@faable/auth-js 1.2.0

package/dist/lib/jwt.d.ts

@@ -0,0 +1,56 @@
+/**
+ * @ignore
+ */
+export interface JWTVerifyOptions {
+    iss: string;
+    aud: string;
+    id_token: string;
+    nonce?: string;
+    leeway?: number;
+    max_age?: number;
+    organizationId?: string;
+    now?: number;
+}
+export interface IdToken {
+    __raw: string;
+    name?: string;
+    given_name?: string;
+    family_name?: string;
+    middle_name?: string;
+    nickname?: string;
+    preferred_username?: string;
+    profile?: string;
+    picture?: string;
+    website?: string;
+    email?: string;
+    email_verified?: boolean;
+    gender?: string;
+    birthdate?: string;
+    zoneinfo?: string;
+    locale?: string;
+    phone_number?: string;
+    phone_number_verified?: boolean;
+    address?: string;
+    updated_at?: string;
+    iss?: string;
+    aud?: string;
+    exp?: number;
+    nbf?: number;
+    iat?: number;
+    jti?: string;
+    azp?: string;
+    nonce?: string;
+    auth_time?: string;
+    at_hash?: string;
+    c_hash?: string;
+    acr?: string;
+    amr?: string;
+    sub_jwk?: string;
+    cnf?: string;
+    sid?: string;
+    org_id?: string;
+    [key: string]: any;
+}
+export declare function decodeJWTPayload(token: string): any;
+export declare const verify: (options: JWTVerifyOptions) => any;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/lib/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/lib/jwt.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAqCD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,OAiB7C;AAED,eAAO,MAAM,MAAM,YAAa,gBAAgB,QAkJ/C,CAAC"}

