@rool-dev/sdk 0.12.4 → 2.0.0-dev.36748aa

package/dist/auth-browser.js

@@ -1,105 +1,73 @@
-// =============================================================================
-// Browser auth provider
-// Full-page redirect flow: hands off to the auth pages and reads the returned
-// tokens from the URL fragment on the way back. Token storage and refresh live
-// in BaseTokenAuthProvider.
-// =============================================================================
-import { BaseTokenAuthProvider } from './auth-base.js';
-export class BrowserAuthProvider extends BaseTokenAuthProvider {
-    /**
-     * Initialize auth manager - should be called on app startup.
-     * Processes any auth callback in the URL and sets up auto-refresh.
-     */
-    initialize() {
-        const wasCallback = this.processCallback();
-        this.initBase();
-        return wasCallback;
+import { TokenAuth } from "./auth-base.js";
+export class BrowserAuth extends TokenAuth {
+    async initialize() {
+        this.processCallback();
+        return this.isAuthenticated();
     }
-    /**
-     * Initiate login by redirecting to auth page.
-     * @param appName - The name of the application requesting login (displayed on auth page)
-     */
-    login(appName, params) {
-        this.redirectToAuth('login', appName, params);
+    async login(appName, params) {
+        this.redirectToAuth("login", appName, params);
     }
-    /**
-     * Initiate signup by redirecting to auth page.
-     * @param appName - The name of the application requesting signup (displayed on auth page)
-     */
-    signup(appName, params) {
-        this.redirectToAuth('signup', appName, params);
+    async signup(appName, params) {
+        this.redirectToAuth("signup", appName, params);
     }
-    /**
-     * Process auth callback from URL fragment.
-     * Should be called on page load.
-     * @returns true if callback was processed
-     */
     processCallback() {
-        const hash = window.location.hash ?? '';
-        const trimmed = hash.startsWith('#') ? hash.slice(1) : hash;
-        if (!trimmed)
+        const hash = window.location.hash.startsWith("#")
+            ? window.location.hash.slice(1)
+            : window.location.hash;
+        if (!hash)
             return false;
-        const params = new URLSearchParams(trimmed);
-        const idToken = params.get('id_token');
+        const params = new URLSearchParams(hash);
+        const idToken = params.get("id_token");
         if (!idToken)
             return false;
-        const refreshToken = params.get('refresh_token');
-        const roolToken = params.get('rool_token');
-        const expiresIn = params.get('expires_in');
-        const expiresAt = expiresIn ? Date.now() + Number(expiresIn) * 1000 : NaN;
-        const incomingState = params.get('state');
+        const incomingState = params.get("state");
         const storedState = this.readState();
-        // Validate state — only enforce when both sides have one (SDK-initiated
-        // flow). When the auth page is opened directly (e.g., link from the
-        // website), there's no incoming state and nothing to validate against.
         if (storedState && incomingState && incomingState !== storedState) {
-            this.logger.error('[RoolClient] Auth state mismatch. Token fragment ignored.');
+            console.error("[RoolAuth] Browser auth state mismatch");
             return false;
         }
-        if (!Number.isFinite(expiresAt)) {
-            this.logger.error('[RoolClient] Auth response missing expires_in. Token ignored.');
+        const accepted = this.acceptTokenResponse({
+            id_token: idToken,
+            refresh_token: params.get("refresh_token"),
+            rool_token: params.get("rool_token"),
+            expires_in: params.get("expires_in"),
+        });
+        if (!accepted)
             return false;
-        }
-        // Clear state and store tokens
         this.clearState();
-        this.acceptTokens(idToken, refreshToken, roolToken, expiresAt);
-        // Clean URL
-        const cleanUrl = window.location.origin + window.location.pathname + window.location.search;
+        const cleanUrl = window.location.origin +
+            window.location.pathname +
+            window.location.search;
         window.history.replaceState({}, document.title, cleanUrl);
-        this.notifyAuthState(true);
+        this.emitAuthState(true);
         return true;
     }
-    // ===========================================================================
