@qlover/oauth-wrapper 0.2.0

package/dist/client.cjs

@@ -0,0 +1,835 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/client/index.ts
+var client_exports = {};
+__export(client_exports, {
+  DEFAULT_OAUTH_AUTHORIZE_PATH: () => DEFAULT_OAUTH_AUTHORIZE_PATH,
+  DEFAULT_PKCE_STORAGE_KEY: () => DEFAULT_PKCE_STORAGE_KEY,
+  OAuthClient: () => OAuthClient,
+  OAuthGateway: () => OAuthGateway,
+  OAuthTokenErrorSchema: () => OAuthTokenErrorSchema,
+  OAuthTokenResponseSchema: () => OAuthTokenResponseSchema,
+  OAuthUserInfoSchema: () => OAuthUserInfoSchema,
+  OAuthWrapperEndpoints: () => OAuthWrapperEndpoints,
+  PKCESessionStore: () => PKCESessionStore,
+  buildAuthorizeSearchParams: () => buildAuthorizeSearchParams,
+  buildOAuthAuthorizeUrl: () => buildOAuthAuthorizeUrl,
+  buildOAuthLocaleHeaders: () => buildOAuthLocaleHeaders,
+  buildOAuthRedirectUri: () => buildOAuthRedirectUri,
+  defaultOAuthClientConfig: () => defaultOAuthClientConfig,
+  formatOAuthAuthorizeUrl: () => formatOAuthAuthorizeUrl,
+  mergeOAuthAuthorizationConfig: () => mergeOAuthAuthorizationConfig,
+  parseOAuthTokenError: () => parseOAuthTokenError,
+  parseOAuthTokenResponse: () => parseOAuthTokenResponse,
+  parseOAuthUserInfoResponse: () => parseOAuthUserInfoResponse,
+  resolveOAuthClientConfig: () => resolveOAuthClientConfig
+});
+module.exports = __toCommonJS(client_exports);
+
+// src/client/interface/OAuthConfig.ts
+var OAuthWrapperEndpoints = {
+  authorize: "/oauth/authorize",
+  token: "/oauth/token",
+  revoke: "/oauth/revoke",
+  userinfo: "/userinfo"
+};
+var DEFAULT_OAUTH_AUTHORIZE_PATH = OAuthWrapperEndpoints.authorize;
+var DEFAULT_PKCE_STORAGE_KEY = "oauth-wrapper-pkcesession";
+var defaultOAuthClientConfig = {
+  locale: "en",
+  localeIn: "path",
+  localeQueryParam: "local",
+  localeHeader: "Accept-Language",
+  serverUrl: "",
+  clientId: "",
+  scope: "openid profile email",
+  redirectPath: "oauth/callback"
+};
+function resolveOAuthClientConfig(partial) {
+  return {
+    ...defaultOAuthClientConfig,
+    ...partial
+  };
+}
+
+// src/client/OAuthGateway.ts
+var import_fe_corekit = require("@qlover/fe-corekit");
+
+// src/client/oauthUrlUtils.ts
+function resolveLocaleIn(options) {
+  if (options.localeIn) {
+    return options.localeIn;
+  }
+  return options.locale ? "path" : "none";
+}
+function buildAuthorizeSearchParams(input) {
+  const params = new URLSearchParams({
+    response_type: "code",
+    client_id: input.clientId,
+    redirect_uri: input.redirectUri,
+    scope: input.scope,
+    state: input.state,
+    code_challenge: input.codeChallenge,
+    code_challenge_method: "S256"
+  });
+  return params;
+}
+function mergeOAuthAuthorizationConfig(params, baseConfig) {
+  const serverUrl = (params?.serverUrl ?? baseConfig?.serverUrl)?.trim();
+  const clientId = (params?.clientId ?? baseConfig?.clientId)?.trim();
+  if (!serverUrl || !clientId) {
+    return null;
+  }
+  return {
+    serverUrl: serverUrl.replace(/\/$/, ""),
+    clientId,
+    scope: params?.scope?.trim() || baseConfig?.scope || defaultOAuthClientConfig.scope,
+    redirectPath: params?.redirectPath?.trim() || baseConfig?.redirectPath || defaultOAuthClientConfig.redirectPath
+  };
+}
+function buildOAuthRedirectUri(redirectPath, options = {}) {
+  const origin = (options.origin ?? (typeof window !== "undefined" ? window.location.origin : "")).replace(/\/$/, "");
+  const prefix = (options.routerPrefix ?? "").replace(/\/$/, "");
+  const path = redirectPath.replace(/^\//, "");
+  const localeIn = resolveLocaleIn(options);
