@crossauth/sveltekit 0.0.2

package/dist/sveltekitoauthclient.d.ts

@@ -0,0 +1,704 @@
+import { CrossauthError, ErrorCode, OAuthTokenResponse, OAuthDeviceAuthorizationResponse } from '@crossauth/common';
+import { OAuthClientBackend, OAuthClientOptions } from '@crossauth/backend';
+import { SvelteKitServer } from './sveltekitserver';
+import { RequestEvent } from '@sveltejs/kit';
+
+export type SvelteKitErrorFn = (server: SvelteKitServer, event: RequestEvent, ce: CrossauthError) => Promise<Response>;
+/**
+ * Options for {@link SvelteKitOAuthClient}.
+ */
+export interface SvelteKitOAuthClientOptions extends OAuthClientOptions {
+    /**
+     * You will have to create a route for the redirect Uri, using
+     * the `redirectUriEndpoint` load function.  But the URL for it
+     * here.  It should be an absolute URL.
+     *
+     * It should be a fully qualified URL as it is called from
+     * the browser in a redriect.
+     *
+     * The default is "oauth/authzcode".
+     */
+    redirect_uri?: string;
+    /**
+     * When using the BFF (backend-for-frontend) pattern, tokens are saved
+     * in the `data` field of the session ID.  They are saved in the JSON
+     * object with this field name.  Default `oauth`.
+     */
+    sessionDataName?: string;
+    /**
+     * If the {@link SvelteKitOAuthClientOptions.tokenResponseType} is
+     * `saveInSessionAndRedirect`, this is the relative URL that the usder
+     * will be redirected to after authorization is complete.
+     */
+    authorizedUrl?: string;
+    /**
+     * Relative URL to redirect user to if login is required.
+     */
+    loginUrl?: string;
+    /**
+     * All flows listed here will require the user to login (here at the client).
+     * If if a flow is not listed here, there does not need to be a user
+     * logged in here at the client.
+     *
+     * In most cases you can ignore this and use
+     * {@link SvelteKitsessionAdapterOptions.loginProtectedPageEndpoints}
+     * to protect the endpoints that begin the flows.
+     *
+     * See {@link @crossauth/common!OAuthFlows}.
+     */
+    loginProtectedFlows?: string[];
+    /**
+     * This function is called after successful authorization to pass the
+     * new tokens to.
+     * @param oauthResponse the response from the OAuth `token` endpoint.
+     * @param client the OAuth client
+     * @param event the SvelteKit request event
+     * @param silent if true, don't return a Response, only JSON or undefined.
+     * @returns a Response, JSON or undefined
+     */
+    receiveTokenFn?: (oauthResponse: OAuthTokenResponse, client: SvelteKitOAuthClient, event: RequestEvent, silent: boolean) => Promise<Response | TokenReturn | undefined>;
+    /**
+     * The function to call when there is an OAuth error and
+     * {@link SvelteKitOAuthClientOptions.errorResponseType}
+     * is `custom`.
+     * See {@link SvelteKitErrorFn}.
+     */
+    errorFn?: SvelteKitErrorFn;
+    /**
+     * What to do when receiving tokens.
+     * See {@link SvelteKitOAuthClient} class documentation for full description.
+     */
+    tokenResponseType?: "sendJson" | "saveInSessionAndLoad" | "saveInSessionAndRedirect" | "saveInSessionAndReturn" | "sendInPage" | "custom";
+    /**
+     * What do do on receiving an OAuth error.
+     * See lass documentation for full description.
+     */
+    errorResponseType?: "sendJson" | "svelteKitError" | "custom";
+    /**
+     * Array of resource server endppints to serve through the
+     * BFF (backend-for-frontend) mechanism.
+     * See {@link SvelteKitOAuthClient} class documentation for full description.
+     */
+    bffEndpoints?: {
+        url: string;
+        methods: ("GET" | "POST" | "PUT" | "DELETE" | "PATCH")[];
+        matchSubUrls?: boolean;
+    }[];
+    /**
+     * Prefix for BFF endpoints.  Default "bff".
+     * See {@link SvelteKitOAuthClient} class documentation for full description.
+     */
+    bffEndpointName?: string;
+    /**
+     * Base URL for resource server endpoints called through the BFF
+     * mechanism.
+     * See {@link SvelteKitOAuthClient} class documentation for full description.
