8693) -> minted ConfigHub token\n//\n// The minted token then rides `Authorization: Bearer` against `/api`. The flow is\n// edition-agnostic: `AuthIssuer` is whatever discovery names (ConfigHub's bundled\n// Keycloak for Cloud, the org's own IdP for Enterprise), so the same code runs\n// against both. Tokens are held in memory by the caller; only the transient PKCE\n// verifier is parked in sessionStorage across the authorize redirect.\n\nexport interface Discovery {\n  AuthIssuer?: string;\n  TokenExchangeEndpoint?: string;\n  TokenExchangeAudience?: string;\n}\n\nexport interface MintedSession {\n  accessToken: string;\n  organizationId: string;\n  /** Claims of the validated IdP token (owning-org, audience, organization shape). */\n  idpClaims: Record<string, unknown>;\n}\n\ninterface PkceState {\n  verifier: string;\n  state: string;\n  clientId: string;\n  tokenEndpoint: string;\n  exchangeEndpoint: string;\n}\n\nconst PKCE_KEY = 'confighub_pkce';\n\nconst redirectUri = (): string => window.location.origin + window.location.pathname;\n\nconst trimSlash = (s: string): string => s.replace(/\\/+$/, '');\n\nconst b64url = (buf: ArrayBuffer): string =>\n  btoa(String.fromCharCode(...new Uint8Array(buf)))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '');\n\nconst randomString = (n = 64): string =>\n  b64url(crypto.getRandomValues(new Uint8Array(n)).buffer);\n\nasync function sha256(s: string): Promise<string> {\n  return b64url(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(s)));\n}\n\nfunction decodeJwtClaims(token: string): Record<string, unknown> {\n  const part = token.split('.')[1];\n  if (!part) return {};\n  return JSON.parse(atob(part.replace(/-/g, '+').replace(/_/g, '/')));\n}\n\nexport async function discover(base: string): Promise<Discovery> {\n  const r = await fetch(trimSlash(base) + '/api/info');\n  if (!r.ok) throw new Error('/api/info failed: ' + r.status);\n  return r.json();\n}\n\nasync function oidcMetadata(\n  issuer: string,\n): Promise<{ authorization_endpoint: string; token_endpoint: string }> {\n  const r = await fetch(trimSlash(issuer) + '/.well-known/openid-configuration');\n  if (!r.ok) throw new Error('OIDC discovery failed: ' + r.status);\n  return r.json();\n}\n\n/**\n * Discover, build a PKCE request, and navigate to the IdP authorize endpoint.\n * Returns only by redirecting the page; `completeLoginFromRedirect()` finishes on\n * the way back.\n */\nexport async function startLogin(base: string, clientId: string): Promise<void> {\n  const info = await discover(base);\n  if (!info.AuthIssuer || !info.TokenExchangeEndpoint) {\n    throw new Error(\n      'this instance is not configured for token-exchange auth (server needs CONFIGHUB_IDP_ISSUER)',\n    );\n  }\n  const meta = await oidcMetadata(info.AuthIssuer);\n  const verifier = randomString();\n  const challenge = await sha256(verifier);\n  const state = randomString(16);\n  const pkce: PkceState = {\n    verifier,\n    state,\n    clientId,\n    tokenEndpoint: meta.token_endpoint,\n    exchangeEndpoint: info.TokenExchangeEndpoint,\n  };\n  sessionStorage.setItem(PKCE_KEY, JSON.stringify(pkce));\n\n  const authURL = new URL(meta.authorization_endpoint);\n  authURL.search = new URLSearchParams({\n    response_type: 'code',\n    client_id: clientId,\n    redirect_uri: redirectUri(),\n    // The \"organization\" scope makes Keycloak emit the org claim the exchange resolves.\n    scope: 'openid email profile organization',\n    code_challenge: challenge,\n    code_challenge_method: 'S256',\n    state,\n  }).toString();\n  window.location.assign(authURL.toString());\n}\n\n// Memoize so React StrictMode's double-mount can't redeem the one-time code twice.\nlet pending: Promise<MintedSession | null> | null = null;\n\n/**\n * If the page is the IdP redirect (`?code=...`), exchange the code for an IdP token\n * and then exchange that for a minted ConfigHub token. Returns null on a normal load.\n */\nexport function completeLoginFromRedirect(): Promise<MintedSession | null> {\n  if (!pending) pending = doCompleteLogin();\n  return pending;\n}\n\nasync function doCompleteLogin(): Promise<MintedSession | null> {\n  const params = new URLSearchParams(window.location.search);\n  const code = params.get('code');\n  const error = params.get('error');\n  if (error) {\n    history.replaceState({}, '', redirectUri());\n    throw new Error(`IdP returned error: ${error} ${params.get('error_description') ?? ''}`);\n  }\n  if (!code) return null;\n\n  const savedRaw = sessionStorage.getItem(PKCE_KEY);\n  sessionStorage.removeItem(PKCE_KEY);\n  history.replaceState({}, '', redirectUri()); // strip ?code= from the URL\n  if (!savedRaw) throw new Error('no PKCE state; restart login');\n  const saved: PkceState = JSON.parse(savedRaw);\n  if (params.get('state') !== saved.state) throw new Error('state mismatch; aborting');\n\n  // Exchange the authorization code for an IdP token (PKCE, public client).\n  const tokenResp = await fetch(saved.tokenEndpoint, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({\n      grant_type: 'authorization_code',\n      code,\n      redirect_uri: redirectUri(),\n      client_id: saved.clientId,\n      code_verifier: saved.verifier,\n    }),\n  });\n  if (!tokenResp.ok) {\n    throw new Error(`IdP token endpoint ${tokenResp.status}: ${await tokenResp.text()}`);\n  }\n  const idpToken = await tokenResp.json();\n\n  // RFC 8693 token exchange against ConfigHub -> minted ConfigHub token.\n  const exResp = await fetch(saved.exchangeEndpoint, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({\n      grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',\n      subject_token: idpToken.access_token,\n      subject_token_type: 'urn:ietf:params:oauth:token-type:access_token',\n    }),\n  });\n  if (!exResp.ok) throw new Error(`/auth/exchange ${exResp.status}: ${await exResp.text()}`);\n  const minted = await exResp.json();\n\n  return {\n    accessToken: minted.access_token,\n    organizationId: minted.organization_id,\n    idpClaims: decodeJwtClaims(idpToken.access_token),\n  };\n}\n\n/** Discard the in-progress login memo (used on logout so a later login re-runs). */\nexport function resetPending(): void {\n  pending = null;\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\n// A module-level holder for the current minted token, so non-React consumers can read\n// it. RTK Query's `prepareHeaders` (in @confighub/rtk-query) is not a hook and cannot\n// read React context, so it calls getAccessToken() instead. The provider keeps this in\n// sync with its React state.\nlet currentToken: string | undefined;\n\n/** @internal — called by the provider; not part of the public surface. */\nexport function setAccessToken(token: string | undefined): void {\n  currentToken = token;\n}\n\n/**\n * The current minted ConfigHub token, or undefined when unauthenticated. Pass this as\n * the `getToken` for `@confighub/rtk-query`'s `configureConfigHub`, or read it anywhere\n * you need the token outside React.