@geekapps/auth-react-native 0.1.0

package/README.md

@@ -0,0 +1,108 @@
+# @geekapps/auth-react-native
+
+SDK de login para apps React Native (Expo ou bare) que usam o Geekapps Auth (`app-api`) como Authorization Server.
+
+Cobre:
+
+- Login via Authorization Code + PKCE, abrindo o navegador do sistema (`Linking.openURL` por padrão, ou um `browserOpener` customizado — ex: `expo-web-browser`);
+- Troca de `code` por tokens, com renovação automática (`refresh_token`) quando o access token está perto de expirar;
+- Device Authorization Grant (útil pra fluxos de segundo dispositivo);
+- Storage de tokens plugável — a lib não força nenhuma dependência nativa; em produção, injete um adapter sobre `expo-secure-store` ou `react-native-keychain`;
+- `request()` — fetch autenticado contra o `app-api`, injeta o Bearer token e renova sozinho se necessário.
+
+Núcleo (`core.ts`) é JS puro, sem imports de `react-native` — só `client.tsx` depende de `Linking`. `crypto.getRandomValues` precisa estar disponível no runtime (ver "Instalação").
+
+## Instalação
+
+```bash
+bun add @geekapps/auth-react-native
+# polyfill de crypto.getRandomValues, necessário pro PKCE
+bun add react-native-get-random-values
+```
+
+No topo do `index.js`/`App.tsx` (antes de qualquer outro import):
+
+```ts
+import "react-native-get-random-values";
+```
+
+## Uso
+
+```tsx
+import { GeekappsAuthProvider, useAuth } from "@geekapps/auth-react-native";
+
+export function App() {
+  return (
+    <GeekappsAuthProvider
+      config={{
+        issuer: "https://auth.suaapp.com",
+        clientId: "gk_client_xxx",
+        redirectUri: "myapp://callback", // precisa de pkceFlowEnabled=true na Application
+        scopes: ["openid", "profile", "email"],
+      }}
+    >
+      <Home />
+    </GeekappsAuthProvider>
+  );
+}
+
+function Home() {
+  const { isAuthenticated, isLoading, user, signIn, signOut, request } = useAuth();
+
+  if (isLoading) return null;
+
+  if (!isAuthenticated) {
+    return <Button title="Entrar" onPress={() => signIn()} />;
+  }
+
+  return (
+    <View>
+      <Text>Olá, {user?.name as string}</Text>
+      <Button title="Sair" onPress={signOut} />
+    </View>
+  );
+}
+```
+
+### Storage seguro (recomendado em produção)
+
+```tsx
+import * as SecureStore from "expo-secure-store";
+import type { TokenStorage } from "@geekapps/auth-react-native";
+
+const secureStorage: TokenStorage = {
+  getItem: (key) => SecureStore.getItemAsync(key),
+  setItem: (key, value) => SecureStore.setItemAsync(key, value),
+  removeItem: (key) => SecureStore.deleteItemAsync(key),
+};
+
+<GeekappsAuthProvider config={config} storage={secureStorage}>
+```
+
+### Browser nativo em apps Expo
+
+Por padrão o login abre no navegador externo (`Linking.openURL`). Em apps Expo, `expo-web-browser` dá uma UX melhor (Custom Tabs/ASWebAuthenticationSession, sem sair do app):
+
+```tsx
+import * as WebBrowser from "expo-web-browser";
+
+<GeekappsAuthProvider
+  config={config}
+  browserOpener={(url) => WebBrowser.openBrowserAsync(url).then(() => undefined)}
+>
+```
+
+### Device flow (segundo dispositivo)
+
+```tsx
+const { startDeviceFlow, waitForDeviceAuthorization } = useAuth();
+
+const device = await startDeviceFlow();
+// mostra device.userCode e device.verificationUri pro usuário
+await waitForDeviceAuthorization(device.deviceCode, device.interval);
+```
+
+## Configuração necessária na Application (dashboard)
+
+- `pkceFlowEnabled = true` — permite `redirect_uri` com custom scheme (ex: `myapp://callback`).
+- Cadastrar `myapp://callback` na lista de `redirect_uris` da Application.

