@meshagent/meshagent-ts-auth 0.35.6

package/dist/esm/meshagent-auth.js

@@ -0,0 +1,173 @@
+import { getDefaultStorage } from "./storage";
+const ACCESS_TOKEN_KEY = "ma:access_token";
+const REFRESH_TOKEN_KEY = "ma:refresh_token";
+const EXPIRATION_KEY = "ma:expiration";
+function parseExpiration(value) {
+    if (!value) {
+        return null;
+    }
+    const parsed = new Date(value);
+    return Number.isNaN(parsed.getTime()) ? null : parsed;
+}
+function buildExpiration(expiresIn) {
+    if (expiresIn == null || !Number.isFinite(expiresIn)) {
+        return null;
+    }
+    return new Date(Date.now() + expiresIn * 1000);
+}
+function sameDate(left, right) {
+    if (left === right) {
+        return true;
+    }
+    if (!left || !right) {
+        return false;
+    }
+    return left.getTime() === right.getTime();
+}
+export class MeshagentAuth {
+    constructor(storage = getDefaultStorage()) {
+        Object.defineProperty(this, "storage", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "listeners", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Set()
+        });
+        Object.defineProperty(this, "snapshot", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.storage = storage;
+        this.snapshot = {
+            accessToken: this.storage.getItem(ACCESS_TOKEN_KEY),
+            refreshToken: this.storage.getItem(REFRESH_TOKEN_KEY),
+            expiration: parseExpiration(this.storage.getItem(EXPIRATION_KEY)),
+            user: null,
+        };
+    }
+    subscribe(listener) {
+        this.listeners.add(listener);
+        return () => {
+            this.listeners.delete(listener);
+        };
+    }
+    getSnapshot() {
+        return this.snapshot;
+    }
+    setSession(session) {
+        this.writeValue(ACCESS_TOKEN_KEY, session.accessToken);
+        this.writeValue(REFRESH_TOKEN_KEY, session.refreshToken);
+        const expiration = buildExpiration(session.expiresIn);
+        if (expiration) {
+            this.storage.setItem(EXPIRATION_KEY, expiration.toISOString());
+        }
+        else {
+            this.storage.removeItem(EXPIRATION_KEY);
+        }
+        this.publish({
+            ...this.snapshot,
+            accessToken: session.accessToken,
+            refreshToken: session.refreshToken,
+            expiration,
+        });
+    }
+    setUser(user) {
+        this.publish({
+            ...this.snapshot,
+            user,
+        });
+    }
+    getUser() {
+        return this.snapshot.user;
+    }
+    signOut() {
+        this.writeValue(ACCESS_TOKEN_KEY, null);
+        this.writeValue(REFRESH_TOKEN_KEY, null);
+        this.storage.removeItem(EXPIRATION_KEY);
+        this.publish({
+            accessToken: null,
+            refreshToken: null,
+            expiration: null,
+            user: null,
+        });
+    }
+    isLoggedIn() {
+        return this.snapshot.accessToken !== null;
+    }
+    get expiration() {
+        return this.snapshot.expiration;
+    }
+    isExpired() {
+        const expiration = this.expiration;
+        return expiration ? expiration.getTime() <= Date.now() : false;
+    }
+    getAccessToken() {
+        return this.snapshot.accessToken;
+    }
+    getRefreshToken() {
+        return this.snapshot.refreshToken;
+    }
+    setAccessToken(token) {
+        this.writeValue(ACCESS_TOKEN_KEY, token);
+        this.publish({
+            ...this.snapshot,
+            accessToken: token,
+        });
+    }
+    setRefreshToken(refreshToken) {
+        this.writeValue(REFRESH_TOKEN_KEY, refreshToken);
+        this.publish({
+            ...this.snapshot,
+            refreshToken,
+        });
+    }
+    setExpiresIn(expiresIn) {
+        const expiration = buildExpiration(expiresIn);
+        if (expiration) {
+            this.storage.setItem(EXPIRATION_KEY, expiration.toISOString());
+        }
+        else {
+            this.storage.removeItem(EXPIRATION_KEY);
+        }
+        this.publish({
+            ...this.snapshot,
+            expiration,
+        });
+    }
+    writeValue(key, value) {
+        if (!value) {
+            this.storage.removeItem(key);
+            return;
+        }
+        this.storage.setItem(key, value);
+    }
+    publish(nextSnapshot) {
+        if (this.isEqual(nextSnapshot)) {
+            return;
+        }
+        this.snapshot = nextSnapshot;
+        for (const listener of this.listeners) {
+            listener();
+        }
+    }
+    isEqual(nextSnapshot) {
+        return this.snapshot.accessToken === nextSnapshot.accessToken
+            && this.snapshot.refreshToken === nextSnapshot.refreshToken
+            && sameDate(this.snapshot.expiration, nextSnapshot.expiration)
+            && this.snapshot.user === nextSnapshot.user;
+    }
+}
+Object.defineProperty(MeshagentAuth, "current", {
+    enumerable: true,
+    configurable: true,
+    writable: true,
+    value: new MeshagentAuth()
+});
+export const meshagentAuth = MeshagentAuth.current;

