@schemavaults/auth-client-sdk 0.17.3 → 0.18.7

package/dist/lib/handle-successful-authentication.js

@@ -1,10 +1,17 @@
-import { createAuthorizationCodePOSTBodySchema, PKCE_ProofKeyManager, createRequestTokensResultSchema, } from "@schemavaults/auth-common";
+// handle-successful-authentication.ts
+//
+// Redeems an authorization code at the auth server's standard OIDC token
+// endpoint (/api/oidc/token) via `openid-client`, then stores the
+// resulting refresh token, access token(s) and user data through the
+// platform adapter.
+import * as oidc from "openid-client";
+import { OIDC_TOKEN_REFRESH_TOKEN_DELIVERY_PARAM, OIDC_TOKEN_RESOURCE_PARAM, PKCE_ProofKeyManager, timingSafeStringEqual, } from "@schemavaults/auth-common";
+import { OIDC_USERINFO_AUDIENCE_ID, } from "@schemavaults/app-definitions";
 import debugPrintTokensAsTable from "./debugPrintTokensAsTable";
 import debugPrintUserDataAsTable from "./debugPrintUserDataAsTable";
-import { z } from "zod";
 import assertHttpOnlyRefreshTokenCookieHasAccompanyingMarkerCookie from "./assert-http-only-refresh-token-has-accompanying-expiry-marker";
-import { timingSafeStringEqual } from "@schemavaults/auth-common";
-export async function handleSuccessfulAuthentication({ authorization_code, challenge_time, code_verifier, received_state, expected_nonce, redirect_uri, loadCodeVerifier, loadOAuth2State, loadOidcNonce, debug, environment, adapter, auth_server_url, auth_server_app_id, client_app_id, defaultTokenAudiences, storeRefreshToken, storeUserData, storeMultipleAccessTokens, triggerAuthStateChanged, }) {
+import { classifyOidcTokenError, createOidcClientConfiguration, normalizeOidcIssuer, tokenEndpointResponseToTokensRecord, uidFromOidcSubClaim, } from "./oidc";
+export async function handleSuccessfulAuthentication({ authorization_code, challenge_time, code_verifier, received_state, received_iss, expected_nonce, redirect_uri, loadCodeVerifier, loadOAuth2State, loadOidcNonce, debug, environment, adapter, auth_server_url, auth_server_app_id, client_app_id, defaultTokenAudiences, storeRefreshToken, storeUserData, storeMultipleAccessTokens, exchangeAuthTokens, fetchUserData, triggerAuthStateChanged, }) {
     if (debug) {
         console.log("[SchemaVaultsAuthClient::handleSuccessfulAuthentication]" +
             " " +
@@ -48,10 +55,11 @@ export async function handleSuccessfulAuthentication({ authorization_code, chall
     // callback to defend against. In the redirect flow the verifier is
     // loaded from storage below and the state check MUST run before any
     // code redemption so a mismatched callback can never burn the stored
-    // state or trade a victim's code.
+    // state or trade a victim's code. (openid-client repeats the check
+    // when it validates the authorization response.)
     const isRedirectFlow = typeof code_verifier !== "string" || code_verifier.length === 0;
+    let stored_state = null;
     if (isRedirectFlow) {
-        let stored_state;
         try {
             stored_state = loadOAuth2State(challenge_time);
         }
@@ -76,7 +84,7 @@ export async function handleSuccessfulAuthentication({ authorization_code, chall
         }
     }
     // Load the stored login replay nonce (redirect flow) BEFORE the code
-    // is redeemed, so the echo in the token response can be verified. In
+    // is redeemed, so the id_token's `nonce` claim can be verified. In
     // the same-context flow the caller passes `expected_nonce` directly.
     let nonce_to_verify = expected_nonce ?? null;
     if (isRedirectFlow) {
@@ -155,142 +163,136 @@ export async function handleSuccessfulAuthentication({ authorization_code, chall
             console.log("[SchemaVaultsAuthClient] Not attempting to clear code verifiers in this app environment...");
         }
     }
-    // Get the endpoint to exchange the authorization code for an access token
-    // https://datatracker.ietf.org/doc/html/rfc7636#section-4.5
-    const authorization_code_token_endpoint = new URL(`/api/auth/token/authorization_code/${client_app_id}`, auth_server_url).toString();
+    // ---- Token audiences ------------------------------------------------
+    //
+    // The standard token endpoint mints ONE access token per request
+    // (RFC 8707 `resource`). The code grant carries the first default
+    // audience; any further default audiences are acquired right after
+    // through refresh grants. A client with no default audiences
+    // exchanges the code for a refresh token + user data only (the access
+    // token minted alongside is for the reserved userinfo audience).
+    const audiences = Array.isArray(defaultTokenAudiences)
+        ? [...defaultTokenAudiences]
+        : typeof defaultTokenAudiences === "string" &&
+            defaultTokenAudiences.length > 0
+            ? [defaultTokenAudiences]
+            : [];
     if (debug) {
-        console.log("[SchemaVaultsAuthClient::handleSuccessfulAuthentication()] Token Endpoint: ", authorization_code_token_endpoint);
+        console.log("[SchemaVaultsAuthClient::handleSuccessfulAuthentication()] Default access token audience(s): ", audiences);
     }
-    let audience = defaultTokenAudiences;
-    if (debug) {
-        console.log("[SchemaVaultsAuthClient::handleSuccessfulAuthentication()] Initial access token audience(s): ", audience);
-    }
-    if (!audience || (Array.isArray(audience) && audience.length === 0)) {
-        // Supported configuration: a client with no default token audiences
-        // exchanges the authorization code for a refresh token + user data
-        // only; access tokens can be acquired later on demand.
-        if (debug) {
-            console.log("[SchemaVaultsAuthClient::handleSuccessfulAuthentication()] No access token audience(s) set; exchanging authorization code without minting access tokens");
-        }
-        audience = [];
+    const first_audience = audiences[0];
+    const remaining_audiences = audiences.slice(1);
+    const wantsHttpOnlyRefreshTokenCookie = typeof adapter.doesSupportHttpOnlyRefreshToken === "function" &&
+        adapter.doesSupportHttpOnlyRefreshToken();
+    const token_endpoint_parameters = new URLSearchParams();
+    if (first_audience) {
+        token_endpoint_parameters.set(OIDC_TOKEN_RESOURCE_PARAM, first_audience);
     }
-    const authorizationCodePOSTBodySchema = createAuthorizationCodePOSTBodySchema(z, environment, { auth_server_url, auth_server_app_id });
-    // Exchange the authorization code for an access token
-    let request_body;
-    try {
-        const parsed = await authorizationCodePOSTBodySchema.safeParseAsync({
-            grant_type: "authorization_code",
-            code: authorization_code,
-            code_verifier: cached_code_verifier,
-            client_app_id,
-            audience,
-            challenge_time,
-            redirect_uri,
-        });
-        if (!parsed.success) {
-            throw parsed.error;
-        }
-        request_body = parsed.data;
+    if (wantsHttpOnlyRefreshTokenCookie) {
+        token_endpoint_parameters.set(OIDC_TOKEN_REFRESH_TOKEN_DELIVERY_PARAM, "http_only_cookie");
     }
-    catch (e) {
-        console.error("Failed to prepare request body for authorization grant request: ", e);
-        throw new Error("Failed to prepare request body for authorization grant request");
+    // ---- Code redemption via openid-client ------------------------------
+    const config = createOidcClientConfiguration({
+        auth_server_url,
+        client_app_id,
+        environment,
+        adapter,
+    });
+    const issuer = normalizeOidcIssuer(auth_server_url);
+    if (debug) {
+        console.log("[SchemaVaultsAuthClient::handleSuccessfulAuthentication()] Token Endpoint: ", config.serverMetadata().token_endpoint);
     }
-    // Send the request to the auth server
-    // The auth server will hash the code_verifier and compare it to the code_challenge
-    let response;
+    let tokens;
     try {
-        if (debug) {
-            console.log(`[SchemaVaultsAuthClient] Exchanging authorization code for access token; sending req body to token endpoint: "${authorization_code_token_endpoint}"`, request_body);
+        if (isRedirectFlow) {
+            if (typeof redirect_uri !== "string" || redirect_uri.length === 0) {
+                throw new Error("Cannot redeem an authorization code from a redirect callback without the 'redirect_uri' it was issued for (is 'authorize_uri' configured?)");
+            }
+            // Reconstruct the authorization response URL openid-client
+            // validates (RFC 6749 §4.1.2 + RFC 9207): the redirect_uri the code
+            // was issued for, plus the `code`, `state` and `iss` parameters the
+            // auth server appended to it.
+            const callback_url = new URL(redirect_uri);
+            callback_url.searchParams.set("code", authorization_code);
+            callback_url.searchParams.set("state", stored_state);
+            if (typeof received_iss === "string" && received_iss.length > 0) {
+                callback_url.searchParams.set("iss", received_iss);
+            }
+            else {
+                // Callers that predate the `received_iss` argument cannot forward
+                // the callback's `iss`. The configured issuer is substituted so the
+                // exchange still proceeds under the (already verified) state + PKCE
+                // bindings — equivalent to the pre-openid-client SDK, which never
+                // checked `iss`. Forward it to get the mix-up defense.
+                if (debug) {
+                    console.warn("[SchemaVaultsAuthClient::handleSuccessfulAuthentication()] No 'iss' callback parameter supplied; skipping RFC 9207 issuer check");
+                }
+                callback_url.searchParams.set("iss", issuer);
+            }
+            tokens = await oidc.authorizationCodeGrant(config, callback_url, {
+                pkceCodeVerifier: cached_code_verifier,
+                expectedState: stored_state,
+                // Always a string in the redirect flow (validated above): the
+                // id_token MUST carry the matching `nonce` claim.
+                expectedNonce: nonce_to_verify,
+                idTokenExpected: true,
+            }, token_endpoint_parameters);
         }
-        response = await adapter.fetch(authorization_code_token_endpoint, {
-            body: JSON.stringify(request_body),
