@eventuras/fides-auth 0.4.0 → 0.5.0

package/dist/oauth.d.ts

@@ -10,6 +10,14 @@ export type OAuthConfig = {
     clientSecret: string;
     redirect_uri: string;
     scope: string;
+    /**
+     * Opt in to Pushed Authorization Requests (RFC 9126) when the provider
+     * supports it. When true, authorization parameters are posted to the
+     * provider's PAR endpoint ahead of the redirect, and only `client_id` +
+     * `request_uri` travel through the user-agent. The provider must advertise
+     * `pushed_authorization_request_endpoint` in its discovery metadata.
+     */
+    usePar?: boolean;
 };
 /**
  * Refreshes an access token using a refresh token grant.
@@ -46,8 +54,27 @@ export declare function buildPKCEOptions(config: OAuthConfig): Promise<PKCEOptio
  */
 export declare function buildAuthorizationUrl(config: openid.Configuration, pkceOptions: PKCEOptions): Promise<URL>;
 /**
- * Convenience function to discover OpenID configuration and build authorization URL.
- * This combines discovery + buildAuthorizationUrl in one call.
+ * Builds an authorization URL using Pushed Authorization Requests (RFC 9126).
+ *
+ * Posts the PKCE parameters to the provider's PAR endpoint and returns a URL
+ * containing only `client_id` and `request_uri`. The provider's discovery
+ * metadata must include `pushed_authorization_request_endpoint`.
+ *
+ * @param config - Discovered OpenID Configuration (use openid.discovery() to obtain)
+ * @param pkceOptions - The PKCE options (e.g., code challenge, state, parameters)
+ * @returns A Promise that resolves to the PAR-based authorization URL
+ */
+export declare function buildAuthorizationUrlWithPAR(config: openid.Configuration, pkceOptions: PKCEOptions): Promise<URL>;
+/**
+ * Convenience function to discover OpenID configuration and build an
+ * authorization URL. Routes through PAR when `oauthConfig.usePar` is true and
+ * the provider advertises `pushed_authorization_request_endpoint`.
+ *
+ * - `usePar === true` + provider advertises PAR → uses PAR.
+ * - `usePar === true` + provider does **not** advertise PAR → throws.
+ * - `usePar` unset/false + provider advertises PAR → standard flow + one-line
+ *   `info` advisory that PAR is available but not enabled.
+ * - `usePar` unset/false + no PAR endpoint → standard flow, no advisory.
  *
  * @param oauthConfig - Your OAuth configuration
  * @param pkceOptions - The PKCE options (e.g., code challenge, state, parameters)

package/dist/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAKvC,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAE1E,uFAAuF;AACvF,eAAO,MAAM,YAAY,wCAAwC,CAAC;AAElE,wDAAwD;AACxD,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,WAAW,EACxB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CA6CvC;AAED,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAmBhF;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,CAAC,aAAa,EAC5B,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,GAAG,CAAC,CASd;AAED;;;;;;;GAOG;AACH,wBAAsB,gCAAgC,CACpD,WAAW,EAAE,WAAW,EACxB,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,GAAG,CAAC,CAgBd;AAED;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,+BAA+B;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,sBAAsB;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,0BAA0B;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,WAAW,EACxB,WAAW,EAAE,GAAG,EAChB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAiCvC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,CAAC,qBAAqB,EACpC,UAAU,GAAE,MAAgB,GAC3B,YAAY,CAoBd;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,CAAC,qBAAqB,EACpC,UAAU,GAAE,MAAgB,GAC3B,OAAO,CAqBT;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,iBAAiB,EAAE,MAAM,EACzB,WAAW,GAAE,MAAY,EACzB,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,GACvC,GAAG,CA+BL;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,WAAW,EACxB,qBAAqB,EAAE,MAAM,GAC5B,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAyBrB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAgCvC"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAKvC,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAE1E,uFAAuF;AACvF,eAAO,MAAM,YAAY,wCAAwC,CAAC;AAElE,wDAAwD;AACxD,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,WAAW,EACxB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CA6CvC;AAED,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAmBhF;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,CAAC,aAAa,EAC5B,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,GAAG,CAAC,CASd;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,4BAA4B,CAChD,MAAM,EAAE,MAAM,CAAC,aAAa,EAC5B,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,GAAG,CAAC,CAYd;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gCAAgC,CACpD,WAAW,EAAE,WAAW,EACxB,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,GAAG,CAAC,CAkCd;AAED;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,+BAA+B;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,sBAAsB;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,0BAA0B;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,WAAW,EACxB,WAAW,EAAE,GAAG,EAChB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAiCvC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,CAAC,qBAAqB,EACpC,UAAU,GAAE,MAAgB,GAC3B,YAAY,CAoBd;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,CAAC,qBAAqB,EACpC,UAAU,GAAE,MAAgB,GAC3B,OAAO,CAqBT;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,iBAAiB,EAAE,MAAM,EACzB,WAAW,GAAE,MAAY,EACzB,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,GACvC,GAAG,CA+BL;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,WAAW,EACxB,qBAAqB,EAAE,MAAM,GAC5B,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAyBrB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAgCvC"}

