@neodaten/auth-native 0.0.0-stage → 0.1.0

package/dist/llaves-del-emisor.js

@@ -0,0 +1,42 @@
+import { ErrorDeIdentidad } from './error-de-identidad';
+const esLlaveEs256 = (valor) => {
+    if (typeof valor !== 'object' || valor === null)
+        return false;
+    if (!('kty' in valor) || !('crv' in valor) || !('x' in valor) || !('y' in valor))
+        return false;
+    if (!('kid' in valor))
+        return false;
+    return (valor.kty === 'EC' &&
+        valor.crv === 'P-256' &&
+        typeof valor.x === 'string' &&
+        typeof valor.y === 'string' &&
+        typeof valor.kid === 'string');
+};
+const llavesDe = async (respuesta) => {
+    if (!respuesta.ok)
+        throw new ErrorDeIdentidad('servicio_no_disponible');
+    const cuerpo = await respuesta.json();
+    const llaves = typeof cuerpo === 'object' && cuerpo !== null && 'keys' in cuerpo && Array.isArray(cuerpo.keys)
+        ? cuerpo.keys
+        : [];
+    return new Map(llaves
+        .filter(esLlaveEs256)
+        .map(({ kid, x, y }) => [kid, { kty: 'EC', crv: 'P-256', x, y }]));
+};
+export const crearLlavesDelEmisor = (jwksUri, pedir) => {
+    let conocidas = null;
+    const descargar = async () => {
+        conocidas = await llavesDe(await pedir(await jwksUri()));
+        return conocidas;
+    };
+    return {
+        async llavePorKid(kid) {
+            const vigentes = conocidas ?? (await descargar());
+            const conocida = vigentes.get(kid);
+            if (conocida !== undefined)
+                return conocida;
+            return (await descargar()).get(kid) ?? null;
+        },
+    };
+};
+//# sourceMappingURL=llaves-del-emisor.js.map

package/dist/llaves-del-emisor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"llaves-del-emisor.js","sourceRoot":"","sources":["../src/llaves-del-emisor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAKxD,MAAM,YAAY,GAAG,CAAC,KAAc,EAA6C,EAAE;IACjF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/F,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,CACL,KAAK,CAAC,GAAG,KAAK,IAAI;QAClB,KAAK,CAAC,GAAG,KAAK,OAAO;QACrB,OAAO,KAAK,CAAC,CAAC,KAAK,QAAQ;QAC3B,OAAO,KAAK,CAAC,CAAC,KAAK,QAAQ;QAC3B,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAC9B,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,QAAQ,GAAG,KAAK,EAAE,SAAmB,EAAwC,EAAE;IACnF,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;IACxE,MAAM,MAAM,GAAY,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;IAC/C,MAAM,MAAM,GACV,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QAC7F,CAAC,CAAC,MAAM,CAAC,IAAI;QACb,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,IAAI,GAAG,CACZ,MAAM;SACH,MAAM,CAAC,YAAY,CAAC;SACpB,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAA4B,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAC9F,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,OAA8B,EAC9B,KAAY,EACK,EAAE;IACnB,IAAI,SAAS,GAAuC,IAAI,CAAC;IACzD,MAAM,SAAS,GAAG,KAAK,IAAI,EAAE;QAC3B,SAAS,GAAG,MAAM,QAAQ,CAAC,MAAM,KAAK,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,CAAC;QACzD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,GAAG;YACnB,MAAM,QAAQ,GAAG,SAAS,IAAI,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC;YAClD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,QAAQ,CAAC;YAC5C,OAAO,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAC9C,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/login-hospedado.d.ts

@@ -0,0 +1,29 @@
+import type { Criptografia } from './criptografia';
+import { type DecisionDeNavegacion, type NavegacionPedida, type ReglasDeNavegacion } from './navegacion-del-login';
+import { type MetadatosDelEmisor, type TokensEmitidos } from './respuesta-del-emisor';
+import { type ProveedorDeAtestacion } from './ticket-de-atestacion';
+export interface DependenciasDelLogin {
+    clienteId: string;
+    recurso: string;
+    redireccion: string;
+    alcance: string;
+    coreApiUrl: string;
+    origenDelLogin: string | null;
+    cripto: Criptografia;
+    proveedorDeAtestacion: ProveedorDeAtestacion | null;
+    metadatos: () => Promise<MetadatosDelEmisor>;
+    pedir: (url: string, init?: RequestInit) => Promise<Response>;
+    ahora: () => number;
+    guardar: (tokens: TokensEmitidos) => Promise<void>;
+}
+export interface OpcionesDeApertura {
+    organizacion?: string;
+    pistaDeIdentificador?: string;
+}
+export interface LoginAbierto {
+    url: string;
+    reglas: ReglasDeNavegacion;
+    decidir(navegacion: NavegacionPedida): DecisionDeNavegacion;
+    completar(urlDelRegreso: string): Promise<void>;
+}
+export declare const abrirLoginHospedado: (dependencias: DependenciasDelLogin, opciones?: OpcionesDeApertura) => Promise<LoginAbierto>;

