@schemavaults/auth-client-sdk 0.17.2 → 0.18.6

package/dist/lib/oidc/is-insecure-transport-allowed.js

@@ -0,0 +1,14 @@
+// is-insecure-transport-allowed.ts
+//
+// The single place that decides which app environments may talk to an
+// auth server over cleartext HTTP.
+/**
+ * Whether `environment` may talk to an auth server over cleartext HTTP.
+ * Mirrors `SchemaVaultsAuthClient.secure`: development and test are the
+ * only non-TLS environments; staging and production always require HTTPS.
+ */
+export function isInsecureTransportAllowed(environment) {
+    return environment === "development" || environment === "test";
+}
+export default isInsecureTransportAllowed;
+//# sourceMappingURL=is-insecure-transport-allowed.js.map

package/dist/lib/oidc/is-insecure-transport-allowed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-insecure-transport-allowed.js","sourceRoot":"","sources":["../../../src/lib/oidc/is-insecure-transport-allowed.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,EAAE;AACF,sEAAsE;AACtE,mCAAmC;AAInC;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,WAAuC;IAEvC,OAAO,WAAW,KAAK,aAAa,IAAI,WAAW,KAAK,MAAM,CAAC;AACjE,CAAC;AAED,eAAe,0BAA0B,CAAC"}

package/dist/lib/oidc/normalize-oidc-issuer.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Strips a trailing slash so the issuer matches `getAuthServerUrl()` —
+ * and therefore the `iss` claim of the id_tokens the auth server mints
+ * and the RFC 9207 `iss` authorization-response parameter, both of which
+ * are compared byte-for-byte by openid-client.
+ */
+export declare function normalizeOidcIssuer(auth_server_url: string): string;
+export default normalizeOidcIssuer;

package/dist/lib/oidc/normalize-oidc-issuer.js

@@ -0,0 +1,19 @@
+// normalize-oidc-issuer.ts
+//
+// Canonicalizes an auth server URL into its OIDC issuer identifier.
+/**
+ * Strips a trailing slash so the issuer matches `getAuthServerUrl()` —
+ * and therefore the `iss` claim of the id_tokens the auth server mints
+ * and the RFC 9207 `iss` authorization-response parameter, both of which
+ * are compared byte-for-byte by openid-client.
+ */
+export function normalizeOidcIssuer(auth_server_url) {
+    if (typeof auth_server_url !== "string" || auth_server_url.length === 0) {
+        throw new TypeError("Expected 'auth_server_url' to be a non-empty string!");
+    }
+    return auth_server_url.endsWith("/")
+        ? auth_server_url.slice(0, -1)
+        : auth_server_url;
+}
+export default normalizeOidcIssuer;
+//# sourceMappingURL=normalize-oidc-issuer.js.map

package/dist/lib/oidc/normalize-oidc-issuer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize-oidc-issuer.js","sourceRoot":"","sources":["../../../src/lib/oidc/normalize-oidc-issuer.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,EAAE;AACF,oEAAoE;AAEpE;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,eAAuB;IACzD,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9B,CAAC,CAAC,eAAe,CAAC;AACtB,CAAC;AAED,eAAe,mBAAmB,CAAC"}

