@idp.global/sdk 5.0.1 → 6.0.1

package/dist_ts_server/classes.idp-global-server-client.js

@@ -14,30 +14,138 @@ export class IdpGlobalServerClient {
     optionsArg;
     typedrouter = new plugins.typedrequest.TypedRouter();
     typedsocket;
-    typedsocketDeferred = plugins.smartpromise.defer();
+    typedsocketDeferred = this.createConnectionDeferred();
+    publicKeyPushHandlers = [];
+    blocklistPushHandlers = [];
+    connectionGeneration = 0;
+    pendingSocketPromise;
+    connectionAbortController;
+    stopWaiters = new Set();
+    stopping = false;
     constructor(optionsArg = {}) {
         this.optionsArg = optionsArg;
+        this.typedrouter.addTypedHandler(new plugins.typedrequest.TypedHandler('pushPublicKeyForValidation', async (requestArg) => {
+            await Promise.all(this.publicKeyPushHandlers.map((handlerArg) => handlerArg(requestArg.publicKeyPem)));
+            return {};
+        }));
+        this.typedrouter.addTypedHandler(new plugins.typedrequest.TypedHandler('pushOrGetJwtIdBlocklist', async (requestArg) => {
+            if (requestArg.blockedJwtIds) {
+                await Promise.all(this.blocklistPushHandlers.map((handlerArg) => handlerArg(requestArg.blockedJwtIds)));
+            }
+            return {};
+        }));
     }
     async connect() {
+        if (this.stopping) {
+            throw new Error('IdpGlobalServerClient is stopping');
+        }
         if (this.typedsocketDeferred.claimed) {
             return this.typedsocketDeferred.promise;
         }
-        this.typedsocketDeferred.claim();
-        this.typedsocket = await plugins.typedsocket.TypedSocket.createClient(this.typedrouter, this.getTypedRequestUrl());
-        this.typedsocketDeferred.resolve(this.typedsocket);
-        return this.typedsocketDeferred.promise;
+        const deferred = this.typedsocketDeferred;
+        const generation = this.connectionGeneration;
+        deferred.claim();
+        let createdSocket;
+        let socketPromise;
+        const connectionAbortController = new AbortController();
+        try {
+            this.connectionAbortController = connectionAbortController;
+            socketPromise = plugins.typedsocket.TypedSocket.createClient(this.typedrouter, this.getTypedRequestUrl(), { autoReconnect: true, abortSignal: connectionAbortController.signal });
+            this.pendingSocketPromise = socketPromise;
+            createdSocket = await this.raceWithStop(socketPromise);
+            if (generation !== this.connectionGeneration) {
+                await createdSocket.stop();
+                if (deferred.status === 'pending') {
+                    deferred.reject(new Error('IdpGlobalServerClient stopped while connecting'));
+                }
+                return deferred.promise;
+            }
+            this.typedsocket = createdSocket;
+            deferred.resolve(createdSocket);
+        }
+        catch (error) {
+            if (generation === this.connectionGeneration && (!createdSocket || this.typedsocket === createdSocket)) {
+                this.typedsocket = undefined;
+            }
+            await createdSocket?.stop().catch(() => undefined);
+            if (deferred.status === 'pending') {
+                deferred.reject(error);
+            }
+            if (this.typedsocketDeferred === deferred) {
+                this.typedsocketDeferred = this.createConnectionDeferred();
+            }
+            throw error;
+        }
+        finally {
+            if (socketPromise && this.pendingSocketPromise === socketPromise) {
+                this.pendingSocketPromise = undefined;
+            }
+            if (this.connectionAbortController === connectionAbortController) {
+                this.connectionAbortController = undefined;
+            }
+        }
+        return deferred.promise;
     }
     async stop() {
-        await this.typedsocket?.stop();
+        this.stopping = true;
+        this.connectionGeneration++;
+        const stopError = new Error('IdpGlobalServerClient stopped');
+        this.rejectStopWaiters(stopError);
+        const socket = this.typedsocket;
+        const pendingSocketPromise = this.pendingSocketPromise;
+        this.connectionAbortController?.abort();
+        this.connectionAbortController = undefined;
         this.typedsocket = undefined;
+        if (this.typedsocketDeferred.status === 'pending' && this.typedsocketDeferred.claimed) {
+            this.typedsocketDeferred.reject(stopError);
+        }
+        await socket?.stop();
+        const pendingSocket = await pendingSocketPromise?.catch(() => undefined);
+        if (pendingSocket && pendingSocket !== socket) {
+            await pendingSocket.stop().catch(() => undefined);
+        }
+        this.typedsocketDeferred = this.createConnectionDeferred();
+        this.pendingSocketPromise = undefined;
+        this.stopping = false;
