@hawcx/oauth-client 0.1.0

package/dist/delegation/hawcx.d.ts

@@ -0,0 +1,254 @@
+/**
+ * Hawcx-specific delegation client with high-level convenience methods.
+ *
+ * This module provides a streamlined API for common Hawcx operations like
+ * MFA configuration, user management, and device operations. All cryptographic
+ * operations (encryption, signing, verification) are handled automatically.
+ */
+import { Signer } from './client';
+import { Verifier, EciesX25519Encryptor, EciesX25519Decryptor } from './crypto';
+/**
+ * Supported MFA methods for Hawcx authentication.
+ *
+ * This enum ensures type safety and prevents typos when specifying MFA methods.
+ *
+ * @example
+ * ```typescript
+ * import { MfaMethod } from '@hawcx/oauth-client';
+ *
+ * // Use enum for type safety
+ * await client.initiateMfaChange({
+ *   userid: "user@example.com",
+ *   mfaMethod: MfaMethod.SMS,  // Type-safe!
+ *   phoneNumber: "+15551234567"
+ * });
+ *
+ * // String values still work for backwards compatibility
+ * await client.initiateMfaChange({
+ *   userid: "user@example.com",
+ *   mfaMethod: "sms",  // Also works
+ *   phoneNumber: "+15551234567"
+ * });
+ * ```
+ */
+export declare enum MfaMethod {
+    EMAIL = "email",
+    SMS = "sms",
+    TOTP = "totp"
+}
+/**
+ * Options for initializing Hawcx delegation client from keys
+ */
+export interface HawcxClientFromKeysOptions {
+    /** Service Provider's Ed25519 private key (PEM format) */
+    spSigningKey: string;
+    /** Service Provider's X25519 private key (PEM format) */
+    spEncryptionKey: string;
+    /** IDP's Ed25519 public key (PEM format) */
+    idpVerifyKey: string;
+    /** IDP's X25519 public key (PEM format) */
+    idpEncryptionKey: string;
+    /** Hawcx API base URL (e.g., "https://ceasar-api.hawcx.com") */
+    baseUrl: string;
+    /** Service Provider identifier (usually OAuth client_id) */
+    spId: string;
+    /** Optional Hawcx API key */
+    apiKey?: string;
+    /** Request timeout in seconds (default: 15) */
+    timeout?: number;
+    /** Internal - Key ID for SP signatures (default: "hawcx", do not change) */
+    kid?: string;
+    /** Internal - Key ID for IDP verification (default: "hawcx", do not change) */
+    idpKid?: string;
+}
+/**
+ * Options for initiating MFA change
+ */
+export interface InitiateMfaChangeOptions {
+    /** User identifier (typically email address) */
+    userid: string;
+    /** MFA method to configure (MfaMethod enum or 'email', 'sms', 'totp' string) */
+    mfaMethod: MfaMethod | string;
+    /** Phone number with country code (required for SMS, e.g., "+15551234567") */
+    phoneNumber?: string;
+    /** Target MFA method after verification (optional) */
+    mfaChangeTo?: MfaMethod | string;
+}
+/**
+ * Options for verifying MFA change
+ */
+export interface VerifyMfaChangeOptions {
+    /** User identifier (must match initiate request) */
+    userid: string;
+    /** Session ID from initiateMfaChange response */
+    sessionId: string;
+    /** One-time password entered by user (6 digits) */
+    otp: string;
+}
+/**
+ * High-level client for Hawcx delegation operations.
+ *
+ * This client provides simplified methods for common Hawcx operations:
+ * - MFA configuration (email, SMS, TOTP)
+ * - User credential management
+ * - Device operations
+ *
+ * All requests are automatically encrypted (ECIES) and signed (Ed25519/RSA-PSS).
+ * All responses are automatically verified and decrypted.