package/dist/lib/oidc/oidc-client-configuration.d.ts

@@ -0,0 +1,43 @@
+import * as oidc from "openid-client";
+import { type SchemaVaultsAppEnvironment } from "@schemavaults/app-definitions";
+import type { ISchemaVaultsAuthClientAdapter } from "../../types/ISchemaVaultsAuthClientAdapter";
+export interface CreateOidcClientConfigurationOptions {
+    /**
+     * The auth server URL — its OIDC issuer identifier, byte-identical to
+     * the `iss` claim of the id_tokens it mints.
+     */
+    auth_server_url: string;
+    /** The OAuth2 client_id: this client application's app id. */
+    client_app_id: string;
+    /**
+     * The app environment this client runs in. Decides whether a plain-HTTP
+     * auth server is tolerated: only `development` and `test` may talk to
+     * the token endpoint without TLS.
+     */
+    environment: SchemaVaultsAppEnvironment;
+    /** Platform adapter supplying the fetch implementation. */
+    adapter: ISchemaVaultsAuthClientAdapter;
+    /** Timeout for token-endpoint requests, in seconds (default 30). */
+    timeout_seconds?: number;
+}
+/**
+ * Creates the openid-client Configuration for this SDK instance.
+ *
+ * - Server metadata: the auth server's discovery document for
+ *   `auth_server_url`, from the shared builder (see module comment).
+ * - Public client: PKCE S256 is the binding, token endpoint auth method
+ *   `none` (the platform never puts client secrets in browsers).
+ * - HTTP requests go through the adapter's fetch so each platform
+ *   (browser, Node, React Native) supplies its own implementation.
+ *   Token-endpoint requests are sent with `credentials: "include"` so
+ *   the auth server's HTTP-only refresh-token cookie travels with the
+ *   refresh grant and the `Set-Cookie` on the response is honored.
+ * - Plain-HTTP issuers (local dev / the docker-compose test network)
+ *   are allowed ONLY in the `development` and `test` environments;
+ *   openid-client refuses non-TLS endpoints otherwise, and this function
+ *   throws before building such a configuration in any other environment
+ *   so a misconfigured `auth_server_url` can never leak tokens over
+ *   cleartext in staging or production.
+ */
+export declare function createOidcClientConfiguration({ auth_server_url, client_app_id, environment, adapter, timeout_seconds, }: CreateOidcClientConfigurationOptions): oidc.Configuration;
+export default createOidcClientConfiguration;

package/dist/lib/oidc/oidc-client-configuration.js

@@ -0,0 +1,68 @@
+// oidc-client-configuration.ts
+//
+// Builds the `openid-client` Configuration the SDK uses to talk to the
+// auth server's standard OIDC surface (/api/oidc/*). The server metadata
+// is the auth server's own discovery document, built locally from the
+// shared `buildOidcProviderMetadata` in @schemavaults/auth-common — the
+// very function the server serves at /.well-known/openid-configuration —
+// so no discovery round trip is needed and the SDK cannot drift from
+// what the server advertises.
+import * as oidc from "openid-client";
+import { isValidSchemaVaultsAppEnvironment, } from "@schemavaults/app-definitions";
+import { buildOidcProviderMetadata } from "@schemavaults/auth-common";
+import { isInsecureTransportAllowed } from "./is-insecure-transport-allowed";
+import { normalizeOidcIssuer } from "./normalize-oidc-issuer";
+/**
+ * Creates the openid-client Configuration for this SDK instance.
+ *
+ * - Server metadata: the auth server's discovery document for
+ *   `auth_server_url`, from the shared builder (see module comment).
+ * - Public client: PKCE S256 is the binding, token endpoint auth method
+ *   `none` (the platform never puts client secrets in browsers).
+ * - HTTP requests go through the adapter's fetch so each platform
+ *   (browser, Node, React Native) supplies its own implementation.
+ *   Token-endpoint requests are sent with `credentials: "include"` so
+ *   the auth server's HTTP-only refresh-token cookie travels with the
+ *   refresh grant and the `Set-Cookie` on the response is honored.
+ * - Plain-HTTP issuers (local dev / the docker-compose test network)
+ *   are allowed ONLY in the `development` and `test` environments;
+ *   openid-client refuses non-TLS endpoints otherwise, and this function
+ *   throws before building such a configuration in any other environment
+ *   so a misconfigured `auth_server_url` can never leak tokens over
+ *   cleartext in staging or production.
+ */
+export function createOidcClientConfiguration({ auth_server_url, client_app_id, environment, adapter, timeout_seconds, }) {
+    if (!isValidSchemaVaultsAppEnvironment(environment)) {
+        throw new TypeError(`Invalid app environment '${String(environment)}' for the OIDC client configuration!`);
+    }
+    const issuer = normalizeOidcIssuer(auth_server_url);
+    const insecure_issuer = issuer.startsWith("http://");
+    if (insecure_issuer && !isInsecureTransportAllowed(environment)) {
+        throw new Error(`Refusing to use the plain-HTTP auth server '${issuer}' in the '${environment}' environment: ` +
+            "the auth server URL must use HTTPS outside of development and test.");
+    }
+    const server = buildOidcProviderMetadata(issuer);
+    const token_endpoint = server.token_endpoint;
+    const config = new oidc.Configuration(server, client_app_id, { token_endpoint_auth_method: "none" }, oidc.None());
+    if (insecure_issuer) {
+        // Reachable only in development/test (asserted above).
+        oidc.allowInsecureRequests(config);
+    }
+    if (typeof timeout_seconds === "number") {
+        config.timeout = timeout_seconds;
+    }
+    config[oidc.customFetch] = async (url, options) => {
+        const isTokenEndpoint = url === token_endpoint;
+        return await adapter.fetch(url, {
+            method: options.method,
+            headers: options.headers,
+            body: options.body,
+            redirect: options.redirect,
+            signal: options.signal,
+            credentials: isTokenEndpoint ? "include" : "same-origin",
+        });
+    };
+    return config;
+}
+export default createOidcClientConfiguration;
+//# sourceMappingURL=oidc-client-configuration.js.map

