@manta-eu/auth 0.1.8 → 0.1.10

package/dist/web-routes.d.ts

@@ -0,0 +1,42 @@
+import type { FetchLike } from "./http.js";
+import type { OidcClient } from "./oidc.js";
+export type WebLoginRoutesOptions = {
+    /** A confidential client: a custom app's client ID and secret, plus `baseUrl` and `realm` off hiremanta.com. */
+    client: OidcClient & {
+        clientSecret: string;
+    };
+    /** Where the app runs, e.g. `https://app.example.com`; `paths.callback` under it must be a registered redirect URL. */
+    appUrl: string;
+    /** At least 32 characters, kept on the server. Rotating it signs everyone out. */
+    sessionSecret: string;
+    paths?: {
+        login?: string;
+        callback?: string;
+        logout?: string;
+    };
+    /** Where people land after signing in (unless `/login?returnTo=` names a page) and after signing out. */
+    afterLogin?: string;
+    afterLogout?: string;
+    offlineAccess?: boolean;
+    idpHint?: string;
+    /** Off signs people out of this app only; on (the default) ends their Manta session too. */
+    signOutOfManta?: boolean;
+    cookieName?: string;
+    fetchImpl?: FetchLike;
+};
+export type WebSession = {
+    /** Absent when no one is signed in, or the session could not be renewed. */
+    accessToken: string | undefined;
+    idToken?: string;
+    /** Set-Cookie values to add to the response: a renewed session, or one cleared after a refused renewal. */
+    setCookies: string[];
+};
+export type WebLoginRoutes = {
+    /** Answers the login, callback and logout paths; `undefined` for any other request. */
+    handle(request: Request): Promise<Response | undefined>;
+    /** The signed-in person's access token, renewed when it is about to expire. */
+    session(request: Request): Promise<WebSession>;
+};
+/** Sign-in, callback and sign-out routes for a custom app's server, on standard Request and Response. */
+export declare function webLoginRoutes(options: WebLoginRoutesOptions): WebLoginRoutes;
+//# sourceMappingURL=web-routes.d.ts.map

package/dist/web-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-routes.d.ts","sourceRoot":"","sources":["../src/web-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAW5C,MAAM,MAAM,qBAAqB,GAAG;IAClC,gHAAgH;IAChH,MAAM,EAAE,UAAU,GAAG;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,uHAAuH;IACvH,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,yGAAyG;IACzG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4FAA4F;IAC5F,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,4EAA4E;IAC5E,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2GAA2G;IAC3G,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,uFAAuF;IACvF,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IACxD,+EAA+E;IAC/E,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAChD,CAAC;AAmFF,yGAAyG;AACzG,wBAAgB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,cAAc,CA+L7E"}

package/dist/web-routes.js

@@ -0,0 +1,248 @@
+import { EncryptJWT, jwtDecrypt } from "jose";
+import { accessTokenExpiresAt } from "./token.js";
+import { endWebLogin, finishWebLogin, refreshWebLogin, startWebLogin, webLogoutUrl, } from "./web-login.js";
+const loginTtlMs = 10 * 60 * 1000;
+const offlineCookieMaxAgeSeconds = 30 * 24 * 60 * 60;
+const chunkSize = 3800;
+const maxChunks = 10;
+const refreshReuseMs = 10_000;
+// One key per purpose, so a login cookie can never be replayed as a session cookie or the other way round.
+async function purposeKey(secret, purpose) {
+    const material = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), "HKDF", false, ["deriveKey"]);
+    return crypto.subtle.deriveKey({
+        name: "HKDF",
+        hash: "SHA-256",
+        salt: new TextEncoder().encode("manta-web-login"),
+        info: new TextEncoder().encode(purpose),
+    }, material, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+}
+async function seal(key, value, ttlMs) {
+    const jwt = new EncryptJWT({ ...value }).setProtectedHeader({ alg: "dir", enc: "A256GCM" });
+    if (ttlMs !== undefined)
+        jwt.setExpirationTime(new Date(Date.now() + ttlMs));
+    return jwt.encrypt(key);
+}
+async function unseal(key, value) {
+    if (!value)
+        return undefined;
+    try {
+        return (await jwtDecrypt(value, key)).payload;
+    }
+    catch {
+        return undefined;
+    }
+}
+function cookiesOf(request) {
+    const cookies = new Map();
+    for (const part of (request.headers.get("cookie") ?? "").split(";")) {
+        const separator = part.indexOf("=");
+        if (separator > 0)
+            cookies.set(part.slice(0, separator).trim(), part.slice(separator + 1).trim());
+    }
+    return cookies;
+}
+// Only a path on the app itself, so `/login?returnTo=` can never send people to another site.
