@pofsis-nbt/pofsis-auth 2.0.1 → 2.1.0

package/docs/popup-integration.md

@@ -1,162 +1,188 @@
-# POFSIS Auth popup integration
-
-`@pofsis-nbt/pofsis-auth` opens the hosted POFSIS Auth UI in a popup and completes OAuth 2.0 Authorization Code with PKCE in the calling tool. Passwords, OTPs, passkeys, refresh tokens, and Cognito credentials remain owned by POFSIS Auth.
-
-## Prerequisites
-
-- Register the tool's exact origin, callback URI, and logout URI with POFSIS Auth for each environment.
-- Use HTTPS outside local development and allow the tool origin in Auth CORS configuration.
-- Obtain the immutable registered application UUID and allowed public scopes.
-- Never put an OAuth client secret or organization service credential in a browser application.
-
-## Package entry points
-
-```bash
-npm install @pofsis-nbt/pofsis-auth
-```
-
-| Import                             | Use                                             |
-| ---------------------------------- | ----------------------------------------------- |
-| `@pofsis-nbt/pofsis-auth/core`     | Framework-neutral browser SDK                   |
-| `@pofsis-nbt/pofsis-auth/react`    | React provider, hooks, guards, and API helper   |
-| `@pofsis-nbt/pofsis-auth/elements` | Optional `<pofsis-sign-in>` Web Component       |
-| `@pofsis-nbt/pofsis-auth`          | Backward-compatible React API plus core exports |
-
-## Framework-neutral setup
-
-```js
-import { createPofsisAuth, relayPopupCallback } from '@pofsis-nbt/pofsis-auth/core'
-
-const auth = createPofsisAuth({
-    applicationId: '11111111-1111-4111-8111-111111111111',
-    apiBaseUrl: 'https://auth-api.example.com',
-    authUrl: 'https://auth.example.com/authorize',
-})
-
-// Run this before rendering the normal app on /auth/callback.
-if (location.pathname === '/auth/callback') {
-    const relayed = relayPopupCallback()
-    if (!relayed) {
-        const params = new URLSearchParams(location.search)
-        await auth.completeRedirectCallback(params.get('code'), params.get('state'))
-    }
-}
-```
-
-Call popup authentication directly from a click or other user gesture:
-
-```js
-document.querySelector('#login').addEventListener('click', async () => {
-    const result = await auth.login({
-        presentation: 'popup',
-        screen: 'login',
-        returnUrl: location.pathname + location.search,
-    })
-    if (result.status === 'authenticated') renderUser(result.user)
-})
-```
-
-The SDK calls `window.open()` itself. A blocked popup falls back to a full-page redirect. Route guards should explicitly use `presentation: 'redirect'` because they may not run during a user gesture.
-
-## Initialization parameters
-
-| Parameter         | Required | Default                | Meaning                            |
-| ----------------- | -------: | ---------------------- | ---------------------------------- |
-| `applicationId`         |      yes | -                      | Immutable `applications.id` UUID |
-| `apiBaseUrl`      |      yes | -                      | Public POFSIS Auth API base URL    |
-| `authUrl`         |      yes | -                      | Hosted Auth `/authorize` URL       |
-| `scope`           |       no | `openid profile email` | Registered OAuth scopes            |
-| `callbackPath`    |       no | `/auth/callback`       | Local tool callback route          |
-| `popup.width`     |       no | `480`                  | Popup width in pixels              |
-| `popup.height`    |       no | `720`                  | Popup height in pixels             |
-| `popup.name`      |       no | `pofsis-auth`          | Reused browser window name         |
-| `popup.timeoutMs` |       no | `300000`               | Authentication timeout             |
-
-## Launch parameters
-
-| Parameter      | Required | Default      | Meaning                                              |
-| -------------- | -------: | ------------ | ---------------------------------------------------- |
-| `presentation` |       no | `popup`      | `popup` or full-page `redirect`                      |
-| `screen`       |       no | `login`      | `login`, `signup`, or `reset`                        |
-| `method`       |       no | Auth default | `password`, `passkey`, or `otp`                      |
-| `loginHint`    |       no | -            | Editable email or Philippine mobile hint             |
-| `returnUrl`    |       no | -            | Safe application-relative route restored after login |
-
-`returnUrl` must start with one `/` and must not start with `//`. Do not put invitation secrets or external URLs in it.