package/dist/lib/oidc/oidc-client-configuration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-client-configuration.js","sourceRoot":"","sources":["../../../src/lib/oidc/oidc-client-configuration.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AACzE,sEAAsE;AACtE,wEAAwE;AACxE,yEAAyE;AACzE,qEAAqE;AACrE,8BAA8B;AAE9B,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,EACL,iCAAiC,GAElC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAsB9D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,6BAA6B,CAAC,EAC5C,eAAe,EACf,aAAa,EACb,WAAW,EACX,OAAO,EACP,eAAe,GACsB;IACrC,IAAI,CAAC,iCAAiC,CAAC,WAAW,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,SAAS,CACjB,4BAA4B,MAAM,CAAC,WAAW,CAAC,sCAAsC,CACtF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAW,mBAAmB,CAAC,eAAe,CAAC,CAAC;IAC5D,MAAM,eAAe,GAAY,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,eAAe,IAAI,CAAC,0BAA0B,CAAC,WAAW,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,+CAA+C,MAAM,aAAa,WAAW,iBAAiB;YAC5F,qEAAqE,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAwB,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,cAAc,GAAW,MAAM,CAAC,cAAwB,CAAC;IAE/D,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,aAAa,CACnC,MAAM,EACN,aAAa,EACb,EAAE,0BAA0B,EAAE,MAAM,EAAE,EACtC,IAAI,CAAC,IAAI,EAAE,CACZ,CAAC;IAEF,IAAI,eAAe,EAAE,CAAC;QACpB,uDAAuD;QACvD,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,CAAC,OAAO,GAAG,eAAe,CAAC;IACnC,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,KAAK,EAC9B,GAAW,EACX,OAAgC,EACb,EAAE;QACrB,MAAM,eAAe,GAAY,GAAG,KAAK,cAAc,CAAC;QACxD,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;YAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa;SACzD,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,eAAe,6BAA6B,CAAC"}

package/dist/lib/oidc/oidc-token-error.d.ts

@@ -0,0 +1,16 @@
+export interface ClassifiedOidcTokenError {
+    /** RFC 6749 §5.2 error code when the server returned one. */
+    error: string | null;
+    error_description: string | null;
+    status: number | null;
+    /**
+     * True when the auth server rejected the grant itself (invalid,
+     * expired, revoked, or re-used refresh token / authorization code, or
+     * the client was rejected outright): the local session cannot be
+     * recovered and should be cleared.
+     */
+    session_lost: boolean;
+    message: string;
+}
+export declare function classifyOidcTokenError(e: unknown): ClassifiedOidcTokenError;
+export default classifyOidcTokenError;

package/dist/lib/oidc/oidc-token-error.js

@@ -0,0 +1,54 @@
+// oidc-token-error.ts
+//
+// Classifies failures thrown by openid-client's grant helpers so the
+// SDK can tell "the session is gone" (log the user out) apart from
+// transient / configuration errors.
+import * as oidc from "openid-client";
+const SESSION_LOST_ERROR_CODES = new Set([
+    "invalid_grant",
+    "invalid_client",
+    "unauthorized_client",
+]);
+export function classifyOidcTokenError(e) {
+    if (e instanceof oidc.ResponseBodyError) {
+        const error = e.error;
+        const error_description = e.error_description ?? null;
+        const status = e.status;
+        const session_lost = SESSION_LOST_ERROR_CODES.has(error) || status === 401 || status === 403;
+        return {
+            error,
+            error_description,
+            status,
+            session_lost,
+            message: `${error}${error_description ? `: ${error_description}` : ""} (HTTP ${status})`,
+        };
+    }
+    if (e instanceof oidc.WWWAuthenticateChallengeError) {
+        const status = e.status;
+        return {
+            error: null,
+            error_description: null,
+            status,
+            session_lost: status === 401 || status === 403,
+            message: `${e.message} (HTTP ${status})`,
+        };
+    }
+    if (e instanceof oidc.ResponseBodyError || e instanceof Error) {
+        return {
+            error: null,
+            error_description: null,
+            status: null,
+            session_lost: false,
+            message: e.message,
+        };
+    }
+    return {
+        error: null,
+        error_description: null,
+        status: null,
+        session_lost: false,
+        message: "Unknown token endpoint error",
+    };
+}
+export default classifyOidcTokenError;
+//# sourceMappingURL=oidc-token-error.js.map