+// A browser drops tabs and newlines from a Location, so `/\t/evil.example` would land on `//evil.example`.
+function safeReturnTo(raw, fallback, appUrl) {
+    if (!raw?.startsWith("/") || /[\p{Cc}\\]/u.test(raw))
+        return fallback;
+    const resolved = new URL(raw, appUrl);
+    // Resolving drops dot segments, so `/.//evil.example` comes out as the protocol-relative `//evil.example`.
+    if (resolved.origin !== appUrl.origin || resolved.pathname.startsWith("//"))
+        return fallback;
+    return `${resolved.pathname}${resolved.search}${resolved.hash}`;
+}
+function isStoredSession(value) {
+    return typeof value === "object" && value !== null && typeof value.accessToken === "string";
+}
+function isPendingLogin(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const login = value;
+    return typeof login.state === "string" && typeof login.verifier === "string" && typeof login.returnTo === "string";
+}
+function redirect(location, setCookies = []) {
+    const headers = new Headers({ location, "cache-control": "no-store" });
+    for (const cookie of setCookies)
+        headers.append("set-cookie", cookie);
+    return new Response(null, { status: 302, headers });
+}
+/** Sign-in, callback and sign-out routes for a custom app's server, on standard Request and Response. */
+export function webLoginRoutes(options) {
+    if (options.sessionSecret.length < 32)
+        throw new Error("sessionSecret must be at least 32 characters");
+    const appUrl = new URL(options.appUrl);
+    const secure = appUrl.protocol === "https:";
+    const paths = { login: "/login", callback: "/callback", logout: "/logout", ...options.paths };
+    const afterLogin = options.afterLogin ?? "/";
+    const afterLogout = options.afterLogout ?? "/";
+    const redirectUri = new URL(paths.callback, appUrl).toString();
+    const sessionName = options.cookieName ?? "manta_session";
+    const loginName = `${sessionName}_login`;
+    const keys = {
+        session: purposeKey(options.sessionSecret, "session"),
+        login: purposeKey(options.sessionSecret, "login"),
+    };
+    const { client, fetchImpl } = options;
+    // Keycloak takes a refresh token at most twice, so requests racing one expired session share one refresh,
+    // and so do requests that arrive with the old cookie shortly after it.
+    const refreshes = new Map();
+    function refreshOnce(refreshToken) {
+        const now = Date.now();
+        for (const [token, { settledAt }] of refreshes) {
+            if (settledAt !== undefined && now - settledAt > refreshReuseMs)
+                refreshes.delete(token);
+        }
+        const known = refreshes.get(refreshToken);
+        if (known)
+            return known.renewed;
+        const entry = { renewed: refreshWebLogin(client, refreshToken, fetchImpl) };
+        refreshes.set(refreshToken, entry);
+        void entry.renewed.then((tokens) => {
+            entry.settledAt = Date.now();
+            entry.nextRefreshToken = tokens?.refreshToken;
+        }, () => refreshes.delete(refreshToken));
+        return entry.renewed;
+    }
+    // A signed-out session must not come back through a refresh shared with a request that still holds an older cookie.
