@eventuras/fides-auth 0.5.0 → 0.7.0

package/dist/silent-login.js

@@ -1,50 +1,150 @@
-import { createLogger as e } from "./logger.js";
-import { o as t, r as n, t as r } from "./build-nL2--iMi.js";
+import { createLogger } from "./logger.js";
+import * as openid from "openid-client";
 //#region src/silent-login.ts
-var i = e({ namespace: "fides-auth:silent-login" });
-async function a(e, a = {}) {
-	i.debug({ issuer: e.issuer }, "Building silent login URL");
+/**
+* Silent login functionality for OAuth flows.
+*
+* Silent login (also called "prompt=none") attempts to authenticate the user
+* without any user interaction. This is useful for:
+* - Checking if a user has an active SSO session
+* - Refreshing authentication silently in the background
+* - Implementing "keep me logged in" features
+*/
+var logger = createLogger({ namespace: "fides-auth:silent-login" });
+/**
+* Builds an authorization URL for silent authentication.
+*
+* This function creates an authorization URL with prompt=none,
+* which tells the OAuth provider to authenticate without user interaction.
+* If the user doesn't have an active session, the provider will return an error.
+*
+* @param config - OAuth configuration
+* @param options - Silent login options
+* @returns Authorization URL for silent authentication
+*
+* @example
+* ```ts
+* const silentAuthUrl = await buildSilentLoginUrl(oauthConfig, {
+*   loginHint: 'user@example.com',
+*   maxAge: 3600, // Require authentication within last hour
+* });
+*
+* // Use this URL in an iframe or hidden window
+* ```
+*/
+async function buildSilentLoginUrl(config, options = {}) {
+	logger.debug({ issuer: config.issuer }, "Building silent login URL");
 	try {
-		let o = await t(new URL(e.issuer), e.clientId, e.clientSecret, r(e.clientSecret)), s = {
-			redirect_uri: e.redirect_uri,
-			scope: e.scope,
+		const server = await openid.discovery(new URL(config.issuer), config.clientId, config.clientSecret, openid.ClientSecretPost(config.clientSecret));
+		const parameters = {
+			redirect_uri: config.redirect_uri,
+			scope: config.scope,
 			prompt: "none",
 			response_type: "code",
-			...a.additionalParams
+			...options.additionalParams
 		};
-		a.loginHint && (s.login_hint = a.loginHint), a.maxAge !== void 0 && (s.max_age = a.maxAge.toString());
-		let c = n(o, s);
-		return i.info("Silent login URL built successfully"), c;
-	} catch (t) {
-		throw i.error({
-			error: t,
-			issuer: e.issuer
-		}, "Failed to build silent login URL"), t;
+		if (options.loginHint) parameters.login_hint = options.loginHint;
+		if (options.maxAge !== void 0) parameters.max_age = options.maxAge.toString();
+		const authUrl = openid.buildAuthorizationUrl(server, parameters);
+		logger.info("Silent login URL built successfully");
+		return authUrl;
+	} catch (error) {
+		logger.error({
+			error,
+			issuer: config.issuer
+		}, "Failed to build silent login URL");
+		throw error;
 	}
 }
-function o(e) {
-	let t = e.searchParams.get("error"), n = e.searchParams.get("error_description"), r = e.searchParams.get("code");
-	return t ? (i.info({
-		error: t,
-		errorDescription: n
-	}, "Silent login failed with error"), {
-		success: !1,
-		error: t,
-		errorDescription: n ?? void 0
-	}) : r ? (i.info("Silent login successful"), { success: !0 }) : (i.warn("Silent login callback missing both code and error"), {
-		success: !1,
+/**
+* Checks if silent login is possible by examining the callback URL.
+*
+* After redirecting to the silent login URL, the OAuth provider will redirect back
+* with either a code (success) or an error (failure). This function parses the
+* callback URL to determine the result.
+*
+* @param callbackUrl - The URL the OAuth provider redirected to
+* @returns Result indicating success or failure with details
+*
+* @example
+* ```ts
+* // In your OAuth callback handler
+* const result = checkSilentLoginResult(new URL(request.url));
+*
+* if (result.success) {
+*   // User has active SSO session, proceed with token exchange
+*   const code = new URL(request.url).searchParams.get('code');
+*   // ... exchange code for tokens
+* } else if (result.error === 'login_required') {
+*   // User needs to log in interactively
+*   redirect('/login');
+* } else {
+*   // Other error
+*   console.error(result.errorDescription);
+* }
+* ```
+*/
+function checkSilentLoginResult(callbackUrl) {
+	const error = callbackUrl.searchParams.get("error");
+	const errorDescription = callbackUrl.searchParams.get("error_description");
+	const code = callbackUrl.searchParams.get("code");
+	if (error) {
+		logger.info({
+			error,
+			errorDescription
+		}, "Silent login failed with error");
+		return {
+			success: false,
+			error,
+			errorDescription: errorDescription ?? void 0
+		};
+	}
+	if (code) {
+		logger.info("Silent login successful");
+		return { success: true };
+	}
+	logger.warn("Silent login callback missing both code and error");
+	return {
+		success: false,
 		error: "invalid_callback",
 		errorDescription: "Callback URL missing both code and error parameters"
-	});
+	};
 }
-var s = {
+/**
+* Common OAuth errors returned from silent login attempts.
+*
+* These can be used to handle specific error cases:
+* - login_required: User must log in interactively
+* - interaction_required: User interaction is needed (e.g., consent)
+* - consent_required: User must grant consent
+* - account_selection_required: User must select an account
+*/
+var SilentLoginErrors = {
 	LOGIN_REQUIRED: "login_required",
 	INTERACTION_REQUIRED: "interaction_required",
 	CONSENT_REQUIRED: "consent_required",
 	ACCOUNT_SELECTION_REQUIRED: "account_selection_required"
 };
-function c(e) {
-	return e ? Object.values(s).includes(e) : !1;
+/**
+* Helper to check if an error requires interactive login.
