@scaleway/auth-scw 1.0.0

package/LICENSE.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2021 Scaleway
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,69 @@
+# Scaleway - Auth Scw
+
+This package contains a React Context Provider which will help to handle authentication workflow within an app.
+
+## Install
+
+```bash
+pnpm add @scaleway/auth-scw
+```
+
+## Usage
+
+...
+
+## How to dev
+
+### Prerequisites
+
+```
+cd packages/auth-scw
+```
+
+### Start
+
+```bash
+pnpm build # Build the package
+pnpm watch # Build the package and watch for changes
+```
+
+# Repo pattern
+
+## How does renew token works? Single or multiple organisation
+
+**Reminder:** A COOKIE is used to syncronise jwt between tabs
+
+When users open severals tabs, syncronoisation of token between tabs can become tedious, here are the scenarios:
+
+### Single organisation
+
+Let say you have 2 tabs on the same organisation, `tab1`, `tab2` with the same JWT, let's call it, `JWT_A`
+
+1. you navigate on `tab2` and after 1h renew your `JWT_A` (and update the cookie) with a new jwt called `JWT_B`
+2. now `tab1` has a React state with an expired `JWT_A` and tabs 2 has renewed its jwt with `JWT_B`
+3. you leave for 1h. You come back on the console app after the `JWT_B` on `tab2` has expired
+4. `tab1` AND `tab2` have both a different expired jwt, `JWT_A` and `JWT_B`
+5. you go on `tab1` do an action on the console => a request is sent
+6. The code will check, React state `JWT_A` is expired then check Cookie `JWT_B` is also expired
+
+// A long term bug use to be:
+
+1. A renew request on `tab1` is attempted with `JWT_A` renew token (which has already been used on step 1)
+2. the API trigger an error telling you (more or less) that this `JWT_A` for renew has already been used (which is fair)
+
+// Bug corrected
+
+1. A renew request on `tab1` is attempted with the last JWT from cookie (so JWT_B) and also because both tabs are on the same organisation therefore, the same jwt can be used for both.
+2. the renew happen without issue and both tabs can be used without problems
+
+### Multiple organisation
+
+Alright, read the Single organisation scenario if you haven't.
+Here let's consider we have `tab1` and `tab2` on `Orga_A` with `JWT_A` and `tab3` on `Orga_B` with `JWT_B`:
+
+1. the last tab you opened is `tab3`, therefore, your cookie is set with `JWT_B` on `Orga_B`
+2. you navigate on `tab1` after 1h your `JWT_A` is being renewed in `JWT_A2` AND the app will use the React state instead of the cookie to have the renew token from `JWT_A`. Because the cookie hold `JWT_B` which is set on `Orga_B` and you are navigating on `tab1` which is on `Orga_A`
+3. Your renew happens without issue, you keep navigating on `tab1`
+4. if you switch tab and go to `tab2` then the app will attempt a `JWT_A` renew (remember `tab1` and `tab2` used both `JWT_A` that they had in their React state)
+   but this time because `JWT_A` has already been used on step 2 to renew, the request will **fail** and tell you `JWT_A` has already been used for renew => this will end up in disconnecting the user
+   At the moment we only use the cookie to syncronise tabs on only **ONE** organisation, but other tab which have switched organisation will not work because they are not using the same organisation than the cookie.

package/dist/constants.d.ts

@@ -0,0 +1,6 @@
+import { EncodedJWT } from "./types/index.js";
+
+//#region src/constants.d.ts
+declare const EmptySession: NonNullable<EncodedJWT>;
+//#endregion
+export { EmptySession };

package/dist/constants.js

@@ -0,0 +1,23 @@
+//#region src/constants.ts
+const EmptySession = {
+	jwt: {
+		audienceId: "",
+		createdAt: void 0,
+		expiresAt: void 0,
+		ip: "",
+		issuerId: "",
+		jti: "",
+		updatedAt: void 0,
+		userAgent: ""
+	},
+	renewToken: "",
+	token: ""
+};
+const COOKIE_CONFIG = {
+	httpOnly: false,
+	path: "/",
+	sameSite: "strict",
+	secure: true
+};
+//#endregion
+export { COOKIE_CONFIG, EmptySession };

