@qlover/oauth-wrapper 0.2.1 → 0.3.0

package/dist/client.cjs

@@ -300,6 +300,7 @@ var OAuthGateway = class {
   constructor(options) {
     this.options = options;
   }
+  options;
   callbackInflight = /* @__PURE__ */ new Map();
   get localeOptions() {
     return {
@@ -742,7 +743,8 @@ var OAuthClient = class {
       locale: this.config.locale,
       redirectUri,
       statePreview: `${state.slice(0, 8)}\u2026`,
-      pkceSaved: this.pkceStore.loadPkceSession() != null
+      pkceSaved: this.pkceStore.loadPkceSession() != null,
+      authorizeUrl: url
     });
     if (params?.target === "_blank") {
       window.open(url, "_blank", "noopener,noreferrer");

package/dist/client.d.ts

@@ -296,7 +296,7 @@ declare class OAuthClient<T extends OAuthUserInfo = OAuthUserInfo> implements OA
     /**
      * @override
      */
-    startOAuthLogin(params?: OAuthGatewayAuthorizeParams): Promise<void>;
+    startOAuthLogin(params?: Partial<OAuthGatewayAuthorizeParams>): Promise<void>;
     completeOAuthCallback(params?: Parameters<OAuthGateway<T>['oAuthWrapperCallback']>[0]): Promise<T>;
     parseOAuthCallbackSearchParams(searchParams: URLSearchParams): Parameters<OAuthGateway<T>['oAuthWrapperCallback']>[0];
     /**

package/dist/client.js

@@ -257,6 +257,7 @@ var OAuthGateway = class {
   constructor(options) {
     this.options = options;
   }
+  options;
   callbackInflight = /* @__PURE__ */ new Map();
   get localeOptions() {
     return {
@@ -699,7 +700,8 @@ var OAuthClient = class {
       locale: this.config.locale,
       redirectUri,
       statePreview: `${state.slice(0, 8)}\u2026`,
-      pkceSaved: this.pkceStore.loadPkceSession() != null
+      pkceSaved: this.pkceStore.loadPkceSession() != null,
+      authorizeUrl: url
     });
     if (params?.target === "_blank") {
       window.open(url, "_blank", "noopener,noreferrer");

package/dist/core.cjs

@@ -44,7 +44,9 @@ __export(core_exports, {
   computePkceS256Challenge: () => computePkceS256Challenge,
   generatePkceVerifier: () => generatePkceVerifier,
   isOAuthRedirectUri: () => isOAuthRedirectUri,
-  randomOAuthState: () => randomOAuthState
+  randomOAuthState: () => randomOAuthState,
+  signWithEmailOtpSchema: () => signWithEmailOtpSchema,
+  signWithPhoneOtpSchema: () => signWithPhoneOtpSchema
 });
 module.exports = __toCommonJS(core_exports);
 
@@ -156,6 +158,18 @@ var OAuthAuthorizationCodeRowSchema = import_zod.z.object({
   used: import_zod.z.boolean(),
   created_at: import_zod.z.string()
 });
+var signWithPhoneOtpSchema = import_zod.z.object({
+  /** The user's phone number. */
+  phone: import_zod.z.string(),
+  /** The otp sent to the user's phone number. */
+  token: import_zod.z.string().optional()
+});
+var signWithEmailOtpSchema = import_zod.z.object({
+  /** The user's email address. */
+  email: import_zod.z.email(),
+  /** The otp sent to the user's email address. */
+  token: import_zod.z.string().optional()
+});
 
 // src/core/schema/OAuthClientSchema.ts
 var import_zod2 = require("zod");
@@ -186,12 +200,12 @@ var OAuthTokenResponseSchema = import_zod2.z.object({
 var import_zod3 = require("zod");
 var OAuthUserInfoResponseSchema = import_zod3.z.object({
   sub: import_zod3.z.string(),
-  email: import_zod3.z.string().email(),
+  email: import_zod3.z.email(),
   name: import_zod3.z.string(),
   roles: import_zod3.z.array(import_zod3.z.string()).optional()
 });
 var OAuthUserInfoErrorResponseSchema = import_zod3.z.object({
-  error: import_zod3.z.literal("invalid_token"),
+  error: import_zod3.z.string(),
   error_id: import_zod3.z.string().optional()
 });
 
