@douvery/auth 0.2.0 → 0.3.0

package/dist/index.d.ts

@@ -207,6 +207,64 @@ interface LogoutOptions {
     /** Only clear local session, don't redirect @default false */
     localOnly?: boolean;
 }
+/** Base options for all auth navigation redirects */
+interface AuthNavigationOptions {
+    /** URL to return to after the action completes */
+    returnTo?: string;
+    /** OAuth client_id for branded experiences */
+    clientId?: string;
+    /** Open in a new tab/window instead of redirecting */
+    openInNewTab?: boolean;
+}
+interface SelectAccountOptions extends AuthNavigationOptions {
+    /** Pre-select a specific email/account */
+    loginHint?: string;
+}
+interface RegisterOptions extends AuthNavigationOptions {
+    /** Pre-fill email on register form */
+    email?: string;
+    /** Pre-fill first name */
+    firstName?: string;
+    /** Pre-fill last name */
+    lastName?: string;
+    /** UI locale preference */
+    uiLocales?: string;
+}
+interface RecoverAccountOptions extends AuthNavigationOptions {
+    /** Pre-fill email for recovery */
+    email?: string;
+}
+interface VerifyAccountOptions extends AuthNavigationOptions {
+    /** Email to verify */
+    email?: string;
+}
+interface UpgradeAccountOptions extends AuthNavigationOptions {
+    /** Scopes to request on upgrade */
+    scopes?: string[];
+}
+interface SetupPasskeyOptions extends AuthNavigationOptions {
+}
+interface SetupAddressOptions extends AuthNavigationOptions {
+}
+interface AddAccountOptions extends AuthNavigationOptions {
+    /** Pre-fill email hint for the new account */
+    loginHint?: string;
+}
+interface RevokeTokenOptions {
+    /** Specific token to revoke. If not provided, revokes current access token */
+    token?: string;
+    /** Token type hint: "access_token" or "refresh_token" */
+    tokenTypeHint?: "access_token" | "refresh_token";
+}
+/** Result of URL builder methods (non-redirecting) */
+interface AuthUrl {
+    /** The full URL */
+    url: string;
+    /** Open the URL via redirect */
+    redirect: () => void;
+    /** Open the URL in a new tab */
+    open: () => Window | null;
+}
 
 /**
  * @douvery/auth - Auth Client
@@ -236,7 +294,55 @@ declare class DouveryAuthClient {
     refreshTokens(): Promise<TokenInfo>;
     /** Get current access token (auto-refreshes if needed) */
     getAccessToken(): Promise<string | null>;
+    /** Redirect to select/switch account */
+    selectAccount(options?: SelectAccountOptions): void;
+    /** Build select-account URL without redirecting */
+    buildSelectAccountUrl(options?: SelectAccountOptions): AuthUrl;
+    /** Redirect to add another account (multi-session) */
+    addAccount(options?: AddAccountOptions): void;
+    /** Build add-account URL without redirecting */
+    buildAddAccountUrl(options?: AddAccountOptions): AuthUrl;
+    /** Redirect to register a new account */
+    register(options?: RegisterOptions): void;
+    /** Build register URL without redirecting */
+    buildRegisterUrl(options?: RegisterOptions): AuthUrl;
+    /** Redirect to recover account (forgot password) */
+    recoverAccount(options?: RecoverAccountOptions): void;
+    /** Build recover-account URL without redirecting */
+    buildRecoverAccountUrl(options?: RecoverAccountOptions): AuthUrl;
+    /** Redirect to verify account (email verification) */
+    verifyAccount(options?: VerifyAccountOptions): void;
+    /** Build verify-account URL without redirecting */
+    buildVerifyAccountUrl(options?: VerifyAccountOptions): AuthUrl;
+    /** Redirect to upgrade account (guest → full account) */
+    upgradeAccount(options?: UpgradeAccountOptions): void;
+    /** Build upgrade-account URL without redirecting */
+    buildUpgradeAccountUrl(options?: UpgradeAccountOptions): AuthUrl;
+    /** Redirect to passkey setup */
+    setupPasskey(options?: SetupPasskeyOptions): void;
+    /** Build setup-passkey URL without redirecting */
+    buildSetupPasskeyUrl(options?: SetupPasskeyOptions): AuthUrl;
+    /** Redirect to address setup */
+    setupAddress(options?: SetupAddressOptions): void;
+    /** Build setup-address URL without redirecting */
+    buildSetupAddressUrl(options?: SetupAddressOptions): AuthUrl;
+    /** Build a login URL without redirecting (useful for links/buttons) */
+    buildLoginUrl(options?: LoginOptions): AuthUrl;
+    /** Build a logout URL without redirecting */
+    buildLogoutUrl(options?: LogoutOptions): AuthUrl;
+    /** Revoke a token (access or refresh) */
+    revokeToken(options?: RevokeTokenOptions): Promise<void>;
+    /** Check if the user's session is expired */
+    isSessionExpired(): boolean;
+    /** Check if user needs email verification */
+    needsEmailVerification(): boolean;
+    /** Check if user is a guest account */
+    isGuestAccount(): boolean;
     private tokenSetToInfo;
+    /** Build an AuthUrl object for a given path and params */
+    private createAuthUrl;
+    /** Navigate to an auth URL, respecting openInNewTab option */
+    private navigate;
     private fetchUser;
     private extractUserFromIdToken;
     private normalizeUser;
@@ -349,4 +455,4 @@ declare class TokenManager {
     clearAll(): Promise<void>;
 }
 
