@owox/idp-owox 0.12.0-next-20251105161542 → 0.12.0-next-20251106101648

package/dist/auth/AuthorizationStore.d.ts

@@ -2,6 +2,7 @@
  * Storage for mapping state -> code_verifier (PKCE).
  * No ORM usage.
  */
+import type { StoreResult } from './StoreResult';
 export interface AuthorizationStore {
     /**
      * Initialize connections/resources and create schema if needed.
@@ -21,9 +22,9 @@ export interface AuthorizationStore {
     save(state: string, codeVerifier: string, expiresAt?: Date | null): Promise<void>;
     /**
      * Get code_verifier by state.
-     * Must return null if record is missing or expired.
+     * Returns StoreResult with either code (reason=null) or reason when code is not available.
      */
-    get(state: string): Promise<string | null>;
+    get(state: string): Promise<StoreResult>;
     /**
      * Delete a record by state.
      */

package/dist/auth/AuthorizationStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthorizationStore.d.ts","sourceRoot":"","sources":["../../src/auth/AuthorizationStore.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5B;;OAEG;IACH,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9B;;;;;;OAMG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElF;;;OAGG;IACH,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE3C;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErC;;;OAGG;IACH,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAEhC;;OAEG;IACH,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B"}
+{"version":3,"file":"AuthorizationStore.d.ts","sourceRoot":"","sources":["../../src/auth/AuthorizationStore.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5B;;OAEG;IACH,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9B;;;;;;OAMG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElF;;;OAGG;IACH,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAEzC;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErC;;;OAGG;IACH,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAEhC;;OAEG;IACH,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B"}

package/dist/auth/MysqlAuthorizationStore.d.ts

@@ -1,5 +1,6 @@
 import type { AuthorizationStore } from './AuthorizationStore';
 import type { MysqlConfig } from '../config';
+import { StoreResult } from './StoreResult';
 /**
  * MySQL implementation (mysql2/promise, no ORM).
  */
@@ -9,7 +10,7 @@ export declare class MysqlAuthorizationStore implements AuthorizationStore {
     constructor(config: MysqlConfig);
     initialize(): Promise<void>;
     save(state: string, codeVerifier: string, expiresAt?: Date | null): Promise<void>;
-    get(state: string): Promise<string | null>;
+    get(state: string): Promise<StoreResult>;
     delete(state: string): Promise<void>;
     purgeExpired(): Promise<number>;
     shutdown(): Promise<void>;

package/dist/auth/MysqlAuthorizationStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MysqlAuthorizationStore.d.ts","sourceRoot":"","sources":["../../src/auth/MysqlAuthorizationStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAG7C;;GAEG;AACH,qBAAa,uBAAwB,YAAW,kBAAkB;IAGpD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFnC,OAAO,CAAC,IAAI,CAAC,CAAO;gBAES,MAAM,EAAE,WAAW;IAE1C,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAgC3B,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAcjF,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAuB1C,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpC,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAO/B,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAOzB,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IASnC,OAAO,CAAC,OAAO;CAIhB;AAED,eAAe,uBAAuB,CAAC"}
+{"version":3,"file":"MysqlAuthorizationStore.d.ts","sourceRoot":"","sources":["../../src/auth/MysqlAuthorizationStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C;;GAEG;AACH,qBAAa,uBAAwB,YAAW,kBAAkB;IAGpD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFnC,OAAO,CAAC,IAAI,CAAC,CAAO;gBAES,MAAM,EAAE,WAAW;IAE1C,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAgC3B,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAcjF,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAqBxC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpC,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAO/B,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAOzB,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IASnC,OAAO,CAAC,OAAO;CAIhB;AAED,eAAe,uBAAuB,CAAC"}