-    // Private
-    // ===========================================================================
     redirectToAuth(flow, appName, params) {
-        const origin = new URL(this.authBaseUrl).origin;
-        const url = new URL(`${origin}/${flow}`);
-        const redirectTarget = window.location.origin + window.location.pathname + window.location.search;
-        url.searchParams.set('redirect_uri', redirectTarget);
-        url.searchParams.set('app_name', appName);
-        if (params) {
-            for (const [key, value] of Object.entries(params)) {
-                url.searchParams.set(key, value);
-            }
+        const url = new URL(`/${flow}`, new URL(this.authBaseUrl).origin);
+        url.searchParams.set("redirect_uri", window.location.origin +
+            window.location.pathname +
+            window.location.search);
+        url.searchParams.set("app_name", appName);
+        for (const [name, value] of Object.entries(params ?? {})) {
+            url.searchParams.set(name, value);
         }
-        const state = this.generateState();
+        const state = randomState();
         this.storeState(state);
-        url.searchParams.set('state', state);
+        url.searchParams.set("state", state);
         window.location.href = url.toString();
     }
     clearTransientState() {
         this.clearState();
     }
     get stateKey() {
-        return this.keyFor('auth_state');
+        return this.keyFor("auth_state");
     }
     storeState(value) {
         try {
             sessionStorage.setItem(this.stateKey, value);
         }
         catch {
-            // Ignore storage restrictions
+            // Storage can be unavailable in restricted browser contexts.
         }
     }
     readState() {
@@ -115,18 +83,13 @@ export class BrowserAuthProvider extends BaseTokenAuthProvider {
             sessionStorage.removeItem(this.stateKey);
         }
         catch {
-            // Ignore storage restrictions
-        }
-    }
-    generateState() {
-        try {
-            const buffer = new Uint8Array(16);
-            window.crypto.getRandomValues(buffer);
-            return Array.from(buffer, (value) => value.toString(16).padStart(2, '0')).join('');
-        }
-        catch {
-            return Math.random().toString(36).slice(2) + Math.random().toString(36).slice(2);
+            // Storage can be unavailable in restricted browser contexts.
         }
     }
 }
+function randomState() {
+    const bytes = new Uint8Array(16);
+    crypto.getRandomValues(bytes);
+    return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
 //# sourceMappingURL=auth-browser.js.map

package/dist/auth-browser.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-browser.js","sourceRoot":"","sources":["../src/auth-browser.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,wBAAwB;AACxB,8EAA8E;AAC9E,+EAA+E;AAC/E,4BAA4B;AAC5B,gFAAgF;AAEhF,OAAO,EAAE,qBAAqB,EAA4B,MAAM,gBAAgB,CAAC;AAIjF,MAAM,OAAO,mBAAoB,SAAQ,qBAAqB;IAC1D;;;OAGG;IACH,UAAU;QACN,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChB,OAAO,WAAW,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAe,EAAE,MAA+B;QAClD,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,OAAe,EAAE,MAA+B;QACnD,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACH,eAAe;QACX,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5D,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAE3B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAE3B,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QAC1E,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAErC,wEAAwE;QACxE,oEAAoE;QACpE,uEAAuE;QACvE,IAAI,WAAW,IAAI,aAAa,IAAI,aAAa,KAAK,WAAW,EAAE,CAAC;YAChE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;YAC/E,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;YACnF,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,+BAA+B;QAC/B,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAE/D,YAAY;QACZ,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC5F,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAE1D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,8EAA8E;IAC9E,UAAU;IACV,8EAA8E;IAEtE,cAAc,CAAC,IAAwB,EAAE,OAAe,EAAE,MAA+B;QAC7F,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QACzC,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAClG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;QACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAE1C,IAAI,MAAM,EAAE,CAAC;YACT,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACrC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACvB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAErC,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC1C,CAAC;IAES,mBAAmB;QACzB,IAAI,CAAC,UAAU,EAAE,CAAC;IACtB,CAAC;IAED,IAAY,QAAQ;QAChB,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACrC,CAAC;IAEO,UAAU,CAAC,KAAa;QAC5B,IAAI,CAAC;YACD,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACL,8BAA8B;QAClC,CAAC;IACL,CAAC;IAEO,SAAS;QACb,IAAI,CAAC;YACD,OAAO,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAEO,UAAU;QACd,IAAI,CAAC;YACD,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACL,8BAA8B;QAClC,CAAC;IACL,CAAC;IAEO,aAAa;QACjB,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;YAClC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YACtC,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrF,CAAC;IACL,CAAC;CACJ"}
+{"version":3,"file":"auth-browser.js","sourceRoot":"","sources":["../src/auth-browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAwB,MAAM,gBAAgB,CAAC;AAIjE,MAAM,OAAO,WAAY,SAAQ,SAAS;IACxC,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAe,EAAE,MAA+B;QAC1D,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,MAAM,CACV,OAAe,EACf,MAA+B;QAE/B,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAEO,eAAe;QACrB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAC/C,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAExB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAE3B,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,IAAI,WAAW,IAAI,aAAa,IAAI,aAAa,KAAK,WAAW,EAAE,CAAC;YAClE,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC;YACxC,QAAQ,EAAE,OAAO;YACjB,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC;YAC1C,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;YACpC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAE5B,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,QAAQ,GACZ,MAAM,CAAC,QAAQ,CAAC,MAAM;YACtB,MAAM,CAAC,QAAQ,CAAC,QAAQ;YACxB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QACzB,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CACpB,IAAwB,EACxB,OAAe,EACf,MAA+B;QAE/B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;QAClE,GAAG,CAAC,YAAY,CAAC,GAAG,CAClB,cAAc,EACd,MAAM,CAAC,QAAQ,CAAC,MAAM;YACpB,MAAM,CAAC,QAAQ,CAAC,QAAQ;YACxB,MAAM,CAAC,QAAQ,CAAC,MAAM,CACzB,CAAC;QACF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACvB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxC,CAAC;IAES,mBAAmB;QAC3B,IAAI,CAAC,UAAU,EAAE,CAAC;IACpB,CAAC;IAED,IAAY,QAAQ;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACnC,CAAC;IAEO,UAAU,CAAC,KAAa;QAC9B,IAAI,CAAC;YACH,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;QAC/D,CAAC;IACH,CAAC;IAEO,SAAS;QACf,IAAI,CAAC;YACH,OAAO,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC;YACH,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;QAC/D,CAAC;IACH,CAAC;CACF;AAED,SAAS,WAAW;IAClB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CACzE,EAAE,CACH,CAAC;AACJ,CAAC"}

package/dist/auth-native.d.ts

@@ -1,72 +1,25 @@
-import { BaseTokenAuthProvider } from './auth-base.js';
-import type { PasswordSignInResult } from './types.js';
-export type NativeAuthFlowProvider = 'google' | 'apple';
-export interface NativePkceAuthConfig {
-    /**
-     * Deep-link redirect URI registered by the app. Must match the auth
-     * server's native-client allowlist exactly, e.g.
-     * 'roolandroidauth://auth/callback' or 'rooliosauth://auth/callback'.
-     */
+import { TokenAuth, type TokenAuthConfig } from "./auth-base.js";
+import type { PasswordSignInResult } from "./types.js";
+export type NativeAuthProvider = "google" | "apple";
+export interface NativeAuthConfig extends TokenAuthConfig {
     redirectUri: string;
-    /** Identity provider used when login()/signup() are called without one. */
-    defaultProvider?: NativeAuthFlowProvider;
-    /**
-     * Open a URL in an external system browser (NOT the app webview), e.g.
-     * Capacitor's `Browser.open({ url })`. PKCE requires the authorization
-     * step to happen outside the app so the app never sees provider secrets.
-     */
+    defaultProvider?: NativeAuthProvider;
     openExternal: (url: string) => void | Promise<void>;
 }
-export declare class NativePkceAuthProvider extends BaseTokenAuthProvider {
+export declare class NativeAuth extends TokenAuth {
     private readonly redirectUri;
     private readonly defaultProvider;
     private readonly openExternal;
-    constructor(config: NativePkceAuthConfig);
-    /**
-     * No synchronous callback to process — the app drives completion via
-     * handleRedirect(). Just arm refresh for any persisted session.
