@manta-eu/auth 0.1.10 → 0.2.0

package/README.md

@@ -117,6 +117,37 @@ const getAccessToken = cachedToken(() => mintWithClientCredentials({ baseUrl, re
 
 Keep the secret on a server; never ship it to a browser.
 
+## Tokens for your app's own users
+
+A custom app with machine access gets a token for one of its own users, by the app's id for them, or
+for a visitor it has not identified, by its session id for them. Manta keeps their chats, and no
+memories:
+
+```ts
+import { cachedToken, customAppUserAccessToken } from "@manta-eu/auth/web";
+
+// One cached getter per person, so each reuses their token until it nears expiry. Evict idle entries in a real app.
+const tokens = new Map<string, () => Promise<string>>();
+const tokenFor = (userId: string) => {
+  let get = tokens.get(userId);
+  if (get === undefined) {
+    get = cachedToken(() =>
+      customAppUserAccessToken({ clientId, clientSecret, userId, name, email, teams: ["/Sales/EU"] }),
+    );
+    tokens.set(userId, get);
+  }
+  return get;
+};
+```
+
+A visitor works the same way, keyed by your session id and with `anonymousId: sessionId` in place of `userId`.
+
+It sends the app's secret, so it runs on the app's server only; the token it returns may go to the
+browser. `datastores` narrows the token to some of the datastores the app reaches. `teams` places
+the person in those teams of the app's organization: an empty list places them in none, and leaving
+it out places them in every team the app reaches. A refusal throws `RefusedRequestError`, whose
+`status` tells `isTransientStatus` whether a retry can help (429, 503) or not (401, 403).
+
 ## Issuer and discovery
 
 `issuerUrl({ baseUrl, realm })` names the realm's issuer, and `discoveryUrl({ baseUrl, realm })` its

package/dist/custom-app-user-token.d.ts

@@ -0,0 +1,33 @@
+import { type CustomAppUserProfile } from "@manta-eu/lib/custom-app";
+import { type FetchLike } from "./http.js";
+export type CustomAppUserGrantBase = {
+    /** The custom app's client ID and secret, held only by the app's server. */
+    clientId: string;
+    clientSecret: string;
+    /** Narrows the token to these datastores; leave out to reach every datastore the app reaches. */
+    datastores?: string[];
+    /**
+     * Places the person in these teams of the app's organization, by path like /Sales/EU, as a member of them. An empty
+     * list places them in no team; leaving it out places them in every team the app reaches.
+     */
+    teams?: string[];
+    /** Manta's address, https://app.hiremanta.com unless you name another deployment. */
+    apiUrl?: string;
+};
+/** A person your app knows: Manta keeps their chats under your id for them, and no memories. */
+export type IdentifiedCustomAppUser = CustomAppUserGrantBase & CustomAppUserProfile & {
+    userId: string;
+    anonymousId?: never;
+};
+/** A visitor your app has not identified, by your session id for them: they chat, and Manta keeps no memories. */
+export type AnonymousCustomAppVisitor = CustomAppUserGrantBase & {
+    anonymousId: string;
+    userId?: never;
+};
+export type CustomAppUserAccessTokenOptions = IdentifiedCustomAppUser | AnonymousCustomAppVisitor;
+/**
+ * Gets a Manta access token for one of the app's own users, or for an anonymous visitor. It sends the app's client
+ * secret, so call it on the app's server only; the token it returns may go to the browser.
+ */
+export declare function customAppUserAccessToken(options: CustomAppUserAccessTokenOptions, fetchImpl?: FetchLike): Promise<string>;
+//# sourceMappingURL=custom-app-user-token.d.ts.map

