@pofsis-nbt/pofsis-auth 1.0.3 → 1.2.0

package/Documentation.md

@@ -1,141 +1,143 @@
-# POFSIS Auth Documentation
-
-This is the complete public API and integration reference for `@pofsis-nbt/pofsis-auth@1.0.1`.
-
-The repository also includes an interactive [POFSIS Auth documentation portal](./index.html) with required environment configuration, generated setup examples, and authentication scenario links. The portal does not persist or transmit entered values and is intentionally excluded from the npm package.
-
-## Integration process
-
-1. Install `@pofsis-nbt/pofsis-auth` with its React, React DOM, and optional Axios peers.
-2. Import `@pofsis-nbt/pofsis-auth/style.css` once.
-3. Wrap the application in `PofsisAuth` and supply runtime configuration.
-4. Protect authenticated content with `RequireAuth` or use `useAuth` directly.
-5. Register `/auth/callback` and the application origin with the POFSIS Auth service.
-
-The consuming application owns environment lookup. The library never reads `import.meta.env`.
-
-## Public components
-
-### `PofsisAuth`
-
-The provider restores the cookie-backed session, manages the in-memory access token, coordinates cross-tab logout, runs OAuth/PKCE, and handles fixed auth paths.
-
-`PofsisAuthProps`:
-
-| Prop            | Type                     | Required | Meaning                                |
-| --------------- | ------------------------ | -------- | -------------------------------------- |
-| `children`      | `ReactNode`              | yes      | Application content                    |
-| `appName`       | `string`                 | yes      | Registered POFSIS application identity |
-| `apiBaseUrl`    | `string`                 | yes      | Auth API base URL                      |
-| `authUrl`       | `string`                 | yes      | OAuth authorize URL                    |
-| `scope`         | `string`                 | no       | Defaults to `openid profile email`     |
-| `postLoginPath` | `string`                 | no       | Callback destination; defaults to `/`  |
-| `components`    | `AuthComponentOverrides` | no       | Custom loading and error screens       |
-
-```tsx
-<PofsisAuth
-    appName="ORBIT"
-    apiBaseUrl={runtimeConfig.authApi}
-    authUrl={runtimeConfig.authorizeUrl}
-    components={{ LoadingScreen: AppLoader, ErrorScreen: AppAuthError }}
->
-    <App />
-</PofsisAuth>
-```
-
-### `RequireAuth`
-
-`RequireAuth({ children, fallback?, onUnauthenticated? })` renders authenticated content. `fallback` overrides loading UI for that guard. Without `onUnauthenticated`, an unauthenticated visitor starts login; failures route to `/auth/error`.
-
-### `AuthLoadingScreen`
-
-The default full-screen loader. `AuthLoadingScreenProps.callback` changes the message for login/callback work.
-
-### `AuthErrorScreen`
-
-The default error page. `AuthErrorScreenProps.retryHref` defaults to `/login`. Its illustration is emitted into the compiled bundle as a data asset.
-
-## `useAuth`
-
-`useAuth(): AuthContextValue` must be called below `PofsisAuth`.
-
-| Value or method                         | Meaning                                                                       |
-| --------------------------------------- | ----------------------------------------------------------------------------- |
-| `user`                                  | Current `PofsisUser`, or `null`                                               |
-| `session`                               | Current `SessionPayload`, or `null`                                           |
-| `isAuthenticated`                       | Whether a session is present                                                  |
-| `isLoading`                             | Whether initial session restoration is running                                |
-| `login(options?)`                       | Starts OAuth/PKCE login                                                       |
-| `logout()`                              | Ends the remote session, clears local state, broadcasts logout, and redirects |
-| `refreshSession()`                      | Exchanges the refresh cookie for a new access token                           |
-| `getAccessToken()`                      | Returns the in-memory token or `null`                                         |
-| `getAccountProfile()`                   | Fetches and merges the current `AccountProfile`                               |
-| `updateAccountProfile(profile)`         | Updates first and/or last name                                                |
-| `uploadAccountProfileImage(kind, file)` | Uploads a `profile` or `cover` image                                          |
-| `deleteAccountProfileImage(kind)`       | Removes a `profile` or `cover` image                                          |
-| `completeCallback(code, state)`         | Completes PKCE callback; normally used internally                             |
-
-## Login options and URL hints
-
-`login(options)` accepts `AuthLaunchOptions`:
-
-- `returnUrl`: accepted only when it starts with `/` and not `//`; unsafe or external values are discarded.
-- `screen`: `login`, `signup`, or `reset`; legacy `register` is normalized to `signup`.
-- `loginHint`: valid email or Philippine mobile number. Emails are trimmed/lowercased; mobile numbers normalize to `+63`; invalid or values over 320 characters are ignored.
-- `method`: `password`, `passkey`, or `otp`. Login accepts all three methods. Signup accepts `password` or `otp`; OTP signup continues to the verification-code page after the identifier is submitted.
-
-The `/login` route also reads `screen`, `login_hint`, and `method`. Legacy `email` is accepted only as an email hint and only when canonical `login_hint` is absent. Unknown values are ignored. Signup defaults to password when no method is supplied and preserves an explicit `otp`; reset does not forward a method.
