@meshagent/meshagent-ts-auth 0.35.6

package/CHANGELOG.md

@@ -0,0 +1,2 @@
+## [0.30.0]
+- Initial TypeScript/React auth package based on `meshagent-flutter-auth`.

package/LICENSE

@@ -0,0 +1,201 @@
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction,
+and distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by
+the copyright owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all
+other entities that control, are controlled by, or are under common
+control with that entity. For the purposes of this definition,
+"control" means (i) the power, direct or indirect, to cause the
+direction or management of such entity, whether by contract or
+otherwise, or (ii) ownership of fifty percent (50%) or more of the
+outstanding shares, or (iii) beneficial ownership of such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity
+exercising permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications,
+including but not limited to software source code, documentation
+source, and configuration files.
+
+"Object" form shall mean any form resulting from mechanical
+transformation or translation of a Source form, including but
+not limited to compiled object code, generated documentation,
+and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or
+Object form, made available under the License, as indicated by a
+copyright notice that is included in or attached to the work
+(an example is provided in the Appendix below).
+
+"Derivative Works" shall mean any work, whether in Source or Object
+form, that is based on (or derived from) the Work and for which the
+editorial revisions, annotations, elaborations, or other modifications
+represent, as a whole, an original work of authorship. For the purposes
+of this License, Derivative Works shall not include works that remain
+separable from, or merely link (or bind by name) to the interfaces of,
+the Work and Derivative Works thereof.
+
+"Contribution" shall mean any work of authorship, including
+the original version of the Work and any modifications or additions
+to that Work or Derivative Works thereof, that is intentionally
+submitted to Licensor for inclusion in the Work by the copyright owner
+or by an individual or Legal Entity authorized to submit on behalf of
+the copyright owner. For the purposes of this definition, "submitted"
+means any form of electronic, verbal, or written communication sent
+to the Licensor or its representatives, including but not limited to
+communication on electronic mailing lists, source code control systems,
+and issue tracking systems that are managed by, or on behalf of, the
+Licensor for the purpose of discussing and improving the Work, but
+excluding communication that is conspicuously marked or otherwise
+designated in writing by the copyright owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity
+on behalf of whom a Contribution has been received by Licensor and
+subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+this License, each Contributor hereby grants to You a perpetual,
+worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+copyright license to reproduce, prepare Derivative Works of,
+publicly display, publicly perform, sublicense, and distribute the
+Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+this License, each Contributor hereby grants to You a perpetual,
+worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+(except as stated in this section) patent license to make, have made,
+use, offer to sell, sell, import, and otherwise transfer the Work,
+where such license applies only to those patent claims licensable
+by such Contributor that are necessarily infringed by their
+Contribution(s) alone or by combination of their Contribution(s)
+with the Work to which such Contribution(s) was submitted. If You
+institute patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Work
+or a Contribution incorporated within the Work constitutes direct
+or contributory patent infringement, then any patent licenses
+granted to You under this License for that Work shall terminate
+as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+Work or Derivative Works thereof in any medium, with or without
+modifications, and in Source or Object form, provided that You
+meet the following conditions:
+
+(a) You must give any other recipients of the Work or
+Derivative Works a copy of this License; and
+
+(b) You must cause any modified files to carry prominent notices
+stating that You changed the files; and
+
+(c) You must retain, in the Source form of any Derivative Works
+that You distribute, all copyright, patent, trademark, and
+attribution notices from the Source form of the Work,
+excluding those notices that do not pertain to any part of
+the Derivative Works; and
+
+(d) If the Work includes a "NOTICE" text file as part of its
+distribution, then any Derivative Works that You distribute must
+include a readable copy of the attribution notices contained
+within such NOTICE file, excluding those notices that do not
+pertain to any part of the Derivative Works, in at least one
+of the following places: within a NOTICE text file distributed
+as part of the Derivative Works; within the Source form or
+documentation, if provided along with the Derivative Works; or,
+within a display generated by the Derivative Works, if and
+wherever such third-party notices normally appear. The contents
+of the NOTICE file are for informational purposes only and
+do not modify the License. You may add Your own attribution
+notices within Derivative Works that You distribute, alongside
+or as an addendum to the NOTICE text from the Work, provided
+that such additional attribution notices cannot be construed
+as modifying the License.
+
+You may add Your own copyright statement to Your modifications and
+may provide additional or different license terms and conditions
+for use, reproduction, or distribution of Your modifications, or
+for any such Derivative Works as a whole, provided Your use,
+reproduction, and distribution of the Work otherwise complies with
+the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+any Contribution intentionally submitted for inclusion in the Work
+by You to the Licensor shall be under the terms and conditions of
+this License, without any additional terms or conditions.
+Notwithstanding the above, nothing herein shall supersede or modify
+the terms of any separate license agreement you may have executed
+with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+names, trademarks, service marks, or product names of the Licensor,
+except as required for reasonable and customary use in describing the
+origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+agreed to in writing, Licensor provides the Work (and each
+Contributor provides its Contributions) on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+implied, including, without limitation, any warranties or conditions
+of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+PARTICULAR PURPOSE. You are solely responsible for determining the
+appropriateness of using or redistributing the Work and assume any
+risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+whether in tort (including negligence), contract, or otherwise,
+unless required by applicable law (such as deliberate and grossly
+negligent acts) or agreed to in writing, shall any Contributor be
+liable to You for damages, including any direct, indirect, special,
+incidental, or consequential damages of any character arising as a
+result of this License or out of the use or inability to use the
+Work (including but not limited to damages for loss of goodwill,
+work stoppage, computer failure or malfunction, or any and all
+other commercial damages or losses), even if such Contributor
+has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+the Work or Derivative Works thereof, You may choose to offer,
+and charge a fee for, acceptance of support, warranty, indemnity,
+or other liability obligations and/or rights consistent with this
+License. However, in accepting such obligations, You may act only
+on Your own behalf and on Your sole responsibility, not on behalf
+of any other Contributor, and only if You agree to indemnify,
+defend, and hold each Contributor harmless for any liability
+incurred by, or claims asserted against, such Contributor by reason
+of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+To apply the Apache License to your work, attach the following
+boilerplate notice, with the fields enclosed by brackets "[]"
+replaced with your own identifying information. (Don't include
+the brackets!)  The text should be enclosed in the appropriate
+comment syntax for the file format. We also recommend that a
+file or class name and description of purpose be included on the
+same "printed page" as the copyright notice for easier
+identification within third-party archives.
+
+Copyright [yyyy] [name of copyright owner]
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/README.md

