@hanzo/iam 0.4.0 → 0.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hanzo/iam",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "TypeScript SDK for Hanzo IAM — OIDC auth, JWT validation, OAuth2 PKCE, user/org/project APIs",
   "type": "module",
   "main": "dist/index.js",
@@ -33,14 +33,6 @@
     "./nextauth": {
       "types": "./dist/nextauth.d.ts",
       "import": "./dist/nextauth.js"
-    },
-    "./passport": {
-      "types": "./dist/passport.d.ts",
-      "import": "./dist/passport.js"
-    },
-    "./betterauth": {
-      "types": "./dist/betterauth.d.ts",
-      "import": "./dist/betterauth.js"
     }
   },
   "files": [
@@ -53,8 +45,8 @@
     "build": "tsc",
     "dev": "tsc --watch",
     "clean": "rm -rf dist",
-    "prepare": "pnpm clean && pnpm build",
-    "prepublishOnly": "pnpm clean && pnpm build",
+    "prepare": "npm run clean && npm run build",
+    "prepublishOnly": "npm run clean && npm run build",
     "test": "node --test --import tsx src/**/*.test.ts"
   },
   "dependencies": {

package/src/browser.ts

@@ -80,8 +80,8 @@ export class BrowserIamSdk {
     this.discoveryCache = {
       issuer: baseUrl,
       authorization_endpoint: `${baseUrl}/login/oauth/authorize`,
-      token_endpoint: `${baseUrl}/api/login/oauth/access_token`,
-      userinfo_endpoint: `${baseUrl}/api/userinfo`,
+      token_endpoint: `${baseUrl}/oauth/token`,
+      userinfo_endpoint: `${baseUrl}/oauth/userinfo`,
       jwks_uri: `${baseUrl}/.well-known/jwks`,
       response_types_supported: ["code", "token", "id_token"],
       grant_types_supported: ["authorization_code", "implicit", "refresh_token"],

package/src/client.ts

@@ -7,6 +7,7 @@ import type {
   IamApiResponse,
   IamUser,
   IamOrganization,
+  IamInvitation,
   IamProject,
   OidcDiscovery,
   TokenResponse,
@@ -289,6 +290,88 @@ export class IamClient {
     return org ? [org] : [];
   }
 
+  /** Create a new organization. */
+  async createOrganization(
+    org: Partial<IamOrganization>,
+    token?: string,
+  ): Promise<IamApiResponse<IamOrganization>> {
+    return this.request<IamApiResponse<IamOrganization>>(
+      "/api/add-organization",
+      { method: "POST", body: org, token },
+    );
+  }
+
+  /** Update an existing organization. */
+  async updateOrganization(
+    org: Partial<IamOrganization>,
+    token?: string,
+  ): Promise<IamApiResponse<IamOrganization>> {
+    return this.request<IamApiResponse<IamOrganization>>(
+      "/api/update-organization",
+      { method: "POST", body: org, token },
+    );
+  }
+
+  /** Delete an organization by owner and name. */
+  async deleteOrganization(
+    org: { owner: string; name: string },
+    token?: string,
+  ): Promise<IamApiResponse<IamOrganization>> {
+    return this.request<IamApiResponse<IamOrganization>>(
+      "/api/delete-organization",
+      { method: "POST", body: org, token },
+    );
+  }
+
+  // -----------------------------------------------------------------------
+  // Invitation
+  // -----------------------------------------------------------------------
+
+  /** List invitations for an owner (organization). */
+  async getInvitations(
+    owner: string,
+    token?: string,
+  ): Promise<IamInvitation[]> {
+    const resp = await this.request<IamApiResponse<IamInvitation[]>>(
+      "/api/get-invitations",
+      { params: { owner }, token },
+    );
+    return resp.data ?? [];
+  }
+
+  /** Create a new invitation. */
+  async createInvitation(
+    invitation: Partial<IamInvitation>,
+    token?: string,
+  ): Promise<IamApiResponse<IamInvitation>> {
+    return this.request<IamApiResponse<IamInvitation>>(
+      "/api/add-invitation",
+      { method: "POST", body: invitation, token },
+    );
+  }
+
+  /** Send an invitation by owner and name. */
+  async sendInvitation(
+    invitation: { owner: string; name: string },
+    token?: string,
+  ): Promise<IamApiResponse<IamInvitation>> {
+    return this.request<IamApiResponse<IamInvitation>>(
+      "/api/send-invitation",
+      { method: "POST", body: invitation, token },
+    );
+  }
+
+  /** Verify an invitation code. */
+  async verifyInvitation(
+    code: string,
+    token?: string,
