@eventuras/fides-auth 0.5.0 → 0.7.0

package/dist/providers/vipps/index.js

@@ -1,120 +1,206 @@
-import { createLogger as e } from "../../logger.js";
-import { l as t, n, o as r, t as i } from "../../build-nL2--iMi.js";
-import { buildAuthorizationUrl as a, buildPKCEOptions as o } from "../../oauth.js";
+import { createLogger } from "../../logger.js";
+import { buildAuthorizationUrl, buildPKCEOptions } from "../../oauth.js";
+import * as openid from "openid-client";
 //#region src/providers/vipps/types.ts
-var s = {
+/**
+* Available Vipps Login scopes
+*/
+var VippsLoginScopes = {
+	/** Required: OpenID Connect base scope */
 	OpenId: "openid",
+	/** User's name (given_name, family_name, name) */
 	Name: "name",
+	/** Phone number */
 	PhoneNumber: "phoneNumber",
+	/** Physical address */
 	Address: "address",
+	/** Birth date */
 	BirthDate: "birthDate",
+	/** Email address */
 	Email: "email"
-}, c = [
-	s.OpenId,
-	s.Name,
-	s.PhoneNumber,
-	s.Address,
-	s.Email
-].join(" "), l = {
+};
+/**
+* Default scopes for Vipps Login
+*/
+var defaultVippsLoginScope = [
+	VippsLoginScopes.OpenId,
+	VippsLoginScopes.Name,
+	VippsLoginScopes.PhoneNumber,
+	VippsLoginScopes.Address,
+	VippsLoginScopes.Email
+].join(" ");
+/**
+* Vipps API environments
+*/
+var VippsEnvironments = {
+	/** Test environment */
 	Test: "https://apitest.vipps.no",
+	/** Production environment */
 	Production: "https://api.vipps.no"
 };
-function u(e) {
-	return `${e}/access-management-1.0/access/`;
+/**
+* Get Vipps OIDC issuer URL for environment
+*/
+function getVippsIssuer(environment) {
+	return `${environment}/access-management-1.0/access/`;
 }
 //#endregion
 //#region src/providers/vipps/client.ts
-var d = e({
+/**
+* Vipps Login Client
+*
+* Client for Vipps Login (OIDC) authentication flow.
+* Implements OAuth/OIDC operations with PKCE for Vipps.
+*/
+var logger = createLogger({
 	namespace: "fides-auth:vipps",
 	context: { module: "VippsLoginClient" }
-}), f = class {
+});
+/**
+* Vipps Login Client
+*
+* Handles Vipps Login (OIDC) authentication flow using PKCE.
+*/
+var VippsLoginClient = class {
 	config;
 	oauthConfig;
 	configPromise = null;
-	constructor(e) {
+	constructor(config) {
 		this.config = {
-			...e,
-			scope: e.scope ?? c
-		}, this.oauthConfig = {
-			issuer: e.issuer,
-			clientId: e.clientId,
-			clientSecret: e.clientSecret,
-			redirect_uri: e.redirectUri,
+			...config,
+			scope: config.scope ?? defaultVippsLoginScope
+		};
+		this.oauthConfig = {
+			issuer: config.issuer,
+			clientId: config.clientId,
+			clientSecret: config.clientSecret,
+			redirect_uri: config.redirectUri,
 			scope: this.config.scope
-		}, d.info({
-			issuer: e.issuer,
-			redirectUri: e.redirectUri,
+		};
+		logger.info({
+			issuer: config.issuer,
+			redirectUri: config.redirectUri,
 			scope: this.config.scope
 		}, "VippsLoginClient initialized");
 	}
+	/**
+	* Get OpenID Configuration (cached)
+	* This ensures we use the same Configuration instance across all operations
+	*/
 	async getConfig() {
-		return this.configPromise ||= r(new URL(this.oauthConfig.issuer), this.oauthConfig.clientId, this.oauthConfig.clientSecret, i(this.oauthConfig.clientSecret)), this.configPromise;
+		if (!this.configPromise) this.configPromise = openid.discovery(new URL(this.oauthConfig.issuer), this.oauthConfig.clientId, this.oauthConfig.clientSecret, openid.ClientSecretPost(this.oauthConfig.clientSecret));
+		return this.configPromise;
 	}
+	/**
+	* Build PKCE options for authorization flow
+	*
+	* @returns PKCE options including code_verifier, code_challenge, and state
+	*/
 	async buildPKCEOptions() {
-		return d.debug("Building PKCE options"), o(this.oauthConfig);
+		logger.debug("Building PKCE options");
+		return buildPKCEOptions(this.oauthConfig);
 	}
-	async buildAuthorizationUrl(e) {
-		return d.debug("Building authorization URL"), a(await this.getConfig(), e);
+	/**
+	* Build authorization URL for Vipps Login
+	*
+	* @param pkceOptions - PKCE options from buildPKCEOptions()
+	* @returns Authorization URL to redirect user to
+	*/
+	async buildAuthorizationUrl(pkceOptions) {
+		logger.debug("Building authorization URL");
+		return buildAuthorizationUrl(await this.getConfig(), pkceOptions);
 	}
-	async exchangeCodeForTokens(e, t, r) {
-		d.debug("Exchanging authorization code for tokens");
+	/**
+	* Exchange authorization code for tokens
+	*
+	* @param callbackUrl - The full callback URL with code parameter from Vipps
+	* @param codeVerifier - PKCE code verifier from initial request
+	* @param expectedState - Expected state value for validation (optional)
+	* @returns Token response with access_token, id_token, and refresh_token
+	*/
+	async exchangeCodeForTokens(callbackUrl, codeVerifier, expectedState) {
+		logger.debug("Exchanging authorization code for tokens");
 		try {
-			let i = await n(await this.getConfig(), typeof e == "string" ? new URL(e) : e, {
-				pkceCodeVerifier: t,
-				expectedState: r,
-				idTokenExpected: !0
+			const config = await this.getConfig();
+			const currentUrl = typeof callbackUrl === "string" ? new URL(callbackUrl) : callbackUrl;
+			const tokens = await openid.authorizationCodeGrant(config, currentUrl, {
+				pkceCodeVerifier: codeVerifier,
+				expectedState,
+				idTokenExpected: true
 			});
-			return d.info({
-				hasAccessToken: !!i.access_token,
-				hasRefreshToken: !!i.refresh_token,
-				hasIdToken: !!i.id_token,
-				expiresIn: i.expires_in
-			}, "Successfully exchanged code for tokens"), i;
-		} catch (e) {
-			throw d.error({ error: e }, "Failed to exchange code for tokens"), e;
+			logger.info({