-
-Convenience methods use the same protocol:
-
-```js
-await auth.signup({ loginHint: 'employee@example.com', method: 'otp' })
-await auth.resetPassword({ loginHint: 'employee@example.com' })
-await auth.login({ method: 'password' })
-await auth.login({ method: 'passkey' })
-```
-
-## React
-
-```tsx
-import { PofsisAuth, useAuth } from '@pofsis-nbt/pofsis-auth/react'
-import '@pofsis-nbt/pofsis-auth/style.css'
-
-function SignInButton() {
-    const { login } = useAuth()
-    return <button onClick={() => void login({ presentation: 'popup' })}>Sign in</button>
-}
-
-export function App() {
-    return (
-        <PofsisAuth
-            applicationId="11111111-1111-4111-8111-111111111111"
-            apiBaseUrl="https://auth-api.example.com"
-            authUrl="https://auth.example.com/authorize"
-        >
-            <SignInButton />
-        </PofsisAuth>
-    )
-}
-```
-
-`RequireAuth` deliberately uses redirect presentation. The provider handles popup and full-page callbacks at `callbackPath`.
-
-## Web Component
-
-Import the package entry or host the generated standalone `dist/pofsis-auth-elements.js` bundle:
-
-```html
-<script type="module" src="https://auth.pofsis.com/sdk/pofsis-auth-elements.js"></script>
-
-<pofsis-sign-in
-    application-id="11111111-1111-4111-8111-111111111111"
-    api-base-url="https://auth-api.example.com"
-    auth-url="https://auth.example.com/authorize"
-    return-url="/dashboard"
-    >Sign in</pofsis-sign-in
->
-```
-
-The element dispatches `pofsis-auth-authenticated`, `pofsis-auth-cancelled`, `pofsis-auth-redirecting`, and `pofsis-auth-error`. It is only a launch control; credential fields always render on the hosted Auth origin.
-
-## Session and API calls
-
-```js
-const unsubscribe = auth.subscribe((session) => updateHeader(session?.user))
-const token = auth.getAccessToken()
-await auth.refreshSession()
-await auth.logout()
-unsubscribe()
-```
-
-Access tokens are held in memory. Use `getAccessToken()` to add a bearer token to the tool's own API calls. Do not write access tokens to URLs or browser storage.
-
-## Results and failures
-
-- `authenticated`: code exchange succeeded and includes the user.
-- `cancelled`: the user closed the popup; this is not an authentication error.
-- `redirecting`: the SDK started full-page navigation, including popup-blocked fallback.
-- Invalid state, origin, popup source, or correlation messages are ignored or rejected.
-- A timeout rejects the launch and closes the popup.
-
-For callback URI mismatches, verify the exact deployed origin and registered URI. For CORS or silent-session failures, verify Auth's origin registry and credentialed cookie configuration. A cancelled or unavailable passkey remains an Auth-screen concern and must retain the password fallback.
-
-The frontend SDK must never call `/api/internal`, Cognito administration APIs, or organization provisioning APIs. Those flows remain tool-backend to Auth-backend operations.
+# POFSIS Auth popup and modal integration
+
+`@pofsis-nbt/pofsis-auth` opens the hosted POFSIS Auth UI in a popup, an SDK-owned iframe modal, or a full-page redirect and completes OAuth 2.0 Authorization Code with PKCE in the calling tool. Passwords, OTPs, passkeys, refresh tokens, and Cognito credentials remain owned by POFSIS Auth.
+
+## Prerequisites
+
+- Register the tool's exact origin, callback URI, and logout URI with POFSIS Auth for each environment.
+- Use HTTPS outside local development and allow the tool origin in Auth CORS configuration.
+- Obtain the immutable registered application UUID and allowed public scopes.
+- Never put an OAuth client secret or organization service credential in a browser application.
+
+## Package entry points
+
+```bash
+npm install @pofsis-nbt/pofsis-auth
+```
+
+| Import                             | Use                                             |
+| ---------------------------------- | ----------------------------------------------- |
+| `@pofsis-nbt/pofsis-auth/core`     | Framework-neutral browser SDK                   |
+| `@pofsis-nbt/pofsis-auth/react`    | React provider, hooks, guards, and API helper   |
+| `@pofsis-nbt/pofsis-auth/elements` | Optional `<pofsis-sign-in>` Web Component       |
+| `@pofsis-nbt/pofsis-auth`          | Backward-compatible React API plus core exports |
+
+## Framework-neutral setup
+
+```js
+import { createPofsisAuth, relayAuthCallback } from '@pofsis-nbt/pofsis-auth/core'
+
+const auth = createPofsisAuth({
+    applicationId: '11111111-1111-4111-8111-111111111111',
+    apiBaseUrl: 'https://auth-api.example.com',
+    authUrl: 'https://auth.example.com/authorize',
+})
+
+// Run this before rendering the normal app on /auth/callback.