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+import { AudienceIdType, AuthScwContextType, EncodedJWT } from "./types/index.js";
+import { EmptySession } from "./constants.js";
+import { AuthScwProvider, useAuthScw } from "./useAuthScw/AuthScwProvider.js";
+import { AuthStoreManager } from "./useAuthScw/authStoreManager.js";
+export { type AudienceIdType, type AuthScwContextType, AuthScwProvider, AuthStoreManager, EmptySession, type EncodedJWT, useAuthScw };

package/dist/index.js

@@ -0,0 +1,4 @@
+import { EmptySession } from "./constants.js";
+import { AuthStoreManager } from "./useAuthScw/authStoreManager.js";
+import { AuthScwProvider, useAuthScw } from "./useAuthScw/AuthScwProvider.js";
+export { AuthScwProvider, AuthStoreManager, EmptySession, useAuthScw };

package/dist/isExpired.js

@@ -0,0 +1,5 @@
+const isExpired = (expireTimestampRaw) => {
+	return Math.floor(Date.now() / 1e3) > expireTimestampRaw.getTime() / 1e3 - 30;
+};
+//#endregion
+export { isExpired };

package/dist/types/iam/index.d.ts

@@ -0,0 +1,9 @@
+import { API, DeleteJWTRequest, EncodedJWT, JWT, UnauthenticatedAPI, UnauthenticatedApiRenewJWTRequest } from "./types.js";
+
+//#region src/types/iam/index.d.ts
+declare namespace Iamv1alpha1 {
+  export type { API, UnauthenticatedAPI };
+  export type { DeleteJWTRequest, EncodedJWT, JWT, UnauthenticatedApiRenewJWTRequest };
+}
+//#endregion
+export { Iamv1alpha1 };

package/dist/types/iam/types.d.ts

@@ -0,0 +1,44 @@
+import { API } from "@scaleway/sdk-client";
+import { Iamv1alpha1 } from "@scaleway/sdk-iam";
+
+//#region src/types/iam/types.d.ts
+type JWT = Iamv1alpha1.JWT;
+type EncodedJWT = Iamv1alpha1.EncodedJWT;
+type DeleteJWTRequest = Iamv1alpha1.DeleteJWTRequest;
+type UnauthenticatedApiRenewJWTRequest = {
+  /**
+   * The JWT ID of the JWT to renew.
+   */
+  jti: string;
+  /**
+   * The renew token associated to the JWT to renew.
+   */
+  renewToken: string;
+};
+/**
+ * IAM API.
+
+This API allows you to manage Identity and Access Management (IAM) across your Scaleway Organizations, Projects and resources.
+ */
+declare class API$1 extends API {
+  /**
+   * Delete a JWT.
+   *
+   * @param request - The request {@link DeleteJWTRequest}
+   */
+  deleteJWT: (request: Readonly<DeleteJWTRequest>) => Promise<void>;
+}
+/**
+ * Unauthenticated API.
+ */
+declare class UnauthenticatedAPI extends API {
+  /**
+   * Renew a JWT.
+   *
+   * @param request - The request {@link UnauthenticatedApiRenewJWTRequest}
+   * @returns A Promise of EncodedJWT
+   */
+  renewJWT: (request: Readonly<UnauthenticatedApiRenewJWTRequest>) => Promise<EncodedJWT>;
+}
+//#endregion
+export { API$1 as API, DeleteJWTRequest, EncodedJWT, JWT, UnauthenticatedAPI, UnauthenticatedApiRenewJWTRequest };