package/dist/lib/jwt.js

@@ -0,0 +1,139 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verify = exports.decodeJWTPayload = void 0;
+const helpers_1 = require("./helpers");
+const isNumber = (n) => typeof n === "number";
+const idTokendecoded = [
+    "iss",
+    "aud",
+    "exp",
+    "nbf",
+    "iat",
+    "jti",
+    "azp",
+    "nonce",
+    "auth_time",
+    "at_hash",
+    "c_hash",
+    "acr",
+    "amr",
+    "sub_jwk",
+    "cnf",
+    "sip_from_tag",
+    "sip_date",
+    "sip_callid",
+    "sip_cseq_num",
+    "sip_via_branch",
+    "orig",
+    "dest",
+    "mky",
+    "events",
+    "toe",
+    "txn",
+    "rph",
+    "sid",
+    "vot",
+    "vtm",
+];
+function decodeJWTPayload(token) {
+    // Regex checks for base64url format
+    const base64UrlRegex = /^([a-z0-9_-]{4})*($|[a-z0-9_-]{3}=?$|[a-z0-9_-]{2}(==)?$)$/i;
+    const parts = token.split(".");
+    if (parts.length !== 3) {
+        throw new Error("JWT is not valid: not a JWT structure");
+    }
+    if (!base64UrlRegex.test(parts[1])) {
+        throw new Error("JWT is not valid: payload is not in base64url format");
+    }
+    const base64Url = parts[1];
+    return JSON.parse((0, helpers_1.decodeBase64URL)(base64Url));
+}
+exports.decodeJWTPayload = decodeJWTPayload;
+const verify = (options) => {
+    if (!options.id_token) {
+        throw new Error("ID token is required but missing");
+    }
+    const decoded = decodeJWTPayload(options.id_token);
+    if (!decoded.claims.iss) {
+        throw new Error("Issuer (iss) claim must be a string present in the ID token");
+    }
+    if (decoded.claims.iss !== options.iss) {
+        throw new Error(`Issuer (iss) claim mismatch in the ID token; expected "${options.iss}", found "${decoded.claims.iss}"`);
+    }
+    if (!decoded.user.sub) {
+        throw new Error("Subject (sub) claim must be a string present in the ID token");
+    }
+    if (decoded.header.alg !== "RS256") {
+        throw new Error(`Signature algorithm of "${decoded.header.alg}" is not supported. Expected the ID token to be signed with "RS256".`);
+    }
+    if (!decoded.claims.aud ||
+        !(typeof decoded.claims.aud === "string" ||
+            Array.isArray(decoded.claims.aud))) {
+        throw new Error("Audience (aud) claim must be a string or array of strings present in the ID token");
+    }
+    if (Array.isArray(decoded.claims.aud)) {
+        if (!decoded.claims.aud.includes(options.aud)) {
+            throw new Error(`Audience (aud) claim mismatch in the ID token; expected "${options.aud}" but was not one of "${decoded.claims.aud.join(", ")}"`);
+        }
+        if (decoded.claims.aud.length > 1) {
+            if (!decoded.claims.azp) {
+                throw new Error("Authorized Party (azp) claim must be a string present in the ID token when Audience (aud) claim has multiple values");
+            }
+            if (decoded.claims.azp !== options.aud) {
+                throw new Error(`Authorized Party (azp) claim mismatch in the ID token; expected "${options.aud}", found "${decoded.claims.azp}"`);
+            }
+        }
+    }
+    else if (decoded.claims.aud !== options.aud) {
+        throw new Error(`Audience (aud) claim mismatch in the ID token; expected "${options.aud}" but found "${decoded.claims.aud}"`);
+    }
+    if (options.nonce) {
+        if (!decoded.claims.nonce) {
+            throw new Error("Nonce (nonce) claim must be a string present in the ID token");
+        }
+        if (decoded.claims.nonce !== options.nonce) {
+            throw new Error(`Nonce (nonce) claim mismatch in the ID token; expected "${options.nonce}", found "${decoded.claims.nonce}"`);
+        }
+    }
+    if (options.max_age && !isNumber(decoded.claims.auth_time)) {
+        throw new Error("Authentication Time (auth_time) claim must be a number present in the ID token when Max Age (max_age) is specified");
+    }
+    /* c8 ignore next 5 */
+    if (decoded.claims.exp == null || !isNumber(decoded.claims.exp)) {
+        throw new Error("Expiration Time (exp) claim must be a number present in the ID token");
+    }
+    if (!isNumber(decoded.claims.iat)) {
+        throw new Error("Issued At (iat) claim must be a number present in the ID token");
+    }
+    const leeway = options.leeway || 60;
+    const now = new Date(options.now || Date.now());
+    const expDate = new Date(0);
+    expDate.setUTCSeconds(decoded.claims.exp + leeway);
+    if (now > expDate) {
+        throw new Error(`Expiration Time (exp) claim error in the ID token; current time (${now}) is after expiration time (${expDate})`);
+    }
+    if (decoded.claims.nbf != null && isNumber(decoded.claims.nbf)) {
+        const nbfDate = new Date(0);
+        nbfDate.setUTCSeconds(decoded.claims.nbf - leeway);
+        if (now < nbfDate) {
+            throw new Error(`Not Before time (nbf) claim in the ID token indicates that this token can't be used just yet. Current time (${now}) is before ${nbfDate}`);
+        }
+    }
+    if (decoded.claims.auth_time != null && isNumber(decoded.claims.auth_time)) {
+        const authTimeDate = new Date(0);
+        authTimeDate.setUTCSeconds(parseInt(decoded.claims.auth_time) + options.max_age + leeway);
+        if (now > authTimeDate) {
+            throw new Error(`Authentication Time (auth_time) claim in the ID token indicates that too much time has passed since the last end-user authentication. Current time (${now}) is after last auth at ${authTimeDate}`);
+        }
+    }
+    if (options.organizationId) {
+        if (!decoded.claims.org_id) {
+            throw new Error("Organization ID (org_id) claim must be a string present in the ID token");
+        }
+        else if (options.organizationId !== decoded.claims.org_id) {
+            throw new Error(`Organization ID (org_id) claim mismatch in the ID token; expected "${options.organizationId}", found "${decoded.claims.org_id}"`);
+        }
+    }
+    return decoded;
+};
+exports.verify = verify;