+    }
+    onPublicKeyPush(handlerArg) {
+        this.publicKeyPushHandlers.push(handlerArg);
+        return () => {
+            this.publicKeyPushHandlers = this.publicKeyPushHandlers.filter((handler) => handler !== handlerArg);
+        };
+    }
+    onBlocklistPush(handlerArg) {
+        this.blocklistPushHandlers.push(handlerArg);
+        return () => {
+            this.blocklistPushHandlers = this.blocklistPushHandlers.filter((handler) => handler !== handlerArg);
+        };
+    }
+    async registerBackendService(backendTokenArg = this.optionsArg.backendToken) {
+        const backendToken = this.requireBackendToken(backendTokenArg);
+        const socket = await this.connect();
+        await this.applyBackendServiceTag(socket, backendToken);
+    }
+    async getPublicKeyForValidation(backendTokenArg = this.optionsArg.backendToken) {
+        const backendToken = this.requireBackendToken(backendTokenArg);
+        const socket = await this.connect();
+        const request = socket.createTypedRequest('getPublicKeyForValidation');
+        const response = await this.raceWithStop(request.fire({ backendToken }));
+        return response.publicKeyPem;
+    }
+    async getJwtIdBlocklist(backendTokenArg = this.optionsArg.backendToken) {
+        const backendToken = this.requireBackendToken(backendTokenArg);
+        const socket = await this.connect();
+        const request = socket.createTypedRequest('pushOrGetJwtIdBlocklist');
+        const response = await this.raceWithStop(request.fire({ backendToken }));
+        return response.blockedJwtIds || [];
     }
     async loginWithEmailAndPassword(optionsArg) {
         const socket = await this.connect();
         const loginRequest = socket.createTypedRequest('loginWithEmailOrUsernameAndPassword');
-        const loginResponse = await loginRequest.fire({
+        const loginResponse = await this.raceWithStop(loginRequest.fire({
             username: optionsArg.email,
             password: optionsArg.password,
-        });
+        }));
         if (loginResponse.twoFaNeeded) {
             throw new IdpMfaRequiredError({
                 mfaChallengeToken: loginResponse.mfaChallengeToken,
@@ -48,12 +156,12 @@ export class IdpGlobalServerClient {
             throw new Error('IdP login failed');
         }
         const refreshRequest = socket.createTypedRequest('refreshJwt');
-        const refreshResponse = await refreshRequest.fire({ refreshToken: loginResponse.refreshToken });
+        const refreshResponse = await this.raceWithStop(refreshRequest.fire({ refreshToken: loginResponse.refreshToken }));
         if (!refreshResponse.jwt) {
             throw new Error('IdP did not return a JWT');
         }
         const whoIsRequest = socket.createTypedRequest('whoIs');
-        const whoIsResponse = await whoIsRequest.fire({ jwt: refreshResponse.jwt });
+        const whoIsResponse = await this.raceWithStop(whoIsRequest.fire({ jwt: refreshResponse.jwt }));
         return {
             user: whoIsResponse.user,
             jwt: refreshResponse.jwt,
@@ -70,5 +178,40 @@ export class IdpGlobalServerClient {
         }
         return baseUrl;
     }
+    requireBackendToken(backendTokenArg) {
+        if (!backendTokenArg) {
+            throw new Error('backendToken is required for backend JWT validation APIs');
+        }
+        return backendTokenArg;
+    }
+    async applyBackendServiceTag(socketArg, backendTokenArg) {
+        await this.raceWithStop(socketArg.setTag('backend-service', {
+            backendToken: backendTokenArg,
+        }));
+    }
+    createConnectionDeferred() {
+        const deferred = plugins.smartpromise.defer();
+        deferred.promise.catch(() => undefined);
+        return deferred;
+    }
+    raceWithStop(promiseArg) {
+        promiseArg.catch(() => undefined);
+        if (this.stopping) {
+            return Promise.reject(new Error('IdpGlobalServerClient stopped'));
+        }
+        return new Promise((resolve, reject) => {
+            const stopReject = (errorArg) => reject(errorArg);
+            this.stopWaiters.add(stopReject);
+            promiseArg.then(resolve, reject).finally(() => {
+                this.stopWaiters.delete(stopReject);
+            });
+        });
+    }
+    rejectStopWaiters(errorArg) {
+        for (const stopWaiter of this.stopWaiters) {
+            stopWaiter(errorArg);
+        }
+        this.stopWaiters.clear();
