@nya-account/node-sdk 2.0.0 → 2.0.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (10) hide show
  1. package/README.md +187 -172
  2. package/dist/{express-yO7hxKKd.d.ts → express-Bn8IUnft.d.ts} +10 -4
  3. package/dist/express-Bn8IUnft.d.ts.map +1 -0
  4. package/dist/express.d.ts +1 -1
  5. package/dist/index.d.ts +60 -45
  6. package/dist/index.d.ts.map +1 -1
  7. package/dist/index.js +103 -153
  8. package/dist/index.js.map +1 -1
  9. package/package.json +2 -2
  10. package/dist/express-yO7hxKKd.d.ts.map +0 -1
package/README.md CHANGED
@@ -1,172 +1,187 @@
1
- # @nya-account/node-sdk
2
-
3
- Official Node.js SDK for [Nya Account](https://github.com/alongw/sso) SSO system.
4
-
5
- Provides a complete OAuth 2.1 / OIDC client with PKCE, JWT verification, and Express middleware.
6
-
7
- ## Installation
8
-
9
- ```bash
10
- npm install @nya-account/node-sdk
11
- # or
12
- pnpm add @nya-account/node-sdk
13
- # or
14
- yarn add @nya-account/node-sdk
15
- ```
16
-
17
- ## Quick Start
18
-
19
- ```typescript
20
- import { NyaAccountClient } from '@nya-account/node-sdk'
21
-
22
- const client = new NyaAccountClient({
23
- issuer: 'https://account.example.com',
24
- clientId: 'my-app',
25
- clientSecret: 'my-secret',
26
- })
27
-
28
- // Create authorization URL (with PKCE)
29
- const { url, codeVerifier, state } = await client.createAuthorizationUrl({
30
- redirectUri: 'https://myapp.com/callback',
31
- scope: 'openid profile email',
32
- })
33
-
34
- // Exchange code for tokens
35
- const tokens = await client.exchangeCode({
36
- code: callbackCode,
37
- redirectUri: 'https://myapp.com/callback',
38
- codeVerifier,
39
- })
40
-
41
- // Get user info
42
- const userInfo = await client.getUserInfo(tokens.accessToken)
43
- ```
44
-
45
- ## Express Middleware
46
-
47
- ```typescript
48
- import express from 'express'
49
- import { NyaAccountClient } from '@nya-account/node-sdk'
50
- import { getAuth } from '@nya-account/node-sdk/express'
51
-
52
- const app = express()
53
- const client = new NyaAccountClient({
54
- issuer: 'https://account.example.com',
55
- clientId: 'my-app',
56
- clientSecret: 'my-secret',
57
- })
58
-
59
- // Protect all /api routes
60
- app.use('/api', client.authenticate())
61
-
62
- app.get('/api/me', (req, res) => {
63
- const auth = getAuth(req)
64
- res.json({ userId: auth?.sub, scopes: auth?.scope })
65
- })
66
-
67
- // Require specific scopes
68
- app.get('/api/profile',
69
- client.authenticate(),
70
- client.requireScopes('profile'),
71
- (req, res) => {
72
- const auth = getAuth(req)
73
- res.json({ name: auth?.sub })
74
- }
75
- )
76
-
77
- // Use introspection for sensitive operations
78
- app.post('/api/sensitive',
79
- client.authenticate({ strategy: 'introspection' }),
80
- handler
81
- )
82
- ```
83
-
84
- ## Configuration
85
-
86
- | Option | Type | Default | Description |
87
- |---|---|---|---|
88
- | `issuer` | `string` | *required* | SSO service URL (Issuer URL) |
89
- | `clientId` | `string` | *required* | OAuth client ID |
90
- | `clientSecret` | `string` | *required* | OAuth client secret |
91
- | `timeout` | `number` | `10000` | HTTP request timeout in milliseconds |
92
