@schemavaults/auth-client-sdk 0.17.3 → 0.18.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +35 -0
- package/dist/auth-client.d.ts +9 -1
- package/dist/auth-client.js +22 -3
- package/dist/auth-client.js.map +1 -1
- package/dist/generated/version.d.ts +1 -1
- package/dist/generated/version.js +1 -1
- package/dist/lib/exchange-auth-tokens.d.ts +16 -6
- package/dist/lib/exchange-auth-tokens.js +119 -97
- package/dist/lib/exchange-auth-tokens.js.map +1 -1
- package/dist/lib/handle-successful-authentication.d.ts +20 -6
- package/dist/lib/handle-successful-authentication.js +170 -131
- package/dist/lib/handle-successful-authentication.js.map +1 -1
- package/dist/lib/handle-successful-exchange-auth-tokens-response.d.ts +11 -7
- package/dist/lib/handle-successful-exchange-auth-tokens-response.js +19 -28
- package/dist/lib/handle-successful-exchange-auth-tokens-response.js.map +1 -1
- package/dist/lib/oidc/index.d.ts +9 -0
- package/dist/lib/oidc/index.js +7 -0
- package/dist/lib/oidc/index.js.map +1 -0
- package/dist/lib/oidc/is-insecure-transport-allowed.d.ts +8 -0
- package/dist/lib/oidc/is-insecure-transport-allowed.js +14 -0
- package/dist/lib/oidc/is-insecure-transport-allowed.js.map +1 -0
- package/dist/lib/oidc/normalize-oidc-issuer.d.ts +8 -0
- package/dist/lib/oidc/normalize-oidc-issuer.js +19 -0
- package/dist/lib/oidc/normalize-oidc-issuer.js.map +1 -0
- package/dist/lib/oidc/oidc-client-configuration.d.ts +43 -0
- package/dist/lib/oidc/oidc-client-configuration.js +68 -0
- package/dist/lib/oidc/oidc-client-configuration.js.map +1 -0
- package/dist/lib/oidc/oidc-token-error.d.ts +16 -0
- package/dist/lib/oidc/oidc-token-error.js +54 -0
- package/dist/lib/oidc/oidc-token-error.js.map +1 -0
- package/dist/lib/oidc/token-endpoint-response-to-tokens-record.d.ts +42 -0
- package/dist/lib/oidc/token-endpoint-response-to-tokens-record.js +72 -0
- package/dist/lib/oidc/token-endpoint-response-to-tokens-record.js.map +1 -0
- package/dist/lib/oidc/uid-from-oidc-sub-claim.d.ts +13 -0
- package/dist/lib/oidc/uid-from-oidc-sub-claim.js +32 -0
- package/dist/lib/oidc/uid-from-oidc-sub-claim.js.map +1 -0
- package/dist/types/ISchemaVaultsAuthClient.d.ts +1 -1
- package/package.json +4 -3
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"exchange-auth-tokens.js","sourceRoot":"","sources":["../../src/lib/exchange-auth-tokens.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"exchange-auth-tokens.js","sourceRoot":"","sources":["../../src/lib/exchange-auth-tokens.ts"],"names":[],"mappings":"AAAA,0BAA0B;AAC1B,EAAE;AACF,mEAAmE;AACnE,2DAA2D;AAC3D,mEAAmE;AACnE,uEAAuE;AACvE,uEAAuE;AACvE,sDAAsD;AAEtD,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AAEtC,OAAO,EACL,yBAAyB,GAG1B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAEL,uCAAuC,EACvC,yBAAyB,GAI1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,mBAAmB,EACnB,mCAAmC,GACpC,MAAM,QAAQ,CAAC;AAgChB,SAAS,kBAAkB,CAAC,QAA2B;IACrD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,QAAQ,CAAC,MAAM,CACpB,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAC1D,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,YAAY,EACZ,QAAQ,EACR,KAAK,EACL,WAAW,EACX,eAAe,EACf,aAAa,EACb,OAAO,EACP,aAAa,EACb,0CAA0C,EAC1C,MAAM,GACkB;IACxB,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,mGAAmG,CACpG,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,IAAI,iBAA0B,CAAC;IAC/B,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACxE,IACE,OAAO,YAAY,CAAC,KAAK,KAAK,QAAQ;YACtC,YAAY,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAC/B,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;QACpE,CAAC;QACD,iBAAiB,GAAG,KAAK,CAAC;IAC5B,CAAC;SAAM,IACL,OAAO,YAAY,KAAK,QAAQ;QAChC,YAAY,KAAK,qBAAqB,EACtC,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,+BAA+B,KAAK,UAAU,EAAE,CAAC;YAClE,MAAM,IAAI,SAAS,CACjB,2HAA2H,CAC5H,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,+BAA+B,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,4HAA4H,CAC7H,CAAC;QACJ,CAAC;QACD,iBAAiB,GAAG,IAAI,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,qEAAqE;IACrE,iEAAiE;IACjE,yCAAyC;IACzC,IAAI,GAAG,GAAuB,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC;IACzD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,GAAoB,MAAM,aAAa,EAAE,CAAC;QACpD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,MAAM,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACxF,CAAC;QACD,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACjB,CAAC;IAED,uEAAuE;IACvE,MAAM,MAAM,GAAuB,6BAA6B,CAAC;QAC/D,eAAe,EAAE,eAAe;QAChC,aAAa;QACb,WAAW;QACX,OAAO;KACR,CAAC,CAAC;IACH,MAAM,MAAM,GAAW,mBAAmB,CAAC,eAAe,CAAC,CAAC;IAE5D,uEAAuE;IACvE,uEAAuE;IACvE,MAAM,SAAS,GAAsB,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAClE,MAAM,MAAM,GAAsB,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAE5E,MAAM,MAAM,GAAgC,EAAE,CAAC;IAC/C,IAAI,OAAO,GAAyC,YAAY,CAAC;IACjE,IAAI,WAA0D,CAAC;IAE/D,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,IAAI,QAAQ,EAAE,CAAC;YACb,UAAU,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,iBAAiB,EAAE,CAAC;YACtB,UAAU,CAAC,GAAG,CAAC,uCAAuC,EAAE,kBAAkB,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CACT,iDAAiD;gBAC/C,6BAA6B,MAAM,CAAC,cAAc,EAAE,CAAC,cAAc,oBAAoB,EACzF,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,EACxC,iBAAiB;gBACf,CAAC,CAAC,gDAAgD;gBAClD,CAAC,CAAC,kCAAkC,CACvC,CAAC;QACJ,CAAC;QAED,IAAI,QAAwE,CAAC;QAC7E,IAAI,CAAC;YACH,IAAI,iBAAiB,EAAE,CAAC;gBACtB,iEAAiE;gBACjE,6DAA6D;gBAC7D,kDAAkD;gBAClD,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CACvC,MAAM,EACN,eAAe,EACf,UAAU,CACX,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;oBAChC,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;gBACJ,CAAC;gBACD,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CACrC,MAAM,EACN,OAAO,CAAC,KAAK,EACb,UAAU,CACX,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,MAAM,UAAU,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAC;YAC7C,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,CAAC,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,UAAU,CAAC,YAAY,EAAE,CAAC;gBAC5B,OAAO,CAAC,KAAK,CACX,8CAA8C,UAAU,CAAC,OAAO,mCAAmC,CACpG,CAAC;gBACF,MAAM,MAAM,EAAE,CAAC;gBACf,gEAAgE;gBAChE,iEAAiE;gBACjE,MAAM,IAAI,KAAK,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,0BAA0B,UAAU,CAAC,OAAO,EAAE,EAAE;gBAC9D,KAAK,EAAE,CAAC;aACT,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAyC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,GAAG,mCAAmC,CAAC;gBAC3C,QAAQ;gBACR,QAAQ,EAAE,QAAQ,IAAI,yBAAyB;gBAC/C,GAAG;gBACH,eAAe,EAAE,MAAM;aACxB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,CAAC,CAAC,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,8CAA8C,EAAE;gBAC9D,KAAK,EAAE,CAAC;aACT,CAAC,CAAC;QACL,CAAC;QAED,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACvC,+DAA+D;YAC/D,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC3B,CAAC;QACD,WAAW,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,MAAM,GAAsC;QAChD,MAAM;QACN,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,GAAG,CAAC,OAAO,WAAW,CAAC,oBAAoB,KAAK,QAAQ;YACtD,CAAC,CAAC,EAAE,oBAAoB,EAAE,WAAW,CAAC,oBAAoB,EAAE;YAC5D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,IAAI,CAAC;QACH,OAAO,MAAM,0CAA0C,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,CACX,4DAA4D,EAC5D,CAAC,CACF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0EAA0E,EAC1E,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;IACJ,CAAC;AACH,CAAC;AAED,eAAe,kBAAkB,CAAC"}
