@schemavaults/auth-client-sdk 0.17.2 → 0.18.6

package/dist/lib/exchange-auth-tokens.js

@@ -1,48 +1,36 @@
-import { createRefreshTokenPOSTBodySchema, createRequestTokensResultSchema, } from "@schemavaults/auth-common";
-import { z } from "zod";
-export async function exchangeAuthTokens({ refreshToken, audience, debug, environment, auth_server_uri, auth_server_app_id, client_app_id, adapter, handleSuccessfulExchangeAuthTokensResponse, logout, }) {
+// exchange-auth-tokens.ts
+//
+// Redeems a refresh token at the auth server's standard OIDC token
+// endpoint (/api/oidc/token, grant_type=refresh_token) via
+// `openid-client`. The endpoint mints ONE access token per request
+// (RFC 8707 `resource`), so a multi-audience exchange is a sequence of
+// refresh grants — each rotating the refresh token, so each subsequent
+// grant presents the token the previous one returned.
+import * as oidc from "openid-client";
+import { OIDC_USERINFO_AUDIENCE_ID, } from "@schemavaults/app-definitions";
+import { OIDC_TOKEN_REFRESH_TOKEN_DELIVERY_PARAM, OIDC_TOKEN_RESOURCE_PARAM, } from "@schemavaults/auth-common";
+import { classifyOidcTokenError, createOidcClientConfiguration, normalizeOidcIssuer, tokenEndpointResponseToTokensRecord, } from "./oidc";
+function normalizeAudiences(audience) {
+    if (Array.isArray(audience)) {
+        return audience.filter((a) => typeof a === "string" && a.length > 0);
+    }
+    return typeof audience === "string" && audience.length > 0 ? [audience] : [];
+}
+export async function exchangeAuthTokens({ refreshToken, audience, debug, environment, auth_server_uri, client_app_id, adapter, fetchUserData, handleSuccessfulExchangeAuthTokensResponse, logout, }) {
     if (debug) {
         console.log("[SchemaVaultsAuthClient] Attempting to send request to exchange refresh token for access token...");
     }
-    const exchange_refresh_token_endpoint = new URL(`/api/auth/token/refresh_token/${client_app_id}`, auth_server_uri);
-    // An empty audience list is a rotation-only request: the server always
-    // rotates the refresh token, so the exchange still yields a fresh
-    // refresh token (and updated user data) even when no access tokens are
-    // requested.
-    const refreshTokenPOSTBodySchema = createRefreshTokenPOSTBodySchema(z, environment, { auth_server_url: auth_server_uri, auth_server_app_id });
-    // Exchange the authorization code for an access token
-    let request_body;
-    try {
-        const parsed = await refreshTokenPOSTBodySchema.safeParseAsync({
-            grant_type: "refresh_token",
-            client_app_id,
-            audience: audience,
-        });
-        if (!parsed.success) {
-            console.error(parsed.error);
-            throw new Error("Failed to parse tokens from exchange auth tokens POST request!");
-        }
-        request_body = parsed.data;
-    }
-    catch (e) {
-        if (debug) {
-            console.error("Failed to prepare request body for authorization grant request: ", e);
-        }
-        throw new Error("Failed to prepare request body for authorization grant request");
-    }
-    const exchangeAuthTokensReqHeaders = {
-        "Content-Type": "application/json",
-    };
     if (!refreshToken) {
         throw new Error("Did not receive a refresh token to exchange for access token!");
     }
+    // ---- Which refresh token, and how is it presented? -----------------
+    let useHttpOnlyCookie;
     if (typeof refreshToken === "object" && refreshToken.type === "refresh") {
         if (typeof refreshToken.token !== "string" ||
             refreshToken.token.length === 0) {
             throw new TypeError("Expected 'token' to be a non-empty string!");
         }
-        exchangeAuthTokensReqHeaders["Authorization"] =
-            `Bearer ${refreshToken.token}`;
+        useHttpOnlyCookie = false;
     }
     else if (typeof refreshToken === "string" &&
         refreshToken === "AS_HTTP_ONLY_COOKIE") {
@@ -52,91 +40,125 @@ export async function exchangeAuthTokens({ refreshToken, audience, debug, enviro
         if (!adapter.doesSupportHttpOnlyRefreshToken()) {
             throw new Error("Adapter does not support HTTP-only refresh tokens! Adapter method 'doesSupportHttpOnlyRefreshToken' returned falsy result!");
         }
+        useHttpOnlyCookie = true;
     }
     else {
         throw new Error("Did not receive a valid refresh token (or valid method of acquiring refresh token)");
     }
-    if (debug) {
-        console.log("[SchemaVaultsAuthClient::exchangeAuthTokens()] " +
-            `Sending POST request to "${exchange_refresh_token_endpoint.toString()}" with body & headers:`, request_body, exchangeAuthTokensReqHeaders);
+    // ---- Resolve the user id for the token record ----------------------
+    // The refresh grant response carries no id_token (OIDC Core §12.2), so
+    // the subject comes from the cached user data — or, on a cold cache,
+    // from the auth server's whoami endpoint (authenticated with the
+    // refresh token we are about to rotate).