+				hasAccessToken: !!tokens.access_token,
+				hasRefreshToken: !!tokens.refresh_token,
+				hasIdToken: !!tokens.id_token,
+				expiresIn: tokens.expires_in
+			}, "Successfully exchanged code for tokens");
+			return tokens;
+		} catch (error) {
+			logger.error({ error }, "Failed to exchange code for tokens");
+			throw error;
 		}
 	}
-	async getUserInfo(e) {
-		d.debug("Fetching user info from Vipps");
+	/**
+	* Get user information from Vipps userinfo endpoint
+	*
+	* @param accessToken - Access token from token exchange
+	* @returns Vipps user information
+	*/
+	async getUserInfo(accessToken) {
+		logger.debug("Fetching user info from Vipps");
 		try {
-			let t = (await this.getConfig()).serverMetadata().userinfo_endpoint;
-			if (!t) throw Error("Userinfo endpoint not found in OpenID configuration");
-			let n = await fetch(t, { headers: {
-				Authorization: `Bearer ${e}`,
+			const userinfoUrl = (await this.getConfig()).serverMetadata().userinfo_endpoint;
+			if (!userinfoUrl) throw new Error("Userinfo endpoint not found in OpenID configuration");
+			const response = await fetch(userinfoUrl, { headers: {
+				Authorization: `Bearer ${accessToken}`,
 				...this.config.subscriptionKey && { "Ocp-Apim-Subscription-Key": this.config.subscriptionKey },
 				...this.config.merchantSerialNumber && { "Merchant-Serial-Number": this.config.merchantSerialNumber }
 			} });
-			if (!n.ok) {
-				let e = await n.text();
-				throw d.error({
-					status: n.status,
-					error: e
-				}, "Failed to fetch user info"), Error(`Failed to fetch user info: ${n.status} - ${e}`);
+			if (!response.ok) {
+				const errorText = await response.text();
+				logger.error({
+					status: response.status,
+					error: errorText
+				}, "Failed to fetch user info");
+				throw new Error(`Failed to fetch user info: ${response.status} - ${errorText}`);
 			}
-			let r = await n.json();
-			return d.info({
-				sub: r.sub,
-				hasEmail: !!r.email,
-				hasPhone: !!r.phone_number,
-				hasAddress: !!r.addresses?.length
-			}, "Successfully fetched user info"), r;
-		} catch (e) {
-			throw d.error({ error: e }, "Error fetching user info"), e;
+			const userInfo = await response.json();
+			logger.info({
+				sub: userInfo.sub,
+				hasEmail: !!userInfo.email,
+				hasPhone: !!userInfo.phone_number,
+				hasAddress: !!userInfo.addresses?.length
+			}, "Successfully fetched user info");
+			return userInfo;
+		} catch (error) {
+			logger.error({ error }, "Error fetching user info");
+			throw error;
 		}
 	}
-	async refreshTokens(e) {
-		d.debug("Refreshing access token");
+	/**
+	* Refresh access token using refresh token
+	*
+	* @param refreshToken - Refresh token from initial token exchange
+	* @returns New token response
+	*/
+	async refreshTokens(refreshToken) {
+		logger.debug("Refreshing access token");
 		try {
-			let n = await t(await this.getConfig(), e);
-			return d.info({
-				hasAccessToken: !!n.access_token,
-				hasRefreshToken: !!n.refresh_token,
-				expiresIn: n.expires_in
-			}, "Successfully refreshed tokens"), n;
-		} catch (e) {
-			throw d.error({ error: e }, "Failed to refresh tokens"), e;
+			const config = await this.getConfig();
+			const tokens = await openid.refreshTokenGrant(config, refreshToken);
+			logger.info({
+				hasAccessToken: !!tokens.access_token,
+				hasRefreshToken: !!tokens.refresh_token,
+				expiresIn: tokens.expires_in
+			}, "Successfully refreshed tokens");
+			return tokens;
+		} catch (error) {
+			logger.error({ error }, "Failed to refresh tokens");
+			throw error;
 		}
 	}
 };
 //#endregion
-export { l as VippsEnvironments, f as VippsLoginClient, s as VippsLoginScopes, c as defaultVippsLoginScope, u as getVippsIssuer };
+export { VippsEnvironments, VippsLoginClient, VippsLoginScopes, defaultVippsLoginScope, getVippsIssuer };
+
+//# sourceMappingURL=index.js.map

package/dist/providers/vipps/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../../src/providers/vipps/types.ts","../../../src/providers/vipps/client.ts"],"sourcesContent":["/**\n * Vipps Login Provider Types\n *\n * Type definitions for Vipps Login (OIDC) integration.\n *\n * @see https://developer.vippsmobilepay.com/docs/APIs/login-api/\n */\n\n/**\n * Configuration for Vipps Login client\n */\nexport interface VippsLoginConfig {\n  /** Vipps OIDC issuer URL (e.g., 'https://apitest.vipps.no/access-management-1.0/access') */\n  issuer: string;\n  /** OAuth Client ID from Vipps */\n  clientId: string;\n  /** OAuth Client Secret from Vipps */\n  clientSecret: string;\n  /** OAuth redirect URI (callback URL) */\n  redirectUri: string;\n  /** OpenID Connect scopes (default: 'openid name phoneNumber address email') */\n  scope?: string;\n  /** Vipps subscription key (Ocp-Apim-Subscription-Key) - required for userinfo endpoint */\n  subscriptionKey?: string;\n  /** Merchant serial number - required for userinfo endpoint */\n  merchantSerialNumber?: string;\n}\n\n/**\n * Vipps address from userinfo endpoint\n */\nexport interface VippsAddress {\n  /** Street address */\n  street_address?: string;\n  /** Postal code */\n  postal_code?: string;\n  /** Region/city */\n  region?: string;\n  /** Country code (e.g., 'NO') */\n  country?: string;\n  /** Formatted address string */\n  formatted?: string;\n  /** Address type (e.g., 'home', 'work', 'other') */\n  address_type?: string;\n}\n\n/**\n * User information returned from Vipps Login userinfo endpoint\n *\n * @see https://developer.vippsmobilepay.com/docs/APIs/login-api/login-api-guide/#userinfo-endpoint\n */\nexport interface VippsUserInfo {\n  /** Subject - unique Vipps user identifier (UUID) */\n  sub: string;\n  /** Email address */\n  email?: string;\n  /** Email verification status */\n  email_verified?: boolean;\n  /** Given name (first name) */\n  given_name?: string;\n  /** Family name (last name) */\n  family_name?: string;\n  /** Full name */\n  name?: string;\n  /** Phone number (with country code, e.g., '4712345678') */\n  phone_number?: string;\n  /** Phone number verification status */\n  phone_number_verified?: boolean;\n  /** Birth date (ISO 8601 format, e.g., '1990-01-15') */\n  birthdate?: string;\n  /** Physical addresses (array) */\n  addresses?: VippsAddress[];\n  /** Other claims (deprecated) */\n  other_addresses?: VippsAddress[];\n}\n\n/**\n * Available Vipps Login scopes\n */\nexport const VippsLoginScopes = {\n  /** Required: OpenID Connect base scope */\n  OpenId: 'openid',\n  /** User's name (given_name, family_name, name) */\n  Name: 'name',\n  /** Phone number */\n  PhoneNumber: 'phoneNumber',\n  /** Physical address */\n  Address: 'address',\n  /** Birth date */\n  BirthDate: 'birthDate',\n  /** Email address */\n  Email: 'email',\n} as const;\n\n/**\n * Default scopes for Vipps Login\n */\nexport const defaultVippsLoginScope = [\n  VippsLoginScopes.OpenId,\n  VippsLoginScopes.Name,\n  VippsLoginScopes.PhoneNumber,\n  VippsLoginScopes.Address,\n  VippsLoginScopes.Email,\n].join(' ');\n\n/**\n * Vipps API environments\n */\nexport const VippsEnvironments = {\n  /** Test environment */\n  Test: 'https://apitest.vipps.no',\n  /** Production environment */\n  Production: 'https://api.vipps.no',\n} as const;\n\n/**\n * Get Vipps OIDC issuer URL for environment\n */\nexport function getVippsIssuer(environment: string): string {\n  // Note: Vipps metadata returns issuer with trailing slash\n  return `${environment}/access-management-1.0/access/`;\n}\n","/**\n * Vipps Login Client\n *\n * Client for Vipps Login (OIDC) authentication flow.\n * Implements OAuth/OIDC operations with PKCE for Vipps.\n */\n\nimport * as openid from 'openid-client';\n\nimport { createLogger } from '../../logger';\nimport {\n  buildAuthorizationUrl,\n  buildPKCEOptions,\n  type OAuthConfig,\n  type PKCEOptions,\n} from '../../oauth';\nimport {\n  defaultVippsLoginScope,\n  type VippsLoginConfig,\n  type VippsUserInfo,\n} from './types';\n\nconst logger = createLogger({\n  namespace: 'fides-auth:vipps',\n  context: { module: 'VippsLoginClient' },\n});\n\n/**\n * Vipps Login Client\n *\n * Handles Vipps Login (OIDC) authentication flow using PKCE.\n */\nexport class VippsLoginClient {\n  private readonly config: VippsLoginConfig;\n  private readonly oauthConfig: OAuthConfig;\n  private configPromise: Promise<openid.Configuration> | null = null;\n\n  constructor(config: VippsLoginConfig) {\n    this.config = {\n      ...config,\n      scope: config.scope ?? defaultVippsLoginScope,\n    };\n\n    this.oauthConfig = {\n      issuer: config.issuer,\n      clientId: config.clientId,\n      clientSecret: config.clientSecret,\n      redirect_uri: config.redirectUri,\n      scope: this.config.scope!,\n    };\n\n    logger.info(\n      {\n        issuer: config.issuer,\n        redirectUri: config.redirectUri,\n        scope: this.config.scope,\n      },\n      'VippsLoginClient initialized'\n    );\n  }\n\n  /**\n   * Get OpenID Configuration (cached)\n   * This ensures we use the same Configuration instance across all operations\n   */\n  private async getConfig(): Promise<openid.Configuration> {\n    if (!this.configPromise) {\n      this.configPromise = openid.discovery(\n        new URL(this.oauthConfig.issuer),\n        this.oauthConfig.clientId,\n        this.oauthConfig.clientSecret,\n        openid.ClientSecretPost(this.oauthConfig.clientSecret)\n      );\n    }\n    return this.configPromise;\n  }\n\n  /**\n   * Build PKCE options for authorization flow\n   *\n   * @returns PKCE options including code_verifier, code_challenge, and state\n   */\n  async buildPKCEOptions(): Promise<PKCEOptions> {\n    logger.debug('Building PKCE options');\n    return buildPKCEOptions(this.oauthConfig);\n  }\n\n  /**\n   * Build authorization URL for Vipps Login\n   *\n   * @param pkceOptions - PKCE options from buildPKCEOptions()\n   * @returns Authorization URL to redirect user to\n   */\n  async buildAuthorizationUrl(pkceOptions: PKCEOptions): Promise<URL> {\n    logger.debug('Building authorization URL');\n    const config = await this.getConfig();\n    return buildAuthorizationUrl(config, pkceOptions);\n  }\n\n  /**\n   * Exchange authorization code for tokens\n   *\n   * @param callbackUrl - The full callback URL with code parameter from Vipps\n   * @param codeVerifier - PKCE code verifier from initial request\n   * @param expectedState - Expected state value for validation (optional)\n   * @returns Token response with access_token, id_token, and refresh_token\n   */\n  async exchangeCodeForTokens(\n    callbackUrl: string | URL,\n    codeVerifier: string,\n    expectedState?: string\n  ): Promise<openid.TokenEndpointResponse> {\n    logger.debug('Exchanging authorization code for tokens');\n\n    try {\n      const config = await this.getConfig();\n\n      // Convert to URL if string\n      const currentUrl = typeof callbackUrl === 'string' ? new URL(callbackUrl) : callbackUrl;\n\n      const tokens = await openid.authorizationCodeGrant(config, currentUrl, {\n        pkceCodeVerifier: codeVerifier,\n        expectedState, // Pass the expected state for validation\n        idTokenExpected: true,\n      });\n\n      logger.info(\n        {\n          hasAccessToken: !!tokens.access_token,\n          hasRefreshToken: !!tokens.refresh_token,\n          hasIdToken: !!tokens.id_token,\n          expiresIn: tokens.expires_in,\n        },\n        'Successfully exchanged code for tokens'\n      );\n\n      return tokens;\n    } catch (error) {\n      logger.error({ error }, 'Failed to exchange code for tokens');\n      throw error;\n    }\n  }\n\n  /**\n   * Get user information from Vipps userinfo endpoint\n   *\n   * @param accessToken - Access token from token exchange\n   * @returns Vipps user information\n   */\n  async getUserInfo(accessToken: string): Promise<VippsUserInfo> {\n    logger.debug('Fetching user info from Vipps');\n\n    try {\n      const config = await this.getConfig();\n      const userinfoUrl = config.serverMetadata().userinfo_endpoint;\n\n      if (!userinfoUrl) {\n        throw new Error('Userinfo endpoint not found in OpenID configuration');\n      }\n\n      const response = await fetch(userinfoUrl, {\n        headers: {\n          Authorization: `Bearer ${accessToken}`,\n          ...(this.config.subscriptionKey && {\n            'Ocp-Apim-Subscription-Key': this.config.subscriptionKey,\n          }),\n          ...(this.config.merchantSerialNumber && {\n            'Merchant-Serial-Number': this.config.merchantSerialNumber,\n          }),\n        },\n      });\n\n      if (!response.ok) {\n        const errorText = await response.text();\n        logger.error(\n          {\n            status: response.status,\n            error: errorText,\n          },\n          'Failed to fetch user info'\n        );\n        throw new Error(`Failed to fetch user info: ${response.status} - ${errorText}`);\n      }\n\n      const userInfo = (await response.json()) as VippsUserInfo;\n\n      logger.info(\n        {\n          sub: userInfo.sub,\n          hasEmail: !!userInfo.email,\n          hasPhone: !!userInfo.phone_number,\n          hasAddress: !!userInfo.addresses?.length,\n        },\n        'Successfully fetched user info'\n      );\n\n      return userInfo;\n    } catch (error) {\n      logger.error({ error }, 'Error fetching user info');\n      throw error;\n    }\n  }\n\n  /**\n   * Refresh access token using refresh token\n   *\n   * @param refreshToken - Refresh token from initial token exchange\n   * @returns New token response\n   */\n  async refreshTokens(refreshToken: string): Promise<openid.TokenEndpointResponse> {\n    logger.debug('Refreshing access token');\n\n    try {\n      const config = await this.getConfig();\n      const tokens = await openid.refreshTokenGrant(config, refreshToken);\n\n      logger.info(\n        {\n          hasAccessToken: !!tokens.access_token,\n          hasRefreshToken: !!tokens.refresh_token,\n          expiresIn: tokens.expires_in,\n        },\n        'Successfully refreshed tokens'\n      );\n\n      return tokens;\n    } catch (error) {\n      logger.error({ error }, 'Failed to refresh tokens');\n      throw error;\n    }\n  }\n}\n"],"mappings":";;;;;;;AA+EA,IAAa,mBAAmB;;CAE9B,QAAQ;;CAER,MAAM;;CAEN,aAAa;;CAEb,SAAS;;CAET,WAAW;;CAEX,OAAO;CACR;;;;AAKD,IAAa,yBAAyB;CACpC,iBAAiB;CACjB,iBAAiB;CACjB,iBAAiB;CACjB,iBAAiB;CACjB,iBAAiB;CAClB,CAAC,KAAK,IAAI;;;;AAKX,IAAa,oBAAoB;;CAE/B,MAAM;;CAEN,YAAY;CACb;;;;AAKD,SAAgB,eAAe,aAA6B;AAE1D,QAAO,GAAG,YAAY;;;;;;;;;;AClGxB,IAAM,SAAS,aAAa;CAC1B,WAAW;CACX,SAAS,EAAE,QAAQ,oBAAoB;CACxC,CAAC;;;;;;AAOF,IAAa,mBAAb,MAA8B;CAC5B;CACA;CACA,gBAA8D;CAE9D,YAAY,QAA0B;AACpC,OAAK,SAAS;GACZ,GAAG;GACH,OAAO,OAAO,SAAS;GACxB;AAED,OAAK,cAAc;GACjB,QAAQ,OAAO;GACf,UAAU,OAAO;GACjB,cAAc,OAAO;GACrB,cAAc,OAAO;GACrB,OAAO,KAAK,OAAO;GACpB;AAED,SAAO,KACL;GACE,QAAQ,OAAO;GACf,aAAa,OAAO;GACpB,OAAO,KAAK,OAAO;GACpB,EACD,+BACD;;;;;;CAOH,MAAc,YAA2C;AACvD,MAAI,CAAC,KAAK,cACR,MAAK,gBAAgB,OAAO,UAC1B,IAAI,IAAI,KAAK,YAAY,OAAO,EAChC,KAAK,YAAY,UACjB,KAAK,YAAY,cACjB,OAAO,iBAAiB,KAAK,YAAY,aAAa,CACvD;AAEH,SAAO,KAAK;;;;;;;CAQd,MAAM,mBAAyC;AAC7C,SAAO,MAAM,wBAAwB;AACrC,SAAO,iBAAiB,KAAK,YAAY;;;;;;;;CAS3C,MAAM,sBAAsB,aAAwC;AAClE,SAAO,MAAM,6BAA6B;AAE1C,SAAO,sBAAsB,MADR,KAAK,WAAW,EACA,YAAY;;;;;;;;;;CAWnD,MAAM,sBACJ,aACA,cACA,eACuC;AACvC,SAAO,MAAM,2CAA2C;AAExD,MAAI;GACF,MAAM,SAAS,MAAM,KAAK,WAAW;GAGrC,MAAM,aAAa,OAAO,gBAAgB,WAAW,IAAI,IAAI,YAAY,GAAG;GAE5E,MAAM,SAAS,MAAM,OAAO,uBAAuB,QAAQ,YAAY;IACrE,kBAAkB;IAClB;IACA,iBAAiB;IAClB,CAAC;AAEF,UAAO,KACL;IACE,gBAAgB,CAAC,CAAC,OAAO;IACzB,iBAAiB,CAAC,CAAC,OAAO;IAC1B,YAAY,CAAC,CAAC,OAAO;IACrB,WAAW,OAAO;IACnB,EACD,yCACD;AAED,UAAO;WACA,OAAO;AACd,UAAO,MAAM,EAAE,OAAO,EAAE,qCAAqC;AAC7D,SAAM;;;;;;;;;CAUV,MAAM,YAAY,aAA6C;AAC7D,SAAO,MAAM,gCAAgC;AAE7C,MAAI;GAEF,MAAM,eAAc,MADC,KAAK,WAAW,EACV,gBAAgB,CAAC;AAE5C,OAAI,CAAC,YACH,OAAM,IAAI,MAAM,sDAAsD;GAGxE,MAAM,WAAW,MAAM,MAAM,aAAa,EACxC,SAAS;IACP,eAAe,UAAU;IACzB,GAAI,KAAK,OAAO,mBAAmB,EACjC,6BAA6B,KAAK,OAAO,iBAC1C;IACD,GAAI,KAAK,OAAO,wBAAwB,EACtC,0BAA0B,KAAK,OAAO,sBACvC;IACF,EACF,CAAC;AAEF,OAAI,CAAC,SAAS,IAAI;IAChB,MAAM,YAAY,MAAM,SAAS,MAAM;AACvC,WAAO,MACL;KACE,QAAQ,SAAS;KACjB,OAAO;KACR,EACD,4BACD;AACD,UAAM,IAAI,MAAM,8BAA8B,SAAS,OAAO,KAAK,YAAY;;GAGjF,MAAM,WAAY,MAAM,SAAS,MAAM;AAEvC,UAAO,KACL;IACE,KAAK,SAAS;IACd,UAAU,CAAC,CAAC,SAAS;IACrB,UAAU,CAAC,CAAC,SAAS;IACrB,YAAY,CAAC,CAAC,SAAS,WAAW;IACnC,EACD,iCACD;AAED,UAAO;WACA,OAAO;AACd,UAAO,MAAM,EAAE,OAAO,EAAE,2BAA2B;AACnD,SAAM;;;;;;;;;CAUV,MAAM,cAAc,cAA6D;AAC/E,SAAO,MAAM,0BAA0B;AAEvC,MAAI;GACF,MAAM,SAAS,MAAM,KAAK,WAAW;GACrC,MAAM,SAAS,MAAM,OAAO,kBAAkB,QAAQ,aAAa;AAEnE,UAAO,KACL;IACE,gBAAgB,CAAC,CAAC,OAAO;IACzB,iBAAiB,CAAC,CAAC,OAAO;IAC1B,WAAW,OAAO;IACnB,EACD,gCACD;AAED,UAAO;WACA,OAAO;AACd,UAAO,MAAM,EAAE,OAAO,EAAE,2BAA2B;AACnD,SAAM"}

package/dist/rate-limit.js

@@ -1,26 +1,64 @@
 //#region src/rate-limit.ts
-var e = class {
+/**
+* Token bucket rate limiter for protecting against brute-force attacks.