@@ -297,5 +311,7 @@ function randomOAuthState() {
   computePkceS256Challenge,
   generatePkceVerifier,
   isOAuthRedirectUri,
-  randomOAuthState
+  randomOAuthState,
+  signWithEmailOtpSchema,
+  signWithPhoneOtpSchema
 });

package/dist/core.d.ts

@@ -111,6 +111,17 @@ declare const OAuthAuthorizationCodeRowSchema: z.ZodObject<{
     created_at: z.ZodString;
 }, z.core.$strip>;
 type OAuthAuthorizationCodeRow = z.infer<typeof OAuthAuthorizationCodeRowSchema>;
+declare const signWithPhoneOtpSchema: z.ZodObject<{
+    phone: z.ZodString;
+    token: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+declare const signWithEmailOtpSchema: z.ZodObject<{
+    email: z.ZodEmail;
+    token: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type SignWithPhoneOtpSchema = z.infer<typeof signWithPhoneOtpSchema>;
+type SignWithEmailOtpSchema = z.infer<typeof signWithEmailOtpSchema>;
+type SignWithOtpSchema = SignWithPhoneOtpSchema | SignWithEmailOtpSchema;
 
 interface OAuthClientsInterface {
     listForOwner(ownerUserId: string): Promise<OAuthClientListItem[]>;
@@ -200,104 +211,6 @@ declare const OAuthTokenRevokeSchema: z.ZodObject<{
 }, z.core.$strip>;
 type OAuthTokenRevokeRequest = z.infer<typeof OAuthTokenRevokeSchema>;
 
-/**
- * OAuth user adapter profile shape.
- *
- * Significance: Keeps OAuth services independent from provider SDK user models.
- * Core idea: Represent only the profile fields required by OAuth login and userinfo.
- * Main function: Provide a canonical user profile contract for adapters.
- * Main purpose: Let the OAuth wrapper switch user providers without changing services.
- *
- * @example
- * const sub = String(profile.id);
- */
-type OAuthUserProfile = {
-    id: string | number;
-    email?: string | null;
-    name?: string | null;
-    first_name?: string | null;
-    last_name?: string | null;
-    roles?: string[];
-    [key: string]: unknown;
-};
-/**
- * OAuth provider login credentials result.
- *
- * Significance: Normalizes provider login responses for middleware sessions.
- * Core idea: Require a session token while allowing provider-specific metadata.
- * Main function: Carry the provider session token after credential verification.
- * Main purpose: Persist the token needed to mint OAuth access tokens later.
- *
- * @example
- * const sessionToken = credentials.token;
- */
-type OAuthUserCredentials = {
-    token: string;
-    [key: string]: unknown;
-};
-/**
- * OAuth provider access token result.
- *
- * Significance: Normalizes provider token exchange responses.
- * Core idea: OAuth token services only need access, expiry, and optional refresh token.
- * Main function: Return a provider access token for third-party OAuth clients.
- * Main purpose: Hide provider SDK response details behind the adapter contract.
- *
- * @example
- * return { access_token: token.access_token, expires_in: token.expires_in };
- */
-type OAuthUserAccessToken = {
-    access_token: string;
-    expires_in: number;
-    refresh_token?: string | null;
-    [key: string]: unknown;
-};
-/**
- * User adapter contract for the OAuth wrapper.
- *
- * Significance: Defines the boundary between OAuth core services and user providers.
- * Core idea: Keep provider-specific login, token exchange, and profile lookup behind one port.
- * Main function: Verify credentials, exchange provider tokens, and load user profiles.
- * Main purpose: Allow any upstream user API to be swapped without changing OAuth services.
- *
- * @example
- * const access = await adapter.exchangeAccessToken({ token: sessionToken });
- */
-interface OAuthUserAdapterInterface {
-    /**
-     * Verifies user credentials with the backing user provider.
-     *
-     * @param email - User email or username accepted by the provider.
-     * @param password - Plain credential submitted by the login form.
-     * @returns Provider credentials containing a session token.
-     */
-    login(params: LoginParams): Promise<OAuthUserCredentials>;
-    /**
-     * Exchanges a provider session token for a provider access token.
-     *
-     * @param params - Session token and optional language preference.
-     * @returns Provider access token payload used as the OAuth access token response.
-     */
-    exchangeAccessToken(params: {
-        token: string;
-        lang?: string;
-    }): Promise<OAuthUserAccessToken>;
-    /**
-     * Loads profile information using a provider session token.
-     *
-     * @param sessionToken - Provider session token from a successful login.
-     * @returns Canonical user profile for session creation.
-     */
-    getUserInfo(sessionToken: string): Promise<OAuthUserProfile>;
-    /**
-     * Loads profile information using a provider access token.
-     *
-     * @param accessToken - Bearer access token presented to the userinfo endpoint.
-     * @returns Canonical user profile for OIDC userinfo claims.
-     */
-    getUserInfoByAccessToken(accessToken: string): Promise<OAuthUserProfile>;
-}
-
 declare const OAuthUserCredentialsSchema: z.ZodObject<{
     user_id: z.ZodString;
     provider_refresh_token: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -365,13 +278,13 @@ interface OAuthWrapperRepositoryInterface extends OAuthClientsRepositoryInterfac
 