\n */\nexport function getAccessToken(): string | undefined {\n  return currentToken;\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\nimport { createConfigHubClient, type ConfigHubClient } from '@confighub/api';\nimport {\n  createContext,\n  useCallback,\n  useEffect,\n  useMemo,\n  useRef,\n  useState,\n  type ReactNode,\n} from 'react';\nimport {\n  completeLoginFromRedirect,\n  resetPending,\n  startLogin,\n  type MintedSession,\n} from './core';\nimport { setAccessToken } from './tokenStore';\n\nexport type AuthStatus = 'loading' | 'authenticated' | 'unauthenticated' | 'error';\n\nexport interface ConfigHubUser {\n  organizationId: string;\n  idpClaims: Record<string, unknown>;\n}\n\nexport interface ConfigHubAuthContextValue {\n  status: AuthStatus;\n  user: ConfigHubUser | null;\n  error: Error | null;\n  /** Begin login: redirects the page to the IdP. */\n  login: () => Promise<void>;\n  /** Clear the in-memory session. Does not call the IdP end-session endpoint. */\n  logout: () => void;\n  /** Current bearer token, or undefined when unauthenticated. */\n  getToken: () => string | undefined;\n  /** A typed API client pre-wired with the current token. Stable across renders. */\n  client: ConfigHubClient;\n}\n\nexport const ConfigHubAuthContext = createContext<ConfigHubAuthContextValue | null>(null);\n\nexport interface ConfigHubAuthProviderProps {\n  /** Absolute base URL of the ConfigHub instance, e.g. `https://hub.confighub.com`. */\n  baseUrl: string;\n  /** This app's registered OAuth `client_id` (from `cub oauthclient create`). */\n  clientId: string;\n  children: ReactNode;\n}\n\n/**\n * Runs the browser-direct auth flow and manages the token lifecycle. On mount it\n * completes a redirect if the page is the IdP callback; otherwise it starts\n * unauthenticated until `login()` is called.\n */\nexport function ConfigHubAuthProvider({\n  baseUrl,\n  clientId,\n  children,\n}: ConfigHubAuthProviderProps): JSX.Element {\n  const [status, setStatus] = useState<AuthStatus>('loading');\n  const [user, setUser] = useState<ConfigHubUser | null>(null);\n  const [error, setError] = useState<Error | null>(null);\n\n  // The token lives in a ref so getToken() reads the latest value synchronously\n  // without re-creating the API client on every render.\n  const tokenRef = useRef<string | undefined>(undefined);\n\n  const applySession = useCallback((session: MintedSession) => {\n    tokenRef.current = session.accessToken;\n    setAccessToken(session.accessToken); // keep the non-React accessor in sync (rtk-query)\n    setUser({ organizationId: session.organizationId, idpClaims: session.idpClaims });\n    setError(null);\n    setStatus('authenticated');\n  }, []);\n\n  useEffect(() => {\n    let cancelled = false;\n    completeLoginFromRedirect()\n      .then((session) => {\n        if (cancelled) return;\n        if (session) applySession(session);\n        else setStatus('unauthenticated');\n      })\n      .catch((e: unknown) => {\n        if (cancelled) return;\n        setError(e instanceof Error ? e : new Error(String(e)));\n        setStatus('error');\n      });\n    return () => {\n      cancelled = true;\n    };\n  }, [applySession]);\n\n  const login = useCallback(async () => {\n    setError(null);\n    try {\n      await startLogin(baseUrl, clientId);\n    } catch (e: unknown) {\n      setError(e instanceof Error ? e : new Error(String(e)));\n      setStatus('error');\n    }\n  }, [baseUrl, clientId]);\n\n  const logout = useCallback(() => {\n    tokenRef.current = undefined;\n    setAccessToken(undefined);\n    resetPending();\n    setUser(null);\n    setStatus('unauthenticated');\n  }, []);\n\n  const getToken = useCallback(() => tokenRef.current, []);\n\n  // One client for the provider's lifetime. getToken reads tokenRef, and a 401\n  // routes back to login() so an expired session re-authenticates.\n  const client = useMemo(\n    () =>\n      createConfigHubClient({\n        baseUrl,\n        getToken,\n        onUnauthorized: () => {\n          logout();\n        },\n      }),\n    [baseUrl, getToken, logout],\n  );\n\n  const value = useMemo<ConfigHubAuthContextValue>(\n    () => ({ status, user, error, login, logout, getToken, client }),\n    [status, user, error, login, logout, getToken, client],\n  );\n\n  return (\n    <ConfigHubAuthContext.Provider value={value}>{children}</ConfigHubAuthContext.Provider>\n  );\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\nimport type { ConfigHubClient } from '@confighub/api';\nimport { useContext } from 'react';\nimport { ConfigHubAuthContext, type ConfigHubAuthContextValue } from './provider';\n\n/**\n * Access the ConfigHub auth state and actions. Must be called under a\n * `<ConfigHubAuthProvider>`.\n *\n * ```ts\n * const { status, user, login, logout } = useAuth();\n * ```\n */\nexport function useAuth(): ConfigHubAuthContextValue {\n  const ctx = useContext(ConfigHubAuthContext);\n  if (!ctx) {\n    throw new Error('useAuth must be used within a <ConfigHubAuthProvider>');\n  }\n  return ctx;\n}\n\n/**\n * The typed ConfigHub API client, pre-wired with the current token. This is the\n * seam between `@confighub/react-auth` and `@confighub/api`: you never pass a\n * token by hand.\n *\n * ```ts\n * const api = useConfigHub();\n * const { data } = await api.GET('/space/{space_id}/unit', { params: { path: { space_id } } });\n * ```\n */\nexport function useConfigHub(): ConfigHubClient {\n  return useAuth().client;\n}\n"]}

package/dist/index.d.cts

@@ -0,0 +1,78 @@
+import * as react from 'react';
+import { ReactNode } from 'react';
+import { ConfigHubClient } from '@confighub/api';
+
+type AuthStatus = 'loading' | 'authenticated' | 'unauthenticated' | 'error';
+interface ConfigHubUser {
+    organizationId: string;
+    idpClaims: Record<string, unknown>;
+}
+interface ConfigHubAuthContextValue {
+    status: AuthStatus;
+    user: ConfigHubUser | null;
+    error: Error | null;
+    /** Begin login: redirects the page to the IdP. */
+    login: () => Promise<void>;
+    /** Clear the in-memory session. Does not call the IdP end-session endpoint. */
+    logout: () => void;
+    /** Current bearer token, or undefined when unauthenticated. */
+    getToken: () => string | undefined;
+    /** A typed API client pre-wired with the current token. Stable across renders. */
+    client: ConfigHubClient;
+}
+declare const ConfigHubAuthContext: react.Context<ConfigHubAuthContextValue | null>;
+interface ConfigHubAuthProviderProps {
+    /** Absolute base URL of the ConfigHub instance, e.g. `https://hub.confighub.com`. */
+    baseUrl: string;
+    /** This app's registered OAuth `client_id` (from `cub oauthclient create`). */
+    clientId: string;
+    children: ReactNode;
+}
+/**
+ * Runs the browser-direct auth flow and manages the token lifecycle. On mount it
+ * completes a redirect if the page is the IdP callback; otherwise it starts
+ * unauthenticated until `login()` is called.