-export { AuthError, type AuthErrorCode, type AuthEvent, type AuthEventHandler, type AuthState, type AuthStatus, type CallbackResult, CookieStorage, type DecodedIdToken, DouveryAuthClient, type DouveryAuthConfig, LocalStorage, type LoginOptions, type LogoutOptions, MemoryStorage, type OIDCDiscovery, type PKCEPair, STORAGE_KEYS, SessionStorage, type StorageKeys, type TokenInfo, TokenManager, type TokenSet, type TokenStorage, type User, base64UrlDecode, base64UrlEncode, createDouveryAuth, createStorage, decodeJWT, generateCodeChallenge, generateCodeVerifier, generateNonce, generatePKCEPair, generateState, getTokenExpiration, isTokenExpired, verifyCodeChallenge };
+export { type AddAccountOptions, AuthError, type AuthErrorCode, type AuthEvent, type AuthEventHandler, type AuthNavigationOptions, type AuthState, type AuthStatus, type AuthUrl, type CallbackResult, CookieStorage, type DecodedIdToken, DouveryAuthClient, type DouveryAuthConfig, LocalStorage, type LoginOptions, type LogoutOptions, MemoryStorage, type OIDCDiscovery, type PKCEPair, type RecoverAccountOptions, type RegisterOptions, type RevokeTokenOptions, STORAGE_KEYS, type SelectAccountOptions, SessionStorage, type SetupAddressOptions, type SetupPasskeyOptions, type StorageKeys, type TokenInfo, TokenManager, type TokenSet, type TokenStorage, type UpgradeAccountOptions, type User, type VerifyAccountOptions, base64UrlDecode, base64UrlEncode, createDouveryAuth, createStorage, decodeJWT, generateCodeChallenge, generateCodeVerifier, generateNonce, generatePKCEPair, generateState, getTokenExpiration, isTokenExpired, verifyCodeChallenge };