-
-Fixed paths are `/login`, `/auth/callback`, and `/auth/error`. Saved callback destinations are restricted to safe local paths.
-
-## Axios interceptor
-
-`attachAuthInterceptor(client, getToken, refresh)` adds the current bearer token and performs one refresh-and-retry after a 401. It returns a cleanup function that ejects both interceptors. Axios is optional unless this helper is used.
-
-## Configuration helper
-
-`resolveConfig(overrides: ConfigOverrides)` validates `appName`, `apiBaseUrl`, and `authUrl`, trims values, removes a trailing slash from URLs, and supplies the default scope. Missing required values throw synchronously.
-
-## Exported types
-
-- `PofsisAuthProps`, `PofsisAuthConfig`, `ConfigOverrides`, `AuthComponentOverrides`
-- `AuthLoadingScreenProps`, `AuthErrorScreenProps`, `RequireAuthProps`
-- `AuthContextValue`, `AuthLaunchOptions`, `AuthScreen`, `AuthMethod`
-- `PofsisUser`, `AccountProfile`, `SessionPayload`, `TokenResponse`
-- `OAuthClientConfig`
-
-`SessionPayload` contains `token_type`, `expires_in`, and `user`. `TokenResponse` adds `access_token`. Access tokens remain in memory. `PofsisUser` exposes identity, display/profile media, and optional roles. `AccountProfile` represents the editable account profile and timestamps. `OAuthClientConfig` represents server-resolved client, redirect, and logout details.
-
-## Module formats
-
-ESM/JavaScript and TypeScript use the same package import:
-
-```ts
-import { PofsisAuth, useAuth } from '@pofsis-nbt/pofsis-auth'
-```
-
-CommonJS uses:
-
-```js
-const { PofsisAuth, useAuth } = require('@pofsis-nbt/pofsis-auth')
-```
-
-TypeScript declarations resolve from `dist/index.d.ts`. No separate TypeScript package is needed.
-
-## Build and verification process
-
-```bash
-npm run format:check
-npm run typecheck
-npm test
-npm run build
-npm run pack:check
-```
-
-`dist/` contains ESM and CommonJS JavaScript, source maps, declaration files/maps, component declarations, and `style.css`. The npm package includes only `dist`, `package.json`, `README.md`, and `Documentation.md`.
-
-## Public boundary and migration
-
-Supported imports are the package root and `@pofsis-nbt/pofsis-auth/style.css`. Files under `auth/`, `components/`, `context/`, `src/`, and `dist/` are implementation details and are not exported.
-
-Migrating from `@pofsis/auth-react` requires changing the package name, passing explicit provider configuration, and importing the stylesheet. OAuth paths, PKCE/session behavior, hooks, profile methods, UI overrides, and interceptor behavior remain available.
+# POFSIS Auth Documentation
+
+This is the complete public API and integration reference for `@pofsis-nbt/pofsis-auth@1.2.0`.
+
+The repository also includes an interactive [POFSIS Auth documentation portal](./index.html) with required environment configuration, generated setup examples, and authentication scenario links. The portal does not persist or transmit entered values and is intentionally excluded from the npm package.
+
+The [popup integration guide](./docs/popup-integration.md) is the canonical consumer reference for framework-neutral, React, and Web Component popup launches.
+
+## Integration process
+
+1. Install `@pofsis-nbt/pofsis-auth` with its React, React DOM, and optional Axios peers.
+2. Import `@pofsis-nbt/pofsis-auth/style.css` once.
+3. Wrap the application in `PofsisAuth` and supply runtime configuration.
+4. Protect authenticated content with `RequireAuth` or use `useAuth` directly.
+5. Register `/auth/callback` and the application origin with the POFSIS Auth service.
+
+The consuming application owns environment lookup. The library never reads `import.meta.env`.
+
+## Public components
+
+### `PofsisAuth`
+
+The provider restores the cookie-backed session, manages the in-memory access token, coordinates cross-tab logout, runs OAuth/PKCE, and handles fixed auth paths.
+
+`PofsisAuthProps`:
+
+| Prop            | Type                     | Required | Meaning                                |
+| --------------- | ------------------------ | -------- | -------------------------------------- |
+| `children`      | `ReactNode`              | yes      | Application content                    |
+| `appName`       | `string`                 | yes      | Registered POFSIS application identity |
+| `apiBaseUrl`    | `string`                 | yes      | Auth API base URL                      |
+| `authUrl`       | `string`                 | yes      | OAuth authorize URL                    |
+| `scope`         | `string`                 | no       | Defaults to `openid profile email`     |
+| `postLoginPath` | `string`                 | no       | Callback destination; defaults to `/`  |
+| `components`    | `AuthComponentOverrides` | no       | Custom loading and error screens       |
+
+```tsx
+<PofsisAuth
+    appName="ORBIT"
+    apiBaseUrl={runtimeConfig.authApi}
+    authUrl={runtimeConfig.authorizeUrl}
+    components={{ LoadingScreen: AppLoader, ErrorScreen: AppAuthError }}
+>
+    <App />
+</PofsisAuth>
+```
+
+### `RequireAuth`
+
+`RequireAuth({ children, fallback?, onUnauthenticated? })` renders authenticated content. `fallback` overrides loading UI for that guard. Without `onUnauthenticated`, an unauthenticated visitor starts login; failures route to `/auth/error`.