package/dist/oauth.js

@@ -1,85 +1,98 @@
 import { createLogger as e } from "./logger.js";
 import { t } from "./decode_jwt-1J26fl4I.js";
-import { a as n, c as r, i, n as a, o, r as s, s as c, t as l } from "./build-BnXr85C9.js";
+import { a as n, c as r, i, l as a, n as o, o as s, r as c, s as l, t as u } from "./build-nL2--iMi.js";
 //#region src/oauth.ts
-var u = e({ namespace: "fides-auth:oauth" }), d = "openid profile email offline_access";
-async function f(e, t) {
-	u.debug({ issuer: e.issuer }, "Starting token refresh");
+var d = e({ namespace: "fides-auth:oauth" }), f = "openid profile email offline_access";
+async function p(e, t) {
+	d.debug({ issuer: e.issuer }, "Starting token refresh");
 	try {
-		let i = await r(await n(new URL(e.issuer), e.clientId, e.clientSecret, l(e.clientSecret)), t, { scope: e.scope });
-		return u.info({
-			hasAccessToken: !!i.access_token,
-			hasRefreshToken: !!i.refresh_token,
-			expiresIn: i.expires_in
-		}, "Token refresh successful"), i;
+		let n = await a(await s(new URL(e.issuer), e.clientId, e.clientSecret, u(e.clientSecret)), t, { scope: e.scope });
+		return d.info({
+			hasAccessToken: !!n.access_token,
+			hasRefreshToken: !!n.refresh_token,
+			expiresIn: n.expires_in
+		}, "Token refresh successful"), n;
 	} catch (t) {
 		let n = t;
-		throw n?.code === "OAUTH_RESPONSE_BODY_ERROR" && n?.error === "invalid_grant" ? u.info({
+		throw n?.code === "OAUTH_RESPONSE_BODY_ERROR" && n?.error === "invalid_grant" ? d.info({
 			error: n.error,
 			error_description: n.error_description,
 			issuer: e.issuer
-		}, "Token refresh failed - refresh token expired or invalid") : u.error({
+		}, "Token refresh failed - refresh token expired or invalid") : d.error({
 			error: t,
 			issuer: e.issuer
 		}, "Token refresh failed"), t;
 	}
 }
-async function p(e) {
-	let t = o(), n = await i(t), r = c(), a = {
+async function m(e) {
+	let t = l(), i = await n(t), a = r(), o = {
 		redirect_uri: e.redirect_uri,
 		scope: e.scope ?? "openid profile email offline_access",
-		code_challenge: n,
+		code_challenge: i,
 		code_challenge_method: "S256",
-		state: r
+		state: a
 	};
-	return u.info({
+	return d.info({
 		redirectUri: e.redirect_uri,
-		scope: a.scope
+		scope: o.scope
 	}, "PKCE parameters generated"), {
 		code_verifier: t,
-		code_challenge: n,
-		state: r,
-		parameters: a
+		code_challenge: i,
+		state: a,
+		parameters: o
 	};
 }
-async function m(e, t) {
+async function h(e, t) {
 	try {
-		let n = s(e, t.parameters);
-		return u.info({ authUrl: n.origin }, "Authorization URL built successfully"), n;
+		let n = c(e, t.parameters);
+		return d.info("Authorization URL built successfully"), n;
 	} catch (e) {
-		throw u.error({ error: e }, "Failed to build authorization URL"), e;
+		throw d.error({ error: e }, "Failed to build authorization URL"), e;
 	}
 }
-async function h(e, t) {
-	u.debug({ issuer: e.issuer }, "Discovering OpenID configuration");
+async function g(e, t) {
 	try {
-		return m(await n(new URL(e.issuer), e.clientId, e.clientSecret, l(e.clientSecret)), t);
+		let n = await i(e, t.parameters);
+		return d.info("PAR authorization URL built successfully"), n;
+	} catch (e) {
+		throw d.error({ error: e }, "Failed to build PAR authorization URL"), e;
+	}
+}
+async function _(e, t) {
+	d.debug({ issuer: e.issuer }, "Discovering OpenID configuration");
+	try {
+		let n = await s(new URL(e.issuer), e.clientId, e.clientSecret, u(e.clientSecret)), r = n.serverMetadata().pushed_authorization_request_endpoint;
+		if (e.usePar) {
+			if (!r) throw Error("PAR requested (usePar=true) but provider does not advertise pushed_authorization_request_endpoint");
+			return g(n, t);
+		}
+		return r && d.info({ issuer: e.issuer }, "Provider advertises PAR but usePar is not enabled — set OAuthConfig.usePar=true to use it"), h(n, t);
 	} catch (t) {
-		throw u.error({
+		throw d.error({
 			error: t,
 			issuer: e.issuer
 		}, "Failed to discover config or build URL"), t;
 	}
 }
-async function g(e, t, r, i) {
-	u.debug({
+async function v(e, t, n, r) {
+	d.debug({
 		issuer: e.issuer,
 		clientId: e.clientId
 	}, "Exchanging authorization code for tokens");
-	let o = await a(await n(new URL(e.issuer), e.clientId, e.clientSecret, l(e.clientSecret)), t, {
-		pkceCodeVerifier: r,
-		expectedState: i