+*
+* @param error - The error code from the OAuth provider
+* @returns True if the user must log in interactively
+*
+* @example
+* ```ts
+* const result = checkSilentLoginResult(callbackUrl);
+* if (!result.success && requiresInteractiveLogin(result.error)) {
+*   // Redirect to full login page
+*   redirect('/login');
+* }
+* ```
+*/
+function requiresInteractiveLogin(error) {
+	if (!error) return false;
+	return Object.values(SilentLoginErrors).includes(error);
 }
 //#endregion
-export { s as SilentLoginErrors, a as buildSilentLoginUrl, o as checkSilentLoginResult, c as requiresInteractiveLogin };
+export { SilentLoginErrors, buildSilentLoginUrl, checkSilentLoginResult, requiresInteractiveLogin };
+
+//# sourceMappingURL=silent-login.js.map

package/dist/silent-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"silent-login.js","names":[],"sources":["../src/silent-login.ts"],"sourcesContent":["/**\n * Silent login functionality for OAuth flows.\n *\n * Silent login (also called \"prompt=none\") attempts to authenticate the user\n * without any user interaction. This is useful for:\n * - Checking if a user has an active SSO session\n * - Refreshing authentication silently in the background\n * - Implementing \"keep me logged in\" features\n */\n\nimport * as openid from 'openid-client';\n\nimport { createLogger } from './logger';\nimport { OAuthConfig } from './oauth';\n\nconst logger = createLogger({ namespace: 'fides-auth:silent-login' });\n\nexport interface SilentLoginOptions {\n  /** Optional hint about the user's identity (e.g., email or user ID) */\n  loginHint?: string;\n  /** Maximum age of authentication in seconds */\n  maxAge?: number;\n  /** Additional parameters to pass to the authorization endpoint */\n  additionalParams?: Record<string, string>;\n}\n\nexport interface SilentLoginResult {\n  /** Whether silent login was successful */\n  success: boolean;\n  /** The authorization URL to use (only if success is true) */\n  authorizationUrl?: URL;\n  /** Error message if silent login failed */\n  error?: string;\n  /** Detailed error description from OAuth provider */\n  errorDescription?: string;\n}\n\n/**\n * Builds an authorization URL for silent authentication.\n *\n * This function creates an authorization URL with prompt=none,\n * which tells the OAuth provider to authenticate without user interaction.\n * If the user doesn't have an active session, the provider will return an error.\n *\n * @param config - OAuth configuration\n * @param options - Silent login options\n * @returns Authorization URL for silent authentication\n *\n * @example\n * ```ts\n * const silentAuthUrl = await buildSilentLoginUrl(oauthConfig, {\n *   loginHint: 'user@example.com',\n *   maxAge: 3600, // Require authentication within last hour\n * });\n *\n * // Use this URL in an iframe or hidden window\n * ```\n */\nexport async function buildSilentLoginUrl(\n  config: OAuthConfig,\n  options: SilentLoginOptions = {}\n): Promise<URL> {\n  logger.debug({ issuer: config.issuer }, 'Building silent login URL');\n\n  try {\n    const server = await openid.discovery(\n      new URL(config.issuer),\n      config.clientId,\n      config.clientSecret,\n      openid.ClientSecretPost(config.clientSecret)\n    );\n\n    const parameters: Record<string, string> = {\n      redirect_uri: config.redirect_uri,\n      scope: config.scope,\n      prompt: 'none', // Critical: tells provider to not show any UI\n      response_type: 'code',\n      ...options.additionalParams,\n    };\n\n    // Add optional parameters\n    if (options.loginHint) {\n      parameters.login_hint = options.loginHint;\n    }\n\n    if (options.maxAge !== undefined) {\n      parameters.max_age = options.maxAge.toString();\n    }\n\n    const authUrl = openid.buildAuthorizationUrl(server, parameters);\n\n    logger.info('Silent login URL built successfully');\n    return authUrl;\n  } catch (error) {\n    logger.error({ error, issuer: config.issuer }, 'Failed to build silent login URL');\n    throw error;\n  }\n}\n\n/**\n * Checks if silent login is possible by examining the callback URL.\n *\n * After redirecting to the silent login URL, the OAuth provider will redirect back\n * with either a code (success) or an error (failure). This function parses the\n * callback URL to determine the result.