+    function forgetRefreshes(endedRefreshToken) {
+        const ended = new Set([endedRefreshToken]);
+        for (const [token, { nextRefreshToken }] of [...refreshes].reverse()) {
+            if (ended.has(token) || (nextRefreshToken !== undefined && ended.has(nextRefreshToken))) {
+                ended.add(token);
+                refreshes.delete(token);
+            }
+        }
+    }
+    function cookie(name, value, extra = {}) {
+        const attributes = [`${name}=${value}`, `Path=${extra.path ?? "/"}`, "HttpOnly", "SameSite=Lax"];
+        if (secure)
+            attributes.push("Secure");
+        if (extra.maxAge !== undefined)
+            attributes.push(`Max-Age=${extra.maxAge}`);
+        return attributes.join("; ");
+    }
+    function clearedSession(cookies) {
+        return [...cookies.keys()]
+            .filter((name) => name.startsWith(`${sessionName}.`))
+            .map((name) => cookie(name, "", { maxAge: 0 }));
+    }
+    async function sessionCookies(stored, cookies) {
+        const value = await seal(await keys.session, stored);
+        const chunks = Math.ceil(value.length / chunkSize);
+        if (chunks > maxChunks)
+            throw new Error("The session is too large to keep in cookies");
+        const maxAge = options.offlineAccess === true ? offlineCookieMaxAgeSeconds : undefined;
+        const written = Array.from({ length: chunks }, (_, index) => cookie(`${sessionName}.${index}`, value.slice(index * chunkSize, (index + 1) * chunkSize), {
+            ...(maxAge === undefined ? {} : { maxAge }),
+        }));
+        const stale = [...cookies.keys()]
+            .filter((name) => name.startsWith(`${sessionName}.`) && Number(name.slice(sessionName.length + 1)) >= chunks)
+            .map((name) => cookie(name, "", { maxAge: 0 }));
+        return [...written, ...stale];
+    }
+    async function storedSession(cookies) {
+        let value = "";
+        for (let index = 0; cookies.has(`${sessionName}.${index}`); index += 1) {
+            value += cookies.get(`${sessionName}.${index}`);
+        }
+        const stored = await unseal(await keys.session, value);
+        return isStoredSession(stored) ? stored : undefined;
+    }
+    async function login(request) {
+        const returnTo = safeReturnTo(new URL(request.url).searchParams.get("returnTo"), afterLogin, appUrl);
+        const { url, state, verifier } = await startWebLogin(client, {
+            redirectUri,
+            ...(options.offlineAccess === true ? { offlineAccess: true } : {}),
+            ...(options.idpHint ? { idpHint: options.idpHint } : {}),
+        });
+        const sealed = await seal(await keys.login, { state, verifier, returnTo }, loginTtlMs);
+        return redirect(url, [cookie(loginName, sealed, { path: paths.callback, maxAge: loginTtlMs / 1000 })]);
+    }
+    async function callback(request) {
+        const url = new URL(request.url);
+        const cookies = cookiesOf(request);
+        const clearLogin = cookie(loginName, "", { path: paths.callback, maxAge: 0 });
+        const pending = await unseal(await keys.login, cookies.get(loginName));
+        const failed = (reason) => new Response(`Sign-in failed: ${reason}`, { status: 400, headers: { "set-cookie": clearLogin } });
+        if (url.searchParams.has("error")) {
+            return failed(url.searchParams.get("error_description") ?? url.searchParams.get("error") ?? "refused");
+        }
+        if (!isPendingLogin(pending))
+            return failed("the sign-in expired, start again");
+        if (url.searchParams.get("state") !== pending.state)
+            return failed("the sign-in does not match this browser");
+        const code = url.searchParams.get("code");
+        if (!code)
+            return failed("no code");
+        const tokens = await finishWebLogin(client, { code, redirectUri, verifier: pending.verifier, callbackUrl: url.toString(), state: pending.state }, fetchImpl);
+        const stored = {
+            accessToken: tokens.accessToken,
+            ...(tokens.refreshToken ? { refreshToken: tokens.refreshToken } : {}),
+            ...(tokens.idToken ? { idToken: tokens.idToken } : {}),
+        };
+        return redirect(pending.returnTo, [...(await sessionCookies(stored, cookies)), clearLogin]);
+    }
+    async function logout(request) {
+        const cookies = cookiesOf(request);
+        const stored = await storedSession(cookies);
+        if (stored?.refreshToken) {
+            forgetRefreshes(stored.refreshToken);
+            await endWebLogin(client, stored.refreshToken, fetchImpl);
+        }
+        // Keycloak matches this exactly against the app's redirect URLs and home URL, which has no trailing slash.