+*
+* Each key (e.g. IP address, user ID) gets its own bucket. Tokens refill
+* over time at a fixed interval. When a bucket is empty, requests are denied.
+*
+* @typeParam _Key - The type of key used to identify rate-limited entities
+*
+* @example
+* ```typescript
+* const limiter = new TokenBucket<string>(10, 60); // 10 tokens, refill 1/min
+*
+* if (!limiter.consume(ipAddress, 1)) {
+*   throw new Error('Rate limit exceeded');
+* }
+* ```
+*/
+var TokenBucket = class {
 	max;
 	refillIntervalSeconds;
-	constructor(e, t) {
-		this.max = e, this.refillIntervalSeconds = t;
+	constructor(max, refillIntervalSeconds) {
+		this.max = max;
+		this.refillIntervalSeconds = refillIntervalSeconds;
 	}
 	storage = /* @__PURE__ */ new Map();
-	check(e, t) {
-		let n = this.storage.get(e) ?? null;
-		if (n === null) return !0;
-		let r = Math.floor((Date.now() - n.refilledAt) / (this.refillIntervalSeconds * 1e3));
-		return r > 0 ? Math.min(n.count + r, this.max) >= t : n.count >= t;
+	/** Check whether the bucket has enough tokens without consuming any. */
+	check(key, cost) {
+		const bucket = this.storage.get(key) ?? null;
+		if (bucket === null) return true;
+		const refill = Math.floor((Date.now() - bucket.refilledAt) / (this.refillIntervalSeconds * 1e3));
+		if (refill > 0) return Math.min(bucket.count + refill, this.max) >= cost;
+		return bucket.count >= cost;
 	}
-	consume(e, t) {
-		let n = this.storage.get(e) ?? null, r = Date.now();
-		if (n === null) return n = {
-			count: this.max - t,
-			refilledAt: r
-		}, this.storage.set(e, n), !0;
-		let i = Math.floor((r - n.refilledAt) / (this.refillIntervalSeconds * 1e3));
-		return i > 0 && (n.count = Math.min(n.count + i, this.max), n.refilledAt = r), n.count < t ? (this.storage.set(e, n), !1) : (n.count -= t, this.storage.set(e, n), !0);
+	/** Consume tokens from the bucket. Returns `true` if allowed, `false` if rate-limited. */
+	consume(key, cost) {
+		let bucket = this.storage.get(key) ?? null;
+		const now = Date.now();
+		if (bucket === null) {
+			bucket = {
+				count: this.max - cost,
+				refilledAt: now
+			};
+			this.storage.set(key, bucket);
+			return true;
+		}
+		const refill = Math.floor((now - bucket.refilledAt) / (this.refillIntervalSeconds * 1e3));
+		if (refill > 0) {
+			bucket.count = Math.min(bucket.count + refill, this.max);
+			bucket.refilledAt = now;
+		}
+		if (bucket.count < cost) {
+			this.storage.set(key, bucket);
+			return false;
+		}
+		bucket.count -= cost;
+		this.storage.set(key, bucket);
+		return true;
 	}
 };
 //#endregion
-export { e as TokenBucket };
+export { TokenBucket };
+
+//# sourceMappingURL=rate-limit.js.map

package/dist/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","names":[],"sources":["../src/rate-limit.ts"],"sourcesContent":["/**\n * Token bucket rate limiter for protecting against brute-force attacks.\n *\n * Each key (e.g. IP address, user ID) gets its own bucket. Tokens refill\n * over time at a fixed interval. When a bucket is empty, requests are denied.\n *\n * @typeParam _Key - The type of key used to identify rate-limited entities\n *\n * @example\n * ```typescript\n * const limiter = new TokenBucket<string>(10, 60); // 10 tokens, refill 1/min\n *\n * if (!limiter.consume(ipAddress, 1)) {\n *   throw new Error('Rate limit exceeded');\n * }\n * ```\n */\nexport class TokenBucket<_Key> {\n  public max: number;\n  public refillIntervalSeconds: number;\n\n  constructor(max: number, refillIntervalSeconds: number) {\n    this.max = max;\n    this.refillIntervalSeconds = refillIntervalSeconds;\n  }\n\n  private readonly storage = new Map<_Key, Bucket>();\n\n  /** Check whether the bucket has enough tokens without consuming any. */\n  public check(key: _Key, cost: number): boolean {\n    const bucket = this.storage.get(key) ?? null;\n    if (bucket === null) {\n      return true;\n    }\n    const now = Date.now();\n    const refill = Math.floor((now - bucket.refilledAt) / (this.refillIntervalSeconds * 1000));\n    if (refill > 0) {\n      return Math.min(bucket.count + refill, this.max) >= cost;\n    }\n    return bucket.count >= cost;\n  }\n\n  /** Consume tokens from the bucket. Returns `true` if allowed, `false` if rate-limited. */\n  public consume(key: _Key, cost: number): boolean {\n    let bucket = this.storage.get(key) ?? null;\n    const now = Date.now();\n    if (bucket === null) {\n      bucket = {\n        count: this.max - cost,\n        refilledAt: now,\n      };\n      this.storage.set(key, bucket);\n      return true;\n    }\n    const refill = Math.floor((now - bucket.refilledAt) / (this.refillIntervalSeconds * 1000));\n    if (refill > 0) {\n      bucket.count = Math.min(bucket.count + refill, this.max);\n      bucket.refilledAt = now;\n    }\n    if (bucket.count < cost) {\n      this.storage.set(key, bucket);\n      return false;\n    }\n    bucket.count -= cost;\n    this.storage.set(key, bucket);\n    return true;\n  }\n}\ninterface Bucket {\n  count: number;\n  refilledAt: number;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAiBA,IAAa,cAAb,MAA+B;CAC7B;CACA;CAEA,YAAY,KAAa,uBAA+B;AACtD,OAAK,MAAM;AACX,OAAK,wBAAwB;;CAG/B,0BAA2B,IAAI,KAAmB;;CAGlD,MAAa,KAAW,MAAuB;EAC7C,MAAM,SAAS,KAAK,QAAQ,IAAI,IAAI,IAAI;AACxC,MAAI,WAAW,KACb,QAAO;EAGT,MAAM,SAAS,KAAK,OADR,KAAK,KACU,GAAM,OAAO,eAAe,KAAK,wBAAwB,KAAM;AAC1F,MAAI,SAAS,EACX,QAAO,KAAK,IAAI,OAAO,QAAQ,QAAQ,KAAK,IAAI,IAAI;AAEtD,SAAO,OAAO,SAAS;;;CAIzB,QAAe,KAAW,MAAuB;EAC/C,IAAI,SAAS,KAAK,QAAQ,IAAI,IAAI,IAAI;EACtC,MAAM,MAAM,KAAK,KAAK;AACtB,MAAI,WAAW,MAAM;AACnB,YAAS;IACP,OAAO,KAAK,MAAM;IAClB,YAAY;IACb;AACD,QAAK,QAAQ,IAAI,KAAK,OAAO;AAC7B,UAAO;;EAET,MAAM,SAAS,KAAK,OAAO,MAAM,OAAO,eAAe,KAAK,wBAAwB,KAAM;AAC1F,MAAI,SAAS,GAAG;AACd,UAAO,QAAQ,KAAK,IAAI,OAAO,QAAQ,QAAQ,KAAK,IAAI;AACxD,UAAO,aAAa;;AAEtB,MAAI,OAAO,QAAQ,MAAM;AACvB,QAAK,QAAQ,IAAI,KAAK,OAAO;AAC7B,UAAO;;AAET,SAAO,SAAS;AAChB,OAAK,QAAQ,IAAI,KAAK,OAAO;AAC7B,SAAO"}

