@icp-sdk/auth 10.0.1 → 11.0.0

package/dist/esm/client/sso.js

@@ -1,120 +1,106 @@
 // The identity provider's cap on the domain it will fetch.
 const MAX_AUTHORITY_LENGTH = 255;
-const WELL_KNOWN_PATH = '/.well-known/ii-openid-configuration';
+// The identity provider's own limits on a DNS name (idna's strict mode).
+const MAX_DNS_NAME_LENGTH = 253;
+const MAX_DNS_LABEL_LENGTH = 63;
+const MAX_QUOTED_LENGTH = 100;
+/** `value` for an error message: cut short, and quoted so control characters show escaped. */
+function quote(value) {
+    return JSON.stringify(value.length > MAX_QUOTED_LENGTH ? `${value.slice(0, MAX_QUOTED_LENGTH)}…` : value);
+}
 /**
- * `localhost` / `127.0.0.1`, optionally followed by `:<port>`. IPv6 loopback
- * (`[::1]`, etc.) is intentionally not handled — the identity provider doesn't
- * recognise it either, and its e2e setup uses the hostname form.
+ * `localhost`, `127.0.0.1`, or a name under `.localhost` (RFC 6761 reserves the
+ * whole domain for loopback), like the identity provider's own check. IPv6
+ * loopback is not one, there either.
  */
-function isLoopbackHost(host) {
-    let url;
-    try {
-        // Parse as a URL authority so the optional `:<port>` is split off for us
-        // rather than by hand. Invalid input throws and is treated as non-loopback.
-        url = new URL(`http://${host}`);
+function isLoopbackHost(hostname) {
+    return hostname === 'localhost' || hostname === '127.0.0.1' || hostname.endsWith('.localhost');
+}
+/** What keeps `hostname` from being a DNS name, by the identity provider's rules. */
+function dnsNameProblems(hostname) {
+    const labels = hostname.split('.');
+    const problems = [];
+    if (labels.length < 2)
+        problems.push('a single label');
+    if (labels.some((label) => label.length === 0))
+        problems.push('an empty label');
+    if (labels.some((label) => label.length > MAX_DNS_LABEL_LENGTH)) {
+        problems.push(`a label longer than ${MAX_DNS_LABEL_LENGTH} characters`);
     }
-    catch {
-        return false;
+    if (labels.some((label) => /[^a-z0-9-]/.test(label))) {
+        problems.push('a character other than a letter, digit, or hyphen');
+    }
+    if (labels.some((label) => label.startsWith('-') || label.endsWith('-'))) {
+        problems.push('a label starting or ending with a hyphen');
     }
-    // A bare `host[:port]` has no path/query/fragment; reject e.g. `localhost/x`.
-    if (url.pathname !== '/' || url.search !== '' || url.hash !== '') {
-        return false;
+    // `--` in the third and fourth places is reserved, except for punycode.
+    if (labels.some((label) => label.slice(2, 4) === '--' && !label.startsWith('xn--'))) {
+        problems.push('a label with "--" in its third and fourth places');
     }
-    return url.hostname === 'localhost' || url.hostname === '127.0.0.1';
+    if (hostname.length > MAX_DNS_NAME_LENGTH) {
+        problems.push(`a name longer than ${MAX_DNS_NAME_LENGTH} characters`);
+    }
+    return problems;
+}
+function listed(items) {
+    return items.length < 2 ? items.join('') : `${items.slice(0, -1).join(', ')} and ${items.at(-1)}`;
 }
 /**
  * Normalizes an SSO domain to the authority the identity provider fetches the
- * discovery document from: lowercased, IDNA-encoded, host and optional port.
+ * discovery document from: lowercased and IDNA-encoded. A loopback host may
+ * carry a port, for a local mock provider; any other host may not.
  *
  * @param domain - The organization domain.
  * @returns The normalized authority.
- * @throws When `domain` is not a domain with an optional port.
+ * @throws When `domain` is not a domain, naming every problem with it.
  */
 export function normalizeSsoDomain(domain) {
     const trimmed = domain.trim();
     if (trimmed.length === 0) {
         throw new Error('ssoDomain cannot be empty');
     }
+    const scheme = /^[a-z][a-z0-9+.-]*:\/\//i.exec(trimmed)?.[0];
+    const rest = scheme === undefined ? trimmed : trimmed.slice(scheme.length);
     let url;
     try {
-        url = new URL(`https://${trimmed}`);
+        url = new URL(`https://${rest}`);
     }
     catch {
-        throw new Error(`ssoDomain is not a domain: ${trimmed}`);
-    }
-    const authority = url.host;
-    // Rebuilding from the host and port alone has to reproduce what was parsed,
