@osdk/oauth 1.1.0-beta.1 → 1.1.0-beta.11

package/build/browser/createPublicOauthClient.js

@@ -13,23 +13,49 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+
 import delay from "delay";
 import { authorizationCodeGrantRequest, calculatePKCECodeChallenge, customFetch, generateRandomCodeVerifier, generateRandomState, processAuthorizationCodeOAuth2Response, refreshTokenGrantRequest, validateAuthResponse } from "oauth4webapi";
-import { common, createAuthorizationServer, readLocal, removeLocal, saveLocal } from "./common.js";
+import { common, createAuthorizationServer, readLocal, readSession, removeLocal, removeSession, saveLocal, saveSession } from "./common.js";
 import { throwIfError } from "./throwIfError.js";
+import { processOptionsAndAssignDefaults } from "./utils.js";
+
 /**
- * @param client_id
- * @param url the base url of your foundry server
- * @param redirectUrl the url configured for redirect in the oauth configuration on the server
- * @param useHistory if true, when possible uses `history.replaceState()`, otherwise uses `window.location.assign()`
- * @param loginPage if you want a custom landing page prior to logging in, set this to that url
- * @param postLoginPage if you want to customize where you return to after a completed authentication cycle. defaults to the url when the page loaded
- * @param scopes
- * @param fetchFn
- * @param ctxPath
- * @returns {PublicOauthClient} which can be used as a token provider
+ * Creates a PublicOauthClient for authentication.
+ *
+ * @param {string} clientId - The client_id from the OAuth configuration on the server
+ * @param {string} url - The base URL of your Foundry server
+ * @param {string} redirectUrl - The URL configured for redirect in the OAuth configuration on the server
+ * @param {PublicOauthClientOptions} options - Additional options for the client
+ * @returns {PublicOauthClient} A client that can be used as a token provider
+ */
+
+/**
+ * Creates a PublicOauthClient for authentication.
+ *
+ * @param {string} clientId - The client_id from the OAuth configuration on the server
+ * @param {string} url - The base URL of your Foundry server
+ * @param {string} redirectUrl - The URL configured for redirect in the OAuth configuration on the server
+ * @param {boolean} useHistory - If true, uses `history.replaceState()`, otherwise uses `window.location.assign()` (defaults to true)
+ * @param {string} loginPage - Custom landing page URL prior to logging in
+ * @param {string} postLoginPage - URL to return to after completed authentication cycle (defaults to `window.location.toString()`)
+ * @param {string[]} scopes - OAuth scopes to request. If not provided, defaults to `["api:read-data", "api:write-data"]`
+ * @param {typeof globalThis.fetch} fetchFn - Custom fetch function to use for requests (defaults to `globalThis.fetch`)
+ * @param {string} ctxPath - Context path for the authorization server (defaults to "multipass")
+ * @returns {PublicOauthClient} A client that can be used as a token provider
  */
-export function createPublicOauthClient(client_id, url, redirectUrl, useHistory = true, loginPage, postLoginPage = window.location.toString(), scopes = [], fetchFn = globalThis.fetch, ctxPath = "/multipass") {
+
+export function createPublicOauthClient(client_id, url, redirect_uri, useHistory, loginPage, postLoginPage, scopes, fetchFn, ctxPath) {
+  let refreshTokenMarker;
+  ({
+    useHistory,
+    loginPage,
+    postLoginPage,
+    scopes,
+    fetchFn,
+    ctxPath,
+    refreshTokenMarker
+  } = processOptionsAndAssignDefaults(url, redirect_uri, useHistory, loginPage, postLoginPage, scopes, fetchFn, ctxPath));
   const client = {
     client_id,
     token_endpoint_auth_method: "none"
@@ -38,9 +64,6 @@ export function createPublicOauthClient(client_id, url, redirectUrl, useHistory
   const oauthHttpOptions = {
     [customFetch]: fetchFn
   };
-  if (scopes.length === 0) {
-    scopes = ["api:read-data", "api:write-data"];
-  }
   const {
     makeTokenAndSaveRefresh,
     getToken
@@ -52,17 +75,23 @@ export function createPublicOauthClient(client_id, url, redirectUrl, useHistory
     ) ?? (await maybeHandleAuthReturn())
     // 3. If we haven't been able to load the token from one of the two above ways, we need to make the initial auth request
     ?? (await initiateLoginRedirect());
-  }, oauthHttpOptions, maybeRefresh.bind(globalThis, true));
-  async function go(x) {
-    if (useHistory) return window.history.replaceState({}, "", x);else window.location.assign(x);
+  }, oauthHttpOptions, maybeRefresh.bind(globalThis, true), refreshTokenMarker);
+
+  // as an arrow function, `useHistory` is known to be a boolean
+  const go = async x => {
+    if (useHistory) {
+      window.history.replaceState({}, "", x);
+      return;
+    } else window.location.assign(x);
     await delay(1000);
     throw new Error("Unable to redirect");
-  }
+  };
   async function maybeRefresh(expectRefreshToken) {
     const {
-      refresh_token
+      refresh_token,
+      refreshTokenMarker: lastRefreshTokenMarker
     } = readLocal(client);
-    if (!refresh_token) {
+    if (!refresh_token || lastRefreshTokenMarker !== refreshTokenMarker) {
       if (expectRefreshToken) throw new Error("No refresh token found");
       return;
     }
@@ -70,11 +99,12 @@ export function createPublicOauthClient(client_id, url, redirectUrl, useHistory
       // note, we don't use processRefreshTokenResponse because the mp oauth implementation
       // doesn't do refresh tokens quite right and this lets us skip the id check
       const result = makeTokenAndSaveRefresh(throwIfError(await processAuthorizationCodeOAuth2Response(authServer, client, await refreshTokenGrantRequest(authServer, client, refresh_token, oauthHttpOptions))), "refresh");
-      if (result && window.location.pathname === new URL(redirectUrl).pathname) {
+      if (result && window.location.pathname === new URL(redirect_uri).pathname) {
         const {
           oldUrl
-        } = readLocal(client);
-        go(oldUrl ?? "/");
