@corvushold/guard-sdk 0.16.0 → 0.17.0

package/dist/index.d.cts

@@ -1045,6 +1045,16 @@ interface GuardClientOptions {
     defaultHeaders?: Record<string, string>;
     authMode?: 'bearer' | 'cookie';
 }
+interface OAuth2TokenExchangeInput {
+    code: string;
+    client_id: string;
+    redirect_uri: string;
+    code_verifier: string;
+}
+interface OAuth2RevokeInput {
+    token: string;
+    token_type_hint?: 'refresh_token' | 'access_token';
+}
 interface OAuth2AuthorizeParams {
     client_id: string;
     redirect_uri: string;
@@ -1061,6 +1071,10 @@ interface OAuth2AuthorizeParams {
 type TokensResp = {
     access_token?: string | null;
     refresh_token?: string | null;
+    id_token?: string | null;
+    token_type?: string | null;
+    expires_in?: number;
+    scope?: string | null;
     success?: boolean;
 };
 type MfaChallengeResp = components['schemas']['controller.mfaChallengeResp'];
@@ -1831,6 +1845,16 @@ declare class GuardClient {
      * This endpoint is public and does not require authentication.
      */
     getOAuth2Metadata(): Promise<ResponseWrapper<OAuth2MetadataResp>>;
+    /**
+     * Exchange an OAuth2 authorization code for tokens (Authorization Code + PKCE).
+     */
+    exchangeOAuth2Code(input: OAuth2TokenExchangeInput): Promise<ResponseWrapper<TokensResp>>;
+    /**
+     * Revoke an OAuth2 token (RFC7009). Server returns 200 for unknown tokens as well.
+     */
+    revokeOAuth2Token(input: OAuth2RevokeInput): Promise<ResponseWrapper<{
+        status?: string;
+    }>>;
     /**
      * Static helper to discover OAuth2 metadata from any Guard API base URL.
      * Useful for auto-configuration before creating a GuardClient instance.
@@ -1853,4 +1877,4 @@ declare class GuardClient {
 
 declare function generateTOTPCode(base32Secret: string): string;
 
-export { type AcceptInvitationReq, type AdminCreateUserReq, type AdminCreateUserResp, type AdminUser, type AdminUsersResp, ApiError, type AsyncStorageLike, type AuthMethod, type CreateOAuthClientReq, type CreateOAuthClientResp, type CreateSsoProviderReq, type DiscoverTenantsResp, type FetchLike, type FgaAclTuple, type FgaGroup, type FgaGroupsResp, GuardClient, type GuardClientOptions, type HeadersMap, HttpClient, InMemoryStorage, type Interceptors, type Invitation, type InvitationStatus, type InvitationsListResp, type InviteUserReq, type InviteUserResp, type LoginOptionsResp, type Meta, type OAuth2AuthorizeParams, type OAuthClientItem, RateLimitError, type RequestInterceptor, type ResponseInterceptor, type ResponseWrapper, type SessionItem, type SessionsListResp, type SsoLinkingPolicy, type SsoPortalContext, type SsoPortalSessionResp, type SsoProvider, type SsoProviderItem, type SsoProviderOption, type SsoProviderSlug, type SsoProviderType, type SsoProvidersListResp, type SsoSPInfoResp, type SsoTestProviderResp, type TenantId, type TenantOption, type TenantSelectionRequiredResp, type TenantSettingsPutRequest, type TenantSettingsResponse, type TenantSummary, type TokenProvider, type TokenStorage, type TransportOptions, type UpdateOAuthClientReq, type UpdateSsoProviderReq, WebLocalStorage, applyRequestInterceptors, applyResponseInterceptors, buildRateLimitError, generateTOTPCode, isApiError, isMfaChallengeResp, isRateLimitError, isTenantSelectionRequired, isTokensResp, noopStorage, parseRetryAfter, reactNativeStorageAdapter, toHeadersMap };
+export { type AcceptInvitationReq, type AdminCreateUserReq, type AdminCreateUserResp, type AdminUser, type AdminUsersResp, ApiError, type AsyncStorageLike, type AuthMethod, type CreateOAuthClientReq, type CreateOAuthClientResp, type CreateSsoProviderReq, type DiscoverTenantsResp, type FetchLike, type FgaAclTuple, type FgaGroup, type FgaGroupsResp, GuardClient, type GuardClientOptions, type HeadersMap, HttpClient, InMemoryStorage, type Interceptors, type Invitation, type InvitationStatus, type InvitationsListResp, type InviteUserReq, type InviteUserResp, type LoginOptionsResp, type Meta, type OAuth2AuthorizeParams, type OAuth2RevokeInput, type OAuth2TokenExchangeInput, type OAuthClientItem, RateLimitError, type RequestInterceptor, type ResponseInterceptor, type ResponseWrapper, type SessionItem, type SessionsListResp, type SsoLinkingPolicy, type SsoPortalContext, type SsoPortalSessionResp, type SsoProvider, type SsoProviderItem, type SsoProviderOption, type SsoProviderSlug, type SsoProviderType, type SsoProvidersListResp, type SsoSPInfoResp, type SsoTestProviderResp, type TenantId, type TenantOption, type TenantSelectionRequiredResp, type TenantSettingsPutRequest, type TenantSettingsResponse, type TenantSummary, type TokenProvider, type TokenStorage, type TransportOptions, type UpdateOAuthClientReq, type UpdateSsoProviderReq, WebLocalStorage, applyRequestInterceptors, applyResponseInterceptors, buildRateLimitError, generateTOTPCode, isApiError, isMfaChallengeResp, isRateLimitError, isTenantSelectionRequired, isTokensResp, noopStorage, parseRetryAfter, reactNativeStorageAdapter, toHeadersMap };