-    // so anything else the domain carried shows up as a difference.
-    if (new URL(`https://${authority}`).href !== url.href) {
-        throw new Error(`ssoDomain must be a domain and optional port, nothing else: ${trimmed}`);
+        throw new Error(`ssoDomain ${quote(trimmed)} is not a domain`);
     }
-    if (authority.length > MAX_AUTHORITY_LENGTH) {
-        throw new Error(`ssoDomain exceeds ${MAX_AUTHORITY_LENGTH} characters`);
+    const { username, password, pathname, hostname, port, host, href } = url;
+    // `URL` drops an empty or default port such as `:443`, so the typed one is read
+    // from the input itself.
+    const typedAuthority = rest.split(/[/?#]/)[0] ?? '';
+    const typedPort = /:([0-9]*)$/.exec(typedAuthority.slice(typedAuthority.lastIndexOf('@') + 1))?.[1];
+    const [beforeFragment = ''] = href.split('#');
+    const problems = [];
+    if (scheme !== undefined)
+        problems.push('a scheme');
+    if (username !== '' || password !== '')
+        problems.push('userinfo');
+    if (pathname !== '/')
+        problems.push('a path');
+    if (beforeFragment.includes('?'))
+        problems.push('a query');
+    if (href.includes('#'))
+        problems.push('a fragment');
+    const loopback = isLoopbackHost(hostname);
+    if (typedPort !== undefined && !loopback) {
+        problems.push('a port, which only loopback hosts may carry');
     }
-    // A bare hostname is a half-typed domain, not something worth a request.
-    if (!authority.includes('.') && !isLoopbackHost(authority)) {
-        throw new Error(`ssoDomain is not a domain name: ${trimmed}`);
+    else if (typedPort !== undefined && (typedPort === '' || typedPort !== port)) {
+        problems.push('an empty or default port');
     }
-    return authority;
-}
-function publishesSsoConfiguration(value) {
-    if (typeof value !== 'object' || value === null) {
-        return false;
+    if (trimmed.length > MAX_AUTHORITY_LENGTH) {
+        problems.push(`more than ${MAX_AUTHORITY_LENGTH} characters`);
     }
-    const { client_id, openid_configuration } = value;
-    return typeof client_id === 'string' && typeof openid_configuration === 'string';
-}
-/**
- * Checks whether an organization domain can be used for SSO sign-in: it is a
- * domain name, and it publishes `/.well-known/ii-openid-configuration` with a
- * `client_id` and an `openid_configuration` URL.
- *
- * The document must be served with `Access-Control-Allow-Origin: *`.
- *
- * The check waits on a third-party server and has no deadline of its own, so
- * `signal` sets one. Pass `AbortSignal.timeout(...)` for a one-shot check, or a
- * controller you abort per keystroke when checking as the user types.
- *
- * @param domain - The organization domain.
- * @param signal - Bounds the check.
- * @returns Whether the domain is usable for SSO sign-in.
- * @throws When `signal` aborts — an abandoned check is not a verdict on the
- *   domain, so it must not be read as `false`.
- *
- * @example
- * if (await isValidSsoDomain(input.value, AbortSignal.timeout(5_000))) {
- *   const authClient = new AuthClient({ ssoDomain: input.value });
- *   await authClient.signIn();
- * }
- */
-export async function isValidSsoDomain(domain, signal) {
-    signal.throwIfAborted();
-    let normalized;
-    try {
-        normalized = normalizeSsoDomain(domain);
-    }
-    catch {
-        return false;
-    }
-    const scheme = isLoopbackHost(normalized) ? 'http' : 'https';
-    try {
-        const response = await fetch(`${scheme}://${normalized}${WELL_KNOWN_PATH}`, {
-            headers: { Accept: 'application/json' },
-            signal,
-        });
-        if (!response.ok) {
-            return false;
-        }
-        const valid = publishesSsoConfiguration(await response.json());
-        signal.throwIfAborted();
-        return valid;
+    else if (!loopback) {
+        problems.push(...dnsNameProblems(hostname));
     }
-    catch (error) {
-        if (signal.aborted) {
-            throw error;
-        }
-        // A DNS, TLS, CORS, or parse failure all leave the domain unusable.
-        return false;
+    if (problems.length > 0) {
+        throw new Error(`ssoDomain ${quote(trimmed)} has ${listed(problems)}`);
     }
+    return host;
 }
 //# sourceMappingURL=sso.js.map

