@flytedesk/app-kit 0.5.0 → 0.7.0

package/dist/auth/testing/fake-idp.js

@@ -0,0 +1,336 @@
+import { createServer } from "node:http";
+import { createHash, randomBytes } from "node:crypto";
+import { generateKeyPair, exportJWK, SignJWT } from "jose";
+export class FakeIdp {
+    server;
+    baseUrl = "";
+    clientId;
+    appId;
+    identities;
+    nextIdentityKey;
+    // Whether this browser/client still holds a live flytedesk-id end-user session cookie
+    // — real oidc-provider's `prompt=none` handling (OIDC Core 3.1.2.1) answers straight
+    // from that cookie with no interaction at all: a fresh code if it's live,
+    // `error=login_required` back to redirect_uri if it's not. Defaults to true.
+    idpSessionLive = true;
+    accessTokenTtlSeconds;
+    // Test-control: forces every subsequent refresh_token grant to fail — see
+    // setForceRefreshFailure's doc comment.
+    forceRefreshFailure = false;
+    keys;
+    publicJwk;
+    kid = "fake-idp-key";
+    codes = new Map();
+    grants = new Map();
+    constructor(opts) {
+        this.clientId = opts.clientId;
+        this.appId = opts.appId ?? opts.clientId;
+        this.identities = opts.identities;
+        this.accessTokenTtlSeconds = opts.accessTokenTtlSeconds ?? 900;
+        if (!(opts.defaultIdentityKey in this.identities)) {
+            throw new Error(`FakeIdp: defaultIdentityKey "${opts.defaultIdentityKey}" is not in identities`);
+        }
+        this.nextIdentityKey = opts.defaultIdentityKey;
+    }
+    /** Pick the identity the NEXT `/auth` grants. */
+    setNextIdentity(key) {
+        if (!(key in this.identities)) {
+            throw new Error(`FakeIdp: no identity registered for "${key}"`);
+        }
+        this.nextIdentityKey = key;
+    }
+    /** See `idpSessionLive`'s doc comment. */
+    setIdpSessionLive(live) {
+        this.idpSessionLive = live;
+    }
+    /** Forces every subsequent `grant_type=refresh_token` call to fail with
+     *  `invalid_grant`, exactly as real flytedesk-id would for a revoked/expired refresh
+     *  token — lets a consumer's test exercise its refresh-failure handling (AK-16;
+     *  `@flytedesk/app-kit/auth`'s `loadAuthedUser`/`getLiveIdpAccessToken` force
+     *  re-login on this) without waiting on a real expiry or needing a separate
+     *  `/revoke` call. */
+    setForceRefreshFailure(force) {
+        this.forceRefreshFailure = force;
+    }
+    /**
+     * Mutates a registered identity's roles/permissions/apps IN PLACE. Every live grant
+     * already holds a reference to this identity object (this fixture keeps identities by
+     * reference, never a copy — see the file doc comment), so the change is visible on
+     * that identity's very next request, with NO new login required. Lets a consumer's
+     * test simulate flytedesk-id revoking a role or changing an app's catalog entry mid-
+     * session (AK-16), which the plain "log in as a different identity" flow can't do.