+
+### `AuthLoadingScreen`
+
+The default full-screen loader. `AuthLoadingScreenProps.callback` changes the message for login/callback work.
+
+### `AuthErrorScreen`
+
+The default error page. `AuthErrorScreenProps.retryHref` defaults to `/login`. Its illustration is emitted into the compiled bundle as a data asset.
+
+## `useAuth`
+
+`useAuth(): AuthContextValue` must be called below `PofsisAuth`.
+
+| Value or method                         | Meaning                                                                       |
+| --------------------------------------- | ----------------------------------------------------------------------------- |
+| `user`                                  | Current `PofsisUser`, or `null`                                               |
+| `session`                               | Current `SessionPayload`, or `null`                                           |
+| `isAuthenticated`                       | Whether a session is present                                                  |
+| `isLoading`                             | Whether initial session restoration is running                                |
+| `login(options?)`                       | Starts OAuth/PKCE login                                                       |
+| `logout()`                              | Ends the remote session, clears local state, broadcasts logout, and redirects |
+| `refreshSession()`                      | Exchanges the refresh cookie for a new access token                           |
+| `getAccessToken()`                      | Returns the in-memory token or `null`                                         |
+| `getAccountProfile()`                   | Fetches and merges the current `AccountProfile`                               |
+| `updateAccountProfile(profile)`         | Updates first and/or last name                                                |
+| `uploadAccountProfileImage(kind, file)` | Uploads a `profile` or `cover` image                                          |
+| `deleteAccountProfileImage(kind)`       | Removes a `profile` or `cover` image                                          |
+| `completeCallback(code, state)`         | Completes PKCE callback; normally used internally                             |
+
+## Login options and URL hints
+
+`login(options)` accepts `AuthLaunchOptions`:
+
+- `returnUrl`: accepted only when it starts with `/` and not `//`; unsafe or external values are discarded.
+- `screen`: `login`, `signup`, or `reset`; legacy `register` is normalized to `signup`.
+- `loginHint`: valid email or Philippine mobile number. Emails are trimmed/lowercased; mobile numbers normalize to `+63`; invalid or values over 320 characters are ignored.
+- `method`: `password`, `passkey`, or `otp`. Login accepts all three methods. Signup accepts `password` or `otp`; OTP signup continues to the verification-code page after the identifier is submitted.
+
+The `/login` route also reads `screen`, `login_hint`, and `method`. Legacy `email` is accepted only as an email hint and only when canonical `login_hint` is absent. Unknown values are ignored. Signup defaults to password when no method is supplied and preserves an explicit `otp`; reset does not forward a method.
+
+Fixed paths are `/login`, `/auth/callback`, and `/auth/error`. Saved callback destinations are restricted to safe local paths.
+
+## Axios interceptor
+
+`attachAuthInterceptor(client, getToken, refresh)` adds the current bearer token and performs one refresh-and-retry after a 401. It returns a cleanup function that ejects both interceptors. Axios is optional unless this helper is used.
+
+## Configuration helper
+
+`resolveConfig(overrides: ConfigOverrides)` validates `appName`, `apiBaseUrl`, and `authUrl`, trims values, removes a trailing slash from URLs, and supplies the default scope. Missing required values throw synchronously.
+
+## Exported types
+
+- `PofsisAuthProps`, `PofsisAuthConfig`, `ConfigOverrides`, `AuthComponentOverrides`
+- `AuthLoadingScreenProps`, `AuthErrorScreenProps`, `RequireAuthProps`
+- `AuthContextValue`, `AuthLaunchOptions`, `AuthScreen`, `AuthMethod`
+- `PofsisUser`, `AccountProfile`, `SessionPayload`, `TokenResponse`
+- `OAuthClientConfig`
+
+`SessionPayload` contains `token_type`, `expires_in`, and `user`. `TokenResponse` adds `access_token`. Access tokens remain in memory. `PofsisUser` exposes identity, display/profile media, and optional roles. `AccountProfile` represents the editable account profile and timestamps. `OAuthClientConfig` represents server-resolved client, redirect, and logout details.
+
+## Module formats
+
+ESM/JavaScript and TypeScript use the same package import:
+
+```ts
+import { PofsisAuth, useAuth } from '@pofsis-nbt/pofsis-auth'
+```
+
+CommonJS uses:
+
+```js
+const { PofsisAuth, useAuth } = require('@pofsis-nbt/pofsis-auth')
+```
+
+TypeScript declarations resolve from `dist/index.d.ts`. No separate TypeScript package is needed.
+
+## Build and verification process
+
+```bash
+npm run format:check
+npm run typecheck
+npm test
+npm run build
+npm run pack:check
+```
+
+`dist/` contains ESM and CommonJS JavaScript, source maps, declaration files/maps, component declarations, and `style.css`. The npm package includes only `dist`, `package.json`, `README.md`, and `Documentation.md`.