- | `discoveryCacheTtl` | `number` | `3600000` | Discovery document cache TTL in milliseconds (default: 1 hour) |
93
- | `endpoints` | `EndpointConfig` | — | Explicitly specify endpoint URLs (auto-discovered via OIDC Discovery if omitted) |
94
-
95
- ## API Reference
96
-
97
- ### `NyaAccountClient`
98
-
99
- #### Authorization
100
-
101
- - **`createAuthorizationUrl(options)`** — Create an OAuth authorization URL with PKCE
102
-
103
- #### Token Operations
104
-
105
- - **`exchangeCode(options)`** — Exchange an authorization code for tokens
106
- - **`refreshToken(refreshToken)`** — Refresh an Access Token
107
- - **`revokeToken(token)`** — Revoke a token (RFC 7009)
108
- - **`introspectToken(token)`** — Token introspection (RFC 7662)
109
-
110
- #### User Info
111
-
112
- - **`getUserInfo(accessToken)`** — Get user info via OIDC UserInfo endpoint
113
-
114
- #### JWT Verification
115
-
116
- - **`verifyAccessToken(token, options?)`** — Locally verify a JWT Access Token (RFC 9068)
117
- - **`verifyIdToken(token, options?)`** — Locally verify an OIDC ID Token
118
-
119
- #### Express Middleware
120
-
121
- - **`authenticate(options?)`** — Middleware to verify Bearer Token (`local` or `introspection` strategy)
122
- - **`requireScopes(...scopes)`** — Middleware to validate token scopes
123
-
124
- #### Cache
125
-
126
- - **`discover()`** — Fetch OIDC Discovery document (cached with TTL)
127
- - **`clearCache()`** — Clear Discovery and JWT verifier cache
128
-
129
- ### Express Helpers
130
-
131
- Available from `@nya-account/node-sdk/express`:
132
-
133
- - **`getAuth(req)`** — Retrieve the verified Access Token payload from a request
134
- - **`extractBearerToken(req)`** — Extract Bearer token from the Authorization header
135
- - **`sendOAuthError(res, statusCode, error, errorDescription)`** — Send an OAuth-standard error response
136
-
137
- ### PKCE Utilities
138
-
139
- - **`generatePkce()`** — Generate a code_verifier and code_challenge pair
140
- - **`generateCodeVerifier()`** — Generate a PKCE code_verifier
141
- - **`generateCodeChallenge(codeVerifier)`** — Generate an S256 code_challenge
142
-
143
- ## Error Handling
144
-
145
- The SDK provides typed error classes:
146
-
147
- ```typescript
148
- import {
149
- NyaAccountError, // Base error class
150
- OAuthError, // OAuth protocol errors from the server
151
- TokenVerificationError, // JWT verification failures
152
- DiscoveryError, // OIDC Discovery failures
153
- } from '@nya-account/node-sdk'
154
-
155
- try {
156
- await client.verifyAccessToken(token)
157
- } catch (error) {
158
- if (error instanceof TokenVerificationError) {
159
- console.log(error.code) // 'token_verification_failed'
160
- console.log(error.description) // Human-readable description
161
- }
162
- }
163
- ```
164
-
165
- ## Requirements
166
-
167
- - Node.js >= 20.0.0
168
- - Express 4.x or 5.x (optional, for middleware features)
169
-
170
- ## License
171
-
172
- [MIT](./LICENSE)
1
+ # @nya-account/node-sdk
2
+
3
+ Official Node.js SDK for [Nya Account](https://account.lolinya.net) SSO system.
4
+
5
+ Provides a complete OAuth 2.1 / OIDC client with PKCE, JWT verification, and Express middleware.
