@fluixi/oauth2 1.0.0-alpha.1 → 1.0.0-alpha.100

package/dist/session-monitor.d.ts

@@ -0,0 +1,32 @@
+/**
+ * OpenID Connect Session Management, the app's half.
+ *
+ * The provider's check page sits in a hidden iframe. The page posts it `client_id` and the
+ * `session_state` of the last authorization answer; the check page recomputes that value
+ * from the provider's own cookie and answers `changed` or `unchanged`, with no request.
+ * `changed` means someone signed in, out, or switched account at the provider since: the
+ * app asks again silently, which signs it in, out, or as the other account.
+ *
+ * Only on the same site as the provider, or where the browser lets a framed page read its
+ * cookies. Elsewhere the check page sees no cookie and answers `changed` at once, every
+ * time: the guard below tells that apart from a real change, which follows an `unchanged`.
+ */
+export interface SessionCheck {
+    /** The provider's check page, or null when it has none. */
+    frame: string | null;
+    clientId: string;
+    /** The last answer's `session_state`, or null when there is nothing to compare. */
+    state: string | null;
+}
+export interface WatchOptions {
+    /** Where the server routes are mounted. Default `/auth`. */
+    basePath?: string;
+    /** How often to ask while the page is visible. Default 3 seconds. */
+    intervalMs?: number;
+    /** What a change does. Default: a silent sign-in that returns to this page. */
+    onChange?: () => void;
+    fetcher?: typeof fetch;
+}
+/** Starts watching; returns a function that stops. Does nothing outside a browser. */
+export declare function watchProviderSession(options?: WatchOptions): () => void;
+//# sourceMappingURL=session-monitor.d.ts.map

package/dist/session-monitor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-monitor.d.ts","sourceRoot":"","sources":["../src/session-monitor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,YAAY;IAC3B,2DAA2D;IAC3D,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAyBD,sFAAsF;AACtF,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,YAAiB,GAAG,MAAM,IAAI,CAiE3E"}

package/dist/session-monitor.js

@@ -0,0 +1,104 @@
+/**
+ * OpenID Connect Session Management, the app's half.
+ *
+ * The provider's check page sits in a hidden iframe. The page posts it `client_id` and the
+ * `session_state` of the last authorization answer; the check page recomputes that value
+ * from the provider's own cookie and answers `changed` or `unchanged`, with no request.
+ * `changed` means someone signed in, out, or switched account at the provider since: the
+ * app asks again silently, which signs it in, out, or as the other account.
+ *
+ * Only on the same site as the provider, or where the browser lets a framed page read its
+ * cookies. Elsewhere the check page sees no cookie and answers `changed` at once, every
+ * time: the guard below tells that apart from a real change, which follows an `unchanged`.
+ */
+/**
+ * A page whose first answer is `changed` within this long of the last silent sign-in is
+ * looking at a provider whose cookie it cannot read, and stops instead of looping.
+ */
+const SETTLE_MS = 15_000;
+const GUARD_KEY = 'fx-session-check';
+function recentlyActed() {
+    try {
+        return Date.now() - Number(sessionStorage.getItem(GUARD_KEY) ?? 0) < SETTLE_MS;
+    }
+    catch {
+        return false;
+    }
+}
+function markActed() {
+    try {
+        sessionStorage.setItem(GUARD_KEY, String(Date.now()));
+    }
+    catch {
+        // Storage refused: the loop guard is lost, the check itself still works.
+    }
+}
+/** Starts watching; returns a function that stops. Does nothing outside a browser. */
+export function watchProviderSession(options = {}) {
+    if (typeof window === 'undefined' || typeof document === 'undefined')
+        return () => { };
+    const base = (options.basePath ?? '/auth').replace(/\/$/, '');
+    const fetcher = options.fetcher ?? fetch;
+    const onChange = options.onChange ??
+        (() => {
+            const login = new URLSearchParams({ prompt: 'none', returnTo: location.pathname + location.search });
+            location.assign(`${base}/login?${login}`);
+        });
+    let stopped = false;
+    const cleanups = [];
+    const stop = () => {
+        stopped = true;
+        for (const cleanup of cleanups.splice(0))
+            cleanup();
+    };
+    void (async () => {
+        const check = (await fetcher(`${base}/session-check`, { credentials: 'same-origin' })
+            .then((response) => (response.ok ? response.json() : null))
+            .catch(() => null));
+        if (stopped || !check?.frame || !check.state)
+            return;
+        const origin = new URL(check.frame).origin;
+        const frame = document.createElement('iframe');
+        frame.src = check.frame;
+        frame.title = 'session check';
+        frame.setAttribute('aria-hidden', 'true');
+        frame.tabIndex = -1;
+        frame.style.cssText = 'position:absolute;width:0;height:0;border:0;visibility:hidden';
+        const message = `${check.clientId} ${check.state}`;
+        const ask = () => {
+            if (!stopped && document.visibilityState === 'visible')
+                frame.contentWindow?.postMessage(message, origin);
+        };
+        let confirmed = false;
+        const answer = (event) => {
+            if (event.origin !== origin || event.source !== frame.contentWindow)
+                return;
+            if (event.data === 'unchanged')
+                confirmed = true;
+            else if (event.data === 'changed') {
+                stop();
+                if (!confirmed && recentlyActed())
+                    return;
+                markActed();
+                onChange();
+            }
+            else if (event.data === 'error') {
+                stop();
+            }
+        };
+        window.addEventListener('message', answer);
+        frame.addEventListener('load', ask);
+        document.addEventListener('visibilitychange', ask);
+        window.addEventListener('focus', ask);
+        const timer = setInterval(ask, options.intervalMs ?? 3000);
+        document.body.appendChild(frame);
+        cleanups.push(() => {
+            window.removeEventListener('message', answer);
+            document.removeEventListener('visibilitychange', ask);
+            window.removeEventListener('focus', ask);
+            clearInterval(timer);
+            frame.remove();
+        });
+    })();
+    return stop;
+}