package/dist/chunk-M525RFU3.js

@@ -0,0 +1,231 @@
+// src/core.ts
+import { sha256 } from "@noble/hashes/sha2";
+function resolveConfig(config) {
+  return {
+    issuer: config.issuer.replace(/\/$/, ""),
+    clientId: config.clientId,
+    redirectUri: config.redirectUri,
+    scopes: config.scopes ?? ["openid", "profile", "email"],
+    prompt: config.prompt
+  };
+}
+var GeekappsAuthError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message ?? code);
+    this.name = "GeekappsAuthError";
+    this.code = code;
+  }
+};
+var BASE64_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function base64UrlEncode(bytes) {
+  let result = "";
+  for (let i = 0; i < bytes.length; i += 3) {
+    const b0 = bytes[i];
+    const b1 = bytes[i + 1];
+    const b2 = bytes[i + 2];
+    result += BASE64_CHARS[b0 >> 2];
+    result += BASE64_CHARS[(b0 & 3) << 4 | (b1 === void 0 ? 0 : b1 >> 4)];
+    result += b1 === void 0 ? "" : BASE64_CHARS[(b1 & 15) << 2 | (b2 === void 0 ? 0 : b2 >> 6)];
+    result += b2 === void 0 ? "" : BASE64_CHARS[b2 & 63];
+  }
+  return result.replace(/\+/g, "-").replace(/\//g, "_");
+}
+function randomBytes(length) {
+  const bytes = new Uint8Array(length);
+  const cryptoObj = globalThis.crypto;
+  if (!cryptoObj?.getRandomValues) {
+    throw new GeekappsAuthError(
+      "invalid_response",
+      "crypto.getRandomValues indispon\xEDvel. Importe 'react-native-get-random-values' no topo do seu index/App.tsx antes de qualquer outro import."
+    );
+  }
+  cryptoObj.getRandomValues(bytes);
+  return bytes;
+}
+function generateCodeVerifier() {
+  return base64UrlEncode(randomBytes(32));
+}
+function generateCodeChallenge(verifier) {
+  const hash = sha256(new TextEncoder().encode(verifier));
+  return base64UrlEncode(hash);
+}
+function generateState() {
+  return base64UrlEncode(randomBytes(16));
+}
+function buildAuthorizationUrl(params) {
+  const { config, codeChallenge, state, prompt } = params;
+  const url = new URL(`${config.issuer}/authorize`);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", config.clientId);
+  url.searchParams.set("redirect_uri", config.redirectUri);
+  url.searchParams.set("scope", config.scopes.join(" "));
+  url.searchParams.set("state", state);
+  url.searchParams.set("code_challenge", codeChallenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  const resolvedPrompt = prompt ?? config.prompt;
+  if (resolvedPrompt) url.searchParams.set("prompt", resolvedPrompt);
+  return url.toString();
+}
+function parseCallbackUrl(callbackUrl) {
+  const url = new URL(callbackUrl);
+  return {
+    code: url.searchParams.get("code") ?? void 0,
+    state: url.searchParams.get("state") ?? void 0,
+    error: url.searchParams.get("error") ?? void 0
+  };
+}
+async function assertHttpSuccess(response) {
+  if (response.ok) return;
+  const data = await response.json().catch(() => null);
+  const message = data?.error_description ?? data?.error ?? `HTTP ${response.status}`;
+  throw new GeekappsAuthError("server_error", message);
+}
+function withObtainedAt(data) {
+  return {
+    accessToken: data.access_token,
+    idToken: data.id_token,
+    refreshToken: data.refresh_token,
+    tokenType: data.token_type ?? "Bearer",
+    expiresIn: data.expires_in ?? 3600,
+    scope: data.scope ?? "",
+    obtainedAt: Date.now()
+  };
+}
+async function exchangeCodeForToken(params) {
+  const { config, code, codeVerifier } = params;
+  const response = await fetch(`${config.issuer}/oauth/token`, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: config.redirectUri,
+      client_id: config.clientId,
+      code_verifier: codeVerifier
+    }).toString()
+  });
+  await assertHttpSuccess(response);
+  return withObtainedAt(await response.json());