package/dist/types/index.d.ts

@@ -0,0 +1,54 @@
+import { Iamv1alpha1 } from "./iam/index.js";
+import { audienceIdSchema, jwtSchema } from "../zodSchemas.js";
+import { z } from "zod";
+import { API, Client, Settings } from "@scaleway/sdk-client";
+
+//#region src/types/index.d.ts
+type EncodedJWT = z.infer<typeof jwtSchema>;
+type AudienceIdType = z.infer<typeof audienceIdSchema>;
+type OnError = (onError: {
+  title: string;
+  error: unknown;
+  extra?: Record<string, unknown>;
+}) => void;
+type GetJWT = (audienceId?: string) => Promise<(EncodedJWT & {
+  source: 'refreshSession' | 'cookie';
+}) | undefined>;
+type GetJwtTokenResponse = NonNullable<Awaited<ReturnType<GetJWT>>>['token'] | undefined;
+type AuthScwContextType = {
+  audienceId?: string;
+  setAudienceId: (audienceId: string) => void;
+  jti?: string;
+  encodeToken: (jwt: EncodedJWT) => string;
+  decodeToken: (encodedToken: string) => EncodedJWT | null;
+  setJWT: (jwtInfoParam: EncodedJWT) => void;
+  getJWT: GetJWT;
+  getJwtToken: (audienceId?: string) => Promise<GetJwtTokenResponse>;
+  logout: () => void;
+  authenticated: boolean;
+};
+declare class IamV1alpha1API extends API {
+  deleteJWT: Iamv1alpha1.API['deleteJWT'];
+}
+declare class IamV1alpha1UnauthenticatedAPI extends API {
+  renewJWT: Iamv1alpha1.UnauthenticatedAPI['renewJWT'];
+}
+type ConfigurationClientAPIs = {
+  IamV1Alpha1: {
+    new (client: Client): IamV1alpha1API;
+  };
+  IamUnauthenticatedV1Alpha1: {
+    new (client: Client): IamV1alpha1UnauthenticatedAPI;
+  };
+};
+type ConfigAuthProvider = {
+  clientSettings: Settings;
+} & ConfigurationClientAPIs;
+type CookieConfigType = {
+  httpOnly: boolean;
+  path: string;
+  sameSite: 'lax' | 'none' | 'strict' | boolean | undefined;
+  secure: boolean;
+};
+//#endregion
+export { AudienceIdType, AuthScwContextType, ConfigAuthProvider, CookieConfigType, EncodedJWT, OnError };

package/dist/useAuthScw/AuthScwProvider.d.ts

@@ -0,0 +1,24 @@
+import { AuthScwContextType, ConfigAuthProvider, CookieConfigType, OnError } from "../types/index.js";
+import { ReactNode } from "react";
+
+//#region src/useAuthScw/AuthScwProvider.d.ts
+type AuthProviderParamType = ConfigAuthProvider & {
+  children: ReactNode;
+  cookieSuffix: string;
+  urlParamTokenName: string;
+  onError?: OnError;
+  cookieConfig?: CookieConfigType;
+};
+declare const useAuthScw: () => AuthScwContextType;
+declare const AuthScwProvider: ({
+  clientSettings,
+  IamV1Alpha1,
+  IamUnauthenticatedV1Alpha1,
+  children,
+  cookieSuffix,
+  cookieConfig,
+  urlParamTokenName,
+  onError
+}: AuthProviderParamType) => import("react").JSX.Element;
+//#endregion
+export { AuthScwProvider, useAuthScw };