+  const segments = [
+    prefix,
+    localeIn === "path" && options.locale ? options.locale : "",
+    path
+  ].filter(Boolean);
+  let url = `${origin}/${segments.join("/")}`.replace(/([^:]\/)\/+/g, "$1");
+  if (options.locale && localeIn === "query") {
+    const param = options.localeQueryParam ?? "locale";
+    const joiner = url.includes("?") ? "&" : "?";
+    url = `${url}${joiner}${param}=${encodeURIComponent(options.locale)}`;
+  }
+  return url;
+}
+function formatOAuthAuthorizeUrl(serverUrl, authorizePath, searchParams, localeOptions = {}) {
+  const base = serverUrl.replace(/\/$/, "");
+  const path = authorizePath.startsWith("/") ? authorizePath : `/${authorizePath}`;
+  const localeIn = resolveLocaleIn(localeOptions);
+  const url = localeOptions.locale && localeIn === "path" ? `${base}/${localeOptions.locale}${path}` : `${base}${path}`;
+  const params = new URLSearchParams(searchParams);
+  if (localeOptions.locale && localeIn === "query") {
+    params.set(
+      localeOptions.localeQueryParam ?? "locale",
+      localeOptions.locale
+    );
+  }
+  const qs = params.toString();
+  return qs ? `${url}?${qs}` : url;
+}
+function buildOAuthAuthorizeUrl(input) {
+  const { config, authorizePath, state, codeChallenge, redirectPath, scope } = input;
+  const redirectUri = buildOAuthRedirectUri(
+    redirectPath ?? config.redirectPath,
+    input
+  );
+  const searchParams = buildAuthorizeSearchParams({
+    clientId: config.clientId,
+    redirectUri,
+    scope: scope ?? config.scope,
+    state,
+    codeChallenge
+  });
+  return formatOAuthAuthorizeUrl(
+    config.serverUrl,
+    authorizePath,
+    searchParams,
+    input
+  );
+}
+function buildOAuthLocaleHeaders(options = {}) {
+  if (!options.locale || options.localeIn !== "header") {
+    return {};
+  }
+  const header = options.localeHeader ?? "Accept-Language";
+  return { [header]: options.locale };
+}
+
+// src/client/parseEnvelope.ts
+var import_zod2 = require("zod");
+
+// src/client/types.ts
+var import_zod = require("zod");
+var OAuthUserInfoSchema = import_zod.z.object({
+  sub: import_zod.z.string(),
+  email: import_zod.z.email(),
+  name: import_zod.z.string(),
+  roles: import_zod.z.array(import_zod.z.string()).optional()
+});
+var OAuthTokenResponseSchema = import_zod.z.object({
+  access_token: import_zod.z.string(),
+  token_type: import_zod.z.literal("Bearer").optional(),
+  expires_in: import_zod.z.number().optional(),
+  refresh_token: import_zod.z.string().optional(),
+  scope: import_zod.z.string().optional()
+});
+var OAuthTokenErrorSchema = import_zod.z.object({
+  error: import_zod.z.string(),
+  error_description: import_zod.z.string().optional(),
+  error_id: import_zod.z.string().optional()
+});
+
+// src/client/parseEnvelope.ts
+var OAuthAppApiSuccessSchema = (dataSchema) => import_zod2.z.object({
+  success: import_zod2.z.literal(true),
+  requestId: import_zod2.z.string().optional(),
+  data: dataSchema
+});
+var OAuthAppApiErrorSchema = import_zod2.z.object({
+  success: import_zod2.z.literal(false),
+  id: import_zod2.z.string().optional(),
+  message: import_zod2.z.string().optional(),
+  requestId: import_zod2.z.string().optional()
+});
+function formatAppApiError(json, fallback) {
+  const wrapped = OAuthAppApiErrorSchema.safeParse(json);
+  if (wrapped.success) {
+    return wrapped.data.message?.trim() || wrapped.data.id || fallback;
+  }
+  const oauth = OAuthTokenErrorSchema.safeParse(json);
+  if (oauth.success) {
+    return oauth.data.error_description?.trim() || oauth.data.error;
+  }