+    }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5pZHAtZ2xvYmFsLXNlcnZlci1jbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19zZXJ2ZXIvY2xhc3Nlcy5pZHAtZ2xvYmFsLXNlcnZlci1jbGllbnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFNeEMsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUcsb0JBQW9CLENBQUM7QUFRNUQsTUFBTSxPQUFPLG1CQUFvQixTQUFRLEtBQUs7SUFDckMsaUJBQWlCLENBQVM7SUFDMUIsbUJBQW1CLENBQTBDO0lBRXBFLFlBQVksVUFBeUc7UUFDbkgsS0FBSyxDQUFDLHVDQUF1QyxDQUFDLENBQUM7UUFDL0MsSUFBSSxDQUFDLElBQUksR0FBRyxxQkFBcUIsQ0FBQztRQUNsQyxJQUFJLENBQUMsaUJBQWlCLEdBQUcsVUFBVSxDQUFDLGlCQUFpQixJQUFJLEVBQUUsQ0FBQztRQUM1RCxJQUFJLENBQUMsbUJBQW1CLEdBQUcsVUFBVSxDQUFDLG1CQUFtQixJQUFJLEVBQUUsQ0FBQztJQUNsRSxDQUFDO0NBQ0Y7QUFFRCxNQUFNLE9BQU8scUJBQXFCO0lBS1o7SUFKWixXQUFXLEdBQVEsSUFBSSxPQUFPLENBQUMsWUFBWSxDQUFDLFdBQVcsRUFBRSxDQUFDO0lBQzFELFdBQVcsQ0FBbUM7SUFDOUMsbUJBQW1CLEdBQUcsT0FBTyxDQUFDLFlBQVksQ0FBQyxLQUFLLEVBQW1DLENBQUM7SUFFNUYsWUFBb0IsYUFBNEMsRUFBRTtRQUE5QyxlQUFVLEdBQVYsVUFBVSxDQUFvQztJQUFHLENBQUM7SUFFL0QsS0FBSyxDQUFDLE9BQU87UUFDbEIsSUFBSSxJQUFJLENBQUMsbUJBQW1CLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDckMsT0FBTyxJQUFJLENBQUMsbUJBQW1CLENBQUMsT0FBTyxDQUFDO1FBQzFDLENBQUM7UUFDRCxJQUFJLENBQUMsbUJBQW1CLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDakMsSUFBSSxDQUFDLFdBQVcsR0FBRyxNQUFNLE9BQU8sQ0FBQyxXQUFXLENBQUMsV0FBVyxDQUFDLFlBQVksQ0FDbkUsSUFBSSxDQUFDLFdBQVcsRUFDaEIsSUFBSSxDQUFDLGtCQUFrQixFQUFFLENBQzFCLENBQUM7UUFDRixJQUFJLENBQUMsbUJBQW1CLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUNuRCxPQUFPLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxPQUFPLENBQUM7SUFDMUMsQ0FBQztJQUVNLEtBQUssQ0FBQyxJQUFJO1FBQ2YsTUFBTSxJQUFJLENBQUMsV0FBVyxFQUFFLElBQUksRUFBRSxDQUFDO1FBQy9CLElBQUksQ0FBQyxXQUFXLEdBQUcsU0FBUyxDQUFDO0lBQy9CLENBQUM7SUFFTSxLQUFLLENBQUMseUJBQXlCLENBQUMsVUFBK0M7UUFDcEYsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDcEMsTUFBTSxZQUFZLEdBQUcsTUFBTSxDQUFDLGtCQUFrQixDQUF5RSxxQ0FBcUMsQ0FBQyxDQUFDO1FBQzlKLE1BQU0sYUFBYSxHQUFHLE1BQU0sWUFBWSxDQUFDLElBQUksQ0FBQztZQUM1QyxRQUFRLEVBQUUsVUFBVSxDQUFDLEtBQUs7WUFDMUIsUUFBUSxFQUFFLFVBQVUsQ0FBQyxRQUFRO1NBQzlCLENBQUMsQ0FBQztRQUNILElBQUksYUFBYSxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQzlCLE1BQU0sSUFBSSxtQkFBbUIsQ0FBQztnQkFDNUIsaUJBQWlCLEVBQUcsYUFBcUIsQ0FBQyxpQkFBaUI7Z0JBQzNELG1CQUFtQixFQUFHLGFBQXFCLENBQUMsbUJBQW1CO2FBQ2hFLENBQUMsQ0FBQztRQUNMLENBQUM7UUFDRCxJQUFJLENBQUMsYUFBYSxDQUFDLFlBQVksRUFBRSxDQUFDO1lBQ2hDLE1BQU0sSUFBSSxLQUFLLENBQUMsa0JBQWtCLENBQUMsQ0FBQztRQUN0QyxDQUFDO1FBRUQsTUFBTSxjQUFjLEdBQUcsTUFBTSxDQUFDLGtCQUFrQixDQUFnRCxZQUFZLENBQUMsQ0FBQztRQUM5RyxNQUFNLGVBQWUsR0FBRyxNQUFNLGNBQWMsQ0FBQyxJQUFJLENBQUMsRUFBRSxZQUFZLEVBQUUsYUFBYSxDQUFDLFlBQVksRUFBRSxDQUFDLENBQUM7UUFDaEcsSUFBSSxDQUFDLGVBQWUsQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUN6QixNQUFNLElBQUksS0FBSyxDQUFDLDBCQUEwQixDQUFDLENBQUM7UUFDOUMsQ0FBQztRQUVELE1BQU0sWUFBWSxHQUFHLE1BQU0sQ0FBQyxrQkFBa0IsQ0FBMkMsT0FBTyxDQUFDLENBQUM7UUFDbEcsTUFBTSxhQUFhLEdBQUcsTUFBTSxZQUFZLENBQUMsSUFBSSxDQUFDLEVBQUUsR0FBRyxFQUFFLGVBQWUsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDO1FBQzVFLE9BQU87WUFDTCxJQUFJLEVBQUUsYUFBYSxDQUFDLElBQUk7WUFDeEIsR0FBRyxFQUFFLGVBQWUsQ0FBQyxHQUFHO1lBQ3hCLFlBQVksRUFBRSxlQUFlLENBQUMsWUFBWSxJQUFJLGFBQWEsQ0FBQyxZQUFZO1NBQ3pFLENBQUM7SUFDSixDQUFDO0lBRU8sa0JBQWtCO1FBQ3hCLElBQUksT0FBTyxHQUFHLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxPQUFPLElBQUksdUJBQXVCLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUMxRSxJQUFJLE9BQU8sQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUMxQixPQUFPLEdBQUcsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNqQyxDQUFDO1FBQ0QsSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsZUFBZSxDQUFDLEVBQUUsQ0FBQztZQUN2QyxPQUFPLEdBQUcsR0FBRyxPQUFPLGVBQWUsQ0FBQztRQUN0QyxDQUFDO1FBQ0QsT0FBTyxPQUFPLENBQUM7SUFDakIsQ0FBQztDQUNGIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5pZHAtZ2xvYmFsLXNlcnZlci1jbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19zZXJ2ZXIvY2xhc3Nlcy5pZHAtZ2xvYmFsLXNlcnZlci1jbGllbnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFPeEMsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUcsb0JBQW9CLENBQUM7QUFRNUQsTUFBTSxPQUFPLG1CQUFvQixTQUFRLEtBQUs7SUFDckMsaUJBQWlCLENBQVM7SUFDMUIsbUJBQW1CLENBQTBDO0lBRXBFLFlBQVksVUFBeUc7UUFDbkgsS0FBSyxDQUFDLHVDQUF1QyxDQUFDLENBQUM7UUFDL0MsSUFBSSxDQUFDLElBQUksR0FBRyxxQkFBcUIsQ0FBQztRQUNsQyxJQUFJLENBQUMsaUJBQWlCLEdBQUcsVUFBVSxDQUFDLGlCQUFpQixJQUFJLEVBQUUsQ0FBQztRQUM1RCxJQUFJLENBQUMsbUJBQW1CLEdBQUcsVUFBVSxDQUFDLG1CQUFtQixJQUFJLEVBQUUsQ0FBQztJQUNsRSxDQUFDO0NBQ0Y7QUFFRCxNQUFNLE9BQU8scUJBQXFCO0lBWVo7SUFYWixXQUFXLEdBQVEsSUFBSSxPQUFPLENBQUMsWUFBWSxDQUFDLFdBQVcsRUFBRSxDQUFDO0lBQzFELFdBQVcsQ0FBbUM7SUFDOUMsbUJBQW1CLEdBQUcsSUFBSSxDQUFDLHdCQUF3QixFQUFFLENBQUM7SUFDdEQscUJBQXFCLEdBQTZELEVBQUUsQ0FBQztJQUNyRixxQkFBcUIsR0FBZ0UsRUFBRSxDQUFDO0lBQ3hGLG9CQUFvQixHQUFHLENBQUMsQ0FBQztJQUN6QixvQkFBb0IsQ0FBNEM7SUFDaEUseUJBQXlCLENBQW1CO0lBQzVDLFdBQVcsR0FBRyxJQUFJLEdBQUcsRUFBNkIsQ0FBQztJQUNuRCxRQUFRLEdBQUcsS0FBSyxDQUFDO0lBRXpCLFlBQW9CLGFBQTRDLEVBQUU7UUFBOUMsZUFBVSxHQUFWLFVBQVUsQ0FBb0M7UUFDaEUsSUFBSSxDQUFDLFdBQVcsQ0FBQyxlQUFlLENBQzlCLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxZQUFZLENBQ25DLDRCQUE0QixFQUM1QixLQUFLLEVBQUUsVUFBVSxFQUFFLEVBQUU7WUFDbkIsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxHQUFHLENBQUMsQ0FBQyxVQUFVLEVBQUUsRUFBRSxDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQ3ZHLE9BQU8sRUFBRSxDQUFDO1FBQ1osQ0FBQyxDQUNGLENBQ0YsQ0FBQztRQUNGLElBQUksQ0FBQyxXQUFXLENBQUMsZUFBZSxDQUM5QixJQUFJLE9BQU8sQ0FBQyxZQUFZLENBQUMsWUFBWSxDQUNuQyx5QkFBeUIsRUFDekIsS0FBSyxFQUFFLFVBQVUsRUFBRSxFQUFFO1lBQ25CLElBQUksVUFBVSxDQUFDLGFBQWEsRUFBRSxDQUFDO2dCQUM3QixNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLHFCQUFxQixDQUFDLEdBQUcsQ0FBQyxDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQyxhQUFjLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDM0csQ0FBQztZQUNELE9BQU8sRUFBRSxDQUFDO1FBQ1osQ0FBQyxDQUNGLENBQ0YsQ0FBQztJQUNKLENBQUM7SUFFTSxLQUFLLENBQUMsT0FBTztRQUNsQixJQUFJLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNsQixNQUFNLElBQUksS0FBSyxDQUFDLG1DQUFtQyxDQUFDLENBQUM7UUFDdkQsQ0FBQztRQUNELElBQUksSUFBSSxDQUFDLG1CQUFtQixDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ3JDLE9BQU8sSUFBSSxDQUFDLG1CQUFtQixDQUFDLE9BQU8sQ0FBQztRQUMxQyxDQUFDO1FBQ0QsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLG1CQUFtQixDQUFDO1FBQzFDLE1BQU0sVUFBVSxHQUFHLElBQUksQ0FBQyxvQkFBb0IsQ0FBQztRQUM3QyxRQUFRLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDakIsSUFBSSxhQUEwRCxDQUFDO1FBQy9ELElBQUksYUFBbUUsQ0FBQztRQUN4RSxNQUFNLHlCQUF5QixHQUFHLElBQUksZUFBZSxFQUFFLENBQUM7UUFDeEQsSUFBSSxDQUFDO1lBQ0gsSUFBSSxDQUFDLHlCQUF5QixHQUFHLHlCQUF5QixDQUFDO1lBQzNELGFBQWEsR0FBRyxPQUFPLENBQUMsV0FBVyxDQUFDLFdBQVcsQ0FBQyxZQUFZLENBQzFELElBQUksQ0FBQyxXQUFXLEVBQ2hCLElBQUksQ0FBQyxrQkFBa0IsRUFBRSxFQUN6QixFQUFFLGFBQWEsRUFBRSxJQUFJLEVBQUUsV0FBVyxFQUFFLHlCQUF5QixDQUFDLE1BQU0sRUFBRSxDQUN2RSxDQUFDO1lBQ0YsSUFBSSxDQUFDLG9CQUFvQixHQUFHLGFBQWEsQ0FBQztZQUMxQyxhQUFhLEdBQUcsTUFBTSxJQUFJLENBQUMsWUFBWSxDQUFDLGFBQWEsQ0FBQyxDQUFDO1lBQ3ZELElBQUksVUFBVSxLQUFLLElBQUksQ0FBQyxvQkFBb0IsRUFBRSxDQUFDO2dCQUM3QyxNQUFNLGFBQWEsQ0FBQyxJQUFJLEVBQUUsQ0FBQztnQkFDM0IsSUFBSSxRQUFRLENBQUMsTUFBTSxLQUFLLFNBQVMsRUFBRSxDQUFDO29CQUNsQyxRQUFRLENBQUMsTUFBTSxDQUFDLElBQUksS0FBSyxDQUFDLGdEQUFnRCxDQUFDLENBQUMsQ0FBQztnQkFDL0UsQ0FBQztnQkFDRCxPQUFPLFFBQVEsQ0FBQyxPQUFPLENBQUM7WUFDMUIsQ0FBQztZQUNELElBQUksQ0FBQyxXQUFXLEdBQUcsYUFBYSxDQUFDO1lBQ2pDLFFBQVEsQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDbEMsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixJQUFJLFVBQVUsS0FBSyxJQUFJLENBQUMsb0JBQW9CLElBQUksQ0FBQyxDQUFDLGFBQWEsSUFBSSxJQUFJLENBQUMsV0FBVyxLQUFLLGFBQWEsQ0FBQyxFQUFFLENBQUM7Z0JBQ3ZHLElBQUksQ0FBQyxXQUFXLEdBQUcsU0FBUyxDQUFDO1lBQy9CLENBQUM7WUFDRCxNQUFNLGFBQWEsRUFBRSxJQUFJLEVBQUUsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDbkQsSUFBSSxRQUFRLENBQUMsTUFBTSxLQUFLLFNBQVMsRUFBRSxDQUFDO2dCQUNsQyxRQUFRLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQ3pCLENBQUM7WUFDRCxJQUFJLElBQUksQ0FBQyxtQkFBbUIsS0FBSyxRQUFRLEVBQUUsQ0FBQztnQkFDMUMsSUFBSSxDQUFDLG1CQUFtQixHQUFHLElBQUksQ0FBQyx3QkFBd0IsRUFBRSxDQUFDO1lBQzdELENBQUM7WUFDRCxNQUFNLEtBQUssQ0FBQztRQUNkLENBQUM7Z0JBQVMsQ0FBQztZQUNULElBQUksYUFBYSxJQUFJLElBQUksQ0FBQyxvQkFBb0IsS0FBSyxhQUFhLEVBQUUsQ0FBQztnQkFDakUsSUFBSSxDQUFDLG9CQUFvQixHQUFHLFNBQVMsQ0FBQztZQUN4QyxDQUFDO1lBQ0QsSUFBSSxJQUFJLENBQUMseUJBQXlCLEtBQUsseUJBQXlCLEVBQUUsQ0FBQztnQkFDakUsSUFBSSxDQUFDLHlCQUF5QixHQUFHLFNBQVMsQ0FBQztZQUM3QyxDQUFDO1FBQ0gsQ0FBQztRQUNELE9BQU8sUUFBUSxDQUFDLE9BQU8sQ0FBQztJQUMxQixDQUFDO0lBRU0sS0FBSyxDQUFDLElBQUk7UUFDZixJQUFJLENBQUMsUUFBUSxHQUFHLElBQUksQ0FBQztRQUNyQixJQUFJLENBQUMsb0JBQW9CLEVBQUUsQ0FBQztRQUM1QixNQUFNLFNBQVMsR0FBRyxJQUFJLEtBQUssQ0FBQywrQkFBK0IsQ0FBQyxDQUFDO1FBQzdELElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNsQyxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsV0FBVyxDQUFDO1FBQ2hDLE1BQU0sb0JBQW9CLEdBQUcsSUFBSSxDQUFDLG9CQUFvQixDQUFDO1FBQ3ZELElBQUksQ0FBQyx5QkFBeUIsRUFBRSxLQUFLLEVBQUUsQ0FBQztRQUN4QyxJQUFJLENBQUMseUJBQXlCLEdBQUcsU0FBUyxDQUFDO1FBQzNDLElBQUksQ0FBQyxXQUFXLEdBQUcsU0FBUyxDQUFDO1FBQzdCLElBQUksSUFBSSxDQUFDLG1CQUFtQixDQUFDLE1BQU0sS0FBSyxTQUFTLElBQUksSUFBSSxDQUFDLG1CQUFtQixDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ3RGLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDN0MsQ0FBQztRQUNELE1BQU0sTUFBTSxFQUFFLElBQUksRUFBRSxDQUFDO1FBQ3JCLE1BQU0sYUFBYSxHQUFHLE1BQU0sb0JBQW9CLEVBQUUsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3pFLElBQUksYUFBYSxJQUFJLGFBQWEsS0FBSyxNQUFNLEVBQUUsQ0FBQztZQUM5QyxNQUFNLGFBQWEsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDcEQsQ0FBQztRQUNELElBQUksQ0FBQyxtQkFBbUIsR0FBRyxJQUFJLENBQUMsd0JBQXdCLEVBQUUsQ0FBQztRQUMzRCxJQUFJLENBQUMsb0JBQW9CLEdBQUcsU0FBUyxDQUFDO1FBQ3RDLElBQUksQ0FBQyxRQUFRLEdBQUcsS0FBSyxDQUFDO0lBQ3hCLENBQUM7SUFFTSxlQUFlLENBQUMsVUFBNkQ7UUFDbEYsSUFBSSxDQUFDLHFCQUFxQixDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUM1QyxPQUFPLEdBQUcsRUFBRTtZQUNWLElBQUksQ0FBQyxxQkFBcUIsR0FBRyxJQUFJLENBQUMscUJBQXFCLENBQUMsTUFBTSxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxPQUFPLEtBQUssVUFBVSxDQUFDLENBQUM7UUFDdEcsQ0FBQyxDQUFDO0lBQ0osQ0FBQztJQUVNLGVBQWUsQ0FBQyxVQUFnRTtRQUNyRixJQUFJLENBQUMscUJBQXFCLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQzVDLE9BQU8sR0FBRyxFQUFFO1lBQ1YsSUFBSSxDQUFDLHFCQUFxQixHQUFHLElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxNQUFNLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLE9BQU8sS0FBSyxVQUFVLENBQUMsQ0FBQztRQUN0RyxDQUFDLENBQUM7SUFDSixDQUFDO0lBRU0sS0FBSyxDQUFDLHNCQUFzQixDQUFDLGVBQWUsR0FBRyxJQUFJLENBQUMsVUFBVSxDQUFDLFlBQVk7UUFDaEYsTUFBTSxZQUFZLEdBQUcsSUFBSSxDQUFDLG1CQUFtQixDQUFDLGVBQWUsQ0FBQyxDQUFDO1FBQy9ELE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ3BDLE1BQU0sSUFBSSxDQUFDLHNCQUFzQixDQUFDLE1BQU0sRUFBRSxZQUFZLENBQUMsQ0FBQztJQUMxRCxDQUFDO0lBRU0sS0FBSyxDQUFDLHlCQUF5QixDQUFDLGVBQWUsR0FBRyxJQUFJLENBQUMsVUFBVSxDQUFDLFlBQVk7UUFDbkYsTUFBTSxZQUFZLEdBQUcsSUFBSSxDQUFDLG1CQUFtQixDQUFDLGVBQWUsQ0FBQyxDQUFDO1FBQy9ELE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ3BDLE1BQU0sT0FBTyxHQUFHLE1BQU0sQ0FBQyxrQkFBa0IsQ0FBK0QsMkJBQTJCLENBQUMsQ0FBQztRQUNySSxNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxFQUFFLFlBQVksRUFBRSxDQUFDLENBQUMsQ0FBQztRQUN6RSxPQUFPLFFBQVEsQ0FBQyxZQUFZLENBQUM7SUFDL0IsQ0FBQztJQUVNLEtBQUssQ0FBQyxpQkFBaUIsQ0FBQyxlQUFlLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxZQUFZO1FBQzNFLE1BQU0sWUFBWSxHQUFHLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUMvRCxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUNwQyxNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsa0JBQWtCLENBQTZELHlCQUF5QixDQUFDLENBQUM7UUFDakksTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsRUFBRSxZQUFZLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDekUsT0FBTyxRQUFRLENBQUMsYUFBYSxJQUFJLEVBQUUsQ0FBQztJQUN0QyxDQUFDO0lBRU0sS0FBSyxDQUFDLHlCQUF5QixDQUFDLFVBQStDO1FBQ3BGLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ3BDLE1BQU0sWUFBWSxHQUFHLE1BQU0sQ0FBQyxrQkFBa0IsQ0FBeUUscUNBQXFDLENBQUMsQ0FBQztRQUM5SixNQUFNLGFBQWEsR0FBRyxNQUFNLElBQUksQ0FBQyxZQUFZLENBQUMsWUFBWSxDQUFDLElBQUksQ0FBQztZQUM5RCxRQUFRLEVBQUUsVUFBVSxDQUFDLEtBQUs7WUFDMUIsUUFBUSxFQUFFLFVBQVUsQ0FBQyxRQUFRO1NBQzlCLENBQUMsQ0FBQyxDQUFDO1FBQ0osSUFBSSxhQUFhLENBQUMsV0FBVyxFQUFFLENBQUM7WUFDOUIsTUFBTSxJQUFJLG1CQUFtQixDQUFDO2dCQUM1QixpQkFBaUIsRUFBRyxhQUFxQixDQUFDLGlCQUFpQjtnQkFDM0QsbUJBQW1CLEVBQUcsYUFBcUIsQ0FBQyxtQkFBbUI7YUFDaEUsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUNELElBQUksQ0FBQyxhQUFhLENBQUMsWUFBWSxFQUFFLENBQUM7WUFDaEMsTUFBTSxJQUFJLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO1FBQ3RDLENBQUM7UUFFRCxNQUFNLGNBQWMsR0FBRyxNQUFNLENBQUMsa0JBQWtCLENBQWdELFlBQVksQ0FBQyxDQUFDO1FBQzlHLE1BQU0sZUFBZSxHQUFHLE1BQU0sSUFBSSxDQUFDLFlBQVksQ0FBQyxjQUFjLENBQUMsSUFBSSxDQUFDLEVBQUUsWUFBWSxFQUFFLGFBQWEsQ0FBQyxZQUFZLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDbkgsSUFBSSxDQUFDLGVBQWUsQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUN6QixNQUFNLElBQUksS0FBSyxDQUFDLDBCQUEwQixDQUFDLENBQUM7UUFDOUMsQ0FBQztRQUVELE1BQU0sWUFBWSxHQUFHLE1BQU0sQ0FBQyxrQkFBa0IsQ0FBMkMsT0FBTyxDQUFDLENBQUM7UUFDbEcsTUFBTSxhQUFhLEdBQUcsTUFBTSxJQUFJLENBQUMsWUFBWSxDQUFDLFlBQVksQ0FBQyxJQUFJLENBQUMsRUFBRSxHQUFHLEVBQUUsZUFBZSxDQUFDLEdBQUcsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUMvRixPQUFPO1lBQ0wsSUFBSSxFQUFFLGFBQWEsQ0FBQyxJQUFJO1lBQ3hCLEdBQUcsRUFBRSxlQUFlLENBQUMsR0FBRztZQUN4QixZQUFZLEVBQUUsZUFBZSxDQUFDLFlBQVksSUFBSSxhQUFhLENBQUMsWUFBWTtTQUN6RSxDQUFDO0lBQ0osQ0FBQztJQUVPLGtCQUFrQjtRQUN4QixJQUFJLE9BQU8sR0FBRyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsT0FBTyxJQUFJLHVCQUF1QixDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDMUUsSUFBSSxPQUFPLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDMUIsT0FBTyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDakMsQ0FBQztRQUNELElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLGVBQWUsQ0FBQyxFQUFFLENBQUM7WUFDdkMsT0FBTyxHQUFHLEdBQUcsT0FBTyxlQUFlLENBQUM7UUFDdEMsQ0FBQztRQUNELE9BQU8sT0FBTyxDQUFDO0lBQ2pCLENBQUM7SUFFTyxtQkFBbUIsQ0FBQyxlQUF3QjtRQUNsRCxJQUFJLENBQUMsZUFBZSxFQUFFLENBQUM7WUFDckIsTUFBTSxJQUFJLEtBQUssQ0FBQywwREFBMEQsQ0FBQyxDQUFDO1FBQzlFLENBQUM7UUFDRCxPQUFPLGVBQWUsQ0FBQztJQUN6QixDQUFDO0lBRU8sS0FBSyxDQUFDLHNCQUFzQixDQUNsQyxTQUEwQyxFQUMxQyxlQUF1QjtRQUV2QixNQUFNLElBQUksQ0FBQyxZQUFZLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBaUQsaUJBQWlCLEVBQUU7WUFDMUcsWUFBWSxFQUFFLGVBQWU7U0FDOUIsQ0FBQyxDQUFDLENBQUM7SUFDTixDQUFDO0lBRU8sd0JBQXdCO1FBQzlCLE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxZQUFZLENBQUMsS0FBSyxFQUFtQyxDQUFDO1FBQy9FLFFBQVEsQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3hDLE9BQU8sUUFBUSxDQUFDO0lBQ2xCLENBQUM7SUFFTyxZQUFZLENBQUksVUFBc0I7UUFDNUMsVUFBVSxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNsQyxJQUFJLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNsQixPQUFPLE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSSxLQUFLLENBQUMsK0JBQStCLENBQUMsQ0FBQyxDQUFDO1FBQ3BFLENBQUM7UUFDRCxPQUFPLElBQUksT0FBTyxDQUFJLENBQUMsT0FBTyxFQUFFLE1BQU0sRUFBRSxFQUFFO1lBQ3hDLE1BQU0sVUFBVSxHQUFHLENBQUMsUUFBZSxFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUM7WUFDekQsSUFBSSxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUM7WUFDakMsVUFBVSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRTtnQkFDNUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUM7WUFDdEMsQ0FBQyxDQUFDLENBQUM7UUFDTCxDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFTyxpQkFBaUIsQ0FBQyxRQUFlO1FBQ3ZDLEtBQUssTUFBTSxVQUFVLElBQUksSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQzFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUN2QixDQUFDO1FBQ0QsSUFBSSxDQUFDLFdBQVcsQ0FBQyxLQUFLLEVBQUUsQ0FBQztJQUMzQixDQUFDO0NBQ0YifQ==

