@fluixi/oauth2 1.0.0-alpha.1

package/dist/return-to.js

@@ -0,0 +1,71 @@
+/**
+ * Where a completed login is allowed to land.
+ *
+ * A login flow carries a destination so a visitor resumes where they were interrupted,
+ * and that destination arrives from outside: a query parameter, a caller's argument, a
+ * value read back out of storage. Redirecting to it unchecked is an open redirect, and a
+ * login is the worst place to have one. The visitor has just authenticated, so the page
+ * they land on is trusted by them and reached with a live session.
+ *
+ * Sealing the value does not help. A signed cookie cannot be tampered with, and an
+ * attacker putting `?returnTo=https://evil.example/` on a link has no need to tamper: the
+ * application seals the attacker's value itself and honours it afterwards.
+ *
+ * So the rule is what the value is allowed to be, rather than where it came from. A path
+ * on this origin, and nothing else.
+ */
+/**
+ * The destination to use, which is `candidate` when it is safe and the fallback when not.
+ *
+ * Refused, with reasons:
+ *
+ * - an absolute URL on another origin, which is the open redirect itself
+ * - `//host`, which a browser reads as protocol-relative and therefore another origin
+ * - `\\host`, which some browsers normalise to the same thing
+ * - a scheme of any kind, so `javascript:` and `data:` cannot be reached
+ * - a control character, which can be used to smuggle a newline past a naive check
+ * - anything that is not a path, since a bare `dashboard` resolves differently depending
+ *   on where it is used
+ */
+export function safeReturnTo(candidate, options = {}) {
+    const fallback = options.fallback ?? '/';
+    if (!candidate || typeof candidate !== 'string')
+        return fallback;
+    const value = candidate.trim();
+    if (!value)
+        return fallback;
+    // A newline or a NUL can split a header or end a string early in whatever reads it next.
+    if (/[\u0000-\u001f\u007f]/.test(value))
+        return fallback;
+    // Protocol-relative in both spellings. `//evil.test` is another origin, and a backslash
+    // is normalised to a slash by enough browsers to count.
+    if (/^[/\\]{2}/.test(value))
+        return fallback;
+    // A path on this origin, which is the ordinary case and the only one needing no origin
+    // to compare against.
+    if (value.startsWith('/'))
+        return value;
+    // Anything else has to be an absolute URL on an origin this application accepts.
+    const here = options.origin ?? (typeof location === 'undefined' ? undefined : location.origin);
+    const allowed = [here, ...(options.allowedOrigins ?? [])].filter(Boolean);
+    if (!allowed.length)
+        return fallback;
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        // Not a URL and not a path: a bare word, which resolves differently depending on the
+        // page it is used from.
+        return fallback;
+    }
+    // Compared as whole origins. A prefix test would accept
+    // `https://app.example.com.evil.test`, which is a different site.
+    if (!allowed.includes(url.origin))
+        return fallback;
+    // Only http and https, whatever the origin list says: an allowed origin cannot make
+    // `javascript:` safe, and `new URL('javascript:...')` has an origin of `null` anyway.
+    if (url.protocol !== 'http:' && url.protocol !== 'https:')
+        return fallback;
+    return url.toString();
+}

package/dist/return-to.mjs

@@ -0,0 +1,25 @@
+// src/return-to.ts
+function safeReturnTo(candidate, options = {}) {
+  const fallback = options.fallback ?? "/";
+  if (!candidate || typeof candidate !== "string") return fallback;
+  const value = candidate.trim();
+  if (!value) return fallback;
+  if (/[\u0000-\u001f\u007f]/.test(value)) return fallback;
+  if (/^[/\\]{2}/.test(value)) return fallback;
+  if (value.startsWith("/")) return value;
+  const here = options.origin ?? (typeof location === "undefined" ? void 0 : location.origin);
+  const allowed = [here, ...options.allowedOrigins ?? []].filter(Boolean);
+  if (!allowed.length) return fallback;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return fallback;
+  }
+  if (!allowed.includes(url.origin)) return fallback;
+  if (url.protocol !== "http:" && url.protocol !== "https:") return fallback;
+  return url.toString();
+}
+export {
+  safeReturnTo
+};