package/dist/lib/local-storage.d.ts

@@ -0,0 +1,13 @@
+import { SupportedStorage } from "./types";
+/**
+ * Provides safe access to the globalThis.localStorage property.
+ */
+export declare const localStorageAdapter: SupportedStorage;
+/**
+ * Returns a localStorage-like object that stores the key-value pairs in
+ * memory.
+ */
+export declare function memoryLocalStorageAdapter(store?: {
+    [key: string]: string;
+}): SupportedStorage;
+//# sourceMappingURL=local-storage.d.ts.map

package/dist/lib/local-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-storage.d.ts","sourceRoot":"","sources":["../../src/lib/local-storage.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAE3C;;GAEG;AACH,eAAO,MAAM,mBAAmB,EAAE,gBAsBjC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,GAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAO,GACpC,gBAAgB,CAclB"}

package/dist/lib/local-storage.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.memoryLocalStorageAdapter = exports.localStorageAdapter = void 0;
+const helpers_1 = require("./helpers");
+/**
+ * Provides safe access to the globalThis.localStorage property.
+ */
+exports.localStorageAdapter = {
+    getItem: (key) => {
+        if (!(0, helpers_1.supportsLocalStorage)()) {
+            return null;
+        }
+        return globalThis.localStorage.getItem(key);
+    },
+    setItem: (key, value) => {
+        if (!(0, helpers_1.supportsLocalStorage)()) {
+            return;
+        }
+        globalThis.localStorage.setItem(key, value);
+    },
+    removeItem: (key) => {
+        if (!(0, helpers_1.supportsLocalStorage)()) {
+            return;
+        }
+        globalThis.localStorage.removeItem(key);
+    },
+};
+/**
+ * Returns a localStorage-like object that stores the key-value pairs in
+ * memory.
+ */
+function memoryLocalStorageAdapter(store = {}) {
+    return {
+        getItem: (key) => {
+            return store[key] || null;
+        },
+        setItem: (key, value) => {
+            store[key] = value;
+        },
+        removeItem: (key) => {
+            delete store[key];
+        },
+    };
+}
+exports.memoryLocalStorageAdapter = memoryLocalStorageAdapter;

package/dist/lib/storage_helpers.d.ts

@@ -0,0 +1,5 @@
+import { SupportedStorage } from "./types";
+export declare const setItemAsync: (storage: SupportedStorage, key: string, data: any) => Promise<void>;
+export declare const getItemAsync: (storage: SupportedStorage, key: string) => Promise<unknown>;
+export declare const removeItemAsync: (storage: SupportedStorage, key: string) => Promise<void>;
+//# sourceMappingURL=storage_helpers.d.ts.map

package/dist/lib/storage_helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage_helpers.d.ts","sourceRoot":"","sources":["../../src/lib/storage_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAG3C,eAAO,MAAM,YAAY,YACd,gBAAgB,OACpB,MAAM,QACL,GAAG,KACR,QAAQ,IAAI,CAEd,CAAC;AAEF,eAAO,MAAM,YAAY,YACd,gBAAgB,OACpB,MAAM,KACV,QAAQ,OAAO,CAYjB,CAAC;AAEF,eAAO,MAAM,eAAe,YACjB,gBAAgB,OACpB,MAAM,KACV,QAAQ,IAAI,CAEd,CAAC"}

package/dist/lib/storage_helpers.js

@@ -0,0 +1,34 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.removeItemAsync = exports.getItemAsync = exports.setItemAsync = void 0;
+// Storage helpers
+const setItemAsync = (storage, key, data) => __awaiter(void 0, void 0, void 0, function* () {
+    yield storage.setItem(key, JSON.stringify(data));
+});
+exports.setItemAsync = setItemAsync;
+const getItemAsync = (storage, key) => __awaiter(void 0, void 0, void 0, function* () {
+    const value = yield storage.getItem(key);
+    if (!value) {
+        return null;
+    }
+    try {
+        return JSON.parse(value);
+    }
+    catch (_a) {
+        return value;
+    }
+});
+exports.getItemAsync = getItemAsync;
+const removeItemAsync = (storage, key) => __awaiter(void 0, void 0, void 0, function* () {
+    yield storage.removeItem(key);
+});
+exports.removeItemAsync = removeItemAsync;

