@hawcx/oauth-client 0.1.0

package/dist/delegation/crypto.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Cryptographic utilities for delegation (ECIES, Ed25519, RSA-PSS)
+ */
+/**
+ * Get current Unix timestamp in seconds
+ */
+export declare function nowS(): number;
+export interface SignResult {
+    alg: string;
+    signatureB64: string;
+    kid?: string;
+}
+/**
+ * Ed25519 signer for delegation requests
+ */
+export declare class Ed25519Signer {
+    private sk;
+    kid?: string;
+    alg: string;
+    constructor(privatePem: string, kid?: string);
+    /**
+     * Sign detached signature over body and timestamp
+     */
+    signDetached(body: Buffer, ts: number): SignResult;
+}
+/**
+ * RSA-PSS signer for delegation requests
+ */
+export declare class RsaPssSigner {
+    private sk;
+    kid?: string;
+    alg: string;
+    constructor(privatePem: string, kid?: string);
+    /**
+     * Sign detached signature over body and timestamp
+     */
+    signDetached(body: Buffer, ts: number): SignResult;
+}
+/**
+ * Verifier for checking signatures from the IDP
+ */
+export declare class Verifier {
+    private pubKeys;
+    constructor(pubkeys: Record<string, string>);
+    /**
+     * Verify signature from IDP
+     */
+    verify(body: Buffer, ts: number, sigB64: string, alg: string, kid?: string): void;
+}
+/**
+ * ECIES encryptor using X25519 + AES-GCM
+ */
+export declare class EciesX25519Encryptor {
+    private peerPublicKey;
+    constructor(peerPubPem: string);
+    /**
+     * Encrypt plaintext using ECIES
+     */
+    encrypt(plaintext: Buffer): Buffer;
+}
+/**
+ * ECIES decryptor using X25519 + AES-GCM
+ */
+export declare class EciesX25519Decryptor {
+    private sk;
+    constructor(privPem: string);
+    /**
+     * Decrypt ECIES envelope
+     */
+    decrypt(envelopeJson: Buffer): Buffer;
+}
+//# sourceMappingURL=crypto.d.ts.map

package/dist/delegation/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/delegation/crypto.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH;;GAEG;AACH,wBAAgB,IAAI,IAAI,MAAM,CAE7B;AAkBD,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,EAAE,CAAmB;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAa;gBAEnB,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM;IAoB5C;;OAEG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,UAAU;CAanD;AAED;;GAEG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,EAAE,CAAmB;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAoB;gBAE1B,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM;IAoB5C;;OAEG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,UAAU;CAiBnD;AAED;;GAEG;AACH,qBAAa,QAAQ;IACnB,OAAO,CAAC,OAAO,CAAgC;gBAEnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAmB3C;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI;CAwClF;AAID;;GAEG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,aAAa,CAAS;gBAElB,UAAU,EAAE,MAAM;IAqB9B;;OAEG;IACH,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;CAiDnC;AAED;;GAEG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,EAAE,CAAmB;gBAEjB,OAAO,EAAE,MAAM;IAkB3B;;OAEG;IACH,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;CA+CtC"}

package/dist/delegation/crypto.js

@@ -0,0 +1,356 @@
+"use strict";
+/**
+ * Cryptographic utilities for delegation (ECIES, Ed25519, RSA-PSS)
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EciesX25519Decryptor = exports.EciesX25519Encryptor = exports.Verifier = exports.RsaPssSigner = exports.Ed25519Signer = void 0;
+exports.nowS = nowS;
+const crypto = __importStar(require("crypto"));
+const exceptions_1 = require("./exceptions");
+// -------- Helpers --------
+/**
+ * Get current Unix timestamp in seconds
+ */
+function nowS() {
+    return Math.floor(Date.now() / 1000);
+}
+/**
+ * Base64url encode (no padding)
+ */
+function b64e(buffer) {
+    return buffer.toString('base64url');
+}
+/**
+ * Base64url decode
+ */
+function b64d(str) {
+    return Buffer.from(str, 'base64url');
+}
+/**
+ * Ed25519 signer for delegation requests
+ */
+class Ed25519Signer {
+    constructor(privatePem, kid) {
+        this.alg = 'ed25519';
+        this.kid = kid;
+        try {
+            this.sk = crypto.createPrivateKey({
+                key: privatePem,
+                format: 'pem',
+            });
+            // Verify it's Ed25519
+            if (this.sk.asymmetricKeyType !== 'ed25519') {
+                throw new exceptions_1.DelegationCryptoError('Provided PEM is not an Ed25519 private key');
+            }
+        }
+        catch (error) {
+            if (error instanceof exceptions_1.DelegationCryptoError) {
+                throw error;
+            }
+            throw new exceptions_1.DelegationCryptoError(`Failed to load Ed25519 private key: ${error}`);