6
+
7
+ ## Installation
8
+
9
+ ```bash
10
+ npm install @nya-account/node-sdk
11
+ # or
12
+ pnpm add @nya-account/node-sdk
13
+ # or
14
+ yarn add @nya-account/node-sdk
15
+ ```
16
+
17
+ ## Quick Start
18
+
19
+ ```typescript
20
+ import { NyaAccountClient } from '@nya-account/node-sdk'
21
+
22
+ const client = new NyaAccountClient({
23
+ // See https://account.lolinya.net/docs/developer/service-endpoints#integration-endpoints
24
+ issuer: 'https://account-api.edge.lolinya.net',
25
+ clientId: 'my-app',
26
+ clientSecret: 'my-secret'
27
+ })
28
+
29
+ // Create authorization URL (with PKCE)
30
+ const { url, codeVerifier, state } = await client.createAuthorizationUrl({
31
+ redirectUri: 'https://myapp.com/callback',
32
+ scope: 'openid profile email'
33
+ })
34
+
35
+ // Exchange code for tokens
36
+ const tokens = await client.exchangeCode({
37
+ code: callbackCode,
38
+ redirectUri: 'https://myapp.com/callback',
39
+ codeVerifier
40
+ })
41
+
42
+ // Get user info
43
+ const userInfo = await client.getUserInfo(tokens.accessToken)
44
+
45
+ // Revoke refresh token on logout
46
+ await client.revokeToken(tokens.refreshToken, { tokenTypeHint: 'refresh_token' })
47
+
48
+ // Build RP-initiated logout URL
49
+ const logoutUrl = await client.createEndSessionUrl({
50
+ idTokenHint: tokens.idToken,
51
+ postLogoutRedirectUri: 'https://myapp.com/logout/callback',
52
+ state: 'logout-csrf-state'
53
+ })
54
+ ```
55
+
56
+ ## Express Middleware
57
+
58
+ ```typescript
59
+ import express from 'express'
60
+ import { NyaAccountClient } from '@nya-account/node-sdk'
61
+ import { getAuth } from '@nya-account/node-sdk/express'
62
+
63
+ const app = express()
64
+ const client = new NyaAccountClient({
65
+ issuer: 'https://account-api.edge.lolinya.net',
66
+ clientId: 'my-app',
67
+ clientSecret: 'my-secret'
68
+ })
69
+
70
+ // Protect all /api routes
71
+ app.use('/api', client.authenticate())
72
+
73
+ app.get('/api/me', (req, res) => {
74
+ const auth = getAuth(req)
75
+ res.json({ userId: auth?.sub, scopes: auth?.scope })
76
+ })
77
+
78
+ // Require specific scopes
79
+ app.get(
80
+ '/api/profile',
81
+ client.authenticate(),
82
+ client.requireScopes('profile'),
83
+ (req, res) => {
84
+ const auth = getAuth(req)
85
+ res.json({ name: auth?.sub })
86
+ }
87
+ )
88
+
89
+ // Use introspection for sensitive operations
90
+ app.post('/api/sensitive', client.authenticate({ strategy: 'introspection' }), handler)
91
+ ```
92
+
93
+ ## Configuration
94
+
95
+ | Option | Type | Default | Description |
96
+ | ------------------- | ---------------- | ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
97
+ | `issuer` | `string` | `'https://account-api.edge.lolinya.net'` | SSO service URL (Issuer URL). See [Service Endpoints](https://account.lolinya.net/docs/developer/service-endpoints#integration-endpoints) for available endpoints. |
98
+ | `clientId` | `string` | _required_ | OAuth client ID |
99
+ | `clientSecret` | `string` | _required_ | OAuth client secret |
100
+ | `timeout` | `number` | `10000` | HTTP request timeout in milliseconds |
101
+ | `discoveryCacheTtl` | `number` | `3600000` | Discovery document cache TTL in milliseconds (default: 1 hour) |
102
+ | `endpoints` | `EndpointConfig` | — | Explicitly specify endpoint URLs (auto-discovered via OIDC Discovery if omitted) |
103
+
104
+ ## API Reference
105
+
106
+ ### `NyaAccountClient`
107
+
108
+ #### Authorization
109
+
110
+ - **`createAuthorizationUrl(options)`** — Create an OAuth authorization URL with PKCE
111
+ - **`pushAuthorizationRequest(options)`** — Push authorization request to PAR endpoint (RFC 9126)
112
