@sendoracloud/sdk-react-native 0.5.0 → 0.7.0

package/dist/index.cjs

@@ -447,6 +447,83 @@ var Auth = class {
       this.bearerHeaders()
     );
   }
+  // ============================================================
+  // OIDC SSO
+  // ============================================================
+  /**
+   * Start OIDC sign-in. Returns the IdP's authorization URL — caller
+   * opens it via React Native's `Linking.openURL()` (or
+   * `WebBrowser.openAuthSessionAsync` from `expo-web-browser` when
+   * inside Expo). The IdP redirects through Sendora's callback to the
+   * `returnTo` URL with `#sendora_oidc_token=...` in the fragment.
+   *
+   * On the customer's app side, `returnTo` MUST be a custom URL scheme
+   * registered in Info.plist (iOS) / AndroidManifest.xml intent-filter
+   * (Android), e.g. `myapp://oidc-callback`. When the deep link fires,
+   * call `consumeSsoFragment(url)` on the captured URL.
+   */
+  async startSso(returnTo) {
+    const res = await post(
+      { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
+      "/api/v1/auth-service/sso/oidc/start",
+      { returnTo }
+    );
+    if (!res || !res.ok) throw new AuthError("SSO_START_FAILED", `HTTP ${res?.status ?? "network"}`);
+    const parsed = await res.json();
+    if (!parsed.success || !parsed.data?.authorizationUrl) {
+      throw new AuthError("SSO_START_FAILED", "Missing authorizationUrl");
+    }
+    return { authorizationUrl: parsed.data.authorizationUrl };
+  }
+  /**
+   * Consume an OIDC callback URL captured via React Native's
+   * `Linking.addEventListener('url', ...)`. Reads the fragment for
+   * `sendora_oidc_token`, exchanges it for a session, and persists.
+   * Throws AuthError on `sendora_oidc_error=...` fragment.
+   */
+  consumeSsoFragment(callbackUrl) {
+    return this.serialize(async () => {
+      if (this.user !== null) await this.wipeLocalIdentity();
+      const hashIdx = callbackUrl.indexOf("#");
+      const fragment = hashIdx >= 0 ? callbackUrl.slice(hashIdx + 1) : "";
+      const params = new URLSearchParams(fragment);
+      const err = params.get("sendora_oidc_error");
+      if (err) throw new AuthError("SSO_FAILED", decodeURIComponent(err));
+      const refresh = params.get("sendora_oidc_token");
+      if (!refresh) throw new AuthError("SSO_NO_TOKEN", "Callback URL has no sendora_oidc_token");
+      const res = await post(
+        { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
+        "/api/v1/auth-service/token/refresh",
+        { refreshToken: refresh }
+      );
+      if (!res || !res.ok) throw new AuthError("SSO_EXCHANGE_FAILED", `HTTP ${res?.status ?? "network"}`);
+      const parsed = await res.json();
+      const access = parsed.data?.accessToken;
+      const newRefresh = parsed.data?.refreshToken;
+      const expiresIn = parsed.data?.expiresIn;
+      if (!parsed.success || !access || !newRefresh || !expiresIn || expiresIn <= 0) {
+        throw new AuthError("SSO_EXCHANGE_FAILED", "Could not exchange OIDC token");
+      }
+      const claims = decodeJwtPayload(access);
+      const user = {
+        id: claims?.sub ?? "",
+        email: claims?.email ?? null,
+        emailVerified: claims?.email_verified ?? true,
+        name: claims?.name ?? null,
+        isAnonymous: false
+      };
+      this.persist({
+        user,
+        tokens: {
+          accessToken: access,
+          refreshToken: newRefresh,
+          expiresIn,
+          tokenType: "Bearer"
+        }
+      });
+      return user;
+    });
+  }
   bearerHeaders() {
     if (!this.accessToken) {
       throw new AuthError("NOT_SIGNED_IN", "Not signed in");
@@ -551,6 +628,19 @@ var Auth = class {
     await this.hooks.onAnonymousWipe();
   }
 };
+function decodeJwtPayload(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return null;
+    const padded = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const pad = (4 - padded.length % 4) % 4;
+    if (typeof atob !== "function") return null;
+    const json = atob(padded + "===".slice(0, pad));
+    return JSON.parse(json);
+  } catch {
+    return null;
+  }
+}
 