package/dist/session-refresh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-refresh.d.ts","sourceRoot":"","sources":["../src/session-refresh.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAsB,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAIxD;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GACzB,iBAAiB,OAAO,EACxB,QAAQ,WAAW,EACnB,UAAS,oBAAyB,KACjC,OAAO,CAAC,OAAO,GAAG,IAAI,CA6CxB,CAAC"}
+{"version":3,"file":"session-refresh.d.ts","sourceRoot":"","sources":["../src/session-refresh.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAsB,MAAM,SAAS,CAAC;AAE1D,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAIxD;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GACzB,iBAAiB,OAAO,EACxB,QAAQ,WAAW,EACnB,UAAS,oBAAyB,KACjC,OAAO,CAAC,OAAO,GAAG,IAAI,CA8CxB,CAAC"}

package/dist/session-refresh.js

@@ -1,27 +1,48 @@
-import { createLogger as e } from "./logger.js";
-import { refreshAccessToken as t } from "./oauth.js";
+import { createLogger } from "./logger.js";
+import { getOAuthErrorLogContext } from "./oauth-logging.js";
+import { refreshAccessToken } from "./oauth.js";
 //#region src/session-refresh.ts
-var n = e({ namespace: "fides-auth:session-refresh" }), r = async (e, r, i = {}) => {
-	if (n.debug("Starting session refresh"), !e.tokens?.refreshToken) throw n.error("No refresh token available in session"), Error("No refresh token available");
+var logger = createLogger({ namespace: "fides-auth:session-refresh" });
+/**
+* Refreshes an existing session by exchanging its refresh token for new tokens.
+*
+* @param current_session - The current session containing a refresh token
+* @param config - OAuth configuration for the identity provider
+* @param options - Optional session creation options
+* @returns The updated session with new tokens, or throws on failure
+* @throws Error if no refresh token is available or the token exchange fails
+*/
+var refreshSession = async (current_session, config, options = {}) => {
+	logger.debug("Starting session refresh");
+	if (!current_session.tokens?.refreshToken) {
+		logger.error("No refresh token available in session");
+		throw new Error("No refresh token available");
+	}
 	try {
-		let i = await t(r, e.tokens.refreshToken), a = {
-			...e,
+		const newtokens = await refreshAccessToken(config, current_session.tokens.refreshToken);
+		const updatedSession = {
+			...current_session,
 			tokens: {
-				...e.tokens,
-				accessToken: i.access_token,
-				accessTokenExpiresAt: i.expires_in ? new Date(Date.now() + i.expires_in * 1e3) : void 0,
-				refreshToken: i.refresh_token ?? e.tokens?.refreshToken
+				...current_session.tokens,
+				accessToken: newtokens.access_token,
+				accessTokenExpiresAt: newtokens.expires_in ? new Date(Date.now() + newtokens.expires_in * 1e3) : void 0,
+				refreshToken: newtokens.refresh_token ?? current_session.tokens?.refreshToken
 			}
 		};
-		return n.info({
-			hasNewAccessToken: !!a.tokens.accessToken,
-			hasNewRefreshToken: !!i.refresh_token,
-			expiresIn: i.expires_in
-		}, "Session refreshed successfully"), a;
-	} catch (e) {
-		let t = e;
-		throw t?.code === "OAUTH_RESPONSE_BODY_ERROR" && t?.error === "invalid_grant" ? n.info("Session refresh failed - refresh token expired or invalid") : n.error({ error: e }, "Session refresh failed"), e;
+		logger.info({
+			hasNewAccessToken: !!updatedSession.tokens.accessToken,
+			hasNewRefreshToken: !!newtokens.refresh_token,
+			expiresIn: newtokens.expires_in
+		}, "Session refreshed successfully");
+		return updatedSession;
+	} catch (error) {
+		const errorContext = getOAuthErrorLogContext(error);
+		if (errorContext.code === "OAUTH_RESPONSE_BODY_ERROR" && errorContext.error === "invalid_grant") logger.info("Session refresh failed - refresh token expired or invalid");
+		else logger.error({ error: errorContext }, "Session refresh failed");
+		throw error;
 	}
 };
 //#endregion
-export { r as refreshSession };
+export { refreshSession };
+
+//# sourceMappingURL=session-refresh.js.map