+  return fallback;
+}
+function parseOAuthTokenResponse(json) {
+  const direct = OAuthTokenResponseSchema.safeParse(json);
+  if (direct.success) {
+    return direct.data;
+  }
+  const wrapped = OAuthAppApiSuccessSchema(OAuthTokenResponseSchema).safeParse(
+    json
+  );
+  if (wrapped.success) {
+    return wrapped.data.data;
+  }
+  throw new Error(
+    formatAppApiError(json, "Invalid token response from authorization server")
+  );
+}
+function parseOAuthTokenError(json, fallback) {
+  return formatAppApiError(json, fallback);
+}
+function parseOAuthUserInfoResponse(json) {
+  const direct = OAuthUserInfoSchema.safeParse(json);
+  if (direct.success) {
+    return direct.data;
+  }
+  const wrapped = OAuthAppApiSuccessSchema(OAuthUserInfoSchema).safeParse(json);
+  if (wrapped.success) {
+    return wrapped.data.data;
+  }
+  throw new Error(
+    formatAppApiError(
+      json,
+      "Invalid userinfo response from authorization server"
+    )
+  );
+}
+
+// src/core/utils/pkce.ts
+var PKCE_CHARSET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
+function generatePkceVerifier(length = 64) {
+  const size = Math.min(128, Math.max(43, length));
+  const values = new Uint8Array(size);
+  crypto.getRandomValues(values);
+  let result = "";
+  for (let i = 0; i < size; i++) {
+    result += PKCE_CHARSET[values[i] % PKCE_CHARSET.length];
+  }
+  return result;
+}
+function base64UrlEncode(buffer) {
+  const bytes = new Uint8Array(buffer);
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function computePkceS256Challenge(verifier) {
+  const data = new TextEncoder().encode(verifier);
+  const digest = await crypto.subtle.digest("SHA-256", data);
+  return base64UrlEncode(digest);
+}
+function randomOAuthState() {
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+// src/client/OAuthGateway.ts
+function parseCallbackParams(params) {
+  if (params instanceof URLSearchParams) {
+    return {
+      code: params.get("code") ?? void 0,
+      state: params.get("state") ?? void 0,
+      error: params.get("error") ?? void 0,
+      error_description: params.get("error_description") ?? void 0
+    };
+  }
+  return params ?? {};
+}
+function callbackDedupeKey(params) {
+  if (!params.code || !params.state) {
+    return null;
+  }
+  return `${params.code}:${params.state}`;
+}
+var OAuthGateway = class {
+  constructor(options) {
+    this.options = options;
+  }
+  callbackInflight = /* @__PURE__ */ new Map();
+  get localeOptions() {
+    return {
+      locale: this.options.locale,
+      localeIn: this.options.localeIn,
+      localeQueryParam: this.options.localeQueryParam,
+      localeHeader: this.options.localeHeader
+    };
+  }
+  get authorizePath() {
+    return this.options.authorizePath ?? DEFAULT_OAUTH_AUTHORIZE_PATH;
+  }
+  get urlOptions() {
+    return {
+      origin: this.options.origin,
+      routerPrefix: this.options.routerPrefix
+    };
+  }
+  getServerUrl() {
+    const serverUrl = this.options.config?.serverUrl;
+    if (!serverUrl) {
+      throw new Error("OAuth is not configured");
+    }
+    return serverUrl;
+  }
+  buildRequestHeaders(headers) {
+    return {
+      ...buildOAuthLocaleHeaders(this.localeOptions),
+      ...headers
+    };
+  }
+  async requestJson(path, init, errorFallback) {
+    const requester = this.options.requester;
+    if (requester) {
+      const response = await requester.request({
+        url: path,
+        method: init.method,
+        headers: init.headers,
+        data: init.body
+      });
+      if (response.status < 200 || response.status >= 300) {