package/dist/esm/client/sso.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso.js","sourceRoot":"","sources":["../../../src/client/sso.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC,MAAM,eAAe,GAAG,sCAAsC,CAAC;AAE/D;;;;GAIG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,yEAAyE;QACzE,4EAA4E;QAC5E,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,8EAA8E;IAC9E,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC;AACtE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC;IAC3B,4EAA4E;IAC5E,gEAAgE;IAChE,IAAI,IAAI,GAAG,CAAC,WAAW,SAAS,EAAE,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,+DAA+D,OAAO,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,qBAAqB,oBAAoB,aAAa,CAAC,CAAC;IAC1E,CAAC;IACD,yEAAyE;IACzE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,GAAG,KAAgC,CAAC;IAC7E,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,OAAO,oBAAoB,KAAK,QAAQ,CAAC;AACnF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,MAAmB;IACxE,MAAM,CAAC,cAAc,EAAE,CAAC;IAExB,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,MAAM,UAAU,GAAG,eAAe,EAAE,EAAE;YAC1E,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,KAAK,GAAG,yBAAyB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,KAAK,CAAC;QACd,CAAC;QACD,oEAAoE;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"sso.js","sourceRoot":"","sources":["../../../src/client/sso.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC,yEAAyE;AACzE,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B,8FAA8F;AAC9F,SAAS,KAAK,CAAC,KAAa;IAC1B,OAAO,IAAI,CAAC,SAAS,CACnB,KAAK,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CACnF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AACjG,CAAC;AAED,qFAAqF;AACrF,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAChF,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,oBAAoB,CAAC,EAAE,CAAC;QAChE,QAAQ,CAAC,IAAI,CAAC,uBAAuB,oBAAoB,aAAa,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACzE,QAAQ,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IAC5D,CAAC;IACD,wEAAwE;IACxE,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACpF,QAAQ,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QAC1C,QAAQ,CAAC,IAAI,CAAC,sBAAsB,mBAAmB,aAAa,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,MAAM,CAAC,KAAe;IAC7B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACpG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3E,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;IACzE,gFAAgF;IAChF,yBAAyB;IACzB,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CACjC,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAC1D,EAAE,CAAC,CAAC,CAAC,CAAC;IACP,MAAM,CAAC,cAAc,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE9C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,MAAM,KAAK,SAAS;QAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpD,IAAI,QAAQ,KAAK,EAAE,IAAI,QAAQ,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAClE,IAAI,QAAQ,KAAK,GAAG;QAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC/D,CAAC;SAAM,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,KAAK,EAAE,IAAI,SAAS,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/E,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QAC1C,QAAQ,CAAC,IAAI,CAAC,aAAa,oBAAoB,aAAa,CAAC,CAAC;IAChE,CAAC;SAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,OAAO,CAAC,QAAQ,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@icp-sdk/auth",
-  "version": "10.0.1",
+  "version": "11.0.0",
   "author": "DFINITY Stiftung <sdk@dfinity.org>",
   "license": "Apache-2.0",
   "description": "Authentication library for Internet Computer web apps",
@@ -54,7 +54,7 @@
     "@icp-sdk/core": "^6"
   },
   "dependencies": {
-    "@icp-sdk/signer": "^6.0.0",
+    "@icp-sdk/signer": "^6.1.0",
     "idb": "^7.1.1"
   },
   "scripts": {

package/src/client/auth-client.ts

@@ -24,6 +24,7 @@ import { SessionIdentity } from './session-identity.js';
 import { SessionMinter } from './session-minter.js';
 import { type Slots, slotsFor } from './slots.js';
 import { normalizeSsoDomain } from './sso.js';
+import { createSsoDomainService, type SsoStatus, SsoStatusChecker } from './sso-status.js';
 import { LocalStateStorage, type SessionState, type StateStorage } from './state-storage.js';
 