+
+## Public boundary and migration
+
+Supported imports are the package root and `@pofsis-nbt/pofsis-auth/style.css`. Files under `auth/`, `components/`, `context/`, `src/`, and `dist/` are implementation details and are not exported.
+
+Migrating from `@pofsis/auth-react` requires changing the package name, passing explicit provider configuration, and importing the stylesheet. OAuth paths, PKCE/session behavior, hooks, profile methods, UI overrides, and interceptor behavior remain available.

package/README.md

@@ -1,119 +1,130 @@
-# @pofsis-nbt/pofsis-auth
-
-React OAuth 2.0/PKCE authentication for POFSIS applications. One package serves JavaScript and TypeScript consumers through ESM, CommonJS, generated declarations, and extracted CSS.
-
-For guided setup and authentication scenarios, open the repository's interactive [POFSIS Auth documentation portal](./index.html). It validates consumer-supplied environment values and generates safe `/login` launch links without storing them.
-
-## Install
-
-```bash
-npm install @pofsis-nbt/pofsis-auth axios react react-dom
-```
-
-Import the package stylesheet once in the application entry point:
-
-```ts
-import '@pofsis-nbt/pofsis-auth/style.css'
-```
-
-## Quick start
-
-```tsx
-import { PofsisAuth, RequireAuth } from '@pofsis-nbt/pofsis-auth'
-import '@pofsis-nbt/pofsis-auth/style.css'
-
-export function App() {
-    return (
-        <PofsisAuth
-            appName="ORBIT"
-            apiBaseUrl="https://auth-api.example.com"
-            authUrl="https://auth.example.com/authorize"
-        >
-            <RequireAuth>
-                <Dashboard />
-            </RequireAuth>
-        </PofsisAuth>
-    )
-}
-```
-
-`appName`, `apiBaseUrl`, and `authUrl` are required. The library does not read environment variables. A Vite application may pass its own values:
-
-```tsx
-<PofsisAuth
-    appName={import.meta.env.VITE_POFSIS_APP_NAME}
-    apiBaseUrl={import.meta.env.VITE_POFSIS_API_BASE_URL}
-    authUrl={import.meta.env.VITE_POFSIS_AUTH_URL}
-    scope={import.meta.env.VITE_POFSIS_SCOPE}
->
-    <App />
-</PofsisAuth>
-```
-
-The same props may come from server-injected runtime configuration or hardcoded deployment configuration. The default scope is `openid profile email`.
-
-## Session and login
-
-```tsx
-import { useAuth } from '@pofsis-nbt/pofsis-auth'
-
-function AccountMenu() {
-    const { user, login, logout } = useAuth()
-    if (!user) return <button onClick={() => void login()}>Sign in</button>
-    return <button onClick={() => void logout()}>Sign out {user.displayName}</button>
-}
-```
-
-The provider handles `/login`, `/auth/callback`, and `/auth/error`. Login supports `screen`, `loginHint`, `method`, and a safe application-relative `returnUrl`. An OTP signup opens the signup page and continues to account verification after the identifier is submitted. See [Documentation.md](./Documentation.md) for the complete API.
-
-## Axios
-
-```ts
-import axios from 'axios'
-import { attachAuthInterceptor, useAuth } from '@pofsis-nbt/pofsis-auth'
-
-const api = axios.create({ baseURL: '/api' })
-
-function ApiAuthBridge() {
-    const { getAccessToken, refreshSession } = useAuth()
-    React.useEffect(
-        () => attachAuthInterceptor(api, getAccessToken, refreshSession),
-        [getAccessToken, refreshSession],
-    )
-    return null
-}
-```
-
-## CommonJS
-
-```js
-const { PofsisAuth, RequireAuth, useAuth } = require('@pofsis-nbt/pofsis-auth')
-require('@pofsis-nbt/pofsis-auth/style.css')
-```
-
-JavaScript consumers use the compiled JavaScript. TypeScript consumers use the same imports and automatically receive declarations.
-
-## Development
-
-Requires Node `^20.19.0` or `>=22.12.0`.
-
-```bash
-npm install
-npm run format:check
-npm run typecheck
-npm test
-npm run build
-npm run pack:check
-```
-
-Build output is written to `dist/` with ESM (`index.js`), CommonJS (`index.cjs`), source maps, declarations, and `style.css`.
-
-## Migration
-
-When migrating from `@pofsis/auth-react`:
-
-1. Change imports to `@pofsis-nbt/pofsis-auth`.
-2. Pass `appName`, `apiBaseUrl`, and `authUrl` to `PofsisAuth`.
-3. Import `@pofsis-nbt/pofsis-auth/style.css` once.
-
-Do not import `src/`, `dist/` internals, or internal auth helpers. Only the package-root exports and `style.css` are supported.
+# @pofsis-nbt/pofsis-auth
+
+React OAuth 2.0/PKCE authentication for POFSIS applications. One package serves JavaScript and TypeScript consumers through ESM, CommonJS, generated declarations, and extracted CSS.
+
+For guided setup and authentication scenarios, open the repository's interactive [POFSIS Auth documentation portal](./index.html). It validates consumer-supplied environment values and generates safe `/login` launch links without storing them.
+
+For hosted popup setup, parameters, callback handling, React usage, and the optional Web Component, see the [popup integration guide](./docs/popup-integration.md).