+if (location.pathname === '/auth/callback') {
+    const relayed = relayAuthCallback()
+    if (!relayed) {
+        const params = new URLSearchParams(location.search)
+        await auth.completeRedirectCallback(params.get('code'), params.get('state'))
+    }
+}
+```
+
+Call popup authentication directly from a click or other user gesture:
+
+```js
+document.querySelector('#login').addEventListener('click', async () => {
+    const result = await auth.login({
+        presentation: 'popup',
+        screen: 'login',
+        returnUrl: location.pathname + location.search,
+    })
+    if (result.status === 'authenticated') renderUser(result.user)
+})
+```
+
+The SDK calls `window.open()` itself. A blocked popup falls back to a full-page redirect. Route guards should explicitly use `presentation: 'redirect'` because they may not run during a user gesture.
+
+To keep Auth visually inside the tool, request the modal presentation:
+
+```js
+const result = await auth.login({
+    presentation: 'modal',
+    screen: 'login',
+    returnUrl: location.pathname + location.search,
+})
+```
+
+The SDK creates an accessible modal and embeds the hosted Auth origin in an iframe. The tool cannot inspect credential fields. Close, Escape, and backdrop dismissal resolve with `status: 'cancelled'`. A modal does not silently fall back to popup or redirect if embedding fails.
+
+## Initialization parameters
+
+| Parameter              | Required | Default                | Meaning                          |
+| ---------------------- | -------: | ---------------------- | -------------------------------- |
+| `applicationId`        |      yes | -                      | Immutable `applications.id` UUID |
+| `apiBaseUrl`           |      yes | -                      | Public POFSIS Auth API base URL  |
+| `authUrl`              |      yes | -                      | Hosted Auth `/authorize` URL     |
+| `scope`                |       no | `openid profile email` | Registered OAuth scopes          |
+| `callbackPath`         |       no | `/auth/callback`       | Local tool callback route        |
+| `popup.width`          |       no | `480`                  | Popup width in pixels            |
+| `popup.height`         |       no | `720`                  | Popup height in pixels           |
+| `popup.name`           |       no | `pofsis-auth`          | Reused browser window name       |
+| `popup.timeoutMs`      |       no | `300000`               | Authentication timeout           |
+| `modal.width`          |       no | `480`                  | Modal width in pixels            |
+| `modal.height`         |       no | `720`                  | Modal height in pixels           |
+| `modal.timeoutMs`      |       no | `300000`               | Authentication timeout           |
+| `modal.readyTimeoutMs` |       no | `15000`                | Secure iframe handshake timeout  |
+
+## Launch parameters
+
+| Parameter      | Required | Default      | Meaning                                              |
+| -------------- | -------: | ------------ | ---------------------------------------------------- |
+| `presentation` |       no | `popup`      | `popup`, iframe `modal`, or full-page `redirect`     |
+| `screen`       |       no | `login`      | `login`, `signup`, or `reset`                        |
+| `method`       |       no | Auth default | `password`, `passkey`, or `otp`                      |
+| `loginHint`    |       no | -            | Editable email or Philippine mobile hint             |
+| `returnUrl`    |       no | -            | Safe application-relative route restored after login |
+
+`returnUrl` must start with one `/` and must not start with `//`. Do not put invitation secrets or external URLs in it.