 /**
@@ -235,8 +236,17 @@ export type AuthClientCreateOptions = AuthClientBaseOptions &
          * When set, the identity provider URL includes an `sso` search param so
          * the user authenticates via that organization's own provider.
          *
-         * A value that is not a domain with an optional port throws. Use
-         * {@link isValidSsoDomain} to check a domain the user typed.
+         * The value is trimmed, lowercased and IDNA-encoded, and has to be a
+         * domain and nothing else: no scheme, port, path, query, fragment or
+         * userinfo. A loopback host (`localhost`, `127.0.0.1`, or a name under
+         * `.localhost`) is accepted too, with a port, for a local mock provider.
+         *
+         * The client checks the domain with Internet Identity as soon as it is
+         * built, and {@link AuthClient.getSsoStatus} reports the answer. A value
+         * that is not a domain is reported as `invalid`, with the reason, rather
+         * than thrown, so a
+         * client can be built from whatever the user typed; a sign-in with it
+         * opens Internet Identity, which explains the error on its own screen.
          */
         ssoDomain?: string;
       }
@@ -384,6 +394,8 @@ export class AuthClient {
   // interaction rather than two.
   #interactions = 0;
   #channelLock: HeldLock | undefined;
+  // Set only for a client built with `ssoDomain`.
+  readonly #sso: SsoStatusChecker | undefined;
 
   constructor(options: AuthClientCreateOptions = {}) {
     this.#options = options;
@@ -467,7 +479,18 @@ export class AuthClient {
       identityProviderUrl.searchParams.set('openid', OPENID_PROVIDER_URLS[options.openIdProvider]);
     }
     if (options.ssoDomain !== undefined) {
-      identityProviderUrl.searchParams.set('sso', normalizeSsoDomain(options.ssoDomain));
+      let domain: string | { invalid: string };
+      try {
+        domain = normalizeSsoDomain(options.ssoDomain);
+      } catch (error) {
+        domain = { invalid: error instanceof Error ? error.message : String(error) };
+      }
+      // A value that is not a domain goes to Internet Identity as typed, which
+      // explains it on its own screen.
+      identityProviderUrl.searchParams.set(
+        'sso',
+        typeof domain === 'string' ? domain : options.ssoDomain.trim(),
+      );
       // The SSO ceremony starts before a delegation is requested, so the
       // channel carries the derivation origin too late to resolve the client.
       if (options.derivationOrigin !== undefined) {
@@ -476,6 +499,14 @@ export class AuthClient {
           options.derivationOrigin.toString(),
         );
       }
+      const canisterId = this.#canisterId;
+      this.#sso = new SsoStatusChecker(
+        domain,
+        () => createSsoDomainService({ canisterId, agentOptions: options.agentOptions }),
+        () => {
+          for (const listener of [...this.#listeners]) listener();
+        },
+      );
     }
     // `prompt` and `hint` are Internet Identity extensions, so they ride on the
     // authorize URL rather than in the ICRC request. Baking them in here, as
@@ -621,6 +652,45 @@ export class AuthClient {
     return this.#status;
   }
 