 declare const OAuthUserInfoResponseSchema: z.ZodObject<{
     sub: z.ZodString;
-    email: z.ZodString;
+    email: z.ZodEmail;
     name: z.ZodString;
     roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
 type OAuthUserInfoResponse = z.infer<typeof OAuthUserInfoResponseSchema>;
 declare const OAuthUserInfoErrorResponseSchema: z.ZodObject<{
-    error: z.ZodLiteral<"invalid_token">;
+    error: z.ZodString;
     error_id: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 type OAuthUserInfoErrorResponse = z.infer<typeof OAuthUserInfoErrorResponseSchema>;
@@ -415,25 +328,87 @@ interface OAuthTokenServiceInterface {
      */
     revokeToken(rawFields: Record<string, string>): Promise<void>;
 }
-interface OAuthServiceInterface<SessionPayload extends OAuthSessionPayload> extends OAuthTokenServiceInterface {
-    resolveAuthorizePage(rawQuery: Record<string, string | string[] | undefined>): Promise<{
-        ok: true;
-        data: OAuthAuthorizePageData;
-    } | {
-        ok: false;
-        error: OAuthAuthorizeValidationError;
-    }>;
-    processConsent(requestBody: unknown): Promise<OAuthConsentResult>;
-    getUserInfo(accessToken: string): Promise<OAuthUserInfoResponse>;
-    getOAuthSession(): OAuthSessionInterface<SessionPayload>;
-    getOAuthAdapter(): OAuthUserAdapterInterface;
-    getOAuthTokenService(): OAuthTokenServiceInterface;
+type ResolveAuthorizePageResult = {
+    ok: true;
+    data: OAuthAuthorizePageData;
+} | {
+    ok: false;
+    error: OAuthAuthorizeValidationError;
+};
+interface OAuthProviderInterface<SessionPayload extends OAuthSessionPayload> extends OAuthTokenServiceInterface {
+    login(params: LoginParams): Promise<SessionPayload>;
+    /**
+     * Get the OAuth repository
+     */
     getOAuthRepo(): OAuthWrapperRepositoryInterface;
     /**
-     * Application logout: revoke issued refresh tokens, clear stored provider
-     * credentials, and clear the authorization-server session cookie.
+     * Clear the session
+     */
+    clearSession(): Promise<void>;
+    /**
+     * Get the session
+     */
+    getSession(): Promise<SessionPayload | null>;
+    /**
+     * Logout the user
+     */
+    logout(userId: string): Promise<void>;
+    /**
+     * Resolve the authorize page
+     */
+    resolveAuthorizePage(rawQuery: Record<string, string | string[] | undefined>): Promise<ResolveAuthorizePageResult>;
+    /**
+     * Process the consent
+     */
+    processConsent(requestBody: unknown): Promise<OAuthConsentResult>;
+    getUserInfoWithAccessToken(accessToken: string): Promise<OAuthUserInfoResponse>;
+}
+type SignWithOtpParams = {
+    email: string;
+} | {
+    phone: string;
+};
+interface VerifyMobileOtpParams {
+    /** The user's phone number. */
+    phone: string;
+    /** The otp sent to the user's phone number. */
+    token: string;
+}
+interface VerifyEmailOtpParams {
+    /** The user's email address. */
+    email: string;
+    /** The otp sent to the user's email address. */
+    token: string;
+}
+type VerifyOtpParams = SignWithOtpSchema;
+type SignOtpResult = {
+    expired: number;
+    messageId?: string;
+};
+/**
+ * Interface for OAuth providers that support OTP-based authentication.
+ *
+ * This interface extends the base OAuthProviderInterface with methods specific to OTP flows.
+ * It allows for signing in with OTP and verifying OTP tokens to establish sessions.
+ *
+ * The generic SessionPayload type parameter allows implementations to define their own session data structure.
+ */
+interface OAuthOTPProviderInterface {
+    /**
+     * Sign in using OTP. The params can be either email-based or phone-based.
+     * The implementation should handle sending the OTP to the user.
+     *
+     * @param params - Parameters for signing in with OTP, either email or phone.
+     * @returns A promise that resolves to the session payload after successful OTP initiation.
+     */
+    signWithOtp(params: SignWithOtpParams): Promise<SignOtpResult>;
+    /**
+     * Verify the OTP token provided by the user. This method should validate the OTP and establish a session if valid.
+     *
+     * @param params - Parameters for verifying the OTP, including the identifier (email or phone) and the OTP token.
+     * @returns A promise that resolves to the session payload after successful OTP verification.
      */
-    logoutUser(userId: string): Promise<void>;
+    verifyOtp(params: VerifyOtpParams): Promise<SignOtpResult>;
 }
 