package/dist/roles.cjs

@@ -0,0 +1,56 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/roles.ts
+var roles_exports = {};
+__export(roles_exports, {
+  rolesFrom: () => rolesFrom
+});
+module.exports = __toCommonJS(roles_exports);
+var rolesFrom = {
+  /** Keycloak, realm roles. Where it puts them unless a client mapper is configured. */
+  keycloakRealm: (claims) => {
+    const realm = claims.realm_access;
+    return realm?.roles ?? [];
+  },
+  /** Keycloak, roles scoped to one client rather than the realm. */
+  keycloakClient: (clientId) => (claims) => {
+    const all = claims.resource_access;
+    return all?.[clientId]?.roles ?? [];
+  },
+  /** Okta, and anything else using a groups claim. Needs a groups claim on the token. */
+  groups: (claims) => Array.isArray(claims.groups) ? claims.groups : [],
+  /** Cognito, which namespaces the claim. */
+  cognito: (claims) => {
+    const groups = claims["cognito:groups"];
+    return Array.isArray(groups) ? groups : [];
+  },
+  /**
+   * Auth0, which requires a namespaced custom claim added by an action.
+   *
+   * `rolesFrom.namespaced('https://adafri.com/roles')`. Auth0 silently drops a custom claim
+   * that is not a URI, so an empty list here usually means the namespace, not the action.
+   */
+  namespaced: (claim) => (claims) => {
+    const value = claims[claim];
+    return Array.isArray(value) ? value : [];
+  },
+  /** The `scope` claim read as a role list, for a provider issuing no roles at all. */
+  scope: (claims) => typeof claims.scope === "string" ? claims.scope.split(" ") : []
+};

package/dist/roles.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Reading roles off a token's claims.
+ *
+ * Its own module because it is pure data access and a browser bundle wants it too: presets
+ * name one per provider, and an app's shared config picks one. Kept here, clear of
+ * `verify.ts`, so importing it never drags the verifier and its `node:` imports into a
+ * client build.
+ */
+import type { TokenClaims } from './verify.js';
+/**
+ * Where each provider puts roles.
+ *
+ * There is no default because they genuinely disagree, and guessing wrong means a guard that
+ * reads an empty list and refuses everyone. Each of these was read off a real token.
+ */
+export declare const rolesFrom: {
+    /** Keycloak, realm roles. Where it puts them unless a client mapper is configured. */
+    keycloakRealm: (claims: TokenClaims) => string[];
+    /** Keycloak, roles scoped to one client rather than the realm. */
+    keycloakClient: (clientId: string) => (claims: TokenClaims) => string[];
+    /** Okta, and anything else using a groups claim. Needs a groups claim on the token. */
+    groups: (claims: TokenClaims) => string[];
+    /** Cognito, which namespaces the claim. */
+    cognito: (claims: TokenClaims) => string[];
+    /**
+     * Auth0, which requires a namespaced custom claim added by an action.
+     *
+     * `rolesFrom.namespaced('https://adafri.com/roles')`. Auth0 silently drops a custom claim
+     * that is not a URI, so an empty list here usually means the namespace, not the action.
+     */
+    namespaced: (claim: string) => (claims: TokenClaims) => string[];
+    /** The `scope` claim read as a role list, for a provider issuing no roles at all. */
+    scope: (claims: TokenClaims) => string[];
+};
+//# sourceMappingURL=roles.d.ts.map

package/dist/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../src/roles.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,SAAS;IACpB,sFAAsF;4BAC9D,WAAW,KAAG,MAAM,EAAE;IAK9C,kEAAkE;+BAErD,MAAM,MAChB,QAAQ,WAAW,KAAG,MAAM,EAAE;IAKjC,uFAAuF;qBACtE,WAAW,KAAG,MAAM,EAAE;IAGvC,2CAA2C;sBACzB,WAAW,KAAG,MAAM,EAAE;IAKxC;;;;;OAKG;wBAEO,MAAM,MACb,QAAQ,WAAW,KAAG,MAAM,EAAE;IAKjC,qFAAqF;oBACrE,WAAW,KAAG,MAAM,EAAE;CAEvC,CAAC"}