+     */
+    bffBaseUrl?: string;
+    /**
+     * Now many times to attempt to make a BFF request before failing
+     * with an unauthorized reponse.  This is useful when you have
+     * enable auto refresh.  If you make a resource request just as the
+     * token is renewing, you might get an error.
+     *
+     * Default 1
+     */
+    bffMaxTries?: number;
+    /**
+     * How many milliseconds to sleep between BFF tries.
+     *
+     * See {@link SvelteKitOAuthClientOptions.bffMaxTries}
+     *
+     * Default 500
+     */
+    bffSleepMilliseconds?: number;
+    /**
+     * Endpoints to provide to acces tokens through the BFF mechanism,
+     * See {@link FastifyOAuthClient} class documentation for full description.
+     */
+    tokenEndpoints?: ("access_token" | "refresh_token" | "id_token" | "have_access_token" | "have_refresh_token" | "have_id_token")[];
+    /** Pass the Sveltekit redirect function */
+    redirect?: any;
+    /** Pass the Sveltekit error function */
+    error?: any;
+    /**
+     * Set of flows to enable (see {@link @crossauth/common!OAuthFlows}).
+     *
+     * Defaults to all flows, as they must be created manually in
+     * your `routes`.  However, be aware that the Password and Password MFA
+     * flows are on the same endpoint, so if you want to support one and
+     * not the other, set this variable.
+     */
+    validFlows?: string[];
+}
+/**
+ * Returned by the authorize endpoint
+ */
+export interface AuthorizationCodeFlowReturn {
+    ok: boolean;
+    error?: string;
+    error_description?: string;
+}
+/**
+ * Returned by the token endpoint
+ */
+export interface TokenReturn extends OAuthTokenResponse {
+    ok: boolean;
+    id_payload?: {
+        [key: string]: any;
+    };
+}
+/**
+ * Returned by the redirect URI endpoint
+ */
+export interface RedirectUriReturn extends OAuthTokenResponse {
+    ok: boolean;
+}
+/**
+ * The SvelteKit version of the OAuth client.
+ *
+ * Makes requests to an authorization server, using a configurable set
+ * of flows, which sends back errors or tokens,
+ *
+ * When constructing this class, you define what happens with tokens that
+ * are returned, or errors that are returned.  You do this with the
+ * configuration options {@link SvelteKitOAuthClientOptions.tokenResponseType}
+ * and {@link SvelteKitOAuthClientOptions.errorResponseType}.
+ *
+ * **{@link SvelteKitOAuthClientOptions.tokenResponseType}**
+ *
+ *   - `sendJson` the token response is sent as-is as a JSON Response.
+ *      In addition to the `token` endpoint response fields,
+ *      `ok: true` and `id_payload` with the decoded
+ *      payload of the ID token are retruned.
+ *      This method should be used
+ *      with `get`/ `post` endpoints, not `load`/`actions`.
+ *   - `saveInSessionAndLoad` the response fields are saved in the `data`
+ *      field of the session ID in key storage.  In addition, `expires_at` is
+ *      set to the number of seconds since Epoch that the access token expires
+ *      at.  When using this method, you should define a SvelteKit page
+ *      in your routes and put the the `load` (GET methods) or `actions`
+ *      (POST methods) function for each endpoint
+ *      in the route's `+page.server.ts`.
+ *      A consequence is the query parameters passed to the
+ *      redirect Uri are displayed in the address bar, as the response
+ *      is to the redirect to the redirect Uri.
+ *    - saveInSessionAndRedirect` same as `saveInSessionAndLoad` except that
+ *      a redirect is done to the `authorizedUrl`.  As an alternative to using `load`
+ *      or `actions` method in a `+page.server.ts`, you can use the `get`
+ *      or `post` method in a `+server.ts`.
+ *    - saveInSessionAndReturn` same as `saveInSessionAndLoad` except that
+ *      a JSON response is returned`.  Instead of using the `load`
+ *      or `actions` method in a `+page.server.ts`, you should use the `get`
+ *      or `post` method in a `+server.ts`.
+ *    - `sendInPage` same as `saveinSessionAndLoad` except the tokens are
+ *      not saved in the session.  Use the `load`/`actions` function in your
+ *      `+page.server.ts`.
+ *    - `custom` the function in
+ *       {@link SvelteKitOAuthClientOptions.receiveTokenFn} is called.  If
+ *       using `get` or `post` methods, your functiin should return
+ *       a Response.  If using `load` and `actions` ir shouls ewruen
+ *       an object for passing in `data` or `form` exports.