+        } = readSession(client);
+        // don't block on the redirect
+        void go(oldUrl ?? "/");
       }
       return result;
     } catch (e) {
@@ -90,14 +120,14 @@ export function createPublicOauthClient(client_id, url, redirectUrl, useHistory
   }
   async function maybeHandleAuthReturn() {
     const {
-      codeVerifier,
       state,
-      oldUrl
-    } = readLocal(client);
+      oldUrl,
+      codeVerifier
+    } = readSession(client);
     if (!codeVerifier) return;
     try {
-      const ret = makeTokenAndSaveRefresh(throwIfError(await processAuthorizationCodeOAuth2Response(authServer, client, await authorizationCodeGrantRequest(authServer, client, throwIfError(validateAuthResponse(authServer, client, new URL(window.location.href), state)), redirectUrl, codeVerifier, oauthHttpOptions))), "signIn");
-      go(oldUrl);
+      const ret = makeTokenAndSaveRefresh(throwIfError(await processAuthorizationCodeOAuth2Response(authServer, client, await authorizationCodeGrantRequest(authServer, client, throwIfError(validateAuthResponse(authServer, client, new URL(window.location.href), state)), redirect_uri, codeVerifier, oauthHttpOptions))), "signIn");
+      void go(oldUrl);
       return ret;
     } catch (e) {
       if (process.env.NODE_ENV !== "production") {
@@ -105,19 +135,26 @@ export function createPublicOauthClient(client_id, url, redirectUrl, useHistory
         console.warn("Failed to get OAuth2 token using PKCE, removing PKCE and starting a new auth flow", e);
       }
       removeLocal(client);
+      removeSession(client);
+      throw e;
     }
   }
-  async function initiateLoginRedirect() {
+
+  // As an arrow function, `scopes` and `postLoginPage` are known at compile time
+  const initiateLoginRedirect = async () => {
     if (loginPage && window.location.href !== loginPage && window.location.pathname !== loginPage) {
-      saveLocal(client, {
+      saveLocal(client, {});
+      saveSession(client, {
         oldUrl: postLoginPage
       });
-      return await go(loginPage);
+      await go(loginPage);
+      return;
     }
     const state = generateRandomState();
     const codeVerifier = generateRandomCodeVerifier();
-    const oldUrl = readLocal(client).oldUrl ?? window.location.toString();
-    saveLocal(client, {
+    const oldUrl = readSession(client).oldUrl ?? window.location.toString();
+    saveLocal(client, {});
+    saveSession(client, {
       codeVerifier,
       state,
       oldUrl
@@ -126,15 +163,16 @@ export function createPublicOauthClient(client_id, url, redirectUrl, useHistory
       client_id,
       response_type: "code",
       state,
-      redirect_uri: redirectUrl,
+      redirect_uri,
       code_challenge: await calculatePKCECodeChallenge(codeVerifier),
       code_challenge_method: "S256",
       scope: ["offline_access", ...scopes].join(" ")
     })}`);
+
     // Give time for redirect to happen
     await delay(1000);
     throw new Error("Unable to redirect");
-  }
+  };
   return getToken;
 }
 //# sourceMappingURL=createPublicOauthClient.js.map

package/build/browser/createPublicOauthClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"createPublicOauthClient.js","names":["delay","authorizationCodeGrantRequest","calculatePKCECodeChallenge","customFetch","generateRandomCodeVerifier","generateRandomState","processAuthorizationCodeOAuth2Response","refreshTokenGrantRequest","validateAuthResponse","common","createAuthorizationServer","readLocal","removeLocal","saveLocal","throwIfError","createPublicOauthClient","client_id","url","redirectUrl","useHistory","loginPage","postLoginPage","window","location","toString","scopes","fetchFn","globalThis","fetch","ctxPath","client","token_endpoint_auth_method","authServer","oauthHttpOptions","length","makeTokenAndSaveRefresh","getToken","_signIn","maybeRefresh","maybeHandleAuthReturn","initiateLoginRedirect","bind","go","x","history","replaceState","assign","Error","expectRefreshToken","refresh_token","result","pathname","URL","oldUrl","e","process","env","NODE_ENV","console","warn","codeVerifier","state","ret","href","authorization_endpoint","URLSearchParams","response_type","redirect_uri","code_challenge","code_challenge_method","scope","join"],"sources":["createPublicOauthClient.js"],"sourcesContent":["/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport delay from \"delay\";\nimport { authorizationCodeGrantRequest, calculatePKCECodeChallenge, customFetch, generateRandomCodeVerifier, generateRandomState, processAuthorizationCodeOAuth2Response, refreshTokenGrantRequest, validateAuthResponse, } from \"oauth4webapi\";\nimport { common, createAuthorizationServer, readLocal, removeLocal, saveLocal, } from \"./common.js\";\nimport { throwIfError } from \"./throwIfError.js\";\n/**\n * @param client_id\n * @param url the base url of your foundry server\n * @param redirectUrl the url configured for redirect in the oauth configuration on the server\n * @param useHistory if true, when possible uses `history.replaceState()`, otherwise uses `window.location.assign()`\n * @param loginPage if you want a custom landing page prior to logging in, set this to that url\n * @param postLoginPage if you want to customize where you return to after a completed authentication cycle. defaults to the url when the page loaded\n * @param scopes\n * @param fetchFn\n * @param ctxPath\n * @returns {PublicOauthClient} which can be used as a token provider\n */\nexport function createPublicOauthClient(client_id, url, redirectUrl, useHistory = true, loginPage, postLoginPage = window.location.toString(), scopes = [], fetchFn = globalThis.fetch, ctxPath = \"/multipass\") {\n    const client = { client_id, token_endpoint_auth_method: \"none\" };\n    const authServer = createAuthorizationServer(ctxPath, url);\n    const oauthHttpOptions = { [customFetch]: fetchFn };\n    if (scopes.length === 0) {\n        scopes = [\"api:read-data\", \"api:write-data\"];\n    }\n    const { makeTokenAndSaveRefresh, getToken } = common(client, authServer, _signIn, oauthHttpOptions, maybeRefresh.bind(globalThis, true));\n    async function go(x) {\n        if (useHistory)\n            return window.history.replaceState({}, \"\", x);\n        else\n            window.location.assign(x);\n        await delay(1000);\n        throw new Error(\"Unable to redirect\");\n    }\n    async function maybeRefresh(expectRefreshToken) {\n        const { refresh_token } = readLocal(client);\n        if (!refresh_token) {\n            if (expectRefreshToken)\n                throw new Error(\"No refresh token found\");\n            return;\n        }\n        try {\n            // note, we don't use processRefreshTokenResponse because the mp oauth implementation\n            // doesn't do refresh tokens quite right and this lets us skip the id check\n            const result = makeTokenAndSaveRefresh(throwIfError(await processAuthorizationCodeOAuth2Response(authServer, client, await refreshTokenGrantRequest(authServer, client, refresh_token, oauthHttpOptions))), \"refresh\");\n            if (result && window.location.pathname === new URL(redirectUrl).pathname) {\n                const { oldUrl } = readLocal(client);\n                go(oldUrl ?? \"/\");\n            }\n            return result;\n        }\n        catch (e) {\n            if (process.env.NODE_ENV !== \"production\") {\n                // eslint-disable-next-line no-console\n                console.warn(\"Failed to get OAuth2 refresh token. Removing refresh token\", e);\n            }\n            removeLocal(client);\n            if (expectRefreshToken) {\n                throw new Error(\"Could not refresh token\");\n            }\n        }\n    }\n    async function maybeHandleAuthReturn() {\n        const { codeVerifier, state, oldUrl } = readLocal(client);\n        if (!codeVerifier)\n            return;\n        try {\n            const ret = makeTokenAndSaveRefresh(throwIfError(await processAuthorizationCodeOAuth2Response(authServer, client, await authorizationCodeGrantRequest(authServer, client, throwIfError(validateAuthResponse(authServer, client, new URL(window.location.href), state)), redirectUrl, codeVerifier, oauthHttpOptions))), \"signIn\");\n            go(oldUrl);\n            return ret;\n        }\n        catch (e) {\n            if (process.env.NODE_ENV !== \"production\") {\n                // eslint-disable-next-line no-console\n                console.warn(\"Failed to get OAuth2 token using PKCE, removing PKCE and starting a new auth flow\", e);\n            }\n            removeLocal(client);\n        }\n    }\n    async function initiateLoginRedirect() {\n        if (loginPage\n            && window.location.href !== loginPage\n            && window.location.pathname !== loginPage) {\n            saveLocal(client, { oldUrl: postLoginPage });\n            return await go(loginPage);\n        }\n        const state = generateRandomState();\n        const codeVerifier = generateRandomCodeVerifier();\n        const oldUrl = readLocal(client).oldUrl ?? window.location.toString();\n        saveLocal(client, { codeVerifier, state, oldUrl });\n        window.location.assign(`${authServer\n            .authorization_endpoint}?${new URLSearchParams({\n            client_id,\n            response_type: \"code\",\n            state,\n            redirect_uri: redirectUrl,\n            code_challenge: await calculatePKCECodeChallenge(codeVerifier),\n            code_challenge_method: \"S256\",\n            scope: [\"offline_access\", ...scopes].join(\" \"),\n        })}`);\n        // Give time for redirect to happen\n        await delay(1000);\n        throw new Error(\"Unable to redirect\");\n    }\n    /** Will throw if there is no token! */\n    async function _signIn() {\n        // 1. Check if we have a refresh token in local storage\n        return await maybeRefresh()\n            // 2. If there is no refresh token we are likely trying to perform the callback\n            ?? await maybeHandleAuthReturn()\n            // 3. If we haven't been able to load the token from one of the two above ways, we need to make the initial auth request\n            ?? await initiateLoginRedirect();\n    }\n    return getToken;\n}\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAOA,KAAK,MAAM,OAAO;AACzB,SAASC,6BAA6B,EAAEC,0BAA0B,EAAEC,WAAW,EAAEC,0BAA0B,EAAEC,mBAAmB,EAAEC,sCAAsC,EAAEC,wBAAwB,EAAEC,oBAAoB,QAAS,cAAc;AAC/O,SAASC,MAAM,EAAEC,yBAAyB,EAAEC,SAAS,EAAEC,WAAW,EAAEC,SAAS,QAAS,aAAa;AACnG,SAASC,YAAY,QAAQ,mBAAmB;AAChD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,uBAAuBA,CAACC,SAAS,EAAEC,GAAG,EAAEC,WAAW,EAAEC,UAAU,GAAG,IAAI,EAAEC,SAAS,EAAEC,aAAa,GAAGC,MAAM,CAACC,QAAQ,CAACC,QAAQ,CAAC,CAAC,EAAEC,MAAM,GAAG,EAAE,EAAEC,OAAO,GAAGC,UAAU,CAACC,KAAK,EAAEC,OAAO,GAAG,YAAY,EAAE;EAC5M,MAAMC,MAAM,GAAG;IAAEd,SAAS;IAAEe,0BAA0B,EAAE;EAAO,CAAC;EAChE,MAAMC,UAAU,GAAGtB,yBAAyB,CAACmB,OAAO,EAAEZ,GAAG,CAAC;EAC1D,MAAMgB,gBAAgB,GAAG;IAAE,CAAC9B,WAAW,GAAGuB;EAAQ,CAAC;EACnD,IAAID,MAAM,CAACS,MAAM,KAAK,CAAC,EAAE;IACrBT,MAAM,GAAG,CAAC,eAAe,EAAE,gBAAgB,CAAC;EAChD;EACA,MAAM;IAAEU,uBAAuB;IAAEC;EAAS,CAAC,GAAG3B,MAAM,CAACqB,MAAM,EAAEE,UAAU,EA+EvE;EACA,eAAeK,OAAOA,CAAA,EAAG;IACrB;IACA,OAAO,OAAMC,YAAY,CAAC;IACtB;IAAA,MACG,MAAMC,qBAAqB,CAAC,CAAC;IAChC;IAAA,IACG,MAAMC,qBAAqB,CAAC,CAAC;EACxC,CAAC,EAvFiFP,gBAAgB,EAAEK,YAAY,CAACG,IAAI,CAACd,UAAU,EAAE,IAAI,CAAC,CAAC;EACxI,eAAee,EAAEA,CAACC,CAAC,EAAE;IACjB,IAAIxB,UAAU,EACV,OAAOG,MAAM,CAACsB,OAAO,CAACC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,EAAEF,CAAC,CAAC,CAAC,KAE9CrB,MAAM,CAACC,QAAQ,CAACuB,MAAM,CAACH,CAAC,CAAC;IAC7B,MAAM3C,KAAK,CAAC,IAAI,CAAC;IACjB,MAAM,IAAI+C,KAAK,CAAC,oBAAoB,CAAC;EACzC;EACA,eAAeT,YAAYA,CAACU,kBAAkB,EAAE;IAC5C,MAAM;MAAEC;IAAc,CAAC,GAAGtC,SAAS,CAACmB,MAAM,CAAC;IAC3C,IAAI,CAACmB,aAAa,EAAE;MAChB,IAAID,kBAAkB,EAClB,MAAM,IAAID,KAAK,CAAC,wBAAwB,CAAC;MAC7C;IACJ;IACA,IAAI;MACA;MACA;MACA,MAAMG,MAAM,GAAGf,uBAAuB,CAACrB,YAAY,CAAC,MAAMR,sCAAsC,CAAC0B,UAAU,EAAEF,MAAM,EAAE,MAAMvB,wBAAwB,CAACyB,UAAU,EAAEF,MAAM,EAAEmB,aAAa,EAAEhB,gBAAgB,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC;MACtN,IAAIiB,MAAM,IAAI5B,MAAM,CAACC,QAAQ,CAAC4B,QAAQ,KAAK,IAAIC,GAAG,CAAClC,WAAW,CAAC,CAACiC,QAAQ,EAAE;QACtE,MAAM;UAAEE;QAAO,CAAC,GAAG1C,SAAS,CAACmB,MAAM,CAAC;QACpCY,EAAE,CAACW,MAAM,IAAI,GAAG,CAAC;MACrB;MACA,OAAOH,MAAM;IACjB,CAAC,CACD,OAAOI,CAAC,EAAE;MACN,IAAIC,OAAO,CAACC,GAAG,CAACC,QAAQ,KAAK,YAAY,EAAE;QACvC;QACAC,OAAO,CAACC,IAAI,CAAC,4DAA4D,EAAEL,CAAC,CAAC;MACjF;MACA1C,WAAW,CAACkB,MAAM,CAAC;MACnB,IAAIkB,kBAAkB,EAAE;QACpB,MAAM,IAAID,KAAK,CAAC,yBAAyB,CAAC;MAC9C;IACJ;EACJ;EACA,eAAeR,qBAAqBA,CAAA,EAAG;IACnC,MAAM;MAAEqB,YAAY;MAAEC,KAAK;MAAER;IAAO,CAAC,GAAG1C,SAAS,CAACmB,MAAM,CAAC;IACzD,IAAI,CAAC8B,YAAY,EACb;IACJ,IAAI;MACA,MAAME,GAAG,GAAG3B,uBAAuB,CAACrB,YAAY,CAAC,MAAMR,sCAAsC,CAAC0B,UAAU,EAAEF,MAAM,EAAE,MAAM7B,6BAA6B,CAAC+B,UAAU,EAAEF,MAAM,EAAEhB,YAAY,CAACN,oBAAoB,CAACwB,UAAU,EAAEF,MAAM,EAAE,IAAIsB,GAAG,CAAC9B,MAAM,CAACC,QAAQ,CAACwC,IAAI,CAAC,EAAEF,KAAK,CAAC,CAAC,EAAE3C,WAAW,EAAE0C,YAAY,EAAE3B,gBAAgB,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;MACjUS,EAAE,CAACW,MAAM,CAAC;MACV,OAAOS,GAAG;IACd,CAAC,CACD,OAAOR,CAAC,EAAE;MACN,IAAIC,OAAO,CAACC,GAAG,CAACC,QAAQ,KAAK,YAAY,EAAE;QACvC;QACAC,OAAO,CAACC,IAAI,CAAC,mFAAmF,EAAEL,CAAC,CAAC;MACxG;MACA1C,WAAW,CAACkB,MAAM,CAAC;IACvB;EACJ;EACA,eAAeU,qBAAqBA,CAAA,EAAG;IACnC,IAAIpB,SAAS,IACNE,MAAM,CAACC,QAAQ,CAACwC,IAAI,KAAK3C,SAAS,IAClCE,MAAM,CAACC,QAAQ,CAAC4B,QAAQ,KAAK/B,SAAS,EAAE;MAC3CP,SAAS,CAACiB,MAAM,EAAE;QAAEuB,MAAM,EAAEhC;MAAc,CAAC,CAAC;MAC5C,OAAO,MAAMqB,EAAE,CAACtB,SAAS,CAAC;IAC9B;IACA,MAAMyC,KAAK,GAAGxD,mBAAmB,CAAC,CAAC;IACnC,MAAMuD,YAAY,GAAGxD,0BAA0B,CAAC,CAAC;IACjD,MAAMiD,MAAM,GAAG1C,SAAS,CAACmB,MAAM,CAAC,CAACuB,MAAM,IAAI/B,MAAM,CAACC,QAAQ,CAACC,QAAQ,CAAC,CAAC;IACrEX,SAAS,CAACiB,MAAM,EAAE;MAAE8B,YAAY;MAAEC,KAAK;MAAER;IAAO,CAAC,CAAC;IAClD/B,MAAM,CAACC,QAAQ,CAACuB,MAAM,CAAC,GAAGd,UAAU,CAC/BgC,sBAAsB,IAAI,IAAIC,eAAe,CAAC;MAC/CjD,SAAS;MACTkD,aAAa,EAAE,MAAM;MACrBL,KAAK;MACLM,YAAY,EAAEjD,WAAW;MACzBkD,cAAc,EAAE,MAAMlE,0BAA0B,CAAC0D,YAAY,CAAC;MAC9DS,qBAAqB,EAAE,MAAM;MAC7BC,KAAK,EAAE,CAAC,gBAAgB,EAAE,GAAG7C,MAAM,CAAC,CAAC8C,IAAI,CAAC,GAAG;IACjD,CAAC,CAAC,EAAE,CAAC;IACL;IACA,MAAMvE,KAAK,CAAC,IAAI,CAAC;IACjB,MAAM,IAAI+C,KAAK,CAAC,oBAAoB,CAAC;EACzC;EAUA,OAAOX,QAAQ;AACnB","ignoreList":[]}
+{"version":3,"file":"createPublicOauthClient.js","names":["delay","authorizationCodeGrantRequest","calculatePKCECodeChallenge","customFetch","generateRandomCodeVerifier","generateRandomState","processAuthorizationCodeOAuth2Response","refreshTokenGrantRequest","validateAuthResponse","common","createAuthorizationServer","readLocal","readSession","removeLocal","removeSession","saveLocal","saveSession","throwIfError","processOptionsAndAssignDefaults","createPublicOauthClient","client_id","url","redirect_uri","useHistory","loginPage","postLoginPage","scopes","fetchFn","ctxPath","refreshTokenMarker","client","token_endpoint_auth_method","authServer","oauthHttpOptions","makeTokenAndSaveRefresh","getToken","_signIn","maybeRefresh","maybeHandleAuthReturn","initiateLoginRedirect","bind","globalThis","go","x","window","history","replaceState","location","assign","Error","expectRefreshToken","refresh_token","lastRefreshTokenMarker","result","pathname","URL","oldUrl","e","process","env","NODE_ENV","console","warn","state","codeVerifier","ret","href","toString","authorization_endpoint","URLSearchParams","response_type","code_challenge","code_challenge_method","scope","join"],"sources":["createPublicOauthClient.ts"],"sourcesContent":["/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport delay from \"delay\";\nimport type { Client, HttpRequestOptions } from \"oauth4webapi\";\nimport {\n  authorizationCodeGrantRequest,\n  calculatePKCECodeChallenge,\n  customFetch,\n  generateRandomCodeVerifier,\n  generateRandomState,\n  processAuthorizationCodeOAuth2Response,\n  refreshTokenGrantRequest,\n  validateAuthResponse,\n} from \"oauth4webapi\";\nimport {\n  common,\n  createAuthorizationServer,\n  readLocal,\n  readSession,\n  removeLocal,\n  removeSession,\n  saveLocal,\n  saveSession,\n} from \"./common.js\";\nimport type { PublicOauthClient } from \"./PublicOauthClient.js\";\nimport { throwIfError } from \"./throwIfError.js\";\nimport type { Token } from \"./Token.js\";\nimport { processOptionsAndAssignDefaults } from \"./utils.js\";\n\ndeclare const process: {\n  env: {\n    NODE_ENV: \"production\" | \"development\";\n    TARGET: \"browser\" | \"node\";\n  };\n};\n\nexport interface PublicOauthClientOptions {\n  /**\n   * If true, uses `history.replaceState()`, otherwise uses `window.location.assign()` (defaults to true)\n   */\n  useHistory?: boolean;\n\n  /**\n   * Custom landing page URL prior to logging in\n   */\n  loginPage?: string;\n\n  /**\n   * URL to return to after completed authentication cycle (defaults to `window.location.toString()`)\n   */\n  postLoginPage?: string;\n\n  /**\n   * * @param {string[]} [scopes=[]] - OAuth scopes to request. If not provided, defaults to `[\"api:read-data\", \"api:write-data\"]`\n   */\n  scopes?: string[];\n\n  /**\n   * Custom fetch function to use for requests (defaults to `globalThis.fetch`)\n   */\n  fetchFn?: typeof globalThis.fetch;\n\n  /**\n   * Context path for the authorization server (defaults to \"multipass\")\n   */\n  ctxPath?: string;\n\n  /**\n   * Allows for an additional value to be appended to the local storage key for the refresh token.\n   */\n  refreshTokenMarker?: string;\n}\n\n/**\n * Creates a PublicOauthClient for authentication.\n *\n * @param {string} clientId - The client_id from the OAuth configuration on the server\n * @param {string} url - The base URL of your Foundry server\n * @param {string} redirectUrl - The URL configured for redirect in the OAuth configuration on the server\n * @param {PublicOauthClientOptions} options - Additional options for the client\n * @returns {PublicOauthClient} A client that can be used as a token provider\n */\nexport function createPublicOauthClient(\n  clientId: string,\n  url: string,\n  redirectUrl: string,\n  options?: PublicOauthClientOptions,\n): PublicOauthClient;\n\n/**\n * Creates a PublicOauthClient for authentication.