+     */
+    updateIdentity(key, patch) {
+        const identity = this.identities[key];
+        if (!identity) {
+            throw new Error(`FakeIdp: no identity registered for "${key}"`);
+        }
+        Object.assign(identity, patch);
+    }
+    get url() {
+        if (!this.baseUrl)
+            throw new Error("FakeIdp not started");
+        return this.baseUrl;
+    }
+    async start(port = 0) {
+        this.keys = await generateKeyPair("RS256", { extractable: true });
+        this.publicJwk = {
+            ...(await exportJWK(this.keys.publicKey)),
+            kid: this.kid,
+            use: "sig",
+            alg: "RS256",
+        };
+        this.server = createServer((req, res) => {
+            this.handle(req, res).catch((err) => {
+                res.writeHead(500, { "content-type": "application/json" });
+                res.end(JSON.stringify({ error: "fake_idp_error", detail: String(err) }));
+            });
+        });
+        await new Promise((resolve) => this.server.listen(port, "127.0.0.1", resolve));
+        const addr = this.server.address();
+        if (!addr || typeof addr === "string")
+            throw new Error("FakeIdp failed to bind a port");
+        this.baseUrl = `http://127.0.0.1:${addr.port}`;
+        return this.baseUrl;
+    }
+    async stop() {
+        if (this.server)
+            await new Promise((resolve) => this.server.close(() => resolve()));
+        this.server = undefined;
+    }
+    json(res, status, body) {
+        res.writeHead(status, { "content-type": "application/json" });
+        res.end(JSON.stringify(body));
+    }
+    async readForm(req) {
+        const chunks = [];
+        for await (const c of req)
+            chunks.push(c);
+        return new URLSearchParams(Buffer.concat(chunks).toString("utf8"));
+    }
+    bearer(req) {
+        const h = req.headers.authorization;
+        return h?.startsWith("Bearer ") ? h.slice(7) : null;
+    }
+    async signIdToken(identity) {
+        return new SignJWT({})
+            .setProtectedHeader({ alg: "RS256", kid: this.kid })
+            .setIssuer(this.baseUrl)
+            .setAudience(this.clientId)
+            .setSubject(identity.sub)
+            .setIssuedAt()
+            .setExpirationTime("15m")
+            .sign(this.keys.privateKey);
+    }
+    issueGrant(identity) {
+        const accessToken = `at-${randomBytes(24).toString("base64url")}`;
+        const refreshToken = `rt-${randomBytes(24).toString("base64url")}`;
+        this.grants.set(accessToken, { identity });
+        this.grants.set(refreshToken, { identity });
+        return { accessToken, refreshToken };
+    }
+    async handle(req, res) {
+        const u = new URL(req.url ?? "/", this.baseUrl);
+        const path = u.pathname;
+        if (req.method === "GET" && path === "/.well-known/openid-configuration") {
+            return this.json(res, 200, {
+                issuer: this.baseUrl,
+                authorization_endpoint: `${this.baseUrl}/auth`,
+                token_endpoint: `${this.baseUrl}/token`,
+                jwks_uri: `${this.baseUrl}/jwks`,
+                userinfo_endpoint: `${this.baseUrl}/me`,
+                // No revocation_endpoint (AK-16): real flytedesk-id's oidc-provider config
+                // (src/lib/oidcProvider.ts) never enables `features.revocation`, so its own
+                // discovery document never advertises one either — this fixture must match
+                // that exactly, or a test against it would pass while the real deployment
+                // silently no-ops the same code path (see oidc-client.ts's revokeIdpToken,
+                // which is a deliberate no-op whenever revocation_endpoint is absent). The
+                // POST /revoke route below is a separate, fixed test-control mechanism, not an
+                // OIDC endpoint this fixture ever claims to have.
+                response_types_supported: ["code"],
+                id_token_signing_alg_values_supported: ["RS256"],
+                code_challenge_methods_supported: ["S256"],
+            });
+        }
+        if (req.method === "GET" && path === "/jwks") {
+            return this.json(res, 200, { keys: [this.publicJwk] });
+        }
+        // Authorize: auto-grant the currently-selected identity, redirect back with a code —
+        // UNLESS this is a `prompt=none` silent request and idpSessionLive has been turned
+        // off, in which case real oidc-provider answers `error=login_required` with no
+        // interaction UI at all, and this fake mirrors that exactly.