+    let uid = adapter.getUserData()?.uid;
+    if (!uid) {
+        const user = await fetchUserData();
+        if (!user) {
+            await logout();
+            throw new Error("Session expired: the auth server no longer recognizes this session");
+        }
+        uid = user.uid;
     }
-    let tokens_response_data;
-    try {
+    // ---- The grant(s) --------------------------------------------------
+    const config = createOidcClientConfiguration({
+        auth_server_url: auth_server_uri,
+        client_app_id,
+        environment,
+        adapter,
+    });
+    const issuer = normalizeOidcIssuer(auth_server_uri);
+    // An empty audience list is a rotation-only request: one grant with no
+    // `resource` (its access token is for the reserved userinfo audience).
+    const audiences = normalizeAudiences(audience);
+    const grants = audiences.length > 0 ? audiences : [null];
+    const access = {};
+    let current = refreshToken;
+    let last_record;
+    for (const resource of grants) {
+        const parameters = new URLSearchParams();
+        if (resource) {
+            parameters.set(OIDC_TOKEN_RESOURCE_PARAM, resource);
+        }
+        if (useHttpOnlyCookie) {
+            parameters.set(OIDC_TOKEN_REFRESH_TOKEN_DELIVERY_PARAM, "http_only_cookie");
+        }
         if (debug) {
-            console.log(`POST => ${exchange_refresh_token_endpoint}`);
+            console.log("[SchemaVaultsAuthClient::exchangeAuthTokens()] " +
+                `Sending refresh grant to "${config.serverMetadata().token_endpoint}" with parameters:`, Object.fromEntries(parameters.entries()), useHttpOnlyCookie
+                ? "(refresh token presented via HTTP-only cookie)"
+                : "(refresh token presented inline)");
         }
-        const response = await adapter.fetch(exchange_refresh_token_endpoint.toString(), {
-            body: JSON.stringify(request_body),
-            method: "POST",
-            headers: exchangeAuthTokensReqHeaders,
-            credentials: "include",
-        });
-        if (!response || typeof response !== "object" || response.status !== 200) {
-            let serverMessage = "unknown error";
-            try {
-                const errorBody = await response.json();
-                if (errorBody &&
-                    typeof errorBody === "object" &&
-                    "message" in errorBody &&
-                    typeof errorBody.message === "string") {
-                    serverMessage = errorBody.message;
+        let response;
+        try {
+            if (useHttpOnlyCookie) {
+                // The refresh token lives in the auth server's HTTP-only cookie,
+                // which the adapter's fetch sends with the request; the form
+                // therefore carries no `refresh_token` parameter.
+                response = await oidc.genericGrantRequest(config, "refresh_token", parameters);
+            }
+            else {
+                if (typeof current !== "object") {
+                    throw new Error("Refresh token rotation switched to cookie delivery mid-exchange");
                 }
+                response = await oidc.refreshTokenGrant(config, current.token, parameters);
             }
-            catch {
-                // Response body may not be valid JSON
+        }
+        catch (e) {
+            const classified = classifyOidcTokenError(e);
+            if (debug) {
+                console.error("[exchangeAuthTokens] Refresh grant failed: ", e);
             }
-            if (response.status === 403 || response.status === 401) {
-                console.error(`${response.status} error response from exchange token attempt, client is not logged in! Server: ${serverMessage}`);
+            if (classified.session_lost) {
+                console.error(`Refresh grant rejected by the auth server (${classified.message}); client is no longer logged in.`);
                 await logout();
-                const sessionExpiredMsg = `Session expired (HTTP ${response.status}): ${serverMessage}`;
-                // Guard: downstream error handlers (acquire-access-token.ts, etc.) detect session
-                // expiry by checking if the error message includes "expired". If the message format
-                // is ever refactored and that keyword is accidentally removed, the entire expired-session
-                // detection chain breaks silently. This check ensures the contract is always upheld.
