@meshagent/meshagent-ts-auth 0.35.6

package/dist/cjs/oauth-session-manager.js

@@ -0,0 +1,116 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthSessionManager = void 0;
+const meshagent_auth_1 = require("./meshagent-auth");
+function toUrl(value) {
+    return value instanceof URL ? value : new URL(value);
+}
+class OAuthSessionManager {
+    constructor({ serverUrl, clientId, clientSecret, refreshSkew = 2 * 60 * 1000, minValidFor = 8 * 60 * 60 * 1000, auth = meshagent_auth_1.meshagentAuth, }) {
+        Object.defineProperty(this, "serverUrl", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "clientId", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "clientSecret", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "refreshSkew", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "minValidFor", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "auth", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.serverUrl = toUrl(serverUrl);
+        this.clientId = clientId;
+        this.clientSecret = clientSecret;
+        this.refreshSkew = refreshSkew;
+        this.minValidFor = minValidFor;
+        this.auth = auth;
+    }
+    get isLoggedIn() {
+        return this.auth.isLoggedIn();
+    }
+    async getValidAccessTokenOrThrow() {
+        const token = this.auth.getAccessToken();
+        if (!token) {
+            throw new Error("Not logged in");
+        }
+        if (this.isAccessTokenValidEnough()) {
+            return token;
+        }
+        await this.refreshOrThrow();
+        const refreshed = this.auth.getAccessToken();
+        if (!refreshed) {
+            throw new Error("Refresh succeeded but access token is missing");
+        }
+        return refreshed;
+    }
+    isAccessTokenValidEnough() {
+        const expiration = this.auth.expiration;
+        if (!expiration) {
+            return false;
+        }
+        const threshold = Date.now() + this.minValidFor + this.refreshSkew;
+        return expiration.getTime() > threshold;
+    }
+    async refreshOrThrow() {
+        const refreshToken = this.auth.getRefreshToken();
+        if (!refreshToken) {
+            throw new Error("No refresh token available");
+        }
+        const response = await fetch(new URL("/oauth/token", this.serverUrl), {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                "Accept": "application/json",
+            },
+            body: JSON.stringify({
+                grant_type: "refresh_token",
+                refresh_token: refreshToken,
+                client_id: this.clientId,
+                ...(this.clientSecret ? { client_secret: this.clientSecret } : {}),
+            }),
+        });
+        if (!response.ok) {
+            throw new Error(`Failed to refresh token: ${response.status} ${await response.text()}`);
+        }
+        const data = await response.json();
+        const accessToken = data["access_token"];
+        const nextRefreshToken = data["refresh_token"];
+        const expiresIn = data["expires_in"];
+        if (typeof accessToken !== "string" || accessToken.length === 0) {
+            throw new Error("Refresh response missing access_token");
+        }
+        this.auth.setSession({
+            accessToken,
+            refreshToken: typeof nextRefreshToken === "string" && nextRefreshToken.length > 0
+                ? nextRefreshToken
+                : refreshToken,
+            expiresIn: typeof expiresIn === "number" ? expiresIn : null,
+        });
+    }
+}
+exports.OAuthSessionManager = OAuthSessionManager;

package/dist/cjs/pkce-generator.d.ts

@@ -0,0 +1,27 @@
+import type { StorageLike } from "./storage";
+export interface PkceCache {
+    saveVerifier(verifier: string): Promise<void>;
+    readVerifier(): Promise<string | null>;
+    clearVerifier(): Promise<void>;
+}
+export declare class LocalStoragePkceCache implements PkceCache {
+    private readonly storage;
+    constructor(storage?: StorageLike);
+    saveVerifier(verifier: string): Promise<void>;
+    readVerifier(): Promise<string | null>;
+    clearVerifier(): Promise<void>;
+}
+export interface PkcePair {
+    codeVerifier: string;
+    codeChallenge: string;
+}
+export declare class PkceGenerator {
+    static readonly minVerifierLength = 43;
+    static readonly maxVerifierLength = 128;
+    private readonly cryptoApi;
+    constructor(cryptoApi?: Crypto);
+    generate(verifierLength?: number): Promise<PkcePair>;
+    private validateLength;
+    private generateCodeVerifier;
+    private createCodeChallenge;
+}

