@niid/sdk 1.0.2 → 1.0.3

package/dist/core/OAuthFlow.d.ts

@@ -4,12 +4,20 @@ export declare class OAuthFlow {
     private config;
     private apiClient;
     private stateStorageKey;
+    private pkceStorageKey;
     constructor(config: NIIDConfig);
     initiateLogin(): void;
     exchangeCodeForToken(code: string, state?: string): Promise<TokenResponse>;
     refreshAccessToken(refreshToken: string): Promise<TokenResponse>;
+    /**
+     * POST request with automatic retry on network/server errors
+     */
+    private postWithRetry;
     private saveState;
     private getState;
     private clearState;
+    private savePKCE;
+    private getPKCE;
+    private clearPKCE;
 }
 //# sourceMappingURL=OAuthFlow.d.ts.map

package/dist/core/OAuthFlow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OAuthFlow.d.ts","sourceRoot":"","sources":["../../src/core/OAuthFlow.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGrD,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,SAAS,CAAgB;IACjC,OAAO,CAAC,eAAe,CAAS;gBAEpB,MAAM,EAAE,UAAU;IAqB9B,aAAa,IAAI,IAAI;IAef,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IA+B1E,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAoBtE,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,QAAQ;IAYhB,OAAO,CAAC,UAAU;CASnB"}
+{"version":3,"file":"OAuthFlow.d.ts","sourceRoot":"","sources":["../../src/core/OAuthFlow.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AA0BrD,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,SAAS,CAAgB;IACjC,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,cAAc,CAAS;gBAEnB,MAAM,EAAE,UAAU;IAuB9B,aAAa,IAAI,IAAI;IAoBf,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAgC1E,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IActE;;OAEG;YACW,aAAa;IA2B3B,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,QAAQ;IAYhB,OAAO,CAAC,UAAU;IAUlB,OAAO,CAAC,QAAQ;IAUhB,OAAO,CAAC,OAAO;IAWf,OAAO,CAAC,SAAS;CASlB"}

package/dist/core/TokenManager.d.ts

@@ -5,6 +5,8 @@ export declare class TokenManager {
     private accessTokenKey;
     private refreshTokenKey;
     private refreshTimer;
+    private isRefreshing;
+    private refreshPromise;
     constructor(storageKey?: string);
     setTokens(tokenResponse: TokenResponse): void;
     getAccessToken(): string | null;
@@ -12,6 +14,15 @@ export declare class TokenManager {
     isTokenValid(token: string | null): boolean;
     isAccessTokenValid(): boolean;
     getTokenExpiration(token: string): number | null;
+    /**
+     * Execute a refresh with lock to prevent duplicate requests.
+     * If refresh is already in progress, wait for it to complete.
+     */
+    executeWithRefreshLock(refreshFn: () => Promise<void>): Promise<void>;
+    /**
+     * Check if a refresh is currently in progress
+     */
+    isRefreshInProgress(): boolean;
     scheduleTokenRefresh(accessToken: string, onRefresh?: () => void): void;
     clearRefreshTimer(): void;
     clearTokens(): void;

package/dist/core/TokenManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TokenManager.d.ts","sourceRoot":"","sources":["../../src/core/TokenManager.ts"],"names":[],"mappings":"AAEA,OAAO,EAAc,aAAa,EAAE,MAAM,UAAU,CAAC;AAErD,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,YAAY,CAA8C;gBAEtD,UAAU,GAAE,MAAe;IAMvC,SAAS,CAAC,aAAa,EAAE,aAAa,GAAG,IAAI;IAQ7C,cAAc,IAAI,MAAM,GAAG,IAAI;IAI/B,eAAe,IAAI,MAAM,GAAG,IAAI;IAIhC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO;IAY3C,kBAAkB,IAAI,OAAO;IAK7B,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAShD,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,IAAI,GAAG,IAAI;IAmBvE,iBAAiB,IAAI,IAAI;IAOzB,WAAW,IAAI,IAAI;CAKpB"}
+{"version":3,"file":"TokenManager.d.ts","sourceRoot":"","sources":["../../src/core/TokenManager.ts"],"names":[],"mappings":"AAEA,OAAO,EAAc,aAAa,EAAE,MAAM,UAAU,CAAC;AAErD,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,YAAY,CAA8C;IAGlE,OAAO,CAAC,YAAY,CAAkB;IACtC,OAAO,CAAC,cAAc,CAA8B;gBAExC,UAAU,GAAE,MAAe;IAMvC,SAAS,CAAC,aAAa,EAAE,aAAa,GAAG,IAAI;IAQ7C,cAAc,IAAI,MAAM,GAAG,IAAI;IAI/B,eAAe,IAAI,MAAM,GAAG,IAAI;IAIhC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO;IAY3C,kBAAkB,IAAI,OAAO;IAK7B,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAShD;;;OAGG;IACG,sBAAsB,CAAC,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB3E;;OAEG;IACH,mBAAmB,IAAI,OAAO;IAI9B,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,IAAI,GAAG,IAAI;IAoBvE,iBAAiB,IAAI,IAAI;IAOzB,WAAW,IAAI,IAAI;CAKpB"}