package/dist/session-refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-refresh.js","names":[],"sources":["../src/session-refresh.ts"],"sourcesContent":["import { createLogger } from './logger';\nimport { OAuthConfig, refreshAccessToken } from \"./oauth\";\nimport { getOAuthErrorLogContext } from './oauth-logging';\nimport { CreateSessionOptions, Session } from \"./types\";\n\nconst logger = createLogger({ namespace: 'fides-auth:session-refresh' });\n\n/**\n * Refreshes an existing session by exchanging its refresh token for new tokens.\n *\n * @param current_session - The current session containing a refresh token\n * @param config - OAuth configuration for the identity provider\n * @param options - Optional session creation options\n * @returns The updated session with new tokens, or throws on failure\n * @throws Error if no refresh token is available or the token exchange fails\n */\nexport const refreshSession = async (\n  current_session: Session,\n  config: OAuthConfig,\n  options: CreateSessionOptions = {}\n): Promise<Session | null> => {\n  logger.debug('Starting session refresh');\n\n  if (!current_session.tokens?.refreshToken) {\n    logger.error('No refresh token available in session');\n    throw new Error('No refresh token available');\n  }\n\n  try {\n    const newtokens = await refreshAccessToken(config, current_session.tokens.refreshToken);\n\n    const updatedSession = {\n      ...current_session,\n      tokens: {\n        ...current_session.tokens,\n        accessToken: newtokens.access_token,\n        accessTokenExpiresAt: newtokens.expires_in\n          ? new Date(Date.now() + newtokens.expires_in * 1000)\n          : undefined,\n        refreshToken: newtokens.refresh_token ?? current_session.tokens?.refreshToken,\n      },\n    };\n\n    logger.info({\n      hasNewAccessToken: !!updatedSession.tokens.accessToken,\n      hasNewRefreshToken: !!newtokens.refresh_token,\n      expiresIn: newtokens.expires_in,\n    }, 'Session refreshed successfully');\n\n    return updatedSession;\n  } catch (error) {\n    // Check if this is an expected invalid_grant error\n    const errorContext = getOAuthErrorLogContext(error);\n    const isInvalidGrant =\n      errorContext.code === 'OAUTH_RESPONSE_BODY_ERROR' && errorContext.error === 'invalid_grant';\n\n    if (isInvalidGrant) {\n      // Expected error during logout/session expiry - log at info level\n      logger.info('Session refresh failed - refresh token expired or invalid');\n    } else {\n      // Unexpected error - log at error level\n      logger.error({ error: errorContext }, 'Session refresh failed');\n    }\n\n    throw error;\n  }\n};\n\n"],"mappings":";;;;AAKA,IAAM,SAAS,aAAa,EAAE,WAAW,8BAA8B,CAAC;;;;;;;;;;AAWxE,IAAa,iBAAiB,OAC5B,iBACA,QACA,UAAgC,EAAE,KACN;AAC5B,QAAO,MAAM,2BAA2B;AAExC,KAAI,CAAC,gBAAgB,QAAQ,cAAc;AACzC,SAAO,MAAM,wCAAwC;AACrD,QAAM,IAAI,MAAM,6BAA6B;;AAG/C,KAAI;EACF,MAAM,YAAY,MAAM,mBAAmB,QAAQ,gBAAgB,OAAO,aAAa;EAEvF,MAAM,iBAAiB;GACrB,GAAG;GACH,QAAQ;IACN,GAAG,gBAAgB;IACnB,aAAa,UAAU;IACvB,sBAAsB,UAAU,aAC5B,IAAI,KAAK,KAAK,KAAK,GAAG,UAAU,aAAa,IAAK,GAClD,KAAA;IACJ,cAAc,UAAU,iBAAiB,gBAAgB,QAAQ;IAClE;GACF;AAED,SAAO,KAAK;GACV,mBAAmB,CAAC,CAAC,eAAe,OAAO;GAC3C,oBAAoB,CAAC,CAAC,UAAU;GAChC,WAAW,UAAU;GACtB,EAAE,iCAAiC;AAEpC,SAAO;UACA,OAAO;EAEd,MAAM,eAAe,wBAAwB,MAAM;AAInD,MAFE,aAAa,SAAS,+BAA+B,aAAa,UAAU,gBAI5E,QAAO,KAAK,4DAA4D;MAGxE,QAAO,MAAM,EAAE,OAAO,cAAc,EAAE,yBAAyB;AAGjE,QAAM"}

package/dist/session-validation.js

@@ -1,2 +1,77 @@
-import { n as e, t } from "./session-validation-BxObT3wC.js";
-export { t as isSession, e as validateSessionJwt };
+import { createLogger } from "./logger.js";
+import { hexToUint8Array } from "./utils.js";
+import { decodeJwt, jwtDecrypt } from "jose";
+//#region src/session-validation.ts
+var logger = createLogger({ namespace: "fides-auth:session-validation" });
+/**
+* Validates an encrypted JWT and checks for expiration.
+*
+* @param encryptedJwt The encrypted JWT string to validate
+* @param secret The decryption key as a hex string or Uint8Array (32 bytes for A256GCM)
+* @returns Session and SessionValidationResult indicating whether it's valid or not,
+*          plus accessTokenExpiresIn if valid
+*/
+async function validateSessionJwt(encryptedJwt, secret) {
+	logger.debug("Starting session JWT validation");
+	const secretBytes = typeof secret === "string" ? hexToUint8Array(secret) : secret;
+	let payload;
+	try {
+		({payload} = await jwtDecrypt(encryptedJwt, secretBytes));
+	} catch (error) {
+		const errorMessage = error instanceof Error ? error.message : "Failed decrypting JWT";
+		logger.warn({ reason: errorMessage }, "Session JWT decryption failed");
+		return {
+			status: "INVALID",
+			reason: `Decryption error: ${errorMessage}`
+		};
+	}
+	if (!isSession(payload)) {
+		logger.warn("JWT payload does not match Session structure");
+		return {
+			status: "INVALID",
+			reason: "jwt does not seem to include a session"
+		};
+	}
+	logger.debug("Session validated successfully");
+	const expiresIn = computeAccessTokenExpiresIn(payload);
+	if (expiresIn !== void 0 && expiresIn <= 0) {
+		logger.info({ accessTokenExpiresIn: expiresIn }, "Session access token has expired");
+		return {
+			session: payload,
+			status: "EXPIRED",
+			accessTokenExpiresIn: expiresIn,
+			reason: "Access token has expired"
+		};
+	}
+	return {
+		session: payload,
+		status: "VALID",
+		accessTokenExpiresIn: expiresIn
+	};
+}
+/**
+* Computes the number of seconds until the access token expires.
+* Returns undefined if no expiry can be determined.