package/dist/login-hospedado.js

@@ -0,0 +1,123 @@
+import { exigirCanalSeguroDelCanje, exigirOrigenDelLogin } from './canal-del-canje';
+import { ErrorDeIdentidad } from './error-de-identidad';
+import { crearLlavesDelEmisor } from './llaves-del-emisor';
+import { decidirNavegacion, esElRegresoDeLaApp, } from './navegacion-del-login';
+import { crearPedidoProtegido } from './pkce';
+import { tokensDe } from './respuesta-del-emisor';
+import { pedirTicketDeAtestacion } from './ticket-de-atestacion';
+import { validarIdToken } from './validar-id-token';
+const PARAMETRO_DEL_TICKET = 'atestacion';
+const ERROR_DE_ACCESO_DENEGADO = 'access_denied';
+const formulario = (campos) => ({
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams(campos).toString(),
+});
+const ajena = () => new ErrorDeIdentidad('respuesta_ajena');
+const origenesDe = ({ issuer, authorization_endpoint }, origenDelLogin) => [
+    ...new Set([
+        new URL(issuer).origin,
+        new URL(authorization_endpoint).origin,
+        exigirOrigenDelLogin(origenDelLogin ?? new URL(issuer).origin, issuer),
+    ]),
+];
+const urlDeAutorizacion = ({ dependencias, metadatos, pedido, ticket, opciones, }) => {
+    const url = new URL(metadatos.authorization_endpoint);
+    const parametros = {
+        client_id: dependencias.clienteId,
+        redirect_uri: dependencias.redireccion,
+        response_type: 'code',
+        scope: dependencias.alcance,
+        resource: dependencias.recurso,
+        state: pedido.estado,
+        nonce: pedido.nonce,
+        code_challenge: pedido.reto,
+        code_challenge_method: 'S256',
+        ...(ticket === null ? {} : { [PARAMETRO_DEL_TICKET]: ticket }),
+        ...(opciones.organizacion === undefined ? {} : { organization: opciones.organizacion }),
+        ...(opciones.pistaDeIdentificador === undefined
+            ? {}
+            : { login_hint: opciones.pistaDeIdentificador }),
+    };
+    for (const [nombre, valor] of Object.entries(parametros))
+        url.searchParams.set(nombre, valor);
+    return url.toString();
+};
+const codigoDelRegreso = (urlDelRegreso, { dependencias, metadatos, pedido }) => {
+    if (!URL.canParse(urlDelRegreso))
+        throw ajena();
+    const regreso = new URL(urlDelRegreso);
+    if (!esElRegresoDeLaApp(regreso, new URL(dependencias.redireccion)))
+        throw ajena();
+    const parametros = regreso.searchParams;
+    if (parametros.get('state') !== pedido.estado)
+        throw ajena();
+    const emisor = parametros.get('iss');
+    if (emisor !== null && emisor !== metadatos.issuer)
+        throw ajena();
+    const error = parametros.get('error');
+    if (error !== null) {
+        throw new ErrorDeIdentidad(error === ERROR_DE_ACCESO_DENEGADO ? 'acceso_cancelado' : 'respuesta_invalida');
+    }
+    const codigo = parametros.get('code');
+    if (codigo === null || codigo.length === 0)
+        throw new ErrorDeIdentidad('respuesta_invalida');
+    return codigo;
+};
+const ticketSiHayProveedor = (dependencias) => dependencias.proveedorDeAtestacion === null
+    ? Promise.resolve(null)
+    : pedirTicketDeAtestacion({
+        coreApiUrl: dependencias.coreApiUrl,
+        clienteId: dependencias.clienteId,
+        proveedor: dependencias.proveedorDeAtestacion,
+        pedir: dependencias.pedir,
+    });
+const canjear = async (codigo, { dependencias, metadatos, pedido }) => {
+    if (dependencias.cripto.verificarEs256 === null) {
+        exigirCanalSeguroDelCanje(metadatos.token_endpoint, metadatos.issuer);
+    }
+    const tokens = await tokensDe(await dependencias.pedir(metadatos.token_endpoint, formulario({
+        grant_type: 'authorization_code',
+        client_id: dependencias.clienteId,
+        code: codigo,
+        redirect_uri: dependencias.redireccion,
+        code_verifier: pedido.verificador,
+        resource: dependencias.recurso,
+    })));
+    if (tokens.id_token === undefined)
+        throw new ErrorDeIdentidad('identidad_invalida');
+    await validarIdToken(tokens.id_token, {
+        emisor: metadatos.issuer,
+        clienteId: dependencias.clienteId,
+        nonce: pedido.nonce,
+        ahoraMs: dependencias.ahora(),
+    }, {
+        llaves: crearLlavesDelEmisor(() => Promise.resolve(metadatos.jwks_uri), dependencias.pedir),
+        cripto: dependencias.cripto,
+    });
+    return tokens;
+};
+export const abrirLoginHospedado = async (dependencias, opciones = {}) => {
+    const metadatos = await dependencias.metadatos();
+    const reglas = {
+        redireccion: dependencias.redireccion,
+        origenesPermitidos: origenesDe(metadatos, dependencias.origenDelLogin),
+    };
+    const pedido = await crearPedidoProtegido(dependencias.cripto);
+    const ticket = await ticketSiHayProveedor(dependencias);
+    const contexto = { dependencias, metadatos, pedido };
+    let completado = false;
+    return {
+        url: urlDeAutorizacion({ ...contexto, ticket, opciones }),
+        reglas,
+        decidir: (navegacion) => decidirNavegacion(navegacion, reglas),
+        async completar(urlDelRegreso) {
+            if (completado)
+                throw new ErrorDeIdentidad('login_ya_completado');
+            completado = true;
+            const codigo = codigoDelRegreso(urlDelRegreso, contexto);
+            await dependencias.guardar(await canjear(codigo, contexto));
+        },
+    };
+};
+//# sourceMappingURL=login-hospedado.js.map