|
|
@@ -1,11 +1,12 @@
|
|
|
1
|
-
import { type AccessToken, type RefreshToken, type UserData } from "@schemavaults/auth-common";
|
|
2
|
-
import type
|
|
1
|
+
import { type AccessToken, type RefreshToken, type SuccessfullyGeneratedTokensRecord, type UserData } from "@schemavaults/auth-common";
|
|
2
|
+
import { type ApiServerId, type AppId, type SchemaVaultsAppEnvironment } from "@schemavaults/app-definitions";
|
|
3
3
|
import type { ISchemaVaultsAuthClientAdapter } from "../types/ISchemaVaultsAuthClientAdapter";
|
|
4
4
|
export interface IHandleSuccessfulAuthenticationOpts {
|
|
5
5
|
authorization_code: string;
|
|
6
6
|
challenge_time: number;
|
|
7
7
|
code_verifier?: string;
|
|
8
8
|
received_state: string | null | undefined;
|
|
9
|
+
received_iss: string | null | undefined;
|
|
9
10
|
expected_nonce: string | null | undefined;
|
|
10
11
|
redirect_uri: string | null;
|
|
11
12
|
loadCodeVerifier: (challenge_time: number) => string | null;
|
|
@@ -18,15 +19,28 @@ export interface IHandleSuccessfulAuthenticationOpts {
|
|
|
18
19
|
auth_server_url: string;
|
|
19
20
|
/**
|
|
20
21
|
* The auth server deployment's own app id (white-label deployments use a
|
|
21
|
-
* custom value
|
|
22
|
-
*
|
|
22
|
+
* custom value; the client resolves it from its constructor option or
|
|
23
|
+
* the platform default). The id_token `sub` claim is namespaced by it.
|
|
23
24
|
*/
|
|
24
|
-
auth_server_app_id
|
|
25
|
+
auth_server_app_id: AppId;
|
|
25
26
|
defaultTokenAudiences: string | string[];
|
|
26
27
|
storeRefreshToken: (refreshToken: RefreshToken) => void;
|
|
27
28
|
storeUserData: (userData: UserData) => void;
|
|
28
29
|
storeMultipleAccessTokens: (accessTokens: Record<ApiServerId, AccessToken | "AS_HTTP_ONLY_COOKIE">) => void;
|
|
30
|
+
/**
|
|
31
|
+
* Redeems the (just stored) refresh token for access tokens of further
|
|
32
|
+
* audiences. The token endpoint issues one access token per request,
|
|
33
|
+
* so default audiences beyond the first are acquired here through
|
|
34
|
+
* refresh grants right after the code grant.
|
|
35
|
+
*/
|
|
36
|
+
exchangeAuthTokens: (refreshToken: RefreshToken | "AS_HTTP_ONLY_COOKIE", audience: string | string[]) => Promise<SuccessfullyGeneratedTokensRecord>;
|
|
37
|
+
/**
|
|
38
|
+
* Loads the signed-in user's data from the auth server (whoami) using
|
|
39
|
+
* the stored refresh token. The OIDC token response carries identity
|
|
40
|
+
* claims only; the platform's full `UserData` comes from here.
|
|
41
|
+
*/
|
|
42
|
+
fetchUserData: () => Promise<UserData | null>;
|
|
29
43
|
triggerAuthStateChanged: () => void;
|
|
30
44
|
}
|
|
31
|
-
export declare function handleSuccessfulAuthentication({ authorization_code, challenge_time, code_verifier, received_state, expected_nonce, redirect_uri, loadCodeVerifier, loadOAuth2State, loadOidcNonce, debug, environment, adapter, auth_server_url, auth_server_app_id, client_app_id, defaultTokenAudiences, storeRefreshToken, storeUserData, storeMultipleAccessTokens, triggerAuthStateChanged, }: IHandleSuccessfulAuthenticationOpts): Promise<void>;
|
|
45
|
+
export declare function handleSuccessfulAuthentication({ authorization_code, challenge_time, code_verifier, received_state, received_iss, expected_nonce, redirect_uri, loadCodeVerifier, loadOAuth2State, loadOidcNonce, debug, environment, adapter, auth_server_url, auth_server_app_id, client_app_id, defaultTokenAudiences, storeRefreshToken, storeUserData, storeMultipleAccessTokens, exchangeAuthTokens, fetchUserData, triggerAuthStateChanged, }: IHandleSuccessfulAuthenticationOpts): Promise<void>;
|
|
32
46
|
export default handleSuccessfulAuthentication;
|
|
@@ -1,10 +1,17 @@
|
|
|
1
|
-
|
|
1
|
+
// handle-successful-authentication.ts
|
|
2
|
+
//
|
|
3
|
+
// Redeems an authorization code at the auth server's standard OIDC token
|
|
4
|
+
// endpoint (/api/oidc/token) via `openid-client`, then stores the
|
|
5
|
+
// resulting refresh token, access token(s) and user data through the
|
|
6
|
+
// platform adapter.
|
|
7
|
+
import * as oidc from "openid-client";
|
|
8
|
+
import { OIDC_TOKEN_REFRESH_TOKEN_DELIVERY_PARAM, OIDC_TOKEN_RESOURCE_PARAM, PKCE_ProofKeyManager, timingSafeStringEqual, } from "@schemavaults/auth-common";
|
|
9
|
+
import { OIDC_USERINFO_AUDIENCE_ID, } from "@schemavaults/app-definitions";
|
|
2
10
|
import debugPrintTokensAsTable from "./debugPrintTokensAsTable";
|
|
3
11
|
import debugPrintUserDataAsTable from "./debugPrintUserDataAsTable";
|
|
4
|
-
import { z } from "zod";
|
|
5
12
|
import assertHttpOnlyRefreshTokenCookieHasAccompanyingMarkerCookie from "./assert-http-only-refresh-token-has-accompanying-expiry-marker";
|
|
6
|
-
import {
|
|
7
|
-
export async function handleSuccessfulAuthentication({ authorization_code, challenge_time, code_verifier, received_state, expected_nonce, redirect_uri, loadCodeVerifier, loadOAuth2State, loadOidcNonce, debug, environment, adapter, auth_server_url, auth_server_app_id, client_app_id, defaultTokenAudiences, storeRefreshToken, storeUserData, storeMultipleAccessTokens, triggerAuthStateChanged, }) {
|
|
13
|
+
import { classifyOidcTokenError, createOidcClientConfiguration, normalizeOidcIssuer, tokenEndpointResponseToTokensRecord, uidFromOidcSubClaim, } from "./oidc";
|
|
14
|
+
export async function handleSuccessfulAuthentication({ authorization_code, challenge_time, code_verifier, received_state, received_iss, expected_nonce, redirect_uri, loadCodeVerifier, loadOAuth2State, loadOidcNonce, debug, environment, adapter, auth_server_url, auth_server_app_id, client_app_id, defaultTokenAudiences, storeRefreshToken, storeUserData, storeMultipleAccessTokens, exchangeAuthTokens, fetchUserData, triggerAuthStateChanged, }) {
|
|
8
15
|
if (debug) {
|
|
9
16
|
console.log("[SchemaVaultsAuthClient::handleSuccessfulAuthentication]" +
|
|
10
17
|
" " +
|
|
@@ -48,10 +55,11 @@ export async function handleSuccessfulAuthentication({ authorization_code, chall
|
|
|
48
55
|
// callback to defend against. In the redirect flow the verifier is
|
|
49
56
|
// loaded from storage below and the state check MUST run before any
|
|
50
57
|
// code redemption so a mismatched callback can never burn the stored
|
|
51
|
-
// state or trade a victim's code.