package/dist/custom-app-user-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-app-user-token.d.ts","sourceRoot":"","sources":["../src/custom-app-user-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,KAAK,oBAAoB,EAE1B,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,KAAK,SAAS,EAAyC,MAAM,WAAW,CAAC;AAElF,MAAM,MAAM,sBAAsB,GAAG;IACnC,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,iGAAiG;IACjG,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,gGAAgG;AAChG,MAAM,MAAM,uBAAuB,GAAG,sBAAsB,GAC1D,oBAAoB,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC;AAEjE,kHAAkH;AAClH,MAAM,MAAM,yBAAyB,GAAG,sBAAsB,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC;AAEzG,MAAM,MAAM,+BAA+B,GAAG,uBAAuB,GAAG,yBAAyB,CAAC;AAoBlG;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,+BAA+B,EACxC,SAAS,GAAE,SAAiB,GAC3B,OAAO,CAAC,MAAM,CAAC,CAoCjB"}

package/dist/custom-app-user-token.js

@@ -0,0 +1,56 @@
+import { customAppClientIdProblem, customAppUserDatastoresProblem, customAppUserIdProblem, customAppUserProfileProblem, customAppUserTeamsProblem, customAppUserTokenPath, } from "@manta-eu/lib/custom-app";
+import { isPresent } from "@manta-eu/lib/present";
+import { defaultDeployment } from "./default-deployment.js";
+import { postTo, readJson, RefusedRequestError } from "./http.js";
+function requestFor(options) {
+    const { clientId, clientSecret, datastores, teams } = options;
+    const narrowed = { ...(datastores === undefined ? {} : { datastores }), ...(teams === undefined ? {} : { teams }) };
+    if (options.userId === undefined) {
+        return { client_id: clientId, client_secret: clientSecret, anonymous_id: options.anonymousId, ...narrowed };
+    }
+    const { userId, name, email, fields } = options;
+    return {
+        client_id: clientId,
+        client_secret: clientSecret,
+        user_id: userId,
+        ...(name === undefined ? {} : { name }),
+        ...(email === undefined ? {} : { email }),
+        ...(fields === undefined ? {} : { fields }),
+        ...narrowed,
+    };
+}
+/**
+ * Gets a Manta access token for one of the app's own users, or for an anonymous visitor. It sends the app's client
+ * secret, so call it on the app's server only; the token it returns may go to the browser.
+ */
+export async function customAppUserAccessToken(options, fetchImpl = fetch) {
+    if (typeof globalThis.document !== "undefined") {
+        throw new Error("customAppUserAccessToken runs on your server only: it sends the app's client secret");
+    }
+    const clientIdProblem = customAppClientIdProblem(options.clientId);
+    if (clientIdProblem !== undefined)
+        throw new Error(clientIdProblem);
+    if (!isPresent(options.clientSecret))
+        throw new Error("The app's client secret is required");
+    const problem = customAppUserIdProblem(options.userId ?? options.anonymousId) ??
+        customAppUserDatastoresProblem(options.datastores) ??
+        customAppUserTeamsProblem(options.teams) ??
+        (options.userId === undefined ? undefined : customAppUserProfileProblem(options));
+    if (problem !== undefined)
+        throw new Error(problem);
+    const endpoint = new URL(customAppUserTokenPath, options.apiUrl ?? defaultDeployment.apiUrl).toString();
+    const response = await postTo(endpoint, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Accept: "application/json" },
+        body: JSON.stringify(requestFor(options)),
+    }, fetchImpl);
+    if (!response.ok) {
+        const refusal = await readJson(response, endpoint).catch(() => ({}));
+        throw new RefusedRequestError(`Manta refused the custom app user token (${response.status}). ${refusal.error_description ?? ""}`.trim(), response.status);
+    }
+    const body = await readJson(response, endpoint);
+    if (typeof body.access_token !== "string")
+        throw new Error("Manta answered without an access token");
+    return body.access_token;
+}
+//# sourceMappingURL=custom-app-user-token.js.map