package/dist/roles.js

@@ -0,0 +1,37 @@
+/**
+ * Where each provider puts roles.
+ *
+ * There is no default because they genuinely disagree, and guessing wrong means a guard that
+ * reads an empty list and refuses everyone. Each of these was read off a real token.
+ */
+export const rolesFrom = {
+    /** Keycloak, realm roles. Where it puts them unless a client mapper is configured. */
+    keycloakRealm: (claims) => {
+        const realm = claims.realm_access;
+        return realm?.roles ?? [];
+    },
+    /** Keycloak, roles scoped to one client rather than the realm. */
+    keycloakClient: (clientId) => (claims) => {
+        const all = claims.resource_access;
+        return all?.[clientId]?.roles ?? [];
+    },
+    /** Okta, and anything else using a groups claim. Needs a groups claim on the token. */
+    groups: (claims) => Array.isArray(claims.groups) ? claims.groups : [],
+    /** Cognito, which namespaces the claim. */
+    cognito: (claims) => {
+        const groups = claims['cognito:groups'];
+        return Array.isArray(groups) ? groups : [];
+    },
+    /**
+     * Auth0, which requires a namespaced custom claim added by an action.
+     *
+     * `rolesFrom.namespaced('https://adafri.com/roles')`. Auth0 silently drops a custom claim
+     * that is not a URI, so an empty list here usually means the namespace, not the action.
+     */
+    namespaced: (claim) => (claims) => {
+        const value = claims[claim];
+        return Array.isArray(value) ? value : [];
+    },
+    /** The `scope` claim read as a role list, for a provider issuing no roles at all. */
+    scope: (claims) => typeof claims.scope === 'string' ? claims.scope.split(' ') : [],
+};

package/dist/roles.mjs

@@ -0,0 +1,35 @@
+// src/roles.ts
+var rolesFrom = {
+  /** Keycloak, realm roles. Where it puts them unless a client mapper is configured. */
+  keycloakRealm: (claims) => {
+    const realm = claims.realm_access;
+    return realm?.roles ?? [];
+  },
+  /** Keycloak, roles scoped to one client rather than the realm. */
+  keycloakClient: (clientId) => (claims) => {
+    const all = claims.resource_access;
+    return all?.[clientId]?.roles ?? [];
+  },
+  /** Okta, and anything else using a groups claim. Needs a groups claim on the token. */
+  groups: (claims) => Array.isArray(claims.groups) ? claims.groups : [],
+  /** Cognito, which namespaces the claim. */
+  cognito: (claims) => {
+    const groups = claims["cognito:groups"];
+    return Array.isArray(groups) ? groups : [];
+  },
+  /**
+   * Auth0, which requires a namespaced custom claim added by an action.
+   *
+   * `rolesFrom.namespaced('https://adafri.com/roles')`. Auth0 silently drops a custom claim
+   * that is not a URI, so an empty list here usually means the namespace, not the action.
+   */
+  namespaced: (claim) => (claims) => {
+    const value = claims[claim];
+    return Array.isArray(value) ? value : [];
+  },
+  /** The `scope` claim read as a role list, for a provider issuing no roles at all. */
+  scope: (claims) => typeof claims.scope === "string" ? claims.scope.split(" ") : []
+};
+export {
+  rolesFrom
+};