-            method: "POST",
-            credentials: "include",
-            headers: {
-                "Content-Type": "application/json",
-            },
-        });
-        if (debug) {
-            console.log("[SchemaVaultsAuthClient] Received response in attempt to exchange authorization code for access token: ", response);
+        else {
+            // Same-context flow (the auth server's own login page): the code
+            // was returned directly by the auth server's login API, so there
+            // is no callback URL / redirect_uri to validate. Redeem it with a
+            // plain authorization_code grant; openid-client still validates
+            // the id_token's iss/aud/exp, and the nonce is checked below.
+            const parameters = new URLSearchParams(token_endpoint_parameters);
+            parameters.set("code", authorization_code);
+            parameters.set("code_verifier", cached_code_verifier);
+            tokens = await oidc.genericGrantRequest(config, "authorization_code", parameters);
+            const claims = tokens.claims();
+            if (!claims) {
+                throw new Error("Token response did not include an id_token");
+            }
+            if (nonce_to_verify) {
+                const echoed_nonce = claims.nonce;
+                if (typeof echoed_nonce !== "string" ||
+                    !timingSafeStringEqual(nonce_to_verify, echoed_nonce)) {
+                    console.error("[SchemaVaultsAuthClient::handleSuccessfulAuthentication()] " +
+                        "Login nonce mismatch in id_token");
+                    throw new Error("Login nonce mismatch in token response — possible replay");
+                }
+            }
         }
     }
     catch (e) {
-        console.error("Failed to exchange authorization code for access token:", e);
-        throw new Error("Failed to exchange authorization code for access token");
-    }
-    if (!response || !response.ok || response.status !== 200) {
-        const errorMsg = `Failed to exchange authorization code for access token (status code: ${response.status})`;
-        console.error(errorMsg);
-        throw new Error(errorMsg);
+        const classified = classifyOidcTokenError(e);
+        console.error("Failed to exchange authorization code for access token:", classified.message);
+        if (debug) {
+            console.error(e);
+        }
+        throw new Error(`Failed to exchange authorization code for access token: ${classified.message}`, { cause: e });
     }
     if (debug) {
         console.log("[SchemaVaultsAuthClient::handleSuccessfulAuthentication()] " +
             "Successfully exchanged authorization code for token(s)");
     }
-    let access_tokens;
-    let refresh_token;
-    let refresh_token_expiry;
-    let user;
+    // ---- Translate the token response ------------------------------------
+    let record;
+    let uid;
     try {
-        const tokens_data = await createRequestTokensResultSchema(z, environment, {
-            auth_server_url,
-            auth_server_app_id,
-        }).safeParseAsync(await response.json());
-        if (!tokens_data.success) {
-            console.error("[SchemaVaultsAuthClient::handleSuccessfulAuthentication()] " +
-                "Failed to parse tokens from auth server response:", tokens_data.error);
-            throw new Error("Failed to parse tokens from auth server response");
-        }
-        else if (!tokens_data.data.success) {
-            throw new Error(tokens_data.data.message);
-        }
-        if (debug) {
-            console.log("[SchemaVaultsAuthClient::handleSuccessfulAuthentication()] Success response data: ", tokens_data.data);
-        }
-        // Login replay-nonce verification: the server echoes the nonce that
-        // was bound to the redeemed authorization code at login time. A
-        // missing or mismatched echo means the token response was not
-        // produced for THIS flow's code — reject it.
-        if (nonce_to_verify) {
-            const echoed_nonce = tokens_data.data.nonce;
-            if (typeof echoed_nonce !== "string" ||
-                !timingSafeStringEqual(nonce_to_verify, echoed_nonce)) {
-                console.error("[SchemaVaultsAuthClient::handleSuccessfulAuthentication()] " +
-                    "Login nonce mismatch in token response");
-                throw new Error("Login nonce mismatch in token response — possible replay");
-            }
-        }
-        const { tokens, userData } = tokens_data.data;
-        if (!tokens) {
-            console.error("Did not receive tokens in response from auth server");
-            throw new Error("Did not receive tokens in response from auth server");
-        }
-        if (!tokens.access) {
-            console.error("Did not receive any access tokens in response from auth server");
-            throw new Error("Did not receive any access tokens in response from auth server");
-        }
-        if (!tokens.refresh ||
-            (typeof tokens.refresh !== "object" && typeof tokens.refresh !== "string")) {
-            console.error("Did not receive (valid) refresh token in response from auth server.", `Type: ${typeof tokens.refresh}`, tokens.refresh);
-            throw new Error("Did not receive refresh token in response from auth server");
-        }
+        const claims = tokens.claims();
+        if (!claims) {
+            throw new Error("Token response did not include an id_token");
+        }
+        uid = uidFromOidcSubClaim(claims.sub, auth_server_app_id, debug);
+        record = tokenEndpointResponseToTokensRecord({
+            response: tokens,
+            audience: first_audience ?? OIDC_USERINFO_AUDIENCE_ID,
+            uid,
+            auth_server_url: issuer,
+        });
         if (debug) {
-            debugPrintTokensAsTable(tokens);
+            debugPrintTokensAsTable(record);
         }
-        access_tokens = tokens.access;
-        refresh_token = tokens.refresh;
-        refresh_token_expiry = tokens.refresh_token_expiry;
-        if (!userData) {
-            console.error("Did not receive user data in response from auth server");
-            throw new Error("Did not receive user data in response from auth server");
-        }
-        else {
-            if (debug) {
-                debugPrintUserDataAsTable(userData);
-            }
-        }
-        user = userData;
     }
     catch (e) {
         let errorMessage = "Unknown error";
@@ -300,10 +302,17 @@ export async function handleSuccessfulAuthentication({ authorization_code, chall
         console.error("Failed to parse tokens response: ", errorMessage);
         throw new Error(`Failed to parse tokens response: ${errorMessage}`);
     }
-    // Store refresh token
+    const access_tokens = record.access;
+    if (!access_tokens) {
+        throw new Error("Did not receive any access tokens in response from auth server");
+    }
+    const refresh_token = record.refresh;
+    if (!refresh_token) {
+        throw new Error("Did not receive refresh token in response from auth server");
+    }
+    // ---- Store refresh token -------------------------------------------
     const doStoreReceivedRefreshToken = () => {
         if (typeof refresh_token === "object" && refresh_token.type === "refresh") {
-            refresh_token_expiry = refresh_token.exp;
             try {
                 if (debug) {
                     console.log("[SchemaVaultsAuthClient] Storing refresh token...");
@@ -320,14 +329,13 @@ export async function handleSuccessfulAuthentication({ authorization_code, chall
         }
         else if (typeof refresh_token === "string" &&
             refresh_token === "AS_HTTP_ONLY_COOKIE") {
-            const supportsHttpOnlyRefreshTokenCookie = typeof adapter.doesSupportHttpOnlyRefreshToken === "function" &&
-                adapter.doesSupportHttpOnlyRefreshToken();
-            if (!supportsHttpOnlyRefreshTokenCookie) {
+            if (!wantsHttpOnlyRefreshTokenCookie) {
                 throw new Error("Received refresh token cookie 'AS_HTTP_ONLY_COOKIE', but this auth client instance's adapter does not support it!");
             }
             if (typeof adapter.storeHttpOnlyRefreshTokenMarker !== "function") {
                 throw new TypeError("Expected auth client adapter to have method 'storeHttpOnlyRefreshTokenMarker'!");
             }
+            const refresh_token_expiry = record.refresh_token_expiry;
             if (typeof refresh_token_expiry !== "number") {
                 throw new TypeError("Expected 'refresh_token_expiry' to be a number if refresh token was passed as HTTP-only cookie!");
             }
@@ -343,8 +351,39 @@ export async function handleSuccessfulAuthentication({ authorization_code, chall
         }
     };
     doStoreReceivedRefreshToken();
-    // Store access tokens
+    // ---- Store access token(s) -----------------------------------------
     storeMultipleAccessTokens(access_tokens);
+    if (remaining_audiences.length > 0) {
+        if (debug) {
+            console.log("[SchemaVaultsAuthClient] Acquiring access tokens for remaining default audiences via refresh grant(s): ", remaining_audiences);
+        }
+        try {
+            await exchangeAuthTokens(refresh_token, remaining_audiences);
+        }
+        catch (e) {
+            console.error("[SchemaVaultsAuthClient] Failed to acquire access tokens for remaining default audiences: ", e);
+            throw new Error("Failed to acquire access tokens for the remaining default audiences", { cause: e });
+        }
+    }
+    // ---- User data -----------------------------------------------------
+    let user;
+    try {
+        user = await fetchUserData();
+    }
+    catch (e) {
+        console.error("Failed to load user data after login: ", e);
+        throw new Error("Failed to load user data after login", { cause: e });
+    }
+    if (!user) {
+        console.error("Did not receive user data from auth server after login");
+        throw new Error("Did not receive user data from auth server after login");
+    }
+    if (user.uid !== uid) {
+        throw new Error("User data returned by the auth server does not belong to the authenticated subject");
+    }
+    if (debug) {
+        debugPrintUserDataAsTable(user);
+    }
     try {
         if (debug) {
             console.log("[SchemaVaultsAuthClient] Storing user data...");