|
|
58
|
+
// state or trade a victim's code. (openid-client repeats the check
|
|
59
|
+
// when it validates the authorization response.)
|
|
52
60
|
const isRedirectFlow = typeof code_verifier !== "string" || code_verifier.length === 0;
|
|
61
|
+
let stored_state = null;
|
|
53
62
|
if (isRedirectFlow) {
|
|
54
|
-
let stored_state;
|
|
55
63
|
try {
|
|
56
64
|
stored_state = loadOAuth2State(challenge_time);
|
|
57
65
|
}
|
|
@@ -76,7 +84,7 @@ export async function handleSuccessfulAuthentication({ authorization_code, chall
|
|
|
76
84
|
}
|
|
77
85
|
}
|
|
78
86
|
// Load the stored login replay nonce (redirect flow) BEFORE the code
|
|
79
|
-
// is redeemed, so the
|
|
87
|
+
// is redeemed, so the id_token's `nonce` claim can be verified. In
|
|
80
88
|
// the same-context flow the caller passes `expected_nonce` directly.
|
|
81
89
|
let nonce_to_verify = expected_nonce ?? null;
|
|
82
90
|
if (isRedirectFlow) {
|
|
@@ -155,142 +163,136 @@ export async function handleSuccessfulAuthentication({ authorization_code, chall
|
|
|
155
163
|
console.log("[SchemaVaultsAuthClient] Not attempting to clear code verifiers in this app environment...");
|
|
156
164
|
}
|
|
157
165
|
}
|
|
158
|
-
//
|
|
159
|
-
//
|
|
160
|
-
|
|
166
|
+
// ---- Token audiences ------------------------------------------------
|
|
167
|
+
//
|
|
168
|
+
// The standard token endpoint mints ONE access token per request
|
|
169
|
+
// (RFC 8707 `resource`). The code grant carries the first default
|
|
170
|
+
// audience; any further default audiences are acquired right after
|
|
171
|
+
// through refresh grants. A client with no default audiences
|
|
172
|
+
// exchanges the code for a refresh token + user data only (the access
|
|
173
|
+
// token minted alongside is for the reserved userinfo audience).
|
|
174
|
+
const audiences = Array.isArray(defaultTokenAudiences)
|
|
175
|
+
? [...defaultTokenAudiences]
|
|
176
|
+
: typeof defaultTokenAudiences === "string" &&
|
|
177
|
+
defaultTokenAudiences.length > 0
|
|
178
|
+
? [defaultTokenAudiences]
|
|
179
|
+
: [];
|
|
161
180
|
if (debug) {
|
|
162
|
-
console.log("[SchemaVaultsAuthClient::handleSuccessfulAuthentication()]
|
|
181
|
+
console.log("[SchemaVaultsAuthClient::handleSuccessfulAuthentication()] Default access token audience(s): ", audiences);
|
|
163
182
|
}
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
|
|
167
|
-
|
|
168
|
-
|
|
169
|
-
|
|
170
|
-
|
|
171
|
-
// only; access tokens can be acquired later on demand.
|
|
172
|
-
if (debug) {
|
|
173
|
-
console.log("[SchemaVaultsAuthClient::handleSuccessfulAuthentication()] No access token audience(s) set; exchanging authorization code without minting access tokens");
|
|
174
|
-
}
|
|
175
|
-
audience = [];
|
|
183
|
+
const first_audience = audiences[0];
|
|
184
|
+
const remaining_audiences = audiences.slice(1);
|
|
185
|
+
const wantsHttpOnlyRefreshTokenCookie = typeof adapter.doesSupportHttpOnlyRefreshToken === "function" &&
|
|
186
|
+
adapter.doesSupportHttpOnlyRefreshToken();
|
|
187
|
+
const token_endpoint_parameters = new URLSearchParams();
|
|
188
|
+
if (first_audience) {
|
|
189
|
+
token_endpoint_parameters.set(OIDC_TOKEN_RESOURCE_PARAM, first_audience);
|
|
176
190
|
}
|
|
177
|
-
|
|
178
|
-
|
|
179
|
-
let request_body;
|
|
180
|
-
try {
|
|
181
|
-
const parsed = await authorizationCodePOSTBodySchema.safeParseAsync({
|
|
182
|
-
grant_type: "authorization_code",
|
|
183
|
-
code: authorization_code,
|
|
184
|
-
code_verifier: cached_code_verifier,
|
|
185
|
-
client_app_id,
|
|
186
|
-
audience,
|
|
187
|
-
challenge_time,
|
|
188
|
-
redirect_uri,
|
|
189
|
-
});
|
|
190
|
-
if (!parsed.success) {
|
|
191
|
-
throw parsed.error;
|
|
192
|
-
}
|
|
193
|
-
request_body = parsed.data;
|
|
191
|
+
if (wantsHttpOnlyRefreshTokenCookie) {
|
|
192
|
+
token_endpoint_parameters.set(OIDC_TOKEN_REFRESH_TOKEN_DELIVERY_PARAM, "http_only_cookie");
|
|
194
193
|
}
|
|
195
|
-
|
|
196
|
-
|
|
197
|
-
|
|
194
|
+
// ---- Code redemption via openid-client ------------------------------
|
|
195
|
+
const config = createOidcClientConfiguration({
|
|
196
|
+
auth_server_url,
|
|
197
|
+
client_app_id,
|
|
198
|
+
environment,
|
|
199
|
+
adapter,
|
|
200
|
+
});
|
|
201
|
+
const issuer = normalizeOidcIssuer(auth_server_url);
|
|
202
|
+
if (debug) {
|
|
203
|
+
console.log("[SchemaVaultsAuthClient::handleSuccessfulAuthentication()] Token Endpoint: ", config.serverMetadata().token_endpoint);
|
|
198
204
|
}
|
|
199
|
-
|
|
200
|
-
// The auth server will hash the code_verifier and compare it to the code_challenge
|
|
201
|
-
let response;
|
|
205
|
+
let tokens;
|
|
202
206
|
try {
|
|
203
|
-
if (
|
|
204
|
-
|
|
207
|
+
if (isRedirectFlow) {
|
|
208
|
+
if (typeof redirect_uri !== "string" || redirect_uri.length === 0) {
|
|
209
|
+
throw new Error("Cannot redeem an authorization code from a redirect callback without the 'redirect_uri' it was issued for (is 'authorize_uri' configured?)");
|
|
210
|
+
}
|
|
211
|
+
// Reconstruct the authorization response URL openid-client
|
|
212
|
+
// validates (RFC 6749 §4.1.2 + RFC 9207): the redirect_uri the code
|
|
213
|
+
// was issued for, plus the `code`, `state` and `iss` parameters the
|
|
214
|
+
// auth server appended to it.