\n *\n * @param {string} clientId - The client_id from the OAuth configuration on the server\n * @param {string} url - The base URL of your Foundry server\n * @param {string} redirectUrl - The URL configured for redirect in the OAuth configuration on the server\n * @param {boolean} useHistory - If true, uses `history.replaceState()`, otherwise uses `window.location.assign()` (defaults to true)\n * @param {string} loginPage - Custom landing page URL prior to logging in\n * @param {string} postLoginPage - URL to return to after completed authentication cycle (defaults to `window.location.toString()`)\n * @param {string[]} scopes - OAuth scopes to request. If not provided, defaults to `[\"api:read-data\", \"api:write-data\"]`\n * @param {typeof globalThis.fetch} fetchFn - Custom fetch function to use for requests (defaults to `globalThis.fetch`)\n * @param {string} ctxPath - Context path for the authorization server (defaults to \"multipass\")\n * @returns {PublicOauthClient} A client that can be used as a token provider\n */\nexport function createPublicOauthClient(\n  client_id: string,\n  url: string,\n  redirectUrl: string,\n  useHistory?: boolean,\n  loginPage?: string,\n  postLoginPage?: string,\n  scopes?: string[],\n  fetchFn?: typeof globalThis.fetch,\n  ctxPath?: string,\n): PublicOauthClient;\nexport function createPublicOauthClient(\n  client_id: string,\n  url: string,\n  redirect_uri: string,\n  useHistory?: boolean | PublicOauthClientOptions,\n  loginPage?: string,\n  postLoginPage?: string,\n  scopes?: string[],\n  fetchFn?: typeof globalThis.fetch,\n  ctxPath?: string,\n): PublicOauthClient {\n  let refreshTokenMarker: string | undefined;\n  ({\n    useHistory,\n    loginPage,\n    postLoginPage,\n    scopes,\n    fetchFn,\n    ctxPath,\n    refreshTokenMarker,\n  } = processOptionsAndAssignDefaults(\n    url,\n    redirect_uri,\n    useHistory,\n    loginPage,\n    postLoginPage,\n    scopes,\n    fetchFn,\n    ctxPath,\n  ));\n\n  const client: Client = {\n    client_id,\n    token_endpoint_auth_method: \"none\",\n  };\n  const authServer = createAuthorizationServer(ctxPath, url);\n  const oauthHttpOptions: HttpRequestOptions = { [customFetch]: fetchFn };\n\n  const { makeTokenAndSaveRefresh, getToken } = common(\n    client,\n    authServer,\n    _signIn,\n    oauthHttpOptions,\n    maybeRefresh.bind(globalThis, true),\n    refreshTokenMarker,\n  );\n\n  // as an arrow function, `useHistory` is known to be a boolean\n  const go = async (x: string) => {\n    if (useHistory) {\n      window.history.replaceState({}, \"\", x);\n      return;\n    } else window.location.assign(x);\n\n    await delay(1000);\n    throw new Error(\"Unable to redirect\");\n  };\n\n  async function maybeRefresh(\n    expectRefreshToken?: boolean,\n  ): Promise<Token | undefined> {\n    const { refresh_token, refreshTokenMarker: lastRefreshTokenMarker } =\n      readLocal(client);\n\n    if (!refresh_token || lastRefreshTokenMarker !== refreshTokenMarker) {\n      if (expectRefreshToken) throw new Error(\"No refresh token found\");\n      return;\n    }\n\n    try {\n      // note, we don't use processRefreshTokenResponse because the mp oauth implementation\n      // doesn't do refresh tokens quite right and this lets us skip the id check\n      const result = makeTokenAndSaveRefresh(\n        throwIfError(\n          await processAuthorizationCodeOAuth2Response(\n            authServer,\n            client,\n            await refreshTokenGrantRequest(\n              authServer,\n              client,\n              refresh_token,\n              oauthHttpOptions,\n            ),\n          ),\n        ),\n        \"refresh\",\n      );\n\n      if (\n        result && window.location.pathname === new URL(redirect_uri).pathname\n      ) {\n        const { oldUrl } = readSession(client);\n        // don't block on the redirect\n        void go(oldUrl ?? \"/\");\n      }\n      return result;\n    } catch (e) {\n      if (process.env.NODE_ENV !== \"production\") {\n        // eslint-disable-next-line no-console\n        console.warn(\n          \"Failed to get OAuth2 refresh token. Removing refresh token\",\n          e,\n        );\n      }\n      removeLocal(client);\n      if (expectRefreshToken) {\n        throw new Error(\"Could not refresh token\");\n      }\n    }\n  }\n\n  async function maybeHandleAuthReturn() {\n    const { state, oldUrl, codeVerifier } = readSession(client);\n    if (!codeVerifier) return;\n\n    try {\n      const ret = makeTokenAndSaveRefresh(\n        throwIfError(\n          await processAuthorizationCodeOAuth2Response(\n            authServer,\n            client,\n            await authorizationCodeGrantRequest(\n              authServer,\n              client,\n              throwIfError(\n                validateAuthResponse(\n                  authServer,\n                  client,\n                  new URL(window.location.href),\n                  state,\n                ),\n              ),\n              redirect_uri,\n              codeVerifier,\n              oauthHttpOptions,\n            ),\n          ),\n        ),\n        \"signIn\",\n      );\n\n      void go(oldUrl);\n      return ret;\n    } catch (e) {\n      if (process.env.NODE_ENV !== \"production\") {\n        // eslint-disable-next-line no-console\n        console.warn(\n          \"Failed to get OAuth2 token using PKCE, removing PKCE and starting a new auth flow\",\n          e,\n        );\n      }\n      removeLocal(client);\n      removeSession(client);\n      throw e;\n    }\n  }\n\n  // As an arrow function, `scopes` and `postLoginPage` are known at compile time\n  const initiateLoginRedirect = async (): Promise<void> => {\n    if (\n      loginPage\n      && window.location.href !== loginPage\n      && window.location.pathname !