package/dist/esm/oauth-session-manager.d.ts

@@ -0,0 +1,22 @@
+import { MeshagentAuth } from "./meshagent-auth";
+export interface OAuthSessionManagerOptions {
+    serverUrl: string | URL;
+    clientId: string;
+    clientSecret?: string;
+    refreshSkew?: number;
+    minValidFor?: number;
+    auth?: MeshagentAuth;
+}
+export declare class OAuthSessionManager {
+    readonly serverUrl: URL;
+    readonly clientId: string;
+    readonly clientSecret?: string;
+    readonly refreshSkew: number;
+    readonly minValidFor: number;
+    private readonly auth;
+    constructor({ serverUrl, clientId, clientSecret, refreshSkew, minValidFor, auth, }: OAuthSessionManagerOptions);
+    get isLoggedIn(): boolean;
+    getValidAccessTokenOrThrow(): Promise<string>;
+    isAccessTokenValidEnough(): boolean;
+    refreshOrThrow(): Promise<void>;
+}

package/dist/esm/oauth-session-manager.js

@@ -0,0 +1,112 @@
+import { meshagentAuth } from "./meshagent-auth";
+function toUrl(value) {
+    return value instanceof URL ? value : new URL(value);
+}
+export class OAuthSessionManager {
+    constructor({ serverUrl, clientId, clientSecret, refreshSkew = 2 * 60 * 1000, minValidFor = 8 * 60 * 60 * 1000, auth = meshagentAuth, }) {
+        Object.defineProperty(this, "serverUrl", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "clientId", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "clientSecret", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "refreshSkew", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "minValidFor", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "auth", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.serverUrl = toUrl(serverUrl);
+        this.clientId = clientId;
+        this.clientSecret = clientSecret;
+        this.refreshSkew = refreshSkew;
+        this.minValidFor = minValidFor;
+        this.auth = auth;
+    }
+    get isLoggedIn() {
+        return this.auth.isLoggedIn();
+    }
+    async getValidAccessTokenOrThrow() {
+        const token = this.auth.getAccessToken();
+        if (!token) {
+            throw new Error("Not logged in");
+        }
+        if (this.isAccessTokenValidEnough()) {
+            return token;
+        }
+        await this.refreshOrThrow();
+        const refreshed = this.auth.getAccessToken();
+        if (!refreshed) {
+            throw new Error("Refresh succeeded but access token is missing");
+        }
+        return refreshed;
+    }
+    isAccessTokenValidEnough() {
+        const expiration = this.auth.expiration;
+        if (!expiration) {
+            return false;
+        }
+        const threshold = Date.now() + this.minValidFor + this.refreshSkew;
+        return expiration.getTime() > threshold;
+    }
+    async refreshOrThrow() {
+        const refreshToken = this.auth.getRefreshToken();
+        if (!refreshToken) {
+            throw new Error("No refresh token available");
+        }
+        const response = await fetch(new URL("/oauth/token", this.serverUrl), {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                "Accept": "application/json",
+            },
+            body: JSON.stringify({
+                grant_type: "refresh_token",
+                refresh_token: refreshToken,
+                client_id: this.clientId,
+                ...(this.clientSecret ? { client_secret: this.clientSecret } : {}),
+            }),
+        });
+        if (!response.ok) {
+            throw new Error(`Failed to refresh token: ${response.status} ${await response.text()}`);
+        }
+        const data = await response.json();
+        const accessToken = data["access_token"];
+        const nextRefreshToken = data["refresh_token"];
+        const expiresIn = data["expires_in"];
+        if (typeof accessToken !== "string" || accessToken.length === 0) {
+            throw new Error("Refresh response missing access_token");
+        }
+        this.auth.setSession({
+            accessToken,
+            refreshToken: typeof nextRefreshToken === "string" && nextRefreshToken.length > 0
+                ? nextRefreshToken
+                : refreshToken,
+            expiresIn: typeof expiresIn === "number" ? expiresIn : null,
+        });
+    }
+}