-                if (!sessionExpiredMsg.toLowerCase().includes("expired")) {
-                    throw new Error("Session expired");
-                }
-                throw new Error(sessionExpiredMsg);
+                // Downstream handlers (acquire-access-token.ts, etc.) detect an
+                // unrecoverable session by the "expired" keyword in the message.
+                throw new Error("Refresh token has expired!", { cause: e });
             }
-            throw new Error(`Token exchange failed (HTTP ${response.status}): ${serverMessage}`);
+            throw new Error(`Token exchange failed: ${classified.message}`, {
+                cause: e,
+            });
         }
-        const parsed_tokens_result = await createRequestTokensResultSchema(z, environment, { auth_server_url: auth_server_uri, auth_server_app_id }).safeParseAsync(await response.json());
-        if (!parsed_tokens_result.success) {
-            console.error("Failed to parse tokens response from server: ", parsed_tokens_result.error);
-            throw new Error("Failed to parse tokens response from server!");
+        let record;
+        try {
+            record = tokenEndpointResponseToTokensRecord({
+                response,
+                audience: resource ?? OIDC_USERINFO_AUDIENCE_ID,
+                uid,
+                auth_server_url: issuer,
+            });
         }
-        tokens_response_data = parsed_tokens_result.data;
-    }
-    catch (e) {
-        if (debug) {
-            console.error("[exchangeAuthTokens] FETCH FAILED: ", e);
+        catch (e) {
+            console.error("Failed to parse tokens response from server: ", e);
+            throw new Error("Failed to parse tokens response from server!", {
+                cause: e,
+            });
         }
-        if (e instanceof Error) {
-            const eMsg = e.message.toLowerCase();
-            if (eMsg.includes("expired") ||
-                eMsg.includes("jwtexpired") ||
-                eMsg.includes("err_jwt_expired")) {
-                console.error("Refresh token appears to have expired!");
-                throw new Error("Refresh token has expired!");
-            }
+        Object.assign(access, record.access ?? {});
+        if (typeof record.refresh === "object") {
+            // Rotation: the next grant must present the replacement token.
+            current = record.refresh;
         }
-        throw e instanceof Error
-            ? e
-            : new Error("Failed to exchange refresh token for access token");
+        last_record = record;
     }
+    if (!last_record) {
+        throw new Error("No refresh grant was performed");
+    }
+    const merged = {
+        access,
+        refresh: last_record.refresh,
+        ...(typeof last_record.refresh_token_expiry === "number"
+            ? { refresh_token_expiry: last_record.refresh_token_expiry }
+            : {}),
+    };
     try {
-        // Parse tokens from response JSON body
-        return await handleSuccessfulExchangeAuthTokensResponse(tokens_response_data);
+        return await handleSuccessfulExchangeAuthTokensResponse(merged);
     }
     catch (e) {
         if (debug) {
-            console.log("typeof e === ", typeof e);
-            if (e instanceof Error) {
-                console.error("Parse tokens error message: ", e.message);
-            }
-            console.error("Failed to parse authentication tokens from exchange tokens POST request: ", e);
+            console.error("Failed to store authentication tokens from refresh grant: ", e);
         }
-        throw new Error("Failed to parse authentication tokens from exchange tokens POST request!");
+        throw new Error("Failed to parse authentication tokens from exchange tokens POST request!", { cause: e });
     }
 }
 export default exchangeAuthTokens;