== loginPage\n    ) {\n      saveLocal(client, {});\n      saveSession(client, { oldUrl: postLoginPage });\n      await go(loginPage);\n      return;\n    }\n\n    const state = generateRandomState()!;\n    const codeVerifier = generateRandomCodeVerifier();\n    const oldUrl = readSession(client).oldUrl ?? window.location.toString();\n    saveLocal(client, {});\n    saveSession(client, { codeVerifier, state, oldUrl });\n\n    window.location.assign(`${authServer\n      .authorization_endpoint!}?${new URLSearchParams({\n      client_id,\n      response_type: \"code\",\n      state,\n      redirect_uri,\n      code_challenge: await calculatePKCECodeChallenge(codeVerifier),\n      code_challenge_method: \"S256\",\n      scope: [\"offline_access\", ...scopes].join(\" \"),\n    })}`);\n\n    // Give time for redirect to happen\n    await delay(1000);\n    throw new Error(\"Unable to redirect\");\n  };\n\n  /** Will throw if there is no token! */\n  async function _signIn() {\n    // 1. Check if we have a refresh token in local storage\n    return await maybeRefresh()\n      // 2. If there is no refresh token we are likely trying to perform the callback\n      ?? await maybeHandleAuthReturn()\n      // 3. If we haven't been able to load the token from one of the two above ways, we need to make the initial auth request\n      ?? await initiateLoginRedirect() as unknown as Token;\n  }\n\n  return getToken;\n}\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,OAAOA,KAAK,MAAM,OAAO;AAEzB,SACEC,6BAA6B,EAC7BC,0BAA0B,EAC1BC,WAAW,EACXC,0BAA0B,EAC1BC,mBAAmB,EACnBC,sCAAsC,EACtCC,wBAAwB,EACxBC,oBAAoB,QACf,cAAc;AACrB,SACEC,MAAM,EACNC,yBAAyB,EACzBC,SAAS,EACTC,WAAW,EACXC,WAAW,EACXC,aAAa,EACbC,SAAS,EACTC,WAAW,QACN,aAAa;AAEpB,SAASC,YAAY,QAAQ,mBAAmB;AAEhD,SAASC,+BAA+B,QAAQ,YAAY;;AA8C5D;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAQA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAYA,OAAO,SAASC,uBAAuBA,CACrCC,SAAiB,EACjBC,GAAW,EACXC,YAAoB,EACpBC,UAA+C,EAC/CC,SAAkB,EAClBC,aAAsB,EACtBC,MAAiB,EACjBC,OAAiC,EACjCC,OAAgB,EACG;EACnB,IAAIC,kBAAsC;EAC1C,CAAC;IACCN,UAAU;IACVC,SAAS;IACTC,aAAa;IACbC,MAAM;IACNC,OAAO;IACPC,OAAO;IACPC;EACF,CAAC,GAAGX,+BAA+B,CACjCG,GAAG,EACHC,YAAY,EACZC,UAAU,EACVC,SAAS,EACTC,aAAa,EACbC,MAAM,EACNC,OAAO,EACPC,OACF,CAAC;EAED,MAAME,MAAc,GAAG;IACrBV,SAAS;IACTW,0BAA0B,EAAE;EAC9B,CAAC;EACD,MAAMC,UAAU,GAAGtB,yBAAyB,CAACkB,OAAO,EAAEP,GAAG,CAAC;EAC1D,MAAMY,gBAAoC,GAAG;IAAE,CAAC9B,WAAW,GAAGwB;EAAQ,CAAC;EAEvE,MAAM;IAAEO,uBAAuB;IAAEC;EAAS,CAAC,GAAG1B,MAAM,CAClDqB,MAAM,EACNE,UAAU,EAwJZ;EACA,eAAeI,OAAOA,CAAA,EAAG;IACvB;IACA,OAAO,OAAMC,YAAY,CAAC;IACxB;IAAA,MACG,MAAMC,qBAAqB,CAAC,CAAC;IAChC;IAAA,IACG,MAAMC,qBAAqB,CAAC,CAAC,CAAoB;EACxD,CAAC,EA9JCN,gBAAgB,EAChBI,YAAY,CAACG,IAAI,CAACC,UAAU,EAAE,IAAI,CAAC,EACnCZ,kBACF,CAAC;;EAED;EACA,MAAMa,EAAE,GAAG,MAAOC,CAAS,IAAK;IAC9B,IAAIpB,UAAU,EAAE;MACdqB,MAAM,CAACC,OAAO,CAACC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,EAAEH,CAAC,CAAC;MACtC;IACF,CAAC,MAAMC,MAAM,CAACG,QAAQ,CAACC,MAAM,CAACL,CAAC,CAAC;IAEhC,MAAM3C,KAAK,CAAC,IAAI,CAAC;IACjB,MAAM,IAAIiD,KAAK,CAAC,oBAAoB,CAAC;EACvC,CAAC;EAED,eAAeZ,YAAYA,CACzBa,kBAA4B,EACA;IAC5B,MAAM;MAAEC,aAAa;MAAEtB,kBAAkB,EAAEuB;IAAuB,CAAC,GACjEzC,SAAS,CAACmB,MAAM,CAAC;IAEnB,IAAI,CAACqB,aAAa,IAAIC,sBAAsB,KAAKvB,kBAAkB,EAAE;MACnE,IAAIqB,kBAAkB,EAAE,MAAM,IAAID,KAAK,CAAC,wBAAwB,CAAC;MACjE;IACF;IAEA,IAAI;MACF;MACA;MACA,MAAMI,MAAM,GAAGnB,uBAAuB,CACpCjB,YAAY,CACV,MAAMX,sCAAsC,CAC1C0B,UAAU,EACVF,MAAM,EACN,MAAMvB,wBAAwB,CAC5ByB,UAAU,EACVF,MAAM,EACNqB,aAAa,EACblB,gBACF,CACF,CACF,CAAC,EACD,SACF,CAAC;MAED,IACEoB,MAAM,IAAIT,MAAM,CAACG,QAAQ,CAACO,QAAQ,KAAK,IAAIC,GAAG,CAACjC,YAAY,CAAC,CAACgC,QAAQ,EACrE;QACA,MAAM;UAAEE;QAAO,CAAC,GAAG5C,WAAW,CAACkB,MAAM,CAAC;QACtC;QACA,KAAKY,EAAE,CAACc,MAAM,IAAI,GAAG,CAAC;MACxB;MACA,OAAOH,MAAM;IACf,CAAC,CAAC,OAAOI,CAAC,EAAE;MACV,IAAIC,OAAO,CAACC,GAAG,CAACC,QAAQ,KAAK,YAAY,EAAE;QACzC;QACAC,OAAO,CAACC,IAAI,CACV,4DAA4D,EAC5DL,CACF,CAAC;MACH;MACA5C,WAAW,CAACiB,MAAM,CAAC;MACnB,IAAIoB,kBAAkB,EAAE;QACtB,MAAM,IAAID,KAAK,CAAC,yBAAyB,CAAC;MAC5C;IACF;EACF;EAEA,eAAeX,qBAAqBA,CAAA,EAAG;IACrC,MAAM;MAAEyB,KAAK;MAAEP,MAAM;MAAEQ;IAAa,CAAC,GAAGpD,WAAW,CAACkB,MAAM,CAAC;IAC3D,IAAI,CAACkC,YAAY,EAAE;IAEnB,IAAI;MACF,MAAMC,GAAG,GAAG/B,uBAAuB,CACjCjB,YAAY,CACV,MAAMX,sCAAsC,CAC1C0B,UAAU,EACVF,MAAM,EACN,MAAM7B,6BAA6B,CACjC+B,UAAU,EACVF,MAAM,EACNb,YAAY,CACVT,oBAAoB,CAClBwB,UAAU,EACVF,MAAM,EACN,IAAIyB,GAAG,CAACX,MAAM,CAACG,QAAQ,CAACmB,IAAI,CAAC,EAC7BH,KACF,CACF,CAAC,EACDzC,YAAY,EACZ0C,YAAY,EACZ/B,gBACF,CACF,CACF,CAAC,EACD,QACF,CAAC;MAED,KAAKS,EAAE,CAACc,MAAM,CAAC;MACf,OAAOS,GAAG;IACZ,CAAC,CAAC,OAAOR,CAAC,EAAE;MACV,IAAIC,OAAO,CAACC,GAAG,CAACC,QAAQ,KAAK,YAAY,EAAE;QACzC;QACAC,OAAO,CAACC,IAAI,CACV,mFAAmF,EACnFL,CACF,CAAC;MACH;MACA5C,WAAW,CAACiB,MAAM,CAAC;MACnBhB,aAAa,CAACgB,MAAM,CAAC;MACrB,MAAM2B,CAAC;IACT;EACF;;EAEA;EACA,MAAMlB,qBAAqB,GAAG,MAAAA,CAAA,KAA2B;IACvD,IACEf,SAAS,IACNoB,MAAM,CAACG,QAAQ,CAACmB,IAAI,KAAK1C,SAAS,IAClCoB,MAAM,CAACG,QAAQ,CAACO,QAAQ,KAAK9B,SAAS,EACzC;MACAT,SAAS,CAACe,MAAM,EAAE,CAAC,CAAC,CAAC;MACrBd,WAAW,CAACc,MAAM,EAAE;QAAE0B,MAAM,EAAE/B;MAAc,CAAC,CAAC;MAC9C,MAAMiB,EAAE,CAAClB,SAAS,CAAC;MACnB;IACF;IAEA,MAAMuC,KAAK,GAAG1D,mBAAmB,CAAC,CAAE;IACpC,MAAM2D,YAAY,GAAG5D,0BAA0B,CAAC,CAAC;IACjD,MAAMoD,MAAM,GAAG5C,WAAW,CAACkB,MAAM,CAAC,CAAC0B,MAAM,IAAIZ,MAAM,CAACG,QAAQ,CAACoB,QAAQ,CAAC,CAAC;IACvEpD,SAAS,CAACe,MAAM,EAAE,CAAC,CAAC,CAAC;IACrBd,WAAW,CAACc,MAAM,EAAE;MAAEkC,YAAY;MAAED,KAAK;MAAEP;IAAO,CAAC,CAAC;IAEpDZ,MAAM,CAACG,QAAQ,CAACC,MAAM,CAAC,GAAGhB,UAAU,CACjCoC,sBAAsB,IAAK,IAAIC,eAAe,CAAC;MAChDjD,SAAS;MACTkD,aAAa,EAAE,MAAM;MACrBP,KAAK;MACLzC,YAAY;MACZiD,cAAc,EAAE,MAAMrE,0BAA0B,CAAC8D,YAAY,CAAC;MAC9DQ,qBAAqB,EAAE,MAAM;MAC7BC,KAAK,EAAE,CAAC,gBAAgB,EAAE,GAAG/C,MAAM,CAAC,CAACgD,IAAI,CAAC,GAAG;IAC/C,CAAC,CAAC,EAAE,CAAC;;IAEL;IACA,MAAM1E,KAAK,CAAC,IAAI,CAAC;IACjB,MAAM,IAAIiD,KAAK,CAAC,oBAAoB,CAAC;EACvC,CAAC;EAYD,OAAOd,QAAQ;AACjB","ignoreList":[]}

package/build/browser/index.js

@@ -13,6 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+
 export { createConfidentialOauthClient } from "./createConfidentialOauthClient.js";
 export { createPublicOauthClient } from "./createPublicOauthClient.js";
 //# sourceMappingURL=index.js.map