package/dist/lib/handle-successful-authentication.js.map

@@ -1 +1 @@
-{"version":3,"file":"handle-successful-authentication.js","sourceRoot":"","sources":["../../src/lib/handle-successful-authentication.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,qCAAqC,EACrC,oBAAoB,EAEpB,+BAA+B,GAEhC,MAAM,2BAA2B,CAAC;AACnC,OAAO,uBAAuB,MAAM,2BAA2B,CAAC;AAChE,OAAO,yBAAyB,MAAM,6BAA6B,CAAC;AAOpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,2DAA2D,MAAM,iEAAiE,CAAC;AAC1I,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AA6ClE,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,cAAc,EACd,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,KAAK,EACL,WAAW,EACX,OAAO,EACP,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,EACb,yBAAyB,EACzB,uBAAuB,GACa;IACpC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,0DAA0D;YACxD,GAAG;YACH,uCAAuC,CAC1C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;SAAM,IACL,OAAO,kBAAkB,KAAK,QAAQ;QACtC,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAC/B,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,cAAc,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,iCAAiC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC;IACtE,IAAI,iCAAiC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,iCAAiC,GAAG,oBAAoB,CAAC,OAAO,EAAE,CAAC;QACrE,OAAO,CAAC,KAAK,CACX,4GAA4G,CAC7G,CAAC;QACF,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC;gBACH,OAAO,CAAC,KAAK,CAAC;oBACZ,cAAc;oBACd,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;oBACxB,YAAY,EAAE,iCAAiC;oBAC/C,OAAO,EAAE,oBAAoB,CAAC,OAAO;iBACtC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAU,EAAE,CAAC;gBACpB,KAAK,CAAC,CAAC,CAAC,YAAY;YACtB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,iEAAiE;IACjE,mEAAmE;IACnE,oEAAoE;IACpE,qEAAqE;IACrE,kCAAkC;IAClC,MAAM,cAAc,GAClB,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC;IAClE,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,YAA2B,CAAC;QAChC,IAAI,CAAC;YACH,YAAY,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CACX,+FAA+F,EAC/F,CAAC,CACF,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;YACzD,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,KAAK,CACX,gFAAgF,EAChF;oBACE,mBAAmB,EAAE,YAAY,CAAC,MAAM;oBACxC,qBAAqB,EAAE,cAAc,CAAC,MAAM;iBAC7C,CACF,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,qEAAqE;IACrE,qEAAqE;IACrE,IAAI,eAAe,GAAkB,cAAc,IAAI,IAAI,CAAC;IAC5D,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,YAA2B,CAAC;QAChC,IAAI,CAAC;YACH,YAAY,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CACX,8FAA8F,EAC9F,CAAC,CACF,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,eAAe,GAAG,YAAY,CAAC;IACjC,CAAC;IAED,4DAA4D;IAC5D,sDAAsD;IACtD,sDAAsD;IACtD,kFAAkF;IAElF,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,2BAA2B;YACzB,0EAA0E,CAC7E,CAAC;IACJ,CAAC;IAED,MAAM,oBAAoB,GACxB,aAAa,IAAI,gBAAgB,CAAC,cAAc,CAAC,CAAC;IACpD,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,MAAM,YAAY,GAAW,2EAA2E,cAAc,EAAE,CAAC;QACzH,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;IAChC,CAAC;IACD,oBAAqC,CAAC;IAEtC,MAAM,gCAAgC,GACpC,WAAW,KAAK,aAAa,CAAC;IAEhC,IAAI,gCAAgC,EAAE,CAAC;QACrC,uCAAuC;QACvC,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CACT,2BAA2B;oBACzB,0FAA0F,EAC5F,cAAc,CACf,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CACT,8DAA8D,CAC/D,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CACX,2DAA2D,EAC3D,CAAC,CACF,CAAC;YACF,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,+DAA+D;QAC/D,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,OAAO,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;YAC3C,CAAC;YAAC,OAAO,CAAU,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CACX,yDAAyD,EACzD,CAAC,CACF,CAAC;gBACF,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,CAAU,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CACX,wDAAwD,EACxD,CAAC,CACF,CAAC;gBACF,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CACT,4FAA4F,CAC7F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,iCAAiC,GAAG,IAAI,GAAG,CAC/C,sCAAsC,aAAa,EAAW,EAC9D,eAAe,CAChB,CAAC,QAAQ,EAAE,CAAC;IACb,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,6EAA6E,EAC7E,iCAAiC,CAClC,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,GAAsB,qBAAqB,CAAC;IACxD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,+FAA+F,EAC/F,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACpE,oEAAoE;QACpE,mEAAmE;QACnE,uDAAuD;QACvD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CACT,yJAAyJ,CAC1J,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,EAAE,CAAC;IAChB,CAAC;IAED,MAAM,+BAA+B,GAAG,qCAAqC,CAC3E,CAAC,EACD,WAAW,EACX,EAAE,eAAe,EAAE,kBAAkB,EAAE,CACxC,CAAC;IAEF,sDAAsD;IACtD,IAAI,YAA6D,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC,cAAc,CAAC;YAClE,UAAU,EAAE,oBAA6B;YACzC,IAAI,EAAE,kBAAkB;YACxB,aAAa,EAAE,oBAAoB;YACnC,aAAa;YACb,QAAQ;YACR,cAAc;YACd,YAAY;SAC6C,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,MAAM,CAAC,KAAK,CAAC;QACrB,CAAC;QACD,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC;IAC7B,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CACX,kEAAkE,EAClE,CAAC,CACF,CAAC;QACF,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,sCAAsC;IACtC,mFAAmF;IAEnF,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CACT,iHAAiH,iCAAiC,GAAG,EACrJ,YAAY,CACb,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC;YAClC,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;SACF,CAAC,CAAC;QAEH,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CACT,yGAAyG,EACzG,QAAQ,CACT,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,yDAAyD,EAAE,CAAC,CAAC,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACzD,MAAM,QAAQ,GAAW,wEAAwE,QAAQ,CAAC,MAAM,GAAG,CAAC;QACpH,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,6DAA6D;YAC3D,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IAED,IAAI,aAAuE,CAAC;IAC5E,IAAI,aAAmD,CAAC;IACxD,IAAI,oBAAwC,CAAC;IAC7C,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,+BAA+B,CAAC,CAAC,EAAE,WAAW,EAAE;YACxE,eAAe;YACf,kBAAkB;SACnB,CAAC,CAAC,cAAc,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,CAAC,KAAK,CACX,6DAA6D;gBAC3D,mDAAmD,EACrD,WAAW,CAAC,KAAK,CAClB,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;aAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CACT,oFAAoF,EACpF,WAAW,CAAC,IAAI,CACjB,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,gEAAgE;QAChE,8DAA8D;QAC9D,6CAA6C;QAC7C,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,YAAY,GAAuB,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;YAChE,IACE,OAAO,YAAY,KAAK,QAAQ;gBAChC,CAAC,qBAAqB,CAAC,eAAe,EAAE,YAAY