package/dist/custom-app-user-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-app-user-token.js","sourceRoot":"","sources":["../src/custom-app-user-token.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,sBAAsB,EACtB,2BAA2B,EAC3B,yBAAyB,EACzB,sBAAsB,GAGvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAkB,MAAM,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AA0BlF,SAAS,UAAU,CAAC,OAAwC;IAC1D,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAC9D,MAAM,QAAQ,GAAG,EAAE,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACpH,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,GAAG,QAAQ,EAAE,CAAC;IAC9G,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAChD,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,aAAa,EAAE,YAAY;QAC3B,OAAO,EAAE,MAAM;QACf,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,GAAG,QAAQ;KACZ,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAwC,EACxC,YAAuB,KAAK;IAE5B,IAAI,OAAQ,UAAqC,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,eAAe,GAAG,wBAAwB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,eAAe,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;IACpE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC7F,MAAM,OAAO,GACX,sBAAsB,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,WAAW,CAAC;QAC7D,8BAA8B,CAAC,OAAO,CAAC,UAAU,CAAC;QAClD,yBAAyB,CAAC,OAAO,CAAC,KAAK,CAAC;QACxC,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC;IACpF,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAEpD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,sBAAsB,EAAE,OAAO,CAAC,MAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxG,MAAM,QAAQ,GAAG,MAAM,MAAM,CAC3B,QAAQ,EACR;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;KAC1C,EACD,SAAS,CACV,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAiC,QAAQ,EAAE,QAAQ,CAAC,CAAC,KAAK,CACtF,GAAmC,EAAE,CAAC,CAAC,EAAE,CAAC,CAC3C,CAAC;QACF,MAAM,IAAI,mBAAmB,CAC3B,4CAA4C,QAAQ,CAAC,MAAM,MAAM,OAAO,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EACzG,QAAQ,CAAC,MAAM,CAChB,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAA4B,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC3E,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACrG,OAAO,IAAI,CAAC,YAAY,CAAC;AAC3B,CAAC"}

package/dist/index.d.ts

@@ -9,4 +9,5 @@ export { cachedToken, mintWithClientCredentials, withRenewal, type ClientCredent
 export { discoveryUrl, issuerUrl, type OidcClient, type Realm } from "./oidc.js";
 export { endWebLogin, finishWebLogin, refreshWebLogin, startWebLogin, webLogoutUrl, type StartWebLoginOptions, type WebLoginStart, type WebLogoutOptions, type WebTokens, } from "./web-login.js";
 export { webLoginRoutes, type WebLoginRoutes, type WebLoginRoutesOptions, type WebSession } from "./web-routes.js";
+export { customAppUserAccessToken, type AnonymousCustomAppVisitor, type CustomAppUserAccessTokenOptions, type CustomAppUserGrantBase, type IdentifiedCustomAppUser, } from "./custom-app-user-token.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,KAAK,EACL,WAAW,EACX,MAAM,EACN,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,WAAW,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,KAAK,GACX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AACpH,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EACL,WAAW,EACX,yBAAyB,EACzB,WAAW,EACX,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,UAAU,EAAE,KAAK,KAAK,EAAE,MAAM,WAAW,CAAC;AACjF,OAAO,EACL,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,YAAY,EACZ,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,SAAS,GACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,KAAK,cAAc,EAAE,KAAK,qBAAqB,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,KAAK,EACL,WAAW,EACX,MAAM,EACN,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,WAAW,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,KAAK,GACX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AACpH,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EACL,WAAW,EACX,yBAAyB,EACzB,WAAW,EACX,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,UAAU,EAAE,KAAK,KAAK,EAAE,MAAM,WAAW,CAAC;AACjF,OAAO,EACL,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,YAAY,EACZ,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,SAAS,GACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,KAAK,cAAc,EAAE,KAAK,qBAAqB,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACnH,OAAO,EACL,wBAAwB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,+BAA+B,EACpC,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,4BAA4B,CAAC"}