@@ -0,0 +1,271 @@
+# Meshagent Auth
+
+Helpers for Meshagent OAuth login, PKCE, token refresh, and auth state.
+
+This package is framework-agnostic. It gives you the primitives to:
+
+- ensure a browser user is logged in with a single `ensureLogin(...)` call
+- start an OAuth login with PKCE
+- exchange the callback `code` for access and refresh tokens
+- persist auth state in `localStorage`
+- refresh expired access tokens
+- create a Meshagent client with the current access token
+
+## Install
+
+```sh
+npm install @meshagent/meshagent-ts-auth
+```
+
+## Tests
+
+Use `npm test` to run the local Jest suite.
+Use `npm run test:watch` while iterating on a regression.
+
+The starter tests focus on the areas most likely to break in day-to-day auth work:
+
+- auth state persistence and sign-out behavior
+- expiry parsing and normalization
+- access-token refresh behavior
+- PKCE verifier and challenge generation
+
+Add new regression tests in `test/*.test.ts` as issues come up.
+
+## Before You Start
+
+You need an OAuth client in Meshagent Studio.
+
+1. Sign in to `https://studio.meshagent.com`.
+2. Open `OAuth Clients`.
+3. Create a new OAuth client.
+4. Add your callback URL.
+
+You will use:
+
+- `serverUrl`: your Meshagent server, for example `https://api.meshagent.com`
+- `oauthClientId`: the OAuth client ID from Studio
+- `callbackUrl`: the URL Meshagent redirects back to after login
+
+## What The Package Stores
+
+`MeshagentAuth` stores the session in browser storage under these keys:
+
+- `ma:access_token`
+- `ma:refresh_token`
+- `ma:expiration`
+
+By default, the package uses `window.localStorage` in the browser and falls back to in-memory storage outside the browser.
+
+## Main Building Blocks
+
+- `ensureLogin`: high-level browser helper that starts login or completes the OAuth callback
+- `MeshagentAuth`: stores tokens, expiration, and the current user
+- `PkceGenerator`: generates `code_verifier` and `code_challenge`
+- `LocalStoragePkceCache`: stores the PKCE verifier between redirect steps
+- `exchangeToken`: exchanges the OAuth authorization code for tokens
+- `OAuthSessionManager`: returns a valid access token and refreshes when needed
+- `RefreshAccessTokenProvider`: thin wrapper around `OAuthSessionManager`
+- `getMeshagentClient`: creates `@meshagent/meshagent` with the current token
+
+## Login Flow
+
+The simplest browser login flow is a single `await ensureLogin(...)` call.
+
+`ensureLogin(...)` handles all of these cases:
+
+- the user is already logged in, so it returns immediately
+- the current URL is the configured callback URL, or it carries the default Meshagent callback marker, and contains `?code=...`, so it exchanges the code, stores the session, loads the current user, and removes auth query params from the URL
+- the user is not logged in yet, so it generates PKCE values, stores the verifier, and redirects to `/oauth/authorize`
+
+When you omit `callbackUrl`, `ensureLogin(...)` uses the current page as the callback URL and adds `ma_origin=meshagent_auth` so it can tell a Meshagent OAuth return apart from unrelated query params. That marker is removed after a successful callback exchange.
+
+## Example: Ensure Login
+
+Use the same function from a login button, on app startup, or on a dedicated callback page.
+
+```ts
+import {
+  MeshagentAuth,
+  ensureLogin,
+} from "@meshagent/meshagent-ts-auth";
+
+const serverUrl = "https://api.meshagent.com";
+const callbackUrl = "http://localhost:3000/auth/callback";
+const oauthClientId = "YOUR_OAUTH_CLIENT_ID";
+
+export async function ensureMeshagentSession(provider?: string): Promise<void> {
+  await ensureLogin({
+    serverUrl,
+    callbackUrl,
+    oauthClientId,
+    provider,
+  });
+
+  if (!MeshagentAuth.current.isLoggedIn()) {
+    return;
+  }
+
+  console.log("Logged in:", MeshagentAuth.current.getSnapshot());
+}
+```
+
+If you want to force a specific identity provider, pass `provider`, for example:
+
+```ts
+await ensureMeshagentSession("google");
+```
+
+`ensureLogin(...)` does all of the following for the default browser flow:
+
+- returns immediately when the user is already logged in
+- reads the stored PKCE verifier after the OAuth redirect
+- sends the `/oauth/token` request
+- stores `access_token` and `refresh_token`