+  ): Promise<IamApiResponse<IamInvitation>> {
+    return this.request<IamApiResponse<IamInvitation>>(
+      "/api/verify-invitation",
+      { params: { code }, token },
+    );
+  }
+
   // -----------------------------------------------------------------------
   // Project
   // -----------------------------------------------------------------------

package/src/index.ts

@@ -14,7 +14,7 @@
  * });
  *
  * const billing = new BillingClient({
- *   commerceUrl: "https://commerce.hanzo.ai",
+ *   commerceUrl: "https://commerce-api.hanzo.ai/api",
  * });
  * ```
  */
@@ -43,6 +43,7 @@ export type {
   IamJwtClaims,
   IamUser,
   IamOrganization,
+  IamInvitation,
   IamProject,
   Subscription,
   Plan,

package/src/react.ts

@@ -46,7 +46,7 @@ import type { ReactNode } from "react";
 import { BrowserIamSdk } from "./browser.js";
 import type { BrowserIamConfig } from "./browser.js";
 import { IamClient } from "./client.js";
-import type { IamUser, IamOrganization, IamProject, TokenResponse } from "./types.js";
+import type { IamUser, IamOrganization, IamInvitation, IamProject, TokenResponse } from "./types.js";
 
 // ---------------------------------------------------------------------------
 // Types
@@ -589,6 +589,200 @@ export function useIamToken(): {
   };
 }
 
+// ---------------------------------------------------------------------------
+// useOrgManagement
+// ---------------------------------------------------------------------------
+
+export interface OrgManagementState {
+  /** Create a new organization. */
+  createOrg: (org: Partial<IamOrganization>) => Promise<void>;
+  /** Update an existing organization. */
+  updateOrg: (org: Partial<IamOrganization>) => Promise<void>;
+  /** Delete an organization by owner and name. */
+  deleteOrg: (org: { owner: string; name: string }) => Promise<void>;
+  /** Whether a mutation is in progress. */
+  isLoading: boolean;
+}
+
+/**
+ * Manage organization CRUD operations.
+ *
+ * Provides create, update, and delete methods that call the IAM API
+ * using the current user's access token.
+ */
+export function useOrgManagement(): OrgManagementState {
+  const { config, accessToken } = useIam();
+  const [isLoading, setIsLoading] = useState(false);
+
+  const client = useMemo(
+    () =>
+      new IamClient({
+        serverUrl: config.serverUrl,
+        clientId: config.clientId,
+      }),
+    [config.serverUrl, config.clientId],
+  );
+
+  const createOrg = useCallback(
+    async (org: Partial<IamOrganization>) => {
+      setIsLoading(true);
+      try {
+        await client.createOrganization(org, accessToken ?? undefined);
+      } finally {
+        setIsLoading(false);
+      }
+    },
+    [client, accessToken],
+  );
+
+  const updateOrg = useCallback(
+    async (org: Partial<IamOrganization>) => {
+      setIsLoading(true);
+      try {
+        await client.updateOrganization(org, accessToken ?? undefined);
+      } finally {
+        setIsLoading(false);
+      }
+    },
+    [client, accessToken],
+  );
+
+  const deleteOrg = useCallback(
+    async (org: { owner: string; name: string }) => {
+      setIsLoading(true);
+      try {
+        await client.deleteOrganization(org, accessToken ?? undefined);
+      } finally {
+        setIsLoading(false);
+      }
+    },
+    [client, accessToken],
+  );
+
+  return { createOrg, updateOrg, deleteOrg, isLoading };
+}
+
+// ---------------------------------------------------------------------------
+// useInvitations
+// ---------------------------------------------------------------------------
+
+export interface InvitationsState {
+  /** All invitations for the organization. */
+  invitations: IamInvitation[];
+  /** Create a new invitation. */
+  createInvite: (invitation: Partial<IamInvitation>) => Promise<void>;
+  /** Send an existing invitation. */
+  sendInvite: (invitation: { owner: string; name: string }) => Promise<void>;
+  /** Verify an invitation code. */
+  verifyInvite: (code: string) => Promise<IamInvitation | null>;
+  /** Whether invitations are loading. */
+  isLoading: boolean;
+  /** Re-fetch the invitations list. */
+  refresh: () => Promise<void>;
+}
+
+/**
+ * Manage invitations for an organization.