+}
+async function refreshAccessToken(params) {
+  const { config, refreshToken } = params;
+  const response = await fetch(`${config.issuer}/oauth/token`, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      client_id: config.clientId
+    }).toString()
+  });
+  await assertHttpSuccess(response);
+  return withObtainedAt(await response.json());
+}
+async function startDeviceAuthorization(params) {
+  const { config } = params;
+  const response = await fetch(`${config.issuer}/oauth/device/authorize`, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      client_id: config.clientId,
+      scope: config.scopes.join(" ")
+    }).toString()
+  });
+  await assertHttpSuccess(response);
+  const data = await response.json();
+  return {
+    deviceCode: data.device_code,
+    userCode: data.user_code,
+    verificationUri: data.verification_uri,
+    verificationUriComplete: data.verification_uri_complete,
+    expiresIn: data.expires_in,
+    interval: data.interval
+  };
+}
+async function requestDeviceToken(params) {
+  const { config, deviceCode } = params;
+  const response = await fetch(`${config.issuer}/oauth/device/token`, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+      client_id: config.clientId,
+      device_code: deviceCode
+    }).toString()
+  });
+  if (response.status === 400) {
+    const data = await response.json().catch(() => null);
+    switch (data?.error) {
+      case "authorization_pending":
+        throw new GeekappsAuthError("authorization_pending");
+      case "slow_down":
+        throw new GeekappsAuthError("slow_down");
+      case "access_denied":
+        throw new GeekappsAuthError("access_denied");
+      case "expired_token":
+        throw new GeekappsAuthError("expired_token");
+      default:
+        throw new GeekappsAuthError("invalid_grant", data?.error);
+    }
+  }
+  await assertHttpSuccess(response);
+  return withObtainedAt(await response.json());
+}
+async function pollDeviceToken(params) {
+  const { config, deviceCode, timeoutMs = 3e5, signal } = params;
+  let currentInterval = params.interval;
+  const startedAt = Date.now();
+  while (Date.now() - startedAt < timeoutMs) {
+    if (signal?.aborted) throw new GeekappsAuthError("cancelled");
+    await new Promise((resolve) => setTimeout(resolve, currentInterval * 1e3));
+    try {
+      return await requestDeviceToken({ config, deviceCode });
+    } catch (error) {
+      if (!(error instanceof GeekappsAuthError)) throw error;
+      if (error.code === "authorization_pending") continue;
+      if (error.code === "slow_down") {
+        currentInterval += 5;
+        continue;
+      }
+      throw error;
+    }
+  }
+  throw new GeekappsAuthError("expired_token");
+}
+function isTokenExpiringSoon(tokens, skewSeconds = 60) {
+  const expiresAt = tokens.obtainedAt + tokens.expiresIn * 1e3;
+  return Date.now() >= expiresAt - skewSeconds * 1e3;
+}
+async function fetchUserInfo(params) {
+  const { config, accessToken } = params;
+  const response = await fetch(`${config.issuer}/me`, {
+    headers: { authorization: `Bearer ${accessToken}` }
+  });
+  await assertHttpSuccess(response);
+  return response.json();
+}
+async function revokeSession(params) {
+  const { config, accessToken } = params;
+  await fetch(`${config.issuer}/auth/sign-out`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${accessToken}` }
+  }).catch(() => null);
+}
+
+export {
+  resolveConfig,
+  GeekappsAuthError,
+  generateCodeVerifier,
+  generateCodeChallenge,
+  generateState,
+  buildAuthorizationUrl,
+  parseCallbackUrl,
+  exchangeCodeForToken,
+  refreshAccessToken,
+  startDeviceAuthorization,
+  pollDeviceToken,
+  isTokenExpiringSoon,
+  fetchUserInfo,
+  revokeSession
+};