+ - **`createAuthorizationUrlWithPar(options)`** — Create authorization URL using PAR `request_uri`
113
+
114
+ #### Token Operations
115
+
116
+ - **`exchangeCode(options)`** — Exchange an authorization code for tokens
117
+ - **`refreshToken(refreshToken)`** — Refresh an Access Token
118
+ - **`revokeToken(token, options?)`** — Revoke a token (RFC 7009)
119
+ - **`introspectToken(token, options?)`** — Token introspection (RFC 7662)
120
+
121
+ #### User Info
122
+
123
+ - **`getUserInfo(accessToken)`** — Get user info via OIDC UserInfo endpoint
124
+
125
+ #### JWT Verification
126
+
127
+ - **`verifyAccessToken(token, options?)`** — Locally verify a JWT Access Token (RFC 9068)
128
+ - **`verifyIdToken(token, options?)`** — Locally verify an OIDC ID Token
129
+
130
+ #### Express Middleware
131
+
132
+ - **`authenticate(options?)`** — Middleware to verify Bearer Token (`local` or `introspection` strategy)
133
+ - **`requireScopes(...scopes)`** — Middleware to validate token scopes
134
+
135
+ #### Cache
136
+
137
+ - **`discover()`** — Fetch OIDC Discovery document (cached with TTL)
138
+ - **`clearCache()`** — Clear Discovery and JWT verifier cache
139
+
140
+ #### OIDC Logout
141
+
142
+ - **`createEndSessionUrl(options?)`** — Create OIDC RP-initiated logout URL (`end_session_endpoint`)
143
+
144
+ ### Express Helpers
145
+
146
+ Available from `@nya-account/node-sdk/express`:
147
+
148
+ - **`getAuth(req)`** — Retrieve the verified Access Token payload from a request
149
+ - **`extractBearerToken(req)`** — Extract Bearer token from the Authorization header
150
+ - **`sendOAuthError(res, statusCode, error, errorDescription)`** — Send an OAuth-standard error response
151
+
152
+ ### PKCE Utilities
153
+
154
+ - **`generatePkce()`** — Generate a code_verifier and code_challenge pair
155
+ - **`generateCodeVerifier()`** — Generate a PKCE code_verifier
156
+ - **`generateCodeChallenge(codeVerifier)`** — Generate an S256 code_challenge
157
+
158
+ ## Error Handling
159
+
160
+ The SDK provides typed error classes:
161
+
162
+ ```typescript
163
+ import {
164
+ NyaAccountError, // Base error class
165
+ OAuthError, // OAuth protocol errors from the server
166
+ TokenVerificationError, // JWT verification failures
167
+ DiscoveryError // OIDC Discovery failures
168
+ } from '@nya-account/node-sdk'
169
+
170
+ try {
171
+ await client.verifyAccessToken(token)
172
+ } catch (error) {
173
+ if (error instanceof TokenVerificationError) {
174
+ console.log(error.code) // 'token_verification_failed'
175
+ console.log(error.description) // Human-readable description
176
+ }
177
+ }
178
+ ```
179
+
180
+ ## Requirements
181
+
182
+ - Node.js >= 20.0.0
183
+ - Express 4.x or 5.x (optional, for middleware features)
184
+
185
+ ## License
186
+
187
+ [MIT](./LICENSE)
package/dist/{express-yO7hxKKd.d.ts → express-Bn8IUnft.d.ts} RENAMED
@@ -9,6 +9,8 @@ declare const AccessTokenPayloadSchema: z.ZodObject<{
9
9
  aud: z.ZodString;
10
10
  scope: z.ZodString;
11
11
  ver: z.ZodString;
12
+ sid: z.ZodString;
13
+ sv: z.ZodNumber;
12
14
  iat: z.ZodNumber;
13
15
  exp: z.ZodNumber;
14
16
  jti: z.ZodString;
@@ -27,6 +29,8 @@ declare const AccessTokenPayloadSchema: z.ZodObject<{
27
29
  aud: string;
28
30
  iss: string;
29
31
  jti: string;
32
+ sid: string;
33
+ sv: number;
30
34
  ver: string;
31
35
  cnf?: {
32
36
  jkt: string;
@@ -39,6 +43,8 @@ declare const AccessTokenPayloadSchema: z.ZodObject<{
39
43
  aud: string;
40
44
  iss: string;
41
45
  jti: string;
46
+ sid: string;
47
+ sv: number;
42
48
  ver: string;
43
49
  cnf?: {
44
50
  jkt: string;
@@ -49,11 +55,11 @@ declare const IdTokenPayloadSchema: z.ZodObject<{