+	let i = await o(await s(new URL(e.issuer), e.clientId, e.clientSecret, u(e.clientSecret)), t, {
+		pkceCodeVerifier: n,
+		expectedState: r
 	}, { redirect_uri: e.redirect_uri });
-	return u.info({
-		hasAccessToken: !!o.access_token,
-		hasRefreshToken: !!o.refresh_token,
-		expiresIn: o.expires_in
-	}, "Authorization code exchange successful"), o;
+	return d.info({
+		hasAccessToken: !!i.access_token,
+		hasRefreshToken: !!i.refresh_token,
+		expiresIn: i.expires_in
+	}, "Authorization code exchange successful"), i;
 }
-function _(e, n = "roles") {
+function y(e, n = "roles") {
 	if (!e.id_token) throw Error("OIDC token response is missing id_token");
 	let r = t(e.id_token), i = r[n], a = typeof i == "string" ? [i] : [], o = Array.isArray(i) ? i : a;
-	return u.debug({
+	return d.debug({
 		sub: r.sub,
 		rolesClaim: n,
 		rolesCount: o.length
@@ -90,9 +103,9 @@ function _(e, n = "roles") {
 		roles: o
 	};
 }
-function v(e, t = "roles") {
+function b(e, t = "roles") {
 	if (!e.access_token) throw Error("OIDC token response is missing access_token");
-	let n = _(e, t);
+	let n = y(e, t);
 	return {
 		tokens: {
 			accessToken: e.access_token,
@@ -106,34 +119,34 @@ function v(e, t = "roles") {
 		}
 	};
 }
-function y(e, t, n = "/", r) {
+function x(e, t, n = "/", r) {
 	let i = e ?? n, a;
 	try {
 		a = new URL(i, t);
 	} catch {
-		return u.warn({ returnTo: i }, "Invalid returnTo URL, using default"), new URL(n, t);
+		return d.warn({ returnTo: i }, "Invalid returnTo URL, using default"), new URL(n, t);
 	}
 	let o = new URL(t);
-	return a.origin === o.origin ? r && !r(a.pathname) ? (u.warn({ pathname: a.pathname }, "returnTo failed custom validation, falling back to default"), new URL(n, t)) : a : (u.error({
+	return a.origin === o.origin ? r && !r(a.pathname) ? (d.warn({ pathname: a.pathname }, "returnTo failed custom validation, falling back to default"), new URL(n, t)) : a : (d.error({
 		returnTo: i,
 		redirectOrigin: a.origin,
 		applicationOrigin: o.origin
 	}, "Possible open redirect attack: returnTo points outside application origin"), new URL(n, t));
 }
-async function b(e, t) {
+async function S(e, t) {
 	try {
-		let r = (await n(new URL(e.issuer), e.clientId, e.clientSecret, l(e.clientSecret))).serverMetadata().end_session_endpoint;
-		if (!r) return u.info({ issuer: e.issuer }, "No end_session_endpoint found"), null;
-		let i = new URL(r);
-		return i.searchParams.set("client_id", e.clientId), i.searchParams.set("post_logout_redirect_uri", t), u.debug({ logoutUrl: i.toString() }, "Built OIDC logout URL"), i;
+		let n = (await s(new URL(e.issuer), e.clientId, e.clientSecret, u(e.clientSecret))).serverMetadata().end_session_endpoint;
+		if (!n) return d.info({ issuer: e.issuer }, "No end_session_endpoint found"), null;
+		let r = new URL(n);
+		return r.searchParams.set("client_id", e.clientId), r.searchParams.set("post_logout_redirect_uri", t), d.debug({ logoutUrl: r.toString() }, "Built OIDC logout URL"), r;
 	} catch (t) {
-		return u.warn({
+		return d.warn({
 			error: t,
 			issuer: e.issuer
 		}, "OIDC discovery failed for logout"), null;
 	}
 }
-async function x(e) {
+async function C(e) {
 	try {
 		let t = new URLSearchParams({
 			grant_type: "client_credentials",
@@ -148,18 +161,18 @@ async function x(e) {
 		});
 		if (!n.ok) {
 			let e = await n.text();
-			throw u.error({
+			throw d.error({
 				status: n.status,
 				error: e
 			}, "Client credentials grant failed"), Error(`Client credentials grant failed: ${n.status} - ${e}`);
 		}
 		return await n.json();
 	} catch (t) {
-		throw u.error({
+		throw d.error({
 			error: t,
 			tokenEndpoint: e.tokenEndpoint
 		}, "Client credentials grant error"), t;
 	}
 }
 //#endregion
-export { m as buildAuthorizationUrl, b as buildOidcLogoutUrl, p as buildPKCEOptions, v as buildSessionFromTokens, x as clientCredentialsGrant, d as defaultScope, h as discoverAndBuildAuthorizationUrl, g as exchangeAuthorizationCode, _ as extractUserFromTokens, f as refreshAccessToken, y as validateReturnUrl };
+export { h as buildAuthorizationUrl, g as buildAuthorizationUrlWithPAR, S as buildOidcLogoutUrl, m as buildPKCEOptions, b as buildSessionFromTokens, C as clientCredentialsGrant, f as defaultScope, _ as discoverAndBuildAuthorizationUrl, v as exchangeAuthorizationCode, y as extractUserFromTokens, p as refreshAccessToken, x as validateReturnUrl };