|
|
215
|
+
const callback_url = new URL(redirect_uri);
|
|
216
|
+
callback_url.searchParams.set("code", authorization_code);
|
|
217
|
+
callback_url.searchParams.set("state", stored_state);
|
|
218
|
+
if (typeof received_iss === "string" && received_iss.length > 0) {
|
|
219
|
+
callback_url.searchParams.set("iss", received_iss);
|
|
220
|
+
}
|
|
221
|
+
else {
|
|
222
|
+
// Callers that predate the `received_iss` argument cannot forward
|
|
223
|
+
// the callback's `iss`. The configured issuer is substituted so the
|
|
224
|
+
// exchange still proceeds under the (already verified) state + PKCE
|
|
225
|
+
// bindings — equivalent to the pre-openid-client SDK, which never
|
|
226
|
+
// checked `iss`. Forward it to get the mix-up defense.
|
|
227
|
+
if (debug) {
|
|
228
|
+
console.warn("[SchemaVaultsAuthClient::handleSuccessfulAuthentication()] No 'iss' callback parameter supplied; skipping RFC 9207 issuer check");
|
|
229
|
+
}
|
|
230
|
+
callback_url.searchParams.set("iss", issuer);
|
|
231
|
+
}
|
|
232
|
+
tokens = await oidc.authorizationCodeGrant(config, callback_url, {
|
|
233
|
+
pkceCodeVerifier: cached_code_verifier,
|
|
234
|
+
expectedState: stored_state,
|
|
235
|
+
// Always a string in the redirect flow (validated above): the
|
|
236
|
+
// id_token MUST carry the matching `nonce` claim.
|
|
237
|
+
expectedNonce: nonce_to_verify,
|
|
238
|
+
idTokenExpected: true,
|
|
239
|
+
}, token_endpoint_parameters);
|
|
205
240
|
}
|
|
206
|
-
|
|
207
|
-
|
|
208
|
-
|
|
209
|
-
|
|
210
|
-
|
|
211
|
-
|
|
212
|
-
|
|
213
|
-
|
|
214
|
-
|
|
215
|
-
|
|
241
|
+
else {
|
|
242
|
+
// Same-context flow (the auth server's own login page): the code
|
|
243
|
+
// was returned directly by the auth server's login API, so there
|
|
244
|
+
// is no callback URL / redirect_uri to validate. Redeem it with a
|
|
245
|
+
// plain authorization_code grant; openid-client still validates
|
|
246
|
+
// the id_token's iss/aud/exp, and the nonce is checked below.
|
|
247
|
+
const parameters = new URLSearchParams(token_endpoint_parameters);
|
|
248
|
+
parameters.set("code", authorization_code);
|
|
249
|
+
parameters.set("code_verifier", cached_code_verifier);
|
|
250
|
+
tokens = await oidc.genericGrantRequest(config, "authorization_code", parameters);
|
|
251
|
+
const claims = tokens.claims();
|
|
252
|
+
if (!claims) {
|
|
253
|
+
throw new Error("Token response did not include an id_token");
|
|
254
|
+
}
|
|
255
|
+
if (nonce_to_verify) {
|
|
256
|
+
const echoed_nonce = claims.nonce;
|
|
257
|
+
if (typeof echoed_nonce !== "string" ||
|
|
258
|
+
!timingSafeStringEqual(nonce_to_verify, echoed_nonce)) {
|
|
259
|
+
console.error("[SchemaVaultsAuthClient::handleSuccessfulAuthentication()] " +
|
|
260
|
+
"Login nonce mismatch in id_token");
|
|
261
|
+
throw new Error("Login nonce mismatch in token response — possible replay");
|
|
262
|
+
}
|
|
263
|
+
}
|
|
216
264
|
}
|
|
217
265
|
}
|
|
218
266
|
catch (e) {
|
|
219
|
-
|
|
220
|
-
|
|
221
|
-
|
|
222
|
-
|
|
223
|
-
|
|
224
|
-
|
|
225
|
-
throw new Error(errorMsg);
|
|
267
|
+
const classified = classifyOidcTokenError(e);
|
|
268
|
+
console.error("Failed to exchange authorization code for access token:", classified.message);
|
|
269
|
+
if (debug) {
|
|
270
|
+
console.error(e);
|
|
271
|
+
}
|
|
272
|
+
throw new Error(`Failed to exchange authorization code for access token: ${classified.message}`, { cause: e });
|
|
226
273
|
}
|
|
227
274
|
if (debug) {
|
|
228
275
|
console.log("[SchemaVaultsAuthClient::handleSuccessfulAuthentication()] " +
|
|
229
276
|
"Successfully exchanged authorization code for token(s)");
|
|
230
277
|
}
|
|
231
|
-
|
|
232
|
-
let
|
|
233
|
-
let
|
|
234
|
-
let user;
|
|
278
|
+
// ---- Translate the token response ------------------------------------
|
|
279
|
+
let record;
|
|
280
|
+
let uid;
|
|
235
281
|
try {
|
|
236
|
-
const
|
|
237
|
-
|
|
238
|
-
|
|
239
|
-
}
|
|
240
|
-
|
|
241
|
-
|
|
242
|
-
|
|
243
|
-
|
|
244
|
-
|
|
245
|
-
|
|
246
|
-
|
|
247
|
-
}
|
|
248
|
-
if (debug) {
|
|
249
|
-
console.log("[SchemaVaultsAuthClient::handleSuccessfulAuthentication()] Success response data: ", tokens_data.data);
|
|
250
|
-
}
|
|
251
|
-
// Login replay-nonce verification: the server echoes the nonce that
|
|
252
|
-
// was bound to the redeemed authorization code at login time. A
|
|
253
|
-
// missing or mismatched echo means the token response was not
|
|
254
|
-
// produced for THIS flow's code — reject it.