+        if (req.method === "GET" && path === "/auth") {
+            const redirectUri = u.searchParams.get("redirect_uri");
+            const state = u.searchParams.get("state") ?? "";
+            const codeChallenge = u.searchParams.get("code_challenge") ?? "";
+            const prompt = u.searchParams.get("prompt");
+            if (!redirectUri)
+                return this.json(res, 400, { error: "missing redirect_uri" });
+            const loc = new URL(redirectUri);
+            if (prompt === "none" && !this.idpSessionLive) {
+                loc.searchParams.set("error", "login_required");
+                loc.searchParams.set("state", state);
+                res.writeHead(302, { location: loc.toString() });
+                return void res.end();
+            }
+            const code = `code-${randomBytes(18).toString("base64url")}`;
+            this.codes.set(code, { identity: this.identities[this.nextIdentityKey], codeChallenge });
+            loc.searchParams.set("code", code);
+            loc.searchParams.set("state", state);
+            res.writeHead(302, { location: loc.toString() });
+            return void res.end();
+        }
+        if (req.method === "POST" && path === "/token") {
+            const form = await this.readForm(req);
+            const grantType = form.get("grant_type");
+            if (grantType === "authorization_code") {
+                const code = form.get("code") ?? "";
+                const verifier = form.get("code_verifier") ?? "";
+                const entry = this.codes.get(code);
+                if (!entry)
+                    return this.json(res, 400, { error: "invalid_grant" });
+                this.codes.delete(code);
+                // PKCE S256: base64url(sha256(verifier)) must equal the stored challenge.
+                const challenge = createHash("sha256").update(verifier).digest("base64url");
+                if (entry.codeChallenge && challenge !== entry.codeChallenge) {
+                    return this.json(res, 400, { error: "invalid_grant", detail: "pkce_mismatch" });
+                }
+                const { accessToken, refreshToken } = this.issueGrant(entry.identity);
+                return this.json(res, 200, {
+                    access_token: accessToken,
+                    id_token: await this.signIdToken(entry.identity),
+                    refresh_token: refreshToken,
+                    token_type: "Bearer",
+                    expires_in: this.accessTokenTtlSeconds,
+                });
+            }
+            if (grantType === "refresh_token") {
+                // setForceRefreshFailure (AK-16): simulates flytedesk-id rejecting/expiring the
+                // refresh token, without needing a real expiry or a separate /revoke call.
+                if (this.forceRefreshFailure) {
+                    return this.json(res, 400, { error: "invalid_grant", detail: "forced_refresh_failure" });
+                }
+                const rt = form.get("refresh_token") ?? "";
+                const grant = this.grants.get(rt);
+                if (!grant)
+                    return this.json(res, 400, { error: "invalid_grant" });
+                // rotateRefreshToken: true, matching real flytedesk-id (oidcProvider.ts) —
+                // issue a fresh pair for the same identity, and invalidate the token that was
+                // just used: a real oidc-provider marks a rotated refresh token consumed the
+                // instant it's used, so presenting it again is a replay, not a valid refresh
+                // (AK-16 — this fixture previously left the old token live in `grants`
+                // forever, which would have let a test pass against behaviour no real
+                // flytedesk-id token actually has).
+                this.grants.delete(rt);
+                const { accessToken, refreshToken } = this.issueGrant(grant.identity);
+                return this.json(res, 200, {
+                    access_token: accessToken,
+                    id_token: await this.signIdToken(grant.identity),
+                    refresh_token: refreshToken,
+                    token_type: "Bearer",
+                    expires_in: this.accessTokenTtlSeconds,
+                });
+            }
+            return this.json(res, 400, { error: "unsupported_grant_type" });
+        }
+        if (req.method === "GET" && path === "/me") {
+            const grant = this.tokenGrant(req);
+            if (!grant)
+                return this.json(res, 401, { error: "invalid_token" });
+            return this.json(res, 200, {
+                sub: grant.identity.sub,
+                email: grant.identity.email,
+                email_verified: true,
+                name: grant.identity.name,
+            });
+        }
+        if (req.method === "GET" && path === `/apps/${this.appId}/authorization`) {
+            const grant = this.tokenGrant(req);
+            if (!grant)
+                return this.json(res, 401, { error: "invalid_token" });
+            return this.json(res, 200, {
+                userId: grant.identity.sub,
+                appId: this.appId,
+                roles: grant.identity.roles,
+                // App-prefixed, exactly as real flytedesk-id returns (the consuming app's
+                // flytedeskAuth plugin strips it back off — see plugin.ts's loadAuthedUser).
