@eventuras/fides-auth 0.14.1 → 0.15.0

package/dist/server/authorized-fetch.d.ts

@@ -0,0 +1,78 @@
+import type { RefreshFailureCause, SessionRejectedReason } from '../session-events';
+import type { Session } from '../types';
+import type { RefreshSessionResult } from './session';
+/** Why {@link authorizedFetch} failed. */
+export type AuthorizedFetchErrorReason = 
+/** The URL is outside `allowedBase` or carries credentials. Nothing was sent. */
+'url_not_allowed'
+/** The session has no access token. Nothing was sent. */
+ | 'no_access_token'
+/** The request failed before a response, including a refused redirect. */
+ | 'network_error'
+/** No response within `timeoutMs`. */
+ | 'timeout'
+/** A 401, and the refresh failed. Not retried. */
+ | 'refresh_failed'
+/** A non-2xx response. */
+ | 'http_error'
+/** `parse` threw. */
+ | 'parse_failed';
+export interface AuthorizedFetchErrorDetails {
+    status?: number;
+    method?: string;
+    url?: string;
+    refreshFailure?: {
+        reason: SessionRejectedReason;
+        cause?: RefreshFailureCause;
+    };
+    response?: Response;
+    cause?: unknown;
+}
+/** A failed {@link authorizedFetch}. Never carries the token or the query string. */
+export declare class AuthorizedFetchError extends Error {
+    readonly reason: AuthorizedFetchErrorReason;
+    /** HTTP status, for `http_error` and `refresh_failed`. */
+    readonly status?: number;
+    readonly method?: string;
+    /** Origin and path only. */
+    readonly url?: string;
+    /** Why the refresh failed. Only `cause: 'invalid_grant'` means the user must log in again. */
+    readonly refreshFailure?: {
+        reason: SessionRejectedReason;
+        cause?: RefreshFailureCause;
+    };
+    /** The unread non-2xx response, for `http_error`. */
+    readonly response?: Response;
+    constructor(reason: AuthorizedFetchErrorReason, details?: AuthorizedFetchErrorDetails);
+}
+export interface AuthorizedFetchOptions<T = undefined> extends Omit<RequestInit, 'redirect'> {
+    /** Absolute http(s) URL. The token goes only to its origin, under its path. */
+    allowedBase: string | URL;
+    /** Reads and validates a 2xx response. Its result is `data`; a throw is `parse_failed`. */
+    parse?: (response: Response) => T | Promise<T>;
+    /** Per request, including a retry. @default 10000 */
+    timeoutMs?: number;
+    /**
+     * Called once on a 401, e.g. `() => tryRefreshSessionInStore(store, config, persistence)`.
+     * Without it a 401 is an `http_error`. A retry resends `body`, so don't pass a stream.
+     */
+    refresh?: () => Promise<RefreshSessionResult | Session | null>;
+}
+export interface AuthorizedFetchResult<T> {
+    /** The 2xx response. `parse` has read its body, if given. */
+    response: Response;
+    /** What `parse` returned. */
+    data: T;
+    /** The session that made the call: the refreshed one if `refreshed`. Use it from now on. */
+    session: Session;
+    /** A 401 led to a refresh. Persist `session` unless `refresh` already did. */
+    refreshed: boolean;
+}
+/**
+ * Calls an API with the session's access token.
+ *
+ * @throws {AuthorizedFetchError} on a disallowed URL, non-2xx, timeout, network error or failed refresh.
+ * @throws {TypeError} when `allowedBase` is not an http(s) URL without credentials.
+ */
+export declare function authorizedFetch<T = undefined>(session: Session, url: string | URL, options: AuthorizedFetchOptions<T>): Promise<AuthorizedFetchResult<T>>;
+//# sourceMappingURL=authorized-fetch.d.ts.map

package/dist/server/authorized-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorized-fetch.d.ts","sourceRoot":"","sources":["../../src/server/authorized-fetch.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAMtD,0CAA0C;AAC1C,MAAM,MAAM,0BAA0B;AACpC,iFAAiF;AAC/E,iBAAiB;AACnB,yDAAyD;GACvD,iBAAiB;AACnB,0EAA0E;GACxE,eAAe;AACjB,sCAAsC;GACpC,SAAS;AACX,kDAAkD;GAChD,gBAAgB;AAClB,0BAA0B;GACxB,YAAY;AACd,qBAAqB;GACnB,cAAc,CAAC;AAEnB,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE;QAAE,MAAM,EAAE,qBAAqB,CAAC;QAAC,KAAK,CAAC,EAAE,mBAAmB,CAAA;KAAE,CAAC;IAChF,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,qFAAqF;AACrF,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAC5C,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,4BAA4B;IAC5B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,8FAA8F;IAC9F,QAAQ,CAAC,cAAc,CAAC,EAAE;QAAE,MAAM,EAAE,qBAAqB,CAAC;QAAC,KAAK,CAAC,EAAE,mBAAmB,CAAA;KAAE,CAAC;IACzF,qDAAqD;IACrD,SAAiB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAErC,YAAY,MAAM,EAAE,0BAA0B,EAAE,OAAO,GAAE,2BAAgC,EAexF;CACF;AAED,MAAM,WAAW,sBAAsB,CAAC,CAAC,GAAG,SAAS,CAAE,SAAQ,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC;IAC1F,+EAA+E;IAC/E,WAAW,EAAE,MAAM,GAAG,GAAG,CAAC;IAC1B,2FAA2F;IAC3F,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/C,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,oBAAoB,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,qBAAqB,CAAC,CAAC;IACtC,6DAA6D;IAC7D,QAAQ,EAAE,QAAQ,CAAC;IACnB,6BAA6B;IAC7B,IAAI,EAAE,CAAC,CAAC;IACR,4FAA4F;IAC5F,OAAO,EAAE,OAAO,CAAC;IACjB,8EAA8E;IAC9E,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,CAAC,GAAG,SAAS,EACjD,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,MAAM,GAAG,GAAG,EACjB,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC,GACjC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAmCnC"}

