@insureco/bio 0.2.0 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/dist/index.d.mts +12 -4
  2. package/dist/index.d.ts +12 -4
  3. package/dist/index.js +13 -4
  4. package/dist/index.mjs +13 -4
  5. package/package.json +1 -1
package/dist/index.d.mts CHANGED
@@ -4,7 +4,7 @@ interface BioAuthConfig {
4
4
  clientId: string;
5
5
  /** OAuth client secret (env: BIO_CLIENT_SECRET) */
6
6
  clientSecret: string;
7
- /** Bio-ID issuer URL (env: BIO_ID_URL, default: https://bio.tawa.insureco.io) */
7
+ /** Bio-ID issuer URL (env: BIO_ID_URL, default: https://bio.tawa.pro) */
8
8
  issuer?: string;
9
9
  /** Number of retry attempts on transient failures (default: 2) */
10
10
  retries?: number;
@@ -13,7 +13,7 @@ interface BioAuthConfig {
13
13
  }
14
14
  /** Configuration for BioAdmin (admin API client) */
15
15
  interface BioAdminConfig {
16
- /** Bio-ID base URL (env: BIO_ID_URL, default: https://bio.tawa.insureco.io) */
16
+ /** Bio-ID base URL (env: BIO_ID_URL, default: https://bio.tawa.pro) */
17
17
  baseUrl?: string;
18
18
  /** Internal API key for service-to-service auth (env: INTERNAL_API_KEY) */
19
19
  internalKey?: string;
@@ -32,6 +32,8 @@ interface AuthorizeOptions {
32
32
  scopes?: string[];
33
33
  /** CSRF state parameter (auto-generated if not provided) */
34
34
  state?: string;
35
+ /** Optional org slug to pre-select during authorization (for multi-org users) */
36
+ organization?: string;
35
37
  }
36
38
  /** Result from getAuthorizationUrl() */
37
39
  interface AuthorizeResult {
@@ -85,6 +87,12 @@ interface BioTokenPayload {
85
87
  permissions: string[];
86
88
  orgId?: string;
87
89
  orgSlug?: string;
90
+ /** Org-specific role slugs within the user's active org (from OrgMembership) */
91
+ orgRoles?: string[];
92
+ /** Job title at the active org (from OrgMembership.jobTitle) */
93
+ orgTitle?: string;
94
+ /** Additional modules granted by the org specifically (from OrgMembership.enabled_modules) */
95
+ orgModules?: string[];
88
96
  client_id: string;
89
97
  scope: string;
90
98
  enabled_modules?: string[];
@@ -116,9 +124,9 @@ interface VerifyOptions {
116
124
  }
117
125
  /** Options for JWKS-based JWT verification (RS256) */
118
126
  interface JWKSVerifyOptions {
119
- /** JWKS endpoint URL (default: https://bio.tawa.insureco.io/.well-known/jwks.json) */
127
+ /** JWKS endpoint URL (default: https://bio.tawa.pro/.well-known/jwks.json) */
120
128
  jwksUri?: string;
121
- /** Expected issuer — defaults to accepting both bio.insureco.io and bio.tawa.insureco.io */
129
+ /** Expected issuer — defaults to accepting bio.insureco.io, bio.tawa.insureco.io, and bio.tawa.pro */
122
130
  issuer?: string;
123
131
  /** Expected audience (client_id) */
124
132
  audience?: string;
package/dist/index.d.ts CHANGED
@@ -4,7 +4,7 @@ interface BioAuthConfig {
4
4
  clientId: string;
5
5
  /** OAuth client secret (env: BIO_CLIENT_SECRET) */
6
6
  clientSecret: string;
7
- /** Bio-ID issuer URL (env: BIO_ID_URL, default: https://bio.tawa.insureco.io) */
7
+ /** Bio-ID issuer URL (env: BIO_ID_URL, default: https://bio.tawa.pro) */
8
8
  issuer?: string;
9
9
  /** Number of retry attempts on transient failures (default: 2) */
10
10
  retries?: number;
@@ -13,7 +13,7 @@ interface BioAuthConfig {
13
13
  }
14
14
  /** Configuration for BioAdmin (admin API client) */
15
15