+        throw new Error(parseOAuthTokenError(response.data, errorFallback));
+      }
+      return response.data;
+    }
+    const res = await fetch(`${this.getServerUrl()}${path}`, {
+      method: init.method,
+      headers: init.headers,
+      body: init.body
+    });
+    const json = await res.json();
+    if (!res.ok) {
+      throw new Error(parseOAuthTokenError(json, errorFallback));
+    }
+    return json;
+  }
+  /**
+   * @override
+   */
+  async authorize(paramsOrUrl) {
+    if (typeof paramsOrUrl === "string") {
+      window.location.assign(paramsOrUrl);
+      return;
+    }
+    const config = mergeOAuthAuthorizationConfig(
+      paramsOrUrl,
+      this.options.config
+    );
+    if (!config) {
+      throw new Error("OAuth is not configured");
+    }
+    const session = this.options.store.loadPkceSession();
+    if (!session) {
+      throw new Error("PKCE session is required before authorize");
+    }
+    const url = buildOAuthAuthorizeUrl({
+      config,
+      authorizePath: this.authorizePath,
+      redirectPath: paramsOrUrl.redirectPath,
+      scope: paramsOrUrl.scope,
+      state: session.state,
+      codeChallenge: await computePkceS256Challenge(session.codeVerifier),
+      ...this.urlOptions,
+      ...this.localeOptions
+    });
+    if (paramsOrUrl.target === "_blank") {
+      window.open(url, "_blank", "noopener,noreferrer");
+      return;
+    }
+    window.location.assign(url);
+  }
+  /**
+   * @override
+   */
+  async getToken(request) {
+    const body = new URLSearchParams({
+      grant_type: request.grant_type,
+      code: request.code,
+      redirect_uri: request.redirect_uri,
+      client_id: request.client_id,
+      code_verifier: request.code_verifier
+    });
+    const json = await this.requestJson(
+      OAuthWrapperEndpoints.token,
+      {
+        method: import_fe_corekit.HttpMethods.POST,
+        headers: this.buildRequestHeaders({
+          "Content-Type": "application/x-www-form-urlencoded"
+        }),
+        body: body.toString()
+      },
+      "Token exchange failed"
+    );
+    return parseOAuthTokenResponse(json);
+  }
+  /**
+   * @override
+   */
+  async getUserInfo(accessToken) {
+    const json = await this.requestJson(
+      OAuthWrapperEndpoints.userinfo,
+      {
+        method: import_fe_corekit.HttpMethods.GET,
+        headers: this.buildRequestHeaders({
+          Authorization: `Bearer ${accessToken}`
+        })
+      },
+      "Failed to fetch userinfo"
+    );
+    return parseOAuthUserInfoResponse(json);
+  }
+  /**
+   * @override
+   */
+  async oAuthWrapperCallback(params) {
+    const parsed = parseCallbackParams(params);
+    const dedupeKey = callbackDedupeKey(parsed);
+    if (dedupeKey) {
+      const inflight = this.callbackInflight.get(dedupeKey);
+      if (inflight) {
+        return inflight;
+      }
+    }
+    const promise = this.runOAuthWrapperCallback(parsed);
+    if (dedupeKey) {
+      this.callbackInflight.set(dedupeKey, promise);
+      promise.finally(() => {
+        this.callbackInflight.delete(dedupeKey);
+      });
+    }
+    return promise;
+  }
+  async runOAuthWrapperCallback(params) {
+    if (params.error) {
+      throw new Error(
+        params.error_description?.trim() || params.error || "Authorization denied"
+      );
+    }
+    if (!params.code || !params.state) {
+      throw new Error("Missing authorization code or state");
+    }
+    const store = this.options.store;
+    const session = store.loadPkceSession();
+    if (!session) {