+
+## Install
+
+```bash
+npm install @pofsis-nbt/pofsis-auth axios react react-dom
+```
+
+Import the package stylesheet once in the application entry point:
+
+```ts
+import '@pofsis-nbt/pofsis-auth/style.css'
+```
+
+## Quick start
+
+```tsx
+import { PofsisAuth, RequireAuth } from '@pofsis-nbt/pofsis-auth'
+import '@pofsis-nbt/pofsis-auth/style.css'
+
+export function App() {
+    return (
+        <PofsisAuth
+            appName="ORBIT"
+            apiBaseUrl="https://auth-api.example.com"
+            authUrl="https://auth.example.com/authorize"
+        >
+            <RequireAuth>
+                <Dashboard />
+            </RequireAuth>
+        </PofsisAuth>
+    )
+}
+```
+
+`appName`, `apiBaseUrl`, and `authUrl` are required. The library does not read environment variables. A Vite application may pass its own values:
+
+```tsx
+<PofsisAuth
+    appName={import.meta.env.VITE_POFSIS_APP_NAME}
+    apiBaseUrl={import.meta.env.VITE_POFSIS_API_BASE_URL}
+    authUrl={import.meta.env.VITE_POFSIS_AUTH_URL}
+    scope={import.meta.env.VITE_POFSIS_SCOPE}
+>
+    <App />
+</PofsisAuth>
+```
+
+The same props may come from server-injected runtime configuration or hardcoded deployment configuration. The default scope is `openid profile email`.
+
+## Session and login
+
+```tsx
+import { useAuth } from '@pofsis-nbt/pofsis-auth'
+
+function AccountMenu() {
+    const { user, login, logout } = useAuth()
+    if (!user) return <button onClick={() => void login()}>Sign in</button>
+    return <button onClick={() => void logout()}>Sign out {user.displayName}</button>
+}
+```
+
+Explicit user actions open hosted Auth in a popup:
+
+```tsx
+const { login } = useAuth()
+<button onClick={() => void login({ presentation: 'popup', returnUrl: location.pathname })}>
+    Sign in
+</button>
+```
+
+The provider handles `/login`, `/auth/callback`, and `/auth/error`. Login supports `screen`, `loginHint`, `method`, and a safe application-relative `returnUrl`. An OTP signup opens the signup page and continues to account verification after the identifier is submitted. See [Documentation.md](./Documentation.md) for the complete API.
+
+## Axios
+
+```ts
+import axios from 'axios'
+import { attachAuthInterceptor, useAuth } from '@pofsis-nbt/pofsis-auth'
+
+const api = axios.create({ baseURL: '/api' })
+
+function ApiAuthBridge() {
+    const { getAccessToken, refreshSession } = useAuth()
+    React.useEffect(
+        () => attachAuthInterceptor(api, getAccessToken, refreshSession),
+        [getAccessToken, refreshSession],
+    )
+    return null
+}
+```
+
+## CommonJS
+
+```js
+const { PofsisAuth, RequireAuth, useAuth } = require('@pofsis-nbt/pofsis-auth')
+require('@pofsis-nbt/pofsis-auth/style.css')
+```
+
+JavaScript consumers use the compiled JavaScript. TypeScript consumers use the same imports and automatically receive declarations.
+
+## Development
+
+Requires Node `^20.19.0` or `>=22.12.0`.
+
+```bash
+npm install
+npm run format:check
+npm run typecheck
+npm test
+npm run build
+npm run pack:check
+```
+
+Build output is written to `dist/` with ESM (`index.js`), CommonJS (`index.cjs`), source maps, declarations, and `style.css`.
+
+## Migration
+
+When migrating from `@pofsis/auth-react`:
+
+1. Change imports to `@pofsis-nbt/pofsis-auth`.
+2. Pass `appName`, `apiBaseUrl`, and `authUrl` to `PofsisAuth`.
+3. Import `@pofsis-nbt/pofsis-auth/style.css` once.
+
+Do not import `src/`, `dist/` internals, or internal auth helpers. Only the package-root exports and `style.css` are supported.

package/dist/PofsisAuth.d.ts

@@ -1,7 +1,3 @@
 import type { PofsisAuthProps } from './types';
-/**
- * Single integration surface for tool apps.
- * Handles session restore, PKCE login, and fixed paths `/login`, `/auth/callback`, `/auth/error`.