  interface BioAdminConfig {
16
- /** Bio-ID base URL (env: BIO_ID_URL, default: https://bio.tawa.insureco.io) */
16
+ /** Bio-ID base URL (env: BIO_ID_URL, default: https://bio.tawa.pro) */
17
17
  baseUrl?: string;
18
18
  /** Internal API key for service-to-service auth (env: INTERNAL_API_KEY) */
19
19
  internalKey?: string;
@@ -32,6 +32,8 @@ interface AuthorizeOptions {
32
32
  scopes?: string[];
33
33
  /** CSRF state parameter (auto-generated if not provided) */
34
34
  state?: string;
35
+ /** Optional org slug to pre-select during authorization (for multi-org users) */
36
+ organization?: string;
35
37
  }
36
38
  /** Result from getAuthorizationUrl() */
37
39
  interface AuthorizeResult {
@@ -85,6 +87,12 @@ interface BioTokenPayload {
85
87
  permissions: string[];
86
88
  orgId?: string;
87
89
  orgSlug?: string;
90
+ /** Org-specific role slugs within the user's active org (from OrgMembership) */
91
+ orgRoles?: string[];
92
+ /** Job title at the active org (from OrgMembership.jobTitle) */
93
+ orgTitle?: string;
94
+ /** Additional modules granted by the org specifically (from OrgMembership.enabled_modules) */
95
+ orgModules?: string[];
88
96
  client_id: string;
89
97
  scope: string;
90
98
  enabled_modules?: string[];
@@ -116,9 +124,9 @@ interface VerifyOptions {
116
124
  }
117
125
  /** Options for JWKS-based JWT verification (RS256) */
118
126
  interface JWKSVerifyOptions {
119
- /** JWKS endpoint URL (default: https://bio.tawa.insureco.io/.well-known/jwks.json) */
127
+ /** JWKS endpoint URL (default: https://bio.tawa.pro/.well-known/jwks.json) */
120
128
  jwksUri?: string;
121
- /** Expected issuer — defaults to accepting both bio.insureco.io and bio.tawa.insureco.io */
129
+ /** Expected issuer — defaults to accepting bio.insureco.io, bio.tawa.insureco.io, and bio.tawa.pro */
122
130
  issuer?: string;
123
131
  /** Expected audience (client_id) */
124
132
  audience?: string;
package/dist/index.js CHANGED
@@ -90,7 +90,7 @@ async function parseJsonResponse(response) {
90
90
  }
91
91
 
92
92
  // src/auth.ts
93
- var DEFAULT_ISSUER = "https://bio.tawa.insureco.io";
93
+ var DEFAULT_ISSUER = "https://bio.tawa.pro";
94
94
  var DEFAULT_SCOPES = ["openid", "profile", "email"];
95
95
  var DEFAULT_TIMEOUT_MS = 1e4;
96
96
  var BioAuth = class _BioAuth {
@@ -160,6 +160,9 @@ var BioAuth = class _BioAuth {
160
160
  code_challenge: codeChallenge,
161
161
  code_challenge_method: "S256"
162
162
  });
163
+ if (opts.organization) {
164
+ params.set("organization", opts.organization);
165
+ }
163
166
  return {
164
167
  url: `${this.issuer}/oauth/authorize?${params.toString()}`,
165
168
  state,
@@ -381,7 +384,7 @@ function mapIntrospectResponse(raw) {
381
384
  }
382
385
 
383
386
  // src/admin.ts
384
- var DEFAULT_BASE_URL = "https://bio.tawa.insureco.io";
387
+ var DEFAULT_BASE_URL = "https://bio.tawa.pro";
385
388
  var DEFAULT_TIMEOUT_MS2 = 1e4;
386
389
  var BioAdmin = class _BioAdmin {
387
390
  baseUrl;
@@ -587,9 +590,10 @@ var import_node_crypto3 = __toESM(require("crypto"));
587
590
  var DEFAULT_ISSUERS = [
588
591
  "https://bio.insureco.io",
589
592
  "https://bio.tawa.insureco.io",
593
+ "https://bio.tawa.pro",
590
594
  "http://localhost:6100"
591
595
  ];
592
- var DEFAULT_JWKS_URI = "https://bio.tawa.insureco.io/.well-known/jwks.json";
596