package/build/browser/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["createConfidentialOauthClient","createPublicOauthClient"],"sources":["index.js"],"sourcesContent":["/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nexport { createConfidentialOauthClient } from \"./createConfidentialOauthClient.js\";\nexport { createPublicOauthClient } from \"./createPublicOauthClient.js\";\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASA,6BAA6B,QAAQ,oCAAoC;AAClF,SAASC,uBAAuB,QAAQ,8BAA8B","ignoreList":[]}
+{"version":3,"file":"index.js","names":["createConfidentialOauthClient","createPublicOauthClient"],"sources":["index.ts"],"sourcesContent":["/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nexport { createConfidentialOauthClient } from \"./createConfidentialOauthClient.js\";\nexport { createPublicOauthClient } from \"./createPublicOauthClient.js\";\nexport type { PublicOauthClient } from \"./PublicOauthClient.js\";\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,6BAA6B,QAAQ,oCAAoC;AAClF,SAASC,uBAAuB,QAAQ,8BAA8B","ignoreList":[]}

package/build/browser/publicOauth.test.js

@@ -0,0 +1,318 @@
+/*
+ * Copyright 2024 Palantir Technologies, Inc. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/* eslint-disable @typescript-eslint/consistent-type-imports */
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
+import * as commonJs from "./common.js";
+import { createPublicOauthClient } from "./createPublicOauthClient.js";
+const hoistedMocks = vi.hoisted(() => {
+  return {
+    makeTokenAndSaveRefresh: vi.fn()
+  };
+});
+vi.mock("delay", async importOriginal => {
+  const original = await importOriginal();
+  return {
+    default: vi.fn((ms, opts) => {
+      // speed up the tests
+      return original.default(ms / 100, opts);
+    })
+  };
+});
+vi.mock("./common.js", async importOriginal => {
+  const original = await importOriginal();
+  return {
+    ...original,
+    common: vi.fn((...args) => {
+      const result = original.common(...args);
+      return {
+        ...result,
+        makeTokenAndSaveRefresh: hoistedMocks.makeTokenAndSaveRefresh
+      };
+    }),
+    readLocal: vi.spyOn(original, "readLocal"),
+    readSession: vi.spyOn(original, "readSession")
+    // vi.fn(original.readLocal),
+  };
+});
+vi.mock("oauth4webapi");
+describe(createPublicOauthClient, () => {
+  const DEFAULT_CUR_URL = new URL("https://fauxurl");
+  const fetchFn = vi.fn();
+  const mockWindow = {
+    location: {
+      toString: vi.fn(() => DEFAULT_CUR_URL),
+      assign: vi.fn(),
+      href: DEFAULT_CUR_URL.href,
+      pathname: DEFAULT_CUR_URL.pathname
+    },
+    history: {
+      replaceState: vi.fn()
+    }
+  };
+  const mockLocalStorage = {
+    setItem: vi.fn(),
+    getItem: vi.fn(),
+    removeItem: vi.fn()
+  };
+  const mockSessionStorage = {
+    setItem: vi.fn(),
+    getItem: vi.fn(),
+    removeItem: vi.fn()
+  };
+  beforeEach(() => {
+    vi.restoreAllMocks();
+    fetchFn.mockRestore();
+  });
+  afterEach(() => {
+    vi.clearAllMocks();
+    fetchFn.mockReset();
+  });
+  beforeAll(() => {
+    vi.stubGlobal("window", mockWindow);
+    vi.stubGlobal("localStorage", mockLocalStorage);
+    vi.stubGlobal("sessionStorage", mockSessionStorage);
+  });
+  afterAll(() => {
+    vi.unstubAllGlobals();
+  });
+  const BASE_CLIENT_ARGS = {
+    clientId: "this-would-be-client-id",
+    foundryUrl: "https://a.foundry.url.local",
+    redirectUrl: "https://my.redirect.url.local",
+    fetchFn
+  };
+  const fullLoginUrl = new URL("/loginPage", DEFAULT_CUR_URL);
+  function setupWindowLocation(currentUrl) {
+    mockWindow.location.href = new URL(currentUrl).href;
+    mockWindow.location.pathname = new URL(currentUrl).pathname;
+  }
+  function setupLocalState(initialLocalState) {
+    vi.mocked(commonJs.readLocal).mockImplementation(() => initialLocalState);
+  }
+  let client;
+  let clientArgs;
+  function setupClient(clientArgs_) {
+    clientArgs = clientArgs_;
+    if (clientArgs.refreshTokenMarker) {
+      client = createPublicOauthClient(clientArgs.clientId, clientArgs.foundryUrl, clientArgs.redirectUrl, clientArgs);
+    } else {
+      client = createPublicOauthClient(clientArgs.clientId, clientArgs.foundryUrl, clientArgs.redirectUrl, clientArgs.useHistory, clientArgs.loginPage, clientArgs.postLoginPage, clientArgs.scopes, clientArgs.fetchFn, clientArgs.ctxPath);
+    }
+  }
+  beforeEach(() => {
+    // prevents mistakes like forgetting to initialize the client with an
+    // old value around
+    client = undefined;
+    clientArgs = undefined;
+  });
+  async function expectRedirectToMultipass(tokenPromise) {
+    // we assume window.location.assign will take you away therefore we
+    // also have to expect in this scenario that the thrown error happens
+    await expect(tokenPromise).rejects.toThrowError(new Error("Unable to redirect"));
+    expect(mockWindow.location.assign).toHaveBeenCalledOnce();
+    const url = new URL(mockWindow.location.assign.mock.calls[0][0]);
+    expect(url.origin).toEqual(clientArgs.foundryUrl);
+    expect(url.pathname).toEqual("/multipass/api/oauth2/authorize");
+    expect(Object.fromEntries(url.searchParams.entries())).toEqual(expect.objectContaining({
+      client_id: clientArgs.clientId,
+      code_challenge: expect.any(String),
+      redirect_uri: clientArgs.redirectUrl,
+      response_type: "code",
+      code_challenge_method: "S256",
+      scope: "offline_access api:read-data api:write-data",
+      state: expect.any(String)
+    }));
+  }
+  describe("refresh token marker", () => {
+    beforeEach(() => {
+      setupWindowLocation("https://foundry.local");
+    });
+    it("should not allow refresh if the refresh markers do not match", async () => {
+      setupLocalState({
+        refresh_token: "refreshToken",
+        refreshTokenMarker: "not-the-right-marker"
+      });
+      setupClient({
+        ...BASE_CLIENT_ARGS,
+        refreshTokenMarker: "marker"
+      });
+      await expectRedirectToMultipass(client());
+    });
+    it("should try to refresh if refresh tokens do match", async () => {
+      setupLocalState({
+        refresh_token: "refreshToken",