49
55
  iss: z.ZodString;
50
56
  sub: z.ZodString;
51
57
  aud: z.ZodString;
58
+ sid: z.ZodOptional<z.ZodString>;
52
59
  iat: z.ZodNumber;
53
60
  exp: z.ZodNumber;
54
61
  nonce: z.ZodOptional<z.ZodString>;
55
62
  name: z.ZodOptional<z.ZodString>;
56
- preferred_username: z.ZodOptional<z.ZodString>;
57
63
  email: z.ZodOptional<z.ZodString>;
58
64
  email_verified: z.ZodOptional<z.ZodBoolean>;
59
65
  updated_at: z.ZodOptional<z.ZodNumber>;
@@ -63,8 +69,8 @@ declare const IdTokenPayloadSchema: z.ZodObject<{
63
69
  sub: string;
64
70
  aud: string;
65
71
  iss: string;
72
+ sid?: string | undefined;
66
73
  name?: string | undefined;
67
- preferred_username?: string | undefined;
68
74
  email?: string | undefined;
69
75
  email_verified?: boolean | undefined;
70
76
  updated_at?: number | undefined;
@@ -75,8 +81,8 @@ declare const IdTokenPayloadSchema: z.ZodObject<{
75
81
  sub: string;
76
82
  aud: string;
77
83
  iss: string;
84
+ sid?: string | undefined;
78
85
  name?: string | undefined;
79
- preferred_username?: string | undefined;
80
86
  email?: string | undefined;
81
87
  email_verified?: boolean | undefined;
82
88
  updated_at?: number | undefined;
@@ -115,4 +121,4 @@ declare function sendOAuthError(res: Response, statusCode: number, error: string
115
121
 
116
122
  //#endregion
117
123
  export { AccessTokenPayload, IdTokenPayload, extractBearerToken as extractBearerToken$1, getAuth as getAuth$1, sendOAuthError as sendOAuthError$1 };
118
- //# sourceMappingURL=express-yO7hxKKd.d.ts.map
124
+ //# sourceMappingURL=express-Bn8IUnft.d.ts.map
package/dist/express-Bn8IUnft.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"express-Bn8IUnft.d.ts","names":[],"sources":["../src/core/schemas.d.ts","../src/middleware/express.d.ts"],"sourcesContent":null,"mappings":";;;;AAcA,IAAW,2BAAM;CAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;AAAA;AACjB,IAAW,qBAAqB;CAAC;CAAA,MAAA;CAAA,MAAA,EAAA;AAAA;AACjC,IAAG,uBAAA;CAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;CAAA,MAAA,EAAA;AAAA;AACH,IAAW,iBAAa;CAAA;CAAA,MAAA;CAAA,MAAA,EAAA;AAAA;;;;;;;;;;;;;;;;;;;ACAxB,IAAW,UAAU,CAAC,GAAG,MAAM,kBAAmB;;;;AAQlD,IAAW,qBAAqB,CAAC,GAAG,MAAM,OAAQ;;;;AAIlD,IAAW,iBAAiB,CAAC,GAAG,MAAM,QAAS"}
package/dist/express.d.ts CHANGED
@@ -1,2 +1,2 @@
1
- import { extractBearerToken$1 as extractBearerToken, getAuth$1 as getAuth, sendOAuthError$1 as sendOAuthError } from "./express-yO7hxKKd.js";
1
+ import { extractBearerToken$1 as extractBearerToken, getAuth$1 as getAuth, sendOAuthError$1 as sendOAuthError } from "./express-Bn8IUnft.js";
2
2
  export { extractBearerToken, getAuth, sendOAuthError };
package/dist/index.d.ts CHANGED
@@ -1,10 +1,14 @@
1
- import { AccessTokenPayload, IdTokenPayload, getAuth$1 as getAuth } from "./express-yO7hxKKd.js";
1
+ import { AccessTokenPayload, IdTokenPayload, getAuth$1 as getAuth } from "./express-Bn8IUnft.js";
2
2
  import { NextFunction, Request, Response } from "express";
3
3
 
4
4
  //#region src/core/types.d.ts
5
5
  interface NyaAccountConfig {
6
- /** SSO service URL (Issuer URL), can be the service or daemon address */
7
- issuer: string;
6
+ /**
7
+ * SSO service URL (Issuer URL), can be the service or daemon address (default: 'https://account-api.edge.lolinya.net')
8
+ *
9
+ * @see https://account.lolinya.net/docs/developer/service-endpoints#integration-endpoints
10
+ */
11
+ issuer?: string;
8
12
  /** OAuth client ID */
9
13
  clientId: string;
10
14
  /** OAuth client secret */
@@ -18,6 +22,7 @@ interface NyaAccountConfig {
18
22
  }
19
23
  interface EndpointConfig {
20
24
  authorization?: string;
25
+ pushedAuthorizationRequest?: string;