|
|
255
|
-
if (nonce_to_verify) {
|
|
256
|
-
const echoed_nonce = tokens_data.data.nonce;
|
|
257
|
-
if (typeof echoed_nonce !== "string" ||
|
|
258
|
-
!timingSafeStringEqual(nonce_to_verify, echoed_nonce)) {
|
|
259
|
-
console.error("[SchemaVaultsAuthClient::handleSuccessfulAuthentication()] " +
|
|
260
|
-
"Login nonce mismatch in token response");
|
|
261
|
-
throw new Error("Login nonce mismatch in token response — possible replay");
|
|
262
|
-
}
|
|
263
|
-
}
|
|
264
|
-
const { tokens, userData } = tokens_data.data;
|
|
265
|
-
if (!tokens) {
|
|
266
|
-
console.error("Did not receive tokens in response from auth server");
|
|
267
|
-
throw new Error("Did not receive tokens in response from auth server");
|
|
268
|
-
}
|
|
269
|
-
if (!tokens.access) {
|
|
270
|
-
console.error("Did not receive any access tokens in response from auth server");
|
|
271
|
-
throw new Error("Did not receive any access tokens in response from auth server");
|
|
272
|
-
}
|
|
273
|
-
if (!tokens.refresh ||
|
|
274
|
-
(typeof tokens.refresh !== "object" && typeof tokens.refresh !== "string")) {
|
|
275
|
-
console.error("Did not receive (valid) refresh token in response from auth server.", `Type: ${typeof tokens.refresh}`, tokens.refresh);
|
|
276
|
-
throw new Error("Did not receive refresh token in response from auth server");
|
|
277
|
-
}
|
|
282
|
+
const claims = tokens.claims();
|
|
283
|
+
if (!claims) {
|
|
284
|
+
throw new Error("Token response did not include an id_token");
|
|
285
|
+
}
|
|
286
|
+
uid = uidFromOidcSubClaim(claims.sub, auth_server_app_id, debug);
|
|
287
|
+
record = tokenEndpointResponseToTokensRecord({
|
|
288
|
+
response: tokens,
|
|
289
|
+
audience: first_audience ?? OIDC_USERINFO_AUDIENCE_ID,
|
|
290
|
+
uid,
|
|
291
|
+
auth_server_url: issuer,
|
|
292
|
+
});
|
|
278
293
|
if (debug) {
|
|
279
|
-
debugPrintTokensAsTable(
|
|
294
|
+
debugPrintTokensAsTable(record);
|
|
280
295
|
}
|
|
281
|
-
access_tokens = tokens.access;
|
|
282
|
-
refresh_token = tokens.refresh;
|
|
283
|
-
refresh_token_expiry = tokens.refresh_token_expiry;
|
|
284
|
-
if (!userData) {
|
|
285
|
-
console.error("Did not receive user data in response from auth server");
|
|
286
|
-
throw new Error("Did not receive user data in response from auth server");
|
|
287
|
-
}
|
|
288
|
-
else {
|
|
289
|
-
if (debug) {
|
|
290
|
-
debugPrintUserDataAsTable(userData);
|
|
291
|
-
}
|
|
292
|
-
}
|
|
293
|
-
user = userData;
|
|
294
296
|
}
|
|
295
297
|
catch (e) {
|
|
296
298
|
let errorMessage = "Unknown error";
|
|
@@ -300,10 +302,17 @@ export async function handleSuccessfulAuthentication({ authorization_code, chall
|
|
|
300
302
|
console.error("Failed to parse tokens response: ", errorMessage);
|
|
301
303
|
throw new Error(`Failed to parse tokens response: ${errorMessage}`);
|
|
302
304
|
}
|
|
303
|
-
|
|
305
|
+
const access_tokens = record.access;
|
|
306
|
+
if (!access_tokens) {
|
|
307
|
+
throw new Error("Did not receive any access tokens in response from auth server");
|
|
308
|
+
}
|
|
309
|
+
const refresh_token = record.refresh;
|
|
310
|
+
if (!refresh_token) {
|
|
311
|
+
throw new Error("Did not receive refresh token in response from auth server");
|
|
312
|
+
}
|
|
313
|
+
// ---- Store refresh token -------------------------------------------
|
|
304
314
|
const doStoreReceivedRefreshToken = () => {
|
|
305
315
|
if (typeof refresh_token === "object" && refresh_token.type === "refresh") {
|
|
306
|
-
refresh_token_expiry = refresh_token.exp;
|
|
307
316
|
try {
|
|
308
317
|
if (debug) {
|
|
309
318
|
console.log("[SchemaVaultsAuthClient] Storing refresh token...");
|
|
@@ -320,14 +329,13 @@ export async function handleSuccessfulAuthentication({ authorization_code, chall
|
|
|
320
329
|
}
|
|
321
330
|
else if (typeof refresh_token === "string" &&
|
|
322
331
|
refresh_token === "AS_HTTP_ONLY_COOKIE") {
|
|
323
|
-
|
|
324
|
-
adapter.doesSupportHttpOnlyRefreshToken();
|
|
325
|
-
if (!supportsHttpOnlyRefreshTokenCookie) {
|
|
332
|
+
if (!wantsHttpOnlyRefreshTokenCookie) {
|
|
326
333
|
throw new Error("Received refresh token cookie 'AS_HTTP_ONLY_COOKIE', but this auth client instance's adapter does not support it!");
|
|
327
334
|
}
|
|
328
335
|
if (typeof adapter.storeHttpOnlyRefreshTokenMarker !== "function") {
|
|
329
336
|
throw new TypeError("Expected auth client adapter to have method 'storeHttpOnlyRefreshTokenMarker'!");
|
|
330
337
|
}
|
|
338
|
+
const refresh_token_expiry = record.refresh_token_expiry;
|
|
331
339
|
if (typeof refresh_token_expiry !== "number") {
|
|
332
340
|
throw new TypeError("Expected 'refresh_token_expiry' to be a number if refresh token was passed as HTTP-only cookie!");
|
|
333
341
|
}
|
|
@@ -343,8 +351,39 @@ export async function handleSuccessfulAuthentication({ authorization_code, chall
|
|
|
343
351
|
}
|
|
344
352
|
};
|
|
345
353
|
doStoreReceivedRefreshToken();
|
|
346
|
-
// Store access
|
|
354
|
+
// ---- Store access token(s) -----------------------------------------
|
|
347
355
|
storeMultipleAccessTokens(access_tokens);
|
|
356
|
+
if (remaining_audiences.length > 0) {
|
|
357
|
+
if (debug) {
|
|
358
|
+
console.log("[SchemaVaultsAuthClient] Acquiring access tokens for remaining default audiences via refresh grant(s): ", remaining_audiences);
|
|
359
|
+
}
|
|
360
|
+
try {
|
|
361
|
+
await exchangeAuthTokens(refresh_token, remaining_audiences);
|
|
362
|
+
}
|
|
363
|
+
catch (e) {
|
|
364
|
+
console.error("[SchemaVaultsAuthClient] Failed to acquire access tokens for remaining default audiences: ", e);
|
|
365
|
+
throw new Error("Failed to acquire access tokens for the remaining default audiences", { cause: e });
|
|
366
|
+
}
|
|
367
|
+
}
|
|
368
|
+
// ---- User data -----------------------------------------------------
|
|
369
|
+
let user;
|
|
370
|
+
try {
|
|
371
|
+
user = await fetchUserData();
|
|
372
|
+
}
|
|
373
|
+
catch (e) {
|
|
374
|
+
console.error("Failed to load user data after login: ", e);
|
|
375
|
+
throw new Error("Failed to load user data after login", { cause: e });
|
|
376
|
+
}
|
|
377
|
+
if (!user) {
|
|
378
|
+
console.error("Did not receive user data from auth server after login");
|
|
379
|
+
throw new Error("Did not receive user data from auth server after login");
|
|
380
|
+
}
|
|
381
|
+
if (user.uid !== uid) {
|
|
382
|
+
throw new Error("User data returned by the auth server does not belong to the authenticated subject");
|
|
383
|
+
}
|
|
384
|
+
if (debug) {
|
|
385
|
+
debugPrintUserDataAsTable(user);
|
|
386
|
+
}
|
|
348
387
|
try {
|
|
349
388
|
if (debug) {
|
|
350
389
|
console.log("[SchemaVaultsAuthClient] Storing user data...");