package/dist/core.d.ts

@@ -0,0 +1,79 @@
+type PromptMode = "login" | "select_account";
+type GeekappsAuthConfig = {
+    /** Auth API/issuer URL (app-api). Ex: https://auth.suaapp.com */
+    issuer: string;
+    clientId: string;
+    /** Deve bater com um redirect_uri de custom scheme cadastrado na Application (pkceFlowEnabled). Ex: myapp://callback */
+    redirectUri: string;
+    scopes?: string[];
+    prompt?: PromptMode;
+};
+type ResolvedGeekappsAuthConfig = Required<Omit<GeekappsAuthConfig, "prompt">> & Pick<GeekappsAuthConfig, "prompt">;
+declare function resolveConfig(config: GeekappsAuthConfig): ResolvedGeekappsAuthConfig;
+type TokenResponse = {
+    accessToken: string;
+    idToken?: string;
+    refreshToken?: string;
+    tokenType: string;
+    expiresIn: number;
+    scope: string;
+    /** epoch ms, calculado no momento do parse — usado pra saber quando renovar. */
+    obtainedAt: number;
+};
+type DeviceAuthorizationResponse = {
+    deviceCode: string;
+    userCode: string;
+    verificationUri: string;
+    verificationUriComplete?: string;
+    expiresIn: number;
+    interval: number;
+};
+type GeekappsAuthErrorCode = "authorization_pending" | "slow_down" | "access_denied" | "expired_token" | "invalid_grant" | "network_error" | "server_error" | "invalid_response" | "cancelled";
+declare class GeekappsAuthError extends Error {
+    code: GeekappsAuthErrorCode;
+    constructor(code: GeekappsAuthErrorCode, message?: string);
+}
+declare function generateCodeVerifier(): string;
+declare function generateCodeChallenge(verifier: string): string;
+declare function generateState(): string;
+declare function buildAuthorizationUrl(params: {
+    config: ResolvedGeekappsAuthConfig;
+    codeChallenge: string;
+    state: string;
+    prompt?: PromptMode;
+}): string;
+declare function parseCallbackUrl(callbackUrl: string): {
+    code?: string;
+    state?: string;
+    error?: string;
+};
+declare function exchangeCodeForToken(params: {
+    config: ResolvedGeekappsAuthConfig;
+    code: string;
+    codeVerifier: string;
+}): Promise<TokenResponse>;
+declare function refreshAccessToken(params: {
+    config: ResolvedGeekappsAuthConfig;
+    refreshToken: string;
+}): Promise<TokenResponse>;
+declare function startDeviceAuthorization(params: {
+    config: ResolvedGeekappsAuthConfig;
+}): Promise<DeviceAuthorizationResponse>;
+declare function pollDeviceToken(params: {
+    config: ResolvedGeekappsAuthConfig;
+    deviceCode: string;
+    interval: number;
+    timeoutMs?: number;
+    signal?: AbortSignal;
+}): Promise<TokenResponse>;
+declare function isTokenExpiringSoon(tokens: TokenResponse, skewSeconds?: number): boolean;
+declare function fetchUserInfo(params: {
+    config: ResolvedGeekappsAuthConfig;
+    accessToken: string;
+}): Promise<any>;
+declare function revokeSession(params: {
+    config: ResolvedGeekappsAuthConfig;
+    accessToken: string;
+}): Promise<void>;
+
+export { type DeviceAuthorizationResponse, type GeekappsAuthConfig, GeekappsAuthError, type GeekappsAuthErrorCode, type PromptMode, type ResolvedGeekappsAuthConfig, type TokenResponse, buildAuthorizationUrl, exchangeCodeForToken, fetchUserInfo, generateCodeChallenge, generateCodeVerifier, generateState, isTokenExpiringSoon, parseCallbackUrl, pollDeviceToken, refreshAccessToken, resolveConfig, revokeSession, startDeviceAuthorization };

package/dist/core.js

@@ -0,0 +1,32 @@
+import {
+  GeekappsAuthError,
+  buildAuthorizationUrl,
+  exchangeCodeForToken,
+  fetchUserInfo,
+  generateCodeChallenge,
+  generateCodeVerifier,
+  generateState,
+  isTokenExpiringSoon,
+  parseCallbackUrl,
+  pollDeviceToken,
+  refreshAccessToken,
+  resolveConfig,
+  revokeSession,
+  startDeviceAuthorization
+} from "./chunk-M525RFU3.js";
+export {
+  GeekappsAuthError,
+  buildAuthorizationUrl,
+  exchangeCodeForToken,
+  fetchUserInfo,
+  generateCodeChallenge,
+  generateCodeVerifier,
+  generateState,
+  isTokenExpiringSoon,
+  parseCallbackUrl,
+  pollDeviceToken,
+  refreshAccessToken,
+  resolveConfig,
+  revokeSession,
+  startDeviceAuthorization
+};

