@icp-sdk/auth 10.0.2 → 11.1.0

package/dist/esm/client/sso-status.js

@@ -0,0 +1,207 @@
+import { Actor, AnonymousIdentity, HttpAgent } from '@icp-sdk/core/agent';
+/**
+ * Written out for the same reason as the session methods in `session-minter.ts`:
+ * this package carries no Internet Identity declarations.
+ */
+const idlFactory = ({ IDL }) => {
+    const Timestamp = IDL.Nat64;
+    const Status = IDL.Variant({
+        Available: IDL.Record({ name: IDL.Opt(IDL.Text) }),
+        Pending: IDL.Null,
+        Unavailable: IDL.Record({ retry_after: IDL.Opt(Timestamp), reason: IDL.Opt(IDL.Text) }),
+    });
+    return IDL.Service({
+        app_sso_domain_check: IDL.Func([IDL.Text], [], []),
+        app_sso_domain_status: IDL.Func([IDL.Text], [Status], ['query']),
+    });
+};
+/**
+ * Builds the service an SSO domain check calls, as the anonymous caller: the
+ * check runs before anyone has signed in.
+ */
+export async function createSsoDomainService(options) {
+    const agent = await HttpAgent.create({
+        ...options.agentOptions,
+        // Last, so no agent option can make the check call as someone.
+        identity: new AnonymousIdentity(),
+    });
+    return Actor.createActor(idlFactory, {
+        agent,
+        canisterId: options.canisterId,
+    });
+}
+/** The first and the longest wait between two status reads. */
+export const SSO_POLL_MIN_MS = 500;
+export const SSO_POLL_MAX_MS = 2_000;
+/**
+ * How long a check may read `Pending` before it is started again. Matches the
+ * age at which Internet Identity treats a fetch as abandoned.
+ */
+export const SSO_RECHECK_AFTER_MS = 120_000;
+const CHECKING = Object.freeze({ state: 'checking' });
+const NANOS_PER_MILLI = 1000000n;
+function fromCandid(status) {
+    if ('Available' in status) {
+        const name = status.Available.name[0];
+        return name === undefined ? { state: 'available' } : { state: 'available', name };
+    }
+    if ('Unavailable' in status) {
+        const retryAfterNs = status.Unavailable.retry_after[0];
+        const reason = status.Unavailable.reason[0];
+        return {
+            state: 'unavailable',
+            ...(retryAfterNs !== undefined && {
+                retryAfter: new Date(Number(retryAfterNs / NANOS_PER_MILLI)),
+            }),
+            ...(reason !== undefined && { reason }),
+        };
+    }
+    // Pending: the fetch is still running, which is what `checking` already says.
+    return undefined;
+}
+function sameStatus(a, b) {
+    switch (a.state) {
+        case 'checking':
+            return b.state === 'checking';
+        case 'available':
+            return b.state === 'available' && a.name === b.name;
+        case 'invalid':
+            return b.state === 'invalid' && a.reason === b.reason;
+        case 'unavailable':
+            return (b.state === 'unavailable' &&
+                a.retryAfter?.getTime() === b.retryAfter?.getTime() &&
+                a.reason === b.reason);
+    }
+}
+/**
+ * Asks Internet Identity whether one SSO domain can be signed in with, and holds
+ * the answer.
+ *
+ * One update starts the fetch, then the status is read with a query until it is
+ * final: a query needs no consensus, so polling it is cheap where polling an
+ * update is not. A read that fails is retried at the next interval, so a check
+ * ends only on an answer from Internet Identity, or on {@link dispose}.
+ */
+export class SsoStatusChecker {
+    #domain;
+    #createService;
+    #onChange;
+    #service;
+    #status;
+    #timer;
+    // Bumped by every start and by dispose, so a run that was replaced drops its
+    // late answers instead of overwriting a newer one.
+    #run = 0;
+    #disposed = false;
+    /**
+     * @param domain - The normalized domain, or, for a value that is not one, why
+     *   not: `invalid` from the start and never checked.
+     * @param createService - Builds the service on the first call.
+     * @param onChange - Called after the status changes.