+  /**
+   * Whether the organization domain this client was built with can be signed
+   * in with, or `undefined` for a client built without `ssoDomain`.
+   *
+   * Synchronous, and the same object until the answer changes, like
+   * {@link getStatus}; {@link subscribe} says when to read it again. A client
+   * built with `ssoDomain` starts checking as soon as it is built: it asks
+   * Internet Identity to resolve the domain, then reads the result
+   * until it is final, so `checking` lasts until Internet Identity answers.
+   * Building the client also warms Internet Identity's cache for the domain, so
+   * a sign-in that follows starts without waiting on the fetch.
+   *
+   * {@link signIn} proceeds in every state: Internet Identity resolves the
+   * domain itself during the sign-in, and explains a failure, a value that is
+   * not a domain included, on its own screen.
+   *
+   * @example
+   * const client = new AuthClient({ ssoDomain: input.value });
+   * client.subscribe(() => render(client.getSsoStatus()));
+   * render(client.getSsoStatus());
+   */
+  getSsoStatus(): SsoStatus | undefined {
+    return this.#sso?.status;
+  }
+
+  /**
+   * Checks the organization domain again, for a "Try again" button.
+   *
+   * The status goes back to `checking` and then to the new answer. Calling it
+   * while an `unavailable` answer's `retryAfter` is still in the future is
+   * harmless: Internet Identity does not fetch again before then, so the answer
+   * comes back the same at once. Nothing re-checks on its own once `retryAfter`
+   * passes. Does nothing for an `invalid` domain, which no retry can fix, or for
+   * a client built without `ssoDomain`.
+   */
+  refreshSsoStatus(): void {
+    this.#sso?.refresh();
+  }
+
   /** Reads the record and builds the answer `getStatus` hands out. */
   #readStatus(): SessionStatus {
     const record = this.#stateStorage.get(this.#slots.state);
@@ -637,22 +707,24 @@ export class AuthClient {
   }
 
   /**
-   * Watches who is signed in here, and returns a function that stops watching.
+   * Watches who is signed in here, and the SSO status of a client built with
+   * `ssoDomain`, and returns a function that stops watching.
    *
-   * `getStatus()` and the predicates beside it are snapshots, so an application
-   * rendering on them needs to be told when to read again. The record changes
-   * for reasons that are nothing to do with this client — another tab signing
-   * out, a sibling subdomain publishing a sign-in, a peer client on this page
-   * re-issuing silently — and this is how those arrive.
+   * `getStatus()`, `getSsoStatus()` and the predicates beside them are
+   * snapshots, so an application rendering on them needs to be told when to read
+   * again. The record changes for reasons that are nothing to do with this
+   * client: another tab signing out, a sibling subdomain publishing a sign-in,
+   * a peer client on this page re-issuing silently. The SSO status changes when
+   * Internet Identity answers. This is how both arrive.
    *
-   * Fired once the record is readable, so a listener asking who is signed in
-   * sees what it was told about. It says that something changed and not what: a
-   * listener reads the answer it wants, which for most is `getStatus()`.
+   * Fired once the new answer is readable, so a listener sees what it was told
+   * about. It says that something changed and not what: a listener reads the
+   * answer it wants, `getStatus()` or `getSsoStatus()`.
    *
    * What it does not cover is the identity being replaced under an application
    * that holds one — an app delegation rotating is deliberately invisible, and
    * nothing about who is signed in has changed when it does.
-   * @param listener - Called after the record changes.
+   * @param listener - Called after the record or the SSO status changes.
    * @returns A function that unregisters it.
    */
   subscribe(listener: () => void): () => void {
@@ -667,10 +739,12 @@ export class AuthClient {
 
   /**
    * Releases what this client hooked: the browser listeners, the state
-   * subscription, and the refresh the identity has scheduled. Call it when
-   * discarding a client, so nothing it registered outlives it.
+   * subscription, the refresh the identity has scheduled, and an SSO domain
+   * check still in progress. Call it when discarding a client, so nothing it
+   * registered outlives it.
    */
   dispose(): void {
+    this.#sso?.dispose();
     // Recorded, because the constructor starts the restore without awaiting it:
     // a client disposed while one is in flight would otherwise have an identity
     // installed afterwards, scheduling refreshes nobody can stop.
@@ -741,19 +815,14 @@ export class AuthClient {
   }
 
   /**
-   * Opens the signer channel and takes the lock that makes this the only
-   * interaction on it.
+   * Takes the lock that makes this the only interaction on the signer channel.
    *
-   * One method because the order is the whole point. A popup may only be opened
-   * from the task the click started, so nothing may be asked of the browser
-   * before `openChannel` — two lock requests in front of it were enough for
-   * Chromium to refuse the window — and the lock has to be taken as soon as it
-   * is open. Two callers doing that by hand is one place too many for the order
-   * to come out backwards.
+   * Called right after a request is handed to the signer, which opens the
+   * channel within that call: a popup may only be opened from the task the
+   * click started, and lock requests in front of it were enough for Chromium to
+   * refuse the window, so the lock is asked for once the window exists.
    */
-  async #openSignerChannel(): Promise<void> {
-    await this.#signer.openChannel();
-
+  #takeChannelLock(): void {
     if (this.#channelLock === undefined) {
       const lock = stealLock(CHANNEL_LOCK);
       // Whoever took the channel has already renavigated the window this one was
@@ -832,14 +901,11 @@ export class AuthClient {
     const returnTo =
       raw === undefined ? undefined : this.memoize(() => sameOriginTarget(raw)?.href ?? null);
 
