@heyatom/bastion-client 0.7.0 → 0.7.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/dist/cjs/core/api-client.d.ts +7 -2
  2. package/dist/cjs/core/api-client.js +8 -3
  3. package/dist/esm/core/api-client.d.ts +7 -2
  4. package/dist/esm/core/api-client.js +8 -3
  5. package/package.json +1 -1
package/dist/cjs/core/api-client.d.ts CHANGED
@@ -50,8 +50,13 @@ export declare class BastionApiClient {
50
50
  register(input: BastionRegisterInput, ctx?: BastionClientContext): Promise<{
51
51
  message: string;
52
52
  }>;
53
- /** Trades the one-time OAuth code for tokens. */
54
- exchange(code: string, ctx?: BastionClientContext): Promise<BastionLoginResult>;
53
+ /**
54
+ * Trades the one-time OAuth code for tokens. `state` is the value the app put
55
+ * on the initiate URL, read back from its own cookie/session (never from the
56
+ * callback query): Bastion refuses a code minted under a different one, which
57
+ * is what stops an attacker's code from being redeemed in a victim's browser.
58
+ */
59
+ exchange(code: string, ctx?: BastionClientContext, state?: string): Promise<BastionLoginResult>;
55
60
  completeTwoFactor(twoFactorToken: string, code: string, ctx?: BastionClientContext): Promise<BastionTokenPair>;
56
61
  refresh(refreshToken: string, ctx?: BastionClientContext): Promise<BastionTokenPair>;
57
62
  /** Revokes the token and any successor issued through `refresh` within the memory window. Never throws. */
package/dist/cjs/core/api-client.js CHANGED
@@ -61,9 +61,14 @@ class BastionApiClient {
61
61
  register(input, ctx) {
62
62
  return this.call('POST', '/auth/register', { ...input, ...this.appContext }, { headers: BastionApiClient.clientHeaders(ctx) });
63
63
  }
64
- /** Trades the one-time OAuth code for tokens. */
65
- exchange(code, ctx) {
66
- return this.call('POST', '/auth/exchange', { code, appSlug: this.appSlug }, { headers: BastionApiClient.clientHeaders(ctx) });
64
+ /**
65
+ * Trades the one-time OAuth code for tokens. `state` is the value the app put
66
+ * on the initiate URL, read back from its own cookie/session (never from the
67
+ * callback query): Bastion refuses a code minted under a different one, which
68
+ * is what stops an attacker's code from being redeemed in a victim's browser.
69
+ */
70
+ exchange(code, ctx, state) {
71
+ return this.call('POST', '/auth/exchange', { code, appSlug: this.appSlug, ...(state !== undefined ? { state } : {}) }, { headers: BastionApiClient.clientHeaders(ctx) });
67
72
  }
68
73
  completeTwoFactor(twoFactorToken, code, ctx) {
69
74
  return this.call('POST', '/auth/2fa/authenticate', { twoFactorToken, code }, { headers: BastionApiClient.clientHeaders(ctx) });
package/dist/esm/core/api-client.d.ts CHANGED
@@ -50,8 +50,13 @@ export declare class BastionApiClient {
50
50
  register(input: BastionRegisterInput, ctx?: BastionClientContext): Promise<{
51
51
  message: string;
52
52
  }>;
53
- /** Trades the one-time OAuth code for tokens. */
54
- exchange(code: string, ctx?: BastionClientContext): Promise<BastionLoginResult>;
53
+ /**
54
+ * Trades the one-time OAuth code for tokens. `state` is the value the app put
55
+ * on the initiate URL, read back from its own cookie/session (never from the
56
+ * callback query): Bastion refuses a code minted under a different one, which
57
+ * is what stops an attacker's code from being redeemed in a victim's browser.
58
+ */
59
+ exchange(code: string, ctx?: BastionClientContext, state?: string): Promise<BastionLoginResult>;
55
60
  completeTwoFactor(twoFactorToken: string, code: string, ctx?: BastionClientContext): Promise<BastionTokenPair>;
56
61
  refresh(refreshToken: string, ctx?: BastionClientContext): Promise<BastionTokenPair>;
57
62
  /** Revokes the token and any successor issued through `refresh` within the memory window. Never throws. */
package/dist/esm/core/api-client.js CHANGED
@@ -58,9 +58,14 @@ export class BastionApiClient {
58
58
  register(input, ctx) {
59
59
  return this.call('POST', '/auth/register', { ...input, ...this.appContext }, { headers: BastionApiClient.clientHeaders(ctx) });
60
60
  }
61
- /** Trades the one-time OAuth code for tokens. */
62
- exchange(code, ctx) {
63
- return this.call('POST', '/auth/exchange', { code, appSlug: this.appSlug }, { headers: BastionApiClient.clientHeaders(ctx) });
61
+ /**
62
+ * Trades the one-time OAuth code for tokens. `state` is the value the app put
63
+ * on the initiate URL, read back from its own cookie/session (never from the
64
+ * callback query): Bastion refuses a code minted under a different one, which
65
+ * is what stops an attacker's code from being redeemed in a victim's browser.
66
+ */
67
+ exchange(code, ctx, state) {
68
+ return this.call('POST', '/auth/exchange', { code, appSlug: this.appSlug, ...(state !== undefined ? { state } : {}) }, { headers: BastionApiClient.clientHeaders(ctx) });
64
69
  }
65
70
  completeTwoFactor(twoFactorToken, code, ctx) {
66
71
  return this.call('POST', '/auth/2fa/authenticate', { twoFactorToken, code }, { headers: BastionApiClient.clientHeaders(ctx) });
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@heyatom/bastion-client",
3
- "version": "0.7.0",
3
+ "version": "0.7.1",
4
4
  "description": "Consumer SDK for the Bastion identity provider: JWKS verification, service-client auth, audit writes, NestJS guards",
5
5
  "license": "MIT",
6
6
  "author": "Andrea Tombolato <hey@heyatom.dev> (https://heyatom.dev)",