- */
-export declare function PofsisAuth({ children, appName, apiBaseUrl, authUrl, scope, postLoginPath, components, }: PofsisAuthProps): import("react").JSX.Element;
+export declare function PofsisAuth({ children, appName, apiBaseUrl, authUrl, scope, callbackPath, popup, postLoginPath, components, }: PofsisAuthProps): import("react").JSX.Element;
 //# sourceMappingURL=PofsisAuth.d.ts.map

package/dist/PofsisAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PofsisAuth.d.ts","sourceRoot":"","sources":["../src/PofsisAuth.tsx"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAIR,eAAe,EAElB,MAAM,SAAS,CAAA;AAmVhB;;;GAGG;AACH,wBAAgB,UAAU,CAAC,EACvB,QAAQ,EACR,OAAO,EACP,UAAU,EACV,OAAO,EACP,KAAK,EACL,aAAmB,EACnB,UAAU,GACb,EAAE,eAAe,+BA4BjB"}
+{"version":3,"file":"PofsisAuth.d.ts","sourceRoot":"","sources":["../src/PofsisAuth.tsx"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAGR,eAAe,EAGlB,MAAM,SAAS,CAAA;AAiMhB,wBAAgB,UAAU,CAAC,EACvB,QAAQ,EACR,OAAO,EACP,UAAU,EACV,OAAO,EACP,KAAK,EACL,YAAY,EACZ,KAAK,EACL,aAAmB,EACnB,UAAU,GACb,EAAE,eAAe,+BAiCjB"}

package/dist/PofsisAuthClient-CRYYsJYc.cjs

@@ -0,0 +1,2 @@
+async function e(e){if(e.status===204)return null;let t=await e.text();return t?JSON.parse(t):null}async function t(t,n,r){let i=await fetch(`${t.apiBaseUrl}${n}`,{credentials:`include`,...r,headers:{Accept:`application/json`,...r?.body&&!(r.body instanceof FormData)?{"Content-Type":`application/json`}:{},...r?.headers}});if(!i.ok){let e=Error(`Auth API ${n} failed (${i.status})`);throw e.status=i.status,e}return{status:i.status,data:await e(i)}}async function n(e){let{data:n}=await t(e,`/oauth/clients/${encodeURIComponent(e.appName.toUpperCase())}?origin=${encodeURIComponent(window.location.origin)}`);return n}async function r(e,n,r,i){let{data:a}=await t(e,`/oauth/token`,{method:`POST`,body:JSON.stringify({grant_type:`authorization_code`,client_id:i.client_id,redirect_uri:i.redirect_uri,code:n,code_verifier:r})});return a}async function i(e,n){let{data:r}=await t(e,`/oauth/token`,{method:`POST`,body:JSON.stringify({grant_type:`refresh_token`,client_id:n})});return r||null}async function a(e){try{return await t(e,`/auth/session`),!0}catch{return!1}}async function o(e){await t(e,`/auth/logout`,{method:`POST`})}async function s(e,n){let{data:r}=await t(e,`/auth/profile/me`,{headers:{Authorization:`Bearer ${n}`}});return r}async function c(e,n,r){let{data:i}=await t(e,`/auth/profile/me`,{method:`PATCH`,headers:{Authorization:`Bearer ${n}`},body:JSON.stringify(r)});return i}async function l(e,n,r,i){let a=new FormData;a.append(`file`,i);let{data:o}=await t(e,`/auth/profile/me/images/${r}`,{method:`POST`,headers:{Authorization:`Bearer ${n}`},body:a});return o}async function u(e,n,r){let{data:i}=await t(e,`/auth/profile/me/images/${r}`,{method:`DELETE`,headers:{Authorization:`Bearer ${n}`}});return i}function d(e){return e.replace(/\/$/,``)}function f(e={}){let t=e.appName?.trim(),n=e.apiBaseUrl?.trim(),r=e.authUrl?.trim(),i=e.scope?.trim()||`openid profile email`,a=e.callbackPath?.trim()||`/auth/callback`,o={width:e.popup?.width??480,height:e.popup?.height??720,name:e.popup?.name?.trim()||`pofsis-auth`,timeoutMs:e.popup?.timeoutMs??3e5},s=[];if(t||s.push(`appName`),n||s.push(`apiBaseUrl`),r||s.push(`authUrl`),s.length)throw Error(`@pofsis-nbt/pofsis-auth missing config: ${s.join(`, `)}`);if(!t||!n||!r)throw Error(`@pofsis-nbt/pofsis-auth missing config`);if(!a.startsWith(`/`)||a.startsWith(`//`))throw Error(`@pofsis-nbt/pofsis-auth callbackPath must be application-relative`);if(o.width<=0||o.height<=0||o.timeoutMs<=0)throw Error(`@pofsis-nbt/pofsis-auth popup dimensions and timeout must be positive`);return{appName:t,apiBaseUrl:d(n),authUrl:d(r),scope:i,callbackPath:a,popup:o}}var p=/^[^\s@]+@[^\s@]+\.[^\s@]+$/,m=/^(?:\+63|63|0)?9\d{9}$/,h=new Set([`password`,`passkey`,`otp`]),g=new Set([`login`,`signup`,`reset`]),_=320;function v(e,t=!1){let n=typeof e==`string`?e.trim():``;if(!n||n.length>_)return;if(p.test(n))return n.toLowerCase();let r=n.replace(/[\s()-]/g,``);if(!t&&m.test(r))return`+63${r.replace(/^(?:\+63|63|0)/,``)}`}function y(e,t=`login`){let n=typeof e==`string`?{returnUrl:e}:e||{},r=n.screen===`register`?