@iqauth/sdk 2.6.4 → 2.8.1

package/dist/hono.mjs

@@ -1,29 +1,37 @@
+import {
+  sanitizeReturnTo
+} from "./chunk-JRDVUWAL.mjs";
 import {
   handleCallback,
   handleRefresh,
   handleSignout,
+  handleUserinfo,
   serializeCookie
-} from "./chunk-6TDJJER7.mjs";
+} from "./chunk-WSH4SW7F.mjs";
 import {
   assertPublishableKey
-} from "./chunk-WQWBJSSS.mjs";
+} from "./chunk-HVHNYPDC.mjs";
 import {
   IQAuthClient
-} from "./chunk-W3F4JYGP.mjs";
-import "./chunk-UNYDG2L4.mjs";
+} from "./chunk-ZLJPABB7.mjs";
+import "./chunk-NUO2I65G.mjs";
 import {
   IQAuthError
-} from "./chunk-6I6RM4MN.mjs";
+} from "./chunk-6PJRLRB4.mjs";
 import "./chunk-Y6FXYEAI.mjs";
 
 // src/hono.ts
+var PKCE_COOKIE = "iqauth_pkce";
 var KNOWN_AUTH_ERRORS = /* @__PURE__ */ new Set([
   "TOKEN_INVALID",
   "TOKEN_EXPIRED",
   "TOKEN_REVOKED",
   "SESSION_EXPIRED",
   "SESSION_INVALID",
-  "AUTH_REQUIRED"
+  "AUTH_REQUIRED",
+  // Task #127 — typed `IQAuthErrorCode` taxonomy.
+  "token_invalid",
+  "token_expired"
 ]);
 function readCookieFromHeader(header, name) {
   if (!header) return void 0;
@@ -45,6 +53,36 @@ function honoResponse(hr) {
   for (const c of hr.cookies) headers.append("set-cookie", serializeCookie(c));
   return new Response(JSON.stringify(hr.body), { status: hr.status, headers });
 }
+function honoCallbackResponse(hr, requestOrigin, returnToCookieValue, returnToCookieName) {
+  const returnTo = sanitizeReturnTo(
+    returnToCookieValue || hr.body?.returnTo,
+    { currentOrigin: requestOrigin, fallback: "/" }
+  );
+  const headers = new Headers({ "Content-Type": "application/json" });
+  for (const c of hr.cookies) headers.append("set-cookie", serializeCookie(c));
+  if (hr.status < 400) {
+    headers.append("set-cookie", `${returnToCookieName}=; Path=/; Max-Age=0; SameSite=Lax`);
+  }
+  const body = { ...hr.body, returnTo };
+  return new Response(JSON.stringify(body), { status: hr.status, headers });
+}
+function honoCallbackRedirect(hr, requestOrigin, returnToCookieValue, cookieNames) {
+  const headers = new Headers();
+  for (const c of hr.cookies) headers.append("set-cookie", serializeCookie(c));
+  headers.append("set-cookie", `${cookieNames.state}=; Path=/; Max-Age=0; SameSite=Lax`);
+  headers.append("set-cookie", `${cookieNames.pkce}=; Path=/; Max-Age=0; SameSite=Lax`);
+  if (hr.status >= 400) {
+    headers.set("location", "/");
+    return new Response(null, { status: 302, headers });
+  }
+  const dest = sanitizeReturnTo(returnToCookieValue, {
+    currentOrigin: requestOrigin,
+    fallback: "/"
+  });
+  headers.append("set-cookie", `${cookieNames.returnTo}=; Path=/; Max-Age=0; SameSite=Lax`);
+  headers.set("location", dest);
+  return new Response(null, { status: 302, headers });
+}
 function iqAuth(options) {
   const parsed = assertPublishableKey(options.publishableKey, { context: "@iqauth/sdk/hono" });
   const issuer = (options.issuer ?? (parsed.iss.startsWith("http") ? parsed.iss : `https://${parsed.iss}`)).replace(/\/+$/, "");
@@ -52,6 +90,7 @@ function iqAuth(options) {
   const client = new IQAuthClient({ baseUrl: issuer, environment: "server" });
   const accessCookie = options.accessCookieName ?? "iqauth_at";
   const refreshCookie = options.refreshCookieName ?? "iqauth_rt";
+  const returnToCookie = options.returnToCookieName ?? "iqauth_return_to";
   const mount = (options.mountPath ?? "/api/iqauth").replace(/\/+$/, "");