+                permissions: grant.identity.permissions.map((p) => `${this.appId}:${p}`),
+            });
+        }
+        if (req.method === "GET" && path === "/me/apps") {
+            const grant = this.tokenGrant(req);
+            if (!grant)
+                return this.json(res, 401, { error: "invalid_token" });
+            return this.json(res, 200, { apps: grant.identity.apps ?? [] });
+        }
+        if (req.method === "POST" && path === "/revoke") {
+            const form = await this.readForm(req);
+            this.grants.delete(form.get("token") ?? "");
+            return this.json(res, 200, {});
+        }
+        // Test-control (out-of-band, not part of OIDC): pick the identity the next /auth
+        // grants. The in-process setNextIdentity() covers a Vitest-style harness; this HTTP
+        // hook lets a Playwright spec (a separate process from the server under test) choose
+        // the persona cross-process.
+        if (req.method === "POST" && path === "/__set-identity") {
+            const form = await this.readForm(req);
+            const key = form.get("key") ?? "";
+            if (!(key in this.identities)) {
+                return this.json(res, 400, { error: "unknown_identity", key });
+            }
+            this.setNextIdentity(key);
+            return this.json(res, 200, { key });
+        }
+        // Test-control: flip whether this fake IdP currently has a live end-user session
+        // (see idpSessionLive's doc comment) — same cross-process HTTP-hook pattern as
+        // /__set-identity.
+        if (req.method === "POST" && path === "/__set-idp-session") {
+            const form = await this.readForm(req);
+            const live = form.get("live");
+            if (live !== "true" && live !== "false") {
+                return this.json(res, 400, { error: "invalid_live", live });
+            }
+            this.setIdpSessionLive(live === "true");
+            return this.json(res, 200, { live: this.idpSessionLive });
+        }
+        // Test-control: cross-process form of setForceRefreshFailure — see its doc comment.
+        if (req.method === "POST" && path === "/__set-force-refresh-failure") {
+            const form = await this.readForm(req);
+            const force = form.get("force");
+            if (force !== "true" && force !== "false") {
+                return this.json(res, 400, { error: "invalid_force", force });
+            }
+            this.setForceRefreshFailure(force === "true");
+            return this.json(res, 200, { force: this.forceRefreshFailure });
+        }
+        // Test-control: cross-process form of updateIdentity — see its doc comment. `patch`
+        // is a JSON-encoded Partial<FakeIdpIdentity> (minus `sub`), form-encoded like every
+        // other test-control hook here rather than a JSON request body, for the same
+        // reason /__set-identity and /__set-idp-session are: one readForm() implementation
+        // for every hook.