+ var DEFAULT_JWKS_URI = "https://bio.tawa.pro/.well-known/jwks.json";
593
597
  var JWKS_CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
594
598
  var jwksCache = /* @__PURE__ */ new Map();
595
599
  async function fetchJWKS(uri) {
@@ -706,7 +710,12 @@ async function verifyTokenJWKS(token, options) {
706
710
  throw new BioError("Malformed JWT: expected 3 parts", "invalid_token");
707
711
  }
708
712
  const [headerB64, payloadB64, signatureB64] = parts;
709
- const header = JSON.parse(base64UrlDecode(headerB64));
713
+ let header;
714
+ try {
715
+ header = JSON.parse(base64UrlDecode(headerB64));
716
+ } catch {
717
+ throw new BioError("Malformed JWT: invalid header encoding", "invalid_token");
718
+ }
710
719
  if (header.alg !== "RS256") {
711
720
  throw new BioError(
712
721
  `Expected RS256 token, got ${header.alg}. Use verifyToken() for HS256.`,
package/dist/index.mjs CHANGED
@@ -47,7 +47,7 @@ async function parseJsonResponse(response) {
47
47
  }
48
48
 
49
49
  // src/auth.ts
50
- var DEFAULT_ISSUER = "https://bio.tawa.insureco.io";
50
+ var DEFAULT_ISSUER = "https://bio.tawa.pro";
51
51
  var DEFAULT_SCOPES = ["openid", "profile", "email"];
52
52
  var DEFAULT_TIMEOUT_MS = 1e4;
53
53
  var BioAuth = class _BioAuth {
@@ -117,6 +117,9 @@ var BioAuth = class _BioAuth {
117
117
  code_challenge: codeChallenge,
118
118
  code_challenge_method: "S256"
119
119
  });
120
+ if (opts.organization) {
121
+ params.set("organization", opts.organization);
122
+ }
120
123
  return {
121
124
  url: `${this.issuer}/oauth/authorize?${params.toString()}`,
122
125
  state,
@@ -338,7 +341,7 @@ function mapIntrospectResponse(raw) {
338
341
  }
339
342
 
340
343
  // src/admin.ts
341
- var DEFAULT_BASE_URL = "https://bio.tawa.insureco.io";
344
+ var DEFAULT_BASE_URL = "https://bio.tawa.pro";
342
345
  var DEFAULT_TIMEOUT_MS2 = 1e4;
343
346
  var BioAdmin = class _BioAdmin {
344
347
  baseUrl;
@@ -544,9 +547,10 @@ import crypto3 from "crypto";
544
547
  var DEFAULT_ISSUERS = [
545
548
  "https://bio.insureco.io",
546
549
  "https://bio.tawa.insureco.io",
550
+ "https://bio.tawa.pro",
547
551
  "http://localhost:6100"
548
552
  ];
549
- var DEFAULT_JWKS_URI = "https://bio.tawa.insureco.io/.well-known/jwks.json";
553
+ var DEFAULT_JWKS_URI = "https://bio.tawa.pro/.well-known/jwks.json";
550
554
  var JWKS_CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
551
555
  var jwksCache = /* @__PURE__ */ new Map();
552
556
  async function fetchJWKS(uri) {
@@ -663,7 +667,12 @@ async function verifyTokenJWKS(token, options) {
663
667
  throw new BioError("Malformed JWT: expected 3 parts", "invalid_token");
664
668
  }
665
669
  const [headerB64, payloadB64, signatureB64] = parts;
666
- const header = JSON.parse(base64UrlDecode(headerB64));
670
+ let header;
671
+ try {
672
+ header = JSON.parse(base64UrlDecode(headerB64));
673
+ } catch {
674
+ throw new BioError("Malformed JWT: invalid header encoding", "invalid_token");
675
+ }
667
676
  if (header.alg !== "RS256") {
668
677
  throw new BioError(
669
678
  `Expected RS256 token, got ${header.alg}. Use verifyToken() for HS256.`,
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@insureco/bio",
3
- "version": "0.2.0",
3
+ "version": "0.3.0",
4
4
  "description": "SDK for Bio-ID SSO integration on the Tawa platform",
5
5
  "main": "dist/index.js",
6
6
  "module": "dist/index.mjs",