+ *
+ * Fetches the invitation list on mount and provides create, send,
+ * and verify methods using the current user's access token.
+ */
+export function useInvitations(orgName: string): InvitationsState {
+  const { config, accessToken, isAuthenticated } = useIam();
+  const [invitations, setInvitations] = useState<IamInvitation[]>([]);
+  const [isLoading, setIsLoading] = useState(false);
+
+  const client = useMemo(
+    () =>
+      new IamClient({
+        serverUrl: config.serverUrl,
+        clientId: config.clientId,
+      }),
+    [config.serverUrl, config.clientId],
+  );
+
+  const fetchInvitations = useCallback(async () => {
+    if (!isAuthenticated || !accessToken || !orgName) return;
+    setIsLoading(true);
+    try {
+      const data = await client.getInvitations(orgName, accessToken);
+      setInvitations(data);
+    } catch {
+      setInvitations([]);
+    } finally {
+      setIsLoading(false);
+    }
+  }, [client, orgName, accessToken, isAuthenticated]);
+
+  // Fetch invitations on mount and when orgName changes
+  useEffect(() => {
+    if (!isAuthenticated || !accessToken || !orgName) {
+      setInvitations([]);
+      return;
+    }
+
+    let cancelled = false;
+
+    const load = async () => {
+      setIsLoading(true);
+      try {
+        const data = await client.getInvitations(orgName, accessToken);
+        if (!cancelled) setInvitations(data);
+      } catch {
+        if (!cancelled) setInvitations([]);
+      } finally {
+        if (!cancelled) setIsLoading(false);
+      }
+    };
+
+    load();
+    return () => {
+      cancelled = true;
+    };
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [isAuthenticated, accessToken, orgName, config.serverUrl, config.clientId]);
+
+  const createInvite = useCallback(
+    async (invitation: Partial<IamInvitation>) => {
+      setIsLoading(true);
+      try {
+        await client.createInvitation(invitation, accessToken ?? undefined);
+        await fetchInvitations();
+      } finally {
+        setIsLoading(false);
+      }
+    },
+    [client, accessToken, fetchInvitations],
+  );
+
+  const sendInvite = useCallback(
+    async (invitation: { owner: string; name: string }) => {
+      setIsLoading(true);
+      try {
+        await client.sendInvitation(invitation, accessToken ?? undefined);
+      } finally {
+        setIsLoading(false);
+      }
+    },
+    [client, accessToken],
+  );
+
+  const verifyInvite = useCallback(
+    async (code: string): Promise<IamInvitation | null> => {
+      setIsLoading(true);
+      try {
+        const resp = await client.verifyInvitation(code, accessToken ?? undefined);
+        return resp.data ?? null;
+      } finally {
+        setIsLoading(false);
+      }
+    },
+    [client, accessToken],
+  );
+
+  return { invitations, createInvite, sendInvite, verifyInvite, isLoading, refresh: fetchInvitations };
+}
+
 // Re-export context for advanced use
 export { IamContext };
 

package/src/types.ts

@@ -226,6 +226,26 @@ export type IamOrder = Order;
 export type IamUsageRecord = UsageRecord;
 export type IamUsageSummary = UsageSummary;
 
+// ---------------------------------------------------------------------------
+// Invitation
+// ---------------------------------------------------------------------------
+
+export type IamInvitation = {
+  owner: string;
+  name: string;
+  displayName?: string;
+  code: string;
+  quota: number;
+  usedCount: number;
+  application?: string;
+  email?: string;
+  phone?: string;
+  signupGroup?: string;
+  state?: string;
+  createdTime?: string;
+  updatedTime?: string;
+};
+
 // ---------------------------------------------------------------------------
 // Project
 // ---------------------------------------------------------------------------

package/dist/betterauth.d.ts

@@ -1,62 +0,0 @@
-/**
- * BetterAuth SSO provider configuration for Hanzo IAM.