package/dist/index.js

@@ -9,4 +9,5 @@ export { cachedToken, mintWithClientCredentials, withRenewal, } from "./token.js
 export { discoveryUrl, issuerUrl } from "./oidc.js";
 export { endWebLogin, finishWebLogin, refreshWebLogin, startWebLogin, webLogoutUrl, } from "./web-login.js";
 export { webLoginRoutes } from "./web-routes.js";
+export { customAppUserAccessToken, } from "./custom-app-user-token.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,KAAK,EACL,WAAW,EACX,MAAM,EACN,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,GAGhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,GAKzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,GAMjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,EAAkB,MAAM,WAAW,CAAC;AACpH,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EACL,WAAW,EACX,yBAAyB,EACzB,WAAW,GAIZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,SAAS,EAA+B,MAAM,WAAW,CAAC;AACjF,OAAO,EACL,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,YAAY,GAKb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAoE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,KAAK,EACL,WAAW,EACX,MAAM,EACN,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,GAGhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,GAKzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,GAMjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,EAAkB,MAAM,WAAW,CAAC;AACpH,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EACL,WAAW,EACX,yBAAyB,EACzB,WAAW,GAIZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,SAAS,EAA+B,MAAM,WAAW,CAAC;AACjF,OAAO,EACL,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,YAAY,GAKb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAoE,MAAM,iBAAiB,CAAC;AACnH,OAAO,EACL,wBAAwB,GAKzB,MAAM,4BAA4B,CAAC"}

package/dist/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,KAAK,EAAkB,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,KAAK,SAAS,EAA4C,MAAM,WAAW,CAAC;AAErF,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;AAGhD,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG;IAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,CAAC;AAOxF,wBAAsB,WAAW,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAY9G;AAGD,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAG1C,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAE3C,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpE;AA0BD,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAI7E;AAED,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK3E;AAED,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAE/D;AAqBD,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,iBAAiB,EAC9B,SAAS,GAAE,SAAiB,GAC3B,OAAO,CAAC,MAAM,CAAC,CAajB;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,GAAE,MAAM,MAAiB,GAAG,oBAAoB,CA6BnG"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,KAAK,EAAkB,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,KAAK,SAAS,EAA4C,MAAM,WAAW,CAAC;AAErF,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;AAGhD,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG;IAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,CAAC;AAOxF,wBAAsB,WAAW,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAY9G;AAGD,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAG1C,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAE3C,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpE;AA0BD,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAI7E;AAED,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK3E;AAED,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAE/D;AAqBD,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,iBAAiB,EAC9B,SAAS,GAAE,SAAiB,GAC3B,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,GAAE,MAAM,MAAiB,GAAG,oBAAoB,CA6BnG"}

package/dist/token.js

@@ -77,8 +77,11 @@ export async function mintWithClientCredentials(credentials, fetchImpl = fetch)
     const endpoint = tokenEndpoint(baseUrl, realm);
     const response = await postTo(endpoint, clientCredentialsRequest(credentials), fetchImpl);
     if (!response.ok) {
+        const { error } = (await response.json().catch(() => ({})));
         throw new Error(`Keycloak refused the client credentials for realm ${realm} with status ${response.status}. ` +
-            `Check the client id and the secret against ${endpoint}.`);
+            (error === "unauthorized_client"
+                ? "This client may not mint tokens on its own: for a custom app, turn on Machine access."
+                : `Check the client id and the secret against ${endpoint}.`));
     }
     return readAccessToken(await response.json(), realm);
 }