 // src/index.ts
 var SDK_VERSION = "0.4.0";

package/dist/index.d.cts

@@ -160,6 +160,28 @@ declare class Auth {
     }>>;
     revokeSession(sessionId: string): Promise<void>;
     revokeAllSessions(): Promise<void>;
+    /**
+     * Start OIDC sign-in. Returns the IdP's authorization URL — caller
+     * opens it via React Native's `Linking.openURL()` (or
+     * `WebBrowser.openAuthSessionAsync` from `expo-web-browser` when
+     * inside Expo). The IdP redirects through Sendora's callback to the
+     * `returnTo` URL with `#sendora_oidc_token=...` in the fragment.
+     *
+     * On the customer's app side, `returnTo` MUST be a custom URL scheme
+     * registered in Info.plist (iOS) / AndroidManifest.xml intent-filter
+     * (Android), e.g. `myapp://oidc-callback`. When the deep link fires,
+     * call `consumeSsoFragment(url)` on the captured URL.
+     */
+    startSso(returnTo: string): Promise<{
+        authorizationUrl: string;
+    }>;
+    /**
+     * Consume an OIDC callback URL captured via React Native's
+     * `Linking.addEventListener('url', ...)`. Reads the fragment for
+     * `sendora_oidc_token`, exchanges it for a session, and persists.
+     * Throws AuthError on `sendora_oidc_error=...` fragment.
+     */
+    consumeSsoFragment(callbackUrl: string): Promise<AuthUser>;
     private bearerHeaders;
     private unwrap;
     /**

package/dist/index.d.ts

@@ -160,6 +160,28 @@ declare class Auth {
     }>>;
     revokeSession(sessionId: string): Promise<void>;
     revokeAllSessions(): Promise<void>;
+    /**
+     * Start OIDC sign-in. Returns the IdP's authorization URL — caller
+     * opens it via React Native's `Linking.openURL()` (or
+     * `WebBrowser.openAuthSessionAsync` from `expo-web-browser` when
+     * inside Expo). The IdP redirects through Sendora's callback to the
+     * `returnTo` URL with `#sendora_oidc_token=...` in the fragment.
+     *
+     * On the customer's app side, `returnTo` MUST be a custom URL scheme
+     * registered in Info.plist (iOS) / AndroidManifest.xml intent-filter
+     * (Android), e.g. `myapp://oidc-callback`. When the deep link fires,
+     * call `consumeSsoFragment(url)` on the captured URL.
+     */
+    startSso(returnTo: string): Promise<{
+        authorizationUrl: string;
+    }>;
+    /**
+     * Consume an OIDC callback URL captured via React Native's
+     * `Linking.addEventListener('url', ...)`. Reads the fragment for
+     * `sendora_oidc_token`, exchanges it for a session, and persists.
+     * Throws AuthError on `sendora_oidc_error=...` fragment.
+     */
+    consumeSsoFragment(callbackUrl: string): Promise<AuthUser>;
     private bearerHeaders;
     private unwrap;
     /**