- *
- * Returns a provider config object compatible with BetterAuth's
- * `socialProviders` or generic OAuth plugin.
- *
- * @example
- * ```ts
- * import { betterAuth } from "better-auth";
- * import { hanzoIamProvider } from "@hanzo/iam/betterauth";
- *
- * export const auth = betterAuth({
- *   socialProviders: [
- *     hanzoIamProvider({
- *       serverUrl: process.env.IAM_SERVER_URL!,
- *       clientId: process.env.IAM_CLIENT_ID!,
- *       clientSecret: process.env.IAM_CLIENT_SECRET!,
- *     }),
- *   ],
- * });
- * ```
- *
- * @packageDocumentation
- */
-import type { IamConfig } from "./types.js";
-export interface HanzoIamSocialProvider {
-    id: string;
-    name: string;
-    type: "oidc";
-    issuer: string;
-    clientId: string;
-    clientSecret?: string;
-    authorization: {
-        url: string;
-        params: {
-            scope: string;
-        };
-    };
-    token: {
-        url: string;
-    };
-    userinfo: {
-        url: string;
-    };
-    profile: (profile: Record<string, unknown>) => {
-        id: string;
-        name: string;
-        email: string;
-        image: string | null;
-    };
-}
-/**
- * Create a BetterAuth-compatible social provider for Hanzo IAM.
- *
- * Works with BetterAuth's SSO plugin or generic OAuth integration.
- * Uses the standard Hanzo IAM / Casdoor OIDC endpoints.
- */
-export declare function hanzoIamProvider(config: IamConfig & {
-    redirectUri?: string;
-}): HanzoIamSocialProvider;
-export { hanzoIamProvider as hanzoIamSocialProvider };
-//# sourceMappingURL=betterauth.d.ts.map

package/dist/betterauth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"betterauth.d.ts","sourceRoot":"","sources":["../src/betterauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAC1D,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACvB,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1B,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK;QAC7C,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;KACtB,CAAC;CACH;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,SAAS,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3C,sBAAsB,CA6BxB;AAGD,OAAO,EAAE,gBAAgB,IAAI,sBAAsB,EAAE,CAAC"}

package/dist/betterauth.js

@@ -1,61 +0,0 @@
-/**
- * BetterAuth SSO provider configuration for Hanzo IAM.
- *
- * Returns a provider config object compatible with BetterAuth's
- * `socialProviders` or generic OAuth plugin.
- *
- * @example
- * ```ts
- * import { betterAuth } from "better-auth";
- * import { hanzoIamProvider } from "@hanzo/iam/betterauth";
- *
- * export const auth = betterAuth({
- *   socialProviders: [
- *     hanzoIamProvider({
- *       serverUrl: process.env.IAM_SERVER_URL!,
- *       clientId: process.env.IAM_CLIENT_ID!,
- *       clientSecret: process.env.IAM_CLIENT_SECRET!,
- *     }),
- *   ],
- * });
- * ```
- *
- * @packageDocumentation
- */
-/**
- * Create a BetterAuth-compatible social provider for Hanzo IAM.
- *
- * Works with BetterAuth's SSO plugin or generic OAuth integration.
- * Uses the standard Hanzo IAM / Casdoor OIDC endpoints.