package/dist/server-client.cjs

@@ -0,0 +1,134 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/server-client.ts
+var server_client_exports = {};
+__export(server_client_exports, {
+  COOKIE_SESSION: () => COOKIE_SESSION,
+  createServerClient: () => createServerClient
+});
+module.exports = __toCommonJS(server_client_exports);
+
+// src/return-to.ts
+function safeReturnTo(candidate, options = {}) {
+  const fallback = options.fallback ?? "/";
+  if (!candidate || typeof candidate !== "string") return fallback;
+  const value = candidate.trim();
+  if (!value) return fallback;
+  if (/[\u0000-\u001f\u007f]/.test(value)) return fallback;
+  if (/^[/\\]{2}/.test(value)) return fallback;
+  if (value.startsWith("/")) return value;
+  const here = options.origin ?? (typeof location === "undefined" ? void 0 : location.origin);
+  const allowed = [here, ...options.allowedOrigins ?? []].filter(Boolean);
+  if (!allowed.length) return fallback;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return fallback;
+  }
+  if (!allowed.includes(url.origin)) return fallback;
+  if (url.protocol !== "http:" && url.protocol !== "https:") return fallback;
+  return url.toString();
+}
+
+// src/types.ts
+var OAuthError = class extends Error {
+  constructor(message, code, description) {
+    super(message);
+    this.code = code;
+    this.description = description;
+    this.name = "OAuthError";
+  }
+};
+
+// src/server-client.ts
+var COOKIE_SESSION = "cookie";
+function createServerClient(config, fetcher = fetch) {
+  const base = (config.basePath ?? "/auth").replace(/\/$/, "");
+  const url = (path) => `${base}${path}`;
+  const call = (path, init = {}) => fetcher(url(path), { credentials: "same-origin", ...init });
+  return {
+    async login(options = {}) {
+      const target = new URL(url("/login"), location.origin);
+      if (options.returnTo) target.searchParams.set("returnTo", options.returnTo);
+      for (const [key, value] of Object.entries(options.params ?? {})) {
+        target.searchParams.set(key, value);
+      }
+      location.assign(target.toString());
+    },
+    async handleCallback(params) {
+      const response = await call("/callback", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(params)
+      });
+      if (!response.ok) {
+        const body = await response.json().catch(() => ({}));
+        throw new OAuthError(
+          String(body.error ?? `Callback failed: ${response.status}`),
+          String(body.error ?? "callback_failed")
+        );
+      }
+      return { accessToken: COOKIE_SESSION };
+    },
+    async refresh() {
+      const response = await call("/refresh", { method: "POST" });
+      if (!response.ok) {
+        throw new OAuthError("The server could not extend the session.", "refresh_failed");
+      }
+      return { accessToken: COOKIE_SESSION };
+    },
+    async fetchUser() {
+      const custom = config.userInfo;
+      const response = custom?.url ? await fetcher(custom.url, {
+        method: custom.method ?? "GET",
+        credentials: custom.credentials ?? "same-origin",
+        headers: { accept: "application/json", ...custom.headers }
+      }) : await call("/me");
+      if (!response.ok) {
+        throw new OAuthError(`The server refused the user request: ${response.status}`, "me_failed");
+      }
+      const raw = await response.json();
+      return custom?.map ? await custom.map(raw, COOKIE_SESSION) : raw;
+    },
+    /**
+     * Retire the session's tokens, which only the server can do here.
+     *
+     * The browser holds a cookie and no token, so it has nothing to send to a revocation
+     * endpoint. This asks the server's own route, which opens the cookie and revokes what
+     * is inside.
+     */
+    async revoke(_token, hint = "refresh_token") {
+      await call(`/revoke?hint=${hint}`, { method: "POST" }).catch(() => void 0);
+    },
+    async logout(options = {}) {
+      await call("/logout", { method: "POST" }).catch(() => void 0);
+      const target = options.returnTo ? safeReturnTo(options.returnTo, {
+        fallback: config.postLogoutRedirectUri ?? "/",
+        allowedOrigins: config.allowedReturnOrigins
+      }) : config.postLogoutRedirectUri ?? "/";
+      if (typeof location !== "undefined") location.assign(target);
+    },
+    async restore() {
+      const response = await call("/me");
+      return response.ok ? { accessToken: COOKIE_SESSION } : null;
+    }
+  };
+}

package/dist/server-client.d.ts

@@ -0,0 +1,12 @@
+import type { AuthClient, ServerConfig } from './types.js';
+/**
+ * Stands in for the access token the caller never sees.
+ *
+ * `@fluixi/session` is built around a token string, and here the credential is a cookie
+ * the browser attaches on its own. A constant keeps the session's state machine working
+ * without inventing a token, and nothing ever sends it anywhere: requests carry the
+ * cookie.
+ */
+export declare const COOKIE_SESSION = "cookie";
+export declare function createServerClient(config: ServerConfig, fetcher?: typeof fetch): AuthClient;
+//# sourceMappingURL=server-client.d.ts.map

package/dist/server-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-client.d.ts","sourceRoot":"","sources":["../src/server-client.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,UAAU,EAAgC,YAAY,EAAU,MAAM,YAAY,CAAC;AAEjG;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,WAAW,CAAC;AAEvC,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,YAAY,EACpB,OAAO,GAAE,OAAO,KAAa,GAC5B,UAAU,CAgGZ"}