package/dist/lib/exchange-auth-tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"exchange-auth-tokens.js","sourceRoot":"","sources":["../../src/lib/exchange-auth-tokens.ts"],"names":[],"mappings":"AAKA,OAAO,EAEL,gCAAgC,EAEhC,+BAA+B,GAEhC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAsBxB,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,YAAY,EACZ,QAAQ,EACR,KAAK,EACL,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,OAAO,EACP,0CAA0C,EAC1C,MAAM,GACkB;IACxB,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,mGAAmG,CACpG,CAAC;IACJ,CAAC;IAED,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAC7C,iCAAiC,aAAa,EAAW,EACzD,eAAe,CAChB,CAAC;IAEF,uEAAuE;IACvE,kEAAkE;IAClE,uEAAuE;IACvE,aAAa;IACb,MAAM,0BAA0B,GAAG,gCAAgC,CACjE,CAAC,EACD,WAAW,EACX,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EAAE,CACzD,CAAC;IAEF,sDAAsD;IACtD,IAAI,YAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,cAAc,CAAC;YAC7D,UAAU,EAAE,eAAwB;YACpC,aAAa;YACb,QAAQ,EAAE,QAAQ;SACkC,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC;IAC7B,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,CACX,kEAAkE,EAClE,CAAC,CACF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,MAAM,4BAA4B,GAA2B;QAC3D,cAAc,EAAE,kBAAkB;KACnC,CAAC;IAEF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACxE,IACE,OAAO,YAAY,CAAC,KAAK,KAAK,QAAQ;YACtC,YAAY,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAC/B,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;QACpE,CAAC;QAED,4BAA4B,CAAC,eAAe,CAAC;YAC3C,UAAU,YAAY,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;SAAM,IACL,OAAO,YAAY,KAAK,QAAQ;QAChC,YAAY,KAAK,qBAAqB,EACtC,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,+BAA+B,KAAK,UAAU,EAAE,CAAC;YAClE,MAAM,IAAI,SAAS,CACjB,2HAA2H,CAC5H,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,+BAA+B,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,4HAA4H,CAC7H,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,iDAAiD;YAC/C,4BAA4B,+BAA+B,CAAC,QAAQ,EAAE,wBAAwB,EAChG,YAAY,EACZ,4BAA4B,CAC7B,CAAC;IACJ,CAAC;IAED,IAAI,oBAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,WAAW,+BAA+B,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,QAAQ,GAAa,MAAM,OAAO,CAAC,KAAK,CAC5C,+BAA+B,CAAC,QAAQ,EAAE,EAC1C;YACE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC;YAClC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,4BAA4B;YACrC,WAAW,EAAE,SAAS;SACvB,CACF,CAAC;QACF,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACzE,IAAI,aAAa,GAAG,eAAe,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,SAAS,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACjD,IACE,SAAS;oBACT,OAAO,SAAS,KAAK,QAAQ;oBAC7B,SAAS,IAAI,SAAS;oBACtB,OAAQ,SAAkC,CAAC,OAAO,KAAK,QAAQ,EAC/D,CAAC;oBACD,aAAa,GAAI,SAAiC,CAAC,OAAO,CAAC;gBAC7D,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,sCAAsC;YACxC,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvD,OAAO,CAAC,KAAK,CACX,GAAG,QAAQ,CAAC,MAAM,iFAAiF,aAAa,EAAE,CACnH,CAAC;gBACF,MAAM,MAAM,EAAE,CAAC;gBACf,MAAM,iBAAiB,GAAG,yBAAyB,QAAQ,CAAC,MAAM,MAAM,aAAa,EAAE,CAAC;gBACxF,kFAAkF;gBAClF,oFAAoF;gBACpF,0FAA0F;gBAC1F,qFAAqF;gBACrF,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;oBACzD,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACrC,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACrC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,+BAA+B,QAAQ,CAAC,MAAM,MAAM,aAAa,EAAE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,oBAAoB,GAAG,MAAM,+BAA+B,CAChE,CAAC,EACD,WAAW,EACX,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EAAE,CACzD,CAAC,cAAc,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,CAAC;YAClC,OAAO,CAAC,KAAK,CACX,+CAA+C,EAC/C,oBAAoB,CAAC,KAAK,CAC3B,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QAED,oBAAoB,GAAG,oBAAoB,CAAC,IAAI,CAAC;IACnD,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;YACvB,MAAM,IAAI,GAAW,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YAC7C,IACE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;gBACxB,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAC3B,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAChC,CAAC;gBACD,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;gBACxD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAED,MAAM,CAAC,YAAY,KAAK;YACtB,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,CAAC;QACH,uCAAuC;QACvC,OAAO,MAAM,0CAA0C,CACrD,oBAAoB,CACrB,CAAC;IACJ,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;YACvC,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;gBACvB,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,CAAC,KAAK,CACX,2EAA2E,EAC3E,CAAC,CACF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,eAAe,kBAAkB,CAAC"}