+ *
+ * @example
+ * ```typescript
+ * // Initialize from keys
+ * const client = HawcxDelegationClient.fromKeys({
+ *   spSigningKey: process.env.SP_SIGNING_KEY!,
+ *   spEncryptionKey: process.env.SP_ENCRYPTION_KEY!,
+ *   idpVerifyKey: process.env.IDP_VERIFY_KEY!,
+ *   idpEncryptionKey: process.env.IDP_ENCRYPTION_KEY!,
+ *   baseUrl: 'https://ceasar-api.hawcx.com',
+ *   spId: 'my-client-id'
+ * });
+ *
+ * // Initiate SMS MFA setup
+ * const result = await client.initiateMfaChange({
+ *   userid: "user@example.com",
+ *   mfaMethod: "sms",
+ *   phoneNumber: "+15551234567"
+ * });
+ * console.log(result.session_id);
+ *
+ * // Verify OTP
+ * await client.verifyMfaChange({
+ *   userid: "user@example.com",
+ *   sessionId: result.session_id,
+ *   otp: "123456"
+ * });
+ * ```
+ */
+export declare class HawcxDelegationClient {
+    private client;
+    private apiKey?;
+    baseUrl: string;
+    spId: string;
+    constructor(options: {
+        baseUrl: string;
+        signer: Signer;
+        verifier: Verifier;
+        encryptor: EciesX25519Encryptor;
+        decryptor: EciesX25519Decryptor;
+        spId: string;
+        apiKey?: string;
+        timeout?: number;
+    });
+    /**
+     * Create client from explicit key values (recommended).
+     *
+     * This method allows the application to load keys from any source
+     * (env vars, config files, secrets manager, etc.) and pass them
+     * as values to the SDK.
+     *
+     * @param options - Configuration options
+     * @returns Configured HawcxDelegationClient instance
+     * @throws DelegationRequestError if key initialization fails
+     *
+     * @example
+     * ```typescript
+     * import * as process from 'process';
+     *
+     * // App controls how to load keys
+     * const client = HawcxDelegationClient.fromKeys({
+     *   spSigningKey: process.env.MY_SIGNING_KEY!,
+     *   spEncryptionKey: process.env.MY_ENCRYPTION_KEY!,
+     *   idpVerifyKey: process.env.IDP_VERIFY_KEY!,
+     *   idpEncryptionKey: process.env.IDP_ENCRYPT_KEY!,
+     *   baseUrl: process.env.HAWCX_URL!,
+     *   spId: process.env.MY_CLIENT_ID!
+     * });
+     * ```
+     */
+    static fromKeys(options: HawcxClientFromKeysOptions): HawcxDelegationClient;
+    /**
+     * Build Hawcx API authentication headers
+     */
+    private buildAuthHeaders;
+    /**
+     * Initiate MFA setup or change for a user.
+     *
+     * This method starts the MFA enrollment/update process by sending an OTP
+     * to the user via their chosen method (email, SMS, or generating a TOTP secret).
+     *
+     * @param options - MFA initiation configuration
+     * @returns Dictionary containing session_id and optional TOTP details
+     * @throws DelegationRequestError if request fails or parameters are invalid
+     * @throws Error if SMS method specified without phone_number
+     *
+     * @example
+     * ```typescript
+     * import { MfaMethod } from '@hawcx/oauth-client';
+     *
+     * // Email MFA (with enum - recommended!)
+     * const result = await client.initiateMfaChange({
+     *   userid: "user@example.com",
+     *   mfaMethod: MfaMethod.EMAIL
+     * });
+     *
+     * // SMS MFA (string also works)
+     * const result = await client.initiateMfaChange({
+     *   userid: "user@example.com",
+     *   mfaMethod: "sms",
+     *   phoneNumber: "+15551234567"
+     * });
+     *
+     * // TOTP MFA
+     * const result = await client.initiateMfaChange({
+     *   userid: "user@example.com",
+     *   mfaMethod: MfaMethod.TOTP
+     * });
+     * console.log(`Scan QR code: ${result.otpauth_uri}`);
+     * ```
+     */
+    initiateMfaChange(options: InitiateMfaChangeOptions): Promise<Record<string, any>>;
+    /**
+     * Verify OTP and complete MFA configuration change.
+     *
+     * This method verifies the OTP sent to the user and completes the MFA
+     * enrollment/update process.