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"handle-successful-authentication.js","sourceRoot":"","sources":["../../src/lib/handle-successful-authentication.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,qCAAqC,EACrC,oBAAoB,EAEpB,+BAA+B,GAEhC,MAAM,2BAA2B,CAAC;AACnC,OAAO,uBAAuB,MAAM,2BAA2B,CAAC;AAChE,OAAO,yBAAyB,MAAM,6BAA6B,CAAC;AAOpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,2DAA2D,MAAM,iEAAiE,CAAC;AAC1I,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AA6ClE,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,cAAc,EACd,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,KAAK,EACL,WAAW,EACX,OAAO,EACP,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,EACb,yBAAyB,EACzB,uBAAuB,GACa;IACpC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,0DAA0D;YACxD,GAAG;YACH,uCAAuC,CAC1C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;SAAM,IACL,OAAO,kBAAkB,KAAK,QAAQ;QACtC,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAC/B,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,cAAc,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,iCAAiC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC;IACtE,IAAI,iCAAiC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,iCAAiC,GAAG,oBAAoB,CAAC,OAAO,EAAE,CAAC;QACrE,OAAO,CAAC,KAAK,CACX,4GAA4G,CAC7G,CAAC;QACF,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC;gBACH,OAAO,CAAC,KAAK,CAAC;oBACZ,cAAc;oBACd,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;oBACxB,YAAY,EAAE,iCAAiC;oBAC/C,OAAO,EAAE,oBAAoB,CAAC,OAAO;iBACtC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAU,EAAE,CAAC;gBACpB,KAAK,CAAC,CAAC,CAAC,YAAY;YACtB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,iEAAiE;IACjE,mEAAmE;IACnE,oEAAoE;IACpE,qEAAqE;IACrE,kCAAkC;IAClC,MAAM,cAAc,GAClB,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC;IAClE,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,YAA2B,CAAC;QAChC,IAAI,CAAC;YACH,YAAY,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CACX,+FAA+F,EAC/F,CAAC,CACF,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;YACzD,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,KAAK,CACX,gFAAgF,EAChF;oBACE,mBAAmB,EAAE,YAAY,CAAC,MAAM;oBACxC,qBAAqB,EAAE,cAAc,CAAC,MAAM;iBAC7C,CACF,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,qEAAqE;IACrE,qEAAqE;IACrE,IAAI,eAAe,GAAkB,cAAc,IAAI,IAAI,CAAC;IAC5D,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,YAA2B,CAAC;QAChC,IAAI,CAAC;YACH,YAAY,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CACX,8FAA8F,EAC9F,CAAC,CACF,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,eAAe,GAAG,YAAY,CAAC;IACjC,CAAC;IAED,4DAA4D;IAC5D,sDAAsD;IACtD,sDAAsD;IACtD,kFAAkF;IAElF,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,2BAA2B;YACzB,0EAA0E,CAC7E,CAAC;IACJ,CAAC;IAED,MAAM,oBAAoB,GACxB,aAAa,IAAI,gBAAgB,CAAC,cAAc,CAAC,CAAC;IACpD,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,MAAM,YAAY,GAAW,2EAA2E,cAAc,EAAE,CAAC;QACzH,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;IAChC,CAAC;IACD,oBAAqC,CAAC;IAEtC,MAAM,gCAAgC,GACpC,WAAW,KAAK,aAAa,CAAC;IAEhC,IAAI,gCAAgC,EAAE,CAAC;QACrC,uCAAuC;QACvC,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CACT,2BAA2B;oBACzB,0FAA0F,EAC5F,cAAc,CACf,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CACT,8DAA8D,CAC/D,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CACX,2DAA2D,EAC3D,CAAC,CACF,CAAC;YACF,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,+DAA+D;QAC/D,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,OAAO,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;YAC3C,CAAC;YAAC,OAAO,CAAU,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CACX,yDAAyD,EACzD,CAAC,CACF,CAAC;gBACF,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,CAAU,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CACX,wDAAwD,EACxD,CAAC,CACF,CAAC;gBACF,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CACT,4FAA4F,CAC7F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,iCAAiC,GAAG,IAAI,GAAG,CAC/C,sCAAsC,aAAa,EAAW,EAC9D,eAAe,CAChB,CAAC,QAAQ,EAAE,CAAC;IACb,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,6EAA6E,EAC7E,iCAAiC,CAClC,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,GAAsB,qBAAqB,CAAC;IACxD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,+FAA+F,EAC/F,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACpE,oEAAoE;QACpE,mEAAmE;QACnE,uDAAuD;QACvD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CACT,yJAAyJ,CAC1J,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,EAAE,CAAC;IAChB,CAAC;IAED,MAAM,+BAA+B,GAAG,qCAAqC,CAC3E,CAAC,EACD,WAAW,EACX,EAAE,eAAe,EAAE,kBAAkB,EAAE,CACxC,CAAC;IAEF,sDAAsD;IACtD,IAAI,YAA6D,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC,cAAc,CAAC;YAClE,UAAU,EAAE,oBAA6B;YACzC,IAAI,EAAE,kBAAkB;YACxB,aAAa,EAAE,oBAAoB;YACnC,aAAa;YACb,QAAQ;YACR,cAAc;YACd,YAAY;SAC6C,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,MAAM,CAAC,KAAK,CAAC;QACrB,CAAC;QACD,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC;IAC7B,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CACX,kEAAkE,EAClE,CAAC,CACF,CAAC;QACF,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,sCAAsC;IACtC,mFAAmF;IAEnF,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CACT,iHAAiH,iCAAiC,GAAG,EACrJ,YAAY,CACb,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC;YAClC,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;SACF,CAAC,CAAC;QAEH,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CACT,yGAAyG,EACzG,QAAQ,CACT,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,yDAAyD,EAAE,CAAC,CAAC,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACzD,MAAM,QAAQ,GAAW,wEAAwE,QAAQ,CAAC,MAAM,GAAG,CAAC;QACpH,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,6DAA6D;YAC3D,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IAED,IAAI,aAAuE,CAAC;IAC5E,IAAI,aAAmD,CAAC;IACxD,IAAI,oBAAwC,CAAC;IAC7C,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,+BAA+B,CAAC,CAAC,EAAE,WAAW,EAAE;YACxE,eAAe;YACf,kBAAkB;SACnB,CAAC,CAAC,cAAc,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,CAAC,KAAK,CACX,6DAA6D;gBAC3D,mDAAmD,EACrD,WAAW,CAAC,KAAK,CAClB,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;aAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CACT,oFAAoF,EACpF,WAAW,CAAC,IAAI,CACjB,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,gEAAgE;QAChE,8DAA8D;QAC9D,6CAA6C;QAC7C,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,YAAY,GAAuB,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;YAChE,IACE,OAAO,YAAY,KAAK,QAAQ;gBAChC,CAAC,qBAAqB,CAAC,eAAe,EAAE,YAAY,CAAC,EACrD,CAAC;gBACD,OAAO,CAAC,KAAK,CACX,6DAA6D;oBAC3D,wCAAwC,CAC3C,CAAC;gBACF,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACrE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,CAAC,KAAK,CACX,gEAAgE,CACjE,CAAC;YACF,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;QACJ,CAAC;QAED,IACE,CAAC,MAAM,CAAC,OAAO;YACf,CAAC,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,EAC1E,CAAC;YACD,OAAO,CAAC,KAAK,CACX,qEAAqE,EACrE,SAAS,OAAO,MAAM,CAAC,OAAO,EAAE,EAChC,MAAM,CAAC,OAAO,CACf,CAAC;YACF,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QAED,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,CAAC;QAEnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;aAAM,CAAC;YACN,IAAI,KAAK,EAAE,CAAC;gBACV,yBAAyB,CAAC,QAA2B,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QACD,IAAI,GAAG,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,IAAI,YAAY,GAAW,eAAe,CAAC;QAC3C,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;YACvB,YAAY,GAAG,CAAC,CAAC,OAAO,CAAC;QAC3B,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,YAAY,