+{"version":3,"file":"exchange-auth-tokens.js","sourceRoot":"","sources":["../../src/lib/exchange-auth-tokens.ts"],"names":[],"mappings":"AAAA,0BAA0B;AAC1B,EAAE;AACF,mEAAmE;AACnE,2DAA2D;AAC3D,mEAAmE;AACnE,uEAAuE;AACvE,uEAAuE;AACvE,sDAAsD;AAEtD,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AAEtC,OAAO,EACL,yBAAyB,GAG1B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAEL,uCAAuC,EACvC,yBAAyB,GAI1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,mBAAmB,EACnB,mCAAmC,GACpC,MAAM,QAAQ,CAAC;AAgChB,SAAS,kBAAkB,CAAC,QAA2B;IACrD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,QAAQ,CAAC,MAAM,CACpB,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAC1D,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,YAAY,EACZ,QAAQ,EACR,KAAK,EACL,WAAW,EACX,eAAe,EACf,aAAa,EACb,OAAO,EACP,aAAa,EACb,0CAA0C,EAC1C,MAAM,GACkB;IACxB,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,mGAAmG,CACpG,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,IAAI,iBAA0B,CAAC;IAC/B,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACxE,IACE,OAAO,YAAY,CAAC,KAAK,KAAK,QAAQ;YACtC,YAAY,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAC/B,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;QACpE,CAAC;QACD,iBAAiB,GAAG,KAAK,CAAC;IAC5B,CAAC;SAAM,IACL,OAAO,YAAY,KAAK,QAAQ;QAChC,YAAY,KAAK,qBAAqB,EACtC,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,+BAA+B,KAAK,UAAU,EAAE,CAAC;YAClE,MAAM,IAAI,SAAS,CACjB,2HAA2H,CAC5H,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,+BAA+B,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,4HAA4H,CAC7H,CAAC;QACJ,CAAC;QACD,iBAAiB,GAAG,IAAI,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,qEAAqE;IACrE,iEAAiE;IACjE,yCAAyC;IACzC,IAAI,GAAG,GAAuB,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC;IACzD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,GAAoB,MAAM,aAAa,EAAE,CAAC;QACpD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,MAAM,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACxF,CAAC;QACD,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACjB,CAAC;IAED,uEAAuE;IACvE,MAAM,MAAM,GAAuB,6BAA6B,CAAC;QAC/D,eAAe,EAAE,eAAe;QAChC,aAAa;QACb,WAAW;QACX,OAAO;KACR,CAAC,CAAC;IACH,MAAM,MAAM,GAAW,mBAAmB,CAAC,eAAe,CAAC,CAAC;IAE5D,uEAAuE;IACvE,uEAAuE;IACvE,MAAM,SAAS,GAAsB,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAClE,MAAM,MAAM,GAAsB,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAE5E,MAAM,MAAM,GAAgC,EAAE,CAAC;IAC/C,IAAI,OAAO,GAAyC,YAAY,CAAC;IACjE,IAAI,WAA0D,CAAC;IAE/D,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YACb,UAAU,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,iBAAiB,EAAE,CAAC;YACtB,UAAU,CAAC,GAAG,CAAC,uCAAuC,EAAE,kBAAkB,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CACT,iDAAiD;gBAC/C,6BAA6B,MAAM,CAAC,cAAc,EAAE,CAAC,cAAc,oBAAoB,EACzF,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,EACxC,iBAAiB;gBACf,CAAC,CAAC,gDAAgD;gBAClD,CAAC,CAAC,kCAAkC,CACvC,CAAC;QACJ,CAAC;QAED,IAAI,QAAwE,CAAC;QAC7E,IAAI,CAAC;YACH,IAAI,iBAAiB,EAAE,CAAC;gBACtB,iEAAiE;gBACjE,6DAA6D;gBAC7D,kDAAkD;gBAClD,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CACvC,MAAM,EACN,eAAe,EACf,UAAU,CACX,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;oBAChC,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;gBACJ,CAAC;gBACD,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CACrC,MAAM,EACN,OAAO,CAAC,KAAK,EACb,UAAU,CACX,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,MAAM,UAAU,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAC;YAC7C,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,UAAU,CAAC,YAAY,EAAE,CAAC;gBAC5B,OAAO,CAAC,KAAK,CACX,8CAA8C,UAAU,CAAC,OAAO,mCAAmC,CACpG,CAAC;gBACF,MAAM,MAAM,EAAE,CAAC;gBACf,gEAAgE;gBAChE,iEAAiE;gBACjE,MAAM,IAAI,KAAK,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,0BAA0B,UAAU,CAAC,OAAO,EAAE,EAAE;gBAC9D,KAAK,EAAE,CAAC;aACT,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAyC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,GAAG,mCAAmC,CAAC;gBAC3C,QAAQ;gBACR,QAAQ,EAAE,QAAQ,IAAI,yBAAyB;gBAC/C,GAAG;gBACH,eAAe,EAAE,MAAM;aACxB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,8CAA8C,EAAE;gBAC9D,KAAK,EAAE,CAAC;aACT,CAAC,CAAC;QACL,CAAC;QAED,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACvC,+DAA+D;YAC/D,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC3B,CAAC;QACD,WAAW,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,MAAM,GAAsC;QAChD,MAAM;QACN,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,GAAG,CAAC,OAAO,WAAW,CAAC,oBAAoB,KAAK,QAAQ;YACtD,CAAC,CAAC,EAAE,oBAAoB,EAAE,WAAW,CAAC,oBAAoB,EAAE;YAC5D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,IAAI,CAAC;QACH,OAAO,MAAM,0CAA0C,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,CACX,4DAA4D,EAC5D,CAAC,CACF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0EAA0E,EAC1E,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;IACJ,CAAC;AACH,CAAC;AAED,eAAe,kBAAkB,CAAC"}