+        if (req.method === "POST" && path === "/__update-identity") {
+            const form = await this.readForm(req);
+            const key = form.get("key") ?? "";
+            let patch;
+            try {
+                patch = JSON.parse(form.get("patch") ?? "{}");
+            }
+            catch {
+                return this.json(res, 400, { error: "invalid_patch" });
+            }
+            try {
+                this.updateIdentity(key, patch);
+            }
+            catch (err) {
+                return this.json(res, 400, { error: "unknown_identity", detail: String(err) });
+            }
+            return this.json(res, 200, { key });
+        }
+        return this.json(res, 404, { error: "not_found", path });
+    }
+    tokenGrant(req) {
+        const token = this.bearer(req);
+        return token ? (this.grants.get(token) ?? null) : null;
+    }
+}
+//# sourceMappingURL=fake-idp.js.map

package/dist/auth/testing/fake-idp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-idp.js","sourceRoot":"","sources":["../../../src/auth/testing/fake-idp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,OAAO,EAAY,MAAM,MAAM,CAAC;AAuDrE,MAAM,OAAO,OAAO;IACV,MAAM,CAAU;IAChB,OAAO,GAAG,EAAE,CAAC;IACJ,QAAQ,CAAS;IACjB,KAAK,CAAS;IACd,UAAU,CAAkC;IACrD,eAAe,CAAS;IAChC,sFAAsF;IACtF,qFAAqF;IACrF,0EAA0E;IAC1E,6EAA6E;IACrE,cAAc,GAAG,IAAI,CAAC;IACb,qBAAqB,CAAS;IAC/C,0EAA0E;IAC1E,wCAAwC;IAChC,mBAAmB,GAAG,KAAK,CAAC;IAC5B,IAAI,CAA+C;IACnD,SAAS,CAAO;IACP,GAAG,GAAG,cAAc,CAAC;IACrB,KAAK,GAAG,IAAI,GAAG,EAAgE,CAAC;IAChF,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAExD,YAAY,IAAoB;QAC9B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC;QACzC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC,qBAAqB,IAAI,GAAG,CAAC;QAC/D,IAAI,CAAC,CAAC,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACb,gCAAgC,IAAI,CAAC,kBAAkB,wBAAwB,CAChF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,kBAAkB,CAAC;IACjD,CAAC;IAED,iDAAiD;IACjD,eAAe,CAAC,GAAW;QACzB,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,GAAG,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC;IAC7B,CAAC;IAED,0CAA0C;IAC1C,iBAAiB,CAAC,IAAa;QAC7B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED;;;;;0BAKsB;IACtB,sBAAsB,CAAC,KAAc;QACnC,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC;IACnC,CAAC;IAED;;;;;;;OAOG;IACH,cAAc,CAAC,GAAW,EAAE,KAA4C;QACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,GAAG,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,GAAG;QACL,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC;QAClB,IAAI,CAAC,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,SAAS,GAAG;YACf,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,OAAO;SACb,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACtC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAClC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5E,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,MAAO,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QACtF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAO,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACxF,IAAI,CAAC,OAAO,GAAG,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,MAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC3F,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;IAC1B,CAAC;IAEO,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;QAC7D,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,GAAoB;QACzC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,GAAG;YAAE,MAAM,CAAC,IAAI,CAAC,CAAW,CAAC,CAAC;QACpD,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,CAAC;IAEO,MAAM,CAAC,GAAoB;QACjC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACpC,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,QAAyB;QACjD,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC;aACnB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aACnD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;aACvB,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;aAC1B,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;aACxB,WAAW,EAAE;aACb,iBAAiB,CAAC,KAAK,CAAC;aACxB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;IAEO,UAAU,CAAC,QAAyB;QAC1C,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAClE,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,GAAoB,EAAE,GAAmB;QAC5D,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;QAExB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,mCAAmC,EAAE,CAAC;YACzE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACzB,MAAM,EAAE,IAAI,CAAC,OAAO;gBACpB,sBAAsB,EAAE,GAAG,IAAI,CAAC,OAAO,OAAO;gBAC9C,cAAc,EAAE,GAAG,IAAI,CAAC,OAAO,QAAQ;gBACvC,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,OAAO;gBAChC,iBAAiB,EAAE,GAAG,IAAI,CAAC,OAAO,KAAK;gBACvC,2EAA2E;gBAC3E,4EAA4E;gBAC5E,2EAA2E;gBAC3E,0EAA0E;gBAC1E,2EAA2E;gBAC3E,2EAA2E;gBAC3E,+EAA+E;gBAC/E,kDAAkD;gBAClD,wBAAwB,EAAE,CAAC,MAAM,CAAC;gBAClC,qCAAqC,EAAE,CAAC,OAAO,CAAC;gBAChD,gCAAgC,EAAE,CAAC,MAAM,CAAC;