package/dist/auth/MysqlAuthorizationStore.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MysqlAuthorizationStore = void 0;
+const StoreResult_1 = require("./StoreResult");
 /**
  * MySQL implementation (mysql2/promise, no ORM).
  */
@@ -47,19 +48,18 @@ class MysqlAuthorizationStore {
           created_at    = CURRENT_TIMESTAMP`, [state, codeVerifier, exp]);
     }
     async get(state) {
-        await this.purgeExpired();
         const [rows] = await this.getPool().execute(`SELECT code_verifier, expires_at FROM auth_states WHERE state = ? LIMIT 1`, [state]);
         const row = Array.isArray(rows) && rows.length > 0
             ? rows[0]
             : null;
         if (!row)
-            return null;
+            return StoreResult_1.StoreResult.notFound();
         const exp = row.expires_at ? new Date(row.expires_at) : null;
         if (exp && exp.getTime() <= Date.now()) {
             await this.delete(state);
-            return null;
+            return StoreResult_1.StoreResult.expired();
         }
-        return row.code_verifier;
+        return StoreResult_1.StoreResult.withCode(row.code_verifier);
     }
     async delete(state) {
         await this.getPool().execute(`DELETE FROM auth_states WHERE state = ?`, [state]);

package/dist/auth/SqliteAuthorizationStore.d.ts

@@ -1,5 +1,6 @@
 import type { AuthorizationStore } from './AuthorizationStore';
 import type { SqliteConfig } from '../config';
+import { StoreResult } from './StoreResult';
 /**
  * SQLite implementation (better-sqlite3, no ORM).
  */
@@ -9,7 +10,7 @@ export declare class SqliteAuthorizationStore implements AuthorizationStore {
     constructor(config: SqliteConfig);
     initialize(): Promise<void>;
     save(state: string, codeVerifier: string, expiresAt?: Date | null): Promise<void>;
-    get(state: string): Promise<string | null>;
+    get(state: string): Promise<StoreResult>;
     delete(state: string): Promise<void>;
     purgeExpired(): Promise<number>;
     shutdown(): Promise<void>;

package/dist/auth/SqliteAuthorizationStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SqliteAuthorizationStore.d.ts","sourceRoot":"","sources":["../../src/auth/SqliteAuthorizationStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAG9C;;GAEG;AACH,qBAAa,wBAAyB,YAAW,kBAAkB;IAGrD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFnC,OAAO,CAAC,EAAE,CAAC,CAAW;gBAEO,MAAM,EAAE,YAAY;IAE3C,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAuB3B,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAcjF,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAmB1C,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpC,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAQ/B,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAOzB,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IASnC,OAAO,CAAC,OAAO;IAKf,OAAO,CAAC,KAAK;CAId;AAED,eAAe,wBAAwB,CAAC"}
+{"version":3,"file":"SqliteAuthorizationStore.d.ts","sourceRoot":"","sources":["../../src/auth/SqliteAuthorizationStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAE9C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C;;GAEG;AACH,qBAAa,wBAAyB,YAAW,kBAAkB;IAGrD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFnC,OAAO,CAAC,EAAE,CAAC,CAAW;gBAEO,MAAM,EAAE,YAAY;IAE3C,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAuB3B,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAcjF,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAiBxC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpC,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAQ/B,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAOzB,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IASnC,OAAO,CAAC,OAAO;IAKf,OAAO,CAAC,KAAK;CAId;AAED,eAAe,wBAAwB,CAAC"}

package/dist/auth/SqliteAuthorizationStore.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SqliteAuthorizationStore = void 0;
+const StoreResult_1 = require("./StoreResult");
 /**
  * SQLite implementation (better-sqlite3, no ORM).
  */
@@ -45,17 +46,16 @@ class SqliteAuthorizationStore {
     async get(state) {
         this.getDb();
         const now = this.getTime();
-        await this.purgeExpired();
         const row = this.getDb()
             .prepare(`SELECT code_verifier, expires_at FROM auth_states WHERE state = ?`)
             .get(state);
         if (!row)
-            return null;
+            return StoreResult_1.StoreResult.notFound();
         if (row.expires_at != null && row.expires_at <= now) {
             await this.delete(state);
-            return null;
+            return StoreResult_1.StoreResult.expired();
         }
-        return row.code_verifier;
+        return StoreResult_1.StoreResult.withCode(row.code_verifier);
     }
     async delete(state) {
         this.getDb().prepare(`DELETE FROM auth_states WHERE state = ?`).run(state);