   const mountHelpers = options.mountHelperRoutes !== false;
   const isPublic = (p) => {
@@ -62,24 +101,52 @@ function iqAuth(options) {
   return async (c, next) => {
     const url = new URL(c.req.url);
     const path = url.pathname;
+    if (options.mountUserinfo && path === `${mount}/me` && c.req.method === "GET") {
+      const auth2 = c.req.header("authorization");
+      const accessToken = auth2 && auth2.replace(/^Bearer /i, "") || readCookieFromHeader(c.req.header("cookie"), accessCookie);
+      return honoResponse(await handleUserinfo(helperConfig, { accessToken, req: c.req }));
+    }
+    if (mountHelpers && path === `${mount}/callback` && c.req.method === "GET") {
+      const cookieHeader = c.req.header("cookie");
+      const stateCookie = helperConfig.stateCookieName ?? "iqauth_state";
+      const hr = await handleCallback(helperConfig, {
+        code: url.searchParams.get("code") ?? void 0,
+        codeVerifier: readCookieFromHeader(cookieHeader, PKCE_COOKIE),
+        redirectUri: `${url.origin}${url.pathname}`,
+        state: url.searchParams.get("state") ?? void 0,
+        expectedState: readCookieFromHeader(cookieHeader, stateCookie)
+      });
+      return honoCallbackRedirect(hr, url.origin, readCookieFromHeader(cookieHeader, returnToCookie), {
+        returnTo: returnToCookie,
+        state: stateCookie,
+        pkce: PKCE_COOKIE
+      });
+    }
     if (mountHelpers && path.startsWith(mount + "/") && c.req.method === "POST") {
       const body = await c.req.json().catch(() => ({}));
       const cookieHeader = c.req.header("cookie");
       if (path === `${mount}/callback`) {
-        return honoResponse(await handleCallback(helperConfig, {
+        const hr = await handleCallback(helperConfig, {
           code: body.code,
           codeVerifier: body.codeVerifier,
-          redirectUri: body.redirectUri
-        }));
+          redirectUri: body.redirectUri,
+          // M-2: bind callback to this browser; handleCallback fails closed.
+          state: body.state,
+          expectedState: readCookieFromHeader(cookieHeader, helperConfig.stateCookieName ?? "iqauth_state")
+        });
+        return honoCallbackResponse(hr, url.origin, readCookieFromHeader(cookieHeader, returnToCookie), returnToCookie);
       }
       if (path === `${mount}/refresh`) {
         const refreshToken = body.refreshToken || readCookieFromHeader(cookieHeader, refreshCookie);
-        return honoResponse(await handleRefresh(helperConfig, { refreshToken }));
+        const idempotencyToken = c.req.header("x-iqauth-idempotency") || body.idempotencyToken;
+        return honoResponse(await handleRefresh(helperConfig, { refreshToken, idempotencyToken }));
       }
       if (path === `${mount}/signout`) {
         const auth2 = c.req.header("authorization");
         const accessToken = auth2 && auth2.replace(/^Bearer /i, "") || readCookieFromHeader(cookieHeader, accessCookie);
-        return honoResponse(await handleSignout(helperConfig, { accessToken, ssoCookieHeader: cookieHeader }));
+        const refreshToken = readCookieFromHeader(cookieHeader, refreshCookie);
+        const idempotencyToken = c.req.header("x-iqauth-idempotency");
+        return honoResponse(await handleSignout(helperConfig, { accessToken, refreshToken, idempotencyToken, ssoCookieHeader: cookieHeader }));
       }
     }
     if (isPublic(path)) return next();