package/dist/lib/handle-successful-authentication.d.ts

@@ -1,11 +1,12 @@
-import { type AccessToken, type RefreshToken, type UserData } from "@schemavaults/auth-common";
-import type { ApiServerId, AppId, SchemaVaultsAppEnvironment } from "@schemavaults/app-definitions";
+import { type AccessToken, type RefreshToken, type SuccessfullyGeneratedTokensRecord, type UserData } from "@schemavaults/auth-common";
+import { type ApiServerId, type AppId, type SchemaVaultsAppEnvironment } from "@schemavaults/app-definitions";
 import type { ISchemaVaultsAuthClientAdapter } from "../types/ISchemaVaultsAuthClientAdapter";
 export interface IHandleSuccessfulAuthenticationOpts {
     authorization_code: string;
     challenge_time: number;
     code_verifier?: string;
     received_state: string | null | undefined;
+    received_iss: string | null | undefined;
     expected_nonce: string | null | undefined;
     redirect_uri: string | null;
     loadCodeVerifier: (challenge_time: number) => string | null;
@@ -18,15 +19,28 @@ export interface IHandleSuccessfulAuthenticationOpts {
     auth_server_url: string;
     /**
      * The auth server deployment's own app id (white-label deployments use a
-     * custom value). Injected into audience schema validation because browser
-     * bundles can't resolve the SCHEMAVAULTS_AUTH_SERVER_APP_ID env var.
+     * custom value; the client resolves it from its constructor option or
+     * the platform default). The id_token `sub` claim is namespaced by it.
      */
-    auth_server_app_id?: AppId;
+    auth_server_app_id: AppId;
     defaultTokenAudiences: string | string[];
     storeRefreshToken: (refreshToken: RefreshToken) => void;
     storeUserData: (userData: UserData) => void;
     storeMultipleAccessTokens: (accessTokens: Record<ApiServerId, AccessToken | "AS_HTTP_ONLY_COOKIE">) => void;
+    /**
+     * Redeems the (just stored) refresh token for access tokens of further
+     * audiences. The token endpoint issues one access token per request,
+     * so default audiences beyond the first are acquired here through
+     * refresh grants right after the code grant.
+     */
+    exchangeAuthTokens: (refreshToken: RefreshToken | "AS_HTTP_ONLY_COOKIE", audience: string | string[]) => Promise<SuccessfullyGeneratedTokensRecord>;
+    /**
+     * Loads the signed-in user's data from the auth server (whoami) using
+     * the stored refresh token. The OIDC token response carries identity
+     * claims only; the platform's full `UserData` comes from here.
+     */
+    fetchUserData: () => Promise<UserData | null>;
     triggerAuthStateChanged: () => void;
 }
-export declare function handleSuccessfulAuthentication({ authorization_code, challenge_time, code_verifier, received_state, expected_nonce, redirect_uri, loadCodeVerifier, loadOAuth2State, loadOidcNonce, debug, environment, adapter, auth_server_url, auth_server_app_id, client_app_id, defaultTokenAudiences, storeRefreshToken, storeUserData, storeMultipleAccessTokens, triggerAuthStateChanged, }: IHandleSuccessfulAuthenticationOpts): Promise<void>;
+export declare function handleSuccessfulAuthentication({ authorization_code, challenge_time, code_verifier, received_state, received_iss, expected_nonce, redirect_uri, loadCodeVerifier, loadOAuth2State, loadOidcNonce, debug, environment, adapter, auth_server_url, auth_server_app_id, client_app_id, defaultTokenAudiences, storeRefreshToken, storeUserData, storeMultipleAccessTokens, exchangeAuthTokens, fetchUserData, triggerAuthStateChanged, }: IHandleSuccessfulAuthenticationOpts): Promise<void>;
 export default handleSuccessfulAuthentication;