+        const landing = afterLogout === "/" ? options.appUrl.replace(/\/+$/, "") : new URL(afterLogout, appUrl).toString();
+        const target = options.signOutOfManta === false
+            ? afterLogout
+            : webLogoutUrl(client, {
+                ...(stored?.idToken ? { idToken: stored.idToken } : {}),
+                postLogoutRedirectUri: landing,
+            });
+        return redirect(target, clearedSession(cookies));
+    }
+    return {
+        async handle(request) {
+            const { pathname } = new URL(request.url);
+            if (pathname === paths.login && request.method === "GET")
+                return login(request);
+            if (pathname === paths.callback && request.method === "GET")
+                return callback(request);
+            if (pathname === paths.logout && (request.method === "GET" || request.method === "POST")) {
+                // The session cookies are SameSite=Lax, so a link from another site would otherwise sign the person out.
+                const site = request.headers.get("sec-fetch-site");
+                if (site === "cross-site" || site === "same-site")
+                    return new Response("Sign out from the app", { status: 403 });
+                return logout(request);
+            }
+            return undefined;
+        },
+        async session(request) {
+            const cookies = cookiesOf(request);
+            const stored = await storedSession(cookies);
+            if (!stored)
+                return { accessToken: undefined, setCookies: [] };
+            const now = Date.now();
+            if (accessTokenExpiresAt(stored.accessToken, now) > now) {
+                return {
+                    accessToken: stored.accessToken,
+                    ...(stored.idToken ? { idToken: stored.idToken } : {}),
+                    setCookies: [],
+                };
+            }
+            const renewed = stored.refreshToken ? await refreshOnce(stored.refreshToken) : undefined;
+            if (!renewed)
+                return { accessToken: undefined, setCookies: clearedSession(cookies) };
+            const next = {
+                accessToken: renewed.accessToken,
+                ...(renewed.refreshToken ? { refreshToken: renewed.refreshToken } : {}),
+                ...((renewed.idToken ?? stored.idToken) ? { idToken: renewed.idToken ?? stored.idToken } : {}),
+            };
+            return {
+                accessToken: next.accessToken,
+                ...(next.idToken ? { idToken: next.idToken } : {}),
+                setCookies: await sessionCookies(next, cookies),
+            };
+        },
+    };
+}
+//# sourceMappingURL=web-routes.js.map

package/dist/web-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-routes.js","sourceRoot":"","sources":["../src/web-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAmB,MAAM,MAAM,CAAC;AAG/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EACL,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,YAAY,GAEb,MAAM,gBAAgB,CAAC;AA4CxB,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAClC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACrD,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,2GAA2G;AAC3G,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,OAAe;IACvD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IACtH,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACjD,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;KACxC,EACD,QAAQ,EACR,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,GAAe,EAAE,KAAmC,EAAE,KAAc;IACtF,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,kBAAkB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IAC5F,IAAI,KAAK,KAAK,SAAS;QAAE,GAAG,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;IAC7E,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,GAAe,EAAE,KAAyB;IAC9D,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,OAAgB;IACjC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8FAA8F;AAC9F,2GAA2G;AAC3G,SAAS,YAAY,CAAC,GAAkB,EAAE,QAAgB,EAAE,MAAW;IACrE,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACtE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACtC,2GAA2G;IAC3G,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7F,OAAO,GAAG,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,OAAQ,KAAuB,CAAC,WAAW,KAAK,QAAQ,CAAC;AACjH,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,KAAK,GAAG,KAAqB,CAAC;IACpC,OAAO,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC;AACrH,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB,EAAE,aAAuB,EAAE;IAC3D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IACvE,KAAK,MAAM,MAAM,IAAI,UAAU;QAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACtE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC3D,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAEvG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC5C,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAC9F,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC;IAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC;IAC/C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/D,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,