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@idp.global/sdk",
-  "version": "5.0.1",
+  "version": "6.0.1",
   "private": false,
   "description": "Reusable browser and server SDK for idp.global authentication.",
   "type": "module",
@@ -15,8 +15,8 @@
   "license": "MIT",
   "dependencies": {
     "@api.global/typedrequest": "^3.3.0",
-    "@api.global/typedsocket": "^4.1.2",
-    "@idp.global/interfaces": "^5.0.0",
+    "@api.global/typedsocket": "^4.2.2",
+    "@idp.global/interfaces": "^7.0.0",
     "@push.rocks/smartdata": "^7.1.7",
     "@push.rocks/smartjson": "^6.0.1",
     "@push.rocks/smartpromise": "^4.2.4",

package/readme.md

@@ -137,10 +137,11 @@ await idp.logout();
 | --- | --- |
 | Registration and login | `firstRegistration`, `afterRegistrationEmailClicked`, `setData`, `mobileNumberVerification`, `finishRegistration`, `loginWithUserNameAndPassword`, `loginWithEmail`, `loginWithEmailAfterToken`, `loginWithApiToken`, `resetPassword`, `setNewPassword`, `obtainDeviceId`, `attachDeviceId` |
 | Tokens and OIDC | `obtainJwt`, `obtainOneTimeToken`, `prepareOidcAuthorization`, `completeOidcAuthorization` |
-| User profile and sessions | `getUserData`, `setUserData`, `getUserSessions`, `revokeSession`, `getUserActivity` |
-| Organizations and members | `getOrganizationById`, `updateOrganization`, `deleteOrganization`, `getOrgRoleDefinitions`, `upsertOrgRoleDefinition`, `deleteOrgRoleDefinition`, `createInvitation`, `getOrgInvitations`, `getOrgMembers`, `cancelInvitation`, `resendInvitation`, `removeMember`, `updateMemberRoles`, `transferOwnership`, `getInvitationByToken`, `acceptInvitation`, `bulkCreateInvitations`, `updateAppRoleMappings` |
-| Billing and validation | `getBillingPlan`, `getPaddleConfig`, `getPublicKeyForValidation`, `pushPublicKeyForValidation`, `pushOrGetJwtIdBlocklist` |
-| Global administration | `suspendUser`, `deleteSuspendedUser`, `checkGlobalAdmin`, `getGlobalAppStats`, `createGlobalApp`, `updateGlobalApp`, `deleteGlobalApp`, `regenerateAppCredentials` |
+| User profile and sessions | `getUserSessions`, `revokeSession`, `getUserActivity` |
+| Organizations, members, and apps | `getOrganizationById`, `updateOrganization`, `deleteOrganization`, `getOrgRoleDefinitions`, `upsertOrgRoleDefinition`, `deleteOrgRoleDefinition`, `createInvitation`, `getOrgInvitations`, `getOrgMembers`, `cancelInvitation`, `resendInvitation`, `removeMember`, `updateMemberRoles`, `transferOwnership`, `getInvitationByToken`, `acceptInvitation`, `bulkCreateInvitations`, `getGlobalApps`, `getAppConnections`, `toggleAppConnection`, `updateAppRoleMappings` |
+| Billing | `getBillingPlan`, `getBillingPlansForOrganizationId`, `getPaddleConfig` |
+| Passport and alerts | `createPassportEnrollmentChallenge`, `completePassportEnrollment`, `getPassportDevices`, `revokePassportDevice`, `createPassportChallenge`, `approvePassportChallenge`, `rejectPassportChallenge`, `registerPassportPushToken`, `listPendingPassportChallenges`, `getPassportChallengeByHint`, `markPassportChallengeSeen`, `getPassportDashboard`, `listPassportAlerts`, `getPassportAlertByHint`, `markPassportAlertSeen`, `dismissPassportAlert`, `upsertAlertRule`, `getAlertRules`, `deleteAlertRule` |
+| Global administration | `suspendUser`, `checkGlobalAdmin`, `getGlobalAppStats`, `createGlobalApp`, `updateGlobalApp`, `deleteGlobalApp`, `regenerateAppCredentials` |
 
 ## Server SDK
 
@@ -228,7 +229,28 @@ if (!authResult) {
 console.log(authResult.account.role, authResult.authSource);
 ```
 
-In `auto` mode, the service tries local auth first when the account allows `local`; if that fails and the account allows `idp.global`, it uses the configured `IdpGlobalServerClient`. `IdpGlobalServerClient` defaults to the hosted `https://idp.global` endpoint; pass `{ baseUrl }` only for self-hosted or staging IdP instances. idp.global authentication is accepted only when the returned user email matches the local account email and the returned user ID matches the stored `idpSubject` when one is already set.
+In `auto` mode, the service tries local auth first when the account allows `local`; if that fails and the account allows `idp.global`, it uses the configured `IdpGlobalServerClient`. `IdpGlobalServerClient` defaults to the hosted `https://idp.global` endpoint; pass `{ baseUrl }` only for self-hosted or staging IdP instances. Pass `{ backendToken }` when a backend service should fetch JWT validation data or subscribe to key/blocklist pushes. idp.global authentication is accepted only when the returned user email matches the local account email and the returned user ID matches the stored `idpSubject` when one is already set.