+      throw new Error("OAuth session expired; please sign in again");
+    }
+    if (session.state !== params.state) {
+      store.clearPkceSession();
+      throw new Error("Invalid state (possible CSRF)");
+    }
+    const currentLocale = this.options.locale;
+    if (session.locale != null && currentLocale != null && session.locale !== currentLocale) {
+      store.clearPkceSession();
+      throw new Error("Locale mismatch during OAuth callback");
+    }
+    const config = this.options.config;
+    if (!config) {
+      throw new Error("OAuth is not configured");
+    }
+    const redirectUri = buildOAuthRedirectUri(
+      config.redirectPath ?? defaultOAuthClientConfig.redirectPath,
+      { ...this.urlOptions, ...this.localeOptions }
+    );
+    try {
+      const tokens = await this.getToken({
+        grant_type: "authorization_code",
+        code: params.code,
+        redirect_uri: redirectUri,
+        client_id: config.clientId,
+        code_verifier: session.codeVerifier
+      });
+      const userinfo = await this.getUserInfo(tokens.access_token);
+      return this.options.mapUser(
+        userinfo,
+        tokens.access_token,
+        tokens.refresh_token
+      );
+    } finally {
+      store.clearPkceSession();
+    }
+  }
+  /**
+   * @override
+   */
+  async revokeToken(options) {
+    const config = this.options.config;
+    if (!config || !options?.refreshToken) {
+      return;
+    }
+    const body = new URLSearchParams({
+      token: options.refreshToken,
+      token_type_hint: "refresh_token",
+      client_id: config.clientId
+    });
+    await this.postRevokeToken(body);
+  }
+  async postRevokeToken(body) {
+    const path = OAuthWrapperEndpoints.revoke;
+    const headers = this.buildRequestHeaders({
+      "Content-Type": "application/x-www-form-urlencoded"
+    });
+    const requester = this.options.requester;
+    if (requester) {
+      await requester.request({
+        url: path,
+        method: import_fe_corekit.HttpMethods.POST,
+        headers,
+        data: body.toString()
+      });
+      return;
+    }
+    await fetch(`${this.getServerUrl()}${path}`, {
+      method: import_fe_corekit.HttpMethods.POST,
+      headers,
+      body: body.toString()
+    });
+  }
+};
+
+// src/client/SessionStorage.ts
+var sessionStorage = {
+  setItem(key, value) {
+    window.sessionStorage.setItem(key, value);
+  },
+  getItem(key, defaultValue) {
+    return window.sessionStorage.getItem(key) ?? defaultValue;
+  },
+  removeItem(key) {
+    window.sessionStorage.removeItem(key);
+  },
+  clear() {
+    window.sessionStorage.clear();
+  }
+};
+
+// src/client/PKCESessionStore.ts
+function createDefaultPkceStorage() {
+  return {
+    setItem(key, value) {
+      sessionStorage.setItem(key, JSON.stringify(value));
+    },
+    getItem(key) {
+      const raw = sessionStorage.getItem(key);
+      if (!raw) {
+        return null;
+      }
+      try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.state === "string" && typeof parsed.codeVerifier === "string" && (parsed.locale === void 0 || typeof parsed.locale === "string")) {
+          return parsed;
+        }
+      } catch {
+      }
+      return null;
+    },
+    removeItem(key) {
+      sessionStorage.removeItem(key);
+    },
+    clear() {
+      sessionStorage.clear();
+    }
+  };
+}
+var PKCESessionStore = class {
+  pkceStorage;
+  pkceStorageKey;
+  constructor(options) {
+    this.pkceStorage = options?.pkceStorage ?? createDefaultPkceStorage();