-     */
-    initialize(): boolean;
-    /**
-     * Begin sign-in. `params.provider` ('google' | 'apple') overrides the
-     * default; `params.rvid` is forwarded for signup attribution.
-     */
+    constructor(config: NativeAuthConfig);
+    initialize(): Promise<boolean>;
     login(_appName: string, params?: Record<string, string>): Promise<void>;
-    /**
-     * Same flow as login — the providers don't distinguish signup from login
-     * for native, and the auth server creates the account on first sign-in.
-     */
     signup(_appName: string, params?: Record<string, string>): Promise<void>;
-    /**
-     * Complete a sign-in from the deep link the app received (e.g. Capacitor's
-     * appUrlOpen). Validates state, exchanges the code + stored verifier at
-     * /token, and persists the session. Returns true once signed in.
-     */
     handleRedirect(url: string): Promise<boolean>;
-    /**
-     * Sign in with email + password. No redirect involved — the auth server
-     * returns the token set as JSON, which we persist directly.
-     *
-     * Resolves `signed_in` on success, or `verify_required` when the account's
-     * email isn't verified (the server has emailed a magic link). Rejects with
-     * a human-readable Error on bad credentials or server failure.
-     */
     signInWithPassword(email: string, password: string): Promise<PasswordSignInResult>;
-    /**
-     * Request a magic sign-in link by email. The server emails a link carrying
-     * a verify token; the user completes sign-in by following it, which lands
-     * back in the app and is finished via `verify(token)`. Resolves once the
-     * email is accepted; rejects with a human-readable Error if the address is
-     * rejected (invalid / disposable / unreachable).
-     *
-     * NOTE: the emailed link is an https URL (`<appsDomain>/?verify=…`), so on
-     * native it only re-opens the app if Universal Links / App Links are set up
-     * for that domain. Without them the link completes on the website instead.
-     */
     requestMagicLink(email: string): Promise<void>;
+    protected clearTransientState(): void;
     private get verifierKey();
     private get stateKey();
     private startPkce;
-    protected clearTransientState(): void;
 }
 //# sourceMappingURL=auth-native.d.ts.map

package/dist/auth-native.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-native.d.ts","sourceRoot":"","sources":["../src/auth-native.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,MAAM,MAAM,sBAAsB,GAAG,QAAQ,GAAG,OAAO,CAAC;AAExD,MAAM,WAAW,oBAAoB;IACjC;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC;;;;OAIG;IACH,YAAY,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvD;AAED,qBAAa,sBAAuB,SAAQ,qBAAqB;IAC7D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAyB;IACzD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAwC;gBAEzD,MAAM,EAAE,oBAAoB;IAOxC;;;OAGG;IACH,UAAU,IAAI,OAAO;IAKrB;;;OAGG;IACH,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvE;;;OAGG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxE;;;;OAIG;IACG,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgFnD;;;;;;;OAOG;IACG,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAiDxF;;;;;;;;;;OAUG;IACG,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA6BpD,OAAO,KAAK,WAAW,GAEtB;IAED,OAAO,KAAK,QAAQ,GAEnB;YAEa,SAAS;IAuBvB,SAAS,CAAC,mBAAmB,IAAI,IAAI;CAIxC"}
+{"version":3,"file":"auth-native.d.ts","sourceRoot":"","sources":["../src/auth-native.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EAET,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEpD,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,kBAAkB,CAAC;IACrC,YAAY,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD;AAED,qBAAa,UAAW,SAAQ,SAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IACrD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAwC;gBAEzD,MAAM,EAAE,gBAAgB;IAO9B,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC;IAI9B,KAAK,CACT,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,OAAO,CAAC,IAAI,CAAC;IAIV,MAAM,CACV,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,OAAO,CAAC,IAAI,CAAC;IAIV,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgD7C,kBAAkB,CACtB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,oBAAoB,CAAC;IAmC1B,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBpD,SAAS,CAAC,mBAAmB,IAAI,IAAI;IAKrC,OAAO,KAAK,WAAW,GAEtB;IAED,OAAO,KAAK,QAAQ,GAEnB;YAEa,SAAS;CAyBxB"}

package/dist/auth-native.js

@@ -1,52 +1,23 @@
-// =============================================================================
-// Native PKCE auth provider
-// For app shells that run JavaScript but sign in through an external system
-// browser (Capacitor, Cordova, Tauri, ...). The app hands off to the auth
-// server's /authorize in an external browser, then feeds the deep-link callback
-// back into handleRedirect(), which exchanges the code + verifier at /token.