\n *\n * @param callbackUrl - The URL the OAuth provider redirected to\n * @returns Result indicating success or failure with details\n *\n * @example\n * ```ts\n * // In your OAuth callback handler\n * const result = checkSilentLoginResult(new URL(request.url));\n *\n * if (result.success) {\n *   // User has active SSO session, proceed with token exchange\n *   const code = new URL(request.url).searchParams.get('code');\n *   // ... exchange code for tokens\n * } else if (result.error === 'login_required') {\n *   // User needs to log in interactively\n *   redirect('/login');\n * } else {\n *   // Other error\n *   console.error(result.errorDescription);\n * }\n * ```\n */\nexport function checkSilentLoginResult(callbackUrl: URL): SilentLoginResult {\n  const error = callbackUrl.searchParams.get('error');\n  const errorDescription = callbackUrl.searchParams.get('error_description');\n  const code = callbackUrl.searchParams.get('code');\n\n  if (error) {\n    logger.info({ error, errorDescription }, 'Silent login failed with error');\n\n    return {\n      success: false,\n      error,\n      errorDescription: errorDescription ?? undefined,\n    };\n  }\n\n  if (code) {\n    logger.info('Silent login successful');\n    return {\n      success: true,\n    };\n  }\n\n  logger.warn('Silent login callback missing both code and error');\n  return {\n    success: false,\n    error: 'invalid_callback',\n    errorDescription: 'Callback URL missing both code and error parameters',\n  };\n}\n\n/**\n * Common OAuth errors returned from silent login attempts.\n *\n * These can be used to handle specific error cases:\n * - login_required: User must log in interactively\n * - interaction_required: User interaction is needed (e.g., consent)\n * - consent_required: User must grant consent\n * - account_selection_required: User must select an account\n */\nexport const SilentLoginErrors = {\n  LOGIN_REQUIRED: 'login_required',\n  INTERACTION_REQUIRED: 'interaction_required',\n  CONSENT_REQUIRED: 'consent_required',\n  ACCOUNT_SELECTION_REQUIRED: 'account_selection_required',\n} as const;\n\nexport type SilentLoginError = typeof SilentLoginErrors[keyof typeof SilentLoginErrors];\n\n/**\n * Helper to check if an error requires interactive login.\n *\n * @param error - The error code from the OAuth provider\n * @returns True if the user must log in interactively\n *\n * @example\n * ```ts\n * const result = checkSilentLoginResult(callbackUrl);\n * if (!result.success && requiresInteractiveLogin(result.error)) {\n *   // Redirect to full login page\n *   redirect('/login');\n * }\n * ```\n */\nexport function requiresInteractiveLogin(error: string | undefined): boolean {\n  if (!error) return false;\n\n  return Object.values(SilentLoginErrors).includes(error as SilentLoginError);\n}\n"],"mappings":";;;;;;;;;;;;AAeA,IAAM,SAAS,aAAa,EAAE,WAAW,2BAA2B,CAAC;;;;;;;;;;;;;;;;;;;;;;AA2CrE,eAAsB,oBACpB,QACA,UAA8B,EAAE,EAClB;AACd,QAAO,MAAM,EAAE,QAAQ,OAAO,QAAQ,EAAE,4BAA4B;AAEpE,KAAI;EACF,MAAM,SAAS,MAAM,OAAO,UAC1B,IAAI,IAAI,OAAO,OAAO,EACtB,OAAO,UACP,OAAO,cACP,OAAO,iBAAiB,OAAO,aAAa,CAC7C;EAED,MAAM,aAAqC;GACzC,cAAc,OAAO;GACrB,OAAO,OAAO;GACd,QAAQ;GACR,eAAe;GACf,GAAG,QAAQ;GACZ;AAGD,MAAI,QAAQ,UACV,YAAW,aAAa,QAAQ;AAGlC,MAAI,QAAQ,WAAW,KAAA,EACrB,YAAW,UAAU,QAAQ,OAAO,UAAU;EAGhD,MAAM,UAAU,OAAO,sBAAsB,QAAQ,WAAW;AAEhE,SAAO,KAAK,sCAAsC;AAClD,SAAO;UACA,OAAO;AACd,SAAO,MAAM;GAAE;GAAO,QAAQ,OAAO;GAAQ,EAAE,mCAAmC;AAClF,QAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCV,SAAgB,uBAAuB,aAAqC;CAC1E,MAAM,QAAQ,YAAY,aAAa,IAAI,QAAQ;CACnD,MAAM,mBAAmB,YAAY,aAAa,IAAI,oBAAoB;CAC1E,MAAM,OAAO,YAAY,aAAa,IAAI,OAAO;AAEjD,KAAI,OAAO;AACT,SAAO,KAAK;GAAE;GAAO;GAAkB,EAAE,iCAAiC;AAE1E,SAAO;GACL,SAAS;GACT;GACA,kBAAkB,oBAAoB,KAAA;GACvC;;AAGH,KAAI,MAAM;AACR,SAAO,KAAK,0BAA0B;AACtC,SAAO,EACL,SAAS,MACV;;AAGH,QAAO,KAAK,oDAAoD;AAChE,QAAO;EACL,SAAS;EACT,OAAO;EACP,kBAAkB;EACnB;;;;;;;;;;;AAYH,IAAa,oBAAoB;CAC/B,gBAAgB;CAChB,sBAAsB;CACtB,kBAAkB;CAClB,4BAA4B;CAC7B;;;;;;;;;;;;;;;;AAmBD,SAAgB,yBAAyB,OAAoC;AAC3E,KAAI,CAAC,MAAO,QAAO;AAEnB,QAAO,OAAO,OAAO,kBAAkB,CAAC,SAAS,MAA0B"}

package/dist/types.d.ts

@@ -13,6 +13,8 @@ export interface Session<TData = Record<string, unknown>> {
         email: string;
         roles?: string[];
     };
+    /** OAuth scopes granted to this session (e.g. ["openid", "profile", "email"]). */
+    scopes?: string[];
     /** Application-specific data stored alongside the session. */
     data?: TData;
 }

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,MAAM,WAAW,MAAM;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qBAAqB,CAAC,EAAE,IAAI,CAAC;CAC9B;AAED,mFAAmF;AACnF,MAAM,WAAW,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;IACF,8DAA8D;IAC9D,IAAI,CAAC,EAAE,KAAK,CAAC;CACd;AAED,oDAAoD;AACpD,MAAM,WAAW,oBAAoB;IACnC,oEAAoE;IACpE,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,MAAM,WAAW,MAAM;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qBAAqB,CAAC,EAAE,IAAI,CAAC;CAC9B;AAED,mFAAmF;AACnF,MAAM,WAAW,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;IACF,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,KAAK,CAAC;CACd;AAED,oDAAoD;AACpD,MAAM,WAAW,oBAAoB;IACnC,oEAAoE;IACpE,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B"}

package/dist/utils.d.ts

@@ -1,3 +1,4 @@
+import { Session } from './types';
 /**
  * Converts a hex string to a Uint8Array.