package/dist/server-client.js

@@ -0,0 +1,107 @@
+/**
+ * The browser half of a server-held session.
+ *
+ * Every method is a call to a route the application's own server exposes, which is what
+ * `@fluixi/oauth2/server` provides. No token reaches this file: the server sets an
+ * httpOnly cookie, so a script on the page has nothing to read and an XSS cannot lift a
+ * session.
+ *
+ * The shape is the same `AuthClient` the browser implementation satisfies, so the
+ * service above does not know which one it has.
+ */
+import { safeReturnTo } from './return-to.js';
+import { OAuthError } from './types.js';
+/**
+ * Stands in for the access token the caller never sees.
+ *
+ * `@fluixi/session` is built around a token string, and here the credential is a cookie
+ * the browser attaches on its own. A constant keeps the session's state machine working
+ * without inventing a token, and nothing ever sends it anywhere: requests carry the
+ * cookie.
+ */
+export const COOKIE_SESSION = 'cookie';
+export function createServerClient(config, fetcher = fetch) {
+    const base = (config.basePath ?? '/auth').replace(/\/$/, '');
+    const url = (path) => `${base}${path}`;
+    /** Same credentials rule for every call: the cookie, and never a bearer token. */
+    const call = (path, init = {}) => fetcher(url(path), { credentials: 'same-origin', ...init });
+    return {
+        async login(options = {}) {
+            // The server builds the authorization URL, because it holds the PKCE verifier and
+            // the client secret. The browser only navigates.
+            const target = new URL(url('/login'), location.origin);
+            if (options.returnTo)
+                target.searchParams.set('returnTo', options.returnTo);
+            for (const [key, value] of Object.entries(options.params ?? {})) {
+                target.searchParams.set(key, value);
+            }
+            location.assign(target.toString());
+        },
+        async handleCallback(params) {
+            // The server owns the exchange; the browser is telling it the callback arrived.
+            // In the usual deployment the redirect URI points at the server route directly and
+            // this is never called, which is why it is tolerant about what it gets back.
+            const response = await call('/callback', {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify(params),
+            });
+            if (!response.ok) {
+                const body = (await response.json().catch(() => ({})));
+                throw new OAuthError(String(body.error ?? `Callback failed: ${response.status}`), String(body.error ?? 'callback_failed'));
+            }
+            return { accessToken: COOKIE_SESSION };
+        },
+        async refresh() {
+            const response = await call('/refresh', { method: 'POST' });
+            if (!response.ok) {
+                throw new OAuthError('The server could not extend the session.', 'refresh_failed');
+            }
+            return { accessToken: COOKIE_SESSION };
+        },
+        async fetchUser() {
+            const custom = config.userInfo;
+            // A URL here points at the app's own API rather than the session route. The cookie
+            // still authenticates it, which is why `credentials` stays on either way.
+            const response = custom?.url
+                ? await fetcher(custom.url, {
+                    method: custom.method ?? 'GET',
+                    credentials: custom.credentials ?? 'same-origin',
+                    headers: { accept: 'application/json', ...custom.headers },
+                })
+                : await call('/me');
+            if (!response.ok) {
+                throw new OAuthError(`The server refused the user request: ${response.status}`, 'me_failed');
+            }
+            const raw = (await response.json());
+            return custom?.map ? (await custom.map(raw, COOKIE_SESSION)) : raw;
+        },
+        /**
+         * Retire the session's tokens, which only the server can do here.
+         *
+         * The browser holds a cookie and no token, so it has nothing to send to a revocation
+         * endpoint. This asks the server's own route, which opens the cookie and revokes what
+         * is inside.
+         */
+        async revoke(_token, hint = 'refresh_token') {
+            await call(`/revoke?hint=${hint}`, { method: 'POST' }).catch(() => undefined);
+        },
+        async logout(options = {}) {
+            await call('/logout', { method: 'POST' }).catch(() => undefined);
+            const target = options.returnTo
+                ? safeReturnTo(options.returnTo, {
+                    fallback: config.postLogoutRedirectUri ?? '/',
+                    allowedOrigins: config.allowedReturnOrigins,
+                })
+                : (config.postLogoutRedirectUri ?? '/');
+            if (typeof location !== 'undefined')
+                location.assign(target);
+        },
+        async restore() {
+            // The cookie is either valid or it is not, and only the server knows. A successful
+            // `/me` is the answer.
+            const response = await call('/me');
+            return response.ok ? { accessToken: COOKIE_SESSION } : null;
+        },
+    };
+}