+        }
+    }
+    /**
+     * Sign detached signature over body and timestamp
+     */
+    signDetached(body, ts) {
+        try {
+            const data = Buffer.concat([body, Buffer.from('.'), Buffer.from(String(ts))]);
+            const signature = crypto.sign(null, data, this.sk);
+            return {
+                alg: this.alg,
+                signatureB64: b64e(signature),
+                kid: this.kid,
+            };
+        }
+        catch (error) {
+            throw new exceptions_1.DelegationCryptoError(`Ed25519 signing failed: ${error}`);
+        }
+    }
+}
+exports.Ed25519Signer = Ed25519Signer;
+/**
+ * RSA-PSS signer for delegation requests
+ */
+class RsaPssSigner {
+    constructor(privatePem, kid) {
+        this.alg = 'rsa-pss-sha256';
+        this.kid = kid;
+        try {
+            this.sk = crypto.createPrivateKey({
+                key: privatePem,
+                format: 'pem',
+            });
+            // Verify it's RSA
+            if (this.sk.asymmetricKeyType !== 'rsa') {
+                throw new exceptions_1.DelegationCryptoError('Provided PEM is not an RSA private key');
+            }
+        }
+        catch (error) {
+            if (error instanceof exceptions_1.DelegationCryptoError) {
+                throw error;
+            }
+            throw new exceptions_1.DelegationCryptoError(`Failed to load RSA private key: ${error}`);
+        }
+    }
+    /**
+     * Sign detached signature over body and timestamp
+     */
+    signDetached(body, ts) {
+        try {
+            const data = Buffer.concat([body, Buffer.from('.'), Buffer.from(String(ts))]);
+            const signature = crypto.sign('sha256', data, {
+                key: this.sk,
+                padding: crypto.constants.RSA_PKCS1_PSS_PADDING,
+                saltLength: crypto.constants.RSA_PSS_SALTLEN_MAX_SIGN,
+            });
+            return {
+                alg: this.alg,
+                signatureB64: b64e(signature),
+                kid: this.kid,
+            };
+        }
+        catch (error) {
+            throw new exceptions_1.DelegationCryptoError(`RSA-PSS signing failed: ${error}`);
+        }
+    }
+}
+exports.RsaPssSigner = RsaPssSigner;
+/**
+ * Verifier for checking signatures from the IDP
+ */
+class Verifier {
+    constructor(pubkeys) {
+        if (!pubkeys || Object.keys(pubkeys).length === 0) {
+            throw new exceptions_1.DelegationCryptoError('At least one public key is required for verification.');
+        }
+        try {
+            this.pubKeys = new Map();
+            for (const [kid, pem] of Object.entries(pubkeys)) {
+                const key = crypto.createPublicKey({
+                    key: pem,
+                    format: 'pem',
+                });
+                this.pubKeys.set(kid, key);
+            }
+        }
+        catch (error) {
+            throw new exceptions_1.DelegationCryptoError(`Failed to load one or more public keys: ${error}`);
+        }
+    }
+    /**
+     * Verify signature from IDP
+     */
+    verify(body, ts, sigB64, alg, kid) {
+        try {
+            const sig = b64d(sigB64);
+            let pub;
+            if (kid && this.pubKeys.has(kid)) {
+                pub = this.pubKeys.get(kid);
+            }
+            else if (this.pubKeys.size === 1 && !kid) {
+                pub = Array.from(this.pubKeys.values())[0];
+            }
+            else {
+                throw new exceptions_1.DelegationCryptoError('Unknown or ambiguous key ID for verification');
+            }
+            const dataToVerify = Buffer.concat([body, Buffer.from('.'), Buffer.from(String(ts))]);
+            let isValid = false;
+            const keyType = pub.asymmetricKeyType;
+            if (alg === 'ed25519' && keyType === 'ed25519') {
+                isValid = crypto.verify(null, dataToVerify, pub, sig);
+            }
+            else if (alg === 'rsa-pss-sha256' && keyType === 'rsa') {
+                isValid = crypto.verify('sha256', dataToVerify, {
+                    key: pub,
+                    padding: crypto.constants.RSA_PKCS1_PSS_PADDING,
+                    saltLength: crypto.constants.RSA_PSS_SALTLEN_MAX_SIGN,
+                }, sig);
+            }
+            else {
+                throw new exceptions_1.DelegationCryptoError(`Unsupported algorithm '${alg}' or mismatched key type.`);
+            }
+            if (!isValid) {
+                throw new exceptions_1.DelegationCryptoError('Signature verification failed');
+            }
+        }
+        catch (error) {
+            if (error instanceof exceptions_1.DelegationCryptoError) {