  *
@@ -80,4 +81,11 @@ export declare function generateToken(tokenLength?: number): string;
  * @returns True if the access token expires within the threshold; otherwise, false.
  */
 export declare const accessTokenExpires: (accessToken: string, seconds?: number) => boolean;
+/**
+ * Returns true if the session was granted the given scope.
+ *
+ * @param session - The session to check
+ * @param scope - The scope string to look for (e.g. "operations.read")
+ */
+export declare function hasScope(session: Session, scope: string): boolean;
 //# sourceMappingURL=utils.d.ts.map

package/dist/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAOA;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAYvD;AAaD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,GAAG,UAAU,GAC1B,OAAO,CAAC,MAAM,CAAC,CAKjB;AAGD;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAkCxF;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CA4CxF;AAcD;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAIvE;AAED;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAIvE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,IAAI,UAAU,CAKvD;AAED;;GAEG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAI/C;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,WAAW,GAAE,MAAW,GAAG,MAAM,CAI9D;AAGD;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,GAC7B,aAAa,MAAM,EACnB,UAAS,MAAW,KACnB,OAsBF,CAAC"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAKvC;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAYvD;AAaD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,GAAG,UAAU,GAC1B,OAAO,CAAC,MAAM,CAAC,CAKjB;AAGD;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAkCxF;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CA4CxF;AAcD;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAIvE;AAED;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAIvE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,IAAI,UAAU,CAKvD;AAED;;GAEG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAI/C;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,WAAW,GAAE,MAAW,GAAG,MAAM,CAI9D;AAGD;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,GAC7B,aAAa,MAAM,EACnB,UAAS,MAAW,KACnB,OAsBF,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAEjE"}

package/dist/utils.js

@@ -1,2 +1,196 @@
-import { a as e, c as t, d as n, i as r, l as i, n as a, o, r as s, s as c, t as l, u } from "./utils-ByMRF7b2.js";
-export { l as accessTokenExpires, a as createEncryptedJWT, s as decrypt, r as encrypt, e as generateToken, o as getSessionSecret, c as getSessionSecretUint8Array, t as hexToUint8Array, i as sha256, u as sha512, n as toHex };
+import { createLogger } from "./logger.js";
+import * as jose from "jose";
+//#region src/utils.ts
+var logger = createLogger({ namespace: "fides-auth:utils" });
+/**
+* Converts a hex string to a Uint8Array.
+*
+* @param hex - A hexadecimal string.
+* @returns A Uint8Array representing the bytes of the hex string.
+*/
+function hexToUint8Array(hex) {
+	if (hex.length % 2 !== 0) throw new Error("Invalid hex string: odd length");
+	if (hex.length > 0 && !/^[0-9a-fA-F]+$/.test(hex)) throw new Error("Invalid hex string: contains non-hex characters");
+	const arr = new Uint8Array(hex.length / 2);
+	for (let i = 0; i < arr.length; i++) arr[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+	return arr;
+}
+/**
+* Normalizes a secret to a Uint8Array.
+* Accepts either a hex-encoded string or an existing Uint8Array.
+*/
+function normalizeSecret(secret) {
+	if (typeof secret === "string") return hexToUint8Array(secret);
+	return secret;
+}
+/**
+* Encrypts a payload into a JWT using the specified secret.
+*
+* @param payload - The payload to encrypt (can be any JSON-serializable value)
+* @param secret - The encryption key as a hex string or Uint8Array (32 bytes for A256GCM)
+* @returns A promise that resolves to the encrypted JWT as a string.
+*/
+async function createEncryptedJWT(payload, secret) {
+	return new jose.EncryptJWT(payload).setProtectedHeader({
+		alg: "dir",
+		enc: "A256GCM"
+	}).setIssuedAt().encrypt(normalizeSecret(secret));
+}
+/**
+* Encrypts the given text using AES-GCM via the Web Crypto API.
+* Returns a string in the format: iv:authTag:ciphertext, all in hex.
+*
+* @param text - The plaintext to encrypt.
+* @param secret - The encryption key as a hex string or Uint8Array (32 bytes for AES-256).
+* @returns A promise that resolves to the encrypted string.
+*/
+async function encrypt(text, secret) {
+	const keyData = normalizeSecret(secret);
+	const key = await crypto.subtle.importKey("raw", keyData, { name: "AES-GCM" }, false, ["encrypt"]);
+	const iv = crypto.getRandomValues(new Uint8Array(12));
+	const data = new TextEncoder().encode(text);
+	const encryptedBuffer = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv,
+		tagLength: 128
+	}, key, data);
+	const encryptedArray = new Uint8Array(encryptedBuffer);
+	const tagLength = 16;
+	const ciphertext = encryptedArray.slice(0, encryptedArray.length - tagLength);
+	const authTag = encryptedArray.slice(encryptedArray.length - tagLength);
+	return [
+		toHex(iv),
+		toHex(authTag),
+		toHex(ciphertext)
+	].join(":");
+}
+/**
+* Decrypts data encrypted with AES-256-GCM (using the Web Crypto API).
+* The input is expected to be in the format: iv:authTag:ciphertext (all hex-encoded).
+*
+* @param data - The encrypted data string.
+* @param secret - The decryption key as a hex string or Uint8Array (32 bytes for AES-256).
+* @returns A promise that resolves to the decrypted plaintext.