package/dist/lib/oidc/oidc-token-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-token-error.js","sourceRoot":"","sources":["../../../src/lib/oidc/oidc-token-error.ts"],"names":[],"mappings":"AAAA,sBAAsB;AACtB,EAAE;AACF,qEAAqE;AACrE,mEAAmE;AACnE,oCAAoC;AAEpC,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AAiBtC,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC;IAC5D,eAAe;IACf,gBAAgB;IAChB,qBAAqB;CACtB,CAAC,CAAC;AAEH,MAAM,UAAU,sBAAsB,CAAC,CAAU;IAC/C,IAAI,CAAC,YAAY,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAW,CAAC,CAAC,KAAK,CAAC;QAC9B,MAAM,iBAAiB,GAAkB,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC;QACrE,MAAM,MAAM,GAAW,CAAC,CAAC,MAAM,CAAC;QAChC,MAAM,YAAY,GAChB,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;QAC1E,OAAO;YACL,KAAK;YACL,iBAAiB;YACjB,MAAM;YACN,YAAY;YACZ,OAAO,EAAE,GAAG,KAAK,GAAG,iBAAiB,CAAC,CAAC,CAAC,KAAK,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,MAAM,GAAG;SACzF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,CAAC,6BAA6B,EAAE,CAAC;QACpD,MAAM,MAAM,GAAW,CAAC,CAAC,MAAM,CAAC;QAChC,OAAO;YACL,KAAK,EAAE,IAAI;YACX,iBAAiB,EAAE,IAAI;YACvB,MAAM;YACN,YAAY,EAAE,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;YAC9C,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,UAAU,MAAM,GAAG;SACzC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,CAAC,iBAAiB,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;QAC9D,OAAO;YACL,KAAK,EAAE,IAAI;YACX,iBAAiB,EAAE,IAAI;YACvB,MAAM,EAAE,IAAI;YACZ,YAAY,EAAE,KAAK;YACnB,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,IAAI;QACX,iBAAiB,EAAE,IAAI;QACvB,MAAM,EAAE,IAAI;QACZ,YAAY,EAAE,KAAK;QACnB,OAAO,EAAE,8BAA8B;KACxC,CAAC;AACJ,CAAC;AAED,eAAe,sBAAsB,CAAC"}

package/dist/lib/oidc/token-endpoint-response-to-tokens-record.d.ts

@@ -0,0 +1,42 @@
+import { type SuccessfullyGeneratedTokensRecord } from "@schemavaults/auth-common";
+/**
+ * The subset of openid-client's `TokenEndpointResponse` the SDK reads.
+ * Structurally typed so tests can build responses without the library.
+ */
+export interface OidcTokenEndpointResponseLike {
+    readonly access_token: string;
+    readonly token_type: string;
+    readonly expires_in?: number;
+    readonly refresh_token?: string;
+    readonly id_token?: string;
+    readonly scope?: string;
+    readonly [parameter: string]: unknown;
+}
+export interface TokenEndpointResponseToTokensRecordOptions {
+    response: OidcTokenEndpointResponseLike;
+    /**
+     * Token audience the response's access token was minted for: the
+     * RFC 8707 `resource` sent with the request, or the reserved userinfo
+     * audience when none was sent.
+     */
+    audience: string;
+    /** The authenticated user's id (from the id_token / cached user data). */
+    uid: string;
+    /** Audience of the refresh token: the auth server URL. */
+    auth_server_url: string;
+    /** Clock override for tests (ms since epoch). */
+    now?: number;
+}
+/**
+ * Builds the SDK tokens record from a token response.
+ *
+ * - `access[audience]` is the response's `access_token`, expiring
+ *   `expires_in` seconds from now.
+ * - `refresh` is the inlined `refresh_token` when present; when the auth
+ *   server delivered it as an HTTP-only cookie instead (platform
+ *   `refresh_token_delivery=http_only_cookie` extension) the record
+ *   carries `"AS_HTTP_ONLY_COOKIE"` plus `refresh_token_expiry`, derived
+ *   from the `refresh_token_expires_in` extension field.
+ */
+export declare function tokenEndpointResponseToTokensRecord({ response, audience, uid, auth_server_url, now, }: TokenEndpointResponseToTokensRecordOptions): SuccessfullyGeneratedTokensRecord;
+export default tokenEndpointResponseToTokensRecord;