package/dist/providers/vipps/index.js

@@ -1,5 +1,5 @@
 import { createLogger as e } from "../../logger.js";
-import { a as t, c as n, n as r, t as i } from "../../build-BnXr85C9.js";
+import { l as t, n, o as r, t as i } from "../../build-nL2--iMi.js";
 import { buildAuthorizationUrl as a, buildPKCEOptions as o } from "../../oauth.js";
 //#region src/providers/vipps/types.ts
 var s = {
@@ -48,7 +48,7 @@ var d = e({
 		}, "VippsLoginClient initialized");
 	}
 	async getConfig() {
-		return this.configPromise ||= t(new URL(this.oauthConfig.issuer), this.oauthConfig.clientId, this.oauthConfig.clientSecret, i(this.oauthConfig.clientSecret)), this.configPromise;
+		return this.configPromise ||= r(new URL(this.oauthConfig.issuer), this.oauthConfig.clientId, this.oauthConfig.clientSecret, i(this.oauthConfig.clientSecret)), this.configPromise;
 	}
 	async buildPKCEOptions() {
 		return d.debug("Building PKCE options"), o(this.oauthConfig);
@@ -56,12 +56,12 @@ var d = e({
 	async buildAuthorizationUrl(e) {
 		return d.debug("Building authorization URL"), a(await this.getConfig(), e);
 	}
-	async exchangeCodeForTokens(e, t, n) {
+	async exchangeCodeForTokens(e, t, r) {
 		d.debug("Exchanging authorization code for tokens");
 		try {
-			let i = await r(await this.getConfig(), typeof e == "string" ? new URL(e) : e, {
+			let i = await n(await this.getConfig(), typeof e == "string" ? new URL(e) : e, {
 				pkceCodeVerifier: t,
-				expectedState: n,
+				expectedState: r,
 				idTokenExpected: !0
 			});
 			return d.info({
@@ -105,12 +105,12 @@ var d = e({
 	async refreshTokens(e) {
 		d.debug("Refreshing access token");
 		try {
-			let t = await n(await this.getConfig(), e);
+			let n = await t(await this.getConfig(), e);
 			return d.info({
-				hasAccessToken: !!t.access_token,
-				hasRefreshToken: !!t.refresh_token,
-				expiresIn: t.expires_in
-			}, "Successfully refreshed tokens"), t;
+				hasAccessToken: !!n.access_token,
+				hasRefreshToken: !!n.refresh_token,
+				expiresIn: n.expires_in
+			}, "Successfully refreshed tokens"), n;
 		} catch (e) {
 			throw d.error({ error: e }, "Failed to refresh tokens"), e;
 		}

package/dist/silent-login.js

@@ -1,5 +1,5 @@
 import { createLogger as e } from "./logger.js";
-import { a as t, r as n, t as r } from "./build-BnXr85C9.js";
+import { o as t, r as n, t as r } from "./build-nL2--iMi.js";
 //#region src/silent-login.ts
 var i = e({ namespace: "fides-auth:silent-login" });
 async function a(e, a = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eventuras/fides-auth",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Framework-agnostic OAuth/OIDC authentication library with PKCE, session management, and pluggable logging",
   "keywords": [
     "oauth",