package/dist/session-monitor.mjs

@@ -0,0 +1,77 @@
+// src/session-monitor.ts
+var SETTLE_MS = 15e3;
+var GUARD_KEY = "fx-session-check";
+function recentlyActed() {
+  try {
+    return Date.now() - Number(sessionStorage.getItem(GUARD_KEY) ?? 0) < SETTLE_MS;
+  } catch {
+    return false;
+  }
+}
+function markActed() {
+  try {
+    sessionStorage.setItem(GUARD_KEY, String(Date.now()));
+  } catch {
+  }
+}
+function watchProviderSession(options = {}) {
+  if (typeof window === "undefined" || typeof document === "undefined") return () => {
+  };
+  const base = (options.basePath ?? "/auth").replace(/\/$/, "");
+  const fetcher = options.fetcher ?? fetch;
+  const onChange = options.onChange ?? (() => {
+    const login = new URLSearchParams({ prompt: "none", returnTo: location.pathname + location.search });
+    location.assign(`${base}/login?${login}`);
+  });
+  let stopped = false;
+  const cleanups = [];
+  const stop = () => {
+    stopped = true;
+    for (const cleanup of cleanups.splice(0)) cleanup();
+  };
+  void (async () => {
+    const check = await fetcher(`${base}/session-check`, { credentials: "same-origin" }).then((response) => response.ok ? response.json() : null).catch(() => null);
+    if (stopped || !check?.frame || !check.state) return;
+    const origin = new URL(check.frame).origin;
+    const frame = document.createElement("iframe");
+    frame.src = check.frame;
+    frame.title = "session check";
+    frame.setAttribute("aria-hidden", "true");
+    frame.tabIndex = -1;
+    frame.style.cssText = "position:absolute;width:0;height:0;border:0;visibility:hidden";
+    const message = `${check.clientId} ${check.state}`;
+    const ask = () => {
+      if (!stopped && document.visibilityState === "visible") frame.contentWindow?.postMessage(message, origin);
+    };
+    let confirmed = false;
+    const answer = (event) => {
+      if (event.origin !== origin || event.source !== frame.contentWindow) return;
+      if (event.data === "unchanged") confirmed = true;
+      else if (event.data === "changed") {
+        stop();
+        if (!confirmed && recentlyActed()) return;
+        markActed();
+        onChange();
+      } else if (event.data === "error") {
+        stop();
+      }
+    };
+    window.addEventListener("message", answer);
+    frame.addEventListener("load", ask);
+    document.addEventListener("visibilitychange", ask);
+    window.addEventListener("focus", ask);
+    const timer = setInterval(ask, options.intervalMs ?? 3e3);
+    document.body.appendChild(frame);
+    cleanups.push(() => {
+      window.removeEventListener("message", answer);
+      document.removeEventListener("visibilitychange", ask);
+      window.removeEventListener("focus", ask);
+      clearInterval(timer);
+      frame.remove();
+    });
+  })();
+  return stop;
+}
+export {
+  watchProviderSession
+};

package/dist/tokens.cjs

@@ -24,6 +24,6 @@ __export(tokens_exports, {
   AuthServiceToken: () => AuthServiceToken
 });
 module.exports = __toCommonJS(tokens_exports);
-var import_di = require("@fluixi/start/di");
+var import_di = require("@fluixi/di");
 var AuthServiceToken = (0, import_di.injectionToken)("AuthService");
 var AuthClientToken = (0, import_di.injectionToken)("AuthClient");

package/dist/tokens.d.ts

@@ -7,7 +7,7 @@ import type { AuthService } from './service.js';
  * explicitly. Injecting it without providing it is an error that names this token,
  * which is the failure worth having.
  */
-export declare const AuthServiceToken: import("@fluixi/start/di").Token<AuthService<unknown, unknown, (p: unknown) => boolean>>;
+export declare const AuthServiceToken: import("@fluixi/di").Token<AuthService<unknown, unknown, (p: unknown) => boolean>>;
 /** The protocol half, for code that drives the flow without needing the session. */
-export declare const AuthClientToken: import("@fluixi/start/di").Token<AuthClient>;
+export declare const AuthClientToken: import("@fluixi/di").Token<AuthClient>;
 //# sourceMappingURL=tokens.d.ts.map

package/dist/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,0FAAsD,CAAC;AAEpF,oFAAoF;AACpF,eAAO,MAAM,eAAe,8CAA2C,CAAC"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,oFAAsD,CAAC;AAEpF,oFAAoF;AACpF,eAAO,MAAM,eAAe,wCAA2C,CAAC"}

package/dist/tokens.js

@@ -8,7 +8,7 @@
  * `@fluixi/dom`, so taking it is cheap, and an app that does not use dependency
  * injection never loads this module.
  */
-import { injectionToken } from '@fluixi/start/di';
+import { injectionToken } from '@fluixi/di';
 /**
  * The application-facing service.
  *

package/dist/tokens.mjs

@@ -1,5 +1,5 @@
 // src/tokens.ts
-import { injectionToken } from "@fluixi/start/di";
+import { injectionToken } from "@fluixi/di";
 var AuthServiceToken = injectionToken("AuthService");
 var AuthClientToken = injectionToken("AuthClient");
 export {