package/dist/index.d.ts

@@ -1045,6 +1045,16 @@ interface GuardClientOptions {
     defaultHeaders?: Record<string, string>;
     authMode?: 'bearer' | 'cookie';
 }
+interface OAuth2TokenExchangeInput {
+    code: string;
+    client_id: string;
+    redirect_uri: string;
+    code_verifier: string;
+}
+interface OAuth2RevokeInput {
+    token: string;
+    token_type_hint?: 'refresh_token' | 'access_token';
+}
 interface OAuth2AuthorizeParams {
     client_id: string;
     redirect_uri: string;
@@ -1061,6 +1071,10 @@ interface OAuth2AuthorizeParams {
 type TokensResp = {
     access_token?: string | null;
     refresh_token?: string | null;
+    id_token?: string | null;
+    token_type?: string | null;
+    expires_in?: number;
+    scope?: string | null;
     success?: boolean;
 };
 type MfaChallengeResp = components['schemas']['controller.mfaChallengeResp'];
@@ -1831,6 +1845,16 @@ declare class GuardClient {
      * This endpoint is public and does not require authentication.
      */
     getOAuth2Metadata(): Promise<ResponseWrapper<OAuth2MetadataResp>>;
+    /**
+     * Exchange an OAuth2 authorization code for tokens (Authorization Code + PKCE).
+     */
+    exchangeOAuth2Code(input: OAuth2TokenExchangeInput): Promise<ResponseWrapper<TokensResp>>;
+    /**
+     * Revoke an OAuth2 token (RFC7009). Server returns 200 for unknown tokens as well.
+     */
+    revokeOAuth2Token(input: OAuth2RevokeInput): Promise<ResponseWrapper<{
+        status?: string;
+    }>>;
     /**
      * Static helper to discover OAuth2 metadata from any Guard API base URL.
      * Useful for auto-configuration before creating a GuardClient instance.
@@ -1853,4 +1877,4 @@ declare class GuardClient {
 
 declare function generateTOTPCode(base32Secret: string): string;
 