21
26
  token?: string;
22
27
  userinfo?: string;
23
28
  revocation?: string;
@@ -36,7 +41,7 @@ interface TokenResponse {
36
41
  interface UserInfo {
37
42
  sub: string;
38
43
  name?: string;
39
- preferredUsername?: string;
44
+ picture?: string;
40
45
  email?: string;
41
46
  emailVerified?: boolean;
42
47
  updatedAt?: number;
@@ -53,6 +58,8 @@ interface IntrospectionResponse {
53
58
  aud?: string;
54
59
  iss?: string;
55
60
  jti?: string;
61
+ sid?: string;
62
+ sv?: number;
56
63
  }
57
64
  interface DiscoveryDocument {
58
65
  issuer: string;
@@ -83,6 +90,20 @@ interface CreateAuthorizationUrlOptions {
83
90
  /** ID Token replay protection parameter */
84
91
  nonce?: string;
85
92
  }
93
+ interface PushAuthorizationRequestOptions extends CreateAuthorizationUrlOptions {
94
+ /** Optional JAR request object */
95
+ request?: string;
96
+ }
97
+ interface PushAuthorizationRequestResult {
98
+ /** PAR request URI */
99
+ requestUri: string;
100
+ /** PAR request URI lifetime in seconds */
101
+ expiresIn: number;
102
+ /** PKCE code_verifier, must be stored in session for later token exchange */
103
+ codeVerifier: string;
104
+ /** State parameter, must be stored in session for CSRF validation */
105
+ state: string;
106
+ }
86
107
  interface AuthorizationUrlResult {
87
108
  /** Full authorization URL to redirect the user to */
88
109
  url: string;
@@ -91,6 +112,16 @@ interface AuthorizationUrlResult {
91
112
  /** State parameter, must be stored in session for CSRF validation */
92
113
  state: string;
93
114
  }
115
+ interface CreateEndSessionUrlOptions {
116
+ /** Previously issued ID Token */
117
+ idTokenHint?: string;
118
+ /** Redirect URL after logout, must match registered post-logout URI */
119
+ postLogoutRedirectUri?: string;
120
+ /** Opaque state value returned to post_logout_redirect_uri */
121
+ state?: string;
122
+ /** Optional client ID override (defaults to configured clientId) */
123
+ clientId?: string;
124
+ }
94
125
  interface ExchangeCodeOptions {
95
126
  /** Authorization code received in the callback */
96
127
  code: string;
@@ -108,43 +139,6 @@ interface PkcePair {
108
139
  codeChallenge: string;
109
140
  } //#endregion
110
141
  //#region src/client.d.ts
111
-
112
- /**
113
- * Nya Account Node.js SDK client.
114
- *
115
- * Provides full OAuth 2.1 / OIDC flow support:
116
- * - Authorization Code + PKCE
117
- * - Token exchange / refresh / revocation / introspection
118
- * - Local JWT verification (via JWKS)
119
- * - OIDC UserInfo
120
- * - OIDC Discovery auto-discovery
121
- * - Express middleware (Bearer Token auth + scope validation)
122
- *
123
- * @example
124
- * ```typescript
125
- * const client = new NyaAccountClient({
126
- * issuer: 'https://account.example.com',
127
- * clientId: 'my-app',
128
- * clientSecret: 'my-secret',
129
- * })
130
- *
131
- * // Create authorization URL (with PKCE)
132
- * const { url, codeVerifier, state } = await client.createAuthorizationUrl({
133
- * redirectUri: 'https://myapp.com/callback',
134
- * scope: 'openid profile email',
135
- * })
136
- *
137
- * // Exchange code for tokens
138
- * const tokens = await client.exchangeCode({
139
- * code: callbackCode,
140
- * redirectUri: 'https://myapp.com/callback',
141
- * codeVerifier,
142
- * })
143
- *
144
- * // Get user info
145
- * const userInfo = await client.getUserInfo(tokens.accessToken)
146
- * ```
147
- */
148
142
  declare class NyaAccountClient {
149
143
  private httpClient;
150
144
  private config;
@@ -168,6 +162,23 @@ declare class NyaAccountClient {
168
162
  * for later use in token exchange and CSRF validation.