package/dist/lib/types.d.ts

@@ -0,0 +1,384 @@
+import { AuthError } from "./errors";
+import { LockFunc } from "../lock/locks";
+import { BaseLogOptions } from "../BaseLog";
+/**
+ * @ignore
+ */
+export interface AuthenticationResult {
+    state: string;
+    code?: string;
+    error?: string;
+    error_description?: string;
+}
+export declare class User {
+    name?: string;
+    profile?: string;
+    picture?: string;
+    email?: string;
+    website?: string;
+    birthdate?: string;
+    locale?: string;
+    sub?: string;
+    [key: string]: any;
+}
+/**
+ * The state of the application before the user was redirected to the login page.
+ */
+export type AppState = {
+    returnTo?: string;
+    [key: string]: any;
+};
+export interface AuthorizationParams {
+    /**
+     * - `'page'`: displays the UI with a full page view
+     * - `'popup'`: displays the UI with a popup window
+     * - `'touch'`: displays the UI in a way that leverages a touch interface
+     * - `'wap'`: displays the UI with a "feature phone" type interface
+     */
+    display?: "page" | "popup" | "touch" | "wap";
+    /**
+     * - `'none'`: do not prompt user for login or consent on reauthentication
+     * - `'login'`: prompt user for reauthentication
+     * - `'consent'`: prompt user for consent before processing request
+     * - `'select_account'`: prompt user to select an account
+     */
+    prompt?: "none" | "login" | "consent" | "select_account";
+    /**
+     * Maximum allowable elapsed time (in seconds) since authentication.
+     * If the last time the user authenticated is greater than this value,
+     * the user must be reauthenticated.
+     */
+    max_age?: string | number;
+    /**
+     * The space-separated list of language tags, ordered by preference.
+     * For example: `'fr-CA fr en'`.
+     */
+    ui_locales?: string;
+    /**
+     * Previously issued ID Token.
+     */
+    id_token_hint?: string;
+    /**
+     * Provides a hint to Auth0 as to what flow should be displayed.
+     * The default behavior is to show a login page but you can override
+     * this by passing 'signup' to show the signup page instead.
+     *
+     * This only affects the New Universal Login Experience.
+     */
+    screen_hint?: "signup" | "login" | string;
+    /**
+     * The user's email address or other identifier. When your app knows
+     * which user is trying to authenticate, you can provide this parameter
+     * to pre-fill the email box or select the right session for sign-in.
+     *
+     * This currently only affects the classic Lock experience.
+     */
+    login_hint?: string;
+    acr_values?: string;
+    /**
+     * The default scope to be used on authentication requests.
+     *
+     * This defaults to `profile email` if not set. If you are setting extra scopes and require
+     * `profile` and `email` to be included then you must include them in the provided scope.
+     *
+     * Note: The `openid` scope is **always applied** regardless of this setting.
+     */
+    scope?: string;
+    /**
+     * The default audience to be used for requesting API access.
+     */
+    audience?: string;
+    /**
+     * The name of the connection configured for your application.
+     * If null, it will redirect to the Auth0 Login Page and show
+     * the Login Widget.
+     */
+    connection?: string;
+    /**
+     * The Id of an organization to log in to.
+     *
+     * This will specify an `organization` parameter in your user's login request and will add a step to validate
+     * the `org_id` claim in your user's ID Token.
+     */
+    organization?: string;
+    /**
+     * The Id of an invitation to accept. This is available from the user invitation URL that is given when participating in a user invitation flow.
+     */
+    invitation?: string;
+    /**
+     * The default URL where Auth0 will redirect your browser to with
+     * the authentication result. It must be whitelisted in
+     * the "Allowed Callback URLs" field in your Auth0 Application's
+     * settings. If not provided here, it should be provided in the other
+     * methods that provide authentication.
+     */
+    redirect_uri?: string;
+    /**
+     * If you need to send custom parameters to the Authorization Server,