package/dist/cjs/pkce-generator.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PkceGenerator = exports.LocalStoragePkceCache = void 0;
+const storage_1 = require("./storage");
+const PKCE_VERIFIER_KEY = "cv";
+class LocalStoragePkceCache {
+    constructor(storage = (0, storage_1.getDefaultStorage)()) {
+        Object.defineProperty(this, "storage", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.storage = storage;
+    }
+    async saveVerifier(verifier) {
+        this.storage.setItem(PKCE_VERIFIER_KEY, verifier);
+    }
+    async readVerifier() {
+        return this.storage.getItem(PKCE_VERIFIER_KEY);
+    }
+    async clearVerifier() {
+        this.storage.removeItem(PKCE_VERIFIER_KEY);
+    }
+}
+exports.LocalStoragePkceCache = LocalStoragePkceCache;
+function assertCryptoAvailable() {
+    if (!globalThis.crypto || typeof globalThis.crypto.getRandomValues !== "function" || !globalThis.crypto.subtle) {
+        throw new Error("Web Crypto is required for PKCE generation");
+    }
+    return globalThis.crypto;
+}
+function encodeBase64Url(bytes) {
+    let binary = "";
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    const base64 = globalThis.btoa(binary);
+    return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+class PkceGenerator {
+    constructor(cryptoApi = assertCryptoAvailable()) {
+        Object.defineProperty(this, "cryptoApi", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.cryptoApi = cryptoApi;
+    }
+    async generate(verifierLength = 64) {
+        this.validateLength(verifierLength);
+        const verifier = this.generateCodeVerifier(verifierLength);
+        const challenge = await this.createCodeChallenge(verifier);
+        return {
+            codeVerifier: verifier,
+            codeChallenge: challenge,
+        };
+    }
+    validateLength(length) {
+        if (length < PkceGenerator.minVerifierLength || length > PkceGenerator.maxVerifierLength) {
+            throw new Error(`verifierLength must be between ${PkceGenerator.minVerifierLength} and ${PkceGenerator.maxVerifierLength}`);
+        }
+    }
+    generateCodeVerifier(targetLength) {
+        let bytesNeeded = Math.ceil((targetLength * 3) / 4);
+        while (true) {
+            const bytes = new Uint8Array(bytesNeeded);
+            this.cryptoApi.getRandomValues(bytes);
+            const candidate = encodeBase64Url(bytes);
+            if (candidate.length >= targetLength) {
+                return candidate.slice(0, targetLength);
+            }
+            bytesNeeded = Math.ceil(bytesNeeded * 1.25);
+        }
+    }
+    async createCodeChallenge(codeVerifier) {
+        const digest = await this.cryptoApi.subtle.digest("SHA-256", new TextEncoder().encode(codeVerifier));
+        return encodeBase64Url(new Uint8Array(digest));
+    }
+}
+exports.PkceGenerator = PkceGenerator;
+Object.defineProperty(PkceGenerator, "minVerifierLength", {
+    enumerable: true,
+    configurable: true,
+    writable: true,
+    value: 43
+});
+Object.defineProperty(PkceGenerator, "maxVerifierLength", {
+    enumerable: true,
+    configurable: true,
+    writable: true,
+    value: 128
+});

package/dist/cjs/storage.d.ts

@@ -0,0 +1,6 @@
+export interface StorageLike {
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): void;
+}
+export declare function getDefaultStorage(): StorageLike;

package/dist/cjs/storage.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getDefaultStorage = getDefaultStorage;
+class MemoryStorage {
+    constructor() {
+        Object.defineProperty(this, "values", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
+    }
+    getItem(key) {
+        return this.values.get(key) ?? null;
+    }
+    setItem(key, value) {
+        this.values.set(key, value);
+    }
+    removeItem(key) {
+        this.values.delete(key);
+    }
+}
+const fallbackStorage = new MemoryStorage();
+function getDefaultStorage() {
+    if (typeof window !== "undefined" && window.localStorage) {
+        return window.localStorage;
+    }
+    return fallbackStorage;
+}

package/dist/esm/access-token-provider.d.ts

@@ -0,0 +1,9 @@
+import type { OAuthSessionManagerOptions } from "./oauth-session-manager";
+export interface AccessTokenProvider {
+    getToken(): Promise<string>;
+}
+export declare class RefreshAccessTokenProvider implements AccessTokenProvider {
+    private readonly session;
+    constructor(options: OAuthSessionManagerOptions);
+    getToken(): Promise<string>;
+}