+ *
+ * **{@link SvelteKitOAuthClientOptions.errorResponseType}**
+ *
+ *    - `sendJson` a JSON response is sent with fields
+ *       `status`, `errorMessage`,
+ *      `errorMessages` and `errorCodeName`.
+ *    - `svelteKitError` calls the SvelteKit `error` function (the one
+ *      provided in the options to {@link SvelteKitServe}).
+ *    - `custom` {@link SvelteKitOAuthClientOptions.errorFn} is called.
+ *
+ *    Note that this parameter is only used when you are using the `get`/`post`
+ *    endpoints, not the `load`/ `actions` ones.  The latter return the error in
+ *    the PageData from the load.
+ *
+ * **Backend-for-Frontend (BFF)**
+ *
+ * This class supports the backend-for-frontend (BFF) model.
+ * This pattern avoids you having to store the access token in the frontend.
+
+ * For this to work
+ * you should set @link SvelteKitOAuthClientOptions.tokenResponseType} to
+ * `saveInSessionAndLoad` or `saveInSessionAndRedirect`.  Then to call
+ * your resource server functions, you call then on a URL on this client
+ * rather than the resource server directly.  The client backend will
+ * attach the access token, and also refresh the token automatically if
+ * expired.
+ *
+ * You need to provide the following options:
+ *   - `bffBaseUrl` - the resource server URL, eg `http://resserver.com`
+ *   - `bffEndpointName` - the prefix for BFF endpoints on this server.
+ *     Eg if your BFF URL on this server is in `routes/bff` then
+ *     set `bffEndpointName` to `/bff`.
+ *
+ * You may optionally also se `bffEndpoints`.
+ *
+ * To sue BFF, first set `tokenResponseType` to
+ * `saveInSessionAndLoad` or `saveInSessionAndRedirect` and set `bffBaseUrl`
+ * and `bffEndpointName`.  THen create a route in your `routes` called
+ * *bffEndpointName*`/`*someMethod* with a `+server.ts`.  In that `+server.ts`,
+ * create a `GET` and/or `POST` endpoint with
+ * `bffEndpoint.get` or `bffEndpoint.post`.  The request will be forwarded
+ * to *bffBaseUrl*`/`*someMethod* with the the body and query parameters
+ * taken from your query and with the access token attached as the
+ * `Authorization` header.  The resulting JSON and HTTP status will be returned.
+ *
+ * If you have a lot of endpoints, you may instead prefer to create a single
+ * one, eg as `routes/[...method]` and use `allBffEndpoint.get` or `.post` .
+ * Put all valid BFF endpoints in the `bffEndpoints` option.  If, for one
+ * of these endpoints, eg `method`, you set `matchSubUrls` to true, then
+ * `method/XXX`, `method/YYY` will match as well as `method`.
+ *
+ * **Endpoints provided by this class**
+ *
+ * | Name                                  | Description                                                  | PageData (returned by load) or JSON returned by get/post                     | ActionData (return by actions)                                   | Form fields expected by actions or post/get input data          |
+ * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ * | authorizationCodeFlowEndpoint         | Starts the authorization code flow.                          | None - redirects to `redirect_uri`                                            | *Not provided*                                                   | - `scope`                                                       |
+ * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ * | authorizationCodeFlowWithPKCEEndpoint | Starts the authorization code flow with PKCE.                | None - redirects to `redirect_uri`                                            | *Not provided*                                                   | - `scope`                                                       |
+ * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ * | redirectUriEndpoint                   | Redirect Uri for authorization code flows                    | See {@link OAuthTokenResponse}                                               | *Not provided*                                                   | As per OAuth Authorization Code Flow spec                       |
+ * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ * | clientCredentialsFlowEndpoint         | Executes the client credentials flow                         | *Not provided*                                                               | See {@link OAuthTokenResponse}                                   | As per OAuth Client Credentials Flow spec                       |
+ * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ * | refreshTokenFlowEndpoint              | Executes the refresh token flow                              | *Not provided*                                                               | See {@link OAuthTokenResponse}                                   | As per OAuth Refresh Token Flow spec                            |
+ * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ * | refreshTokensIfExpiredEndpoint        | Executes the refresh token flow only if access token expired | *Not provided*                                                               | See {@link OAuthTokenResponse}                                   | As per OAuth Refresh Token Flow spec or nothing                 |
+ * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ * | autoRefreshTokensIfExpiredEndpoint    | Same as refreshTokensIfExpiredEndpoint but only returns an object, no redirect | *Not provided*                                             | See {@link OAuthTokenResponse}                                   | As per OAuth Refresh Token Flow spec or nothing                 |
+ * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ * | refreshTokensIfExpiredEndpoint        | Same as refreshTokenFlowEndpoint but only returns an object, no redirect | *Not provided*                                                   | See {@link OAuthTokenResponse}                                   | As per OAuth Refresh Token Flow spec or nothing                 |
+ * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ * | passwordFlowEndpoint                  |                                                              | *Not provided*                                                               | `password`                                                       |                                                                 |
+ * |                                       | Executes the password flow only with out without MFA         |                                                                              |   -  See {@link OAuthTokenResponse}.  Returns password flow response if no MFA, MFA challenge response if user has 2FA | See OAuth password flow or Auth0 Password with MFA password flow specs |
+ * |                                       |                                                              |                                                                              | `passwordOtp`                                                                                                          |                                                                        |
