@portalshq/capability-identity 0.2.1 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @portalshq/capability-identity
 
+## 0.4.0
+
+- Expose the hosted sign-in session RPCs on `createAuthGatewayClient`:
+  `startAuthSession` returns the `loginUrl` and `sessionCode` to poll,
+  `getAuthSession` resolves `null` while sign-in is pending and the minted
+  `AuthSessionTokens` (user token, expiry, rotating `refreshToken`) once the
+  viewer completes it, `refreshAuthSession` rotates the refresh credential for
+  a new user token, and `revokeAuthSession` ends the session family. Refresh
+  and revoke carry the credential in `authorization` metadata per the RPC
+  contract. No auth-gateway changes are required — the service already
+  implements these methods.
+
+## 0.3.0
+
+### Minor Changes
+
+- 31b4bb6: Promote identity from stub to usable: verified access-token resolution, PostgreSQL-backed cross-channel interaction history stamped with the transaction clock, and bounded identifiers and reads.
+
 ## 0.2.1
 
 - Implement typed explicit auth-gateway sync with subject matching and clear unsupported-store errors.

package/dist/auth-gateway-client.d.ts

@@ -2,10 +2,51 @@ export interface UserInfo {
     userId: string;
     displayName: string;
 }
+/** Returned by `startAuthSession`: send the viewer to `loginUrl`, then poll
+ *  `getAuthSession` with the `sessionCode` until it yields tokens. */
+export interface AuthSessionStart {
+    sessionCode: string;
+    loginUrl: string;
+}
+/** A minted user credential. `refreshToken` is present only on session
+ *  creation and refresh; it rotates on every refresh, so callers must persist
+ *  the newest value or the next rotation fails as replay. */
+export interface AuthSessionTokens {
+    userToken: string;
+    /** Epoch seconds when the user token expires, as issued by the gateway. */
+    expiresAt: number;
+    userId: string;
+    userName: string;
+    refreshToken?: string;
+}
 export interface AuthGatewayClient {
     verifyUser(token: string): Promise<UserInfo>;
     getUserInfo(resourceId: string, userId: string): Promise<UserInfo>;
     getUserId(resourceId: string, displayName: string): Promise<UserInfo>;
+    /**
+     * Begin a hosted sign-in. `clientState` must be a UUID generated by the
+     * caller; it binds the session to the requester and is required again when
+     * polling, so a different browser cannot consume the session.
+     */
+    startAuthSession(clientState: string): Promise<AuthSessionStart>;
+    /**
+     * Poll a session started with `startAuthSession`. Resolves `null` while the
+     * viewer has not completed sign-in; resolves the minted tokens once they
+     * have. The gateway consumes the session on success — only the first
+     * successful poll receives tokens.
+     */
+    getAuthSession(sessionCode: string, clientState: string): Promise<AuthSessionTokens | null>;
+    /**
+     * Rotate a refresh credential for a new user token. The credential travels
+     * in the `authorization` metadata key because the RPC request is empty by
+     * contract. Resolves `null` when the gateway returns no token.
+     */
+    refreshAuthSession(refreshToken: string): Promise<AuthSessionTokens | null>;
+    /**
+     * Revoke the refresh credential's session family (sign-out). Best-effort:
+     * the gateway never reveals whether the token existed.
+     */
+    revokeAuthSession(refreshToken: string): Promise<void>;
     close(): void;
 }
 export interface AuthGatewayClientConfig {