package/dist/esm/access-token-provider.js

@@ -0,0 +1,15 @@
+import { OAuthSessionManager } from "./oauth-session-manager";
+export class RefreshAccessTokenProvider {
+    constructor(options) {
+        Object.defineProperty(this, "session", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.session = new OAuthSessionManager(options);
+    }
+    getToken() {
+        return this.session.getValidAccessTokenOrThrow();
+    }
+}

package/dist/esm/browser-global.d.ts

@@ -0,0 +1,7 @@
+import type * as MeshagentAuthModule from "./index";
+declare global {
+    interface Window {
+        maAuth: typeof MeshagentAuthModule;
+    }
+}
+export {};

package/dist/esm/browser-global.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/ensure-login.d.ts

@@ -0,0 +1,6 @@
+export declare function ensureLogin({ oauthClientId, serverUrl, callbackUrl, provider, }: {
+    oauthClientId: string;
+    serverUrl?: string;
+    callbackUrl?: string;
+    provider?: string;
+}): Promise<void>;

package/dist/esm/ensure-login.js

@@ -0,0 +1,115 @@
+import { LocalStoragePkceCache, PkceGenerator } from "./pkce-generator";
+import { exchangeToken, getAuthorizationCode } from "./mauth-response";
+import { MeshagentAuth } from "./meshagent-auth";
+import { getDefaultStorage } from "./storage";
+const DEFAULT_SERVER_URL = "https://api.meshagent.com";
+const CALLBACK_URL_KEY = "ma:callback_url";
+const CALLBACK_SOURCE_QUERY_PARAM = "ma_origin";
+const CALLBACK_SOURCE_QUERY_VALUE = "meshagent_auth";
+function getCurrentUrl() {
+    if (typeof window === "undefined") {
+        throw new Error("ensureLogin requires a browser environment");
+    }
+    return new URL(window.location.href);
+}
+function clearMeshagentAuthQueryParams(url) {
+    url.searchParams.delete("code");
+    url.searchParams.delete("state");
+    url.searchParams.delete("error");
+    url.searchParams.delete("error_description");
+    url.searchParams.delete("error_uri");
+    url.searchParams.delete(CALLBACK_SOURCE_QUERY_PARAM);
+}
+function hasMeshagentCallbackMarker(url) {
+    return url.searchParams.get(CALLBACK_SOURCE_QUERY_PARAM) === CALLBACK_SOURCE_QUERY_VALUE;
+}
+function isMeshagentCallbackUrl(callbackUrl) {
+    const currentUrl = getCurrentUrl();
+    if (!currentUrl.searchParams.has("code")) {
+        return false;
+    }
+    if (!callbackUrl) {
+        return hasMeshagentCallbackMarker(currentUrl);
+    }
+    const expectedCallbackUrl = new URL(callbackUrl, currentUrl);
+    clearMeshagentAuthQueryParams(currentUrl);
+    clearMeshagentAuthQueryParams(expectedCallbackUrl);
+    return currentUrl.toString() === expectedCallbackUrl.toString();
+}
+function getRedirectCallbackUrl(callbackUrl) {
+    if (callbackUrl) {
+        return callbackUrl;
+    }
+    const currentUrl = getCurrentUrl();
+    clearMeshagentAuthQueryParams(currentUrl);
+    currentUrl.searchParams.set(CALLBACK_SOURCE_QUERY_PARAM, CALLBACK_SOURCE_QUERY_VALUE);
+    return currentUrl.toString();
+}
+function getExchangeCallbackUrl(callbackUrl, storage) {
+    if (callbackUrl) {
+        return callbackUrl;
+    }
+    const storedCallbackUrl = storage.getItem(CALLBACK_URL_KEY);
+    if (storedCallbackUrl) {
+        return storedCallbackUrl;
+    }
+    return getRedirectCallbackUrl(undefined);
+}
+function saveCallbackUrl(storage, callbackUrl) {
+    storage.setItem(CALLBACK_URL_KEY, callbackUrl);
+}
+function clearCallbackUrl(storage) {
+    storage.removeItem(CALLBACK_URL_KEY);
+}
+function replaceCurrentUrlWithoutAuthParams() {
+    if (typeof window === "undefined" || typeof window.history.replaceState !== "function") {
+        return;
+    }
+    const currentUrl = getCurrentUrl();
+    clearMeshagentAuthQueryParams(currentUrl);
+    window.history.replaceState(window.history.state, "", currentUrl.toString());
+}
+export async function ensureLogin({ oauthClientId, serverUrl, callbackUrl, provider, }) {
+    const serverBaseUrl = serverUrl ?? DEFAULT_SERVER_URL;
+    const storage = getDefaultStorage();
+    const cache = new LocalStoragePkceCache(storage);
+    const authorizationCode = isMeshagentCallbackUrl(callbackUrl)
+        ? getAuthorizationCode()
+        : null;
+    if (authorizationCode) {
+        const exchangeCallbackUrl = getExchangeCallbackUrl(callbackUrl, storage);
+        await exchangeToken({
+            oauthClientId,
+            serverUrl: serverBaseUrl,
+            callbackUrl: exchangeCallbackUrl,
+            authorizationCode,
+            storage,
+            auth: MeshagentAuth.current,
+        });
+        await cache.clearVerifier();
+        clearCallbackUrl(storage);
+        replaceCurrentUrlWithoutAuthParams();
+        return;
+    }
+    if (MeshagentAuth.current.isLoggedIn()) {
+        return;
+    }
+    const redirectCallbackUrl = getRedirectCallbackUrl(callbackUrl);
+    const generator = new PkceGenerator();
+    const pkce = await generator.generate();
+    await cache.saveVerifier(pkce.codeVerifier);
+    saveCallbackUrl(storage, redirectCallbackUrl);
+    const query = new URLSearchParams({
+        scope: "email",
+        client_id: oauthClientId,
+        code_challenge: pkce.codeChallenge,
+        response_type: "code",
+        redirect_uri: redirectCallbackUrl,
+        prompt: "select_account",
+    });
+    if (provider) {
+        query.set("provider", provider);
+    }
+    const authorizeUrl = new URL(`/oauth/authorize?${query.toString()}`, serverBaseUrl);
+    window.location.assign(authorizeUrl.toString());
+}