+                throw error;
+            }
+            throw new exceptions_1.DelegationCryptoError(`Signature verification failed: ${error}`);
+        }
+    }
+}
+exports.Verifier = Verifier;
+// -------- ECIES (X25519 + AES-GCM) --------
+/**
+ * ECIES encryptor using X25519 + AES-GCM
+ */
+class EciesX25519Encryptor {
+    constructor(peerPubPem) {
+        try {
+            const key = crypto.createPublicKey({
+                key: peerPubPem,
+                format: 'pem',
+            });
+            if (key.asymmetricKeyType !== 'x25519') {
+                throw new exceptions_1.DelegationCryptoError('peer_pub_pem must be an X25519 public key');
+            }
+            // Export raw X25519 public key (32 bytes)
+            this.peerPublicKey = key.export({ type: 'spki', format: 'der' }).slice(-32);
+        }
+        catch (error) {
+            if (error instanceof exceptions_1.DelegationCryptoError) {
+                throw error;
+            }
+            throw new exceptions_1.DelegationCryptoError(`Failed to load ECIES peer public key: ${error}`);
+        }
+    }
+    /**
+     * Encrypt plaintext using ECIES
+     */
+    encrypt(plaintext) {
+        try {
+            // Generate ephemeral X25519 keypair
+            const ephPrivateKey = crypto.generateKeyPairSync('x25519', {
+                privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+                publicKeyEncoding: { type: 'spki', format: 'pem' },
+            });
+            const ephPrivKey = crypto.createPrivateKey(ephPrivateKey.privateKey);
+            const ephPubKey = crypto.createPublicKey(ephPrivateKey.publicKey);
+            // Perform ECDH
+            const shared = crypto.diffieHellman({
+                privateKey: ephPrivKey,
+                publicKey: crypto.createPublicKey({
+                    key: Buffer.concat([
+                        Buffer.from([0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x6e, 0x03, 0x21, 0x00]),
+                        this.peerPublicKey,
+                    ]),
+                    format: 'der',
+                    type: 'spki',
+                }),
+            });
+            // Derive AES key using HKDF
+            const key = crypto.hkdfSync('sha256', shared, Buffer.alloc(0), Buffer.from('idp-sp-ecies-v1'), 32);
+            // Encrypt with AES-GCM
+            const nonce = crypto.randomBytes(12);
+            const cipher = crypto.createCipheriv('aes-256-gcm', Buffer.from(key), nonce);
+            const ct = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+            const tag = cipher.getAuthTag();
+            // Get ephemeral public key raw bytes
+            const ephPubKeyRaw = ephPubKey.export({ type: 'spki', format: 'der' }).slice(-32);
+            // Build envelope
+            const envelope = {
+                enc: 'x25519-aesgcm',
+                epk: b64e(ephPubKeyRaw),
+                iv: b64e(nonce),
+                ct: b64e(Buffer.concat([ct, tag])),
+            };
+            return Buffer.from(JSON.stringify(envelope));
+        }
+        catch (error) {
+            throw new exceptions_1.DelegationCryptoError(`ECIES encryption failed: ${error}`);
+        }
+    }
+}
+exports.EciesX25519Encryptor = EciesX25519Encryptor;
+/**
+ * ECIES decryptor using X25519 + AES-GCM
+ */
+class EciesX25519Decryptor {
+    constructor(privPem) {
+        try {
+            this.sk = crypto.createPrivateKey({
+                key: privPem,
+                format: 'pem',
+            });
+            if (this.sk.asymmetricKeyType !== 'x25519') {
+                throw new exceptions_1.DelegationCryptoError('priv_pem must be an X25519 private key');
+            }
+        }
+        catch (error) {
+            if (error instanceof exceptions_1.DelegationCryptoError) {
+                throw error;
+            }
+            throw new exceptions_1.DelegationCryptoError(`Failed to load ECIES private key: ${error}`);
+        }
+    }
+    /**
+     * Decrypt ECIES envelope
+     */
+    decrypt(envelopeJson) {
+        try {
+            const envelope = JSON.parse(envelopeJson.toString('utf-8'));
+            if (envelope.enc !== 'x25519-aesgcm') {
+                throw new exceptions_1.DelegationCryptoError('Unsupported envelope encryption algorithm');
+            }
+            const epkBytes = b64d(envelope.epk);
+            const nonce = b64d(envelope.iv);
+            const ctWithTag = b64d(envelope.ct);
+            // Split ciphertext and auth tag (last 16 bytes)
+            const ct = ctWithTag.slice(0, -16);
+            const tag = ctWithTag.slice(-16);
+            // Reconstruct ephemeral public key