+     */
+    constructor(domain, createService, onChange) {
+        this.#domain = typeof domain === 'string' ? domain : undefined;
+        this.#createService = createService;
+        this.#onChange = onChange;
+        this.#status =
+            typeof domain === 'string'
+                ? CHECKING
+                : Object.freeze({ state: 'invalid', reason: domain.invalid });
+        if (typeof domain === 'string')
+            this.#start(0);
+    }
+    /** The current answer. The same object until it changes. */
+    get status() {
+        return this.#status;
+    }
+    /** Checks again. Does nothing for an `invalid` domain, or once disposed. */
+    refresh() {
+        if (this.#domain === undefined || this.#disposed)
+            return;
+        this.#set(CHECKING);
+        this.#start(0);
+    }
+    /** Stops checking. A call already sent is not recalled; its answer is dropped. */
+    dispose() {
+        this.#disposed = true;
+        this.#run += 1;
+        clearTimeout(this.#timer);
+        this.#timer = undefined;
+    }
+    #start(delayMs) {
+        this.#run += 1;
+        const run = this.#run;
+        clearTimeout(this.#timer);
+        this.#timer = setTimeout(() => {
+            void this.#check(run);
+        }, delayMs);
+    }
+    #isCurrent(run) {
+        return run === this.#run && !this.#disposed;
+    }
+    async #check(run) {
+        const domain = this.#domain;
+        if (domain === undefined || !this.#isCurrent(run))
+            return;
+        const checkedAt = Date.now();
+        try {
+            const service = await this.#serviceFor();
+            if (!this.#isCurrent(run))
+                return;
+            await service.app_sso_domain_check(domain);
+        }
+        catch {
+            // The reads below still see whatever Internet Identity has, and a check
+            // that never started is started again after `SSO_RECHECK_AFTER_MS`.
+        }
+        await this.#poll(run, domain, checkedAt, SSO_POLL_MIN_MS);
+    }
+    async #poll(run, domain, checkedAt, nextDelayMs) {
+        if (!this.#isCurrent(run))
+            return;
+        let answer;
+        try {
+            const service = await this.#serviceFor();
+            if (!this.#isCurrent(run))
+                return;
+            answer = fromCandid(await service.app_sso_domain_status(domain));
+        }
+        catch {
+            answer = undefined;
+        }
+        if (!this.#isCurrent(run))
+            return;
+        if (answer !== undefined) {
+            this.#set(answer);
+            return;
+        }
+        if (Date.now() - checkedAt >= SSO_RECHECK_AFTER_MS) {
+            this.#timer = setTimeout(() => {
+                void this.#check(run);
+            }, nextDelayMs);
+            return;
+        }
+        this.#timer = setTimeout(() => {
+            void this.#poll(run, domain, checkedAt, Math.min(nextDelayMs * 2, SSO_POLL_MAX_MS));
+        }, nextDelayMs);
+    }
+    #serviceFor() {
+        if (this.#service === undefined) {
+            const created = this.#createService();
+            this.#service = created;
+            // A service that could not be built is built again on the next call.
+            created.catch(() => {
+                if (this.#service === created)
+                    this.#service = undefined;
+            });
+        }
+        return this.#service;
+    }
+    #set(next) {
+        if (sameStatus(this.#status, next))
+            return;
+        this.#status = next;
+        this.#onChange();
+    }
+}
+//# sourceMappingURL=sso-status.js.map

package/dist/esm/client/sso-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-status.js","sourceRoot":"","sources":["../../../src/client/sso-status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAyB,MAAM,qBAAqB,CAAC;AAoCjG;;;GAGG;AACH,MAAM,UAAU,GAAyB,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;IACnD,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC;IAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC;QACzB,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;KACxF,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,OAAO,CAAC;QACjB,oBAAoB,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC;QAClD,qBAAqB,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;KACjE,CAAC,CAAC;AACL,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAG5C;IACC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC;QACnC,GAAG,OAAO,CAAC,YAAY;QACvB,+DAA+D;QAC/D,QAAQ,EAAE,IAAI,iBAAiB,EAAE;KAClC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,WAAW,CAAmB,UAAU,EAAE;QACrD,KAAK;QACL,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAC;AACnC,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC;AAErC;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAE5C,MAAM,QAAQ,GAAc,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;AAEjE,MAAM,eAAe,GAAG,QAAU,CAAC;AAEnC,SAAS,UAAU,CAAC,MAA6B;IAC/C,IAAI,WAAW,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,aAAa,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5C,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI;gBAChC,UAAU,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,GAAG,eAAe,CAAC,CAAC;aAC7D,CAAC;YACF,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;SACxC,CAAC;IACJ,CAAC;IACD,8EAA8E;IAC9E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,CAAY,EAAE,CAAY;IAC5C,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,KAAK,UAAU;YACb,OAAO,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC;QAChC,KAAK,WAAW;YACd,OAAO,CAAC,CAAC,KAAK,KAAK,WAAW,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC;QACtD,KAAK,SAAS;YACZ,OAAO,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC;QACxD,KAAK,aAAa;YAChB,OAAO,CACL,CAAC,CAAC,KAAK,KAAK,aAAa;gBACzB,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE;gBACnD,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CACtB,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,gBAAgB;IAClB,OAAO,CAAqB;IAC5B,cAAc,CAAkC;IAChD,SAAS,CAAa;IAC/B,QAAQ,CAAwC;IAChD,OAAO,CAAY;IACnB,MAAM,CAA4C;IAClD,6EAA6E;IAC7E,mDAAmD;IACnD,IAAI,GAAG,CAAC,CAAC;IACT,SAAS,GAAG,KAAK,CAAC;IAElB;;;;;OAKG;IACH,YACE,MAAoC,EACpC,aAA8C,EAC9C,QAAoB;QAEpB,IAAI,CAAC,OAAO,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/D,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,OAAO;YACV,OAAO,MAAM,KAAK,QAAQ;gBACxB,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAClE,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,4DAA4D;IAC5D,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,4EAA4E;IAC5E,OAAO;QACL,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QACzD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,kFAAkF;IAClF,OAAO;QACL,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;QACf,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;IAC1B,CAAC;IAED,MAAM,CAAC,OAAe;QACpB,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC,EAAE,OAAO,CAAC,CAAC;IACd,CAAC;IAED,UAAU,CAAC,GAAW;QACpB,OAAO,GAAG,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO;YAClC,MAAM,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,oEAAoE;QACtE,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,MAAc,EAAE,SAAiB,EAAE,WAAmB;QAC7E,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAClC,IAAI,MAA6B,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO;YAClC,MAAM,GAAG,UAAU,CAAC,MAAM,OAAO,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClB,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI,oBAAoB,EAAE,CAAC;YACnD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC,EAAE,WAAW,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC;QACtF,CAAC,EAAE,WAAW,CAAC,CAAC;IAClB,CAAC;IAED,WAAW;QACT,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YACtC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;YACxB,qEAAqE;YACrE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;gBACjB,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;oBAAE,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;YAC3D,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,IAAI,CAAC,IAAe;QAClB,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC;YAAE,OAAO;QAC3C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,SAAS,EAAE,CAAC;IACnB,CAAC;CACF"}

package/dist/esm/client/sso.d.ts

@@ -1,33 +1,10 @@
 /**
  * Normalizes an SSO domain to the authority the identity provider fetches the
- * discovery document from: lowercased, IDNA-encoded, host and optional port.
+ * discovery document from: lowercased and IDNA-encoded. A loopback host may
+ * carry a port, for a local mock provider; any other host may not.
  *
  * @param domain - The organization domain.
  * @returns The normalized authority.
- * @throws When `domain` is not a domain with an optional port.
+ * @throws When `domain` is not a domain, naming every problem with it.
  */
 export declare function normalizeSsoDomain(domain: string): string;
-/**
- * Checks whether an organization domain can be used for SSO sign-in: it is a
- * domain name, and it publishes `/.well-known/ii-openid-configuration` with a
- * `client_id` and an `openid_configuration` URL.
- *
- * The document must be served with `Access-Control-Allow-Origin: *`.
- *
- * The check waits on a third-party server and has no deadline of its own, so
- * `signal` sets one. Pass `AbortSignal.timeout(...)` for a one-shot check, or a
- * controller you abort per keystroke when checking as the user types.
- *
- * @param domain - The organization domain.
- * @param signal - Bounds the check.