+     *
+     * @param options - MFA verification configuration
+     * @returns Dictionary containing success message and optional mfa_changed_to
+     * @throws DelegationRequestError if verification fails
+     * @throws Error if OTP format is invalid
+     *
+     * @example
+     * ```typescript
+     * // Get OTP from user
+     * const otp = getUserInput();
+     *
+     * // Verify and complete MFA setup
+     * const result = await client.verifyMfaChange({
+     *   userid: "user@example.com",
+     *   sessionId: sessionId,
+     *   otp: otp
+     * });
+     * console.log(`MFA updated: ${result.detail}`);
+     * ```
+     */
+    verifyMfaChange(options: VerifyMfaChangeOptions): Promise<Record<string, any>>;
+    /**
+     * Get user's stored credentials and MFA status.
+     *
+     * This method retrieves the user's credentials from Hawcx, including
+     * their current MFA configuration.
+     *
+     * @param userid - User identifier
+     * @returns Dictionary containing user credentials and MFA status
+     *
+     * @example
+     * ```typescript
+     * const creds = await client.getUserCredentials("user@example.com");
+     * console.log(`MFA method: ${creds.mfa_method}`);
+     * console.log(`Phone: ${creds.contact}`);
+     * ```
+     */
+    getUserCredentials(userid: string): Promise<Record<string, any>>;
+}
+//# sourceMappingURL=hawcx.d.ts.map

package/dist/delegation/hawcx.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hawcx.d.ts","sourceRoot":"","sources":["../../src/delegation/hawcx.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAuB,MAAM,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAEL,QAAQ,EACR,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,UAAU,CAAC;AAGlB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,oBAAY,SAAS;IACnB,KAAK,UAAU;IACf,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,0DAA0D;IAC1D,YAAY,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,eAAe,EAAE,MAAM,CAAC;IACxB,4CAA4C;IAC5C,YAAY,EAAE,MAAM,CAAC;IACrB,2CAA2C;IAC3C,gBAAgB,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,SAAS,EAAE,SAAS,GAAG,MAAM,CAAC;IAC9B,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,WAAW,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,MAAM,CAAC,CAAS;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;gBAER,OAAO,EAAE;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,QAAQ,CAAC;QACnB,SAAS,EAAE,oBAAoB,CAAC;QAChC,SAAS,EAAE,oBAAoB,CAAC;QAChC,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB;IAeD;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,0BAA0B,GAAG,qBAAqB;IAqC3E;;OAEG;IACH,OAAO,CAAC,gBAAgB;IASxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACG,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAyDxF;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACG,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAgCpF;;;;;;;;;;;;;;;OAeG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAmBvE"}

package/dist/delegation/hawcx.js

@@ -0,0 +1,326 @@
+"use strict";
+/**
+ * Hawcx-specific delegation client with high-level convenience methods.
+ *
+ * This module provides a streamlined API for common Hawcx operations like
+ * MFA configuration, user management, and device operations. All cryptographic
+ * operations (encryption, signing, verification) are handled automatically.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HawcxDelegationClient = exports.MfaMethod = void 0;
+const client_1 = require("./client");
+const crypto_1 = require("./crypto");
+const exceptions_1 = require("./exceptions");
+/**
+ * Supported MFA methods for Hawcx authentication.
+ *
+ * This enum ensures type safety and prevents typos when specifying MFA methods.
+ *
+ * @example
+ * ```typescript
+ * import { MfaMethod } from '@hawcx/oauth-client';
+ *
+ * // Use enum for type safety
+ * await client.initiateMfaChange({
+ *   userid: "user@example.com",
+ *   mfaMethod: MfaMethod.SMS,  // Type-safe!
+ *   phoneNumber: "+15551234567"
+ * });
+ *
+ * // String values still work for backwards compatibility
+ * await client.initiateMfaChange({
+ *   userid: "user@example.com",
+ *   mfaMethod: "sms",  // Also works
+ *   phoneNumber: "+15551234567"
+ * });
+ * ```
+ */
+var MfaMethod;
+(function (MfaMethod) {
+    MfaMethod["EMAIL"] = "email";
+    MfaMethod["SMS"] = "sms";
+    MfaMethod["TOTP"] = "totp";
+})(MfaMethod || (exports.MfaMethod = MfaMethod = {}));
+/**
+ * High-level client for Hawcx delegation operations.