package/dist/login-hospedado.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-hospedado.js","sourceRoot":"","sources":["../src/login-hospedado.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,iBAAiB,EACjB,kBAAkB,GAInB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAwB,MAAM,QAAQ,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAgD,MAAM,wBAAwB,CAAC;AAChG,OAAO,EAAE,uBAAuB,EAA8B,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAC1C,MAAM,wBAAwB,GAAG,eAAe,CAAC;AA6BjD,MAAM,UAAU,GAAG,CAAC,MAA8B,EAAe,EAAE,CAAC,CAAC;IACnE,MAAM,EAAE,MAAM;IACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;IAChE,IAAI,EAAE,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAEH,MAAM,KAAK,GAAG,GAAqB,EAAE,CAAC,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;AAE9E,MAAM,UAAU,GAAG,CACjB,EAAE,MAAM,EAAE,sBAAsB,EAAsB,EACtD,cAA6B,EACnB,EAAE,CAAC;IACb,GAAG,IAAI,GAAG,CAAC;QACT,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM;QACtB,IAAI,GAAG,CAAC,sBAAsB,CAAC,CAAC,MAAM;QACtC,oBAAoB,CAAC,cAAc,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC;KACvE,CAAC;CACH,CAAC;AAUF,MAAM,iBAAiB,GAAG,CAAC,EACzB,YAAY,EACZ,SAAS,EACT,MAAM,EACN,MAAM,EACN,QAAQ,GACU,EAAU,EAAE;IAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;IACtD,MAAM,UAAU,GAA2B;QACzC,SAAS,EAAE,YAAY,CAAC,SAAS;QACjC,YAAY,EAAE,YAAY,CAAC,WAAW;QACtC,aAAa,EAAE,MAAM;QACrB,KAAK,EAAE,YAAY,CAAC,OAAO;QAC3B,QAAQ,EAAE,YAAY,CAAC,OAAO;QAC9B,KAAK,EAAE,MAAM,CAAC,MAAM;QACpB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,cAAc,EAAE,MAAM,CAAC,IAAI;QAC3B,qBAAqB,EAAE,MAAM;QAC7B,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC9D,GAAG,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC;QACvF,GAAG,CAAC,QAAQ,CAAC,oBAAoB,KAAK,SAAS;YAC7C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,oBAAoB,EAAE,CAAC;KACnD,CAAC;IACF,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9F,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CACvB,aAAqB,EACrB,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAkD,EAC3E,EAAE;IACV,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC;QAAE,MAAM,KAAK,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACvC,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QAAE,MAAM,KAAK,EAAE,CAAC;IACnF,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC;IACxC,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM;QAAE,MAAM,KAAK,EAAE,CAAC;IAC7D,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,CAAC,MAAM;QAAE,MAAM,KAAK,EAAE,CAAC;IAClE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,gBAAgB,CACxB,KAAK,KAAK,wBAAwB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,oBAAoB,CAC/E,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;IAC7F,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAAC,YAAkC,EAA0B,EAAE,CAC1F,YAAY,CAAC,qBAAqB,KAAK,IAAI;IACzC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;IACvB,CAAC,CAAC,uBAAuB,CAAC;QACtB,UAAU,EAAE,YAAY,CAAC,UAAU;QACnC,SAAS,EAAE,YAAY,CAAC,SAAS;QACjC,SAAS,EAAE,YAAY,CAAC,qBAAqB;QAC7C,KAAK,EAAE,YAAY,CAAC,KAAK;KAC1B,CAAC,CAAC;AAET,MAAM,OAAO,GAAG,KAAK,EACnB,MAAc,EACd,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAkD,EAC1D,EAAE;IAC3B,IAAI,YAAY,CAAC,MAAM,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;QAChD,yBAAyB,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAC3B,MAAM,YAAY,CAAC,KAAK,CACtB,SAAS,CAAC,cAAc,EACxB,UAAU,CAAC;QACT,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,YAAY,CAAC,SAAS;QACjC,IAAI,EAAE,MAAM;QACZ,YAAY,EAAE,YAAY,CAAC,WAAW;QACtC,aAAa,EAAE,MAAM,CAAC,WAAW;QACjC,QAAQ,EAAE,YAAY,CAAC,OAAO;KAC/B,CAAC,CACH,CACF,CAAC;IACF,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;IACpF,MAAM,cAAc,CAClB,MAAM,CAAC,QAAQ,EACf;QACE,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,SAAS,EAAE,YAAY,CAAC,SAAS;QACjC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,YAAY,CAAC,KAAK,EAAE;KAC9B,EACD;QACE,MAAM,EAAE,oBAAoB,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC;QAC3F,MAAM,EAAE,YAAY,CAAC,MAAM;KAC5B,CACF,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EACtC,YAAkC,EAClC,WAA+B,EAAE,EACV,EAAE;IACzB,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,CAAC;IACjD,MAAM,MAAM,GAAuB;QACjC,WAAW,EAAE,YAAY,CAAC,WAAW;QACrC,kBAAkB,EAAE,UAAU,CAAC,SAAS,EAAE,YAAY,CAAC,cAAc,CAAC;KACvE,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IACrD,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,OAAO;QACL,GAAG,EAAE,iBAAiB,CAAC,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACzD,MAAM;QACN,OAAO,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,iBAAiB,CAAC,UAAU,EAAE,MAAM,CAAC;QAC9D,KAAK,CAAC,SAAS,CAAC,aAAa;YAC3B,IAAI,UAAU;gBAAE,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;YAClE,UAAU,GAAG,IAAI,CAAC;YAClB,MAAM,MAAM,GAAG,gBAAgB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;YACzD,MAAM,YAAY,CAAC,OAAO,CAAC,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC9D,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/navegacion-del-login.d.ts