package/dist/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAkB,WAAW,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAarF,SAAS,WAAW,CAAC,KAAkB;IACrC,OAAO,OAAQ,KAAuC,CAAC,KAAK,KAAK,UAAU,CAAC;AAC9E,CAAC;AAED,kHAAkH;AAClH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAI,KAAkB,EAAE,IAAyC;IAChG,IAAI,WAA+B,CAAC;IACpC,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,KAAK,EAAE,CAAC;QAC5B,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,mBAAmB,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAExG,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAEzB,OAAO,IAAI,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAE1C,gFAAgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAE3C,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,KAAa;IAC1D,OAAO,GAAG,OAAO,WAAW,KAAK,gCAAgC,CAAC;AACpE,CAAC;AAED,gFAAgF;AAChF,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,MAAM,GAAG,KAAK;SACjB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,mGAAmG;AACnG,SAAS,gBAAgB,CAAC,WAAmB;IAC3C,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1C,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAExB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QAE7D,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,WAAmB,EAAE,GAAW;IACnE,MAAM,GAAG,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC;IAE9C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,GAAG,GAAG,oBAAoB,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,KAAK,CAAC;IAEvD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,SAAiB,EAAE,GAAW;IACpD,OAAO,SAAS,GAAG,GAAG,CAAC;AACzB,CAAC;AAED,SAAS,wBAAwB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAqB;IACpF,OAAO,WAAW,CAAC;QACjB,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,QAAQ;QACnB,aAAa,EAAE,YAAY;QAC3B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,IAAa,EAAE,KAAa;IACnD,MAAM,WAAW,GAAI,IAAmC,CAAC,YAAY,CAAC;IAEtE,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,2BAA2B,CAAC,CAAC;IACvF,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,WAA8B,EAC9B,YAAuB,KAAK;IAE5B,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,wBAAwB,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,CAAC;IAE1F,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,qDAAqD,KAAK,gBAAgB,QAAQ,CAAC,MAAM,IAAI;YAC3F,8CAA8C,QAAQ,GAAG,CAC5D,CAAC;IACJ,CAAC;IAED,OAAO,eAAe,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAiB,EAAE,QAAsB,IAAI,CAAC,GAAG;IAC3E,IAAI,IAAsD,CAAC;IAC3D,+GAA+G;IAC/G,IAAI,OAAoC,CAAC;IAEzC,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC;QAC3B,mFAAmF;QACnF,IAAI,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,oBAAoB,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAElE,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;QACxB,IAAI,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;QAEhE,MAAM,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACnD,IAAI,OAAO,KAAK,OAAO;gBAAE,OAAO,GAAG,SAAS,CAAC;QAC/C,CAAC,CAAC,CAAC,CAAC;QAEJ,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE;QAC3B,2FAA2F;QAC3F,KAAK,EAAE,CAAC,QAAiB,EAAE,EAAE;YAC3B,IAAI,QAAQ,KAAK,SAAS,IAAI,IAAI,EAAE,KAAK,KAAK,QAAQ;gBAAE,IAAI,GAAG,SAAS,CAAC;QAC3E,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAkB,WAAW,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAarF,SAAS,WAAW,CAAC,KAAkB;IACrC,OAAO,OAAQ,KAAuC,CAAC,KAAK,KAAK,UAAU,CAAC;AAC9E,CAAC;AAED,kHAAkH;AAClH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAI,KAAkB,EAAE,IAAyC;IAChG,IAAI,WAA+B,CAAC;IACpC,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,KAAK,EAAE,CAAC;QAC5B,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,mBAAmB,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAExG,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAEzB,OAAO,IAAI,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAE1C,gFAAgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAE3C,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,KAAa;IAC1D,OAAO,GAAG,OAAO,WAAW,KAAK,gCAAgC,CAAC;AACpE,CAAC;AAED,gFAAgF;AAChF,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,MAAM,GAAG,KAAK;SACjB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,mGAAmG;AACnG,SAAS,gBAAgB,CAAC,WAAmB;IAC3C,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1C,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAExB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QAE7D,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,WAAmB,EAAE,GAAW;IACnE,MAAM,GAAG,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC;IAE9C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,GAAG,GAAG,oBAAoB,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,KAAK,CAAC;IAEvD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,SAAiB,EAAE,GAAW;IACpD,OAAO,SAAS,GAAG,GAAG,CAAC;AACzB,CAAC;AAED,SAAS,wBAAwB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAqB;IACpF,OAAO,WAAW,CAAC;QACjB,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,QAAQ;QACnB,aAAa,EAAE,YAAY;QAC3B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,IAAa,EAAE,KAAa;IACnD,MAAM,WAAW,GAAI,IAAmC,CAAC,YAAY,CAAC;IAEtE,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,2BAA2B,CAAC,CAAC;IACvF,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,WAA8B,EAC9B,YAAuB,KAAK;IAE5B,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,wBAAwB,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,CAAC;IAE1F,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAwB,CAAC;QACnF,MAAM,IAAI,KAAK,CACb,qDAAqD,KAAK,gBAAgB,QAAQ,CAAC,MAAM,IAAI;YAC3F,CAAC,KAAK,KAAK,qBAAqB;gBAC9B,CAAC,CAAC,uFAAuF;gBACzF,CAAC,CAAC,8CAA8C,QAAQ,GAAG,CAAC,CACjE,CAAC;IACJ,CAAC;IAED,OAAO,eAAe,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAiB,EAAE,QAAsB,IAAI,CAAC,GAAG;IAC3E,IAAI,IAAsD,CAAC;IAC3D,+GAA+G;IAC/G,IAAI,OAAoC,CAAC;IAEzC,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC;QAC3B,mFAAmF;QACnF,IAAI,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,oBAAoB,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAElE,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;QACxB,IAAI,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;QAEhE,MAAM,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACnD,IAAI,OAAO,KAAK,OAAO;gBAAE,OAAO,GAAG,SAAS,CAAC;QAC/C,CAAC,CAAC,CAAC,CAAC;QAEJ,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE;QAC3B,2FAA2F;QAC3F,KAAK,EAAE,CAAC,QAAiB,EAAE,EAAE;YAC3B,IAAI,QAAQ,KAAK,SAAS,IAAI,IAAI,EAAE,KAAK,KAAK,QAAQ;gBAAE,IAAI,GAAG,SAAS,CAAC;QAC3E,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/web.d.ts