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,oCAAoC,YAAY,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,sBAAsB;IACtB,MAAM,2BAA2B,GAAG,GAAG,EAAE;QACvC,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC1E,oBAAoB,GAAG,aAAa,CAAC,GAAG,CAAC;YACzC,IAAI,CAAC;gBACH,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;gBACnE,CAAC;gBACD,iBAAiB,CAAC,aAAa,CAAC,CAAC;gBACjC,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;gBAChE,CAAC;YACH,CAAC;YAAC,OAAO,CAAU,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;aAAM,IACL,OAAO,aAAa,KAAK,QAAQ;YACjC,aAAa,KAAK,qBAAqB,EACvC,CAAC;YACD,MAAM,kCAAkC,GACtC,OAAO,OAAO,CAAC,+BAA+B,KAAK,UAAU;gBAC7D,OAAO,CAAC,+BAA+B,EAAE,CAAC;YAE5C,IAAI,CAAC,kCAAkC,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CACb,mHAAmH,CACpH,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,OAAO,CAAC,+BAA+B,KAAK,UAAU,EAAE,CAAC;gBAClE,MAAM,IAAI,SAAS,CACjB,gFAAgF,CACjF,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,oBAAoB,KAAK,QAAQ,EAAE,CAAC;gBAC7C,MAAM,IAAI,SAAS,CACjB,iGAAiG,CAClG,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,+BAA+B,CACrC,oBAAqC,CACvB,CAAC;YAEjB,2DAA2D,CACzD,OAAO,CACO,CAAC;YAEjB,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CACT,yFAAyF,CAC1F,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC;IACF,2BAA2B,EAAE,CAAC;IAE9B,sBAAsB;IACtB,yBAAyB,CAAC,aAAa,CAAC,CAAC;IAEzC,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC/D,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,CAAC,CAAC,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;IACzE,CAAC;IACD,uBAAuB,EAAE,CAAC;IAC1B,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,OAAO;AACT,CAAC;AAED,eAAe,8BAA8B,CAAC"}
|
|
1
|
+
{"version":3,"file":"handle-successful-authentication.js","sourceRoot":"","sources":["../../src/lib/handle-successful-authentication.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,yEAAyE;AACzE,kEAAkE;AAClE,qEAAqE;AACrE,oBAAoB;AAEpB,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,EAEL,uCAAuC,EACvC,yBAAyB,EACzB,oBAAoB,EAIpB,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,yBAAyB,GAI1B,MAAM,+BAA+B,CAAC;AACvC,OAAO,uBAAuB,MAAM,2BAA2B,CAAC;AAChE,OAAO,yBAAyB,MAAM,6BAA6B,CAAC;AAEpE,OAAO,2DAA2D,MAAM,iEAAiE,CAAC;AAC1I,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,mBAAmB,EACnB,mCAAmC,EACnC,mBAAmB,GACpB,MAAM,QAAQ,CAAC;AAiEhB,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,cAAc,EACd,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,KAAK,EACL,WAAW,EACX,OAAO,EACP,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,EACb,yBAAyB,EACzB,kBAAkB,EAClB,aAAa,EACb,uBAAuB,GACa;IACpC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,0DAA0D;YACxD,GAAG;YACH,uCAAuC,CAC1C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;SAAM,IACL,OAAO,kBAAkB,KAAK,QAAQ;QACtC,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAC/B,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,cAAc,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,iCAAiC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC;IACtE,IAAI,iCAAiC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,iCAAiC,GAAG,oBAAoB,CAAC,OAAO,EAAE,CAAC;QACrE,OAAO,CAAC,KAAK,CACX,4GAA4G,CAC7G,CAAC;QACF,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC;gBACH,OAAO,CAAC,KAAK,CAAC;oBACZ,cAAc;oBACd,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;oBACxB,YAAY,EAAE,iCAAiC;oBAC/C,OAAO,EAAE,oBAAoB,CAAC,OAAO;iBACtC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAU,EAAE,CAAC;gBACpB,KAAK,CAAC,CAAC,CAAC,YAAY;YACtB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,iEAAiE;IACjE,mEAAmE;IACnE,oEAAoE;IACpE,qEAAqE;IACrE,mEAAmE;IACnE,iDAAiD;IACjD,MAAM,cAAc,GAClB,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC;IAClE,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,YAAY,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CACX,+FAA+F,EAC/F,CAAC,CACF,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;YACzD,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,KAAK,CACX,gFAAgF,EAChF;oBACE,mBAAmB,EAAE,YAAY,CAAC,MAAM;oBACxC,qBAAqB,EAAE,cAAc,CAAC,MAAM;iBAC7C,CACF,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,mEAAmE;IACnE,qEAAqE;IACrE,IAAI,eAAe,GAAkB,cAAc,IAAI,IAAI,CAAC;IAC5D,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,YAA2B,CAAC;QAChC,IAAI,CAAC;YACH,YAAY,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CACX,8FAA8F,EAC9F,CAAC,CACF,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,eAAe,GAAG,YAAY,CAAC;IACjC,CAAC;IAED,4DAA4D;IAC5D,sDAAsD;IACtD,sDAAsD;IACtD,kFAAkF;IAElF,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,2BAA2B;YACzB,0EAA0E,CAC7E,CAAC;IACJ,CAAC;IAED,MAAM,oBAAoB,GACxB,aAAa,IAAI,gBAAgB,CAAC,cAAc,CAAC,CAAC;IACpD,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,MAAM,YAAY,GAAW,2EAA2E,cAAc,EAAE,CAAC;QACzH,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;IAChC,CAAC;IACD,oBAAqC,CAAC;IAEtC,MAAM,gCAAgC,GACpC,WAAW,KAAK,aAAa,CAAC;IAEhC,IAAI,gCAAgC,EAAE,CAAC;QACrC,uCAAuC;QACvC,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CACT,2BAA2B;oBACzB,0FAA0F,EAC5F,cAAc,CACf,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CACT,8DAA8D,CAC/D,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CACX,2DAA2D,EAC3D,CAAC,CACF,CAAC;YACF,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,+DAA+D;QAC/D,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,OAAO,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;YAC3C,CAAC;YAAC,OAAO,CAAU,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CACX,yDAAyD,EACzD,CAAC,CACF,CAAC;gBACF,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,CAAU,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CACX,wDAAwD,EACxD,CAAC,CACF,CAAC;gBACF,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CACT,4FAA4F,CAC7F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,EAAE;IACF,iEAAiE;IACjE,kEAAkE;IAClE,mEAAmE;IACnE,6DAA6D;IAC7D,sEAAsE;IACtE,iEAAiE;IACjE,MAAM,SAAS,GAAa,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC;QAC9D,CAAC,CAAC,CAAC,GAAG,qBAAqB,CAAC;QAC5B,CAAC,CAAC,OAAO,qBAAqB,KAAK,QAAQ;YACvC,qBAAqB,CAAC,MAAM,GAAG,CAAC;YAClC,CAAC,CAAC,CAAC,qBAAqB,CAAC;YACzB,CAAC,CAAC,EAAE,CAAC;IACT,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,+FAA+F,EAC/F,SAAS,CACV,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAuB,SAAS,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,mBAAmB,GAAa,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEzD,MAAM,+BAA+B,GACnC,OAAO,OAAO,CAAC,+BAA+B,KAAK,UAAU;QAC7D,OAAO,CAAC,+BAA+B,EAAE,CAAC;IAE5C,MAAM,yBAAyB,GAAG,IAAI,eAAe,EAAE,CAAC;IACxD,IAAI,cAAc,EAAE,CAAC;QACnB,yBAAyB,CAAC,GAAG,CAAC,yBAAyB,EAAE,cAAc,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,+BAA+B,EAAE,CAAC;QACpC,yBAAyB,CAAC,GAAG,CAC3B,uCAAuC,EACvC,kBAAkB,CACnB,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,MAAM,MAAM,GAAuB,6BAA6B,CAAC;QAC/D,eAAe;QACf,aAAa;QACb,WAAW;QACX,OAAO;KACR,CAAC,CAAC;IACH,MAAM,MAAM,GAAW,mBAAmB,CAAC,eAAe,CAAC,CAAC;IAE5D,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,6EAA6E,EAC7E,MAAM,CAAC,cAAc,EAAE,CAAC,cAAc,CACvC,CAAC;IACJ,CAAC;IAED,IAAI,MAAsE,CAAC;IAC3E,IAAI,CAAC;QACH,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClE,MAAM,IAAI,KAAK,CACb,4IAA4I,CAC7I,CAAC;YACJ,CAAC;