+ *
+ * This client provides simplified methods for common Hawcx operations:
+ * - MFA configuration (email, SMS, TOTP)
+ * - User credential management
+ * - Device operations
+ *
+ * All requests are automatically encrypted (ECIES) and signed (Ed25519/RSA-PSS).
+ * All responses are automatically verified and decrypted.
+ *
+ * @example
+ * ```typescript
+ * // Initialize from keys
+ * const client = HawcxDelegationClient.fromKeys({
+ *   spSigningKey: process.env.SP_SIGNING_KEY!,
+ *   spEncryptionKey: process.env.SP_ENCRYPTION_KEY!,
+ *   idpVerifyKey: process.env.IDP_VERIFY_KEY!,
+ *   idpEncryptionKey: process.env.IDP_ENCRYPTION_KEY!,
+ *   baseUrl: 'https://ceasar-api.hawcx.com',
+ *   spId: 'my-client-id'
+ * });
+ *
+ * // Initiate SMS MFA setup
+ * const result = await client.initiateMfaChange({
+ *   userid: "user@example.com",
+ *   mfaMethod: "sms",
+ *   phoneNumber: "+15551234567"
+ * });
+ * console.log(result.session_id);
+ *
+ * // Verify OTP
+ * await client.verifyMfaChange({
+ *   userid: "user@example.com",
+ *   sessionId: result.session_id,
+ *   otp: "123456"
+ * });
+ * ```
+ */
+class HawcxDelegationClient {
+    constructor(options) {
+        this.client = new client_1.IdpDelegationClient({
+            baseUrl: options.baseUrl,
+            signer: options.signer,
+            verifier: options.verifier,
+            encryptor: options.encryptor,
+            decryptor: options.decryptor,
+            spId: options.spId,
+            timeout: options.timeout,
+        });
+        this.apiKey = options.apiKey;
+        this.baseUrl = options.baseUrl;
+        this.spId = options.spId;
+    }
+    /**
+     * Create client from explicit key values (recommended).
+     *
+     * This method allows the application to load keys from any source
+     * (env vars, config files, secrets manager, etc.) and pass them
+     * as values to the SDK.
+     *
+     * @param options - Configuration options
+     * @returns Configured HawcxDelegationClient instance
+     * @throws DelegationRequestError if key initialization fails
+     *
+     * @example
+     * ```typescript
+     * import * as process from 'process';
+     *
+     * // App controls how to load keys
+     * const client = HawcxDelegationClient.fromKeys({
+     *   spSigningKey: process.env.MY_SIGNING_KEY!,
+     *   spEncryptionKey: process.env.MY_ENCRYPTION_KEY!,
+     *   idpVerifyKey: process.env.IDP_VERIFY_KEY!,
+     *   idpEncryptionKey: process.env.IDP_ENCRYPT_KEY!,
+     *   baseUrl: process.env.HAWCX_URL!,
+     *   spId: process.env.MY_CLIENT_ID!
+     * });
+     * ```
+     */
+    static fromKeys(options) {
+        const { spSigningKey, spEncryptionKey, idpVerifyKey, idpEncryptionKey, baseUrl, spId, apiKey, timeout = 15, kid = 'hawcx', idpKid = 'hawcx', } = options;
+        try {
+            const signer = new crypto_1.Ed25519Signer(spSigningKey, kid);
+            const verifier = new crypto_1.Verifier({ [idpKid]: idpVerifyKey });
+            const encryptor = new crypto_1.EciesX25519Encryptor(idpEncryptionKey);
+            const decryptor = new crypto_1.EciesX25519Decryptor(spEncryptionKey);
+            console.log(`Initialized HawcxDelegationClient with base_url=${baseUrl}, sp_id=${spId}`);
+            return new HawcxDelegationClient({
+                baseUrl,
+                signer,
+                verifier,
+                encryptor,
+                decryptor,
+                spId,
+                apiKey,
+                timeout,
+            });
+        }
+        catch (error) {
+            throw new exceptions_1.DelegationRequestError(`Failed to initialize crypto helpers: ${error}`);
+        }
+    }
+    /**
+     * Build Hawcx API authentication headers
+     */
+    buildAuthHeaders() {
+        const headers = {};
+        if (this.apiKey) {
+            headers['apikey'] = this.apiKey;
+        }
+        return headers;
+    }
+    /**
+     * Initiate MFA setup or change for a user.