package/dist/auth-gateway-client.js

@@ -16,12 +16,15 @@ export function createAuthGatewayClient(config) {
     const Constructor = namespace.UrcAuthApi;
     const client = new Constructor(config.address, config.useTls ? grpc.credentials.createSsl() : grpc.credentials.createInsecure());
     let closed = false;
-    async function call(method, request, expectedId) {
+    function unary(method, request, metadata) {
         if (closed)
-            throw new Error("Auth-gateway client is closed.");
-        const response = await new Promise((resolve, reject) => {
-            client.makeUnaryRequest(`/epic_urc.UrcAuthApi/${method}`, (value) => methods[method].requestSerialize(value), (value) => methods[method].responseDeserialize(value), request, new grpc.Metadata(), { deadline: Date.now() + timeout }, (error, result) => error ? reject(error) : resolve(result ?? {}));
+            return Promise.reject(new Error("Auth-gateway client is closed."));
+        return new Promise((resolve, reject) => {
+            client.makeUnaryRequest(`/epic_urc.UrcAuthApi/${method}`, (value) => methods[method].requestSerialize(value), (value) => methods[method].responseDeserialize(value), request, metadata ?? new grpc.Metadata(), { deadline: Date.now() + timeout }, (error, result) => error ? reject(error) : resolve(result ?? {}));
         });
+    }
+    async function call(method, request, expectedId) {
+        const response = await unary(method, request);
         const candidates = Array.isArray(response.user_info) ? response.user_info : response.user_info ? [response.user_info] : [];
         const user = expectedId ? candidates.find((candidate) => candidate.user_id === expectedId) : candidates[0];
         if (!user || typeof user.user_id !== "string" || !user.user_id.trim() || typeof user.display_name !== "string") {
@@ -29,10 +32,47 @@ export function createAuthGatewayClient(config) {
         }
         return { userId: user.user_id, displayName: user.display_name };
     }
+    /** The refresh credential rides in `authorization` metadata — the
+     *  RefreshAuthSession and RevokeAuthSession requests are empty by contract. */
+    function refreshMetadata(refreshToken) {
+        const metadata = new grpc.Metadata();
+        metadata.add("authorization", `Bearer ${refreshToken}`);
+        return metadata;
+    }
+    function mapUserToken(response) {
+        const token = response.user_token;
+        if (token === null || token === undefined)
+            return null;
+        if (typeof token.user_token !== "string" || !token.user_token.trim())
+            return null;
+        const expiresAt = Number(token.expires_at);
+        return {
+            userToken: token.user_token,
+            expiresAt: Number.isFinite(expiresAt) ? expiresAt : 0,
+            userId: typeof token.user_id === "string" ? token.user_id : "",
+            userName: typeof token.user_name === "string" ? token.user_name : "",
+            ...(typeof token.refresh_token === "string" && token.refresh_token ? { refreshToken: token.refresh_token } : {}),
+        };
+    }
     return {
         verifyUser: (token) => call("VerifyUser", { target_user: { user_token: token }, requirements: [] }),
         getUserInfo: (resourceId, userId) => call("GetUserInfo", { resource_id: resourceId, user_id: [userId] }, userId),
         getUserId: (resourceId, displayName) => call("GetUserId", { resource_id: resourceId, user_display_name: displayName }),
+        async startAuthSession(clientState) {
+            const response = await unary("StartAuthSession", { client_state: clientState });
+            if (typeof response.session_code !== "string" || !response.session_code.trim()
+                || typeof response.login_url !== "string" || !response.login_url.trim()) {
+                throw new Error("Auth-gateway StartAuthSession returned no usable session");
+            }
+            return { sessionCode: response.session_code, loginUrl: response.login_url };
+        },
+        getAuthSession: (sessionCode, clientState) => unary("GetAuthSession", { session_code: sessionCode, client_state: clientState })
+            .then(mapUserToken),
+        refreshAuthSession: (refreshToken) => unary("RefreshAuthSession", {}, refreshMetadata(refreshToken))
+            .then(mapUserToken),
+        revokeAuthSession: async (refreshToken) => {
+            await unary("RevokeAuthSession", {}, refreshMetadata(refreshToken));
+        },
         close: () => { if (!closed) {
             closed = true;
             client.close();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@portalshq/capability-identity",
-  "version": "0.2.1",
+  "version": "0.4.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/portalshq/portals-cloud.git",