+
+Convenience methods use the same protocol:
+
+```js
+await auth.signup({ loginHint: 'employee@example.com', method: 'otp' })
+await auth.resetPassword({ loginHint: 'employee@example.com' })
+await auth.login({ method: 'password' })
+await auth.login({ method: 'passkey' })
+```
+
+## React
+
+```tsx
+import { PofsisAuth, useAuth } from '@pofsis-nbt/pofsis-auth/react'
+import '@pofsis-nbt/pofsis-auth/style.css'
+
+function SignInButton() {
+    const { login } = useAuth()
+    return <button onClick={() => void login({ presentation: 'modal' })}>Sign in</button>
+}
+
+export function App() {
+    return (
+        <PofsisAuth
+            applicationId="11111111-1111-4111-8111-111111111111"
+            apiBaseUrl="https://auth-api.example.com"
+            authUrl="https://auth.example.com/authorize"
+            modal={{ width: 480, height: 720 }}
+        >
+            <SignInButton />
+        </PofsisAuth>
+    )
+}
+```
+
+`RequireAuth` deliberately uses redirect presentation. The provider handles popup, modal, and full-page callbacks at `callbackPath`.
+
+## Web Component
+
+Import the package entry or host the generated standalone `dist/pofsis-auth-elements.js` bundle:
+
+```html
+<script type="module" src="https://auth.pofsis.com/sdk/pofsis-auth-elements.js"></script>
+
+<pofsis-sign-in
+    application-id="11111111-1111-4111-8111-111111111111"
+    api-base-url="https://auth-api.example.com"
+    auth-url="https://auth.example.com/authorize"
+    return-url="/dashboard"
+    presentation="modal"
+    >Sign in</pofsis-sign-in
+>
+```
+
+The element dispatches `pofsis-auth-authenticated`, `pofsis-auth-cancelled`, `pofsis-auth-redirecting`, and `pofsis-auth-error`. It is only a launch control; credential fields always render on the hosted Auth origin.
+
+## Iframe security and hosting
+
+- The Auth frontend verifies a parent-frame handshake against the registered OAuth client before rendering credentials.
+- The callback accepts messages only from the exact iframe window, expected origin, state, and correlation ID.
+- The iframe is sandboxed and receives only the capabilities needed for forms, scripts, external legal links, and WebAuthn.
+- Auth HTML must not send `X-Frame-Options: DENY` or `SAMEORIGIN`. A CSP `frame-ancestors` directive must include every registered tool origin.
+- Third-party-cookie or WebAuthn restrictions vary by browser. Keep popup or redirect available as an explicit consumer fallback when required by browser policy.
+
+## Session and API calls
+
+```js
+const unsubscribe = auth.subscribe((session) => updateHeader(session?.user))
+const token = auth.getAccessToken()
+await auth.refreshSession()
+await auth.logout()
+unsubscribe()
+```
+
+Access tokens are held in memory. Use `getAccessToken()` to add a bearer token to the tool's own API calls. Do not write access tokens to URLs or browser storage.
+
+## Results and failures
+
+- `authenticated`: code exchange succeeded and includes the user.
+- `cancelled`: the user dismissed the popup or modal; this is not an authentication error.
+- `redirecting`: the SDK started full-page navigation, including popup-blocked fallback.
+- Invalid state, origin, popup or iframe source, or correlation messages are ignored or rejected.
+- A timeout rejects the launch and closes the popup or modal. Failure to validate the iframe parent rejects with an embedding error.
+
+For callback URI mismatches, verify the exact deployed origin and registered URI. For CORS or silent-session failures, verify Auth's origin registry and credentialed cookie configuration. A cancelled or unavailable passkey remains an Auth-screen concern and must retain the password fallback.
+
+The frontend SDK must never call `/api/internal`, Cognito administration APIs, or organization provisioning APIs. Those flows remain tool-backend to Auth-backend operations.

package/package.json

@@ -1,87 +1,87 @@
-{
-    "name": "@pofsis-nbt/pofsis-auth",
-    "version": "2.0.1",
-    "description": "POFSIS OAuth/PKCE authentication SDK for browser applications.",
-    "type": "module",
-    "main": "./dist/index.cjs",
-    "module": "./dist/index.js",
-    "types": "./dist/index.d.ts",
-    "exports": {
-        ".": {
-            "types": "./dist/index.d.ts",
-            "import": "./dist/index.js",
-            "require": "./dist/index.cjs",
-            "default": "./dist/index.js"
-        },
-        "./core": {
-            "types": "./dist/core/index.d.ts",
-            "import": "./dist/core.js",
-            "require": "./dist/core.cjs",
-            "default": "./dist/core.js"
-        },
-        "./react": {
-            "types": "./dist/react/index.d.ts",
-            "import": "./dist/react.js",
-            "require": "./dist/react.cjs",
-            "default": "./dist/react.js"
-        },
-        "./elements": {
-            "types": "./dist/elements/index.d.ts",
-            "import": "./dist/elements.js",
-            "require": "./dist/elements.cjs",
-            "default": "./dist/elements.js"
-        },
-        "./style.css": "./dist/style.css"
-    },
-    "files": [
-        "dist",
-        "README.md",
-        "Documentation.md",
-        "docs"
-    ],
-    "sideEffects": [
-        "**/*.css"
-    ],
-    "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-    },
-    "scripts": {
-        "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
-        "typecheck": "tsc --noEmit -p tsconfig.json",
-        "test": "tsx --test src/**/*.test.ts",
-        "check": "npm run typecheck && npm test",
-        "build": "npm run clean && vite build && vite build --config vite.elements.config.ts && tsc -p tsconfig.build.json",
-        "prepack": "npm run check && npm run build",
-        "pack:check": "npm pack --dry-run --json",
-        "format": "prettier --write .",
-        "format:check": "prettier --check ."