+ * |                                       |  Pass OTP for Password MFA flow                              |                                                                              |   -  See {@link OAuthTokenResponse}.  Returns Password MFA challenge response if user has 2FA                          | See Auth0 Password with MFA password flow specs                        |
+ * |                                       |                                                              |                                                                              | `passwordOob`                                                                                                          |                                                                        |
+ * |                                       |  Pass OOB for Password MFA flow                              |                                                                              |   -  See {@link OAuthTokenResponse}.  Returns Password MFA challenge response if user has 2FA                          | See Auth0 Password with MFA password flow specs                        |
+ * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
+ * | passwordOtp Endpoint                  | `post` is same as `passwordOtp` action above                 | *Not provided*                                                               | See {@link OAuthTokenResponse}.  Returns MFA challenge response if user has 2FA                                        | See OAuth password flow or Auth0 Password with MFA password flow specs |
+ * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
+ * | passwordOob Endpoint                  | `post` is same as `passwordOob` action above                 | *Not provided*                                                               | See {@link OAuthTokenResponse}.  Returns MFA challenge response if user has 2FA                                        | See OAuth password flow or Auth0 Password with MFA password flow specs |
+ * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
+ * | bffEndpoint                           | BFF resource server request.  See class documentation        | As per the corresponding resource server endpoint                            | As per the correspoinding resource server endpoint               | As per the corresponding resource server endpoint               |
+ * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ * | allBffEndpoint                        | BFF resource server request.  See class documentation        | As per the corresponding resource server endpoint                            | As per the correspoinding resource server endpoint               | As per the corresponding resource server endpoint               |
+ * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ * | accessTokenEndpoint                   | For BFF only, return the access token payload or error       | JSON of the access token payload                                             | *Not provided*                                                   |                                                                 |
+ * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ * | refreshTokenEndpoint                  | For BFF only, return the refresh token payload or error      | JSON of the refresh token payload                                            | *Not provided*                                                   |                                                                 |
+ * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ * | idTokenEndpoint                       | For BFF only, return the id token payload or error           | POST: JSON of the id token payload                                           | *Not provided*                                                   |                                                                 |
+ * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ * | havAeccessTokenEndpoint               | For BFF only, return whether access token present            | POST: `ok` of false or true                                                  | *Not provided*                                                   |                                                                 |
+ * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ * | haveRefreshTokenEndpoint              | For BFF only, return whether refresh token present           | POST: `ok` of false or true                                                  | *Not provided*                                                   |                                                                 |
+ * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ * | haveIdTokenEndpoint                   | For BFF only, return whether id token present                | POST: `ok` of false or true                                                  | *Not provided*                                                   |                                                                 |
+ * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ * | tokensEndpoint                        | For BFF only, return a JSON object of all of the above       | POST: All of the above, keyed on `access_token`, `have_access_token`, etc.   | *Not provided*                                                   |                                                                 |
+ * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ * | deleteTokensEndpoint                  | For BFF only, deletes tokens saved for session               | POST:  `ok` of false or true                                                 | `default`: `ok` of false or true                                 | *None*                                                          |
+ * | ------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ */
+export declare class SvelteKitOAuthClient extends OAuthClientBackend {
+    server: SvelteKitServer;
+    sessionDataName: string;
+    private receiveTokenFn;
+    readonly errorFn: SvelteKitErrorFn;
+    private loginUrl;
+    private validFlows;
+    authorizedUrl: string;
+    private autoRefreshActive;
+    readonly redirect: any;
+    readonly error: any;
+    /**
+     * See {@link FastifyOAuthClientOptions}
+     */
+    loginProtectedFlows: string[];
+    private tokenResponseType;
+    private errorResponseType;
+    private bffEndpoints;
+    private bffEndpointName;
+    private bffBaseUrl?;
+    private tokenEndpoints;
+    private bffMaxTries;
+    private bffSleepMilliseconds;
+    /**
+     * Constructor
+     * @param server the {@link FastifyServer} instance
+     * @param authServerBaseUrl the `iss` claim in the access token must match this value
+     * @param options See {@link FastifyOAuthClientOptions}
+     */
+    constructor(server: SvelteKitServer, authServerBaseUrl: string, options: SvelteKitOAuthClientOptions);
+    private passwordPost;
+    private passwordMfa;
+    private passwordOtp;
+    private passwordOob;
+    private refresh;
+    private refreshTokens;
+    private passwordFlow_post;
+    private passwordFlow_action;
+    /**
+     * Call a resource on the resource server, passing in the access token
+     * along with the body from the event and, unless overridden, the URL.