package/dist/useAuthScw/AuthScwProvider.js

@@ -0,0 +1,129 @@
+import { isExpired } from "../isExpired.js";
+import { AuthStoreManager, setCookieConfig } from "./authStoreManager.js";
+import { clientSingleton } from "./createClient.js";
+import { decodeToken, encodeToken, getCookieJWT, refreshSession } from "./helpers.js";
+import { proxyJwt } from "./proxyJwt.js";
+import { createContext, useCallback, useContext, useMemo, useState } from "react";
+import { jsx } from "react/jsx-runtime";
+//#region src/useAuthScw/AuthScwProvider.tsx
+const AuthScwContext = createContext({});
+const useAuthScw = () => useContext(AuthScwContext);
+const AuthScwProvider = ({ clientSettings, IamV1Alpha1, IamUnauthenticatedV1Alpha1, children, cookieSuffix, cookieConfig, urlParamTokenName, onError }) => {
+	if (cookieConfig) setCookieConfig(cookieConfig);
+	clientSingleton.setAPIsAndSettings({
+		clientSettings,
+		IamV1Alpha1,
+		IamUnauthenticatedV1Alpha1
+	});
+	const initAudienceId = useCallback(() => {
+		AuthStoreManager.setSuffixKey(cookieSuffix);
+		const currentUrl = new URL(globalThis.location.href);
+		const tokenRaw = currentUrl.searchParams.get(urlParamTokenName);
+		if (tokenRaw) {
+			currentUrl.searchParams.delete(urlParamTokenName);
+			const token = decodeToken(tokenRaw);
+			if (token) {
+				const jwtProxy = proxyJwt(token);
+				if (jwtProxy.jwt) AuthStoreManager.setJwt({ jwtInfo: jwtProxy });
+				globalThis.history.replaceState({}, "", currentUrl);
+				return jwtProxy.jwt?.audienceId;
+			}
+		}
+		const audienceId = AuthStoreManager.getAudienceId();
+		if (audienceId) {
+			if (AuthStoreManager.getJwt(audienceId)) return audienceId;
+		}
+	}, [cookieSuffix, urlParamTokenName]);
+	const [currentAudienceId, setCurrentAudienceId] = useState(() => initAudienceId());
+	const setJWT = useCallback((jwtInfoParam) => {
+		const currentJWT = proxyJwt(jwtInfoParam);
+		if (currentJWT.jwt?.audienceId) {
+			AuthStoreManager.setJwt({ jwtInfo: currentJWT });
+			setCurrentAudienceId(currentJWT.jwt.audienceId);
+		}
+	}, [setCurrentAudienceId]);
+	const getJWT = useCallback(async (audienceId = currentAudienceId) => {
+		if (audienceId) {
+			const cookieJWT = getCookieJWT(audienceId);
+			if (cookieJWT?.jwt) {
+				const { renewToken, token, jwt: currentJWT } = cookieJWT;
+				if (currentJWT.expiresAt && !isExpired(new Date(currentJWT.expiresAt))) return {
+					jwt: currentJWT,
+					renewToken,
+					source: "cookie",
+					token
+				};
+				const jwtInfoData = await refreshSession({
+					onError,
+					paramsRenewRequest: {
+						jti: currentJWT.jti,
+						renewToken
+					},
+					setJWT
+				});
+				if (jwtInfoData) return {
+					jwt: jwtInfoData.jwt,
+					renewToken: jwtInfoData.renewToken,
+					source: "refreshSession",
+					token: jwtInfoData.token
+				};
+			}
+		}
+	}, [
+		currentAudienceId,
+		setJWT,
+		onError
+	]);
+	const getJwtToken = useCallback(async (audienceId) => {
+		const currentJWT = await getJWT(audienceId);
+		if (currentJWT) return currentJWT.token;
+	}, [getJWT]);
+	const logout = useCallback(() => {
+		if (currentAudienceId) {
+			const cookieJWT = getCookieJWT(currentAudienceId);
+			AuthStoreManager.deleteJwt(currentAudienceId);
+			if (cookieJWT?.jwt) {
+				const { deleteJWT } = clientSingleton.createClient({ getAsyncToken: getJwtToken });
+				deleteJWT?.({ jti: cookieJWT.jwt.jti }).catch(() => null);
+			}
+		}
+		AuthStoreManager.deleteAudienceId();
+		setCurrentAudienceId(void 0);
+	}, [getJwtToken, currentAudienceId]);
+	const jti = useMemo(() => {
+		if (currentAudienceId) {
+			const cookieJWT = getCookieJWT(currentAudienceId);
+			if (cookieJWT?.jwt) return cookieJWT.jwt.jti;
+		}
+	}, [currentAudienceId]);
+	const isAuthenticated = useMemo(() => !!(currentAudienceId && getCookieJWT(currentAudienceId)), [currentAudienceId]);
+	const setAudienceId = useCallback((audienceId) => {
+		setCurrentAudienceId(audienceId);
+	}, []);
+	return /* @__PURE__ */ jsx(AuthScwContext, {
+		value: useMemo(() => ({
+			audienceId: currentAudienceId ?? void 0,
+			authenticated: isAuthenticated,
+			decodeToken,
+			encodeToken,
+			getJWT,
+			getJwtToken,
+			jti,
+			logout,
+			setAudienceId,
+			setJWT
+		}), [
+			getJWT,
+			getJwtToken,
+			logout,
+			setJWT,
+			setAudienceId,
+			currentAudienceId,
+			isAuthenticated,
+			jti
+		]),
+		children
+	});
+};
+//#endregion
+export { AuthScwProvider, useAuthScw };