@@ -5,4 +5,5 @@ export { discoveryUrl, issuerUrl, type OidcClient, type Realm } from "./oidc.js"
 export { accessTokenExpiresAt, cachedToken, mintWithClientCredentials, withRenewal, type ClientCredentials, type RenewableTokenSource, type TokenSource, } from "./token.js";
 export { endWebLogin, finishWebLogin, refreshWebLogin, startWebLogin, webLogoutUrl, type StartWebLoginOptions, type WebLoginStart, type WebLogoutOptions, type WebTokens, } from "./web-login.js";
 export { webLoginRoutes, type WebLoginRoutes, type WebLoginRoutesOptions, type WebSession } from "./web-routes.js";
+export { customAppUserAccessToken, type AnonymousCustomAppVisitor, type CustomAppUserAccessTokenOptions, type CustomAppUserGrantBase, type IdentifiedCustomAppUser, } from "./custom-app-user-token.js";
 //# sourceMappingURL=web.d.ts.map

package/dist/web.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"web.d.ts","sourceRoot":"","sources":["../src/web.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAClG,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,UAAU,EAAE,KAAK,KAAK,EAAE,MAAM,WAAW,CAAC;AACjF,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,yBAAyB,EACzB,WAAW,EACX,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,YAAY,EACZ,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,SAAS,GACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,KAAK,cAAc,EAAE,KAAK,qBAAqB,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"web.d.ts","sourceRoot":"","sources":["../src/web.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAClG,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,UAAU,EAAE,KAAK,KAAK,EAAE,MAAM,WAAW,CAAC;AACjF,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,yBAAyB,EACzB,WAAW,EACX,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,YAAY,EACZ,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,SAAS,GACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,KAAK,cAAc,EAAE,KAAK,qBAAqB,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACnH,OAAO,EACL,wBAAwB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,+BAA+B,EACpC,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,4BAA4B,CAAC"}

package/dist/web.js

@@ -4,4 +4,5 @@ export { discoveryUrl, issuerUrl } from "./oidc.js";
 export { accessTokenExpiresAt, cachedToken, mintWithClientCredentials, withRenewal, } from "./token.js";
 export { endWebLogin, finishWebLogin, refreshWebLogin, startWebLogin, webLogoutUrl, } from "./web-login.js";
 export { webLoginRoutes } from "./web-routes.js";
+export { customAppUserAccessToken, } from "./custom-app-user-token.js";
 //# sourceMappingURL=web.js.map