+ */
+declare function ConfigHubAuthProvider({ baseUrl, clientId, children, }: ConfigHubAuthProviderProps): JSX.Element;
+
+/**
+ * Access the ConfigHub auth state and actions. Must be called under a
+ * `<ConfigHubAuthProvider>`.
+ *
+ * ```ts
+ * const { status, user, login, logout } = useAuth();
+ * ```
+ */
+declare function useAuth(): ConfigHubAuthContextValue;
+/**
+ * The typed ConfigHub API client, pre-wired with the current token. This is the
+ * seam between `@confighub/react-auth` and `@confighub/api`: you never pass a
+ * token by hand.
+ *
+ * ```ts
+ * const api = useConfigHub();
+ * const { data } = await api.GET('/space/{space_id}/unit', { params: { path: { space_id } } });
+ * ```
+ */
+declare function useConfigHub(): ConfigHubClient;
+
+/**
+ * The current minted ConfigHub token, or undefined when unauthenticated. Pass this as
+ * the `getToken` for `@confighub/rtk-query`'s `configureConfigHub`, or read it anywhere
+ * you need the token outside React.
+ */
+declare function getAccessToken(): string | undefined;
+
+interface Discovery {
+    AuthIssuer?: string;
+    TokenExchangeEndpoint?: string;
+    TokenExchangeAudience?: string;
+}
+interface MintedSession {
+    accessToken: string;
+    organizationId: string;
+    /** Claims of the validated IdP token (owning-org, audience, organization shape). */
+    idpClaims: Record<string, unknown>;
+}
+
+export { type AuthStatus, ConfigHubAuthContext, type ConfigHubAuthContextValue, ConfigHubAuthProvider, type ConfigHubAuthProviderProps, type ConfigHubUser, type Discovery, type MintedSession, getAccessToken, useAuth, useConfigHub };

package/dist/index.d.ts

@@ -0,0 +1,78 @@
+import * as react from 'react';
+import { ReactNode } from 'react';
+import { ConfigHubClient } from '@confighub/api';
+
+type AuthStatus = 'loading' | 'authenticated' | 'unauthenticated' | 'error';
+interface ConfigHubUser {
+    organizationId: string;
+    idpClaims: Record<string, unknown>;
+}
+interface ConfigHubAuthContextValue {
+    status: AuthStatus;
+    user: ConfigHubUser | null;
+    error: Error | null;
+    /** Begin login: redirects the page to the IdP. */
+    login: () => Promise<void>;
+    /** Clear the in-memory session. Does not call the IdP end-session endpoint. */
+    logout: () => void;
+    /** Current bearer token, or undefined when unauthenticated. */
+    getToken: () => string | undefined;
+    /** A typed API client pre-wired with the current token. Stable across renders. */
+    client: ConfigHubClient;
+}
+declare const ConfigHubAuthContext: react.Context<ConfigHubAuthContextValue | null>;
+interface ConfigHubAuthProviderProps {
+    /** Absolute base URL of the ConfigHub instance, e.g. `https://hub.confighub.com`. */
+    baseUrl: string;
+    /** This app's registered OAuth `client_id` (from `cub oauthclient create`). */
+    clientId: string;
+    children: ReactNode;
+}
+/**
+ * Runs the browser-direct auth flow and manages the token lifecycle. On mount it
+ * completes a redirect if the page is the IdP callback; otherwise it starts
+ * unauthenticated until `login()` is called.
+ */
+declare function ConfigHubAuthProvider({ baseUrl, clientId, children, }: ConfigHubAuthProviderProps): JSX.Element;
+
+/**
+ * Access the ConfigHub auth state and actions. Must be called under a
+ * `<ConfigHubAuthProvider>`.
+ *
+ * ```ts
+ * const { status, user, login, logout } = useAuth();
+ * ```
+ */
+declare function useAuth(): ConfigHubAuthContextValue;
+/**
+ * The typed ConfigHub API client, pre-wired with the current token. This is the
+ * seam between `@confighub/react-auth` and `@confighub/api`: you never pass a
+ * token by hand.
+ *
+ * ```ts
+ * const api = useConfigHub();
+ * const { data } = await api.GET('/space/{space_id}/unit', { params: { path: { space_id } } });
+ * ```
+ */
+declare function useConfigHub(): ConfigHubClient;
+
+/**
+ * The current minted ConfigHub token, or undefined when unauthenticated. Pass this as
+ * the `getToken` for `@confighub/rtk-query`'s `configureConfigHub`, or read it anywhere
+ * you need the token outside React.