@@ -0,0 +1,20 @@
+export declare const ORIGEN_DEL_CAPTCHA = "https://challenges.cloudflare.com";
+export type DecisionDeNavegacion = {
+    tipo: 'cargar';
+} | {
+    tipo: 'callback';
+    url: string;
+} | {
+    tipo: 'descartar';
+    url: string;
+};
+export interface NavegacionPedida {
+    url: string;
+    esMarcoPrincipal: boolean;
+}
+export interface ReglasDeNavegacion {
+    redireccion: string;
+    origenesPermitidos: readonly string[];
+}
+export declare const esElRegresoDeLaApp: (url: URL, redireccion: URL) => boolean;
+export declare const decidirNavegacion: ({ url, esMarcoPrincipal }: NavegacionPedida, { redireccion, origenesPermitidos }: ReglasDeNavegacion) => DecisionDeNavegacion;

package/dist/navegacion-del-login.js

@@ -0,0 +1,27 @@
+export const ORIGEN_DEL_CAPTCHA = 'https://challenges.cloudflare.com';
+const PROTOCOLOS_WEB = new Set(['https:', 'http:']);
+const MARCOS_INTERNOS = new Set(['about:blank', 'about:srcdoc']);
+const leer = (texto) => (URL.canParse(texto) ? new URL(texto) : null);
+export const esElRegresoDeLaApp = (url, redireccion) => url.protocol === redireccion.protocol &&
+    url.host === redireccion.host &&
+    url.pathname === redireccion.pathname &&
+    url.username === '' &&
+    url.password === '';
+const esOrigenPermitido = (url, origenes) => PROTOCOLOS_WEB.has(url.protocol) && origenes.includes(url.origin);
+const esDelMarcoDelCaptcha = (url, esMarcoPrincipal) => !esMarcoPrincipal && url.origin === ORIGEN_DEL_CAPTCHA;
+export const decidirNavegacion = ({ url, esMarcoPrincipal }, { redireccion, origenesPermitidos }) => {
+    const descartar = { tipo: 'descartar', url };
+    const leida = leer(url);
+    const regreso = leer(redireccion);
+    if (leida === null || regreso === null)
+        return descartar;
+    if (esElRegresoDeLaApp(leida, regreso)) {
+        return esMarcoPrincipal ? { tipo: 'callback', url } : descartar;
+    }
+    if (!esMarcoPrincipal && MARCOS_INTERNOS.has(url))
+        return { tipo: 'cargar' };
+    if (esOrigenPermitido(leida, origenesPermitidos))
+        return { tipo: 'cargar' };
+    return esDelMarcoDelCaptcha(leida, esMarcoPrincipal) ? { tipo: 'cargar' } : descartar;
+};
+//# sourceMappingURL=navegacion-del-login.js.map

package/dist/navegacion-del-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"navegacion-del-login.js","sourceRoot":"","sources":["../src/navegacion-del-login.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,kBAAkB,GAAG,mCAAmC,CAAC;AAEtE,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AACzE,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;AAiBtF,MAAM,IAAI,GAAG,CAAC,KAAa,EAAc,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAE1F,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAQ,EAAE,WAAgB,EAAW,EAAE,CACxE,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC,QAAQ;IACrC,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI;IAC7B,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC,QAAQ;IACrC,GAAG,CAAC,QAAQ,KAAK,EAAE;IACnB,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC;AAEtB,MAAM,iBAAiB,GAAG,CAAC,GAAQ,EAAE,QAA2B,EAAW,EAAE,CAC3E,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAEpE,MAAM,oBAAoB,GAAG,CAAC,GAAQ,EAAE,gBAAyB,EAAW,EAAE,CAC5E,CAAC,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,kBAAkB,CAAC;AAEzD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,EAAE,GAAG,EAAE,gBAAgB,EAAoB,EAC3C,EAAE,WAAW,EAAE,kBAAkB,EAAsB,EACjC,EAAE;IACxB,MAAM,SAAS,GAAyB,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;IACnE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IAClC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACzD,IAAI,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;QACvC,OAAO,gBAAgB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,gBAAgB,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC7E,IAAI,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5E,OAAO,oBAAoB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACxF,CAAC,CAAC"}

package/dist/pantalla/index.d.ts

@@ -0,0 +1,2 @@
+export { crearManejadorDeCarga, type AvisosDelLogin } from './manejador-de-carga';
+export { PantallaDeLoginHospedado, type PropiedadesDelLoginHospedado, } from './pantalla-de-login-hospedado';

package/dist/pantalla/index.js

@@ -0,0 +1,3 @@
+export { crearManejadorDeCarga } from './manejador-de-carga';
+export { PantallaDeLoginHospedado, } from './pantalla-de-login-hospedado';
+//# sourceMappingURL=index.js.map

package/dist/pantalla/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/pantalla/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAuB,MAAM,sBAAsB,CAAC;AAClF,OAAO,EACL,wBAAwB,GAEzB,MAAM,+BAA+B,CAAC"}

package/dist/pantalla/manejador-de-carga.d.ts

@@ -0,0 +1,11 @@
+import type { LoginAbierto } from '../login-hospedado';
+export interface PeticionDeCarga {
+    url: string;
+    isTopFrame: boolean;
+}
+export interface AvisosDelLogin {
+    alEntrar: () => void;
+    alFallar: (error: unknown) => void;
+    alDescartarEnlace?: (url: string) => void;
+}
+export declare const crearManejadorDeCarga: (login: LoginAbierto, { alEntrar, alFallar, alDescartarEnlace }: AvisosDelLogin) => ({ url, isTopFrame }: PeticionDeCarga) => boolean;