package/dist/index.js

@@ -636,6 +636,171 @@ var DouveryAuthClient = class {
     }
     return tokens.accessToken;
   }
+  // ============================================
+  // Navigation Methods
+  // ============================================
+  /** Redirect to select/switch account */
+  selectAccount(options = {}) {
+    const url = this.buildSelectAccountUrl(options);
+    this.navigate(url, options);
+  }
+  /** Build select-account URL without redirecting */
+  buildSelectAccountUrl(options = {}) {
+    const params = new URLSearchParams();
+    if (options.returnTo) params.set("continue", options.returnTo);
+    if (options.clientId) params.set("client_id", options.clientId);
+    if (options.loginHint) params.set("login_hint", options.loginHint);
+    return this.createAuthUrl("/select-account", params);
+  }
+  /** Redirect to add another account (multi-session) */
+  addAccount(options = {}) {
+    const url = this.buildAddAccountUrl(options);
+    this.navigate(url, options);
+  }
+  /** Build add-account URL without redirecting */
+  buildAddAccountUrl(options = {}) {
+    const params = new URLSearchParams({ add_account: "true" });
+    if (options.returnTo) params.set("continue", options.returnTo);
+    if (options.clientId) params.set("client_id", options.clientId);
+    if (options.loginHint) params.set("login_hint", options.loginHint);
+    return this.createAuthUrl("/login", params);
+  }
+  /** Redirect to register a new account */
+  register(options = {}) {
+    const url = this.buildRegisterUrl(options);
+    this.navigate(url, options);
+  }
+  /** Build register URL without redirecting */
+  buildRegisterUrl(options = {}) {
+    const params = new URLSearchParams();
+    if (options.returnTo) params.set("continue", options.returnTo);
+    if (options.clientId) params.set("client_id", options.clientId);
+    if (options.email) params.set("email", options.email);
+    if (options.firstName) params.set("first_name", options.firstName);
+    if (options.lastName) params.set("last_name", options.lastName);
+    if (options.uiLocales) params.set("ui_locales", options.uiLocales);
+    return this.createAuthUrl("/register", params);
+  }
+  /** Redirect to recover account (forgot password) */
+  recoverAccount(options = {}) {
+    const url = this.buildRecoverAccountUrl(options);
+    this.navigate(url, options);
+  }
+  /** Build recover-account URL without redirecting */
+  buildRecoverAccountUrl(options = {}) {
+    const params = new URLSearchParams();
+    if (options.returnTo) params.set("continue", options.returnTo);
+    if (options.clientId) params.set("client_id", options.clientId);
+    if (options.email) params.set("email", options.email);
+    return this.createAuthUrl("/recover-account", params);
+  }
+  /** Redirect to verify account (email verification) */
+  verifyAccount(options = {}) {
+    const url = this.buildVerifyAccountUrl(options);
+    this.navigate(url, options);
+  }
+  /** Build verify-account URL without redirecting */
+  buildVerifyAccountUrl(options = {}) {
+    const params = new URLSearchParams();
+    if (options.returnTo) params.set("continue", options.returnTo);
+    if (options.clientId) params.set("client_id", options.clientId);
+    if (options.email) params.set("email", options.email);
+    return this.createAuthUrl("/verify-account", params);
+  }
+  /** Redirect to upgrade account (guest → full account) */
+  upgradeAccount(options = {}) {
+    const url = this.buildUpgradeAccountUrl(options);
+    this.navigate(url, options);
+  }
+  /** Build upgrade-account URL without redirecting */
+  buildUpgradeAccountUrl(options = {}) {
+    const params = new URLSearchParams();
+    if (options.returnTo) params.set("continue", options.returnTo);
+    if (options.clientId) params.set("client_id", options.clientId);
+    if (options.scopes?.length) params.set("scope", options.scopes.join(" "));
+    return this.createAuthUrl("/upgrade-account", params);
+  }
+  /** Redirect to passkey setup */
+  setupPasskey(options = {}) {
+    const url = this.buildSetupPasskeyUrl(options);
+    this.navigate(url, options);
+  }
+  /** Build setup-passkey URL without redirecting */
+  buildSetupPasskeyUrl(options = {}) {
+    const params = new URLSearchParams();
+    if (options.returnTo) params.set("continue", options.returnTo);
+    if (options.clientId) params.set("client_id", options.clientId);
+    return this.createAuthUrl("/setup-passkey", params);
+  }
+  /** Redirect to address setup */
+  setupAddress(options = {}) {
+    const url = this.buildSetupAddressUrl(options);
+    this.navigate(url, options);
+  }
+  /** Build setup-address URL without redirecting */
+  buildSetupAddressUrl(options = {}) {
+    const params = new URLSearchParams();
+    if (options.returnTo) params.set("continue", options.returnTo);
+    if (options.clientId) params.set("client_id", options.clientId);
+    return this.createAuthUrl("/setup-address", params);
+  }
+  /** Build a login URL without redirecting (useful for links/buttons) */
+  buildLoginUrl(options = {}) {
+    const params = new URLSearchParams();
+    if (options.returnTo) params.set("continue", options.returnTo);
+    if (options.loginHint) params.set("email", options.loginHint);
+    if (options.prompt) params.set("prompt", options.prompt);
+    if (options.uiLocales) params.set("ui_locales", options.uiLocales);
+    return this.createAuthUrl("/login", params);
+  }
+  /** Build a logout URL without redirecting */
+  buildLogoutUrl(options = {}) {
+    const params = new URLSearchParams();
+    if (options.returnTo) params.set("continue", options.returnTo);
+    return this.createAuthUrl("/logout", params);
+  }
+  /** Revoke a token (access or refresh) */
+  async revokeToken(options = {}) {
+    this.log("Revoking token...");
+    const token = options.token ?? (await this.tokenManager.getTokens())?.accessToken;
+    if (!token) {
+      throw new AuthError("invalid_token", "No token to revoke");
+    }
+    const revokeUrl = `${this.config.issuer}/oauth/revoke`;
+    const body = new URLSearchParams({
+      token,
+      client_id: this.config.clientId
+    });
+    if (options.tokenTypeHint) {
+      body.set("token_type_hint", options.tokenTypeHint);
+    }
+    const response = await fetch(revokeUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body
+    });
+    if (!response.ok) {
+      const error = await response.json().catch(() => ({}));
+      throw new AuthError(
+        error.error ?? "server_error",
+        error.error_description ?? "Token revocation failed"
+      );
+    }
+    this.log("Token revoked successfully");
+  }
+  /** Check if the user's session is expired */
+  isSessionExpired() {
+    if (!this.state.tokens) return true;
+    return isTokenExpired(this.state.tokens.accessToken);
+  }
+  /** Check if user needs email verification */
+  needsEmailVerification() {
+    return this.state.user?.emailVerified === false;
+  }
+  /** Check if user is a guest account */
+  isGuestAccount() {
+    return this.state.user?.accountType === "guest";
+  }
   tokenSetToInfo(tokenSet) {
     return {
       accessToken: tokenSet.access_token,
@@ -646,6 +811,28 @@ var DouveryAuthClient = class {
       scope: tokenSet.scope?.split(" ") ?? []
     };
   }
+  /** Build an AuthUrl object for a given path and params */
+  createAuthUrl(path, params) {
+    const query = params.toString();
+    const url = `${this.config.issuer}${path}${query ? `?${query}` : ""}`;
+    return {
+      url,
+      redirect: () => {
+        window.location.href = url;
+      },
+      open: () => {
+        return window.open(url, "_blank");
+      }
+    };
+  }
+  /** Navigate to an auth URL, respecting openInNewTab option */
+  navigate(authUrl, options) {
+    if (options.openInNewTab) {
+      authUrl.open();
+    } else {
+      authUrl.redirect();
+    }
+  }
   async fetchUser(accessToken) {
     const discovery = await this.getDiscovery();
     const response = await fetch(discovery.userinfo_endpoint, {