+    this.pkceStorageKey = options?.pkceStorageKey ?? DEFAULT_PKCE_STORAGE_KEY;
+  }
+  savePkceSession(session) {
+    this.pkceStorage.setItem(this.pkceStorageKey, session);
+  }
+  loadPkceSession() {
+    return this.pkceStorage.getItem(this.pkceStorageKey, null);
+  }
+  clearPkceSession() {
+    this.pkceStorage.removeItem(this.pkceStorageKey);
+  }
+};
+
+// src/client/OAuthClient.ts
+var OAUTH_CLIENT_CONFIG_KEYS = [
+  "serverUrl",
+  "clientId",
+  "scope",
+  "redirectPath",
+  "origin",
+  "routerPrefix",
+  "locale",
+  "localeIn",
+  "localeQueryParam",
+  "localeHeader"
+];
+function pickClientConfig(options) {
+  const fromOptions = Object.fromEntries(
+    OAUTH_CLIENT_CONFIG_KEYS.filter((key) => options[key] !== void 0).map(
+      (key) => [key, options[key]]
+    )
+  );
+  return {
+    ...fromOptions,
+    ...options.config
+  };
+}
+var OAuthClient = class {
+  serviceName;
+  config;
+  authorizePath;
+  mapUser;
+  requester;
+  logger;
+  pkceStore;
+  gateway;
+  constructor(options) {
+    const {
+      serviceName = "OAuthClient",
+      gateway,
+      mapUser,
+      requester,
+      logger,
+      authorizePath = DEFAULT_OAUTH_AUTHORIZE_PATH,
+      pkceStorage,
+      pkceStorageKey
+    } = options;
+    this.serviceName = serviceName;
+    this.config = resolveOAuthClientConfig(pickClientConfig(options));
+    this.pkceStore = new PKCESessionStore({ pkceStorage, pkceStorageKey });
+    this.mapUser = mapUser;
+    this.requester = requester;
+    this.logger = logger;
+    this.authorizePath = authorizePath;
+    this.gateway = gateway ?? new OAuthGateway({
+      store: this.pkceStore,
+      config: this.authorizationConfig,
+      mapUser: mapUser ?? ((userinfo) => {
+        return userinfo;
+      }),
+      requester,
+      authorizePath,
+      origin: this.config.origin,
+      routerPrefix: this.config.routerPrefix,
+      locale: this.config.locale,
+      localeIn: this.config.localeIn,
+      localeQueryParam: this.config.localeQueryParam,
+      localeHeader: this.config.localeHeader
+    });
+  }
+  patchConfig(config) {
+    Object.assign(this.config, config);
+  }
+  get authorizationConfig() {
+    const serverUrl = this.config.serverUrl?.trim();
+    const clientId = this.config.clientId?.trim();
+    if (!serverUrl || !clientId) {
+      return null;
+    }
+    return {
+      serverUrl: serverUrl.replace(/\/$/, ""),
+      clientId,
+      scope: this.config.scope || defaultOAuthClientConfig.scope,
+      redirectPath: this.config.redirectPath || defaultOAuthClientConfig.redirectPath
+    };
+  }
+  get urlOptions() {
+    const { origin, routerPrefix } = this.config;
+    return { origin, routerPrefix };
+  }
+  get localeOptions() {
+    const { locale, localeIn, localeQueryParam, localeHeader } = this.config;
+    return { locale, localeIn, localeQueryParam, localeHeader };
+  }
+  getGateway() {
+    return this.gateway;
+  }
+  getLogger() {
+    return this.logger;
+  }
+  /**
+   * @override
+   */
+  isConfigured() {
+    return this.authorizationConfig != null;
+  }
+  /**
+   * @override
+   */
+  async startOAuthLogin(params) {
+    const config = mergeOAuthAuthorizationConfig(
+      params,
+      this.authorizationConfig
+    );
+    if (!config) {
+      throw new Error("OAuth is not configured");
+    }
+    const verifier = generatePkceVerifier();
+    const challenge = await computePkceS256Challenge(verifier);
+    const state = randomOAuthState();
+    const redirectPath = params?.redirectPath ?? config.redirectPath;
+    this.pkceStore.savePkceSession({
+      state,