package/dist/lib/oidc/token-endpoint-response-to-tokens-record.js

@@ -0,0 +1,72 @@
+// token-endpoint-response-to-tokens-record.ts
+//
+// Translates an RFC 6749 §5.1 token response (as returned by
+// openid-client) into the SDK's internal tokens record — the shape the
+// adapters store and `acquireAccessToken` reads.
+import { accessTokenExpiry, oidcTokenResponseExtensionsSchema, refreshTokenExpiry, } from "@schemavaults/auth-common";
+/**
+ * Builds the SDK tokens record from a token response.
+ *
+ * - `access[audience]` is the response's `access_token`, expiring
+ *   `expires_in` seconds from now.
+ * - `refresh` is the inlined `refresh_token` when present; when the auth
+ *   server delivered it as an HTTP-only cookie instead (platform
+ *   `refresh_token_delivery=http_only_cookie` extension) the record
+ *   carries `"AS_HTTP_ONLY_COOKIE"` plus `refresh_token_expiry`, derived
+ *   from the `refresh_token_expires_in` extension field.
+ */
+export function tokenEndpointResponseToTokensRecord({ response, audience, uid, auth_server_url, now = Date.now(), }) {
+    if (typeof response.access_token !== "string" || !response.access_token) {
+        throw new TypeError("Token response is missing 'access_token'!");
+    }
+    if (typeof response.token_type !== "string" || response.token_type.toLowerCase() !== "bearer") {
+        throw new TypeError(`Unsupported token_type '${String(response.token_type)}' in token response; expected 'Bearer'`);
+    }
+    if (typeof audience !== "string" || audience.length === 0) {
+        throw new TypeError("Expected 'audience' to be a non-empty string!");
+    }
+    if (typeof uid !== "string" || uid.length === 0) {
+        throw new TypeError("Expected 'uid' to be a non-empty string!");
+    }
+    const parsed_extensions = oidcTokenResponseExtensionsSchema.safeParse(response);
+    if (!parsed_extensions.success) {
+        throw new TypeError("Token response carries malformed extension fields: " +
+            parsed_extensions.error.issues.map((i) => i.message).join("; "));
+    }
+    const refresh_token_expires_in = parsed_extensions.data.refresh_token_expires_in;
+    const access_expires_in = typeof response.expires_in === "number" && response.expires_in > 0
+        ? response.expires_in
+        : accessTokenExpiry;
+    const access = {
+        type: "access",
+        uid,
+        iat: now,
+        exp: now + access_expires_in * 1000,
+        token: response.access_token,
+        aud: audience,
+    };
+    const record = {
+        access: { [audience]: access },
+    };
+    if (typeof response.refresh_token === "string" && response.refresh_token) {
+        const refresh = {
+            type: "refresh",
+            uid,
+            iat: now,
+            exp: now + (refresh_token_expires_in ?? refreshTokenExpiry) * 1000,
+            token: response.refresh_token,
+            aud: auth_server_url,
+        };
+        record.refresh = refresh;
+    }
+    else if (typeof refresh_token_expires_in === "number") {
+        record.refresh = "AS_HTTP_ONLY_COOKIE";
+        record.refresh_token_expiry = now + refresh_token_expires_in * 1000;
+    }
+    else {
+        throw new Error("Token response included neither an inlined 'refresh_token' nor a 'refresh_token_expires_in' for a cookie-delivered refresh token!");
+    }
+    return record;
+}
+export default tokenEndpointResponseToTokensRecord;
+//# sourceMappingURL=token-endpoint-response-to-tokens-record.js.map

