@darkauth/client 0.1.1 → 0.2.1

package/README.md

@@ -2,6 +2,10 @@
 
 A TypeScript client library for DarkAuth - providing zero-knowledge authentication and client-side encryption capabilities for web applications.
 
+The client supports both:
+- ZK-enabled OAuth/OIDC flows
+- Standard OAuth/OIDC flows without ZK delivery
+
 ## Features
 
 - **Zero-Knowledge Authentication**: Secure OAuth2/OIDC flow with PKCE and ephemeral key exchange
@@ -29,7 +33,7 @@ setConfig({
   issuer: 'https://auth.example.com',
   clientId: 'your-client-id',
   redirectUri: 'https://app.example.com/callback',
-  zk: true // Enable zero-knowledge mode
+  zk: false // Optional: disable ZK request parameters for standard OIDC flows
 });
 
 // Start login flow
@@ -61,7 +65,7 @@ setConfig({
   issuer: 'https://auth.example.com',     // DarkAuth server URL
   clientId: 'your-client-id',              // Your application's client ID
   redirectUri: 'https://app.example.com/callback', // OAuth callback URL
-  zk: true                                 // Enable zero-knowledge mode (default: true)
+  zk: true                                 // Optional. Default true. Set false for non-ZK flows.
 });
 ```
 
@@ -80,20 +84,24 @@ Starts the OAuth2/OIDC login flow with PKCE. Redirects the user to the DarkAuth
 
 Processes the OAuth callback after successful authentication. Returns an `AuthSession` object containing:
 - `idToken`: JWT ID token
-- `drk`: Derived Root Key for encryption operations
+- `drk`: Derived Root Key for encryption operations. In non-ZK flows this is an empty `Uint8Array`.
 - `refreshToken?`: Optional refresh token
 
+Behavior:
+- If ZK artifacts are present in the callback/token response, ZK validation and DRK decryption are enforced.
+- If no ZK artifacts are present, callback still succeeds as a standard OIDC flow.
+
 #### `logout(): void`
 
 Clears all authentication data from storage.
 
 #### `getStoredSession(): AuthSession | null`
 
-Retrieves the current session from storage if valid.
+Retrieves the current session from storage if valid. For non-ZK sessions, returns `drk` as an empty `Uint8Array`.
 
 #### `refreshSession(): Promise<AuthSession | null>`
 
-Refreshes the current session using the stored refresh token.
+Refreshes the current session using the stored refresh token. For non-ZK sessions, returns `drk` as an empty `Uint8Array`.
 
 ### User Information
 

package/dist/dek.js

@@ -1,6 +1,6 @@
 import { compactDecrypt, importJWK } from "jose";
-import { deriveDek, unwrapPrivateKey } from "./crypto";
-import { getHooks } from "./hooks";
+import { deriveDek, unwrapPrivateKey } from "./crypto.js";
+import { getHooks } from "./hooks.js";
 let cachedPrivKey = null;
 let cachedPrivKeyPromise = null;
 async function getUserEncPrivateKey(drk) {

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-export * from "./crypto";
-export * from "./dek";
-export { setHooks } from "./hooks";
+export * from "./crypto.js";
+export * from "./dek.js";
+export { setHooks } from "./hooks.js";
 type Config = {
     issuer: string;
     clientId: string;

package/dist/index.js

@@ -1,7 +1,7 @@
 import { compactDecrypt } from "jose";
-export * from "./crypto";
-export * from "./dek";
-export { setHooks } from "./hooks";
+export * from "./crypto.js";
+export * from "./dek.js";
+export { setHooks } from "./hooks.js";
 function viteEnvGet(key) {
     try {
         const im = import.meta || undefined;
@@ -19,7 +19,7 @@ let cfg = {
     clientId: (typeof window !== "undefined" && window.__APP_CONFIG__?.clientId) ||
         viteEnvGet("VITE_CLIENT_ID") ||
         (typeof process !== "undefined" ? process.env.DARKAUTH_CLIENT_ID : undefined) ||
-        "app-web",
+        "demo-public-client",
     redirectUri: (typeof window !== "undefined" && window.__APP_CONFIG__?.redirectUri) ||
         viteEnvGet("VITE_REDIRECT_URI") ||
         (typeof window !== "undefined"
@@ -28,6 +28,7 @@ let cfg = {
     zk: true,
 };
 const OBFUSCATION_KEY = "DarkAuth-Storage-Protection-2025";
+const EMPTY_DRK = new Uint8Array(0);
 export function setConfig(next) {
     cfg = { ...cfg, ...next };
 }
@@ -93,14 +94,18 @@ export function isTokenValid(token) {
     return claims.exp * 1000 > Date.now() + 5000;
 }
 export async function initiateLogin() {
-    const keyPair = await crypto.subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, true, [
-        "deriveKey",
-        "deriveBits",
-    ]);
-    const publicJwk = await crypto.subtle.exportKey("jwk", keyPair.publicKey);
-    const privateJwk = await crypto.subtle.exportKey("jwk", keyPair.privateKey);
-    sessionStorage.setItem("zk_eph_priv_jwk", JSON.stringify(privateJwk));
-    const zkPubParam = bytesToBase64Url(new TextEncoder().encode(JSON.stringify(publicJwk)));
+    const zkEnabled = cfg.zk !== false;
+    let zkPubParam;
+    if (zkEnabled) {
+        const keyPair = await crypto.subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, true, [