package/dist/auth/StoreResult.d.ts

@@ -0,0 +1,12 @@
+export declare enum StoreReason {
+    NOT_FOUND = "not_found",
+    EXPIRED = "expired"
+}
+export declare class StoreResult {
+    code: string | null;
+    reason: StoreReason | null;
+    static withCode(code: string): StoreResult;
+    static notFound(): StoreResult;
+    static expired(): StoreResult;
+}
+//# sourceMappingURL=StoreResult.d.ts.map

package/dist/auth/StoreResult.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StoreResult.d.ts","sourceRoot":"","sources":["../../src/auth/StoreResult.ts"],"names":[],"mappings":"AAAA,oBAAY,WAAW;IACrB,SAAS,cAAc;IACvB,OAAO,YAAY;CACpB;AAED,qBAAa,WAAW;IACtB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC;IAE3B,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW;IAG1C,MAAM,CAAC,QAAQ,IAAI,WAAW;IAG9B,MAAM,CAAC,OAAO,IAAI,WAAW;CAG9B"}

package/dist/auth/StoreResult.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StoreResult = exports.StoreReason = void 0;
+var StoreReason;
+(function (StoreReason) {
+    StoreReason["NOT_FOUND"] = "not_found";
+    StoreReason["EXPIRED"] = "expired";
+})(StoreReason || (exports.StoreReason = StoreReason = {}));
+class StoreResult {
+    code;
+    reason;
+    static withCode(code) {
+        return { code, reason: null };
+    }
+    static notFound() {
+        return { code: null, reason: StoreReason.NOT_FOUND };
+    }
+    static expired() {
+        return { code: null, reason: StoreReason.EXPIRED };
+    }
+}
+exports.StoreResult = StoreResult;

package/dist/client/IdentityOwoxClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityOwoxClient.d.ts","sourceRoot":"","sources":["../../src/client/IdentityOwoxClient.ts"],"names":[],"mappings":"AACA,OAAO,EACL,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,YAAY,EAIb,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAErD,OAAO,EAAE,QAAQ,EAAkB,MAAM,oBAAoB,CAAC;AAE9D;;;GAGG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgB;gBAEzB,MAAM,EAAE,wBAAwB;IAW5C;;OAEG;IACG,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC;IAKzD;;OAEG;IACG,WAAW,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAKtE;;OAEG;IACG,eAAe,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAUhF;;OAEG;IACG,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAUzD;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC;CAIvC"}
+{"version":3,"file":"IdentityOwoxClient.d.ts","sourceRoot":"","sources":["../../src/client/IdentityOwoxClient.ts"],"names":[],"mappings":"AACA,OAAO,EACL,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,YAAY,EAIb,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAErD,OAAO,EAAE,QAAQ,EAAkB,MAAM,oBAAoB,CAAC;AAG9D;;;GAGG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgB;gBAEzB,MAAM,EAAE,wBAAwB;IAW5C;;OAEG;IACG,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC;IAyBzD;;OAEG;IACG,WAAW,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAKtE;;OAEG;IACG,eAAe,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAUhF;;OAEG;IACG,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAUzD;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC;CAIvC"}

package/dist/client/IdentityOwoxClient.js

@@ -8,6 +8,7 @@ const axios_1 = __importDefault(require("axios"));
 const dto_1 = require("./dto");
 const ms_1 = __importDefault(require("ms"));
 const idp_protocol_1 = require("@owox/idp-protocol");
+const exception_1 = require("../exception");
 /**
  * Represents a client for interacting with the Identity OWOX API.
  * Provides methods for token management, validation, and retrieval of key sets.
@@ -28,8 +29,26 @@ class IdentityOwoxClient {
      * POST /api/idp/token
      */
     async getToken(req) {
-        const { data } = await this.http.post('/api/idp/token', req);
-        return dto_1.TokenResponseSchema.parse(data);
+        try {
+            const { data } = await this.http.post('/api/idp/token', req);
+            return dto_1.TokenResponseSchema.parse(data);
+        }
+        catch (err) {
+            if (axios_1.default.isAxiosError(err)) {
+                const status = err.response?.status;
+                if (status === 401) {
+                    throw new exception_1.AuthenticationException('Invalid or expired credentials', {
+                        cause: err,
+                        context: { req },
+                    });
+                }
+                throw new exception_1.IdpFailedException(`Failed to get token: ${status}`, {
+                    cause: err,
+                    context: { req },
+                });
+            }
+            throw err;
+        }
     }
     /**
      * POST /api/idp/revocation