package/dist/useAuthScw/authStoreManager.d.ts

@@ -0,0 +1,29 @@
+import { AudienceIdType, EncodedJWT } from "../types/index.js";
+
+//#region src/useAuthScw/authStoreManager.d.ts
+declare const AuthStoreManager: {
+  COOKIE_AGE: number;
+  DOMAIN: string;
+  deleteAllJwts(): void;
+  deleteAudienceId(): void;
+  deleteJwt(audienceId: string): void;
+  getAudienceId(): string | null;
+  getJwt(audienceId: string): EncodedJWT | null;
+  getKeyAudienceId(): string;
+  getKeySession(audienceId: string): string;
+  getUniqueHostnameString: (inputString: string) => string;
+  SUFFIX_KEY: string;
+  setAudienceId(audienceId: string): void;
+  setJwt({
+    jwtInfo,
+    setAudienceId
+  }: {
+    jwtInfo: EncodedJWT;
+    setAudienceId?: boolean;
+  }): void;
+  setSuffixKey(key: string): void;
+  typeGuardAudienceId(untypedObject: unknown): untypedObject is AudienceIdType;
+  typeGuardJWT(untypedObject: unknown): untypedObject is EncodedJWT;
+};
+//#endregion
+export { AuthStoreManager };

package/dist/useAuthScw/authStoreManager.js

@@ -0,0 +1,105 @@
+import { COOKIE_CONFIG } from "../constants.js";
+import { audienceIdSchema, jwtSchema } from "../zodSchemas.js";
+import { parseCookie, stringifySetCookie } from "cookie";
+//#region src/useAuthScw/authStoreManager.ts
+const KEY_SESSION = "_scw_session";
+const KEY_AUDIENCE_ID = "_scw_audience_id";
+const DEFAULT_SUFFIX_KEY = "";
+const COOKIE_AGE = 3600 * 24 * 31;
+let cookieConfig = COOKIE_CONFIG;
+const DOMAIN = typeof window !== "undefined" ? globalThis.location.hostname : "";
+const getUniqueHostnameString = (inputString) => inputString.replaceAll(".", "_").replaceAll("-", "_");
+const setCookieConfig = (COOKIE_CONFIG_PARAM) => cookieConfig = COOKIE_CONFIG_PARAM;
+const setCookie = (value, key, maxAge = COOKIE_AGE) => {
+	document.cookie = stringifySetCookie({
+		name: key,
+		value: JSON.stringify(value),
+		domain: DOMAIN,
+		httpOnly: cookieConfig.httpOnly,
+		maxAge,
+		path: cookieConfig.path,
+		sameSite: cookieConfig.sameSite,
+		secure: cookieConfig.secure
+	});
+};
+const getCookie = (key) => {
+	const cookies = parseCookie(document.cookie);
+	if (key in cookies && cookies[key]) {
+		const cookieSessionString = cookies[key];
+		if (cookieSessionString) return JSON.parse(cookieSessionString);
+		return null;
+	}
+	return null;
