@multiplatform.one/keycloak 6.6.0 → 7.0.0

package/types/oauth/pkce.d.ts

@@ -0,0 +1,49 @@
+/**
+ * File: /src/oauth/pkce.ts
+ * Project: @multiplatform.one/keycloak
+ *
+ * PKCE (RFC 7636) for public clients. A desktop app cannot keep a client
+ * secret, so the code verifier is what proves the app redeeming the
+ * authorization code is the same app that requested it.
+ *
+ * Crypto is injected rather than imported: the browser has WebCrypto, GJS has
+ * GLib.compute_checksum_for_bytes, and neither is reachable from the other.
+ * Keeping the primitive behind an interface is also what makes this file
+ * testable with fixed vectors.
+ */
+export interface PkceCrypto {
+    /** Cryptographically secure random bytes. */
+    randomBytes(length: number): Uint8Array;
+    /** Raw (not hex) SHA-256 digest. */
+    sha256(input: Uint8Array): Uint8Array;
+}
+export interface PkcePair {
+    verifier: string;
+    challenge: string;
+    method: "S256";
+}
+/**
+ * base64url per RFC 4648 §5 — no padding, URL-safe alphabet.
+ *
+ * Hand-rolled rather than btoa/Buffer because this runs on all three of
+ * browsers, node (tests) and GJS, and GJS has neither of those globals.
+ */
+export declare function base64UrlEncode(bytes: Uint8Array): string;
+/**
+ * RFC 7636 §4.1 allows a 43–128 char verifier; 32 random bytes base64url-encode
+ * to 43 chars, the shortest length the spec considers secure.
+ */
+export declare function createPkcePair(crypto: PkceCrypto): PkcePair;
+/** Opaque CSRF token echoed back on the redirect (RFC 6749 §10.12). */
+export declare function createStateToken(crypto: Pick<PkceCrypto, "randomBytes">): string;
+/**
+ * Replay defence for the ID token (OIDC Core §3.1.2.1). Sent on the
+ * authorization request and echoed in the id_token's `nonce` claim, so a
+ * token captured from one login cannot be presented as the result of another.
+ *
+ * Separate from the state token on purpose: state binds the *redirect* to
+ * this process, nonce binds the *token* to this authorization request, and
+ * reusing one value for both would leak the state into the token.
+ */
+export declare function createNonce(crypto: Pick<PkceCrypto, "randomBytes">): string;
+//# sourceMappingURL=pkce.d.ts.map

package/types/oauth/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/oauth/pkce.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,UAAU;IACzB,6CAA6C;IAC7C,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC;IACxC,oCAAoC;IACpC,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAAC;CACvC;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAID;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAgBzD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,QAAQ,CAI3D;AAED,uEAAuE;AACvE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,MAAM,CAEhF;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,MAAM,CAE3E"}

package/types/oauth/tokenExchange.d.ts

@@ -0,0 +1,89 @@
+/**
+ * File: /src/oauth/tokenExchange.ts
+ * Project: @multiplatform.one/keycloak
+ *
+ * The token endpoint calls, written against a minimal fetch shape so the GJS
+ * libsoup fetch shim satisfies it as readily as the platform fetch.
+ *
+ * This module is also where every ID token this package produces gets
+ * validated. Doing it here rather than in the flow is what makes the
+ * invariant checkable: a `TokenSet` whose `idToken` is set has had that token
+ * validated against the issuer and this client, because there is no other way
+ * to construct one — `toTokenSet` is module-private and `TokenSet` is branded,
+ * so a consumer cannot object-literal its way past the validation either. It
+ * is also the only place OIDC Core §3.1.3.7's "directly from the Token
+ * Endpoint" precondition is provably true — see idToken.ts for what that
+ * precondition buys and what it does not.
+ */
+import type { OidcEndpoints } from "./endpoints";
+import { type IdTokenClaims } from "./idToken";
+export interface FetchLikeResponse {
+    ok: boolean;
+    status: number;
+    json(): Promise<unknown>;
+    text(): Promise<string>;
+}
+export type FetchLike = (url: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    body: string;
+}) => Promise<FetchLikeResponse>;
+declare const tokenSetBrand: unique symbol;
+export interface TokenSet {
+    /**
+     * Phantom brand — in the type, never on the object. It is what makes the
+     * invariant above checkable rather than merely stated: an object literal
+     * cannot satisfy this interface, so the only `TokenSet` that exists is one
+     * `toTokenSet` returned, and `toTokenSet` cannot return without having put
+     * any `idToken` through `validateIdToken` first.
+     */
+    readonly [tokenSetBrand]: true;
+    accessToken: string;
+    /**
+     * Present only when it passed `validateIdToken` — `iss`, `aud`, `azp`,
+     * `exp` and (on the authorization-code grant) `nonce` have all been
+     * checked. Its signature has not been verified; see idToken.ts for why
+     * that is sound here and what would break it.
+     */
+    idToken?: string;
+    /** Claims of the validated `idToken`, so callers need not re-decode it. */
+    idTokenClaims?: IdTokenClaims;
+    refreshToken?: string;
+    /** Access token lifetime in seconds, as reported by the server. */
+    expiresIn?: number;
+    refreshExpiresIn?: number;
+    tokenType?: string;
+    scope?: string;
+}
+export interface ExchangeCodeParams {
+    endpoints: OidcEndpoints;
+    clientId: string;
+    code: string;
+    codeVerifier: string;
+    redirectUri: string;
+    /**
+     * The nonce from the authorization request this code came back on.
+     * Required, not optional: it is the only thing binding the returned ID
+     * token to this login, and an optional parameter is one a caller forgets.
+     */
+    nonce: string;
+    /** Epoch seconds for the `exp`/`iat` checks. Injected by tests. */
+    now?: number;
+}
+export declare function exchangeAuthorizationCode(fetchImpl: FetchLike, { endpoints, clientId, code, codeVerifier, redirectUri, nonce, now }: ExchangeCodeParams): Promise<TokenSet>;
+export interface RefreshParams {
+    endpoints: OidcEndpoints;
+    clientId: string;
+    refreshToken: string;
+    /** Epoch seconds for the `exp`/`iat` checks. Injected by tests. */
+    now?: number;
+}
+export declare function refreshAccessToken(fetchImpl: FetchLike, { endpoints, clientId, refreshToken, now }: RefreshParams): Promise<TokenSet>;
+/**
+ * End the Keycloak SSO session via back-channel logout. Preferred over opening
+ * the end-session URL in a browser on GNOME: there is no app window to return
+ * to, so a browser tab would just be left sitting on a logout page.
+ */
+export declare function endSession(fetchImpl: FetchLike, { endpoints, clientId, refreshToken }: RefreshParams): Promise<void>;
+export {};
+//# sourceMappingURL=tokenExchange.d.ts.map