-//
-// The SDK stays platform-agnostic: the app injects how to open an external URL
-// (openExternal) and calls handleRedirect() from its own deep-link listener.
-// Token storage and refresh are inherited from BaseTokenAuthProvider.
-// =============================================================================
-import { BaseTokenAuthProvider } from './auth-base.js';
-export class NativePkceAuthProvider extends BaseTokenAuthProvider {
+import { TokenAuth, } from "./auth-base.js";
+export class NativeAuth extends TokenAuth {
     redirectUri;
     defaultProvider;
     openExternal;
     constructor(config) {
-        super();
+        super(config);
         this.redirectUri = config.redirectUri;
-        this.defaultProvider = config.defaultProvider ?? 'google';
+        this.defaultProvider = config.defaultProvider ?? "google";
         this.openExternal = config.openExternal;
     }
-    /**
-     * No synchronous callback to process — the app drives completion via
-     * handleRedirect(). Just arm refresh for any persisted session.
-     */
-    initialize() {
-        this.initBase();
-        return false;
+    async initialize() {
+        return this.isAuthenticated();
     }
-    /**
-     * Begin sign-in. `params.provider` ('google' | 'apple') overrides the
-     * default; `params.rvid` is forwarded for signup attribution.
-     */
-    login(_appName, params) {
-        return this.startPkce(params);
+    async login(_appName, params) {
+        await this.startPkce(params);
     }
-    /**
-     * Same flow as login — the providers don't distinguish signup from login
-     * for native, and the auth server creates the account on first sign-in.
-     */
-    signup(_appName, params) {
-        return this.startPkce(params);
+    async signup(_appName, params) {
+        await this.startPkce(params);
     }
-    /**
-     * Complete a sign-in from the deep link the app received (e.g. Capacitor's
-     * appUrlOpen). Validates state, exchanges the code + stored verifier at
-     * /token, and persists the session. Returns true once signed in.
-     */
     async handleRedirect(url) {
         if (!url.startsWith(this.redirectUri))
             return false;
@@ -57,204 +28,144 @@ export class NativePkceAuthProvider extends BaseTokenAuthProvider {
         catch {
             return false;
         }
-        const error = parsed.searchParams.get('error');
+        const error = parsed.searchParams.get("error");
         if (error) {
-            this.logger.warn(`[RoolClient] Native auth error: ${error}`);
+            console.warn(`[RoolAuth] Native auth error: ${error}`);
             this.clearTransientState();
             return false;
         }
-        const code = parsed.searchParams.get('code');
-        const incomingState = parsed.searchParams.get('state');
-        if (!code)
-            return false;
+        const code = parsed.searchParams.get("code");
+        const incomingState = parsed.searchParams.get("state");
         const verifier = this.readString(this.verifierKey);
         const storedState = this.readString(this.stateKey);
-        if (!verifier) {
-            this.logger.error('[RoolClient] No PKCE verifier for redirect. Ignored.');
+        if (!code || !verifier)
             return false;
-        }
         if (storedState && incomingState !== storedState) {
-            this.logger.error('[RoolClient] Native auth state mismatch. Ignored.');
             this.clearTransientState();
             return false;
         }
         let response;
         try {
-            response = await fetch(`${this.authBaseUrl}/token`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
+            response = await this.fetchAuth("/token", {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
                 body: JSON.stringify({ code, code_verifier: verifier }),
             });
         }
-        catch (err) {
-            // Network error - keep the verifier so a retry can still complete.