,CAAC,EACrD,CAAC;gBACD,OAAO,CAAC,KAAK,CACX,6DAA6D;oBAC3D,wCAAwC,CAC3C,CAAC;gBACF,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACrE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,CAAC,KAAK,CACX,gEAAgE,CACjE,CAAC;YACF,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;QACJ,CAAC;QAED,IACE,CAAC,MAAM,CAAC,OAAO;YACf,CAAC,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,EAC1E,CAAC;YACD,OAAO,CAAC,KAAK,CACX,qEAAqE,EACrE,SAAS,OAAO,MAAM,CAAC,OAAO,EAAE,EAChC,MAAM,CAAC,OAAO,CACf,CAAC;YACF,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QAED,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,CAAC;QAEnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;aAAM,CAAC;YACN,IAAI,KAAK,EAAE,CAAC;gBACV,yBAAyB,CAAC,QAA2B,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QACD,IAAI,GAAG,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,IAAI,YAAY,GAAW,eAAe,CAAC;QAC3C,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;YACvB,YAAY,GAAG,CAAC,CAAC,OAAO,CAAC;QAC3B,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,YAAY,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,oCAAoC,YAAY,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,sBAAsB;IACtB,MAAM,2BAA2B,GAAG,GAAG,EAAE;QACvC,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC1E,oBAAoB,GAAG,aAAa,CAAC,GAAG,CAAC;YACzC,IAAI,CAAC;gBACH,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;gBACnE,CAAC;gBACD,iBAAiB,CAAC,aAAa,CAAC,CAAC;gBACjC,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;gBAChE,CAAC;YACH,CAAC;YAAC,OAAO,CAAU,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;aAAM,IACL,OAAO,aAAa,KAAK,QAAQ;YACjC,aAAa,KAAK,qBAAqB,EACvC,CAAC;YACD,MAAM,kCAAkC,GACtC,OAAO,OAAO,CAAC,+BAA+B,KAAK,UAAU;gBAC7D,OAAO,CAAC,+BAA+B,EAAE,CAAC;YAE5C,IAAI,CAAC,kCAAkC,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CACb,mHAAmH,CACpH,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,OAAO,CAAC,+BAA+B,KAAK,UAAU,EAAE,CAAC;gBAClE,MAAM,IAAI,SAAS,CACjB,gFAAgF,CACjF,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,oBAAoB,KAAK,QAAQ,EAAE,CAAC;gBAC7C,MAAM,IAAI,SAAS,CACjB,iGAAiG,CAClG,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,+BAA+B,CACrC,oBAAqC,CACvB,CAAC;YAEjB,2DAA2D,CACzD,OAAO,CACO,CAAC;YAEjB,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CACT,yFAAyF,CAC1F,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC;IACF,2BAA2B,EAAE,CAAC;IAE9B,sBAAsB;IACtB,yBAAyB,CAAC,aAAa,CAAC,CAAC;IAEzC,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC/D,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,CAAC,CAAC,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;IACzE,CAAC;IACD,uBAAuB,EAAE,CAAC;IAC1B,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,OAAO;AACT,CAAC;AAED,eAAe,8BAA8B,CAAC"}
+{"version":3,"file":"handle-successful-authentication.js","sourceRoot":"","sources":["../../src/lib/handle-successful-authentication.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,yEAAyE;AACzE,kEAAkE;AAClE,qEAAqE;AACrE,oBAAoB;AAEpB,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,EAEL,uCAAuC,EACvC,yBAAyB,EACzB,oBAAoB,EAIpB,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,yBAAyB,GAI1B,MAAM,+BAA+B,CAAC;AACvC,OAAO,uBAAuB,MAAM,2BAA2B,CAAC;AAChE,OAAO,yBAAyB,MAAM,6BAA6B,CAAC;AAEpE,OAAO,2DAA2D,MAAM,iEAAiE,CAAC;AAC1I,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,mBAAmB,EACnB,mCAAmC,EACnC,mBAAmB,GACpB,MAAM,QAAQ,CAAC;AAiEhB,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,cAAc,EACd,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,KAAK,EACL,WAAW,EACX,OAAO,EACP,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,EACb,yBAAyB,EACzB,kBAAkB,EAClB,aAAa,EACb,uBAAuB,GACa;IACpC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,0DAA0D;YACxD,GAAG;YACH,uCAAuC,CAC1C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;SAAM,IACL,OAAO,kBAAkB,KAAK,QAAQ;QACtC,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAC/B,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,cAAc,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,iCAAiC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC;IACtE,IAAI,iCAAiC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,iCAAiC,GAAG,oBAAoB,CAAC,OAAO,EAAE,CAAC;QACrE,OAAO,CAAC,KAAK,CACX,4GAA4G,CAC7G,CAAC;QACF,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC;gBACH,OAAO,CAAC,KAAK,CAAC;oBACZ,cAAc;oBACd,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;oBACxB,YAAY,EAAE,iCAAiC;oBAC/C,OAAO,EAAE,oBAAoB,CAAC,OAAO;iBACtC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAU,EAAE,CAAC;gBACpB,KAAK,CAAC,CAAC,CAAC,YAAY;YACtB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,iEAAiE;IACjE,mEAAmE;IACnE,oEAAoE;IACpE,qEAAqE;IACrE,mEAAmE;IACnE,iDAAiD;IACjD,MAAM,cAAc,GAClB,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC;IAClE,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,YAAY,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CACX,+FAA+F,EAC/F,CAAC,CACF,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;YACzD,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,KAAK,CACX,gFAAgF,EAChF;oBACE,mBAAmB,EAAE,YAAY,CAAC,MAAM;oBACxC,qBAAqB,EAAE,cAAc,CAAC,MAAM;iBAC7C,CACF,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,mEAAmE;IACnE,qEAAqE;IACrE,IAAI,eAAe,GAAkB,cAAc,IAAI,IAAI,CAAC;IAC5D,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,YAA2B,CAAC;QAChC,IAAI,CAAC;YACH,YAAY,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CACX,8FAA8F,EAC9F,CAAC,CACF,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,eAAe,GAAG,YAAY,CAAC;IACjC,CAAC;IAED,4DAA4D;IAC5D,sDAAsD;IACtD,sDAAsD;IACtD,kFAAkF;IAElF,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,2BAA2B;YACzB,0EAA0E,CAC7E,CAAC;IACJ,CAAC;IAED,MAAM,oBAAoB,GACxB,aAAa,IAAI,gBAAgB,CAAC,cAAc,CAAC,CAAC;IACpD,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,MAAM,YAAY,GAAW,2EAA2E,cAAc,EAAE,CAAC;QACzH,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;IAChC,CAAC;IACD,oBAAqC,CAAC;IAEtC,MAAM,gCAAgC,GACpC,WAAW,KAAK,aAAa,CAAC;IAEhC,IAAI,gCAAgC,EAAE,CAAC;QACrC,uCAAuC;QACvC,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CACT,2BAA2B;oBACzB,0FAA0F,EAC5F,cAAc,CACf,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CACT,8DAA8D,CAC/D,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CACX,2DAA2D,EAC3D,CAAC,CACF,CAAC;YACF,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,+DAA+D;QAC/D,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,OAAO,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;YAC3C,CAAC;YAAC,OAAO,CAAU,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CACX,yDAAyD,EACzD,CAAC,CACF,CAAC;gBACF,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,CAAU,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CACX,wDAAwD,EACxD,CAAC,CACF,CAAC;gBACF,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CACT,4FAA4F,CAC7F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,EAAE;IACF,iEAAiE;IACjE,kEAAkE;IAClE,mEAAmE;IACnE,6DAA6D;IAC7D,sEAAsE;IACtE,iEAAiE;IACjE,MAAM,SAAS,GAAa,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC;QAC9D,CAAC,CAAC,CAAC,GAAG,qBAAqB,CAAC;QAC5B,CAAC,CAAC,OAAO,qBAAqB,KAAK,QAAQ;YACvC,qBAAqB,CAAC,MAAM,GAAG,CAAC;YAClC,CAAC,CAAC,CAAC,qBAAqB,CAAC;YACzB,CAAC,CAAC,EAAE,CAAC;IACT,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,+FAA+F,EAC/F,SAAS,CACV,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAuB,SAAS,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,mBAAmB,GAAa,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEzD,MAAM,+BAA+B,GACnC,OAAO,OAAO,CAAC,+BAA+B,KAAK,UAAU;QAC7D,OAAO,CAAC,+BAA+B,EAAE,CAAC;IAE5C,MAAM,yBAAyB,GAAG,IAAI,eAAe,EAAE,CAAC;IACxD,IAAI,cAAc,EAAE,CAAC;QACnB,yBAAyB,CAAC,GAAG,CAAC,yBAAyB,EAAE,cAAc,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,+BAA+B,EAAE,CAAC;QACpC,yBAAyB,CAAC,GAAG,CAC3B,uCAAuC,EACvC,kBAAkB,CACnB,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,MAAM,MAAM,GAAuB,6BAA6B,CAAC;QAC/D,eAAe;QACf,aAAa;QACb,WAAW;QACX,OAAO;KACR,CAAC,CAAC;IACH,MAAM,MAAM,GAAW,mBAAmB,CAAC,eAAe,CAAC,CAAC;IAE5D,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,6EAA6E,EAC7E,MAAM,CAAC,cAAc,EAAE,CAAC,cAAc,CACvC,CAAC;IACJ,CAAC;IAED,IAAI,MAAsE,CAAC;IAC3E,IAAI,CAAC;QACH,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClE,MAAM,IAAI,KAAK,CACb,4IAA4I,CAC7I,CAAC;YACJ,CAAC;YACD,2DAA2D;YAC3D,oEAAoE;YACpE,oEAAoE;YACpE,8BAA8B;YAC9B,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;YAC3C,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;YAC1D,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,YAAsB,CAAC,CAAC;YAC/D,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChE,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YACrD,CAAC;iBAAM,CAAC;gBACN,kEAAkE;gBAClE,oEAAoE;gBACpE,oEAAoE;gBACpE,kEAAkE;gBAClE,uDAAuD;gBACvD,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,CAAC,IAAI,CACV,iIAAiI,CAClI,CAAC;gBACJ,CAAC;gBACD,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC/C,CAAC;YAED,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CACxC,MAAM,EACN,YAAY,EACZ;gBACE,gBAAgB,EAAE,oBAAoB;gBACtC,aAAa,EAAE,YAAsB;gBACrC,8DAA8D;gBAC9D,kDAAkD;gBAClD,aAAa,EAAE,eAAyB;gBACxC,eAAe,EAAE,IAAI;aACtB,EACD,yBAAyB,CAC1B,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,iEAAiE;YACjE,iEAAiE;YACjE,kEAAkE;YAClE,gEAAgE;YAChE,8DAA8D;YAC9D,MAAM,UAAU,GAAG,IAAI,eAAe,CAAC,yBAAyB,CAAC,CAAC;YAClE,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;YAC3C,UAAU,CAAC,GAAG,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC;YACtD,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CACrC,MAAM,EACN,oBAAoB,EACpB,UAAU,CACX,CAAC;YACF,MAAM,MAAM,GAA6B,MAAM,CAAC,MAAM,EAAE,CAAC;YACzD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,YAAY,GAAY,MAAM,CAAC,KAAK,CAAC;gBAC3C,IACE,OAAO,YAAY,KAAK,QAAQ;oBAChC,CAAC,qBAAqB,CAAC,eAAe,EAAE,YAAY,CAAC,EACrD,CAAC;oBACD,OAAO,CAAC,KAAK,CACX,6DAA6D;wBAC3D,kCAAkC,CACrC,CAAC;oBACF,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,MAAM,UAAU,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,KAAK,CACX,yDAAyD,EACzD,UAAU,CAAC,OAAO,CACnB,CAAC;QACF,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,2DAA2D,UAAU,CAAC,OAAO,EAAE,EAC/E,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,6DAA6D;YAC3D,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,IAAI,MAAyC,CAAC;IAC9C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,MAAM,GAA6B,MAAM,CAAC,MAAM,EAAE,CAAC;QACzD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,GAAG,GAAG,mBAAmB,CAAC,MAAM,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC;QACjE,MAAM,GAAG,mCAAmC,CAAC;YAC3C,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,cAAc,IAAI,yBAAyB;YACrD,GAAG;YACH,eAAe,EAAE,MAAM;SACxB,CAAC,CAAC;QACH,IAAI,KAAK,EAAE,CAAC;YACV,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,IAAI,YAAY,GAAW,eAAe,CAAC;QAC3C,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;YACvB,YAAY,GAAG,CAAC,CAAC,OAAO,CAAC;QAC3B,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,YAAY,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,oCAAoC,YAAY,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACpC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GACjB,MAAM,CAAC,OAAO,CAAC;IACjB,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,MAAM,2BAA2B,GAAG,GAAG,EAAE;QACvC,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC1E,IAAI,CAAC;gBACH,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;gBACnE,CAAC;gBACD,iBAAiB,CAAC,aAAa,CAAC,CAAC;gBACjC,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;gBAChE,CAAC;YACH,CAAC;YAAC,OAAO,CAAU,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;aAAM,IACL,OAAO,aAAa,KAAK,QAAQ;YACjC,aAAa,KAAK,qBAAqB,EACvC,CAAC;YACD,IAAI,CAAC,+BAA+B,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CACb,mHAAmH,CACpH,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,OAAO,CAAC,+BAA+B,KAAK,UAAU,EAAE,CAAC;gBAClE,MAAM,IAAI,SAAS,CACjB,gFAAgF,CACjF,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GACxB,MAAM,CAAC,oBAAoB,CAAC;YAC9B,IAAI,OAAO,oBAAoB,KAAK,QAAQ,EAAE,CAAC;gBAC7C,MAAM,IAAI,SAAS,CACjB,iGAAiG,CAClG,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,+BAA+B,CACrC,oBAAqC,CACvB,CAAC;YAEjB,2DAA2D,CACzD,OAAO,CACO,CAAC;YAEjB,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CACT,yFAAyF,CAC1F,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC;IACF,2BAA2B,EAAE,CAAC;IAE9B,uEAAuE;IACvE,yBAAyB,CAAC,aAAa,CAAC,CAAC;IAEzC,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CACT,yGAAyG,EACzG,mBAAmB,CACpB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,kBAAkB,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CACX,4FAA4F,EAC5F,CAAC,CACF,CAAC;YACF,MAAM,IAAI,KAAK,CACb,qEAAqE,EACrE,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,IAAI,IAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,aAAa,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,sCAAsC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,yBAAyB,CAAC,IAAuB,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC/D,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,CAAC,CAAC,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;IACzE,CAAC;IACD,uBAAuB,EAAE,CAAC;IAC1B,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,OAAO;AACT,CAAC;AAED,eAAe,8BAA8B,CAAC"}