-    },
-    "peerDependencies": {
-        "axios": ">=1",
-        "react": ">=18",
-        "react-dom": ">=18"
-    },
-    "peerDependenciesMeta": {
-        "axios": {
-            "optional": true
-        },
-        "react": {
-            "optional": true
-        },
-        "react-dom": {
-            "optional": true
-        }
-    },
-    "devDependencies": {
-        "@types/node": "^26.0.0",
-        "@types/react": "^19.2.0",
-        "@types/react-dom": "^19.2.0",
-        "axios": "^1.19.0",
-        "prettier": "^3.6.0",
-        "react": "^19.2.0",
-        "react-dom": "^19.2.0",
-        "tsx": "^4.20.0",
-        "typescript": "^5.9.0",
-        "vite": "^8.2.0"
-    }
-}
+{
+    "name": "@pofsis-nbt/pofsis-auth",
+    "version": "2.1.0",
+    "description": "POFSIS OAuth/PKCE authentication SDK for browser applications.",
+    "type": "module",
+    "main": "./dist/index.cjs",
+    "module": "./dist/index.js",
+    "types": "./dist/index.d.ts",
+    "exports": {
+        ".": {
+            "types": "./dist/index.d.ts",
+            "import": "./dist/index.js",
+            "require": "./dist/index.cjs",
+            "default": "./dist/index.js"
+        },
+        "./core": {
+            "types": "./dist/core/index.d.ts",
+            "import": "./dist/core.js",
+            "require": "./dist/core.cjs",
+            "default": "./dist/core.js"
+        },
+        "./react": {
+            "types": "./dist/react/index.d.ts",
+            "import": "./dist/react.js",
+            "require": "./dist/react.cjs",
+            "default": "./dist/react.js"
+        },
+        "./elements": {
+            "types": "./dist/elements/index.d.ts",
+            "import": "./dist/elements.js",
+            "require": "./dist/elements.cjs",
+            "default": "./dist/elements.js"
+        },
+        "./style.css": "./dist/style.css"
+    },
+    "files": [
+        "dist",
+        "README.md",
+        "Documentation.md",
+        "docs"
+    ],
+    "sideEffects": [
+        "**/*.css"
+    ],
+    "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+    },
+    "scripts": {
+        "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
+        "typecheck": "tsc --noEmit -p tsconfig.json",
+        "test": "tsx --test src/**/*.test.ts",
+        "check": "npm run typecheck && npm test",
+        "build": "npm run clean && vite build && vite build --config vite.elements.config.ts && tsc -p tsconfig.build.json",
+        "prepack": "npm run check && npm run build",
+        "pack:check": "npm pack --dry-run --json",
+        "format": "prettier --write .",
+        "format:check": "prettier --check ."