+*/
+async function decrypt(data, secret) {
+	const [ivHex, tagHex, ciphertextHex] = data.split(":");
+	if (!ivHex || !tagHex || !ciphertextHex) throw new Error("Invalid encrypted data format");
+	const iv = hexToUint8Array(ivHex);
+	const tag = hexToUint8Array(tagHex);
+	const ciphertext = hexToUint8Array(ciphertextHex);
+	const combined = new Uint8Array(ciphertext.length + tag.length);
+	combined.set(ciphertext);
+	combined.set(tag, ciphertext.length);
+	const keyData = normalizeSecret(secret);
+	const keyDataArrayBuffer = new Uint8Array([...keyData]);
+	const ivArrayBuffer = new Uint8Array([...iv]);
+	const key = await crypto.subtle.importKey("raw", keyDataArrayBuffer, { name: "AES-GCM" }, false, ["decrypt"]);
+	const decryptedBuffer = await crypto.subtle.decrypt({
+		name: "AES-GCM",
+		iv: ivArrayBuffer,
+		tagLength: 128
+	}, key, combined.buffer);
+	return new TextDecoder().decode(decryptedBuffer);
+}
+/**
+* Converts input data (string or Uint8Array) to a Uint8Array backed by a plain ArrayBuffer.
+* @param data - The input data.
+* @returns A Uint8Array representing the input data.
+*/
+function toUint8Array(data) {
+	if (typeof data === "string") return new TextEncoder().encode(data);
+	return data;
+}
+/**
+* Hashes the input using SHA-256 with the Web Crypto API.
+* @param data - The input data (string or Uint8Array).
+* @returns A Promise that resolves to the SHA-256 hash as a hex string.
+*/
+async function sha256(data) {
+	const buffer = toUint8Array(data);
+	const hashBuffer = await crypto.subtle.digest("SHA-256", buffer);
+	return toHex(new Uint8Array(hashBuffer));
+}
+/**
+* Hashes the input using SHA-512 with the Web Crypto API.
+* @param data - The input data (string or Uint8Array).
+* @returns A Promise that resolves to the SHA-512 hash as a hex string.
+*/
+async function sha512(data) {
+	const buffer = toUint8Array(data);
+	const hashBuffer = await crypto.subtle.digest("SHA-512", buffer);
+	return toHex(new Uint8Array(hashBuffer));
+}
+/**
+* Retrieves the session secret from environment variables.
+* Throws an error if the SESSION_SECRET is not defined.
+*
+* @returns {string} The session secret.
+*/
+function getSessionSecret() {
+	const secret = process.env.SESSION_SECRET;
+	if (!secret) throw new Error("SESSION_SECRET is not defined");
+	return secret;
+}
+/**
+* Retrieves the session secret from environment variables as Uint8Array .
+* Throws an error if the SESSION_SECRET is not defined.
+*
+* @returns {Uint8Array} The session secret as Uint8Array.
+*/
+function getSessionSecretUint8Array() {
+	const keyData = hexToUint8Array(getSessionSecret());
+	return new Uint8Array([...keyData]);
+}
+/**
+* Converts a Uint8Array to a lowercase hexadecimal string.
+*/
+function toHex(bytes) {
+	return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+/**
+* Generates a random token of the given byte length and returns it as a hex string.
+* Default token length is 20 bytes (160 bits).
+*
+* @param tokenLength - The number of random bytes to generate (default is 20).
+* @returns A hex string representing the token.
+*/
+function generateToken(tokenLength = 32) {
+	const bytes = new Uint8Array(tokenLength);
+	crypto.getRandomValues(bytes);
+	return toHex(bytes);
+}
+/**
+* Determines if the access token of a session will expire in less than the given threshold.
+*
+* It decodes the access token (assumed to be a JWT) and reads the `exp` claim.
+* The expiration (`exp`) claim is the UNIX timestamp (in seconds) when the token expires.
+*
+* @param accessToken - The access token string.
+* @param seconds - The threshold (in seconds) for checking expiration (default is 10 seconds).
+* @returns True if the access token expires within the threshold; otherwise, false.
+*/
+var accessTokenExpires = (accessToken, seconds = 10) => {
+	try {
+		const payload = jose.decodeJwt(accessToken);
+		if (!payload.exp) return false;
+		const nowInSeconds = Date.now() / 1e3;
+		return payload.exp - nowInSeconds < seconds;
+	} catch (error) {
+		logger.error({ error }, "Error decoding access token");
+		return true;
+	}
+};
+/**
+* Returns true if the session was granted the given scope.