package/dist/web.js.map

@@ -1 +1 @@
-{"version":3,"file":"web.js","sourceRoot":"","sources":["../src/web.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,mBAAmB,EAAkB,MAAM,WAAW,CAAC;AAClG,OAAO,EAAE,YAAY,EAAE,SAAS,EAA+B,MAAM,WAAW,CAAC;AACjF,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,yBAAyB,EACzB,WAAW,GAIZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,YAAY,GAKb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAoE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"web.js","sourceRoot":"","sources":["../src/web.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,mBAAmB,EAAkB,MAAM,WAAW,CAAC;AAClG,OAAO,EAAE,YAAY,EAAE,SAAS,EAA+B,MAAM,WAAW,CAAC;AACjF,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,yBAAyB,EACzB,WAAW,GAIZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,YAAY,GAKb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAoE,MAAM,iBAAiB,CAAC;AACnH,OAAO,EACL,wBAAwB,GAKzB,MAAM,4BAA4B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@manta-eu/auth",
-  "version": "0.1.10",
+  "version": "0.2.0",
   "description": "Keycloak login for the SDK CLIs: browser and device-code login, silent token renewal, and credential storage; plus the default deployment the SDK targets",
   "homepage": "https://developers.manta.eu",
   "keywords": [
@@ -30,7 +30,8 @@
   "dependencies": {
     "commander": "^15.0.0",
     "jose": "^6.2.12",
-    "openid-client": "^6.8.8"
+    "openid-client": "^6.8.8",
+    "@manta-eu/lib": "0.2.0"
   },
   "devDependencies": {
     "@types/node": "^24.13.3",

package/src/custom-app-user-token.ts

@@ -0,0 +1,100 @@
+import {
+  customAppClientIdProblem,
+  customAppUserDatastoresProblem,
+  customAppUserIdProblem,
+  customAppUserProfileProblem,
+  customAppUserTeamsProblem,
+  customAppUserTokenPath,
+  type CustomAppUserProfile,
+  type CustomAppUserTokenRequest,
+} from "@manta-eu/lib/custom-app";
+import { isPresent } from "@manta-eu/lib/present";
+import { defaultDeployment } from "./default-deployment.js";
+import { type FetchLike, postTo, readJson, RefusedRequestError } from "./http.js";
+
+export type CustomAppUserGrantBase = {
+  /** The custom app's client ID and secret, held only by the app's server. */
+  clientId: string;
+  clientSecret: string;
+  /** Narrows the token to these datastores; leave out to reach every datastore the app reaches. */
+  datastores?: string[];
+  /**
+   * Places the person in these teams of the app's organization, by path like /Sales/EU, as a member of them. An empty
+   * list places them in no team; leaving it out places them in every team the app reaches.
+   */
+  teams?: string[];
+  /** Manta's address, https://app.hiremanta.com unless you name another deployment. */
+  apiUrl?: string;
+};
+
+/** A person your app knows: Manta keeps their chats under your id for them, and no memories. */
+export type IdentifiedCustomAppUser = CustomAppUserGrantBase &
+  CustomAppUserProfile & { userId: string; anonymousId?: never };
+
+/** A visitor your app has not identified, by your session id for them: they chat, and Manta keeps no memories. */
+export type AnonymousCustomAppVisitor = CustomAppUserGrantBase & { anonymousId: string; userId?: never };
+
+export type CustomAppUserAccessTokenOptions = IdentifiedCustomAppUser | AnonymousCustomAppVisitor;
+
+function requestFor(options: CustomAppUserAccessTokenOptions): CustomAppUserTokenRequest {
+  const { clientId, clientSecret, datastores, teams } = options;
+  const narrowed = { ...(datastores === undefined ? {} : { datastores }), ...(teams === undefined ? {} : { teams }) };
+  if (options.userId === undefined) {
+    return { client_id: clientId, client_secret: clientSecret, anonymous_id: options.anonymousId, ...narrowed };
+  }
+  const { userId, name, email, fields } = options;
+  return {
+    client_id: clientId,
+    client_secret: clientSecret,
+    user_id: userId,
+    ...(name === undefined ? {} : { name }),
+    ...(email === undefined ? {} : { email }),
+    ...(fields === undefined ? {} : { fields }),
+    ...narrowed,
+  };
+}
+
+/**
+ * Gets a Manta access token for one of the app's own users, or for an anonymous visitor. It sends the app's client
+ * secret, so call it on the app's server only; the token it returns may go to the browser.
+ */
+export async function customAppUserAccessToken(
+  options: CustomAppUserAccessTokenOptions,
+  fetchImpl: FetchLike = fetch,
+): Promise<string> {
+  if (typeof (globalThis as { document?: unknown }).document !== "undefined") {
+    throw new Error("customAppUserAccessToken runs on your server only: it sends the app's client secret");
+  }
+  const clientIdProblem = customAppClientIdProblem(options.clientId);
+  if (clientIdProblem !== undefined) throw new Error(clientIdProblem);
+  if (!isPresent(options.clientSecret)) throw new Error("The app's client secret is required");
+  const problem =
+    customAppUserIdProblem(options.userId ?? options.anonymousId) ??
+    customAppUserDatastoresProblem(options.datastores) ??
+    customAppUserTeamsProblem(options.teams) ??
+    (options.userId === undefined ? undefined : customAppUserProfileProblem(options));
+  if (problem !== undefined) throw new Error(problem);
+
+  const endpoint = new URL(customAppUserTokenPath, options.apiUrl ?? defaultDeployment.apiUrl).toString();
+  const response = await postTo(
+    endpoint,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Accept: "application/json" },
+      body: JSON.stringify(requestFor(options)),
+    },
+    fetchImpl,
+  );
+  if (!response.ok) {
+    const refusal = await readJson<{ error_description?: string }>(response, endpoint).catch(
+      (): { error_description?: string } => ({}),
+    );
+    throw new RefusedRequestError(
+      `Manta refused the custom app user token (${response.status}). ${refusal.error_description ?? ""}`.trim(),
+      response.status,
+    );
+  }
+  const body = await readJson<{ access_token?: string }>(response, endpoint);
+  if (typeof body.access_token !== "string") throw new Error("Manta answered without an access token");
+  return body.access_token;
+}