+ */
+declare function getAccessToken(): string | undefined;
+
+interface Discovery {
+    AuthIssuer?: string;
+    TokenExchangeEndpoint?: string;
+    TokenExchangeAudience?: string;
+}
+interface MintedSession {
+    accessToken: string;
+    organizationId: string;
+    /** Claims of the validated IdP token (owning-org, audience, organization shape). */
+    idpClaims: Record<string, unknown>;
+}
+
+export { type AuthStatus, ConfigHubAuthContext, type ConfigHubAuthContextValue, ConfigHubAuthProvider, type ConfigHubAuthProviderProps, type ConfigHubUser, type Discovery, type MintedSession, getAccessToken, useAuth, useConfigHub };

package/dist/index.js

@@ -0,0 +1,205 @@
+import { createConfigHubClient } from '@confighub/api';
+import { createContext, useState, useRef, useCallback, useEffect, useMemo, useContext } from 'react';
+import { jsx } from 'react/jsx-runtime';
+
+// src/provider.tsx
+
+// src/core.ts
+var PKCE_KEY = "confighub_pkce";
+var redirectUri = () => window.location.origin + window.location.pathname;
+var trimSlash = (s) => s.replace(/\/+$/, "");
+var b64url = (buf) => btoa(String.fromCharCode(...new Uint8Array(buf))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+var randomString = (n = 64) => b64url(crypto.getRandomValues(new Uint8Array(n)).buffer);
+async function sha256(s) {
+  return b64url(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(s)));
+}
+function decodeJwtClaims(token) {
+  const part = token.split(".")[1];
+  if (!part) return {};
+  return JSON.parse(atob(part.replace(/-/g, "+").replace(/_/g, "/")));
+}
+async function discover(base) {
+  const r = await fetch(trimSlash(base) + "/api/info");
+  if (!r.ok) throw new Error("/api/info failed: " + r.status);
+  return r.json();
+}
+async function oidcMetadata(issuer) {
+  const r = await fetch(trimSlash(issuer) + "/.well-known/openid-configuration");
+  if (!r.ok) throw new Error("OIDC discovery failed: " + r.status);
+  return r.json();
+}
+async function startLogin(base, clientId) {
+  const info = await discover(base);
+  if (!info.AuthIssuer || !info.TokenExchangeEndpoint) {
+    throw new Error(
+      "this instance is not configured for token-exchange auth (server needs CONFIGHUB_IDP_ISSUER)"
+    );
+  }
+  const meta = await oidcMetadata(info.AuthIssuer);
+  const verifier = randomString();
+  const challenge = await sha256(verifier);
+  const state = randomString(16);
+  const pkce = {
+    verifier,
+    state,
+    clientId,
+    tokenEndpoint: meta.token_endpoint,
+    exchangeEndpoint: info.TokenExchangeEndpoint
+  };
+  sessionStorage.setItem(PKCE_KEY, JSON.stringify(pkce));
+  const authURL = new URL(meta.authorization_endpoint);
+  authURL.search = new URLSearchParams({
+    response_type: "code",
+    client_id: clientId,
+    redirect_uri: redirectUri(),
+    // The "organization" scope makes Keycloak emit the org claim the exchange resolves.
+    scope: "openid email profile organization",
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+    state
+  }).toString();
+  window.location.assign(authURL.toString());
+}
+var pending = null;
+function completeLoginFromRedirect() {
+  if (!pending) pending = doCompleteLogin();
+  return pending;
+}
+async function doCompleteLogin() {
+  const params = new URLSearchParams(window.location.search);
+  const code = params.get("code");
+  const error = params.get("error");
+  if (error) {
+    history.replaceState({}, "", redirectUri());
+    throw new Error(`IdP returned error: ${error} ${params.get("error_description") ?? ""}`);
+  }
+  if (!code) return null;
+  const savedRaw = sessionStorage.getItem(PKCE_KEY);
+  sessionStorage.removeItem(PKCE_KEY);
+  history.replaceState({}, "", redirectUri());
+  if (!savedRaw) throw new Error("no PKCE state; restart login");
+  const saved = JSON.parse(savedRaw);
+  if (params.get("state") !== saved.state) throw new Error("state mismatch; aborting");
+  const tokenResp = await fetch(saved.tokenEndpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: redirectUri(),
+      client_id: saved.clientId,
+      code_verifier: saved.verifier
+    })
+  });
+  if (!tokenResp.ok) {
+    throw new Error(`IdP token endpoint ${tokenResp.status}: ${await tokenResp.text()}`);
+  }
+  const idpToken = await tokenResp.json();
+  const exResp = await fetch(saved.exchangeEndpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
+      subject_token: idpToken.access_token,
+      subject_token_type: "urn:ietf:params:oauth:token-type:access_token"
+    })
+  });
+  if (!exResp.ok) throw new Error(`/auth/exchange ${exResp.status}: ${await exResp.text()}`);
+  const minted = await exResp.json();
+  return {
+    accessToken: minted.access_token,
+    organizationId: minted.organization_id,
+    idpClaims: decodeJwtClaims(idpToken.access_token)
+  };
+}
+function resetPending() {
+  pending = null;
+}
+
+// src/tokenStore.ts
+var currentToken;
+function setAccessToken(token) {
+  currentToken = token;
+}
+function getAccessToken() {
+  return currentToken;
+}
+var ConfigHubAuthContext = createContext(null);
+function ConfigHubAuthProvider({
+  baseUrl,
+  clientId,
+  children
+}) {
+  const [status, setStatus] = useState("loading");
+  const [user, setUser] = useState(null);
+  const [error, setError] = useState(null);
+  const tokenRef = useRef(void 0);
+  const applySession = useCallback((session) => {
+    tokenRef.current = session.accessToken;
+    setAccessToken(session.accessToken);
+    setUser({ organizationId: session.organizationId, idpClaims: session.idpClaims });
+    setError(null);
+    setStatus("authenticated");
+  }, []);
+  useEffect(() => {
+    let cancelled = false;
+    completeLoginFromRedirect().then((session) => {
+      if (cancelled) return;