package/dist/pantalla/manejador-de-carga.js

@@ -0,0 +1,12 @@
+export const crearManejadorDeCarga = (login, { alEntrar, alFallar, alDescartarEnlace }) => ({ url, isTopFrame }) => {
+    const decision = login.decidir({ url, esMarcoPrincipal: isTopFrame });
+    if (decision.tipo === 'cargar')
+        return true;
+    if (decision.tipo === 'descartar') {
+        alDescartarEnlace?.(decision.url);
+        return false;
+    }
+    login.completar(decision.url).then(alEntrar, alFallar);
+    return false;
+};
+//# sourceMappingURL=manejador-de-carga.js.map

package/dist/pantalla/manejador-de-carga.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manejador-de-carga.js","sourceRoot":"","sources":["../../src/pantalla/manejador-de-carga.ts"],"names":[],"mappings":"AAaA,MAAM,CAAC,MAAM,qBAAqB,GAChC,CAAC,KAAmB,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,EAAkB,EAAE,EAAE,CACnF,CAAC,EAAE,GAAG,EAAE,UAAU,EAAmB,EAAW,EAAE;IAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAC;IACtE,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAClC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACvD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC"}

package/dist/pantalla/pantalla-de-login-hospedado.d.ts

@@ -0,0 +1,6 @@
+import type { LoginAbierto } from '../login-hospedado';
+import { type AvisosDelLogin } from './manejador-de-carga';
+export interface PropiedadesDelLoginHospedado extends AvisosDelLogin {
+    login: LoginAbierto;
+}
+export declare function PantallaDeLoginHospedado({ login, alEntrar, alFallar, alDescartarEnlace, }: PropiedadesDelLoginHospedado): import("react/jsx-runtime").JSX.Element;

package/dist/pantalla/pantalla-de-login-hospedado.js

@@ -0,0 +1,30 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { useMemo } from 'react';
+import { WebView } from 'react-native-webview';
+import { crearManejadorDeCarga } from './manejador-de-carga';
+const ORIGENES_QUE_DECIDE_LA_APP = ['*'];
+const SIN_RASTRO = {
+    incognito: true,
+    cacheEnabled: false,
+    cacheMode: 'LOAD_NO_CACHE',
+    sharedCookiesEnabled: false,
+    thirdPartyCookiesEnabled: false,
+    javaScriptCanOpenWindowsAutomatically: false,
+    setSupportMultipleWindows: false,
+    allowFileAccess: false,
+    allowFileAccessFromFileURLs: false,
+    allowUniversalAccessFromFileURLs: false,
+    allowsLinkPreview: false,
+    mediaPlaybackRequiresUserAction: true,
+    geolocationEnabled: false,
+    webviewDebuggingEnabled: false,
+};
+export function PantallaDeLoginHospedado({ login, alEntrar, alFallar, alDescartarEnlace, }) {
+    const decidirCarga = useMemo(() => crearManejadorDeCarga(login, {
+        alEntrar,
+        alFallar,
+        ...(alDescartarEnlace === undefined ? {} : { alDescartarEnlace }),
+    }), [login, alEntrar, alFallar, alDescartarEnlace]);
+    return (_jsx(WebView, { ...SIN_RASTRO, source: { uri: login.url }, originWhitelist: ORIGENES_QUE_DECIDE_LA_APP, onShouldStartLoadWithRequest: decidirCarga }));
+}
+//# sourceMappingURL=pantalla-de-login-hospedado.js.map

package/dist/pantalla/pantalla-de-login-hospedado.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pantalla-de-login-hospedado.js","sourceRoot":"","sources":["../../src/pantalla/pantalla-de-login-hospedado.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAChC,OAAO,EAAE,OAAO,EAAqB,MAAM,sBAAsB,CAAC;AAGlE,OAAO,EAAE,qBAAqB,EAAuB,MAAM,sBAAsB,CAAC;AAElF,MAAM,0BAA0B,GAAG,CAAC,GAAG,CAAC,CAAC;AAMzC,MAAM,UAAU,GAA0B;IACxC,SAAS,EAAE,IAAI;IACf,YAAY,EAAE,KAAK;IACnB,SAAS,EAAE,eAAe;IAC1B,oBAAoB,EAAE,KAAK;IAC3B,wBAAwB,EAAE,KAAK;IAC/B,qCAAqC,EAAE,KAAK;IAC5C,yBAAyB,EAAE,KAAK;IAChC,eAAe,EAAE,KAAK;IACtB,2BAA2B,EAAE,KAAK;IAClC,gCAAgC,EAAE,KAAK;IACvC,iBAAiB,EAAE,KAAK;IACxB,+BAA+B,EAAE,IAAI;IACrC,kBAAkB,EAAE,KAAK;IACzB,uBAAuB,EAAE,KAAK;CAC/B,CAAC;AAEF,MAAM,UAAU,wBAAwB,CAAC,EACvC,KAAK,EACL,QAAQ,EACR,QAAQ,EACR,iBAAiB,GACY;IAC7B,MAAM,YAAY,GAAG,OAAO,CAC1B,GAAG,EAAE,CACH,qBAAqB,CAAC,KAAK,EAAE;QAC3B,QAAQ;QACR,QAAQ;QACR,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC;KAClE,CAAC,EACJ,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAC/C,CAAC;IAEF,OAAO,CACL,KAAC,OAAO,OACF,UAAU,EACd,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,EAC1B,eAAe,EAAE,0BAA0B,EAC3C,4BAA4B,EAAE,YAAY,GAC1C,CACH,CAAC;AACJ,CAAC"}