+- loads the current user profile
+- stores token expiration when `expires_in` is present
+- removes the auth query params from the current URL after a successful callback exchange
+
+Use `exchangeToken(...)`, `PkceGenerator`, and `LocalStoragePkceCache` directly only if you need manual control over the redirect flow.
+
+## Example: Use The Logged-In Session
+
+After `ensureLogin(...)` completes on the callback return, `MeshagentAuth.current` contains the current session.
+
+```ts
+import { MeshagentAuth } from "@meshagent/meshagent-ts-auth";
+
+const auth = MeshagentAuth.current;
+
+if (auth.isLoggedIn()) {
+  console.log("access token:", auth.getAccessToken());
+  console.log("refresh token:", auth.getRefreshToken());
+  console.log("expires at:", auth.expiration);
+  console.log("user:", auth.getUser());
+}
+```
+
+## Example: Refresh Access Tokens
+
+Use `OAuthSessionManager` when you need a token that is still valid, or a refresh if the current token is too close to expiry.
+
+```ts
+import { OAuthSessionManager } from "@meshagent/meshagent-ts-auth";
+
+const session = new OAuthSessionManager({
+  serverUrl: "https://api.meshagent.com",
+  clientId: "YOUR_OAUTH_CLIENT_ID",
+});
+
+const accessToken = await session.getValidAccessTokenOrThrow();
+console.log(accessToken);
+```
+
+You can also use `RefreshAccessTokenProvider` if another API expects an object with `getToken(): Promise<string>`.
+
+```ts
+import { RefreshAccessTokenProvider } from "@meshagent/meshagent-ts-auth";
+
+const tokenProvider = new RefreshAccessTokenProvider({
+  serverUrl: "https://api.meshagent.com",
+  clientId: "YOUR_OAUTH_CLIENT_ID",
+});
+
+const token = await tokenProvider.getToken();
+```
+
+## Example: Create A Meshagent Client
+
+If you want a ready-to-use Meshagent client after login:
+
+```ts
+import {
+  MeshagentAuth,
+  getMeshagentClient,
+} from "@meshagent/meshagent-ts-auth";
+
+const client = getMeshagentClient(
+  MeshagentAuth.current,
+  "https://api.meshagent.com",
+);
+
+const me = await client.getUserProfile("me");
+console.log(me);
+```
+
+`getMeshagentClient(...)` throws if the user is not logged in.
+
+## Example: Sign Out
+
+```ts
+import { MeshagentAuth } from "@meshagent/meshagent-ts-auth";
+
+MeshagentAuth.current.signOut();
+```
+
+This clears the stored access token, refresh token, expiration, and cached user.
+
+## Example: Subscribe To Auth Changes
+
+```ts
+import { MeshagentAuth } from "@meshagent/meshagent-ts-auth";
+
+const unsubscribe = MeshagentAuth.current.subscribe(() => {
+  console.log("auth changed", MeshagentAuth.current.getSnapshot());
+});
+
+// later
+unsubscribe();
+```
+
+## Browser Global Bundle
+
+Run `npm run build` to generate `dist/browser/ma-auth.global.js`.
+
+Serve that file from your app or copy it into your static assets, then include it with a classic script tag:
+
+```html
+<script src="/assets/ma-auth.global.js"></script>
+<script>
+  const auth = window.maAuth.MeshagentAuth.current;
+  console.log(auth.isLoggedIn());
+</script>
+```
+
+TypeScript consumers using the global bundle can add:
+
+```ts
+/// <reference types="@meshagent/meshagent-ts-auth/global" />
+```
+
+The browser-global API matches the module API, so the earlier examples translate directly. For example:
+
+```html
+<script src="/assets/ma-auth.global.js"></script>
+<script>
+  async function ensureMeshagentSession(provider) {
+    await window.maAuth.ensureLogin({
+      serverUrl: "https://api.meshagent.com",
+      callbackUrl: "http://localhost:3000/auth/callback",
+      oauthClientId: "YOUR_OAUTH_CLIENT_ID",
+      provider,
+    });
+
+    if (!window.maAuth.MeshagentAuth.current.isLoggedIn()) {
+      return;
+    }
+
+    console.log(
+      "Logged in:",
+      window.maAuth.MeshagentAuth.current.getSnapshot(),
+    );
+  }
+<\/script>
+```
+
+## Notes
+
+- This package assumes a browser-style OAuth redirect flow.
+- `PkceGenerator` requires Web Crypto (`globalThis.crypto`).
+- `ensureLogin(...)` manages the PKCE verifier for the default browser flow.
+- `exchangeToken(...)` expects the PKCE verifier to still be available in storage after the redirect when you use the low-level helpers directly.
+- `OAuthSessionManager` uses the stored refresh token and calls `/oauth/token` with `grant_type=refresh_token`.