+      if (session) applySession(session);
+      else setStatus("unauthenticated");
+    }).catch((e) => {
+      if (cancelled) return;
+      setError(e instanceof Error ? e : new Error(String(e)));
+      setStatus("error");
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [applySession]);
+  const login = useCallback(async () => {
+    setError(null);
+    try {
+      await startLogin(baseUrl, clientId);
+    } catch (e) {
+      setError(e instanceof Error ? e : new Error(String(e)));
+      setStatus("error");
+    }
+  }, [baseUrl, clientId]);
+  const logout = useCallback(() => {
+    tokenRef.current = void 0;
+    setAccessToken(void 0);
+    resetPending();
+    setUser(null);
+    setStatus("unauthenticated");
+  }, []);
+  const getToken = useCallback(() => tokenRef.current, []);
+  const client = useMemo(
+    () => createConfigHubClient({
+      baseUrl,
+      getToken,
+      onUnauthorized: () => {
+        logout();
+      }
+    }),
+    [baseUrl, getToken, logout]
+  );
+  const value = useMemo(
+    () => ({ status, user, error, login, logout, getToken, client }),
+    [status, user, error, login, logout, getToken, client]
+  );
+  return /* @__PURE__ */ jsx(ConfigHubAuthContext.Provider, { value, children });
+}
+function useAuth() {
+  const ctx = useContext(ConfigHubAuthContext);
+  if (!ctx) {
+    throw new Error("useAuth must be used within a <ConfigHubAuthProvider>");
+  }
+  return ctx;
+}
+function useConfigHub() {
+  return useAuth().client;
+}
+
+export { ConfigHubAuthContext, ConfigHubAuthProvider, getAccessToken, useAuth, useConfigHub };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core.ts","../src/tokenStore.ts","../src/provider.tsx","../src/hooks.ts"],"names":[],"mappings":";;;;;;;AAwCA,IAAM,QAAA,GAAW,gBAAA;AAEjB,IAAM,cAAc,MAAc,MAAA,CAAO,QAAA,CAAS,MAAA,GAAS,OAAO,QAAA,CAAS,QAAA;AAE3E,IAAM,YAAY,CAAC,CAAA,KAAsB,CAAA,CAAE,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAE7D,IAAM,MAAA,GAAS,CAAC,GAAA,KACd,IAAA,CAAK,OAAO,YAAA,CAAa,GAAG,IAAI,UAAA,CAAW,GAAG,CAAC,CAAC,CAAA,CAC7C,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,OAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAEtB,IAAM,YAAA,GAAe,CAAC,CAAA,GAAI,EAAA,KACxB,MAAA,CAAO,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,CAAC,CAAC,CAAA,CAAE,MAAM,CAAA;AAEzD,eAAe,OAAO,CAAA,EAA4B;AAChD,EAAA,OAAO,MAAA,CAAO,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AAClF;AAEA,SAAS,gBAAgB,KAAA,EAAwC;AAC/D,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC/B,EAAA,IAAI,CAAC,IAAA,EAAM,OAAO,EAAC;AACnB,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAC,CAAC,CAAA;AACpE;AAEA,eAAsB,SAAS,IAAA,EAAkC;AAC/D,EAAA,MAAM,IAAI,MAAM,KAAA,CAAM,SAAA,CAAU,IAAI,IAAI,WAAW,CAAA;AACnD,EAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,oBAAA,GAAuB,EAAE,MAAM,CAAA;AAC1D,EAAA,OAAO,EAAE,IAAA,EAAK;AAChB;AAEA,eAAe,aACb,MAAA,EACqE;AACrE,EAAA,MAAM,IAAI,MAAM,KAAA,CAAM,SAAA,CAAU,MAAM,IAAI,mCAAmC,CAAA;AAC7E,EAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,yBAAA,GAA4B,EAAE,MAAM,CAAA;AAC/D,EAAA,OAAO,EAAE,IAAA,EAAK;AAChB;AAOA,eAAsB,UAAA,CAAW,MAAc,QAAA,EAAiC;AAC9E,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAI,CAAA;AAChC,EAAA,IAAI,CAAC,IAAA,CAAK,UAAA,IAAc,CAAC,KAAK,qBAAA,EAAuB;AACnD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAO,MAAM,YAAA,CAAa,IAAA,CAAK,UAAU,CAAA;AAC/C,EAAA,MAAM,WAAW,YAAA,EAAa;AAC9B,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,QAAQ,CAAA;AACvC,EAAA,MAAM,KAAA,GAAQ,aAAa,EAAE,CAAA;AAC7B,EAAA,MAAM,IAAA,GAAkB;AAAA,IACtB,QAAA;AAAA,IACA,KAAA;AAAA,IACA,QAAA;AAAA,IACA,eAAe,IAAA,CAAK,cAAA;AAAA,IACpB,kBAAkB,IAAA,CAAK;AAAA,GACzB;AACA,EAAA,cAAA,CAAe,OAAA,CAAQ,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AAErD,EAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,IAAA,CAAK,sBAAsB,CAAA;AACnD,EAAA,OAAA,CAAQ,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,IACnC,aAAA,EAAe,MAAA;AAAA,IACf,SAAA,EAAW,QAAA;AAAA,IACX,cAAc,WAAA,EAAY;AAAA;AAAA,IAE1B,KAAA,EAAO,mCAAA;AAAA,IACP,cAAA,EAAgB,SAAA;AAAA,IAChB,qBAAA,EAAuB,MAAA;AAAA,IACvB;AAAA,GACD,EAAE,QAAA,EAAS;AACZ,EAAA,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,OAAA,CAAQ,QAAA,EAAU,CAAA;AAC3C;AAGA,IAAI,OAAA,GAAgD,IAAA;AAM7C,SAAS,yBAAA,GAA2D;AACzE,EAAA,IAAI,CAAC,OAAA,EAAS,OAAA,GAAU,eAAA,EAAgB;AACxC,EAAA,OAAO,OAAA;AACT;AAEA,eAAe,eAAA,GAAiD;AAC9D,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAA,CAAO,SAAS,MAAM,CAAA;AACzD,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AAC9B,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA;AAChC,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,OAAA,CAAQ,YAAA,CAAa,EAAC,EAAG,EAAA,EAAI,aAAa,CAAA;AAC1C,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,KAAK,CAAA,CAAA,EAAI,OAAO,GAAA,CAAI,mBAAmB,CAAA,IAAK,EAAE,CAAA,CAAE,CAAA;AAAA,EACzF;AACA,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAElB,EAAA,MAAM,QAAA,GAAW,cAAA,CAAe,OAAA,CAAQ,QAAQ,CAAA;AAChD,EAAA,cAAA,CAAe,WAAW,QAAQ,CAAA;AAClC,EAAA,OAAA,CAAQ,YAAA,CAAa,EAAC,EAAG,EAAA,EAAI,aAAa,CAAA;AAC1C,EAAA,IAAI,CAAC,QAAA,EAAU,MAAM,IAAI,MAAM,8BAA8B,CAAA;AAC7D,EAAA,MAAM,KAAA,GAAmB,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA;AAC5C,EAAA,IAAI,MAAA,CAAO,IAAI,OAAO,CAAA,KAAM,MAAM,KAAA,EAAO,MAAM,IAAI,KAAA,CAAM,0BAA0B,CAAA;AAGnF,EAAA,MAAM,SAAA,GAAY,MAAM,KAAA,CAAM,KAAA,CAAM,aAAA,EAAe;AAAA,IACjD,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,oBAAA;AAAA,MACZ,IAAA;AAAA,MACA,cAAc,WAAA,EAAY;AAAA,MAC1B,WAAW,KAAA,CAAM,QAAA;AAAA,MACjB,eAAe,KAAA,CAAM;AAAA,KACtB;AAAA,GACF,CAAA;AACD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,SAAA,CAAU,MAAM,KAAK,MAAM,SAAA,CAAU,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EACrF;AACA,EAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,IAAA,EAAK;AAGtC,EAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,KAAA,CAAM,gBAAA