-            this.logger.error('[RoolClient] /token network error:', err);
+        catch (error) {
+            console.error("[RoolAuth] Native token exchange failed:", error);
             return false;
         }
-        // The code is single-use and the verifier is now spent either way.
         this.clearTransientState();
-        if (!response.ok) {
-            this.logger.warn(`[RoolClient] /token failed: ${response.status}`);
+        if (!response.ok)
             return false;
-        }
-        let data;
-        try {
-            data = await response.json();
-        }
-        catch (err) {
-            this.logger.error('[RoolClient] /token response parse error:', err);
-            return false;
-        }
-        const idToken = data.id_token ?? null;
-        const refreshToken = data.refresh_token ?? null;
-        const expiresAt = data.expires_in ? Date.now() + data.expires_in * 1000 : NaN;
-        if (!idToken || !Number.isFinite(expiresAt)) {
-            this.logger.error('[RoolClient] /token response missing id_token or expires_in');
+        const data = await readJson(response);
+        if (!data || !this.acceptTokenResponse(data))
             return false;
-        }
-        this.acceptTokens(idToken, refreshToken, data.rool_token ?? null, expiresAt);
-        this.notifyAuthState(true);
+        this.emitAuthState(true);
         return true;
     }
-    /**
-     * Sign in with email + password. No redirect involved — the auth server
-     * returns the token set as JSON, which we persist directly.
-     *
-     * Resolves `signed_in` on success, or `verify_required` when the account's
-     * email isn't verified (the server has emailed a magic link). Rejects with
-     * a human-readable Error on bad credentials or server failure.
-     */
     async signInWithPassword(email, password) {
         let response;
         try {
-            response = await fetch(`${this.authBaseUrl}/login-password`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
+            response = await this.fetchAuth("/login-password", {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
                 body: JSON.stringify({ email, password }),
             });
         }
-        catch (err) {
-            this.logger.error('[RoolClient] login-password network error:', err);
-            throw new Error('Network error. Please try again.');
-        }
-        let data;
-        try {
-            data = await response.json();
-        }
-        catch {
-            throw new Error('Unexpected response. Please try again.');
+        catch (error) {
+            console.error("[RoolAuth] Password sign-in failed:", error);
+            throw new Error("Network error. Please try again.");
         }
+        const data = await readJson(response);
+        if (!data)
+            throw new Error("Unexpected response. Please try again.");
         if (!response.ok || data.ok === false) {
-            throw new Error(data.error || 'Invalid email or password.');
+            throw new Error(data.error || "Invalid email or password.");
         }
-        if (data.status === 'verify_required') {
-            return { status: 'verify_required' };
+        if (data.status === "verify_required") {
+            return { status: "verify_required" };
         }
-        const idToken = data.id_token ?? null;
-        const refreshToken = data.refresh_token ?? null;
-        const expiresAt = data.expires_in ? Date.now() + data.expires_in * 1000 : NaN;
-        if (!idToken || !Number.isFinite(expiresAt)) {
-            this.logger.error('[RoolClient] login-password response missing id_token or expires_in');
-            throw new Error('Sign-in failed. Please try again.');
+        if (!this.acceptTokenResponse(data)) {
+            throw new Error("Sign-in failed. Please try again.");
         }
-        this.acceptTokens(idToken, refreshToken, data.rool_token ?? null, expiresAt);
-        this.notifyAuthState(true);
-        return { status: 'signed_in' };
+        this.emitAuthState(true);
+        return { status: "signed_in" };
     }
-    /**
-     * Request a magic sign-in link by email. The server emails a link carrying
-     * a verify token; the user completes sign-in by following it, which lands
-     * back in the app and is finished via `verify(token)`. Resolves once the
-     * email is accepted; rejects with a human-readable Error if the address is
-     * rejected (invalid / disposable / unreachable).
-     *
-     * NOTE: the emailed link is an https URL (`<appsDomain>/?verify=…`), so on
-     * native it only re-opens the app if Universal Links / App Links are set up
-     * for that domain. Without them the link completes on the website instead.