YACD,2DAA2D;YAC3D,oEAAoE;YACpE,oEAAoE;YACpE,8BAA8B;YAC9B,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;YAC3C,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;YAC1D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,YAAsB,CAAC,CAAC;YAC/D,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChE,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YACrD,CAAC;iBAAM,CAAC;gBACN,kEAAkE;gBAClE,oEAAoE;gBACpE,oEAAoE;gBACpE,kEAAkE;gBAClE,uDAAuD;gBACvD,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,CAAC,IAAI,CACV,iIAAiI,CAClI,CAAC;gBACJ,CAAC;gBACD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC/C,CAAC;YAED,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CACxC,MAAM,EACN,YAAY,EACZ;gBACE,gBAAgB,EAAE,oBAAoB;gBACtC,aAAa,EAAE,YAAsB;gBACrC,8DAA8D;gBAC9D,kDAAkD;gBAClD,aAAa,EAAE,eAAyB;gBACxC,eAAe,EAAE,IAAI;aACtB,EACD,yBAAyB,CAC1B,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,iEAAiE;YACjE,iEAAiE;YACjE,kEAAkE;YAClE,gEAAgE;YAChE,8DAA8D;YAC9D,MAAM,UAAU,GAAG,IAAI,eAAe,CAAC,yBAAyB,CAAC,CAAC;YAClE,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;YAC3C,UAAU,CAAC,GAAG,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC;YACtD,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CACrC,MAAM,EACN,oBAAoB,EACpB,UAAU,CACX,CAAC;YACF,MAAM,MAAM,GAA6B,MAAM,CAAC,MAAM,EAAE,CAAC;YACzD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,YAAY,GAAY,MAAM,CAAC,KAAK,CAAC;gBAC3C,IACE,OAAO,YAAY,KAAK,QAAQ;oBAChC,CAAC,qBAAqB,CAAC,eAAe,EAAE,YAAY,CAAC,EACrD,CAAC;oBACD,OAAO,CAAC,KAAK,CACX,6DAA6D;wBAC3D,kCAAkC,CACrC,CAAC;oBACF,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,MAAM,UAAU,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,KAAK,CACX,yDAAyD,EACzD,UAAU,CAAC,OAAO,CACnB,CAAC;QACF,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,2DAA2D,UAAU,CAAC,OAAO,EAAE,EAC/E,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,6DAA6D;YAC3D,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,IAAI,MAAyC,CAAC;IAC9C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,MAAM,GAA6B,MAAM,CAAC,MAAM,EAAE,CAAC;QACzD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,GAAG,GAAG,mBAAmB,CAAC,MAAM,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC;QACjE,MAAM,GAAG,mCAAmC,CAAC;YAC3C,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,cAAc,IAAI,yBAAyB;YACrD,GAAG;YACH,eAAe,EAAE,MAAM;SACxB,CAAC,CAAC;QACH,IAAI,KAAK,EAAE,CAAC;YACV,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,IAAI,YAAY,GAAW,eAAe,CAAC;QAC3C,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;YACvB,YAAY,GAAG,CAAC,CAAC,OAAO,CAAC;QAC3B,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,YAAY,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,oCAAoC,YAAY,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACpC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GACjB,MAAM,CAAC,OAAO,CAAC;IACjB,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,MAAM,2BAA2B,GAAG,GAAG,EAAE;QACvC,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC1E,IAAI,CAAC;gBACH,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;gBACnE,CAAC;gBACD,iBAAiB,CAAC,aAAa,CAAC,CAAC;gBACjC,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;gBAChE,CAAC;YACH,CAAC;YAAC,OAAO,CAAU,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;aAAM,IACL,OAAO,aAAa,KAAK,QAAQ;YACjC,aAAa,KAAK,qBAAqB,EACvC,CAAC;YACD,IAAI,CAAC,+BAA+B,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CACb,mHAAmH,CACpH,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,OAAO,CAAC,+BAA+B,KAAK,UAAU,EAAE,CAAC;gBAClE,MAAM,IAAI,SAAS,CACjB,gFAAgF,CACjF,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GACxB,MAAM,CAAC,oBAAoB,CAAC;YAC9B,IAAI,OAAO,oBAAoB,KAAK,QAAQ,EAAE,CAAC;gBAC7C,MAAM,IAAI,SAAS,CACjB,iGAAiG,CAClG,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,+BAA+B,CACrC,oBAAqC,CACvB,CAAC;YAEjB,2DAA2D,CACzD,OAAO,CACO,CAAC;YAEjB,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CACT,yFAAyF,CAC1F,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC;IACF,2BAA2B,EAAE,CAAC;IAE9B,uEAAuE;IACvE,yBAAyB,CAAC,aAAa,CAAC,CAAC;IAEzC,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CACT,yGAAyG,EACzG,mBAAmB,CACpB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,kBAAkB,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CACX,4FAA4F,EAC5F,CAAC,CACF,CAAC;YACF,MAAM,IAAI,KAAK,CACb,qEAAqE,EACrE,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,IAAI,IAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,aAAa,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,sCAAsC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,yBAAyB,CAAC,IAAuB,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC/D,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,CAAC,CAAC,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;IACzE,CAAC;IACD,uBAAuB,EAAE,CAAC;IAC1B,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,OAAO;AACT,CAAC;AAED,eAAe,8BAA8B,CAAC"}
|
|
@@ -2,7 +2,8 @@ import { type AccessToken, type SuccessfullyGeneratedTokensRecord, type UserData
|
|
|
2
2
|
import type { ISchemaVaultsAuthClientAdapter } from "../types/ISchemaVaultsAuthClientAdapter";
|
|
3
3
|
import type { ApiServerId, AppId, SchemaVaultsAppEnvironment } from "@schemavaults/app-definitions";
|
|
4
4
|
export interface IHandleSuccessfulExchangeAuthTokensResponseOpts {
|
|
5
|
-
|
|
5
|
+
/** The tokens record built from the refresh grant response(s). */
|
|
6
|
+
tokens: SuccessfullyGeneratedTokensRecord;
|
|
6
7
|
debug: boolean;
|
|
7
8
|
environment: SchemaVaultsAppEnvironment;
|
|
8
9
|
adapter: ISchemaVaultsAuthClientAdapter;
|
|
@@ -16,14 +17,17 @@ export interface IHandleSuccessfulExchangeAuthTokensResponseOpts {
|
|
|
16
17
|
auth_server_app_id?: AppId;
|
|
17
18
|
storeMultipleAccessTokens: (access_tokens: Record<ApiServerId, AccessToken | "AS_HTTP_ONLY_COOKIE">) => void;
|
|
18
19
|
/**
|
|
19
|
-
*
|
|
20
|
-
*
|
|
21
|
-
*
|
|
22
|
-
*
|
|
23
|
-
*
|
|
20
|
+
* Re-loads the user's data from the auth server after the exchange.
|
|
21
|
+
* The refresh grant loads user data fresh from the database when
|
|
22
|
+
* minting tokens (server-side guards reading the rotated refresh
|
|
23
|
+
* token see the new claims), and the whoami re-sync here propagates
|
|
24
|
+
* claims that changed since login (e.g. `email_verified` after
|
|
25
|
+
* completing email verification) to `currentUser` without requiring
|
|
26
|
+
* a re-login. Failures are non-fatal: the tokens are already stored.
|
|
24
27
|
*/
|
|
28
|
+
fetchUserData?: () => Promise<UserData | null>;
|
|
25
29
|
storeUserData?: (userData: UserData) => void;
|
|
26
30
|
/** Called after `storeUserData` when the cached user data actually changed. */
|
|
27
31
|
triggerAuthStateChanged?: () => void;
|
|
28
32
|
}
|
|
29
|
-
export default function handleSuccessfulExchangeAuthTokensResponse({
|
|
33
|
+
export default function handleSuccessfulExchangeAuthTokensResponse({ tokens: unvalidated_tokens, debug, environment, auth_server_url, auth_server_app_id, storeMultipleAccessTokens, fetchUserData, storeUserData, triggerAuthStateChanged, adapter, }: IHandleSuccessfulExchangeAuthTokensResponseOpts): Promise<SuccessfullyGeneratedTokensRecord>;
|