`signup`:n.screen,i=g.has(r)?r:t,a=h.has(n.method)?n.method:void 0,o=i===`login`||i===`signup`&&(a===`password`||a===`otp`)?a:void 0;return{returnUrl:n.returnUrl,screen:i,loginHint:v(n.loginHint),method:o}}function b(e){let t=new URLSearchParams(e),n=t.get(`login_hint`),r=n===null?v(t.get(`email`),!0):v(n);return y({screen:t.get(`screen`)||void 0,loginHint:r,method:t.get(`method`)||void 0})}function x({authUrl:e,appName:t,query:n,options:r}){let i=y(r),a=new URL(e);if(a.search=n.toString(),i.loginHint&&a.searchParams.set(`login_hint`,i.loginHint),i.screen===`login`&&i.method&&a.searchParams.set(`method`,i.method),i.screen===`login`)return a.toString();let o=i.screen===`signup`?`/signup`:`/forgot-password`,s=new URL(o,a);return s.searchParams.set(`app`,t),s.searchParams.set(`return_to`,`${a.pathname}${a.search}`),i.loginHint&&s.searchParams.set(`login_hint`,i.loginHint),i.screen===`signup`&&s.searchParams.set(`method`,i.method||`password`),s.toString()}var S=`pofsis-auth:callback`;function C(e){if(!e)return;let t=e.indexOf(`.`);return t>0?e.slice(0,t):void 0}function w(e=window.location.origin){let t=window.opener&&!window.opener.closed?window.opener:window.parent===window?null:window.parent;if(!t)return!1;let n=new URLSearchParams(window.location.search),r=n.get(`state`)||void 0,i={type:S,code:n.get(`code`)||void 0,state:r,error:n.get(`error`)||void 0,correlationId:C(r||null)};return t.postMessage(i,e),t===window.opener&&window.close(),!0}var T=e=>btoa(String.fromCharCode(...e)).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/,``),E=()=>T(crypto.getRandomValues(new Uint8Array(32)));async function D(e){return T(new Uint8Array(await crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(e))))}var O=e=>e?.startsWith(`/`)&&!e.startsWith(`//`)?e:void 0,k=e=>({token_type:e.token_type,expires_in:e.expires_in,user:e.user}),A=class{config;token=null;session=null;client=null;clientPromise=null;refreshPromise=null;subscribers=new Set;attempt=null;iframeAttempt=null;listening=!1;constructor(e){this.config=f(e),this.attach()}attach(){this.listening||=(window.addEventListener(`message`,this.onPopupMessage),!0)}destroy(){window.removeEventListener(`message`,this.onPopupMessage),this.listening=!1;let e=this.finishAttempt();e&&(e.popup.close(),e.resolve({status:`cancelled`})),this.cancelIframeLogin(),this.subscribers.clear()}getUser(){return this.session?.user??null}getSession(){return this.session}getAccessToken(){return this.token}subscribe(e){return this.attach(),this.subscribers.add(e),e(this.session),()=>{this.subscribers.delete(e)}}emit(){for(let e of this.subscribers)e(this.session)}accept(e){this.token=e.access_token,this.session=k(e),this.emit()}loadClient(){return this.clientPromise||=n(this.config).then(e=>this.client=e).catch(e=>{throw this.clientPromise=null,e}),this.clientPromise}getOAuthClient(){return this.loadClient()}async refreshSession(){let e=await this.loadClient();return this.refreshPromise||=i(this.config,e.client_id).then(e=>{e?this.accept(e):this.clearSession()}).finally(()=>this.refreshPromise=null),this.refreshPromise}async isRemoteSessionActive(){return a(this.config)}clearSession(){this.token=null,this.session=null,this.emit()}replaceUser(e){this.session&&(this.session={...this.session,user:e},this.emit())}async logout(){try{await o(this.config)}finally{this.clearSession()}}signup(e={}){return this.login({...e,screen:`signup`})}resetPassword(e={}){return this.login({...e,screen:`reset`})}async login(e={}){let t=y(e),n=e.presentation??`popup`;return n===`popup`?this.openPopup({...e,...t}):n===`iframe`?this.openIframe({...e,...t}):this.startRedirect({...e,...t})}cancelIframeLogin(){this.finishIframeAttempt()?.resolve({status:`cancelled`})}openIframe(e){let t=e.target;if(!t)return Promise.reject(Error(`POFSIS Auth iframe target is required.`));this.cancelIframeLogin();let n=E(),r=`${n}.${E()}`,i=E(),a=O(e.returnUrl);return new Promise((o,s)=>{let c=setTimeout(()=>{this.finishIframeAttempt()?.reject(Error(`POFSIS Auth iframe timed out.`))},this.config.popup.timeoutMs);this.iframeAttempt={frame:t,state:r,verifier:i,correlationId:n,returnUrl:a,resolve:o,reject:s,timeout:c},this.authorizationUrl(e,r,i).then(e=>t.contentWindow?.location.replace(e)).catch(e=>{this.finishIframeAttempt()?.reject(e instanceof Error?e:Error(String(e)))})})}async authorizationUrl(e,t,n){let r=await this.loadClient(),i=new URLSearchParams({app:this.config.appName.toUpperCase(),client_id:r.client_id,redirect_uri:r.redirect_uri,response_type:`code`,scope:this.config.scope,state:t,code_challenge:await D(n),code_challenge_method:`S256`});return x({authUrl:this.config.authUrl,appName:this.config.appName.toUpperCase(),query:i,options:e})}storageKey(e){return`${this.config.appName.toLowerCase()}.auth.