package/dist/browser/access-token-provider.d.ts

@@ -0,0 +1,9 @@
+import type { OAuthSessionManagerOptions } from "./oauth-session-manager";
+export interface AccessTokenProvider {
+    getToken(): Promise<string>;
+}
+export declare class RefreshAccessTokenProvider implements AccessTokenProvider {
+    private readonly session;
+    constructor(options: OAuthSessionManagerOptions);
+    getToken(): Promise<string>;
+}

package/dist/browser/browser-global.d.ts

@@ -0,0 +1,7 @@
+import type * as MeshagentAuthModule from "./index";
+declare global {
+    interface Window {
+        maAuth: typeof MeshagentAuthModule;
+    }
+}
+export {};

package/dist/browser/ensure-login.d.ts

@@ -0,0 +1,6 @@
+export declare function ensureLogin({ oauthClientId, serverUrl, callbackUrl, provider, }: {
+    oauthClientId: string;
+    serverUrl?: string;
+    callbackUrl?: string;
+    provider?: string;
+}): Promise<void>;

package/dist/browser/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./access-token-provider";
+export * from "./ensure-login";
+export * from "./mauth-response";
+export * from "./meshagent-auth";
+export * from "./oauth-session-manager";
+export * from "./pkce-generator";
+export * from "./storage";