IAAI,eAAe,CAAC;IAC1D,MAAM,SAAS,GAAG,GAAG,WAAW,QAAQ,CAAC;IACzC,MAAM,IAAI,GAAG;QACX,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC;QACrD,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC;KAClD,CAAC;IACF,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IACtC,0GAA0G;IAC1G,uEAAuE;IACvE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEnD,SAAS,WAAW,CAAC,YAAoB;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,IAAI,SAAS,EAAE,CAAC;YAC/C,IAAI,SAAS,KAAK,SAAS,IAAI,GAAG,GAAG,SAAS,GAAG,cAAc;gBAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,OAAO,CAAC;QAChC,MAAM,KAAK,GAAkB,EAAE,OAAO,EAAE,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,CAAC;QAC3F,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACnC,KAAK,KAAK,CAAC,OAAO,CAAC,IAAI,CACrB,CAAC,MAAM,EAAE,EAAE;YACT,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,KAAK,CAAC,gBAAgB,GAAG,MAAM,EAAE,YAAY,CAAC;QAChD,CAAC,EACD,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CACrC,CAAC;QACF,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IAED,oHAAoH;IACpH,SAAS,eAAe,CAAC,iBAAyB;QAChD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC3C,KAAK,MAAM,CAAC,KAAK,EAAE,EAAE,gBAAgB,EAAE,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACrE,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;gBACxF,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACjB,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,MAAM,CAAC,IAAY,EAAE,KAAa,EAAE,QAA4C,EAAE;QACzF,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,QAAQ,KAAK,CAAC,IAAI,IAAI,GAAG,EAAE,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;QACjG,IAAI,MAAM;YAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,UAAU,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,SAAS,cAAc,CAAC,OAA4B;QAClD,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;aACvB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,CAAC,CAAC;aACpD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,UAAU,cAAc,CAAC,MAAqB,EAAE,OAA4B;QAC/E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;QACnD,IAAI,MAAM,GAAG,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,SAAS,CAAC;QACvF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAC1D,MAAM,CAAC,GAAG,WAAW,IAAI,KAAK,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,SAAS,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,EAAE;YACzF,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;SAC5C,CAAC,CACH,CAAC;QACF,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;aAC9B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;aAC5G,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,OAA4B;QACvD,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,WAAW,IAAI,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACvE,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,WAAW,IAAI,KAAK,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACvD,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC;IAED,KAAK,UAAU,KAAK,CAAC,OAAgB;QACnC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QACrG,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE;YAC3D,WAAW;YACX,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAyB,EAAE,UAAU,CAAC,CAAC;QAC9G,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACzG,CAAC;IAED,KAAK,UAAU,QAAQ,CAAC,OAAgB;QACtC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAChC,IAAI,QAAQ,CAAC,mBAAmB,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAEpG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,OAAO,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;YAAE,OAAO,MAAM,CAAC,kCAAkC,CAAC,CAAC;QAChF,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,KAAK;YAAE,OAAO,MAAM,CAAC,yCAAyC,CAAC,CAAC;QAC9G,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI;YAAE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;QAEpC,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,MAAM,EACN,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EACpG,SAAS,CACV,CAAC;QACF,MAAM,MAAM,GAAkB;YAC5B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvD,CAAC;QACF,OAAO,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IAC9F,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,OAAgB;QACpC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,YAAY,EAAE,CAAC;YACzB,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACrC,MAAM,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC5D,CAAC;QACD,2GAA2G;QAC3G,MAAM,OAAO,GAAG,WAAW,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnH,MAAM,MAAM,GACV,OAAO,CAAC,cAAc,KAAK,KAAK;YAC9B,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE;gBACnB,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,qBAAqB,EAAE,OAAO;aAC/B,CAAC,CAAC;QACT,OAAO,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,QAAQ,KAAK,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;YAChF,IAAI,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;YACtF,IAAI,QAAQ,KAAK,KAAK,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;gBACzF,yGAAyG;gBACzG,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBACnD,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,WAAW;oBAC/C,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBAChE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;YAE/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,oBAAoB,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC;gBACxD,OAAO;oBACL,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtD,UAAU,EAAE,EAAE;iBACf,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACzF,IAAI,CAAC,OAAO;gBAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;YAErF,MAAM,IAAI,GAAkB;gBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/F,CAAC;YACF,OAAO;gBACL,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,UAAU,EAAE,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC;aAChD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/web.d.ts

