@osdk/oauth 1.2.0-beta.2 → 1.2.0

package/build/cjs/index.cjs

@@ -82,7 +82,7 @@ var LRU = class {
       this.update(key, v);
       return v;
     }
-    return undefined;
+    return void 0;
   }
   has(key) {
     return this.cache.has(key) || this._cache.has(key);
@@ -205,7 +205,7 @@ function getKeyAndKid(input) {
   if (!(input?.key instanceof CryptoKey)) {
     return {};
   }
-  if (input.kid !== undefined && !validateString(input.kid)) {
+  if (input.kid !== void 0 && !validateString(input.kid)) {
     throw new TypeError('"kid" must be a non-empty string');
   }
   return {
@@ -327,12 +327,12 @@ function assertClientSecret(clientSecret) {
   return clientSecret;
 }
 function assertNoClientPrivateKey(clientAuthMethod, clientPrivateKey) {
-  if (clientPrivateKey !== undefined) {
+  if (clientPrivateKey !== void 0) {
     throw new TypeError(`"options.clientPrivateKey" property must not be provided when ${clientAuthMethod} client authentication method is used.`);
   }
 }
 function assertNoClientSecret(clientAuthMethod, clientSecret) {
-  if (clientSecret !== undefined) {
+  if (clientSecret !== void 0) {
     throw new TypeError(`"client.client_secret" property must not be provided when ${clientAuthMethod} client authentication method is used.`);
   }
 }
@@ -341,7 +341,7 @@ async function clientAuthentication(as, client, body, headers, clientPrivateKey)
   body.delete("client_assertion_type");
   body.delete("client_assertion");
   switch (client.token_endpoint_auth_method) {
-    case undefined:
+    case void 0:
     case "client_secret_basic": {
       assertNoClientPrivateKey("client_secret_basic", clientPrivateKey);
       headers.set("authorization", clientSecretBasic(client.client_id, assertClientSecret(client.client_secret)));
@@ -355,7 +355,7 @@ async function clientAuthentication(as, client, body, headers, clientPrivateKey)
     }
     case "private_key_jwt": {
       assertNoClientSecret("private_key_jwt", client.client_secret);
-      if (clientPrivateKey === undefined) {
+      if (clientPrivateKey === void 0) {
         throw new TypeError('"options.clientPrivateKey" must be provided when "client.token_endpoint_auth_method" is "private_key_jwt"');
       }
       const {
@@ -402,7 +402,7 @@ async function dpopProofJwt(headers, options, url, htm, clockSkew2, accessToken)
   if (!isPublicKey(publicKey)) {
     throw new TypeError('"DPoP.publicKey" must be a public CryptoKey');
   }
-  if (nonce !== undefined && !validateString(nonce)) {
+  if (nonce !== void 0 && !validateString(nonce)) {
     throw new TypeError('"DPoP.nonce" must be a non-empty string or undefined');
   }
   if (!publicKey.extractable) {
@@ -419,7 +419,7 @@ async function dpopProofJwt(headers, options, url, htm, clockSkew2, accessToken)
     htm,
     nonce,
     htu: `${url.origin}${url.pathname}`,
-    ath: undefined
+    ath: void 0
   }, privateKey);
   headers.set("dpop", proof);
 }
@@ -468,7 +468,7 @@ function isOAuth2Error(input) {
   if (typeof value !== "object" || Array.isArray(value) || value === null) {
     return false;
   }
-  return value.error !== undefined;
+  return value.error !== void 0;
 }
 async function authenticatedRequest(as, client, method, url, body, headers, options) {
   await clientAuthentication(as, client, body, headers, options?.clientPrivateKey);
@@ -486,7 +486,7 @@ async function tokenEndpointRequest(as, client, grantType, parameters, options)
   parameters.set("grant_type", grantType);
   const headers = prepareHeaders(options?.headers);
   headers.set("accept", "application/json");
-  if (options?.DPoP !== undefined) {
+  if (options?.DPoP !== void 0) {
     await dpopProofJwt(headers, options.DPoP, url, "POST", getClockSkew(client));
   }
   return authenticatedRequest(as, client, "POST", url, parameters, headers, options);
@@ -537,23 +537,23 @@ async function processGenericAccessTokenResponse(as, client, response, ignoreIdT
   if (json.token_type !== "dpop" && json.token_type !== "bearer") {
     throw new UnsupportedOperationError("unsupported `token_type` value");
   }