package/dist/server/heartbeat-handler.d.ts

@@ -1,14 +1,15 @@
-import type { OAuthConfig } from '../oauth';
+import type { OAuthConfig } from '../oauth-config';
 import type { CookieStore } from './cookie-store';
-export interface HeartbeatHandlerConfig {
+import { type SessionPersistenceConfig } from './session-persistence';
+/** {@link handleHeartbeat} config. Takes `secret`, `persistence`, or both. */
+export type HeartbeatHandlerConfig = HeartbeatBaseConfig & SessionPersistenceConfig;
+interface HeartbeatBaseConfig {
     /** OAuth/OIDC configuration used to refresh the access token. */
     oauthConfig: OAuthConfig;
     /** Cookie store holding the session. */
     cookies: CookieStore;
     /** Optional rate-limit gate. When it resolves false, the handler responds 429. */
     rateLimit?: () => boolean | Promise<boolean>;
-    /** Session encryption secret. Defaults to {@link getSessionSecret}. */
-    secret?: string | Uint8Array;
 }
 /**
  * Handles a heartbeat request — refresh the active session if there is one.
@@ -25,4 +26,5 @@ export interface HeartbeatHandlerConfig {
  * failures with backoff.
  */
 export declare function handleHeartbeat(request: Request, config: HeartbeatHandlerConfig): Promise<Response>;
+export {};
 //# sourceMappingURL=heartbeat-handler.d.ts.map

package/dist/server/heartbeat-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"heartbeat-handler.d.ts","sourceRoot":"","sources":["../../src/server/heartbeat-handler.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAG5C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAKlD,MAAM,WAAW,sBAAsB;IACrC,iEAAiE;IACjE,WAAW,EAAE,WAAW,CAAC;IAEzB,wCAAwC;IACxC,OAAO,EAAE,WAAW,CAAC;IAErB,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7C,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;CAC9B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,QAAQ,CAAC,CAkDnB"}
+{"version":3,"file":"heartbeat-handler.d.ts","sourceRoot":"","sources":["../../src/server/heartbeat-handler.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EAAmB,KAAK,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAIvF,8EAA8E;AAC9E,MAAM,MAAM,sBAAsB,GAAG,mBAAmB,GAAG,wBAAwB,CAAC;AAEpF,UAAU,mBAAmB;IAC3B,iEAAiE;IACjE,WAAW,EAAE,WAAW,CAAC;IAEzB,wCAAwC;IACxC,OAAO,EAAE,WAAW,CAAC;IAErB,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,QAAQ,CAAC,CAmDnB"}

package/dist/server/index.d.ts

@@ -1,5 +1,9 @@
 export type { CookieStore } from './cookie-store';
+export { createMemorySessionStore, type SessionStore, type StoredSession, } from './session-store';
+export { cookiePersistence, serverPersistence, type ServerPersistenceOptions, type SessionPersistence, type SessionPersistenceConfig, type SessionSecret, } from './session-persistence';
 export { persistSession, readSession, tryReadSession, refreshSessionInStore, tryRefreshSessionInStore, readIdToken, clearSession, type ClearSessionOptions, type PersistSessionOptions, type ReadSessionResult, type RefreshSessionResult, } from './session';
+export { createTransaction, persistTransaction, readTransaction, clearTransaction, validateCallback, transactionCookieOptions, CallbackValidationError, type CallbackValidationReason, type CreateTransactionOptions, type LoginTransaction, type TransactionCookieOptions, type ValidateCallbackOptions, } from './login-transaction';
+export { authorizedFetch, AuthorizedFetchError, type AuthorizedFetchErrorDetails, type AuthorizedFetchErrorReason, type AuthorizedFetchOptions, type AuthorizedFetchResult, } from './authorized-fetch';
 export { handleOidcLogin, type OidcLoginConfig } from './oidc-login';
 export { handleOidcCallback, type OidcCallbackConfig } from './oidc-callback';
 export { handleOidcLogout, type OidcLogoutConfig } from './oidc-logout';

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAIA,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EACL,cAAc,EACd,WAAW,EACX,cAAc,EACd,qBAAqB,EACrB,wBAAwB,EACxB,WAAW,EACX,YAAY,EACZ,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,GAC1B,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,eAAe,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAMA,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EACL,wBAAwB,EACxB,KAAK,YAAY,EACjB,KAAK,aAAa,GACnB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,aAAa,GACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,cAAc,EACd,WAAW,EACX,cAAc,EACd,qBAAqB,EACrB,wBAAwB,EACxB,WAAW,EACX,YAAY,EACZ,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,GAC1B,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,GAC3B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,eAAe,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,qBAAqB,CAAC"}