,EAAkB;AAAA,IACjD,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,iDAAA;AAAA,MACZ,eAAe,QAAA,CAAS,YAAA;AAAA,MACxB,kBAAA,EAAoB;AAAA,KACrB;AAAA,GACF,CAAA;AACD,EAAA,IAAI,CAAC,MAAA,CAAO,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,MAAA,CAAO,MAAM,CAAA,EAAA,EAAK,MAAM,MAAA,CAAO,IAAA,EAAM,CAAA,CAAE,CAAA;AACzF,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,EAAK;AAEjC,EAAA,OAAO;AAAA,IACL,aAAa,MAAA,CAAO,YAAA;AAAA,IACpB,gBAAgB,MAAA,CAAO,eAAA;AAAA,IACvB,SAAA,EAAW,eAAA,CAAgB,QAAA,CAAS,YAAY;AAAA,GAClD;AACF;AAGO,SAAS,YAAA,GAAqB;AACnC,EAAA,OAAA,GAAU,IAAA;AACZ;;;ACpLA,IAAI,YAAA;AAGG,SAAS,eAAe,KAAA,EAAiC;AAC9D,EAAA,YAAA,GAAe,KAAA;AACjB;AAOO,SAAS,cAAA,GAAqC;AACnD,EAAA,OAAO,YAAA;AACT;ACqBO,IAAM,oBAAA,GAAuB,cAAgD,IAAI;AAejF,SAAS,qBAAA,CAAsB;AAAA,EACpC,OAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAA,EAA4C;AAC1C,EAAA,MAAM,CAAC,MAAA,EAAQ,SAAS,CAAA,GAAI,SAAqB,SAAS,CAAA;AAC1D,EAAA,MAAM,CAAC,IAAA,EAAM,OAAO,CAAA,GAAI,SAA+B,IAAI,CAAA;AAC3D,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAI,SAAuB,IAAI,CAAA;AAIrD,EAAA,MAAM,QAAA,GAAW,OAA2B,MAAS,CAAA;AAErD,EAAA,MAAM,YAAA,GAAe,WAAA,CAAY,CAAC,OAAA,KAA2B;AAC3D,IAAA,QAAA,CAAS,UAAU,OAAA,CAAQ,WAAA;AAC3B,IAAA,cAAA,CAAe,QAAQ,WAAW,CAAA;AAClC,IAAA,OAAA,CAAQ,EAAE,cAAA,EAAgB,OAAA,CAAQ,gBAAgB,SAAA,EAAW,OAAA,CAAQ,WAAW,CAAA;AAChF,IAAA,QAAA,CAAS,IAAI,CAAA;AACb,IAAA,SAAA,CAAU,eAAe,CAAA;AAAA,EAC3B,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,SAAA,GAAY,KAAA;AAChB,IAAA,yBAAA,EAA0B,CACvB,IAAA,CAAK,CAAC,OAAA,KAAY;AACjB,MAAA,IAAI,SAAA,EAAW;AACf,MAAA,IAAI,OAAA,eAAsB,OAAO,CAAA;AAAA,qBAClB,iBAAiB,CAAA;AAAA,IAClC,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,CAAA,KAAe;AACrB,MAAA,IAAI,SAAA,EAAW;AACf,MAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,MAAA,SAAA,CAAU,OAAO,CAAA;AAAA,IACnB,CAAC,CAAA;AACH,IAAA,OAAO,MAAM;AACX,MAAA,SAAA,GAAY,IAAA;AAAA,IACd,CAAA;AAAA,EACF,CAAA,EAAG,CAAC,YAAY,CAAC,CAAA;AAEjB,EAAA,MAAM,KAAA,GAAQ,YAAY,YAAY;AACpC,IAAA,QAAA,CAAS,IAAI,CAAA;AACb,IAAA,IAAI;AACF,MAAA,MAAM,UAAA,CAAW,SAAS,QAAQ,CAAA;AAAA,IACpC,SAAS,CAAA,EAAY;AACnB,MAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,MAAA,SAAA,CAAU,OAAO,CAAA;AAAA,IACnB;AAAA,EACF,CAAA,EAAG,CAAC,OAAA,EAAS,QAAQ,CAAC,CAAA;AAEtB,EAAA,MAAM,MAAA,GAAS,YAAY,MAAM;AAC/B,IAAA,QAAA,CAAS,OAAA,GAAU,MAAA;AACnB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,YAAA,EAAa;AACb,IAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,IAAA,SAAA,CAAU,iBAAiB,CAAA;AAAA,EAC7B,CAAA,EAAG,EAAE,CAAA;AAEL,EAAA,MAAM,WAAW,WAAA,CAAY,MAAM,QAAA,CAAS,OAAA,EAAS,EAAE,CAAA;AAIvD,EAAA,MAAM,MAAA,GAAS,OAAA;AAAA,IACb,MACE,qBAAA,CAAsB;AAAA,MACpB,OAAA;AAAA,MACA,QAAA;AAAA,MACA,gBAAgB,MAAM;AACpB,QAAA,MAAA,EAAO;AAAA,MACT;AAAA,KACD,CAAA;AAAA,IACH,CAAC,OAAA,EAAS,QAAA,EAAU,MAAM;AAAA,GAC5B;AAEA,EAAA,MAAM,KAAA,GAAQ,OAAA;AAAA,IACZ,OAAO,EAAE,MAAA,EAAQ,IAAA,EAAM,OAAO,KAAA,EAAO,MAAA,EAAQ,UAAU,MAAA,EAAO,CAAA;AAAA,IAC9D,CAAC,MAAA,EAAQ,IAAA,EAAM,OAAO,KAAA,EAAO,MAAA,EAAQ,UAAU,MAAM;AAAA,GACvD;AAEA,EAAA,uBACE,GAAA,CAAC,oBAAA,CAAqB,QAAA,EAArB,EAA8B,OAAe,QAAA,EAAS,CAAA;AAE3D;AC3HO,SAAS,OAAA,GAAqC;AACnD,EAAA,MAAM,GAAA,GAAM,WAAW,oBAAoB,CAAA;AAC3C,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,EACzE;AACA,EAAA,OAAO,GAAA;AACT;AAYO,SAAS,YAAA,GAAgC;AAC9C,EAAA,OAAO,SAAQ,CAAE,MAAA;AACnB","file":"index.js","sourcesContent":["// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n//\n// Framework-neutral browser-auth engine for ConfigHub. Productionized from the\n// reference harness `test/browser-auth/src/confighubAuth.ts` in the ConfigHub\n// monorepo, which is validated end to end against staging and prod.\n//\n// Flow (design: third-party-browser-app-auth.md §6):\n//   GET {base}/api/info                 -> discovery { AuthIssuer, TokenExchangeEndpoint }\n//   OIDC discovery on AuthIssuer        -> authorize/token endpoints\n//   PKCE authorize + code->token        -> IdP token\n//   POST {TokenExchangeEndpoint} (8693) -> minted ConfigHub token\n//\n// The minted token then rides `Authorization: Bearer` against `/api`. The flow is\n// edition-agnostic: `AuthIssuer` is whatever discovery names (ConfigHub's bundled\n// Keycloak for Cloud, the org's own IdP for Enterprise), so the same code runs\n// against both. Tokens are held in memory by the caller; only the transient PKCE\n// verifier is parked in sessionStorage across the authorize redirect.\n\nexport interface Discovery {\n  AuthIssuer?: string;\n  TokenExchangeEndpoint?: string;\n  TokenExchangeAudience?: string;\n}\n\nexport interface MintedSession {\n  accessToken: string;\n  organizationId: string;\n  /** Claims of the validated IdP token (owning-org, audience, organization shape). */\n  idpClaims: Record<string, unknown>;\n}\n\ninterface PkceState {\n  verifier: string;\n  state: string;\n  clientId: string;\n  tokenEndpoint: string;\n  exchangeEndpoint: string;\n}\n\nconst PKCE_KEY = 'confighub_pkce';\n\nconst redirectUri = (): string => window.location.origin + window.location.pathname;\n\nconst trimSlash = (s: string): string => s.replace(/\\/+$/, '');\n\nconst b64url = (buf: ArrayBuffer): string =>\n  btoa(String.fromCharCode(...new Uint8Array(buf)))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '');\n\nconst randomString = (n = 64): string =>\n  b64url(crypto.getRandomValues(new Uint8Array(n)).buffer);\n\nasync function sha256(s: string): Promise<string> {\n  return b64url(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(s)));\n}\n\nfunction decodeJwtClaims(token: string): Record<string, unknown> {\n  const part = token.split('.')