@mdbase-dev/connect 0.1.0-beta.100

package/dist/async.d.ts

@@ -0,0 +1 @@
+export declare function abortableDelay(milliseconds: number, signal?: AbortSignal): Promise<void>;

package/dist/async.js

@@ -0,0 +1,19 @@
+export function abortableDelay(milliseconds, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted) {
+            reject(signal?.reason ?? new DOMException("Aborted", "AbortError"));
+            return;
+        }
+        const cleanup = () => signal?.removeEventListener("abort", abort);
+        const timeout = setTimeout(() => {
+            cleanup();
+            resolve();
+        }, milliseconds);
+        const abort = () => {
+            clearTimeout(timeout);
+            cleanup();
+            reject(signal?.reason ?? new DOMException("Aborted", "AbortError"));
+        };
+        signal?.addEventListener("abort", abort, { once: true });
+    });
+}

package/dist/authority-proof.d.ts

@@ -0,0 +1,3 @@
+import { type GrantKeyStore } from "./crypto.js";
+import type { StoredToken } from "./internal-types.js";
+export declare function authorityProofHeaders(keyStore: GrantKeyStore, token: StoredToken, method: string, url: string, body: string | undefined, credential: string): Promise<Record<string, string>>;

package/dist/authority-proof.js

@@ -0,0 +1,24 @@
+import { RelayCryptoError, signAuthorityRequest } from "./crypto.js";
+import { connectError, serverConnectError } from "./errors.js";
+export async function authorityProofHeaders(keyStore, token, method, url, body, credential) {
+    if (!token.authority?.proofPublicKey)
+        return {};
+    if (!token.keyHandle) {
+        throw connectError("missing_grant_key", "Reconnect this application to restore remote authority request signing.");
+    }
+    try {
+        const target = new URL(url);
+        return await signAuthorityRequest(keyStore, token.keyHandle, token.authority.proofPublicKey, {
+            method,
+            target: `${target.pathname}${target.search}`,
+            body,
+            credential
+        });
+    }
+    catch (error) {
+        if (error instanceof RelayCryptoError) {
+            throw serverConnectError(error.code, error.message);
+        }
+        throw error;
+    }
+}

package/dist/authority-sync-request.d.ts

@@ -0,0 +1,3 @@
+import type { GrantKeyStore } from "./crypto.js";
+import type { StoredToken } from "./internal-types.js";
+export declare function sendAuthoritySyncRequest(keyStore: GrantKeyStore, token: StoredToken, method: "GET" | "POST", path: string, input: unknown, signal: AbortSignal): Promise<Response>;

package/dist/authority-sync-request.js

@@ -0,0 +1,20 @@
+import { authorityProofHeaders } from "./authority-proof.js";
+import { connectError } from "./errors.js";
+export async function sendAuthoritySyncRequest(keyStore, token, method, path, input, signal) {
+    if (!token.authority) {
+        throw connectError("not_remote_authority", "This authorization has no remote authority endpoint.");
+    }
+    const url = `${token.authority.syncUrl}/${path}`;
+    const body = input === undefined ? undefined : JSON.stringify(input);
+    const proof = await authorityProofHeaders(keyStore, token, method, url, body, token.authority.accessToken);
+    return fetch(url, {
+        method,
+        headers: {
+            authorization: `Bearer ${token.authority.accessToken}`,
+            ...(input === undefined ? {} : { "content-type": "application/json" }),
+            ...proof
+        },
+        ...(body === undefined ? {} : { body }),
+        signal
+    });
+}

package/dist/authorization-refresh.d.ts

@@ -0,0 +1,14 @@
+import type { GrantKeyStore } from "./crypto.js";
+import type { StoredToken } from "./internal-types.js";
+interface AuthorizationRefreshOptions {
+    current: StoredToken | null;
+    serverUrl: string;
+    keyStore: GrantKeyStore;
+    signal?: AbortSignal;
+    currentToken(): StoredToken | null;
+    directCapable(token: StoredToken): boolean;
+    removeToken(keyHandle?: string): void;
+    storeTokenResponse(body: any, clientId: string, keyHandle?: string): StoredToken;
+}
+export declare function performAuthorizationRefresh(options: AuthorizationRefreshOptions): Promise<StoredToken>;
+export {};