169
163
  */
170
164
  createAuthorizationUrl(options: CreateAuthorizationUrlOptions): Promise<AuthorizationUrlResult>;
165
+ /**
166
+ * Push authorization parameters to PAR endpoint (RFC 9126).
167
+ *
168
+ * Returns a `request_uri` that can be used in the authorization endpoint.
169
+ */
170
+ pushAuthorizationRequest(options: PushAuthorizationRequestOptions): Promise<PushAuthorizationRequestResult>;
171
+ /**
172
+ * Create an authorization URL using PAR `request_uri`.
173
+ */
174
+ createAuthorizationUrlWithPar(options: PushAuthorizationRequestOptions): Promise<AuthorizationUrlResult & {
175
+ requestUri: string;
176
+ expiresIn: number;
177
+ }>;
178
+ /**
179
+ * Create OIDC RP-Initiated Logout URL (`end_session_endpoint`).
180
+ */
181
+ createEndSessionUrl(options?: CreateEndSessionUrlOptions): Promise<string>;
171
182
  /**
172
183
  * Exchange an authorization code for tokens (Authorization Code Grant).
173
184
  */
@@ -182,18 +193,22 @@ declare class NyaAccountClient {
182
193
  * Supports revoking Access Tokens or Refresh Tokens.
183
194
  * Revoking a Refresh Token also revokes its entire token family.
184
195
  */
185
- revokeToken(token: string): Promise<void>;
196
+ revokeToken(token: string, options?: {
197
+ tokenTypeHint?: 'access_token' | 'refresh_token';
198
+ }): Promise<void>;
186
199
  /**
187
200
  * Token introspection (RFC 7662).
188
201
  *
189
202
  * Query the server for the current state of a token (active status, associated user info, etc.).
190
203
  */
191
- introspectToken(token: string): Promise<IntrospectionResponse>;
204
+ introspectToken(token: string, options?: {
205
+ tokenTypeHint?: 'access_token' | 'refresh_token';
206
+ }): Promise<IntrospectionResponse>;
192
207
  /**
193
208
  * Get user info using an Access Token (OIDC UserInfo Endpoint).
194
209
  *
195
210
  * The returned fields depend on the scopes included in the token:
196
- * - `profile`: name, preferredUsername, updatedAt
211
+ * - `profile`: name, picture, updatedAt
197
212
  * - `email`: email, emailVerified
198
213
  */
199
214
  getUserInfo(accessToken: string): Promise<UserInfo>;
@@ -303,5 +318,5 @@ declare function generateCodeChallenge(codeVerifier: string): string;
303
318
  declare function generatePkce(): PkcePair;
304
319
 
305
320
  //#endregion
306
- export { AccessTokenPayload, AuthenticateOptions, AuthorizationUrlResult, CreateAuthorizationUrlOptions, DiscoveryDocument, DiscoveryError, EndpointConfig, ExchangeCodeOptions, IdTokenPayload, IntrospectionResponse, NyaAccountClient, NyaAccountConfig, NyaAccountError, OAuthError, PkcePair, TokenResponse, TokenVerificationError, UserInfo, generateCodeChallenge, generateCodeVerifier, generatePkce, getAuth };