package/dist/index.d.ts

@@ -0,0 +1,55 @@
+import { TokenResponse, GeekappsAuthError, PromptMode, DeviceAuthorizationResponse, GeekappsAuthConfig } from './core.js';
+export { GeekappsAuthErrorCode, ResolvedGeekappsAuthConfig, buildAuthorizationUrl, exchangeCodeForToken, fetchUserInfo, generateCodeChallenge, generateCodeVerifier, generateState, isTokenExpiringSoon, parseCallbackUrl, pollDeviceToken, refreshAccessToken, resolveConfig, revokeSession, startDeviceAuthorization } from './core.js';
+import { ReactNode, ReactElement } from 'react';
+
+/**
+ * Storage plugável — a lib não força nenhuma dependência nativa de storage.
+ * Em produção, passe um adapter sobre `expo-secure-store` ou `react-native-keychain`
+ * (guarda credenciais fora do AsyncStorage, que não é seguro pra tokens).
+ * Sem `storage` configurado, os tokens ficam só em memória (perdidos ao fechar o app).
+ */
+type TokenStorage = {
+    getItem(key: string): Promise<string | null>;
+    setItem(key: string, value: string): Promise<void>;
+    removeItem(key: string): Promise<void>;
+};
+declare function createInMemoryStorage(): TokenStorage;
+declare function loadStoredTokens(storage: TokenStorage): Promise<TokenResponse | null>;
+declare function saveStoredTokens(storage: TokenStorage, tokens: TokenResponse): Promise<void>;
+declare function clearStoredTokens(storage: TokenStorage): Promise<void>;
+
+/**
+ * Abre a URL de autorização no navegador do sistema. Por padrão usa `Linking.openURL`
+ * (funciona em qualquer RN, bare ou Expo). Se o app usa Expo, pode passar
+ * `browserOpener={(url) => WebBrowser.openBrowserAsync(url)}` (de `expo-web-browser`)
+ * pra ter Custom Tabs/ASWebAuthenticationSession nativo em vez do browser externo.
+ */
+type BrowserOpener = (url: string) => Promise<void> | void;
+type GeekappsAuthProviderProps = {
+    children: ReactNode;
+    config: GeekappsAuthConfig;
+    storage?: TokenStorage;
+    browserOpener?: BrowserOpener;
+};
+type SignInOptions = {
+    prompt?: PromptMode;
+};
+type GeekappsAuthContextValue = {
+    isAuthenticated: boolean;
+    isLoading: boolean;
+    tokens: TokenResponse | null;
+    user: Record<string, unknown> | null;
+    error: GeekappsAuthError | null;
+    signIn: (options?: SignInOptions) => Promise<void>;
+    signOut: () => Promise<void>;
+    refreshUser: () => Promise<void>;
+    getAccessToken: () => Promise<string | null>;
+    startDeviceFlow: () => Promise<DeviceAuthorizationResponse>;
+    waitForDeviceAuthorization: (deviceCode: string, interval: number) => Promise<void>;
+    /** fetch autenticado contra o app-api, injeta Bearer e renova o token se necessário. */
+    request: <T>(path: string, init?: RequestInit) => Promise<T>;
+};
+declare function GeekappsAuthProvider({ children, config: rawConfig, storage, browserOpener, }: GeekappsAuthProviderProps): ReactElement;
+declare function useAuth(): GeekappsAuthContextValue;
+
+export { type BrowserOpener, DeviceAuthorizationResponse, GeekappsAuthConfig, type GeekappsAuthContextValue, GeekappsAuthError, GeekappsAuthProvider, type GeekappsAuthProviderProps, PromptMode, type SignInOptions, TokenResponse, type TokenStorage, clearStoredTokens, createInMemoryStorage, loadStoredTokens, saveStoredTokens, useAuth };