 declare const OAuthRfcCodes: {
@@ -458,4 +433,4 @@ declare function generatePkceVerifier(length?: number): string;
 declare function computePkceS256Challenge(verifier: string): Promise<string>;
 declare function randomOAuthState(): string;
 
-export { type CreateAuthorizationCodeInput, type CreateOAuthRefreshTokenInput, type OAuthAuthorizationCodeRow, OAuthAuthorizationCodeRowSchema, type OAuthAuthorizePageData, type OAuthAuthorizeQuery, OAuthAuthorizeQuerySchema, type OAuthAuthorizeValidationError, type OAuthClientCreate, type OAuthClientCreateResponse, OAuthClientCreateResponseSchema, OAuthClientCreateSchema, type OAuthClientDetail, OAuthClientDetailSchema, type OAuthClientListItem, OAuthClientListItemSchema, type OAuthClientRow, OAuthClientRowSchema, type OAuthClientSecretRotateResponse, OAuthClientSecretRotateResponseSchema, type OAuthClientUpdate, OAuthClientUpdateSchema, type OAuthClientsInterface, type OAuthClientsRepositoryInterface, type OAuthConsentBody, OAuthConsentBodySchema, type OAuthConsentResult, type OAuthRefreshTokenRow, OAuthRefreshTokenSchema, type OAuthRfcCodeType, OAuthRfcCodes, type OAuthRfcErrorCodesType, type OAuthServiceInterface, type OAuthSessionInterface, type OAuthSessionPayload, type OAuthTokenAuthorizationCodeRequest, OAuthTokenAuthorizationCodeSchema, type OAuthTokenErrorResponse, OAuthTokenErrorResponseSchema, type OAuthTokenRefreshRequest, OAuthTokenRefreshSchema, type OAuthTokenRequest, OAuthTokenRequestSchema, type OAuthTokenResponse, OAuthTokenResponseSchema, type OAuthTokenRevokeRequest, OAuthTokenRevokeSchema, type OAuthTokenServiceInterface, type OAuthUserAccessToken, type OAuthUserAdapterInterface, type OAuthUserCredentials, type OAuthUserCredentialsRow, OAuthUserCredentialsSchema, type OAuthUserInfoErrorResponse, OAuthUserInfoErrorResponseSchema, type OAuthUserInfoResponse, OAuthUserInfoResponseSchema, type OAuthUserProfile, type OAuthWrapperRepositoryInterface, computePkceS256Challenge, generatePkceVerifier, isOAuthRedirectUri, randomOAuthState };
+export { type CreateAuthorizationCodeInput, type CreateOAuthRefreshTokenInput, type OAuthAuthorizationCodeRow, OAuthAuthorizationCodeRowSchema, type OAuthAuthorizePageData, type OAuthAuthorizeQuery, OAuthAuthorizeQuerySchema, type OAuthAuthorizeValidationError, type OAuthClientCreate, type OAuthClientCreateResponse, OAuthClientCreateResponseSchema, OAuthClientCreateSchema, type OAuthClientDetail, OAuthClientDetailSchema, type OAuthClientListItem, OAuthClientListItemSchema, type OAuthClientRow, OAuthClientRowSchema, type OAuthClientSecretRotateResponse, OAuthClientSecretRotateResponseSchema, type