+            "deriveKey",
+            "deriveBits",
+        ]);
+        const publicJwk = await crypto.subtle.exportKey("jwk", keyPair.publicKey);
+        const privateJwk = await crypto.subtle.exportKey("jwk", keyPair.privateKey);
+        sessionStorage.setItem("zk_eph_priv_jwk", JSON.stringify(privateJwk));
+        zkPubParam = bytesToBase64Url(new TextEncoder().encode(JSON.stringify(publicJwk)));
+    }
     const state = crypto.randomUUID();
     const verifier = bytesToBase64Url(crypto.getRandomValues(new Uint8Array(32)));
     sessionStorage.setItem("pkce_verifier", verifier);
@@ -113,7 +118,7 @@ export async function initiateLogin() {
     authUrl.searchParams.set("state", state);
     authUrl.searchParams.set("code_challenge", challenge);
     authUrl.searchParams.set("code_challenge_method", "S256");
-    if (cfg.zk !== false)
+    if (zkEnabled && zkPubParam)
         authUrl.searchParams.set("zk_pub", zkPubParam);
     location.assign(authUrl.toString());
 }
@@ -143,22 +148,36 @@ export async function handleCallback() {
     const tokenResponse = await response.json();
     const fragmentParams = parseFragmentParams(location.hash || "");
     const drkJwe = fragmentParams.drk_jwe;
+    const zkDrkHash = typeof tokenResponse.zk_drk_hash === "string" ? tokenResponse.zk_drk_hash : null;
+    const idToken = tokenResponse.id_token;
+    const refreshToken = tokenResponse.refresh_token;
+    const hasZkArtifacts = !!drkJwe || !!zkDrkHash;
+    if (!hasZkArtifacts) {
+        sessionStorage.removeItem("zk_eph_priv_jwk");
+        try {
+            history.replaceState(null, "", location.origin + location.pathname);
+        }
+        catch { }
+        sessionStorage.setItem("id_token", idToken);
+        localStorage.removeItem("drk_protected");
+        if (refreshToken)
+            localStorage.setItem("refresh_token", refreshToken);
+        return { idToken, drk: EMPTY_DRK, refreshToken };
+    }
     if (!drkJwe || typeof drkJwe !== "string")
         throw new Error("Missing DRK JWE from URL fragment");
-    if (tokenResponse.zk_drk_hash) {
+    if (zkDrkHash) {
         const hash = bytesToBase64Url(await sha256(new TextEncoder().encode(drkJwe)));
-        if (tokenResponse.zk_drk_hash !== hash)
+        if (zkDrkHash !== hash)
             throw new Error("DRK hash mismatch");
     }
     const privateJwkString = sessionStorage.getItem("zk_eph_priv_jwk");
     if (!privateJwkString)
-        return null;
+        throw new Error("Missing ZK private key for callback");
     sessionStorage.removeItem("zk_eph_priv_jwk");
     const privateKey = await crypto.subtle.importKey("jwk", JSON.parse(privateJwkString), { name: "ECDH", namedCurve: "P-256" }, true, ["deriveBits", "deriveKey"]);
     const { plaintext } = await compactDecrypt(drkJwe, privateKey);
     const drk = new Uint8Array(plaintext);
-    const idToken = tokenResponse.id_token;
-    const refreshToken = tokenResponse.refresh_token;
     try {
         history.replaceState(null, "", location.origin + location.pathname);
     }
@@ -173,10 +192,12 @@ export async function handleCallback() {
 export function getStoredSession() {
     const idToken = sessionStorage.getItem("id_token");
     const obfuscatedDrkBase64 = localStorage.getItem("drk_protected");
-    if (!idToken || !obfuscatedDrkBase64)
+    if (!idToken)
         return null;
     if (!isTokenValid(idToken))
         return null;
+    if (!obfuscatedDrkBase64)
+        return { idToken, drk: EMPTY_DRK };
     try {
         const obfuscatedDrk = base64UrlToBytes(obfuscatedDrkBase64);
         const drk = deobfuscateKey(obfuscatedDrk);
@@ -202,7 +223,9 @@ export async function refreshSession() {
         }),
     });
     if (!response.ok) {
-        localStorage.removeItem("refresh_token");
+        if (response.status === 401) {
+            localStorage.removeItem("refresh_token");
+        }
         return null;
     }
     const tokenResponse = await response.json();
@@ -213,7 +236,7 @@ export async function refreshSession() {
         localStorage.setItem("refresh_token", newRefreshToken);
     const obfuscatedDrkBase64 = localStorage.getItem("drk_protected");
     if (!obfuscatedDrkBase64)
-        return null;
+        return { idToken, drk: EMPTY_DRK, refreshToken: newRefreshToken || refreshToken };
     const obfuscatedDrk = base64UrlToBytes(obfuscatedDrkBase64);
     const drk = deobfuscateKey(obfuscatedDrk);
     return { idToken, drk, refreshToken: newRefreshToken || refreshToken };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@darkauth/client",
-  "version": "0.1.1",
+  "version": "0.2.1",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
@@ -12,6 +12,7 @@
   ],
   "scripts": {
     "build": "tsc",
+    "test": "npm run build && node --test --test-reporter=dot --experimental-specifier-resolution=node",
     "prepack": "npm run build",
     "typecheck": "tsc --noEmit",
     "prepare": "tsc",