+     * make sure to use the original parameter name.
+     */
+    [key: string]: any;
+}
+interface BaseLoginOptions {
+    /**
+     * URL parameters that will be sent back to the Authorization Server. This can be known parameters
+     * defined by Auth0 or custom parameters that you define.
+     */
+    authorizationParams?: AuthorizationParams;
+}
+export interface RedirectLoginOptions<TAppState = any> extends BaseLoginOptions {
+    /**
+     * Used to store state before doing the redirect
+     */
+    appState?: TAppState;
+}
+export interface IdToken {
+    __raw: string;
+    name?: string;
+    given_name?: string;
+    family_name?: string;
+    middle_name?: string;
+    nickname?: string;
+    preferred_username?: string;
+    profile?: string;
+    picture?: string;
+    website?: string;
+    email?: string;
+    email_verified?: boolean;
+    gender?: string;
+    birthdate?: string;
+    zoneinfo?: string;
+    locale?: string;
+    phone_number?: string;
+    phone_number_verified?: boolean;
+    address?: string;
+    updated_at?: string;
+    iss?: string;
+    aud?: string;
+    exp?: number;
+    nbf?: number;
+    iat?: number;
+    jti?: string;
+    azp?: string;
+    nonce?: string;
+    auth_time?: string;
+    at_hash?: string;
+    c_hash?: string;
+    acr?: string;
+    amr?: string;
+    sub_jwk?: string;
+    cnf?: string;
+    sid?: string;
+    org_id?: string;
+    [key: string]: any;
+}
+export interface GetTokenSilentlyOptions {
+    /**
+     * When `off`, ignores the cache and always sends a
+     * request to Auth0.
+     * When `cache-only`, only reads from the cache and never sends a request to Auth0.
+     * Defaults to `on`, where it both reads from the cache and sends a request to Auth0 as needed.
+     */
+    cacheMode?: "on" | "off" | "cache-only";
+    /**
+     * Parameters that will be sent back to Auth0 as part of a request.
+     */
+    authorizationParams?: {
+        /**
+         * There's no actual redirect when getting a token silently,
+         * but, according to the spec, a `redirect_uri` param is required.
+         * Auth0 uses this parameter to validate that the current `origin`
+         * matches the `redirect_uri` `origin` when sending the response.
+         * It must be whitelisted in the "Allowed Web Origins" in your
+         * Auth0 Application's settings.
+         */
+        redirect_uri?: string;
+        /**
+         * The scope that was used in the authentication request
+         */
+        scope?: string;
+        /**
+         * The audience that was used in the authentication request
+         */
+        audience?: string;
+        /**
+         * If you need to send custom parameters to the Authorization Server,
+         * make sure to use the original parameter name.
+         */
+        [key: string]: any;
+    };
+    /** A maximum number of seconds to wait before declaring the background /authorize call as failed for timeout
+     * Defaults to 60s.
+     */
+    timeoutInSeconds?: number;
+    /**
+     * If true, the full response from the /oauth/token endpoint (or the cache, if the cache was used) is returned
+     * (minus `refresh_token` if one was issued). Otherwise, just the access token is returned.
+     *
+     * The default is `false`.
+     */
+    detailedResponse?: boolean;
+}
+export type GetTokenSilentlyVerboseResponse = Omit<TokenEndpointResponse, "refresh_token">;
+export type TokenEndpointResponse = {
+    id_token: string;
+    access_token: string;
+    refresh_token?: string;
+    expires_in: number;
+    scope?: string;
+};
+export type FaableAuthClientConfig = {
+    domain: string;
+    scope?: string;
+    audience?: string;
+    redirect_uri?: string;
+    clientId: string;
+    authorizationParams?: AuthorizationParams;
+    cookieDomain?: string;
+    useRefreshTokens?: boolean;
+    flowType?: AuthFlowType;
+    storage?: SupportedStorage;
+    storageKey?: string;
+    /**
+     * Provide your own locking mechanism based on the environment. By default no locking is done at this time.
+     *
+     * @experimental
+     */
+    lock?: LockFunc;
+} & BaseLogOptions;
+type AnyFunction = (...args: any[]) => any;
+type MaybePromisify<T> = T | Promise<T>;
+type PromisifyMethods<T> = {