OAuthClientUpdate, OAuthClientUpdateSchema, type OAuthClientsInterface, type OAuthClientsRepositoryInterface, type OAuthConsentBody, OAuthConsentBodySchema, type OAuthConsentResult, type OAuthOTPProviderInterface, type OAuthProviderInterface, type OAuthRefreshTokenRow, OAuthRefreshTokenSchema, type OAuthRfcCodeType, OAuthRfcCodes, type OAuthRfcErrorCodesType, type OAuthSessionInterface, type OAuthSessionPayload, type OAuthTokenAuthorizationCodeRequest, OAuthTokenAuthorizationCodeSchema, type OAuthTokenErrorResponse, OAuthTokenErrorResponseSchema, type OAuthTokenRefreshRequest, OAuthTokenRefreshSchema, type OAuthTokenRequest, OAuthTokenRequestSchema, type OAuthTokenResponse, OAuthTokenResponseSchema, type OAuthTokenRevokeRequest, OAuthTokenRevokeSchema, type OAuthTokenServiceInterface, type OAuthUserCredentialsRow, OAuthUserCredentialsSchema, type OAuthUserInfoErrorResponse, OAuthUserInfoErrorResponseSchema, type OAuthUserInfoResponse, OAuthUserInfoResponseSchema, type OAuthWrapperRepositoryInterface, type ResolveAuthorizePageResult, type SignOtpResult, type SignWithEmailOtpSchema, type SignWithOtpParams, type SignWithOtpSchema, type SignWithPhoneOtpSchema, type VerifyEmailOtpParams, type VerifyMobileOtpParams, type VerifyOtpParams, computePkceS256Challenge, generatePkceVerifier, isOAuthRedirectUri, randomOAuthState, signWithEmailOtpSchema, signWithPhoneOtpSchema };

package/dist/core.js

@@ -106,6 +106,18 @@ var OAuthAuthorizationCodeRowSchema = z.object({
   used: z.boolean(),
   created_at: z.string()
 });
+var signWithPhoneOtpSchema = z.object({
+  /** The user's phone number. */
+  phone: z.string(),
+  /** The otp sent to the user's phone number. */
+  token: z.string().optional()
+});
+var signWithEmailOtpSchema = z.object({
+  /** The user's email address. */
+  email: z.email(),
+  /** The otp sent to the user's email address. */
+  token: z.string().optional()
+});
 
 // src/core/schema/OAuthClientSchema.ts
 import { z as z2 } from "zod";
@@ -136,12 +148,12 @@ var OAuthTokenResponseSchema = z2.object({
 import { z as z3 } from "zod";
 var OAuthUserInfoResponseSchema = z3.object({
   sub: z3.string(),
-  email: z3.string().email(),
+  email: z3.email(),
   name: z3.string(),
   roles: z3.array(z3.string()).optional()
 });
 var OAuthUserInfoErrorResponseSchema = z3.object({
-  error: z3.literal("invalid_token"),
+  error: z3.string(),
   error_id: z3.string().optional()
 });
 
@@ -246,5 +258,7 @@ export {
   computePkceS256Challenge,
   generatePkceVerifier,
   isOAuthRedirectUri,
-  randomOAuthState
+  randomOAuthState,
+  signWithEmailOtpSchema,
+  signWithPhoneOtpSchema
 };