@@ -0,0 +1,8 @@
+export { defaultDeployment } from "./default-deployment.js";
+export type { PublicClient } from "./device-login.js";
+export { describeError, isTransientStatus, RefusedRequestError, type FetchLike } from "./http.js";
+export { discoveryUrl, issuerUrl, type OidcClient, type Realm } from "./oidc.js";
+export { accessTokenExpiresAt, cachedToken, mintWithClientCredentials, withRenewal, type ClientCredentials, type RenewableTokenSource, type TokenSource, } from "./token.js";
+export { endWebLogin, finishWebLogin, refreshWebLogin, startWebLogin, webLogoutUrl, type StartWebLoginOptions, type WebLoginStart, type WebLogoutOptions, type WebTokens, } from "./web-login.js";
+export { webLoginRoutes, type WebLoginRoutes, type WebLoginRoutesOptions, type WebSession } from "./web-routes.js";
+//# sourceMappingURL=web.d.ts.map

package/dist/web.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web.d.ts","sourceRoot":"","sources":["../src/web.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAClG,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,UAAU,EAAE,KAAK,KAAK,EAAE,MAAM,WAAW,CAAC;AACjF,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,yBAAyB,EACzB,WAAW,EACX,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,YAAY,EACZ,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,SAAS,GACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,KAAK,cAAc,EAAE,KAAK,qBAAqB,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/web.js

@@ -0,0 +1,7 @@
+export { defaultDeployment } from "./default-deployment.js";
+export { describeError, isTransientStatus, RefusedRequestError } from "./http.js";
+export { discoveryUrl, issuerUrl } from "./oidc.js";
+export { accessTokenExpiresAt, cachedToken, mintWithClientCredentials, withRenewal, } from "./token.js";
+export { endWebLogin, finishWebLogin, refreshWebLogin, startWebLogin, webLogoutUrl, } from "./web-login.js";
+export { webLoginRoutes } from "./web-routes.js";
+//# sourceMappingURL=web.js.map

package/dist/web.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web.js","sourceRoot":"","sources":["../src/web.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,mBAAmB,EAAkB,MAAM,WAAW,CAAC;AAClG,OAAO,EAAE,YAAY,EAAE,SAAS,EAA+B,MAAM,WAAW,CAAC;AACjF,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,yBAAyB,EACzB,WAAW,GAIZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,YAAY,GAKb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAoE,MAAM,iBAAiB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@manta-eu/auth",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Keycloak login for the SDK CLIs: browser and device-code login, silent token renewal, and credential storage; plus the default deployment the SDK targets",
   "homepage": "https://developers.manta.eu",
   "keywords": [
@@ -19,12 +19,18 @@
     "./default-deployment": {
       "types": "./dist/default-deployment.d.ts",
       "import": "./dist/default-deployment.js"
+    },
+    "./web": {
+      "types": "./dist/web.d.ts",
+      "import": "./dist/web.js"
     }
   },
   "author": "",
   "license": "MIT",
   "dependencies": {
-    "commander": "^15.0.0"
+    "commander": "^15.0.0",
+    "jose": "^6.2.12",
+    "openid-client": "^6.8.8"
   },
   "devDependencies": {
     "@types/node": "^24.13.3",
@@ -38,7 +44,12 @@
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
-    "dist"
+    "dist",
+    "src",
+    "!src/**/*.test.*",
+    "!src/**/*.stories.*",
+    "!src/**/__fixtures__",
+    "!src/coverage"
   ],
   "publishConfig": {
     "access": "public"

package/src/auth-commands.ts

@@ -0,0 +1,239 @@
+import type { Command } from "commander";
+import { browserLogin, loginScope } from "./browser-login.js";
+import { hasLocalBrowser, openInBrowser } from "./browser.js";
+import { type CredentialStore, defaultCredentialStore } from "./credential-store.js";
+import { defaultDeployment } from "./default-deployment.js";
+import {
+  createPkcePair,
+  type DeviceTokens,
+  pollForDeviceTokens,
+  type PublicClient,
+  startDeviceLogin,
+} from "./device-login.js";
+import { describeError, type FetchLike, formRequest, postTo } from "./http.js";
+import { saveLogin, storedLoginTokenSource } from "./stored-login.js";
+import { accessTokenUsername, type RenewableTokenSource } from "./token.js";
+
+export type ClientOptions = { keycloakUrl: string; keycloakRealm: string; clientId?: string };
+
+export function cliClientId(realm: string): string {
+  return `${realm}-cli`;
+}
+
+// The confidential client a CI job authenticates with through MANTA_CLIENT_SECRET.