package/dist/index.js

@@ -407,6 +407,83 @@ var Auth = class {
       this.bearerHeaders()
     );
   }
+  // ============================================================
+  // OIDC SSO
+  // ============================================================
+  /**
+   * Start OIDC sign-in. Returns the IdP's authorization URL — caller
+   * opens it via React Native's `Linking.openURL()` (or
+   * `WebBrowser.openAuthSessionAsync` from `expo-web-browser` when
+   * inside Expo). The IdP redirects through Sendora's callback to the
+   * `returnTo` URL with `#sendora_oidc_token=...` in the fragment.
+   *
+   * On the customer's app side, `returnTo` MUST be a custom URL scheme
+   * registered in Info.plist (iOS) / AndroidManifest.xml intent-filter
+   * (Android), e.g. `myapp://oidc-callback`. When the deep link fires,
+   * call `consumeSsoFragment(url)` on the captured URL.
+   */
+  async startSso(returnTo) {
+    const res = await post(
+      { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
+      "/api/v1/auth-service/sso/oidc/start",
+      { returnTo }
+    );
+    if (!res || !res.ok) throw new AuthError("SSO_START_FAILED", `HTTP ${res?.status ?? "network"}`);
+    const parsed = await res.json();
+    if (!parsed.success || !parsed.data?.authorizationUrl) {
+      throw new AuthError("SSO_START_FAILED", "Missing authorizationUrl");
+    }
+    return { authorizationUrl: parsed.data.authorizationUrl };
+  }
+  /**
+   * Consume an OIDC callback URL captured via React Native's
+   * `Linking.addEventListener('url', ...)`. Reads the fragment for
+   * `sendora_oidc_token`, exchanges it for a session, and persists.
+   * Throws AuthError on `sendora_oidc_error=...` fragment.
+   */
+  consumeSsoFragment(callbackUrl) {
+    return this.serialize(async () => {
+      if (this.user !== null) await this.wipeLocalIdentity();
+      const hashIdx = callbackUrl.indexOf("#");
+      const fragment = hashIdx >= 0 ? callbackUrl.slice(hashIdx + 1) : "";
+      const params = new URLSearchParams(fragment);
+      const err = params.get("sendora_oidc_error");
+      if (err) throw new AuthError("SSO_FAILED", decodeURIComponent(err));
+      const refresh = params.get("sendora_oidc_token");
+      if (!refresh) throw new AuthError("SSO_NO_TOKEN", "Callback URL has no sendora_oidc_token");
+      const res = await post(
+        { apiUrl: this.hooks.apiUrl, publicKey: this.hooks.publicKey, debug: this.hooks.debug },
+        "/api/v1/auth-service/token/refresh",
+        { refreshToken: refresh }
+      );
+      if (!res || !res.ok) throw new AuthError("SSO_EXCHANGE_FAILED", `HTTP ${res?.status ?? "network"}`);
+      const parsed = await res.json();
+      const access = parsed.data?.accessToken;
+      const newRefresh = parsed.data?.refreshToken;
+      const expiresIn = parsed.data?.expiresIn;
+      if (!parsed.success || !access || !newRefresh || !expiresIn || expiresIn <= 0) {
+        throw new AuthError("SSO_EXCHANGE_FAILED", "Could not exchange OIDC token");
+      }
+      const claims = decodeJwtPayload(access);
+      const user = {
+        id: claims?.sub ?? "",
+        email: claims?.email ?? null,
+        emailVerified: claims?.email_verified ?? true,
+        name: claims?.name ?? null,
+        isAnonymous: false
+      };
+      this.persist({
+        user,
+        tokens: {
+          accessToken: access,
+          refreshToken: newRefresh,
+          expiresIn,
+          tokenType: "Bearer"
+        }
+      });
+      return user;
+    });
+  }
   bearerHeaders() {
     if (!this.accessToken) {
       throw new AuthError("NOT_SIGNED_IN", "Not signed in");
@@ -511,6 +588,19 @@ var Auth = class {
     await this.hooks.onAnonymousWipe();
   }
 };
+function decodeJwtPayload(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return null;
+    const padded = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const pad = (4 - padded.length % 4) % 4;
+    if (typeof atob !== "function") return null;
+    const json = atob(padded + "===".slice(0, pad));
+    return JSON.parse(json);
+  } catch {
+    return null;
+  }
+}
 
 // src/index.ts
 var SDK_VERSION = "0.4.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendoracloud/sdk-react-native",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Sendora Cloud React Native + Expo SDK — analytics, identity, push-token registration, auth. Expo Go compatible, no native modules beyond AsyncStorage.",
   "type": "module",
   "main": "./dist/index.cjs",