+*
+* @param session - The session to check
+* @param scope - The scope string to look for (e.g. "operations.read")
+*/
+function hasScope(session, scope) {
+	return session.scopes?.includes(scope) ?? false;
+}
+//#endregion
+export { accessTokenExpires, createEncryptedJWT, decrypt, encrypt, generateToken, getSessionSecret, getSessionSecretUint8Array, hasScope, hexToUint8Array, sha256, sha512, toHex };
+
+//# sourceMappingURL=utils.js.map

package/dist/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","names":[],"sources":["../src/utils.ts"],"sourcesContent":["import * as jose from 'jose';\n\nimport { createLogger } from './logger';\nimport type { Session } from './types';\n\nconst logger = createLogger({ namespace: 'fides-auth:utils' });\n\n\n/**\n * Converts a hex string to a Uint8Array.\n *\n * @param hex - A hexadecimal string.\n * @returns A Uint8Array representing the bytes of the hex string.\n */\nexport function hexToUint8Array(hex: string): Uint8Array {\n  if (hex.length % 2 !== 0) {\n    throw new Error('Invalid hex string: odd length');\n  }\n  if (hex.length > 0 && !/^[0-9a-fA-F]+$/.test(hex)) {\n    throw new Error('Invalid hex string: contains non-hex characters');\n  }\n  const arr = new Uint8Array(hex.length / 2);\n  for (let i = 0; i < arr.length; i++) {\n    arr[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n  }\n  return arr;\n}\n\n/**\n * Normalizes a secret to a Uint8Array.\n * Accepts either a hex-encoded string or an existing Uint8Array.\n */\nfunction normalizeSecret(secret: string | Uint8Array): Uint8Array {\n  if (typeof secret === 'string') {\n    return hexToUint8Array(secret);\n  }\n  return secret;\n}\n\n/**\n * Encrypts a payload into a JWT using the specified secret.\n *\n * @param payload - The payload to encrypt (can be any JSON-serializable value)\n * @param secret - The encryption key as a hex string or Uint8Array (32 bytes for A256GCM)\n * @returns A promise that resolves to the encrypted JWT as a string.\n */\nexport async function createEncryptedJWT(\n  payload: unknown,\n  secret: string | Uint8Array,\n): Promise<string> {\n  return new jose.EncryptJWT(payload as jose.JWTPayload)\n    .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })\n    .setIssuedAt()\n    .encrypt(normalizeSecret(secret));\n}\n\n\n/**\n * Encrypts the given text using AES-GCM via the Web Crypto API.\n * Returns a string in the format: iv:authTag:ciphertext, all in hex.\n *\n * @param text - The plaintext to encrypt.\n * @param secret - The encryption key as a hex string or Uint8Array (32 bytes for AES-256).\n * @returns A promise that resolves to the encrypted string.\n */\nexport async function encrypt(text: string, secret: string | Uint8Array): Promise<string> {\n  const keyData = normalizeSecret(secret);\n\n  // Import the key for AES-GCM encryption.\n  const key = await crypto.subtle.importKey(\n    'raw',\n    keyData as BufferSource,\n    { name: 'AES-GCM' },\n    false,\n    ['encrypt']\n  );\n\n  // Generate a 12-byte IV using the Web Crypto API.\n  const iv = crypto.getRandomValues(new Uint8Array(12));\n\n  // Encode the plaintext into a Uint8Array.\n  const encoder = new TextEncoder();\n  const data = encoder.encode(text);\n\n  // Encrypt the data using AES-GCM.\n  // Note: The Web Crypto API combines the ciphertext and authentication tag in the output.\n  const encryptedBuffer = await crypto.subtle.encrypt(\n    { name: 'AES-GCM', iv, tagLength: 128 },\n    key,\n    data\n  );\n\n  // Convert the encrypted data to a Uint8Array for separation.\n  const encryptedArray = new Uint8Array(encryptedBuffer);\n  const tagLength = 16; // AES-GCM uses a 128-bit (16-byte) tag.\n  const ciphertext = encryptedArray.slice(0, encryptedArray.length - tagLength);\n  const authTag = encryptedArray.slice(encryptedArray.length - tagLength);\n\n  return [toHex(iv), toHex(authTag), toHex(ciphertext)].join(':');\n}\n\n/**\n * Decrypts data encrypted with AES-256-GCM (using the Web Crypto API).\n * The input is expected to be in the format: iv:authTag:ciphertext (all hex-encoded).\n *\n * @param data - The encrypted data string.\n * @param secret - The decryption key as a hex string or Uint8Array (32 bytes for AES-256).\n * @returns A promise that resolves to the decrypted plaintext.\n */\nexport async function decrypt(data: string, secret: string | Uint8Array): Promise<string> {\n\n  // Split the incoming data. We expect exactly three parts.