- */
-export function hanzoIamProvider(config) {
-    const baseUrl = config.serverUrl.replace(/\/+$/, "");
-    return {
-        id: "hanzo-iam",
-        name: "Hanzo IAM",
-        type: "oidc",
-        issuer: baseUrl,
-        clientId: config.clientId,
-        clientSecret: config.clientSecret,
-        authorization: {
-            url: `${baseUrl}/login/oauth/authorize`,
-            params: { scope: "openid profile email" },
-        },
-        token: { url: `${baseUrl}/api/login/oauth/access_token` },
-        userinfo: { url: `${baseUrl}/api/userinfo` },
-        profile(profile) {
-            return {
-                id: profile.sub ?? profile.id ?? "",
-                name: profile.displayName ??
-                    profile.name ??
-                    profile.preferred_username ??
-                    "",
-                email: profile.email ?? "",
-                image: profile.avatar ?? profile.picture ?? null,
-            };
-        },
-    };
-}
-// Backwards-compatible alias
-export { hanzoIamProvider as hanzoIamSocialProvider };
-//# sourceMappingURL=betterauth.js.map

package/dist/betterauth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"betterauth.js","sourceRoot":"","sources":["../src/betterauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAsBH;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAA4C;IAE5C,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAErD,OAAO;QACL,EAAE,EAAE,WAAW;QACf,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,aAAa,EAAE;YACb,GAAG,EAAE,GAAG,OAAO,wBAAwB;YACvC,MAAM,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE;SAC1C;QACD,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,OAAO,+BAA+B,EAAE;QACzD,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,OAAO,eAAe,EAAE;QAC5C,OAAO,CAAC,OAAgC;YACtC,OAAO;gBACL,EAAE,EAAG,OAAO,CAAC,GAAc,IAAK,OAAO,CAAC,EAAa,IAAI,EAAE;gBAC3D,IAAI,EACD,OAAO,CAAC,WAAsB;oBAC9B,OAAO,CAAC,IAAe;oBACvB,OAAO,CAAC,kBAA6B;oBACtC,EAAE;gBACJ,KAAK,EAAG,OAAO,CAAC,KAAgB,IAAI,EAAE;gBACtC,KAAK,EAAG,OAAO,CAAC,MAAiB,IAAK,OAAO,CAAC,OAAkB,IAAI,IAAI;aACzE,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,6BAA6B;AAC7B,OAAO,EAAE,gBAAgB,IAAI,sBAAsB,EAAE,CAAC"}

package/dist/passport.d.ts

@@ -1,44 +0,0 @@
-/**
- * Passport.js OAuth2 strategy factory for Hanzo IAM.
- *
- * Creates a pre-configured passport-oauth2 strategy that authenticates
- * against hanzo.id with PKCE and fetches user info on callback.
- *
- * @example
- * ```ts
- * import passport from "passport";
- * import { createIamPassportStrategy } from "@hanzo/iam/passport";
- *
- * passport.use("iam", createIamPassportStrategy({
- *   serverUrl: "https://hanzo.id",
- *   clientId: "hanzo-kms-client-id",
- *   clientSecret: process.env.IAM_CLIENT_SECRET!,
- *   callbackUrl: "https://kms.hanzo.ai/api/v1/sso/oidc/callback",
- * }));
- * ```
- *
- * @packageDocumentation
- */
-import type { IamConfig } from "./types.js";
-export interface IamPassportConfig extends IamConfig {
-    /** Full callback URL for OAuth2 redirect. */
-    callbackUrl: string;
-    /** OAuth2 scopes. Default: "openid profile email". */
-    scope?: string;
-}
-export interface IamPassportUser {
-    accessToken: string;
-    refreshToken?: string;
-    userinfo: Record<string, unknown>;
-}
-/**
- * Create a Passport OAuth2 strategy for Hanzo IAM.
- *
- * Requires `passport-oauth2` as a peer dependency.
- * Returns an OAuth2Strategy instance ready to pass to `passport.use()`.
- *
- * The verify callback fetches userinfo from the IAM server and passes
- * `{ accessToken, refreshToken, userinfo }` as the user object.