package/dist/index.js

@@ -0,0 +1,264 @@
+import {
+  GeekappsAuthError,
+  buildAuthorizationUrl,
+  exchangeCodeForToken,
+  fetchUserInfo,
+  generateCodeChallenge,
+  generateCodeVerifier,
+  generateState,
+  isTokenExpiringSoon,
+  parseCallbackUrl,
+  pollDeviceToken,
+  refreshAccessToken,
+  resolveConfig,
+  revokeSession,
+  startDeviceAuthorization
+} from "./chunk-M525RFU3.js";
+
+// src/storage.ts
+function createInMemoryStorage() {
+  const store = /* @__PURE__ */ new Map();
+  return {
+    async getItem(key) {
+      return store.get(key) ?? null;
+    },
+    async setItem(key, value) {
+      store.set(key, value);
+    },
+    async removeItem(key) {
+      store.delete(key);
+    }
+  };
+}
+var TOKENS_KEY = "geekapps_auth_tokens";
+async function loadStoredTokens(storage) {
+  const raw = await storage.getItem(TOKENS_KEY);
+  if (!raw) return null;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+async function saveStoredTokens(storage, tokens) {
+  await storage.setItem(TOKENS_KEY, JSON.stringify(tokens));
+}
+async function clearStoredTokens(storage) {
+  await storage.removeItem(TOKENS_KEY);
+}
+
+// src/client.tsx
+import {
+  createContext,
+  useCallback,
+  useContext,
+  useEffect,
+  useMemo,
+  useRef,
+  useState
+} from "react";
+import { Linking } from "react-native";
+import { jsx } from "react/jsx-runtime";
+var GeekappsAuthContext = createContext(null);
+function GeekappsAuthProvider({
+  children,
+  config: rawConfig,
+  storage,
+  browserOpener
+}) {
+  const config = useMemo(() => resolveConfig(rawConfig), [rawConfig]);
+  const resolvedStorage = useMemo(() => storage ?? createInMemoryStorage(), [storage]);
+  const openBrowser = browserOpener ?? ((url) => Linking.openURL(url));
+  const [tokens, setTokens] = useState(null);
+  const [user, setUser] = useState(null);
+  const [isLoading, setIsLoading] = useState(true);
+  const [error, setError] = useState(null);
+  const pendingFlow = useRef(null);
+  const refreshingPromise = useRef(null);
+  const persistTokens = useCallback(
+    async (next) => {
+      setTokens(next);
+      if (next) await saveStoredTokens(resolvedStorage, next);
+      else await clearStoredTokens(resolvedStorage);
+    },
+    [resolvedStorage]
+  );
+  const refreshUser = useCallback(async () => {
+    if (!tokens) {
+      setUser(null);
+      return;
+    }
+    try {
+      const info = await fetchUserInfo({ config, accessToken: tokens.accessToken });
+      setUser(info);
+    } catch {
+      setUser(null);
+    }
+  }, [config, tokens]);
+  useEffect(() => {
+    (async () => {
+      const stored = await loadStoredTokens(resolvedStorage);
+      setTokens(stored);
+      setIsLoading(false);
+    })();
+  }, [resolvedStorage]);
+  useEffect(() => {
+    void refreshUser();
+  }, [refreshUser]);
+  useEffect(() => {
+    function handleUrl(url) {
+      const flow = pendingFlow.current;
+      if (!flow || !url.startsWith(config.redirectUri)) return;
+      const { code, state, error: callbackError } = parseCallbackUrl(url);
+      pendingFlow.current = null;
+      if (callbackError) {
+        flow.reject(new GeekappsAuthError("access_denied", callbackError));
+        return;
+      }
+      if (!code || state !== flow.state) {
+        flow.reject(new GeekappsAuthError("invalid_response", "state ou code ausente/inv\xE1lido"));
+        return;
+      }
+      exchangeCodeForToken({ config, code, codeVerifier: flow.codeVerifier }).then(async (result) => {
+        await persistTokens(result);
+        flow.resolve();
+      }).catch(flow.reject);
+    }
+    const subscription = Linking.addEventListener("url", ({ url }) => handleUrl(url));
+    Linking.getInitialURL().then((url) => {
+      if (url) handleUrl(url);
+    });
+    return () => subscription.remove();
+  }, [config, persistTokens]);
+  const signIn = useCallback(
+    async (options) => {
+      setError(null);
+      setIsLoading(true);
+      try {
+        const codeVerifier = generateCodeVerifier();
+        const codeChallenge = generateCodeChallenge(codeVerifier);
+        const state = generateState();
+        const authUrl = buildAuthorizationUrl({
+          config,
+          codeChallenge,
+          state,
+          prompt: options?.prompt
+        });
+        await new Promise((resolve, reject) => {
+          pendingFlow.current = { state, codeVerifier, resolve, reject };
+          void openBrowser(authUrl);
+        });
+        await refreshUser();