package/dist/lib/handle-successful-exchange-auth-tokens-response.d.ts

@@ -2,7 +2,8 @@ import { type AccessToken, type SuccessfullyGeneratedTokensRecord, type UserData
 import type { ISchemaVaultsAuthClientAdapter } from "../types/ISchemaVaultsAuthClientAdapter";
 import type { ApiServerId, AppId, SchemaVaultsAppEnvironment } from "@schemavaults/app-definitions";
 export interface IHandleSuccessfulExchangeAuthTokensResponseOpts {
-    tokens_response: unknown;
+    /** The tokens record built from the refresh grant response(s). */
+    tokens: SuccessfullyGeneratedTokensRecord;
     debug: boolean;
     environment: SchemaVaultsAppEnvironment;
     adapter: ISchemaVaultsAuthClientAdapter;
@@ -16,14 +17,17 @@ export interface IHandleSuccessfulExchangeAuthTokensResponseOpts {
     auth_server_app_id?: AppId;
     storeMultipleAccessTokens: (access_tokens: Record<ApiServerId, AccessToken | "AS_HTTP_ONLY_COOKIE">) => void;
     /**
-     * The refresh grant loads user data fresh from the database when minting
-     * tokens and echoes it back as `userData`. When provided, that snapshot is
-     * cached so claims that changed server-side since login (e.g.
-     * `email_verified` after completing email verification) propagate to
-     * `currentUser` without requiring a re-login.
+     * Re-loads the user's data from the auth server after the exchange.
+     * The refresh grant loads user data fresh from the database when
+     * minting tokens (server-side guards reading the rotated refresh
+     * token see the new claims), and the whoami re-sync here propagates
+     * claims that changed since login (e.g. `email_verified` after
+     * completing email verification) to `currentUser` without requiring
+     * a re-login. Failures are non-fatal: the tokens are already stored.
      */
+    fetchUserData?: () => Promise<UserData | null>;
     storeUserData?: (userData: UserData) => void;
     /** Called after `storeUserData` when the cached user data actually changed. */
     triggerAuthStateChanged?: () => void;
 }
-export default function handleSuccessfulExchangeAuthTokensResponse({ tokens_response, debug, environment, auth_server_url, auth_server_app_id, storeMultipleAccessTokens, storeUserData, triggerAuthStateChanged, adapter, }: IHandleSuccessfulExchangeAuthTokensResponseOpts): Promise<SuccessfullyGeneratedTokensRecord>;
+export default function handleSuccessfulExchangeAuthTokensResponse({ tokens: unvalidated_tokens, debug, environment, auth_server_url, auth_server_app_id, storeMultipleAccessTokens, fetchUserData, storeUserData, triggerAuthStateChanged, adapter, }: IHandleSuccessfulExchangeAuthTokensResponseOpts): Promise<SuccessfullyGeneratedTokensRecord>;