package/dist/index.js

@@ -2512,7 +2512,27 @@ function validateConfig(config) {
 function generateState() {
   return Math.random().toString(36).substring(2, 15) + Math.random().toString(36).substring(2, 15);
 }
-function buildAuthorizationUrl(ssoUrl, clientId, redirectUri, scope = "profile email", state) {
+function generatePKCE() {
+  const array = new Uint8Array(32);
+  if (typeof window !== "undefined" && window.crypto) {
+    window.crypto.getRandomValues(array);
+  } else {
+    for (let i = 0; i < array.length; i++) {
+      array[i] = Math.floor(Math.random() * 256);
+    }
+  }
+  const verifier = base64UrlEncode(array);
+  const challenge = verifier;
+  return { verifier, challenge };
+}
+function base64UrlEncode(buffer) {
+  let binary = "";
+  for (let i = 0; i < buffer.length; i++) {
+    binary += String.fromCharCode(buffer[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function buildAuthorizationUrl(ssoUrl, clientId, redirectUri, scope = "profile email", state, codeChallenge) {
   const params = new URLSearchParams({
     response_type: "code",
     client_id: clientId,
@@ -2522,6 +2542,10 @@ function buildAuthorizationUrl(ssoUrl, clientId, redirectUri, scope = "profile e
   if (state) {
     params.append("state", state);
   }
+  if (codeChallenge) {
+    params.append("code_challenge", codeChallenge);
+    params.append("code_challenge_method", "plain");
+  }
   return `${ssoUrl}/?${params.toString()}`;
 }
 class InvalidTokenError extends Error {
@@ -2624,6 +2648,8 @@ class StorageManager {
 class TokenManager {
   constructor(storageKey = "niid") {
     this.refreshTimer = null;
+    this.isRefreshing = false;
+    this.refreshPromise = null;
     this.storage = new StorageManager(storageKey);
     this.accessTokenKey = "access_token";
     this.refreshTokenKey = "refresh_token";
@@ -2663,6 +2689,27 @@ class TokenManager {
       return null;
     }
   }
+  /**
+   * Execute a refresh with lock to prevent duplicate requests.
+   * If refresh is already in progress, wait for it to complete.
+   */
+  async executeWithRefreshLock(refreshFn) {
+    if (this.isRefreshing && this.refreshPromise) {
+      return this.refreshPromise;
+    }
+    this.isRefreshing = true;
+    this.refreshPromise = refreshFn().finally(() => {
+      this.isRefreshing = false;
+      this.refreshPromise = null;
+    });
+    return this.refreshPromise;
+  }
+  /**
+   * Check if a refresh is currently in progress
+   */
+  isRefreshInProgress() {
+    return this.isRefreshing;
+  }
   scheduleTokenRefresh(accessToken, onRefresh) {
     this.clearRefreshTimer();
     const expiration = this.getTokenExpiration(accessToken);
@@ -2690,6 +2737,18 @@ class TokenManager {
     this.clearRefreshTimer();
   }
 }
+const MAX_RETRIES = 3;
+const RETRY_DELAY_MS = 1e3;
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function isRetryableError(error) {
+  if (!error.response) {
+    return true;
+  }
+  const status = error.response.status;
+  return status >= 500 && status < 600;
+}
 class OAuthFlow {
   constructor(config) {
     this.config = {
@@ -2702,27 +2761,32 @@ class OAuthFlow {
       storageKey: config.storageKey || "niid"
     };
     this.stateStorageKey = `${this.config.storageKey}_oauth_state_${this.config.clientId}`;
+    this.pkceStorageKey = `${this.config.storageKey}_pkce_verifier_${this.config.clientId}`;
     this.apiClient = axios.create({
       baseURL: this.config.apiUrl,
       headers: {
         "Content-Type": "application/json"
-      }
+      },
+      timeout: 3e4
+      // 30 second timeout
     });
   }
   initiateLogin() {
     const state = generateState();
     this.saveState(state);