+      } catch (err) {
+        const authError = err instanceof GeekappsAuthError ? err : new GeekappsAuthError("network_error", String(err));
+        setError(authError);
+        throw authError;
+      } finally {
+        setIsLoading(false);
+      }
+    },
+    [config, openBrowser, refreshUser]
+  );
+  const signOut = useCallback(async () => {
+    if (tokens) await revokeSession({ config, accessToken: tokens.accessToken });
+    await persistTokens(null);
+    setUser(null);
+  }, [config, persistTokens, tokens]);
+  const startDeviceFlow = useCallback(() => startDeviceAuthorization({ config }), [config]);
+  const waitForDeviceAuthorization = useCallback(
+    async (deviceCode, interval) => {
+      const result = await pollDeviceToken({ config, deviceCode, interval });
+      await persistTokens(result);
+      await refreshUser();
+    },
+    [config, persistTokens, refreshUser]
+  );
+  const ensureFreshTokens = useCallback(async () => {
+    if (!tokens) return null;
+    if (!isTokenExpiringSoon(tokens)) return tokens;
+    if (!tokens.refreshToken) return tokens;
+    if (!refreshingPromise.current) {
+      refreshingPromise.current = refreshAccessToken({ config, refreshToken: tokens.refreshToken }).then(async (next) => {
+        await persistTokens(next);
+        return next;
+      }).finally(() => {
+        refreshingPromise.current = null;
+      });
+    }
+    try {
+      return await refreshingPromise.current;
+    } catch {
+      await persistTokens(null);
+      return null;
+    }
+  }, [config, persistTokens, tokens]);
+  const getAccessToken = useCallback(async () => {
+    const fresh = await ensureFreshTokens();
+    return fresh?.accessToken ?? null;
+  }, [ensureFreshTokens]);
+  const request = useCallback(
+    async (path, init) => {
+      const accessToken = await getAccessToken();
+      const response = await fetch(`${config.issuer}${path}`, {
+        ...init,
+        headers: {
+          ...init?.body ? { "content-type": "application/json" } : {},
+          ...init?.headers,
+          ...accessToken ? { authorization: `Bearer ${accessToken}` } : {}
+        }
+      });
+      if (!response.ok) {
+        const data = await response.json().catch(() => null);
+        throw new GeekappsAuthError("server_error", data?.error_description ?? data?.error ?? `HTTP ${response.status}`);
+      }
+      if (response.status === 204) return null;
+      return response.json();
+    },
+    [config, getAccessToken]
+  );
+  const value = useMemo(
+    () => ({
+      isAuthenticated: tokens !== null,
+      isLoading,
+      tokens,
+      user,
+      error,
+      signIn,
+      signOut,
+      refreshUser,
+      getAccessToken,
+      startDeviceFlow,
+      waitForDeviceAuthorization,
+      request
+    }),
+    [error, getAccessToken, isLoading, refreshUser, request, signIn, signOut, startDeviceFlow, tokens, user, waitForDeviceAuthorization]
+  );
+  return /* @__PURE__ */ jsx(GeekappsAuthContext.Provider, { value, children });
+}
+function useAuth() {
+  const context = useContext(GeekappsAuthContext);
+  if (!context) throw new Error("useAuth must be used inside GeekappsAuthProvider");
+  return context;
+}
+export {
+  GeekappsAuthError,
+  GeekappsAuthProvider,
+  buildAuthorizationUrl,
+  clearStoredTokens,
+  createInMemoryStorage,
+  exchangeCodeForToken,
+  fetchUserInfo,
+  generateCodeChallenge,
+  generateCodeVerifier,
+  generateState,
+  isTokenExpiringSoon,
+  loadStoredTokens,
+  parseCallbackUrl,
+  pollDeviceToken,
+  refreshAccessToken,
+  resolveConfig,
+  revokeSession,
+  saveStoredTokens,
+  startDeviceAuthorization,
+  useAuth
+};

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@geekapps/auth-react-native",
+  "version": "0.1.0",
+  "description": "Geekapps Auth SDK for React Native (Expo and bare) apps — PKCE login, device flow, token refresh.",
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./core": {
+      "types": "./dist/core.d.ts",
+      "import": "./dist/core.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsup src/index.ts src/core.ts --format esm --dts --clean",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@noble/hashes": "^1.6.1"
+  },
+  "peerDependencies": {
+    "react": ">=18",
+    "react-native": ">=0.73"
+  },
+  "devDependencies": {
+    "@types/react": "^19.0.0",
+    "react": "^19.0.0",
+    "react-native": "^0.76.0",
+    "tsup": "^8.3.5",
+    "typescript": "^5.7.2"
+  }
+}