+     *
+     * This method starts the MFA enrollment/update process by sending an OTP
+     * to the user via their chosen method (email, SMS, or generating a TOTP secret).
+     *
+     * @param options - MFA initiation configuration
+     * @returns Dictionary containing session_id and optional TOTP details
+     * @throws DelegationRequestError if request fails or parameters are invalid
+     * @throws Error if SMS method specified without phone_number
+     *
+     * @example
+     * ```typescript
+     * import { MfaMethod } from '@hawcx/oauth-client';
+     *
+     * // Email MFA (with enum - recommended!)
+     * const result = await client.initiateMfaChange({
+     *   userid: "user@example.com",
+     *   mfaMethod: MfaMethod.EMAIL
+     * });
+     *
+     * // SMS MFA (string also works)
+     * const result = await client.initiateMfaChange({
+     *   userid: "user@example.com",
+     *   mfaMethod: "sms",
+     *   phoneNumber: "+15551234567"
+     * });
+     *
+     * // TOTP MFA
+     * const result = await client.initiateMfaChange({
+     *   userid: "user@example.com",
+     *   mfaMethod: MfaMethod.TOTP
+     * });
+     * console.log(`Scan QR code: ${result.otpauth_uri}`);
+     * ```
+     */
+    async initiateMfaChange(options) {
+        const { userid, mfaMethod, phoneNumber, mfaChangeTo } = options;
+        // Convert enum to string if needed
+        const mfaMethodStr = typeof mfaMethod === 'string' ? mfaMethod : String(mfaMethod);
+        const mfaChangeToStr = mfaChangeTo
+            ? typeof mfaChangeTo === 'string'
+                ? mfaChangeTo
+                : String(mfaChangeTo)
+            : undefined;
+        // Validate method
+        const validMethods = [MfaMethod.EMAIL, MfaMethod.SMS, MfaMethod.TOTP];
+        if (!validMethods.includes(mfaMethodStr)) {
+            throw new Error(`Invalid mfa_method '${mfaMethodStr}'. Must be one of: ${validMethods.join(', ')}`);
+        }
+        // Validate SMS requires phone number
+        if (mfaMethodStr === MfaMethod.SMS && !phoneNumber) {
+            throw new Error('phone_number is required for SMS MFA');
+        }
+        // Build Hawcx UpdateTable API payload
+        const payload = {
+            userid,
+            mfa_method: mfaMethodStr,
+        };
+        // Add SMS phone number
+        if (mfaMethodStr === MfaMethod.SMS && phoneNumber) {
+            payload.contact = phoneNumber;
+        }
+        // Add target method if changing
+        if (mfaChangeToStr) {
+            payload.mfa_change_to = mfaChangeToStr;
+        }
+        console.log(`[MFA Initiate] Method=${mfaMethodStr} for user=${userid}`);
+        try {
+            const response = await this.client.sendSecureRequest({
+                endpoint: '/hc_auth/v5/update/initiate',
+                payload,
+                extraHeaders: this.buildAuthHeaders(),
+            });
+            console.log(`[MFA Initiate] Success for user=${userid}, session_id=${response.session_id}`);
+            return response;
+        }
+        catch (error) {
+            console.error(`[MFA Initiate] Failed for user=${userid}:`, error);
+            throw error;
+        }
+    }
+    /**
+     * Verify OTP and complete MFA configuration change.
+     *
+     * This method verifies the OTP sent to the user and completes the MFA
+     * enrollment/update process.