package/dist/passkey-de-la-bienvenida.d.ts

@@ -0,0 +1,20 @@
+import type { ProveedorDeAtestacion } from './ticket-de-atestacion';
+export declare const GRANT_TYPE_PASSKEY = "urn:neodaten:grant-type:passkey";
+export type BiometriaDelDispositivo = 'rostro' | 'huella' | 'otra';
+export interface ProveedorDePasskey {
+    biometria(): Promise<BiometriaDelDispositivo | null>;
+    firmar(opcionesJson: string): Promise<string>;
+}
+export interface RetoDePasskey {
+    reto: string;
+    opcionesJson: string;
+    dispositivo: string | null;
+}
+export interface PedidoDeRetoDePasskey {
+    coreApiUrl: string;
+    emisor: string;
+    clienteId: string;
+    proveedorDeAtestacion: ProveedorDeAtestacion | null;
+    pedir: (url: string, init?: RequestInit) => Promise<Response>;
+}
+export declare const pedirRetoDePasskey: (pedido: PedidoDeRetoDePasskey) => Promise<RetoDePasskey>;

package/dist/passkey-de-la-bienvenida.js

@@ -0,0 +1,50 @@
+import { ErrorDeIdentidad } from './error-de-identidad';
+import { pedirTicketDelDispositivo } from './ticket-de-atestacion';
+export const GRANT_TYPE_PASSKEY = 'urn:neodaten:grant-type:passkey';
+const PREFIJO_DEL_EMISOR = '/p/';
+const ESTADO_DE_ATESTACION_REQUERIDA = 428;
+const slugDelEmisor = (emisor) => {
+    const { pathname } = new URL(emisor);
+    const indice = pathname.lastIndexOf(PREFIJO_DEL_EMISOR);
+    const slug = indice === -1 ? '' : pathname.slice(indice + PREFIJO_DEL_EMISOR.length);
+    if (slug.length === 0 || slug.includes('/'))
+        throw new ErrorDeIdentidad('respuesta_invalida');
+    return slug;
+};
+const esObjeto = (valor) => typeof valor === 'object' && valor !== null;
+const ticketSiHayProveedor = (pedido) => pedido.proveedorDeAtestacion === null
+    ? Promise.resolve(null)
+    : pedirTicketDelDispositivo({
+        coreApiUrl: pedido.coreApiUrl,
+        clienteId: pedido.clienteId,
+        proveedor: pedido.proveedorDeAtestacion,
+        pedir: pedido.pedir,
+    });
+const retoDe = async (respuesta) => {
+    if (!respuesta.ok) {
+        throw new ErrorDeIdentidad(respuesta.status === ESTADO_DE_ATESTACION_REQUERIDA
+            ? 'atestacion_fallida'
+            : 'servicio_no_disponible');
+    }
+    const cuerpo = await respuesta.json();
+    if (!esObjeto(cuerpo) || typeof cuerpo.reto !== 'string' || !esObjeto(cuerpo.opciones)) {
+        throw new ErrorDeIdentidad('respuesta_invalida');
+    }
+    return { reto: cuerpo.reto, opcionesJson: JSON.stringify(cuerpo.opciones) };
+};
+export const pedirRetoDePasskey = async (pedido) => {
+    const atestada = await ticketSiHayProveedor(pedido);
+    const respuesta = await pedido.pedir(`${pedido.coreApiUrl}/oidc/${slugDelEmisor(pedido.emisor)}/nativa/passkey/reto`, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            ...(atestada === null ? {} : { 'x-dispositivo': atestada.dispositivo }),
+        },
+        body: JSON.stringify({
+            client_id: pedido.clienteId,
+            ...(atestada === null ? {} : { atestacion: atestada.ticket }),
+        }),
+    });
+    return { ...(await retoDe(respuesta)), dispositivo: atestada?.dispositivo ?? null };
+};
+//# sourceMappingURL=passkey-de-la-bienvenida.js.map

package/dist/passkey-de-la-bienvenida.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-de-la-bienvenida.js","sourceRoot":"","sources":["../src/passkey-de-la-bienvenida.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAEnE,MAAM,CAAC,MAAM,kBAAkB,GAAG,iCAAiC,CAAC;AAuBpE,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAE3C,MAAM,aAAa,GAAG,CAAC,MAAc,EAAU,EAAE;IAC/C,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACrF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;IAC9F,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AAE9C,MAAM,oBAAoB,GAAG,CAC3B,MAA6B,EACS,EAAE,CACxC,MAAM,CAAC,qBAAqB,KAAK,IAAI;IACnC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;IACvB,CAAC,CAAC,yBAAyB,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,qBAAqB;QACvC,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC,CAAC;AAET,MAAM,MAAM,GAAG,KAAK,EAAE,SAAmB,EAA+C,EAAE;IACxF,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,gBAAgB,CACxB,SAAS,CAAC,MAAM,KAAK,8BAA8B;YACjD,CAAC,CAAC,oBAAoB;YACtB,CAAC,CAAC,wBAAwB,CAC7B,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAY,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC9E,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EAAE,MAA6B,EAA0B,EAAE;IAChG,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAClC,GAAG,MAAM,CAAC,UAAU,SAAS,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAC/E;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;SACxE;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;SAC9D,CAAC;KACH,CACF,CAAC;IACF,OAAO,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,IAAI,IAAI,EAAE,CAAC;AACtF,CAAC,CAAC"}