321
+ export { AccessTokenPayload, AuthenticateOptions, AuthorizationUrlResult, CreateAuthorizationUrlOptions, CreateEndSessionUrlOptions, DiscoveryDocument, DiscoveryError, EndpointConfig, ExchangeCodeOptions, IdTokenPayload, IntrospectionResponse, NyaAccountClient, NyaAccountConfig, NyaAccountError, OAuthError, PkcePair, PushAuthorizationRequestOptions, PushAuthorizationRequestResult, TokenResponse, TokenVerificationError, UserInfo, generateCodeChallenge, generateCodeVerifier, generatePkce, getAuth };
307
322
  //# sourceMappingURL=index.d.ts.map
package/dist/index.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","names":[],"sources":["../src/core/types.d.ts","../src/client.d.ts","../src/core/errors.d.ts","../src/utils/pkce.d.ts"],"sourcesContent":null,"mappings":";;;;AAEA,IAAW,mBAAmB,CAAC,IAAG,MAAA,cAAA;AAClC,IAAW,iBAAiB,CAAC,EAAG;AAChC,IAAW,gBAAO,CAAA,EAAA;AAClB,IAAW,WAAW,CAAC,EAAE;AACzB,IAAW,wBAAS,CAAA,EAAA;AACpB,IAAW,oBAAkB,CAAA,EAAA;AAC7B,IAAW,gCAAa,CAAA,EAAA;AACxB,IAAW,yBAAyB,CAAC,EAAG;AACxC,IAAW,sBAAS,CAAA,EAAA;AACpB,IAAW,sBAAsB,CAAC,EAAG;AACrC,IAAW,WAAW,CAAC,EAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC2B1B,IAAW,mBAAmB;CAAC;CAAG,MAAI;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;AAAA;;;;;;;ACpCtC,IAAW,kBAAkB,CAAC,IAAI,MAAM,KAAM;;;;AAI9C,IAAA,aAAA,CAAA,IAAA,MAAA,eAAA;;;;AAIA,IAAW,yBAAyB,CAAC,IAAI,MAAM,eAAS;;;;AAIxD,IAAW,iBAAc,CAAA,IAAA,MAAA,eAAA;;;;;;;ACXzB,IAAW,uBAAuB,CAAC,EAAG;;;;AAItC,IAAW,wBAAwB,CAAC,EAAG;;;;AAIvC,IAAW,eAAe,CAAC,IAAI,MAAM,QAAS"}
1
+ {"version":3,"file":"index.d.ts","names":[],"sources":["../src/core/types.d.ts","../src/client.d.ts","../src/core/errors.d.ts","../src/utils/pkce.d.ts"],"sourcesContent":null,"mappings":";;;;AAEA,IAAW,mBAAmB,CAAC,IAAG,MAAA,cAAA;AAClC,IAAM,iBAAA,CAAA,EAAA;AACN,IAAW,gBAAgB,CAAC,EAAG;AAC/B,IAAK,WAAA,CAAA,EAAA;AACL,IAAW,wBAAwB,CAAC,EAAG;AACvC,IAAM,oBAAA,CAAA,EAAA;AACN,IAAW,gCAAQ,CAAA,EAAA;AACnB,IAAW,kCAAc,CAAA,IAAA,MAAA,6BAAA;AACzB,IAAW,iCAAS,CAAA,EAAA;AACpB,IAAW,yBAAkB,CAAA,EAAA;AAC7B,IAAW,6BAAa,CAAA,EAAA;AACxB,IAAW,sBAAsB,CAAC,EAAG;AACrC,IAAW,sBAAS,CAAA,EAAA;AACpB,IAAW,WAAW,CAAC,EAAG;;;;ACZ1B,IAAW,mBAAmB;CAAC;CAAG,MAAI;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;CAAA,MAAA;AAAA;;;;;;;ACAtC,IAAW,kBAAkB,CAAC,IAAI,MAAM,KAAM;;;;AAI9C,IAAA,aAAA,CAAA,IAAA,MAAA,eAAA;;;;AAIA,IAAW,yBAAyB,CAAC,IAAI,MAAM,eAAS;;;;AAIxD,IAAW,iBAAc,CAAA,IAAA,MAAA,eAAA;;;;;;;ACXzB,IAAW,uBAAuB,CAAC,EAAG;;;;AAItC,IAAW,wBAAwB,CAAC,EAAG;;;;AAIvC,IAAW,eAAe,CAAC,IAAI,MAAM,QAAS"}