+     *
+     * @param options - MFA verification configuration
+     * @returns Dictionary containing success message and optional mfa_changed_to
+     * @throws DelegationRequestError if verification fails
+     * @throws Error if OTP format is invalid
+     *
+     * @example
+     * ```typescript
+     * // Get OTP from user
+     * const otp = getUserInput();
+     *
+     * // Verify and complete MFA setup
+     * const result = await client.verifyMfaChange({
+     *   userid: "user@example.com",
+     *   sessionId: sessionId,
+     *   otp: otp
+     * });
+     * console.log(`MFA updated: ${result.detail}`);
+     * ```
+     */
+    async verifyMfaChange(options) {
+        const { userid, sessionId, otp } = options;
+        // Validate OTP format
+        if (!otp || otp.length !== 6 || !/^\d{6}$/.test(otp)) {
+            throw new Error('OTP must be a 6-digit code');
+        }
+        // Build Hawcx UpdateTable API payload
+        const payload = {
+            userid,
+            session_id: sessionId,
+            otp,
+        };
+        console.log(`[MFA Verify] Verifying OTP for user=${userid}, session=${sessionId}`);
+        try {
+            const response = await this.client.sendSecureRequest({
+                endpoint: '/hc_auth/v5/update/verify',
+                payload,
+                extraHeaders: this.buildAuthHeaders(),
+            });
+            console.log(`[MFA Verify] Success for user=${userid}`);
+            return response;
+        }
+        catch (error) {
+            console.error(`[MFA Verify] Failed for user=${userid}:`, error);
+            throw error;
+        }
+    }
+    /**
+     * Get user's stored credentials and MFA status.
+     *
+     * This method retrieves the user's credentials from Hawcx, including
+     * their current MFA configuration.
+     *
+     * @param userid - User identifier
+     * @returns Dictionary containing user credentials and MFA status
+     *
+     * @example
+     * ```typescript
+     * const creds = await client.getUserCredentials("user@example.com");
+     * console.log(`MFA method: ${creds.mfa_method}`);
+     * console.log(`Phone: ${creds.contact}`);
+     * ```
+     */
+    async getUserCredentials(userid) {
+        const payload = { userid };
+        console.log(`[Get Creds] Fetching credentials for user=${userid}`);
+        try {
+            const response = await this.client.sendSecureRequest({
+                endpoint: '/hc_auth/v5/update/get-creds',
+                payload,
+                extraHeaders: this.buildAuthHeaders(),
+            });
+            console.log(`[Get Creds] Success for user=${userid}`);
+            return response;
+        }
+        catch (error) {
+            console.error(`[Get Creds] Failed for user=${userid}:`, error);
+            throw error;
+        }
+    }
+}
+exports.HawcxDelegationClient = HawcxDelegationClient;
+//# sourceMappingURL=hawcx.js.map

package/dist/delegation/hawcx.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hawcx.js","sourceRoot":"","sources":["../../src/delegation/hawcx.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAEH,qCAAuD;AACvD,qCAKkB;AAClB,6CAAsD;AAEtD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,IAAY,SAIX;AAJD,WAAY,SAAS;IACnB,4BAAe,CAAA;IACf,wBAAW,CAAA;IACX,0BAAa,CAAA;AACf,CAAC,EAJW,SAAS,yBAAT,SAAS,QAIpB;AAsDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAa,qBAAqB;IAMhC,YAAY,OASX;QACC,IAAI,CAAC,MAAM,GAAG,IAAI,4BAAmB,CAAC;YACpC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,MAAM,CAAC,QAAQ,CAAC,OAAmC;QACjD,MAAM,EACJ,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,OAAO,EACP,IAAI,EACJ,MAAM,EACN,OAAO,GAAG,EAAE,EACZ,GAAG,GAAG,OAAO,EACb,MAAM,GAAG,OAAO,GACjB,GAAG,OAAO,CAAC;QAEZ,