package/src/index.ts

@@ -58,3 +58,10 @@ export {
   type WebTokens,
 } from "./web-login.js";
 export { webLoginRoutes, type WebLoginRoutes, type WebLoginRoutesOptions, type WebSession } from "./web-routes.js";
+export {
+  customAppUserAccessToken,
+  type AnonymousCustomAppVisitor,
+  type CustomAppUserAccessTokenOptions,
+  type CustomAppUserGrantBase,
+  type IdentifiedCustomAppUser,
+} from "./custom-app-user-token.js";

package/src/token.ts

@@ -110,9 +110,12 @@ export async function mintWithClientCredentials(
   const response = await postTo(endpoint, clientCredentialsRequest(credentials), fetchImpl);
 
   if (!response.ok) {
+    const { error } = (await response.json().catch(() => ({}))) as { error?: unknown };
     throw new Error(
       `Keycloak refused the client credentials for realm ${realm} with status ${response.status}. ` +
-        `Check the client id and the secret against ${endpoint}.`,
+        (error === "unauthorized_client"
+          ? "This client may not mint tokens on its own: for a custom app, turn on Machine access."
+          : `Check the client id and the secret against ${endpoint}.`),
     );
   }
 

package/src/web.ts

@@ -23,3 +23,10 @@ export {
   type WebTokens,
 } from "./web-login.js";
 export { webLoginRoutes, type WebLoginRoutes, type WebLoginRoutesOptions, type WebSession } from "./web-routes.js";
+export {
+  customAppUserAccessToken,
+  type AnonymousCustomAppVisitor,
+  type CustomAppUserAccessTokenOptions,
+  type CustomAppUserGrantBase,
+  type IdentifiedCustomAppUser,
+} from "./custom-app-user-token.js";