-  if (json.expires_in !== undefined && (typeof json.expires_in !== "number" || json.expires_in <= 0)) {
+  if (json.expires_in !== void 0 && (typeof json.expires_in !== "number" || json.expires_in <= 0)) {
     throw new OPE('"response" body "expires_in" property must be a positive number');
   }
-  if (!ignoreRefreshToken && json.refresh_token !== undefined && !validateString(json.refresh_token)) {
+  if (!ignoreRefreshToken && json.refresh_token !== void 0 && !validateString(json.refresh_token)) {
     throw new OPE('"response" body "refresh_token" property must be a non-empty string');
   }
-  if (json.scope !== undefined && typeof json.scope !== "string") {
+  if (json.scope !== void 0 && typeof json.scope !== "string") {
     throw new OPE('"response" body "scope" property must be a string');
   }
   if (!ignoreIdToken) {
-    if (json.id_token !== undefined && !validateString(json.id_token)) {
+    if (json.id_token !== void 0 && !validateString(json.id_token)) {
       throw new OPE('"response" body "id_token" property must be a non-empty string');
     }
     if (json.id_token) {
       const {
         claims
-      } = await validateJwt(json.id_token, checkSigningAlgorithm.bind(undefined, client.id_token_signed_response_alg, as.id_token_signing_alg_values_supported), noSignatureCheck, getClockSkew(client), getClockTolerance(client)).then(validatePresence.bind(undefined, ["aud", "exp", "iat", "iss", "sub"])).then(validateIssuer.bind(undefined, as.issuer)).then(validateAudience.bind(undefined, client.client_id));
+      } = await validateJwt(json.id_token, checkSigningAlgorithm.bind(void 0, client.id_token_signed_response_alg, as.id_token_signing_alg_values_supported), noSignatureCheck, getClockSkew(client), getClockTolerance(client)).then(validatePresence.bind(void 0, ["aud", "exp", "iat", "iss", "sub"])).then(validateIssuer.bind(void 0, as.issuer)).then(validateAudience.bind(void 0, client.client_id));
       if (Array.isArray(claims.aud) && claims.aud.length !== 1 && claims.azp !== client.client_id) {
         throw new OPE('unexpected ID Token "azp" (authorized party) claim value');
       }
@@ -626,7 +626,7 @@ var jwtClaimNames = {
 };
 function validatePresence(required, result) {
   for (const claim of required) {
-    if (result.claims[claim] === undefined) {
+    if (result.claims[claim] === void 0) {
       throw new OPE(`JWT "${claim}" (${jwtClaimNames[claim]}) claim missing`);
     }
   }
@@ -637,7 +637,7 @@ async function processAuthorizationCodeOAuth2Response(as, client, response) {
   if (isOAuth2Error(result)) {
     return result;
   }
-  if (result.id_token !== undefined) {
+  if (result.id_token !== void 0) {
     if (typeof result.id_token === "string" && result.id_token.length) {
       throw new OPE("Unexpected ID Token returned, use processAuthorizationCodeOpenIDResponse() for OpenID Connect callback processing");
     }
@@ -681,7 +681,7 @@ async function processRevocationResponse(response) {
     }
     throw new OPE('"response" is not a conform Revocation Endpoint response');
   }
-  return undefined;
+  return void 0;
 }
 function assertReadableResponse(response) {
   if (response.bodyUsed) {
@@ -711,7 +711,7 @@ async function handleOAuthBodyError(response) {
     } catch {
     }
   }
-  return undefined;
+  return void 0;
 }
 function checkRsaKeyAlgorithm(algorithm) {
   if (typeof algorithm.modulusLength !== "number" || algorithm.modulusLength < 2048) {
@@ -786,7 +786,7 @@ async function validateJwt(jws, checkAlg, getKey, clockSkew2, clockTolerance2) {
     throw new OPE("JWT Header must be a top level object");
   }
   checkAlg(header);
-  if (header.crit !== undefined) {
+  if (header.crit !== void 0) {
     throw new OPE('unexpected JWT "crit" header parameter');
   }
   const signature = b64u(encodedSignature);
@@ -811,7 +811,7 @@ async function validateJwt(jws, checkAlg, getKey, clockSkew2, clockTolerance2) {
     throw new OPE("JWT Payload must be a top level object");
   }
   const now = epochTime() + clockSkew2;
-  if (claims.exp !== undefined) {
+  if (claims.exp !== void 0) {