-    // Start session-key acquisition BEFORE opening the channel, awaiting it only
-    // after. In the redirect flow the acquisition's first `transport.memoize`
-    // runs synchronously when invoked, so its in-flight bump lands in the same
-    // tick `signIn` is called — holding the transport's batch flush from the
-    // very start of the flow rather than only after the `openChannel` await.
-    // Under `Promise.all([signIn, requestAttributes])` this is what keeps a
-    // faster concurrent request from flushing before this flow's delegation
-    // request is buffered.
+    // Session-key acquisition starts on the call, and the delegation request
+    // that needs it is handed to the signer on the call too, as a promise of the
+    // request. The signer places it in call order there, so in the redirect
+    // flow it replays into the slot it was sent from whatever the key costs on
+    // either load, and a `requestAttributes` issued alongside keeps its own.
     const sessionKeyPromise: Promise<{
       key: SignIdentity | PartialIdentity;
       pending?: boolean;
@@ -853,9 +919,25 @@ export class AuthClient {
     // rejection and propagates it when reached.
     void sessionKeyPromise.catch(() => undefined);
 
-    // Must stay the first await: it opens the signer window, which the browser
-    // allows only in the tick the click started.
-    await this.#openSignerChannel();
+    // Opens the signer window within the call, which the browser allows only in
+    // the tick the click started, so nothing before it may ask the browser for
+    // anything.
+    const sessionChainPromise = requestSessionDelegation(
+      this.#signer,
+      sessionKeyPromise.then(({ key }) => ({
+        sessionPublicKey: key.getPublicKey().toDer(),
+        // Both bounds are sent only where the caller asked, so the provider's
+        // own defaults apply otherwise rather than numbers this library
+        // invented. How long a sign-in lasts is the provider's policy, narrowed
+        // by what the user chooses at consent and by an organization's cap.
+        maxTimeToLive: options?.maxTimeToLive,
+        maxTimeToIdle: options?.maxTimeToIdle,
+        derivationOrigin: this.#options.derivationOrigin?.toString(),
+      })),
+    );
+    void sessionChainPromise.catch(() => undefined);
+
+    this.#takeChannelLock();
 
     // The other lock a ceremony needs, taken once the window is open for the
     // same reason. Stolen rather than queued for, so the newer intent wins and
@@ -893,16 +975,7 @@ export class AuthClient {
         throw new Error('A session needs a key that can sign');
       }
 
-      const sessionChain = await requestSessionDelegation(this.#signer, {
-        sessionPublicKey: key.getPublicKey().toDer(),
-        // Both bounds are sent only where the caller asked, so the provider's
-        // own defaults apply otherwise rather than numbers this library
-        // invented. How long a sign-in lasts is the provider's policy, narrowed
-        // by what the user chooses at consent and by an organization's cap.
-        maxTimeToLive: options?.maxTimeToLive,
-        maxTimeToIdle: options?.maxTimeToIdle,
-        derivationOrigin: this.#options.derivationOrigin?.toString(),
-      });
+      const sessionChain = await sessionChainPromise;
 
       // The chain comes from the signer over a transport shared with others, so
       // the key it delegates to is checked here rather than assumed. A chain for
@@ -1002,21 +1075,10 @@ export class AuthClient {
       );
     }
 