\n  const [ivHex, tagHex, ciphertextHex] = data.split(':');\n  if (!ivHex || !tagHex || !ciphertextHex) {\n    throw new Error('Invalid encrypted data format');\n  }\n\n  // Convert each hex-encoded part to a Uint8Array\n  const iv = hexToUint8Array(ivHex);\n  const tag = hexToUint8Array(tagHex);\n  const ciphertext = hexToUint8Array(ciphertextHex);\n\n  // Concatenate ciphertext and auth tag (Web Crypto expects them combined)\n  const combined = new Uint8Array(ciphertext.length + tag.length);\n  combined.set(ciphertext);\n  combined.set(tag, ciphertext.length);\n\n  // Convert the secret and import it as a CryptoKey for AES-GCM decryption.\n  const keyData = normalizeSecret(secret);\n  // Ensure keyData is backed by a real ArrayBuffer (not SharedArrayBuffer)\n  const keyDataArrayBuffer = new Uint8Array([...keyData]);\n\n  // Ensure iv is backed by a real ArrayBuffer (not SharedArrayBuffer)\n  const ivArrayBuffer = new Uint8Array([...iv]);\n\n  const key = await crypto.subtle.importKey(\n    'raw',\n    keyDataArrayBuffer as BufferSource,\n    { name: 'AES-GCM' },\n    false,\n    ['decrypt']\n  );\n\n  // Decrypt the combined ciphertext+tag using the IV.\n  const decryptedBuffer = await crypto.subtle.decrypt(\n    { name: 'AES-GCM', iv: ivArrayBuffer, tagLength: 128 },\n    key,\n    combined.buffer\n  );\n\n  // Decode the decrypted ArrayBuffer back to a string.\n  const decoder = new TextDecoder();\n  return decoder.decode(decryptedBuffer);\n}\n\n/**\n * Converts input data (string or Uint8Array) to a Uint8Array backed by a plain ArrayBuffer.\n * @param data - The input data.\n * @returns A Uint8Array representing the input data.\n */\nfunction toUint8Array(data: string | Uint8Array): Uint8Array {\n  if (typeof data === 'string') {\n    return new TextEncoder().encode(data);\n  }\n  return data;\n}\n\n/**\n * Hashes the input using SHA-256 with the Web Crypto API.\n * @param data - The input data (string or Uint8Array).\n * @returns A Promise that resolves to the SHA-256 hash as a hex string.\n */\nexport async function sha256(data: string | Uint8Array): Promise<string> {\n  const buffer = toUint8Array(data);\n  const hashBuffer = await crypto.subtle.digest('SHA-256', buffer as BufferSource);\n  return toHex(new Uint8Array(hashBuffer));\n}\n\n/**\n * Hashes the input using SHA-512 with the Web Crypto API.\n * @param data - The input data (string or Uint8Array).\n * @returns A Promise that resolves to the SHA-512 hash as a hex string.\n */\nexport async function sha512(data: string | Uint8Array): Promise<string> {\n  const buffer = toUint8Array(data);\n  const hashBuffer = await crypto.subtle.digest('SHA-512', buffer as BufferSource);\n  return toHex(new Uint8Array(hashBuffer));\n}\n\n/**\n * Retrieves the session secret from environment variables.\n * Throws an error if the SESSION_SECRET is not defined.\n *\n * @returns {string} The session secret.\n */\nexport function getSessionSecret(): string {\n  const secret = process.env.SESSION_SECRET;\n  if (!secret) {\n    throw new Error('SESSION_SECRET is not defined');\n  }\n  return secret;\n}\n\n/**\n * Retrieves the session secret from environment variables as Uint8Array .\n * Throws an error if the SESSION_SECRET is not defined.\n *\n * @returns {Uint8Array} The session secret as Uint8Array.\n */\nexport function getSessionSecretUint8Array(): Uint8Array {\n  const secret = getSessionSecret();\n  const keyData = hexToUint8Array(secret);\n  // Ensure it's backed by a regular ArrayBuffer (not SharedArrayBuffer)\n  return new Uint8Array([...keyData]);\n}\n\n/**\n * Converts a Uint8Array to a lowercase hexadecimal string.\n */\nexport function toHex(bytes: Uint8Array): string {\n  return Array.from(bytes)\n    .map(b => b.toString(16).padStart(2, '0'))\n    .join('');\n}\n\n/**\n * Generates a random token of the given byte length and returns it as a hex string.\n * Default token length is 20 bytes (160 bits).\n *\n * @param tokenLength - The number of random bytes to generate (default is 20).\n * @returns A hex string representing the token.\n */\nexport function generateToken(tokenLength: number = 32): string {\n  const bytes = new Uint8Array(tokenLength);\n  crypto.getRandomValues(bytes);\n  return toHex(bytes);\n}\n\n\n/**\n * Determines if the access token of a session will expire in less than the given threshold.\n *\n * It decodes the access token (assumed to be a JWT) and reads the `exp` claim.\n * The expiration (`exp`) claim is the UNIX timestamp (in seconds) when the token expires.\n *\n * @param accessToken - The access token string.\n * @param seconds - The threshold (in seconds) for checking expiration (default is 10 seconds).\n * @returns True if the access token expires within the threshold; otherwise, false.\n */\nexport const accessTokenExpires = (\n  accessToken: string,\n  seconds: number = 10\n): boolean => {\n  try {\n    // Decode the JWT without verifying the signature.