     if (typeof claims.exp !== "number") {
       throw new OPE('unexpected JWT "exp" (expiration time) claim type');
     }
@@ -819,17 +819,17 @@ async function validateJwt(jws, checkAlg, getKey, clockSkew2, clockTolerance2) {
       throw new OPE('unexpected JWT "exp" (expiration time) claim value, timestamp is <= now()');
     }
   }
-  if (claims.iat !== undefined) {
+  if (claims.iat !== void 0) {
     if (typeof claims.iat !== "number") {
       throw new OPE('unexpected JWT "iat" (issued at) claim type');
     }
   }
-  if (claims.iss !== undefined) {
+  if (claims.iss !== void 0) {
     if (typeof claims.iss !== "string") {
       throw new OPE('unexpected JWT "iss" (issuer) claim type');
     }
   }
-  if (claims.nbf !== undefined) {
+  if (claims.nbf !== void 0) {
     if (typeof claims.nbf !== "number") {
       throw new OPE('unexpected JWT "nbf" (not before) claim type');
     }
@@ -837,7 +837,7 @@ async function validateJwt(jws, checkAlg, getKey, clockSkew2, clockTolerance2) {
       throw new OPE('unexpected JWT "nbf" (not before) claim value, timestamp is > now()');
     }
   }
-  if (claims.aud !== undefined) {
+  if (claims.aud !== void 0) {
     if (typeof claims.aud !== "string" && !Array.isArray(claims.aud)) {
       throw new OPE('unexpected JWT "aud" (audience) claim type');
     }
@@ -850,7 +850,7 @@ async function validateJwt(jws, checkAlg, getKey, clockSkew2, clockTolerance2) {
   };
 }
 function checkSigningAlgorithm(client, issuer, header) {
-  if (client !== undefined) {
+  if (client !== void 0) {
     if (header.alg !== client) {
       throw new OPE('unexpected JWT "alg" header parameter');
     }
@@ -899,9 +899,9 @@ function validateAuthResponse(as, client, parameters, expectedState) {
     throw new OPE('unexpected "iss" (issuer) response parameter value');
   }
   switch (expectedState) {
-    case undefined:
+    case void 0:
     case expectNoState:
-      if (state !== undefined) {
+      if (state !== void 0) {
         throw new OPE('unexpected "state" response parameter encountered');
       }
       break;
@@ -911,7 +911,7 @@ function validateAuthResponse(as, client, parameters, expectedState) {
       if (!validateString(expectedState)) {
         throw new OPE('"expectedState" must be a non-empty string');
       }
-      if (state === undefined) {
+      if (state === void 0) {
         throw new OPE('response parameter "state" missing');
       }
       if (state !== expectedState) {
@@ -928,7 +928,7 @@ function validateAuthResponse(as, client, parameters, expectedState) {
   }
   const id_token = getURLSearchParameter(parameters, "id_token");
   const token = getURLSearchParameter(parameters, "token");
-  if (id_token !== undefined || token !== undefined) {
+  if (id_token !== void 0 || token !== void 0) {
     throw new UnsupportedOperationError("implicit and hybrid flows are not supported");
   }
   return brand(new URLSearchParams(parameters));
@@ -989,7 +989,7 @@ function common(client, as, _signIn, oauthHttpOptions, refresh, refreshTokenMark
       expires_in,
       access_token
     } = resp;
-    !(expires_in != null) ? process.env.NODE_ENV !== "production" ? invariant2__default.default(false) : invariant2__default.default(false) : undefined;
+    !(expires_in != null) ? process.env.NODE_ENV !== "production" ? invariant2__default.default(false) : invariant2__default.default(false) : void 0;
     saveLocal(client, {
       refresh_token,
       refreshTokenMarker,
@@ -1017,11 +1017,11 @@ function common(client, as, _signIn, oauthHttpOptions, refresh, refreshTokenMark
     }
   }
   async function signOut() {
-    !token ? process.env.NODE_ENV !== "production" ? invariant2__default.default(false, "not signed in") : invariant2__default.default(false) : undefined;
+    !token ? process.env.NODE_ENV !== "production" ? invariant2__default.default(false, "not signed in") : invariant2__default.default(false) : void 0;
     const result = await processRevocationResponse(await revocationRequest(as, client, token.access_token, oauthHttpOptions));