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,qFAAqF;QACrF,mFAAmF;QACnF,+EAA+E;QAC/E,6DAA6D;QAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAChD,MAAM,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;YACjE,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,CAAC,WAAW;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YAEhF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;YACjC,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;gBAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;gBAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;gBACjD,OAAO,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;YACxB,CAAC;YAED,MAAM,IAAI,GAAG,QAAQ,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAE,EAAE,aAAa,EAAE,CAAC,CAAC;YAC1F,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACnC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACjD,OAAO,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACzC,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;gBACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;gBACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACnC,IAAI,CAAC,KAAK;oBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;gBACnE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACxB,0EAA0E;gBAC1E,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAC5E,IAAI,KAAK,CAAC,aAAa,IAAI,SAAS,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;oBAC7D,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;gBAClF,CAAC;gBACD,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACtE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBACzB,YAAY,EAAE,WAAW;oBACzB,QAAQ,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC;oBAChD,aAAa,EAAE,YAAY;oBAC3B,UAAU,EAAE,QAAQ;oBACpB,UAAU,EAAE,IAAI,CAAC,qBAAqB;iBACvC,CAAC,CAAC;YACL,CAAC;YACD,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;gBAClC,gFAAgF;gBAChF,2EAA2E;gBAC3E,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAC;gBAC3F,CAAC;gBACD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;gBAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAClC,IAAI,CAAC,KAAK;oBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;gBACnE,2EAA2E;gBAC3E,8EAA8E;gBAC9E,6EAA6E;gBAC7E,6EAA6E;gBAC7E,uEAAuE;gBACvE,sEAAsE;gBACtE,oCAAoC;gBACpC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACvB,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACtE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBACzB,YAAY,EAAE,WAAW;oBACzB,QAAQ,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC;oBAChD,aAAa,EAAE,YAAY;oBAC3B,UAAU,EAAE,QAAQ;oBACpB,UAAU,EAAE,IAAI,CAAC,qBAAqB;iBACvC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACzB,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG;gBACvB,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;gBAC3B,cAAc,EAAE,IAAI;gBACpB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,gBAAgB,EAAE,CAAC;YACzE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACzB,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG;gBAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;gBAC3B,0EAA0E;gBAC1E,6EAA6E;gBAC7E,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;aACzE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACjC,CAAC;QAED,iFAAiF;QACjF,oFAAoF;QACpF,qFAAqF;QACrF,6BAA6B;QAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACtC,CAAC;QAED,iFAAiF;QACjF,+EAA+E;QAC/E,mBAAmB;QACnB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC9B,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBACxC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;YACxC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,oFAAoF;QACpF,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,8BAA8B,EAAE,CAAC;YACrE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;gBAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,CAAC,sBAAsB,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC;YAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,oFAAoF;QACpF,oFAAoF;QACpF,6EAA6E;QAC7E,mFAAmF;QACnF,kBAAkB;QAClB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,KAA4C,CAAC;YACjD,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAA0C,CAAC;YACzF,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjF,CAAC;YACD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACtC,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAEO,UAAU,CAAC,GAAoB;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,CAAC;CACF"}

package/dist/auth/testing/index.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Test-only fixtures for `@flytedesk/app-kit/auth` consumers — a separate subpath
+ * export so this never ships to a production bundle by accident. See fake-idp.ts.
+ */
+export { FakeIdp, type FakeIdpIdentity, type FakeIdpOptions } from "./fake-idp.js";

package/dist/auth/testing/index.js

@@ -0,0 +1,6 @@
+/**
+ * Test-only fixtures for `@flytedesk/app-kit/auth` consumers — a separate subpath
+ * export so this never ships to a production bundle by accident. See fake-idp.ts.