+            const epkDer = Buffer.concat([
+                Buffer.from([0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x6e, 0x03, 0x21, 0x00]),
+                epkBytes,
+            ]);
+            const epk = crypto.createPublicKey({
+                key: epkDer,
+                format: 'der',
+                type: 'spki',
+            });
+            // Perform ECDH
+            const shared = crypto.diffieHellman({
+                privateKey: this.sk,
+                publicKey: epk,
+            });
+            // Derive AES key using HKDF
+            const key = crypto.hkdfSync('sha256', shared, Buffer.alloc(0), Buffer.from('idp-sp-ecies-v1'), 32);
+            // Decrypt with AES-GCM
+            const decipher = crypto.createDecipheriv('aes-256-gcm', Buffer.from(key), nonce);
+            decipher.setAuthTag(tag);
+            const plaintext = Buffer.concat([decipher.update(ct), decipher.final()]);
+            return plaintext;
+        }
+        catch (error) {
+            throw new exceptions_1.DelegationCryptoError(`ECIES decryption failed: ${error}`);
+        }
+    }
+}
+exports.EciesX25519Decryptor = EciesX25519Decryptor;
+//# sourceMappingURL=crypto.js.map

package/dist/delegation/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/delegation/crypto.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUH,oBAEC;AAVD,+CAAiC;AACjC,6CAAqD;AAErD,4BAA4B;AAE5B;;GAEG;AACH,SAAgB,IAAI;IAClB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,SAAS,IAAI,CAAC,MAAc;IAC1B,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,SAAS,IAAI,CAAC,GAAW;IACvB,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AACvC,CAAC;AAUD;;GAEG;AACH,MAAa,aAAa;IAKxB,YAAY,UAAkB,EAAE,GAAY;QAFrC,QAAG,GAAW,SAAS,CAAC;QAG7B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,gBAAgB,CAAC;gBAChC,GAAG,EAAE,UAAU;gBACf,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;YAEH,sBAAsB;YACtB,IAAI,IAAI,CAAC,EAAE,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBAC5C,MAAM,IAAI,kCAAqB,CAAC,4CAA4C,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kCAAqB,EAAE,CAAC;gBAC3C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,kCAAqB,CAAC,uCAAuC,KAAK,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,IAAY,EAAE,EAAU;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YACnD,OAAO;gBACL,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC;gBAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,kCAAqB,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;CACF;AAzCD,sCAyCC;AAED;;GAEG;AACH,MAAa,YAAY;IAKvB,YAAY,UAAkB,EAAE,GAAY;QAFrC,QAAG,GAAW,gBAAgB,CAAC;QAGpC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,gBAAgB,CAAC;gBAChC,GAAG,EAAE,UAAU;gBACf,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;YAEH,kBAAkB;YAClB,IAAI,IAAI,CAAC,EAAE,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;gBACxC,MAAM,IAAI,kCAAqB,CAAC,wCAAwC,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kCAAqB,EAAE,CAAC;gBAC3C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,kCAAqB,CAAC,mCAAmC,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,IAAY,EAAE,EAAU;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE;gBAC5C,GAAG,EAAE,IAAI,CAAC,EAAE;gBACZ,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,qBAAqB;gBAC/C,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,wBAAwB;aACtD,CAAC,CAAC;YACH,OAAO;gBACL,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC;gBAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,kCAAqB,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;CACF;AA7CD,oCA6CC;AAED;;GAEG;AACH,MAAa,QAAQ;IAGnB,YAAY,OAA+B;QACzC,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,kCAAqB,CAAC,uDAAuD,CAAC,CAAC;QAC3F,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC;YACzB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjD,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC;oBACjC,GAAG,EAAE,GAAG;oBACR,MAAM,EAAE,KAAK;iBACd,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,kCAAqB,CAAC,2CAA2C,KAAK,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,IAAY,EAAE,EAAU,EAAE,MAAc,EAAE,GAAW,EAAE,GAAY;QACxE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,IAAI,GAAqB,CAAC;YAE1B,IAAI,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;YAC/B,CAAC;iBAAM,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC3C,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,kCAAqB,CAAC,8CAA8C,CAAC,CAAC;YAClF,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAEtF,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,OAAO,GAAG,GAAG,CAAC,iBAAiB,CAAC;YAEtC,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC/C,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACxD,CAAC;iBAAM,IAAI,GAAG,KAAK,gBAAgB,