+     *
+     * It is probably easier to use `bffEndpoint` instead of this method.
+     * However you can use this if you need to pass custom headers or want
+     * to specify the URL manually.
+     *
+     * @param event the Sveltekit request event
+     * @param opts additional data to put in resource server request.  You can also override the URL here
+     * @returns resource server response
+     */
+    bff(event: RequestEvent, opts?: {
+        method?: "GET" | "POST" | "PUT" | "HEAD" | "OPTIONS" | "PATCH" | "DELETE";
+        headers?: Headers;
+        url?: string;
+    }): Promise<Response>;
+    unpack(resp: Response): Promise<{
+        status: number;
+        body: {
+            [key: string]: any;
+        };
+        error?: string;
+        error_description?: string;
+    }>;
+    pack(ret: {
+        [key: string]: any;
+    } | undefined | Response): Response;
+    /**
+     * Ordinarily you would not call this directly but use `allBffEndpoint`.
+     *
+     * However you can use this if you need to pass custom headers.
+     * @param event the Sveltekit request event
+     * @param opts additional data to put in resource server request
+     * @returns resource server response
+     */
+    allBff(event: RequestEvent, opts?: {
+        method?: "GET" | "POST" | "PUT" | "HEAD" | "OPTIONS" | "PATCH" | "DELETE";
+        headers?: Headers;
+    }): Promise<Response>;
+    private tokenPayload;
+    tokens(event: RequestEvent, token: string | string[]): Promise<{
+        status: number;
+        body?: {
+            [key: string]: any;
+        };
+    }>;
+    tokensResponse(event: RequestEvent, token: string | string[]): Promise<Response>;
+    private startDeviceCodeFlow_internal;
+    private pollDeviceCodeFlow_internal;
+    private deleteSessionData;
+    readonly authorizationCodeFlowEndpoint: {
+        get: (event: RequestEvent) => Promise<Response>;
+        load: (event: RequestEvent) => Promise<AuthorizationCodeFlowReturn>;
+    };
+    readonly authorizationCodeFlowWithPKCEEndpoint: {
+        get: (event: RequestEvent) => Promise<Response>;
+        load: (event: RequestEvent) => Promise<AuthorizationCodeFlowReturn>;
+    };
+    readonly redirectUriEndpoint: {
+        get: (event: RequestEvent) => Promise<Response | TokenReturn | undefined>;
+        load: (event: RequestEvent) => Promise<RedirectUriReturn>;
+    };
+    readonly clientCredentialsFlowEndpoint: {
+        post: (event: RequestEvent) => Promise<Response>;
+        actions: {
+            default: (event: RequestEvent) => Promise<{}>;
+        };
+    };
+    readonly refreshTokenFlowEndpoint: {
+        post: (event: RequestEvent) => Promise<Response>;
+        actions: {
+            default: (event: RequestEvent) => Promise<{}>;
+        };
+    };
+    readonly refreshTokensIfExpiredEndpoint: {
+        post: (event: RequestEvent) => Promise<Response>;
+        actions: {
+            default: (event: RequestEvent) => Promise<Response | (TokenReturn & {
+                expires_at?: number | undefined;
+            }) | undefined>;
+        };
+    };
+    readonly autoRefreshTokensIfExpiredEndpoint: {
+        post: (event: RequestEvent) => Promise<Response>;
+    };
+    readonly autoRefreshTokensEndpoint: {
+        post: (event: RequestEvent) => Promise<Response>;
+    };
+    readonly startDeviceCodeFlowEndpoint: {
+        actions: {
+            default: (event: RequestEvent) => Promise<OAuthDeviceAuthorizationResponse & {
+                verification_uri_qrdata?: string | undefined;
+            }>;
+        };
+        post: (event: RequestEvent) => Promise<Response>;
+    };
+    readonly pollDeviceCodeFlowEndpoint: {
+        actions: {
+            default: (event: RequestEvent) => Promise<{}>;
+        };
+        post: (event: RequestEvent) => Promise<Response>;
+    };
+    readonly passwordFlowEndpoint: {
+        post: (event: RequestEvent) => Promise<Response | {
+            access_token?: string | undefined;
+            refresh_token?: string | undefined;
+            id_token?: string | undefined;
+            token_type?: string | undefined;
+            expires_in?: number | undefined;
+            error?: string | undefined;
+            error_description?: string | undefined;
+            scope?: string | undefined;
+            mfa_token?: string | undefined;
+            oob_channel?: string | undefined;