+    },
+    "peerDependencies": {
+        "axios": ">=1",
+        "react": ">=18",
+        "react-dom": ">=18"
+    },
+    "peerDependenciesMeta": {
+        "axios": {
+            "optional": true
+        },
+        "react": {
+            "optional": true
+        },
+        "react-dom": {
+            "optional": true
+        }
+    },
+    "devDependencies": {
+        "@types/node": "^26.0.0",
+        "@types/react": "^19.2.0",
+        "@types/react-dom": "^19.2.0",
+        "axios": "^1.19.0",
+        "prettier": "^3.6.0",
+        "react": "^19.2.0",
+        "react-dom": "^19.2.0",
+        "tsx": "^4.20.0",
+        "typescript": "^5.9.0",
+        "vite": "^8.2.0"
+    }
+}

package/dist/PofsisAuthClient-B3YHqgZL.cjs

@@ -1,2 +0,0 @@
-async function e(e){if(e.status===204)return null;let t=await e.text();return t?JSON.parse(t):null}async function t(t,n,r){let i=await fetch(`${t.apiBaseUrl}${n}`,{credentials:`include`,...r,headers:{Accept:`application/json`,...r?.body&&!(r.body instanceof FormData)?{"Content-Type":`application/json`}:{},...r?.headers}});if(!i.ok){let e=Error(`Auth API ${n} failed (${i.status})`);throw e.status=i.status,e}return{status:i.status,data:await e(i)}}async function n(e){let{data:n}=await t(e,`/oauth/applications/${encodeURIComponent(e.applicationId)}/client?origin=${encodeURIComponent(window.location.origin)}`);return n}async function r(e,n,r,i){let{data:a}=await t(e,`/oauth/token`,{method:`POST`,body:JSON.stringify({grant_type:`authorization_code`,client_id:i.client_id,redirect_uri:i.redirect_uri,code:n,code_verifier:r})});return a}async function i(e,n){let{data:r}=await t(e,`/oauth/token`,{method:`POST`,body:JSON.stringify({grant_type:`refresh_token`,client_id:n})});return r||null}async function a(e){try{return await t(e,`/auth/session`),!0}catch{return!1}}async function o(e){await t(e,`/auth/logout`,{method:`POST`})}async function s(e,n){let{data:r}=await t(e,`/auth/profile/me`,{headers:{Authorization:`Bearer ${n}`}});return r}async function c(e,n,r){let{data:i}=await t(e,`/auth/profile/me`,{method:`PATCH`,headers:{Authorization:`Bearer ${n}`},body:JSON.stringify(r)});return i}async function l(e,n,r,i){let a=new FormData;a.append(`file`,i);let{data:o}=await t(e,`/auth/profile/me/images/${r}`,{method:`POST`,headers:{Authorization:`Bearer ${n}`},body:a});return o}async function u(e,n,r){let{data:i}=await t(e,`/auth/profile/me/images/${r}`,{method:`DELETE`,headers:{Authorization:`Bearer ${n}`}});return i}function d(e){return e.replace(/\/$/,``)}function f(e={}){let t=e.applicationId?.trim(),n=e.apiBaseUrl?.trim(),r=e.authUrl?.trim(),i=e.scope?.trim()||`openid profile email`,a=e.callbackPath?.trim()||`/auth/callback`,o={width:e.popup?.width??480,height:e.popup?.height??720,name:e.popup?.name?.trim()||`pofsis-auth`,timeoutMs:e.popup?.timeoutMs??3e5},s=[];if(t||s.push(`applicationId`),n||s.push(`apiBaseUrl`),r||s.push(`authUrl`),s.length)throw Error(`@pofsis-nbt/pofsis-auth missing config: ${s.join(`, `)}`);if(!t||!n||!r)throw Error(`@pofsis-nbt/pofsis-auth missing config`);if(!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(t))throw Error(`@pofsis-nbt/pofsis-auth applicationId must be a UUID`);if(!a.startsWith(`/`)||a.startsWith(`//`))throw Error(`@pofsis-nbt/pofsis-auth callbackPath must be application-relative`);if(o.width<=0||o.height<=0||o.timeoutMs<=0)throw Error(`@pofsis-nbt/pofsis-auth popup dimensions and timeout must be positive`);return{applicationId:t.toLowerCase(),apiBaseUrl:d(n),authUrl:d(r),scope:i,callbackPath:a,popup:o}}var p=/^[^\s@]+@[^\s@]+\.[^\s@]+$/,m=/^(?:\+63|63|0)?9\d{9}$/,h=new Set([`password`,`passkey`,`otp`]),g=new Set([`login`,`signup`,`reset`]),_=320;function v(e,t=!1){let n=typeof e==`string`?e.trim():``;if(!n||n.length>_)return;if(p.test(n))return n.toLowerCase();let r=n.replace(/[\s()-]/g,``);if(!t&&m.test(r))return`+63${r.replace(/^(?:\+63|63|0)/,``)}`}function y(e,t=`login`){let n=typeof e==`string`?