package/dist/exception.d.ts

@@ -0,0 +1,17 @@
+export declare class AuthenticationException extends Error {
+    readonly cause?: unknown;
+    readonly context?: Record<string, unknown>;
+    constructor(message: string, opts?: {
+        cause?: unknown;
+        context?: Record<string, unknown>;
+    });
+}
+export declare class IdpFailedException extends Error {
+    readonly cause?: unknown;
+    readonly context?: Record<string, unknown>;
+    constructor(message: string, opts?: {
+        cause?: unknown;
+        context?: Record<string, unknown>;
+    });
+}
+//# sourceMappingURL=exception.d.ts.map

package/dist/exception.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exception.d.ts","sourceRoot":"","sources":["../src/exception.ts"],"names":[],"mappings":"AAAA,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAE/B,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE;CAM3F;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAE/B,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE;CAM3F"}

package/dist/exception.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdpFailedException = exports.AuthenticationException = void 0;
+class AuthenticationException extends Error {
+    cause;
+    context;
+    constructor(message, opts) {
+        super(message);
+        this.name = 'AuthenticationException';
+        this.cause = opts?.cause;
+        this.context = opts?.context;
+    }
+}
+exports.AuthenticationException = AuthenticationException;
+class IdpFailedException extends Error {
+    cause;
+    context;
+    constructor(message, opts) {
+        super(message);
+        this.name = 'IdpRequestFailedException';
+        this.cause = opts?.cause;
+        this.context = opts?.context;
+    }
+}
+exports.IdpFailedException = IdpFailedException;

package/dist/owoxIdp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"owoxIdp.d.ts","sourceRoot":"","sources":["../src/owoxIdp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAiB,MAAM,oBAAoB,CAAC;AAC/F,OAAO,CAAC,EAAE,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAkBzC,qBAAa,OAAQ,YAAW,WAAW;IAK7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAC3C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEH,MAAM,EAAE,aAAa;IAMlD,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAW7D,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAU5C,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAiBvD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK/C,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAInB,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IAI7B,gBAAgB,CACpB,GAAG,EAAE,CAAC,CAAC,OAAO,EACd,GAAG,EAAE,CAAC,CAAC,QAAQ,EACf,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;IAIvB,gBAAgB,CACpB,GAAG,EAAE,CAAC,CAAC,OAAO,EACd,GAAG,EAAE,CAAC,CAAC,QAAQ,EACf,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;IAIvB,iBAAiB,CACrB,GAAG,EAAE,CAAC,CAAC,OAAO,EACd,GAAG,EAAE,CAAC,CAAC,QAAQ,EACf,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;IASvB,iBAAiB,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAchF,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAWrF,qBAAqB,CACzB,GAAG,EAAE,CAAC,CAAC,OAAO,EACd,GAAG,EAAE,CAAC,CAAC,QAAQ,EACf,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;IA0B7B,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,GAAG,IAAI;YAyBtB,iBAAiB;YAyBjB,cAAc;IAgB5B,OAAO,CAAC,gBAAgB;IAiBxB,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,WAAW;CAOpB"}
+{"version":3,"file":"owoxIdp.d.ts","sourceRoot":"","sources":["../src/owoxIdp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAiB,MAAM,oBAAoB,CAAC;AAC/F,OAAO,CAAC,EAAE,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAoBzC,qBAAa,OAAQ,YAAW,WAAW;IAK7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAC3C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEH,MAAM,EAAE,aAAa;IAMlD,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAW7D,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAU5C,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAiBvD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK/C,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAInB,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IAI7B,gBAAgB,CACpB,GAAG,EAAE,CAAC,CAAC,OAAO,EACd,GAAG,EAAE,CAAC,CAAC,QAAQ,EACf,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;IAIvB,gBAAgB,CACpB,GAAG,EAAE,CAAC,CAAC,OAAO,EACd,GAAG,EAAE,CAAC,CAAC,QAAQ,EACf,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;IAIvB,iBAAiB,CACrB,GAAG,EAAE,CAAC,CAAC,OAAO,EACd,GAAG,EAAE,CAAC,CAAC,QAAQ,EACf,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;IASvB,iBAAiB,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAchF,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAWrF,qBAAqB,CACzB,GAAG,EAAE,CAAC,CAAC,OAAO,EACd,GAAG,EAAE,CAAC,CAAC,QAAQ,EACf,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;IA4C7B,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,GAAG,IAAI;YAuCtB,iBAAiB;YAyBjB,cAAc;IAmB5B,OAAO,CAAC,gBAAgB;IAiBxB,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,WAAW;CAOpB"}