+            oob_code?: string | undefined;
+            challenge_type?: string | undefined;
+            binding_method?: string | undefined;
+            name?: string | undefined;
+            ok: boolean;
+        }>;
+        actions: {
+            password: (event: RequestEvent) => Promise<{}>;
+            passwordOtp: (event: RequestEvent) => Promise<{}>;
+            passwordOob: (event: RequestEvent) => Promise<{}>;
+        };
+    };
+    readonly passwordOtpEndpoint: {
+        post: (event: RequestEvent) => Promise<Response | {
+            access_token?: string | undefined;
+            refresh_token?: string | undefined;
+            id_token?: string | undefined;
+            token_type?: string | undefined;
+            expires_in?: number | undefined;
+            error?: string | undefined;
+            error_description?: string | undefined;
+            scope?: string | undefined;
+            mfa_token?: string | undefined;
+            oob_channel?: string | undefined;
+            oob_code?: string | undefined;
+            challenge_type?: string | undefined;
+            binding_method?: string | undefined;
+            name?: string | undefined;
+            ok: boolean;
+        }>;
+        actions: {
+            default: (event: RequestEvent) => Promise<{}>;
+        };
+    };
+    readonly passwordOobEndpoint: {
+        post: (event: RequestEvent) => Promise<Response | {
+            access_token?: string | undefined;
+            refresh_token?: string | undefined;
+            id_token?: string | undefined;
+            token_type?: string | undefined;
+            expires_in?: number | undefined;
+            error?: string | undefined;
+            error_description?: string | undefined;
+            scope?: string | undefined;
+            mfa_token?: string | undefined;
+            oob_channel?: string | undefined;
+            oob_code?: string | undefined;
+            challenge_type?: string | undefined;
+            binding_method?: string | undefined;
+            name?: string | undefined;
+            ok: boolean;
+        }>;
+        actions: {
+            default: (event: RequestEvent) => Promise<{}>;
+        };
+    };
+    readonly deleteTokensEndpoint: {
+        post: (event: RequestEvent) => Promise<Response>;
+        actions: {
+            default: (event: RequestEvent) => Promise<{
+                ok: boolean;
+                user?: undefined;
+                csrfToken?: undefined;
+                errorCode?: undefined;
+                errorCodeName?: undefined;
+                errorMessage?: undefined;
+                exception?: undefined;
+            } | {
+                ok: boolean;
+                user: import('@crossauth/common').User | undefined;
+                csrfToken: string | undefined;
+                errorCode: ErrorCode;
+                errorCodeName: string;
+                errorMessage: string;
+                exception: CrossauthError;
+            }>;
+        };
+    };
+    readonly bffEndpoint: {
+        post: (event: RequestEvent) => Promise<Response>;
+        get: (event: RequestEvent) => Promise<Response>;
+        put: (event: RequestEvent) => Promise<Response>;
+        head: (event: RequestEvent) => Promise<Response>;
+        options: (event: RequestEvent) => Promise<Response>;
+        delete: (event: RequestEvent) => Promise<Response>;
+        patch: (event: RequestEvent) => Promise<Response>;
+        actions: {
+            get: (event: RequestEvent) => Promise<{
+                status: number;
+                body: {
+                    [key: string]: any;
+                };
+                error?: string | undefined;
+                error_description?: string | undefined;
+            }>;
+            post: (event: RequestEvent) => Promise<{
+                status: number;
+                body: {
+                    [key: string]: any;
+                };
+                error?: string | undefined;
+                error_description?: string | undefined;
+            }>;
+        };
+    };
+    readonly allBffEndpoint: {
+        post: (event: RequestEvent) => Promise<Response>;
+        get: (event: RequestEvent) => Promise<Response>;
+        put: (event: RequestEvent) => Promise<Response>;
+        head: (event: RequestEvent) => Promise<Response>;
+        options: (event: RequestEvent) => Promise<Response>;