{returnUrl:e}:e||{},r=n.screen===`register`?`signup`:n.screen,i=g.has(r)?r:t,a=h.has(n.method)?n.method:void 0,o=i===`login`||i===`signup`&&(a===`password`||a===`otp`)?a:void 0;return{returnUrl:n.returnUrl,screen:i,loginHint:v(n.loginHint),method:o}}function b(e){let t=new URLSearchParams(e),n=t.get(`login_hint`),r=n===null?v(t.get(`email`),!0):v(n);return y({screen:t.get(`screen`)||void 0,loginHint:r,method:t.get(`method`)||void 0})}function x({authUrl:e,query:t,options:n}){let r=y(n),i=new URL(e);if(i.search=t.toString(),r.loginHint&&i.searchParams.set(`login_hint`,r.loginHint),r.screen===`login`&&r.method&&i.searchParams.set(`method`,r.method),r.screen===`login`)return i.toString();let a=r.screen===`signup`?`/signup`:`/forgot-password`,o=new URL(a,i),s=t.get(`client_id`);return s&&o.searchParams.set(`client_id`,s),o.searchParams.set(`return_to`,`${i.pathname}${i.search}`),r.loginHint&&o.searchParams.set(`login_hint`,r.loginHint),r.screen===`signup`&&o.searchParams.set(`method`,r.method||`password`),o.toString()}var S=`pofsis-auth:callback`;function C(e){if(!e)return;let t=e.indexOf(`.`);return t>0?e.slice(0,t):void 0}function w(e=window.location.origin){if(!window.opener||window.opener.closed)return!1;let t=new URLSearchParams(window.location.search),n=t.get(`state`)||void 0,r={type:S,code:t.get(`code`)||void 0,state:n,error:t.get(`error`)||void 0,correlationId:C(n||null)};return window.opener.postMessage(r,e),window.close(),!0}var T=e=>btoa(String.fromCharCode(...e)).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=+$/,``),E=()=>T(crypto.getRandomValues(new Uint8Array(32)));async function D(e){return T(new Uint8Array(await crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(e))))}var O=e=>e?.startsWith(`/`)&&!e.startsWith(`//`)?e:void 0,k=e=>({token_type:e.token_type,expires_in:e.expires_in,user:e.user}),A=class{config;token=null;session=null;client=null;clientPromise=null;refreshPromise=null;subscribers=new Set;attempt=null;listening=!1;constructor(e){this.config=f(e),this.attach()}attach(){this.listening||=(window.addEventListener(`message`,this.onPopupMessage),!0)}destroy(){window.removeEventListener(`message`,this.onPopupMessage),this.listening=!1;let e=this.finishAttempt();e&&(e.popup.close(),e.resolve({status:`cancelled`})),this.subscribers.clear()}getUser(){return this.session?.user??null}getSession(){return this.session}getAccessToken(){return this.token}subscribe(e){return this.attach(),this.subscribers.add(e),e(this.session),()=>{this.subscribers.delete(e)}}emit(){for(let e of this.subscribers)e(this.session)}accept(e){this.token=e.access_token,this.session=k(e),this.emit()}loadClient(){return this.clientPromise||=n(this.config).then(e=>this.client=e).catch(e=>{throw this.clientPromise=null,e}),this.clientPromise}getOAuthClient(){return this.loadClient()}async refreshSession(){let e=await this.loadClient();return this.refreshPromise||=i(this.config,e.client_id).then(e=>{e?this.accept(e):this.clearSession()}).finally(()=>this.refreshPromise=null),this.refreshPromise}async isRemoteSessionActive(){return a(this.config)}clearSession(){this.token=null,this.session=null,this.emit()}replaceUser(e){this.session&&(this.session={...this.session,user:e},this.emit())}async logout(){try{await o(this.config)}finally{this.clearSession()}}signup(e={}){return this.login({...e,screen:`signup`})}resetPassword(e={}){return this.login({...e,screen:`reset`})}async login(e={}){let t=y(e);return(e.presentation??