- * @returns Whether the domain is usable for SSO sign-in.
- * @throws When `signal` aborts — an abandoned check is not a verdict on the
- *   domain, so it must not be read as `false`.
- *
- * @example
- * if (await isValidSsoDomain(input.value, AbortSignal.timeout(5_000))) {
- *   const authClient = new AuthClient({ ssoDomain: input.value });
- *   await authClient.signIn();
- * }
- */
-export declare function isValidSsoDomain(domain: string, signal: AbortSignal): Promise<boolean>;

package/dist/esm/client/sso.js

@@ -1,120 +1,106 @@
 // The identity provider's cap on the domain it will fetch.
 const MAX_AUTHORITY_LENGTH = 255;
-const WELL_KNOWN_PATH = '/.well-known/ii-openid-configuration';
+// The identity provider's own limits on a DNS name (idna's strict mode).
+const MAX_DNS_NAME_LENGTH = 253;
+const MAX_DNS_LABEL_LENGTH = 63;
+const MAX_QUOTED_LENGTH = 100;
+/** `value` for an error message: cut short, and quoted so control characters show escaped. */
+function quote(value) {
+    return JSON.stringify(value.length > MAX_QUOTED_LENGTH ? `${value.slice(0, MAX_QUOTED_LENGTH)}…` : value);
+}
 /**
- * `localhost` / `127.0.0.1`, optionally followed by `:<port>`. IPv6 loopback
- * (`[::1]`, etc.) is intentionally not handled — the identity provider doesn't
- * recognise it either, and its e2e setup uses the hostname form.
+ * `localhost`, `127.0.0.1`, or a name under `.localhost` (RFC 6761 reserves the
+ * whole domain for loopback), like the identity provider's own check. IPv6
+ * loopback is not one, there either.
  */
-function isLoopbackHost(host) {
-    let url;
-    try {
-        // Parse as a URL authority so the optional `:<port>` is split off for us
-        // rather than by hand. Invalid input throws and is treated as non-loopback.
-        url = new URL(`http://${host}`);
+function isLoopbackHost(hostname) {
+    return hostname === 'localhost' || hostname === '127.0.0.1' || hostname.endsWith('.localhost');
+}
+/** What keeps `hostname` from being a DNS name, by the identity provider's rules. */
+function dnsNameProblems(hostname) {
+    const labels = hostname.split('.');
+    const problems = [];
+    if (labels.length < 2)
+        problems.push('a single label');
+    if (labels.some((label) => label.length === 0))
+        problems.push('an empty label');
+    if (labels.some((label) => label.length > MAX_DNS_LABEL_LENGTH)) {
+        problems.push(`a label longer than ${MAX_DNS_LABEL_LENGTH} characters`);
     }
-    catch {
-        return false;
+    if (labels.some((label) => /[^a-z0-9-]/.test(label))) {
+        problems.push('a character other than a letter, digit, or hyphen');
+    }
+    if (labels.some((label) => label.startsWith('-') || label.endsWith('-'))) {
+        problems.push('a label starting or ending with a hyphen');
     }
-    // A bare `host[:port]` has no path/query/fragment; reject e.g. `localhost/x`.
-    if (url.pathname !== '/' || url.search !== '' || url.hash !== '') {
-        return false;
+    // `--` in the third and fourth places is reserved, except for punycode.
+    if (labels.some((label) => label.slice(2, 4) === '--' && !label.startsWith('xn--'))) {
+        problems.push('a label with "--" in its third and fourth places');
     }
-    return url.hostname === 'localhost' || url.hostname === '127.0.0.1';
+    if (hostname.length > MAX_DNS_NAME_LENGTH) {
+        problems.push(`a name longer than ${MAX_DNS_NAME_LENGTH} characters`);
+    }
+    return problems;
+}
+function listed(items) {
+    return items.length < 2 ? items.join('') : `${items.slice(0, -1).join(', ')} and ${items.at(-1)}`;
 }
 /**
  * Normalizes an SSO domain to the authority the identity provider fetches the
- * discovery document from: lowercased, IDNA-encoded, host and optional port.
+ * discovery document from: lowercased and IDNA-encoded. A loopback host may
+ * carry a port, for a local mock provider; any other host may not.