+ */
+export { FakeIdp } from "./fake-idp.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/testing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/testing/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,OAAO,EAA6C,MAAM,eAAe,CAAC"}

package/dist/auth/types.d.ts

@@ -1,4 +1,6 @@
 import type { FastifyRequest } from "fastify";
+import type { AuthedUserDto, IdpRole } from "./shared-types.js";
+export type { IdpRole };
 /**
  * Profile claims returned by flytedesk-id's userinfo endpoint (`GET {issuer}/me`).
  * Deliberately does NOT include roles/permissions — those come from flytedesk-id's
@@ -13,24 +15,10 @@ export interface UserinfoClaims {
     emailVerified: boolean;
     name?: string;
 }
-export interface IdpRole {
-    id: string;
-    key: string;
-    name: string;
-}
-/** What ends up on `request.authUser` for every authenticated request. */
-export interface AuthedUser {
-    id: string;
-    email: string;
-    name: string;
-    roles: IdpRole[];
-    /** Already stripped of the `${appId}:` prefix flytedesk-id's catalog uses to keep
-     *  permission keys collision-free across apps — see loadAuthedUser in ./plugin.ts. */
-    permissions: string[];
-    /** The IdpSession row id backing this session — the same value AuthStore rows key
-     *  refresh tokens to via `idpSessionId`. */
-    sessionId: string;
-}
+/** What ends up on `request.authUser` for every authenticated request — the identical
+ *  shape `GET {api}/me` returns to the browser, see ./shared-types.js's AuthedUserDto
+ *  doc comment for why this is a single definition rather than two. */
+export type AuthedUser = AuthedUserDto;
 export interface RefreshTokenRow {
     id: string;
     /** Shared by every refresh token descended from the same login, via rotation.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flytedesk/app-kit",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Shared platform kit for flytedesk apps: flytedesk-id auth (BFF/OIDC client) and a Postgres-native trace/audit layer.",
   "type": "module",
   "license": "UNLICENSED",
@@ -37,6 +37,14 @@
       "types": "./dist/auth/index.d.ts",
       "import": "./dist/auth/index.js"
     },
+    "./auth/testing": {
+      "types": "./dist/auth/testing/index.d.ts",
+      "import": "./dist/auth/testing/index.js"
+    },
+    "./auth/client": {
+      "types": "./dist/auth/client/index.d.ts",
+      "import": "./dist/auth/client/index.js"
+    },
     "./trace": {
       "types": "./dist/trace/index.d.ts",
       "import": "./dist/trace/index.js"
@@ -79,11 +87,15 @@
   },
   "peerDependencies": {
     "@prisma/client": "^7",
-    "fastify": "^4 || ^5"
+    "fastify": "^4 || ^5",
+    "react": "^18 || ^19"
   },
   "peerDependenciesMeta": {
     "@prisma/client": {
       "optional": true
+    },
+    "react": {
+      "optional": true
     }
   },
   "overrides": {
@@ -97,9 +109,12 @@
     "@changesets/cli": "^3.0.1",
     "@prisma/client": "^7.10.0",
     "@testcontainers/postgresql": "^12.1.0",
+    "@testing-library/react": "^16.3.3",
     "@types/cross-spawn": "^6.0.6",
     "@types/node": "^24.0.0",
     "@types/pg": "^8.23.1",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
     "@typescript/typescript6": "^6.0.2",
     "@vitest/coverage-v8": "^4.1.11",
     "eslint": "^10.9.1",
@@ -107,9 +122,12 @@
     "eslint-plugin-n": "^18.3.0",
     "fastify": "^5.12.0",
     "globals": "^17.12.0",
+    "jsdom": "^30.1.1",
     "pg": "^8.23.0",
     "prettier": "^3.9.6",
     "publint": "^0.3.24",
+    "react": "^19.3.0",
+    "react-dom": "^19.3.0",
     "testcontainers": "^12.1.0",
     "typescript": "^7.0.2",
     "typescript-eslint": "^8.69.0",