+
+Backend services can register for JWT validation updates after constructing a server client with a backend token:
+
+```ts
+const idpClient = new IdpGlobalServerClient({
+  baseUrl: process.env.IDP_URL,
+  backendToken: process.env.IDP_BACKEND_TOKEN,
+});
+
+idpClient.onPublicKeyPush((publicKeyPem) => {
+  // update the local JWT verifier key cache
+});
+
+idpClient.onBlocklistPush((blockedJwtIds) => {
+  // update the local JWT ID blocklist
+});
+
+await idpClient.registerBackendService();
+const publicKeyPem = await idpClient.getPublicKeyForValidation();
+const blockedJwtIds = await idpClient.getJwtIdBlocklist();
+```
 
 ### Server API Surface
 
@@ -236,7 +258,7 @@ In `auto` mode, the service tries local auth first when the account allows `loca
 | --- | --- |
 | `SmartdataAccountStore` | Smartdata-backed account persistence and local password verification. |
 | `AccountAuthService` | Existing-account authentication orchestration for `local`, `idp.global`, and `auto`. |
-| `IdpGlobalServerClient` | Typed-socket client for idp.global password login, JWT refresh, and `whoIs` lookup. |
+| `IdpGlobalServerClient` | Typed-socket client for idp.global password login, JWT refresh, `whoIs` lookup, backend JWT validation fetches, and JWT key/blocklist pushes. |
 | `PasswordHasher` | Static `hashPassword()` and `verifyPassword()` helpers using `scrypt:v1`. |
 | `IdpSdkAccountDoc` | Smartdata document class backing persisted SDK accounts. |
 | `setAccountDocSmartdataDb()` | Configure the active Smartdata DB for `IdpSdkAccountDoc`. Usually handled by `SmartdataAccountStore`. |
@@ -254,7 +276,7 @@ The server export includes these TypeScript types:
 | `ICreateIdpSdkAccountOptions` | Input for account creation. |
 | `IAuthenticateAccountOptions` | Input for `AccountAuthService.authenticate()`. |
 | `IAuthenticatedAccountResult` | Successful auth result with account, auth source, and optional idp.global tokens. |
-| `IIdpGlobalServerClientOptions` | Server client configuration with optional `baseUrl`; defaults to `https://idp.global`. |
+| `IIdpGlobalServerClientOptions` | Server client configuration with optional `baseUrl` and `backendToken`; defaults to `https://idp.global`. |
 | `IIdpPasswordAuthResult` | idp.global user, JWT, and refresh-token result. |
 
 ## Runtime Notes

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@idp.global/sdk',
-  version: '5.0.1',
+  version: '6.0.1',
   description: 'Reusable browser and server SDK for idp.global authentication.'
 }

package/ts_browser/classes.idpclient.ts

@@ -126,14 +126,15 @@ export class IdpClient {
       return null;
     }
 
-    await this.typedsocketDeferred.promise;
+    await this.enableTypedSocket();
     const refreshJwtReq = this.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_RefreshJwt>('refreshJwt');
-    const response = await refreshJwtReq
-      .fire({ refreshToken })
-      .catch(async () => {
+    const response = await refreshJwtReq.fire({ refreshToken }).catch(async (error) => {
+      if (this.isAuthInvalidResponse(error)) {
         await this.clearAuthState();
         return null;
-      });
+      }
+      throw error;
+    });
 
     if (!response?.jwt) {
       await this.clearAuthState();
@@ -149,13 +150,37 @@ export class IdpClient {
     return response.jwt;
   }
 
+  private isAuthInvalidResponse(errorArg: unknown): boolean {
+    if (!errorArg || typeof errorArg !== 'object') {
+      return false;
+    }
+    const errorText = (errorArg as { errorText?: unknown }).errorText;
+    return errorText === 'Invalid JWT' || errorText === 'User not found';
+  }
+
+  private async validateJwtWithServer(jwtStringArg: string): Promise<boolean> {
+    await this.enableTypedSocket();
+    const whoIs = this.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_WhoIs>('whoIs');
+    try {
+      await whoIs.fire({ jwt: jwtStringArg });
+      return true;
+    } catch (error) {
+      if (this.isAuthInvalidResponse(error)) {
+        await this.clearAuthState();
+        this.statusObservable.next('loggedOut');
+        return false;
+      }
+      throw error;
+    }
+  }
+
   public async getTransferToken(appDataArg?: plugins.idpInterfaces.data.IAppLegacy): Promise<string | null> {
     await this.performJwtHousekeeping();
     const refreshToken = await this.getRefreshToken();
     if (!refreshToken) {
       return null;
     }
-    await this.typedsocketDeferred.promise;
+    await this.enableTypedSocket();
     const getTransferToken = this.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_ExchangeRefreshTokenAndTransferToken>('exchangeRefreshTokenAndTransferToken');
     const response = await getTransferToken.fire({
       refreshToken,
@@ -193,7 +218,7 @@ export class IdpClient {
     const transferToken = url.searchParams['transfertoken'];
     if (transferToken) {
       this.scrubTransferTokenFromCurrentUrl();
-      await this.typedsocketDeferred.promise;
+      await this.enableTypedSocket();
       const getTransferToken = this.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_ExchangeRefreshTokenAndTransferToken>('exchangeRefreshTokenAndTransferToken');
       const response = await getTransferToken.fire({
         transferToken,
@@ -212,14 +237,16 @@ export class IdpClient {
 
   public async checkJwtPresent() {
     const jwt = await this.performJwtHousekeeping();
-    return !!jwt;
+    if (!jwt) {
+      return false;
+    }
+    return this.validateJwtWithServer(jwt);
   }
 
   public async determineLoginStatus(requireLoginArg: boolean = false): Promise<boolean> {
     const jwtPresent = await this.checkJwtPresent();
     if (jwtPresent) {
-      const jwt = await this.performJwtHousekeeping();
-      return !!jwt;
+      return true;
     }
     const refreshToken = await this.getRefreshToken();
     if (refreshToken) {
@@ -273,27 +300,53 @@ export class IdpClient {
     }
   }
 
+  private typedsocketStopRequested = false;
+  private typedsocketAbortController?: AbortController;
   public typedsocketDeferred = plugins.smartpromise.defer<plugins.typedsocket.TypedSocket>();
 
   public async enableTypedSocket() {
     if (this.typedsocketDeferred.claimed) {
       return this.typedsocketDeferred.promise;
     }
+    this.typedsocketStopRequested = false;
+    const abortController = new AbortController();
+    this.typedsocketAbortController = abortController;
     this.typedsocketDeferred.claim();
-    this.typedsocket = await plugins.typedsocket.TypedSocket.createClient(
-      this.typedrouter,
-      this.parsedReceptionUrl.toString(),
-    );
-    this.typedsocketDeferred.resolve(this.typedsocket);
-    return this.typedsocketDeferred.promise;
+    try {
+      const typedsocket = await plugins.typedsocket.TypedSocket.createClient(
+        this.typedrouter,
+        this.parsedReceptionUrl.toString(),
+        { abortSignal: abortController.signal },
+      );
+      if (this.typedsocketStopRequested) {
+        await typedsocket.stop();
+        throw new Error('TypedSocket start was stopped');
+      }
+      this.typedsocket = typedsocket;
+      this.typedsocketDeferred.resolve(this.typedsocket);
+      return this.typedsocket;
+    } catch (error) {
+      if (this.typedsocketAbortController === abortController) {
+        this.typedsocketAbortController = undefined;
+      }
+      void this.typedsocketDeferred.promise.catch(() => {});
+      this.typedsocketDeferred.reject(error);
+      this.typedsocketDeferred = plugins.smartpromise.defer<plugins.typedsocket.TypedSocket>();