[1];\n  if (!part) return {};\n  return JSON.parse(atob(part.replace(/-/g, '+').replace(/_/g, '/')));\n}\n\nexport async function discover(base: string): Promise<Discovery> {\n  const r = await fetch(trimSlash(base) + '/api/info');\n  if (!r.ok) throw new Error('/api/info failed: ' + r.status);\n  return r.json();\n}\n\nasync function oidcMetadata(\n  issuer: string,\n): Promise<{ authorization_endpoint: string; token_endpoint: string }> {\n  const r = await fetch(trimSlash(issuer) + '/.well-known/openid-configuration');\n  if (!r.ok) throw new Error('OIDC discovery failed: ' + r.status);\n  return r.json();\n}\n\n/**\n * Discover, build a PKCE request, and navigate to the IdP authorize endpoint.\n * Returns only by redirecting the page; `completeLoginFromRedirect()` finishes on\n * the way back.\n */\nexport async function startLogin(base: string, clientId: string): Promise<void> {\n  const info = await discover(base);\n  if (!info.AuthIssuer || !info.TokenExchangeEndpoint) {\n    throw new Error(\n      'this instance is not configured for token-exchange auth (server needs CONFIGHUB_IDP_ISSUER)',\n    );\n  }\n  const meta = await oidcMetadata(info.AuthIssuer);\n  const verifier = randomString();\n  const challenge = await sha256(verifier);\n  const state = randomString(16);\n  const pkce: PkceState = {\n    verifier,\n    state,\n    clientId,\n    tokenEndpoint: meta.token_endpoint,\n    exchangeEndpoint: info.TokenExchangeEndpoint,\n  };\n  sessionStorage.setItem(PKCE_KEY, JSON.stringify(pkce));\n\n  const authURL = new URL(meta.authorization_endpoint);\n  authURL.search = new URLSearchParams({\n    response_type: 'code',\n    client_id: clientId,\n    redirect_uri: redirectUri(),\n    // The \"organization\" scope makes Keycloak emit the org claim the exchange resolves.\n    scope: 'openid email profile organization',\n    code_challenge: challenge,\n    code_challenge_method: 'S256',\n    state,\n  }).toString();\n  window.location.assign(authURL.toString());\n}\n\n// Memoize so React StrictMode's double-mount can't redeem the one-time code twice.\nlet pending: Promise<MintedSession | null> | null = null;\n\n/**\n * If the page is the IdP redirect (`?code=...`), exchange the code for an IdP token\n * and then exchange that for a minted ConfigHub token. Returns null on a normal load.\n */\nexport function completeLoginFromRedirect(): Promise<MintedSession | null> {\n  if (!pending) pending = doCompleteLogin();\n  return pending;\n}\n\nasync function doCompleteLogin(): Promise<MintedSession | null> {\n  const params = new URLSearchParams(window.location.search);\n  const code = params.get('code');\n  const error = params.get('error');\n  if (error) {\n    history.replaceState({}, '', redirectUri());\n    throw new Error(`IdP returned error: ${error} ${params.get('error_description') ?? ''}`);\n  }\n  if (!code) return null;\n\n  const savedRaw = sessionStorage.getItem(PKCE_KEY);\n  sessionStorage.removeItem(PKCE_KEY);\n  history.replaceState({}, '', redirectUri()); // strip ?code= from the URL\n  if (!savedRaw) throw new Error('no PKCE state; restart login');\n  const saved: PkceState = JSON.parse(savedRaw);\n  if (params.get('state') !== saved.state) throw new Error('state mismatch; aborting');\n\n  // Exchange the authorization code for an IdP token (PKCE, public client).\n  const tokenResp = await fetch(saved.tokenEndpoint, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({\n      grant_type: 'authorization_code',\n      code,\n      redirect_uri: redirectUri(),\n      client_id: saved.clientId,\n      code_verifier: saved.verifier,\n    }),\n  });\n  if (!tokenResp.ok) {\n    throw new Error(`IdP token endpoint ${tokenResp.status}: ${await tokenResp.text()}`);\n  }\n  const idpToken = await tokenResp.json();\n\n  // RFC 8693 token exchange against ConfigHub -> minted ConfigHub token.\n  const exResp = await fetch(saved.exchangeEndpoint, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({\n      grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',\n      subject_token: idpToken.access_token,\n      subject_token_type: 'urn:ietf:params:oauth:token-type:access_token',\n    }),\n  });\n  if (!exResp.ok) throw new Error(`/auth/exchange ${exResp.status}: ${await exResp.text()}`);\n  const minted = await exResp.json();\n\n  return {\n    accessToken: minted.access_token,\n    organizationId: minted.organization_id,\n    idpClaims: decodeJwtClaims(idpToken.access_token),\n  };\n}\n\n/** Discard the in-progress login memo (used on logout so a later login re-runs). */\nexport function resetPending(): void {\n  pending = null;\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\n// A module-level holder for the current minted token, so non-React consumers can read\n// it. RTK Query's `prepareHeaders` (in @confighub/rtk-query) is not a hook and cannot\n// read React context, so it calls getAccessToken() instead. The provider keeps this in\n// sync with its React state.\nlet currentToken: string | undefined;\n\n/** @internal — called by the provider; not part of the public surface. */\nexport function setAccessToken(token: string | undefined): void {\n  currentToken = token;\n}\n\n/**\n * The current minted ConfigHub token, or undefined when unauthenticated. Pass this as\n * the `getToken` for `@confighub/rtk-query`'s `configureConfigHub`, or read it anywhere\n * you need the token outside React.