package/dist/lib/handle-successful-exchange-auth-tokens-response.js

@@ -1,37 +1,25 @@
 // handle-successful-exchange-auth-tokens-response.ts
 import { z } from "zod";
-import { createRequestTokensResultSchema, } from "@schemavaults/auth-common";
+import { createSuccessfullyGeneratedTokensRecordSchema, } from "@schemavaults/auth-common";
 import isSameUserData from "../lib/is-same-user-data";
 import assertHttpOnlyRefreshTokenCookieHasAccompanyingMarkerCookie from "../lib/assert-http-only-refresh-token-has-accompanying-expiry-marker";
-export default async function handleSuccessfulExchangeAuthTokensResponse({ tokens_response, debug, environment, auth_server_url, auth_server_app_id, storeMultipleAccessTokens, storeUserData, triggerAuthStateChanged, adapter, }) {
-    const parsed_tokens_data = await createRequestTokensResultSchema(z, environment, {
-        auth_server_url,
-        auth_server_app_id,
-    }).safeParseAsync(tokens_response);
-    if (!parsed_tokens_data.success) {
+export default async function handleSuccessfulExchangeAuthTokensResponse({ tokens: unvalidated_tokens, debug, environment, auth_server_url, auth_server_app_id, storeMultipleAccessTokens, fetchUserData, storeUserData, triggerAuthStateChanged, adapter, }) {
+    const parsed_tokens = await createSuccessfullyGeneratedTokensRecordSchema(z, environment, { auth_server_url, auth_server_app_id }).safeParseAsync(unvalidated_tokens);
+    if (!parsed_tokens.success) {
         if (debug) {
             console.error("[SchemaVaultsAuthClient::handleSuccessfulExchangeAuthTokensResponse()] " +
-                "Failed to parse successful exchange auth tokens result: ", parsed_tokens_data.error.issues);
+                "Failed to validate exchange auth tokens result: ", parsed_tokens.error.issues);
         }
         throw new Error("Failed to parse successful exchange auth tokens result!");
     }
-    const request_tokens_result = parsed_tokens_data.data;
-    if (!request_tokens_result.success) {
-        throw new Error("Request tokens response has success === false");
-    }
-    const tokens = request_tokens_result.tokens;
-    if (!tokens) {
-        throw new Error("Response did not include any tokens");
-    }
+    const tokens = parsed_tokens.data;
     if (!tokens.access) {
         throw new Error("No access token was included in the tokens response");
     }
     if (debug) {
         console.log("[SchemaVaultsAuthClient] Successfully exchanged refresh token for new authentication token(s)");
     }
-    if (tokens.access) {
-        storeMultipleAccessTokens(tokens.access);
-    }
+    storeMultipleAccessTokens(tokens.access);
     if (tokens.refresh) {
         if (typeof tokens.refresh === "object" &&
             tokens.refresh.type === "refresh") {
@@ -64,22 +52,25 @@ export default async function handleSuccessfulExchangeAuthTokensResponse({ token
             throw new TypeError("Invalid refresh token type");
         }
     }
-    if (request_tokens_result.userData && typeof storeUserData === "function") {
+    if (typeof fetchUserData === "function" && typeof storeUserData === "function") {
         // Failures here must not fail the exchange itself — the tokens above are
         // already stored and usable.
         try {
-            const previous = adapter.getUserData();
-            const changed = !isSameUserData(previous, request_tokens_result.userData);
-            storeUserData(request_tokens_result.userData);
-            if (changed && typeof triggerAuthStateChanged === "function") {
-                if (debug) {
-                    console.log("[SchemaVaultsAuthClient] Cached user data changed after token exchange; triggering auth state change event...");
+            const fresh = await fetchUserData();
+            if (fresh) {
+                const previous = adapter.getUserData();
+                const changed = !isSameUserData(previous, fresh);
+                storeUserData(fresh);
+                if (changed && typeof triggerAuthStateChanged === "function") {
+                    if (debug) {
+                        console.log("[SchemaVaultsAuthClient] Cached user data changed after token exchange; triggering auth state change event...");
+                    }
+                    triggerAuthStateChanged();
                 }
-                triggerAuthStateChanged();
             }
         }
         catch (e) {
-            console.error("[SchemaVaultsAuthClient] Failed to sync cached user data from token exchange response: ", e);
+            console.error("[SchemaVaultsAuthClient] Failed to sync cached user data after token exchange: ", e);
         }
     }
     return tokens;