+        delete: (event: RequestEvent) => Promise<Response>;
+        patch: (event: RequestEvent) => Promise<Response>;
+        actions: {
+            get: (event: RequestEvent) => Promise<{
+                status: number;
+                body: {
+                    [key: string]: any;
+                };
+                error?: string | undefined;
+                error_description?: string | undefined;
+            }>;
+            gpostet: (event: RequestEvent) => Promise<{
+                status: number;
+                body: {
+                    [key: string]: any;
+                };
+                error?: string | undefined;
+                error_description?: string | undefined;
+            }>;
+            put: (event: RequestEvent) => Promise<{
+                status: number;
+                body: {
+                    [key: string]: any;
+                };
+                error?: string | undefined;
+                error_description?: string | undefined;
+            }>;
+            options: (event: RequestEvent) => Promise<{
+                status: number;
+                body: {
+                    [key: string]: any;
+                };
+                error?: string | undefined;
+                error_description?: string | undefined;
+            }>;
+            delete: (event: RequestEvent) => Promise<{
+                status: number;
+                body: {
+                    [key: string]: any;
+                };
+                error?: string | undefined;
+                error_description?: string | undefined;
+            }>;
+            patch: (event: RequestEvent) => Promise<{
+                status: number;
+                body: {
+                    [key: string]: any;
+                };
+                error?: string | undefined;
+                error_description?: string | undefined;
+            }>;
+        };
+    };
+    readonly accessTokenEndpoint: {
+        post: (event: RequestEvent) => Promise<{
+            status: number;
+            body?: {
+                [key: string]: any;
+            } | undefined;
+        }>;
+        actions: {
+            default: (event: RequestEvent) => Promise<{
+                status: number;
+                body?: {
+                    [key: string]: any;
+                } | undefined;
+            }>;
+        };
+    };
+    readonly haveAccessTokenEndpoint: {
+        post: (event: RequestEvent) => Promise<Response>;
+        actions: {
+            default: (event: RequestEvent) => Promise<{
+                status: number;
+                body?: {
+                    [key: string]: any;
+                } | undefined;
+            }>;
+        };
+    };
+    readonly refreshTokenEndpoint: {
+        post: (event: RequestEvent) => Promise<Response>;
+        actions: {
+            default: (event: RequestEvent) => Promise<{
+                status: number;
+                body?: {
+                    [key: string]: any;
+                } | undefined;
+            }>;
+        };
+    };
+    readonly haveRefreshTokenEndpoint: {
+        post: (event: RequestEvent) => Promise<Response>;
+        actions: {
+            default: (event: RequestEvent) => Promise<{
+                status: number;
+                body?: {
+                    [key: string]: any;
+                } | undefined;
+            }>;
+        };
+    };
+    readonly idTokenEndpoint: {
+        post: (event: RequestEvent) => Promise<Response>;
+        actions: {
+            default: (event: RequestEvent) => Promise<{
+                status: number;
+                body?: {
+                    [key: string]: any;
+                } | undefined;
+            }>;
+        };
+    };
+    readonly haveIdTokenEndpoint: {
+        post: (event: RequestEvent) => Promise<Response>;
+        actions: {
+            default: (event: RequestEvent) => Promise<{
+                status: number;
+                body?: {
+                    [key: string]: any;
+                } | undefined;
+            }>;
+        };
+    };
+    readonly tokensEndpoint: {
+        post: (event: RequestEvent) => Promise<Response>;
+        actions: {
+            default: (event: RequestEvent) => Promise<{
+                status: number;
+                body?: {
+                    [key: string]: any;
+                } | undefined;
+            }>;
+        };
+    };
+}