package/dist/pkce.d.ts

@@ -0,0 +1,8 @@
+import type { Criptografia } from './criptografia';
+export interface PedidoProtegido {
+    verificador: string;
+    reto: string;
+    estado: string;
+    nonce: string;
+}
+export declare const crearPedidoProtegido: (cripto: Criptografia) => Promise<PedidoProtegido>;

package/dist/pkce.js

@@ -0,0 +1,13 @@
+import { aBase64url, textoABytes } from './base64url';
+const BYTES_DEL_VERIFICADOR = 32;
+const BYTES_DEL_ESTADO = 16;
+export const crearPedidoProtegido = async (cripto) => {
+    const verificador = aBase64url(cripto.bytesAleatorios(BYTES_DEL_VERIFICADOR));
+    return {
+        verificador,
+        reto: aBase64url(await cripto.sha256(textoABytes(verificador))),
+        estado: aBase64url(cripto.bytesAleatorios(BYTES_DEL_ESTADO)),
+        nonce: aBase64url(cripto.bytesAleatorios(BYTES_DEL_ESTADO)),
+    };
+};
+//# sourceMappingURL=pkce.js.map

package/dist/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../src/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAGtD,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAS5B,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EAAE,MAAoB,EAA4B,EAAE;IAC3F,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC9E,OAAO;QACL,WAAW;QACX,IAAI,EAAE,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;QAC/D,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;QAC5D,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;KAC5D,CAAC;AACJ,CAAC,CAAC"}

package/dist/respuesta-del-emisor.d.ts

@@ -0,0 +1,17 @@
+import { ErrorDeIdentidad } from './error-de-identidad';
+export interface TokensEmitidos {
+    access_token: string;
+    expires_in: number;
+    refresh_token: string;
+    id_token?: string;
+}
+export interface MetadatosDelEmisor {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    jwks_uri: string;
+    revocation_endpoint?: string;
+}
+export declare function sinConexion(error: unknown): ErrorDeIdentidad;
+export declare function tokensDe(respuesta: Response): Promise<TokensEmitidos>;
+export declare function metadatosDe(respuesta: Response, emisorEsperado: string): Promise<MetadatosDelEmisor>;

package/dist/respuesta-del-emisor.js

@@ -0,0 +1,70 @@
+import { ErrorDeIdentidad } from './error-de-identidad';
+const CAMPOS_OBLIGATORIOS_DEL_EMISOR = [
+    'issuer',
+    'authorization_endpoint',
+    'token_endpoint',
+    'jwks_uri',
+];
+const PRIMER_ESTADO_DE_ERROR_DEL_SERVIDOR = 500;
+const ERRORES_DE_CREDENCIAL = new Set(['invalid_grant']);
+const esObjeto = (valor) => typeof valor === 'object' && valor !== null;
+const interpretarJson = async (respuesta) => {
+    try {
+        const valor = await respuesta.json();
+        return valor;
+    }
+    catch (error) {
+        if (error instanceof SyntaxError)
+            return null;
+        throw error;
+    }
+};
+export function sinConexion(error) {
+    return error instanceof ErrorDeIdentidad
+        ? error
+        : new ErrorDeIdentidad('sin_conexion', { cause: error });
+}
+export async function tokensDe(respuesta) {
+    const cuerpo = await interpretarJson(respuesta);
+    if (!respuesta.ok) {
+        const error = esObjeto(cuerpo) ? cuerpo.error : undefined;
+        if (typeof error === 'string' && ERRORES_DE_CREDENCIAL.has(error)) {
+            throw new ErrorDeIdentidad('codigo_invalido');
+        }
+        throw new ErrorDeIdentidad(respuesta.status >= PRIMER_ESTADO_DE_ERROR_DEL_SERVIDOR || error === 'temporarily_unavailable'
+            ? 'servicio_no_disponible'
+            : 'respuesta_invalida');
+    }
+    if (!esObjeto(cuerpo) ||
+        typeof cuerpo.access_token !== 'string' ||
+        typeof cuerpo.expires_in !== 'number' ||
+        typeof cuerpo.refresh_token !== 'string') {
+        throw new ErrorDeIdentidad('respuesta_invalida');
+    }
+    return {
+        access_token: cuerpo.access_token,
+        expires_in: cuerpo.expires_in,
+        refresh_token: cuerpo.refresh_token,
+        ...(typeof cuerpo.id_token === 'string' ? { id_token: cuerpo.id_token } : {}),
+    };
+}
+const tieneLosCamposDelEmisor = (cuerpo) => esObjeto(cuerpo) &&
+    CAMPOS_OBLIGATORIOS_DEL_EMISOR.every((campo) => typeof cuerpo[campo] === 'string');
+export async function metadatosDe(respuesta, emisorEsperado) {
+    const cuerpo = await interpretarJson(respuesta);
+    if (!respuesta.ok || !tieneLosCamposDelEmisor(cuerpo)) {
+        throw new ErrorDeIdentidad('servicio_no_disponible');
+    }
+    if (cuerpo.issuer !== emisorEsperado)
+        throw new ErrorDeIdentidad('respuesta_ajena');
+    return {
+        issuer: cuerpo.issuer,
+        authorization_endpoint: cuerpo.authorization_endpoint,
+        token_endpoint: cuerpo.token_endpoint,
+        jwks_uri: cuerpo.jwks_uri,
+        ...(typeof cuerpo.revocation_endpoint === 'string'
+            ? { revocation_endpoint: cuerpo.revocation_endpoint }
+            : {}),
+    };
+}
+//# sourceMappingURL=respuesta-del-emisor.js.map