+*/
+function computeAccessTokenExpiresIn(session) {
+	const accessToken = session.tokens?.accessToken;
+	if (!accessToken) return;
+	try {
+		const { exp } = decodeJwt(accessToken);
+		if (typeof exp !== "number") return;
+		return Math.floor(exp - Date.now() / 1e3);
+	} catch {
+		return;
+	}
+}
+/** Type guard that checks whether an unknown value conforms to the {@link Session} shape. */
+function isSession(object) {
+	if (typeof object !== "object" || object === null) return false;
+	if ("tokens" in object && typeof object.tokens !== "object") return false;
+	if ("user" in object && typeof object.user !== "object") return false;
+	return true;
+}
+//#endregion
+export { isSession, validateSessionJwt };
+
+//# sourceMappingURL=session-validation.js.map

package/dist/session-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-validation.js","names":[],"sources":["../src/session-validation.ts"],"sourcesContent":["// session-validation.ts\n\nimport { jwtDecrypt, decodeJwt } from 'jose';\n\nimport { createLogger } from './logger';\nimport { hexToUint8Array } from './utils';\nimport { Session } from './types';\n\nconst logger = createLogger({ namespace: 'fides-auth:session-validation' });\n\n/** Result of validating an encrypted session JWT. */\nexport interface SessionValidationResult {\n  /** The decoded session, if valid. */\n  session?: Session;\n  /** Validation status: VALID, INVALID (decryption/format error), or EXPIRED. */\n  status: 'VALID' | 'INVALID' | 'EXPIRED';\n  /** Seconds until the access token expires (negative means already expired). */\n  accessTokenExpiresIn?: number;\n  /** Human-readable reason when status is not VALID. */\n  reason?: string;\n}\n\n/**\n * Validates an encrypted JWT and checks for expiration.\n *\n * @param encryptedJwt The encrypted JWT string to validate\n * @param secret The decryption key as a hex string or Uint8Array (32 bytes for A256GCM)\n * @returns Session and SessionValidationResult indicating whether it's valid or not,\n *          plus accessTokenExpiresIn if valid\n */\nexport async function validateSessionJwt(\n  encryptedJwt: string,\n  secret: string | Uint8Array,\n): Promise<SessionValidationResult> {\n  logger.debug('Starting session JWT validation');\n\n  const secretBytes = typeof secret === 'string'\n    ? hexToUint8Array(secret)\n    : secret;\n\n  let payload: unknown;\n  try {\n    ({ payload } = await jwtDecrypt(encryptedJwt, secretBytes));\n  } catch (error) {\n    const errorMessage = error instanceof Error ? error.message : 'Failed decrypting JWT';\n    logger.warn({ reason: errorMessage }, 'Session JWT decryption failed');\n    return {\n      status: 'INVALID',\n      reason: `Decryption error: ${errorMessage}`\n    };\n  }\n\n  // Check if payload has the shape of a Session\n  if (!isSession(payload)) {\n    logger.warn('JWT payload does not match Session structure');\n    return {\n      status: 'INVALID',\n      reason: 'jwt does not seem to include a session'\n    };\n  }\n\n  logger.debug('Session validated successfully');\n\n  // Check access token expiry if available\n  const expiresIn = computeAccessTokenExpiresIn(payload);\n\n  if (expiresIn !== undefined && expiresIn <= 0) {\n    logger.info({ accessTokenExpiresIn: expiresIn }, 'Session access token has expired');\n    return {\n      session: payload,\n      status: 'EXPIRED',\n      accessTokenExpiresIn: expiresIn,\n      reason: 'Access token has expired',\n    };\n  }\n\n  return {\n    session: payload,\n    status: 'VALID',\n    accessTokenExpiresIn: expiresIn,\n  };\n}\n\n/**\n * Computes the number of seconds until the access token expires.\n * Returns undefined if no expiry can be determined.\n */\nfunction computeAccessTokenExpiresIn(session: Session): number | undefined {\n  const accessToken = session.tokens?.accessToken;\n  if (!accessToken) {\n    return undefined;\n  }\n\n  try {\n    const { exp } = decodeJwt(accessToken);\n    if (typeof exp !== 'number') {\n      return undefined;\n    }\n    return Math.floor(exp - Date.now() / 1000);\n  } catch {\n    // Not a valid JWT or can't decode — ignore\n    return undefined;\n  }\n}\n\n\n/** Type guard that checks whether an unknown value conforms to the {@link Session} shape. */\nexport function isSession(object: unknown): object is Session {\n  if (typeof object !== 'object' || object === null) {\n    return false;\n  }\n\n  if (\n    'tokens' in object &&\n    typeof (object as any).tokens !== 'object'\n  ) {\n    return false;\n  }\n\n  if (\n    'user' in object &&\n    typeof (object as any).user !== 'object'\n  ) {\n    return false;\n  }\n\n  // Seems to be a real session\n  return true;\n}\n"],"mappings":";;;;AAQA,IAAM,SAAS,aAAa,EAAE,WAAW,iCAAiC,CAAC;;;;;;;;;AAsB3E,eAAsB,mBACpB,cACA,QACkC;AAClC,QAAO,MAAM,kCAAkC;CAE/C,MAAM,cAAc,OAAO,WAAW,WAClC,gBAAgB,OAAO,GACvB;CAEJ,IAAI;AACJ,KAAI;AACF,GAAC,CAAE,WAAY,MAAM,WAAW,cAAc,YAAY;UACnD,OAAO;EACd,MAAM,eAAe,iBAAiB,QAAQ,MAAM,UAAU;AAC9D,SAAO,KAAK,EAAE,QAAQ,cAAc,EAAE,gCAAgC;AACtE,SAAO;GACL,QAAQ;GACR,QAAQ,qBAAqB;GAC9B;;AAIH,KAAI,CAAC,UAAU,QAAQ,EAAE;AACvB,SAAO,KAAK,+CAA+C;AAC3D,SAAO;GACL,QAAQ;GACR,QAAQ;GACT;;AAGH,QAAO,MAAM,iCAAiC;CAG9C,MAAM,YAAY,4BAA4B,QAAQ;AAEtD,KAAI,cAAc,KAAA,KAAa,aAAa,GAAG;AAC7C,SAAO,KAAK,EAAE,sBAAsB,WAAW,EAAE,mCAAmC;AACpF,SAAO;GACL,SAAS;GACT,QAAQ;GACR,sBAAsB;GACtB,QAAQ;GACT;;AAGH,QAAO;EACL,SAAS;EACT,QAAQ;EACR,sBAAsB;EACvB;;;;;;AAOH,SAAS,4BAA4B,SAAsC;CACzE,MAAM,cAAc,QAAQ,QAAQ;AACpC,KAAI,CAAC,YACH;AAGF,KAAI;EACF,MAAM,EAAE,QAAQ,UAAU,YAAY;AACtC,MAAI,OAAO,QAAQ,SACjB;AAEF,SAAO,KAAK,MAAM,MAAM,KAAK,KAAK,GAAG,IAAK;SACpC;AAEN;;;;AAMJ,SAAgB,UAAU,QAAoC;AAC5D,KAAI,OAAO,WAAW,YAAY,WAAW,KAC3C,QAAO;AAGT,KACE,YAAY,UACZ,OAAQ,OAAe,WAAW,SAElC,QAAO;AAGT,KACE,UAAU,UACV,OAAQ,OAAe,SAAS,SAEhC,QAAO;AAIT,QAAO"}