package/dist/esm/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./access-token-provider";
+export * from "./ensure-login";
+export * from "./mauth-response";
+export * from "./meshagent-auth";
+export * from "./oauth-session-manager";
+export * from "./pkce-generator";
+export * from "./storage";

package/dist/esm/index.js

@@ -0,0 +1,7 @@
+export * from "./access-token-provider";
+export * from "./ensure-login";
+export * from "./mauth-response";
+export * from "./meshagent-auth";
+export * from "./oauth-session-manager";
+export * from "./pkce-generator";
+export * from "./storage";

package/dist/esm/mauth-response.d.ts

@@ -0,0 +1,15 @@
+import { Meshagent } from "@meshagent/meshagent";
+import { MeshagentAuth } from "./meshagent-auth";
+import type { StorageLike } from "./storage";
+export declare function getAuthorizationCode(): string | null;
+export declare function normalizedExpiresIn(expiresIn: unknown): number | null;
+export declare function getMeshagentClient(auth: MeshagentAuth, serverUrl: URL | string): Meshagent;
+export interface MAuthResponseProps {
+    serverUrl: string | URL;
+    callbackUrl: string | URL;
+    oauthClientId: string;
+    authorizationCode?: string;
+    storage?: StorageLike;
+    auth?: MeshagentAuth;
+}
+export declare function exchangeToken(props: MAuthResponseProps, signal?: AbortSignal): Promise<void>;