package/dist/authorization-refresh.js

@@ -0,0 +1,41 @@
+import { authorityProofHeaders } from "./authority-proof.js";
+import { apiError, decodeJsonResponse, oauthErrorCode } from "./runtime-utils.js";
+import { connectError } from "./errors.js";
+export async function performAuthorizationRefresh(options) {
+    const current = options.current;
+    if (!current?.refreshToken) {
+        throw connectError("not_authorized", "Reconnect this application to continue.");
+    }
+    if ((current.refreshExpiresAt ?? 0) <= Date.now()) {
+        throw connectError("relay_authorization_expired", "Direct access is still available on this computer, but using the relay requires reconnecting this application.");
+    }
+    const attemptedRefreshToken = current.refreshToken;
+    const refreshUrl = `${options.serverUrl}/oauth/token`;
+    const refreshBody = new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: current.refreshToken,
+        client_id: current.clientId
+    }).toString();
+    const proof = current.authority
+        ? await authorityProofHeaders(options.keyStore, current, "POST", refreshUrl, refreshBody, current.refreshToken)
+        : {};
+    const response = await fetch(refreshUrl, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded", ...proof },
+        body: refreshBody,
+        signal: options.signal
+    });
+    const body = await decodeJsonResponse(response, "invalid_token_response", "The authorization service returned an invalid token response.");
+    if (!response.ok) {
+        const latest = options.currentToken();
+        if (latest?.refreshToken && latest.refreshToken !== attemptedRefreshToken)
+            return latest;
+        if (!options.directCapable(current))
+            options.removeToken(current.keyHandle);
+        if ((oauthErrorCode(body) ?? body?.error?.code) === "invalid_grant") {
+            throw connectError("authorization_expired", body?.error_description ?? body?.error?.message ?? "Reconnect this application to continue.", { status: response.status });
+        }
+        throw apiError(body, "authorization_expired", "Reconnect this application to continue.", response.status);
+    }
+    return options.storeTokenResponse(body, current.clientId, current.keyHandle);
+}

package/dist/authorization-types.d.ts

@@ -0,0 +1,7 @@
+export interface MdbaseDeviceAuthorization {
+    userCode: string;
+    verificationUri: string;
+    verificationUriComplete: string;
+    expiresAt: number;
+    intervalSeconds: number;
+}

package/dist/authorization-types.js

@@ -0,0 +1 @@
+export {};

package/dist/authorization-url.d.ts

@@ -0,0 +1,5 @@
+import type { ConnectProblem } from "@mdbase-dev/connect-protocol";
+export declare function cleanAuthorizationParameters(url: URL): URL;
+export declare function isAuthorizationCallbackUrl(value: string): boolean;
+export declare function authorizationCallbackState(value: string): string | null;
+export declare function authorizationReturnToFromProblem(problem: ConnectProblem): string | undefined;

package/dist/authorization-url.js

@@ -0,0 +1,34 @@
+export function cleanAuthorizationParameters(url) {
+    for (const parameter of ["code", "state", "error", "error_description"]) {
+        url.searchParams.delete(parameter);
+    }
+    return url;
+}
+export function isAuthorizationCallbackUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return false;
+    }
+    return url.searchParams.has("state")
+        && (url.searchParams.has("code") || url.searchParams.has("error"));
+}
+export function authorizationCallbackState(value) {
+    try {
+        const state = new URL(value).searchParams.get("state");
+        return state && state.length > 0 ? state : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function authorizationReturnToFromProblem(problem) {
+    if (!problem.details
+        || typeof problem.details !== "object"
+        || Array.isArray(problem.details))
+        return undefined;
+    const returnTo = problem.details.return_to;
+    return typeof returnTo === "string" ? returnTo : undefined;
+}

package/dist/base64.d.ts

@@ -0,0 +1,3 @@
+export declare function randomBase64Url(size: number): string;
+export declare function bytesToBase64Url(bytes: Uint8Array): string;
+export declare function base64UrlBytes(value: string): Uint8Array<ArrayBuffer>;

package/dist/base64.js

@@ -0,0 +1,21 @@
+export function randomBase64Url(size) {
+    const bytes = new Uint8Array(size);
+    crypto.getRandomValues(bytes);
+    return bytesToBase64Url(bytes);
+}
+export function bytesToBase64Url(bytes) {
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+export function base64UrlBytes(value) {
+    const padded = value.replaceAll("-", "+").replaceAll("_", "/")
+        .padEnd(Math.ceil(value.length / 4) * 4, "=");
+    const binary = atob(padded);
+    const bytes = new Uint8Array(new ArrayBuffer(binary.length));
+    for (let index = 0; index < binary.length; index += 1) {
+        bytes[index] = binary.charCodeAt(index);
+    }
+    return bytes;
+}

package/dist/browser/integrity.json

@@ -0,0 +1,4 @@
+{
+  "file": "mdbase-connect.min.js",
+  "integrity": "sha384-qa5e6QDDjQFkjqKf4HstaDjyvJmQnvu4PkubKmMs2QIDou3qqMn+uYWQG2Z0ImA2"
+}