\n    const payload = jose.decodeJwt(accessToken) as { exp?: number; };\n\n    // If there is no exp claim, assume the token does not expire\n    if (!payload.exp) {\n      return false;\n    }\n\n    const nowInSeconds = Date.now() / 1000;\n    const remainingSeconds = payload.exp - nowInSeconds;\n\n    return remainingSeconds < seconds;\n  } catch (error) {\n    // If decoding fails, treat the token as invalid so no refresh is triggered.\n    logger.error(\n      { error },\n      'Error decoding access token'\n    );\n    return true;\n  }\n};\n\n/**\n * Returns true if the session was granted the given scope.\n *\n * @param session - The session to check\n * @param scope - The scope string to look for (e.g. \"operations.read\")\n */\nexport function hasScope(session: Session, scope: string): boolean {\n  return session.scopes?.includes(scope) ?? false;\n}\n"],"mappings":";;;AAKA,IAAM,SAAS,aAAa,EAAE,WAAW,oBAAoB,CAAC;;;;;;;AAS9D,SAAgB,gBAAgB,KAAyB;AACvD,KAAI,IAAI,SAAS,MAAM,EACrB,OAAM,IAAI,MAAM,iCAAiC;AAEnD,KAAI,IAAI,SAAS,KAAK,CAAC,iBAAiB,KAAK,IAAI,CAC/C,OAAM,IAAI,MAAM,kDAAkD;CAEpE,MAAM,MAAM,IAAI,WAAW,IAAI,SAAS,EAAE;AAC1C,MAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,IAC9B,KAAI,KAAK,OAAO,SAAS,IAAI,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,EAAE,GAAG;AAE3D,QAAO;;;;;;AAOT,SAAS,gBAAgB,QAAyC;AAChE,KAAI,OAAO,WAAW,SACpB,QAAO,gBAAgB,OAAO;AAEhC,QAAO;;;;;;;;;AAUT,eAAsB,mBACpB,SACA,QACiB;AACjB,QAAO,IAAI,KAAK,WAAW,QAA2B,CACnD,mBAAmB;EAAE,KAAK;EAAO,KAAK;EAAW,CAAC,CAClD,aAAa,CACb,QAAQ,gBAAgB,OAAO,CAAC;;;;;;;;;;AAYrC,eAAsB,QAAQ,MAAc,QAA8C;CACxF,MAAM,UAAU,gBAAgB,OAAO;CAGvC,MAAM,MAAM,MAAM,OAAO,OAAO,UAC9B,OACA,SACA,EAAE,MAAM,WAAW,EACnB,OACA,CAAC,UAAU,CACZ;CAGD,MAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,GAAG,CAAC;CAIrD,MAAM,OAAO,IADO,aACP,CAAQ,OAAO,KAAK;CAIjC,MAAM,kBAAkB,MAAM,OAAO,OAAO,QAC1C;EAAE,MAAM;EAAW;EAAI,WAAW;EAAK,EACvC,KACA,KACD;CAGD,MAAM,iBAAiB,IAAI,WAAW,gBAAgB;CACtD,MAAM,YAAY;CAClB,MAAM,aAAa,eAAe,MAAM,GAAG,eAAe,SAAS,UAAU;CAC7E,MAAM,UAAU,eAAe,MAAM,eAAe,SAAS,UAAU;AAEvE,QAAO;EAAC,MAAM,GAAG;EAAE,MAAM,QAAQ;EAAE,MAAM,WAAW;EAAC,CAAC,KAAK,IAAI;;;;;;;;;;AAWjE,eAAsB,QAAQ,MAAc,QAA8C;CAGxF,MAAM,CAAC,OAAO,QAAQ,iBAAiB,KAAK,MAAM,IAAI;AACtD,KAAI,CAAC,SAAS,CAAC,UAAU,CAAC,cACxB,OAAM,IAAI,MAAM,gCAAgC;CAIlD,MAAM,KAAK,gBAAgB,MAAM;CACjC,MAAM,MAAM,gBAAgB,OAAO;CACnC,MAAM,aAAa,gBAAgB,cAAc;CAGjD,MAAM,WAAW,IAAI,WAAW,WAAW,SAAS,IAAI,OAAO;AAC/D,UAAS,IAAI,WAAW;AACxB,UAAS,IAAI,KAAK,WAAW,OAAO;CAGpC,MAAM,UAAU,gBAAgB,OAAO;CAEvC,MAAM,qBAAqB,IAAI,WAAW,CAAC,GAAG,QAAQ,CAAC;CAGvD,MAAM,gBAAgB,IAAI,WAAW,CAAC,GAAG,GAAG,CAAC;CAE7C,MAAM,MAAM,MAAM,OAAO,OAAO,UAC9B,OACA,oBACA,EAAE,MAAM,WAAW,EACnB,OACA,CAAC,UAAU,CACZ;CAGD,MAAM,kBAAkB,MAAM,OAAO,OAAO,QAC1C;EAAE,MAAM;EAAW,IAAI;EAAe,WAAW;EAAK,EACtD,KACA,SAAS,OACV;AAID,QAAO,IADa,aACb,CAAQ,OAAO,gBAAgB;;;;;;;AAQxC,SAAS,aAAa,MAAuC;AAC3D,KAAI,OAAO,SAAS,SAClB,QAAO,IAAI,aAAa,CAAC,OAAO,KAAK;AAEvC,QAAO;;;;;;;AAQT,eAAsB,OAAO,MAA4C;CACvE,MAAM,SAAS,aAAa,KAAK;CACjC,MAAM,aAAa,MAAM,OAAO,OAAO,OAAO,WAAW,OAAuB;AAChF,QAAO,MAAM,IAAI,WAAW,WAAW,CAAC;;;;;;;AAQ1C,eAAsB,OAAO,MAA4C;CACvE,MAAM,SAAS,aAAa,KAAK;CACjC,MAAM,aAAa,MAAM,OAAO,OAAO,OAAO,WAAW,OAAuB;AAChF,QAAO,MAAM,IAAI,WAAW,WAAW,CAAC;;;;;;;;AAS1C,SAAgB,mBAA2B;CACzC,MAAM,SAAS,QAAQ,IAAI;AAC3B,KAAI,CAAC,OACH,OAAM,IAAI,MAAM,gCAAgC;AAElD,QAAO;;;;;;;;AAST,SAAgB,6BAAyC;CAEvD,MAAM,UAAU,gBADD,kBACiB,CAAO;AAEvC,QAAO,IAAI,WAAW,CAAC,GAAG,QAAQ,CAAC;;;;;AAMrC,SAAgB,MAAM,OAA2B;AAC/C,QAAO,MAAM,KAAK,MAAM,CACrB,KAAI,MAAK,EAAE,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,CACzC,KAAK,GAAG;;;;;;;;;AAUb,SAAgB,cAAc,cAAsB,IAAY;CAC9D,MAAM,QAAQ,IAAI,WAAW,YAAY;AACzC,QAAO,gBAAgB,MAAM;AAC7B,QAAO,MAAM,MAAM;;;;;;;;;;;;AAcrB,IAAa,sBACX,aACA,UAAkB,OACN;AACZ,KAAI;EAEF,MAAM,UAAU,KAAK,UAAU,YAAY;AAG3C,MAAI,CAAC,QAAQ,IACX,QAAO;EAGT,MAAM,eAAe,KAAK,KAAK,GAAG;AAGlC,SAFyB,QAAQ,MAAM,eAEb;UACnB,OAAO;AAEd,SAAO,MACL,EAAE,OAAO,EACT,8BACD;AACD,SAAO;;;;;;;;;AAUX,SAAgB,SAAS,SAAkB,OAAwB;AACjE,QAAO,QAAQ,QAAQ,SAAS,MAAM,IAAI"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eventuras/fides-auth",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Framework-agnostic OAuth/OIDC authentication library with PKCE, session management, and pluggable logging",
   "keywords": [
     "oauth",
@@ -47,6 +47,10 @@
       "types": "./dist/oauth.d.ts",
       "import": "./dist/oauth.js"
     },
+    "./oauth-logging": {
+      "types": "./dist/oauth-logging.d.ts",
+      "import": "./dist/oauth-logging.js"
+    },
     "./oauth-browser": {
       "types": "./dist/oauth-browser.d.ts",
       "import": "./dist/oauth-browser.js"
@@ -88,7 +92,7 @@
     "vite": "^8.0.8",
     "vitest": "^4.1.4",
     "@eventuras/typescript-config": "1.0.0",
-    "@eventuras/vite-config": "0.2.1"
+    "@eventuras/vite-config": "0.2.2"
   },
   "engines": {
     "node": ">=18"