  *
  * @param domain - The organization domain.
  * @returns The normalized authority.
- * @throws When `domain` is not a domain with an optional port.
+ * @throws When `domain` is not a domain, naming every problem with it.
  */
 export function normalizeSsoDomain(domain) {
     const trimmed = domain.trim();
     if (trimmed.length === 0) {
         throw new Error('ssoDomain cannot be empty');
     }
+    const scheme = /^[a-z][a-z0-9+.-]*:\/\//i.exec(trimmed)?.[0];
+    const rest = scheme === undefined ? trimmed : trimmed.slice(scheme.length);
     let url;
     try {
-        url = new URL(`https://${trimmed}`);
+        url = new URL(`https://${rest}`);
     }
     catch {
-        throw new Error(`ssoDomain is not a domain: ${trimmed}`);
-    }
-    const authority = url.host;
-    // Rebuilding from the host and port alone has to reproduce what was parsed,
-    // so anything else the domain carried shows up as a difference.
-    if (new URL(`https://${authority}`).href !== url.href) {
-        throw new Error(`ssoDomain must be a domain and optional port, nothing else: ${trimmed}`);
+        throw new Error(`ssoDomain ${quote(trimmed)} is not a domain`);
     }
-    if (authority.length > MAX_AUTHORITY_LENGTH) {
-        throw new Error(`ssoDomain exceeds ${MAX_AUTHORITY_LENGTH} characters`);
+    const { username, password, pathname, hostname, port, host, href } = url;
+    // `URL` drops an empty or default port such as `:443`, so the typed one is read
+    // from the input itself.
+    const typedAuthority = rest.split(/[/?#]/)[0] ?? '';
+    const typedPort = /:([0-9]*)$/.exec(typedAuthority.slice(typedAuthority.lastIndexOf('@') + 1))?.[1];
+    const [beforeFragment = ''] = href.split('#');
+    const problems = [];
+    if (scheme !== undefined)
+        problems.push('a scheme');
+    if (username !== '' || password !== '')
+        problems.push('userinfo');
+    if (pathname !== '/')
+        problems.push('a path');
+    if (beforeFragment.includes('?'))
+        problems.push('a query');
+    if (href.includes('#'))
+        problems.push('a fragment');
+    const loopback = isLoopbackHost(hostname);
+    if (typedPort !== undefined && !loopback) {
+        problems.push('a port, which only loopback hosts may carry');
     }
-    // A bare hostname is a half-typed domain, not something worth a request.
-    if (!authority.includes('.') && !isLoopbackHost(authority)) {
-        throw new Error(`ssoDomain is not a domain name: ${trimmed}`);
+    else if (typedPort !== undefined && (typedPort === '' || typedPort !== port)) {
+        problems.push('an empty or default port');
     }
-    return authority;
-}
-function publishesSsoConfiguration(value) {
-    if (typeof value !== 'object' || value === null) {
-        return false;
+    if (trimmed.length > MAX_AUTHORITY_LENGTH) {
+        problems.push(`more than ${MAX_AUTHORITY_LENGTH} characters`);
     }
-    const { client_id, openid_configuration } = value;
-    return typeof client_id === 'string' && typeof openid_configuration === 'string';
-}
-/**
- * Checks whether an organization domain can be used for SSO sign-in: it is a
- * domain name, and it publishes `/.well-known/ii-openid-configuration` with a
- * `client_id` and an `openid_configuration` URL.
- *
- * The document must be served with `Access-Control-Allow-Origin: *`.
- *
- * The check waits on a third-party server and has no deadline of its own, so
- * `signal` sets one. Pass `AbortSignal.timeout(...)` for a one-shot check, or a
- * controller you abort per keystroke when checking as the user types.
- *
- * @param domain - The organization domain.
- * @param signal - Bounds the check.
- * @returns Whether the domain is usable for SSO sign-in.
- * @throws When `signal` aborts — an abandoned check is not a verdict on the
- *   domain, so it must not be read as `false`.