package/dist/esm/mauth-response.js

@@ -0,0 +1,88 @@
+import { Meshagent } from "@meshagent/meshagent";
+import { MeshagentAuth } from "./meshagent-auth";
+import { LocalStoragePkceCache } from "./pkce-generator";
+import { getDefaultStorage } from "./storage";
+function toUrl(value) {
+    return value instanceof URL ? value : new URL(value);
+}
+export function getAuthorizationCode() {
+    if (typeof window === "undefined") {
+        return null;
+    }
+    const url = new URL(window.location.href);
+    return url.searchParams.get("code");
+}
+export function normalizedExpiresIn(expiresIn) {
+    if (typeof expiresIn === "number" && Number.isFinite(expiresIn)) {
+        return expiresIn;
+    }
+    if (typeof expiresIn === "string") {
+        if (expiresIn.trim() === "") {
+            return null;
+        }
+        const val = Number(expiresIn);
+        if (Number.isFinite(val)) {
+            return val;
+        }
+    }
+    return null;
+}
+export function getMeshagentClient(auth, serverUrl) {
+    const token = auth.getAccessToken();
+    const baseUrl = serverUrl.toString();
+    if (!token) {
+        throw Error("No access token - you are not logged in");
+    }
+    return new Meshagent({ baseUrl, token });
+}
+export async function exchangeToken(props, signal) {
+    const serverUrl = toUrl(props.serverUrl);
+    const callbackUrl = toUrl(props.callbackUrl);
+    const authorizationCode = props.authorizationCode ?? getAuthorizationCode();
+    const storage = props.storage ?? getDefaultStorage();
+    const auth = props.auth ?? MeshagentAuth.current;
+    const cache = new LocalStoragePkceCache(storage);
+    if (!authorizationCode) {
+        throw new Error("Missing authorization code");
+    }
+    const codeVerifier = await cache.readVerifier();
+    if (!codeVerifier) {
+        throw new Error("Missing PKCE code verifier");
+    }
+    const response = await fetch(new URL("/oauth/token", serverUrl), {
+        method: "POST",
+        signal,
+        headers: {
+            "content-type": "application/json",
+            "accept": "application/json",
+        },
+        body: JSON.stringify({
+            "client_id": props.oauthClientId,
+            "code_verifier": codeVerifier,
+            "code": authorizationCode,
+            "grant_type": "authorization_code",
+            "redirect_uri": callbackUrl.toString(),
+        }),
+    });
+    if (!response.ok) {
+        throw new Error(`Token exchange failed: ${response.status} ${await response.text()}`);
+    }
+    const data = await response.json();
+    const accessToken = data["access_token"];
+    const refreshToken = data["refresh_token"];
+    const expiresIn = data["expires_in"];
+    if (typeof accessToken !== "string" || accessToken.length === 0) {
+        throw new Error("Token exchange response missing access token");
+    }
+    auth.setAccessToken(accessToken);
+    if (typeof refreshToken !== "string" || refreshToken.length === 0) {
+        throw new Error("Token exchange response missing refresh token");
+    }
+    auth.setRefreshToken(refreshToken);
+    const client = getMeshagentClient(auth, serverUrl);
+    const me = await client.getUserProfile("me");
+    if (me) {
+        auth.setUser(me);
+    }
+    auth.setExpiresIn(normalizedExpiresIn(expiresIn));
+}

package/dist/esm/meshagent-auth.d.ts

@@ -0,0 +1,40 @@
+import type { StorageLike } from "./storage";
+export type MeshagentUser = Record<string, unknown>;
+export interface MeshagentAuthSnapshot {
+    accessToken: string | null;
+    refreshToken: string | null;
+    expiration: Date | null;
+    user: MeshagentUser | null;
+}
+export interface MeshagentAuthSession {
+    accessToken: string | null;
+    refreshToken: string | null;
+    expiresIn: number | null | undefined;
+}
+type MeshagentAuthListener = () => void;
+export declare class MeshagentAuth {
+    static current: MeshagentAuth;
+    private readonly storage;
+    private readonly listeners;
+    private snapshot;
+    constructor(storage?: StorageLike);
+    subscribe(listener: MeshagentAuthListener): () => void;
+    getSnapshot(): MeshagentAuthSnapshot;
+    setSession(session: MeshagentAuthSession): void;
+    setUser(user: MeshagentUser | null): void;
+    getUser(): MeshagentUser | null;
+    signOut(): void;
+    isLoggedIn(): boolean;
+    get expiration(): Date | null;
+    isExpired(): boolean;
+    getAccessToken(): string | null;
+    getRefreshToken(): string | null;
+    setAccessToken(token: string | null): void;
+    setRefreshToken(refreshToken: string | null): void;
+    setExpiresIn(expiresIn: number | null | undefined): void;
+    private writeValue;
+    private publish;
+    private isEqual;
+}
+export declare const meshagentAuth: MeshagentAuth;
+export {};