+};
+const deleteCookie = (key) => {
+	document.cookie = stringifySetCookie({
+		name: key,
+		value: "",
+		domain: DOMAIN,
+		httpOnly: cookieConfig.httpOnly,
+		maxAge: -1,
+		path: cookieConfig.path,
+		sameSite: cookieConfig.sameSite,
+		secure: cookieConfig.secure
+	});
+};
+const AuthStoreManager = {
+	COOKIE_AGE,
+	DOMAIN,
+	deleteAllJwts() {
+		const prefix = AuthStoreManager.getKeySession("");
+		document.cookie.split(";").forEach((cookieParam) => {
+			let [audienceId] = cookieParam.split("=");
+			if (audienceId) {
+				audienceId = audienceId.trim();
+				if (audienceId.startsWith(prefix)) this.deleteJwt(audienceId);
+			}
+		});
+	},
+	deleteAudienceId() {
+		deleteCookie(AuthStoreManager.getKeyAudienceId());
+	},
+	deleteJwt(audienceId) {
+		deleteCookie(AuthStoreManager.getKeySession(audienceId));
+	},
+	getAudienceId() {
+		const cookieParsed = getCookie(AuthStoreManager.getKeyAudienceId());
+		const resultCookieParsed = audienceIdSchema.safeParse(cookieParsed);
+		if (resultCookieParsed.success) return resultCookieParsed.data.audienceId;
+		return null;
+	},
+	getJwt(audienceId) {
+		const cookieParsed = getCookie(AuthStoreManager.getKeySession(audienceId));
+		const resultCookieParsed = jwtSchema.safeParse(cookieParsed);
+		if (resultCookieParsed.success) return resultCookieParsed.data;
+		if (resultCookieParsed.error) {}
+		return null;
+	},
+	getKeyAudienceId() {
+		return `${KEY_AUDIENCE_ID}${AuthStoreManager.SUFFIX_KEY}`;
+	},
+	getKeySession(audienceId) {
+		return `${KEY_SESSION}${AuthStoreManager.SUFFIX_KEY}_${audienceId}`;
+	},
+	getUniqueHostnameString,
+	SUFFIX_KEY: DEFAULT_SUFFIX_KEY,
+	setAudienceId(audienceId) {
+		setCookie({ audienceId }, AuthStoreManager.getKeyAudienceId());
+	},
+	setJwt({ jwtInfo, setAudienceId = true }) {
+		const audienceId = jwtInfo.jwt?.audienceId;
+		setCookie(jwtInfo, AuthStoreManager.getKeySession(audienceId));
+		if (setAudienceId) this.setAudienceId(audienceId);
+	},
+	setSuffixKey(key) {
+		AuthStoreManager.SUFFIX_KEY = key ? `_${key}` : DEFAULT_SUFFIX_KEY;
+	},
+	typeGuardAudienceId(untypedObject) {
+		return audienceIdSchema.safeParse(untypedObject).success;
+	},
+	typeGuardJWT(untypedObject) {
+		return jwtSchema.safeParse(untypedObject).success;
+	}
+};
+//#endregion
+export { AuthStoreManager, setCookieConfig };