+    [K in keyof T]: T[K] extends AnyFunction ? (...args: Parameters<T[K]>) => MaybePromisify<ReturnType<T[K]>> : T[K];
+};
+export type SupportedStorage = PromisifyMethods<Pick<Storage, "getItem" | "setItem" | "removeItem">> & {
+    /**
+     * If set to `true` signals to the library that the storage medium is used
+     * on a server and the values may not be authentic, such as reading from
+     * request cookies. Implementations should not set this to true if the client
+     * is used on a server that reads storage information from authenticated
+     * sources, such as a secure database or file.
+     */
+    isServer?: boolean;
+};
+export type Provider = "google" | "github";
+export type AuthFlowType = "implicit" | "pkce";
+export type SignInWithOAuthConnection = {
+    /** Default connection is used if not setted. */
+    connection?: string;
+    /** A URL to send the user to after they are confirmed. */
+    redirectTo?: string;
+    /** A space-separated list of scopes granted to the OAuth application. */
+    scopes?: string;
+    /** An object of query params */
+    queryParams?: {
+        [key: string]: string;
+    };
+    /** If set to true does not immediately redirect the current browser context to visit the OAuth authorization page for the provider. */
+    skipBrowserRedirect?: boolean;
+};
+export type OAuthResponse = {
+    data: {
+        url: string;
+    };
+    error: null;
+} | {
+    data: {
+        url: null;
+    };
+    error: AuthError;
+};
+export interface Session {
+    /**
+     * The oauth provider token. If present, this can be used to make external API requests to the oauth provider used.
+     */
+    provider_token?: string | null;
+    /**
+     * The oauth provider refresh token. If present, this can be used to refresh the provider_token via the oauth provider's API.
+     * Not all oauth providers return a provider refresh token. If the provider_refresh_token is missing, please refer to the oauth provider's documentation for information on how to obtain the provider refresh token.
+     */
+    provider_refresh_token?: string | null;
+    /**
+     * The access token jwt. It is recommended to set the JWT_EXPIRY to a shorter expiry value.
+     */
+    access_token: string;
+    /**
+     * A one-time used refresh token that never expires.
+     */
+    refresh_token: string;
+    /**
+     * The number of seconds until the token expires (since it was issued). Returned when a login is confirmed.
+     */
+    expires_in: number;
+    /**
+     * A timestamp of when the token will expire. Returned when a login is confirmed.
+     */
+    expires_at?: number;
+    token_type: string;
+    user: User;
+}
+export type AuthResponse = {
+    data: {
+        user: User | null;
+        session: Session | null;
+    };
+    error: null;
+} | {
+    data: {
+        user: null;
+        session: null;
+    };
+    error: AuthError;
+};
+export type AuthChangeEventMFA = "MFA_CHALLENGE_VERIFIED";
+export type AuthChangeEvent = "INITIAL_SESSION" | "PASSWORD_RECOVERY" | "SIGNED_IN" | "SIGNED_OUT" | "TOKEN_REFRESHED" | "USER_UPDATED" | AuthChangeEventMFA;
+export interface Subscription {
+    /**
+     * The subscriber UUID. This will be set by the client.
+     */
+    id: string;
+    /**
+     * The function to call every time there is an event. eg: (eventName) => {}
+     */
+    callback: (event: AuthChangeEvent, session: Session | null) => void;
+    /**
+     * Call this to remove the listener.
+     */
+    unsubscribe: () => void;
+}
+export type SignOut = {
+    /**
+     * Determines which sessions should be
+     * logged out. Global means all
+     * sessions by this account. Local
+     * means only this session. Others
+     * means all other sessions except the
+     * current one. When using others,
+     * there is no sign-out event fired on
+     * the current session!
+     */
+    scope?: "global" | "local" | "others";
+};
+export type InitializeResult = {
+    error: AuthError | null;
+};
+export type UserResponse = {
+    data: {
+        user: User;
+    };
+    error: null;
+} | {
+    data: {
+        user: null;
+    };
+    error: AuthError;
+};
+export type CallRefreshTokenResult = {
+    session: Session;
+    error: null;
+} | {
+    session: null;
+    error: AuthError;
+};
+export {};
+//# sourceMappingURL=types.d.ts.map