package/dist/respuesta-del-emisor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"respuesta-del-emisor.js","sourceRoot":"","sources":["../src/respuesta-del-emisor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAiBxD,MAAM,8BAA8B,GAAG;IACrC,QAAQ;IACR,wBAAwB;IACxB,gBAAgB;IAChB,UAAU;CACF,CAAC;AAEX,MAAM,mCAAmC,GAAG,GAAG,CAAC;AAChD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;AAEzD,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AAE9C,MAAM,eAAe,GAAG,KAAK,EAAE,SAAmB,EAAoB,EAAE;IACtE,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,KAAK,YAAY,gBAAgB;QACtC,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,gBAAgB,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,SAAmB;IAChD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,IAAI,gBAAgB,CACxB,SAAS,CAAC,MAAM,IAAI,mCAAmC,IAAI,KAAK,KAAK,yBAAyB;YAC5F,CAAC,CAAC,wBAAwB;YAC1B,CAAC,CAAC,oBAAoB,CACzB,CAAC;IACJ,CAAC;IACD,IACE,CAAC,QAAQ,CAAC,MAAM,CAAC;QACjB,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;QACvC,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;QACrC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,EACxC,CAAC;QACD,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;IACnD,CAAC;IACD,OAAO;QACL,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,GAAG,CAAC,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC;AACJ,CAAC;AAED,MAAM,uBAAuB,GAAG,CAC9B,MAAe,EAES,EAAE,CAC1B,QAAQ,CAAC,MAAM,CAAC;IAChB,8BAA8B,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC;AAErF,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAmB,EACnB,cAAsB;IAEtB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc;QAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IACpF,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;QACrD,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,CAAC,OAAO,MAAM,CAAC,mBAAmB,KAAK,QAAQ;YAChD,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,EAAE;YACrD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC"}

package/dist/sesion-guardada.d.ts

@@ -0,0 +1,12 @@
+import type { AlmacenSeguro } from './almacen-seguro';
+export declare const LLAVE_DE_LA_SESION = "neodaten.sesion";
+export declare const LLAVE_DEL_REFRESCO = "neodaten.sesion.refresco";
+export interface SesionGuardada {
+    acceso: string;
+    venceEn: number;
+    refresco: string;
+    identidad: string | null;
+}
+export declare function borrarSesion(almacen: AlmacenSeguro): Promise<void>;
+export declare function leerSesion(almacen: AlmacenSeguro): Promise<SesionGuardada | null>;
+export declare function guardarSesion(almacen: AlmacenSeguro, { refresco, ...datos }: SesionGuardada): Promise<void>;

package/dist/sesion-guardada.js

@@ -0,0 +1,44 @@
+export const LLAVE_DE_LA_SESION = 'neodaten.sesion';
+export const LLAVE_DEL_REFRESCO = 'neodaten.sesion.refresco';
+const esTexto = (valor) => typeof valor === 'string' && valor.length > 0;
+const esDatosDeLaSesion = (valor) => {
+    if (typeof valor !== 'object' || valor === null)
+        return false;
+    if (!('acceso' in valor) || !('venceEn' in valor) || !('identidad' in valor))
+        return false;
+    return (esTexto(valor.acceso) &&
+        typeof valor.venceEn === 'number' &&
+        (valor.identidad === null || esTexto(valor.identidad)));
+};
+const interpretarJson = (texto) => {
+    try {
+        const valor = JSON.parse(texto);
+        return valor;
+    }
+    catch (error) {
+        if (error instanceof SyntaxError)
+            return null;
+        throw error;
+    }
+};
+export async function borrarSesion(almacen) {
+    await almacen.borrar(LLAVE_DE_LA_SESION);
+    await almacen.borrar(LLAVE_DEL_REFRESCO);
+}
+export async function leerSesion(almacen) {
+    const texto = await almacen.obtener(LLAVE_DE_LA_SESION);
+    if (texto === null)
+        return null;
+    const datos = interpretarJson(texto);
+    const refresco = await almacen.obtener(LLAVE_DEL_REFRESCO);
+    if (esDatosDeLaSesion(datos) && esTexto(refresco)) {
+        return { acceso: datos.acceso, venceEn: datos.venceEn, identidad: datos.identidad, refresco };
+    }
+    await borrarSesion(almacen);
+    return null;
+}
+export async function guardarSesion(almacen, { refresco, ...datos }) {
+    await almacen.guardar(LLAVE_DEL_REFRESCO, refresco);
+    await almacen.guardar(LLAVE_DE_LA_SESION, JSON.stringify(datos));
+}
+//# sourceMappingURL=sesion-guardada.js.map

package/dist/sesion-guardada.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sesion-guardada.js","sourceRoot":"","sources":["../src/sesion-guardada.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AACpD,MAAM,CAAC,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAW7D,MAAM,OAAO,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AAEnG,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAA4B,EAAE;IACrE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3F,OAAO,CACL,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QACrB,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACjC,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CACvD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,KAAa,EAAW,EAAE;IACjD,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAsB;IACvD,MAAM,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACzC,MAAM,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAsB;IACrD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACxD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC3D,IAAI,iBAAiB,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC;IAChG,CAAC;IACD,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAsB,EACtB,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAkB;IAEtC,MAAM,OAAO,CAAC,OAAO,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;IACpD,MAAM,OAAO,CAAC,OAAO,CAAC,kBAAkB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AACnE,CAAC"}

package/dist/sha256.d.ts

@@ -0,0 +1 @@
+export declare const sha256: (datos: Uint8Array) => Uint8Array;