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;gBACzD,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE;oBAC9C,GAAG,EAAE,GAAG;oBACR,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,qBAAqB;oBAC/C,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,wBAAwB;iBACtD,EAAE,GAAG,CAAC,CAAC;YACV,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,kCAAqB,CAAC,0BAA0B,GAAG,2BAA2B,CAAC,CAAC;YAC5F,CAAC;YAED,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,kCAAqB,CAAC,+BAA+B,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kCAAqB,EAAE,CAAC;gBAC3C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,kCAAqB,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;CACF;AAjED,4BAiEC;AAED,6CAA6C;AAE7C;;GAEG;AACH,MAAa,oBAAoB;IAG/B,YAAY,UAAkB;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC;gBACjC,GAAG,EAAE,UAAU;gBACf,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;YAEH,IAAI,GAAG,CAAC,iBAAiB,KAAK,QAAQ,EAAE,CAAC;gBACvC,MAAM,IAAI,kCAAqB,CAAC,2CAA2C,CAAC,CAAC;YAC/E,CAAC;YAED,0CAA0C;YAC1C,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kCAAqB,EAAE,CAAC;gBAC3C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,kCAAqB,CAAC,yCAAyC,KAAK,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,SAAiB;QACvB,IAAI,CAAC;YACH,oCAAoC;YACpC,MAAM,aAAa,GAAG,MAAM,CAAC,mBAAmB,CAAC,QAAQ,EAAE;gBACzD,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;gBACpD,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;aACnD,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;YACrE,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;YAElE,eAAe;YACf,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC;gBAClC,UAAU,EAAE,UAAU;gBACtB,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC;oBAChC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;wBACjB,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;wBACrF,IAAI,CAAC,aAAa;qBACnB,CAAC;oBACF,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,MAAM;iBACb,CAAC;aACH,CAAC,CAAC;YAEH,4BAA4B;YAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAAC,CAAC;YAEnG,uBAAuB;YACvB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;YAC7E,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACrE,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAEhC,qCAAqC;YACrC,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YAElF,iBAAiB;YACjB,MAAM,QAAQ,GAAG;gBACf,GAAG,EAAE,eAAe;gBACpB,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC;gBACvB,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC;gBACf,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;aACnC,CAAC;YAEF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,kCAAqB,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;CACF;AA5ED,oDA4EC;AAED;;GAEG;AACH,MAAa,oBAAoB;IAG/B,YAAY,OAAe;QACzB,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,gBAAgB,CAAC;gBAChC,GAAG,EAAE,OAAO;gBACZ,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;YAEH,IAAI,IAAI,CAAC,EAAE,CAAC,iBAAiB,KAAK,QAAQ,EAAE,CAAC;gBAC3C,MAAM,IAAI,kCAAqB,CAAC,wCAAwC,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kCAAqB,EAAE,CAAC;gBAC3C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,kCAAqB,CAAC,qCAAqC,KAAK,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,YAAoB;QAC1B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAE5D,IAAI,QAAQ,CAAC,GAAG,KAAK,eAAe,EAAE,CAAC;gBACrC,MAAM,IAAI,kCAAqB,CAAC,2CAA2C,CAAC,CAAC;YAC/E,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAChC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAEpC,gDAAgD;YAChD,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YAEjC,mCAAmC;YACnC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBACrF,QAAQ;aACT,CAAC,CAAC;YAEH,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC;gBACjC,GAAG,EAAE,MAAM;gBACX,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;YAEH,eAAe;YACf,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC;gBAClC,UAAU,EAAE,IAAI,CAAC,EAAE;gBACnB,SAAS,EAAE,GAAG;aACf,CAAC,CAAC;YAEH,4BAA4B;YAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAAC,CAAC;YAEnG,uBAAuB;YACvB,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;YACjF,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACzB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAEzE,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,kCAAqB,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;CACF;AAvED,oDAuEC"}

package/dist/delegation/exceptions.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Custom exceptions for the Delegation module
+ */
+import { HawcxOAuthError } from '../exceptions';
+/**
+ * Base exception for delegation errors
+ */
+export declare class DelegationError extends HawcxOAuthError {
+    constructor(message: string);
+}
+/**
+ * Raised for cryptographic errors (signing, encryption, etc.)