+      codeVerifier: verifier,
+      locale: this.config.locale
+    });
+    const redirectUri = buildOAuthRedirectUri(redirectPath, {
+      ...this.urlOptions,
+      ...this.localeOptions
+    });
+    const url = buildOAuthAuthorizeUrl({
+      config,
+      authorizePath: this.authorizePath,
+      redirectPath: params?.redirectPath,
+      scope: params?.scope,
+      state,
+      codeChallenge: challenge,
+      ...this.urlOptions,
+      ...this.localeOptions
+    });
+    this.logger?.debug?.(`[${String(this.serviceName)}] startOAuthLogin`, {
+      locale: this.config.locale,
+      redirectUri,
+      statePreview: `${state.slice(0, 8)}\u2026`,
+      pkceSaved: this.pkceStore.loadPkceSession() != null
+    });
+    if (params?.target === "_blank") {
+      window.open(url, "_blank", "noopener,noreferrer");
+      return;
+    }
+    window.location.assign(url);
+  }
+  async completeOAuthCallback(params) {
+    const session = this.pkceStore.loadPkceSession();
+    const callbackState = params instanceof URLSearchParams ? params.get("state") : params?.state;
+    this.logger?.debug?.(
+      `[${String(this.serviceName)}] completeOAuthCallback`,
+      {
+        hasPkceSession: session != null,
+        callbackStatePreview: callbackState ? `${callbackState.slice(0, 8)}\u2026` : null,
+        sessionStatePreview: session?.state ? `${session.state.slice(0, 8)}\u2026` : null,
+        locale: this.config.locale
+      }
+    );
+    try {
+      const result = await this.gateway.oAuthWrapperCallback(params);
+      this.logger?.debug?.(
+        `[${String(this.serviceName)}] completeOAuthCallback succeeded`
+      );
+      return result;
+    } catch (error) {
+      this.logger?.warn?.(
+        `[${String(this.serviceName)}] completeOAuthCallback failed`,
+        {
+          message: error instanceof Error ? error.message : String(error),
+          hasPkceSessionAfterFailure: this.pkceStore.loadPkceSession() != null
+        }
+      );
+      throw error;
+    }
+  }
+  parseOAuthCallbackSearchParams(searchParams) {
+    return {
+      code: searchParams.get("code") ?? void 0,
+      state: searchParams.get("state") ?? void 0,
+      error: searchParams.get("error") ?? void 0,
+      error_description: searchParams.get("error_description") ?? void 0
+    };
+  }
+  /**
+   * @override
+   */
+  async revokeToken(refreshToken) {
+    if (!this.isConfigured()) {
+      return;
+    }
+    await this.gateway.revokeToken({
+      refreshToken: refreshToken ?? void 0
+    });
+  }
+  /**
+   * Fetch user profile from the OAuth userinfo endpoint and map it via {@link mapUser}.
+   */
+  async fetchUserInfo(accessToken, refreshToken) {
+    if (!this.isConfigured()) {
+      throw new Error("OAuth is not configured");
+    }
+    const userinfo = await this.gateway.getUserInfo(accessToken);
+    const mapper = this.mapUser ?? ((info) => info);
+    return await mapper(userinfo, accessToken, refreshToken);
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DEFAULT_OAUTH_AUTHORIZE_PATH,
+  DEFAULT_PKCE_STORAGE_KEY,
+  OAuthClient,
+  OAuthGateway,
+  OAuthTokenErrorSchema,
+  OAuthTokenResponseSchema,
+  OAuthUserInfoSchema,
+  OAuthWrapperEndpoints,
+  PKCESessionStore,
+  buildAuthorizeSearchParams,
+  buildOAuthAuthorizeUrl,
+  buildOAuthLocaleHeaders,
+  buildOAuthRedirectUri,
+  defaultOAuthClientConfig,
+  formatOAuthAuthorizeUrl,
+  mergeOAuthAuthorizationConfig,
+  parseOAuthTokenError,
+  parseOAuthTokenResponse,
+  parseOAuthUserInfoResponse,
+  resolveOAuthClientConfig
+});