package/dist/lib/oidc/token-endpoint-response-to-tokens-record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-endpoint-response-to-tokens-record.js","sourceRoot":"","sources":["../../../src/lib/oidc/token-endpoint-response-to-tokens-record.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,6DAA6D;AAC7D,uEAAuE;AACvE,iDAAiD;AAEjD,OAAO,EACL,iBAAiB,EACjB,iCAAiC,EACjC,kBAAkB,GAInB,MAAM,2BAA2B,CAAC;AAgCnC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mCAAmC,CAAC,EAClD,QAAQ,EACR,QAAQ,EACR,GAAG,EACH,eAAe,EACf,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAC2B;IAC3C,IAAI,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QACxE,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC9F,MAAM,IAAI,SAAS,CACjB,2BAA2B,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,wCAAwC,CAC/F,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,SAAS,CAAC,0CAA0C,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,iBAAiB,GAAG,iCAAiC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAChF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,IAAI,SAAS,CACjB,qDAAqD;YACnD,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,wBAAwB,GAC5B,iBAAiB,CAAC,IAAI,CAAC,wBAAwB,CAAC;IAElD,MAAM,iBAAiB,GACrB,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,GAAG,CAAC;QAChE,CAAC,CAAC,QAAQ,CAAC,UAAU;QACrB,CAAC,CAAC,iBAAiB,CAAC;IAExB,MAAM,MAAM,GAAgB;QAC1B,IAAI,EAAE,QAAQ;QACd,GAAG;QACH,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,iBAAiB,GAAG,IAAI;QACnC,KAAK,EAAE,QAAQ,CAAC,YAAY;QAC5B,GAAG,EAAE,QAAQ;KACd,CAAC;IAEF,MAAM,MAAM,GAAsC;QAChD,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE;KAC/B,CAAC;IAEF,IAAI,OAAO,QAAQ,CAAC,aAAa,KAAK,QAAQ,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;QACzE,MAAM,OAAO,GAAiB;YAC5B,IAAI,EAAE,SAAS;YACf,GAAG;YACH,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,GAAG,GAAG,CAAC,wBAAwB,IAAI,kBAAkB,CAAC,GAAG,IAAI;YAClE,KAAK,EAAE,QAAQ,CAAC,aAAa;YAC7B,GAAG,EAAE,eAAe;SACrB,CAAC;QACF,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IAC3B,CAAC;SAAM,IAAI,OAAO,wBAAwB,KAAK,QAAQ,EAAE,CAAC;QACxD,MAAM,CAAC,OAAO,GAAG,qBAAqB,CAAC;QACvC,MAAM,CAAC,oBAAoB,GAAG,GAAG,GAAG,wBAAwB,GAAG,IAAI,CAAC;IACtE,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CACb,mIAAmI,CACpI,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,eAAe,mCAAmC,CAAC"}

package/dist/lib/oidc/uid-from-oidc-sub-claim.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Resolves the platform user id from an id_token's `sub` claim, which the
+ * auth server namespaces as `<auth_server_app_id>|<uid>` (Auth0-style).
+ *
+ * The prefix is NOT required to match `expected_auth_server_app_id`:
+ * the id_token's `iss` claim (verified by openid-client against the
+ * configured auth server URL) already pins the deployment, and external
+ * resource servers commonly leave `auth_server_app_id` at its default
+ * even against white-label auth servers. A mismatch is only surfaced as
+ * a warning in debug mode.
+ */
+export declare function uidFromOidcSubClaim(sub: unknown, expected_auth_server_app_id: string, debug?: boolean): string;
+export default uidFromOidcSubClaim;