`popup`)===`popup`?this.openPopup({...e,...t}):this.startRedirect({...e,...t})}async authorizationUrl(e,t,n){let r=await this.loadClient(),i=new URLSearchParams({client_id:r.client_id,redirect_uri:r.redirect_uri,response_type:`code`,scope:this.config.scope,state:t,code_challenge:await D(n),code_challenge_method:`S256`});return x({authUrl:this.config.authUrl,query:i,options:e})}storageKey(e){return`${this.config.applicationId}.auth.${e}`}async startRedirect(e){let t=E(),n=E();sessionStorage.setItem(this.storageKey(`state`),t),sessionStorage.setItem(this.storageKey(`verifier`),n);let r=O(e.returnUrl);return r?sessionStorage.setItem(this.storageKey(`return-path`),r):sessionStorage.removeItem(this.storageKey(`return-path`)),window.location.assign(await this.authorizationUrl(e,t,n)),{status:`redirecting`}}async openPopup(e){if(this.attempt&&!this.attempt.popup.closed)return this.attempt.popup.focus(),new Promise((e,t)=>{let n=this.attempt,r=n.resolve,i=n.reject;n.resolve=t=>{r(t),e(t)},n.reject=e=>{i(e),t(e)}});let{width:t,height:n,name:r,timeoutMs:i}=this.config.popup,a=Math.max(0,window.screenX+(window.outerWidth-t)/2),o=Math.max(0,window.screenY+(window.outerHeight-n)/2),s=window.open(`about:blank`,r,`popup=yes,width=${t},height=${n},left=${Math.round(a)},top=${Math.round(o)}`);if(!s)return this.startRedirect({...e,presentation:`redirect`});let c=E(),l=`${c}.${E()}`,u=E(),d=O(e.returnUrl);return new Promise((t,n)=>{let r=setInterval(()=>{s.closed&&this.finishAttempt()?.resolve({status:`cancelled`})},250),a=setTimeout(()=>{let e=this.finishAttempt();s.close(),e?.reject(Error(`POFSIS Auth popup timed out.`))},i);this.attempt={popup:s,state:l,verifier:u,correlationId:c,returnUrl:d,resolve:t,reject:n,timer:r,timeout:a},this.authorizationUrl(e,l,u).then(e=>s.location.replace(e)).catch(e=>{let t=this.finishAttempt();s.close(),t?.reject(e instanceof Error?e:Error(String(e)))})})}finishAttempt(){let e=this.attempt;return e?(clearInterval(e.timer),clearTimeout(e.timeout),this.attempt=null,e):null}onPopupMessage=e=>{let t=this.attempt,n=e.data;if(!t||e.origin!==window.location.origin||e.source!==t.popup||n?.type!==`pofsis-auth:callback`||n.correlationId!==t.correlationId||C(n.state||null)!==t.correlationId||n.state!==t.state)return;let r=this.finishAttempt();if(r){if(n.error||!n.code){r.popup.close(),r.reject(Error(n.error||`POFSIS Auth callback was incomplete.`));return}this.completeCode(n.code,n.state,r.verifier).then(()=>{r.popup.close(),r.returnUrl&&window.history.replaceState(null,``,r.returnUrl),r.resolve({status:`authenticated`,user:this.getUser()})}).catch(e=>{r.popup.close(),r.reject(e instanceof Error?e:Error(String(e)))})}};async completeCode(e,t,n){if(!t||!n)throw Error(`Authentication state could not be verified.`);let i=await this.loadClient();this.accept(await r(this.config,e,n,i))}async completeRedirectCallback(e,t){let n=sessionStorage.getItem(this.storageKey(`state`)),r=sessionStorage.getItem(this.storageKey(`verifier`));if(sessionStorage.removeItem(this.storageKey(`state`)),sessionStorage.removeItem(this.storageKey(`verifier`)),!n||!r||t!==n)throw Error(`Authentication state could not be verified.`);await this.completeCode(e,t,r)}};function j(e){return new A(e)}Object.defineProperty(exports,"a",{enumerable:!0,get:function(){return f}}),Object.defineProperty(exports,"c",{enumerable:!0,get:function(){return c}}),Object.defineProperty(exports,"i",{enumerable:!0,get:function(){return b}}),Object.defineProperty(exports,"l",{enumerable:!0,get:function(){return l}}),Object.defineProperty(exports,"n",{enumerable:!0,get:function(){return j}}),Object.defineProperty(exports,"o",{enumerable:!0,get:function(){return u}}),Object.defineProperty(exports,"r",{enumerable:!0,get:function(){return w}}),Object.defineProperty(exports,"s",{enumerable:!0,get:function(){return s}}),Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return A}});
-//# sourceMappingURL=PofsisAuthClient-B3YHqgZL.cjs.map