-export { type AcceptInvitationReq, type AdminCreateUserReq, type AdminCreateUserResp, type AdminUser, type AdminUsersResp, ApiError, type AsyncStorageLike, type AuthMethod, type CreateOAuthClientReq, type CreateOAuthClientResp, type CreateSsoProviderReq, type DiscoverTenantsResp, type FetchLike, type FgaAclTuple, type FgaGroup, type FgaGroupsResp, GuardClient, type GuardClientOptions, type HeadersMap, HttpClient, InMemoryStorage, type Interceptors, type Invitation, type InvitationStatus, type InvitationsListResp, type InviteUserReq, type InviteUserResp, type LoginOptionsResp, type Meta, type OAuth2AuthorizeParams, type OAuthClientItem, RateLimitError, type RequestInterceptor, type ResponseInterceptor, type ResponseWrapper, type SessionItem, type SessionsListResp, type SsoLinkingPolicy, type SsoPortalContext, type SsoPortalSessionResp, type SsoProvider, type SsoProviderItem, type SsoProviderOption, type SsoProviderSlug, type SsoProviderType, type SsoProvidersListResp, type SsoSPInfoResp, type SsoTestProviderResp, type TenantId, type TenantOption, type TenantSelectionRequiredResp, type TenantSettingsPutRequest, type TenantSettingsResponse, type TenantSummary, type TokenProvider, type TokenStorage, type TransportOptions, type UpdateOAuthClientReq, type UpdateSsoProviderReq, WebLocalStorage, applyRequestInterceptors, applyResponseInterceptors, buildRateLimitError, generateTOTPCode, isApiError, isMfaChallengeResp, isRateLimitError, isTenantSelectionRequired, isTokensResp, noopStorage, parseRetryAfter, reactNativeStorageAdapter, toHeadersMap };
+export { type AcceptInvitationReq, type AdminCreateUserReq, type AdminCreateUserResp, type AdminUser, type AdminUsersResp, ApiError, type AsyncStorageLike, type AuthMethod, type CreateOAuthClientReq, type CreateOAuthClientResp, type CreateSsoProviderReq, type DiscoverTenantsResp, type FetchLike, type FgaAclTuple, type FgaGroup, type FgaGroupsResp, GuardClient, type GuardClientOptions, type HeadersMap, HttpClient, InMemoryStorage, type Interceptors, type Invitation, type InvitationStatus, type InvitationsListResp, type InviteUserReq, type InviteUserResp, type LoginOptionsResp, type Meta, type OAuth2AuthorizeParams, type OAuth2RevokeInput, type OAuth2TokenExchangeInput, type OAuthClientItem, RateLimitError, type RequestInterceptor, type ResponseInterceptor, type ResponseWrapper, type SessionItem, type SessionsListResp, type SsoLinkingPolicy, type SsoPortalContext, type SsoPortalSessionResp, type SsoProvider, type SsoProviderItem, type SsoProviderOption, type SsoProviderSlug, type SsoProviderType, type SsoProvidersListResp, type SsoSPInfoResp, type SsoTestProviderResp, type TenantId, type TenantOption, type TenantSelectionRequiredResp, type TenantSettingsPutRequest, type TenantSettingsResponse, type TenantSummary, type TokenProvider, type TokenStorage, type TransportOptions, type UpdateOAuthClientReq, type UpdateSsoProviderReq, WebLocalStorage, applyRequestInterceptors, applyResponseInterceptors, buildRateLimitError, generateTOTPCode, isApiError, isMfaChallengeResp, isRateLimitError, isTenantSelectionRequired, isTokensResp, noopStorage, parseRetryAfter, reactNativeStorageAdapter, toHeadersMap };

package/dist/index.js

@@ -277,7 +277,7 @@ var HttpClient = class {
 
 // package.json
 var package_default = {
-  version: "0.16.0"};
+  version: "0.17.0"};
 
 // src/client.ts
 function isTenantSelectionRequired(data) {
@@ -1101,6 +1101,47 @@ var GuardClient = class {
   async getOAuth2Metadata() {
     return this.request("/.well-known/oauth-authorization-server", { method: "GET" });
   }
+  /**
+   * Exchange an OAuth2 authorization code for tokens (Authorization Code + PKCE).
+   */
+  async exchangeOAuth2Code(input) {
+    const code = input.code?.trim();
+    const clientID = input.client_id?.trim();
+    const redirectURI = input.redirect_uri?.trim();
+    const codeVerifier = input.code_verifier?.trim();
+    if (!code) throw new Error("code is required");
+    if (!clientID) throw new Error("client_id is required");
+    if (!redirectURI) throw new Error("redirect_uri is required");
+    if (!codeVerifier) throw new Error("code_verifier is required");
+    const body = new URLSearchParams();
+    body.set("grant_type", "authorization_code");
+    body.set("code", code);
+    body.set("client_id", clientID);
+    body.set("redirect_uri", redirectURI);
+    body.set("code_verifier", codeVerifier);
+    const res = await this.request("/oauth/token", {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: body.toString()
+    });
+    if (res.meta.status >= 200 && res.meta.status < 300) this.persistTokensFrom(res.data);
+    return res;
+  }
+  /**
+   * Revoke an OAuth2 token (RFC7009). Server returns 200 for unknown tokens as well.
+   */
+  async revokeOAuth2Token(input) {
+    const token = input.token?.trim();
+    if (!token) throw new Error("token is required");
+    const body = new URLSearchParams();
+    body.set("token", token);
+    if (input.token_type_hint) body.set("token_type_hint", input.token_type_hint);
+    return this.request("/oauth/revoke", {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: body.toString()
+    });
+  }
   /**
    * Static helper to discover OAuth2 metadata from any Guard API base URL.
    * Useful for auto-configuration before creating a GuardClient instance.