+ */
+export declare class DelegationCryptoError extends DelegationError {
+    constructor(message: string);
+}
+/**
+ * Raised for errors sending requests to the IDP
+ */
+export declare class DelegationRequestError extends DelegationError {
+    statusCode?: number;
+    responseBody?: string;
+    constructor(message: string, statusCode?: number, responseBody?: string);
+    toString(): string;
+}
+/**
+ * Raised for errors in the IDP's response
+ */
+export declare class DelegationResponseError extends DelegationError {
+    constructor(message: string);
+}
+//# sourceMappingURL=exceptions.d.ts.map

package/dist/delegation/exceptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exceptions.d.ts","sourceRoot":"","sources":["../../src/delegation/exceptions.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD;;GAEG;AACH,qBAAa,eAAgB,SAAQ,eAAe;gBACtC,OAAO,EAAE,MAAM;CAK5B;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,eAAe;gBAC5C,OAAO,EAAE,MAAM;CAK5B;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,eAAe;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;gBAEV,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM;IAQvE,QAAQ,IAAI,MAAM;CAOnB;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,eAAe;gBAC9C,OAAO,EAAE,MAAM;CAK5B"}

package/dist/delegation/exceptions.js

@@ -0,0 +1,61 @@
+"use strict";
+/**
+ * Custom exceptions for the Delegation module
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DelegationResponseError = exports.DelegationRequestError = exports.DelegationCryptoError = exports.DelegationError = void 0;
+const exceptions_1 = require("../exceptions");
+/**
+ * Base exception for delegation errors
+ */
+class DelegationError extends exceptions_1.HawcxOAuthError {
+    constructor(message) {
+        super(message);
+        this.name = 'DelegationError';
+        Object.setPrototypeOf(this, DelegationError.prototype);
+    }
+}
+exports.DelegationError = DelegationError;
+/**
+ * Raised for cryptographic errors (signing, encryption, etc.)
+ */
+class DelegationCryptoError extends DelegationError {
+    constructor(message) {
+        super(message);
+        this.name = 'DelegationCryptoError';
+        Object.setPrototypeOf(this, DelegationCryptoError.prototype);
+    }
+}
+exports.DelegationCryptoError = DelegationCryptoError;
+/**
+ * Raised for errors sending requests to the IDP
+ */
+class DelegationRequestError extends DelegationError {
+    constructor(message, statusCode, responseBody) {
+        super(message);
+        this.name = 'DelegationRequestError';
+        this.statusCode = statusCode;
+        this.responseBody = responseBody;
+        Object.setPrototypeOf(this, DelegationRequestError.prototype);
+    }
+    toString() {
+        let base = this.message;
+        if (this.statusCode) {
+            base = `${base} (HTTP ${this.statusCode})`;
+        }
+        return base;
+    }
+}
+exports.DelegationRequestError = DelegationRequestError;
+/**
+ * Raised for errors in the IDP's response
+ */
+class DelegationResponseError extends DelegationError {
+    constructor(message) {
+        super(message);
+        this.name = 'DelegationResponseError';
+        Object.setPrototypeOf(this, DelegationResponseError.prototype);
+    }
+}
+exports.DelegationResponseError = DelegationResponseError;
+//# sourceMappingURL=exceptions.js.map

package/dist/delegation/exceptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exceptions.js","sourceRoot":"","sources":["../../src/delegation/exceptions.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,8CAAgD;AAEhD;;GAEG;AACH,MAAa,eAAgB,SAAQ,4BAAe;IAClD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC;CACF;AAND,0CAMC;AAED;;GAEG;AACH,MAAa,qBAAsB,SAAQ,eAAe;IACxD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC/D,CAAC;CACF;AAND,sDAMC;AAED;;GAEG;AACH,MAAa,sBAAuB,SAAQ,eAAe;IAIzD,YAAY,OAAe,EAAE,UAAmB,EAAE,YAAqB;QACrE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAChE,CAAC;IAED,QAAQ;QACN,IAAI,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QACxB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,GAAG,GAAG,IAAI,UAAU,IAAI,CAAC,UAAU,GAAG,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAnBD,wDAmBC;AAED;;GAEG;AACH,MAAa,uBAAwB,SAAQ,eAAe;IAC1D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACjE,CAAC;CACF;AAND,0DAMC"}