     rmTimeout();
     removeLocal(client);
-    token = undefined;
+    token = void 0;
     throwIfError(result);
     eventTarget.dispatchTypedEvent("signOut", new Event("signOut"));
   }
@@ -1034,14 +1034,14 @@ function common(client, as, _signIn, oauthHttpOptions, refresh, refreshTokenMark
       pendingSignIn = _signIn();
       return await pendingSignIn;
     } finally {
-      pendingSignIn = undefined;
+      pendingSignIn = void 0;
     }
   }
   eventTarget.addEventListener("signIn", restartRefreshTimer);
   eventTarget.addEventListener("refresh", restartRefreshTimer);
   function getTokenOrUndefined() {
     if (!token || Date.now() >= token.expires_at) {
-      return undefined;
+      return void 0;
     }
     return token?.access_token;
   }
@@ -1075,7 +1075,7 @@ function createAuthorizationServer(ctxPath, url) {
 }
 
 // src/createConfidentialOauthClient.ts
-function createConfidentialOauthClient(client_id, client_secret, url, scopes = ["api:read-data", "api:write-data"], fetchFn = globalThis.fetch, ctxPath = "multipass") {
+function createConfidentialOauthClient(client_id, client_secret, url, scopes = ["api:read-data", "api:write-data", "api:use-ontologies-read", "api:use-ontologies-write"], fetchFn = globalThis.fetch, ctxPath = "multipass") {
   const client = {
     client_id,
     client_secret
@@ -1088,7 +1088,7 @@ function createConfidentialOauthClient(client_id, client_secret, url, scopes = [
   const {
     getToken,
     makeTokenAndSaveRefresh
-  } = common(client, authServer, _signIn, oauthHttpOptions, undefined, undefined, joinedScopes);
+  } = common(client, authServer, _signIn, oauthHttpOptions, void 0, void 0, joinedScopes);
   async function _signIn() {
     return makeTokenAndSaveRefresh(throwIfError(await processClientCredentialsResponse(authServer, client, await clientCredentialsGrantRequest(authServer, client, new URLSearchParams({
       scope: joinedScopes
@@ -1154,7 +1154,7 @@ var delay_default = delay;
 function processOptionsAndAssignDefaults(url, redirect_uri, useHistory, loginPage, postLoginPage, scopes, fetchFn, ctxPath) {
   let options = {};
   if (typeof useHistory === "object") {
-    !(!loginPage && !postLoginPage && !scopes && !fetchFn && !ctxPath) ? process.env.NODE_ENV !== "production" ? invariant2__default.default(false, "If useHistory is an object, other options should not be provided") : invariant2__default.default(false) : undefined;
+    !(!loginPage && !postLoginPage && !scopes && !fetchFn && !ctxPath) ? process.env.NODE_ENV !== "production" ? invariant2__default.default(false, "If useHistory is an object, other options should not be provided") : invariant2__default.default(false) : void 0;
     options = useHistory;
   } else {
     options = {
@@ -1166,13 +1166,13 @@ function processOptionsAndAssignDefaults(url, redirect_uri, useHistory, loginPag
       ctxPath
     };
   }
-  !url ? process.env.NODE_ENV !== "production" ? invariant2__default.default(false, "url is required") : invariant2__default.default(false) : undefined;
-  !redirect_uri ? process.env.NODE_ENV !== "production" ? invariant2__default.default(false, "redirectUrl is required") : invariant2__default.default(false) : undefined;
+  !url ? process.env.NODE_ENV !== "production" ? invariant2__default.default(false, "url is required") : invariant2__default.default(false) : void 0;
+  !redirect_uri ? process.env.NODE_ENV !== "production" ? invariant2__default.default(false, "redirectUrl is required") : invariant2__default.default(false) : void 0;
   return {
     useHistory: options.useHistory ?? true,
     loginPage: options.loginPage,
     postLoginPage: options.postLoginPage || window.location.toString(),
-    joinedScopes: [...options.scopes ?? ["api:read-data", "api:write-data"]].sort().join(" "),
+    joinedScopes: [...options.scopes ?? ["api:read-data", "api:write-data", "api:use-ontologies-read", "api:use-ontologies-write"]].sort().join(" "),
     fetchFn: options.fetchFn ?? globalThis.fetch,
     ctxPath: options.ctxPath ?? "multipass",
     refreshTokenMarker: options.refreshTokenMarker