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,sBAAa,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;YACpD,MAAM,QAAQ,GAAG,IAAI,iBAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;YAC1D,MAAM,SAAS,GAAG,IAAI,6BAAoB,CAAC,gBAAgB,CAAC,CAAC;YAC7D,MAAM,SAAS,GAAG,IAAI,6BAAoB,CAAC,eAAe,CAAC,CAAC;YAE5D,OAAO,CAAC,GAAG,CAAC,mDAAmD,OAAO,WAAW,IAAI,EAAE,CAAC,CAAC;YAEzF,OAAO,IAAI,qBAAqB,CAAC;gBAC/B,OAAO;gBACP,MAAM;gBACN,QAAQ;gBACR,SAAS;gBACT,SAAS;gBACT,IAAI;gBACJ,MAAM;gBACN,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,mCAAsB,CAAC,wCAAwC,KAAK,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED;;OAEG;IACK,gBAAgB;QACtB,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QAClC,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAAiC;QACvD,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;QAEhE,mCAAmC;QACnC,MAAM,YAAY,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnF,MAAM,cAAc,GAAG,WAAW;YAChC,CAAC,CAAC,OAAO,WAAW,KAAK,QAAQ;gBAC/B,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;YACvB,CAAC,CAAC,SAAS,CAAC;QAEd,kBAAkB;QAClB,MAAM,YAAY,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACtE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAyB,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,uBAAuB,YAAY,sBAAsB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnF,CAAC;QACJ,CAAC;QAED,qCAAqC;QACrC,IAAI,YAAY,KAAK,SAAS,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,sCAAsC;QACtC,MAAM,OAAO,GAAwB;YACnC,MAAM;YACN,UAAU,EAAE,YAAY;SACzB,CAAC;QAEF,uBAAuB;QACvB,IAAI,YAAY,KAAK,SAAS,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC;YAClD,OAAO,CAAC,OAAO,GAAG,WAAW,CAAC;QAChC,CAAC;QAED,gCAAgC;QAChC,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,CAAC,aAAa,GAAG,cAAc,CAAC;QACzC,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,yBAAyB,YAAY,aAAa,MAAM,EAAE,CAAC,CAAC;QAExE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;gBACnD,QAAQ,EAAE,6BAA6B;gBACvC,OAAO;gBACP,YAAY,EAAE,IAAI,CAAC,gBAAgB,EAAE;aACtC,CAAC,CAAC;YAEH,OAAO,CAAC,GAAG,CAAC,mCAAmC,MAAM,gBAAgB,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;YAC5F,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,kCAAkC,MAAM,GAAG,EAAE,KAAK,CAAC,CAAC;YAClE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,KAAK,CAAC,eAAe,CAAC,OAA+B;QACnD,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QAE3C,sBAAsB;QACtB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,sCAAsC;QACtC,MAAM,OAAO,GAAG;YACd,MAAM;YACN,UAAU,EAAE,SAAS;YACrB,GAAG;SACJ,CAAC;QAEF,OAAO,CAAC,GAAG,CAAC,uCAAuC,MAAM,aAAa,SAAS,EAAE,CAAC,CAAC;QAEnF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;gBACnD,QAAQ,EAAE,2BAA2B;gBACrC,OAAO;gBACP,YAAY,EAAE,IAAI,CAAC,gBAAgB,EAAE;aACtC,CAAC,CAAC;YAEH,OAAO,CAAC,GAAG,CAAC,iCAAiC,MAAM,EAAE,CAAC,CAAC;YACvD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,MAAM,GAAG,EAAE,KAAK,CAAC,CAAC;YAChE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,kBAAkB,CAAC,MAAc;QACrC,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,CAAC;QAE3B,OAAO,CAAC,GAAG,CAAC,6CAA6C,MAAM,EAAE,CAAC,CAAC;QAEnE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;gBACnD,QAAQ,EAAE,8BAA8B;gBACxC,OAAO;gBACP,YAAY,EAAE,IAAI,CAAC,gBAAgB,EAAE;aACtC,CAAC,CAAC;YAEH,OAAO,CAAC,GAAG,CAAC,gCAAgC,MAAM,EAAE,CAAC,CAAC;YACtD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,+BAA+B,MAAM,GAAG,EAAE,KAAK,CAAC,CAAC;YAC/D,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAlSD,sDAkSC"}

package/dist/delegation/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Hawcx OAuth Client SDK - Delegation Module
+ *
+ * Exposes the client and utilities for making secure, backend-to-backend
+ * delegated requests to an IDP.
+ *
+ * For Hawcx-specific operations, use HawcxDelegationClient for simplified high-level API.
+ * For generic delegation operations, use IdpDelegationClient for lower-level control.