package/types/oauth/tokenExchange.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenExchange.d.ts","sourceRoot":"","sources":["../../src/oauth/tokenExchange.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjD,OAAO,EAAE,KAAK,aAAa,EAAmB,MAAM,WAAW,CAAC;AAEhE,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACzB,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACzB;AAED,MAAM,MAAM,SAAS,GAAG,CACtB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,KACpE,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEhC,OAAO,CAAC,MAAM,aAAa,EAAE,OAAO,MAAM,CAAC;AAE3C,MAAM,WAAW,QAAQ;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAkFD,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,aAAa,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,yBAAyB,CAC7C,SAAS,EAAE,SAAS,EACpB,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,kBAAkB,GACvF,OAAO,CAAC,QAAQ,CAAC,CAuBnB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,aAAa,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,SAAS,EACpB,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,EAAE,EAAE,aAAa,GACxD,OAAO,CAAC,QAAQ,CAAC,CAWnB;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAC9B,SAAS,EAAE,SAAS,EACpB,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,aAAa,GACnD,OAAO,CAAC,IAAI,CAAC,CAWf"}

package/types/one.d.ts

@@ -23,6 +23,13 @@ export interface AuthHandlerConfig {
     scopes?: string[];
     /** Expo deep-link scheme (e.g. "multiplatform-one") — added to trustedOrigins. */
     expoScheme?: string;
+    /**
+     * Additional origins allowed to hit the auth route (e.g. LAN device
+     * origins). Extends — never replaces — the defaults (baseUrl, keycloak
+     * URL, expo scheme). Also readable from the KEYCLOAK_TRUSTED_ORIGINS env
+     * var as a comma-separated list.
+     */
+    trustedOrigins?: string[];
 }
 export type Auth = ReturnType<typeof createAuth>;
 //# sourceMappingURL=one.d.ts.map

package/types/one.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"one.d.ts","sourceRoot":"","sources":["../src/one.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,wBAAgB,UAAU,CAAC,MAAM,EAAE,iBAAiB,mCA+CnD;AAED,MAAM,WAAW,eAAe;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC"}
+{"version":3,"file":"one.d.ts","sourceRoot":"","sources":["../src/one.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,wBAAgB,UAAU,CAAC,MAAM,EAAE,iBAAiB,mCAmEnD;AAED,MAAM,WAAW,eAAe;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC"}

package/types/provider/AfterAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AfterAuth.d.ts","sourceRoot":"","sources":["../../src/provider/AfterAuth.tsx"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,iBAAiB,EAAa,MAAM,OAAO,CAAC;AAK9E,MAAM,WAAW,cAAe,SAAQ,iBAAiB;IACvD,gBAAgB,CAAC,EAAE,aAAa,CAAC;CAClC;AAED,wBAAgB,SAAS,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,EAAE,cAAc,2CAwD1F"}
+{"version":3,"file":"AfterAuth.d.ts","sourceRoot":"","sources":["../../src/provider/AfterAuth.tsx"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,iBAAiB,EAAa,MAAM,OAAO,CAAC;AAM9E,MAAM,WAAW,cAAe,SAAQ,iBAAiB;IACvD,gBAAgB,CAAC,EAAE,aAAa,CAAC;CAClC;AAED,wBAAgB,SAAS,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,EAAE,cAAc,2CA8D1F"}

package/types/provider/authProvider/index.native.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.native.d.ts","sourceRoot":"","sources":["../../../src/provider/authProvider/index.native.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAYH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAElD,wBAAgB,YAAY,CAAC,EAC3B,QAAQ,EACR,QAAQ,EACR,cAAc,EACd,gBAAgB,GACjB,EAAE,iBAAiB,2CA6FnB"}
+{"version":3,"file":"index.native.d.ts","sourceRoot":"","sources":["../../../src/provider/authProvider/index.native.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAiBH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAElD,wBAAgB,YAAY,CAAC,EAC3B,QAAQ,EACR,QAAQ,EACR,cAAc,EACd,gBAAgB,GACjB,EAAE,iBAAiB,2CAyHnB"}

package/types/state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,OAAO,SAAmD,CAAC;AAExE,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,SAAU,SAAQ,cAAc;IAC/C,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,eAAe,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,SAAS,EAAE,CAAC,MAAM,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CAC1F;AAOD,wBAAgB,YAAY,IAAI,SAAS,CAUxC"}
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,OAAO,SAAwC,CAAC;AAE7D,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,SAAU,SAAQ,cAAc;IAC/C,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,eAAe,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,SAAS,EAAE,CAAC,MAAM,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CAC1F;AAOD,wBAAgB,YAAY,IAAI,SAAS,CAUxC"}