package/dist/lib/handle-successful-exchange-auth-tokens-response.js.map

@@ -1 +1 @@
-{"version":3,"file":"handle-successful-exchange-auth-tokens-response.js","sourceRoot":"","sources":["../../src/lib/handle-successful-exchange-auth-tokens-response.ts"],"names":[],"mappings":"AAAA,qDAAqD;AAErD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,+BAA+B,GAGhC,MAAM,2BAA2B,CAAC;AACnC,OAAO,cAAc,MAAM,yBAAyB,CAAC;AACrD,OAAO,2DAA2D,MAAM,qEAAqE,CAAC;AAoC9I,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,0CAA0C,CAAC,EACvE,eAAe,EACf,KAAK,EACL,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,yBAAyB,EACzB,aAAa,EACb,uBAAuB,EACvB,OAAO,GACyC;IAChD,MAAM,kBAAkB,GAAG,MAAM,+BAA+B,CAAC,CAAC,EAAE,WAAW,EAAE;QAC/E,eAAe;QACf,kBAAkB;KACnB,CAAC,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;IACnC,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,CAAC;QAChC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,CACX,yEAAyE;gBACvE,0DAA0D,EAC5D,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAChC,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,qBAAqB,GAAwB,kBAAkB,CAAC,IAAI,CAAC;IAE3E,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,MAAM,GACV,qBAAqB,CAAC,MAAM,CAAC;IAE/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,+FAA+F,CAChG,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,yBAAyB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,IACE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;YAClC,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,EACjC,CAAC;YACD,IACE,OAAO,OAAO,CAAC,+BAA+B,KAAK,UAAU;gBAC7D,OAAO,CAAC,+BAA+B,EAAE,EACzC,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;aAAM,IACL,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;YAClC,MAAM,CAAC,OAAO,KAAK,qBAAqB,EACxC,CAAC;YACD,MAAM,kCAAkC,GACtC,OAAO,OAAO,CAAC,+BAA+B,KAAK,UAAU;gBAC7D,OAAO,CAAC,+BAA+B,EAAE,CAAC;YAE5C,IAAI,CAAC,kCAAkC,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CACb,mHAAmH,CACpH,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,MAAM,CAAC,oBAAoB,KAAK,QAAQ,EAAE,CAAC;gBACpD,MAAM,IAAI,SAAS,CACjB,iGAAiG,CAClG,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,OAAO,CAAC,+BAA+B,KAAK,UAAU,EAAE,CAAC;gBAClE,MAAM,IAAI,SAAS,CACjB,gFAAgF,CACjF,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,+BAA+B,CACrC,MAAM,CAAC,oBAAqC,CAC9B,CAAC;YAEjB,2DAA2D,CACzD,OAAO,CACO,CAAC;YACjB,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CACT,0FAA0F,CAC3F,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,SAAS,CAAC,4BAA4B,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,IAAI,qBAAqB,CAAC,QAAQ,IAAI,OAAO,aAAa,KAAK,UAAU,EAAE,CAAC;QAC1E,yEAAyE;QACzE,6BAA6B;QAC7B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAoB,OAAO,CAAC,WAAW,EAAE,CAAC;YACxD,MAAM,OAAO,GAAY,CAAC,cAAc,CACtC,QAAQ,EACR,qBAAqB,CAAC,QAAQ,CAC/B,CAAC;YACF,aAAa,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAC9C,IAAI,OAAO,IAAI,OAAO,uBAAuB,KAAK,UAAU,EAAE,CAAC;gBAC7D,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,CAAC,GAAG,CACT,+GAA+G,CAChH,CAAC;gBACJ,CAAC;gBACD,uBAAuB,EAAE,CAAC;YAC5B,CAAC;QACH,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CACX,yFAAyF,EACzF,CAAC,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"handle-successful-exchange-auth-tokens-response.js","sourceRoot":"","sources":["../../src/lib/handle-successful-exchange-auth-tokens-response.ts"],"names":[],"mappings":"AAAA,qDAAqD;AAErD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,6CAA6C,GAG9C,MAAM,2BAA2B,CAAC;AACnC,OAAO,cAAc,MAAM,yBAAyB,CAAC;AACrD,OAAO,2DAA2D,MAAM,qEAAqE,CAAC;AAwC9I,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,0CAA0C,CAAC,EACvE,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EACL,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,yBAAyB,EACzB,aAAa,EACb,aAAa,EACb,uBAAuB,EACvB,OAAO,GACyC;IAChD,MAAM,aAAa,GAAG,MAAM,6CAA6C,CACvE,CAAC,EACD,WAAW,EACX,EAAE,eAAe,EAAE,kBAAkB,EAAE,CACxC,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC;IACrC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QAC3B,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,CACX,yEAAyE;gBACvE,kDAAkD,EACpD,aAAa,CAAC,KAAK,CAAC,MAAM,CAC3B,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,MAAM,GAAsC,aAAa,CAAC,IAAI,CAAC;IAErE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CACT,+FAA+F,CAChG,CAAC;IACJ,CAAC;IAED,yBAAyB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEzC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,IACE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;YAClC,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,EACjC,CAAC;YACD,IACE,OAAO,OAAO,CAAC,+BAA+B,KAAK,UAAU;gBAC7D,OAAO,CAAC,+BAA+B,EAAE,EACzC,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;aAAM,IACL,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;YAClC,MAAM,CAAC,OAAO,KAAK,qBAAqB,EACxC,CAAC;YACD,MAAM,kCAAkC,GACtC,OAAO,OAAO,CAAC,+BAA+B,KAAK,UAAU;gBAC7D,OAAO,CAAC,+BAA+B,EAAE,CAAC;YAE5C,IAAI,CAAC,kCAAkC,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CACb,mHAAmH,CACpH,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,MAAM,CAAC,oBAAoB,KAAK,QAAQ,EAAE,CAAC;gBACpD,MAAM,IAAI,SAAS,CACjB,iGAAiG,CAClG,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,OAAO,CAAC,+BAA+B,KAAK,UAAU,EAAE,CAAC;gBAClE,MAAM,IAAI,SAAS,CACjB,gFAAgF,CACjF,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,+BAA+B,CACrC,MAAM,CAAC,oBAAqC,CAC9B,CAAC;YAEjB,2DAA2D,CACzD,OAAO,CACO,CAAC;YACjB,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CACT,0FAA0F,CAC3F,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,SAAS,CAAC,4BAA4B,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,IAAI,OAAO,aAAa,KAAK,UAAU,IAAI,OAAO,aAAa,KAAK,UAAU,EAAE,CAAC;QAC/E,yEAAyE;QACzE,6BAA6B;QAC7B,IAAI,CAAC;YACH,MAAM,KAAK,GAAoB,MAAM,aAAa,EAAE,CAAC;YACrD,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,QAAQ,GAAoB,OAAO,CAAC,WAAW,EAAE,CAAC;gBACxD,MAAM,OAAO,GAAY,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAC1D,aAAa,CAAC,KAAK,CAAC,CAAC;gBACrB,IAAI,OAAO,IAAI,OAAO,uBAAuB,KAAK,UAAU,EAAE,CAAC;oBAC7D,IAAI,KAAK,EAAE,CAAC;wBACV,OAAO,CAAC,GAAG,CACT,+GAA+G,CAChH,CAAC;oBACJ,CAAC;oBACD,uBAAuB,EAAE,CAAC;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CACX,iFAAiF,EACjF,CAAC,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/lib/oidc/index.d.ts

@@ -0,0 +1,9 @@
+export { createOidcClientConfiguration } from "./oidc-client-configuration";
+export type { CreateOidcClientConfigurationOptions } from "./oidc-client-configuration";
+export { isInsecureTransportAllowed } from "./is-insecure-transport-allowed";
+export { normalizeOidcIssuer } from "./normalize-oidc-issuer";
+export { tokenEndpointResponseToTokensRecord } from "./token-endpoint-response-to-tokens-record";
+export type { OidcTokenEndpointResponseLike, TokenEndpointResponseToTokensRecordOptions, } from "./token-endpoint-response-to-tokens-record";
+export { uidFromOidcSubClaim } from "./uid-from-oidc-sub-claim";
+export { classifyOidcTokenError } from "./oidc-token-error";
+export type { ClassifiedOidcTokenError } from "./oidc-token-error";

package/dist/lib/oidc/index.js

@@ -0,0 +1,7 @@
+export { createOidcClientConfiguration } from "./oidc-client-configuration";
+export { isInsecureTransportAllowed } from "./is-insecure-transport-allowed";
+export { normalizeOidcIssuer } from "./normalize-oidc-issuer";
+export { tokenEndpointResponseToTokensRecord } from "./token-endpoint-response-to-tokens-record";
+export { uidFromOidcSubClaim } from "./uid-from-oidc-sub-claim";
+export { classifyOidcTokenError } from "./oidc-token-error";
+//# sourceMappingURL=index.js.map

package/dist/lib/oidc/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/oidc/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAG5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,OAAO,EAAE,mCAAmC,EAAE,MAAM,4CAA4C,CAAC;AAMjG,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEhE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/lib/oidc/is-insecure-transport-allowed.d.ts

@@ -0,0 +1,8 @@
+import type { SchemaVaultsAppEnvironment } from "@schemavaults/app-definitions";
+/**
+ * Whether `environment` may talk to an auth server over cleartext HTTP.
+ * Mirrors `SchemaVaultsAuthClient.secure`: development and test are the
+ * only non-TLS environments; staging and production always require HTTPS.
+ */
+export declare function isInsecureTransportAllowed(environment: SchemaVaultsAppEnvironment): boolean;
+export default isInsecureTransportAllowed;

package/dist/lib/oidc/is-insecure-transport-allowed.js

@@ -0,0 +1,14 @@
+// is-insecure-transport-allowed.ts
+//
+// The single place that decides which app environments may talk to an
+// auth server over cleartext HTTP.
+/**
+ * Whether `environment` may talk to an auth server over cleartext HTTP.
+ * Mirrors `SchemaVaultsAuthClient.secure`: development and test are the
+ * only non-TLS environments; staging and production always require HTTPS.
+ */
+export function isInsecureTransportAllowed(environment) {
+    return environment === "development" || environment === "test";
+}
+export default isInsecureTransportAllowed;
+//# sourceMappingURL=is-insecure-transport-allowed.js.map

package/dist/lib/oidc/is-insecure-transport-allowed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-insecure-transport-allowed.js","sourceRoot":"","sources":["../../../src/lib/oidc/is-insecure-transport-allowed.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,EAAE;AACF,sEAAsE;AACtE,mCAAmC;AAInC;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,WAAuC;IAEvC,OAAO,WAAW,KAAK,aAAa,IAAI,WAAW,KAAK,MAAM,CAAC;AACjE,CAAC;AAED,eAAe,0BAA0B,CAAC"}