- *
- * @example
- * if (await isValidSsoDomain(input.value, AbortSignal.timeout(5_000))) {
- *   const authClient = new AuthClient({ ssoDomain: input.value });
- *   await authClient.signIn();
- * }
- */
-export async function isValidSsoDomain(domain, signal) {
-    signal.throwIfAborted();
-    let normalized;
-    try {
-        normalized = normalizeSsoDomain(domain);
-    }
-    catch {
-        return false;
-    }
-    const scheme = isLoopbackHost(normalized) ? 'http' : 'https';
-    try {
-        const response = await fetch(`${scheme}://${normalized}${WELL_KNOWN_PATH}`, {
-            headers: { Accept: 'application/json' },
-            signal,
-        });
-        if (!response.ok) {
-            return false;
-        }
-        const valid = publishesSsoConfiguration(await response.json());
-        signal.throwIfAborted();
-        return valid;
+    else if (!loopback) {
+        problems.push(...dnsNameProblems(hostname));
     }
-    catch (error) {
-        if (signal.aborted) {
-            throw error;
-        }
-        // A DNS, TLS, CORS, or parse failure all leave the domain unusable.
-        return false;
+    if (problems.length > 0) {
+        throw new Error(`ssoDomain ${quote(trimmed)} has ${listed(problems)}`);
     }
+    return host;
 }
 //# sourceMappingURL=sso.js.map

package/dist/esm/client/sso.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso.js","sourceRoot":"","sources":["../../../src/client/sso.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC,MAAM,eAAe,GAAG,sCAAsC,CAAC;AAE/D;;;;GAIG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,yEAAyE;QACzE,4EAA4E;QAC5E,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,8EAA8E;IAC9E,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC;AACtE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC;IAC3B,4EAA4E;IAC5E,gEAAgE;IAChE,IAAI,IAAI,GAAG,CAAC,WAAW,SAAS,EAAE,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,+DAA+D,OAAO,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,qBAAqB,oBAAoB,aAAa,CAAC,CAAC;IAC1E,CAAC;IACD,yEAAyE;IACzE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,GAAG,KAAgC,CAAC;IAC7E,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,OAAO,oBAAoB,KAAK,QAAQ,CAAC;AACnF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,MAAmB;IACxE,MAAM,CAAC,cAAc,EAAE,CAAC;IAExB,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,MAAM,UAAU,GAAG,eAAe,EAAE,EAAE;YAC1E,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,KAAK,GAAG,yBAAyB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,KAAK,CAAC;QACd,CAAC;QACD,oEAAoE;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"sso.js","sourceRoot":"","sources":["../../../src/client/sso.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC,yEAAyE;AACzE,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B,8FAA8F;AAC9F,SAAS,KAAK,CAAC,KAAa;IAC1B,OAAO,IAAI,CAAC,SAAS,CACnB,KAAK,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CACnF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AACjG,CAAC;AAED,qFAAqF;AACrF,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAChF,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,oBAAoB,CAAC,EAAE,CAAC;QAChE,QAAQ,CAAC,IAAI,CAAC,uBAAuB,oBAAoB,aAAa,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACzE,QAAQ,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IAC5D,CAAC;IACD,wEAAwE;IACxE,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACpF,QAAQ,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QAC1C,QAAQ,CAAC,IAAI,CAAC,sBAAsB,mBAAmB,aAAa,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,MAAM,CAAC,KAAe;IAC7B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACpG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3E,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;IACzE,gFAAgF;IAChF,yBAAyB;IACzB,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CACjC,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAC1D,EAAE,CAAC,CAAC,CAAC,CAAC;IACP,MAAM,CAAC,cAAc,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE9C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,MAAM,KAAK,SAAS;QAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpD,IAAI,QAAQ,KAAK,EAAE,IAAI,QAAQ,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAClE,IAAI,QAAQ,KAAK,GAAG;QAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC/D,CAAC;SAAM,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,KAAK,EAAE,IAAI,SAAS,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/E,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QAC1C,QAAQ,CAAC,IAAI,CAAC,aAAa,oBAAoB,aAAa,CAAC,CAAC;IAChE,CAAC;SAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,OAAO,CAAC,QAAQ,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@icp-sdk/auth",
-  "version": "10.0.2",
+  "version": "11.1.0",
   "author": "DFINITY Stiftung <sdk@dfinity.org>",
   "license": "Apache-2.0",
   "description": "Authentication library for Internet Computer web apps",