-    // Acquire the key inside a `memoize` producer so the transport holds its
-    // batch flush across the (async) key read/create + storage write. The
-    // transport coalesces concurrently issued requests into one redirect by
-    // flushing on a macrotask once no memoize producer is in flight; without
-    // this hold, a faster concurrent request (e.g. the nonce path of
-    // `requestAttributes`) buffers first and trips that flush before this flow's
-    // delegation request — issued only once the key is ready — is buffered,
-    // splitting what should be one redirect into two.
-    //
-    // The key is captured in a closure, not read back after the producer: on the
-    // FIRST load the producer sets `acquired`, so the delegation request that
-    // follows is issued with no intervening storage read — a read there would
-    // re-open the very flush gap this closes. The producer is skipped on the
-    // replay load (its result is journaled), where the key is instead read from
-    // the pending slot.
+    // Acquired inside a `memoize` producer, so the first load journals which key
+    // this ceremony started with. The key is captured in a closure on the first
+    // load, where the producer runs; on the replay load the producer is skipped
+    // (its result is journaled) and the key is read from the pending slot.
     //
     // What is journaled is the key's *public* half: not a secret, it survives the
     // redirect as text, and on the return load it says whether the pending slot
@@ -1057,9 +1119,10 @@ export class AuthClient {
    *
    * In 'window' mode the callback lets the identity provider window open while the
    * nonce is still resolving, avoiding a perceived delay before the user sees
-   * the prompt; auto-close of the signer transport channel is temporarily
-   * disabled while awaiting so the window cannot be closed out from under the
-   * pending flow.
+   * the prompt; the signer keeps the channel open while the request waits for
+   * its nonce. In both modes the request takes its place with the signer when
+   * this method is called, so it can be issued alongside `signIn` in either
+   * order.
    *
    * @param params - Request parameters.
    * @param params.keys - Attribute keys to request (e.g. `['email', 'name']`).
@@ -1089,16 +1152,24 @@ export class AuthClient {
   }): Promise<SignedAttributes> {
     // In redirect mode the nonce is journaled (base64, since the journal is
     // JSON) so the replay on the return load signs against the same bytes.
-    const nonceBytes = this.#urlTransport
-      ? fromBase64(await this.#urlTransport.memoize(async () => toBase64(await params.nonce())))
-      : await this.#resolveNonce(params.nonce);
-
-    const response = await this.#signer.sendRequest({
-      jsonrpc: '2.0',
-      id: globalThis.crypto.randomUUID(),
-      method: 'ii-icrc3-attributes',
-      params: { keys: params.keys, nonce: toBase64(nonceBytes) },
-    });
+    const nonce: Promise<string> = this.#urlTransport
+      ? this.#urlTransport.memoize(async () => toBase64(await params.nonce()))
+      : params.nonce().then(toBase64);
+
+    // Handed to the signer on the call, as a promise of the request: the signer
+    // window opens within the call while the nonce is still on its way, and the
+    // request keeps its place in call order however long the nonce takes on
+    // either load of a redirect flow.
+    const responsePromise = this.#signer.sendRequest(
+      nonce.then((value) => ({
+        jsonrpc: '2.0' as const,
+        id: globalThis.crypto.randomUUID(),
+        method: 'ii-icrc3-attributes',
+        params: { keys: params.keys, nonce: value },
+      })),
+    );
+    this.#takeChannelLock();
+    const response = await responsePromise;
 
     if ('error' in response) {
       throw new Error(response.error.message);
@@ -1235,24 +1306,6 @@ export class AuthClient {
     }
   }
 
-  // Popup-mode nonce resolution. Start the fetch, then open the transport
-  // channel so the identity provider window is visible while we wait, and
-  // suspend auto-close so it can't fire mid-await (e.g. due to a close
-  // scheduled by a prior request on the same signer). The original auto-close
-  // setting is restored before sendRequest, so the next response resumes
-  // normal close behaviour.
-  async #resolveNonce(nonce: () => Promise<Uint8Array>): Promise<Uint8Array> {
-    const value = nonce();
-    await this.#openSignerChannel();
-    const previousAutoClose = this.#signer.autoCloseTransportChannel;
-    this.#signer.autoCloseTransportChannel = false;
-    try {
-      return await value;
-    } finally {
-      this.#signer.autoCloseTransportChannel = previousAutoClose;
-    }
-  }
-
   /**
    * Mints ahead of the next request when the page comes back, if one is due.
    *

package/src/client/index.ts

@@ -21,7 +21,7 @@ export {
   DEFAULT_SHARED_MEMORY_NAME,
   SharedMemoryCredentialStorage,
 } from './shared-memory-credential-storage.js';
-export { isValidSsoDomain } from './sso.js';
+export type { SsoStatus } from './sso-status.js';
 export {
   LocalStateStorage,
   MemoryStateStorage,