+    const { verifier, challenge } = generatePKCE();
+    this.savePKCE(verifier);
     const authUrl = buildAuthorizationUrl(
       this.config.ssoUrl,
       this.config.clientId,
       this.config.redirectUri,
       this.config.scope,
-      state
+      state,
+      challenge
     );
     window.location.href = authUrl;
   }
   async exchangeCodeForToken(code, state) {
-    var _a, _b;
     if (state) {
       const savedState = this.getState();
       if (savedState) {
@@ -2741,16 +2805,14 @@ class OAuthFlow {
     if (this.config.clientSecret) {
       tokenData.client_secret = this.config.clientSecret;
     }
-    try {
-      const response = await this.apiClient.post("/oauth/token", tokenData);
-      return response.data;
-    } catch (error) {
-      const errorMessage = ((_b = (_a = error.response) == null ? void 0 : _a.data) == null ? void 0 : _b.detail) || error.message || "Failed to exchange authorization code";
-      throw new Error(errorMessage);
+    const pkceVerifier = this.getPKCE();
+    if (pkceVerifier) {
+      tokenData.code_verifier = pkceVerifier;
+      this.clearPKCE();
     }
+    return this.postWithRetry("/oauth/token", tokenData);
   }
   async refreshAccessToken(refreshToken) {
-    var _a, _b;
     const tokenData = {
       grant_type: "refresh_token",
       refresh_token: refreshToken,
@@ -2759,13 +2821,32 @@ class OAuthFlow {
     if (this.config.clientSecret) {
       tokenData.client_secret = this.config.clientSecret;
     }
-    try {
-      const response = await this.apiClient.post("/oauth/token", tokenData);
-      return response.data;
-    } catch (error) {
-      const errorMessage = ((_b = (_a = error.response) == null ? void 0 : _a.data) == null ? void 0 : _b.detail) || error.message || "Failed to refresh access token";
-      throw new Error(errorMessage);
+    return this.postWithRetry("/oauth/token", tokenData);
+  }
+  /**
+   * POST request with automatic retry on network/server errors
+   */
+  async postWithRetry(url, data) {
+    var _a, _b;
+    let lastError = null;
+    for (let attempt = 1; attempt <= MAX_RETRIES; attempt++) {
+      try {
+        const response = await this.apiClient.post(url, data);
+        return response.data;
+      } catch (error) {
+        lastError = error;
+        if (error.isAxiosError && isRetryableError(error)) {
+          if (attempt < MAX_RETRIES) {
+            console.warn(`[NIID SDK] Request failed (attempt ${attempt}/${MAX_RETRIES}), retrying...`);
+            await delay(RETRY_DELAY_MS * attempt);
+            continue;
+          }
+        }
+        const errorMessage = ((_b = (_a = error.response) == null ? void 0 : _a.data) == null ? void 0 : _b.detail) || error.message || "Request failed";
+        throw new Error(errorMessage);
+      }
     }
+    throw lastError || new Error("Request failed after retries");
   }
   saveState(state) {
     if (typeof window !== "undefined") {
@@ -2796,6 +2877,33 @@ class OAuthFlow {
       }
     }
   }
+  savePKCE(verifier) {
+    if (typeof window !== "undefined") {
+      try {
+        localStorage.setItem(this.pkceStorageKey, verifier);
+      } catch (error) {
+        console.warn("[NIID SDK] Failed to save PKCE verifier:", error);
+      }
+    }
+  }
+  getPKCE() {
+    if (typeof window !== "undefined") {
+      try {
+        return localStorage.getItem(this.pkceStorageKey);
+      } catch (error) {
+        return null;
+      }
+    }
+    return null;
+  }
+  clearPKCE() {
+    if (typeof window !== "undefined") {
+      try {
+        localStorage.removeItem(this.pkceStorageKey);
+      } catch (error) {
+      }
+    }
+  }
 }
 class NIIDClient {
   constructor(config) {