package/dist/useAuthScw/createClient.js

@@ -0,0 +1,24 @@
+import { SESSION_HEADER_KEY, addAsyncHeaderInterceptor, createAdvancedClient, withAdditionalInterceptors, withProfile } from "@scaleway/sdk-client";
+//#region src/useAuthScw/createClient.ts
+const clientSingleton = {
+	IamV1Alpha1: void 0,
+	IamUnauthenticatedV1Alpha1: void 0,
+	clientSettings: void 0,
+	setAPIsAndSettings({ IamV1Alpha1, IamUnauthenticatedV1Alpha1, clientSettings }) {
+		this.IamV1Alpha1 = IamV1Alpha1;
+		this.IamUnauthenticatedV1Alpha1 = IamUnauthenticatedV1Alpha1;
+		this.clientSettings = clientSettings;
+	},
+	createClient({ getAsyncToken }) {
+		if (!this.IamV1Alpha1 || !this.IamUnauthenticatedV1Alpha1 || !this.clientSettings) throw "You must set apis and client settings to use package: auth-scw";
+		const client = createAdvancedClient(withProfile(this.clientSettings), withAdditionalInterceptors([...this.clientSettings.interceptors, { request: async ({ request }) => getAsyncToken ? addAsyncHeaderInterceptor(SESSION_HEADER_KEY, getAsyncToken)({ request }) : request }]));
+		const iamv1alpha1API = new this.IamV1Alpha1(client);
+		const iamUnauthenticatedV1Alpha1API = new this.IamUnauthenticatedV1Alpha1(client);
+		return {
+			deleteJWT: iamv1alpha1API.deleteJWT,
+			renewJWT: iamUnauthenticatedV1Alpha1API.renewJWT
+		};
+	}
+};
+//#endregion
+export { clientSingleton };

package/dist/useAuthScw/helpers.js

@@ -0,0 +1,40 @@
+import { AuthStoreManager } from "./authStoreManager.js";
+import { clientSingleton } from "./createClient.js";
+import { Errors } from "@scaleway/sdk-client";
+//#region src/useAuthScw/helpers.ts
+let refreshSessionPromise;
+const refreshSession = ({ paramsRenewRequest, setJWT, onError }) => {
+	if (refreshSessionPromise !== void 0) return refreshSessionPromise;
+	const { renewJWT } = clientSingleton.createClient({});
+	refreshSessionPromise = renewJWT(paramsRenewRequest).then((jwtInfo) => {
+		setJWT(jwtInfo);
+		return jwtInfo;
+	}).catch((error) => {
+		if (onError) onError({
+			error,
+			extra: {
+				iframe: globalThis.self !== globalThis.top,
+				jti: paramsRenewRequest.jti,
+				message: error instanceof Errors.ScalewayError ? error.rawMessage : void 0,
+				renewToken: paramsRenewRequest.renewToken
+			},
+			title: "Renew token failed"
+		});
+	}).finally(() => {
+		refreshSessionPromise = void 0;
+	});
+	return refreshSessionPromise;
+};
+const decodeToken = (encodedToken) => {
+	try {
+		const decodedTokenRaw = JSON.parse(atob(encodedToken));
+		if (AuthStoreManager.typeGuardJWT(decodedTokenRaw)) return decodedTokenRaw;
+		return null;
+	} catch {
+		return null;
+	}
+};
+const encodeToken = (jwt) => btoa(JSON.stringify(jwt));
+const getCookieJWT = (audienceId) => AuthStoreManager.getJwt(audienceId);
+//#endregion
+export { decodeToken, encodeToken, getCookieJWT, refreshSession };

package/dist/useAuthScw/index.d.ts

@@ -0,0 +1 @@
+import { AuthScwProvider, useAuthScw } from "./AuthScwProvider.js";