+ */
+export { IdpDelegationClient } from './client';
+export { HawcxDelegationClient, MfaMethod } from './hawcx';
+export { Ed25519Signer, RsaPssSigner, Verifier, EciesX25519Encryptor, EciesX25519Decryptor, nowS, } from './crypto';
+export { DelegationError, DelegationCryptoError, DelegationRequestError, DelegationResponseError, } from './exceptions';
+//# sourceMappingURL=index.d.ts.map

package/dist/delegation/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,EACL,aAAa,EACb,YAAY,EACZ,QAAQ,EACR,oBAAoB,EACpB,oBAAoB,EACpB,IAAI,GACL,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,cAAc,CAAC"}

package/dist/delegation/index.js

@@ -0,0 +1,30 @@
+"use strict";
+/**
+ * Hawcx OAuth Client SDK - Delegation Module
+ *
+ * Exposes the client and utilities for making secure, backend-to-backend
+ * delegated requests to an IDP.
+ *
+ * For Hawcx-specific operations, use HawcxDelegationClient for simplified high-level API.
+ * For generic delegation operations, use IdpDelegationClient for lower-level control.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DelegationResponseError = exports.DelegationRequestError = exports.DelegationCryptoError = exports.DelegationError = exports.nowS = exports.EciesX25519Decryptor = exports.EciesX25519Encryptor = exports.Verifier = exports.RsaPssSigner = exports.Ed25519Signer = exports.MfaMethod = exports.HawcxDelegationClient = exports.IdpDelegationClient = void 0;
+var client_1 = require("./client");
+Object.defineProperty(exports, "IdpDelegationClient", { enumerable: true, get: function () { return client_1.IdpDelegationClient; } });
+var hawcx_1 = require("./hawcx");
+Object.defineProperty(exports, "HawcxDelegationClient", { enumerable: true, get: function () { return hawcx_1.HawcxDelegationClient; } });
+Object.defineProperty(exports, "MfaMethod", { enumerable: true, get: function () { return hawcx_1.MfaMethod; } });
+var crypto_1 = require("./crypto");
+Object.defineProperty(exports, "Ed25519Signer", { enumerable: true, get: function () { return crypto_1.Ed25519Signer; } });
+Object.defineProperty(exports, "RsaPssSigner", { enumerable: true, get: function () { return crypto_1.RsaPssSigner; } });
+Object.defineProperty(exports, "Verifier", { enumerable: true, get: function () { return crypto_1.Verifier; } });
+Object.defineProperty(exports, "EciesX25519Encryptor", { enumerable: true, get: function () { return crypto_1.EciesX25519Encryptor; } });
+Object.defineProperty(exports, "EciesX25519Decryptor", { enumerable: true, get: function () { return crypto_1.EciesX25519Decryptor; } });
+Object.defineProperty(exports, "nowS", { enumerable: true, get: function () { return crypto_1.nowS; } });
+var exceptions_1 = require("./exceptions");
+Object.defineProperty(exports, "DelegationError", { enumerable: true, get: function () { return exceptions_1.DelegationError; } });
+Object.defineProperty(exports, "DelegationCryptoError", { enumerable: true, get: function () { return exceptions_1.DelegationCryptoError; } });
+Object.defineProperty(exports, "DelegationRequestError", { enumerable: true, get: function () { return exceptions_1.DelegationRequestError; } });
+Object.defineProperty(exports, "DelegationResponseError", { enumerable: true, get: function () { return exceptions_1.DelegationResponseError; } });
+//# sourceMappingURL=index.js.map

package/dist/delegation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/delegation/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAEH,mCAA+C;AAAtC,6GAAA,mBAAmB,OAAA;AAC5B,iCAA2D;AAAlD,8GAAA,qBAAqB,OAAA;AAAE,kGAAA,SAAS,OAAA;AACzC,mCAOkB;AANhB,uGAAA,aAAa,OAAA;AACb,sGAAA,YAAY,OAAA;AACZ,kGAAA,QAAQ,OAAA;AACR,8GAAA,oBAAoB,OAAA;AACpB,8GAAA,oBAAoB,OAAA;AACpB,8FAAA,IAAI,OAAA;AAEN,2CAKsB;AAJpB,6GAAA,eAAe,OAAA;AACf,mHAAA,qBAAqB,OAAA;AACrB,oHAAA,sBAAsB,OAAA;AACtB,qHAAA,uBAAuB,OAAA"}