+      throw error;
+    }
   }
 
   public async stop() {
+    this.typedsocketStopRequested = true;
+    this.typedsocketAbortController?.abort();
     await this.typedsocket?.stop();
+    if (this.typedsocketDeferred.status === 'fulfilled') {
+      this.typedsocketDeferred = plugins.smartpromise.defer<plugins.typedsocket.TypedSocket>();
+    }
   }
 
   public async createOrganization(orgNameArg: string, orgSlugArg: string, modeArg: 'checkAvailability' | 'manifest') {
-    await this.typedsocketDeferred.promise;
+    await this.enableTypedSocket();
     const validateOrg = this.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_CreateOrganization>('createOrganization');
     return validateOrg.fire({
       jwt: await this.getJwt(),
@@ -305,7 +358,7 @@ export class IdpClient {
   }
 
   public async getRolesAndOrganizations() {
-    await this.typedsocketDeferred.promise;
+    await this.enableTypedSocket();
     const rolesAndOrganizationsForUserId = this.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetRolesAndOrganizationsForUserId>('getRolesAndOrganizationsForUserId');
     return rolesAndOrganizationsForUserId.fire({
       jwt: await this.getJwt(),
@@ -314,7 +367,7 @@ export class IdpClient {
   }
 
   public async updatePaddleCheckoutId(orgIdArg: string, checkoutIdArg: string) {
-    await this.typedsocketDeferred.promise;
+    await this.enableTypedSocket();
     const updateBillingPlan = this.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_UpdatePaymentMethod>('updatePaymentMethod');
     return updateBillingPlan.fire({
       jwtString: await this.getJwt(),
@@ -324,7 +377,7 @@ export class IdpClient {
   }
 
   public async whoIs() {
-    await this.typedsocketDeferred.promise;
+    await this.enableTypedSocket();
     const whoIs = this.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_WhoIs>('whoIs');
     return whoIs.fire({ jwt: await this.getJwt() });
   }

package/ts_browser/classes.idprequests.ts

@@ -72,14 +72,6 @@ export class IdpRequests {
     return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_FirstRegistration>('firstRegistrationRequest');
   }
 
-  public get getUserData() {
-    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetUserData>('getUserData');
-  }
-
-  public get setUserData() {
-    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_SetUserData>('setUserData');
-  }
-
   public get getUserSessions() {
     return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetUserSessions>('getUserSessions');
   }
@@ -216,32 +208,108 @@ export class IdpRequests {
     return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_UpdateAppRoleMappings>('updateAppRoleMappings');
   }
 
-  public get getBillingPlan() {
-    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetBillingPlan>('getBillingPlan');
+  public get getGlobalApps() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetGlobalApps>('getGlobalApps');
   }
 
-  public get getPaddleConfig() {
-    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetPaddleConfig>('getPaddleConfig');
+  public get getAppConnections() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetAppConnections>('getAppConnections');
   }
 
-  public get getPublicKeyForValidation() {
-    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetPublicKeyForValidation>('getPublicKeyForValidation');
+  public get toggleAppConnection() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_ToggleAppConnection>('toggleAppConnection');
   }
 
-  public get pushPublicKeyForValidation() {
-    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_PushPublicKeyForValidation>('pushPublicKeyForValidation');
+  public get createPassportEnrollmentChallenge() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_CreatePassportEnrollmentChallenge>('createPassportEnrollmentChallenge');
   }
 
-  public get pushOrGetJwtIdBlocklist() {
-    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_PushOrGetJwtIdBlocklist>('pushOrGetJwtIdBlocklist');
+  public get completePassportEnrollment() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_CompletePassportEnrollment>('completePassportEnrollment');
   }
 
-  public get suspendUser() {
-    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_SuspendUser>('suspendUser');
+  public get getPassportDevices() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetPassportDevices>('getPassportDevices');
+  }
+
+  public get revokePassportDevice() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_RevokePassportDevice>('revokePassportDevice');
+  }
+
+  public get createPassportChallenge() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_CreatePassportChallenge>('createPassportChallenge');
+  }
+
+  public get approvePassportChallenge() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_ApprovePassportChallenge>('approvePassportChallenge');
+  }
+
+  public get rejectPassportChallenge() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_RejectPassportChallenge>('rejectPassportChallenge');
+  }
+
+  public get registerPassportPushToken() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_RegisterPassportPushToken>('registerPassportPushToken');
+  }
+
+  public get listPendingPassportChallenges() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_ListPendingPassportChallenges>('listPendingPassportChallenges');
+  }
+
+  public get getPassportChallengeByHint() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetPassportChallengeByHint>('getPassportChallengeByHint');
+  }
+
+  public get markPassportChallengeSeen() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_MarkPassportChallengeSeen>('markPassportChallengeSeen');
+  }
+
+  public get getPassportDashboard() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetPassportDashboard>('getPassportDashboard');
+  }
+
+  public get listPassportAlerts() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_ListPassportAlerts>('listPassportAlerts');
+  }
+
+  public get getPassportAlertByHint() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetPassportAlertByHint>('getPassportAlertByHint');
+  }
+
+  public get markPassportAlertSeen() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_MarkPassportAlertSeen>('markPassportAlertSeen');
   }
 
-  public get deleteSuspendedUser() {
-    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IDeleteSuspendedUser>('deleteSuspendedUser');
+  public get dismissPassportAlert() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_DismissPassportAlert>('dismissPassportAlert');
+  }
+
+  public get upsertAlertRule() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_UpsertAlertRule>('upsertAlertRule');
+  }
+
+  public get getAlertRules() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetAlertRules>('getAlertRules');
+  }
+
+  public get deleteAlertRule() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_DeleteAlertRule>('deleteAlertRule');
+  }
+
+  public get getBillingPlan() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetBillingPlan>('getBillingPlan');
+  }
+
+  public get getBillingPlansForOrganizationId() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetPlansForOrganizationId>('getBillingPlansForOrganizationId');
+  }
+
+  public get getPaddleConfig() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetPaddleConfig>('getPaddleConfig');
+  }
+
+  public get suspendUser() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_SuspendUser>('suspendUser');
   }
 
   public get checkGlobalAdmin() {