package/dist/useAuthScw/proxyJwt.js

@@ -0,0 +1,29 @@
+import { subMinutes, subSeconds } from "date-fns";
+//#region src/useAuthScw/proxyJwt.ts
+const defaultUpdateValue = {
+	shouldOutdated: false,
+	subMinuteOfExpires: 59,
+	subSecondesOfExpires: 20
+};
+/**
+* This function is only use for Development purpose only !!!
+* internal only
+* @param jwtInfoParam
+* @param shouldOutdatedJWT
+* @returns jwt
+*/
+const proxyJwt = (jwtInfoParam, updateJwt = defaultUpdateValue) => {
+	if (updateJwt.shouldOutdated) {
+		const oldJwt = {
+			...jwtInfoParam.jwt,
+			expiresAt: jwtInfoParam.jwt?.expiresAt ? subSeconds(subMinutes(new Date(jwtInfoParam.jwt.expiresAt), updateJwt.subMinuteOfExpires), updateJwt.subSecondesOfExpires) : void 0
+		};
+		return {
+			...jwtInfoParam,
+			jwt: oldJwt
+		};
+	}
+	return jwtInfoParam;
+};
+//#endregion
+export { proxyJwt };

package/dist/zodSchemas.d.ts

@@ -0,0 +1,20 @@
+import { Iamv1alpha1 } from "./types/iam/index.js";
+import { z } from "zod";
+
+//#region src/zodSchemas.d.ts
+type TransformJWT = Omit<Iamv1alpha1.JWT, 'createdAt' | 'updatedAt' | 'expiresAt'> & {
+  createdAt?: string | Date;
+  updatedAt?: string | Date;
+  expiresAt?: string | Date;
+};
+type ValidateJWTSchema = {
+  jwt?: TransformJWT;
+  token: string;
+  renewToken: string;
+};
+declare const jwtSchema: z.ZodType<ValidateJWTSchema>;
+declare const audienceIdSchema: z.ZodObject<{
+  audienceId: z.ZodString;
+}, z.core.$strip>;
+//#endregion
+export { audienceIdSchema, jwtSchema };

package/dist/zodSchemas.js

@@ -0,0 +1,19 @@
+import { z } from "zod";
+//#region src/zodSchemas.ts
+const jwtSchema = z.object({
+	jwt: z.object({
+		audienceId: z.string().min(1),
+		createdAt: z.union([z.string().min(1), z.date()]).optional(),
+		expiresAt: z.union([z.string().min(1), z.date()]).optional(),
+		ip: z.string().min(1),
+		issuerId: z.string().min(1),
+		jti: z.string().min(1),
+		updatedAt: z.union([z.string().min(1), z.date()]).optional(),
+		userAgent: z.string().min(1)
+	}),
+	renewToken: z.string().min(1),
+	token: z.string().min(1)
+});
+const audienceIdSchema = z.object({ audienceId: z.string().min(1) });
+//#endregion
+export { audienceIdSchema, jwtSchema };

package/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "@scaleway/auth-scw",
+  "version": "1.0.0",
+  "description": "Auth Scaleway",
+  "homepage": "https://github.com/scaleway/scaleway-lib/tree/main/packages/auth-scw",
+  "bugs": {
+    "url": "https://github.com/scaleway/scaleway-lib/issues"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/scaleway/scaleway-lib.git",
+    "directory": "packages/auth-scw"
+  },
+  "files": [
+    "dist/*"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": "./dist/index.js",
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "@scaleway/sdk-client": "2.4.1",
+    "@scaleway/sdk-iam": "2.9.4",
+    "@types/react": "19.2.17",
+    "cookie": "2.0.0",
+    "date-fns": "4.4.0",
+    "react": "19.2.7",
+    "zod": "4.4.3"
+  },
+  "peerDependencies": {
+    "@scaleway/sdk-client": "2.4.1",
+    "@scaleway/sdk-iam": "2.9.4",
+    "cookie": "2.0.0",
+    "date-fns": "4.4.0",
+    "react": "19.2.7",
+    "zod": "4.4.3"
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "build": "tsdown",
+    "test:unit": "vitest --run",
+    "test:unit:coverage": "pnpm test:unit --coverage"
+  }
+}