package/dist/owoxIdp.js

@@ -12,6 +12,8 @@ const parseToken_1 = require("./token/parseToken");
 const pkce_1 = require("./pkce");
 const idpOwoxPayloadToPayloadMapper_1 = require("./mappers/idpOwoxPayloadToPayloadMapper");
 const ms_1 = __importDefault(require("ms"));
+const exception_1 = require("./exception");
+const StoreResult_1 = require("./auth/StoreResult");
 const COOKIE_NAME = 'refreshToken';
 class OwoxIdp {
     config;
@@ -119,9 +121,21 @@ class OwoxIdp {
             return res.json(auth);
         }
         catch (error) {
-            this.logger.error(this.formatError(error));
             res.clearCookie(COOKIE_NAME);
-            return res.json({ reason: 'atm4' });
+            if (error instanceof exception_1.AuthenticationException) {
+                this.logger.info(this.formatError(error), {
+                    context: error.name,
+                    params: error.context,
+                    cause: error.cause,
+                });
+                return res.json({ reason: 'atm4' });
+            }
+            if (error instanceof exception_1.IdpFailedException) {
+                this.logger.error('Access Token middleware failed with unexpected code', error.context, error.cause);
+                return res.json({ reason: 'atm5' });
+            }
+            this.logger.error(this.formatError(error));
+            return res.json({ reason: 'atm6' });
         }
     }
     registerRoutes(app) {
@@ -142,7 +156,19 @@ class OwoxIdp {
                 res.redirect('/');
             }
             catch (error) {
-                this.logger.error(this.formatError(error));
+                if (error instanceof exception_1.AuthenticationException) {
+                    this.logger.info(this.formatError(error), {
+                        context: error.name,
+                        params: error.context,
+                        cause: error.cause,
+                    });
+                }
+                else if (error instanceof exception_1.IdpFailedException) {
+                    this.logger.error('Token Exchange callback failed with unexpected code', error.context, error.cause);
+                }
+                else {
+                    this.logger.error(this.formatError(error));
+                }
                 return res.redirect(idp_protocol_1.ProtocolRoute.SIGN_IN);
             }
         });
@@ -165,14 +191,17 @@ class OwoxIdp {
         res.redirect(redirectUrl.toString());
     }
     async changeAuthCode(code, state) {
-        const codeVerifier = await this.store.get(state);
-        if (!codeVerifier) {
-            throw Error('Code verifier is empty');
+        const res = await this.store.get(state);
+        if (!res.code) {
+            if (res.reason == StoreResult_1.StoreReason.EXPIRED) {
+                throw new exception_1.AuthenticationException('Code verifier has expired');
+            }
+            throw new exception_1.IdpFailedException(`Code verifier is not available: ${res.reason ?? 'unknown'}`);
         }
         const request = {
             grantType: 'authorization_code',
             authCode: code,
-            codeVerifier: codeVerifier,
+            codeVerifier: res.code,
             clientId: this.config.idpConfig.clientId,
         };
         return await this.identityClient.getToken(request);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owox/idp-owox",
-  "version": "0.12.0-next-20251105161542",
+  "version": "0.12.0-next-20251106101648",
   "description": "Identity Provider implementation from OWOX",
   "author": "OWOX",
   "license": "ELv2",
@@ -21,8 +21,8 @@
     "prepublishOnly": "npm run lint && npm run typecheck"
   },
   "dependencies": {
-    "@owox/idp-protocol": "0.12.0-next-20251105161542",
-    "@owox/internal-helpers": "0.12.0-next-20251105161542",
+    "@owox/idp-protocol": "0.12.0-next-20251106101648",
+    "@owox/internal-helpers": "0.12.0-next-20251106101648",
     "pkce-challenge": "^5.0.0",
     "cookie-parser": "^1.4.7",
     "env-paths": "^3.0.0",