package/dist/esm/pkce-generator.d.ts

@@ -0,0 +1,27 @@
+import type { StorageLike } from "./storage";
+export interface PkceCache {
+    saveVerifier(verifier: string): Promise<void>;
+    readVerifier(): Promise<string | null>;
+    clearVerifier(): Promise<void>;
+}
+export declare class LocalStoragePkceCache implements PkceCache {
+    private readonly storage;
+    constructor(storage?: StorageLike);
+    saveVerifier(verifier: string): Promise<void>;
+    readVerifier(): Promise<string | null>;
+    clearVerifier(): Promise<void>;
+}
+export interface PkcePair {
+    codeVerifier: string;
+    codeChallenge: string;
+}
+export declare class PkceGenerator {
+    static readonly minVerifierLength = 43;
+    static readonly maxVerifierLength = 128;
+    private readonly cryptoApi;
+    constructor(cryptoApi?: Crypto);
+    generate(verifierLength?: number): Promise<PkcePair>;
+    private validateLength;
+    private generateCodeVerifier;
+    private createCodeChallenge;
+}

package/dist/esm/pkce-generator.js

@@ -0,0 +1,89 @@
+import { getDefaultStorage } from "./storage";
+const PKCE_VERIFIER_KEY = "cv";
+export class LocalStoragePkceCache {
+    constructor(storage = getDefaultStorage()) {
+        Object.defineProperty(this, "storage", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.storage = storage;
+    }
+    async saveVerifier(verifier) {
+        this.storage.setItem(PKCE_VERIFIER_KEY, verifier);
+    }
+    async readVerifier() {
+        return this.storage.getItem(PKCE_VERIFIER_KEY);
+    }
+    async clearVerifier() {
+        this.storage.removeItem(PKCE_VERIFIER_KEY);
+    }
+}
+function assertCryptoAvailable() {
+    if (!globalThis.crypto || typeof globalThis.crypto.getRandomValues !== "function" || !globalThis.crypto.subtle) {
+        throw new Error("Web Crypto is required for PKCE generation");
+    }
+    return globalThis.crypto;
+}
+function encodeBase64Url(bytes) {
+    let binary = "";
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    const base64 = globalThis.btoa(binary);
+    return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+export class PkceGenerator {
+    constructor(cryptoApi = assertCryptoAvailable()) {
+        Object.defineProperty(this, "cryptoApi", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.cryptoApi = cryptoApi;
+    }
+    async generate(verifierLength = 64) {
+        this.validateLength(verifierLength);
+        const verifier = this.generateCodeVerifier(verifierLength);
+        const challenge = await this.createCodeChallenge(verifier);
+        return {
+            codeVerifier: verifier,
+            codeChallenge: challenge,
+        };
+    }
+    validateLength(length) {
+        if (length < PkceGenerator.minVerifierLength || length > PkceGenerator.maxVerifierLength) {
+            throw new Error(`verifierLength must be between ${PkceGenerator.minVerifierLength} and ${PkceGenerator.maxVerifierLength}`);
+        }
+    }
+    generateCodeVerifier(targetLength) {
+        let bytesNeeded = Math.ceil((targetLength * 3) / 4);
+        while (true) {
+            const bytes = new Uint8Array(bytesNeeded);
+            this.cryptoApi.getRandomValues(bytes);
+            const candidate = encodeBase64Url(bytes);
+            if (candidate.length >= targetLength) {
+                return candidate.slice(0, targetLength);
+            }
+            bytesNeeded = Math.ceil(bytesNeeded * 1.25);
+        }
+    }
+    async createCodeChallenge(codeVerifier) {
+        const digest = await this.cryptoApi.subtle.digest("SHA-256", new TextEncoder().encode(codeVerifier));
+        return encodeBase64Url(new Uint8Array(digest));
+    }
+}
+Object.defineProperty(PkceGenerator, "minVerifierLength", {
+    enumerable: true,
+    configurable: true,
+    writable: true,
+    value: 43
+});
+Object.defineProperty(PkceGenerator, "maxVerifierLength", {
+    enumerable: true,
+    configurable: true,
+    writable: true,
+    value: 128
+});