${e}`}async startRedirect(e){let t=E(),n=E();sessionStorage.setItem(this.storageKey(`state`),t),sessionStorage.setItem(this.storageKey(`verifier`),n);let r=O(e.returnUrl);return r?sessionStorage.setItem(this.storageKey(`return-path`),r):sessionStorage.removeItem(this.storageKey(`return-path`)),window.location.assign(await this.authorizationUrl(e,t,n)),{status:`redirecting`}}async openPopup(e){if(this.attempt&&!this.attempt.popup.closed)return this.attempt.popup.focus(),new Promise((e,t)=>{let n=this.attempt,r=n.resolve,i=n.reject;n.resolve=t=>{r(t),e(t)},n.reject=e=>{i(e),t(e)}});let{width:t,height:n,name:r,timeoutMs:i}=this.config.popup,a=Math.max(0,window.screenX+(window.outerWidth-t)/2),o=Math.max(0,window.screenY+(window.outerHeight-n)/2),s=window.open(`about:blank`,r,`popup=yes,width=${t},height=${n},left=${Math.round(a)},top=${Math.round(o)}`);if(!s)return this.startRedirect({...e,presentation:`redirect`});let c=E(),l=`${c}.${E()}`,u=E(),d=O(e.returnUrl);return new Promise((t,n)=>{let r=setInterval(()=>{s.closed&&this.finishAttempt()?.resolve({status:`cancelled`})},250),a=setTimeout(()=>{let e=this.finishAttempt();s.close(),e?.reject(Error(`POFSIS Auth popup timed out.`))},i);this.attempt={popup:s,state:l,verifier:u,correlationId:c,returnUrl:d,resolve:t,reject:n,timer:r,timeout:a},this.authorizationUrl(e,l,u).then(e=>s.location.replace(e)).catch(e=>{let t=this.finishAttempt();s.close(),t?.reject(e instanceof Error?e:Error(String(e)))})})}finishAttempt(){let e=this.attempt;return e?(clearInterval(e.timer),clearTimeout(e.timeout),this.attempt=null,e):null}finishIframeAttempt(){let e=this.iframeAttempt;return e?(clearTimeout(e.timeout),this.iframeAttempt=null,e):null}onPopupMessage=e=>{let t=this.iframeAttempt;if(t&&e.origin===window.location.origin&&e.source===t.frame.contentWindow&&e.data?.type===`pofsis-auth:callback`&&e.data.correlationId===t.correlationId&&C(e.data.state||null)===t.correlationId&&e.data.state===t.state){let t=this.finishIframeAttempt();if(e.data.error||!e.data.code){t.reject(Error(e.data.error||`POFSIS Auth callback was incomplete.`));return}this.completeCode(e.data.code,e.data.state,t.verifier).then(()=>t.resolve({status:`authenticated`,user:this.getUser()})).catch(e=>t.reject(e instanceof Error?e:Error(String(e))));return}let n=this.attempt,r=e.data;if(!n||e.origin!==window.location.origin||e.source!==n.popup||r?.type!==`pofsis-auth:callback`||r.correlationId!==n.correlationId||C(r.state||null)!==n.correlationId||r.state!==n.state)return;let i=this.finishAttempt();if(i){if(r.error||!r.code){i.popup.close(),i.reject(Error(r.error||`POFSIS Auth callback was incomplete.`));return}this.completeCode(r.code,r.state,i.verifier).then(()=>{i.popup.close(),i.returnUrl&&window.history.replaceState(null,``,i.returnUrl),i.resolve({status:`authenticated`,user:this.getUser()})}).catch(e=>{i.popup.close(),i.reject(e instanceof Error?e:Error(String(e)))})}};async completeCode(e,t,n){if(!t||!n)throw Error(`Authentication state could not be verified.`);let i=await this.loadClient();this.accept(await r(this.config,e,n,i))}async completeRedirectCallback(e,t){let n=sessionStorage.getItem(this.storageKey(`state`)),r=sessionStorage.getItem(this.storageKey(`verifier`));if(sessionStorage.removeItem(this.storageKey(`state`)),sessionStorage.removeItem(this.storageKey(`verifier`)),!n||!r||t!==n)throw Error(`Authentication state could not be verified.`);await this.completeCode(e,t,r)}};function j(e){return new A(e)}Object.defineProperty(exports,"a",{enumerable:!0,get:function(){return f}}),Object.defineProperty(exports,"c",{enumerable:!0,get:function(){return c}}),Object.defineProperty(exports,"i",{enumerable:!0,get:function(){return b}}),Object.defineProperty(exports,"l",{enumerable:!0,get:function(){return l}}),Object.defineProperty(exports,"n",{enumerable:!0,get:function(){return j}}),Object.defineProperty(exports,"o",{enumerable:!0,get:function(){return u}}),Object.defineProperty(exports,"r",{enumerable:!0,get:function(){return w}}),Object.defineProperty(exports,"s",{enumerable:!0,get:function(){return s}}),Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return A}});
+//# sourceMappingURL=PofsisAuthClient-CRYYsJYc.cjs.map