+        refreshTokenMarker: "marker"
+      });
+      setupClient({
+        ...BASE_CLIENT_ARGS,
+        refreshTokenMarker: "marker"
+      });
+      hoistedMocks.makeTokenAndSaveRefresh.mockImplementationOnce(() => ({
+        access_token: "some token",
+        expires_at: Date.now(),
+        expires_in: 10000
+      }));
+      const tokenPromise = client();
+      await expect(tokenPromise).resolves.toEqual("some token");
+      expect(hoistedMocks.makeTokenAndSaveRefresh).toBeCalledTimes(1);
+    });
+  });
+  describe.each([{
+    name: "Basic Usage",
+    currentUrl: DEFAULT_CUR_URL,
+    clientArgs: {
+      ...BASE_CLIENT_ARGS
+    },
+    should: {
+      redirectToLoginPage: false
+    }
+  }, {
+    name: "Base w/ full loginPage and curUrl is root",
+    currentUrl: DEFAULT_CUR_URL,
+    clientArgs: {
+      ...BASE_CLIENT_ARGS,
+      loginPage: fullLoginUrl.toString()
+    },
+    should: {
+      redirectToLoginPage: true
+    }
+  }, {
+    name: "Base w/ full loginPage and curUrl is login page",
+    currentUrl: fullLoginUrl,
+    clientArgs: {
+      ...BASE_CLIENT_ARGS,
+      loginPage: fullLoginUrl.toString()
+    },
+    should: {
+      redirectToLoginPage: false
+    }
+  }, {
+    name: "Base w/ short loginPage and curUrl is root",
+    currentUrl: DEFAULT_CUR_URL,
+    clientArgs: {
+      ...BASE_CLIENT_ARGS,
+      loginPage: "/loginPage"
+    },
+    should: {
+      redirectToLoginPage: true
+    }
+  }, {
+    name: "Base w/ short loginPage and curUrl is loginPage",
+    currentUrl: new URL("/loginPage", DEFAULT_CUR_URL),
+    clientArgs: {
+      ...BASE_CLIENT_ARGS,
+      loginPage: "/loginPage"
+    },
+    should: {
+      redirectToLoginPage: false
+    }
+  }])("$name", ({
+    clientArgs,
+    currentUrl,
+    should
+  }) => {
+    beforeEach(() => {
+      setupClient(clientArgs);
+      setupWindowLocation(currentUrl.toString());
+    });
+    it("calls common with expected values", () => {
+      expect(vi.mocked(commonJs.common)).toHaveBeenCalledWith(expect.objectContaining({
+        client_id: clientArgs.clientId,
+        token_endpoint_auth_method: "none"
+      }), commonJs.createAuthorizationServer(clientArgs.ctxPath ?? "/multipass", clientArgs.foundryUrl), expect.any(Function), expect.anything(), expect.any(Function), undefined);
+    });
+    describe.each([{
+      localStorage: {
+        refresh_token: "a-refresh-token"
+      },
+      sessionStorage: {}
+    }, {
+      localStorage: {},
+      sessionStorage: {
+        codeVerifier: "hi",
+        state: "mom",
+        oldUrl: "https://someoldurl.local"
+      }
+    }, {
+      localStorage: {},
+      sessionStorage: {}
+    }])("Initial Local State: %s", initialState => {
+      const ACCESS_TOKEN = (Math.random() + 1).toString(36).substring(7);
+      beforeEach(() => {
+        vi.mocked(commonJs.readLocal).mockImplementation(() => initialState.localStorage);
+        vi.mocked(commonJs.readSession).mockImplementation(() => initialState.sessionStorage);
+        hoistedMocks.makeTokenAndSaveRefresh.mockImplementation(() => ({
+          access_token: ACCESS_TOKEN,
+          expires_at: Date.now(),
+          expires_in: 10000
+        }));
+      });
+      if (Object.keys(initialState.localStorage).length === 0 && Object.keys(initialState.sessionStorage).length === 0) {
+        if (should.redirectToLoginPage) {
+          it("redirects to login page", async () => {
+            const tokenPromise = client();
+            expect(vi.mocked(commonJs.common)).toBeCalledTimes(1);
+            if (should.redirectToLoginPage) {
+              // expect save local
+              await expect(tokenPromise).resolves.toBeUndefined();
+              expect(mockSessionStorage.setItem).toBeCalledWith(`@osdk/oauth : refresh : ${clientArgs.clientId}`, JSON.stringify({
+                oldUrl: window.location.toString()
+              }));
+              expect(mockWindow.history.replaceState).toHaveBeenCalledWith({}, "", clientArgs.loginPage);
+            }
+          });
+        } else {
+          it("redirects to multipass", async () => {
+            const tokenPromise = client();
+            expect(vi.mocked(commonJs.common)).toBeCalledTimes(1);
+            if (should.redirectToLoginPage) {
+              // expect save local
+              await expect(tokenPromise).resolves.toBeUndefined();
+              expect(mockSessionStorage.setItem).toBeCalledWith(`@osdk/oauth : refresh : ${clientArgs.clientId}`, JSON.stringify({
+                oldUrl: window.location.toString()
+              }));
+              expect(mockWindow.history.replaceState).toHaveBeenCalledWith({}, "", clientArgs.loginPage);
+              return;
+            }
+            await expectRedirectToMultipass(tokenPromise);
+          });
+        }
+      }
+      if (initialState.sessionStorage.codeVerifier) {
+        it("tries to auth with return results", async () => {
+          await expect(client()).resolves.toEqual(ACCESS_TOKEN);
+          expect(hoistedMocks.makeTokenAndSaveRefresh).toHaveBeenCalledTimes(1);
+          expect(hoistedMocks.makeTokenAndSaveRefresh).toHaveBeenCalledWith(undefined,
+          // this is only because we didn't mock out the internals
+          "signIn");
+          expect(mockWindow.history.replaceState).toHaveBeenCalledTimes(1);
+          expect(mockWindow.history.replaceState).toBeCalledWith(expect.anything(), expect.anything(), initialState.sessionStorage.oldUrl);
+        });
+      }
+      if (initialState.localStorage.refresh_token) {
+        it("refreshes", async () => {
+          await expect(client()).resolves.toEqual(ACCESS_TOKEN);
+          expect(hoistedMocks.makeTokenAndSaveRefresh).toHaveBeenCalledTimes(1);
+          expect(hoistedMocks.makeTokenAndSaveRefresh).toHaveBeenCalledWith(undefined,
+          // this is only because we didn't mock out the internals
+          "refresh");
+        });
+      }
+    });
+  });
+});
+//# sourceMappingURL=publicOauth.test.js.map