package/dist/esm/storage.d.ts

@@ -0,0 +1,6 @@
+export interface StorageLike {
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): void;
+}
+export declare function getDefaultStorage(): StorageLike;

package/dist/esm/storage.js

@@ -0,0 +1,26 @@
+class MemoryStorage {
+    constructor() {
+        Object.defineProperty(this, "values", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
+    }
+    getItem(key) {
+        return this.values.get(key) ?? null;
+    }
+    setItem(key, value) {
+        this.values.set(key, value);
+    }
+    removeItem(key) {
+        this.values.delete(key);
+    }
+}
+const fallbackStorage = new MemoryStorage();
+export function getDefaultStorage() {
+    if (typeof window !== "undefined" && window.localStorage) {
+        return window.localStorage;
+    }
+    return fallbackStorage;
+}

package/package.json

@@ -0,0 +1,50 @@
+{
+    "name": "@meshagent/meshagent-ts-auth",
+    "version": "0.35.6",
+    "description": "Meshagent Typescript Auth",
+    "homepage": "https://github.com/meshagent/meshagent-ts-auth",
+    "scripts": {
+        "build": "mkdir -p dist && bash ./scripts/build.sh",
+        "test": "jest",
+        "test:watch": "jest --watch"
+    },
+    "author": "Meshagent Software",
+    "license": "Apache-2.0",
+    "type": "module",
+    "unpkg": "./dist/browser/ma-auth.global.js",
+    "jsdelivr": "./dist/browser/ma-auth.global.js",
+    "module": "dist/esm/index.js",
+    "main": "./dist/esm/index.js",
+    "types": "dist/esm/index.d.ts",
+    "typesVersions": {
+        "*": {
+            "global": [
+                "dist/browser/browser-global.d.ts"
+            ]
+        }
+    },
+    "exports": {
+        ".": {
+            "module": "./dist/esm/index.js",
+            "default": "./dist/cjs/index.js"
+        },
+        "./package.json": "./package.json"
+    },
+    "files": [
+        "dist",
+        "LICENSE",
+        "README.md",
+        "CHANGELOG.md"
+    ],
+    "dependencies": {
+        "@meshagent/meshagent": "^0.35.6",
+        "typescript": "^5.8.3"
+    },
+    "devDependencies": {
+        "esbuild": "^0.25.0",
+        "jest": "^30.3.0"
+    },
+    "overrides": {
+        "rollup": "4.52.5"
+    }
+}