- */
-export declare function createIamPassportStrategy(config: IamPassportConfig): unknown;
-//# sourceMappingURL=passport.d.ts.map

package/dist/passport.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"passport.d.ts","sourceRoot":"","sources":["../src/passport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IAClD,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAgDT"}

package/dist/passport.js

@@ -1,67 +0,0 @@
-/**
- * Passport.js OAuth2 strategy factory for Hanzo IAM.
- *
- * Creates a pre-configured passport-oauth2 strategy that authenticates
- * against hanzo.id with PKCE and fetches user info on callback.
- *
- * @example
- * ```ts
- * import passport from "passport";
- * import { createIamPassportStrategy } from "@hanzo/iam/passport";
- *
- * passport.use("iam", createIamPassportStrategy({
- *   serverUrl: "https://hanzo.id",
- *   clientId: "hanzo-kms-client-id",
- *   clientSecret: process.env.IAM_CLIENT_SECRET!,
- *   callbackUrl: "https://kms.hanzo.ai/api/v1/sso/oidc/callback",
- * }));
- * ```
- *
- * @packageDocumentation
- */
-/**
- * Create a Passport OAuth2 strategy for Hanzo IAM.
- *
- * Requires `passport-oauth2` as a peer dependency.
- * Returns an OAuth2Strategy instance ready to pass to `passport.use()`.
- *
- * The verify callback fetches userinfo from the IAM server and passes
- * `{ accessToken, refreshToken, userinfo }` as the user object.
- */
-export function createIamPassportStrategy(config) {
-    // Dynamic import to keep passport-oauth2 as optional peer dep.
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const { Strategy: OAuth2Strategy } = require("passport-oauth2");
-    const baseUrl = config.serverUrl.replace(/\/+$/, "");
-    const verify = async (...args) => {
-        // passReqToCallback=true: (req, accessToken, refreshToken, profile, done)
-        const accessToken = args[1];
-        const refreshToken = args[2];
-        const done = args[4];
-        try {
-            const res = await fetch(`${baseUrl}/api/userinfo`, {
-                headers: { Authorization: `Bearer ${accessToken}` },
-            });
-            if (!res.ok) {
-                return done(new Error(`IAM userinfo failed: ${res.status}`));
-            }
-            const userinfo = (await res.json());
-            done(null, { accessToken, refreshToken, userinfo });
-        }
-        catch (err) {
-            done(err instanceof Error ? err : new Error(String(err)));
-        }
-    };
-    return new OAuth2Strategy({
-        authorizationURL: `${baseUrl}/login/oauth/authorize`,
-        tokenURL: `${baseUrl}/api/login/oauth/access_token`,
-        clientID: config.clientId,
-        clientSecret: config.clientSecret ?? "",
-        callbackURL: config.callbackUrl,
-        scope: config.scope ?? "openid profile email",
-        state: true,
-        pkce: true,
-        passReqToCallback: true,
-    }, verify);
-}
-//# sourceMappingURL=passport.js.map

package/dist/passport.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"passport.js","sourceRoot":"","sources":["../src/passport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAiBH;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAyB;IAEzB,+DAA+D;IAC/D,iEAAiE;IACjE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,iBAAiB,CAK7D,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAErD,MAAM,MAAM,GAAG,KAAK,EAClB,GAAG,IAAe,EACH,EAAE;QACjB,0EAA0E;QAC1E,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QACtC,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,CAAuB,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAwD,CAAC;QAE5E,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,eAAe,EAAE;gBACjD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;aACpD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC/D,IAAI,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,IAAI,cAAc,CACvB;QACE,gBAAgB,EAAE,GAAG,OAAO,wBAAwB;QACpD,QAAQ,EAAE,GAAG,OAAO,+BAA+B;QACnD,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;QACvC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,sBAAsB;QAC7C,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,IAAI;QACV,iBAAiB,EAAE,IAAI;KACxB,EACD,MAAM,CACP,CAAC;AACJ,CAAC"}