-     */
     async requestMagicLink(email) {
         let response;
         try {
-            response = await fetch(`${this.authBaseUrl}/magic-link`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
+            response = await this.fetchAuth("/magic-link", {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
                 body: JSON.stringify({ email }),
             });
         }
-        catch (err) {
-            this.logger.error('[RoolClient] magic-link network error:', err);
-            throw new Error('Network error. Please try again.');
-        }
-        let data;
-        try {
-            data = await response.json();
-        }
-        catch {
-            data = {};
+        catch (error) {
+            console.error("[RoolAuth] Magic-link request failed:", error);
+            throw new Error("Network error. Please try again.");
         }
-        if (!response.ok || data.ok === false) {
-            throw new Error(data.error || 'Could not send the sign-in link. Please try again.');
+        const data = await readJson(response);
+        if (!response.ok || data?.ok === false) {
+            throw new Error(data?.error || "Could not send the sign-in link. Please try again.");
         }
     }
-    // ===========================================================================
-    // Private
-    // ===========================================================================
+    clearTransientState() {
+        this.removeString(this.verifierKey);
+        this.removeString(this.stateKey);
+    }
     get verifierKey() {
-        return this.keyFor('pkce_verifier');
+        return this.keyFor("pkce_verifier");
     }
     get stateKey() {
-        return this.keyFor('pkce_state');
+        return this.keyFor("pkce_state");
     }
     async startPkce(params) {
-        const provider = normalizeProvider(params?.provider) ?? this.defaultProvider;
-        const verifier = generateCodeVerifier();
-        const challenge = await deriveCodeChallenge(verifier);
-        const state = generateState();
-        // Stash the verifier + state for handleRedirect(). localStorage (not
-        // sessionStorage) so it survives the app being backgrounded while the
-        // external browser is in front.
+        const requestedProvider = params?.provider;
+        const provider = isProvider(requestedProvider)
+            ? requestedProvider
+            : this.defaultProvider;
+        const verifier = base64Url(randomBytes(32));
+        const challenge = base64Url(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier)));
+        const state = Array.from(randomBytes(16), (byte) => byte.toString(16).padStart(2, "0")).join("");
         this.writeString(this.verifierKey, verifier);
         this.writeString(this.stateKey, state);
         const url = new URL(`${this.authBaseUrl}/authorize`);
-        url.searchParams.set('provider', provider);
-        url.searchParams.set('redirect_uri', this.redirectUri);
-        url.searchParams.set('state', state);
-        url.searchParams.set('code_challenge', challenge);
-        url.searchParams.set('code_challenge_method', 'S256');
+        url.searchParams.set("provider", provider);
+        url.searchParams.set("redirect_uri", this.redirectUri);
+        url.searchParams.set("state", state);
+        url.searchParams.set("code_challenge", challenge);
+        url.searchParams.set("code_challenge_method", "S256");
         if (params?.rvid)
-            url.searchParams.set('rvid', params.rvid);
+            url.searchParams.set("rvid", params.rvid);
         await this.openExternal(url.toString());
     }
-    clearTransientState() {
-        this.removeString(this.verifierKey);
-        this.removeString(this.stateKey);
-    }
 }
-function normalizeProvider(value) {
-    return value === 'google' || value === 'apple' ? value : null;
+function isProvider(value) {
+    return value === "google" || value === "apple";
 }
-/** RFC 7636 code verifier: base64url of 32 random bytes (43 chars, unreserved). */
-function generateCodeVerifier() {
-    const bytes = new Uint8Array(32);
+function randomBytes(length) {
+    const bytes = new Uint8Array(length);
     crypto.getRandomValues(bytes);
-    return base64UrlEncode(bytes.buffer);
+    return bytes;
 }
-/** S256 challenge: base64url(SHA-256(verifier)). */
-async function deriveCodeChallenge(verifier) {
-    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
-    return base64UrlEncode(digest);
+function base64Url(buffer) {
+    const bytes = buffer instanceof Uint8Array ? buffer : new Uint8Array(buffer);
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary)
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
 }
-function generateState() {
-    const bytes = new Uint8Array(16);
-    crypto.getRandomValues(bytes);
-    return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
-}
-function base64UrlEncode(buffer) {
-    const bytes = new Uint8Array(buffer);
-    let binary = '';
-    for (let i = 0; i < bytes.length; i++) {
-        binary += String.fromCharCode(bytes[i]);
+async function readJson(response) {
+    try {
+        return (await response.json());
+    }
+    catch {
+        return null;
     }
-    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
 }
 //# sourceMappingURL=auth-native.js.map