\n */\nexport function getAccessToken(): string | undefined {\n  return currentToken;\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\nimport { createConfigHubClient, type ConfigHubClient } from '@confighub/api';\nimport {\n  createContext,\n  useCallback,\n  useEffect,\n  useMemo,\n  useRef,\n  useState,\n  type ReactNode,\n} from 'react';\nimport {\n  completeLoginFromRedirect,\n  resetPending,\n  startLogin,\n  type MintedSession,\n} from './core';\nimport { setAccessToken } from './tokenStore';\n\nexport type AuthStatus = 'loading' | 'authenticated' | 'unauthenticated' | 'error';\n\nexport interface ConfigHubUser {\n  organizationId: string;\n  idpClaims: Record<string, unknown>;\n}\n\nexport interface ConfigHubAuthContextValue {\n  status: AuthStatus;\n  user: ConfigHubUser | null;\n  error: Error | null;\n  /** Begin login: redirects the page to the IdP. */\n  login: () => Promise<void>;\n  /** Clear the in-memory session. Does not call the IdP end-session endpoint. */\n  logout: () => void;\n  /** Current bearer token, or undefined when unauthenticated. */\n  getToken: () => string | undefined;\n  /** A typed API client pre-wired with the current token. Stable across renders. */\n  client: ConfigHubClient;\n}\n\nexport const ConfigHubAuthContext = createContext<ConfigHubAuthContextValue | null>(null);\n\nexport interface ConfigHubAuthProviderProps {\n  /** Absolute base URL of the ConfigHub instance, e.g. `https://hub.confighub.com`. */\n  baseUrl: string;\n  /** This app's registered OAuth `client_id` (from `cub oauthclient create`). */\n  clientId: string;\n  children: ReactNode;\n}\n\n/**\n * Runs the browser-direct auth flow and manages the token lifecycle. On mount it\n * completes a redirect if the page is the IdP callback; otherwise it starts\n * unauthenticated until `login()` is called.\n */\nexport function ConfigHubAuthProvider({\n  baseUrl,\n  clientId,\n  children,\n}: ConfigHubAuthProviderProps): JSX.Element {\n  const [status, setStatus] = useState<AuthStatus>('loading');\n  const [user, setUser] = useState<ConfigHubUser | null>(null);\n  const [error, setError] = useState<Error | null>(null);\n\n  // The token lives in a ref so getToken() reads the latest value synchronously\n  // without re-creating the API client on every render.\n  const tokenRef = useRef<string | undefined>(undefined);\n\n  const applySession = useCallback((session: MintedSession) => {\n    tokenRef.current = session.accessToken;\n    setAccessToken(session.accessToken); // keep the non-React accessor in sync (rtk-query)\n    setUser({ organizationId: session.organizationId, idpClaims: session.idpClaims });\n    setError(null);\n    setStatus('authenticated');\n  }, []);\n\n  useEffect(() => {\n    let cancelled = false;\n    completeLoginFromRedirect()\n      .then((session) => {\n        if (cancelled) return;\n        if (session) applySession(session);\n        else setStatus('unauthenticated');\n      })\n      .catch((e: unknown) => {\n        if (cancelled) return;\n        setError(e instanceof Error ? e : new Error(String(e)));\n        setStatus('error');\n      });\n    return () => {\n      cancelled = true;\n    };\n  }, [applySession]);\n\n  const login = useCallback(async () => {\n    setError(null);\n    try {\n      await startLogin(baseUrl, clientId);\n    } catch (e: unknown) {\n      setError(e instanceof Error ? e : new Error(String(e)));\n      setStatus('error');\n    }\n  }, [baseUrl, clientId]);\n\n  const logout = useCallback(() => {\n    tokenRef.current = undefined;\n    setAccessToken(undefined);\n    resetPending();\n    setUser(null);\n    setStatus('unauthenticated');\n  }, []);\n\n  const getToken = useCallback(() => tokenRef.current, []);\n\n  // One client for the provider's lifetime. getToken reads tokenRef, and a 401\n  // routes back to login() so an expired session re-authenticates.\n  const client = useMemo(\n    () =>\n      createConfigHubClient({\n        baseUrl,\n        getToken,\n        onUnauthorized: () => {\n          logout();\n        },\n      }),\n    [baseUrl, getToken, logout],\n  );\n\n  const value = useMemo<ConfigHubAuthContextValue>(\n    () => ({ status, user, error, login, logout, getToken, client }),\n    [status, user, error, login, logout, getToken, client],\n  );\n\n  return (\n    <ConfigHubAuthContext.Provider value={value}>{children}</ConfigHubAuthContext.Provider>\n  );\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\nimport type { ConfigHubClient } from '@confighub/api';\nimport { useContext } from 'react';\nimport { ConfigHubAuthContext, type ConfigHubAuthContextValue } from './provider';\n\n/**\n * Access the ConfigHub auth state and actions. Must be called under a\n * `<ConfigHubAuthProvider>`.\n *\n * ```ts\n * const { status, user, login, logout } = useAuth();\n * ```\n */\nexport function useAuth(): ConfigHubAuthContextValue {\n  const ctx = useContext(ConfigHubAuthContext);\n  if (!ctx) {\n    throw new Error('useAuth must be used within a <ConfigHubAuthProvider>');\n  }\n  return ctx;\n}\n\n/**\n * The typed ConfigHub API client, pre-wired with the current token. This is the\n * seam between `@confighub/react-auth` and `@confighub/api`: you never pass a\n * token by hand.\n *\n * ```ts\n * const api = useConfigHub();\n * const { data } = await api.GET('/space/{space_id}/unit', { params: { path: { space_id } } });\n * ```\n */\nexport function useConfigHub(): ConfigHubClient {\n  return useAuth().client;\n}\n"]}

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "@confighub/react-auth",
+  "version": "0.1.0",
+  "description": "React auth provider and hooks for ConfigHub browser apps (OIDC PKCE + RFC 8693 token exchange)",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/confighub/js-sdk.git",
+    "directory": "packages/react-auth"
+  },
+  "homepage": "https://github.com/confighub/js-sdk/tree/main/packages/react-auth#readme",
+  "bugs": "https://github.com/confighub/js-sdk/issues",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "@confighub/api": "^0.1.0"
+  },
+  "peerDependencies": {
+    "react": "^18.0.0 || ^19.0.0"
+  },
+  "devDependencies": {
+    "@types/react": "^18.3.12",
+    "react": "^18.3.1"
+  },
+  "keywords": [
+    "confighub",
+    "oauth",
+    "oidc",
+    "pkce",
+    "react",
+    "auth"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}