+export const ciClientId = "manta-codegen";
+
+export const clientIdHelp = `Keycloak client id (default: <realm>-cli, or ${ciClientId} with MANTA_CLIENT_SECRET)`;
+
+export type LoginOptions = { useDeviceCode?: boolean };
+
+export function publicClientFrom({ keycloakUrl, keycloakRealm, clientId }: ClientOptions): PublicClient {
+  return {
+    baseUrl: keycloakUrl.replace(/\/+$/, ""),
+    realm: keycloakRealm,
+    clientId: clientId ?? cliClientId(keycloakRealm),
+  };
+}
+
+function warnAs(label: string): (message: string) => void {
+  return (message) => console.error(`${label}: ${message}`);
+}
+
+function where(client: PublicClient): string {
+  return `${client.realm} at ${client.baseUrl}`;
+}
+
+export async function interactiveLogin(
+  client: PublicClient,
+  {
+    label,
+    useDeviceCode = false,
+    fetchImpl = fetch,
+  }: { label: string; useDeviceCode?: boolean; fetchImpl?: FetchLike },
+): Promise<DeviceTokens> {
+  const localBrowser = hasLocalBrowser();
+
+  if (useDeviceCode || !localBrowser) {
+    const login = await startDeviceLogin(client, fetchImpl, createPkcePair(), loginScope);
+
+    console.error(`${label}: open ${login.verificationUri} and enter the code ${login.userCode}`);
+    if (localBrowser) openInBrowser(login.verificationUri);
+
+    return pollForDeviceTokens(client, login, { fetchImpl });
+  }
+
+  return browserLogin(client, {
+    fetchImpl,
+    openUrl: (url) => {
+      console.error(`${label}: log in with the browser that opened. If none did, open ${url}`);
+      openInBrowser(url);
+    },
+  });
+}
+
+export function reportLogin(label: string, client: PublicClient, tokens: DeviceTokens, saved: boolean): void {
+  const username = accessTokenUsername(tokens.accessToken);
+
+  console.error(`${label}: logged in to ${where(client)}${username ? ` as ${username}` : ""}`);
+  if (!saved) console.error(`${label}: Keycloak sent no refresh token, so the next run logs in again.`);
+}
+
+export function notLoggedIn(label: string, client: PublicClient): Error {
+  const flags = [
+    client.baseUrl === defaultDeployment.keycloakUrl ? "" : ` --keycloak-url ${client.baseUrl}`,
+    client.realm === defaultDeployment.keycloakRealm ? "" : ` --keycloak-realm ${client.realm}`,
+    client.clientId === cliClientId(client.realm) ? "" : ` --client-id ${client.clientId}`,
+  ].join("");
+
+  return new Error(`not logged in to ${where(client)}. Run: ${label} login${flags}`);
+}
+
+// A run without a terminal cannot answer a browser, so it names the command to run instead of waiting.
+export function userTokenSource(
+  client: PublicClient,
+  {
+    label,
+    useDeviceCode,
+    store = defaultCredentialStore({ warn: warnAs(label) }),
+    interactive = Boolean(process.stdin.isTTY),
+    fetchImpl = fetch,
+  }: {
+    label: string;
+    useDeviceCode?: boolean;
+    store?: CredentialStore;
+    interactive?: boolean;
+    fetchImpl?: FetchLike;
+  },
+): RenewableTokenSource {
+  return storedLoginTokenSource({
+    client,
+    store,
+    fetchImpl,
+    warn: warnAs(label),
+    login: async () => {
+      if (!interactive) throw notLoggedIn(label, client);
+
+      const tokens = await interactiveLogin(client, { label, useDeviceCode, fetchImpl });
+      reportLogin(label, client, tokens, Boolean(tokens.refreshToken));
+
+      return tokens;
+    },
+  });
+}
+
+export function revocationEndpoint(baseUrl: string, realm: string): string {
+  return `${baseUrl}/realms/${realm}/protocol/openid-connect/revoke`;
+}
+
+// Revoking the refresh token ends its offline session in Keycloak, not just this machine's copy.