package/dist/server-client.mjs

@@ -0,0 +1,111 @@
+// src/return-to.ts
+function safeReturnTo(candidate, options = {}) {
+  const fallback = options.fallback ?? "/";
+  if (!candidate || typeof candidate !== "string") return fallback;
+  const value = candidate.trim();
+  if (!value) return fallback;
+  if (/[\u0000-\u001f\u007f]/.test(value)) return fallback;
+  if (/^[/\\]{2}/.test(value)) return fallback;
+  if (value.startsWith("/")) return value;
+  const here = options.origin ?? (typeof location === "undefined" ? void 0 : location.origin);
+  const allowed = [here, ...options.allowedOrigins ?? []].filter(Boolean);
+  if (!allowed.length) return fallback;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return fallback;
+  }
+  if (!allowed.includes(url.origin)) return fallback;
+  if (url.protocol !== "http:" && url.protocol !== "https:") return fallback;
+  return url.toString();
+}
+
+// src/types.ts
+var OAuthError = class extends Error {
+  constructor(message, code, description) {
+    super(message);
+    this.code = code;
+    this.description = description;
+    this.name = "OAuthError";
+  }
+};
+
+// src/server-client.ts
+var COOKIE_SESSION = "cookie";
+function createServerClient(config, fetcher = fetch) {
+  const base = (config.basePath ?? "/auth").replace(/\/$/, "");
+  const url = (path) => `${base}${path}`;
+  const call = (path, init = {}) => fetcher(url(path), { credentials: "same-origin", ...init });
+  return {
+    async login(options = {}) {
+      const target = new URL(url("/login"), location.origin);
+      if (options.returnTo) target.searchParams.set("returnTo", options.returnTo);
+      for (const [key, value] of Object.entries(options.params ?? {})) {
+        target.searchParams.set(key, value);
+      }
+      location.assign(target.toString());
+    },
+    async handleCallback(params) {
+      const response = await call("/callback", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(params)
+      });
+      if (!response.ok) {
+        const body = await response.json().catch(() => ({}));
+        throw new OAuthError(
+          String(body.error ?? `Callback failed: ${response.status}`),
+          String(body.error ?? "callback_failed")
+        );
+      }
+      return { accessToken: COOKIE_SESSION };
+    },
+    async refresh() {
+      const response = await call("/refresh", { method: "POST" });
+      if (!response.ok) {
+        throw new OAuthError("The server could not extend the session.", "refresh_failed");
+      }
+      return { accessToken: COOKIE_SESSION };
+    },
+    async fetchUser() {
+      const custom = config.userInfo;
+      const response = custom?.url ? await fetcher(custom.url, {
+        method: custom.method ?? "GET",
+        credentials: custom.credentials ?? "same-origin",
+        headers: { accept: "application/json", ...custom.headers }
+      }) : await call("/me");
+      if (!response.ok) {
+        throw new OAuthError(`The server refused the user request: ${response.status}`, "me_failed");
+      }
+      const raw = await response.json();
+      return custom?.map ? await custom.map(raw, COOKIE_SESSION) : raw;
+    },
+    /**
+     * Retire the session's tokens, which only the server can do here.
+     *
+     * The browser holds a cookie and no token, so it has nothing to send to a revocation
+     * endpoint. This asks the server's own route, which opens the cookie and revokes what
+     * is inside.
+     */
+    async revoke(_token, hint = "refresh_token") {
+      await call(`/revoke?hint=${hint}`, { method: "POST" }).catch(() => void 0);
+    },
+    async logout(options = {}) {
+      await call("/logout", { method: "POST" }).catch(() => void 0);
+      const target = options.returnTo ? safeReturnTo(options.returnTo, {
+        fallback: config.postLogoutRedirectUri ?? "/",
+        allowedOrigins: config.allowedReturnOrigins
+      }) : config.postLogoutRedirectUri ?? "/";
+      if (typeof location !== "undefined") location.assign(target);
+    },
+    async restore() {
+      const response = await call("/me");
+      return response.ok ? { accessToken: COOKIE_SESSION } : null;
+    }
+  };
+}
+export {
+  COOKIE_SESSION,
+  createServerClient
+};