package/dist/lib/oidc/uid-from-oidc-sub-claim.js

@@ -0,0 +1,32 @@
+// uid-from-oidc-sub-claim.ts
+//
+// Resolves the platform user id from an OIDC id_token `sub` claim.
+import { parseOidcSubClaim } from "@schemavaults/auth-common";
+/**
+ * Resolves the platform user id from an id_token's `sub` claim, which the
+ * auth server namespaces as `<auth_server_app_id>|<uid>` (Auth0-style).
+ *
+ * The prefix is NOT required to match `expected_auth_server_app_id`:
+ * the id_token's `iss` claim (verified by openid-client against the
+ * configured auth server URL) already pins the deployment, and external
+ * resource servers commonly leave `auth_server_app_id` at its default
+ * even against white-label auth servers. A mismatch is only surfaced as
+ * a warning in debug mode.
+ */
+export function uidFromOidcSubClaim(sub, expected_auth_server_app_id, debug = false) {
+    if (typeof sub !== "string" || sub.length === 0) {
+        throw new TypeError("id_token is missing its 'sub' claim!");
+    }
+    const parsed = parseOidcSubClaim(sub);
+    if (!parsed) {
+        throw new Error("id_token 'sub' claim is not in '<app_id>|<uid>' form!");
+    }
+    if (debug && parsed.auth_server_app_id !== expected_auth_server_app_id) {
+        console.warn(`[SchemaVaultsAuthClient] id_token 'sub' claim is namespaced by '${parsed.auth_server_app_id}', ` +
+            `but this client is configured with auth_server_app_id '${expected_auth_server_app_id}'. ` +
+            "Pass the deployment's SCHEMAVAULTS_AUTH_SERVER_APP_ID as 'auth_server_app_id' when initializing the client.");
+    }
+    return parsed.uid;
+}
+export default uidFromOidcSubClaim;
+//# sourceMappingURL=uid-from-oidc-sub-claim.js.map

package/dist/lib/oidc/uid-from-oidc-sub-claim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"uid-from-oidc-sub-claim.js","sourceRoot":"","sources":["../../../src/lib/oidc/uid-from-oidc-sub-claim.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,EAAE;AACF,mEAAmE;AAEnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAY,EACZ,2BAAmC,EACnC,QAAiB,KAAK;IAEtB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,KAAK,IAAI,MAAM,CAAC,kBAAkB,KAAK,2BAA2B,EAAE,CAAC;QACvE,OAAO,CAAC,IAAI,CACV,mEAAmE,MAAM,CAAC,kBAAkB,KAAK;YAC/F,0DAA0D,2BAA2B,KAAK;YAC1F,6GAA6G,CAChH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC;AACpB,CAAC;AAED,eAAe,mBAAmB,CAAC"}

package/dist/lib/send-authenticate-request.js

@@ -155,7 +155,7 @@ export async function sendAuthenticateRequest(opts) {
         }
         const parsed_auth_response = await authenticateResultSchema.safeParseAsync(await response.json());
         if (!parsed_auth_response.success) {
-            throw new Error(parsed_auth_response.error.errors.join(", "));
+            throw new Error(parsed_auth_response.error.issues.join(", "));
         }
         const data = parsed_auth_response.data;
         if (data.kind === "failure") {

package/dist/types/ISchemaVaultsAuthClient.d.ts

@@ -100,7 +100,7 @@ export interface ISchemaVaultsAuthClient {
      * @throws if `error_id` is not in the catalog or `error_code` is out of range
      */
     buildErrorPageUrl: (error_id: SchemaVaultsAuthErrorId, error_code?: number) => string;
-    handleSuccessfulAuthentication: (authorization_code: string, challenge_time: number, code_verifier?: string, received_state?: string | null, expected_nonce?: string | null) => Promise<void>;
+    handleSuccessfulAuthentication: (authorization_code: string, challenge_time: number, code_verifier?: string, received_state?: string | null, expected_nonce?: string | null, received_iss?: string | null) => Promise<void>;
     getAccessTokenFromCache: (token_id: string) => AccessToken | null;
     getRefreshTokenFromCache: () => RefreshToken | null;
     hasHttpOnlyRefreshToken: () => boolean;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@schemavaults/auth-client-sdk",
   "description": "TypeScript SDK for interacting with SchemaVaults Auth server or protected resources",
-  "version": "0.17.2",
+  "version": "0.18.6",
   "license": "UNLICENSED",
   "private": false,
   "repository": {
@@ -13,9 +13,10 @@
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "dependencies": {
-    "zod": "3.25.8",
-    "@schemavaults/auth-common": "0.25.0",
-    "@schemavaults/app-definitions": "0.12.0"
+    "zod": "4.4.3",
+    "@schemavaults/auth-common": "0.26.1",
+    "@schemavaults/app-definitions": "0.12.1",
+    "openid-client": "6.8.4"
   },
   "scripts": {
     "generate-version": "bash generate-version.sh",