+export async function revokeRefreshToken(
+  client: PublicClient,
+  refreshToken: string,
+  fetchImpl: FetchLike = fetch,
+): Promise<boolean> {
+  const request = formRequest({ token: refreshToken, token_type_hint: "refresh_token", client_id: client.clientId });
+
+  try {
+    return (await postTo(revocationEndpoint(client.baseUrl, client.realm), request, fetchImpl)).ok;
+  } catch {
+    return false;
+  }
+}
+
+export async function logIn(
+  client: PublicClient,
+  {
+    label,
+    useDeviceCode,
+    store,
+    fetchImpl = fetch,
+  }: { label: string; useDeviceCode?: boolean; store: CredentialStore; fetchImpl?: FetchLike },
+): Promise<void> {
+  const tokens = await interactiveLogin(client, { label, useDeviceCode, fetchImpl });
+
+  reportLogin(label, client, tokens, await saveLogin(store, client, tokens));
+}
+
+// The local copy goes even when Keycloak is unreachable, since a login the user asked to end must not linger here.
+export async function logOut(
+  client: PublicClient,
+  { label, store, fetchImpl = fetch }: { label: string; store: CredentialStore; fetchImpl?: FetchLike },
+): Promise<void> {
+  const stored = await store.read(client);
+
+  if (!stored) {
+    console.error(`${label}: not logged in to ${where(client)}`);
+    return;
+  }
+
+  const revoked = await revokeRefreshToken(client, stored.refreshToken, fetchImpl);
+  await store.remove(client);
+
+  console.error(
+    revoked
+      ? `${label}: logged out of ${where(client)}`
+      : `${label}: deleted the stored login for ${where(client)}, but Keycloak did not confirm the revocation.`,
+  );
+}
+
+// Reads the store only, so it answers offline; the next run finds out whether Keycloak still accepts the login.
+export async function loginStatus(
+  client: PublicClient,
+  { store }: { store: CredentialStore },
+): Promise<{ loggedIn: boolean; line: string }> {
+  const stored = await store.read(client);
+
+  if (!stored) return { loggedIn: false, line: `not logged in to ${where(client)}` };
+
+  return { loggedIn: true, line: `logged in to ${where(client)}${stored.username ? ` as ${stored.username}` : ""}` };
+}
+
+function clientCommand(program: Command, name: string, description: string): Command {
+  return program
+    .command(name)
+    .description(description)
+    .option("--keycloak-url <url>", "Keycloak base URL", defaultDeployment.keycloakUrl)
+    .option("--keycloak-realm <realm>", "Keycloak realm", defaultDeployment.keycloakRealm)
+    .option("--client-id <id>", "Keycloak client id (default: <realm>-cli)");
+}
+
+async function reportingFailure(label: string, action: () => Promise<void>): Promise<void> {
+  try {
+    await action();
+  } catch (error) {
+    console.error(`${label}: ${describeError(error)}`);
+    process.exitCode = 1;
+  }
+}
+
+// Both CLIs register the same commands over the same store, so one login serves both.
+export function registerAuthCommands(
+  program: Command,
+  {
+    label,
+    store = defaultCredentialStore({ warn: warnAs(label) }),
+    fetchImpl = fetch,
+  }: { label: string; store?: CredentialStore; fetchImpl?: FetchLike },
+): void {
+  clientCommand(program, "login", "log in once; later runs renew the stored login without a browser")
+    .option("--use-device-code", "log in with a one-time code instead of a browser redirect, e.g. over SSH")
+    .action((options: ClientOptions & LoginOptions) =>
+      reportingFailure(label, () =>
+        logIn(publicClientFrom(options), { label, useDeviceCode: options.useDeviceCode, store, fetchImpl }),
+      ),
+    );
+
+  clientCommand(program, "logout", "revoke the stored login at Keycloak and delete it").action(
+    (options: ClientOptions) =>
+      reportingFailure(label, () => logOut(publicClientFrom(options), { label, store, fetchImpl })),
+  );
+
+  clientCommand(program, "status", "show whether a login is stored").action((options: ClientOptions) =>
+    reportingFailure(label, async () => {
+      const { loggedIn, line } = await loginStatus(publicClientFrom(options), { store });
+
+      console.log(line);
+      if (!loggedIn) process.exitCode = 1;
+    }),
+  );
+}